MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ba983c41c400c82c194778c9ca6798383b00c80bec7b85c9c8010dd667fdcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30ba983c41c400c82c194778c9ca6798383b00c80bec7b85c9c8010dd667fdcf
SHA3-384 hash: bfc7afbb0eeb217718b6a306896447e41f61c41c285eb5a0882a8beb8266d9bc0167f40bb2b620b94a1c32caa85dac95
SHA1 hash: 5f414e04d762d1a5e291598c15d1b75623e298bb
MD5 hash: a2d044ecbe9dfcf588cc1b8d5ec1bdcd
humanhash: india-winner-spring-missouri
File name:PO 001077 - CS#000310.xlsx
Download: download sample
Signature GuLoader
Create hunting rule
File size:61'115 bytes
First seen:2020-04-06 11:22:43 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 1536:NBAFZ0C26Jmegk6OkYIOmEqFjwhezfDcYdJyUSvk6QHc1lw:NyFZ096Jmeg7B97fXyUShQ8g
TLSH 4653F1D6DA7311ACEF78533510DC1B42438136C7431BC7B2BBA6599026CE3FA59AC589
Reporter cocaman
Tags:xlsx

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Malware.XML.Autoload-1.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EQAndMisCasedOleNativeWasTheCaseThatTheyGaveMe.20200215.UNOFFICIAL
Create hunting rule

Result
Threat name:
AveMaria
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/337902
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Document-Word.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 08:57:02 UTC
File Type:
Document
Extracted files:
15
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Excel file xlsx 30ba983c41c400c82c194778c9ca6798383b00c80bec7b85c9c8010dd667fdcf

(this sample)

AveMariaRAT

Executable exe 6998249e77f7c33821b3678fbdbc0a843ca39d80d49aa55335b48ef7c4011ad2

GuLoader

Executable exe 91dfd41acf3e4f461c8c0c5ffdad45e08e92c839dd4f4f233b3e0ff57efd5064

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91dfd41acf3e4f461c8c0c5ffdad45e08e92c839dd4f4f233b3e0ff57efd5064

Comments