MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fdfbb4301ae00013d942b73533ac1563cb90f2df9d8bf35956a777d2114bf9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fdfbb4301ae00013d942b73533ac1563cb90f2df9d8bf35956a777d2114bf9c
SHA3-384 hash: 933e3f9640ba9792d4d456f8b417a33fb0a3b4ae2e57499c67fbd33fb87e30f622f6f2ee3cf972346f6da7f74165491c
SHA1 hash: c96d2d7911ffd77a1b7427d91c68db9e38afa371
MD5 hash: 315dcb6c85a6042a4ae5c1eb9867c129
humanhash: apart-avocado-aspen-twenty
File name:DOC (1).exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:81'920 bytes
First seen:2020-04-27 19:14:36 UTC
Last seen:2020-04-27 20:07:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 395b9826f6ab370edcbe38c091cf7f2c (1 x GuLoader)
ssdeep 768:Ga71k8j7cPPdAznx0oAlRruLJnNB+J7bL8:DCNPPdArxHeyNB+G
Threatray 187 similar samples on MalwareBazaar
TLSH 27831A2A77D0D879C15945F01FB196B641AAFD305E408A0336883F2FBD3DEAA6520B57
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33734730.14669.30058.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 20:03:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r7p3wqybvyaacpmufnzvgowbky6lsdzn7hml6nmvnj3x2iiux6oa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
4765d8704e79566062d7e9908cc8d01f12c2fd9b3cd2a73bffd197ac63ee8191
GuLoader
56af437f8b3b60b32b7cba77fa159138a777a48e98ce0215e8ec6f97ef12b223
GuLoader
66a2bf82afdb19daffd125afa2f94c6801fefd75b7759c10e2c0f8aec62fb795
GuLoader
6f2d3e1ae0ac968d44b8b5c0248734c6162a069904661dd9a19000342597d5ad
GuLoader
7a5a7df0ebb60c50c5e62e44eb2985ac7a34b935b33a1118581c3d9202444eae
GuLoader
7eb35bd5acf41463c83df3ba2a3b7bc251192a730c02b1c8bbf0bebf5bb923da
GuLoader
93379d7c4b130e722ae0e0a1ff1ac06d40fd7343ca1436bdfcc487a28a7a9e8f
GuLoader
af20d149797962d651171269a6518a23ab0dd4486adf9e4e05d090a8b9077279
GuLoader
c4b0a3d1567c5603f9c01835027081ece17b36f870282e6ff4aaecba57944461
GuLoader
d4d2c82cdc75f723e08d6139593a5a651e75e74b885acf480fe41c239d99e548
GuLoader
+ 177 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaLateMemCallLd

Comments