MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99d56ba9a904827cedca699d6d641ff5d4289af6d4b2bce6a838548650c268c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99d56ba9a904827cedca699d6d641ff5d4289af6d4b2bce6a838548650c268c5
SHA3-384 hash: 786ddbec6da93c0d06d814af1c5aff6bc8df4b9e8298b7866c0046aac5c5e3eb36ede82f0f35a555f515418b6aca416b
SHA1 hash: 319d1899c9529fa311545f60143651d84d24fa24
MD5 hash: 82d31a4ebbf9435c19fe01f110eb3181
humanhash: texas-december-paris-louisiana
File name:Particulars.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:942'976 bytes
First seen:2020-08-05 11:35:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:giWGh3dTpvRZxrqhnoTvohhtUb0iwfMLa0wRt9heI68sDZs/4jvHdcVyv4jg5:kGhJtxrK2vwsVp4VhebDZsgsyvmg5
TLSH 86153374CD63060CEA63AF1ED33CE2C12F4186E535D1EF27EAF8E5911365D2AA884B45
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.esipooaintl.cf
Sending IP: 161.129.67.157
From: Huang Biyu <biyu.huang@sg.wilmar-intl.com>
Subject: FW: MV PRINCESS SUZAN - AGENCY NOMINATION /DISCHARGING
Attachment: Particulars.zip (contains "Particulars.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99d56ba9a904827cedca699d6d641ff5d4289af6d4b2bce6a838548650c268c5/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 11:37:08 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=thkwxknjasbhz3okngow2za76xkcrgxw2szlzzvihbkimugcndcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/99d56ba9a904827cedca699d6d641ff5d4289af6d4b2bce6a838548650c268c5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 99d56ba9a904827cedca699d6d641ff5d4289af6d4b2bce6a838548650c268c5

(this sample)

Formbook

Executable exe de4a1ed43a149b646a258a5b119270c2c38da15f4b90ed9821d9e1e3527e8ed8

  
Dropping
MD5 ffeb800717463d2746d70a3585b5f983
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de4a1ed43a149b646a258a5b119270c2c38da15f4b90ed9821d9e1e3527e8ed8

Comments