MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1bfd88850399a6349eab36587ddb1a8a4bcdf1fda271429c0044d2e386c578b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1bfd88850399a6349eab36587ddb1a8a4bcdf1fda271429c0044d2e386c578b
SHA3-384 hash: 3a00ef2272369730b64d285c271c44634e4a704f9792d56f0afb628667e48bd65294695db16a52ae1713467e956958a0
SHA1 hash: f22482ffce2c925fdada2fea489cb8a6c8841417
MD5 hash: a5c91b6302e4e0fe5321691d18cfda75
humanhash: solar-early-blue-dakota
File name:ORDER_PDF.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:208'145 bytes
First seen:2021-03-31 07:05:11 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 3072:CirE4VLKvnQfw/23Q0cgMUIiiqOnCjznOFQSUYVW9c5xhJalJzlzolp:BE4VKnQfQ2p3LOCHrw5TwpoT
TLSH B7142304DD2A50977766AE0F82B34546341B3FBBC634C3B25E6E10E6E86F45BEA2044F
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sayyess.xyz
Sending IP: 103.82.24.142
From: Jason Bourne <admin@sayyess.xyz>
Subject: RE: New Order
Attachment: ORDER_PDF.arj (contains "ORDER_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1bfd88850399a6349eab36587ddb1a8a4bcdf1fda271429c0044d2e386c578b/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 07:06:09 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wg75rccqhgnggspkwnsypxnrvcslzxy73itrikoaargs4odmk6fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/b1bfd88850399a6349eab36587ddb1a8a4bcdf1fda271429c0044d2e386c578b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj b1bfd88850399a6349eab36587ddb1a8a4bcdf1fda271429c0044d2e386c578b

(this sample)

Formbook

Executable exe af074697503cdf7544bc7f2f9ffa4df804aafe1b8374b1c666591189f60113a9

  
Dropping
MD5 e4651b69c621c32d10aff2412a997a07
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 af074697503cdf7544bc7f2f9ffa4df804aafe1b8374b1c666591189f60113a9

Comments