MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2953242301852c967392bbccabe8c70e33c2d9fac542e20066abd4e3d46c4d40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 3
| SHA256 hash: | 2953242301852c967392bbccabe8c70e33c2d9fac542e20066abd4e3d46c4d40 |
|---|---|
| SHA3-384 hash: | a735e93f706d4a547b61c37e3d08cc21acbfa96435a4849199d02d8e0df28236f2f1741738e494fc938fa3ca50e3acf9 |
| SHA1 hash: | 7a3fe0360c26c421771ab4cf54d92b6daa0d7947 |
| MD5 hash: | e905ec18f06a7bd0a1eb1a48b9b07617 |
| humanhash: | fifteen-burger-quiet-freddie |
| File name: | G0170-PF3F-20-02602T.cab |
| Download: | download sample |
| Signature | Formbook |
| File size: | 597'233 bytes |
| First seen: | 2020-12-29 08:00:00 UTC |
| Last seen: | Never |
| File type: | cab |
| MIME type: | application/vnd.ms-cab-compressed |
| ssdeep | 12288:hyvtIrTUavoWu3qQgMbq/nxbKgK6BRcImjm4rLpVzpMZpwjjw6YIAO4kEfeE7:GeLvj8g6Kn13BGFj3vfpMI3w6YILhEfT |
| TLSH | F1C423F0C9973212D63D6A46E5ACF99B94AFC2D71293C3492135B62F01FDF0D6680A4D |
| Reporter |  abuse_ch |
| Tags: | cab FormBook |
abuse_ch
Malspam distributing Formbook:HELO: mail-smail-vm47.hanmail.net
Sending IP: 203.133.180.235
From: ė´ėí ë°°ė <kny3940@daum.net>
Subject: ėė˛ėëŖëĒŠëĄ
Attachment: G0170-PF3F-20-02602T.cab (contains "List.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Dropping
Formbook
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.