MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d2f169c37561f240ad256ef7a43adb4d6e9d752f8d5f364ff294820c79edd313. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | d2f169c37561f240ad256ef7a43adb4d6e9d752f8d5f364ff294820c79edd313 |
|---|---|
| SHA3-384 hash: | 0b432532be620ca9ffe30f47fafe40db56b38fefb3d9ea8c96ceb3fa615238ade34ece43fec28a58539913c447bfdf9d |
| SHA1 hash: | 60b66a153d5cb47b125ac3c26fa61ddb44ac5fc4 |
| MD5 hash: | fb448e042d64304bd75b0a7eaa88d9c6 |
| humanhash: | dakota-bluebird-alanine-romeo |
| File name: | DHL-Shipment-Notification#766474849_feb.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 143'360 bytes |
| First seen: | 2021-02-22 07:30:30 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3f0d3842f1f621625b7b4016e6be4558 (2 x GuLoader) |
| ssdeep | 1536:fWWTwV4fVhu5+zCGdJL1wTbagPJR+PbqDRJlVuxVQwV4MjW:TwVUPLCGdZ1YmgzWbiRHVQqwV |
| Threatray | 1'678 similar samples on MalwareBazaar |
| TLSH | A9E317A2619AF897E05541335A1D9BF88D709D2B19307803739D3A1F2B39ACD57F03AB |
| Reporter |  abuse_ch |
| Tags: | DHL exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: mail.sayyess.uno
Sending IP: 62.108.35.214
From: DHL | Global | Express <admin@sayyess.uno>
Subject: DHL Express Shipment Notification #88377493
Attachment: DHL-Shipment-Notification766474849_feb.rar (contains "DHL-Shipment-Notification#766474849_feb.exe")
GuLoader payload URL:
https://waeorat-71.tk/admin/MuNwgeCO242.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Signature
Found potential dummy code loops (likely to delay analysis)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Detection(s):
Malicious file
Verdict:
unknown
Similar samples:
+ 1'668 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
d2f169c37561f240ad256ef7a43adb4d6e9d752f8d5f364ff294820c79edd313
MD5 hash:
fb448e042d64304bd75b0a7eaa88d9c6
SHA1 hash:
60b66a153d5cb47b125ac3c26fa61ddb44ac5fc4
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.