MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31d48172ce3208d1f0853b776da6c8bf6b3aae4dd1d518a54269b8ea6ca3043d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31d48172ce3208d1f0853b776da6c8bf6b3aae4dd1d518a54269b8ea6ca3043d
SHA3-384 hash: a342646ab6a393d18d0d93fb8b62a70495fe75847e274c88ff700bc8384ac18d0c432544178891456e51fd91619e6e71
SHA1 hash: a0df7e30b950ba05abb16a2e6e179fee84e6b2cf
MD5 hash: 6bea09999c2c8251b51d2d89b04482c9
humanhash: diet-maryland-asparagus-mobile
File name:order_barcode_1405621_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:200'695 bytes
First seen:2020-11-09 16:02:10 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 3072:qUlFlambHlEvk8ixp50UtI3clbtitgpk4pGUWjP9NYVE4Ts+OXYOOBunPdNqRq:qiwMHlEvkfn56cdk4o1iVXQJYO6uPSU
TLSH 6A14239471759933AD3043901FBA6A6BF651F85C79032DC114EAB3A0BB6B3ABE5F0580
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.devbox12.com
Sending IP: 162.249.2.44
From: comenzi_furnizori@emag.ro
Subject: [Supplier Order] [forecast] [Initiated] eMAG Order # 1405621 Inbox
Attachment: order_barcode_1405621_pdf.gz (contains "order_barcode_1405621_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31d48172ce3208d1f0853b776da6c8bf6b3aae4dd1d518a54269b8ea6ca3043d/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-11-09 11:36:42 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ghkic4wogiend4efhn3w3jwix5vtvlsn2hkrrjkcng4ou3fdaq6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/31d48172ce3208d1f0853b776da6c8bf6b3aae4dd1d518a54269b8ea6ca3043d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 31d48172ce3208d1f0853b776da6c8bf6b3aae4dd1d518a54269b8ea6ca3043d

(this sample)

Loki

Executable exe 3a080bd2bc175ba929ce56ebeb07c3603d63a968eca9d74e8ad76a66e59988a1

  
Dropping
MD5 3e33e962f695cf6f045278fe708619bb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a080bd2bc175ba929ce56ebeb07c3603d63a968eca9d74e8ad76a66e59988a1

Comments