MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5baf9d0dac3d4c74f8721877e94be48d858cfca9a2ee65ddf4d8dadf3974e4d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5baf9d0dac3d4c74f8721877e94be48d858cfca9a2ee65ddf4d8dadf3974e4d2
SHA3-384 hash: 11c7c517151afd14fb54db9be31a5408e938e61dcc0cddd613ffc20860c910184e841550e882b45d05c6ddf10e8ca30a
SHA1 hash: 99a503f7838f0c701e7a5bda8b4e4f3a52638da4
MD5 hash: 1573586ff97b01caa0954fda3bc34f3c
humanhash: sodium-cup-oscar-gee
File name:MT OCEAN STAR- ISO 8217 2005_pdf.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:991'436 bytes
First seen:2020-05-04 17:45:22 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 24576:Ce+obqqBhI6RNy6aOSMjMWtdlXLfpguF9s3r6mhH6DgTHl:CenbqAehT5Wphsb6m6wHl
TLSH 802533ECBE5B777B79C6330ACA00C02DA0371C49E857A668C4C1F2E87EF9DD159A2951
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: r1.cleanmx.pt
Sending IP: 130.185.80.27
From: Vungtau Ocean Shipping Agency (VTOSA) <operations@vtosa.com>
Reply-To: operations@vtosa.com
Subject: REQUEST FOR QUOTATION //MT OCEAN STAR// ISO 8217 2005
Attachment: MT OCEAN STAR- ISO 8217 2005_pdf.arj (contains "MT OCEAN STAR- ISO 8217 2005_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 01:52:57 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=loxz2dnmhvghj6dsdb36ss7erwcyz7fjulxglxpu3dnn6olu4tja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 5baf9d0dac3d4c74f8721877e94be48d858cfca9a2ee65ddf4d8dadf3974e4d2

(this sample)

FormBook

Executable exe 6f1759c73e6a30da4906dba3c46112a2e8460acc51c3533524cc42198b01b747

  
Dropping
MD5 31df90eb8d81ea61e41dbf411bba832b
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f1759c73e6a30da4906dba3c46112a2e8460acc51c3533524cc42198b01b747

Comments