MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d
SHA1 hash: 405014bd6c9d7a699ec43a6cf67d29515cf5eb22
MD5 hash: 5c1b9662ca70e3bd79aa65262ffadcc7
File name:list.dwg.exe
Download: download sample
Signature GuLoader
File size:102'400 bytes
First seen:2020-05-22 09:59:06 UTC
Last seen:2020-05-22 10:51:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1002d92e14dc4d0e8a14b48cbd8a260a
ssdeep 768:h3wEF1JeO4Unkg4EPpojH8cqLJbFH8nU2w6EyZ4Hq53NFF0Urm0G3Fa:NvJeEkg4skXqLJRH2ZEyZ4O3Nzv
TLSH BDA30A31B5D0EC13CA65CDF26DAB4B75140BAC786D198A43A2CB7B2C29775C0A6353CB
Reporter @abuse_ch
Tags:exe geo GuLoader KOR

Malspam distributing GuLoader:

Sending IP:
From: 오경호 <>
Subject: 중국 수출용 NEW PROJECT -Purchase Order_200522-01 발주서 첨부 건
Attachment: NEW PROJECT - Purchase.img (contains "list.dwg.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 24
Origin country FR FR
ClamAV PUA.Win.Packer.ProtectSharewar-2
VirusTotal:Virustotal results 8.33%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d

(this sample)

Delivery method
Distributed via e-mail attachment