MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef911d4f6162d25b42b36bd71b99dd256565a68410c707ee29c40a01f3797036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef911d4f6162d25b42b36bd71b99dd256565a68410c707ee29c40a01f3797036
SHA3-384 hash: 00feb3ea41ae0a62be34c22d5c4feba2e9312b345647ec73840f5e79070ba3c3ff01f16aecf965f81ef699f2022e4c08
SHA1 hash: 9c974a41167a4ba628c5e56e3962235ce28799e0
MD5 hash: d559327081b57fd122838deb74b92ac5
humanhash: oranges-earth-burger-colorado
File name:DHL PACKAGE - PDF.ace
Download: download sample
Signature FormBook
Create hunting rule
File size:378'096 bytes
First seen:2020-09-16 05:57:21 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 6144:IXD7gYxbzgfWl7KV7n9BJbyNlWUy0PwaFtc/alTsmBv5uZ5pK9WwpbQALCXtPhV:IXDE9fWcPu3DwaoismBx2SPbNWJhV
TLSH 6F84237363D70B1A92E84996457CD4CD300352380B56A26B06D992EDFE77818BEAF3DC
Reporter cocaman
Tags:ace


Avatar
cocaman
Malicious email (T1566.001)
From: ""Dhl Staff" <support@mie-tech.com>"
Received: "from server0.mie-tech.com (server0.mie-tech.com [23.254.165.190]) "
Date: "Wed, 16 Sep 2020 13:11:09 +0800"
Subject: "DHL - Your shipment reference - /Pending Notification"
Attachment: "DHL PACKAGE - PDF.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef911d4f6162d25b42b36bd71b99dd256565a68410c707ee29c40a01f3797036/
Threat name:
Win32.Trojan.Delikle
Create hunting rule
Status:
Malicious
First seen:
2020-09-15 10:51:14 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ef911d4f6162d25b42b36bd71b99dd256565a68410c707ee29c40a01f3797036

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

ace ef911d4f6162d25b42b36bd71b99dd256565a68410c707ee29c40a01f3797036

(this sample)

FormBook

Executable exe a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b

Comments