MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b4194788e140b12361bf9db6857c88d308804e30bca16e4f28dca90a2e12fd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b4194788e140b12361bf9db6857c88d308804e30bca16e4f28dca90a2e12fd6
SHA3-384 hash: e59a754f9c0c9b4a01ec84ab1b74e82039bc8d4dbe976e5204cd972030c445ecd5bba284fe3440a6a5ee857fd1650a1c
SHA1 hash: 83fe7015dfa93b16748a6fca606608316295dadf
MD5 hash: 8ae565b2d330951df5ec2016393541d7
humanhash: double-lake-juliet-november
File name:Commercial Invoice.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:417'940 bytes
First seen:2020-08-17 14:03:26 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:KYysEVhvryDyNi6P4GhrKzi/rgzlMTB2zuzUFs8O:KbzdNiMZt/rolMEqIO8O
TLSH 6C942363BE00FC65C6CE85207157E51CBD60350B7BFF6C850B6079CAA29F2B5ECA191A
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: emirates.net.ae
Sending IP: 45.137.22.136
From: alsumood@emirates.net.ae
Reply-To: milsfrankblaze@gmail.com
Subject: Order 8203 || Commercial Invoice
Attachment: Commercial Invoice.arj (contains "Commercial Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b4194788e140b12361bf9db6857c88d308804e30bca16e4f28dca90a2e12fd6/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 14:05:08 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dnazi6eocqfrenq37hnwqv6iruyiqbhdbpfbnzhsrxfjbixbf7la._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1b4194788e140b12361bf9db6857c88d308804e30bca16e4f28dca90a2e12fd6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 1b4194788e140b12361bf9db6857c88d308804e30bca16e4f28dca90a2e12fd6

(this sample)

Formbook

Executable exe 43a2a98bb50daedc36c6f08ab5698638de59f80ad30f9754b8ff690d90c088f3

  
Dropping
MD5 6ef27022ea23bd2e78d6b26f1fc1dc22
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 43a2a98bb50daedc36c6f08ab5698638de59f80ad30f9754b8ff690d90c088f3

Comments