MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f40467bb039025f6639a1a2cd3c57a016f91b420327cde4785297bcc7efb7f1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f40467bb039025f6639a1a2cd3c57a016f91b420327cde4785297bcc7efb7f1f
SHA3-384 hash: 1e1c8000e7b44429ed748466971c303dddb1bc336771c66b43de85a56695ae38db5378a64da478cd87f64e2b58c63798
SHA1 hash: 020d2d6722c8a8d7ffa0d0dc2b7336949a1f1480
MD5 hash: 98443d87f62d882d5f056968554b3060
humanhash: juliet-ohio-rugby-zebra
File name:do202120102_010010101001010.pdf.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:453'960 bytes
First seen:2021-02-21 18:13:57 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:G1JVD/xfxSNBCJ/z/qsyC0Mz93p7me/f413x57Q:UJVDvSilE6xB3o5DM
TLSH 1FA423B80E34567C9C8E81153AEA3BEF028EBA95B71311351BB5E1912437274BCD7E4B
Reporter abuse_ch
Tags:FormBook r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slybilgisayar.com
Sending IP: 213.142.132.183
From: Syed Imran Ali <depcoshj@emirates.net.ae>
Subject: New Inquiry
Attachment: do202120102_010010101001010.pdf.r00 (contains "do202120102_010010101001010.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-A.24721.25493.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f40467bb039025f6639a1a2cd3c57a016f91b420327cde4785297bcc7efb7f1f/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-21 18:14:09 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qcgpoydsas7my42diwnhrl2afxzdnbagj6n4r4fff54y7x3p4pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 f40467bb039025f6639a1a2cd3c57a016f91b420327cde4785297bcc7efb7f1f

(this sample)

Formbook

Executable exe 878780dd4a45cd2ac3266e865c987933f7f6539fe93f6bc6b314188b2e5d2a45

  
Dropping
MD5 c88a43469800fcd034790256cf9440c8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 878780dd4a45cd2ac3266e865c987933f7f6539fe93f6bc6b314188b2e5d2a45

Comments