MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fa2fb5810ad3f0a2d181e54790ef5f49babaeef9be0ffe41505b5125f4c65935. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 6
| SHA256 hash: | fa2fb5810ad3f0a2d181e54790ef5f49babaeef9be0ffe41505b5125f4c65935 |
|---|---|
| SHA3-384 hash: | d6967b903285f89087452fcceef0de8bfb231e46b7908e9bb04125e7179be0cf8c16a6825ba4edd0c613ac183794c21a |
| SHA1 hash: | 9282c0a968ba37dadaa64575ae805782a50a191b |
| MD5 hash: | 21bdd02dfbeb4c0055f45c53afbf7eb4 |
| humanhash: | jig-nine-bluebird-carolina |
| File name: | Inv.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 347'432 bytes |
| First seen: | 2020-07-22 09:38:37 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 52f231b9dc70d434298609cc4e7563c2 (4 x Formbook) |
| ssdeep | 6144:hcwoGdFE2av7MysbTXJpix1fI4w+jlRtqdedXn9x1sHQUG+:hcJie2av7PAXJUf7lft+e59xqwUG |
| Threatray | 3 similar samples on MalwareBazaar |
| TLSH | 2D74F0437988CCB0D0A3267E8879EB528D7FFD52A576812376D8335DBEB22804976353 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook geo TUR ZiraatBank |
abuse_ch
Malspam distributing Formbook:HELO: server.sgbcg.com
Sending IP: 113.11.251.241
From: ZIRAAT BANKASI <ziraat@ileti.ziraatbank.com.tr>
Reply-To: ziraat@ileti.ziraatbank.com.tr
Subject: Re: 22.07.2020 Dönemi MEVDUAT Ekstre Bilgileri
Attachment: 22.07.2020 Dönemi MEVDUAT Ekstre Bilgileri.img (contains "Inv.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a custom TCP request
Creating a window
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Behaviour
Behavior Graph:
Detection:
formbook
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2020-07-22 09:40:10 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.