MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c1abc6c731f272e22deabeeb92b6378fdc32507a1fac93271b45a2a577aa88c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6c1abc6c731f272e22deabeeb92b6378fdc32507a1fac93271b45a2a577aa88c
SHA3-384 hash:	d17e92521f680547c438f3fa65474b354d1a54d8cdcdc3d0704b11906a1e43f280c585a4b7507556ed66b849837e1689
SHA1 hash:	f04d5be78e3d6f33e12a53f1dbb17033a51e2116
MD5 hash:	1bc85fa0861e29220ac221302bcd4fe5
humanhash:	seventeen-december-romeo-romeo
File name:	Quotation.JS
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	4'151'392 bytes
First seen:	2026-07-28 20:44:18 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:CMq69t2ynXIkZt/n4Ynab8USlsH7dX65iAM83i4M8BFdz7:kqII4oab8US+dKXzi+z7
TLSH	T1A716E8974F544A9D55ACC76CC96EEB484B7D120B033CAE0E3BB938D4DE56FAB104C09A
Magika	javascript
Reporter	James_inthe_box
Tags:	exe FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

190

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan-Downloader.JS.XLoader.5842.13182.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Agent.UNU.tr.8211.32274.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis JS/TrojanDropper.ModiLoader

Verdict:

Malicious

Labled as:

JS/TrojanDropper.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/6c1abc6c731f272e22deabeeb92b6378fdc32507a1fac93271b45a2a577aa88c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-28T06:17:00Z UTC

Last seen:

2026-07-30T17:45:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/6c1abc6c731f272e22deabeeb92b6378fdc32507a1fac93271b45a2a577aa88c/results?tab=lookup

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6c1abc6c731f272e22deabeeb92b6378fdc32507a1fac93271b45a2a577aa88c

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6c1abc6c731f272e22deabeeb92b6378fdc32507a1fac93271b45a2a577aa88c/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nqnly3dtd4ts4iw6vpxlsk3dpd64gjihuh5msmtrwrncuv32vcga._file

Threatray Formbook

Verdict:

malicious

Label(s):

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/f2956c53-bda6-42da-8e4f-7a27e851daf7

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook discovery execution persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/260728-zjfwvshl7x/

Behaviour

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Family: Formbook

Formbook payload

VMRay FormBook

Malware family:

FormBook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6c1abc6c731f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6c1abc6c731f272e22deabeeb92b6378fdc32507a1fac93271b45a2a577aa88c