MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 81dc51cb4c9a375262666a59dc61a43408439f968b51f825f5e2193b990587c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
FormBook
Vendor detections: 4
| SHA256 hash: | 81dc51cb4c9a375262666a59dc61a43408439f968b51f825f5e2193b990587c2 |
|---|---|
| SHA3-384 hash: | f2bbc2672204c843554e5cac99db1629006778bac3f5a046bd970a23067779c6dec9ae594fcca7682c4640b7f3f1245e |
| SHA1 hash: | ddcbd0eca10da0093b7cd613da8ef7d032e68b1e |
| MD5 hash: | 607179e2d115befd41a93ca7323c24e6 |
| humanhash: | lactose-bravo-finch-vermont |
| File name: | Fax Message_encrypted.exe |
| Download: | download sample |
| Signature | FormBook |
| File size: | 350'208 bytes |
| First seen: | 2020-05-01 10:59:44 UTC |
| Last seen: | 2020-05-01 11:56:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:SurMzrGfGeuMr/fDCHxN1QdmZVoNu4NaHo90/4d3vB0BkSmB:SKMzBeueDcxwdmvreco90/4dR |
| Threatray | 5'107 similar samples on MalwareBazaar |
| TLSH | D774D0BB6348CE96C8DE09B9A8BAC581DFF67CCB1D03E707446274A038773D1761658A |
| Reporter |  abuse_ch |
| Tags: | eFax exe FormBook |
abuse_ch
Malspam distributing FormBook:HELO: walmailout07.yourhostingaccount.com
Sending IP: 65.254.253.58
From: eFax <salahudeen@awazigargash.com>
Subject: Re: You have a new fax message
Attachment: Fax Message_encrypted.zip (contains "Fax Message_encrypted.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-05-01 02:18:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
27 of 31 (87.10%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 5'097 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.