MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97fcd78356f44eded027f8236c70a7d8923b1f9390ee2cf87ea220e38c2b8903. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97fcd78356f44eded027f8236c70a7d8923b1f9390ee2cf87ea220e38c2b8903
SHA3-384 hash: af2a6fba194147b888cba4bb4da58fa0df338dbc90d46cda0b0ea19902e87414c8086cd554baae3c2757fed474f15622
SHA1 hash: 9d770ea89e7b3e5bc7e95707003ea8ae7a8df9ce
MD5 hash: e6a788a1c8eb5a0afa1b3b7ef999cb03
humanhash: august-freddie-mobile-delta
File name:Unattended Purchase Order PDF.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:337'870 bytes
First seen:2020-08-20 13:17:05 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:9BRztmnyjsRLt6Ys1Qqmn0eKU2gwQ64yZzbbJl7GJ+uahekrvjPE05e4hXLz3OWq:dU7dVCJu2ZmAHFe+uBkrLJ5e4hXOyqZV
TLSH 2D7423593D40E1D20598A1631B4F563CC26A6B690F33B7E9F3C1D8A5CC95EA087BCE6C
Reporter cocaman
Tags:FormBook r00


Avatar
cocaman
Malicious email
From: Sherry Sewell <sherry.sewell@deltarefractories.com>
Received: from deltarefractories.com (unknown [103.133.106.216])
Date: 20 Aug 2020 06:16:04 -0700
Subject: Previous PO
Attachment: Unattended Purchase Order PDF.r00

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97fcd78356f44eded027f8236c70a7d8923b1f9390ee2cf87ea220e38c2b8903/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-20 08:31:30 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s76npa2w6rhn5ubh7arwy4fh3cjdwh4tsdxcz6d6uiqohdblrebq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97fcd78356f44eded027f8236c70a7d8923b1f9390ee2cf87ea220e38c2b8903

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 97fcd78356f44eded027f8236c70a7d8923b1f9390ee2cf87ea220e38c2b8903

(this sample)

Formbook

Executable exe f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f3a30108ab40b7f31ad7ad191bb41bd3ad148d09597705c1ec0bc0352d18c29e

Comments