MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0f97dc6857d36735d62755635432505bd50cc6203c19a9435c277d6eddbfcb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 10

Intelligence 10 IOCs YARA 12 File information Comments

SHA256 hash:	a0f97dc6857d36735d62755635432505bd50cc6203c19a9435c277d6eddbfcb2
SHA3-384 hash:	c9308828bdaab6da912a2594c51048550c8a039af562a99220707bbe5fa98940f8b65afe75e5d66cb8a69bebc579ca5a
SHA1 hash:	4cfc38ebdd8182dc7fff0e65f1ac6ed59f73d67d
MD5 hash:	06898f2bdfb18f44093c473283a0e5c6
humanhash:	hotel-florida-mobile-cup
File name:	GLTB-PO2410002.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	684'176 bytes
First seen:	2024-12-06 21:10:12 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:1X29Y6/S2rqL3zqThh/u/AmzFvVcElzvw5vMY/R:VpCSOgzqTb/WV5pjk
TLSH	T1E0E4230D65D867AF5BCA54302B85646831EFBAE282F0C07486A1BD547FB7BF7041E207
Magika	zip
Reporter	cocaman
Tags:	FormBook zip

cocaman

Malicious email (T1566.001)
From: "Ismail MF <info@ipp.ae>" (likely spoofed)
Received: "from ipp.ae (unknown [141.98.10.209]) "
Date: "06 Dec 2024 22:08:20 +0100"
Subject: "RE: GLTB-PO/24/10002"
Attachment: "GLTB-PO2410002.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

714

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	GLTB-PO2410002.exe
File size:	733'184 bytes
SHA256 hash:	d2409d7db0c9a560886eeb399501c90314efe0568859cb21c460fcdc92b2e160
MD5 hash:	167bb869ff95207f62d65f9bae551bb7
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.29324.26224.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6753049119fba9940b49867e

Tags:

virus micro msil

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/a0f97dc6857d36735d62755635432505bd50cc6203c19a9435c277d6eddbfcb2/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/67536867f158f0b6a3b2eace/reports/4e9172de-7b2c-4231-b8a3-2da0f1d6c423/overview

Verdict:

Suspicious

Labled as:

Troj/Krypt

Link:

https://www.hybrid-analysis.com/sample/a0f97dc6857d36735d62755635432505bd50cc6203c19a9435c277d6eddbfcb2

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/a0f97dc6857d36735d62755635432505bd50cc6203c19a9435c277d6eddbfcb2

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)