MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c8cbc5d37f73ea225951298649669c8eb9eb7b867ed2660d0f69c7c091e4914. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c8cbc5d37f73ea225951298649669c8eb9eb7b867ed2660d0f69c7c091e4914
SHA3-384 hash: 877fda0a636c7fcb4fbc2cbbd631e3f50e41ac7f37454d4610bf56c6f90fb921c445ff5f0f6ebddb5c5a34381f3974d6
SHA1 hash: 847d3edcc3ccff690d6483249355dac649635401
MD5 hash: 68fa6e11c1f4dbff192341cf93ac4a14
humanhash: august-jersey-queen-mirror
File name:ORDER4.lzh
Download: download sample
Signature Formbook
Create hunting rule
File size:499'654 bytes
First seen:2020-11-09 16:14:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:dQbJPO20tBdEGLrMNvT0lxGaMyyiJxU++Zb:WZYBdjMN70lopyyibod
TLSH E6B423D3ABFEAC637F1808614E2154D0DFC1889BD564B77B42D0ACA4FFAE06B90169D0
Reporter abuse_ch
Tags:FormBook lzh


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.jardipondi.com
Sending IP: 45.153.203.126
From: Sajjad Soltanian <office@jardipondi.com>
Subject: Jimco orders
Attachment: ORDER4.lzh (contains "ORDER 2020-11-09 KICIPDN07266SZ1 1X20GP KCL631.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c8cbc5d37f73ea225951298649669c8eb9eb7b867ed2660d0f69c7c091e4914/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-11-09 12:36:00 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hsglyxjx647kejmvckmgjftjzdvz5n5ym7wsmygq62ohyci6jeka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c8cbc5d37f73ea225951298649669c8eb9eb7b867ed2660d0f69c7c091e4914

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 3c8cbc5d37f73ea225951298649669c8eb9eb7b867ed2660d0f69c7c091e4914

(this sample)

Formbook

Executable exe 787e10aed324cae24ab5136f95deb95efe8715a6bd7ced09028b2ee21d228a5e

  
Dropping
MD5 f450ef03208ae2ad9089cd9035d98584
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 787e10aed324cae24ab5136f95deb95efe8715a6bd7ced09028b2ee21d228a5e

Comments