MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76379ed79c498f2de8ca768eaa6e265d8d4b9732afc5f3979e631fdda1352ef6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76379ed79c498f2de8ca768eaa6e265d8d4b9732afc5f3979e631fdda1352ef6
SHA3-384 hash: e8e41b56cd80464c0dcf4b56a046c86dfa1853753009f394968f94e83aaf25ed63a4fe9fcfd9b2a7b7cb18a034e56564
SHA1 hash: 17f2dd760e5457bb1cedd7a7b049850c6f306279
MD5 hash: 07f2f7dbb0e924ad8892e25cf7053244
humanhash: magazine-ink-july-kitten
File name:PO4700055064_PDF.r00
Download: download sample
Signature FormBook
Create hunting rule
File size:367'152 bytes
First seen:2020-07-31 06:54:42 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:xZX9Tnd2ToGSOoyO3EbCHdT0HZRWVLxWY0sTl24W++MPZ6Es0vc1EUE+:x1pd2Uxj3h8ZosYFP+8ZJs6kER+
TLSH 757423DC9CF77A72E3358BA00263A84E9E1A87C71D8CF654405866DD4CA2A1EC729B17
Reporter abuse_ch
Tags:FormBook r00


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: nytex.sg
Sending IP: 103.133.106.216
From: Nytex <Marketing@nytex.sg>
Subject: RE: Nytex Pte Ltd # NEW PO #RESUMING SERVICES
Attachment: PO4700055064_PDF.r00 (contains "PO#4700055064_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76379ed79c498f2de8ca768eaa6e265d8d4b9732afc5f3979e631fdda1352ef6/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 06:56:11 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oy3z5v44jghs32gko2hku3rglwguxfzsv7c7hf46mmp53ijvf33a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76379ed79c498f2de8ca768eaa6e265d8d4b9732afc5f3979e631fdda1352ef6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

r00 76379ed79c498f2de8ca768eaa6e265d8d4b9732afc5f3979e631fdda1352ef6

(this sample)

FormBook

Executable exe 6ff25388a91cbed0a11467e592e39e34c54de49d61876a2a201554e67c5b8cb4

  
Dropping
MD5 adddf4b486e8fe90ab07d586012ff342
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ff25388a91cbed0a11467e592e39e34c54de49d61876a2a201554e67c5b8cb4

Comments