MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fa085719a6b5701dff065332e4fa698b8961acc2883e611576c178cf370eb5d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | fa085719a6b5701dff065332e4fa698b8961acc2883e611576c178cf370eb5d7 |
|---|---|
| SHA3-384 hash: | 78d652fd9b5348437e6ea763d3c26af43830658e19e81d1f367f640f5231d6206261755067136e29a238432a3e433ea5 |
| SHA1 hash: | 800b5266bb4b0c84e60b45aef239592ed6017f81 |
| MD5 hash: | 7ba591968fe72137459e109b02b72a2d |
| humanhash: | seven-indigo-fillet-hawaii |
| File name: | Safety Precautions Tips_PDF_.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 102'400 bytes |
| First seen: | 2020-04-02 15:18:16 UTC |
| Last seen: | 2020-04-02 15:48:35 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b37379ae97db3c0e0efbb6514561d99f (1 x GuLoader) |
| ssdeep | 768:+KNNclYNbcjL+amtoAvo+K7CAvS/6h0bGqjZId2NSA/oHcTD:+sNHcjL4tzoNmAQ6hGrjqpAV |
| Threatray | 673 similar samples on MalwareBazaar |
| TLSH | A5A3D312BE90FD50D4044AB19E7A8BEC466AFC30DD916E07BAC43F6E3EB1151B641B47 |
| Reporter |  abuse_ch |
| Tags: | COVID-19 exe GuLoader |
abuse_ch
COVID-19 themed malspam distributing GuLoader:HELO: highrollers.website
Sending IP: 173.254.251.92
From: Dr Peter D. Haytaian <belviewhospital@highrollers.website>
Subject: How to Stay safe Covid-19
Attachment: Safety Precautions Tips_PDF_.img (contains "Safety Precautions Tips_PDF_.exe")
GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1zmKBkfiG8ycIBu0LtRT6hD285RCFhzBq
Intelligence
File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-04-02 15:35:24 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 663 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| VB_API | Legacy Visual Basic API used | MSVBVM60.DLL::__vbaObjSetAddref MSVBVM60.DLL::EVENT_SINK_AddRef MSVBVM60.DLL::__vbaFileOpen |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.