MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06cc817eb5655934e2929b69d1e89da641fe99c90fdd613b6c7245cdac50ef47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: 06cc817eb5655934e2929b69d1e89da641fe99c90fdd613b6c7245cdac50ef47
SHA1 hash: 606669b5c536d19e0f51255eb45dcea5517251f8
MD5 hash: 9480967ae73950b7aaee723cc802d4ad
File name:Letter of Conformity.pdf.z
Download: download sample
Signature Loki
File size:291'343 bytes
First seen:2020-05-22 13:43:06 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:c1eXsAcDxj4Vk3MFKwBKQnUaNKlffDdjdtzgPabNz7tfYUGUMfqEpaV:co1MxvMFnVyfxhxRbNpZGUMfq3V
TLSH 4C542305EE09F46A700218DC3E71BB4FAA9A0F6DAF319BE316F0E909B4DD7107D44A65
Reporter @abuse_ch
Tags:Loki z

Malspam distributing Loki:

Sending IP:
From: Stefan Knorsch <>
Subject: INQUIRY FOR Nitril and Latex Gloves & KN95/FFP2 Face mask.
Attachment: Letter of Conformity.pdf.z (contains "Letter of Conformity.pdf.exe")


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 24
Origin country US US
ClamAV No detection
VirusTotal:Virustotal results 35.48%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



z 06cc817eb5655934e2929b69d1e89da641fe99c90fdd613b6c7245cdac50ef47

(this sample)

Delivery method
Distributed via e-mail attachment