MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c96692ae8abe08d8fdd8627fdef74513a6843350f57aaa6afdf4390de0cdd3a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c96692ae8abe08d8fdd8627fdef74513a6843350f57aaa6afdf4390de0cdd3a3
SHA3-384 hash: f63e0695dbbc625b4bc6267269f7cc1c3a976b518be5edab2203c020a582a424bebb139b4bfbc98ccaa321670a7df356
SHA1 hash: d631bc196678e1b3338002b5f0cb37c913a7cc94
MD5 hash: 7496ff994aa3673fa3b3e257a69dc7ec
humanhash: lemon-five-autumn-hydrogen
File name:Proforma Doc.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:207'074 bytes
First seen:2020-07-20 12:05:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:d7ohso1gmksd1zGHXtZ3amsRQDEKu22hiFlN4Ln/j6JYjb3Z:ZtbmkU1S3twUE024lN4D/+JYvZ
TLSH 531413096F3255F6FCA1EC2A9C9A9C6BF106DAF4ECACC096C440415F949CDD512BD2C6
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: unitechsystem.com
Sending IP: 95.211.253.194
From: Aadila Al Shanfari<adila.Shanfari@unitechsystem.com>
Subject: Re: Notice Of Payment release and confirmation of bank details
Attachment: Proforma Doc.zip (contains "Proforma Doc.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodZp-A.4843.7009.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c96692ae8abe08d8fdd8627fdef74513a6843350f57aaa6afdf4390de0cdd3a3/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 12:07:04 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zftjflukxyenr7oymj75552fcotiim2q6v5ku2x56q4q3ygn2orq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c96692ae8abe08d8fdd8627fdef74513a6843350f57aaa6afdf4390de0cdd3a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip c96692ae8abe08d8fdd8627fdef74513a6843350f57aaa6afdf4390de0cdd3a3

(this sample)

FormBook

Executable exe 8d8f0c6fdcd021f11d41e3da7521ec78e5460def24bd61f7eb15879788fafcc2

  
Dropping
MD5 64e041d709a1b6d2b8ae678e0ba63c5b
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d8f0c6fdcd021f11d41e3da7521ec78e5460def24bd61f7eb15879788fafcc2

Comments