MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 079c7d83465481952407f3da954e08a5f165ff5480e2a51c32505088e78750f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 079c7d83465481952407f3da954e08a5f165ff5480e2a51c32505088e78750f5
SHA3-384 hash: 147ed017402f555aaa1c3f341913b9ebeeac82ca4d168fabd0c018b9d2ff44e41d6602d7f31c15ac8437fb34c87cb265
SHA1 hash: 8535e8022b32d1980b6af2829281582c59dd226f
MD5 hash: 9ca67e4d66813ccda202476f5df62253
humanhash: india-london-two-magazine
File name:(RFQ)1.1 LNG (LGP 1 LNG Package)_(13033B).img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-02 07:47:04 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:WR3mQbbmNRxegofI2vrqjjJnjh7luYoUbLB4N6x:YmNRxeg2TTqHF63dN
TLSH 5145BE3A22D51BA8E57DD73956A4212047F1BA03E333C36A3DEC11C98F91E895633B66
Reporter abuse_ch
Tags:FormBook geo img KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: 서진효 <jinhyo.seo@daewooenc.com>
Subject: [울산북항 LNG PKG]Request for Quotation_터미널 1단계 LNG Package 건설공사
Attachment: (RFQ)1.1 LNG (LGP 1 LNG Package)_(13033B).img (contains "(RFQ)1.1 LNG (LGP 1 LNG Package)_(13033B).exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com..10513.20792.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/079c7d83465481952407f3da954e08a5f165ff5480e2a51c32505088e78750f5/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6oh3a2gksazkjah6pnjktqiuxywl72uqdrkkhbskbiirz4hkd2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/079c7d83465481952407f3da954e08a5f165ff5480e2a51c32505088e78750f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 079c7d83465481952407f3da954e08a5f165ff5480e2a51c32505088e78750f5

(this sample)

Formbook

Executable exe 34be61cbbae899e84afc83e9c84308d24a688bc2a38e9e496f357d75f0d2d27b

  
Dropping
MD5 1be5def739c9cede7a1bf189fc8c8bf6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34be61cbbae899e84afc83e9c84308d24a688bc2a38e9e496f357d75f0d2d27b

Comments