MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9065217c8c054c16f631097a121808f540acbff955e88ba81270bb97b8ac2b65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9065217c8c054c16f631097a121808f540acbff955e88ba81270bb97b8ac2b65
SHA3-384 hash: a09931bf1b2416688f50524e0b0fd78bc12e7c2bd6941c7d60929af9a93c1a9119650f0f50a6901150c9f612bd94c823
SHA1 hash: d3aae2914ae2255f92bbb8a91163401d39f0cadc
MD5 hash: 50c6a199853a9de8e73aa764c66738f0
humanhash: lithium-fifteen-don-berlin
File name:SCAN_PAYMENT ADVICE.Pdf.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-18 11:43:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:ZXjFBmtgKWn6rNdeVTeHhu0ICGQXJXcNR1fVtuitjvM87SsZ780T1w+CdORzbI:ZXjFBmtgKWn6rNdeVTeHhu0ICGQXJXcJ
TLSH 7E45990276407211D1A8317D83E69C5937B8ACFF4AE1880DDF49769EFAB21E36C586CD
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.africanfitness.pw
Sending IP: 161.129.65.69
From: Sales 3 <citrroen.gouws@naverl.com>
Reply-To: citrroen.gouws@gmail.com
Subject: Fwd:Payment Advice!
Attachment: SCAN_PAYMENT ADVICE.Pdf.img (contains "SCAN_PAYMENT ADVICE.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9065217c8c054c16f631097a121808f540acbff955e88ba81270bb97b8ac2b65/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-18 11:45:07 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sbssc7emavgbn5rrbf5begai6vakzp7zkxuixkasoc5zpofmfnsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9065217c8c054c16f631097a121808f540acbff955e88ba81270bb97b8ac2b65

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 9065217c8c054c16f631097a121808f540acbff955e88ba81270bb97b8ac2b65

(this sample)

Formbook

Executable exe 017bb0ec25e33f7dbefcac17b8bdfc5ca199579e0d7a14670270eef15ff8abce

  
Dropping
MD5 58e5625ddd12f520189eb0e06e5bc08d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 017bb0ec25e33f7dbefcac17b8bdfc5ca199579e0d7a14670270eef15ff8abce

Comments