MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0518fe66f4ec2565d35e7124defd88b24507ad5d99fd46c69ce679d9c1f824c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0518fe66f4ec2565d35e7124defd88b24507ad5d99fd46c69ce679d9c1f824c0
SHA3-384 hash: 87d96b25ee5060c1f58f62a5b9e29d89ac1dc968878dca95cca20e1559918e48955f394b97b8ec37b39ba2fb0d4587cc
SHA1 hash: c6fdfb71943b3d57beef3239f328c966e27f7e8d
MD5 hash: 4e3a73d9b71939ad89c09154d3bf9c72
humanhash: texas-september-green-april
File name:Scan 2072020 pdf.iso
Download: download sample
Signature FormBook
Create hunting rule
File size:837'632 bytes
First seen:2020-07-20 09:34:59 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:kpxEDrQY5EvoFzhlmTS1i4jkkg52CKRC8fZ9G6z10lsYbu01:ca8voVOIObYfZo/6YbP
TLSH 1A05A062E2E04877C1671A3C4D1B6668A836BE003E3C99767FFB5C4CDF3A64134A5297
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server.example.com
Sending IP: 103.133.110.22
From: Vinh Loc - Davico <info@daivietseafoods.com> <admin@motonina.ml>
Subject: Re: SWIFT CONFIRMATION ON NEW ORDER 8/5/2020
Attachment: Scan 2072020 pdf.iso (contains "Scan 2072020 pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0518fe66f4ec2565d35e7124defd88b24507ad5d99fd46c69ce679d9c1f824c0/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:36:12 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aump4zxu5qswlu26oesn57miwjcqplk5th6unru44z45tqpyetaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legal
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0518fe66f4ec2565d35e7124defd88b24507ad5d99fd46c69ce679d9c1f824c0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso 0518fe66f4ec2565d35e7124defd88b24507ad5d99fd46c69ce679d9c1f824c0

(this sample)

FormBook

Executable exe 34a88c5a15f36eb7b24dfb21e53185ffa67a04760533e9d474dd4de4e5331153

  
Dropping
MD5 b954219ab84d14e4efbeb8f0b629ad25
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34a88c5a15f36eb7b24dfb21e53185ffa67a04760533e9d474dd4de4e5331153

Comments