MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5ee487c616532dab3c06755f8df4d201072d815e687f7e495b24781172f8313. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d5ee487c616532dab3c06755f8df4d201072d815e687f7e495b24781172f8313
SHA3-384 hash:	f22fb24c4ee5f2b1acdef8a4629ae627726a15d44a9f077c2d39184f12d97919cc8db4cf81e755d35f3401f5dfd5f5b9
SHA1 hash:	e6e7e6abdcdd40d52ae74ab6604bb7667b57fdd1
MD5 hash:	c58de2200934510c52e700b155a7f4b4
humanhash:	twenty-asparagus-texas-floor
File name:	Quotation.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	2'124'812 bytes
First seen:	2025-10-14 13:45:23 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24576:W4chRU7p6tJShYGCjoY+3flJohFG/Yp7Sq4+FsZoO9P/6IXB43D49fPJlgyng3jJ:jUShdCjoRPoyg7FsZxRM7G1cb
Threatray	2'086 similar samples on MalwareBazaar
TLSH	T183A5E0348D1AAC4A3FAD49C748DC2DC54D6C1B93822C97F89B4C737A62AD5119EED0BC
Magika	vba
Reporter	abuse_ch
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

86

Origin country :

SE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ee543a97a16d00a8d9df3d

Tags:

delphi spawn virus blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug base64 dropper fingerprint keylogger obfuscated obfuscated packed packed redcap

Link:

https://www.filescan.io/uploads/68ee561f71883144ef3674b9/reports/a5cd0d17-6915-4d1c-8e49-6136deedc115/overview

Hybrid Analysis GT:JS.Cbum.1

Verdict:

Malicious

Labled as:

GT:JS.Cbum.1

Link:

https://www.hybrid-analysis.com/sample/d5ee487c616532dab3c06755f8df4d201072d815e687f7e495b24781172f8313

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2025-10-14T04:37:00Z UTC

Last seen:

2025-10-16T03:42:00Z UTC

Hits:

~100

Detections:

Trojan-Spy.Win32.Noon.sb Trojan-PSW.Win32.Stealer.sb Trojan-Dropper.JS.SDrop.sb Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan.Script.SAgent.gen HEUR:Trojan.Script.Generic PDM:Trojan.Win32.Generic HEUR:Trojan-PSW.Win32.DarkCloud.gen

Link:

https://opentip.kaspersky.com/d5ee487c616532dab3c06755f8df4d201072d815e687f7e495b24781172f8313/results?tab=lookup

Joe Sandbox DBatLoader, FormBook

Result

Threat name:

DBatLoader, FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1794913

Signature

Allocates many large memory junks

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Benign windows process drops PE files

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Detected unpacking (changes PE section rights)

Drops PE files to the user root directory

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Execution from Suspicious Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected DBatLoader

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d5ee487c616532dab3c06755f8df4d201072d815e687f7e495b24781172f8313

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d5ee487c616532dab3c06755f8df4d201072d815e687f7e495b24781172f8313/

Neiki Family.MODILOADER

Verdict:

Malicious

Threat:

Family.MODILOADER

Link:

https://tip.neiki.dev/file/d5ee487c616532dab3c06755f8df4d201072d815e687f7e495b24781172f8313

ReversingLabs TitaniumCloud Script-JS.Trojan.Egairtigado

Threat name:

Script-JS.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-14 13:32:09 UTC

File Type:

Text

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2xxeq7dbmuznvm6am5k7rx2neaihfwav42d7pzevwjdycfzpqmjq._file

Threatray dbatloader

Verdict:

malicious

Label(s):

dbatloader

Alert

Create hunting rule

Similar samples:

0dfd9f9027f0f6eeb381e55a0668b5b5a146fd4310f10edceeda4454eeaab924

Formbook

1626575d77b31d3b8cfebf81867d2dd2da280a4b83ab74a2852bc26143ca8aef

Formbook

2b2813d971b9a081db71183c0687b4a80b423a1228617b13a13f1baaa6ba9158

Formbook

5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488

Formbook

89369898ebf3b91a1f28cecd38382b3f47d32e0cbde22543b1ece74c25c03eef

Formbook

cb464455cbb783df8da5d7e1cee51cde3b42f5cd1c4c5cb6559aa56cbb1007fe

Formbook

cf77ea3d603cf9d76cac65e60a4d53dfbc850631f77c24784361e6f8984c9798

Formbook

e5736df87221b67a2e2a614374e1d6353043b95e08448ea9260e103ab18a5c8d

Formbook

ea710abc03bb6f1d7bb3045bfbbf6450e49fbaea858df1fef7563d525d708c0c

Formbook

ebc963782a30a3e6cc360a6e4fda16d2acac2de13ee0d8db863082e699dabd5a

Formbook

error

Formbook

+ 2'076 additional samples on MalwareBazaar

Hatching Triage modiloader

Result

Malware family:

modiloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook family:modiloader discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/251014-q737mabj7s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Formbook payload

ModiLoader Second Stage

Formbook

Formbook family

ModiLoader, DBatLoader

Modiloader family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.85

Link:

https://yomi.yoroi.company/submissions/d5ee487c616532dab3c06755f8df4d201072d815e687f7e495b24781172f8313