MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85da31a80a4d9abbb63b08026620b12410c1865fdc8399c283af3bbfbddfd4f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: 85da31a80a4d9abbb63b08026620b12410c1865fdc8399c283af3bbfbddfd4f6
SHA1 hash: e6f6408c7b75c0434569375b4893f98eab1167e9
MD5 hash: f415bb90f50b609f1d477e066b6b8d93
File name:Invoice DFC-6546735_pdf.exe
Download: download sample
Signature GuLoader
File size:180'224 bytes
First seen:2020-05-23 11:50:08 UTC
Last seen:2020-05-23 13:13:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 89dc71b70aaaba08e2e4c1a7b5ac83ed
ssdeep 768:An+UZv8p31bkgk5wLuk+BKW+lsmThZ71jaCtNhwI/3ziPcHmFDWuwhXLZay:q+s6bkgowLu+W+lsmThzaQ33DQDWuAYy
TLSH 5D04832BB50DCBADE7148EB2F57042F0157AAF6BE895192BF9C5FE2C347114C26012E6
Reporter @abuse_ch
Tags:exe GuLoader

Malspam distributing GuLoader:

Sending IP:
From: Andrea Perry <>
Subject: Re:Overdue Invoice DFC-6546735
Attachment: Invoice DFC-6546735_pdf.img (contains "Invoice DFC-6546735_pdf.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country US US
VirusTotal:Virustotal results 34.25%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 85da31a80a4d9abbb63b08026620b12410c1865fdc8399c283af3bbfbddfd4f6

(this sample)

Delivery method
Distributed via e-mail attachment