MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 893ef71a58da9c450161aa56fddb97cd0e9c377f94a55e1d71a42569ee085de3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 893ef71a58da9c450161aa56fddb97cd0e9c377f94a55e1d71a42569ee085de3
SHA1 hash: 55e6eb2373bba84a5ccf785c58b293b880b1d7a4
MD5 hash: bbef2e61308d0e0b15af08fc65852ce6
File name:VGM-SONAE-33714657_PDF.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 10:33:15 UTC
Last seen:2020-05-22 11:46:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash eb6e8e5a2d6e9895a10b341184c10112
ssdeep 768:8tDn4d/OquneYLztQai3dKcwJ7T6x8V5Z7Xt7Y8Lsigljsj7:ynAV8z23dKxTP/DR7
TLSH 289328A2B1E9DC27DA340FB11D328A981667FE725E504A0738D73F1EB533519A932317
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: pkz49-4-spamexpert2.hoster.kz
Sending IP: 185.113.132.47
From: Triman Group <b.beisembaeva@shanyrak-group.kz>
Subject: BUNKER ESTIMATE - MV SEA HORSE 22TH MAY.2020
Attachment: VGM-SONAE-33714657_ZIP.arj (contains "VGM-SONAE-33714657_PDF.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1rmBwfDK7lb6oqzUMm62NnzIS3CDh_9RT

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 28
Origin country FR FR
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 16.44%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 893ef71a58da9c450161aa56fddb97cd0e9c377f94a55e1d71a42569ee085de3

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments