MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a34d50edbd87c99b41bc37b2059011d778a15eb07ab66065e8eed5cd15f378fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 5
| SHA256 hash: | a34d50edbd87c99b41bc37b2059011d778a15eb07ab66065e8eed5cd15f378fa |
|---|---|
| SHA3-384 hash: | 93473701845d25c6f5f2a893b8ec198d6d20efd30250b88028273a1ae2bcca2e4c24cdc2358f561e0585e06331afd65e |
| SHA1 hash: | 9c8d0be840eecc2fd307e4b391f139057833766d |
| MD5 hash: | c8f8c392bd5d2d53168ec6ac9c5d62dd |
| humanhash: | eight-comet-zebra-lion |
| File name: | BL836477488575.zip |
| Download: | download sample |
| Signature | Formbook |
| File size: | 16'886 bytes |
| First seen: | 2021-04-07 05:53:50 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 384:lNg992GVKjNtH2nVwxeh+WyNctsr9A3hdvEhylgtYW:7lN52nixe4nGg4NDo |
| TLSH | 2372D048BD6E7D4A39D7F73C03E17A913C81B20C4097C24A1F4A91D34979F845F66E89 |
| Reporter |  abuse_ch |
| Tags: | FormBook zip |
abuse_ch
Malspam distributing Formbook:HELO: server.oregontech.biz
Sending IP: 43.252.212.107
From: Damia/Navegacion SHIPPING <contactus@bloommaze.com>
Subject: RE: DRAFT BL: BPGUC21001161 / NEW SHIPMENT (Draft Dispatch Documents).
Attachment: BL836477488575.zip (contains "BL836477488575.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Spyware.Noon
Status:
Malicious
First seen:
2021-04-07 01:44:12 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
2/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Dropping
Formbook
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.