MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 5 Yara Comments

SHA256 hash: 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5
SHA1 hash: a836744570a3f8d7dcf248e17d3ea55092f0958c
MD5 hash: 302a7400cd2dffe963934ff724fafeae
File name:order 52242020.arj
Download: download sample
Signature GuLoader
File size:24'039 bytes
First seen:2020-05-22 10:25:01 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 384:vrDEIO4iIACgKF3Y860Ez6heJ3FczWGtnkTs5PUHn4JN40PMDneFeviC:jDEqjpEBJnLgtUYf4GMDneFQ
TLSH 3AB2E1E0E1097D722868802F68BFE685BC6F2198BBC54D3885F1785625D9D283B73B84
Reporter @abuse_ch
Tags:arj GuLoader

Malspam distributing GuLoader:

Sending IP:
From: Evangelos Fasilis <>
Subject: Re:New Order
Attachment: order 52242020.arj (contains "order 52242020.pdf.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 22
Origin country FR FR
ClamAV No detection
VirusTotal:Virustotal results 14.75%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



arj 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5

(this sample)

Delivery method
Distributed via e-mail attachment