MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 baf23acf5e1b9e4bd094eac1e69d2971ad2259d407f6572e43598cfcdb5806d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	baf23acf5e1b9e4bd094eac1e69d2971ad2259d407f6572e43598cfcdb5806d8
SHA3-384 hash:	e32ddf37c6078807aed6c819aafe141719d612a972c5f780e187334ecf3dddfadaff3fd5820c99ce5cd11d495ecbcf27
SHA1 hash:	3b95354e40fb3a275252397c11974fa71984dc24
MD5 hash:	99f42c217f3b1a8eba49e518adc4cb3e
humanhash:	crazy-four-mike-earth
File name:	SC_PO3674638912400.docm
Download:	download sample
Signature	Formbook Create hunting rule
File size:	26'738 bytes
First seen:	2020-04-30 11:12:33 UTC
Last seen:	Never
File type:	docm
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	384:/e2lmlQMt+osjbinWGhzhPnzXB+bT0xQ7t2XZIqOztdSIHkhmPp9IFHWA0jbR0gR:1QE6Hhb4TwQQXEtcIl/Itlk
Threatray	5'094 similar samples on MalwareBazaar
TLSH	3CC27CD38047E41CDE72D57586BFC1E2F45B01C1B293916DD03CDA8D821FDBBA568A8A
Reporter	abuse_ch
Tags:	docm FormBook

abuse_ch

Malspam distributing Formbook:

HELO: hsgeneral.com
Sending IP: 185.62.189.231
From: Christopher Sales Manager<info@hsgeneral.com>
Subject: AW: SC_PO3674638912400
Attachment: SC_PO3674638912400.docm

FormBook payload URL:
https://linx.li/s/r7a3hqws.exe

Intelligence

File Origin

# of uploads :

# of downloads :

163

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

Document-Word.Downloader.Sload

Status:

Malicious

First seen:

2020-05-01 04:30:47 UTC

File Type:

Document

Extracted files:

AV detection:

4 of 48 (8.33%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xlzdvt26dopexueu5la6nhjjogwsewoua73folsdlggpzw2ya3ma._file

Verdict:

malicious

Label(s):

netwirerc

Formbook

223bbe1af0d09289a1ebeddf78e3218fcae28d0a69c291d66fee5fa29337844a

Formbook

3bd58e3b3fe712e8d7595cfbd576a96251c68a5dac230bd3e778640e8eb817ec

Formbook

5628310c6fe718d77dadbc5c8cb6238faa27942517b590c2a87c07aadca429d6

Formbook

6012fb54cc0a67842710e7189ebfa42c27d30f18a604fbb4122734fb23b7accd

Formbook

7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6

Formbook

ca49aa362621679944ff2bb5c323dbb64ef5f0364dff1be6168c0657962296ec

Formbook

ceec91127018aba0be51981277015baf08e3f0ef6fbd0a5efe5821fa698ba645

Formbook

ed3e93996b60fbaeb82c59f62dc3dcee809b229748ad7772829a8f738e307cbd

Formbook

f38d170b1da421aa60e778a64fec953d3058336f7cb06568ba7926495fe87f0c

Formbook

+ 5'084 additional samples on MalwareBazaar

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	win_alina_pos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_gootkit_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator