MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4b0a3d1567c5603f9c01835027081ece17b36f870282e6ff4aaecba57944461. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4b0a3d1567c5603f9c01835027081ece17b36f870282e6ff4aaecba57944461
SHA3-384 hash: fd8a036b5a4253cba48de72c76fe214ad2dbaca8d362d85e9e8dadbcbeeae8d21739fd5ec501d791e58d5f75d0d96dbc
SHA1 hash: 3c0ae378c9da240b885c546acf23a945d3c29f1f
MD5 hash: bd401a0b909315c8fe200041040e36dd
humanhash: lima-asparagus-fourteen-video
File name:Quotaiton JJ-MPS-200417-1.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:81'920 bytes
First seen:2020-04-28 05:25:15 UTC
Last seen:2020-04-28 05:59:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 67cfd9f6a93cc449d8cc2c7acc6f0631 (1 x GuLoader)
ssdeep 768:mgi2szR20/NbNbkqEOs5zuJoX++Gpl6ruHvE50MazwDbOqRv/sl:m92o5RN+ciG4zmbwbzal
Threatray 147 similar samples on MalwareBazaar
TLSH FD833B41B268EC36D43649F39B22D6B59077BD304C83CD0336857B2EAE71D91EA90787
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.37058.5060.19140.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 23:54:01 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ysykhukwprlah6oada2qe4eb5tqxwnxyoauc437uvlwluv4uirqq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
28d5385136c2bb70ae04b2e7f2e7ddfb8d28307e6a9624040c9c10320cbe2a67
GuLoader
453dacb9349991ae41f06e03837a54f188f0c60869b2bd6c187a46629d4bbd55
GuLoader
4765d8704e79566062d7e9908cc8d01f12c2fd9b3cd2a73bffd197ac63ee8191
GuLoader
66a2bf82afdb19daffd125afa2f94c6801fefd75b7759c10e2c0f8aec62fb795
GuLoader
7a5a7df0ebb60c50c5e62e44eb2985ac7a34b935b33a1118581c3d9202444eae
GuLoader
7eb35bd5acf41463c83df3ba2a3b7bc251192a730c02b1c8bbf0bebf5bb923da
GuLoader
8fdfbb4301ae00013d942b73533ac1563cb90f2df9d8bf35956a777d2114bf9c
GuLoader
93379d7c4b130e722ae0e0a1ff1ac06d40fd7343ca1436bdfcc487a28a7a9e8f
GuLoader
af20d149797962d651171269a6518a23ab0dd4486adf9e4e05d090a8b9077279
GuLoader
d4d2c82cdc75f723e08d6139593a5a651e75e74b885acf480fe41c239d99e548
GuLoader
+ 137 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaLateMemCallLd

Comments