MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce86a2218eff30dae2862d460329e65b67d6828acc82ad220ec584f419c30599. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: ce86a2218eff30dae2862d460329e65b67d6828acc82ad220ec584f419c30599
SHA1 hash: c7d29abc24e8221f931fd0b3e2a2cc17c816e69f
MD5 hash: afefddd28e50144b56fd566596cc82ef
File name:Billing_Statement-162315090.pdf exe
Download: download sample
Signature GuLoader
File size:102'400 bytes
First seen:2020-05-22 09:49:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 66c3dae82c4fd1cf683ea3026b0441a7
ssdeep 768:WzpVYS1RPbmIw/eTAcXlh9/VOfu5NJnrCDrb3YvUqJvNyOhB6IMM8crFxuryULi9:mpVYgJyIw6Ac1rcDrb3ef9og8QF2LI
TLSH EFA31836BAA4AC61C6548EF11D699B7815AFEC7569030F0B74CB7B2D1433A82F52138F
Reporter @abuse_ch
Tags:GuLoader pdf exe


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mxserver22-out4.masterweb.com
Sending IP: 103.25.223.204
From: Total Credit Management Services Ltd. <inquiry@totalcredit.hk>
Subject: Billing_Statement-162315070; 162315090
Attachment: Billing_Statement-162315070.rar (contains "Billing_Statement-162315090.pdf exe")

GuLoader payload URL:
https://qif.ac.ke/komi_yUyfmoyRdV90.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 23
Origin country FR FR
ClamAV No detection
VirusTotal:Virustotal results 39.44%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe ce86a2218eff30dae2862d460329e65b67d6828acc82ad220ec584f419c30599

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments