MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3d1deb8894adcea109429405e9bd575b8a26a901cc679c32973a74702d79741. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3d1deb8894adcea109429405e9bd575b8a26a901cc679c32973a74702d79741
SHA3-384 hash: 4c672d64df7ad0aaa4a0a53bd4608973f9d603843f6f51cc699c48d886de01a02be9382acea6bd2adfdc8eca5de2826b
SHA1 hash: 3a5e7b0505137dab58c66c0ccb500f8a72a675c6
MD5 hash: 05349b2e7a39db8a413f689b50829c86
humanhash: monkey-mexico-magnesium-river
File name:Product spec purchase order.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:640'912 bytes
First seen:2020-05-20 12:05:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:GKn7yqc3d+yapz9HotQE0iP54PKn7yqc3d+yapz9HotQE0iP540:GSqwy4zwJ0i+PSqwy4zwJ0i+0
TLSH C3D42351D8E9A13F334A1A42C36165BC6674531B748DF988B564BD32EBB2FEC311EC82
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: palantir.greenwoodmails.com
Sending IP: 69.195.142.6
From: sales@greenwoodmails.com
Subject: Re: RFQ New Order
Attachment: Product spec purchase order.rar (contains "Product specification.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 12:36:34 UTC
File Type:
Binary (Archive)
Extracted files:
42
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2pi55oejjlooueeuffaf5g6vow4ke2uqdtdhtqzjootuoawxs5aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar d3d1deb8894adcea109429405e9bd575b8a26a901cc679c32973a74702d79741

(this sample)

Formbook

Executable exe cee1dd4dab302f51c7a8d824e8672bdabd4bae2ef03c015b96702e8ce5e8b70f

  
Dropping
MD5 e021db7f3ee6d3fc266637e61932733a
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cee1dd4dab302f51c7a8d824e8672bdabd4bae2ef03c015b96702e8ce5e8b70f

Comments