MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7cf754ed7c5a766f7622660204ef84baefe244fea900ee17fd5c80610fe302e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 7cf754ed7c5a766f7622660204ef84baefe244fea900ee17fd5c80610fe302e9 |
|---|---|
| SHA3-384 hash: | 1f7d8e194506ce43700b8e83cc0eadbcb3fa118e6d78d1eb7bc48c40e416161ed1a03c023643f457eaaa793a6b24f208 |
| SHA1 hash: | 55097e061dafd75bf9e7813fb7e9c4c2ed141b97 |
| MD5 hash: | ec0609eca14b271cb6b11da6360a179f |
| humanhash: | august-uncle-uniform-five |
| File name: | Doc.kr.com |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 65'536 bytes |
| First seen: | 2020-05-13 10:13:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ab3af5e62d5ba14d98be7574ccf4d70d (2 x GuLoader, 1 x FormBook) |
| ssdeep | 768:shKJXYEdK7Nmso+dynmmk4IIH/JJH+WAgSdte+hXPy/wg:a8Imh+wiyHjbhSd0+hXPyo |
| Threatray | 5'111 similar samples on MalwareBazaar |
| TLSH | 8B53C71DEDD4DDBDD22DCBBCCAAA459881196D300DB6CEC3344835E92B33A76A316316 |
| Reporter |  abuse_ch |
| Tags: | com DHL GuLoader |
abuse_ch
Malspam distributing unidentified malware:HELO: [134.209.156.135]
Sending IP: 134.209.156.135
From: DHL Customer Support <support@dhl.com>
Reply-To: kens87914@gmail.com
Subject: DHL Shipment Notification
Attachment: Doc.kr.xz (contains "Doc.kr.com")
Intelligence
File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-13 10:36:47 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
20 of 31 (64.52%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 5'101 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.