MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ab026fdeca625c8acd514261d0e78af68c39603eaba666662c271bf6a903d75c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 6
| SHA256 hash: | ab026fdeca625c8acd514261d0e78af68c39603eaba666662c271bf6a903d75c |
|---|---|
| SHA3-384 hash: | a405836908b267580a043efb5d0b4e4a5835d7d350c8f4d60c53977d55487b41212208048ea6311cd9b2741ca5bc4e13 |
| SHA1 hash: | 0e9472defa298b6e6abd0a14179d907a738186cc |
| MD5 hash: | 9e309965b7a19080951e20f36014a70c |
| humanhash: | iowa-white-undress-sink |
| File name: | Shipping Documents Original BL, Invoice & Packing List.r04 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 410'509 bytes |
| First seen: | 2022-01-06 06:55:39 UTC |
| Last seen: | 2022-01-06 06:58:09 UTC |
| File type: | r04 |
| MIME type: | application/x-rar |
| ssdeep | 6144:PhyS1sLm1y3mDFUoXlW5BLcRVUFQT00X7c//P1VX2mePkEfCI0YbrMg40d:MKAm1y3n2W5B2VUFQPw1VLePhXE8 |
| TLSH | T13A94239A2C394DA19193C1C3EEDCC678DB51151A26FA06F2E74458EE1756312AFACCC3 |
| Reporter |  cocaman |
| Tags: | DHL FormBook INVOICE r04 |
cocaman
Malicious email (T1566.001)From: "DHL | Shipping Services <sa.remittance@dhl.com>" (likely spoofed)
Received: "from www558.sakura.ne.jp (www558.sakura.ne.jp [59.106.13.208]) "
Date: "5 Jan 2022 12:57:03 -0800"
Subject: "Last Reminder -DHL Shipment dispatched parcel"
Attachment: "Shipping Documents Original BL, Invoice & Packing List.r04"
Intelligence
File Origin
# of uploads :
2
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Status:
Malicious
First seen:
2022-01-06 06:56:17 UTC
File Type:
Binary (Archive)
Extracted files:
57
AV detection:
13 of 43 (30.23%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.