MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ef9cd57b76458d3295f29f89300c1635d60de142c5a5fd71d53c8a9e5d74a59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ef9cd57b76458d3295f29f89300c1635d60de142c5a5fd71d53c8a9e5d74a59
SHA3-384 hash: bb0bd446458bcbc4c2b46523627c181a52e383fb0f77ec0bc47dab42ea9269b087ba58e8755766443e89597921438182
SHA1 hash: 0f6d23a42d8209efdde414a3630a67f7f6f06c1d
MD5 hash: 114b75e47967fd35a8538fb1550c9531
humanhash: ink-music-arkansas-autumn
File name:Commercial Invoice.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:424'657 bytes
First seen:2020-08-18 06:20:37 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:pITz30iR1rdWUV20QqKVR2DCkOH8HbGAfT1pViqVJM4mOowqwmalSeZTYgNa1qk1:p2j7/r0YiwGkhHbLTFnPocXmjeRK1Pt
TLSH 1994237EC650F73DF8B9F2291C65952DB369E0ECD42B26AF40854D23A4744F17068AF8
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: kleancuts.ml
Sending IP: 192.236.154.210
From: ''info@kleancuts.ml" <info@kleancuts.ml>
Reply-To: milsfrankblaze@gmail.com
Subject: Order 8203 || Commercial Invoice
Attachment: Commercial Invoice.arj (contains "Commercial Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ef9cd57b76458d3295f29f89300c1635d60de142c5a5fd71d53c8a9e5d74a59/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 01:36:19 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l3442v5xmrmngkk7fh4jgagbmnowbxqufrnf7vy5kpektzoxjjmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 5ef9cd57b76458d3295f29f89300c1635d60de142c5a5fd71d53c8a9e5d74a59

(this sample)

Formbook

Executable exe 2bde8d605b2ce54ea697cab8be4daff0c2349322b42a96c8a9237ac7eff35314

  
Dropping
MD5 b9acbd74ef64764ea09a0f21eb887ba2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2bde8d605b2ce54ea697cab8be4daff0c2349322b42a96c8a9237ac7eff35314

Comments