MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb68673dc5267bb4205f3f8085ada863c9d89a18beec3b943c6b16930e3ecfe1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb68673dc5267bb4205f3f8085ada863c9d89a18beec3b943c6b16930e3ecfe1
SHA3-384 hash: 4d2b1c64eda49653f91492c22591002d215128044fe7e2cf816dee85926e8dee78b602d4a3d77c1cca3d64d9aa40e5d1
SHA1 hash: 51289e9a4791aa5ebfbb02df9855afb432f808f4
MD5 hash: bf69d568cc7fb5a7c64f55ea39a066a7
humanhash: stream-cat-jupiter-social
File name:Inquiry-RFQ93847849-pdf.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:234'921 bytes
First seen:2021-01-06 16:09:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:EFd6/cP0IMNJmRBCK/dnB4PFL9hulbObrRX4P:udkcsIcmyK/JBCICbrRX4P
TLSH A83423C5161C6098E63537BC871B96EC9DCE87DD2AC1A23ED613317B35E463B184E0AB
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.briqidanorte.com
Sending IP: 45.85.90.87
From: AJITH GEORGE<office@briqidanorte.com>
Subject: Fw: Inquiry
Attachment: Inquiry-RFQ93847849-pdf.zip (contains "Inquiry-RFQ93847849-pdf.pif")

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb68673dc5267bb4205f3f8085ada863c9d89a18beec3b943c6b16930e3ecfe1/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 16:10:06 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=znugopofez53iic7h6aillnimpe5rgqyx3wdxfb4nmljgdr6z7qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb68673dc5267bb4205f3f8085ada863c9d89a18beec3b943c6b16930e3ecfe1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip cb68673dc5267bb4205f3f8085ada863c9d89a18beec3b943c6b16930e3ecfe1

(this sample)

Formbook

Executable exe 2ce70c12c5b8806fc6b3e507c5ed406599045b20688b456db124b1b685da60d0

  
Dropping
MD5 c586eef5da0522589ec8fd00ae4d52fd
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ce70c12c5b8806fc6b3e507c5ed406599045b20688b456db124b1b685da60d0

Comments