MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4515c333f7395af0cbe0c374d8f51cabf9566006860500ed0f223eff497e76d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4515c333f7395af0cbe0c374d8f51cabf9566006860500ed0f223eff497e76d4
SHA3-384 hash: b02467bb9b861b92131b925021b91cc4931be097c9c23e9842153606bdb191b218d2191c8e139e931af43f2fbfe1de1f
SHA1 hash: a30d21ed985093cf00e9e692134cceaf6466bf84
MD5 hash: 5b38d0e1999c4894c08a4e5d785cf9ff
humanhash: shade-apart-oregon-lima
File name:Doc726362738283738 PDF.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-06-05 18:52:26 UTC
Last seen:2020-06-05 19:51:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 102c662bfe1ab6281665795aeb35f744 (1 x GuLoader)
ssdeep 3072:qrdhrEBuZjlWPrDtsSVgPut2P7ZMyXrzwdoYEJG7x:qXwrDgMyXrzwnEJG7
Threatray 817 similar samples on MalwareBazaar
TLSH 48B3941BA969BC6DD1C93DF0BC25A49703163C14AB48A6BE51D4FBBCB630AE27C11707
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CLOUD.8214.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 11:57:30 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iuk4gm7xhfnpbs7ayn2nr5i4vp4vmyagqycqb3ipei7p6sl6o3ka._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0494c6b3493335509d5fdce6d9592d796e592fee648f42dded58ddc29e3565a1
GuLoader
17653f0b95df006bc5833a71a7cedaf0210ab2dd9c913104576b4823c8f7cdfd
GuLoader
1acf4f64dbce46e70553494cf02959634528477066cc736e3f49df3bb6253923
GuLoader
229d8d98a701a24e93b4e374092a5ce767fb859ffbc243cea9c1486b871dd4fb
GuLoader
6604738347de31acf8c045750f89e3f8e1bf57e29007dbc0fd7e21fb4d7e9aa3
GuLoader
6f06cf7295e9301a4358854569f7d53dcf77319a94a76b45e60ebc72b88c2087
GuLoader
765500e5e5af3c7320a36073ad19d4ba4bd15a21a5c65e2ed61eabfc428244c7
GuLoader
7acf7bc635e79515685759c8b4673d69245730d1e77dac430e093d7869e06e11
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
b8565239fc984ae11a613ad6a80eebcf3e006125c8e6240583a0365669c32397
GuLoader
+ 807 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-3mwh98vlea/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

cb7feac301c48a645d42438584ab23706f7e3a9f4999f3378fb751384c9af1e2

GuLoader

Executable exe 4515c333f7395af0cbe0c374d8f51cabf9566006860500ed0f223eff497e76d4

(this sample)

  
Dropped by
MD5 1362072b7cfe46182bbe4f99634a953a
  
Dropped by
SHA256 cb7feac301c48a645d42438584ab23706f7e3a9f4999f3378fb751384c9af1e2
  
Delivery method
Distributed via e-mail attachment

Comments