guloader | jaffacakes118_Trojan-Spy[.]Win32[.]Noon[.]nup[.]2db6b84287c463467260ae2966182c69

General

Target
jaffacakes118_Trojan-Spy.Win32.Noon.nup.2db6b84287c463467260ae2966182c69
Size 648KB
Sample261012-lsbfvabc62
SHA256 ba8ee5a8557b509e2a07a97c836fd1194830341f80ec7469b91cf95881aaa0e4
MD5 2db6b84287c463467260ae2966182c69
SHA1 a5df7c9bb18b529f30a5f362229e227e570cef97
SHA512 31feb134e427a48e35a1b1741d2cdf44fdda4a58935e1ad9adc4dcbba33bc2380ee90d261ced555a357e061e5477d99ec803ecfe5d589312057ee54fec812b06
SSDEEP 6144:M56Qk2wc1XHysHxvZQxzvm/O1ou3oYwOOIehmnfoelgc3rMr:MkQdRHyAkzhou3oJ3IeEf13o
TLSH
T148E48E36CAC7A434C6B0A9B11C354BBA27AEB9F32517EF01578D8C772D3120296F5A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.Noon.nup.2db6b84287c463467260ae2966182c69

jaffacakes118_Trojan-Spy.Win32.Noon.nup.2db6b84287c463467260ae2966182c69

.exe 648KB

IMPHASH e74c1994c5f8d3f1fefd1328ae2829e1
SHA256 ba8ee5a8557b509e2a07a97c836fd1194830341f80ec7469b91cf95881aaa0e4
MD5 2db6b84287c463467260ae2966182c69
SHA1 a5df7c9bb18b529f30a5f362229e227e570cef97
SHA512 31feb134e427a48e35a1b1741d2cdf44fdda4a58935e1ad9adc4dcbba33bc2380ee90d261ced555a357e061e5477d99ec803ecfe5d589312057ee54fec812b06
SSDEEP 6144:M56Qk2wc1XHysHxvZQxzvm/O1ou3oYwOOIehmnfoelgc3rMr:MkQdRHyAkzhou3oJ3IeEf13o
TLSH
T148E48E36CAC7A434C6B0A9B11C354BBA27AEB9F32517EF01578D8C772D3120296F5A53
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5308

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths