MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d9a34f51bcef521b4dad284038743c1cce9b9481d558225e33add85c4c9173b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 1 Comments

SHA256 hash: 8d9a34f51bcef521b4dad284038743c1cce9b9481d558225e33add85c4c9173b
SHA3-384 hash: f59357068055a6fedd591cf6054418347aa6f39c66d7b24909216a19f35544f26e264e7e1c67e7bfdd4cf47ee9e2e6cb
SHA1 hash: 20aa89a8d2cb83226065e4ecf97799409f9fd2ae
MD5 hash: ad085c2d0b11bd6268b5cf5e1f86c6d2
humanhash: sweet-emma-eight-nuts
File name:bin 1.xls
Download: download sample
Signature FormBook
File size:187'392 bytes
First seen:2020-07-31 10:22:32 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 3072:Pk3hOdsylKlgryzc4bNhZFGzE+cL2knEv7W495jlNgZ0rAA5rqapJwXqfRuyAWsM:Pk3hOdsylKlgryzc4bNhZF+E+W2knu7a
TLSH 2D04F1A2B596E816D70B07750BA11110BF3BFC00B391A24A32F4BB071B715BD9E63DE6
Reporter @abuse_ch
Tags:FormBook xls


Twitter
@abuse_ch
Malspam distributing FormBook:

HELO: cloudhost-150218.us-midwest-1.nxcli.net
Sending IP: 104.207.254.25
From: Mr. Engin TOPTAS <procurement_company@europe.com>
Subject: Confirmation of samples
Attachment: bin 1.xls

FormBook payload URL:
https://a.uguu.se/qkuriw.jpg

Intelligence


File Origin
# of uploads :
1
# of downloads :
30
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl
Score:
60 / 100
Signature
Creates HTML files with .exe extension (expired dropper behavior)
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document exploit detected (creates forbidden files)
Behaviour
Behavior Graph:
Threat name:
Script-Macro.Downloader.EncDoc
Status:
Malicious
First seen:
2020-07-31 01:32:58 UTC
AV detection:
15 of 31 (48.39%)
Threat level
  3/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Behaviour
Suspicious Office macro
Threat name:
sLoad
Score:
1.00

Yara Signatures


Rule name:SharedStrings
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

Excel file xls 8d9a34f51bcef521b4dad284038743c1cce9b9481d558225e33add85c4c9173b

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments