MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6031b6aeab0b8c5111938e3c0819e717858aa3586bcdacea994d980ac36c5368. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 6031b6aeab0b8c5111938e3c0819e717858aa3586bcdacea994d980ac36c5368
SHA3-384 hash: 6afff65d9c84ebc1bada3309643bcf86c44cd5773934059963242dcf6a8006f5d6f92da6e185209e678f18da3cf9b69b
SHA1 hash: 4419b76003f333925f4cf84b5e679ff64d7d6d08
MD5 hash: 7689c98d5db51db149591210ad24c4ff
humanhash: don-speaker-berlin-spring
File name:PO 17774.xls
Download: download sample
Signature Formbook
File size:187'392 bytes
First seen:2020-07-31 11:11:58 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 3072:fk3hOdsylKlgryzc4bNhZFGzE+cL2kn3v7W495jlNgZ0rAA5rqapJwXqfRuyAWsi:fk3hOdsylKlgryzc4bNhZF+E+W2knf7a
TLSH 4F04F1A2B596E816D70B07750BA11110BF3BFC00B391A24A32F4BB071B715BD9E63DE6
Reporter @abuse_ch
Tags:FormBook xls


Twitter
@abuse_ch
Malspam distributing Formbook:

HELO: akhaten.nordnet.ws
Sending IP: 144.76.106.247
From: zhouliywang009@yahoo.com <zhouliywang009@yahoo.com>
Subject: PO 17774
Attachment: PO 17774.xls

FormBook payload URL:
https://a.uguu.se/pjhjuc.jpg

Intelligence


File Origin
# of uploads :
1
# of downloads :
32
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl
Score:
60 / 100
Signature
Creates HTML files with .exe extension (expired dropper behavior)
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document exploit detected (creates forbidden files)
Behaviour
Behavior Graph:
Threat name:
Script-Macro.Downloader.SLoad
Status:
Suspicious
First seen:
2020-07-31 11:13:06 UTC
AV detection:
14 of 31 (45.16%)
Threat level
  3/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Behaviour
Suspicious Office macro
Threat name:
Dropper
Score:
0.80

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Excel file xls 6031b6aeab0b8c5111938e3c0819e717858aa3586bcdacea994d980ac36c5368

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments