guloader | 7920878337664465adb0254c8135d74c8337cc0a77e6e2aa05c893e76c7f2fb6

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 18:16

Target
f8813d632dfd45f8e903eb6282b732cd_JaffaCakes118.exe
Size 116KB
Sample240418-wwf6lsbb44
SHA256 7920878337664465adb0254c8135d74c8337cc0a77e6e2aa05c893e76c7f2fb6
MD5 f8813d632dfd45f8e903eb6282b732cd
SHA1 b194ee53ef9a10636d46f9567d47b052f448bd77
SHA512 a473fa6322822391439c036e28a5b4b46e72d055d1fe0c7a3e000afc8865a83b5ac21585eb16b5e0ed6ce48c7880d2debb3d4699bfcb0100231ef5e45af22291
SSDEEP 3072:jn9pppppppupppppppppppfppppppppppAppppppppFpppppppppYpppppp3pppq:hpppppppupppppppppppfppppppppppW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1376	f8813d632dfd45f8e903eb6282b732cd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f8813d632dfd45f8e903eb6282b732cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8813d632dfd45f8e903eb6282b732cd_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1376

memory/1376-2-0x0000000002BE0000-0x0000000002BF5000-memory.dmp

Download