MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 581b1aa4337bf5d4766d805b4f5ea863f38202563cc4b303e853fc6e6ea42b47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 581b1aa4337bf5d4766d805b4f5ea863f38202563cc4b303e853fc6e6ea42b47
SHA3-384 hash: f3ddb47b398c6aef7dfc83b56202fc43d0d9f4bdbfc2c9d0d152dc4d33cb1993d9840c3fa11666ff4d04e72c01ef061d
SHA1 hash: 2dc9caa41188b3218cb03764ef0857fc30f929d8
MD5 hash: f2f739775cb368ed655ac873c14e2d66
humanhash: mountain-bravo-july-mobile
File name:Shipping documents.7z
Download: download sample
Signature Formbook
Create hunting rule
File size:387'937 bytes
First seen:2020-10-20 08:28:42 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:SxxuO+bL8A+QILHBVcUCoKWJPVnNsQuXsyOEIx65n7KmJpCC8cEaLwfy5h:SzuO+h+QI7BVjUiPVNsPsyRE6BtJpZ8U
TLSH 5D8423D1F69A02DEB836A30C5E712516601FFE8B5645A24EBD467F0BC9E213F45AC360
Reporter abuse_ch
Tags:7z DHL FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail0.grandair.xyz
Sending IP: 143.110.228.46
From: DHL <no-reply@dhl.co>
Subject: Re:Re: D.H.L Parcel Notification
Attachment: Shipping documents.7z (contains "Shipping documents.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/581b1aa4337bf5d4766d805b4f5ea863f38202563cc4b303e853fc6e6ea42b47/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lanrvjbtpp25i5tnqbnu6xvimpzyeaswhtclga7ikp6g43vefndq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/581b1aa4337bf5d4766d805b4f5ea863f38202563cc4b303e853fc6e6ea42b47

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

7z 581b1aa4337bf5d4766d805b4f5ea863f38202563cc4b303e853fc6e6ea42b47

(this sample)

Formbook

Executable exe 72339a82b3bca6e89bd9b29a5e6214a4dab154275ca6ef0c06fee6ac1847df3e

  
Dropping
MD5 19d659997c1e551ff64271996ac090c5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72339a82b3bca6e89bd9b29a5e6214a4dab154275ca6ef0c06fee6ac1847df3e

Comments