MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bd2709c49a5e8440d082d77c394f25a5c4f51fa6c13d9a76c656126434db5b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bd2709c49a5e8440d082d77c394f25a5c4f51fa6c13d9a76c656126434db5b9
SHA3-384 hash: b6f9f00284c722eb5f37b83e4bc20dbc6d104f9a263d8646a5c647a3d1a6e385b1c504d63f46b7dcd5ec0448b0f7bb5e
SHA1 hash: 7a9fc4854dcee8126e3a01d4b62b964bdc16ae68
MD5 hash: a2a0e2288493ccaaa64c5502f6004444
humanhash: william-nuts-river-four
File name:New Purchase Order 501,689.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:611'385 bytes
First seen:2020-10-14 16:32:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:UvWhJMzMFwfzqcypZ+JKXkG87btm1b7mST9+XCBMLbXsouF:UvWh6zMSfza47btmFHT4yBkTsouF
TLSH ECD423FEA4611F360DF92DAAC41863DE0C6E2DD7AE3B42D4915E5B2843EE99487B0C41
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sonic308-3.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.130.42
From: shishichuanhao <shishichuanhao@aol.com>
Reply-To: shishichuanhao <shishichuanhao@aol.com>
Subject: Re: Purchase Order Details
Attachment: New Purchase Order 501,689.rar (contains "New Purchase Order 501,689$.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bd2709c49a5e8440d082d77c394f25a5c4f51fa6c13d9a76c656126434db5b9/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rpjhbhcjuxueidiifv34hfhsljoe6up2nqj5tj3mmvqsmq2nww4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8bd2709c49a5e8440d082d77c394f25a5c4f51fa6c13d9a76c656126434db5b9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 8bd2709c49a5e8440d082d77c394f25a5c4f51fa6c13d9a76c656126434db5b9

(this sample)

Formbook

Executable exe 95cf775c4ff8b1fbaa88f99cf6148cfae8116b5258169dc1bf0dbae42a60f1f1

  
Dropping
MD5 70f28ccdf35c0a404b02d7bbb21907f4
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 95cf775c4ff8b1fbaa88f99cf6148cfae8116b5258169dc1bf0dbae42a60f1f1

Comments