MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0e67a756fae287327df087026a90555ce7c261730aae3d95073164169e8e9d97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 0e67a756fae287327df087026a90555ce7c261730aae3d95073164169e8e9d97 |
|---|---|
| SHA3-384 hash: | 5aad6277a464339b715c28a42951de0a888befac54befe3827fca71f2fc4919e659e05f0f597f62df2d8b9863db1ba64 |
| SHA1 hash: | 008b341ed9b702a7fa95cf9d215b573393cb7667 |
| MD5 hash: | 1e73e1aa55106b523ecfcc268bb980c9 |
| humanhash: | double-xray-eight-hot |
| File name: | ENQUIRY-21703.PDF.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 86'016 bytes |
| First seen: | 2020-05-12 16:08:05 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 89bb4b7afaa479bbb09935f9c22223da (1 x GuLoader) |
| ssdeep | 768:aYFzL/jxDc92qx1kkrYHG9G59bVsNbR1pdyw+89jEvHzDwzsryE2Z:zDx701rrYm9G59onjNR9YvH7SZ |
| Threatray | 247 similar samples on MalwareBazaar |
| TLSH | 7F835B1DB464E5B3DB418DF16B6163A9050E7C3019C5CB07B4C2BB1E2AF6B52A921B2F |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: linux977.grserver.gr
Sending IP: 185.138.42.16
From: Gianluca Cardarelli <janet.awoseyin@nsiainsurance.com>
Subject: PO_NO.ENQUIRY-21703
Attachment: ENQUIRY-21703.PDF.arj (contains "ENQUIRY-21703.PDF.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-12 10:09:00 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 237 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.