MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef455878d681b9a1255fa75207ea3cc905c96e780b2191f48873006d8a811327. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef455878d681b9a1255fa75207ea3cc905c96e780b2191f48873006d8a811327
SHA3-384 hash: 7530ce9946d76550b6e49718a6556c56c9aef5c579a4ec002b2c098a26324fd5864dc8d761eafd5a74f61661a20dfe04
SHA1 hash: ce68ea9dd93b0f18a234369861dacf410b672117
MD5 hash: 02d74e80efafe62595927e0c24862b79
humanhash: sierra-nebraska-muppet-oven
File name:Outstanding Invoices.pdf.ace
Download: download sample
Signature Formbook
Create hunting rule
File size:660'112 bytes
First seen:2021-02-22 12:45:38 UTC
Last seen:2021-02-26 13:06:42 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:4XIlZ58h3g3YX4QlWbgMF8CFbsyFgjSM+UxeDT7+GIL74+VjKdVZr:pwh38P8WxFFwjSDv36rx0r
TLSH 2DE4230B932A71932910F1B366A2E5BD7C84905FC52F9B0A7DD8524DBCF12DEC80B9D6
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
44
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef455878d681b9a1255fa75207ea3cc905c96e780b2191f48873006d8a811327/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 12:37:44 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=55cvq6gwqg42cjk7u5jap2r4zec4s3tybmqzd5eiomag3cubcmtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ef455878d681b9a1255fa75207ea3cc905c96e780b2191f48873006d8a811327

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace ef455878d681b9a1255fa75207ea3cc905c96e780b2191f48873006d8a811327

(this sample)

Formbook

Executable exe a8599ed108a38560de3851540edbbf3b83fc87a0f56fb883a24d6fda82b90c8f

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a8599ed108a38560de3851540edbbf3b83fc87a0f56fb883a24d6fda82b90c8f
  
Dropping
MD5 e6dd96a4410adfaafb8543a571212b61

Comments