MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6145d6cc40e42b0940ab9990445277eb9101d48638ee9726bef58bafb8f272a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6145d6cc40e42b0940ab9990445277eb9101d48638ee9726bef58bafb8f272a6
SHA3-384 hash: 4632145b8e9833eb0fb9d2cb11a6a2a787c9bbc312d3036c9f1c0aa96f034a9c3834998ce25fbb70bec934d2cbde7103
SHA1 hash: d8f8424fd1f5f419b129e5307c8bd242337e0825
MD5 hash: cad97965ae310597547785d73a5ad5ee
humanhash: red-item-orange-washington
File name:Our New Order August 14 2020 at 2.30_PVV440_PDF.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-14 08:55:01 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:PmZ7XUYP+LT5oegvSqUkCZ7XtV4CBKCC1Z9cN3x9fTts:y7XUDLT5oFv7UFZBSFf1ZipfTu
TLSH 2545F08667D39551C4BA363343B1930502E5C35612A3CB69F89F03AB6F63FFD66429C8
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosting4.kmtiendas.com
Sending IP: 37.152.93.84
From: Jana Azih <jana.azih@getinge.com>
Subject: RE: AW: Our New Order/Enquiry No.00127
Attachment: Our New Order August 14 2020 at 2.30_PVV440_PDF.img (contains "Our New Order August 14 2020 at 2.30_PVV440_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisC89C939468B5.12200.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6145d6cc40e42b0940ab9990445277eb9101d48638ee9726bef58bafb8f272a6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 08:56:10 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mfc5ntca4qvqsqfltgieiutx5oiqdveghdxjojv66wf27ohsokta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6145d6cc40e42b0940ab9990445277eb9101d48638ee9726bef58bafb8f272a6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 6145d6cc40e42b0940ab9990445277eb9101d48638ee9726bef58bafb8f272a6

(this sample)

Formbook

Executable exe 4077e5eeadfc447b88c36f638c37adc77ee35766a737e4a7aca64e61f2ef3d1a

  
Dropping
MD5 c89c939468b5ce30b702c6d151dc9f31
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4077e5eeadfc447b88c36f638c37adc77ee35766a737e4a7aca64e61f2ef3d1a

Comments