MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d7a914b1f52126fbd1988bbb55f5b55e249a605f678fc8fbcd0dfaae32d6261. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d7a914b1f52126fbd1988bbb55f5b55e249a605f678fc8fbcd0dfaae32d6261
SHA3-384 hash: 1f4e3b48a3d8723b405ba465128fed93a34b1397f7976dd4f1c858c008312c4b5a965556da9783a02799efb5f9bf8cb4
SHA1 hash: e922b3d76856e49d7857d1ce7a26e3eb504736a2
MD5 hash: 04bb4dab6a8abe9175b3e5efca313b12
humanhash: victor-kitten-william-steak
File name:Scan Document 01.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:315'142 bytes
First seen:2021-01-14 20:23:14 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:P2t635/wWj10nklibiQ8qgyBu/9W8vEMArKJ7BU96coa2Gao9IFK:Ocp4WBWklibX85p9LgorcoPGao9Is
TLSH 8F6423D3E6D5A176C233E522F317562ABC3ADC5DBF1A8684160CF06742F119743AAD23
Reporter abuse_ch
Tags:DHL FormBook r00


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: soa0.506.jxwi.cf
Sending IP: 46.101.60.174
From: DHL Express <support@dhl.com>
Subject: DHL CONSIGNMENT NOTIFICATION: AWB 9899691012 Clearance Doc
Attachment: Scan Document 01.r00 (contains "Scan Document 01.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d7a914b1f52126fbd1988bbb55f5b55e249a605f678fc8fbcd0dfaae32d6261/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 20:24:05 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pv5jcsy7kijg7pizrc53kx23kxretjqf6z4pzd542dp2vyznmjqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7d7a914b1f52126fbd1988bbb55f5b55e249a605f678fc8fbcd0dfaae32d6261

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 7d7a914b1f52126fbd1988bbb55f5b55e249a605f678fc8fbcd0dfaae32d6261

(this sample)

Formbook

Executable exe 196b4470cd98c4f6d5c634170a1c6a98cf59b61c9b12a032ec9fb776b74a0527

  
Dropping
MD5 47a3b1f5f7a8f5d342654a4e351d62ea
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 196b4470cd98c4f6d5c634170a1c6a98cf59b61c9b12a032ec9fb776b74a0527

Comments