MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88ec3c5d32e0f0e3b6a63d2b8b2daacbaafc48ed8f86d450d248522516e6f092. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88ec3c5d32e0f0e3b6a63d2b8b2daacbaafc48ed8f86d450d248522516e6f092
SHA3-384 hash: 8b29e767584b0b08c891b5f2acdb065455cb228838aae302ef7d5e137d43c6d94e46975cd9468f36f133fe19449033b4
SHA1 hash: 43b797b87af73e040edac81eee419d386858fff9
MD5 hash: 5b9de6a95a83b7fe10074741997fbd03
humanhash: shade-september-low-magazine
File name:Drafts POF Project - Cost projection.z
Download: download sample
Signature FormBook
Create hunting rule
File size:230'460 bytes
First seen:2020-05-20 08:49:14 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:IQ6X0+9aNiFY864Sdm56/iU53YxGkVfX6pxDTz0LBpc3:xuQ0hHW5AX6pNz0Vu3
TLSH 123423A8431C80B41D5C46F58F32D0C91E311F49A5BF4468EBAA4BCD7D2E9DEAB0D24B
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: gongcha.com
Sending IP: 80.85.157.91
From: Brian Wang <brian.w@abb-world.com>
Subject: RE: POF Tender - Cost inspection
Attachment: Drafts POF Project - Cost projection.z (contains "Drafts POF Project - Cost projection.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 09:36:11 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdwdyxjs4dyohnvghuvywlnkzovpyshnr6dniugsjbjckfxg6cja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

z 88ec3c5d32e0f0e3b6a63d2b8b2daacbaafc48ed8f86d450d248522516e6f092

(this sample)

FormBook

Executable exe 50c3229d95c112d70bd8af684bd42e14ca2f38f8fa6b702dcba32e1d70025bd4

  
Dropping
MD5 f1e7fc79cfc09a77601dc2aae23a4923
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50c3229d95c112d70bd8af684bd42e14ca2f38f8fa6b702dcba32e1d70025bd4

Comments