MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09f2e3658cbc40c948b56017608af5316b0ff94ea3d632a3c977152eedd24aad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09f2e3658cbc40c948b56017608af5316b0ff94ea3d632a3c977152eedd24aad
SHA3-384 hash: 2e70cf8d24fe4eb0081d057dae0efbeb11abe37445d1d459ee6c8acafff6bc1f6357b8ab10f11ff573f4316e310ac984
SHA1 hash: aeb98e3ecd75ef419355a39ef003f0fdf42f710c
MD5 hash: 88ac04e653225cfb13f5611ed87a130a
humanhash: shade-one-earth-high
File name:PO-21-0076.PDF.z
Download: download sample
Signature Formbook
Create hunting rule
File size:269'423 bytes
First seen:2021-03-19 18:34:18 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:+yOLZ32M75BUXDtXg96OahTxfhNKbStGkMf1e+yptSlvyLvJC+MMQ:+yClNBMDtQ9eRtvtN61CSl8C+MMQ
TLSH 8C442345D802E0BAC3CA0D436711D0B35F7BB32D610E7874C44E5B6D751AABA3C39AA3
Reporter cocaman
Tags:z


Avatar
cocaman
Malicious email (T1566.001)
From: "Mohammad Azaz Sarwar <masarwar@icddrb.org>" (likely spoofed)
Received: "from icddrb.org (unknown [104.129.24.112]) "
Date: "19 Mar 2021 04:11:04 -0700"
Subject: "RE: PO-21-0076 against /NS-20-3738/2021"
Attachment: "PO-21-0076.PDF.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09f2e3658cbc40c948b56017608af5316b0ff94ea3d632a3c977152eedd24aad/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-19 12:00:04 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bhzogzmmxramssfvmalwbcxvgfvq76koupldfi6jo4ks53osjkwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/09f2e3658cbc40c948b56017608af5316b0ff94ea3d632a3c977152eedd24aad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 09f2e3658cbc40c948b56017608af5316b0ff94ea3d632a3c977152eedd24aad

(this sample)

Formbook

Executable exe 1d03cbad439f831d0cdd34e444ef7d054fc46370025a2ee70a29abc50a178cd4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d03cbad439f831d0cdd34e444ef7d054fc46370025a2ee70a29abc50a178cd4

Comments