MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1d4cf3aea3811e50188b9420eae68de18006627f4dd86719459d99ad41d49291. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 1d4cf3aea3811e50188b9420eae68de18006627f4dd86719459d99ad41d49291 |
|---|---|
| SHA3-384 hash: | 1952b196ee046323dcbd6bf7ff72997479de5ed57c41cef44405e246cf00ddc146981e3ef9778208b5b14923c7c4c6ab |
| SHA1 hash: | 7c0381e6d33dda470af8e46643320170d804803f |
| MD5 hash: | 72a520cbabe7b364eb0a64573442773c |
| humanhash: | hydrogen-five-kentucky-lion |
| File name: | Order CVD-7104618_pdf.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 167'936 bytes |
| First seen: | 2020-06-04 17:21:40 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5e4d32787be169e941f5f3e2702d4d0f (1 x GuLoader) |
| ssdeep | 1536:LM8DrdLtwkVc0qTAowDwvU2ESTrHsSNr06QQDWuAmD:LxrdhDVpqTCEwST3C+6mD |
| Threatray | 1'941 similar samples on MalwareBazaar |
| TLSH | ACF3091BB90DC78EE2048AB1F97251F40A79AF1BE4416D2FFAC0FE1DB4B024D24955E9 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: fastmail.com
Sending IP: 172.241.27.139
From: Nancy Anderson <dannysanders222@fastmail.com>
Reply-To: dannysanders222@fastmail.com
Subject: Order Receipt CVD-7104618
Attachment: Order CVD-7104618_pdf.img (contains "Order CVD-7104618_pdf.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1SRYKGO5xpgYZAxKdiSGlMnssBLKY3VcQ
Intelligence
File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Gathering data
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-06-04 17:36:04 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 1'931 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.