MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5a579ad4c78746af5321fbf4ec5654679f428a99a692ad012ef90afb27745b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5a579ad4c78746af5321fbf4ec5654679f428a99a692ad012ef90afb27745b6
SHA3-384 hash: 0a396db09587043e1d73f2ffc17338478782cd51d3ebc7e64f2f901be9e7f9245f08237471025086df999b489a49a892
SHA1 hash: acc4c3560498525d9fa7ea3933854e3d863dbebf
MD5 hash: b3e8a410e9ffea0184b3fdb6665a335c
humanhash: zebra-south-angel-white
File name:RFQ 73210704.pdf.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-04-08 07:04:41 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:mdm0rQdjIvD2Jb6le9ZRuu1nc361e35Upg4Qo:x0rQ6L68YnH1UUpg4h
TLSH 03458915264C9CA7FBE097322596A3352222FB401C20DF5AEE7B6A395B233715F07D72
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: tenda.cn
Sending IP: 58.250.161.62
From: marketing@tenda.cn <marketing@tenda.cn>
Subject: RFQ 73210704
Attachment: RFQ 73210704.pdf.IMG (contains "PO7321.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis774ECA4068DC.31277.22524.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5a579ad4c78746af5321fbf4ec5654679f428a99a692ad012ef90afb27745b6/
Threat name:
Win32.PUA.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 07:05:16 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwsxtlkmpb2gv5jsd67u5rlfiz47ikfjtjusvuas56ik7mtxiw3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/a5a579ad4c78746af5321fbf4ec5654679f428a99a692ad012ef90afb27745b6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img a5a579ad4c78746af5321fbf4ec5654679f428a99a692ad012ef90afb27745b6

(this sample)

Formbook

Executable exe 3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1

  
Dropping
MD5 774eca4068dce6d3db505c49af0a516e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1

Comments