MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b472f10e007ff12dd477da58de8b555a4bbb5c758d7e98361328ca48cb2a208. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b472f10e007ff12dd477da58de8b555a4bbb5c758d7e98361328ca48cb2a208
SHA3-384 hash: 616dc0bf597bdb080c601b4ccda4ac58b35785a319e001959c8eac388c7e73d4d915fc2ff1b112d9ec3a2ca632e43a00
SHA1 hash: d6bb0efe846ed657ecf8861b84e257f05822f7c6
MD5 hash: b3a992e5e3d68a4d737e04836555cb69
humanhash: jersey-sink-mexico-violet
File name:DA-PROFORMA-BCC-211370-1-1289009-doc.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:209'341 bytes
First seen:2021-03-31 06:58:39 UTC
Last seen:2021-03-31 09:50:00 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:p+vB44o4QqRfqp/ERh3KZMJvwYieVexbvIXj:p+5447QEfqtqe4V2bvg
TLSH 521423C8E5BDC87819F634B136C0801CEEB5513BB6986A986EBD471C319CBBDB02C6D5
Reporter abuse_ch
Tags:arj


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: da-desk.com
Sending IP: 103.99.1.146
From: DA-Desk FZ-LLC Mail System <bccs@da-desk.com>
Reply-To: DA-Desk FZ-LLC Mail System <bccs@da-desk.com>
Subject: Appointment acceptance receipt confirmation for DA-PROFORMA - BCC-211370-1, 1289009
Attachment: DA-PROFORMA-BCC-211370-1-1289009-doc.arj (contains "DA-PROFORMA-BCC-211370-1-1289009-doc.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_doc.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25907.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/1b472f10e007ff12dd477da58de8b555a4bbb5c758d7e98361328ca48cb2a208
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b472f10e007ff12dd477da58de8b555a4bbb5c758d7e98361328ca48cb2a208/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 02:45:17 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dnds6ehaa77rfxkhpwsy32fvkwslxnohldl6ta3bgkgkjdfsuiea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/1b472f10e007ff12dd477da58de8b555a4bbb5c758d7e98361328ca48cb2a208

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 1b472f10e007ff12dd477da58de8b555a4bbb5c758d7e98361328ca48cb2a208

(this sample)

Formbook

Executable exe 1de5c6b986a6401ba0490ccce78e8bf125d9604d07c4ad87a856a588f0aba6cb

  
Dropping
MD5 5a701f7f34d8198f49fdfb7dc7e88c19
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1de5c6b986a6401ba0490ccce78e8bf125d9604d07c4ad87a856a588f0aba6cb

Comments