MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcc09519737448bb4c06a246cbac8cf2b97f978e3d48db856b3dcd759e17b3eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcc09519737448bb4c06a246cbac8cf2b97f978e3d48db856b3dcd759e17b3eb
SHA3-384 hash: 174d691d179fdcbb0f595df295f8c80b4e0a1377fe29a36dd0b63bdf8f6616b4cc717f88d9e8bd992d42612b433f78cf
SHA1 hash: 5599f05d4f796edf928010b04ad6b433b97b1bdb
MD5 hash: e68b82cd0bc323461dfe1a02df4a25a6
humanhash: indigo-quiet-white-enemy
File name:New Purchase Order NoI-701-PDF.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-01-04 17:56:42 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:U/hXM6TGfaXeRGjwj9qsgEtBI/IJQSv38gRxZcnC7O+LpS4Kz3Tx9LkfZ6o/r0hm:IXMXFUsgEz3K0p3h6oh
TLSH DC454B26B7C8F696E18000B87205FFA650603C35692EC843F7C57B5B78726EE9616F1B
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.briqidanorte.com
Sending IP: 45.85.90.87
From: AJITH GEORGE<office@briqidanorte.com>
Subject: Re: New Purchase Order No. I-701
Attachment: New Purchase Order NoI-701-PDF.img (contains "New Purchase Order NoI-701-PDF.pif")

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis94D16F15C595.9727.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcc09519737448bb4c06a246cbac8cf2b97f978e3d48db856b3dcd759e17b3eb/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 17:57:06 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3tajkgltorelwtagujdmxlem6k4x7f4ohvenxbllhxgxlhqxwpvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
VirLock
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dcc09519737448bb4c06a246cbac8cf2b97f978e3d48db856b3dcd759e17b3eb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img dcc09519737448bb4c06a246cbac8cf2b97f978e3d48db856b3dcd759e17b3eb

(this sample)

Formbook

Executable exe f1c600a86d9492512f5c80574f885bc0b2c0f058419f58b1c8800eb6e1502713

  
Dropping
MD5 94d16f15c595d839571bb68ece0e55f3
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1c600a86d9492512f5c80574f885bc0b2c0f058419f58b1c8800eb6e1502713

Comments