MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e5a3ee63b69b69739dc47ad4af8a5fcb25900a6f8b6b5c58d998c41997afd0e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 8
| SHA256 hash: | e5a3ee63b69b69739dc47ad4af8a5fcb25900a6f8b6b5c58d998c41997afd0e5 |
|---|---|
| SHA3-384 hash: | f18fda4e488ee6e0fe83e939eceaf48ba1912c84347e9e94bd6e81fa4ea4ba3559760b42fc389ce6d9fe3d740c3bed25 |
| SHA1 hash: | 5d7341a8e30bda5ed32903ad21e1a622efc8808a |
| MD5 hash: | cf5c864741d6c1cdec6149991eeb0d76 |
| humanhash: | yankee-fish-don-monkey |
| File name: | Orden_de_compra.pdf.7z.rar |
| Download: | download sample |
| Signature | Formbook |
| File size: | 2'888 bytes |
| First seen: | 2026-07-24 12:18:41 UTC |
| Last seen: | 2026-07-24 12:37:38 UTC |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 48:t/GXuNj5p6ITnVMf3+0OallQs1r+kFC0XuSU6SIaDafMrUI+qQdoBtrIyRq9:hG+nzTnmf3xOclQK40+iEaUrUIQgts9 |
| TLSH | T142514DE101A5FB83E5C7FDB62D1F5A683589F4886222BD2B45B0ED242095E546B1008A |
| TrID | 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1) |
| Magika | rar |
| Reporter |  TomU |
| Tags: | FormBook rar |
Intelligence
File Origin
# of uploads :
33
# of downloads :
65
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Orden de compra.pdf.js |
|---|---|
| File size: | 2'403'936 bytes |
| SHA256 hash: | 9ce6f41b4e5a362ac2faf57f2cecf2107183ca532da34d17d1905a8219660cd7 |
| MD5 hash: | 8f148bdd475ba9c6adc8ca52198e1503 |
| MIME type: | text/plain |
| Signature | Formbook |
Vendor Threat Intelligence
Verdict:
Suspicious
Labled as:
Trojan.Generic
Verdict:
Malicious
File Type:
rar
First seen:
2026-07-21T17:53:00Z UTC
Last seen:
2026-07-24T19:46:00Z UTC
Hits:
~10
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Rar Archive
Threat name:
Script-JS.Trojan.Cryxos
Status:
Malicious
First seen:
2026-07-16 17:19:11 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
13 of 36 (36.11%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook execution rat spyware stealer trojan
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Badlisted process makes network request
Formbook payload
Process spawned unexpected child process
Family: Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Formbook
rar e5a3ee63b69b69739dc47ad4af8a5fcb25900a6f8b6b5c58d998c41997afd0e5
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.