MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1bbb7a110f15909ed9997e96ecb3f5322fb50eacc9b63670f7897ebfb62d8f91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 1bbb7a110f15909ed9997e96ecb3f5322fb50eacc9b63670f7897ebfb62d8f91 |
|---|---|
| SHA3-384 hash: | c1076218f586d54044d2952eda997b65b63a05c96737a846eaa6725eaadc80d7dd7ef67fb530f2f24333fcafaaa4f474 |
| SHA1 hash: | 3bf41969d7f3f3771c5513e35b9a2d3539e2e622 |
| MD5 hash: | a9a633957222953cb7423eadfdd19725 |
| humanhash: | three-december-alabama-edward |
| File name: | DHL Shipping Documents_jpg.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 90'112 bytes |
| First seen: | 2020-08-10 12:49:43 UTC |
| Last seen: | 2020-08-10 14:03:38 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 377ea45d19398a548366f08b9df6f024 (1 x GuLoader) |
| ssdeep | 768:EUg0AnJabZdJ9mFpvtBN43//jjwgQwhCVdX+CBdcot+0:a1nojm3u3//jjM7VdX+C7cot+ |
| Threatray | 43 similar samples on MalwareBazaar |
| TLSH | 3C934B42A589FA32F218CAB51D3916F784BEBC3469834E4B38487F1B3672E17D45631B |
| Reporter |  abuse_ch |
| Tags: | DHL exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: mta0.bosum-mould.com
Sending IP: 104.168.220.7
From: DHL EXPRESS <info@bosum-mould.com>
Reply-To: paulas@sigrnfg.com
Subject: Original Shipping Documents Commercial Invoice ,B/L
Attachment: DHL Shipping Documents_jpg.rar (contains "DHL Shipping Documents_jpg.exe")
GuLoader payload URL:
https://onedrive.live.com/download?cid=8E778D4A23C91A07&resid=8E778D4A23C91A07%21254&authkey=AMd_OEsUIxZ4dRE
Intelligence
File Origin
# of uploads :
2
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
GuLoader
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Signature
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Tries to detect virtualization through RDTSC time measurements
Yara detected GuLoader
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-08-10 12:51:09 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 33 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.