MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8c3d7cd117d98d92e834d53374635acaf20a51a32888642eb621f5225bd9e29f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | 8c3d7cd117d98d92e834d53374635acaf20a51a32888642eb621f5225bd9e29f |
|---|---|
| SHA3-384 hash: | ac67e89b87732cfb38a1b669f26e590c4a4914aedf7f9806fc6de6b03c430cf312c6972f5174b977ba71d3bc6b0902fc |
| SHA1 hash: | 8c1683f4a73cfa191449067d52765c51790fd7aa |
| MD5 hash: | 1598864808b372c032b1777fd23aa154 |
| humanhash: | sodium-rugby-timing-salami |
| File name: | INTER-PIPE PURCHASE ORDER_02062020_pdf.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 77'824 bytes |
| First seen: | 2020-06-02 11:15:27 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1c17a9ab30689ec1858f6eea575eae0c (1 x GuLoader) |
| ssdeep | 768:l4hc7416N8lBR2zDRMgi/xhB6BJLaB0G3w+1T2eq0hNQ35Kdelelj3i:l4FO8lLENi/xhB6HeB0EJdhNQpKoeg |
| Threatray | 1'117 similar samples on MalwareBazaar |
| TLSH | 0B734B17AE088A22E6B042B11C77C7BD2F16BC0C4A861A4B395EAE57FF313719C5D61D |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: s1.smallhost.in
Sending IP: 103.46.239.70
From: KAMAL SHIPPING CO., LTD <contact@kamalcontainers.com>
Subject: INTER-PIPE PURCHASE ORDER NUMBER 06022020
Attachment: INTER-PIPE PURCHASE ORDER_02062020_pdf.arj (contains "INTER-PIPE PURCHASE ORDER_02062020_pdf.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1emdeFT0ppBWGwMGoh2tGfD7cpkKDTuPU
Intelligence
File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Occamy
Status:
Malicious
First seen:
2020-06-02 19:42:00 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 1'107 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.