MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf110b2a5010075e0a4bb99c1d8ac5b532b99a4a86cd6b8a97fbd7c727b34edf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf110b2a5010075e0a4bb99c1d8ac5b532b99a4a86cd6b8a97fbd7c727b34edf
SHA3-384 hash: 90d7b58dfc2d1f9e4676f24bb306eb680759c5cfbfbf6fe8fc11d549d548960d0504ab3958784b313c8443426555c249
SHA1 hash: 70b2b681c0d09edb051ee33a3173a17d34db6b76
MD5 hash: 8dd188896e659e8f46932214f84f2e5d
humanhash: undress-march-washington-lima
File name:DHL SHIPPING NOTIFICATION.ace
Download: download sample
Signature Formbook
Create hunting rule
File size:410'324 bytes
First seen:2020-11-26 13:53:37 UTC
Last seen:2020-11-27 20:02:37 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:O2Slh0apMrfiGQYhBSJPerkRF7TVxB8FkUnwvk1:hSlKapMraGQ8wYgjVxB8WUf
TLSH 5E9423837B135920E76E6FB60DB3F96D88F5C65A18B7001A4BBE0A61335188371C72DE
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
9
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf110b2a5010075e0a4bb99c1d8ac5b532b99a4a86cd6b8a97fbd7c727b34edf/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-23 10:00:31 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf110b2a5010075e0a4bb99c1d8ac5b532b99a4a86cd6b8a97fbd7c727b34edf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace cf110b2a5010075e0a4bb99c1d8ac5b532b99a4a86cd6b8a97fbd7c727b34edf

(this sample)

Formbook

Executable exe d8d9bb65ea3637fda09488baada0c9b387e0619b7c430b93c8a0fa2d8b489bc1

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d8d9bb65ea3637fda09488baada0c9b387e0619b7c430b93c8a0fa2d8b489bc1
  
Dropping
MD5 579ba39b6a146080ef6481591440e445

Comments