MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4947b26c5306a3abf3699d57d332983f1fd64c7d0b676e49f6dfa8bafca59d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4947b26c5306a3abf3699d57d332983f1fd64c7d0b676e49f6dfa8bafca59d0
SHA3-384 hash: f9b1181d1c5218551cc71d15b8377692d1aa46988e5f1c8e049aa0f033ca1d38a037f4def7fe7a10375a45e7b2b34eae
SHA1 hash: 771e672ffd89bcdd62b5fac8980f7b4f2b388159
MD5 hash: f5c9afcc50905b9670479f4fc959cc46
humanhash: mexico-carolina-hawaii-kansas
File name:pago SWift pdf.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:426'792 bytes
First seen:2021-02-20 11:26:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:hGMruu5awjsK+/oSq+ZsDK/J9iNoJ/mFe38FHJKslXc1e7Tn:nS4VjsK+zPsDKdJ+FQ8F77Tn
TLSH EC94236D0304DC6B09260AD251F9D23C977EC3D694924BFD3B0A23E9D77A6AB76F0160
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: srv03.webparaguay.com
Sending IP: 177.251.252.12
From: jorge vasquez <ventas@guyer.com.uy>
Subject: RE: copia rápida
Attachment: pago SWift pdf.zip (contains "pago SWift pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4947b26c5306a3abf3699d57d332983f1fd64c7d0b676e49f6dfa8bafca59d0/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-02-20 11:27:10 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4skhwjwfgbvdvpzwthkx2mzjqpy72zgh2c3hnze7nx5ixl6klhia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip e4947b26c5306a3abf3699d57d332983f1fd64c7d0b676e49f6dfa8bafca59d0

(this sample)

FormBook

Executable exe c76a77d2c81deab2fda96cc7cfcd42ca3886522b254ab6fa7448c7db8692e00a

  
Dropping
MD5 391975e669d455f1adecc5ca6a60f66a
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c76a77d2c81deab2fda96cc7cfcd42ca3886522b254ab6fa7448c7db8692e00a

Comments