guloader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

guloader.exe
Size

40KB
MD5

8c7a8292c45058fe7514da3305ca4db9
SHA1

ddfb15ca40a71daee4e9b70333dda7a2dcddd6f4
SHA256

19294a8f3982807f6119e9720e8fde7c21fdc5c13be427f2c6fd130a7b532bec
SHA512

2ac232deedc1d2cdd63e31bef1d8cebffd8bbfb9dae412fafa2c4f7ae4667d940c8e2a590957c5dcd1dde661cedd6ecf0d81fab33bb30c78a5740c6df2b8f62e
SSDEEP

384:0kva/bC4jguLlgXwLdzk8kQEQMXy6U6yxAXEbfPB3QHTVCNZzh:0k748uLiXwLp4QVMJSxA0dQHTVKZz

Score

N/A

Malware Config

Signatures

Files

guloader.exe
.exe windows x86

304a8128a1957406316206e7fad43092

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CIcos
_adj_fptan
__vbaFreeVar
_adj_fdiv_m64
_adj_fprem1
__vbaStrCat
__vbaHresultCheckObj
_adj_fdiv_m32
_adj_fdiv_m16i
_adj_fdivr_m16i
ord703
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
ord535
__vbaI2Var
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
ord616
_CIatan
__vbaStrMove
__vbaI4Cy
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ