MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f98919ff9ea620eb83d4f61f81370d4d514f94883122ff0365062f262b31fe9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f98919ff9ea620eb83d4f61f81370d4d514f94883122ff0365062f262b31fe9
SHA3-384 hash: 67de0bc5bb1f1a969ad5098d7dfd845381d1d02e7e8e2dec741c55121a2e8364ac0769040d8d8c8a2dffcb2b1cd7abb4
SHA1 hash: 10cd880e569d349df0ced7d45001aad94fdc92f1
MD5 hash: 2ae93fa58acb3cdff1988a0c2d7e60b0
humanhash: music-two-emma-speaker
File name:Payment Slip PO 740559177569477756740_pdf.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:805'197 bytes
First seen:2020-06-08 05:52:56 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:aqV8R3lNTVjMdjpEvEkftRq4QLO6+hq9dv1wQKlgWvawE+aBgpgI5wjWrQerIjj8:aLlMpEckrbuOHqJFwgWvF9aBgv12E
TLSH 79053395D04D8F593B6E4839A1B06C371973502A64E6B7218CCF823B860EF9C6DE1A7D
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 198-49-68-77.static.hostdime.com
Sending IP: 198.49.68.77
From: SINCERE INDUSTRIAL CORP. <procurement@sinceremarine.com>
Subject: PO 7405591 / 7756947 / 7756740 invoice for 30% Deposit
Attachment: Payment Slip PO 740559177569477756740_pdf.arj (contains "scan000.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 05:54:12 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6mjdh7z5jra5ob5j5q7qe3q2tkrj6kiqmjc74bwkbrpeyvtd7uq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 7f98919ff9ea620eb83d4f61f81370d4d514f94883122ff0365062f262b31fe9

(this sample)

FormBook

Executable exe 29bad4252fa4cda5eea6a5a8587169e1d88d58f9c1fed8c13cf29695995178b6

  
Dropping
MD5 d390c0d9bf8da0c2c37cbdbd5e6cdba4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29bad4252fa4cda5eea6a5a8587169e1d88d58f9c1fed8c13cf29695995178b6

Comments