When we sum up the entire architecture of Guloader, we observe several stages and key features: 1) The malware initially come wrapped with a VB layer 2) After the VB part ends, the entire malware activity is executed by a shellcode. 5) The second shellcode downloads further malware