MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9
SHA3-384 hash:	25ec110a3ba9637be6785591bb364492d226e7e21f5d82527aa77ce193188f961507598b33213cea6eb6cf0b9593aa91
SHA1 hash:	7390f5d438d867c98ae908d2ddeb18f70817fed6
MD5 hash:	03564de0414ad6a7dbfc295cb877907b
humanhash:	colorado-river-neptune-hamper
File name:	Proforma Invoice 5628-1.vbs
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	2'146'883 bytes
First seen:	2026-06-18 12:12:10 UTC
Last seen:	2026-07-03 17:58:55 UTC
File type:	vbs
MIME type:	text/csv
ssdeep	384:bbFnyZ5nQCxTIrtnzivGvbV+4PGRH120wteU/Qrn74Ow9IehKlToUQ1w/HTF74k0:u2
Threatray	154 similar samples on MalwareBazaar
TLSH	T178A58FC2C5060A13BBD3049DB590FF914DF3993AB9432DE7ABA7868141470E84FF9B66
Magika	autoit
Reporter	James_inthe_box
Tags:	exe FormBook vbs

Intelligence

---

File Origin

# of uploads :

5

# of downloads :

219

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/71166/

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a33e1011548daf709f796e0

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 evasive fingerprint masquerade obfuscated overlay powershell

Link:

https://www.filescan.io/uploads/6a33e0d162d0679105f7c339/reports/54c513d0-cda5-40f0-901e-a7d29f713ada/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text.utf8

First seen:

2026-06-18T07:21:00Z UTC

Last seen:

2026-06-20T09:13:00Z UTC

Hits:

~1000

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9/results?tab=lookup

Nucleon Malprob Benign

Score:

16%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9/

Neiki Family.FORMBOOK

Verdict:

Malicious

Threat:

Family.FORMBOOK

Link:

https://tip.neiki.dev/file/fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9

ReversingLabs TitaniumCloud Script-WScript.Trojan.Generic

Threat name:

Script-WScript.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-18 10:47:37 UTC

File Type:

Binary

AV detection:

6 of 23 (26.09%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7lb366wf4t6quccajbwuegakqq2qzd5dpgpb65li2azg5gbhzleq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

072001c16c0663baaefe3741453b288bf13f38e9faf43a693fae3bed70a6dfba

Formbook

072390f5cd7fcc48e7f9c622adadbb70e58ec12ec3740897ce267e075a27033e

Formbook

1dd645d051d6f65180033662ce1e9dbc1d5a28ec8bd3d1298746903d537cff38

Formbook

34176dbfc22053f8b953daa3176bd55ec642f8e23adfae9431b35e6d97d5984b

Formbook

7260bf9530e349bb1e8037739ca6ef4c28404f305f70f44087a6156f0c32c678

Formbook

788919bf34d3a23ab0480f0d86627aed25101822f71e0c0037f09b0ced427a5a

Formbook

92354fb4e971d88d3b4aee3e946ad8364f7a302de82acaa1ea7bcb233b2c463e

Formbook

ba6191d098d270dc482e37488db22600e3014b2ccbbd64eab9d259733aaa90d4

Formbook

cc9404c26313da4d1c83f107c793edd68da52378d48328d27da16ad72b51b4e3

Formbook

d6d6f9c0160cf7bfa97097f58f6acf8cafc8bd657b7aebbd326fea05e9bc3165

Formbook

error

Formbook

+ 144 additional samples on MalwareBazaar

Hatching Triage formbook

Result

Malware family:

formbook

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook execution rat spyware stealer trojan

Link:

https://tria.ge/reports/260618-pdt67ahw2y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: Formbook

Formbook payload

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://brenmayasociados.com/sass/optimized_MSIjune.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/71166/