MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8fc06ee3c19914cdb5576a9dd32a606096ea08a51eb323a5d443754be208d1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8fc06ee3c19914cdb5576a9dd32a606096ea08a51eb323a5d443754be208d1e
SHA3-384 hash: e416257938d29d38232f0ef6b24ad69485a62f8f401ef1a294605a8ade204a680f910b011855316b4ad11c12fc21cdd0
SHA1 hash: 4f04b2e2f863e6271a51845189caee8c9b9b37a4
MD5 hash: 1b777c3e1776eb86d6a5e838531859d6
humanhash: don-california-zulu-lemon
File name:AWB775678FGH456789HVC59-Shipment_INV_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:400'511 bytes
First seen:2020-11-12 16:38:53 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:4J2+xXY9XvI29ApYf8YvphZjAMjN+qCzOSC7Tj:dyCXA7pjYlzp+Vq7Tj
TLSH 9D842399A7F361A4F45DC83A4FB3FCA986420C1AB8CAD4496973D74C8C83FCB595E460
Reporter fabjer
Tags:archive

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8fc06ee3c19914cdb5576a9dd32a606096ea08a51eb323a5d443754be208d1e/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:18:15 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3d6an3r4dgiuzw2vo2u52mvgayew5iekkhvteos5iq3vjprarupa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz d8fc06ee3c19914cdb5576a9dd32a606096ea08a51eb323a5d443754be208d1e

(this sample)

Loki

Executable exe e85036337c7c8c9395bf5bd813cfda27f043c8e197cfb4509a947b240cf2506d

  
Dropping
SHA256 e85036337c7c8c9395bf5bd813cfda27f043c8e197cfb4509a947b240cf2506d
  
Delivery method
Distributed via e-mail attachment

Comments