MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 646bb701a6091b42c6cd53ccc63f1412158854afdfb5a6bc7336cac00a4efcde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 646bb701a6091b42c6cd53ccc63f1412158854afdfb5a6bc7336cac00a4efcde
SHA3-384 hash: 30b3c319ce22d5b9fa89dfca4afcdfdbb2bc2a834c14895e59b56ff4b9f3ded3494377ae210181670b9ad2187947a5c6
SHA1 hash: 793d15323fc3598aa3b51fa593af6a392a485e26
MD5 hash: e07de17ece462acfb01300949bbbc14b
humanhash: freddie-johnny-black-cold
File name:Swift_18442.pdf.z
Download: download sample
Signature Formbook
Create hunting rule
File size:233'828 bytes
First seen:2021-03-10 10:27:59 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:2sQym8piXSpGwYP52oWevxY5T1wxN/ipa/tJ5k:2vuppwwY+evxBL/ipa/tM
TLSH F33422AAC1B0E03D0C0AFFD09B902CE29916E9BA5571CF90F157994197B8AEE64177C3
Reporter cocaman
Tags:FormBook SWIFT z


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?TWFyaW5hIEJ1bGF0b3ZpxIc=?= <marina.bulatovic@ivdamprocess.com>" (likely spoofed)
Received: "from ivdamprocess.com (unknown [104.129.30.183]) "
Date: "10 Mar 2021 00:35:16 -0800"
Subject: "Payment Advice"
Attachment: "Swift_18442.pdf.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 10:07:07 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mrv3oangbenufrwnkpgmmpyucikyqvfp3622npdtg3fmacso7tpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/646bb701a6091b42c6cd53ccc63f1412158854afdfb5a6bc7336cac00a4efcde

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 646bb701a6091b42c6cd53ccc63f1412158854afdfb5a6bc7336cac00a4efcde

(this sample)

Formbook

Executable exe cc0c4f8f34907be8839ae185fa40e5d7ad5279b70067a3279501d18483b590a7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc0c4f8f34907be8839ae185fa40e5d7ad5279b70067a3279501d18483b590a7
  
Dropping
Formbook

Comments