MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ce4c50de8607241ddf5dd785bf7d28cc0ba4eee1461c70863d80ce4cc6ce63c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ce4c50de8607241ddf5dd785bf7d28cc0ba4eee1461c70863d80ce4cc6ce63c
SHA3-384 hash: 5aec73defb9b0d3e05ddd8352a0a979d5be06942b7c9600489a32399d9bf1a1e25fc1976d6fe621b7b1eee362a4aaab1
SHA1 hash: d01b1e2e1c4dfbd44d89a11eb53b36e666b2ce57
MD5 hash: 4e7b077279539afda267ff31d42b06b9
humanhash: nine-magazine-hydrogen-cold
File name:Inquiry pdf.z
Download: download sample
Signature Formbook
Create hunting rule
File size:394'893 bytes
First seen:2021-02-06 13:47:13 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:Gkh0obcRw1m2QNRtRB8IF8uiiMaehF5oftqZQWsbsIhyE5Pkfggil+rVFjbYF:GW0QWw4dNVWkh7lebSfWQWsbr58R5/be
TLSH 3E84239A17136DEA37CE60826F6C3CA529ED4D1B49CEF0A30B4F239C7C18654E9DE464
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email (T1566.001)
From: "Tamta Beraia<server@hobbyiobby.com>" (likely spoofed)
Received: "from hobbyiobby.com (unknown [45.137.22.51]) "
Date: "6 Feb 2021 02:54:59 -0800"
Subject: "Fwd: Product Inquiry"
Attachment: "Inquiry pdf.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ce4c50de8607241ddf5dd785bf7d28cc0ba4eee1461c70863d80ce4cc6ce63c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-06 09:01:16 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=btsmkdpimbzedxpv3v4fx56srtalutxocrq4ocdd3agojtdm4y6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0ce4c50de8607241ddf5dd785bf7d28cc0ba4eee1461c70863d80ce4cc6ce63c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 0ce4c50de8607241ddf5dd785bf7d28cc0ba4eee1461c70863d80ce4cc6ce63c

(this sample)

Formbook

Executable exe 7c8c0bb9a552f62aa1ef1e5c037ef17b2064055d15025eea8c6b2b5ccd54f10e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c8c0bb9a552f62aa1ef1e5c037ef17b2064055d15025eea8c6b2b5ccd54f10e
  
Dropping
Formbook

Comments