MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f42f3029723540c5b3526f4d5e8b06c9cb924cb0b53f16be06d63d2faf55ec2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f42f3029723540c5b3526f4d5e8b06c9cb924cb0b53f16be06d63d2faf55ec2
SHA3-384 hash: ba0ac7c30a566cd160e5c71c0c6a97f5ca42d5e65c62c54d7f751b3908c90d2e54e900778347f0e96900569f8b9f1fc0
SHA1 hash: dd2ce875543c7285b75f8c10bf55537a2ad81f8b
MD5 hash: e5e5075bf81e9c6eaa0bfdbe40423a09
humanhash: kentucky-high-arizona-pip
File name:Dhl package - pdf.ace
Download: download sample
Signature Formbook
Create hunting rule
File size:564'604 bytes
First seen:2020-09-21 16:31:55 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:qebSw5XOJgGTCRedBHaGLAL7icjn4fflh3U9liy18Ul/Cl+17tf:hOJLTd5aGkPicjnQfle9RVn1tf
TLSH FEC4235AF1B5AAEE3FC099ADA53C2B1AC6A83499C3FD0CD501B2741FDB11128D2F5E50
Reporter cocaman
Tags:ace


Avatar
cocaman
Malicious email (T1566.001)
From: ""Dhl Staff" <cliffemeh@yahoo.com>"
Received: "from mail.wingsglobal.co.id (mx.wingsglobal.co.id [203.160.63.228]) "
Date: "Mon, 21 Sep 2020 10:20:06 +0300"
Subject: "DHL - Your shipment reference - /Pending Notification"
Attachment: "Dhl package - pdf.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2f42f3029723540c5b3526f4d5e8b06c9cb924cb0b53f16be06d63d2faf55ec2/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-09-21 04:13:29 UTC
File Type:
Binary (Archive)
Extracted files:
171
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2f42f3029723540c5b3526f4d5e8b06c9cb924cb0b53f16be06d63d2faf55ec2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace 2f42f3029723540c5b3526f4d5e8b06c9cb924cb0b53f16be06d63d2faf55ec2

(this sample)

Formbook

Executable exe 3a10c525b2f0a94e7e9facfa4685490e9a46d0d6a62be53f570fa845cd680c56

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a10c525b2f0a94e7e9facfa4685490e9a46d0d6a62be53f570fa845cd680c56

Comments