MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd55f956428248f5a30829cb0145764e3a7c551c741bc0bd653594c20678e283. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd55f956428248f5a30829cb0145764e3a7c551c741bc0bd653594c20678e283
SHA3-384 hash: 7d6b422e46328d573abbe67d41d4eaa8b1936fe5b67dc286e18296a9df85fada8d2d2876cd4f16b6560610093099684c
SHA1 hash: e809f0ec3e1e544a39de12433d0afced0dc38604
MD5 hash: f0182f1daf7dd0238e286d50969a97c8
humanhash: harry-double-butter-bluebird
File name:Po 6-10331.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:16'837 bytes
First seen:2021-03-22 07:45:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:oGW8FRRrfpmjsOGJHWrXvvQsEtYwxpOvyBtzUa2WywwrZ:soJhmjsLH4ESwmvy/oaHCrZ
TLSH 2F72BFB92C368583909ED952625DA9A05D629EC2E0594BC2F01F0EF00B339946CF6F5D
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: BarrettHodgson.com
Sending IP: 103.156.91.170
From: Samiya Ahmad Khan<samiya.khan@BarrettHodgson.com>
Reply-To: samiya.khan@BarrettHodgon.com
Subject: REQUEST FOR QUOTATIONPo # 6-10331
Attachment: Po 6-10331.zip (contains "Po # 6-10331.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.12116.20300.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/dd55f956428248f5a30829cb0145764e3a7c551c741bc0bd653594c20678e283
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd55f956428248f5a30829cb0145764e3a7c551c741bc0bd653594c20678e283/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 06:55:57 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3vk7svscqjepliyifhfqcrlwjy5hyvi4oqn4bplfgwkmebty4kbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd55f956428248f5a30829cb0145764e3a7c551c741bc0bd653594c20678e283

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip dd55f956428248f5a30829cb0145764e3a7c551c741bc0bd653594c20678e283

(this sample)

Formbook

Executable exe 4046dccfa2b2852d5e1330d6dcbdd1f82a484d91b629c75c50adb5d0195a90f5

  
Dropping
MD5 a48d86def38d502bac802e367735ab6a
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4046dccfa2b2852d5e1330d6dcbdd1f82a484d91b629c75c50adb5d0195a90f5

Comments