MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1fc7c7bbff5e20c961978c33ad1502afb86703bf950afb2c8658a0ea43798c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: c1fc7c7bbff5e20c961978c33ad1502afb86703bf950afb2c8658a0ea43798c8
SHA1 hash: d24340147d3f21976ac0579f393945149813dc83
MD5 hash: cd10cc348e76fd337dddfc765c837259
File name:DOC_761892_pdf.exe
Download: download sample
Signature GuLoader
File size:90'112 bytes
First seen:2020-05-22 10:21:04 UTC
Last seen:2020-05-22 10:52:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a53117862ae63bc105f05b726f2ca67f
ssdeep 768:rJu2Ae92zjwYq656VrfzIjpYLlh6y/Xvnf3Cu0MEcUsJhZxpBTz+WOme2zLDbTri:VnAe0HQm6VrfIpulKr9
TLSH FD933B21B7A8DDF2CF151EF14EF8C9D8146BFC709A544A0F78853B2D3E329909A22716
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: host12.axxesslocal.co.za
Sending IP: 154.0.160.107
From: lbakkes@rabdos.co.za
Subject: Gentle Reminder
Attachment: DOC_761892_pdf.arj (contains "DOC_761892_pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1k89Uk6Z_HBTDGT505YN0bMpPWsQHTtx1

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country FR FR
ClamAV SecuriteInfo.com.Variant.Ursu.878098.22545.29434.UNOFFICIAL
VirusTotal:Virustotal results 34.72%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe c1fc7c7bbff5e20c961978c33ad1502afb86703bf950afb2c8658a0ea43798c8

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments