MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aada59d2334345770be8c2392e761b1f8361844ccd64852a0aac3b79ba7d88bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aada59d2334345770be8c2392e761b1f8361844ccd64852a0aac3b79ba7d88bf
SHA3-384 hash: 8370b4c95c01e4a8175f5a0a06424b17512a8b4816495fde1b841241b752f6f2d315c9b61bdeacec5ae3401bbdf34376
SHA1 hash: 75e850e63655625905fff143419976baa94045fb
MD5 hash: 20c72cc97e12ee46cc85b4ea4c49535c
humanhash: river-fillet-connecticut-berlin
File name:DOCUMENTS.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-01 13:31:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9009786593552811958a26984352d598 (1 x GuLoader)
ssdeep 768:D+f2a/q0CMHm1UoEGecjGpVa24OCn3mWmWBIHymdW6phPvr3uccEMu:Rqq0fG1B0HVaVQHymdW6p1O6
Threatray 114 similar samples on MalwareBazaar
TLSH 6293C8897ED9F1B3C0A44BF2272BC59009C57D7A3C679F03B38C762E9A39A81D514267
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 09:17:31 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vlnfturtincxoc7iyi4s45q3d6bwdbcmzvsikkqkvq5xtot5rc7q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0b2c23184d7575924ccd5208513a561aa8a98461b6d558aa9bd12c7d488ce430
GuLoader
3827270781e1757ffa4f6c953bba112cdd1afd673e26f639023bcaeb1cae94a0
GuLoader
57322806d9dc1437a2491cac599aa2df5028184e3deec9d9c45c6b4d003b0132
GuLoader
631a30f2f8d182709534c3ab4aa1d531df4147997258ab7c7f819ae51f3e5e2d
GuLoader
6b03cfee0a25254f46bb2c3138ece41f2c0255a70141e3f457389e07120a153c
GuLoader
9b2ad325e0cda26d0cd3769bea307050581d5c38d40d1281ff7e6b56420369cd
GuLoader
b74e722c4a7b85d49e9c25991528d742161a1ae76c860e001868b1918dc66222
GuLoader
b833d79953fe177a48a5832ce2606c41d00f0d5b9bd31ceb25d3055a3850c2f7
GuLoader
bcc7af2de70a30482b2b1b282579faf215fed0f5f9e9f9c060f81d720845df3c
GuLoader
c158b8ed8c9a0221bfeb3dea8d026d5bb9bade9ecfd19191ada59c51c8eb4089
GuLoader
+ 104 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaLateMemCallLd

Comments