MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5523f788b6b921689b9078667e01d1c280dde63baa431d81afd845d78f72748b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5523f788b6b921689b9078667e01d1c280dde63baa431d81afd845d78f72748b
SHA3-384 hash: e0c5db1c851903a4a611d566e3890f7437a141b2577bdfde46882af9aae1abcbe770947539351c3937faf91dc569b24a
SHA1 hash: 083090f04577a6341ac3fe1531c5ca1746a5cda5
MD5 hash: 77d67710eac40c282a243fd29b9ecc06
humanhash: freddie-lima-william-uniform
File name:REVISED PROFORMA_XLS.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:694'434 bytes
First seen:2020-10-08 17:44:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:OCZ//pYYMgs7ys8UmJ7mgivfCWYf+h16lXp1VuWg4RZSMHLXt7XVnVxIHDXmLU4z:F5/p3s7/e7m3vjYf++Z1q4RVHbt7XVVz
TLSH ABE4335C90B7894048F1F33E9E47AE95B8CAD7947EAFC38A625760587ABEC5D008F412
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cpshared6.tedata.net
Sending IP: 213.158.180.196
From: Sales Department <hyejinp51@yongbee.co.kr>
Subject: PROFORMA INVOICE
Attachment: REVISED PROFORMA_XLS.arj (contains "REVISED PROFORMA_XLS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5523f788b6b921689b9078667e01d1c280dde63baa431d81afd845d78f72748b/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 17:19:49 UTC
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kur7pcfwxeqwrg4qpbth4aorykan3zr3vjbr3anp3bc5pd3sosfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/5523f788b6b921689b9078667e01d1c280dde63baa431d81afd845d78f72748b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 5523f788b6b921689b9078667e01d1c280dde63baa431d81afd845d78f72748b

(this sample)

Formbook

Executable exe a998850fc7940055baac6f61dde2d0e29836c9386ac87555549eeaa1a9998401

  
Dropping
MD5 55e0e0b024886daa5ebb3664ce8fd4c7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a998850fc7940055baac6f61dde2d0e29836c9386ac87555549eeaa1a9998401

Comments