GuLoader Malware Obfuscation Techniques Analyzed

This report provides a technical analysis of GuLoader, detailing its polymorphic constant construction, multiple exception-based control-flow obfuscation techniques (software breakpoints, single-step, access violation, illegal/privileged instruction handlers), dynamic DJB2-based hashing, encrypted string handling (static and stack-based), payload decryption using large XOR keys with cloud-hosted payloads, and accompanying IDA scripts developed by ThreatLabz to aid deobfuscation and analysis.