MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fa43cf52471509d28ecd8231a31225f1b9f9f137cff159dc3560815a5b74a75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fa43cf52471509d28ecd8231a31225f1b9f9f137cff159dc3560815a5b74a75
SHA3-384 hash: 6fb9f35241902e1c3f60aab4382ce5fa693eac1aa90c4783ed872d92b52550d16ca5b9e2a7940814e0d64943ae425ab5
SHA1 hash: b47551f8ce3b5631c408655212c579c21283d20d
MD5 hash: b667419acb9647b097f7c4fa59c8e6f8
humanhash: wyoming-jersey-alaska-orange
File name:dhl.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:283'556 bytes
First seen:2021-01-04 07:31:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:z1YDt8biepe6HFOKPql07OyGyWZyUJ4KhDJHap5swX:zst8biep/xPq8OyGyaF7BapOi
TLSH 995423D5B135F65B12E02528627021A0677CAA7D3B3E11CE7D371BAB0155FCBA21FE22
Reporter abuse_ch
Tags:DHL FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: ns.soho.co.jp
Sending IP: 211.8.31.18
From: DHL Express<receipt@dhl.com>
Reply-To: <receipt@dhl.com>
Subject: DHL Courier / Shipping Document
Attachment: dhl.rar (contains "dhl.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.MSIL.Kryptik.QME.99298.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fa43cf52471509d28ecd8231a31225f1b9f9f137cff159dc3560815a5b74a75/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 04:09:39 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6sdz5jeofij2khm3arrumjcl4nz7hytpt7rlhodkyebljnxjj2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0fa43cf52471509d28ecd8231a31225f1b9f9f137cff159dc3560815a5b74a75

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 0fa43cf52471509d28ecd8231a31225f1b9f9f137cff159dc3560815a5b74a75

(this sample)

Formbook

Executable exe 63ddf9a4a4f69468eef45c633df0066f39b025e7a0a0c8d8dc7e50982ed93b39

  
Dropping
MD5 a5afbe6a4e6fe51ef8bbb47f40db590b
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 63ddf9a4a4f69468eef45c633df0066f39b025e7a0a0c8d8dc7e50982ed93b39

Comments