MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f452820b8a7f5bc46c27a7dd2a92736194f8e2d99f16e509c15a56313e2d738. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f452820b8a7f5bc46c27a7dd2a92736194f8e2d99f16e509c15a56313e2d738
SHA3-384 hash: f0ee0169f09631b42b92f540933aa88282ad8a1ae3d5e7a9be8514108600e3ec41018e429111b072d5f96ecfcaf5ec8d
SHA1 hash: 4e53437e1ff5222c176db1fff5c124afc90a8639
MD5 hash: e3b0d20cd210a3f6760dc4e4fb2bc092
humanhash: lactose-utah-oklahoma-fruit
File name:New Purchase Order GH934782GHY489330.PDF.z
Download: download sample
Signature Formbook
Create hunting rule
File size:287'578 bytes
First seen:2021-03-29 13:35:57 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:9A0eY/H1SdE8cSQ9/DU9MxpNvvw1+A5iCk7cmSF5TfUe3:9A0eY/IdE8cSQ9U9UNwAA5075SbUQ
TLSH 6C5423FC566EF5D6941822315B506E3E7FC3A377054D6E980A93B0F8178F8066A03AED
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email (T1566.001)
From: "Elie Abdel <recambios@irizar.com>" (likely spoofed)
Received: "from irizar.com (unknown [109.237.103.27]) "
Date: "29 Mar 2021 16:11:18 -0700"
Subject: "Re: NEW ORDER "
Attachment: "New Purchase Order GH934782GHY489330.PDF.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f452820b8a7f5bc46c27a7dd2a92736194f8e2d99f16e509c15a56313e2d738/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 13:36:08 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
13 of 27 (48.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n5csqifyu723yrwcpj65fkjhgymu7drnthyw4ue4cwswge7c244a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/6f452820b8a7f5bc46c27a7dd2a92736194f8e2d99f16e509c15a56313e2d738

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 6f452820b8a7f5bc46c27a7dd2a92736194f8e2d99f16e509c15a56313e2d738

(this sample)

Formbook

Executable exe 97d4de7a9478320c718f18c0f57349cfc611f5dee0aab5271304e4670e63d2a8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97d4de7a9478320c718f18c0f57349cfc611f5dee0aab5271304e4670e63d2a8
  
Dropping
Formbook

Comments