MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc74c098cef50f977c755b6810fd8173f32810b1caa94853c56d82c15efbc1d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc74c098cef50f977c755b6810fd8173f32810b1caa94853c56d82c15efbc1d0
SHA3-384 hash: 1c306986428b8c7a54e47c9cd9010261c54e9bc5ac9b74c256dc2498597e727ecfec929f7e88fabaf80af1327411c2af
SHA1 hash: 9a43eab18bbeae61dee57357fea0de85d4643702
MD5 hash: eb51d128b7eb1df512aa6a694fbcc102
humanhash: georgia-charlie-alanine-hotel
File name:NEW ORDER.pdf.z
Download: download sample
Signature Formbook
Create hunting rule
File size:225'648 bytes
First seen:2021-05-25 08:21:12 UTC
Last seen:2021-05-25 10:03:18 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:/K3RY2mx2/GIXlkO1fNW4Z5JicvMxyd9liR2kc4v4midYY:q/F1kO1fNTPrqyd98R2W4LqY
TLSH C92423432718D507F82D47CF825F4B3892CD787989D32F72A1B8682951D6A42E6CBDCA
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email (T1566.001)
From: "Terence So <terence.so@otlsystems.com>" (likely spoofed)
Received: "from otlsystems.com (unknown [185.222.57.135]) "
Date: "25 May 2021 00:46:18 -0700"
Subject: "Re: PO 2020208"
Attachment: "NEW ORDER.pdf.z"

Intelligence

File Origin
# of uploads :
3
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27360.Rar5Heur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.46353888.14113.6419.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc74c098cef50f977c755b6810fd8173f32810b1caa94853c56d82c15efbc1d0/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-05-24 20:29:48 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
10 of 46 (21.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3r2mbggo6uhzo7dvlnubb7mbopzsqefrzkuuqu6fnwbmcxx3yhia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/dc74c098cef50f977c755b6810fd8173f32810b1caa94853c56d82c15efbc1d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z dc74c098cef50f977c755b6810fd8173f32810b1caa94853c56d82c15efbc1d0

(this sample)

Formbook

Executable exe 4d81b8f02e5a9eadfdb53142d1ad0c6793d07ca942f5ff5f946e6854fbe74c26

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4d81b8f02e5a9eadfdb53142d1ad0c6793d07ca942f5ff5f946e6854fbe74c26
  
Dropping
Formbook

Comments