Formbook - Malware Samples
500 samples tracked (rolling 30 days)
Last updated: 2026-10-02
This page lists the most recent Formbook malware samples collected from MalwareBazaar. Each entry includes the SHA256 hash (linked to the MalwareBazaar sample page), original file name, file type, size, and VirusTotal detection rate where available. Samples are updated daily and retained for a rolling 30-day window.
How to Use This Data
Security teams can use these hashes in several ways. Import them into your SIEM or EDR platform to detect known Formbook variants in your environment. Cross-reference file names against your email gateway logs to identify phishing campaigns delivering this family. The file type distribution reveals which delivery formats are currently in use - a shift from .exe to .msi or .js may indicate the operators are adapting to your defenses. Samples with low or missing VirusTotal detection rates are the most dangerous - these are fresh variants that may bypass signature-based protection.
About the Data
All samples are sourced from MalwareBazaar, a free malware sample sharing platform operated by abuse.ch. Detection rates come from VirusTotal. This data is provided for defensive purposes only. For the latest Formbook indicators of compromise including C2 servers and domains, see the IOC page.
| SHA256 | File Name | Type | Size | Detection | First Seen | Country |
|---|---|---|---|---|---|---|
| 140a2b7ff0068183... | svchost.exe | exe | 280.5 KB | 57/71 | 2026-10-02 | - |
| 3346fb7e363282a6... | ORDER#02102026-79065.PDF.vbs | vbs | 812.2 KB | 34/61 | 2026-10-02 | - |
| 3d9749403fa06f24... | HSBC_Payment_Receipt.com | exe | 806.5 KB | 47/71 | 2026-10-02 | - |
| 28834a0b5162d580... | New_Order0732_Quotation_Forms.js | js | 2.0 MB | 16/36 | 2026-10-02 | - |
| 873f978003b2aafd... | 873f978003b2aafd389abe461197a730223a5b3bf48e86145f8f76216550a507.bin | ps1 | 2.2 MB | 7/59 | 2026-10-02 | - |
| f49e801931d8bece... | f49e801931d8bece12769f4c585c2cf1c83e116c4cc2d28fdd05c10374699bc4.bin | ps1 | 1.5 MB | 6/61 | 2026-10-01 | - |
| cedc91f67010cb67... | cedc91f67010cb67ce64cf44f8164d0f7ed3b683fb0b341d3bf3496a464b1263.bin | ps1 | 1.5 MB | 6/61 | 2026-10-01 | - |
| b08c1c00c075cbad... | b08c1c00c075cbada18a85e77b2f2796ebc11d480ef4c1faf26f489f787ddec4.bin | ps1 | 1.5 MB | 6/61 | 2026-10-01 | - |
| e380ccc60436da1b... | e380ccc60436da1b923f33e332c3a1a038b220a7510d4fa07fd3a61ce3e93689.bin | ps1 | 1.5 MB | 5/61 | 2026-10-01 | - |
| 432c16188c7eb814... | image 2.vbe | vbe | 3.5 KB | 11/61 | 2026-10-01 | - |
| ef880c86329f7451... | Swift_USD56900.JS | js | 2.6 MB | - | 2026-10-01 | - |
| 279299b8f14b03fb... | USD 711,560.72.js | js | 2.0 MB | - | 2026-10-01 | - |
| 3d3ef1abccd97eaf... | Swift 000840S3409XXX.js | js | 2.0 MB | - | 2026-10-01 | - |
| cf7226916e45ace0... | BOQ -Attched.js | js | 21.6 KB | - | 2026-10-01 | - |
| a9f1633d2d13a34c... | ORDER LIST LABASA 30TH SEPTEMBER 2026.js | js | 2.0 MB | - | 2026-10-01 | - |
| 99b3ec583d1f54e6... | Image BOQ 01-10-26 Specification 0000000.js | js | 21.0 KB | - | 2026-10-01 | - |
| 40c8318094909626... | SW_628811.JS | js | 3.3 MB | - | 2026-10-01 | - |
| 6c49b15e013bf00d... | AW_ORDER_.JS | js | 3.2 MB | - | 2026-10-01 | - |
| 7567d16b1fe03f1e... | ORDER LIST LABASA 30TH SEPTEMBER 2026.js | js | 2.0 MB | - | 2026-10-01 | - |
| 289cb3470cadba69... | πληρωμή_9723.JS | js | 3.3 MB | - | 2026-10-01 | - |
| 16e8ca6832fd9580... | image.js | js | 32.5 KB | - | 2026-10-01 | - |
| 33fe8e44bb2d5f66... | Image BOQ 01-10-26.js | js | 32.5 KB | - | 2026-10-01 | - |
| 2556b5d44b0d1fb0... | Penawaran Harga.pdf.js | js | 21.1 KB | - | 2026-10-01 | - |
| 67dd478f8c69df95... | Documents.JS | js | 3.3 MB | - | 2026-10-01 | - |
| db47c4ee320a21f6... | Purchase Order PO-580133429.exe | exe | 801.0 KB | - | 2026-10-01 | - |
| 786169a79bb50577... | mv TOI CHALLENGER SHIP INFORMATION.com | exe | 834.0 KB | - | 2026-10-01 | - |
| 3bb89c9e7eff35cd... | Q88_Manas_2026.01.10.com | exe | 827.0 KB | - | 2026-10-01 | - |
| 4cbe69952f8dd01c... | rpedidodeprojeto_PDF.exe | exe | 792.5 KB | - | 2026-09-30 | - |
| 477f0cb821df2882... | Invoice – IALOPC342526-279302670s1.js | js | 735.6 KB | - | 2026-09-30 | - |
| 391cb28f1589928e... | 1C26TAP_00011607.js | js | 2.0 MB | - | 2026-09-30 | - |
| 0095985a94e54846... | Quotation - PO#1524701080 pdf.js | js | 2.0 MB | - | 2026-09-30 | - |
| b751262481492cfa... | COTIZACIÓN_5726527.js | js | 799.2 KB | - | 2026-09-30 | - |
| 1c8b03161f31aa38... | DHL_Express_Kontaktni_Formular_a_AWB_236-47892145.pdf.js | js | 2.0 MB | - | 2026-09-30 | - |
| 516d6b7a4f5eab11... | FİYAT İSTEĞİ HK..bat | exe | 797.0 KB | - | 2026-09-30 | - |
| ace240c21c6b8712... | TEKLİF FORMU 30.09.2026.exe | exe | 840.0 KB | - | 2026-09-30 | - |
| e088d53914498cb5... | img_30939590395930950930.hta | hta | 14.7 KB | - | 2026-09-30 | - |
| 6cd3384dcd0e66c1... | IRICOX--XINVXIN-7016-D-003.exe | exe | 899.0 KB | - | 2026-09-30 | - |
| 5ecfc1826938bf3f... | Invoice_and_Packing_List.js | js | 2.0 MB | - | 2026-09-30 | - |
| 7e25b5c8110ed1d0... | myCRYPTED_STUB.ps1 | ps1 | 2.2 MB | - | 2026-09-29 | - |
| 74d03fc1f9576464... | AES_ExportBegleitDokument_21bf6a8f-71c8 CMR Versandpapiere Galeri TR TP 52646.wsf | wsf | 28.6 KB | - | 2026-09-29 | - |
| dc5021a0e1d00fb1... | 248903376886823-051555-sanlccjavap29-09-26.pdf.exe | exe | 420.8 KB | - | 2026-09-29 | - |
| e44869eb433cab78... | AES_ExportBegleitDokument_21bf6a8f-71c8 CMR Versandpapiere Galeri TR TP 52646.js | js | 22.8 KB | - | 2026-09-29 | - |
| fb8eb3f18143e414... | TEKNİK RESİM BİLGİ SAYFASI 7953-0053_110_AA 9100052982.wsf | wsf | 23.1 KB | - | 2026-09-29 | - |
| 12c1bd2c203bde00... | Invoice_Packing_List.com | exe | 795.5 KB | - | 2026-09-29 | - |
| 9e9aad5520f90fb8... | image_00040404.jpg.hta | hta | 14.5 KB | - | 2026-09-29 | - |
| d07b2660e7812ed8... | MCRYPTED_STUB.ps1 | ps1 | 2.2 MB | - | 2026-09-29 | - |
| 791aef7c4b22b3b7... | 791aef7c4b22b3b7aa930d54734be059587b7ceae735279fdd076373506284a3.bin | ps1 | 2.2 MB | - | 2026-09-29 | - |
| ebcb18de01e4dc24... | Teklif Talebi 1540-0092RFQ26_202606100623256209 .js | js | 28.3 KB | - | 2026-09-29 | - |
| 64752b6c1a67a900... | Request for Quotation (RFQ) - procurement Prima Energy Northwest Natuna Pte., Ltd.xls | xls | 606.0 KB | - | 2026-09-29 | - |
| fb370476092e61c5... | fb370476092e61c556c479e0d20ce7ceb2c6f298423131a5206cf31ab740cb5f.bin | ps1 | 2.2 MB | - | 2026-09-29 | - |
| 28e18f02bd5bf443... | Teklif Talebi Bildirimi - 1540-0092RFQ26_202606100623256209 .wsf | wsf | 28.6 KB | - | 2026-09-29 | - |
| ec643228b9baf53e... | Purchase Order PO-000806758.bat | exe | 822.5 KB | - | 2026-09-29 | - |
| 36b408e6bc25bf6c... | PI.js | js | 26.6 KB | - | 2026-09-29 | - |
| 1a9fab97d323289a... | Payment advice.vbe | vbe | 3.5 KB | - | 2026-09-29 | - |
| cd94e9870014616e... | NOTIS PERINGATAN BERKAITAN KEGAGALAN MEMBAYAR KESELURUHAN CUKAI TERMASUK PENALTI DI BAWAH AKTA CUKAI PERKHIDMATAN 2018.js | js | 28.3 KB | - | 2026-09-29 | - |
| a9ad7ad21d6b5b33... | ePL_290926_4849.wsf | wsf | 28.6 KB | - | 2026-09-29 | - |
| ec4e5a7900d98e13... | Bank_Payment_receipt.com | exe | 930.0 KB | - | 2026-09-29 | - |
| f837deeca3a41c9c... | stub.exe | exe | 281.3 KB | - | 2026-09-28 | - |
| da76eb3b0e04f01c... | quotation copy.com | exe | 1.0 MB | - | 2026-09-28 | - |
| acc82d5cf6e8bcbf... | Request for Quotation.com.exe | exe | 1.0 MB | - | 2026-09-28 | - |
| 84be1faa831352c0... | AES_ExportBegleitDokument_21bf6a8f-71c8 CMR Versandpapiere Galeri TR TP 52646.exe | exe | 784.5 KB | - | 2026-09-28 | - |
| ab72487522dab964... | Letter of Intent to Purchase 2026.com | exe | 805.0 KB | - | 2026-09-28 | - |
| 21b4ae3cb4d48b4f... | teklif şartname-2.bat | exe | 798.5 KB | - | 2026-09-28 | - |
| 08edc0df73427e60... | Purchase order.exe | exe | 1.0 MB | - | 2026-09-28 | - |
| e0ef951cc57b26c0... | DOC-30240028-WA0026_pdf.js | js | 135.2 KB | 5/61 | 2026-08-30 | - |
| 289f90256c209b6c... | Halkbank,doc.exe | exe | 1018.5 KB | 53/70 | 2026-08-28 | - |
| ee1ea484d5500605... | 品訂單 (PO00920388) - 詢價。.js | js | 141.7 KB | 8/60 | 2026-08-28 | - |
| f8b0a602b00b06a9... | Ziraat Bankasi Swift Mesaji.JS | js | 1.2 MB | 11/60 | 2026-08-28 | - |
| 9802baffac7cebad... | Draft copy Documents RefNo49805 Pdf.js | js | 578.0 KB | 22/60 | 2026-08-28 | - |
| 1ae4caa3d772e6d2... | HSBC PAYMENT RECEIPT MT103.JS | js | 1.5 MB | 11/60 | 2026-08-28 | - |
| 5dc16448032c1144... | Cotización_5723.js | js | 1.2 MB | 14/60 | 2026-08-28 | - |
| 7d3931057e837a93... | Draft copy Documents RefNo00940421940 Pdf.js | js | 584.2 KB | 26/60 | 2026-08-28 | - |
| 94a33fc48ecb5040... | Solenis RFQ-BID--870994965701.exe | exe | 902.0 KB | 50/70 | 2026-08-28 | - |
| a2fc3ab543e72dec... | Purchasing Order Required Specification RQTC1FWfMShV.exe | exe | 1.0 MB | 48/70 | 2026-08-28 | - |
| 58b4786146d1aa9f... | comprobante_transferencia_27-ago-2026_13_02_40.pdf.js | js | 897.4 KB | - | 2026-08-27 | - |
| aa9879b41c127636... | ADIPEC 2026 PO98476745.exe | exe | 903.0 KB | - | 2026-08-27 | - |
| c2ece48aa2e7b959... | file | exe | 1.2 MB | - | 2026-08-27 | - |
| 6bde014a76cd6cbe... | file | exe | 1.1 MB | - | 2026-08-27 | - |
| 9ea60920a0811f06... | Ziraat Bankasi Swift Mesaji.pdf.JS | js | 1.2 MB | - | 2026-08-27 | - |
| 851de006597d4b84... | DOC-20240428-WA000026_pdf.js | js | 586.2 KB | - | 2026-08-27 | - |
| 6cec13db8c819c95... | PO 26-01081.js | js | 606.6 KB | - | 2026-08-27 | - |
| 9a961c65027a2113... | crypted.ps1 | ps1 | 2.1 MB | - | 2026-08-27 | - |
| ea810de463883ddc... | crypted.ps1 | ps1 | 2.1 MB | - | 2026-08-27 | - |
| f0631a2bf108cef1... | doc-BSFACTURA-002836-Sabadell-2026-08-27-pdf200829.js | js | 610.7 KB | - | 2026-08-27 | - |
| 30d7ec130e692f74... | po.js | js | 2.9 MB | - | 2026-08-27 | - |
| cc9b6a5d4967278c... | SC0449210000383905874.exe | exe | 919.5 KB | - | 2026-08-27 | - |
| 56e1d6bef47aedb3... | HOTLINE TRADING EST SOA.exe | exe | 278.0 KB | - | 2026-08-27 | - |
| 38abdab6df0f8820... | Company-Profile.vbe | vbe | 67.7 KB | - | 2026-08-27 | - |
| 4727cb5c0619c876... | HSBC PAYMENT RECEIPT MT103.js | js | 576.0 KB | - | 2026-08-27 | - |
| b8bb7578b0be7d0b... | Order-ref27082607.js | js | 172.1 KB | - | 2026-08-27 | - |
| 92ed9e1345402798... | Customs.js | js | 2.9 MB | - | 2026-08-27 | - |
| 693c0f6e52c3f7ed... | New-Order-ref2608470.js | js | 2.9 MB | - | 2026-08-27 | - |
| e4e8681f4bdd93b0... | crypted.ps1 | ps1 | 2.1 MB | - | 2026-08-27 | - |
| 40c3326300db9e0e... | Purchasing Order Required Specification RQTCTPMDWXX.exe | exe | 1.0 MB | - | 2026-08-27 | - |
| 7fed01344fe28b74... | Orden de Compra_PO 65092692.jpg.js | js | 959.8 KB | - | 2026-08-26 | - |
| 5d9d3d0e80ef2f08... | Purchase Order.exe | exe | 1022.5 KB | - | 2026-08-26 | - |
| f97cf93357e85510... | Ziraat Bankasi Swift Mesaji.pdf.JS | js | 1.2 MB | - | 2026-08-26 | - |
| f2474cc8073b759d... | doc0082620260000826.JS | js | 4.0 MB | - | 2026-08-26 | - |
| 3b364ae8f741a449... | IREM - Richiesta d'offerta A294.js | js | 573.3 KB | - | 2026-08-26 | - |
| b08cf1ed811afc66... | RFQ-New_Order-ref26093740-Sept.js | js | 97.8 KB | - | 2026-08-26 | - |