MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 aadd8812bdbbe483d3635c581c7671d3b73a69cad0ea6f90dbd5617bbb298f14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 6
| SHA256 hash: | aadd8812bdbbe483d3635c581c7671d3b73a69cad0ea6f90dbd5617bbb298f14 |
|---|---|
| SHA3-384 hash: | 342490e1fd0db7997a3a607f483f3eac77b4d1d632644d8fb8a6f80e7b1fe07d37e5c21c47c5e4ca535ed11bcb3f05c9 |
| SHA1 hash: | 5e4d035c40f6d35eed903adf6bf20e271c4e1919 |
| MD5 hash: | 5cf75552d077ce4ed73aa8b258e4f6de |
| humanhash: | mirror-london-venus-butter |
| File name: | QUOTATION#89234A_2021_LISTED_Shipment_0022404ITEMS_DUC_PHUCS_IMPORT_EXPORT_CO.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 81'920 bytes |
| First seen: | 2021-01-14 06:55:35 UTC |
| Last seen: | 2021-01-14 08:53:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f08e2fa188bfdb85d74117a6c20b7544 (14 x GuLoader) |
| ssdeep | 768:Cw/kgg2N2+bkPl5QlRxhf9SLuUPoyVZQW1brj383:CwcggsvbkmRxp9S9wyVZQW1vj3Q |
| Threatray | 4'709 similar samples on MalwareBazaar |
| TLSH | 0F83A5ACF766DCB2E74E443299083798C6C292A3E2569539F409AEB4CF737440D5836F |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: vm1752843.nvme.had.yt
Sending IP: 185.244.219.92
From: Traân troïng (Sales Dept) <sales.phatdt58@gmail.com>
Subject: REQUEST FOR QUOTATION (RFQ#38787-A)
Attachment: QUOTATIONRFQ89234A_2021_LISTED_Shipment_0022404ITEMS_DUC_PHUCS_IMPORT_EXPORT_CO.arj (contains "QUOTATION#89234A_2021_LISTED_Shipment_0022404ITEMS_DUC_PHUCS_IMPORT_EXPORT_CO.exe")
GuLoader payload URL:
https://onedrive.live.com/download?cid=A951308400164DD4&resid=A951308400164DD4%21109&authkey=ANqaiU2I-EAdxcs
Intelligence
File Origin
# of uploads :
2
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
QUOTATION#89234A_2021_LISTED_Shipment_0022404ITEMS_DUC_PHUCS_IMPORT_EXPORT_CO.exe
Verdict:
No threats detected
Analysis date:
2021-01-14 07:04:15 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
Found potential dummy code loops (likely to delay analysis)
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Midie
Status:
Malicious
First seen:
2021-01-14 01:46:59 UTC
AV detection:
8 of 28 (28.57%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
unknown
Similar samples:
+ 4'699 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
aadd8812bdbbe483d3635c581c7671d3b73a69cad0ea6f90dbd5617bbb298f14
MD5 hash:
5cf75552d077ce4ed73aa8b258e4f6de
SHA1 hash:
5e4d035c40f6d35eed903adf6bf20e271c4e1919
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.