MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1
SHA3-384 hash:	3b986d44993228c8ef2ef6a9f742a3bf79295293f09e7031ac5754ccabd921629139c4963343cdfec80aa5b1cfe7052f
SHA1 hash:	19c720215dd0ddf77657473bbea26c29ddd988a0
MD5 hash:	56a71d3bdca5b4b9bfb9e734e49f2de0
humanhash:	angel-wyoming-juliet-jersey
File name:	56a71d3bdca5b4b9bfb9e734e49f2de0.js
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	33'978 bytes
First seen:	2026-03-03 14:37:10 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:sGLCfWt2nTY6c4NrJ1Z/g3qvW3l3TvwoBpmvEh9gYQ0pEAI72KErJDso53IqYPAs:sgyv7Td5X
Threatray	2'716 similar samples on MalwareBazaar
TLSH	T1A9E2081CB1CF4987F4679601EB4C70CC0A15E0D32F995CEAD66F6CAAA1D058E7A933D8
Magika	javascript
Reporter	abuse_ch
Tags:	FormBook js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

442

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Packed.165.6067.12387.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a6f278002d37d5c98324dc

Tags:

ransomware sage smtp

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm fingerprint repaired

Link:

https://www.filescan.io/uploads/69a6f23310e80629d4fa5024/reports/abb1820e-bef0-4fc9-a3e1-81a4681e10b7/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Detections:

Trojan-Downloader.PowerShell.NanoShield.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic Trojan-Downloader.SLoad.TCP.ServerRequest

Link:

https://opentip.kaspersky.com/f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1877562

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

Creates processes via WMI

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell Decrypt And Execute Base64 Data

Sigma detected: Suspicious PowerShell IEX Execution Patterns

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected MSIL Injector

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

81%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1/

Neiki Trojan-Downloader.PowerShell.TCP

Verdict:

Malicious

Threat:

Trojan-Downloader.PowerShell.TCP

Link:

https://tip.neiki.dev/file/f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1

ReversingLabs TitaniumCloud Win32.Trojan.Kepavll

Threat name:

Win32.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-02 13:26:47 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6cuyu4vxwhegvrgoiv7hs6fen2fpkm4t4eah2l7jimdlwbbdrdiq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

1f58eaedefb85d620985c5fc267c05ffa7c4877cbff67763da7ebe2fe540d220

Formbook

39d4b2c2f232d51c44e28e77ef48a8f57803f053f7ab864de307f6a45fe5705e

Formbook

44eb0ca230176e7653e8287dac64b16e4cfde7088635498e52d802d8a3dcb7e9

Formbook

5a721e420c6fc129a198af6fd7458202c574cff68e0b60b4372a8af5767bd2d9

Formbook

5aa4328001eb57a54a716ba3c7f0fa7f6b8c390828ea8b33a3c85dfb2838a512

Formbook

71043a4c0e0ce7ea11b1f1de15594cd3ddb7048a34134022c1101e7653d5a2f6

Formbook

e5736df87221b67a2e2a614374e1d6353043b95e08448ea9260e103ab18a5c8d

Formbook

error

Formbook

f0827019d570ad314a99dd69590b0c83639c60b1dcac77d708cd6d4959383757

Formbook

f424bb11bb0e71134361f14d3d698933095f8d464d710eb12c131652bbda5164

Formbook

+ 2'706 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260303-rzc6xabt2y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1