MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bcd9aa0b18caf74a7d771c9802cdbb4f05a810c29c2d093252f004564fe4ed2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 5
| SHA256 hash: | bcd9aa0b18caf74a7d771c9802cdbb4f05a810c29c2d093252f004564fe4ed2b |
|---|---|
| SHA3-384 hash: | 95ad2eb26acc416204466117b5a0ac283c363f94c30aefaf8eb8ac406bce31100c473461a14698de1b35dda62f87d099 |
| SHA1 hash: | 98cb4d658ac1f16412c0255477b73586061a57c2 |
| MD5 hash: | 2c1fe24e7b0abe668a26653a8077f9a1 |
| humanhash: | papa-quebec-william-nitrogen |
| File name: | invoice.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 655'872 bytes |
| First seen: | 2020-04-15 11:03:26 UTC |
| Last seen: | 2020-04-15 11:59:45 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1a6aeac54320258ec433d218798aa4e9 (1 x Formbook) |
| ssdeep | 12288:K+LW6n5UJCEJBeaGpqVFQpJRevrLuTKXd+NznSmFE4XTRvRqr:rLWkuJp4awqVFQpJR+rLuGXd+NznnFE1 |
| Threatray | 2'093 similar samples on MalwareBazaar |
| TLSH | BCD412DBA5FDC5A0D4DC86311D0E76A02EC4FC93A40713390889F6A9B1B7B28A4B7775 |
| Reporter |  abuse_ch |
| Tags: | COVID-19 exe FormBook |
abuse_ch
COVID-19 themed malspam distributing FormBook:RAR->IMG->EXE
HELO: salo.com
Sending IP: 94.177.240.142
From: Chu Lam Yiu <tskiba@besser.com>
Subject: COVID 19 PENDIMG ORDER
Attachment: KH.O2333.rar (contains "KH.O2333#.img" -> "invoice.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Noon
Status:
Malicious
First seen:
2020-04-15 13:01:18 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
26 of 31 (83.87%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 2'083 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::GetStartupInfoW |
| WIN_USER_API | Performs GUI Actions | USER32.dll::CreateWindowExW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.