MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c292ebf9b397158c6d5c4cd26157cf0dbf80dc8951919804fcb5e32e3ec95a79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c292ebf9b397158c6d5c4cd26157cf0dbf80dc8951919804fcb5e32e3ec95a79
SHA3-384 hash: 5cdf52092de6316ee66a388c2792b07b7a5e7b4bd3461d556e71c59d90259777cfb59a809eedf27388b73a7231a0084c
SHA1 hash: fe37547b8284cd5dd596d57c190ac8b96a868b40
MD5 hash: a936fdb779ff6eb8694d7872de53a354
humanhash: zulu-hawaii-early-friend
File name:MV TBN SPEC-VSL PARTICULAR -DOCX.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:405'061 bytes
First seen:2020-05-08 05:20:44 UTC
Last seen:2020-05-08 13:02:58 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:udG0dgN+n3pIridbNilsrOatWFJXbTIf6rMqN7ePirO5c3uqwAnX9mGX:6JdgN+nYiZ0OvSsYN7Lrq6wI0GX
TLSH EE8423D59A3473848A2C8852C9B1F72BA40553603ECDC340E99D4F9FE9BA4FCB5DE216
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Hploki
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 00:38:58 UTC
File Type:
Binary (Archive)
Extracted files:
65
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykjox6nts4kyy3k4jtjgcv6pbw7ybxejkgizqbh4wxrs4pwjlj4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip c292ebf9b397158c6d5c4cd26157cf0dbf80dc8951919804fcb5e32e3ec95a79

(this sample)

FormBook

Executable exe 1d24189fffd0bdcb0395a3670721f29f37d08bd80565471db28d45ac36b2cbc9

  
Dropped by
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d24189fffd0bdcb0395a3670721f29f37d08bd80565471db28d45ac36b2cbc9
  
Dropping
MD5 6df8d60dd8a8848681698ca450ab8481

Comments