MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4
SHA3-384 hash: 6cac71d4bdae2eb53d1ee3168596c23f7185a7989dfacf4b10107ad7f05a9b20107c0ec9bb3aa1041137af7e8dffa09f
SHA1 hash: 4821a93237e2e0d9f03daef212fb77424424e19a
MD5 hash: 554b72ad7349bbd0262e218a7530dcf7
humanhash: helium-winter-cola-fish
File name:RFQ 477528).js
Download: download sample
Signature Formbook
Create hunting rule
File size:2'432'960 bytes
First seen:2026-07-01 07:24:40 UTC
Last seen:2026-07-02 15:03:28 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:jTKY4eGn7xhBpmgB9xwBB4Vy+FNrbWFXFSnkGX+na0Sc1UzBH3T5C1XWJgPUfDb5:m
Threatray 2'939 similar samples on MalwareBazaar
TLSH T115B5375303851BBDF68D0EC9C94B255B20F2D4677D251298EBB36EEBBC3B9849430636
Magika javascript
Reporter lowmal3
Tags:FormBook js

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a44c0f77ebb079b692b46ce
Tags:
obfuscate xtreme shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
encrypted evasive obfuscated powershell repaired zero-day
Link:
https://www.filescan.io/uploads/6a44c0f1b83e46df19cc99bc/reports/971681c7-06cb-4198-bea8-6bdd5df2425a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4
Verdict:
Malicious
File Type:
js
First seen:
2026-07-01T03:44:00Z UTC
Last seen:
2026-07-03T05:30:00Z UTC
Hits:
~1000
Detections:
HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1935923
Signature
Bypasses PowerShell execution policy
JScript performs obfuscated calls to suspicious functions
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4
Threat name:
Script-JS.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-07-01 07:25:41 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4i3yteekqbvpabgyvdmd3sznqbgvmngphqr5sdur6mvl2ukuil2a._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0a993640c09796e86f5284f0bd4177a40e50399f43905dbd0947e3ec1fea1c4f
Formbook
29343979342fcf3f93bd27e25d05c4278d10c9ba479f8e04db3dc1ff06032f3e
Formbook
3c7d9bc681e97b85adc3b943510b57927708b81d9996587ee3c1f07b8f33f14d
Formbook
3dc175bf861340b97aa3de7ba407113cd540fd4b0b4525f5ee1792932f5785f0
Formbook
79b1d72476c6d6525e17a5c409aca357b793a6d1f4c8fba23d3da19ca2efdb87
Formbook
a25fae26922ee1223edd81a29e05e84bbd4dd43eaea8596397f6be2d159f6eeb
Formbook
abff69c0d2985c11e4e92309178f13b8857d44498303dff2c074e772b23c8023
Formbook
cb70357549841be383d38d9c155e6cb95b46c1711f7e67c8a2274d1166a3a538
Formbook
d757052f889b71f80d4c641cb535c485d3b699a74b77d414d4dd53029036679f
Formbook
error
Formbook
+ 2'929 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook discovery execution rat spyware stealer trojan
Link:
https://tria.ge/reports/260701-h89rssgy8q/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Family: Formbook
Formbook payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Java Script (JS) js e23789908a806af004d8a8d83dcb2d804d5634cf3c23d90e91f32abd515442f4

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments