MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7aca2c860a5cee1da53f6f06992f4524c3b201e3597d099d31f7a8e57693672. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7aca2c860a5cee1da53f6f06992f4524c3b201e3597d099d31f7a8e57693672
SHA3-384 hash: f37a3ea327cb06a30ff1f7c6644b550525695a5c736bc3a20bf89d5969f014d553df3804a22657f72cb8b5500cc4dc34
SHA1 hash: f08990fa496bcf5c44c26716ce6b29a6200bfed8
MD5 hash: 638ad3ba6b6a245a9e28c92ccf4f5c3f
humanhash: xray-spring-ohio-fanta
File name:Mv Maersk Kleven V949E_pdf.xz
Download: download sample
Signature Formbook
Create hunting rule
File size:687'455 bytes
First seen:2021-01-14 20:08:19 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:BTYcXk+M5SxARuYSep/elFfcN6wsS+12PePWUjJa8Ce4QqlZp5H960fLmsMUQ/0W:BDXk+M5SfYSekLxjSwPH9aw4F5hjfMJB
TLSH 0EE42341D0BDBCB45A8E3D3B08235A275D2B0EA9B7A51CEE3DD8FED724466F626410C1
Reporter abuse_ch
Tags:FormBook Maersk xz


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: vm4983.aproweb.it
Sending IP: 217.64.205.19
From: A.P. Moller - Maersk <info@hoteldaltavilla.it>
Subject: RE : RE : URGENT!!! 2 x 20ft - SHIPPING DOC BL,SI,INV#462345 // MAERSK KLEVEN V.949E // CLGQOE191781 //
Attachment: Mv Maersk Kleven V949E_pdf.xz (contains "Mv Maersk Kleven V949E_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7aca2c860a5cee1da53f6f06992f4524c3b201e3597d099d31f7a8e57693672/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-14 20:09:13 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=26wkfsdauxhodwst63ygtexukjgdwia6gwl5bgotd55i4v3jgzza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d7aca2c860a5cee1da53f6f06992f4524c3b201e3597d099d31f7a8e57693672

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

xz d7aca2c860a5cee1da53f6f06992f4524c3b201e3597d099d31f7a8e57693672

(this sample)

Formbook

Executable exe 56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275

  
Dropping
MD5 b9df17359c7c49389acb9d374464a780
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 56db76250b06a9b52b44a9cc88161cd8fb070c4b72aae4f2186362875edac275

Comments