MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52d9132242c3eb71c38d9f1703fb3a62b559432b76ae9a68ca203526ab222819. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	52d9132242c3eb71c38d9f1703fb3a62b559432b76ae9a68ca203526ab222819
SHA3-384 hash:	933f9ae94c759b3b39721e26feb71479b743d11f08654898298f3cc39645c1181e91fc9f72db59ed2414b3891b2324a6
SHA1 hash:	f40189e18c2c7b2fdb2562de0ec5f048af6ed715
MD5 hash:	2d13b27364f587fcd18c7b0efb36deb2
humanhash:	october-iowa-pennsylvania-failed
File name:	Halkbank.pdf.exe
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	331'338 bytes
First seen:	2023-07-10 12:17:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e2a592076b17ef8bfb48b7e03965a3fc (386 x GuLoader, 59 x RemcosRAT, 43 x VIPKeylogger)
ssdeep	6144:qhgqhwXoAoVHX2B5lb5mxtKfIcCfK8AbN7vecuH7vTWpP4+O:pqvVHX8l1mxZc9j70d+O
Threatray	913 similar samples on MalwareBazaar
TLSH	T10764AD2B6B3A9921FE7C6031F5D795B36B384CB25528B42232D0FE13287757B690E18D
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	ccf4d4dcdedee9b1 (4 x GuLoader)
Reporter	abuse_ch
Tags:	exe geo GuLoader Halkbank TUR

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

290

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Halkbank.pdf.exe

Verdict:

Malicious activity

Analysis date:

2023-07-10 12:29:36 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/836e1724-0304-4b17-ab6c-c4a112c0bec4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Guloader

Detection:

Guloader

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/413571/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Jaik.154612.1749.19558.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a file

Delayed reading of the file

Creating a file in the %temp% subdirectories

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/96937/overview

Behaviour

MalwareBazaar

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/64abf6fc2333b198b23a091b/reports/00a803d9-4553-4ba1-8522-ccfbd9d78f6b/overview

Hybrid Analysis Jaik.Generic

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/52d9132242c3eb71c38d9f1703fb3a62b559432b76ae9a68ca203526ab222819

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7ccf478a-df31-42bf-8b64-e48660e90f37

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1269724

Signature

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/52d9132242c3eb71c38d9f1703fb3a62b559432b76ae9a68ca203526ab222819/

ReversingLabs TitaniumCloud Win32.Trojan.Guloader

Threat name:

Win32.Trojan.Guloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-10 08:00:44 UTC

File Type:

PE (Exe)

Extracted files:

7

AV detection:

23 of 38 (60.53%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=klmrgiscypvxdq4nt4lqh6z2mk2vsqzlo2xju2gkea2snkzcfamq._file

Threatray cloudeye

Verdict:

malicious

Label(s):

cloudeye

Alert

Create hunting rule

Similar samples:

499f3776e1adb365489d0797796c5acf9c4b16bf69a2f14c5fce2bbaa8896aef

GuLoader

4d6ae0a40fcc30fab170c3e70dd5076253ddf9fa6ec0886d39cffbd9df99ae52

GuLoader

4f836a2654cceccebabea728ed2d43426153053660a7fbdab3c86b8cd28ef31d

GuLoader

830399d0bb2b6696dcf818f38342f9fda9243105a7a29621d72c4351dd717773

GuLoader

8731774a17b8d40b743f7fd6ff83d45ca5890f8e1371be8a0755186f2fc3cda0

GuLoader

b028ced984ab94ba551b890e2b55645509a1bfd4f2970b592ada728de261a379

GuLoader

c1e64e86dd89a5820bbb518ead2176741f91d3bf5c579e154533d44e816c1f76

GuLoader

dd2da125c47646d0bdc47095f374272d0e81af7a0aa4fb726004a9b8e09a2a6f

GuLoader

e4b6f95557a2356d046da60a1ca4e52d302618108fae774b8128ffc0586366e0

GuLoader

+ 903 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/230710-pgln8aba81/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks installed software on the system

Checks QEMU agent file

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

MD5 hash:

0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1 hash:

10c51496d37cecd0e8a503a5a9bb2329d9b38116

Link:

https://www.unpac.me/results/dfab8d43-aa51-4315-a408-bb2feca5f5ef/

SH256 hash:

52d9132242c3eb71c38d9f1703fb3a62b559432b76ae9a68ca203526ab222819

MD5 hash:

2d13b27364f587fcd18c7b0efb36deb2

SHA1 hash:

f40189e18c2c7b2fdb2562de0ec5f048af6ed715

Link:

https://www.unpac.me/results/dfab8d43-aa51-4315-a408-bb2feca5f5ef/

VMRay GuLoader

Malware family:

GuLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/52d9132242c3/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/413571/