MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4cd60f5488472faa0d33c0d84e607ac9764c8c38f6ffeab550e9a469629b612. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c4cd60f5488472faa0d33c0d84e607ac9764c8c38f6ffeab550e9a469629b612
SHA3-384 hash:	ef45eee953d98a327ee1cb7b937a6283b6ebdde356d5ab7c4df5379c96222af618508b3c57322e65b2c56a3272f83ed4
SHA1 hash:	80c432fb9b1d1750606647f26df840ce35863177
MD5 hash:	a51c6739472ff692b8a2c58b96cb8251
humanhash:	table-minnesota-fourteen-nineteen
File name:	Order NLDB-078005261400.r00
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	296'832 bytes
First seen:	2023-10-05 07:59:39 UTC
Last seen:	Never
File type:	r00
MIME type:	application/x-rar
ssdeep	6144:ly/KxlL6T6DyfxsQzdN5tI/Z+fECasvt+oDkeoLK4obkg1J/O1vo8WD9imdLXiqS:k/K726GpsQzBAZ+fJa6tlweoHoYu/QwG
TLSH	T15054236EA329CD4489BF6158E17FEC1DC4740C221122734E4FA66C1C7BE8779E6E2E46
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	FormBook r00

cocaman

Malicious email (T1566.001)
From: "Laura Mantese <8010@hbjomay.com>" (likely spoofed)
Received: "from [81.161.229.115] (unknown [81.161.229.115]) "
Date: "4 Oct 2023 18:46:13 +0200"
Subject: "Order NL/DB-078005261400"
Attachment: "Order NLDB-078005261400.r00"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

77

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Order NLDB-078005261400.exe
File size:	312'288 bytes
SHA256 hash:	0dd9f991b5122b16cb56164428b0665fee18ec5e5b56d9dab27125edc08b11e2
MD5 hash:	d996b078e1d0d20f86e2b5f7ce09fdb3
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20231004-1936.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control lolbin masquerade overlay packed remcos shell32 threat virus

Link:

https://www.filescan.io/uploads/651e6d04be42b2ac8e5bf53e/reports/96f084cc-0086-4bdb-b768-fbcaa95f5a34/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/c4cd60f5488472faa0d33c0d84e607ac9764c8c38f6ffeab550e9a469629b612

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c4cd60f5488472faa0d33c0d84e607ac9764c8c38f6ffeab550e9a469629b612/

ReversingLabs TitaniumCloud Win32.Trojan.FormBook

Threat name:

Win32.Trojan.FormBook

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-04 16:30:36 UTC

File Type:

Binary (Archive)

Extracted files:

4

AV detection:

17 of 35 (48.57%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ytgwb5kiqrzpvigthqgyjzqhvslwjsgdr5x75k2vb2nenfrjwyja._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Formbook

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c4cd60f5488472faa0d33c0d84e607ac9764c8c38f6ffeab550e9a469629b612