MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faec6d6be94f707fb02a30319e22111b2c67cc67affefa858ee9eab1dfabe91b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: faec6d6be94f707fb02a30319e22111b2c67cc67affefa858ee9eab1dfabe91b
SHA3-384 hash: 9b3c1f9fb420c0e3f15de669c9804f6ad235535ada4b6750aa2e8ee23c0e377d4a0aaf688674d38d075336cb8a7a9c95
SHA1 hash: 153a607ee18100b3a908c695d5727e15933b9891
MD5 hash: a2ea23bf90cb7603b0c5212a1f3ee165
humanhash: river-crazy-solar-robert
File name:ORDER SPECIFICATIONS.pdf.jpg.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'310'720 bytes
First seen:2020-10-12 05:55:14 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:/Qy/WiEXDlyYC9r7dlgQ2Ukm5wycHtVKMcyUlsG4nc3b56lTXIa9Rxw3gL8LX:L0XsYYO9UkmIIInKyXz9
TLSH E05522E086900575FA355A36A134C621B7372DC56CF0EE2E71AC706B77FA1936092CAF
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: server.svetaine123.lt
Sending IP: 109.235.71.104
From: WURTH<commercial@wuerth.my>
Subject: ORDER ENQUIRY
Attachment: ORDER SPECIFICATIONS.pdf.jpg.img (contains "ORDER SPECIFICATIONS.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/faec6d6be94f707fb02a30319e22111b2c67cc67affefa858ee9eab1dfabe91b/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-12 00:59:43 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7lwg227jj5yh7mbkgayz4iqrdmwgptdhv77pvbmo5hvldx5l5enq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/faec6d6be94f707fb02a30319e22111b2c67cc67affefa858ee9eab1dfabe91b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img faec6d6be94f707fb02a30319e22111b2c67cc67affefa858ee9eab1dfabe91b

(this sample)

Formbook

Executable exe 914b9ec48f15df901f689ee02624b6b164a57ee6dc6383f7770e432f92faa337

  
Dropping
MD5 ac9716cdc33b246c2cd6220ffff22095
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 914b9ec48f15df901f689ee02624b6b164a57ee6dc6383f7770e432f92faa337

Comments