MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e5885f71c6fb1a072681d448a1baf5c8206887e79cb7900e0eb4246efa27011f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 7
| SHA256 hash: | e5885f71c6fb1a072681d448a1baf5c8206887e79cb7900e0eb4246efa27011f |
|---|---|
| SHA3-384 hash: | ae97350ddd788dfa7f96fe0a11a459b35f76faaaf8a1d8d6cd47cf09cf1047c9895f7c230fdd0e88a45d6a82cf451e7b |
| SHA1 hash: | 114f45a9a546e3001fb42eeb03c1375b0a296789 |
| MD5 hash: | 672d03ea2a5d52eaaac669ed0295d321 |
| humanhash: | india-butter-nitrogen-diet |
| File name: | NEW EXPORT COPY DOCUMENT_IMG_JPEG_EXW_32765100214532116_JUNE 2021.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 270'336 bytes |
| First seen: | 2021-06-14 22:30:27 UTC |
| Last seen: | 2021-06-14 23:40:53 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | adaafa2c180eccb7addf1201d12c8322 (4 x GuLoader) |
| ssdeep | 3072:a9JmDjJ7Mb+bnPdCJJ8G3j5AZP59+aNHH8JkZLEji7/XfhI52o4:GJm1CJJRj5AP/+aN8mLIO/6 |
| Threatray | 59 similar samples on MalwareBazaar |
| TLSH | 0C44B843B2477626D1A89C7026ABD12A77FB2D77F21048033AC1BF2767349A77DB0916 |
| Reporter | Anonymous |
| Tags: | exe GuLoader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NEW EXPORT COPY DOCUMENT_IMG_JPEG_EXW_32765100214532116_JUNE 2021.exe
Verdict:
No threats detected
Analysis date:
2021-06-14 22:33:51 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Executable has a suspicious name (potential lure to open the executable)
Found potential dummy code loops (likely to delay analysis)
Initial sample is a PE file and has a suspicious name
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2021-06-14 03:55:00 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
5/5
Verdict:
malicious
Label(s):
cloudeye
Similar samples:
+ 49 additional samples on MalwareBazaar
Result
Malware family:
guloader
Score:
10/10
Tags:
family:guloader downloader
Behaviour
Suspicious use of SetWindowsHookEx
Guloader,Cloudeye
Malware Config
C2 Extraction:
https://onedrive.live.com/download?cid=BAC03012EC7BD279&resid=BAC03012EC7BD279%21112&authkey=AA4jGf_o12jxHp8
Unpacked files
SH256 hash:
e5885f71c6fb1a072681d448a1baf5c8206887e79cb7900e0eb4246efa27011f
MD5 hash:
672d03ea2a5d52eaaac669ed0295d321
SHA1 hash:
114f45a9a546e3001fb42eeb03c1375b0a296789
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Distributed via e-mail link
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.