🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075
SHA3-384 hash: 92003441453cae2e2f3f4a5951af03a907e25e79cb1ddadd14580bbe659f5bd056ba9e05fd8fd40cf1f09813670f3c50
SHA1 hash: 6c5f445cb8a9bd4f612c61cbbb0cca79c4253826
MD5 hash: be6e2feb5fc79e3322fce7edb44351e7
humanhash: red-gee-florida-finch
File name:Orden de compra-65678768.pdf9875679876798766.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:117'760 bytes
First seen:2025-10-21 11:34:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 46ce5c12b293febbeb513b196aa7f843 (47 x GuLoader, 21 x RemcosRAT, 15 x AgentTesla)
ssdeep 768:xtFX46WhQH9mfcnUjrwLPp6Zvzx2eMoWrotE4j9icGsuBqWLAT+waxqz7PO0DXOT:xrX4tpfcUjrwLxZYE8ksuBzdoZSRTj5
TLSH T1BCB35B103A96C53BEE572934AE3261799ABBEE200DD7531773527F4C1FB3A499E0A103
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 00f8c4c4c4c8e000 (1 x GuLoader)
Reporter abuse_ch
Tags:de-pumped exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Orden de compra-65678768.pdf9875679876798766.exe
Verdict:
No threats detected
Analysis date:
2025-10-21 11:36:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f8d10341-4c8d-49b0-a7ae-a1292beb0bdf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33622/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f77013ad6ce0f5ad404d06
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer microsoft_visual_cc nsis
Link:
https://www.filescan.io/uploads/68f7700afd2d7e012f4bdf79/reports/74a5f8c5-3bce-430f-8b28-f3fb83df4e20/overview
Verdict:
Malicious
Labled as:
Trojan/GuLoader
Link:
https://www.hybrid-analysis.com/sample/0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075
Verdict:
Clean
File Type:
exe x32
Link:
https://opentip.kaspersky.com/0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075/results?tab=lookup
Malware family:
WinEdt Team
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/305cb5f5-1051-4c83-9e06-f8cd92a6cbe9
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
24 / 100
Link:
https://www.joesandbox.com/analysis/1799051
Signature
Initial sample is a PE file and has a suspicious name
Behaviour
Behavior Graph:
Download SVG
Score:
67%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bng7bml3nmeko7rni657casykzktdtt56te7ivht5bcb2tp7yb2q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/251021-np26hahv2g/
Behaviour
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075
MD5 hash:
be6e2feb5fc79e3322fce7edb44351e7
SHA1 hash:
6c5f445cb8a9bd4f612c61cbbb0cca79c4253826
Link:
https://www.unpac.me/results/fc5c7ff9-aad3-45d5-84eb-ab5d93741327/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 43f6f999b13f232d86d059735e43d9ac2cdded3be9ec36a5aeb27f655e008c68

GuLoader

Executable exe 0b4df0b17b6b08a77e2d47bbf10258565531ce7df4c9f454f3e8441d4dffc075

(this sample)

  
Dropped by
MD5 452c4a89c86069b52af745cf971f3ea7
  
Dropped by
SHA256 43f6f999b13f232d86d059735e43d9ac2cdded3be9ec36a5aeb27f655e008c68
Cape
Cape
https://www.capesandbox.com/analysis/33622/

Comments