MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2420b932bf54b767be3595dca1d2f14df788a9992a70704b3dec913c3566b02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2420b932bf54b767be3595dca1d2f14df788a9992a70704b3dec913c3566b02
SHA3-384 hash: 5c5623a4eb0e4b22c7e5c0333f2f7008654f1c08045d047e5a6b24d1da58896efba30aedd0406e8cce54b94d0fe74818
SHA1 hash: 99bf1de99be76ed43bdd0b73c23f16f5c55df732
MD5 hash: a016aabb947dd2f109c4606c4883bde3
humanhash: venus-kentucky-mango-football
File name:ORDER 20200717-019.pdf.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:552'801 bytes
First seen:2020-11-06 17:22:18 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:2GkUvF3W+fUsD2fHzstt/feXQhmOGSb2RGbd89+Q:2ivF3W8UBHgFxER99+Q
TLSH A2C4236B3CC25299DF241DA8643BC424E252B324AB5E3DFDC6DEC54297C20D3A12F978
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: jivanindia.com
Sending IP: 77.68.31.54
From: Chandra Pal Singh <mail@jivanindia.com>
Subject: RE: MILIBOO - IT/ JIVAN - NEW ORDER 20200717-019
Attachment: ORDER 20200717-019.pdf.gz (contains "ORDER 20200717-019.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2420b932bf54b767be3595dca1d2f14df788a9992a70704b3dec913c3566b02/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 11:55:00 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2jbaxezl6vfxm67dlfo4uhjpctpxrcuzsktqobft33erhq2wnmba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz d2420b932bf54b767be3595dca1d2f14df788a9992a70704b3dec913c3566b02

(this sample)

Formbook

Executable exe a244a77f990bdec5f4f81d605990749206b6e5827e4bc140b9b4b2fbfdb0bb12

  
Dropping
MD5 f8fdaa6d045f8e817aea4ec6be8af64b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a244a77f990bdec5f4f81d605990749206b6e5827e4bc140b9b4b2fbfdb0bb12

Comments