Formbook - Malware Samples
500 samples tracked (rolling 30 days)
Last updated: 2026-10-10
This page lists the most recent Formbook malware samples collected from MalwareBazaar. Each entry includes the SHA256 hash (linked to the MalwareBazaar sample page), original file name, file type, size, and VirusTotal detection rate where available. Samples are updated daily and retained for a rolling 30-day window.
How to Use This Data
Security teams can use these hashes in several ways. Import them into your SIEM or EDR platform to detect known Formbook variants in your environment. Cross-reference file names against your email gateway logs to identify phishing campaigns delivering this family. The file type distribution reveals which delivery formats are currently in use - a shift from .exe to .msi or .js may indicate the operators are adapting to your defenses. Samples with low or missing VirusTotal detection rates are the most dangerous - these are fresh variants that may bypass signature-based protection.
About the Data
All samples are sourced from MalwareBazaar, a free malware sample sharing platform operated by abuse.ch. Detection rates come from VirusTotal. This data is provided for defensive purposes only. For the latest Formbook indicators of compromise including C2 servers and domains, see the IOC page.
| SHA256 | File Name | Type | Size | Detection | First Seen | Country |
|---|---|---|---|---|---|---|
| 97cb2ecc246e032d... | s3.exe | exe | 281.0 KB | 55/69 | 2026-10-10 | - |
| ce8700d416c495f4... | Invoice-2783 Image.js | js | 60.7 KB | 23/61 | 2026-10-09 | - |
| faf05fddeefde69d... | DHL 订舱安排.js | js | 2.7 MB | 27/61 | 2026-10-09 | - |
| 7b4fe6b40a5d1f44... | New Samples.js | js | 53.4 KB | 16/61 | 2026-10-09 | - |
| e27bab85732749db... | Whatssap Image 8-10-26.js | js | 57.5 KB | 25/61 | 2026-10-09 | - |
| 9e185f16c4c15283... | Germany order.JS | js | 3.7 MB | 25/61 | 2026-10-09 | - |
| 33dbb7d0c78bfa2e... | 103_ETT177321458.JS | js | 3.7 MB | 23/53 | 2026-10-09 | - |
| 6bea58f9b6fdcef7... | RFQ ORDER LIST.js | js | 2.6 MB | 25/58 | 2026-10-09 | - |
| 568041dc166e7d1c... | DHL 订舱安排 0000932.js | js | 2.6 MB | 24/61 | 2026-10-09 | - |
| 9103ef909bdddc0a... | INQUIRY5634..pdf.js | js | 3.3 MB | 23/60 | 2026-10-09 | - |
| e15e5d4f77fa217c... | PK04852Q0000383PKKHI.exe | exe | 804.5 KB | - | 2026-10-09 | - |
| 774acba8544be239... | Files 0019002610.pdf.js | js | 27.2 KB | - | 2026-10-09 | - |
| 3ea03e28c0a5a8c8... | Swift_Copy_IF01200022823419.exe | exe | 803.0 KB | - | 2026-10-09 | - |
| 4e2d3b193a9bfb9f... | PO50A-051141161_ORDER_DETAIL.com | exe | 899.0 KB | - | 2026-10-09 | - |
| 427a774025774978... | Proforma invoice and Packing list.vbs | vbs | 653.5 KB | - | 2026-10-08 | - |
| 99ffcf74e73a8522... | Quotation#26108-265789.pdf.vbs | vbs | 1.1 MB | - | 2026-10-08 | - |
| ba83e2a9587a95e0... | NEW ORDER-PO.js | js | 2.0 MB | - | 2026-10-08 | - |
| 6c196428e65a6fe1... | pwsecured_stub.ps1 | ps1 | 1.5 MB | - | 2026-10-08 | - |
| a8a6f5ad5f6bc59b... | SC_TR11670000_pdf.exe | exe | 739.0 KB | - | 2026-10-08 | - |
| a36cbacd3c6950de... | Inquiry 20261037______________________PDF.bat | exe | 997.5 KB | - | 2026-10-08 | - |
| bcaa60dcc3369c42... | Caixa-pago.exe | exe | 427.3 KB | - | 2026-10-08 | - |
| c721af4ea5bcceff... | Payment_copy 20260937483947783778 PDF.JS | js | 3.7 MB | - | 2026-10-08 | - |
| 75e3b78baddb4f02... | PO.2610041 Dan PO.2610042.pdf.js | js | 30.5 KB | - | 2026-10-08 | - |
| 79f433ea9c0375b1... | DHL 订舱安排.js | js | 2.7 MB | - | 2026-10-08 | - |
| 64768d05d82b4b2c... | 0834_368259283.JS | js | 3.7 MB | - | 2026-10-08 | - |
| f4fc837294cd35d0... | PPL-RFQ-PI-035 And Spare Parts.js | js | 30.8 KB | - | 2026-10-08 | - |
| a6b6bc072f1f38a5... | 103_ETT1773214587633.JS | js | 3.7 MB | - | 2026-10-08 | - |
| d50f2369c4350241... | Documents.JS | js | 3.7 MB | - | 2026-10-08 | - |
| 66fc9f1c18d5abd0... | PO - 643535.JS | js | 3.7 MB | - | 2026-10-08 | - |
| 4f38dfef0fbfcf48... | PO - DONZA4179.JS | js | 3.7 MB | - | 2026-10-08 | - |
| 12a9931c6bf47a12... | Comandă de achiziție nr. 89654314102020-RO.js | js | 2.0 MB | - | 2026-10-08 | - |
| d4cd6e3f516c6fa0... | payment invoice.js | js | 2.0 MB | - | 2026-10-08 | - |
| 461ba9a7d6b34442... | PO50A-051141161_ORDER_DETAILS.com | exe | 837.0 KB | - | 2026-10-08 | - |
| 7a9bffbf3a920d9b... | ORDER7865.bat | exe | 832.0 KB | - | 2026-10-08 | - |
| ba4bd1e18af0cc4a... | PO4501895496.js | js | 30.8 KB | - | 2026-10-08 | - |
| a63e5bac28f9b1d6... | 001IklanSebutHarga.wsf | wsf | 30.9 KB | - | 2026-10-08 | - |
| 64506ae267aed8af... | NEW_FLF7997_SHIPMENT_DETAILpdf.com | exe | 835.0 KB | - | 2026-10-08 | - |
| 2e965ae359bcc693... | RFQ ORDER LIST.js | js | 2.6 MB | - | 2026-10-08 | - |
| 7d6a7376e8262e07... | ORDEN_549236.js | js | 1.2 MB | - | 2026-10-07 | - |
| a81c8dc954bf8a92... | ORDER_10_2026.JS | js | 3.2 MB | - | 2026-10-07 | - |
| 537edff805f01933... | order document 4500583468.js | js | 2.0 MB | - | 2026-10-07 | - |
| df1e0e84ae0ec092... | Ziraat Bankasi Swift Mesaji.js | js | 2.8 MB | - | 2026-10-07 | - |
| 2f1a160fead73b27... | Samples.js | js | 57.2 KB | - | 2026-10-07 | - |
| 4d6930feaf120f23... | sevv.ps1 | ps1 | 1.4 MB | - | 2026-10-07 | - |
| fe9cd79bc755d47a... | secured_stub.ps1 | ps1 | 1.4 MB | - | 2026-10-07 | - |
| 05abc25b7a5a3add... | NEW ORDER-PO.js | js | 2.0 MB | - | 2026-10-07 | - |
| d538f52e0703db62... | 261F0000723-00042F.261F0000723-00042F.PDF.exe | exe | 425.5 KB | - | 2026-10-07 | - |
| c821494f28bc861b... | PO958483485430394.js | js | 1.2 MB | - | 2026-10-07 | - |
| bc179912f78307a8... | QUOTATION_2543_REQUEST_FORM.com | exe | 828.0 KB | - | 2026-10-07 | - |
| a26c1907727d35b0... | Order Inquiry.js | js | 1.2 MB | - | 2026-10-07 | - |
| 46008dea9a887efb... | TE20042324.docx | docx | 2.1 MB | - | 2026-10-07 | - |
| a21be069523269d3... | Request for Quotation #26050236.scr | exe | 1.1 MB | - | 2026-10-07 | - |
| 1f0babd6b021b89f... | RFI-MZ-025-09OCT2026 (21797712) Supply of Spare Parts.wsf | wsf | 36.1 KB | - | 2026-10-07 | - |
| b85d4673ac19ee20... | PO.2610041 Dan PO.2610042.pdf.js | js | 21.2 KB | - | 2026-10-07 | - |
| d59ff957804da52b... | NEW_FLF7997_SHIPMENT_DETAILS.js | js | 76.0 KB | - | 2026-10-06 | - |
| d1183f5ef4afd271... | millssecured_stub.ps1 | ps1 | 1.5 MB | - | 2026-10-06 | - |
| bf92c8212abce380... | SW_0129191.js | js | 2.0 MB | - | 2026-10-06 | - |
| 395db105e8ae64c2... | Remittance Advice.js | js | 28.6 KB | - | 2026-10-06 | - |
| 0eaf1f86209364e6... | 20260610_主蒸気系統用バルブ一覧表.js | js | 25.4 KB | - | 2026-10-06 | - |
| bcc3c61d48a5175a... | secured_stub.ps1 | ps1 | 1.5 MB | - | 2026-10-06 | - |
| 8e4772e7850006e7... | mlsecured_stub.ps1 | ps1 | 1.5 MB | - | 2026-10-06 | - |
| b27ba7046e98fec6... | secured_stub.ps1 | ps1 | 1.5 MB | - | 2026-10-06 | - |
| b16e1b73113223db... | secured_stub.ps1 | ps1 | 1.5 MB | - | 2026-10-06 | - |
| fa1d013f5d8f4833... | neue Bestellliste.pdf.exe | exe | 838.5 KB | - | 2026-10-06 | - |
| a834ac8699c5b2fc... | CHECK VALVE - ENQ-MYY-EG-SPE-00002 - Valve Materials.js | js | 25.3 KB | - | 2026-10-06 | - |
| 9ed1c9ac09d30259... | BALL VALVE 1500# - ENQ-MYY-EG-SPE-00002 - Valve Materials.vbe | vbe | 3.5 KB | - | 2026-10-06 | - |
| 9c374c3801bdcfa5... | Payment Confirmations 20260510800017023.scr | exe | 871.0 KB | - | 2026-10-06 | - |
| 10333cfe3b8de037... | QUOTATION_2543_REQUEST_FORM.com | exe | 865.0 KB | - | 2026-10-06 | - |
| 0ccda5fb8da309f4... | probable_Formbook_5.exe | exe | 278.5 KB | - | 2026-10-05 | - |
| 2a4e92f9ceeafdde... | probable_Formbook_4.exe | exe | 275.5 KB | - | 2026-10-05 | - |
| 0b81936f0bc1aaf3... | probable_Formbook_3.exe | exe | 279.5 KB | - | 2026-10-05 | - |
| 5d010b50c9cfd89d... | Probable_Formbook_2.exe | exe | 278.0 KB | - | 2026-10-05 | - |
| 21eed78ef28f1358... | Probable_Formbook.exe | exe | 277.0 KB | - | 2026-10-05 | - |
| ad94161a022aa308... | ad94161a022aa30896c1a8bcd8dbc85771295f860cbfda0926bfeaca9546f094.exe | exe | 791.5 KB | - | 2026-10-05 | - |
| 6158bb236d98187b... | 6158bb236d98187b9d7a267bc4ce36e8c053e8c487c25df844cc7c7d0345c34a.exe | exe | 785.5 KB | - | 2026-10-05 | - |
| 83ec0f2732ffc388... | 83ec0f2732ffc388763f69c1f5a4e190dee8df484cdcbba6b798faf4bab0bf16.exe | exe | 1.0 MB | - | 2026-10-05 | - |
| 25a127ef0fe99db1... | 25a127ef0fe99db17a3a08ddbd6848b3c96e1e61819b8819d34d1f016cb72b0e.exe | exe | 791.5 KB | - | 2026-10-05 | - |
| 6bad5f64830f45ab... | 6bad5f64830f45abe2775306962aa6cd98ab3d54977f8a662c35b3a407377ffe.exe | exe | 784.0 KB | - | 2026-10-05 | - |
| 50de568b3bd5bdc9... | QUOTATION_2543_FORMS.com | exe | 780.0 KB | - | 2026-10-05 | - |
| dd81171bc6c8137e... | dd81171bc6c8137ea1630eddfdb4234116b8293c5e4e33d5ba857686d04b9bfd.bin | ps1 | 1.5 MB | - | 2026-10-05 | - |
| 1e67a657db76e435... | 1e67a657db76e435e71bf415296975c61cafa49d5ff219ac641431eb5928f376.bin | ps1 | 1.5 MB | - | 2026-10-05 | - |
| fef37229535dcfb8... | RFQ - PROVISION TO SUPPLY AND DELIVERY OF FITTINGS AND ACCESSORIES.vbe | vbe | 3.5 KB | - | 2026-10-05 | - |
| 0761a56193a5ce6c... | Quotation Copy.exe | exe | 914.0 KB | - | 2026-10-05 | - |
| 69a482c5823cd333... | PARSAN KISH INQUIRY_pdf.com | exe | 915.0 KB | - | 2026-10-05 | - |
| 9c44283c1430c19f... | Specifications.js | js | 20.2 KB | - | 2026-10-05 | - |
| 6ff069b653fcba8f... | PO7780804959GHMCN3395858EU.js | js | 3.1 MB | - | 2026-10-05 | - |
| 1fa2d2eacb303395... | Company profile Image.vbe | vbe | 3.5 KB | - | 2026-10-05 | - |
| b304734df2c865e4... | ORDER-07896-10526AP.DOCX.vbs | vbs | 835.3 KB | - | 2026-10-05 | - |
| c035b3bfcd8c5027... | SWIFT SKM850i26073017605.js | js | 2.0 MB | - | 2026-10-05 | - |
| 152fba31825e5531... | PO - DSM943567.JS | js | 3.2 MB | - | 2026-10-05 | - |
| 133d7c605a3a184d... | RFQ 07283 Image.js | js | 2.0 MB | - | 2026-10-05 | - |
| 42716619bb34bad7... | Quotations Image.js | js | 48.2 KB | - | 2026-10-05 | - |
| ea6188f0e81d426b... | Remittance Advice.js | js | 29.2 KB | - | 2026-10-05 | - |
| 03c2c65c8fc38236... | ePL_051026_4850.js | js | 48.5 KB | - | 2026-10-05 | - |
| 2ee5fff869eef982... | ePL_051026_4850.js | js | 48.5 KB | - | 2026-10-05 | - |
| 789ad476a56534cb... | Technical Specifications Image.js | js | 48.2 KB | - | 2026-10-05 | - |
| 46e8d2bd45492664... | ROQ_O 2828-501.JS | js | 3.2 MB | - | 2026-10-05 | - |
| 559e4d862c44df0c... | 1C26TLL_00001453.js | js | 48.5 KB | - | 2026-10-05 | - |
| 7391d82a748cb62a... | New Inquiry-for Quotation.pdf.js | js | 2.0 MB | - | 2026-10-05 | - |
| 04a6e7e0ebdb93b2... | payload_shellcode.bin | exe | 281.0 KB | - | 2026-10-05 | - |