MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dada9e05330e6b6ff4d3ff68567caf21dafbb9057ea50a33626bec577a3c175d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dada9e05330e6b6ff4d3ff68567caf21dafbb9057ea50a33626bec577a3c175d
SHA3-384 hash: a5c7e3d8ee99d5a2b019324d7005e2187b8c1d3da0db292055246e34c45e32854d109fd5be9f4086fada2e9faf2cc1df
SHA1 hash: b368c99a38db45c0ad1cbe98515c557068c72490
MD5 hash: 868f8c2ddf977c0bbdfe7955452b51a8
humanhash: ohio-berlin-magazine-sad
File name:RFQ 1014397402856.pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:550'838 bytes
First seen:2021-04-04 08:24:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:zG9AyzilmGwWcn0Q1RZOUmvmmlBQkeoaPkF8mHdAmfljR2gzet:zF9I1JUBmxkeoFJHb88o
TLSH 1DC423D275D9482CAC53C6CCC407A69E1BA1C767C935674D8C1C2818A66FDB87B321F7
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: iwhost8.axxesslocal.co.za
Sending IP: 197.242.150.169
From: A Kanjani <md@gtobacco.com>
Subject: RFQ # 1014/397-18/NA
Attachment: RFQ 1014397402856.pdf.rar (contains "RFQ # 1014397402856.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-04 09:06:52 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lnj4bjtbzvw75gt75ufm7fpehnpxoifp2squm3cnpwfo6r4c5oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar dada9e05330e6b6ff4d3ff68567caf21dafbb9057ea50a33626bec577a3c175d

(this sample)

Formbook

Executable exe 2ceaf0bcc42eb42fd5f0762a630d78d965c6d4188016f32429f2eb86330da7dc

  
Dropping
MD5 00c19cdfb4c0dd846227e8eae3b3931e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ceaf0bcc42eb42fd5f0762a630d78d965c6d4188016f32429f2eb86330da7dc

Comments