MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a82ac9bbd0ca656a30fc08280b2a997d648c93dff8783c49510b8f5d8c6ba821. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a82ac9bbd0ca656a30fc08280b2a997d648c93dff8783c49510b8f5d8c6ba821
SHA3-384 hash:	c6c97937ad4e9393305688b76fd1ba00ab2fbd2dccb12e296c73187f639a188ed8b54580b7970d52a9050ef0343744d0
SHA1 hash:	d2630878f04fe84fc7393a6643f0215cba06dd28
MD5 hash:	6e8dc746e0f36cf511000b784d8a73f0
humanhash:	uncle-cold-fruit-undress
File name:	A2026_ORDER.JS
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	3'092'552 bytes
First seen:	2026-08-05 12:22:13 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	49152:a5jwDAR0wbsMVT421omoyrNIGF7jEz9s2aPQHG2CKmiWbSASYs51DA8TTYIWqBWd:apwDAREMVTfomXryG6z9snG/miWbSASm
TLSH	T18AE51A40570998B17A3D673DE5376E201B1EB00751C5EF1E36BC6608B3A2E6B639DCE2
Magika	txt
Reporter	James_inthe_box
Tags:	exe FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

193

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive masquerade obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a732b031e925ec01d0a42b0/reports/2c323e5c-45ff-4bde-a7c4-80a457689452/overview

Hybrid Analysis JS/TrojanDropper.ModiLoader

Verdict:

Malicious

Labled as:

JS/TrojanDropper.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/a82ac9bbd0ca656a30fc08280b2a997d648c93dff8783c49510b8f5d8c6ba821

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-05T05:45:00Z UTC

Last seen:

2026-08-07T10:40:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/a82ac9bbd0ca656a30fc08280b2a997d648c93dff8783c49510b8f5d8c6ba821/results?tab=lookup

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a82ac9bbd0ca656a30fc08280b2a997d648c93dff8783c49510b8f5d8c6ba821

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a82ac9bbd0ca656a30fc08280b2a997d648c93dff8783c49510b8f5d8c6ba821/

ReversingLabs TitaniumCloud Script-JS.Downloader.SLoad

Threat name:

Script-JS.Downloader.SLoad

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-05 10:39:01 UTC

File Type:

Binary

AV detection:

10 of 38 (26.32%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vavmto6qzjswumh4bauawkuzpvsize677b4dyskrbohv3ddlvaqq._file

Threatray Formbook

Verdict:

malicious

Label(s):

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/e2e9df96-23b7-4f61-8b39-a8df3389f2fa

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook discovery execution persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/260805-pj49ca1zfw/

Behaviour

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Family: Formbook

Formbook payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a82ac9bbd0ca656a30fc08280b2a997d648c93dff8783c49510b8f5d8c6ba821