MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 559ac9a08e2263a036dc045b7ad9e9bba2b5115de42ab57d75e5e6bb168ceeb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 5
| SHA256 hash: | 559ac9a08e2263a036dc045b7ad9e9bba2b5115de42ab57d75e5e6bb168ceeb9 |
|---|---|
| SHA3-384 hash: | f2c30f3f1d2b9e4f6346f15b648569a8e1e23e024556b6712c8b65dedb3115f20bced69a2bff699b930ccbbc2d4dea7b |
| SHA1 hash: | 1fe5603ea7fcbb1d76a2a093b9bfa6a2204a4e1d |
| MD5 hash: | e5e13115542ea5441209a45a46e3d0b9 |
| humanhash: | sixteen-fillet-high-ack |
| File name: | PTOR000037520_PDF.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 77'824 bytes |
| First seen: | 2020-06-02 11:28:33 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c8e40cfeb26871555a8a91c6fc569218 (6 x GuLoader) |
| ssdeep | 1536:WFO8lLu0ALW70fIAPaNPBvOBd/7WXs/pTd0j:d00WpjxxOBdDnBTd0j |
| Threatray | 1'150 similar samples on MalwareBazaar |
| TLSH | AD734B07AE08CA21D57046701C5BC76E2F15BC4C4A861E8B759E7E57FB323B26C6E21D |
| Reporter |  abuse_ch |
| Tags: | DHL exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: vps.gibalto.es
Sending IP: 82.194.93.48
From: DHL EXPRESS <pt.ebilling@dhl.com>
Subject: Your last DHL Global Consolidated invoice: PTOR000037520
Attachment: PTOR000037520_PDF.gz (contains "PTOR000037520_PDF.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1PP8W-2FMMVl8nMnGTheJ7NEx3XFnvFAh
Intelligence
File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
XpertRAT
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-06-02 11:37:18 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 1'140 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.