MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 389629442f9b55884e0451ba4d98e6191f33c6440e0c923a4a2d2beec560807f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 389629442f9b55884e0451ba4d98e6191f33c6440e0c923a4a2d2beec560807f
SHA3-384 hash: d707fb5291104df41ce310068ee12bc3caff35ab909f17e715836f491303b928b6a6903be37158f2d4be5ba7cd91f9bc
SHA1 hash: 7efcb5467d38c5eecb3daec2fa28ef38edb9afd2
MD5 hash: 1b79396b9260f736fdb82076b5f6346f
humanhash: oxygen-minnesota-alpha-wisconsin
File name:Shipping Document PLBL Draft.img
Download: download sample
Signature Formbook
Create hunting rule
File size:942'080 bytes
First seen:2021-01-15 15:51:52 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:SQUfFUlakZZlXV5VNEKihPxHh+matXsguKIHbYW2xNB8Aj0QSbyP:xckakZR5zEKi1+6LHbgDB8O0hb
TLSH AC15BE8550446A7CF15C8E32BBEA8FB221965C657F44354BAD783F623E33DC0B69062E
Reporter abuse_ch
Tags:DHL FormBook img


Avatar
abuse_ch
Malspam distributing Formbook:

From: DHL Express INC <support@dhl.com>
Subject: Consignment Notification: You Have A Package With Us
Attachment: Shipping Document PLBL Draft.img (contains "Shipping Document PL&BL Draft.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.12686.30639.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/389629442f9b55884e0451ba4d98e6191f33c6440e0c923a4a2d2beec560807f/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 15:52:08 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hclcsrbptnkyqtqekg5e3ghgdepthrsebygjeoskfuv65rlaqb7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/389629442f9b55884e0451ba4d98e6191f33c6440e0c923a4a2d2beec560807f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 389629442f9b55884e0451ba4d98e6191f33c6440e0c923a4a2d2beec560807f

(this sample)

Formbook

Executable exe 58b012a7c77564704af9bc88d272f1aa68c6789c84a146d0f566304c370bc89a

  
Dropping
MD5 9a35a8f3f77ce5b039c3a8c2763270cd
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58b012a7c77564704af9bc88d272f1aa68c6789c84a146d0f566304c370bc89a

Comments