MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f915f4793f8f9c2ab396236064f242ad228010d70fa21aea0eda5c623f10d7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7f915f4793f8f9c2ab396236064f242ad228010d70fa21aea0eda5c623f10d7f
SHA3-384 hash:	af6c32522dbdf66fc10c443c5b392acd8cf06a56345d4b99bbbc72861d1683267dd8d2cae9348cef250da0241d1db284
SHA1 hash:	87bbe575957e4a91fd34848e450bcd727d196379
MD5 hash:	1c40ef7daba51d96c05b10516e500801
humanhash:	oranges-maine-whiskey-missouri
File name:	6383826DG.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	6'766'247 bytes
First seen:	2025-12-08 17:04:42 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:gdsdw1VpJYs2tcTSJ3sBy1gaeEEdJSV6JTwxJgzpjHws9JXdJgnlm9hg3yRg:p
Threatray	9 similar samples on MalwareBazaar
TLSH	T1CF661260D92846C9C0EC9C138F85E9C86F1E6AEEB7193CB4761970CBDF9641DE1B2913
Magika	javascript
Reporter	abuse_ch
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

93

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=693705d8db58e1a2c22ba112

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 base64 fingerprint obfuscated obfuscated overlay powershell repaired

Link:

https://www.filescan.io/uploads/6937055cd12d1c79d42ae20f/reports/556cf569-9d0e-4e1a-bd35-78ef4f4669d9/overview

Hybrid Analysis GT:JS.ObfPadding.1

Verdict:

Malicious

Labled as:

GT:JS.ObfPadding.1

Link:

https://www.hybrid-analysis.com/sample/7f915f4793f8f9c2ab396236064f242ad228010d70fa21aea0eda5c623f10d7f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2025-12-08T02:31:00Z UTC

Last seen:

2025-12-10T13:53:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan.Script.SAgent.gen HEUR:Trojan.Script.Generic Trojan.JS.SAgent.sb

Link:

https://opentip.kaspersky.com/7f915f4793f8f9c2ab396236064f242ad228010d70fa21aea0eda5c623f10d7f/results?tab=lookup

Joe Sandbox FormBook, PureLog Stealer

Result

Threat name:

FormBook, PureLog Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1829012

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Injects a PE file into a foreign processes

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious Process Parents

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected FormBook

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/7f915f4793f8f9c2ab396236064f242ad228010d70fa21aea0eda5c623f10d7f

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/1c40ef7daba51d96c05b10516e500801

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f915f4793f8f9c2ab396236064f242ad228010d70fa21aea0eda5c623f10d7f/

Neiki Family.FORMBOOK

Verdict:

Malicious

Threat:

Family.FORMBOOK

Link:

https://tip.neiki.dev/file/7f915f4793f8f9c2ab396236064f242ad228010d70fa21aea0eda5c623f10d7f

ReversingLabs TitaniumCloud Script-JS.Trojan.Egairtigado

Threat name:

Script-JS.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-08 17:05:42 UTC

File Type:

Binary

AV detection:

13 of 37 (35.14%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p6iv6r4t7d44fkzzmi3amtzefljcqainod5cdlva5ws4mi7rbv7q._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

035353f9e0b18cc558c0f1f23cb03cee62714e0b74c502b3722598f3fc326c6a

Formbook

107e00e14a8e3c42e0e51e21f430c4e5fb6bd824ed4d9b03fd6783c6a97e655d

Formbook

52c54f72fc81d56c90fefc4cc4ef9a99f92a481953ac377b3a87c510a9ef89ba

Formbook

770a4e03c153f5fbd0011423d1710705af8d044d6b2dd35fff986c688843467a

Formbook

a7a565a4a611b7fd96d361e5b7f229a4a84388d15619dbf844e1e23ade31e3e6

Formbook

b801bcc02f26c3756b929cbe8ae210cd56dca87527c4091f94d27a04f092f9b8

Formbook

c51c2bd39c3596fb16fdcb72835a6ae3aa4bcc255b1174516e90c1750f199dda

Formbook

ed8fbe4e80d22ae1ca136cf51085802b6eedf916d68f5c27306cd661e08644fb

Formbook

error

Formbook

f74d263c8384f7ab6440f5639aa49ca86172132d0bfe734fe6e0e2be086edda7

Formbook

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/251208-vl3q7agw3g/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Suspicious use of SetThreadContext

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Formbook payload

Formbook

Formbook family

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://pngup.com/VmOv/MSI_PRO_with_b64.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/7f915f4793f8f9c2ab396236064f242ad228010d70fa21aea0eda5c623f10d7f