MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daf52d49cfc32c5a10453db45242bbd5b7b8886f3595d4099cf6b61b7a186309. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daf52d49cfc32c5a10453db45242bbd5b7b8886f3595d4099cf6b61b7a186309
SHA3-384 hash: 72a2775d4bb86772f2d08551fa0b0d75570eef6914b678ccddac9905e7f09939d8e751bd2c2ee99616c7dc79d3d7dc90
SHA1 hash: 776203cabf1241005c2b44818515a079cbc75cf0
MD5 hash: 0dc0ac6622230b25c7c5c694289d9da2
humanhash: delaware-ohio-muppet-south
File name:SHIPPING INVOICEpdf.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:500'040 bytes
First seen:2021-01-06 07:40:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:o7XqqntljhkNiKrCx3x0TqGOQl7wFlDfXNHhRHyk0YzelR:mljqM0T1L6tPWr
TLSH 74B423AC5D978D3D35E50D2E08002EAE63DDB040706D56D9BA9D17E8CC9EA4C4C73EAE
Reporter abuse_ch
Tags:DHL FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: elcon-in.com
Sending IP: 185.222.57.189
From: dhl express<Accountant@elcon-in.com>
Subject: DHL BILL OF LADING SHIPPING INVOICE DOCUMENTS
Attachment: SHIPPING INVOICEpdf.zip (contains "SHIPPING INVOICEpdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn25.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daf52d49cfc32c5a10453db45242bbd5b7b8886f3595d4099cf6b61b7a186309/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-05 21:53:43 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3l2s2sopymwfuecfhw2feqv32w33rcdpgwk5icm4623bw6qymmeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/daf52d49cfc32c5a10453db45242bbd5b7b8886f3595d4099cf6b61b7a186309

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip daf52d49cfc32c5a10453db45242bbd5b7b8886f3595d4099cf6b61b7a186309

(this sample)

Formbook

Executable exe 00f87217db6ce0a8cdff2047e69f74165e70f3a3a2132d0465217bf27e557776

  
Dropping
MD5 91347f3e146a598b9033329b55c957a5
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 00f87217db6ce0a8cdff2047e69f74165e70f3a3a2132d0465217bf27e557776

Comments