MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f90b059b16049df89d9f70e80ad850bcd46663b3786ed6081ed821845c418c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f90b059b16049df89d9f70e80ad850bcd46663b3786ed6081ed821845c418c7
SHA3-384 hash: 0fa196f274647d21fda2c2471f61cbd148650a1ed72468d7426a36f727d6495fe1f4f28ee8a8336bc780852e87296f4f
SHA1 hash: 1271ea2ae88dc996a0ce0bfa93083b4d7b452782
MD5 hash: 4b9cf5b7466defe11e6763654087fe7a
humanhash: failed-artist-vegan-oscar
File name:Purchase Order CITMCH_EM.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:309'317 bytes
First seen:2020-11-30 08:11:33 UTC
Last seen:2020-12-10 08:24:34 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:rZDKNC0hwyvsDU0Oc1KFyogUGFCdwMtk1ENWnKxijgetyEXYzksPVoYi:8Y0hPvIzrfogUdOIk6NIK2gWozLti
TLSH 626423932F758D484EA5A9B8382C552520FF9FCFE9B36F467362D76C13A5082DB4700A
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
38
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.f761004854ebeec8.14062.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f90b059b16049df89d9f70e80ad850bcd46663b3786ed6081ed821845c418c7/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-30 08:12:06 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6ilawnrmbe57coz64hiblmfbpgumzr3g6do2yeb5wbbqroedddq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f90b059b16049df89d9f70e80ad850bcd46663b3786ed6081ed821845c418c7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 7f90b059b16049df89d9f70e80ad850bcd46663b3786ed6081ed821845c418c7

(this sample)

Formbook

Executable exe 121ce6392d23c72269e9581f98c66e9d2c5bf7f405923dd620902dc1216f9127

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 121ce6392d23c72269e9581f98c66e9d2c5bf7f405923dd620902dc1216f9127
  
Dropping
MD5 f761004854ebeec86a0e943921a39af8

Comments