MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ca09577ca7a54a21f0f823fffeac8b5dd3d10bb9e0df385e4cd8da670b0843a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	4ca09577ca7a54a21f0f823fffeac8b5dd3d10bb9e0df385e4cd8da670b0843a
SHA3-384 hash:	c2ab7ded9b32c94c9978c3c5ba9b22897f40848a04afd5284d9c7f163d992373c7fd671ec22c9771b7cc61eaaea6b3ec
SHA1 hash:	20b1ea1807d291845a542059f2fd57aecd3d626d
MD5 hash:	31b1accd4c2b0f4a3e09ab064e0f773a
humanhash:	fix-sierra-pennsylvania-london
File name:	MyFile027.js
Download:	download sample
Signature	Formbook Create hunting rule
File size:	51'649 bytes
First seen:	2025-06-28 14:40:11 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:BmCQWLbNl7VB2BIPlSp0YK5UMJS6DJ4in+n5YeWTa:rDfUWTa
Threatray	66 similar samples on MalwareBazaar
TLSH	T1FB33B7D9B08FE166175326481A3A5466F9ED812839DF99B4F04CDC947B2D83D83B0CBE
Magika	javascript
Reporter	abuse_ch
Tags:	FormBook js

Intelligence

File Origin

# of uploads :

# of downloads :

397

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.26863.JsHeur.UNOFFICIAL

Js.Dropper.Divergent-7133099-1

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685ffee737c343677946a42a

Tags:

obfuscate dropper xtreme

Verdict:

Malicious

Labled as:

Trojan_Script_Wacatac_B_ml

Link:

https://www.hybrid-analysis.com/sample/4ca09577ca7a54a21f0f823fffeac8b5dd3d10bb9e0df385e4cd8da670b0843a

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1724697

Signature

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found suspicious powershell code related to unpacking or dynamic code loading

Found Tor onion address

Javascript file is likely language aware (will only work on specific systems)

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/4ca09577ca7a54a21f0f823fffeac8b5dd3d10bb9e0df385e4cd8da670b0843a

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ca09577ca7a54a21f0f823fffeac8b5dd3d10bb9e0df385e4cd8da670b0843a/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2025-06-27 23:26:23 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jsqjk56kpjkkehypqi7772wiwxot2ef3tyg7hbpezwg2m4fqqq5a._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

n/a

Score:

10/10

Tags:

execution

Link:

https://tria.ge/reports/250628-r15mjsen2t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Malware Config

Dropper Extraction:

https://archive.org/download/wp4096799-lost-in-space-wallpapers_20250624_1601/wp4096799-lost-in-space-wallpapers.jpg

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4ca09577ca7a54a21f0f823fffeac8b5dd3d10bb9e0df385e4cd8da670b0843a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	OBFUS_PowerShell_Common_Replace Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the common usage of replace for obfuscation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample