MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 11de084924b529df84b9c2c04845a186f10c8a0475e34f6eb379d949f35756fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 11de084924b529df84b9c2c04845a186f10c8a0475e34f6eb379d949f35756fe |
|---|---|
| SHA3-384 hash: | 93e23f5f698ab85bd13d8b0123abc414b54e295fe38d5c46f8a99d5918a3d9fbc0a097855140b51cec626de3262b78e9 |
| SHA1 hash: | cf15b094b55c3d26db0eb7421c7965f654d5aeec |
| MD5 hash: | 7c153693b7ab4dd7f06aa7ef38c5d6b2 |
| humanhash: | utah-beryllium-shade-green |
| File name: | PO LIST AND CUSTOMER CONTACT DETAILS_pdf.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 135'168 bytes |
| First seen: | 2020-05-12 16:30:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3e18bc95d74783d071881498552ca15c (1 x GuLoader) |
| ssdeep | 3072:85BDdcxIHa9r2AyaIo7qrFE/aekMMwIrRsJuSfWlamhs/hxzsMayxiqZedQc/ERq:85BDd |
| Threatray | 658 similar samples on MalwareBazaar |
| TLSH | CAD37447F260FB16C31110F177A916EA86EC9D38A9A4C553E7C072EE67B9B05E432393 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing unidentified malware:HELO: server1.arsari.co.id
Sending IP: 43.252.137.130
From: BOVIET SOLAR TECHNOLOGY CO., LTD. <marketing@boviet.com>
Subject: RECENT BUSINESS DEVELOPMENT:PO_TSY 3519,7422,7341 // EUROPE SUPPLY
Attachment: PO LIST AND CUSTOMER CONTACT DETAILS_pdf.rar (contains "PO LIST AND CUSTOMER CONTACT DETAILS_pdf.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-12 16:36:44 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 648 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.