MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfd0bc152c70931b1491f264176cacc609b7527eae471dc1f9bae04d1927fd12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfd0bc152c70931b1491f264176cacc609b7527eae471dc1f9bae04d1927fd12
SHA3-384 hash: f715bcdc634f7f3ef50d7e18af25b05551e43eb5c1c69ce6fefea31870d06de1121e009cd6db9e273249cebdb75f66e5
SHA1 hash: ba3ac30c8e1277cc839d07cecd3244bd951791bb
MD5 hash: 07a3c0430a1e0a6730bece2b57e24623
humanhash: illinois-alanine-oregon-enemy
File name:QUOTATION_DOC_DOCX_PDF.GZ
Download: download sample
Signature FormBook
Create hunting rule
File size:28'786 bytes
First seen:2020-08-17 13:56:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:rsWGTEJEw7tvu7UBdfUWSTp7m8sgULR9i4h0N:rooaKvuwGlRm8sFLS4s
TLSH C5D2E1C566CB262B4B1D0FE0730B6643A1C5E1AAF678208C1493679C7D57DD3F7C602A
Reporter abuse_ch
Tags:FormBook GuLoader gz Hostwinds


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-760084.hostwindsdns.com
Sending IP: 104.168.145.121
From: info@hemoclan.com
Subject: QUOTE PRICE
Attachment: QUOTATION_DOC_DOCX_PDF.GZ (contains "QUOTATION_DOC_DOCX_PDF.exe")

GuLoader pushing Formbook:
https://onedrive.live.com/download?cid=6A851B3D3D1425A8&resid=6A851B3D3D1425A8%21109&authkey=ADruIa-EK-olg1M

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfd0bc152c70931b1491f264176cacc609b7527eae471dc1f9bae04d1927fd12/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 13:58:07 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7ilyfjmocjrwfer6jsbo3fmyye3out6vzdr3qpzxlqe2gjh7uja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cfd0bc152c70931b1491f264176cacc609b7527eae471dc1f9bae04d1927fd12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip cfd0bc152c70931b1491f264176cacc609b7527eae471dc1f9bae04d1927fd12

(this sample)

FormBook

Executable exe d4be4226b685156a19f30ba35099d97c9608c08053992fc0d158b8f6b2bb7712

  
URLhaus
https://urlhaus.abuse.ch/url/434382/
  
Dropping
MD5 e7e24dc3a53ea2ae2a518ae5d743d100
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d4be4226b685156a19f30ba35099d97c9608c08053992fc0d158b8f6b2bb7712

Comments