MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2a896a1572fd1bdd420a9686b4e98885b1308ade872b300303c4a638700854d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2a896a1572fd1bdd420a9686b4e98885b1308ade872b300303c4a638700854d
SHA3-384 hash: 3203dfcdb70d221f38f0de88f25b91aae3faf68222a1063ec9a87be3e87910aef8e0c092764d2ca82aa7caf94ad27844
SHA1 hash: 15f02db9db75a51d93a31a087e0ce3a975d37e82
MD5 hash: 5d4341eb4ea964a031e35e581c2a310e
humanhash: lima-ack-shade-jig
File name:NEW PO N49876733_PDF.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:215'530 bytes
First seen:2020-08-12 07:04:05 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 3072:otOD5/wQrxQCUcKHI0rGP/aniyUpRXHA+GQWZtKkH7ZKDApu4w6orLz5EVvityrj:oCwobU/Ij8iLpZHADJtKkHFju4VI4vnn
TLSH 48242360D4B8E8DE0EB16CFD5D4A8373582DF156E6C3895C4B8EC978F0270A9118B27E
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email
From: Ann<hskim@ecomaister.com>
Received: from ecomaister.com (unknown [212.83.46.93])
Date: 2 Aug 2020 19:05:36 -0700
Subject: NEW ORDER
Attachment: NEW PO N49876733_PDF.Z

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2a896a1572fd1bdd420a9686b4e98885b1308ade872b300303c4a638700854d/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 04:45:37 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kujnikxf7i33vbavfugwtuyrbnrgcfn5bzlgabqhrfghbyaqvgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f2a896a1572fd1bdd420a9686b4e98885b1308ade872b300303c4a638700854d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z f2a896a1572fd1bdd420a9686b4e98885b1308ade872b300303c4a638700854d

(this sample)

Formbook

Executable exe 2811e1f4aa210ac5b0a651add7c3b3a999d70203c06dad333cbe4b8a3b64d608

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2811e1f4aa210ac5b0a651add7c3b3a999d70203c06dad333cbe4b8a3b64d608
  
Dropping
Formbook

Comments