MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d47f9dbde2f5133f7e7ce82aa4ee2cda2c56bdc355e584b680db0380f774e3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d47f9dbde2f5133f7e7ce82aa4ee2cda2c56bdc355e584b680db0380f774e3f
SHA3-384 hash: 35a766197e57aa59c7e64a19a3396ef356e5c125331b4befa28d6685e6efdc33f5e547fcfdf85f1902faf66665adb278
SHA1 hash: e0488f8b492bd7de3b8355ba21e851f8779ec060
MD5 hash: 1594c851cdea566c9a200ee7fc57797c
humanhash: snake-nebraska-oscar-two
File name:MV ARCTURUS_RFQ_SPR024_pdf.xz
Download: download sample
Signature FormBook
Create hunting rule
File size:764'240 bytes
First seen:2020-05-22 07:20:42 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:KCKez7unjo6oEnb6nonwkmjHzLYndn0wdnjIWgZ23Bti6bNguO:1z7unjo6oeywwkQvIt0Yn0WgEj6
TLSH DDF4232C3F553BBFA67973AEDA82C06E7CD9E8EDD5B397956070924E1E004248384F46
Reporter abuse_ch
Tags:FormBook xz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: lh001.interdominios.com
Sending IP: 93.174.4.62
From: BULKSEAS MARINE MANAGEMENT S.A. <infoo@bulkseas.com>
Subject: Fw: RE : M.V ARCTURUS - ARC/SPR/024-20
Attachment: MV ARCTURUS_RFQ_SPR024_pdf.xz (contains "MV ARCTURUS_RFQ_SPR024_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:36:27 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

xz 3d47f9dbde2f5133f7e7ce82aa4ee2cda2c56bdc355e584b680db0380f774e3f

(this sample)

FormBook

Executable exe ea95c0511e50da3a5225f551733b37b0b8f117b42dacd071620984fb550a00c9

  
Dropping
MD5 c1772685a60a21134f948ded4654fb6d
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea95c0511e50da3a5225f551733b37b0b8f117b42dacd071620984fb550a00c9

Comments