MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e7790a40afd5251aad1745ff35e60925d261a9e635446c89e8ec3f069ca4127. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e7790a40afd5251aad1745ff35e60925d261a9e635446c89e8ec3f069ca4127
SHA3-384 hash: f1b2554c28a18dee69b39de07ab517f882dffddf654b9a65dd9a74310ba30050ac80bf0a2a623a6a3ad505db8a1c26b2
SHA1 hash: 4774fa79500f6439089e7e066f37911caab1a456
MD5 hash: 0590411f59a9a630ed1e4bc51d0b562b
humanhash: tango-avocado-fish-undress
File name:SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:781'568 bytes
First seen:2020-06-11 06:10:39 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:8uUrnAt0U+5vHxFtsN2YE2hqzCNvaSBy3tNoepLWQ0q9m8aohK1wzhiyGw0/qC:sVU+RxXO2YhBVBy3t7LWTD8aqZi5w0/b
TLSH A3F4336F39002B08E4FAAE9E08505EA5CF38C6C970C870F8AB17597D6C6F2935564B97
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail.emsbd.com
Sending IP: 202.40.181.229
From: A.P. Moller - Maersk <kevin.chung@maersk.com>
Reply-To: kevin.chung@maersk.com
Subject: RE : RE : URGENT!!! 2 x 40ft - SHIPPING DOC BL,SI,INV#462345 // MV MAERSK HANGZHOU V.698E // CLGQOP181781 //
Attachment: SHIPPING_DOC_MV MAERSK HANGZHOU_V.698E_pdf.arj (contains "SHIPPING_DOC_MAERSK_KLEVEN_V.949E_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 06:12:12 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nz3zbjak7vjfdkwrorp7gxtasjosmgu6mnkense6r3b7a2okietq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 6e7790a40afd5251aad1745ff35e60925d261a9e635446c89e8ec3f069ca4127

(this sample)

FormBook

Executable exe f8257ea6068267793a12ae2a1dfd91384664bee14820c51fd8984031ad3047de

  
Dropping
MD5 139736bc65116c98a08038e8177f72fc
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8257ea6068267793a12ae2a1dfd91384664bee14820c51fd8984031ad3047de

Comments