MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11229717430c541b88de006884dd7a9c42d5ef2ae24433f7c92b4711ed4a6529. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11229717430c541b88de006884dd7a9c42d5ef2ae24433f7c92b4711ed4a6529
SHA3-384 hash: ea93b6800c315ecd8988a72575152a29e78f9221767df1e15a8eca8395f2dae57d09094f3ef67af57c304cad819766dc
SHA1 hash: 22661c625455d1836af702587313d21f59ae7bf9
MD5 hash: 9b0ae214979397cde1bd2fb2a075bf42
humanhash: princess-maine-december-hotel
File name:Order.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:368'522 bytes
First seen:2020-06-16 05:18:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:jxor1fDELFHQXjcX071XVaylvFVWMPCqzgoT+sormky5+zOn05Imcfzxftsk+w+a:jxi1fDoFwXZ71FLlvDtzgq+sxCOn0Kjt
TLSH 137423824F456647DF0D857EC429F8F1C938649583E35F8627DE82CEC0E2936482EE76
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sonic315-14.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.134.124
From: ABDULLAH <ozoigbonduoneofenyi@yahoo.com>
Reply-To: heidimendozah3@gmail.com
Subject: Confirmation of Proforma Invoice
Attachment: Order.rar (contains "Cdcdgmj.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Exploit.BypassUac
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:20:07 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cerjof2dbrkbxcg6abuijxl2trbnl3zk4jcdh56jfndrd3kkmuuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 11229717430c541b88de006884dd7a9c42d5ef2ae24433f7c92b4711ed4a6529

(this sample)

FormBook

Executable exe 7246bf76c555a29cb79c124fb1e17001ffcd4625e99fdd552ff9fe88427a0e48

  
Dropping
MD5 4a73fb862eaf3b96a0759fce98bc05a4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7246bf76c555a29cb79c124fb1e17001ffcd4625e99fdd552ff9fe88427a0e48

Comments