MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40ead66f8b514c57ecda339f991d248e99c6a164b64d5f1e05d69567bfef1a0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40ead66f8b514c57ecda339f991d248e99c6a164b64d5f1e05d69567bfef1a0a
SHA3-384 hash: a93983e21d584ff51a3dc3112241bff92df0f5666617cb529c4ed39c4437ca25e23cd0ea4ec2ccbdbd0c9695b8ea9271
SHA1 hash: ae8c90ac77c8ce645abd02e75d12fbef21e095a6
MD5 hash: 16ff77dae9fedbf46df10945ffa13251
humanhash: spring-purple-cardinal-idaho
File name:QUOTATION -2025 - Pictures catalog.js
Download: download sample
Signature Formbook
Create hunting rule
File size:41'380 bytes
First seen:2025-10-01 15:11:22 UTC
Last seen:2025-10-01 17:31:03 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:iCpQDP3qp4wvk9f6RUJ2Dmtkuxf2Fa23yzLEacHbs+TC0ym00TY8FfQJyC6Bqk5L:ieQrqp4wvMzQ5sVsY8VQQf5/2Kl
Threatray 334 similar samples on MalwareBazaar
TLSH T1FC039484BC1DE56443AF2520311E64C7EE58BB270CB8F060BEDCC5D337A557246AAB7A
Magika javascript
Reporter abuse_ch
Tags:FormBook js

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68dd44ad40b7da0b4eb94ab8
Tags:
obfuscate xtreme virus
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/68dd4530c564c8e81d0bd228/reports/4135abb4-d546-4d18-88d0-5bfebb5d54d8/overview
Verdict:
Malicious
Labled as:
Trojan.JS.Agent.JS
Link:
https://www.hybrid-analysis.com/sample/40ead66f8b514c57ecda339f991d248e99c6a164b64d5f1e05d69567bfef1a0a
Verdict:
Malicious
File Type:
js
First seen:
2025-10-01T07:33:00Z UTC
Last seen:
2025-10-03T12:02:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/40ead66f8b514c57ecda339f991d248e99c6a164b64d5f1e05d69567bfef1a0a/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1787466
Signature
Creates processes via WMI
Found Tor onion address
Injects a PE file into a foreign processes
JavaScript source code contains functionality to generate code involving a shell, file or stream
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected FormBook
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1787466 Sample: QUOTATION -2025 - Pictures ... Startdate: 01/10/2025 Architecture: WINDOWS Score: 100 39 www.vipcortex.xyz 2->39 41 www.pgmoon88.xyz 2->41 43 6 other IPs or domains 2->43 63 Suricata IDS alerts for network traffic 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Multi AV Scanner detection for submitted file 2->67 71 7 other signatures 2->71 12 wscript.exe 1 2->12         started        signatures3 69 Performs DNS queries to domains with low reputation 41->69 process4 signatures5 85 Suspicious powershell command line found 12->85 87 Wscript starts Powershell (via cmd or directly) 12->87 89 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->89 91 2 other signatures 12->91 15 powershell.exe 14 15 12->15         started        process6 dnsIp7 51 filetocrt.live 198.23.193.170, 443, 49723 AS-COLOCROSSINGUS United States 15->51 53 archive.org 207.241.224.2, 443, 49718 INTERNET-ARCHIVEUS United States 15->53 55 ia902909.us.archive.org 207.241.233.49, 443, 49721 INTERNET-ARCHIVEUS United States 15->55 57 Found Tor onion address 15->57 59 Writes to foreign memory regions 15->59 61 Injects a PE file into a foreign processes 15->61 19 MSBuild.exe 15->19         started        22 conhost.exe 15->22         started        signatures8 process9 signatures10 73 Maps a DLL or memory area into another process 19->73 24 ZoOuBJVIc.exe 19->24 injected process11 signatures12 75 Maps a DLL or memory area into another process 24->75 27 RMActivate_ssp.exe 13 24->27         started        process13 signatures14 77 Tries to steal Mail credentials (via file / registry access) 27->77 79 Tries to harvest and steal browser information (history, passwords, etc) 27->79 81 Modifies the context of a thread in another process (thread injection) 27->81 83 3 other signatures 27->83 30 qBKXAehq2gLVaB.exe 27->30 injected 33 chrome.exe 27->33         started        35 firefox.exe 27->35         started        process15 dnsIp16 45 www.94qt15.top 172.67.194.41, 49727, 80 CLOUDFLARENETUS United States 30->45 47 pgmoon88.xyz 3.33.130.190, 80 AMAZONEXPANSIONGB United States 30->47 49 2 other IPs or domains 30->49 37 WerFault.exe 4 33->37         started        process17
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/40ead66f8b514c57ecda339f991d248e99c6a164b64d5f1e05d69567bfef1a0a
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40ead66f8b514c57ecda339f991d248e99c6a164b64d5f1e05d69567bfef1a0a/
Threat name:
Script-JS.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2025-10-01 10:48:16 UTC
File Type:
Text (JavaScript)
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=idvnm34lkfgfp3g2gopzshjer2m4nilewzgv6hqf22kwpp7pdifa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
katzstealer
Create hunting rule
Similar samples:
0e6b25555ea3bc08519eef033a4518f27121f7e7cace0271e456a361534fe69d
Formbook
664272d1c9d15f1747c86d06066467ccdc54ce0062e1d201950a5a95478f1d99
Formbook
693326e19e98db0b09372ddd5d454b3c23db0fbd20dc2e1671d7395fd150010c
Formbook
7343fde1eb7ed90af6b923297177ae109f2ff9b8e86cee4f5961cf619fad81f4
Formbook
8c2bf37543f505883716f27429754461c61c2b259a882942e59b4ecd0f279b80
Formbook
8e3ac942df072256abcf91e4f1e5c76a09093374a9f5b997905dfc5a8b949e2a
Formbook
9a85868fada912b766b75721172bd8d3c741cb29811490fd8e9f53832712fe89
Formbook
d54eb1027281e9a83ca07c521d6db3090320cccf8a5424a2d191cbdc1b54b743
Formbook
dccde739186bcc2b12daae93ada247895c811ec080cf06fd4d431d2caecdc196
Formbook
error
Formbook
+ 324 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook execution rat spyware stealer trojan
Link:
https://tria.ge/reports/251001-sls6mshl2s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Formbook payload
Formbook
Formbook family
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://archive.org/download/optimized_msi_20250904/optimized_MSI.png
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/40ead66f8b51/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40ead66f8b514c57ecda339f991d248e99c6a164b64d5f1e05d69567bfef1a0a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:OBFUS_PowerShell_Common_Replace
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the common usage of replace for obfuscation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments