MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14b0c34398683f1c2cf60b4df925b42750e1883724335339c9d0b257fb23c712. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14b0c34398683f1c2cf60b4df925b42750e1883724335339c9d0b257fb23c712
SHA3-384 hash: 2ed27b02a7ce8c78bfe86b224b9b4e3c8a9dbeac334b6338c6632220eda92b87c49b2600689ba3b55035d625870a48fc
SHA1 hash: 07ebe0f919b3656f39b1e82d03ca29ad5ee1e6d2
MD5 hash: 5e2f325bfe91c83128639b778214b175
humanhash: winter-stairway-kitten-washington
File name:PO101420.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:677'234 bytes
First seen:2021-01-14 20:04:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/5xvpaEZ2TfxoHFT1rrEwjE2fKOQzndZZdjMgk/dQX3wNvhT3M7HT6uHU+/4J7:/lz9lJrrEmChndZZbk/QUhT3KnQd
TLSH 5FE4330A9D5525357F8B805ED5AC002AE06FAF1239EEF7858150279AFC330664BB5F3B
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.hitinalow.ga
Sending IP: 23.254.229.236
From: lizzyyoung668@gmail.com
Subject: Re: New Order
Attachment: PO101420.zip (contains "PO101420.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14b0c34398683f1c2cf60b4df925b42750e1883724335339c9d0b257fb23c712/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-14 20:05:07 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=csymgq4yna7rylhwbng7sjnue5iodcbxeqzvgooj2czfp6zdy4ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/14b0c34398683f1c2cf60b4df925b42750e1883724335339c9d0b257fb23c712

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 14b0c34398683f1c2cf60b4df925b42750e1883724335339c9d0b257fb23c712

(this sample)

Formbook

Executable exe 709b457160612a42a7714a517690760f05b09fb55f61570632500aa14328deec

  
Dropping
MD5 ff9de567dd3c2aa2ebcb5e0450964875
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 709b457160612a42a7714a517690760f05b09fb55f61570632500aa14328deec

Comments