MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d792a60273e0b756e5efe2ef9275df360eb55faa365fdb2dffeb4a6ba431846. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2d792a60273e0b756e5efe2ef9275df360eb55faa365fdb2dffeb4a6ba431846
SHA3-384 hash:	d9093055d347c5d030cd83be6d50c39fb2f89fdcb2426a8cd59f81ff3ba855dea1416217ccc495c09c4c603b5d7adaba
SHA1 hash:	09ee215bacc4a53718e2b55262c4a696e538be8c
MD5 hash:	a97dd89e628a99dcc567f2885afb8175
humanhash:	lima-mockingbird-pasta-mountain
File name:	Fiyat Teklif İsteği - IDPRNo 69611 - BUSBAR BESLEME PANOSU.wsf
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	3'583 bytes
First seen:	2026-11-02 08:03:27 UTC
Last seen:	Never
File type:	WSF
MIME type:	text/xml
ssdeep	48:Fg8yG5F/d7swsJ1SJWAZjm2jpHHktF7az7GjGz60LI4:Fg8zl7srJoYgJEtF74GjGHLp
TLSH	T1EF7114DD6C49A0594E73B33DDB6F9909FFAB55271902C324B89C92002FB1815809EFEC
Magika	txt
Reporter	lowmal3
Tags:	FormBook wsf

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

101

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae843ff38ccdea12c568885

Tags:

shell spawn sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes aspnet_compiler base64 crypto encrypted evasive lolbin obfuscated powershell reconnaissance

Link:

https://www.filescan.io/uploads/6ae843fbba9c5c0fc16466b3/reports/b55a9af3-7fc0-4dec-a536-f3b8765b3009/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/2d792a60273e0b756e5efe2ef9275df360eb55faa365fdb2dffeb4a6ba431846

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

wsf

First seen:

2026-11-02T00:19:00Z UTC

Last seen:

2026-11-04T05:49:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/2d792a60273e0b756e5efe2ef9275df360eb55faa365fdb2dffeb4a6ba431846/results?tab=lookup

Joe Sandbox FormBook, PSLoader

Result

Threat name:

FormBook, PSLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1996528

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Suricata IDS alerts for network traffic

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected FormBook

Yara detected Generic JS Downloader

Yara detected Powershell decode and execute

Yara detected PSLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

8%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2d792a60273e0b756e5efe2ef9275df360eb55faa365fdb2dffeb4a6ba431846

Malva.RE Malware

Verdict:

Malware

YARA:

5 match(es)

Tags:

Html Javascript JS Emulation Trace MSXML2.XMLHTTP PowerShell Scripting.FileSystemObject T1059.007 T1105 WSF File

Link:

https://app.malva.re/file/a97dd89e628a99dcc567f2885afb8175

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2d792a60273e0b756e5efe2ef9275df360eb55faa365fdb2dffeb4a6ba431846/

ReversingLabs TitaniumCloud Script-JS.Backdoor.FormBook

Threat name:

Script-JS.Backdoor.FormBook

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-02 03:23:12 UTC

File Type:

Text (XML)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fv4suybhhyfxk3s67yxpsj256nqowvp2uns73mw7722knosddbda._file

Threatray Formbook

Verdict:

malicious

Label(s):

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/9fe0c9b2-2f0b-45a4-8623-1471d56d8d9b

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook adware collection defense_evasion discovery execution privilege_escalation rat spyware stealer trojan

Link:

https://tria.ge/reports/261102-jybyfsav3p/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Badlisted process makes network request

Family: Formbook

Formbook payload

VirusSign cryxos

Malware Family:

cryxos

Alert

Create hunting rule

Malicious:

True

Tags:

xml

Link:

https://intel.virussign.com/intelligence/file/2d792a60273e0b756e5efe2ef9275df360eb55faa365fdb2dffeb4a6ba431846

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2d792a60273e0b756e5efe2ef9275df360eb55faa365fdb2dffeb4a6ba431846