MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d
SHA1 hash: 405014bd6c9d7a699ec43a6cf67d29515cf5eb22
MD5 hash: 5c1b9662ca70e3bd79aa65262ffadcc7
File name:list.dwg.exe
Download: download sample
Signature GuLoader
File size:102'400 bytes
First seen:2020-05-22 09:59:06 UTC
Last seen:2020-05-22 10:51:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1002d92e14dc4d0e8a14b48cbd8a260a
ssdeep 768:h3wEF1JeO4Unkg4EPpojH8cqLJbFH8nU2w6EyZ4Hq53NFF0Urm0G3Fa:NvJeEkg4skXqLJRH2ZEyZ4O3Nzv
TLSH BDA30A31B5D0EC13CA65CDF26DAB4B75140BAC786D198A43A2CB7B2C29775C0A6353CB
Reporter @abuse_ch
Tags:exe geo GuLoader KOR


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm38.hanmail.net
Sending IP: 203.133.180.226
From: 오경호 <pop0403@daum.net>
Subject: 중국 수출용 NEW PROJECT -Purchase Order_200522-01 발주서 첨부 건
Attachment: NEW PROJECT - Purchase.img (contains "list.dwg.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1SrbSxlrT9xoe_w1ZAl6Molm77gnXfEXY

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 24
Origin country FR FR
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 8.33%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe f4e3a5c0dc83e93f54af3543efe40a1a984c4eb25be88b1259b685e06176461d

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments