MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4b5846ab10b6ac87f6f176bcb8a3f76a720628fd8b1aa9d7c1f603192f67bd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: c4b5846ab10b6ac87f6f176bcb8a3f76a720628fd8b1aa9d7c1f603192f67bd0
SHA1 hash: 27e3ef432eab3b6aa22ef74555efc7e9f1b0ff42
MD5 hash: 438e1a6a0b443e233277a1f575374241
File name:Billing_Statement-162315070.xlsx.exe
Download: download sample
Signature GuLoader
File size:102'400 bytes
First seen:2020-05-22 09:49:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1837609478fe760f0f96cbd6700d17c0
ssdeep 768:EAQaxii1OqmZJl0NFM3sVmweCaAQN9Uncw+fUoxnHaw30NvpJ+aGDZ1jks:vow8ZJlg1ep3HMxo1Hz30N6aKZt
TLSH 78A32B3178E0EC51EA5485F2AE674779192BBCB015468A47F3C77F2C29326D2E86334B
Reporter @abuse_ch
Tags:exe GuLoader

Malspam distributing GuLoader:

Sending IP:
From: Total Credit Management Services Ltd. <>
Subject: Billing_Statement-162315070; 162315090
Attachment: Billing_Statement-162315070.rar (contains "Billing_Statement-162315070.xlsx.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 23
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
VirusTotal:Virustotal results 32.86%
ReversingLabs :No data

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe c4b5846ab10b6ac87f6f176bcb8a3f76a720628fd8b1aa9d7c1f603192f67bd0

(this sample)

Delivery method
Distributed via e-mail attachment