MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af868fb563094032a83b34c6ee8385530895af9d9f4ccfd0b738077f78292c50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af868fb563094032a83b34c6ee8385530895af9d9f4ccfd0b738077f78292c50
SHA3-384 hash: d10c85fffa36927406f925dc3733b505524395f22fd635339ad9dafae2ead842c14838663c9b0c54f0df135648427ea0
SHA1 hash: 8cf96ccab9edff54b19819ecee6dbcbe4a6e13f9
MD5 hash: 0af724f271de88e5b10fe3f3597ff2bc
humanhash: asparagus-ten-india-ten
File name:Price list pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:634'399 bytes
First seen:2021-03-31 06:01:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:8GSrXoyzx19ByFd5kKfbmkPjq+gvfGrI8RljX5dhlDPPm6WJ98TJi:89DNMFd5kKTmkPdAGr95zhRP7W0T4
TLSH 4BD4231ED6A9B0EF05445C9E3C86E93D389E5A7300FD4E4FED1332667E2B2117E49690
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: "<sales@singcomm.com.sg>" (likely spoofed)
Received: "from singcomm.com.sg (unknown [103.153.183.156]) "
Date: "31 Mar 2021 00:52:21 -0700"
Subject: "Price List confirmations "
Attachment: "Price list pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af868fb563094032a83b34c6ee8385530895af9d9f4ccfd0b738077f78292c50/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 05:39:44 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
4 of 45 (8.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6di7nldbfadfkb3gtdo5a4fkmejll45t5gm7ufxhadx66bjfria._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/af868fb563094032a83b34c6ee8385530895af9d9f4ccfd0b738077f78292c50

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar af868fb563094032a83b34c6ee8385530895af9d9f4ccfd0b738077f78292c50

(this sample)

Formbook

Executable exe 3df2cc414d6cef0d973d0f47141a13be183a9da46e0455940affe5d24b9c2f9f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3df2cc414d6cef0d973d0f47141a13be183a9da46e0455940affe5d24b9c2f9f
  
Dropping
FormBook

Comments