MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97d38f358fcd1829bd281b8218e7ee32cd2ea0b0e649adea2dc25ecf168751a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	97d38f358fcd1829bd281b8218e7ee32cd2ea0b0e649adea2dc25ecf168751a8
SHA3-384 hash:	2c2fada1762d2ef0855a71d01d622622f0b1c9f1162dc315f22bb3561926db12cdbd162473fdc0b7bee673b2c0ff11ff
SHA1 hash:	dc08253d755b854c75798d2a485b3d3c4c255650
MD5 hash:	6938070b1b9f9ad45f99b27d20d109cf
humanhash:	mississippi-dakota-bulldog-black
File name:	TAM0018.JS
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	4'047'126 bytes
First seen:	2026-06-15 13:28:58 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:H2PdpfEJTbYQQbF8v6SV0Uc6jwM6IaAOUJywEuaK71uzCyFP+mNCpitjn9OKH2H2:CEJMbCq2WBAO62IyFP7NCpoJWHVdSWe1
TLSH	T18216C4200314C571D26C5B6DE675BA28150D298B50F9FB0D39AA47B43376E33A3BE7E2
Magika	txt
Reporter	James_inthe_box
Tags:	exe FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

159

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2ffe42a15110463ee60ce0

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug base64 dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a2ffe3d1f652d686580d5f2/reports/cce5afff-4789-4598-9530-15bee8b5b6dd/overview

Hybrid Analysis DR/JS.Dropper

Verdict:

Malicious

Labled as:

DR/JS.Dropper

Link:

https://www.hybrid-analysis.com/sample/97d38f358fcd1829bd281b8218e7ee32cd2ea0b0e649adea2dc25ecf168751a8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-14T23:25:00Z UTC

Last seen:

2026-06-15T09:54:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/97d38f358fcd1829bd281b8218e7ee32cd2ea0b0e649adea2dc25ecf168751a8/results?tab=lookup

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1928026

Signature

Antivirus / Scanner detection for submitted sample

Benign windows process drops PE files

Found API chain indicative of debugger detection

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/97d38f358fcd1829bd281b8218e7ee32cd2ea0b0e649adea2dc25ecf168751a8

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/97d38f358fcd1829bd281b8218e7ee32cd2ea0b0e649adea2dc25ecf168751a8/

Neiki Trojan-Spy.Win32.Noon

Verdict:

Malicious

Threat:

Trojan-Spy.Win32.Noon

Link:

https://tip.neiki.dev/file/97d38f358fcd1829bd281b8218e7ee32cd2ea0b0e649adea2dc25ecf168751a8

ReversingLabs TitaniumCloud Script-JS.Dropper.Generic

Threat name:

Script-JS.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-15 12:59:42 UTC

File Type:

Binary

AV detection:

5 of 36 (13.89%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s7jy6nmpzumctpjidobbrz7oglgs5ifq4ze232rnyjpm6fuhkgua._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

error

Formbook

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260615-qrh7hses3p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Family: Formbook

Formbook payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.