MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 683360abc9273cf1bf058dff26e14550987ff5bb2cab8d6e56b7139bb97f4328. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 683360abc9273cf1bf058dff26e14550987ff5bb2cab8d6e56b7139bb97f4328
SHA3-384 hash: 8bad207ac269d16dfbe9483f6fe7111ffc136b407d8d0834e9d2328d37b0e9bef74684a2606b426c07b25b3355361ed5
SHA1 hash: 125ed2dc79534b520f97fc2b9e9e6bef1489927b
MD5 hash: e34d17af1833b92b4f6b04a0d6af5de6
humanhash: princess-bravo-sodium-shade
File name:Draft Contract - Chinese Language.ace
Download: download sample
Signature FormBook
Create hunting rule
File size:480'093 bytes
First seen:2021-02-10 06:22:23 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:r6vWlOK5gPOHOdpADs/oW1zdaKRrdUeVY4qrvr:r6elOK5gPxSQbVUKRr2e8rj
TLSH B7A423A532941C24E6272D62494C93BBFF4195B319FF339697F8A0DCAD026EAF01E14D
Reporter cocaman
Tags:ace FormBook


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?7KCV7J287ISd?= <zzjaa@zzjms.net>" (likely spoofed)
Received: "from zzjms.net (unknown [45.137.22.138]) "
Date: "9 Feb 2021 19:11:46 -0800"
Subject: "=?UTF-8?B?6rOE7JW97IScIOyDmO2UjCAtIFNhbXBsZSBjb250cmFjdA==?="
Attachment: "Draft Contract - Chinese Language.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/683360abc9273cf1bf058dff26e14550987ff5bb2cab8d6e56b7139bb97f4328/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 06:23:10 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nazwbk6je46pdpyfrx7snykfkcmh75n3fsvy23sww4jzxol7imua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/683360abc9273cf1bf058dff26e14550987ff5bb2cab8d6e56b7139bb97f4328

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

ace 683360abc9273cf1bf058dff26e14550987ff5bb2cab8d6e56b7139bb97f4328

(this sample)

FormBook

Executable exe 505f647367949d8bf6f8636f28a4376c125d5f6d2febc87b93e27075007b05c9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 505f647367949d8bf6f8636f28a4376c125d5f6d2febc87b93e27075007b05c9
  
Dropping
FormBook

Comments