MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f4cdd70a2168dcc26b55a9ec7f16987a56c4301b1c289bceef132b2400bfd07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f4cdd70a2168dcc26b55a9ec7f16987a56c4301b1c289bceef132b2400bfd07
SHA3-384 hash: 4dc4ae6a4ec8816defe87a51c32bbba4b0c6db5171e3cd68ac2a3fb6aa717cc03686bda4a5798af230eb05bc1f54b52b
SHA1 hash: f48e900d7d1d5be45c625444304b7a4fe336e53d
MD5 hash: b58d41159f55da7e2613bd7b1dcd0f72
humanhash: asparagus-mobile-sodium-cup
File name:Outstanding statement.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:312'649 bytes
First seen:2020-10-05 11:23:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:TR7oa9e1/JP+YqGY60VgpMOx8S8+L5WjxIdLM2bii/++YJHQv:TBe146dt8+MMViCYJHI
TLSH 8E64221C99A474152CB234FB5CF853C8E064464AC3FFA65D34336B00936A8EEABCDB65
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: linux3.webmastersindia.net
Sending IP: 207.58.177.91
From: accounts1 <accounts1@zaleship.com>
Subject: RE: Outstanding statement
Attachment: Outstanding statement.zip (contains "Outstanding statement.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f4cdd70a2168dcc26b55a9ec7f16987a56c4301b1c289bceef132b2400bfd07/
Threat name:
ByteCode-MSIL.Trojan.SmartAssembly
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 10:59:50 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5gn24fcc2g4yjvvlkpmp4ljq6swyqybwhbitpho6ezleqal7udq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f4cdd70a2168dcc26b55a9ec7f16987a56c4301b1c289bceef132b2400bfd07

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 1f4cdd70a2168dcc26b55a9ec7f16987a56c4301b1c289bceef132b2400bfd07

(this sample)

Formbook

Executable exe c65fe5438e02a697fa15a0c17e76885ffb3a22eb92d47359f0519196d8b9c104

  
Dropping
MD5 dea5848e1a04b430b59500a4a5b1e067
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c65fe5438e02a697fa15a0c17e76885ffb3a22eb92d47359f0519196d8b9c104

Comments