MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 651de969b23b9ccefa429649a4eb97410e39055ef44ae7cbf6960eeb8cf63072. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 651de969b23b9ccefa429649a4eb97410e39055ef44ae7cbf6960eeb8cf63072
SHA3-384 hash: 6001d7340bf6ed035ba7c0a44c20363c5854bd6ec6a6a86a41e2794d2afdf3ffe8e560052b7a7c6380ce04b4d4a45a5f
SHA1 hash: a2f94b51f4dbfe9a0244271e2e1650bd42867b0d
MD5 hash: 1af7842f50ab91aaa90e4590ca16f4d8
humanhash: cat-zebra-zebra-rugby
File name:AUG110820_pdf.z
Download: download sample
Signature Formbook
Create hunting rule
File size:328'577 bytes
First seen:2020-08-11 14:06:53 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:AHmhaqf0K00+LC3mIK2aqhf0R51iHcu8s0pGYKjBdx/QcAjxnH9GmGZGBpOvN5:AGw3K53KBqU1Ngrjf9Mnd9TpOH
TLSH D56423E07EDC0E02538BFBA1B104C51A72BFEAD2A8C9113DA75D47BC276A9E18432C45
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: pcp1.mywebsitebox.com
Sending IP: 116.202.86.111
From: info <info@onlinemall.com.pk>
Reply-To: info <sm@centrimax.co>
Subject: FW:
Attachment: AUG110820_pdf.z (contains "AUG110820_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/651de969b23b9ccefa429649a4eb97410e39055ef44ae7cbf6960eeb8cf63072/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 14:08:05 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=muo6s2nshoom56scsze2j24xiehdsbk66rfops7wsyhoxdhwgbza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/651de969b23b9ccefa429649a4eb97410e39055ef44ae7cbf6960eeb8cf63072

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 651de969b23b9ccefa429649a4eb97410e39055ef44ae7cbf6960eeb8cf63072

(this sample)

Formbook

Executable exe b2d8df96514495cb6b3fe66a6d61e70b8b6e92426910db93f7ae521be4fd2762

  
Dropping
MD5 3cf4d429039e6e547dc025a339f34f4d
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b2d8df96514495cb6b3fe66a6d61e70b8b6e92426910db93f7ae521be4fd2762

Comments