MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84e985ab847a98edb2a6be51a3f62f1743c12a088b0f2e89ef4798c24aa775e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	84e985ab847a98edb2a6be51a3f62f1743c12a088b0f2e89ef4798c24aa775e8
SHA3-384 hash:	e991d152f293de87bee7a4bd6a96d71776c39f50cc967c45e60e320fe6070e3e20ccaaeb1d5676719d03281f86bd5ab2
SHA1 hash:	386d2c2abfb0ccfac7f68bc93edc2d24ccf259b1
MD5 hash:	8bf3ae491ecb060163884516e85700f9
humanhash:	six-music-march-mango
File name:	NOWE ZAMÓWIENIE-pdf.exe
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	302'408 bytes
First seen:	2022-12-06 10:09:16 UTC
Last seen:	2022-12-06 11:33:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	6e7f9a29f2c85394521a08b9f31f6275 (291 x GuLoader, 51 x VIPKeylogger, 48 x RemcosRAT)
ssdeep	6144:S3hqLEqbt8KIow53mFK8Gvfbqzoc+MM/UkKj:S3E8ow5ZvLxlUv
TLSH	T13C54E150FB508097D8A963713CBBCE3256B2AC6999E1920F33CE7A1ABD73741091F14B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b269e8cce8cce869 (1 x GuLoader)
Reporter	Anonymous
Tags:	exe GuLoader signed

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

188

Origin country :

PL

Vendor Threat Intelligence

ANY.RUN guloader

Malware family:

guloader

Alert

Create hunting rule

ID:

1

File name:

NOWE ZAMÓWIENIE-pdf.exe

Verdict:

Malicious activity

Analysis date:

2022-12-06 10:11:51 UTC

Tags:

guloader

Link:

https://app.any.run/tasks/946c0945-7729-4f01-902f-ead1d98d304a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/343350/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.SuspectCrc.16975.17071.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file

Creating a process from a recently created file

Launching a process

Sending an HTTP GET request

Sending a custom TCP request

Modifying a system file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

overlay packed remoteadmin shell32.dll

Link:

https://www.filescan.io/uploads/638f14fc0c6473d16719a642/reports/4b7ad8b3-9fdf-41a7-b04e-fae6cf30d52a/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/62e9bcfc-5f80-4446-bb47-396414c66129

Joe Sandbox AgentTesla, GuLoader

Result

Threat name:

AgentTesla, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1128790

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Obfuscated command line found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic

Suspicious powershell command line found

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Yara detected AgentTesla

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/84e985ab847a98edb2a6be51a3f62f1743c12a088b0f2e89ef4798c24aa775e8/

ReversingLabs TitaniumCloud Win32.Trojan.AgentTesla

Threat name:

Win32.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-12-06 06:55:13 UTC

File Type:

PE (Exe)

Extracted files:

5

AV detection:

18 of 26 (69.23%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qtuylk4epkmo3mvgxzi2h5rpc5b4ckqirmhs5cppi6mmesvhoxua._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery

Link:

https://tria.ge/reports/221206-l7c8zsbe3z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Checks installed software on the system

UnpacMe

Unpacked files

SH256 hash:

84e985ab847a98edb2a6be51a3f62f1743c12a088b0f2e89ef4798c24aa775e8

MD5 hash:

8bf3ae491ecb060163884516e85700f9

SHA1 hash:

386d2c2abfb0ccfac7f68bc93edc2d24ccf259b1

Link:

https://www.unpac.me/results/7f41ae7c-5195-4158-8de0-23753a4f3802/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.74

Link:

https://yomi.yoroi.company/submissions/84e985ab847a98edb2a6be51a3f62f1743c12a088b0f2e89ef4798c24aa775e8

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/343350/