MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2c5bfd23304888a6f7fb4ec5f45b2f3e51bd411297c8d5c38fd010640af610f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2c5bfd23304888a6f7fb4ec5f45b2f3e51bd411297c8d5c38fd010640af610f
SHA3-384 hash: a1abd1302ea2435e9af5755204d3d73bf86ade56d1e3ed459d94a9c57b1805d08c5a964a9b78f71d0aa1e31d703e31f2
SHA1 hash: 1e37c43de6a1046d22e469ffa1c95ed90d70b73b
MD5 hash: 5298c4e4910e765377976a038d846ea8
humanhash: magazine-beer-salami-fifteen
File name:Order_April shipment.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:567'685 bytes
First seen:2021-04-07 11:20:30 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:uKgL/i+EceQ+t2sjZskVs4vDMBRa8Kbk/CrU9u2CY0nRc3C:u/L/7Ecep1fQBArbUwU9ubnR2C
TLSH ABC4234B080BBFCA1C9DDC5572B91857AB1E33ADA5A2B778FE3500458030B167C6FE82
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ip116.ip-147-135-107.us
Sending IP: 147.135.107.116
From: Kivuya<sales@angiplast.com>
Subject: New Order For April Shipment
Attachment: Order_April shipment.gz (contains "Order_April shipment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-AIC.1787.23003.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e2c5bfd23304888a6f7fb4ec5f45b2f3e51bd411297c8d5c38fd010640af610f/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 11:21:10 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4lc37urtaseiu337wtwf6rns6psrxvarff6i2xby7uaqmqfpmehq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e2c5bfd23304888a6f7fb4ec5f45b2f3e51bd411297c8d5c38fd010640af610f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz e2c5bfd23304888a6f7fb4ec5f45b2f3e51bd411297c8d5c38fd010640af610f

(this sample)

Formbook

Executable exe 029626fb22c7446fc6f2abd2551252a08507c68fd035d41694e2c77b6e868698

  
Dropping
MD5 edee2fdfadf88e84ca4136861633d099
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 029626fb22c7446fc6f2abd2551252a08507c68fd035d41694e2c77b6e868698

Comments