MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee8fa79b46f58568694a1555e121ac033419c0a6d3ca02989a8433f0008613fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee8fa79b46f58568694a1555e121ac033419c0a6d3ca02989a8433f0008613fc
SHA3-384 hash: 53ee54296cfce29f4570bb0b9e768287939395a770ff40c9b24a29b1327e80da65c7baef75539e39d20f1e2a7f42fbee
SHA1 hash: 2a6542a341ee20a7ff72cba85e148bcffc1a1f00
MD5 hash: c217fd52759a513e2680af0b0d6a9c82
humanhash: alaska-aspen-six-purple
File name:PROFORMA INVOICE.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:480'551 bytes
First seen:2021-03-02 08:11:33 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:PqHWJOHLx7LLfRa9M0+ufweoMKmADnzHpOtUX+M/3wl:PMoOrxnLfRa+u4eodzmO+/
TLSH 0EA423CB2BCA3F8CCF6F197D8B2B5C2970EC5AAB4BDF04246B4D9B0684A76F44145584
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: dimmandiri.com
Sending IP: 45.137.22.36
From: "Pan Sovannareth" <mail@dimmandiri.com>
Subject: The PI of purchase order from UNIS company
Attachment: PROFORMA INVOICE.Z (contains "PROFORMA INVOICE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee8fa79b46f58568694a1555e121ac033419c0a6d3ca02989a8433f0008613fc/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-02 03:22:17 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=52h2pg2g6wcwq2kkcvk6cinmam2btqfg2pfafge2qqz7aaegcp6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/ee8fa79b46f58568694a1555e121ac033419c0a6d3ca02989a8433f0008613fc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z ee8fa79b46f58568694a1555e121ac033419c0a6d3ca02989a8433f0008613fc

(this sample)

Formbook

Executable exe 9c544787dc8afb7c1984cefedcdaa5bc28b7cdb2b57bf3c4fb5b158c02e3444d

  
Dropping
MD5 1bd3aaf000ed6d58b733dfead9e3433b
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c544787dc8afb7c1984cefedcdaa5bc28b7cdb2b57bf3c4fb5b158c02e3444d

Comments