MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bbc88d9736b6a25c4f4a1c16a9c28cb90fe8c0b88d900e90b21f965853f76ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bbc88d9736b6a25c4f4a1c16a9c28cb90fe8c0b88d900e90b21f965853f76ab
SHA3-384 hash: 2c87371b49716385c29348600d830719991ef46a2e2d95ea84c2773e3489a20f4e5ed737a090089d6b2a54851bd969a2
SHA1 hash: aaf337fa20f57b7bcdd781fae25eb27341d7866b
MD5 hash: c828c09ba3e14fdc003bf7097d6b9c62
humanhash: monkey-finch-fruit-speaker
File name:18008-F-ASTM A815-WPS32750 flange_xlsx.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:405'216 bytes
First seen:2020-05-21 07:43:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:3RNMZGKoOzdLa6ajuabhhWjSiqrI40F6ZKejRXUUo5ZHiW+hWDDp:TMZGkdgSqheSAOR1qFb+hWDDp
TLSH 7E8423583B69DC61D2AB3DCBAA604A9235799BFD3CE2906FC33679120274D5216FB031
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: postman.capriolo.com
Sending IP: 91.102.231.162
From: emilly.zhang@coseeindustry.com <emilly.zhang@coseeindustry.com>
Reply-To: emilly.zhang@coseeindustry.com <emilly.zhang@coseeindustry.com>
Subject: POX 18008-F-S32750-flange-Maass
Attachment: 18008-F-ASTM A815-WPS32750 flange_xlsx.zip (contains "18008-F-ASTM A815-WPS32750 flange_xlsx.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.12176.11480.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 08:36:15 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fo6irwltnnvclrhuuhawvhbizoip5dalrdmqb2ileh4wlbj7o2vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 2bbc88d9736b6a25c4f4a1c16a9c28cb90fe8c0b88d900e90b21f965853f76ab

(this sample)

FormBook

Executable exe 295c508d5a38496e158e8ae8795196bfa24a12d1aabc2e528a133b41e6723ed2

  
Dropping
MD5 88aca8bfdae09a19633e8e704ac40791
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 295c508d5a38496e158e8ae8795196bfa24a12d1aabc2e528a133b41e6723ed2

Comments