Formbook - Malware Samples
500 samples tracked (rolling 30 days)
Last updated: 2026-08-07
This page lists the most recent Formbook malware samples collected from MalwareBazaar. Each entry includes the SHA256 hash (linked to the MalwareBazaar sample page), original file name, file type, size, and VirusTotal detection rate where available. Samples are updated daily and retained for a rolling 30-day window.
How to Use This Data
Security teams can use these hashes in several ways. Import them into your SIEM or EDR platform to detect known Formbook variants in your environment. Cross-reference file names against your email gateway logs to identify phishing campaigns delivering this family. The file type distribution reveals which delivery formats are currently in use - a shift from .exe to .msi or .js may indicate the operators are adapting to your defenses. Samples with low or missing VirusTotal detection rates are the most dangerous - these are fresh variants that may bypass signature-based protection.
About the Data
All samples are sourced from MalwareBazaar, a free malware sample sharing platform operated by abuse.ch. Detection rates come from VirusTotal. This data is provided for defensive purposes only. For the latest Formbook indicators of compromise including C2 servers and domains, see the IOC page.
| SHA256 | File Name | Type | Size | Detection | First Seen | Country |
|---|---|---|---|---|---|---|
| 1d5322c50ac0e03e... | PO 050186.js | js | 3.0 MB | 28/60 | 2026-08-07 | - |
| d3b2ccc8a4d957e4... | 854f1e97-5dbb-4a87a5PDF.js | js | 55.0 KB | 24/60 | 2026-08-07 | - |
| ee594fc03a20cd84... | WellsFargo Payment Confirmation.js | js | 3.0 MB | 25/60 | 2026-08-07 | - |
| 38f6528d14eccac7... | SWI0020260608938FT.vbs | vbs | 306.0 KB | 22/59 | 2026-08-07 | - |
| dc23b3336cba5370... | MV.SEA_GLORY_APPOINTMENT_LETTER.vbs | vbs | 965.3 KB | 29/60 | 2026-08-07 | - |
| 94e2bbcbdbdb5c78... | PERMOHONAN DOKUMEN SOKONGAN BAYARAN - SEKSYEN 81 AKTA CUKAI PENDAPATAN 1967.js | js | 88.5 KB | 26/60 | 2026-08-07 | - |
| 44ccb0b2c6f16f12... | Bank_Payment_Receipt_MT103pdf.js | js | 3.0 MB | 27/60 | 2026-08-07 | - |
| 6e383213ab698d95... | New_Shipment_0285_Detail_Specificationpdf.js | js | 3.0 MB | 27/58 | 2026-08-07 | - |
| f0e29d11e1800cf4... | SecuriteInfo.com.Win64.Malware-gen.56431661 | exe | 295.0 KB | 50/68 | 2026-08-06 | - |
| e4a1cba61b06c78f... | HSBC PAYMENT COPY.js | js | 3.0 MB | 22/59 | 2026-08-06 | - |
| f787bb3704a9fe63... | SW_683200.js | js | 949.0 KB | - | 2026-08-06 | - |
| ba32aebc04dc365a... | ORDER_LIST.js | js | 1004.3 KB | - | 2026-08-06 | - |
| 0e9789bcef41a88a... | Teklif Talep TRC2600508 - 10107161.js | js | 96.4 KB | - | 2026-08-06 | - |
| b4030f06fa3ea85a... | 06.08.2026 Fiyat Taleb 600508 - 10107161.js | js | 96.4 KB | - | 2026-08-06 | - |
| 415ce6602e049715... | Doc_Ref0000392026.vbs | vbs | 15.3 KB | - | 2026-08-06 | - |
| 9651b0ffc0ae5c18... | MV_SEA_PEARL_ORDER_QUOTATION_FORMpdf.js | js | 3.0 MB | - | 2026-08-06 | - |
| a8af219a8047cc0c... | Signed and Stamped Agreement Attached.vbs | vbs | 15.3 KB | - | 2026-08-06 | - |
| c2eda59b5a04a3c0... | COTIZACIÓN_623.js | js | 966.6 KB | - | 2026-08-06 | - |
| bf2c84ab0b460c3a... | funds transfer.pdf.lzh.js | js | 45.0 KB | - | 2026-08-06 | - |
| 21b023d38875a3c3... | PI #68140024_02797268970802796529299668_pdf.js | js | 85.2 KB | - | 2026-08-06 | - |
| 3aa97c40f9829f82... | Shipment_0285_Detail_Specification.JS | js | 2.9 MB | - | 2026-08-06 | - |
| 48db3033a0aeab07... | 5TP00356-0162026.js | js | 3.0 MB | - | 2026-08-06 | - |
| 3ddce244c308f1ce... | bin.exe | exe | 277.0 KB | - | 2026-08-06 | - |
| 9e4635b5b43a8a5e... | VESSEL_STOWAGE_PLAN VSL_PARTICULARS.js | js | 1023.5 KB | - | 2026-08-06 | - |
| 520e8e29ace68efc... | MT_LADY_YASSO_VSL_BRIEF_DETAILSpdf.js | js | 3.0 MB | - | 2026-08-06 | - |
| a1f37819e6cea462... | k4aVruZ1gk0AjWh.exe | exe | 1003.0 KB | - | 2026-08-05 | - |
| df1756b2e055ceeb... | ΠΛΗΡΩΜΗ_804353.js | js | 952.0 KB | - | 2026-08-05 | - |
| 5fd276cac6c062df... | ORDER_NEW _HUY7986.JS | js | 2.9 MB | - | 2026-08-05 | - |
| a82ac9bbd0ca656a... | A2026_ORDER.JS | js | 2.9 MB | - | 2026-08-05 | - |
| b2921bd743c2b8be... | jkgtholb.JS | js | 3.0 MB | - | 2026-08-05 | - |
| cf3e25b9df6cd364... | COTIZACIÓN _623895.js | js | 945.7 KB | - | 2026-08-05 | - |
| 0dca7ae3d3c39824... | Purchase Order.js | js | 995.3 KB | - | 2026-08-05 | - |
| 7413c6d84fc25879... | whatsapp.img.JS | js | 2.9 MB | - | 2026-08-05 | - |
| 1773b3e23c2ff661... | PO 050184.js | js | 3.1 MB | - | 2026-08-05 | - |
| 386d7cc46dc90690... | folderhwpqmfh3.js | js | 69.1 KB | - | 2026-08-05 | - |
| 94be3d9f80cb97d4... | 854f1e97-5dbb-4a87a5PDF.js | js | 46.1 KB | - | 2026-08-05 | - |
| 664e8ea263f2cec1... | Barclays MT103 Confirmation copy.js | js | 3.0 MB | - | 2026-08-05 | - |
| 64699e0882d4daf0... | NewXPOXX#82026X.js | js | 995.0 KB | - | 2026-08-05 | - |
| c2fbe4fd85440a8c... | LOA-AD-142026944-7K.Rivera.js | js | 3.2 MB | - | 2026-08-05 | - |
| b228e371e64bee4b... | DhpA5sRIPpKBtGr.exe | exe | 992.0 KB | - | 2026-08-05 | - |
| fc04a6d3555001a8... | MV ANNA SCHULTE VESSEL Q88 PARTICULARS.js | js | 3.1 MB | - | 2026-08-05 | - |
| 151b01ecbb7aca8b... | Q88 with vessel's particulars.exe | exe | 1009.5 KB | - | 2026-08-04 | - |
| 438a199c60026b89... | bin.dat | exe | 278.0 KB | - | 2026-08-04 | - |
| b932279338477845... | MV ANNA SCHULTE VSL Q88.js | js | 3.0 MB | - | 2026-08-04 | - |
| e4ea1a522ec3fc61... | NAROČILO_8321.js | js | 947.5 KB | - | 2026-08-04 | - |
| ca28f9d8f0342b87... | MV.SEA_GLORY_APPOINTMENT_LETTER.js | js | 794.8 KB | - | 2026-08-04 | - |
| 3fe05af115f964e9... | DEKONT_pdf.js | js | 76.6 KB | - | 2026-08-04 | - |
| de76dc301e542c23... | HSBC PAYMENT COPY.js | js | 3.0 MB | - | 2026-08-04 | - |
| af78e48a8bcffe2d... | Kopia załącznika do protokołu ze spotkania.vbs | vbs | 330.5 KB | - | 2026-08-04 | - |
| b190fbd2a225dfd5... | NEW_ORDER_2026_N0_DF987.JS | js | 3.3 MB | - | 2026-08-04 | - |
| 3d9b634d1d7634fb... | 47907DOCS.js | js | 103.9 KB | - | 2026-08-04 | - |
| 7ba2b0a420e45f02... | PI#XTEC20260731XXTWX.scr | exe | 710.6 KB | - | 2026-08-04 | - |
| 3e947c7fba8012b9... | Daftar Pesanan Pembelian #000183.pdf.js | js | 6.1 MB | - | 2026-08-04 | - |
| ffaf0988604a1620... | MATERIALS_BILLS _SECIFICATIONS _Quote.js | js | 3.0 MB | - | 2026-08-04 | - |
| 3302ea8a0278e17f... | 854f1e97-5dbb-4a87a5PDF.js | js | 46.5 KB | - | 2026-08-04 | - |
| 9d78b652337862b1... | INV008973 TIMBER.001.js | js | 5.0 MB | - | 2026-08-04 | - |
| 422e30edd409936c... | invoicesXnoXA396Xjpg.exe | exe | 1005.0 KB | - | 2026-08-04 | - |
| fc28090a08f8e46e... | Bagge.exe | exe | 714.4 KB | - | 2026-08-04 | - |
| 320a63cee8599bbc... | MXjOtVrU067TrOT.exe | exe | 1.0 MB | - | 2026-08-04 | - |
| 12d83cc0201eb2f0... | QT25-0724 - NEW PO IMSM09112026-07.exe | exe | 390.1 KB | - | 2026-08-04 | - |
| bd4248677322b365... | RFQ_ORDER 0195_QUOTATION_FORM.js | js | 6.1 MB | - | 2026-08-04 | - |
| 0f2b42e74b69b831... | Arrival Notice.js | js | 3.0 MB | - | 2026-08-03 | - |
| 04e293d3a35fc2a8... | Doc001886_1308002341 Pdf.exe | exe | 1.0 MB | - | 2026-08-03 | - |
| d0a8c7f680f9573a... | FREP0000003583.pdf 67 KB.js | js | 44.3 KB | - | 2026-08-03 | - |
| 20cdcfc958897b31... | DHL_AWB#6078538091.exe | exe | 834.5 KB | - | 2026-08-03 | - |
| a6d4a7d43d4868e8... | DHL_AWB#6078538091.exe | exe | 717.5 KB | - | 2026-08-03 | - |
| 2d9c7ea66ffb1c9b... | Ziraat Bankası'ndan 03.08.2026 tarihli ödeme makbuzunun kopyası..js | js | 3.0 MB | - | 2026-08-03 | - |
| 983b8144e80f7053... | Our Order 2744PO19.exe | exe | 1.1 MB | - | 2026-08-03 | - |
| 33341baf2c19c4a4... | VESSEL_INFO_PARTICULARSpdf.js | js | 3.0 MB | - | 2026-08-03 | - |
| 817f4fd56392bbd9... | Shipping Doc.js | js | 3.0 MB | - | 2026-08-03 | - |
| 956be196929073e5... | Factura_Electronica Banco_Sabadell_pdf_BS350698.js | js | 821.3 KB | - | 2026-08-02 | - |
| 4a876ab6e6a02906... | Dekont Pdf.js | js | 41.8 KB | 8/58 | 2026-07-31 | - |
| ff839798f00b8d75... | Confirmación de pago de Santander 31.07.26.js | js | 6.0 MB | 26/59 | 2026-07-31 | - |
| 967e20b5efdb7a61... | OUR NEW ORDER_2026.JS | js | 3.3 MB | 24/60 | 2026-07-31 | - |
| f13e68373ba8c006... | shipping documents.js | js | 3.0 MB | 23/60 | 2026-07-31 | - |
| 868f688f5c9300df... | order N° 25000474,.exe | exe | 349.0 KB | 43/70 | 2026-07-31 | - |
| 3e1b1fe0edaa2aa1... | SecuriteInfo.com.Win32.MalwareX-gen.81626146 | exe | 1.0 MB | 53/71 | 2026-07-30 | - |
| 3383eb3b2432c941... | Comprobante transferencia.pdf.js | js | 66.0 KB | 12/61 | 2026-07-30 | - |
| 74eb42416b47c082... | nHRwHRSjI1H5wol.exe | exe | 1.0 MB | 35/69 | 2026-07-30 | - |
| 5074b37a866644a7... | PAGO-29-07-26.pdf.js | js | 48.8 KB | 24/60 | 2026-07-30 | - |
| d96ab58f07cd94c3... | Order X3000 DD.js | js | 3.3 MB | 27/60 | 2026-07-30 | - |
| af71b2c0fa2345a5... | upz.rtf | rtf | 140.7 KB | - | 2026-07-29 | - |
| 6a2ba34451531f67... | SPECIFICATIONS.exe | exe | 1006.5 KB | - | 2026-07-29 | - |
| 120d7d50ebb84782... | Invoice (1).js | js | 2.0 MB | - | 2026-07-29 | - |
| d13e4f45c26c3df8... | July Invoice_PDF.js | js | 66.7 KB | - | 2026-07-29 | - |
| 92d27e98374b3657... | MV_CHRYSANTHI_S_VSL_DESCRIPTIONpdf.js | js | 3.2 MB | - | 2026-07-29 | - |
| 6c1abc6c731f272e... | Quotation.JS | js | 4.0 MB | - | 2026-07-28 | - |
| a3ab968ecfe40961... | PO10025_2026_07_28.exe | exe | 984.5 KB | - | 2026-07-28 | - |
| f4a5711227814012... | MV_ARUNA BERK SAILING ORDERS pdf.js | js | 100.8 KB | - | 2026-07-28 | - |
| 212d2635b3cc5af9... | DHL Waybill No 005107085566P.JS | js | 3.9 MB | - | 2026-07-28 | - |
| 9ed59215e2462140... | DYyDQyvpujOEjl1 (1).exe | exe | 990.5 KB | - | 2026-07-28 | - |
| c189e889e530d891... | PO_62401394.exe | exe | 1014.0 KB | - | 2026-07-28 | - |
| 96adddbb37c0c217... | Whatssap image.jpg 27-7-26.js | js | 1.5 MB | - | 2026-07-28 | - |
| 5326cd216b594557... | z9QUOTATIONORDER.exe | exe | 1.0 MB | - | 2026-07-27 | - |
| c6713b3c5ba4da50... | PURCHASE ORDER_909826.JS | js | 3.9 MB | - | 2026-07-27 | - |
| ed1f71433e9f5514... | Our Order 2644OP18.exe | exe | 1.0 MB | - | 2026-07-27 | - |
| 85708f2b9dfcda4f... | PO_890.js | js | 3.1 MB | - | 2026-07-27 | - |
| 68105f85b33f67e9... | Quotation.JS | js | 4.0 MB | - | 2026-07-27 | - |
| d712b6f9fa3ea6fa... | Dekont-2026-07-24_0T122032.314.pdf (~21 KB).exe | exe | 1.0 MB | - | 2026-07-27 | - |
| b843f789741fd637... | Ad_NEW_INQUIRY_SPAREPART_02877843 DOCUMENT_PDF.js | js | 100.9 KB | - | 2026-07-27 | - |