MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f564e620c93af38cd1117d7e35e86c38ac7c4771de61a9d7acda64db8f80ba76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f564e620c93af38cd1117d7e35e86c38ac7c4771de61a9d7acda64db8f80ba76
SHA3-384 hash: 4aa96bcb1f7f8b72b5764a20f986e13e619cece060e33ae132fe66ee024dec33ca02dcd4c9bbb004272261a02b0a758c
SHA1 hash: 54eb00594ba85695ed5c24b18d4ba5c073a3ded8
MD5 hash: cc69029e732e945e5c7c0584963d5021
humanhash: tennessee-florida-coffee-artist
File name:Inquiry.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2022-10-31 10:11:09 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:SweEwTKu1gRtv6cWGqP+D5rElT0Cx6Yx74cNqVmWtqyiigLPsDC:tv6cxqP+dETEYxUcIVdLbgLEDC
TLSH T16445BF19D5445ED6D202B238E5FCFB1C46108FA6722EAB49F539BD027A727CF2426C8D
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "Marina Stavanovic <jay.hua@bestshepherd.com>" (likely spoofed)
Received: "from xszjhkqp.bestshepherd.com (xszjhkqp.bestshepherd.com [92.52.217.244]) "
Date: "28 Oct 2022 01:47:38 -0700"
Subject: "Contract Inquiry/Specs & Quantities"
Attachment: "Inquiry.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
320
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1731.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Siggen18.65215.25828.23749.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
context-iso overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/635f9f72ce1f43143c2a2aad/reports/d462abdf-7a7c-4044-8253-b80845e53b00/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f564e620c93af38cd1117d7e35e86c38ac7c4771de61a9d7acda64db8f80ba76/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2022-10-28 08:55:19 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 41 (43.90%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vsomigjhlzyzuirpv7dl2dmhcwhyr3r3zq2tv5m3jsnxd4axj3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.18
Link:
https://yomi.yoroi.company/submissions/f564e620c93af38cd1117d7e35e86c38ac7c4771de61a9d7acda64db8f80ba76

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img f564e620c93af38cd1117d7e35e86c38ac7c4771de61a9d7acda64db8f80ba76

(this sample)

Formbook

Executable exe 320f7bf0fe5297d7735fc088454b523107d87d011a332e0362da98df35b5d8c3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 320f7bf0fe5297d7735fc088454b523107d87d011a332e0362da98df35b5d8c3
  
Dropping
Formbook
  
Dropping
MD5 c505fbcaf1940fe5c01c43626f17c47a

Comments