MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81cce625083e6605ae26986b9c8b6aabbcbad243d7cc92c47b50e14aa950a075. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81cce625083e6605ae26986b9c8b6aabbcbad243d7cc92c47b50e14aa950a075
SHA3-384 hash: 7e48cda3b07f91ab9d11d6310e636cde81065ff20088eea43bde99bd7498996bd8d50600c3465df632172988d4ae660f
SHA1 hash: 5e3df7a9333087a2ccc2e150670004fcb9d44af4
MD5 hash: 3f929b07d5328dcdfbc8cf53ea9e5bbd
humanhash: tennessee-pasta-ten-paris
File name:Invoices.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:180'224 bytes
First seen:2020-04-20 11:28:25 UTC
Last seen:2020-04-20 12:45:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash dccaba7e3992c73da56132d3600803bd (1 x GuLoader)
ssdeep 1536:+u8k40nUBmu0DPPh+r4kBwhy63EYfSxcuWP687Kez+GiOz2xIcJhT+ALVsJ82gS7:lxYDnPhh54E6
Threatray 715 similar samples on MalwareBazaar
TLSH 3E04C6527E74E421C0100B702E6AC3AED350BDE5D9E8458F7190FB1FFE715A23AA169E
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.NetWire-7678915-0
Create hunting rule

Win.Dropper.NetWire-7683377-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-04-20 00:23:38 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qhgomjiihztallrgtbvzzc3kvo6lvusd27gjfrd3kdquvkkqub2q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
051101f45d03dac4583297cce0d708af562dedfa085b3d9dcfea40be2083e7ab
GuLoader
085723cd3bf42b5f4cba4d975389d6f088c22cc696f4f0771251a3a1afaedc53
GuLoader
473f6c38f3047708289a930f291a474052b160a9090bc6c2844f53b6226805ad
GuLoader
549d741341e63a5b461b0244c3ecb5377d8d8c95fa9a2bfe9bb096950b7993e2
GuLoader
712b5489228115a95c7718684ee0c1f80a352da3872fbfcbf74000c5306ba664
GuLoader
7ca90c14bd5ed0eed66f26051883a84eaa393bf51b1c1c877b2d98325342ef9f
GuLoader
89e7b3d326525ac681ac369108ceea6641ce74782bddd37528bfef6ae1b2a6bf
GuLoader
abc26a4dae06f9fa3a58be8ae001afa9b529384fd22814469cd4e7bc5b8c1255
GuLoader
c37ae1ed1bf166c96faa73db4544f415c2b81f0a42ccd5311e0aabc0b9e4f455
GuLoader
df34eee3a23ae66bb689bc1911e417cdaa7b51c353dc586bdb3280f86df09b55
GuLoader
+ 705 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaFileOpen

Comments