MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0d126f49034e3701305ea919df19a34f32e55971ba4a4c970cfbebae601a23f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0d126f49034e3701305ea919df19a34f32e55971ba4a4c970cfbebae601a23f
SHA3-384 hash: 198bec937931656b77344139e3fab73f77044227247ad51987682b5bfe00df899346f5af177b40219ccf32ff1006c5ef
SHA1 hash: 42ea0db883cb4fcbd2aab5e566829aca2cb82576
MD5 hash: d29aadaf68b91be934641eac6f3206d6
humanhash: shade-pip-sodium-september
File name:Invoice Payment Receipt PDF .img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-03 07:34:13 UTC
Last seen:2021-03-03 07:35:06 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:TT4DtRF5xXGGxhTju8gOWPESDuzEJJDh0ZCNoc:TTIHpxA8grc0LJ30ZU
TLSH BD451201A7A4C877C1B111781636967A9FB6C0195D60EE4B374C1A4D3FB2EE1CF2F6A2
Reporter abuse_ch
Tags:FormBook GoDaddy img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: a2nlsmtp01-05.prod.iad2.secureserver.net
Sending IP: 198.71.225.49
From: Klevev Finance A.P <customerservice@hhmtelemedicine.com>
Subject: Payment Invoice Receipt
Attachment: Invoice Payment Receipt PDF .img (contains "Invoice #0023228 PDF.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1493.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0d126f49034e3701305ea919df19a34f32e55971ba4a4c970cfbebae601a23f/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 07:35:04 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6disn5eqgtrxaeyf5kiz34m2gtzs4vmxdoskjslqz67lvzqbui7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/f0d126f49034e3701305ea919df19a34f32e55971ba4a4c970cfbebae601a23f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img f0d126f49034e3701305ea919df19a34f32e55971ba4a4c970cfbebae601a23f

(this sample)

Formbook

Executable exe 8532972f199b85a336710c894ddebea7560f7f19c774b52a0d648275960e4db4

  
Dropping
MD5 1a48b4b314d6f2b3e9a67a8261b6d0d1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8532972f199b85a336710c894ddebea7560f7f19c774b52a0d648275960e4db4

Comments