MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56a49cf2834d65a1da230ed23e3d62c8b112cb00eafd4dedfb9a7d874010c0a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	56a49cf2834d65a1da230ed23e3d62c8b112cb00eafd4dedfb9a7d874010c0a8
SHA3-384 hash:	781238a2af96ad67629f6d47f628ebebee009610916c3e9f2df94fd3de0eb1d5ffb6b9167370a372586df6d1ec6f4347
SHA1 hash:	fa45b72bfddb2c1b4dacd6ff0e01d5d0dfeaa1c1
MD5 hash:	4e185a7be90b33ece61611cd5722a692
humanhash:	music-mirror-three-oklahoma
File name:	Outstanding invoice.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	17'910 bytes
First seen:	2026-05-07 06:40:04 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:m1aZTn8ddnVve+Vf1a6A/ksdIEOXHEVWUU424zGasENdCD3cMg3bK7q:msnIdnV2ItF/PEOiWUw4KmM83Iq
TLSH	T1448257CE32DBF760436160A3255FB06BF22F8C74784D81D0C298A5CA7939748EBA567C
Magika	javascript
Reporter	jahlives
Tags:	exe-in-archive FormBook js spamtrap

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

139

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress

Gathering data

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

evasive masquerade obfuscated repaired

Link:

https://www.filescan.io/uploads/69fc33ea2fcb905ec284c12b/reports/3f0d6d32-632f-4a2e-a9d8-1efb7a4daf66/overview

Hybrid Analysis SVM:TrojanDownloader/JS.Nemucod

Verdict:

Malicious

Labled as:

SVM:TrojanDownloader/JS.Nemucod

Link:

https://www.hybrid-analysis.com/sample/56a49cf2834d65a1da230ed23e3d62c8b112cb00eafd4dedfb9a7d874010c0a8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-05-07T02:20:00Z UTC

Last seen:

2026-05-09T03:57:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan.Script.Badur.genw Trojan-Downloader.JS.SLoad.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan-Downloader.Agent.HTTP.C&C PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/56a49cf2834d65a1da230ed23e3d62c8b112cb00eafd4dedfb9a7d874010c0a8/results?tab=lookup

Nucleon Malprob Malware

Score:

87%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/56a49cf2834d65a1da230ed23e3d62c8b112cb00eafd4dedfb9a7d874010c0a8

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

PowerShell

Link:

https://app.malva.re/file/4e185a7be90b33ece61611cd5722a692

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/56a49cf2834d65a1da230ed23e3d62c8b112cb00eafd4dedfb9a7d874010c0a8/

Neiki Family.FORMBOOK

Verdict:

Malicious

Threat:

Family.FORMBOOK

Link:

https://tip.neiki.dev/file/56a49cf2834d65a1da230ed23e3d62c8b112cb00eafd4dedfb9a7d874010c0a8

ReversingLabs TitaniumCloud Script-JS.Trojan.DarkCloud

Threat name:

Script-JS.Trojan.DarkCloud

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-07 05:27:10 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k2sjz4udjvs2dwrdb3jd4plczcyrfsya5l6u33p3tj6yoqaqycua._file

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook adware discovery execution persistence privilege_escalation rat spyware stealer trojan

Link:

https://tria.ge/reports/260507-hfj1nsct6r/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Event Triggered Execution: Accessibility Features

System Location Discovery: System Language Discovery

ConfuserEx .NET packer

Suspicious use of SetThreadContext

Checks computer location settings

Badlisted process makes network request

Family: Formbook

Formbook payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/56a49cf2834d65a1da230ed23e3d62c8b112cb00eafd4dedfb9a7d874010c0a8