MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d36ed137f9ad6964486285f443f21a27510c8b15f40ef2c47911b5a47b8bc083. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d36ed137f9ad6964486285f443f21a27510c8b15f40ef2c47911b5a47b8bc083
SHA3-384 hash:	eabb21c9bf2d5f61b2c99cbde0e4e15dcf2820978636c1c5ae7f1e80e0355464c4ef28941e0e110d16b5d767cf7651f7
SHA1 hash:	8da68794e088d9007e4a1768e1de18e6dffd2829
MD5 hash:	e8376db8625ab4c07c66cbd8c5ae372c
humanhash:	alanine-sweet-avocado-skylark
File name:	arquivo_889bb95255b5492b83d70b0c212262d0.vbs
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	132'999 bytes
First seen:	2025-05-03 10:23:49 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	384:2geNsi3ruVoJs9tHQ9I0OLzxHGtpL08ev9tfk+nnnnO:ssi3ruVoJs9tHQ9I0OLzxHGt9pl
Threatray	14 similar samples on MalwareBazaar
TLSH	T141D3444BCC9092064976ADA1BDEDBF49041FD39B82061CC1BAF7AB74F523893C46856F
Magika	vba
Reporter	smica83
Tags:	FormBook HUN kimber-lovestoblog-com vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

106

Origin country :

HU

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6815f0eee81a664e0167ae9e

Tags:

xtreme shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 evasive obfuscated opendir opendir overlay powershell

Link:

https://www.filescan.io/uploads/6815eec70b64e174c415bc92/reports/c453bc1b-7710-433d-9bd0-621b2292a212/overview

Hybrid Analysis TrojWare.BadShell

Verdict:

Malicious

Labled as:

TrojWare.BadShell

Link:

https://www.hybrid-analysis.com/sample/d36ed137f9ad6964486285f443f21a27510c8b15f40ef2c47911b5a47b8bc083

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1680502

Signature

Antivirus detection for URL or domain

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected FormBook

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d36ed137f9ad6964486285f443f21a27510c8b15f40ef2c47911b5a47b8bc083/

ReversingLabs TitaniumCloud Script.Trojan.Generic

Threat name:

Script.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-05-03 10:24:11 UTC

File Type:

Binary

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2nxncn7zvvuwisdcqx2eh4q2e5iqzcyv6qhpfrdzcg22i64lycbq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

14c3023fd2bb18fd4095277f47582be9251c6aaa51c66c4a97659a2c2435ec36

Formbook

1ae589f7033b509d9f1132e9e1159fd3185860f67544e95bce6055849c96b2c9

Formbook

491fbbb1b91c4ec1521dcbe45566794adad56ae63ab9347b5674e5a764b9f483

Formbook

4cc764fdbe313ada11d232bb924795207e0ac8f9be2c39aaeb7cf77f2011af2c

Formbook

7c3ff0fc1748fa37047666d9ed7c74d1bcf1bd5a5277995d9e37c1af3b161d54

Formbook

8910d1eb637d5a45972756c4990d10fc757656639ffe17714bca956432b6b0e3

Formbook

aba25ba7b11ce6ea98e0d305fba0034b71ae2a8aab15b34a1fdeabdede9ed08c

Formbook

d4b5f80983a954f27ebecfdf87f26582b36b64c57f02ede40c74145d880a69f0

Formbook

error

Formbook

f42e5e71951226abef9b73e236b7d374c7144b66e8f2cc055d536cf444547fe6

Formbook

f612e7e8f8f1810c3f5261ab945c8793b1e62fd8077bad0e9ede61a96be58de9

Formbook

+ 4 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/250503-mfd7msgq61/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d36ed137f9ad6964486285f443f21a27510c8b15f40ef2c47911b5a47b8bc083