MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eda99519f7e5ef015a4450927bc96f26f837f07e54eb692eaa4ad12ed2a837a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	eda99519f7e5ef015a4450927bc96f26f837f07e54eb692eaa4ad12ed2a837a1
SHA3-384 hash:	f99970b12f1321f59a5c41ba927ebde044c4a98f2910ad9665042e30d613a52abaa7c2535825226142745746d34703c2
SHA1 hash:	d996f063f45b201c337b2c3a2b4c66773bb080f3
MD5 hash:	22b0a687a3130cb683e619d80320412f
humanhash:	don-coffee-river-whiskey
File name:	Pago (1).js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	2'085'213 bytes
First seen:	2026-07-20 16:21:10 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:ncmHEviuR/HMjxhUsMaW8+sM3+ajEqcDqmyLlq7DP0MzluFF3d:kvE/BaViW3d
TLSH	T13AA5029973A71112D29F22420BA80C2DD9417C2F3EFB2EDCBDAE41D934117689E9DC75
Magika	javascript
Reporter	proxylife
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

196

Origin country :

BR

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10514.22271.2191.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5e4b1385479d70bfb785fe

Tags:

cryxos virus shell spawn

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fingerprint powershell repaired

Link:

https://www.filescan.io/uploads/6a5e4b0b3cfa5d6d7dd1b449/reports/8eedd783-2729-410c-8389-8fed064148e5/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/eda99519f7e5ef015a4450927bc96f26f837f07e54eb692eaa4ad12ed2a837a1

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-20T12:45:00Z UTC

Last seen:

2026-07-22T10:33:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/eda99519f7e5ef015a4450927bc96f26f837f07e54eb692eaa4ad12ed2a837a1/results?tab=lookup

Nucleon Malprob Susipicious

Score:

61%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/eda99519f7e5ef015a4450927bc96f26f837f07e54eb692eaa4ad12ed2a837a1

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eda99519f7e5ef015a4450927bc96f26f837f07e54eb692eaa4ad12ed2a837a1/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-21 01:37:14 UTC

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5wuzkgpx4xxqcwsekcjhxslpe34dp4d6ktvwslvkjlis5uvig6qq._file

Threatray Formbook

Verdict:

malicious

Label(s):

Formbook

Alert

Create hunting rule

Link:

https://reports.threatray.com/87575d4b-731d-4935-a88e-4b716965e481

Similar samples:

1317e1b8a9b4907968c3ccd5924ec46494e8d3c03e16add3c510602f36d969e6

Formbook

2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e

Formbook

4d973c1e3c2e7eafc3e97b85b50322043c59f04bd0b5fdca80f6e9cc8024ae39

Formbook

52fb1acfeb05dfcca47b00a79f6b5b7b35187a2f261c22ad358450280333fde2

Formbook

a64590e1d51a40670052ae7de0fa91707e15d0699f5ff2745ee3ba6edb357d9a

Formbook

ac02050f714750b9bb82b71c689bb48163a27ec3c53d1d92f24fd886d8ebecb5

Formbook

cae5e8e2fa9cd2078bfac5606196bfb734bae2074289016eda7651dffc6c7962

Formbook

d08cf8c8f95b4df31198be8583cdbcf5f8e5beda95487e4aaed26cd2529e255d

Formbook

edf9ebe33ce5c5c82b0a14ceddb1fba4f5cb1d299a1f98f49436f8f9729a7a4a

Formbook

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260720-ttxz8shx8y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Badlisted process makes network request

Family: Formbook

Formbook payload

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/eda99519f7e5ef015a4450927bc96f26f837f07e54eb692eaa4ad12ed2a837a1