MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e92e8fd2f291f75954d7417f414bb08e8fd5b015773798ab9743426685dab322. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | e92e8fd2f291f75954d7417f414bb08e8fd5b015773798ab9743426685dab322 |
|---|---|
| SHA3-384 hash: | 4356a18713c73b7c939e645edb5b16c9efef3e9cd89dad927fe6e5b0d530db55bdaf13d96f88e668b0b567ac9215632c |
| SHA1 hash: | b14f5438a8b49825f10ebc2d74eab52b3718ad94 |
| MD5 hash: | 80c95782f462c61246a9558506811647 |
| humanhash: | grey-michigan-mirror-emma |
| File name: | Payment Advice - AdviceRefG20755400121.pdf.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 135'168 bytes |
| First seen: | 2020-05-12 16:29:08 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d2e471ceace505f8b878e47384cd80d6 (1 x GuLoader) |
| ssdeep | 3072:8TpTE549TLZYViRDe3523kML0tngPOZMGfK6hk9DeNwgqSb+9jWjMcJobb84HxF:K |
| Threatray | 136 similar samples on MalwareBazaar |
| TLSH | ABD3624BE220FB01C35414F17BA95AEA42ED9D3D6964C503E3D072AE6779B0AE532393 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader HSBC |
abuse_ch
Malspam distributing unidentified malware:HELO: host.sarmcol.com
Sending IP: 199.217.117.157
From: advising.service.56028822.518660.1539198682@mail.hsbcnet.hsbc.com
Reply-To: robles@ammeraalbeltechusa.info
Subject: Payment Advice - Advice Ref:[G20755400121] / ACH credits / Customer Ref:[HSBC/FT/006-B] / Second Party
Attachment: Payment Advice - Advice RefG20755400121.pdf.gz (contains "Payment Advice - Advice RefG20755400121.pdf.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-12 16:37:13 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 126 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.