MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f1c9ac4297324f418aa33dec1094fb1797ac2b59d043999de2a26149d976ab3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f1c9ac4297324f418aa33dec1094fb1797ac2b59d043999de2a26149d976ab3
SHA3-384 hash: 4458fc69af70b85830d0f0a2a46f5d5c0a175d2e778c3ec224a8c80bd43bbb31a9bbb88beff470deeb1c9afabaf014e5
SHA1 hash: d723770bea9fe79b0a9bd5019aa0c984c9abf54e
MD5 hash: 8137e99fe0dc8a149e528c948d85090e
humanhash: may-jersey-fourteen-beryllium
File name:copy_pdf.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:434'107 bytes
First seen:2020-06-20 12:47:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:OrJ+y2nOZtt0ZPkZVlbz6uEpWrm/65blULMwvmRh7hr:OrJ+y2WAZPkzDTrmCwLRvmRh7hr
TLSH 0094232AEF36F7216FC4591E6AEE3153519934EA277EE5EE00F11060A5E31483FB8217
Reporter abuse_ch
Tags:FormBook HSBC zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: slot0.wewinning.xyz
Sending IP: 45.95.169.89
From: HSBC <swift@hsbc.com>
Subject: SWIFT confirmation details
Attachment: copy_pdf.zip (contains "copy_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 12:49:03 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4ojvrbjomspigfkgppmcckpwf4xvqvvtucdtgo6fitbjhmxnkzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 4f1c9ac4297324f418aa33dec1094fb1797ac2b59d043999de2a26149d976ab3

(this sample)

FormBook

Executable exe a51505ac0bd3e2a16d1540d88456f7e21dea4b8b0d3d7ceb00248fa6a433c067

  
Dropping
MD5 872c4944660f25fc1339f1a3d366dbb2
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a51505ac0bd3e2a16d1540d88456f7e21dea4b8b0d3d7ceb00248fa6a433c067

Comments