MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfc469e5794942566685a02ac6550a52e41a9d687891b2f8297364bee09c2ca4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfc469e5794942566685a02ac6550a52e41a9d687891b2f8297364bee09c2ca4
SHA3-384 hash: 5e6bc4c1fea4c61824dad9d3d34a393f8ba0e1cc23e49a4c84c43412657201972ae061b09da4cf0c340fe3a4f8150be0
SHA1 hash: 1111a5f865a406fb21ea6cd83ae5c1bedd032115
MD5 hash: b8563afffc2cbef6c18fd2926146e473
humanhash: oklahoma-ohio-oscar-lactose
File name:Payment Copy pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:672'358 bytes
First seen:2020-10-17 06:57:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:dmodxhMyK6zQ9XxaroN3CIyUb3id7lrPzwM3T9lNjrjyLQyArq4wmAQBpTBeo1o+:dmodxKy0xUYUlrrwM3ZlNjrGqumBBfe+
TLSH 64E4236D3AB5E1F5A447FFB3E112E1056822CE2A66D1543FD16809CF4CB386B63AF148
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ekinci-insaat.com
Sending IP: 64.52.174.16
From: Account <info@ekinci-insaat.com>
Subject: Re: PAYMENT COPY FOR REFERENCE
Attachment: Payment Copy pdf.rar (contains "payment copy pdf")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfc469e5794942566685a02ac6550a52e41a9d687891b2f8297364bee09c2ca4/
Threat name:
ByteCode-MSIL.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 22:40:40 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7cgtzlzjfbfmzufuavmmvikklsbvhlipci3f6bjonsl5ye4fssa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cfc469e5794942566685a02ac6550a52e41a9d687891b2f8297364bee09c2ca4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar cfc469e5794942566685a02ac6550a52e41a9d687891b2f8297364bee09c2ca4

(this sample)

Formbook

Executable exe e3a99ce882e0faa9a119c9a4d7f91368463f38f7cd20ae48528c267ac6a19968

  
Dropping
MD5 0278600e812f6b928722f884992e3abe
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e3a99ce882e0faa9a119c9a4d7f91368463f38f7cd20ae48528c267ac6a19968

Comments