MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a7e54deb003abf05b923c36f287085bc34f1c462a762714e86fcb0506b1a44c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a7e54deb003abf05b923c36f287085bc34f1c462a762714e86fcb0506b1a44c
SHA3-384 hash: 75f2c9befbe98e40a82f7d5bd2b71d009b658a9877e29a1dc749274eaba5295a52926252e60a40eda385c60fcdd54669
SHA1 hash: 08fa6c57dadd651415b04f7d6eec59c9e701d622
MD5 hash: bc74b596e886ac952e1d1b80584432c8
humanhash: massachusetts-uncle-river-black
File name:ORDINI.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:211'098 bytes
First seen:2021-01-04 13:20:52 UTC
Last seen:2021-01-09 09:03:31 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:dOgXalGHk3AoHF/UTjM2CyB0qsfZC6UM7pB2hj:XE3FJUTB0qEZC6rH2hj
TLSH 8A24233313FC2E6BE0946369290952E5C5462B88291BDF0B2EDB5FE68B113C3DD67931
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: server.allaboutoffice.gr
Sending IP: 94.130.138.183
From: Catia Mancini <c.mancini@crikcrok.it>
Reply-To: Catia Mancini <c.mancini_crik@toke.com>
Subject: ORDINE 04/01
Attachment: ORDINI.zip (contains "REQ670091261.exe")

Intelligence

File Origin
# of uploads :
15
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.b60584d1e39e2d6b.30069.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a7e54deb003abf05b923c36f287085bc34f1c462a762714e86fcb0506b1a44c/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 13:21:07 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tj7fjxvqaov7aw4shq3pfbyilpbu6hcgfj3cofhin7fqkbvrurga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9a7e54deb003abf05b923c36f287085bc34f1c462a762714e86fcb0506b1a44c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 9a7e54deb003abf05b923c36f287085bc34f1c462a762714e86fcb0506b1a44c

(this sample)

Formbook

Executable exe 59ce83a6f502ce8e4d717a387bebf425424a566eaa9e8c2c4a24fe864afc1679

  
Dropping
MD5 b60584d1e39e2d6b29c7e2b76f5c3b6d
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 59ce83a6f502ce8e4d717a387bebf425424a566eaa9e8c2c4a24fe864afc1679

Comments