MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6f2ddb3eb2696dc88121f6cad6fce9c0b023d4aa1f8a31e912c7577b2e08e32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: d6f2ddb3eb2696dc88121f6cad6fce9c0b023d4aa1f8a31e912c7577b2e08e32
SHA1 hash: 56c9e77edbc6e0c59fca9ab1bec6a3b6b53515b9
MD5 hash: 1948787e848758aad4f5712626724c50
File name:Shipping advice.exe
Download: download sample
Signature GuLoader
File size:90'112 bytes
First seen:2020-05-22 09:55:07 UTC
Last seen:2020-05-22 10:52:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 60a96472cca422bab9aaa742e0402861
ssdeep 768:fSE/ccRzIR13ON2RaaK2agDbRwm4jp5DSXLZTJAF2UpttAah:KEbIr3O/z+b2m0pFSBUtA4
TLSH 90933C11B850DC66D9684EF76E39CED215AB7CB01E144B1B38C83B7C7A33942A92176F
Reporter @abuse_ch
Tags:exe GuLoader

Malspam distributing GuLoader:

Sending IP:
From: Seon Won <>
Subject: Fw: Shipping advice
Attachment: Shipping (contains "Shipping advice.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country FR FR
VirusTotal:Virustotal results 24.66%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe d6f2ddb3eb2696dc88121f6cad6fce9c0b023d4aa1f8a31e912c7577b2e08e32

(this sample)

Delivery method
Distributed via e-mail attachment