MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fe12f28037e9c51db2fbb1a95e8cb2ec0cec9c94cebfb21f37b51b38c54de23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fe12f28037e9c51db2fbb1a95e8cb2ec0cec9c94cebfb21f37b51b38c54de23
SHA3-384 hash: cf1a05355c2d277788c3b91ae88d55c0f06a1b11f779a728f29a13307eee49c42faa21a7f239f129559ab90ce50e35e9
SHA1 hash: 8f0e2d75df543c3b48a9630cd37ef96aa613e8c2
MD5 hash: 1c08e823601da46e4426b3421647f961
humanhash: jersey-sodium-kitten-freddie
File name:PO9943440.pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:273'606 bytes
First seen:2020-08-17 06:04:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:nv72tzJ4SuZ7xzguH9+rjWKqN02qs/kz5NvhXft:z2tzJ4zZ7xgu4jEtqsMnhvt
TLSH 444423C8FAE36855A0FE6B87DFFA1912777C2649AE3C57B4098FB04491ADDC21446C8C
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.stauboi.com
Sending IP: 45.95.168.229
From: import and export department <orderss@stauboi.com>
Reply-To: import and export department <orderss@stauboi.com>
Subject: order PO#9943440
Attachment: PO9943440.pdf.rar (contains "PO#9943440.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fe12f28037e9c51db2fbb1a95e8cb2ec0cec9c94cebfb21f37b51b38c54de23/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:06:06 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h7qs6kadp2ofdwzpxmnjl2glf3am5sojjtv7wiptpni3hdcu3yrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3fe12f28037e9c51db2fbb1a95e8cb2ec0cec9c94cebfb21f37b51b38c54de23

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 3fe12f28037e9c51db2fbb1a95e8cb2ec0cec9c94cebfb21f37b51b38c54de23

(this sample)

Formbook

Executable exe 4fd6cfb4c08338e8b3a6ec64118aa6ad90350e865e90365b5b700aa41908b984

  
Dropping
MD5 ce35c84bc463eca5f6d02214d8874bbc
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4fd6cfb4c08338e8b3a6ec64118aa6ad90350e865e90365b5b700aa41908b984

Comments