Formbook - Malware Samples
500 samples tracked (rolling 30 days)
Last updated: 2026-06-26
This page lists the most recent Formbook malware samples collected from MalwareBazaar. Each entry includes the SHA256 hash (linked to the MalwareBazaar sample page), original file name, file type, size, and VirusTotal detection rate where available. Samples are updated daily and retained for a rolling 30-day window.
How to Use This Data
Security teams can use these hashes in several ways. Import them into your SIEM or EDR platform to detect known Formbook variants in your environment. Cross-reference file names against your email gateway logs to identify phishing campaigns delivering this family. The file type distribution reveals which delivery formats are currently in use - a shift from .exe to .msi or .js may indicate the operators are adapting to your defenses. Samples with low or missing VirusTotal detection rates are the most dangerous - these are fresh variants that may bypass signature-based protection.
About the Data
All samples are sourced from MalwareBazaar, a free malware sample sharing platform operated by abuse.ch. Detection rates come from VirusTotal. This data is provided for defensive purposes only. For the latest Formbook indicators of compromise including C2 servers and domains, see the IOC page.
| SHA256 | File Name | Type | Size | Detection | First Seen | Country |
|---|---|---|---|---|---|---|
| d9460d9ceadf0347... | ADCB_PAYMENT_COPY_PDF.bat | bat | 184.6 KB | 18/59 | 2026-06-26 | - |
| 33522ec6cd83ae54... | ARIBA_CONTRACT_ADNOC_INVOICE_PDF.bat | exe | 991.0 KB | 49/70 | 2026-06-26 | - |
| fdcb54b77eee41b9... | Doc 24.06.26.js | js | 71.6 KB | 31/60 | 2026-06-25 | - |
| b710e94d81dab660... | 09786y7662026-DMS108997.bat | exe | 1.0 MB | 33/70 | 2026-06-24 | - |
| 0e44300f6f2d8f1d... | ProformaInvoice-5628.vbs | vbs | 2.5 MB | 14/61 | 2026-06-24 | - |
| 69642cd14966d9ab... | Supplier Evaluation Form-Hilteks.bat | exe | 1.0 MB | 52/70 | 2026-06-24 | - |
| c5c2c8515c39bb07... | MAERSK FELIXSTOWE - MF-E-26-024~028.exe | exe | 1.0 MB | 53/70 | 2026-06-24 | - |
| 2882e8c9aba470c8... | Payment_Invoice_Swift_pdf.js | js | 1.5 MB | 27/60 | 2026-06-24 | - |
| 6ad2118a59a80e57... | Makluman Tawaran Baru Dibuka oleh JABATAN PENGURUSAN SISA PEPEJAL & KESIHATAN PERSEKITARAN.js | js | 70.4 KB | 22/59 | 2026-06-24 | - |
| c8ecede68b9b5cec... | RFQDMBU0083 - SPECIFICATION.js | js | 1.9 MB | 27/60 | 2026-06-24 | - |
| d34d42aa33ae8ec4... | ProformaInvoice-5628-1.vbs | vbs | 1.8 MB | - | 2026-06-23 | - |
| 97894eccb6b591f2... | Purchasing Order required Specification.exe | exe | 1.1 MB | - | 2026-06-23 | - |
| de63935f2c7f1302... | INVOICE-FEB-MAY 00938947484.exe | exe | 1.1 MB | - | 2026-06-23 | - |
| 1178b301d128edce... | SK-69430825194038-.js | js | 1.9 MB | - | 2026-06-23 | - |
| cbcfbe367b0e6d08... | DOKUMEN PENGIRIMANsF.js | js | 1.9 MB | - | 2026-06-23 | - |
| ce7675698547d31f... | InquiryQU040526_pdf.js | js | 1.9 MB | - | 2026-06-23 | - |
| 39efe6ed5f42ff06... | Payment-7384.js | js | 1.8 MB | - | 2026-06-23 | - |
| 0e4a82606b479a77... | Request for Quotation _RFQ_FOET_ME_2026_9.js | js | 44.8 KB | - | 2026-06-23 | - |
| 9a5aa62c26a2d64b... | QT LVFX RTX _ pdf.JS | js | 3.9 MB | - | 2026-06-22 | - |
| 6f3cfd2058f91f14... | 260621 1TO64XW790476015120 -Price Offer.js | js | 1.9 MB | - | 2026-06-22 | - |
| ff46cc264bc2f185... | S.O.A_ 21-06-26.js | js | 1.9 MB | - | 2026-06-22 | - |
| 651efc60866c39cc... | doc.js | js | 1.9 MB | - | 2026-06-22 | - |
| c9914dfb295d673c... | Purchase ORDER PB 2400I TP1026230.hta | hta | 36.0 KB | - | 2026-06-22 | - |
| 28daa7354a3ae40d... | Payment copy (HSBC A2rKEW3FwXGU).js | js | 1.3 MB | - | 2026-06-22 | - |
| 55d983dd42592c18... | IMG_8920.js | js | 71.3 KB | - | 2026-06-22 | - |
| e55968141708af19... | Yeni Talep Duco_Nq.s.js | js | 1.9 MB | - | 2026-06-22 | - |
| efdaf4ed6f70941f... | report.pdf.js | js | 1.9 MB | - | 2026-06-22 | - |
| 71d9a2e4e87f95f3... | swift.js | js | 71.8 KB | - | 2026-06-22 | - |
| 331712785d2f4d9f... | Purchase Order_Data sheet for 20ft.js | js | 1.5 MB | - | 2026-06-22 | - |
| d43766bcc8d45cb5... | Flexy_startup.js | js | 1.9 MB | - | 2026-06-22 | - |
| 214de53f2e06cc87... | Account Statement 0220626.vbs | vbs | 1.8 MB | - | 2026-06-22 | - |
| cc9dfcca94f44e8e... | ProformaInvoice-WES 5628-1.vbs | vbs | 2.2 MB | - | 2026-06-22 | - |
| 8b9e4f92bb9551e0... | 952203.vbs | vbs | 191.7 KB | - | 2026-06-22 | - |
| 9d16b4e2e2852fde... | Letter of Intent(LOI) Document.bat | exe | 1.1 MB | - | 2026-06-22 | - |
| 89d12a60639016a1... | RFQ(F100)-05-400030.pdf.JS | js | 3.9 MB | - | 2026-06-22 | - |
| 5c75f8db41424705... | 1. GTC Procurement of GOODS_R.js | js | 107.7 KB | - | 2026-06-22 | - |
| 77276fd72e3394ab... | HSBC_PAYMENT_ADVICEpdf.js | js | 1.9 MB | - | 2026-06-22 | - |
| 626f2311154e7a07... | PI pdf.bat | bat | 421.7 KB | 31/60 | 2026-06-19 | - |
| f7accd662f00c8cf... | Statement_of_Accountpdf.js | js | 1.9 MB | 24/58 | 2026-06-19 | - |
| 147ac0fd88b0a7d9... | KBOBI2KJ.ps1 | ps1 | 1.4 MB | 23/60 | 2026-06-18 | - |
| 1797f76fed29dfe0... | dwg101330816.bat | exe | 1004.5 KB | 50/69 | 2026-06-18 | - |
| fac3bf7ac5e4fd0a... | Proforma Invoice 5628-1.vbs | vbs | 2.0 MB | 19/59 | 2026-06-18 | - |
| 3d5866fc83f0bba0... | RFQ Specification.js | js | 31.8 KB | 13/59 | 2026-06-18 | - |
| b0907be21611ebfd... | PURCHASE_ORDER0923118765pdf.bat | exe | 986.5 KB | 44/62 | 2026-06-18 | - |
| a3298ebf883d48e6... | Products Specifications - PO110692.js | js | 71.7 KB | 28/59 | 2026-06-17 | - |
| ab6d741ca89e409b... | REQUEST FOR QUOTATION_ PURCHASE OF PROJECT MATERIALS CLOSING DATE 17062026.js | js | 2.8 MB | 21/46 | 2026-06-17 | - |
| cc9bfcef74068157... | po0923118765pdf.js | js | 2.9 MB | 27/57 | 2026-06-17 | - |
| f424ff410507bf45... | SPECIFICATIONS.js | js | 33.7 KB | - | 2026-06-17 | - |
| 43a2ea2404672eb1... | AWB.SF0254761508620pdf.exe | exe | 1012.0 KB | - | 2026-06-17 | - |
| b4e7a3375a80a0da... | New Quote.exe | exe | 1.2 MB | - | 2026-06-16 | - |
| f1e1aa06c3793b8e... | VESSEL_INFORMATION_DETAILSpdf.exe | exe | 1.0 MB | - | 2026-06-16 | - |
| 59320d6b1c1e96f3... | MV_NM_SAKURA_PRE_ARRIVAL_DOCpdf.bat | exe | 1.0 MB | - | 2026-06-16 | - |
| 7e9b6481033ae247... | BULK_EUROPA-2_SAILING_ORDERS_VESSEL_PARTICULARSpdf.exe | exe | 1.0 MB | - | 2026-06-16 | - |
| a1c41f9aec30973d... | PM114079-990528pdf.exe | exe | 1.0 MB | - | 2026-06-16 | - |
| bbfde2345d2d771f... | 嘉能可 (Glencore) 询价单号 #7GC-2026042.js | js | 2.8 MB | - | 2026-06-15 | - |
| 54417e3e4d738422... | PO2601853.js | js | 29.7 KB | - | 2026-06-15 | - |
| 6e5745c46906bf94... | DOCS PN NAS1611-327.pdf.JS | js | 3.9 MB | - | 2026-06-15 | - |
| 9a2833c6b35cf4b4... | scan copy 190806.js | js | 71.1 KB | - | 2026-06-15 | - |
| cf1a7d6182e95a60... | Specs_QU150626.js | js | 2.8 MB | - | 2026-06-15 | - |
| bd9c72e5581e091b... | New Order inquiry.JS | js | 3.9 MB | - | 2026-06-15 | - |
| 681e078fc513b1fc... | shipping documents pdf.JS | js | 3.9 MB | - | 2026-06-15 | - |
| 7b52e0606944e8c9... | Nostro Ordine 264418 pdf.js | js | 2.8 MB | - | 2026-06-15 | - |
| 828a964a4eeb55c2... | HSBC_PDF_SWIFT_COPY.js | js | 779.9 KB | - | 2026-06-15 | - |
| b95285ef988a8f6a... | FedEx_invoice.pdf.js | js | 14.3 MB | - | 2026-06-15 | - |
| 824d39d6d2d09c01... | Bill off Lading Document.vbs | vbs | 2.0 MB | - | 2026-06-15 | - |
| 1db883f47e2ab7c6... | PO#K260519-KOR-01.vbs | vbs | 326.7 KB | - | 2026-06-15 | - |
| 7f90a5b38e271f11... | Bill of Lading Document.vbs | vbs | 2.0 MB | - | 2026-06-15 | - |
| efe40c6e16536400... | FedEx_invoice.pdf.vbs | vbs | 14.4 MB | - | 2026-06-15 | - |
| 3ae0a2cd16d28c90... | Copia di Attachment to MOM_270526_xls.vbs | vbs | 349.5 KB | - | 2026-06-15 | - |
| df6ce4093ece9eb4... | Quotation.scr | exe | 1.1 MB | - | 2026-06-15 | - |
| 96c45fa9e609f433... | Shipment Notification doc 2348703711.exe | exe | 1.1 MB | - | 2026-06-15 | - |
| 97d38f358fcd1829... | TAM0018.JS | js | 3.9 MB | - | 2026-06-15 | - |
| 1068b6049165dfad... | QUOTATION.exe | exe | 1.0 MB | - | 2026-06-15 | - |
| 33a8656f24e3e1fa... | 473441.vbs | vbs | 178.2 KB | - | 2026-06-15 | - |
| c48b4f43a3e30194... | SPECIFICATIONS.js | js | 29.7 KB | - | 2026-06-15 | - |
| 772b1228f031de8d... | RFQX11062026.zip | zip | 19.8 KB | 30/63 | 2026-06-12 | - |
| 4d0553443e7b38a2... | OrderXno.X3241688.rar | rar | 7.1 KB | 31/60 | 2026-06-12 | - |
| 6c417a7be904852d... | DOWNXPAYMENTXCOPY_20260510_160955_0000.rar | rar | 843.5 KB | 34/46 | 2026-06-12 | - |
| 7caff20c50d04bc0... | SWIFTXUSDX22.496,32X20261032254113.rar | rar | 7.2 KB | 32/61 | 2026-06-12 | - |
| dcea95d8021d391a... | NewXQuote.rar | rar | 802.9 KB | 47/63 | 2026-06-12 | - |
| 39603c646ed7cc71... | New Quote.com | exe | 1.3 MB | 46/69 | 2026-06-12 | - |
| d6d6f9c0160cf7bf... | RFQ 11062026.js | js | 2.5 MB | 27/60 | 2026-06-11 | - |
| 58d435f0675c2331... | GLD-QTN-10422.js | js | 2.9 MB | 24/60 | 2026-06-11 | - |
| 671c99fe3edc789c... | Swift_USD.js | js | 2.9 MB | 28/58 | 2026-06-11 | - |
| 34b0d10ee1f8927d... | ysTD_v11.7.4.6842.exe | exe | 1.0 MB | 49/66 | 2026-06-11 | - |
| ef6e6eeefd2da3e9... | QUOTATION.exe | exe | 1.2 MB | - | 2026-06-11 | - |
| fcf77056fc4d3515... | INQUIRY_FORMpdf.js | js | 27.2 KB | - | 2026-06-11 | - |
| 919b5cd185f5a5cc... | MASTER_CTM_BREAKDOWN.exe | exe | 1.1 MB | - | 2026-06-11 | - |
| 2e190a4c22601d5e... | DI-1017-PH1-26_ABBREVIATED_CON.com | exe | 1.1 MB | - | 2026-06-10 | - |
| a52f2947d9dd682c... | Quotation Request_7009.js | js | 25.8 KB | - | 2026-06-10 | - |
| bd6dc1b2bf27d2fe... | New Order.js | js | 3.0 MB | - | 2026-06-10 | - |
| 7b1e8b201a6cd8f1... | Nostro Ordine 264418 PDF.js | js | 3.0 MB | - | 2026-06-10 | - |
| b9ffd24643748eaa... | TR9302.js | js | 3.0 MB | - | 2026-06-10 | - |
| c9d9fb517eaedbaa... | SWIFT USD 22.496,32 20261032254113.js | js | 71.7 KB | - | 2026-06-10 | - |
| 265d12ace3e4a41c... | Qot220190402606.vbs | vbs | 1.9 MB | - | 2026-06-10 | - |
| f77faf7d8d425fdb... | PO_2026.scr.exe | exe | 1.2 MB | - | 2026-06-10 | - |
| d1654ee1272baee7... | SecuriteInfo.com.Trojan.FbngENT.1.24657.7307 | exe | 278.5 KB | - | 2026-06-10 | - |
| dbbce171d3da70ed... | RFQ;KC&GC L.L.C-100626.js | js | 2.1 MB | - | 2026-06-10 | - |
| add86e84bb76decd... | New Order.vbs | vbs | 322.1 KB | - | 2026-06-10 | - |
| dece042526daa8ea... | INVOICE-PAYMENT ADVICE.vbs | vbs | 399.7 KB | - | 2026-06-10 | - |