MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd931a8edca7f3016961ff7633973864e3e60266f6a920f01dfcd1b240a0b22b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd931a8edca7f3016961ff7633973864e3e60266f6a920f01dfcd1b240a0b22b
SHA3-384 hash: fc203b06dd616890bed636280466d4998889075d5f5480d97dce21d967c8966d87095710077289293193c771c01d0fef
SHA1 hash: 45ffd57aca4fa621f6d704c0a99c9a80761c7b06
MD5 hash: ed7189aaca312909de6e10a1564699dd
humanhash: georgia-lima-video-xray
File name:GM85NEI PDF.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:510'563 bytes
First seen:2020-08-27 05:23:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:tE0kCCiDSFP26o2KoggPxEOIxTapqwRkgZdnnbV+lh8:tEZionbKox0x+pq8kcVl
TLSH 6AB423538A989C43B266907CDC82CDC42F1DA230618B9F1C568F5B5B7394669DEBE0CD
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sonic305-19.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.64.82
From: john sales <sale_john1@yahoo.com>
Subject: : Fwd: Wire Transfer Payment
Attachment: GM85NEI PDF.rar (contains "yGM85NEI1QLBt87.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd931a8edca7f3016961ff7633973864e3e60266f6a920f01dfcd1b240a0b22b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:25:06 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wjrvdw4u7zqc2lb753dhfzymtr6matg62usb4a57ti3eqfawivq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd931a8edca7f3016961ff7633973864e3e60266f6a920f01dfcd1b240a0b22b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar dd931a8edca7f3016961ff7633973864e3e60266f6a920f01dfcd1b240a0b22b

(this sample)

FormBook

Executable exe 22366b7c6e51e58b855a91cc558885c438a34deaa588af13e0601586686e18f3

  
Dropping
MD5 8d37edf39c5ec13ed51cd67cb1fcaf84
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22366b7c6e51e58b855a91cc558885c438a34deaa588af13e0601586686e18f3

Comments