MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 503f94f00304bc18900c3494f2da5bcb1d8a103a0b15ce00bbdaeb5dfd8d9b7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 503f94f00304bc18900c3494f2da5bcb1d8a103a0b15ce00bbdaeb5dfd8d9b7b |
|---|---|
| SHA3-384 hash: | ca89158297c792cf62693680e72af5fec13d57b2e5cdbdf9d622f5ddd193a7919f8d67e67af1fc3f79bec0ef7af55df4 |
| SHA1 hash: | fcbd6fa6d3cc0f753cfb1ee78ca0a550cbc819bc |
| MD5 hash: | 7ee17f20dc7ef645bb7867d9b1a4b432 |
| humanhash: | oscar-mars-july-five |
| File name: | makave1.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 77'824 bytes |
| First seen: | 2020-03-19 14:22:01 UTC |
| Last seen: | 2020-03-19 15:48:12 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 043742c3e7c65a220cdd0983416ab948 (1 x GuLoader) |
| ssdeep | 768:Ezjn8MHl9X8Kc9FkSyqN+VZJk6cvnqE8abRKBLq36Y5WogAZSYU24Tv9:Gj3L6GNqIDK6cx8FLqq7AZmN |
| Threatray | 905 similar samples on MalwareBazaar |
| TLSH | CE737C03F750F826C959CB3E6C0AD690311BBC741992DA8B36E47F1F6CF50A28E59B58 |
| Reporter |  abuse_ch |
| Tags: | COVID-19 exe GuLoader |
abuse_ch
COVID-19 malspam:HELO: megaform.com
Sending IP: 193.142.59.211
Subject: Breaking!!! COVID-19 Solution Announced by WHO At Last As a total control method is discovered.
Attachment: covid-19.img (makave1.exe)
Intelligence
File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-03-20 01:37:07 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 895 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
0659a9731d2ab35331689dd356156a8d
Dropped by
MD5 0659a9731d2ab35331689dd356156a8d
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| VB_API | Legacy Visual Basic API used | MSVBVM60.DLL::EVENT_SINK_AddRef |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.