MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 147eb9a06a2f94511bb3fd8637cffb4d4d3283fa5fdbd1e82519f014e7ddad81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 147eb9a06a2f94511bb3fd8637cffb4d4d3283fa5fdbd1e82519f014e7ddad81
SHA3-384 hash: 0d5280bf4cff692493b6e1b85a1c372ea41c494840b73184d77c4672a2b7956b8e502c569ba3fad48e00f16b61d5e770
SHA1 hash: 135f9fbd6aa31f6ddd7e8f3558e46bc046316385
MD5 hash: ddb8d7e67559eb93f58c0d76ee099f5c
humanhash: whiskey-nitrogen-robin-solar
File name:PO98765.z
Download: download sample
Signature Formbook
Create hunting rule
File size:489'452 bytes
First seen:2020-11-26 08:34:01 UTC
Last seen:2020-11-26 10:29:35 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:eVt9F7S09tl4qdfQHN3j01ZSU8/cSOan4HU/stc1Guac8JrInytLGEo/cYkp:eV/JdIH9OgN/6qFwJ5tLJL
TLSH 95A423E3EB4D510AED043133E797E19A28E0E0D90B85544D6D7F71E2DB3DAE8C0DA626
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email (T1566.001)
From: "Lisa <info@indianfiles.in>" (likely spoofed)
Received: "from indianfiles.in (unknown [92.118.190.190]) "
Date: "26 Nov 2020 09:45:32 +0100"
Subject: "PURCHASE ORDER39873"
Attachment: "PO98765.z"

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/147eb9a06a2f94511bb3fd8637cffb4d4d3283fa5fdbd1e82519f014e7ddad81/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cr7ltidkf6kfcg5t7wddpt73jvgtfa72l7n5d2bfdhybjz65vwaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 147eb9a06a2f94511bb3fd8637cffb4d4d3283fa5fdbd1e82519f014e7ddad81

(this sample)

Formbook

Executable exe 60263179eccb843c5aa38040ebd2483b29a3923a94987f006561488e5d0f1d96

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 60263179eccb843c5aa38040ebd2483b29a3923a94987f006561488e5d0f1d96
  
Dropping
Formbook

Comments