MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e15f5f63e6567529c48d76f8bb06944c17d9029b5a540026fec84e5bb5a6a7f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e15f5f63e6567529c48d76f8bb06944c17d9029b5a540026fec84e5bb5a6a7f5
SHA3-384 hash: cd2906fb207d19c538b7b7deef6491069803425cf7d82eb05202f9b905b40ca6555f53e9b8d4ead8a113de861bc5863e
SHA1 hash: aaf6da4874d7403b8ac7eb8b4be6ffa00e30fe95
MD5 hash: 3b0cf22f00f51fab778bcee1e51e2711
humanhash: jupiter-ohio-magazine-illinois
File name:copy.pdf.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:434'161 bytes
First seen:2020-06-20 06:01:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Se31WKIySdPKIS17J5ihYy9Etok8O7j9RG:SeFW1ySIdihYy9Etoh4JRG
TLSH 1C9423A4C5DDA8D79A0BF79EEF6895EF3513500431C8C7056C6E7B9296FA120402BEA3
Reporter abuse_ch
Tags:FormBook HSBC zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: slot0.wewinning.xyz
Sending IP: 45.95.169.89
From: HSBC <swift@hsbc.com.ph>
Subject: SWIFT confirmation details
Attachment: copy.pdf.zip (contains "copy.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 06:03:03 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4fpv6y7gkz2streno34lwbuujql5sau3ljkaajx6zbhfxnngu72q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip e15f5f63e6567529c48d76f8bb06944c17d9029b5a540026fec84e5bb5a6a7f5

(this sample)

FormBook

Executable exe 8e40f99cc08408c1ee5a1ec56357f23d993e29a6c4e5751a6fad33e7c9e222e1

  
Dropping
MD5 c013a10b2c99e66a4b26e912a71d1867
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e40f99cc08408c1ee5a1ec56357f23d993e29a6c4e5751a6fad33e7c9e222e1

Comments