MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfb532d61805c80f7a0dee1626dc0433f7866ff1522d0d978a679b37082071de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfb532d61805c80f7a0dee1626dc0433f7866ff1522d0d978a679b37082071de
SHA3-384 hash: 5740f1aa1e7d185473889f14292feb31a8dfb130b636b1def39b7eedb8c3314203d8b21877923e7de952a20913dfeb1b
SHA1 hash: 767c8f7c1524fcf3f781111f6d4b5eb6186b3bab
MD5 hash: 20088a6edc95eba6752add09e7aa94d2
humanhash: glucose-fanta-artist-single
File name:PURCHASE ORDER CONFIRMATION_pdf.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:833'205 bytes
First seen:2020-05-12 05:51:52 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 24576:DuQ1SeLcTf7cMwdVqgxM2SfIqF3UIrQIqk1zxlbwS:maMaIgOh4Iqk1zx1
TLSH 20052309123C2B9A4229BCF37365D65A52F87F8FF54C80D9A3A50F7572E9B20634D827
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: pro11.emailserver.vn
Sending IP: 103.15.48.231
From: FES TRADING CO., LTD. <info@lienbangtravel.com>
Subject: RE: Greetings From FES TRADING CO., LTD.
Attachment: PURCHASE ORDER CONFIRMATION_pdf.arj (contains "PURCHASE ORDER CONFIRMATION_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 06:36:09 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=362tfvqyaxea66qn5ylcnxaegp3ym37rkiwq3f4km6ntocbaohpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj dfb532d61805c80f7a0dee1626dc0433f7866ff1522d0d978a679b37082071de

(this sample)

FormBook

Executable exe 6fd98f10610827553549cf795c654fde41891da53df2a254f37a645530b809c1

  
Dropping
MD5 3e513165c274662bbd1bda8056782a96
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fd98f10610827553549cf795c654fde41891da53df2a254f37a645530b809c1

Comments