MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5ec465ce7a271a129795092fe0b67c0365242eaf4aeed60db0b10f97a84a3d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5ec465ce7a271a129795092fe0b67c0365242eaf4aeed60db0b10f97a84a3d8
SHA3-384 hash: 3abe1559ab07990c397589066c1e5cb750646b33205dc3ef10a2c07f7da53e2006ae431be6899334e810832123163778
SHA1 hash: 97c5999cd8081bd3da685d7af3f3185cb6e4da80
MD5 hash: 206a48b2b1fa2df50040aae79ef60e1e
humanhash: single-saturn-bulldog-romeo
File name:INVOICE INV987845435.PDF.ARJ
Download: download sample
Signature Formbook
Create hunting rule
File size:286'033 bytes
First seen:2020-07-29 12:53:19 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:hmqiBoalQnmNnu/LIVHaNGrkw5rIvZbAI6opnU5n+9thTYzb3xSOoAFPQeScD:iBofpDIV6NGodZBPlNthTYzDxSjc9zD
TLSH 8254232C0A5B24C12FB905B6B5491D6078F6BA53273DE8E80D5B37CC817D13AF4E22E9
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: hotmail.com
Sending IP: 45.90.222.242
From: Hami TURFANDA <comercialrasmer@hotmail.com>
Subject: URGENT PROFORMA INVOICE INV987845435
Attachment: INVOICE INV987845435.PDF.ARJ (contains "INVOICE INV987845435.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5ec465ce7a271a129795092fe0b67c0365242eaf4aeed60db0b10f97a84a3d8/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 12:55:05 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uxwemxhhujy2cklzkcjp4c3hya3feqxk6sxo2yg3bmips6ueupma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5ec465ce7a271a129795092fe0b67c0365242eaf4aeed60db0b10f97a84a3d8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj a5ec465ce7a271a129795092fe0b67c0365242eaf4aeed60db0b10f97a84a3d8

(this sample)

Formbook

Executable exe 1ff207b34ed7e732262fb02c3effc89a93026ed7b4211f3242bbe830fabe55a3

  
Dropping
MD5 b564260bc01351ac561c23e23d3d07e3
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ff207b34ed7e732262fb02c3effc89a93026ed7b4211f3242bbe830fabe55a3

Comments