MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50db1df7ab966361c8b4f497ddf28b1692e8f5a07e08cab1cfbef00ad78dea56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50db1df7ab966361c8b4f497ddf28b1692e8f5a07e08cab1cfbef00ad78dea56
SHA3-384 hash: b457857599dc496305bff20b607b4085bf2b5fd330bbc290eb9ed70b8b1227d30b10a73b0ac521b680825323241e4930
SHA1 hash: dc946ad82beb39672fca213ff303286872c425ae
MD5 hash: 0b10aeef77005867e483732a251936a2
humanhash: hot-pasta-carpet-july
File name:INQUIRY.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:470'662 bytes
First seen:2020-12-03 08:32:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:u/UpXlLQlUicOsDOLggYywlHynkaF4qYDup6fWsVxJQYA:O629CWUazF4qYqp6xJe
TLSH 0EA423135A5365903DC49977BBEAB671B06DA37015FF80CB45C30D7B84022B63BA963E
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: vps.nc-hunicorn.com
Sending IP: 45.85.90.117
From: Miss.Khuanrutai Sammanuch <office@nc-hunicorn.com>
Subject: Products Inquiry
Attachment: INQUIRY.zip (contains "INQUIRY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs264.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50db1df7ab966361c8b4f497ddf28b1692e8f5a07e08cab1cfbef00ad78dea56/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-03 08:33:08 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kdnr355lszrwdsfu6sl534ulc2jor5napyemvmopx3yavv4n5jla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/50db1df7ab966361c8b4f497ddf28b1692e8f5a07e08cab1cfbef00ad78dea56

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 50db1df7ab966361c8b4f497ddf28b1692e8f5a07e08cab1cfbef00ad78dea56

(this sample)

Formbook

Executable exe da37b9b8890fa84de87323c1599d96ca8aab10238d9d98bdb72853f2d445780f

  
Dropping
MD5 a9e8652bed10c05029a21c09a261916b
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da37b9b8890fa84de87323c1599d96ca8aab10238d9d98bdb72853f2d445780f

Comments