MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07404e970a44aca7a063ab284b3ebaabf212ead386b6ad15f1046318cd55ecb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07404e970a44aca7a063ab284b3ebaabf212ead386b6ad15f1046318cd55ecb2
SHA3-384 hash: 3bbe8d2c6d7b71c94e8240a8ac4871d153db3628eedf3b33d98412a7805aeea6ae33cdece894df8da9219e2a17868c71
SHA1 hash: f1b97ca404053a25df45f4d7562ec63b28ecb2e8
MD5 hash: 94d143f2e66e3a741f50da8dc2ac00de
humanhash: tennessee-ceiling-fruit-fix
File name:SWIFT COPY (1).pdf.z
Download: download sample
Signature Formbook
Create hunting rule
File size:217'326 bytes
First seen:2021-04-14 16:51:13 UTC
Last seen:2021-04-15 05:31:32 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:kKqieqwAUKb0GKTEoyx6xBXuZ0ydT7zNTHdB:kpi7wKb0RNsmXuZ9NTH
TLSH 90241280CE9A5E90AAEE0472000773E059AA515FC81529ED65C8F28DD5FF87D2C3F7B9
Reporter cocaman
Tags:INVOICE SWIFT z


Avatar
cocaman
Malicious email (T1566.001)
From: "ZHONGSHAN DAZHI SUPPLY CHAIN MANAGEMENT CO.,LTD. <ocean.lin@dazhi-hk.com>" (likely spoofed)
Received: "from dazhi-hk.com (unknown [45.137.22.100]) "
Date: "14 Apr 2021 15:04:26 -0700"
Subject: "RE: INVOICE "
Attachment: "SWIFT COPY (1).pdf.z"

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07404e970a44aca7a063ab284b3ebaabf212ead386b6ad15f1046318cd55ecb2/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-04-14 16:52:10 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
13 of 29 (44.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a5ae5fykiswkpiddvmuewpv2vpzbf2wtq23k2fprarrrrtkv5sza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/07404e970a44aca7a063ab284b3ebaabf212ead386b6ad15f1046318cd55ecb2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 07404e970a44aca7a063ab284b3ebaabf212ead386b6ad15f1046318cd55ecb2

(this sample)

Formbook

Executable exe 85c528083c96b1f895ddd73681a8b78caf639b8dcf91eca47ae4e7e7cd3e3540

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85c528083c96b1f895ddd73681a8b78caf639b8dcf91eca47ae4e7e7cd3e3540

Comments