MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0a8c7f680f9573add4c7d681fbfee2bfd8a4c3cf606e98e2b136a63ef85348d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d0a8c7f680f9573add4c7d681fbfee2bfd8a4c3cf606e98e2b136a63ef85348d
SHA3-384 hash:	8048c4b23eeae7eb4ca730cec7d1ca1bc2cf187de7a84a6fec69c95deb0b0bd9dea9dfc1301ef5a0bcf7a37d669bc47d
SHA1 hash:	5e29c642364d43b91f8f97b4c97fc5bf64a51c73
MD5 hash:	83c2ed0cfdbabaf6e55d3637bb276fe0
humanhash:	high-triple-mockingbird-twelve
File name:	FREP0000003583.pdf 67 KB.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	45'357 bytes
First seen:	2026-08-03 12:13:11 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:TSVz1back6VAZSvVvaSDodQ6uIgHJ2I1v:85Jf
TLSH	T1C113B3FB6A1EC470ADA00CCB58D77FCB51CC8879453436B39228686AEDF4B1521B75B8
Magika	javascript
Reporter	James_inthe_box
Tags:	exe FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

59

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm downloader fingerprint powershell repaired

Link:

https://www.filescan.io/uploads/6a7097932d4ff8fd0db00de1/reports/8c11b5b1-cc92-4552-b509-49b8f450f145/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d0a8c7f680f9573add4c7d681fbfee2bfd8a4c3cf606e98e2b136a63ef85348d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-31T11:46:00Z UTC

Last seen:

2026-08-03T07:48:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/d0a8c7f680f9573add4c7d681fbfee2bfd8a4c3cf606e98e2b136a63ef85348d/results?tab=lookup

Nucleon Malprob Malware

Score:

87%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d0a8c7f680f9573add4c7d681fbfee2bfd8a4c3cf606e98e2b136a63ef85348d

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d0a8c7f680f9573add4c7d681fbfee2bfd8a4c3cf606e98e2b136a63ef85348d/

ReversingLabs TitaniumCloud Script-JS.Trojan.Leonem

Threat name:

Script-JS.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-01 10:11:59 UTC

File Type:

Binary

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2cump5ua7fltvxkmpvub7p7ofp6yutb46ydotdrlcnvgh34fgsgq._file

Threatray Formbook

Verdict:

malicious

Label(s):

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/8718717e-156b-4b73-9054-cddca59b83b8

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260803-pd1zqsxbqg/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Badlisted process makes network request

Family: Formbook

Formbook payload

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/d0a8c7f680f9573add4c7d681fbfee2bfd8a4c3cf606e98e2b136a63ef85348d