MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 838eccb3a23ad73e9e3dd0f50fad73d0589138e9f30339757bf7c84265843927. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 838eccb3a23ad73e9e3dd0f50fad73d0589138e9f30339757bf7c84265843927
SHA3-384 hash: 871bed1bcc4ee52c32fb8bd3b356063aaf1c946528b3d582e693fe98a77eecc1be73a3fe66fc264e7e2d1b6757ba25ef
SHA1 hash: f1d26591c2b03828db221426f3c203611fc4e4d4
MD5 hash: 400b0025512af09cfc1d75fc5c0f4fcb
humanhash: alaska-may-one-wolfram
File name:Shipment doc, INV+BL.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:330'904 bytes
First seen:2020-08-16 14:03:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:FnNXEYYXHnEHgs7gH0TIhGBeq0n3RDRNQysYd2OGwlQ+5SK6APHxipa2IogsvzHf:FnCYEHegHLhGe3RDHlsYAADBPRUahogG
TLSH DA64235B6F48AD3B3888FD3FA0ECDE5F70BB423A191D481B5168FACC452D479E096486
Reporter abuse_ch
Tags:DHL FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dhl.com
Sending IP: 37.49.230.8
From: Noorul Hudha (DHL)<Nhung.Cam@dhl.com>
Subject: DHL Shipment Arrival Notification victim-email
Attachment: Shipment doc, INV+BL.zip (contains "Shipment doc, INV+BL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis438DD6FF4176.8257.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/838eccb3a23ad73e9e3dd0f50fad73d0589138e9f30339757bf7c84265843927/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-16 14:05:04 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qohmzm5chllt5hr52d2q7llt2bmjcohj6mbts5l367eeezmehetq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/838eccb3a23ad73e9e3dd0f50fad73d0589138e9f30339757bf7c84265843927

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 838eccb3a23ad73e9e3dd0f50fad73d0589138e9f30339757bf7c84265843927

(this sample)

FormBook

Executable exe 7abf73f6d63535a3770a681960124ee32f77d0305cfb82e80da13301829d5b25

  
Dropping
MD5 438dd6ff4176d470f3c8fa1c2f43aa58
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7abf73f6d63535a3770a681960124ee32f77d0305cfb82e80da13301829d5b25

Comments