🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 687248c21164a212ef2860d3f496e4e00f6147e26fed9bfba014ebf6f9b6798e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 687248c21164a212ef2860d3f496e4e00f6147e26fed9bfba014ebf6f9b6798e
SHA3-384 hash: 673039bf5f719dc69c3c7871ea00235780f43294f6407e66474325bb1044f62c5bc16550f78dd473ec842f75287d681c
SHA1 hash: e17076a3ef4bcd27c3dcd86133d9d3deaaa4d697
MD5 hash: 59ca4bd1b84d8e74637f9d589e85e435
humanhash: golf-batman-cold-bakerloo
File name:Order-Inv-oct7483549.js
Download: download sample
Signature Formbook
Create hunting rule
File size:7'968 bytes
First seen:2026-10-22 04:13:13 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:application/javascript
ssdeep 192:NsgIyrPOeo/WslT1bZFl/HyNSRmfiqFaUXsbwwb4:SgIgOBTdZGs8G4
TLSH T1BCF1E189AE569029DEF6F33DCF298609E72704170906E259B4DC82A45FB109D83ECDFD
Magika javascript
Reporter abuse_ch
Tags:FormBook js

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad98d70afb06e650cd884d0
Tags:
autorun shell virus blic
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/687248c21164a212ef2860d3f496e4e00f6147e26fed9bfba014ebf6f9b6798e
Verdict:
Malicious
File Type:
js
First seen:
2026-10-22T00:35:00Z UTC
Last seen:
2026-10-23T18:36:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/687248c21164a212ef2860d3f496e4e00f6147e26fed9bfba014ebf6f9b6798e/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1990398
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected FormBook
Yara detected Generic JS Downloader
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1990398 Sample: Order-Inv-oct7483549.js Startdate: 22/10/2026 Architecture: WINDOWS Score: 100 36 www.sowerif.com 2->36 38 www.foodipics.com 2->38 40 18 other IPs or domains 2->40 64 Suricata IDS alerts for network traffic 2->64 66 Antivirus detection for URL or domain 2->66 68 Yara detected Generic JS Downloader 2->68 70 8 other signatures 2->70 8 wscript.exe 21 2->8         started        13 SuMLsW3qEe.exe 2->13 injected 15 PNdymSYYM.exe 2->15 injected signatures3 process4 dnsIp5 42 promotedial.com 208.91.199.118, 443, 49713 UNIFIEDLAYER-AS-1-UnifiedLayerUS United States 8->42 34 C:\Temp\UXEJBUINWS.ps1, ASCII 8->34 dropped 80 System process connects to network (likely due to code injection or exploit) 8->80 82 JScript performs obfuscated calls to suspicious functions 8->82 84 Wscript starts Powershell (via cmd or directly) 8->84 90 4 other signatures 8->90 17 powershell.exe 16 8->17         started        86 Maps a DLL or memory area into another process 13->86 88 Found direct / indirect Syscall (likely to bypass EDR) 13->88 20 ftp.exe 13 13->20         started        44 www.foodipics.com 45.204.237.169, 49744, 49745, 49746 OWGELS-AS-APOWGELSINTERNATIONALCOLIMITEDHK Hong Kong SAR China 15->44 46 104.219.250.36, 49726, 49727, 49736 NAMECHEAP-NET-NamecheapIncUS United States 15->46 48 7 other IPs or domains 15->48 file6 signatures7 process8 signatures9 52 Writes to foreign memory regions 17->52 54 Injects a PE file into a foreign processes 17->54 22 aspnet_compiler.exe 17->22         started        25 SIHClient.exe 8 17->25         started        28 conhost.exe 17->28         started        32 31 other processes 17->32 56 Tries to steal Mail credentials (via file / registry access) 20->56 58 Tries to harvest and steal browser information (history, passwords, etc) 20->58 60 Modifies the context of a thread in another process (thread injection) 20->60 62 3 other signatures 20->62 30 firefox.exe 20->30         started        process10 dnsIp11 72 Modifies the context of a thread in another process (thread injection) 22->72 74 Maps a DLL or memory area into another process 22->74 76 Queues an APC in another process (thread injection) 22->76 78 3 other signatures 22->78 50 mr-b01.tm-azurefd.net 150.171.110.17, 443, 49717 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 25->50 signatures12
Score:
3%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/687248c21164a212ef2860d3f496e4e00f6147e26fed9bfba014ebf6f9b6798e
Verdict:
Malware
YARA:
1 match(es)
Tags:
PowerShell T1059.001 T1105
Link:
https://app.malva.re/file/59ca4bd1b84d8e74637f9d589e85e435
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/687248c21164a212ef2860d3f496e4e00f6147e26fed9bfba014ebf6f9b6798e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-22 04:14:29 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbzerqqrmsrbf3zimdj7jfxe4ahwcr7cn7wzx65actv7n6nwpgha._file
Verdict:
malicious
Label(s):
Formbook
Create hunting rule
Link:
https://reports.threatray.com/6027040a-a3d9-4b88-854d-661ac25154e9
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/261022-etaglshy21/
Behaviour
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
Reads the TCP/IP host and domain name from the registry
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/687248c21164a212ef2860d3f496e4e00f6147e26fed9bfba014ebf6f9b6798e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_0507f067_Script
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat script)
Rule name:SUSP_Script_PowerShell_Hidden_Launcher
Create hunting rule
Author:Marjoriefort
Description:Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:Veille fraicheur 2026-09-14 / cluster misses web

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments