MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f33e53b450e553b15b609a3223ecaaf4f13fae392b88b2fae27a62c25be34519. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f33e53b450e553b15b609a3223ecaaf4f13fae392b88b2fae27a62c25be34519
SHA3-384 hash: abf6c590b233a832057bf30cf8b9db89c261ff191d59c98070071c317d243570fe333cf7116c8d82052b89f6764788f7
SHA1 hash: bc32d539217b6ffb07ee02766601b4822471405f
MD5 hash: 4b064f9bda46d4dcfffd9ab1faa751f0
humanhash: louisiana-alanine-potato-tennis
File name:PO99430.doc.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:367'839 bytes
First seen:2020-08-13 10:09:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:6llhg6m+KXCx1FnhxctwzSLTUex0xu+/XKpOhoMDGhWMF4K+POQ3haepPiGBXC:6hJKszhMGuIXKpOhoKGs20L3N68C
TLSH 4874231C0257566D3AA0C6791B61AEEA43828776CAD780EEEF0264FF44177B40275FD8
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.sanrentas.com
Sending IP: 104.168.236.22
From: import and export department <info@sanrentas.com>
Reply-To: import and export department <info@sanrentas.com>
Subject: order PO#99430
Attachment: PO99430.doc.rar (contains "PO#99430.doc.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27215.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f33e53b450e553b15b609a3223ecaaf4f13fae392b88b2fae27a62c25be34519/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 10:11:07 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6m7fhncq4vj3cw3atizch3fk6tyt7lrzfoelf6xcpjrmew7diumq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f33e53b450e553b15b609a3223ecaaf4f13fae392b88b2fae27a62c25be34519

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar f33e53b450e553b15b609a3223ecaaf4f13fae392b88b2fae27a62c25be34519

(this sample)

Formbook

Executable exe 3d8ff1b4492a541b44c03733b090c73fd992535d8c4e867abc0e6aeaf5b58b30

  
Dropping
MD5 b5fe57b1a664e5cbc76ea0fe617a7810
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d8ff1b4492a541b44c03733b090c73fd992535d8c4e867abc0e6aeaf5b58b30

Comments