MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23fd049c38f1d44360b9a9a2dc395fef724961cd14c94c57b354b3b4a42a627d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23fd049c38f1d44360b9a9a2dc395fef724961cd14c94c57b354b3b4a42a627d
SHA3-384 hash: 1a54fc13eb47e60185b192fc792dfdbd0b6ddf931d2e5c3386981b8169f818d0dda24fa66c154b15b75f57daf71a4a13
SHA1 hash: b33a76d347e3032a82b59722d1892fdedfaf3227
MD5 hash: 6441b3d76f3e0daef0e6936ff975bbc1
humanhash: blue-may-fruit-kilo
File name:Pago001522278.Scan.pdf.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:317'880 bytes
First seen:2020-08-04 07:18:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:kJ4sj/qXOChIlWn47hNgM5YZ4ZAxTXaMZ73t36IR37haPSIAPOJLh:I4FeChIzsMGZ4+xDai73l37gGPGLh
TLSH 7D6423F31A8B60F35356697E2EB2D43193AEBEB51358B53D27FD4000AC7224583EB685
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: fica.com
Sending IP: 45.127.62.80
From: Alberto Serna <allison@nagle.gq>
Subject: RE: RE: Pago
Attachment: Pago001522278.Scan.pdf.rar (contains "Pago001522278.Scan.pdf..exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23fd049c38f1d44360b9a9a2dc395fef724961cd14c94c57b354b3b4a42a627d/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:19:03 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ep6qjhby6hkegyfzvgrnyok755zesyoncteuyv5tksz3jjbkmj6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/23fd049c38f1d44360b9a9a2dc395fef724961cd14c94c57b354b3b4a42a627d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 23fd049c38f1d44360b9a9a2dc395fef724961cd14c94c57b354b3b4a42a627d

(this sample)

FormBook

Executable exe fc7f170e0b18f35f5d150ec384f7d7db8cd790bdac22d469424515225ab30658

  
Dropping
MD5 7f978dd63c83cd8a4c195dc4195ffc1f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc7f170e0b18f35f5d150ec384f7d7db8cd790bdac22d469424515225ab30658

Comments