MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78aa211440dc945fde98a9d035a45c014813331edc9d2d5dc0ebbeb78ecc77ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	78aa211440dc945fde98a9d035a45c014813331edc9d2d5dc0ebbeb78ecc77ea
SHA3-384 hash:	b156fbdd2243ef183d9fb6338293ca6a337a0a6233a8a8619c4a20f6b9326b21715bfab2397b8da72238ab0df8e1ddff
SHA1 hash:	5c793b7673af9c092687cb2a0c5ca2bd08db54e0
MD5 hash:	077e58942aa6f4c706d1efdd456246f1
humanhash:	pizza-whiskey-five-yellow
File name:	SCANNED_DOCUMENT_HSBC_PAYMENT_COPY_pdf.JS
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	3'931'565 bytes
First seen:	2026-08-17 05:38:41 UTC
Last seen:	2026-08-17 12:14:59 UTC
File type:	js
MIME type:	text/plain
ssdeep	98304:wJrSTu/W8HNkz41tXd4yDbB2ycGiiJw2zqJvXrEH925uZ4xB5cDBWVO:wAMO41tDbBkiD8vXQH9UuZ4xgBWVO
TLSH	T1E20661A077C899397360E75D42369921A00E254725E3CB163BFDF2043B2BA977358AF7
Magika	txt
Reporter	lowmal3
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

176

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.16799731.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dbatloader downloader dropper evasive formbook loader masquerade obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a829e982a955edf6d06b218/reports/a0994458-76ec-4937-b82e-a99419887814/overview

Hybrid Analysis Trojan.GenericFCA

Verdict:

Malicious

Labled as:

Trojan.GenericFCA

Link:

https://www.hybrid-analysis.com/sample/78aa211440dc945fde98a9d035a45c014813331edc9d2d5dc0ebbeb78ecc77ea

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-16T07:52:00Z UTC

Last seen:

2026-08-17T02:32:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/78aa211440dc945fde98a9d035a45c014813331edc9d2d5dc0ebbeb78ecc77ea/results?tab=lookup

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1958816

Signature

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

JavaScript source code contains functionality to generate code involving a shell, file or stream

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

92%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/78aa211440dc945fde98a9d035a45c014813331edc9d2d5dc0ebbeb78ecc77ea

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/78aa211440dc945fde98a9d035a45c014813331edc9d2d5dc0ebbeb78ecc77ea/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-16 12:52:42 UTC

File Type:

Text (JavaScript)

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pcvccfca3skf7xuyvhidljc4afebgmy63sos2xoa5o7lpdwmo7va._file

Threatray Formbook

Verdict:

malicious

Label(s):

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/1c25db0e-354a-41fe-91c0-83a0627df10f

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260817-gcl57aterh/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Family: Formbook

Formbook payload

VMRay FormBook

Malware family:

FormBook

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/78aa211440dc/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/78aa211440dc945fde98a9d035a45c014813331edc9d2d5dc0ebbeb78ecc77ea