MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32d2a154f3de64d0d16f6c1fdb7911812126a1a4be4c63aaf1604d9fa7157163. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32d2a154f3de64d0d16f6c1fdb7911812126a1a4be4c63aaf1604d9fa7157163
SHA3-384 hash: 7aca1a20d9034fbb469b5f0221ece09032e0ed51347dafdc6ba2920c51a33a85a6025e0ce8dd860369efea5566fd3841
SHA1 hash: e2e944ac01817fb7354f84db827675efb5b0668a
MD5 hash: 3722a5116b1947398cb72108470c518d
humanhash: mirror-zulu-echo-twenty
File name:Quotation Request.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:300'305 bytes
First seen:2020-04-30 10:14:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:i5CgdiJHw6p8n3j0SzTa/JZUnZmpo0oxb/5REglz0krrBx5dNOKD:0iJ/8T022/JZUZmpnYYkrrBPOKD
TLSH 7E542322C72B5037D0462B5E37399BD648383D2B555DE237E937077A268A28D0A4FCA7
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: pardc1.ParkeInteriors.local
Sending IP: 70.89.105.1
From: Salama Med<manager@chinaglowplug.com>
Subject: Re: Produtcts Inquiry
Attachment: Quotation Request.zip (contains "Quotation Request.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 10:36:29 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gljkcvht3zsnbulpnqp5w6irqeqsninexzgghkxrmbgz7jyvofrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 32d2a154f3de64d0d16f6c1fdb7911812126a1a4be4c63aaf1604d9fa7157163

(this sample)

Formbook

Executable exe b39707482b00744db8fa4b03ab586f8e7fc5da0e80143f32b05ac0fa1e8f3e1c

  
Dropping
MD5 cea8bf73c641d528551eab98e56e0abc
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b39707482b00744db8fa4b03ab586f8e7fc5da0e80143f32b05ac0fa1e8f3e1c

Comments