MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0fcfb06093cb25bc222e54065620b24f582b5865cb7a6c9e5a238fe8743340e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0fcfb06093cb25bc222e54065620b24f582b5865cb7a6c9e5a238fe8743340e
SHA3-384 hash: e70c150da879220f835af1d6fd770c081530b0a59672a6a14800f8aa645e4a6a4a4a6df51d79d87b3d6408dc89d2cd82
SHA1 hash: ffc5a1cf1adf973cc552f5c541767ff4e29a5411
MD5 hash: 87a4d35c6c735302ed84dc0ba785584a
humanhash: crazy-july-saturn-magazine
File name:TOYO-M’s General Conditions of Purchase.exe.iso
Download: download sample
Signature FormBook
Create hunting rule
File size:907'264 bytes
First seen:2020-08-04 10:14:29 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:o3Ou0HcPgYxmOE+2Do4pPeRH89fx/jPhVTq/+rMHvniNp12mDVjUR:bu5IYxPeVZlH1VTQqMHe3V
TLSH AE15AEC5F1409A5DD81A4D3B8D324C914B33AC6BEF06D207349DB6996BBB1C66E24F83
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing FormBook:

From: gomez reham <gomez-reham@toyo-eng.com>
Reply-To: procurement@toyo-eng.com
Subject: RE: TOYO ENGINEERING FINAL REMINDER [PR742 BIO-MEG] AYBF001 Hot Oil Heater / RFQ / Toyo Engineering & Construction Sdn. Bhd
Attachment: TOYO-M’s General Conditions of Purchase.exe.iso (contains "TOYO-M’s General Conditions of Purchase.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0fcfb06093cb25bc222e54065620b24f582b5865cb7a6c9e5a238fe8743340e/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 10:16:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6d6pwbqjhszfxqrc4vagkyqlet2yfnmgls32nspfui4p5b2dgqha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f0fcfb06093cb25bc222e54065620b24f582b5865cb7a6c9e5a238fe8743340e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso f0fcfb06093cb25bc222e54065620b24f582b5865cb7a6c9e5a238fe8743340e

(this sample)

FormBook

Executable exe cc84debcfc3e30a4b682bb53e028acb0a75d56607ab25b2418797f65a7e6efb7

  
Dropping
MD5 339e21f5891cb585710cd86ca799fdba
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc84debcfc3e30a4b682bb53e028acb0a75d56607ab25b2418797f65a7e6efb7

Comments