MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad62423fa86a4bd84e4fc02dd4e49d463789e7b61f036c6b54c93be7956de930. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad62423fa86a4bd84e4fc02dd4e49d463789e7b61f036c6b54c93be7956de930
SHA3-384 hash: 906412cb3a568180908facdb7048ae22fdbe8a66caeacbb14d05fbf767e61f24e270b53c8d6e44f1675b0022c8e1023d
SHA1 hash: 7546538fd563ffea45027e1dc6cc725f0ea952d6
MD5 hash: f42b7368faf66fa6c598c7d854783dce
humanhash: twenty-april-white-hydrogen
File name:Certrificate Confirmation.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:529'396 bytes
First seen:2021-04-07 05:52:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:MaryNJhiAlGg9q5YgJEHaGrulDFHfXLLB25ARnzKz7+vQDSpq8g83:/iZ9q5YgmHaGrUF/X8qR+zVDyq8g6
TLSH F2B423EA841B7FB3D55C64680A6FA5B01AFCE09121BB5308F5ABD09824B77CCB31954F
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: "Admin"<sales@acalbfi.com>
Reply-To: bmathena@accesesdata.com
Subject: FYI
Attachment: Certrificate Confirmation.rar (contains "Certrificate Confirmation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad62423fa86a4bd84e4fc02dd4e49d463789e7b61f036c6b54c93be7956de930/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vvreep5injf5qtspyaw5jze5iy3ytz5wd4bwy22uze56pfln5eya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/ad62423fa86a4bd84e4fc02dd4e49d463789e7b61f036c6b54c93be7956de930

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar ad62423fa86a4bd84e4fc02dd4e49d463789e7b61f036c6b54c93be7956de930

(this sample)

Formbook

Executable exe 002ec09931d23f0e66d86eda11ce72113d3e29a1cd0bd296b83ee567981610d8

  
Dropping
MD5 e20d1a790563961f595cc045934ff3d2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 002ec09931d23f0e66d86eda11ce72113d3e29a1cd0bd296b83ee567981610d8

Comments