MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ec60b31a40c7e7ba36100a8b4f93abcae95167b08e8faa845d673939d81f6f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ec60b31a40c7e7ba36100a8b4f93abcae95167b08e8faa845d673939d81f6f4
SHA3-384 hash: 52ae5a68b46814552c09632cb253b6e6640ad9c5a6653909c6a7e5867dcdfca8f51972e4b5df7d263105253a0d80b35b
SHA1 hash: aaca89677cda22c4bce32450e111f56271e55dad
MD5 hash: 00e9004edfb28f2bc4c82b796ede102f
humanhash: hotel-october-two-july
File name:Rfq 214871_TAWI Catalog.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:391'168 bytes
First seen:2021-01-04 18:01:08 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:e/hXM6TGfaXeRGjwj9qsgEtBI/IJQSv38gRxZcJ1lIwMSZIVGI+0VyFQX9eraeaS:2XMXFUsgEz3KJ1lIwPuVdWrajt
TLSH 13843B6277C8F6A6E18040B97105FFA640513C34292EC843F7C97B5B39722EE9A16F5B
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: vepo.donoralpha.com
Sending IP: 111.118.214.86
From: procurement@tawi.com.ph
Reply-To: procurement.tawi@mail.com
Subject: RFQ 20/4871 for TAWI GROUP
Attachment: Rfq 214871_TAWI Catalog.iso (contains "Rfq 214871_TAWI Catalog.com")

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisCC1F751EDBB4.10927.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ec60b31a40c7e7ba36100a8b4f93abcae95167b08e8faa845d673939d81f6f4/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 18:02:06 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3dawmnebr7hxi3baculj6j2xsxjkft3bdupvkcf2zzzhhmb632a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0ec60b31a40c7e7ba36100a8b4f93abcae95167b08e8faa845d673939d81f6f4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 0ec60b31a40c7e7ba36100a8b4f93abcae95167b08e8faa845d673939d81f6f4

(this sample)

Formbook

Executable exe 73872fa96dc607365e450f7dae21085f9091d511fb2a495ae55b2a3e812d9a34

  
Dropping
MD5 cc1f751edbb4142e1cbe28034a755c04
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 73872fa96dc607365e450f7dae21085f9091d511fb2a495ae55b2a3e812d9a34

Comments