MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b13d431a07f4f60bac10cfeae185552509c0efee7d9de7c369d5b63a4b9db4a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b13d431a07f4f60bac10cfeae185552509c0efee7d9de7c369d5b63a4b9db4a2
SHA3-384 hash: abee3eb43e3d23bad8ae904f0117e50f19da852fce1660c4c259768dc028727f312d2a53357bca96e421dd068e29b77a
SHA1 hash: d8ca01afc2073ee20cd2fd4ac0e33a267644c250
MD5 hash: b3a28cce02888a20b0a9b935fb7b2eaa
humanhash: tennessee-mississippi-aspen-virginia
File name:PI-292829.txt.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:390'282 bytes
First seen:2020-10-19 06:30:21 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:J1IGbjRaFvptn+SEpHlMntX9ukIc2JE3V2d4h8jAzvCXB3MKOKdvUC55B3M6+UaC:YeAhL+fwt9uo2JioxjBR3MZKdso5JJ+u
TLSH 2884238AE6350C20A8494D1214FA472C7B459217C91DF9B7FBF97D47A7B05A03FACE60
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: qq.com
Sending IP: 83.149.106.6
From: Jenny Chan <13409204634@qq.com>
Subject: RE: 回复： 回复： RE： Urgent: Proforma invoice
Attachment: PI-292829.txt.gz (contains "PI-292829.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b13d431a07f4f60bac10cfeae185552509c0efee7d9de7c369d5b63a4b9db4a2/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-18 23:36:34 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=we6uggqh6t3axlaqz7vodbkveue4b37opwo6pq3j2w3dus45wsra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b13d431a07f4f60bac10cfeae185552509c0efee7d9de7c369d5b63a4b9db4a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz b13d431a07f4f60bac10cfeae185552509c0efee7d9de7c369d5b63a4b9db4a2

(this sample)

Formbook

Executable exe c74fbf07caa2e454d520cd64c36928a24082ded47a6ded2a58e3287b3d9ddb82

  
Dropping
MD5 c4657321e3593494c5b3e307c992bbc1
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c74fbf07caa2e454d520cd64c36928a24082ded47a6ded2a58e3287b3d9ddb82

Comments