MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7c94551aecf1c6d81d3bd7986e06667fadc6bd496ce7133d671d0c79137eb51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7c94551aecf1c6d81d3bd7986e06667fadc6bd496ce7133d671d0c79137eb51
SHA3-384 hash: 5ed7a527e65e5945e225f2c07f077060aab4516f6e5ebd79ed72b1b9318eb50d38d720dcb09c9f3fae50da9cf0c08068
SHA1 hash: 1a72c8ecd2c4dd7d4e86ae3019635fa100475671
MD5 hash: 8b454ae6b6f885af5d1f4213d3733777
humanhash: lion-washington-march-paris
File name:DHL Shipping Notification-pdf.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:948'029 bytes
First seen:2021-07-26 14:24:12 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:kTqS4lV7F5deCnBC+AdNt8f/SDraKvChoxKJKQPQ5hV0kt4/8rBS06g/ClO6p/MT:gwDgCnUF8f63Lqhox/5hikSASiZ4Q4U
TLSH T1D715238CD2A2F9227F7B14608E9720CE2E29632CA584F1585D9E5FC348A93DDC3ED41D
Reporter cocaman
Tags:DHL FormBook r00


Avatar
cocaman
Malicious email (T1566.001)
From: "ycm82820985 <ycm82820985@vip.126.com>" (likely spoofed)
Received: "from vip.126.com (unknown [185.222.57.90]) "
Date: "26 Jul 2021 14:33:23 +0200"
Subject: "New DHL Shipping Notification!"
Attachment: "DHL Shipping Notification-pdf.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-07-26 14:25:09 UTC
File Type:
Binary (Archive)
Extracted files:
59
AV detection:
14 of 28 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w7eukunoz4og3aotxv4ynydgm75ny26us3hhcm6wohimpejx5niq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/b7c94551aecf1c6d81d3bd7986e06667fadc6bd496ce7133d671d0c79137eb51

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 b7c94551aecf1c6d81d3bd7986e06667fadc6bd496ce7133d671d0c79137eb51

(this sample)

Formbook

Executable exe eebf2b5d558c3f39f52538f7d3175c732f38351dca734eb37bf975796dcc086a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eebf2b5d558c3f39f52538f7d3175c732f38351dca734eb37bf975796dcc086a

Comments