MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6c7fded730b3a7330e68f13c2b540a886b05d276a5c4ec3536a9c9813cc5e34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6c7fded730b3a7330e68f13c2b540a886b05d276a5c4ec3536a9c9813cc5e34
SHA3-384 hash: 44028708ef5cd2f811363d46369fb4c9ac0f715e8a292e245bc4909fda1ac863fc281bae8afe7dfd30690c0111bc4089
SHA1 hash: 560867f2fa81d21e4d9866f2667317571a1ac930
MD5 hash: 5e2349edf78491f2e793543978e0bd5d
humanhash: ack-stream-winter-mexico
File name:order2.img
Download: download sample
Signature FormBook
Create hunting rule
File size:2'097'152 bytes
First seen:2020-06-16 10:45:46 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:tsE+vF8Th7G6rdhASVNe1/hqIiHsCTM7x:tsEmIQSjiBiM
TLSH C5A59E37A3D17476C1E63EB9D816C69E58DEBD801AD4107F1AEB4B0B1A2B661333C172
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: slot0.nextbugaero.com
Sending IP: 45.95.169.180
From: Nicole Gapes<info@nextbugaero.com>
Reply-To: gapes.nicole@yahoo.com
Subject: Price List
Attachment: order2.img (contains "Order2.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader33.54874.8500.28600.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Exploit.BypassUac
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 10:47:04 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=43d733ltbm5hgmhgr4j4fnkavcdlaxjhnjoe5q2tnkojqe6mly2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img e6c7fded730b3a7330e68f13c2b540a886b05d276a5c4ec3536a9c9813cc5e34

(this sample)

FormBook

Executable exe 91864b23c3bfb54a354704f3fa769b25d641fd510aa4854a45f5de5956505e91

  
Dropping
MD5 44f4cbe95fce72b86d4f84717fb752d3
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91864b23c3bfb54a354704f3fa769b25d641fd510aa4854a45f5de5956505e91

Comments