MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 691c6defbe65e45ab1f8511bb7b4b331d79ebe32d29e65e3e87e2cd4d51613d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 14

Intelligence 14 IOCs YARA 6 File information Comments

SHA256 hash:	691c6defbe65e45ab1f8511bb7b4b331d79ebe32d29e65e3e87e2cd4d51613d7
SHA3-384 hash:	654b8acf97fefa39df6a36410fde595cf238040fd4dfcfe616b9eba727e66327bf410fa022bcc5edc961902a8b546c4e
SHA1 hash:	d6e61a4aa4740a812b835e5224e650e6c75e1726
MD5 hash:	b1eb5656dbca370b7cafa085d4e10ba0
humanhash:	montana-mango-avocado-jersey
File name:	Air Quote Request & 客户详情.js
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'047'782 bytes
First seen:	2026-11-11 14:14:15 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	24576:qFLfEmxEARgyIMAF/3wXwcnYY6+TOaJhh8m6B/Rm/o1bTy7E:qFEm6RMAF/ewqTdhgZRms
TLSH	T1A52502055F01AC9F4B5086E7E8125D857B203F0F90F845F73AAE3DA7EBC985917782A8
TrID	57.1% (.S) Digital Micrograph Script (4000/1/1) 42.8% (.TRA) Infinity Engine Translation (with rem) (3001/2/1)
Magika	javascript
Reporter	abuse_ch
Tags:	FormBook js

Intelligence

File Origin

# of uploads :

# of downloads :

187

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af47893e9782982f92aef6e

Tags:

proxy java

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Creating a process from a recently created file

Sending a custom TCP request

Launching a process

Creating synchronization primitives

Launching a service

Using the Windows Management Instrumentation requests

Forced system process termination

Creating a process with a hidden window

Searching for the window

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Labled as:

GT:JS.Loader.31

Link:

https://www.hybrid-analysis.com/sample/691c6defbe65e45ab1f8511bb7b4b331d79ebe32d29e65e3e87e2cd4d51613d7

Verdict:

Malicious

File Type:

Link:

https://opentip.kaspersky.com/691c6defbe65e45ab1f8511bb7b4b331d79ebe32d29e65e3e87e2cd4d51613d7/results?tab=lookup

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2004115

Signature

AI detected malicious Powershell script

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

JavaScript file contains suspicious strings

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: CMSTP Execution Process Creation

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected FormBook

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/691c6defbe65e45ab1f8511bb7b4b331d79ebe32d29e65e3e87e2cd4d51613d7

Verdict:

Malware

YARA:

3 match(es)

Tags:

DeObfuscated PowerShell T1027 T1059.001

Link:

https://app.malva.re/file/b1eb5656dbca370b7cafa085d4e10ba0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/691c6defbe65e45ab1f8511bb7b4b331d79ebe32d29e65e3e87e2cd4d51613d7/

Threat name:

Script-JS.Trojan.Heuristic

Status:

Malicious

First seen:

2026-11-11 12:58:58 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 36 (19.44%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=neog3356mxsfvmpyken3pnftghlz5prs2kpgly7ipywnjviwcplq._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook adware collection defense_evasion discovery execution privilege_escalation rat spyware stealer trojan

Link:

https://tria.ge/reports/261111-rkr2hshh97/

Behaviour

Kills process with taskkill

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

ConfuserEx .NET packer

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Reads user/profile data of web browsers

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: Formbook

Formbook payload

Malware Family:

loader

Malicious:

True

Tags:

javascript

Link:

https://intel.virussign.com/intelligence/file/691c6defbe65e45ab1f8511bb7b4b331d79ebe32d29e65e3e87e2cd4d51613d7

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/691c6defbe65e45ab1f8511bb7b4b331d79ebe32d29e65e3e87e2cd4d51613d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery Create hunting rule
Author:	ditekSHen
Description:	Detects JS potentially executing WMI queries

Rule name:	SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (script_js, etat binaire)

Rule name:	SUSP_Script_PowerShell_Hidden_Launcher Create hunting rule
Author:	Marjoriefort
Description:	Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:	Veille fraicheur 2026-09-14 / cluster misses web

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample