MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce86a2218eff30dae2862d460329e65b67d6828acc82ad220ec584f419c30599. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: ce86a2218eff30dae2862d460329e65b67d6828acc82ad220ec584f419c30599
SHA1 hash: c7d29abc24e8221f931fd0b3e2a2cc17c816e69f
MD5 hash: afefddd28e50144b56fd566596cc82ef
File name:Billing_Statement-162315090.pdf exe
Download: download sample
Signature GuLoader
File size:102'400 bytes
First seen:2020-05-22 09:49:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 66c3dae82c4fd1cf683ea3026b0441a7
ssdeep 768:WzpVYS1RPbmIw/eTAcXlh9/VOfu5NJnrCDrb3YvUqJvNyOhB6IMM8crFxuryULi9:mpVYgJyIw6Ac1rcDrb3ef9og8QF2LI
TLSH EFA31836BAA4AC61C6548EF11D699B7815AFEC7569030F0B74CB7B2D1433A82F52138F
Reporter @abuse_ch
Tags:GuLoader pdf exe

Malspam distributing GuLoader:

Sending IP:
From: Total Credit Management Services Ltd. <>
Subject: Billing_Statement-162315070; 162315090
Attachment: Billing_Statement-162315070.rar (contains "Billing_Statement-162315090.pdf exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 23
Origin country FR FR
ClamAV No detection
VirusTotal:Virustotal results 39.44%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe ce86a2218eff30dae2862d460329e65b67d6828acc82ad220ec584f419c30599

(this sample)

Delivery method
Distributed via e-mail attachment