MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f201f5ed829e08dbd5ccb40533f26010f5c3e75134fc1da3f9ed56eec6077300. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f201f5ed829e08dbd5ccb40533f26010f5c3e75134fc1da3f9ed56eec6077300
SHA3-384 hash: fa9bb9566bc6d7243d9f8a45b0d3f3d54655c5321ccc6a573a7087f4e37ceb1db095b31ad5ba1e0dabf0ba425910ca8e
SHA1 hash: 6df51e167bb25b675f0f3b79f2ceb52426ca8292
MD5 hash: 15cdaba40d68b1aaaa46e176b94dd946
humanhash: ceiling-bluebird-winner-california
File name:Purchase order PO045793 from Voile Trading Co.,Ltd.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:243'321 bytes
First seen:2020-05-25 18:08:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:eNrtqEJ6ETFCOJPr/8Bhr4DoNI5gV9G/wTkGA3H0xSNPoBYO:eNr7nd8BaDdgVM4Tk30xoZO
TLSH B034232E6147F7DDE44117C2742F7601CF9E4862AF644916002ACBB6EFC7A67AFE1211
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.196
From: Divine Gutierrez <sales02@ywxspring.com>
Subject: Re:Purchase order PO045793 from Voile
Attachment: Purchase order PO045793 from Voile Trading Co.,Ltd.zip (contains "Purchase order PO045793 from Voile Trading Co.,Ltd.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 18:35:41 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip f201f5ed829e08dbd5ccb40533f26010f5c3e75134fc1da3f9ed56eec6077300

(this sample)

FormBook

Executable exe c6bed06259f7c50c2b15e8161d5b1fa11690e69a7e5bb3261202debfb7d96708

  
Dropping
MD5 b02fb2439cd88a5e399683f14d6d80ff
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c6bed06259f7c50c2b15e8161d5b1fa11690e69a7e5bb3261202debfb7d96708

Comments