MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4249140de433d53152df57ec4557bc0cb406541d2c6b8636538751cf02b22503. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4249140de433d53152df57ec4557bc0cb406541d2c6b8636538751cf02b22503
SHA3-384 hash:	e7c037b508e145a5e12330bd98abdbc28c7d795693dc5e11bc98527549f44955ec21865ad4c12485bf5d96141be1ce60
SHA1 hash:	c5f390f2476cc4b32f889f2e80a3f195757cb79d
MD5 hash:	490be97beb9d8985d801777a45773110
humanhash:	carolina-mountain-aspen-tennis
File name:	RFQ_Order Specification_Quantity_N1HSBDGH_pdf.JS
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	3'935'213 bytes
First seen:	2026-08-17 12:39:32 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:jVQNi/m24V7uPHrcFybFzkZEgiel6yQLFyT54E/2xkT1mFQPtQ:KNi/m24VqPHAF0a0JyJUY1DFQ
TLSH	T137063C411B84993277B2AB5FF9379931A50F910342E1DB14307EC3287F2899B635ABF6
Magika	json
Reporter	lowmal3
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

167

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.27478247.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive masquerade obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a830145ef413e566f8b1104/reports/680c63b0-9294-4697-b072-2a86613bab29/overview

Hybrid Analysis Trojan.GenericFCA

Verdict:

Malicious

Labled as:

Trojan.GenericFCA

Link:

https://www.hybrid-analysis.com/sample/4249140de433d53152df57ec4557bc0cb406541d2c6b8636538751cf02b22503

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-16T08:59:00Z UTC

Last seen:

2026-08-17T09:28:00Z UTC

Hits:

~10000

Detections:

HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan-Spy.Win32.Noon.sb Trojan-Downloader.JS.Cryptoload.sb PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/4249140de433d53152df57ec4557bc0cb406541d2c6b8636538751cf02b22503/results?tab=lookup

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1959015

Signature

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

JavaScript source code contains functionality to generate code involving a shell, file or stream

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4249140de433d53152df57ec4557bc0cb406541d2c6b8636538751cf02b22503

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4249140de433d53152df57ec4557bc0cb406541d2c6b8636538751cf02b22503/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-16 13:08:45 UTC

File Type:

Text (JavaScript)

AV detection:

14 of 36 (38.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ijeridpegpktcuw7k7wekv54bs2amva5frvymnstq5i46avseubq._file

Threatray Formbook

Verdict:

malicious

Label(s):

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/0d28d49e-d00c-4b64-b3c5-3d27429f8649

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260817-pwhacazhka/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Family: Formbook

Formbook payload

VMRay FormBook

Malware family:

FormBook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4249140de433/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Formbook

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4249140de433d53152df57ec4557bc0cb406541d2c6b8636538751cf02b22503