🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7
SHA3-384 hash: 7dfb79d4915243ac6099c80863b8f73f469c360627d2e3dd36b27449f92d739a9b1141ccd410bb04543de1ebb37aefd1
SHA1 hash: 3939f6fb4badfd3233885a9d3f1b13b4faa54784
MD5 hash: 37685e8f86e314d72db011dcfa40a0eb
humanhash: early-nine-pizza-bakerloo
File name:SWIFT809827736829.PDF.JS
Download: download sample
Signature Formbook
Create hunting rule
File size:11'053'388 bytes
First seen:2026-03-27 15:34:42 UTC
Last seen:2026-05-20 16:50:35 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 196608:7mDE+NP0IEfxlpp/JMux+bEOoIAuvAmFQPIgcNa0DTrNTVve8H3UbpMJGIN8GOtA:7GE+NPifFDz+bE2AzmFuIgqaQ33W8H3B
TLSH T187B65A84930D897DF65EEF1CD17ADAC0D98D23A645C9EF1D342DD2287B4A0536B8B0CA
Magika javascript
Reporter TomU
Tags:FormBook js


Avatar
TomU
--- mail headers ---
Date: Wed, 25 Mar 2026 03:05:10 -0700
From: AGRON SOKOL <Agron.Sokol@saccavini.it>
Subject: =?UTF-8?Q?RE=3A_RE=3A_KONFIRMONI_K=C3=8BT=C3=8B_PAGES=C3=8B_DHE_?=
Message-ID: <370a418a1c5e70443e5789e7a260d092@saccavini.it>
User-Agent: Roundcube Webmail/1.3.7

--- mail attachments (spaces replaced with [_X]) ---
fb3f1b2563b5591f35b9cbf8e0c8b018 SWIFT809827736829.PDF.zip
37685e8f86e314d72db011dcfa40a0eb SWIFT809827736829.PDF.JS

Intelligence

File Origin
# of uploads :
2
# of downloads :
146
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c6a383aacb4c376b14ac18
Tags:
obfuscate xtreme blic
Verdict:
Malicious
Labled as:
JS/Obfuscated.C suspicious application
Link:
https://www.hybrid-analysis.com/sample/c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7
Verdict:
Malicious
File Type:
js
First seen:
2026-03-25T07:21:00Z UTC
Last seen:
2026-03-27T18:05:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7/
Verdict:
Malicious
Threat:
Trojan.Win32
Link:
https://tip.neiki.dev/file/c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2026-03-25 10:15:03 UTC
File Type:
Text (JavaScript)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ybbcu3yfkb7nvstx7rv7zpzo3qnmzaxifb35fajyfkvifh3qcplq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260327-s1jwhsct8m/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Formbook
Formbook family
Formbook payload
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c0422a6f0550/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Java Script (JS) js c0422a6f05507edaca77fc6bfcbf2edc1acc82e82877d281382aaa829f7013d7

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments