MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5f53e95fed65c79b83d8baf6cb25bf34c9cfa8c52defce1d29220954f373076. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5f53e95fed65c79b83d8baf6cb25bf34c9cfa8c52defce1d29220954f373076
SHA3-384 hash: 9d002b058ce524648b25947160bb90c9c85a7d251d73be041b3b9d7c0c90b8cc87214a0595b60da49c365aad7479761e
SHA1 hash: ff398f6243981d6bc73a8fcb3568102a410d6154
MD5 hash: 4de39062ee395e1f931bf2205d792b06
humanhash: undress-sweet-earth-snake
File name:Imaged Clips Of Purchase-Order Inquiry.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'310'720 bytes
First seen:2022-05-14 06:40:22 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:ROtIWkZwQuqWRg7BLjLSif1UE8kat4MU53h2FHQyo:ROGUqs2HxNUE8kODnHQ
TLSH T10155D011FE25A4DEEC321E31CE3176FA052178216429EB0A7E7F7E0E1B7308C5627A95
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "Celene Parker <purchase@unibevkw.com>" (likely spoofed)
Received: "from server.ecomatter.in (server.ecomatter.in [162.215.217.75]) "
Date: "13 May 2022 02:17:33 -0700"
Subject: "Re: Imaged Clips Of Purchase-Order Inquiry"
Attachment: "Imaged Clips Of Purchase-Order Inquiry.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe formbook overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/627f4f0786897499c667137a/reports/d7a14245-2fc0-47a5-831a-71e5023dcbbe/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5f53e95fed65c79b83d8baf6cb25bf34c9cfa8c52defce1d29220954f373076/
Threat name:
Win32.Trojan.NSISInject
Create hunting rule
Status:
Malicious
First seen:
2022-05-13 08:21:02 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 41 (41.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wx2t5fp62zohtob5roxwzms36ngjz6umklppzyossiqjktzxgb3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5f53e95fed65c79b83d8baf6cb25bf34c9cfa8c52defce1d29220954f373076

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img b5f53e95fed65c79b83d8baf6cb25bf34c9cfa8c52defce1d29220954f373076

(this sample)

Formbook

Executable exe 05757c5f227063732e6e153de6c997f58a55a74b3236ef6af0aefcc859d29dce

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 05757c5f227063732e6e153de6c997f58a55a74b3236ef6af0aefcc859d29dce
  
Dropping
Formbook

Comments