MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d25d464d2f5c9697a54eafd37e42ca8da17683aa60d80cdf97463d8d6f8cfa9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d25d464d2f5c9697a54eafd37e42ca8da17683aa60d80cdf97463d8d6f8cfa9e
SHA3-384 hash: 4553ad4fe434858870b6cd65569984bacb71ceecccca3b402038d2f8bbd2c8a0d79c9e030fc3f67edcebeab5ae9adf2f
SHA1 hash: 2e475049d2635b6edd7d9159dd380c7c498e4fbb
MD5 hash: 0b5148ad2d8875478a820c118692248f
humanhash: winner-vermont-muppet-undress
File name:Quotation Request 18-08-20 PDF.r00
Download: download sample
Signature FormBook
Create hunting rule
File size:346'717 bytes
First seen:2020-08-18 10:18:09 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:qx/omT2hMn/OePZau0pMW68cqzCb2+PXGAm1vtxRA/s20MziCRYz6FbZebVllns:0omSq/O/ueMW687W3PXGAYvtxRA/s20C
TLSH 747423189740E432C301B4A3A542539D9FA35F688E973CD784236CDE9A71FB694A83FD
Reporter cocaman
Tags:FormBook r00


Avatar
cocaman
Malicious email
From: Sikereta Batsirai <batsirais@oldmutual.co.zw>
Received: from oldmutual.co.zw (unknown [103.133.106.216])
Date: 18 Aug 2020 03:16:52 -0700
Subject: REQUEST FOR QUOTATION
Attachment: Quotation Request 18-08-20 PDF.r00

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d25d464d2f5c9697a54eafd37e42ca8da17683aa60d80cdf97463d8d6f8cfa9e/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 04:40:45 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2joumtjplsljpjkov7jx4qwkrwqxna5kmdmazx4xiy6y234m7kpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

r00 d25d464d2f5c9697a54eafd37e42ca8da17683aa60d80cdf97463d8d6f8cfa9e

(this sample)

FormBook

Executable exe 1bfdb7e4f0aadba330b6017c2608570e791bfddff789d128ecb5ca9a5a06e6fe

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1bfdb7e4f0aadba330b6017c2608570e791bfddff789d128ecb5ca9a5a06e6fe
  
Dropping
FormBook

Comments