🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c56336bc761bdc04209e70cf3caf519fdff0b8a2abe0510e31b695327cbe1ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c56336bc761bdc04209e70cf3caf519fdff0b8a2abe0510e31b695327cbe1ff
SHA3-384 hash: ec2327fc72b0ec3e118a07e2d196167837eeeedab2ec0a38b43a87d991d45af43eda74bca69b62e78713b88a6e3c0cbe
SHA1 hash: 8dfd023989057bdbd0f531be6a3e6e521b7f6abb
MD5 hash: b2c164e130b0b5a533b9121bd940fc1f
humanhash: floor-lake-alanine-december
File name:DEME_EUR12393_pdf.js
Download: download sample
Signature Formbook
Create hunting rule
File size:642'285 bytes
First seen:2026-10-29 09:10:09 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:CUhRemwobMwr15NHd/PC5CSB/PU8trCG9gkWOwmZ6ND2m63YwQk4h9uP5Z3:CUhRejobVzN9/Qs8tCAWkQB2TH4hGv
TLSH T186D412D0BF95A8AB82BCC631485F1F0D6F9067D36C48F68B5478A1C10FA7B2156DAD2C
Magika javascript
Reporter abuse_ch
Tags:FormBook geo js TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae30d94b121dd519dce9363
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm base64 base64 encrypted fingerprint masquerade obfuscated repaired
Link:
https://www.filescan.io/uploads/6ae30d8d9d5eebeba64c00bd/reports/bc5afda9-c3ee-40e2-88d0-f7d8fffdbdc8/overview
Verdict:
Suspicious
Labled as:
VBS/Obfuscated.G trojan
Link:
https://www.hybrid-analysis.com/sample/9c56336bc761bdc04209e70cf3caf519fdff0b8a2abe0510e31b695327cbe1ff
Verdict:
Malicious
File Type:
js
First seen:
2026-10-29T04:51:00Z UTC
Last seen:
2026-10-31T07:20:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/9c56336bc761bdc04209e70cf3caf519fdff0b8a2abe0510e31b695327cbe1ff/results?tab=lookup
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1994555
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Creates processes via WMI
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected FormBook
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1994555 Sample: DEME_EUR12393_pdf.js Startdate: 29/10/2026 Architecture: WINDOWS Score: 100 65 www.wine-stories.ro 2->65 67 www.totacks.com 2->67 69 23 other IPs or domains 2->69 71 Suricata IDS alerts for network traffic 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 Antivirus detection for URL or domain 2->75 77 10 other signatures 2->77 9 powershell.exe 25 2->9         started        13 1OWTWqBQUOckt.exe 2->13 injected 15 wscript.exe 1 2 2->15         started        17 2 other processes 2->17 signatures3 process4 dnsIp5 51 C:\Users\user\AppData\...\ntodc0lu.cmdline, Unicode 9->51 dropped 53 C:\Users\user\AppData\Local\...\manifest.js, ASCII 9->53 dropped 101 Writes to foreign memory regions 9->101 103 Injects a PE file into a foreign processes 9->103 20 CasPol.exe 9->20         started        23 csc.exe 3 9->23         started        26 conhost.exe 9->26         started        105 Maps a DLL or memory area into another process 13->105 107 Found direct / indirect Syscall (likely to bypass EDR) 13->107 28 sethc.exe 13 13->28         started        55 C:\Users\user\AppData\Local\...\w89186.ps1, Unicode 15->55 dropped 109 JScript performs obfuscated calls to suspicious functions 15->109 111 Wscript starts Powershell (via cmd or directly) 15->111 113 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->113 115 2 other signatures 15->115 59 marathilyrics.com 192.250.235.42, 49920, 49921, 49922 WHG-SGPGB Singapore 17->59 61 lb-go66totd-cidju8opnfbqas41.clb.bj-tencentclb.com 49.233.246.57, 49899, 49900, 49901 TENCENT-NET-APShenzhenTencentComputerSystemsCompanyLimitedCN China 17->61 63 13 other IPs or domains 17->63 57 C:\Users\user\AppData\Local\...\w59584.ps1, Unicode 17->57 dropped 30 powershell.exe 19 17->30         started        file6 signatures7 process8 file9 79 Maps a DLL or memory area into another process 20->79 81 Queues an APC in another process (thread injection) 20->81 83 Unusual module load detection (module proxying) 20->83 85 Found direct / indirect Syscall (likely to bypass EDR) 20->85 49 C:\Users\user\AppData\Local\...\ntodc0lu.dll, PE32 23->49 dropped 32 cvtres.exe 1 23->32         started        87 Tries to steal Mail credentials (via file / registry access) 28->87 89 Tries to harvest and steal browser information (history, passwords, etc) 28->89 91 Modifies the context of a thread in another process (thread injection) 28->91 93 Switches to a custom stack to bypass stack traces 28->93 34 msedge.exe 28->34         started        36 firefox.exe 28->36         started        95 Writes to foreign memory regions 30->95 97 Allocates memory in foreign processes 30->97 99 Injects a PE file into a foreign processes 30->99 38 csc.exe 30->38         started        41 conhost.exe 30->41         started        43 CasPol.exe 30->43         started        signatures10 process11 file12 47 C:\Users\user\AppData\Local\...\1p3ck1pg.dll, PE32 38->47 dropped 45 cvtres.exe 38->45         started        process13
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9c56336bc761bdc04209e70cf3caf519fdff0b8a2abe0510e31b695327cbe1ff
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
DeObfuscated Javascript Obfuscated T1027 T1059.007
Link:
https://app.malva.re/file/b2c164e130b0b5a533b9121bd940fc1f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c56336bc761bdc04209e70cf3caf519fdff0b8a2abe0510e31b695327cbe1ff/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-29 09:10:43 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=trldg26hmg64aqqj44gphsxvdh676c4kfk7akehddnuvgj6l4h7q._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/261029-k5bfyaax7w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/9c56336bc761bdc04209e70cf3caf519fdff0b8a2abe0510e31b695327cbe1ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments