MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 68db7504dc6689ddfa6f5ca341c824f1f34dea654ad653153be12b0dc2c768ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 16
| SHA256 hash: | 68db7504dc6689ddfa6f5ca341c824f1f34dea654ad653153be12b0dc2c768ab |
|---|---|
| SHA3-384 hash: | c83bbab0971499dcd4fd88301bb8d934840be6bcda2b6dad56c2edfd8923ef16bedcbb1f8ef4623131ead1dd1ff31cdc |
| SHA1 hash: | e55cb2ec2a4e8680666cf3015f8a06faee945843 |
| MD5 hash: | cd8333c58706deaef1368111f38f38ab |
| humanhash: | connecticut-early-venus-edward |
| File name: | Maersk Documents.pif |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 594'429 bytes |
| First seen: | 2026-03-09 06:52:34 UTC |
| Last seen: | 2026-03-09 07:31:31 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6e7f9a29f2c85394521a08b9f31f6275 (326 x GuLoader, 65 x AgentTesla, 63 x RemcosRAT) |
| ssdeep | 12288:4MwNPjD7QHvdzs2T0zXY6zdtgQ+jSxI2Gcnc5ebAnWJNbD9I:4MwJa1oa0zo6zdt9emQckSAWvbK |
| Threatray | 2'472 similar samples on MalwareBazaar |
| TLSH | T15AC4020537619C45D683D0309DA6AD6A9A99BC0CFCB49A733761BAFD3D35221F80F3A4 |
| TrID | 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | 6c6ad0d4d48e90e0 (3 x GuLoader) |
| Reporter |  lowmal3 |
| Tags: | exe GuLoader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
200
Origin country :
DEVendor Threat Intelligence
Malware configuration found for:
GuLoader
NSIS
Details
GuLoader
a c2 URL, a useragent string, and a string XOR key
GuLoader
an XOR decryption key and an extracted component
NSIS
extracted archive contents
Malware family:
n/a
ID:
1
File name:
Maersk Documents.pif
Verdict:
Malicious activity
Analysis date:
2026-03-09 06:54:38 UTC
Tags:
stealer netreactor purehvnc
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Malicious
Score:
95.7%
Tags:
injection virus nsis blic
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug blackhole guloader installer installer installer-heuristic masquerade microsoft_visual_cc nemesis nsis soft-404 unsafe
Verdict:
Malicious
Labled as:
Malware_52.2
Verdict:
Malicious
File Type:
exe x32
Detections:
Trojan.Makoob.HTTP.C&C PDM:Trojan.Win32.Generic Backdoor.Androm.HTTP.Download Trojan-Downloader.Win32.Minix.sb Trojan.Win32.Guloader.sb HEUR:Trojan-Downloader.Win32.Minix.gen
Malware family:
Unlabeled
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Score:
98%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.PUREHVNC
Threat name:
Win32.Trojan.Egairtigado
Status:
Malicious
First seen:
2026-03-09 06:53:37 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
15 of 24 (62.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
cloudeye
Similar samples:
+ 2'462 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
collection discovery spyware stealer
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
68db7504dc6689ddfa6f5ca341c824f1f34dea654ad653153be12b0dc2c768ab
MD5 hash:
cd8333c58706deaef1368111f38f38ab
SHA1 hash:
e55cb2ec2a4e8680666cf3015f8a06faee945843
SH256 hash:
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 hash:
6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 hash:
070ea80e2192abc42f358d47b276990b5fa285a9
SH256 hash:
c719697d5ced17d97bbc48662327339ccec7e03f6552aa1d5c248f6fa5f16324
MD5 hash:
ca5bb0ee2b698869c41c087c9854487c
SHA1 hash:
4a8abbb2544f1a9555e57a142a147dfeb40c4ca4
Malware family:
GuLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.99
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Detect_NSIS_Nullsoft_Installer |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects NSIS installers by .ndata section + NSIS header string |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.