Formbook - Malware Samples
500 samples tracked (rolling 30 days)
Last updated: 2026-08-14
This page lists the most recent Formbook malware samples collected from MalwareBazaar. Each entry includes the SHA256 hash (linked to the MalwareBazaar sample page), original file name, file type, size, and VirusTotal detection rate where available. Samples are updated daily and retained for a rolling 30-day window.
How to Use This Data
Security teams can use these hashes in several ways. Import them into your SIEM or EDR platform to detect known Formbook variants in your environment. Cross-reference file names against your email gateway logs to identify phishing campaigns delivering this family. The file type distribution reveals which delivery formats are currently in use - a shift from .exe to .msi or .js may indicate the operators are adapting to your defenses. Samples with low or missing VirusTotal detection rates are the most dangerous - these are fresh variants that may bypass signature-based protection.
About the Data
All samples are sourced from MalwareBazaar, a free malware sample sharing platform operated by abuse.ch. Detection rates come from VirusTotal. This data is provided for defensive purposes only. For the latest Formbook indicators of compromise including C2 servers and domains, see the IOC page.
| SHA256 | File Name | Type | Size | Detection | First Seen | Country |
|---|---|---|---|---|---|---|
| 4111e5a44a0f083a... | RFQ830082614.exe | exe | 1.0 MB | 38/70 | 2026-08-14 | - |
| 5bb5c4be630aeca4... | RFQ - 18360479.pdf.js | js | 3.1 MB | 13/60 | 2026-08-14 | - |
| 06fe9a22b45bfa76... | giqbdlhFITaorka.exe | exe | 1.1 MB | 51/70 | 2026-08-14 | - |
| a775b31dea57a96f... | MV_POAVOSA_WISDOM_III_SAILING_ORDERS_AND_VESSEL_DETAILSpdf.js | js | 3.0 MB | 28/57 | 2026-08-14 | - |
| 973cbcc0cedff496... | Uvozni dokumenti 13-08-26.js | js | 3.0 MB | 30/60 | 2026-08-13 | - |
| 5cb8d41ea10ce8e7... | SecuriteInfo.com.Trojan.Inject7.506.14826.15420 | exe | 295.0 KB | 53/70 | 2026-08-13 | - |
| 0cc6331d5f567d3a... | Booking_Req_136.vbs | vbs | 16.1 KB | 27/60 | 2026-08-13 | - |
| cec68e63576aa848... | RFQ.js | js | 89.5 KB | 10/60 | 2026-08-13 | - |
| 78201ddf22793ad4... | Proof of Payment.js | js | 3.0 MB | 25/60 | 2026-08-13 | - |
| 16413c926e25149b... | Swift 000640S3-XXX003.js | js | 5.9 MB | 22/60 | 2026-08-13 | - |
| 011ca806ac92b0f9... | PAGO_5350178.js | js | 949.1 KB | - | 2026-08-13 | - |
| ddda1600aca37013... | PAGO_9685.js | js | 952.5 KB | - | 2026-08-13 | - |
| 0f51115e67af4bbc... | BU560.js | js | 519.3 KB | - | 2026-08-13 | - |
| ebd9e7cb52ae723f... | SCANNED_HSBC AUSTRALIA CUSTOMER_PAYMENT_COPY.js | js | 3.0 MB | - | 2026-08-13 | - |
| 4a5de638f60fb03d... | PO 6395117.js | js | 3.0 MB | - | 2026-08-13 | - |
| 7e68d7a5f2575a4e... | Demurage Invoice 130826.js | js | 85.4 KB | - | 2026-08-13 | - |
| 4383105497e61d07... | preuve du paiement.js | js | 3.0 MB | - | 2026-08-13 | - |
| d7cae19dd4c3552a... | o96lDHvTo8XVhQE.exe | exe | 1.1 MB | - | 2026-08-13 | - |
| d1997a3d88d785e6... | RFQ 6000423118.exe | exe | 432.2 KB | - | 2026-08-13 | - |
| fac484c0ff243ee5... | BANK_PAYMENT_CONFIRMATION_RECEIPT_MT103.JS | js | 3.3 MB | - | 2026-08-13 | - |
| 1e7a0fb9d4821f2d... | Air Products Invoice 0436085385.vbe | vbe | 57.7 KB | - | 2026-08-13 | - |
| 223082d8fb6188b3... | RFQ No. 10542026..exe | exe | 386.8 KB | - | 2026-08-13 | - |
| 1e2d6c587dd68648... | SOAactstatement0072026.js | js | 3.0 MB | - | 2026-08-13 | - |
| 6db1729e39bac1b5... | rnovaordem_PDF.exe | exe | 1.1 MB | - | 2026-08-12 | - |
| bb036570b24bde4c... | CPGdQhrk0tr7B9h.exe | exe | 1.0 MB | - | 2026-08-12 | - |
| 21cb173c28396822... | SOA for Outstanding Invoices_pdf.js | js | 89.5 KB | - | 2026-08-12 | - |
| 703ef22683b3a6f2... | Swift-Receipt-TTUSD34,456-ref1208268650_pdf.js | js | 130.1 KB | - | 2026-08-12 | - |
| b82e00c9e5790937... | New_Booking_859_26.vbs | vbs | 16.1 KB | - | 2026-08-12 | - |
| 7e3e5ddd3ee64f1b... | Pago_436761.js | js | 943.7 KB | - | 2026-08-12 | - |
| 13ac73f4d4f28b8e... | SW_2752369.js | js | 957.1 KB | - | 2026-08-12 | - |
| 1e17f7e1abf637c2... | SCANNED_DOCUMENT_HSBC CUSTOMER_PAYMENT_COPY.js | js | 3.0 MB | - | 2026-08-12 | - |
| 29148aea579552e9... | PO 0582604-1.js | js | 3.0 MB | - | 2026-08-12 | - |
| b93c700ae326c52d... | MokkiHub-Company-Profile.js | js | 144.6 KB | - | 2026-08-12 | - |
| 247f6f51ba009d91... | Order-Mokki-ref8092687.js | js | 71.7 KB | - | 2026-08-12 | - |
| d26dc74cf790d8b8... | 103_FTX26222VADLV_4416371107.js | js | 958.0 KB | - | 2026-08-12 | - |
| 4aa15aa4be81be37... | 103_FTX26222VADLV_4416.js | js | 946.0 KB | - | 2026-08-12 | - |
| 00027cd3ed57fe8d... | (E9010450102) - PENGEMUKAAN DOKUMEN MAJIKAN BAGI TAHUN SARAAN 0050-E-MD-0013-00 -26--08-12.js | js | 71.7 KB | - | 2026-08-12 | - |
| 43ec2662d839781b... | MV_SEA_LADY_VESSEL_MAIN_INFORMATION.js | js | 3.0 MB | - | 2026-08-12 | - |
| 54f7a59d215988a0... | ITM00092928838.exe | exe | 472.8 KB | - | 2026-08-11 | - |
| 82bc1032c1493429... | 1-26-QTN-09345,pdf.js | js | 5.8 MB | - | 2026-08-11 | - |
| 7fbd90ecc017dddf... | Company-Profile-MokkiGroup.js | js | 131.5 KB | - | 2026-08-11 | - |
| a2ba9ad1392dcd7d... | Order-Mokki-ref26081107.js | js | 75.6 KB | - | 2026-08-11 | - |
| 9ca5f5aa2a2f99dc... | QtePage2.js | js | 1.0 MB | - | 2026-08-11 | - |
| 28ffd6cabaa73b27... | J6G5tzYJQyoHL3B.exe | exe | 1.0 MB | - | 2026-08-11 | - |
| a66979f3bd65f8c8... | Ziraat Bankasi Payment Confirmation Copy.js | js | 5.9 MB | - | 2026-08-11 | - |
| 54692596ddec105c... | 54692596ddec105cb0a4de07623bacd32fb45525b041114b71db1ceaa1a3e176.exe | exe | 978.0 KB | - | 2026-08-11 | - |
| 8f40a33bd4478332... | teklif talebi-boyahane-genel-kinetik.js | js | 75.6 KB | - | 2026-08-11 | - |
| 2b4f71088b02ab41... | PO_Eco-26081018EA1.rtf | rtf | 100.9 KB | - | 2026-08-11 | - |
| 4163def24e57962f... | MokkiHUb Company Profile.js | js | 131.5 KB | - | 2026-08-11 | - |
| c16cc7117f8f97f8... | Order-Spec-refMokki1182678.js | js | 75.6 KB | - | 2026-08-11 | - |
| d55fca68e795db96... | New_Booking_105_220.vbs | vbs | 15.9 KB | - | 2026-08-11 | - |
| b0ac5e4f010cc15a... | Ziraat Bankasi Payment Copy.js | js | 5.9 MB | - | 2026-08-11 | - |
| b46e4c8513419f18... | SWIFT_11082026_#MT1038025849_pdf.js | js | 75.6 KB | - | 2026-08-11 | - |
| 464ec2b347c0ed33... | DQUBE ORDER REQUEST QUOTATION.PDF.js | js | 5.9 MB | - | 2026-08-11 | - |
| fcb005ac3f9585d1... | rcius mop110136722-0810.js | js | 3.0 MB | - | 2026-08-11 | - |
| fe3ffcb9a7b29dc9... | DQUBE ORDER REQUEST QUOTATION.PDF.js | js | 2.8 MB | - | 2026-08-11 | - |
| 4371260390a2c516... | Whatssap Image.jpg 11-8-26.js | js | 5.0 MB | - | 2026-08-11 | - |
| 739636a908792585... | C-Invoice-PackingList-COO.js | js | 131.5 KB | - | 2026-08-11 | - |
| 75896cc1dbab79bb... | Draft-BL-MEDUxxx862.js | js | 60.8 KB | - | 2026-08-11 | - |
| d9a7a6090b1e0e21... | Orden de compra 896.js | js | 5.9 MB | - | 2026-08-11 | - |
| d8af1c881296aa08... | COTIZACIÓN_0433.js | js | 929.8 KB | - | 2026-08-11 | - |
| 9e90cc3386c57560... | COTI_384526.js | js | 929.4 KB | - | 2026-08-11 | - |
| 01cc5dd1a9084645... | Booking_00120.vbs | vbs | 15.8 KB | - | 2026-08-11 | - |
| 440bc573a02ba11f... | PSV TECHNICAL DATASHEET.js | js | 60.8 KB | - | 2026-08-11 | - |
| f376bc73f8923ebe... | MV_SEA_LADY_VESSEL_MAIN_PARTICULARSpdf.js | js | 2.8 MB | - | 2026-08-11 | - |
| f47dbb997d68ec12... | 724826.vbs | vbs | 34.4 KB | - | 2026-08-10 | - |
| 65dbe21962f1ecd8... | SecuriteInfo.com.Variant.Yogi.44771.23588.21930 | exe | 692.9 KB | - | 2026-08-10 | - |
| 9b1b95c4aacfc7ac... | 9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5 | exe | 310.5 KB | - | 2026-08-10 | - |
| eb1b424a41a5d8e0... | eb1b424a41a5d8e02ad74d0446738038ff3251f4e58f0605546dd00cbbd1d158 | exe | 1.0 MB | - | 2026-08-10 | - |
| af422171aae6f313... | af422171aae6f3132d3ed234616a19fc51b524968599fcfde9e05e81a6e5ab79 | exe | 1006.0 KB | - | 2026-08-10 | - |
| e8783275d1135e52... | e8783275d1135e522355850d43355952456b51b4bd671c4e148bf03fef7ccfe6 | exe | 986.5 KB | - | 2026-08-10 | - |
| c000b2fffd6d6f55... | c000b2fffd6d6f552f2ec347dcd6c4e12409cf7207c27407225164e010d8c21e | exe | 1.0 MB | - | 2026-08-10 | - |
| 6ba7f0ca733d826c... | 6ba7f0ca733d826c160f4ad7a8e49b3ff673defb477c47b0621b048baac67450 | exe | 1002.5 KB | - | 2026-08-10 | - |
| 673b0804edc54bb4... | 673b0804edc54bb48d24da3e6fccdcf193b737bbf28ca448e215c1c63d5acb0c | exe | 1002.0 KB | - | 2026-08-10 | - |
| b2346b21db6c58f4... | b2346b21db6c58f44a5da13d29d923b939cf01ecc0ea7b0f786c739d8285cfd6 | exe | 991.0 KB | - | 2026-08-10 | - |
| ce53d11110c1db9c... | ce53d11110c1db9c7b25b09d4209cbefb80f241b6faa1289c6f2d620d576790a | exe | 457.5 KB | - | 2026-08-10 | - |
| efbdd2173551cae0... | efbdd2173551cae0bb7f56fcb88a0340fee48e4bd4fca88daf3c1ab7c96a4cf9 | exe | 1002.5 KB | - | 2026-08-10 | - |
| ba90ce18dd03a8c6... | ba90ce18dd03a8c6c51f608b926dfc27bb89af9eeb611be9b36592c81652dc92 | exe | 990.5 KB | - | 2026-08-10 | - |
| 38769a2e4f94e3b6... | 38769a2e4f94e3b64653527637ba7d977a607577c4ef056629f1cd83480a8fcb | exe | 985.0 KB | - | 2026-08-10 | - |
| 727a57b900d1a2c8... | 727a57b900d1a2c8ad8100fe1eda2f0fd4ff0b15297911293b80b396e5c1ea7b | exe | 1.0 MB | - | 2026-08-10 | - |
| 69a1769374132e96... | 69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd | exe | 1.1 MB | - | 2026-08-10 | - |
| 2598b0f8297dc652... | 2598b0f8297dc652e3fe52b3912895d9f81f6435ba0f7ffa00d71c491fc914a7 | exe | 988.0 KB | - | 2026-08-10 | - |
| 11f3ef4344774c9a... | 11f3ef4344774c9a0490b077ed446f7be49ade73a0072682c921e5166ee24c2b | exe | 978.5 KB | - | 2026-08-10 | - |
| f9c76fc04dd298b1... | f9c76fc04dd298b12cbc96f5e9ad7ddd24f5aa8842f466a5747f11894d87b9cc | exe | 1.1 MB | - | 2026-08-10 | - |
| 566496a5d069886d... | 566496a5d069886d1125076b4b9d0f728c306cc6989842daddadbe53db691e16 | exe | 281.0 KB | - | 2026-08-10 | - |
| e768cc4262f2d9c1... | e768cc4262f2d9c12b81a822ab4319c9db377848960fd798230f0ded13159615 | exe | 1.1 MB | - | 2026-08-10 | - |
| 3a96f25feefbab52... | 3a96f25feefbab52042aa5768020b128bdb7231cb3f8114a01fe23e6c873071d | exe | 1.1 MB | - | 2026-08-10 | - |
| d2910ae06e748f28... | d2910ae06e748f283a4ecc4826a4ae03f9c4d52bcabdf5a9053a7e1f4536533f | exe | 1.1 MB | - | 2026-08-10 | - |
| 7d4ca6eefe896481... | 7d4ca6eefe89648114310a5b13c0134976dc7975bd03a17cc5e397548808d037 | exe | 1.1 MB | - | 2026-08-10 | - |
| c9c875dea57d0a64... | c9c875dea57d0a648e55b0b178bf5aa37465bca4c5d00f5b21ba1069e28a30ee | exe | 278.0 KB | - | 2026-08-10 | - |
| 18f6d316d88055a2... | 18f6d316d88055a24c76b9a548ed4510819228c9fca2b3ba681a5c4a0e63ff08 | exe | 1.0 MB | - | 2026-08-10 | - |
| f3cfcbd8c2d33128... | f3cfcbd8c2d33128a836f891791a1743c427f321f538dc208521c371edd03d7f | exe | 279.0 KB | - | 2026-08-10 | - |
| 6e8536a9357f44f3... | 6e8536a9357f44f364359022cae1f4e6bca7737bfee92508a769dae863064cec | exe | 276.0 KB | - | 2026-08-10 | - |
| 389693bb8dc83ab5... | 389693bb8dc83ab540ce9eac5da510d10e1ae85cccc24d95e60d1a3216f6ec3a | exe | 1.1 MB | - | 2026-08-10 | - |
| 23a8568003768b2f... | 23a8568003768b2f4e2fc3bd47a6d6d054c11ce622737d27df4c4f1bb0c28146 | exe | 277.5 KB | - | 2026-08-10 | - |
| 7cf341abc47c1aff... | 7cf341abc47c1aff8deccb0f1689e21d98b29218f25540eba47af269e569f1cb | exe | 1.1 MB | - | 2026-08-10 | - |
| 2dbd20c97b10c76a... | 2dbd20c97b10c76aefdc90737cb8597ddef34f925d1ae347d2bb52f284db1632 | exe | 1.1 MB | - | 2026-08-10 | - |
| 983138aaea5f4123... | 983138aaea5f4123933dc6f0ca33e35e9a087c5e8cc20e6bd118a7cd56981f32 | exe | 1.0 MB | - | 2026-08-10 | - |
| e457fb605f567508... | e457fb605f56750833b4395f6dfe0bd8a200eeb15ce162bc58a31b6e066a1fd3 | exe | 1.0 MB | - | 2026-08-10 | - |
| aa07032bf63046cc... | aa07032bf63046cc3c2316990ab31d20d861ada7f77d96356f83bcceef4487ec | exe | 1.1 MB | - | 2026-08-10 | - |