MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 876005dcba89dd510717592ef26fc586299a6233c2cae3428b471b77162cd2cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 876005dcba89dd510717592ef26fc586299a6233c2cae3428b471b77162cd2cd
SHA3-384 hash: bbd4a813084acaa79b18357687caa00d1600680bf0d6640bf778b8069ecc851bd79258648463acda784e2c7e8629e91f
SHA1 hash: 3c799d5a5f0a0db5a5e00c02d70bfa3b1595cf16
MD5 hash: c03a44a15700384fc2cf0b041e1d121a
humanhash: maine-river-football-maryland
File name:INVJO 2002534 01IG0_PDF.IMG
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-21 08:05:23 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Q/XSzROZ1fEJ7lS/2Ius+ErPVmba3iAAt150WbtM25:CX5hk7lk2Ius+ErtmmWt/tM2
TLSH 8545F03212A86F66E67E973C5031200013F4F127D3A2E59EBDED90DE1BB6F458172B69
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: box.dhlexpressmx.xyz
Sending IP: 192.236.209.16
From: Grupo Bamex. S.A. de C.V. <office@dhlexpressmx.xyz>
Subject: Re: Recibo De Remesa - INVJO2002534/10/778369
Attachment: INVJO 2002534 01IG0_PDF.IMG (contains "INV202010778369.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.3706.30703.425.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/876005dcba89dd510717592ef26fc586299a6233c2cae3428b471b77162cd2cd/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-20 19:22:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q5qalxf2rhovcbyxlexpe36fqyuzuyrtylfogquli4nxofrm2lgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 876005dcba89dd510717592ef26fc586299a6233c2cae3428b471b77162cd2cd

(this sample)

FormBook

Executable exe 5943e0f810c211de134f7225c22c1d453da8acb0b6774b86b60eeb084b61a37a

  
Dropping
MD5 463c4ab7d6fb5ccf5a6390016276ab2e
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5943e0f810c211de134f7225c22c1d453da8acb0b6774b86b60eeb084b61a37a

Comments