MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39d63764ce14e7874f887911b7c8bd5b6adf3ce01f88db50a9081251422fd9bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39d63764ce14e7874f887911b7c8bd5b6adf3ce01f88db50a9081251422fd9bf
SHA3-384 hash: ae6a98eabfb03ccae6f3558ec3bb4bd88c44feaf3a5572a9a85891e8ac4ccb951062090689b92c802f1e0f63ca421c05
SHA1 hash: 1929d1e4c9acdb4f8efd2d293cc8116b42c5156d
MD5 hash: 5e435a4b89e9fda6fa082aa11debdb39
humanhash: apart-early-lake-utah
File name:3KvCNpcQ6tvwKr5pdf.z
Download: download sample
Signature Formbook
Create hunting rule
File size:601'949 bytes
First seen:2021-01-19 07:53:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:jv6eLa+WcXxNeNmMpBfGjdx9eexuOlLTbOMR1coUFimA3fFdpG3:OedbOrfopduO5Ok++3f743
TLSH 0FD433D728DCEC56E5DC7716075B699FB21C85E0A9C4ABE40CA1DE06E01F3E6CEA205C
Reporter abuse_ch
Tags:FormBook Yahoo z


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sonic301-19.consmr.mail.sg3.yahoo.com
Sending IP: 106.10.242.82
From: keithtangalphapioneer.com@yahoo.com <keithtangalphapioneer.com@yahoo.com>
Subject: Fw: CONFIRMATION ORDER
Attachment: 3KvCNpcQ6tvwKr5pdf.z (contains "3KvCNpcQ6tvwKr5.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/39d63764ce14e7874f887911b7c8bd5b6adf3ce01f88db50a9081251422fd9bf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:54:08 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hhldozgocttyot4ipei3psf5lnvn6phad6enwufjbajfcqrp3g7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/39d63764ce14e7874f887911b7c8bd5b6adf3ce01f88db50a9081251422fd9bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 39d63764ce14e7874f887911b7c8bd5b6adf3ce01f88db50a9081251422fd9bf

(this sample)

Formbook

Executable exe f1422701954b6c0116802819526ba75f414beda5419f80445d321885d8732473

  
Dropping
MD5 03c67a5a09e3a472b5ac1db3e64f36dd
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1422701954b6c0116802819526ba75f414beda5419f80445d321885d8732473

Comments