MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b82e00c9e57909378b04b615745cb75f8694698d841ec7bae656ab2c0cb7bda8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b82e00c9e57909378b04b615745cb75f8694698d841ec7bae656ab2c0cb7bda8
SHA3-384 hash:	47c28229ab8302b98529cd23bc64ae989f3a5c714ea2d2d5a77c028db78a2c246687802af943fe6f82f7c6d24b238d10
SHA1 hash:	3144fedf1fd48c3b6ba880da45d1a7c4235f9704
MD5 hash:	32621d8b0e417df985000b31837b53c2
humanhash:	yellow-vermont-bakerloo-network
File name:	New_Booking_859_26.vbs
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	16'450 bytes
First seen:	2026-08-12 08:27:06 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:6AAT527gkgtX9AGYH0sO8mOJwtsq83s9yHzzqAreEusBzb5F00r5lUn5+VRMProv:RgLtXfYH0sO8mOJwtyX7rTfBPFT7X
TLSH	T11E72333AF908DFF40B2E11D0418B7D0660996756B53A4DECE4D6C5987F2AB008F9B8EC
Magika	vba
Reporter	abuse_ch
Tags:	FormBook vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

77

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/80714/

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac58062f1f9523193f0caa5

Tags:

infosteal virus

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/6a7c2e71d4c8433509c4200e/reports/b5f2f6ed-0b41-4b15-adb6-e98a11782895/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b82e00c9e57909378b04b615745cb75f8694698d841ec7bae656ab2c0cb7bda8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-08-11T22:18:00Z UTC

Last seen:

2026-08-14T06:30:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/b82e00c9e57909378b04b615745cb75f8694698d841ec7bae656ab2c0cb7bda8/results?tab=lookup

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1956637

Signature

Antivirus detection for URL or domain

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell Decrypt And Execute Base64 Data

Sigma detected: Suspicious PowerShell IEX Execution Patterns

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected FormBook

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

86%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b82e00c9e57909378b04b615745cb75f8694698d841ec7bae656ab2c0cb7bda8

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

T1059.005 VBScript WScript.Network

Link:

https://app.malva.re/file/32621d8b0e417df985000b31837b53c2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b82e00c9e57909378b04b615745cb75f8694698d841ec7bae656ab2c0cb7bda8/

ReversingLabs TitaniumCloud Script-WScript.Trojan.GuLoader

Threat name:

Script-WScript.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-12 08:27:36 UTC

File Type:

Text (VBS)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xaxabspfpeetpcyewykxixfxl6dji2mnqqpmpoxgk2vsydfxxwua._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260812-kcnwkasdle/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b82e00c9e57909378b04b615745cb75f8694698d841ec7bae656ab2c0cb7bda8

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/80714/