MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 097464ec913da3d525f2aa92f6f877d81b619a4ad59bdf9da567ff60ce985a3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 3
| SHA256 hash: | 097464ec913da3d525f2aa92f6f877d81b619a4ad59bdf9da567ff60ce985a3d |
|---|---|
| SHA3-384 hash: | 173721d5958d52873103e2d5e81fac9ad87ede392adacfe328d3b0bc419ab9c24b6bab952656c3cbfc420997b81fbe62 |
| SHA1 hash: | 3232f37475ee399f70bcbdf58ac6dd6db0220c3b |
| MD5 hash: | ccd1c7f5041a371f5d76d575171fab18 |
| humanhash: | dakota-foxtrot-oranges-juliet |
| File name: | Maksuvahvistus.zip |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'363'704 bytes |
| First seen: | 2021-04-19 15:50:03 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 24576:0Gsz20dBz7WKQsMYa1EWmMA29hgq1svNGA9e8FoJRSoipmAiAxLp5U:0GW2UWXfEWmBsRa4SkSo/oe |
| TLSH | C055333D32C99988DF6A0EC089E5020DD89CA8A38DB5D997C2CD1F5F9710F1CAF195DA |
| Reporter |  GovCERT_CH |
Intelligence
File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.