MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cf5a86737ab13ec2ea858e0d7c635c3a3c79d1deda05e79a81dd1b470dcb0942. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | cf5a86737ab13ec2ea858e0d7c635c3a3c79d1deda05e79a81dd1b470dcb0942 |
|---|---|
| SHA3-384 hash: | 748cb830452498ed7e955104276f2cc5fbc57fede81207b1e6d220570a893d7ec8170f2497f6cd7a9da6a85392270613 |
| SHA1 hash: | d21c694dd285157d9dda0e8abdcedada5594a068 |
| MD5 hash: | 785dd0e1472e6f0dc6f78c9e98f55671 |
| humanhash: | grey-muppet-uranus-mississippi |
| File name: | PLanilla de Facturacion Mensual 2020.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 114'688 bytes |
| First seen: | 2020-05-26 13:45:34 UTC |
| Last seen: | 2020-05-26 15:24:31 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0c33c5b6c23258752d6300239a539326 (1 x GuLoader) |
| ssdeep | 768:Pw3KucK9IS6v3GyVJQ+NbT7l9CLNCf9FH1l3Hv4Vi2a3AHAS:a+K9OWlop98wvHrHvuY6 |
| Threatray | 5'119 similar samples on MalwareBazaar |
| TLSH | 30B3181B34D14C72FC7C9BF658F195640D66AC003E0E4B2FB508FE6C297768A68A4B97 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: mail.strongmailvault.com
Sending IP: 111.90.144.220
From: Bárbara Pavez <bpavvez@alternattiva.cl>
Subject: PLANILLA DE FACTURACION HASTA ABRIL 2020
Attachment: PLanilla de Facturacion Mensual 2020.img (contains "PLanilla de Facturacion Mensual 2020.exe")
GuLoader payload URL:
http://kuroilersuganda.com/bin_OCtwVXZv132.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-26 14:36:06 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'109 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.#Formbook
https://capesandbox.com/analysis/4937/