MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ffe8a0c22c433b676f40639e236a1c7cc58656be5150f1bd4dc7f24d807c761. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ffe8a0c22c433b676f40639e236a1c7cc58656be5150f1bd4dc7f24d807c761
SHA3-384 hash: 307c3c96185e261e16ca650682dc2261eb891c3c9a87f8f19ab353e4d98e4c6d65ed2767279e3fb200799e99bd39c761
SHA1 hash: 9baeef431b0d1705291292e6f9d311b5f77126ad
MD5 hash: b5dc38b791076c31153ff6310b928113
humanhash: alpha-avocado-low-colorado
File name:Payment Advice.doc
Download: download sample
Signature Formbook
Create hunting rule
File size:310'015 bytes
First seen:2020-05-07 12:07:44 UTC
Last seen:Never
File type:Word file doc
MIME type:text/rtf
ssdeep 1536:m2STPJyjtHv9YH9E96obaKkRq+GbUZhyf6mQgaeeVhMDw5wfLN:mYb7aRDAw5wf5
Threatray 5'081 similar samples on MalwareBazaar
TLSH 1D6468E820C78A50E645A528E9C8F58D05B6B5E770C84D7853EFF8739E59FD02E8818F
Reporter jarumlus

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Exploit-RTF-Dropper-1.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.RTFSTR.SCRIPTLET.200421.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Document-Word.Trojan.CVE-2017-8570
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 14:00:00 UTC
File Type:
Document
Extracted files:
9
AV detection:
11 of 31 (35.48%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1edf8c6bcf0ae2b38e9e28bcb1fd838c2ea35b5b126e4bc9e42daa2e1e722298
Formbook
54dd660151b98bcbe222d290c2407d654786b72bc2bcdd0293cd8741a1e20266
Formbook
8842ac3497c777517b2f18152eabaa0994a460d249773a5e89a4e16bca2bd741
Formbook
8a1f8815b2d54f7171358001bec7be97d87660a29d8bce9d247da901b012f594
Formbook
c5049b79f66303da5f8f91e527b7f182a765c54c075f134b1779fc5802ad6b1b
Formbook
cb79e22a86732bd8ccbb3d73dcc9ef716e305c85dfed8872851c273d1eaacaf4
Formbook
cfbd66845ba87ca332833515563aaf417025692ad4f341567b7bd11a509c06d9
Formbook
d76bb689a401094eee47a075368224161d261665c2b285b155d1b7833ba4fbaa
Formbook
dea5303370177b621cdd1fd497396ddaa9e94d3edd1407339f52f0dc85a67046
Formbook
e273d82c782a01c388cc619e6832bfb43301f4308884751b9393262302fc84c0
Formbook
+ 5'071 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-vflx87rm8j/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
NTFS ADS
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Retefe
Create hunting rule
Author:bartblaze
Description:Retefe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Word file doc 1ffe8a0c22c433b676f40639e236a1c7cc58656be5150f1bd4dc7f24d807c761

(this sample)

Formbook

Executable exe cfbd66845ba87ca332833515563aaf417025692ad4f341567b7bd11a509c06d9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cfbd66845ba87ca332833515563aaf417025692ad4f341567b7bd11a509c06d9
  
Dropping
MD5 bc0a9468b9de7354e369b021ec50cc1e

Comments