MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9cdb5156ed4b5375ebcb5b4adac65852bcc134480ed2a66363e7652ea651fec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b9cdb5156ed4b5375ebcb5b4adac65852bcc134480ed2a66363e7652ea651fec
SHA3-384 hash:	3fb5b4c6b76a448f4f48b5839cf8c172a575da281d19e01553749b9889f36c2f3461dd7ed8816a8975262506eda698b5
SHA1 hash:	ed2ea1c2ccba18e3260e495407255e69fafdea5e
MD5 hash:	82444d2bdb4473c530da30f5d8a43588
humanhash:	vermont-alanine-monkey-friend
File name:	HSBC_PAYMENT_RECEIPT_MT103.zip
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	228'788 bytes
First seen:	2026-10-14 15:09:44 UTC
Last seen:	2026-10-14 15:10:28 UTC
File type:	zip
MIME type:	application/zip
ssdeep	6144:HOGP2kfl55NMuEpLAuyWNurhc0er3C62e1hvGIt0ZE:NOk35NMuqEzWYdczmejO/C
TLSH	T160242203C90D7842AF3E4B656A3FC694126804F87CB0BAC53C81379548DBDA559EBBDB
Magika	zip
Reporter	TomU
Tags:	FormBook zip

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

39

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	HSBC PAYMENT RECEIPT MT103.js
File size:	589'862 bytes
SHA256 hash:	4727cb5c0619c8769b506df5a4420a18b91b7f3b7ef31c8c7d6fd0a1196ee5a2
MD5 hash:	28d6bba51defd18d6dfa717a3aedd23a
MIME type:	text/plain
Signature	Formbook

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9956cada-e8dd-4229-aa59-0f8adc366d12/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_JsNum.v2.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Heur.22080.10495.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/b9cdb5156ed4b5375ebcb5b4adac65852bcc134480ed2a66363e7652ea651fec/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

active-directory aes base64 conhost conhost.exe crypto dropper evasive formbook hacktool lolbin masquerade obfuscated persistence powershell reconnaissance repaired wscript

Link:

https://www.filescan.io/uploads/6acf9b6a61fb566b5b65c4fd/reports/f3d7496c-ab06-43a6-9c3e-c10aa398f730/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b9cdb5156ed4b5375ebcb5b4adac65852bcc134480ed2a66363e7652ea651fec

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-08-26T23:33:00Z UTC

Last seen:

2026-10-01T05:29:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/b9cdb5156ed4b5375ebcb5b4adac65852bcc134480ed2a66363e7652ea651fec/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/b9cdb5156ed4b5375ebcb5b4adac65852bcc134480ed2a66363e7652ea651fec

Malva.RE Malware

Verdict:

Malware

YARA:

2 match(es)

Tags:

DeObfuscated PowerShell T1027 T1059.001 T1105 Zip Archive

Link:

https://app.malva.re/file/82444d2bdb4473c530da30f5d8a43588

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b9cdb5156ed4b5375ebcb5b4adac65852bcc134480ed2a66363e7652ea651fec/

ReversingLabs TitaniumCloud Script.Trojan.Multiverze

Threat name:

Script.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-27 05:31:26 UTC

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xhg3kflo2s2toxv4ww2k3ldfquv4ye2eqdwsuzrwhz3ff2tfd7wa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/261014-s325wagg66/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b9cdb5156ed4b5375ebcb5b4adac65852bcc134480ed2a66363e7652ea651fec