MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2da49e36c7fdbed7f0dc6222a78417a487f16db630bd24ae12629e1061c87321. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2da49e36c7fdbed7f0dc6222a78417a487f16db630bd24ae12629e1061c87321
SHA3-384 hash:	3aaa2d92b4752afac2e30d17808d46848d1c40acd31aa00ff9a2cf98109e38a121bd831f657c245041177c5206bb20e4
SHA1 hash:	5bba837a43db4af1e990b6291ef05961f3504eba
MD5 hash:	56f499e701fcb0bfc7f6561d06878c83
humanhash:	king-yankee-oxygen-angel
File name:	ProformaXInvoiceX5628-1.zip
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	15'413 bytes
First seen:	2026-07-03 17:54:09 UTC
Last seen:	2026-07-03 17:58:56 UTC
File type:	zip
MIME type:	application/zip
ssdeep	48:9qhQUDvgP7j4KX2bNq9vMBmQb7s1ZHQNfS9MOUgZ3VJ4myyNcaiJ1RiiZagGkPEG:gfDvA8KXU+S76iZM283sBeNeagRWk
TLSH	T1B26286E7BBDEC0E751CA5193A417379639387B489DB07F98EB4E8A340217E8A45C2D70
Magika	zip
Reporter	TomU
Tags:	FormBook zip

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

44

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Proforma Invoice 5628-1.vbs
File size:	2'146'883 bytes
SHA256 hash:	fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9
MD5 hash:	03564de0414ad6a7dbfc295cb877907b
MIME type:	application/csv
Signature	Formbook

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/87278628-6665-45f8-8b22-d24d6f802889/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1v.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Malware.Dropzip-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a33e1011548daf709f796e0

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 evasive fingerprint masquerade obfuscated powershell

Link:

https://www.filescan.io/uploads/6a47f75ea4254f99f84d544e/reports/15c5626b-450a-4237-98bc-a67987221f6c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2da49e36c7fdbed7f0dc6222a78417a487f16db630bd24ae12629e1061c87321

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-06-18T07:21:00Z UTC

Last seen:

2026-06-20T21:19:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/2da49e36c7fdbed7f0dc6222a78417a487f16db630bd24ae12629e1061c87321/results?tab=lookup

Nucleon Malprob Benign

Score:

16%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/2da49e36c7fdbed7f0dc6222a78417a487f16db630bd24ae12629e1061c87321

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2da49e36c7fdbed7f0dc6222a78417a487f16db630bd24ae12629e1061c87321/

ReversingLabs TitaniumCloud Win32.Backdoor.FormBook

Threat name:

Win32.Backdoor.FormBook

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-18 10:47:40 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

14 of 36 (38.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fwsj4nwh7w7np4g4mirkpbaxusd7c3nwgc6sjlqsmkpbayoiomqq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2da49e36c7fdbed7f0dc6222a78417a487f16db630bd24ae12629e1061c87321