MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dbb568a27ba00004d455a2bd66439c2fca1f9948fc6f4c19371862ea2d8c25e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6dbb568a27ba00004d455a2bd66439c2fca1f9948fc6f4c19371862ea2d8c25e
SHA3-384 hash: e2877600d7333145b21583d7c5578d4edfdc623ddee3c1a2473fb1e338db8aa9837ab06b9198eea603e8c5a437c17b96
SHA1 hash: 5ec5b000c6d9d71ac6f24d03ee3d8b4d28eb9117
MD5 hash: 83ba6d0051c75780ba34f08cb02333b1
humanhash: nebraska-december-four-paris
File name:Proforma Invoice_2796_xlsx.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:231'548 bytes
First seen:2022-04-05 06:31:50 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:Zsa2imV8KRlW8w/4BLn+aMdibMnwjld+W+eNKadp:ZsanvM+FdWf/+ehdp
TLSH T17E3423D5E55209B1C9BC3B463B0DE53DD47EE460E82D6C04E948BBE289C8D728739CA7
Reporter cocaman
Tags:arj FormBook INVOICE payment


Avatar
cocaman
Malicious email (T1566.001)
From: "account <admin@2080technologiesllc.partners>" (likely spoofed)
Received: "from ns-882.awsdns-46.net (unknown [45.58.34.21]) "
Date: "4 Apr 2022 16:07:49 -0700"
Subject: "Re: Proforma Invoice 2796 / confirmation for Payment"
Attachment: "Proforma Invoice_2796_xlsx.arj"

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Suspected-exe-in-RAR.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/624be26faa7e43c6a6baa728/reports/3a030f28-4149-4c9a-8025-1f71338e31ac/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6dbb568a27ba00004d455a2bd66439c2fca1f9948fc6f4c19371862ea2d8c25e/
Threat name:
Win32.Trojan.NSISInject
Create hunting rule
Status:
Malicious
First seen:
2022-04-05 06:32:07 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 41 (41.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nw5vncrhxiaaatkfliv5mzbzyl6kd6mur7dpjqmtogdc5iwyyjpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6dbb568a27ba00004d455a2bd66439c2fca1f9948fc6f4c19371862ea2d8c25e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 6dbb568a27ba00004d455a2bd66439c2fca1f9948fc6f4c19371862ea2d8c25e

(this sample)

Formbook

Executable exe add90f420c37b1391d4e3c22020c664c36a0dc0e0b6c43bfcc2a5f092fa18f0c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 add90f420c37b1391d4e3c22020c664c36a0dc0e0b6c43bfcc2a5f092fa18f0c
  
Dropping
Formbook

Comments