MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c941ea2b294981ace026ef6e9c51190910ab02def7d9454f67098da7a774937b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c941ea2b294981ace026ef6e9c51190910ab02def7d9454f67098da7a774937b
SHA3-384 hash: 08525a2fde5d015eaab414ac2adb5e095a27e127fadef3b2ef47dad88f3fa14d18d91a682bd2f844b3f13f2e0de177ab
SHA1 hash: 2dd8daa337b6ad073d5481250081916eb38fc153
MD5 hash: 4a680d2fe8c92fe28a2f789964550945
humanhash: alpha-nevada-fifteen-magazine
File name:Draft Contract1 Shipment-pdf.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:414'938 bytes
First seen:2020-05-11 10:26:34 UTC
Last seen:2020-05-11 15:28:29 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:c35Ox0Jr3kMsyXU2ea/t+nibO4MCAk9dbr7/H:D0B3k4U0ui64G+
TLSH 899423AED91D4C2BA809DE7048DCC66487D5B7F5EB2CEC43285CC2889E6700DF795A23
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
4
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 10:47:22 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfa6ukzjjga2zybg55xjyuizbeikwaw667mukt3hbgg2pj3usn5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip c941ea2b294981ace026ef6e9c51190910ab02def7d9454f67098da7a774937b

(this sample)

FormBook

Executable exe 1c7388bfdfb41e34dc95423b351d3b18d737889d9f8648da0ce24048d6e2f495

  
Dropped by
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c7388bfdfb41e34dc95423b351d3b18d737889d9f8648da0ce24048d6e2f495
  
Dropping
MD5 494af35c7dd4519a33fab574e66d3e0e

Comments