MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69e3e7a0726435f1d48dc9d56db3a3759fb038b9c8b7506ce48e5efc5460d839. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 69e3e7a0726435f1d48dc9d56db3a3759fb038b9c8b7506ce48e5efc5460d839
SHA1 hash: f7f97cfb4aaf029efd2a1c3006ba7135d6b88326
MD5 hash: 136249853c8c2103b17e948c66168e35
File name:SHIPPING DOCUMENTS_PDF.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 15:04:12 UTC
Last seen:2020-05-22 15:48:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b248f6a6360434f12b4832a8033762f3
ssdeep 768:QqyHDegrrbGjL+jljhlhn9n/hoVGRxp+F5u/TOHVB13stbOqjy:hyjegrkL+j1h/n9y8O1PQyAy
TLSH FC933A32FAA4DC72CD244BF21D3A479410ABEE301E824A1778C63B9D35325CDA9B5797
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mail.nwiran.com
Sending IP: 185.94.98.43
From: NORMAN LOGISTICS LTD <info@kts-me.com>
Subject: Confirm change in Goods destination
Attachment: SHIPPING DOCUMENTS_PDF.arj (contains "SHIPPING DOCUMENTS_PDF.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=16pdtfZQsIuTKlvUWbPTFf7qt38rdyUVy

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 13.89%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 69e3e7a0726435f1d48dc9d56db3a3759fb038b9c8b7506ce48e5efc5460d839

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments