MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ebf8c36edf876c352646c5d153b82599e3990ead26e8dbd9220f2b10103217ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 6
| SHA256 hash: | ebf8c36edf876c352646c5d153b82599e3990ead26e8dbd9220f2b10103217ac |
|---|---|
| SHA3-384 hash: | 62b7c715fcda21c07fb0f28f045d267307432acac8d33f42c2ec020310cead684b4b74d23882b59d8a8dd7461a460683 |
| SHA1 hash: | 270d499b394992bf6884c3fec4ebdacac83306d3 |
| MD5 hash: | 06566c6cc694eafc182eae43a5e2497d |
| humanhash: | salami-cat-beryllium-mobile |
| File name: | 0700122.zip |
| Download: | download sample |
| Signature | Formbook |
| File size: | 29'834 bytes |
| First seen: | 2022-07-01 07:23:00 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 768:EByf7xpqI1XdxaF+zLlfjm6ZBQscvu8ZOWD3:TdpqIhbpLxh0tvu8Zx3 |
| TLSH | T1E7D2F1BE2BFE09A843DCD7091869DD06412BF7F464A75A25716BB5E62C8C08E08F1279 |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  cocaman |
| Tags: | FormBook zip |
cocaman
Malicious email (T1566.001)From: "CIMB Malaysia <cimb.marketing@cimb.my>" (likely spoofed)
Received: "from aymotall.puzzest.com (aymotall.puzzest.com [45.130.138.175]) "
Date: "1 Jul 2022 00:00:55 -0700"
Subject: "Transaction Notification"
Attachment: "0700122.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Spyware.Noon
Status:
Malicious
First seen:
2022-07-01 07:23:06 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
11 of 39 (28.21%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook campaign:fs44 rat spyware stealer suricata trojan
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.