MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a269358089c5d4852d4c43ce63745226d1b889620be5937125184569a379999. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 3a269358089c5d4852d4c43ce63745226d1b889620be5937125184569a379999
SHA1 hash: cbd364b1550b597863573285a040d65654e10de2
MD5 hash: da26b25f2d6ef4aaddb565815bdada96
File name:dowód bankowy.pdf.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 15:03:21 UTC
Last seen:2020-05-22 15:48:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 19b6b530142d1067449f05305a2ee9b8
ssdeep 768:sznN2vd9EqWJfd++aRwKme8vrgOUn/9xTXXDWtJZ1BcRZ8DHyjnwrVXR:UnN2vdWFd+ieGrgOUDT2BzKwrH
TLSH 55931822F190DEA2C8284FF10D76A6A85867FC3C59188B4770CE3F1E653294DD63939B
Reporter @abuse_ch
Tags:exe geo GuLoader POL


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: techdata.pl
Sending IP: 209.58.149.73
From: Graczyk, Daria <Daria.Graczyk@techdata.pl>
Subject: Fw: DOWÓD FAKTUR PŁATNOŚCI
Attachment: dowd bankowy.pdf.gz (contains "dowód bankowy.pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1dsmROHC1JlAbWrI367jfmsm1WsShvxAX

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 27
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 18.06%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 3a269358089c5d4852d4c43ce63745226d1b889620be5937125184569a379999

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments