MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5be42919dfb437cf7e10d6d5a2c04888fbf122ffb49176529de77dbbaf51a845. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 3 Yara Comments

SHA256 hash: 5be42919dfb437cf7e10d6d5a2c04888fbf122ffb49176529de77dbbaf51a845
SHA3-384 hash: e7c7410165a4c6191a2820ea31a05929d37899e89ae2993f5a38dc4bf75f9a68951c740a966d323e66c9bb888ddd6da5
SHA1 hash: 76cd574f1498c0ac17250a666082a2aa0ac3b932
MD5 hash: 872cc0d933df0c9b71db6820c60bff79
humanhash: burger-south-summer-pip
File name:NOW PO n08765456789093.r09
Download: download sample
Signature Formbook
File size:277'427 bytes
First seen:2020-06-30 07:19:48 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 6144:5e5jHUHSmsoqdw7dtcsRdC9VOzmoSl3h3f1XC:5e2HZsHdmdttRdC9VO+3htXC
TLSH 2A4423947FC91B520BF4FF76ABB5B3650ABAEC54DAC5DC14C43A9353A50B0225FB0228
Reporter @jarumlus
Tags:FormBook

Intelligence


Mail intelligence
Trap location Impact
CH Switzerland Low
Global Medium
NL Netherlands Low
# of uploads 1
# of downloads 36
Origin country US US
ClamAV No detection
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/5be42919dfb437cf7e10d6d5a2c04888fbf122ffb49176529de77dbbaf51a845/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Nanocore
First seen:2020-06-30 07:21:04 UTC
AV detection:16 of 48 (33.33%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 4.84%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r09 5be42919dfb437cf7e10d6d5a2c04888fbf122ffb49176529de77dbbaf51a845

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments