MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a8a4476ef5819e4ebc0dffc03661f91d180f5e2fd160bcb3c3a16d87925d78d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6a8a4476ef5819e4ebc0dffc03661f91d180f5e2fd160bcb3c3a16d87925d78d
SHA3-384 hash:	53c5481c1cefdb9cc7c10603b4f8d3f86ad24569ff5b5843924eb734e4b58aaad3f82e9f19a62787b27b0b0b4a5700f6
SHA1 hash:	da33bd5c2eb40af913e2197b1dce25636e2d947a
MD5 hash:	58baba07468c5b8ad7cb9d0aeda52c55
humanhash:	neptune-twenty-july-solar
File name:	FIYAT TEKLIF TALEBI 10282026.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	5'461 bytes
First seen:	2026-10-28 13:08:25 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	48:VstqqeBA6nvKpC2H2deDiDKXJWgSokRpj40x/J8F7JTqCkbFy6ZPzJt6YvFQFFJ:VsH2Lvai+YwkR9xUF7JTqRFZRFPuFFJ
TLSH	T122B1FB8CAC8D702D4D767339CB2E9506E3F7146B2A0AC155B56D83503F3185D81ADFEA
Magika	javascript
Reporter	abuse_ch
Tags:	FormBook geo js TUR

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

192

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae1f3ff49621540087c2963

Tags:

vmdetect stration shell spawn

Hybrid Analysis SVM:TrojanDownloader/JS.Nemucod

Verdict:

Suspicious

Labled as:

SVM:TrojanDownloader/JS.Nemucod

Link:

https://www.hybrid-analysis.com/sample/6a8a4476ef5819e4ebc0dffc03661f91d180f5e2fd160bcb3c3a16d87925d78d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-10-28T08:02:00Z UTC

Last seen:

2026-10-30T10:27:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/6a8a4476ef5819e4ebc0dffc03661f91d180f5e2fd160bcb3c3a16d87925d78d/results?tab=lookup

Joe Sandbox FormBook, PSLoader

Result

Threat name:

FormBook, PSLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1994002

Signature

Bypasses PowerShell execution policy

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected FormBook

Yara detected Generic JS Downloader

Yara detected Powershell decode and execute

Yara detected PSLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

4%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/6a8a4476ef5819e4ebc0dffc03661f91d180f5e2fd160bcb3c3a16d87925d78d

Malva.RE Malware

Verdict:

Malware

YARA:

2 match(es)

Tags:

Javascript JS Emulation Trace MSXML2.XMLHTTP PowerShell Scripting.FileSystemObject T1059.007 T1105

Link:

https://app.malva.re/file/58baba07468c5b8ad7cb9d0aeda52c55

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6a8a4476ef5819e4ebc0dffc03661f91d180f5e2fd160bcb3c3a16d87925d78d/

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-28 12:56:09 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 24 (33.33%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nkfei5xplam6j26a376agzq7shiyb5pc7ulaxsz4hilnq6jf26gq._file

Threatray FantomCrypt Formbook

Verdict:

malicious

Label(s):

FantomCrypt

Alert

Create hunting rule

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/7e9ffc7c-f0b0-4652-a257-75e5db8f56cc

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook adware collection defense_evasion discovery execution privilege_escalation rat spyware stealer trojan

Link:

https://tria.ge/reports/261028-qdwwfscv5z/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Badlisted process makes network request

Family: Formbook

Formbook payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6a8a4476ef5819e4ebc0dffc03661f91d180f5e2fd160bcb3c3a16d87925d78d