MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b143c2fe0a31089b8a3a389e9297456b557462f4c0a74909fe1796d9f4239bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b143c2fe0a31089b8a3a389e9297456b557462f4c0a74909fe1796d9f4239bc
SHA3-384 hash: 37c3afed77570ba0917b6e0db93192ec7ab212156f5014e8f2f1f0e84fd48c51dc613c3e36c93e6196d15af80c5efce6
SHA1 hash: df26a232e1af5fc7f444174feae31c69adffad40
MD5 hash: d5889f96c48fc0453c53142637d810dd
humanhash: winner-stairway-cold-delta
File name:Order Drawing.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:351'682 bytes
First seen:2021-03-31 07:11:49 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:0M0rhLtAIZHxVBXc79nDc+JFH5sHmhHUsqSNPGG+sZpjcz05ZhFaiDut3K8FGpqy:0LeIZHxVJcJlGaUmPGNsnoz05rFteaBn
TLSH 147423B0B934AB83DC30CB6A7A95BCBF7617C259A275FB60F74E140D84547E3464A20B
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: armonitele.com
Sending IP: 45.133.1.196
From: Kamena Gaoussou <gkamenae@gmail.com>
Subject: Our Order Drawing - Request for Offer
Attachment: Order Drawing.gz (contains "Order Drawing.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b143c2fe0a31089b8a3a389e9297456b557462f4c0a74909fe1796d9f4239bc/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fmkdyl7aumiitofduoe6skluk22vorrpjqfhjee74f4w3h2chg6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b143c2fe0a31089b8a3a389e9297456b557462f4c0a74909fe1796d9f4239bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 2b143c2fe0a31089b8a3a389e9297456b557462f4c0a74909fe1796d9f4239bc

(this sample)

Formbook

Executable exe 68fa77befde4e147cc7bc2fb142306a94245adb49c4ccca175f12f29414ce3d1

  
Dropping
MD5 5ceb8db06412b0ba9a81fda8edbf7c6f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 68fa77befde4e147cc7bc2fb142306a94245adb49c4ccca175f12f29414ce3d1

Comments