MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433
SHA3-384 hash:	14a9928402ab89e2e8dc17ccbfa56507e21221df27562002a6b047caa3887b110037501cd0b85dd9a7c97b8a042a5237
SHA1 hash:	05eba92fcded89a64ab16afd28ecadbdf3dd4484
MD5 hash:	8a99caaa2db77388ca5705180c0efc67
humanhash:	utah-delta-echo-connecticut
File name:	D494203 __ RFQ __ 208384779388 PDF.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	439'882 bytes
First seen:	2026-04-30 02:42:13 UTC
Last seen:	2026-05-20 16:51:15 UTC
File type:	js
MIME type:	text/plain
ssdeep	12288:90gkn35eSnY7ciqeuCqyq64XQjFq9BaetPi+9LuBxL/UoNTx:kE0ojp
Threatray	2'746 similar samples on MalwareBazaar
TLSH	T1F8941138AAFA4019B1B3EF54AEE47453D96FBB633B0E985D1081034A0633945EDE573E
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	autohotkey
Reporter	jahlives
Tags:	exe-in-archive FormBook js spamtrap

Intelligence

---

File Origin

# of uploads :

14

# of downloads :

156

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 conhost crypto encrypted obfuscated overlay powershell repaired

Link:

https://www.filescan.io/uploads/69f2c19086e92bda70185239/reports/d25b406b-7a64-4494-b2b8-9eaeb0e21363/overview

Hybrid Analysis JS/Agent.EBS

Verdict:

Suspicious

Labled as:

JS/Agent.EBS

Link:

https://www.hybrid-analysis.com/sample/c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-04-29T20:57:00Z UTC

Last seen:

2026-05-01T17:42:00Z UTC

Hits:

~100

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433/results?tab=lookup

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433/

Neiki Trojan.Win32

Verdict:

Malicious

Threat:

Trojan.Win32

Link:

https://tip.neiki.dev/file/c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-04-30 02:43:39 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zgbwyruojbaa6hwp4dcokfkfol54opn65evzfvtqfjxdn5bnyqzq._file

Threatray stubrunner formbook

Verdict:

malicious

Label(s):

stubrunner

Alert

Create hunting rule

formbook

Alert

Create hunting rule

Similar samples:

2b6fbc05f4e047f1c4441b7123380cc5284f3611bcf1ed8069dafb3555647eec

Formbook

2d2b6e4497e44239a28593031b18ba3a9550fe322f39ce87d0a3995b1b33086f

Formbook

78c2800187465b3e924e70eda2f69b0e0e0c9a843acf6a2506795145e7cf5e8d

Formbook

9029bab7100d209fa33c32f5450d0fc7a5661d4e481069aec127adc719f7308c

Formbook

df7ae8cbf85a38ceab3551bf0f806fb3b6b62a2664d029c465309ffccf9f6d69

Formbook

ef32abda2c3d6013ebe526a20bc266e62311794aedd673dc58e1c60a078ef92f

Formbook

error

Formbook

f0827019d570ad314a99dd69590b0c83639c60b1dcac77d708cd6d4959383757

Formbook

f37e88ccac15a8cbf0adc55ff9148f3bcdb2e59051fd87fe459cf3f012901f5c

Formbook

+ 2'736 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/260430-c67xjaes2l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433