MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95e6b099bad289fc5df5aa43fbf0360eb0b7f04c319eaee43043b094054c6cbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95e6b099bad289fc5df5aa43fbf0360eb0b7f04c319eaee43043b094054c6cbc
SHA3-384 hash: 99d7201a358b9fd93521d03875c2dca8a4dc934d6ada0a1465aee1a0d9b2c10b6c55ab8351ac2b8654a4927a508ad29b
SHA1 hash: 5dec646ff768b09e34518530ac70340b0d7e8ef4
MD5 hash: 4da4189b7db8637d7517797795fc5cb4
humanhash: five-king-hot-solar
File name:PDF NEW P.OJerhWEMSj4RnE4Z.r.z
Download: download sample
Signature Formbook
Create hunting rule
File size:408'633 bytes
First seen:2021-04-01 07:24:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:M586zaQ2dcp9BkTP7fjldq3hdgoerhRj3u1i:6TzTp9Bk7nl43hd2rzuQ
TLSH E1942330C266EF4A94E271EBD3D209296457E2602D2C03BE9DD0CC917615D2BBB639E7
Reporter abuse_ch
Tags:z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hormozanoil.com
Sending IP: 103.125.191.170
From: Hormozan Oil<zeinab@hormozanoil.com>
Reply-To: Zeinab Arjeini<rolandskin@mail.ru>
Subject: QUOTE FOB IN USD
Attachment: PDF NEW P.OJerhWEMSj4RnE4Z.r.z (contains "PDF NEW P.OJerhWEMSj4RnE4Z.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.576-3.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/95e6b099bad289fc5df5aa43fbf0360eb0b7f04c319eaee43043b094054c6cbc
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95e6b099bad289fc5df5aa43fbf0360eb0b7f04c319eaee43043b094054c6cbc/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-04-01 05:09:38 UTC
AV detection:
10 of 44 (22.73%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sxtlbgn22ke7yxpvvjb7x4bwb2ylp4cmggpk5zbqioyjibkmns6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/95e6b099bad289fc5df5aa43fbf0360eb0b7f04c319eaee43043b094054c6cbc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 95e6b099bad289fc5df5aa43fbf0360eb0b7f04c319eaee43043b094054c6cbc

(this sample)

Formbook

Executable exe 3803dec5e2ab718dedda091e9ee84b588545614ae3d54aa78d956cec21128fda

  
Dropping
MD5 68614b4f9185440fb9dca40451d4d6e7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3803dec5e2ab718dedda091e9ee84b588545614ae3d54aa78d956cec21128fda

Comments