MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78dedc26287fad6627a271a8734ad7db7f590ffd8e6afdd4a760cbdc4f50592d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78dedc26287fad6627a271a8734ad7db7f590ffd8e6afdd4a760cbdc4f50592d
SHA3-384 hash: 3f8f697f4b14543f74c161f6a8e9fe955e2af38526e63a6a8347fbe7aecc07d3c17de4fefdffabb672428831ef31511b
SHA1 hash: 495936502956fa2c40cdc8e9e63ba4a31434b4f8
MD5 hash: bcb92747983590699d39e4896dd8c4c0
humanhash: saturn-jersey-bluebird-robin
File name:PO652.xls.z
Download: download sample
Signature Formbook
Create hunting rule
File size:318'398 bytes
First seen:2021-02-18 07:40:38 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:uCobTD+5JB0zpO9jelDmJN4OHtuY3YTOmFyDb0OW8V33bi2M:uVbPzmel6v4OHthmFa1V3m2M
TLSH 2D64232D41341AE6C231C7C9AB283274E81D7533E4765F9DA325C7E4FEAD97A0E1016E
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: curlze.site
Sending IP: 185.31.160.145
From: OVOL Sdn Bhd <A.zaki@aminternational.ae>
Subject: Purchased Order - victim-email - PO#652
Attachment: PO652.xls.z (contains "PO#652.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78dedc26287fad6627a271a8734ad7db7f590ffd8e6afdd4a760cbdc4f50592d/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 07:41:06 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pdpnyjrip6wwmj5coguhgswx3n7vsd75rzvp3vfhmdf5yt2qlewq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/78dedc26287fad6627a271a8734ad7db7f590ffd8e6afdd4a760cbdc4f50592d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 78dedc26287fad6627a271a8734ad7db7f590ffd8e6afdd4a760cbdc4f50592d

(this sample)

Formbook

Executable exe a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570

  
Dropping
MD5 095d3e149a73c5daa7da04428ee3d561
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570

Comments