MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29c65d4ad00f4134b8f56f3b19a5880b1e81e24a037cb431efad92eda57d2b26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Maldoc score: 11


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29c65d4ad00f4134b8f56f3b19a5880b1e81e24a037cb431efad92eda57d2b26
SHA3-384 hash: 48d5be9e52729d39a7d8dca4e1852a4f2b5f6e13f68b6d8817615c60f7ae7c7f5d02b770436d24c3d14351111d417af4
SHA1 hash: 8ef1482add08bf82744a8b7cc75d598aa590b007
MD5 hash: ce0091a2b297798f9f7e4b686745beab
humanhash: gee-chicken-sodium-uranus
File name:trk38594634.xls
Download: download sample
Signature ZLoader
Create hunting rule
File size:41'984 bytes
First seen:2021-04-06 16:16:18 UTC
Last seen:2021-04-06 16:57:28 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 768:bKvk3hOdsylKlgxopeiBNhZFGzE+cL2kQAAfTPs+Sy6KKmybqL2zffb3GbT6KKCq:Sk3hOdsylKlgxopeiBNhZFGzE+cL2kQW
TLSH FA13CA72F281C925C54B873589D2DA972222BCD25A9AC2CF3398B33F1F71F855D0265E
Reporter abuse_ch
Tags:xls ZLoader

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 11
Application name is Microsoft Excel
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 14 sections in this file using oledump:

Section IDSection sizeSection name
1108 bytesCompObj
2244 bytesDocumentSummaryInformation
3220 bytesSummaryInformation
424724 bytesWorkbook
5414 bytes_VBA_PROJECT_CUR/PROJECT
662 bytes_VBA_PROJECT_CUR/PROJECTwm
7991 bytes_VBA_PROJECT_CUR/VBA/Sheet1
83330 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
92774 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
101665 bytes_VBA_PROJECT_CUR/VBA/__SRP_0
11246 bytes_VBA_PROJECT_CUR/VBA/__SRP_1
12929 bytes_VBA_PROJECT_CUR/VBA/__SRP_2
13318 bytes_VBA_PROJECT_CUR/VBA/__SRP_3
14515 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_ActivateRuns when the Excel Workbook is opened
SuspiciousShellMay run an executable file or a system command
SuspiciousShellExecuteMay run an executable file or a system command
SuspiciousCreateObjectMay create an OLE object
SuspiciousShell.ApplicationMay run an application (if combined with CreateObject)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Administrator Notification_ Redirecting email with malware.msg
Verdict:
Malicious activity
Analysis date:
2021-04-06 14:45:38 UTC
Tags:
maldoc-20 opendir
Link:
https://app.any.run/tasks/8ecc30ee-e0f5-4746-b3bb-a2002905b28c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.ms-excel
Has a screenshot:
False
Contains macros:
True
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/132695/
Detection(s):
TwinWave.EvilDoc.MiscreantsTurnBackTime.20210220.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
DNS request
Sending an HTTP GET request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Launching a process
Running batch commands
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/29c65d4ad00f4134b8f56f3b19a5880b1e81e24a037cb431efad92eda57d2b26/results/dashboard
Payload URLs
URL
File name
trevnoC.metsyS
WorkBook
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/29c65d4ad00f4134b8f56f3b19a5880b1e81e24a037cb431efad92eda57d2b26
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Shell.Application Object
Detected the instantiation of Shell Application object within the macro.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.expl
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/667799
Signature
Creates autostart registry keys with suspicious values (likely registry only malware)
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Machine Learning detection for sample
Performs DNS queries to domains with low reputation
Uses cmd line tools excessively to alter registry or file data
Very long command line found
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 382830 Sample: trk38594634.xls Startdate: 06/04/2021 Architecture: WINDOWS Score: 76 50 servr.killwhenabuse1.xyz 2->50 54 Very long command line found 2->54 56 Performs DNS queries to domains with low reputation 2->56 58 Machine Learning detection for sample 2->58 60 3 other signatures 2->60 10 EXCEL.EXE 12 8 2->10         started        13 wscript.exe 1 2->13         started        15 wscript.exe 1 2->15         started        signatures3 process4 signatures5 66 Very long command line found 10->66 17 powershell.exe 12 7 10->17         started        68 Wscript starts Powershell (via cmd or directly) 13->68 21 cmd.exe 13->21         started        24 powershell.exe 7 13->24         started        26 cmd.exe 15->26         started        28 powershell.exe 7 15->28         started        process6 dnsIp7 48 khmerosja.net 199.192.24.250, 49165, 49166, 49167 NAMECHEAP-NETUS United States 17->48 46 C:\Users\user\AppData\Roaming\notepads.js, ASCII 17->46 dropped 30 wscript.exe 1 17->30         started        62 Uses cmd line tools excessively to alter registry or file data 21->62 33 reg.exe 21->33         started        35 reg.exe 26->35         started        file8 signatures9 process10 signatures11 72 Wscript starts Powershell (via cmd or directly) 30->72 74 Very long command line found 30->74 37 cmd.exe 30->37         started        40 powershell.exe 7 30->40         started        process12 dnsIp13 64 Uses cmd line tools excessively to alter registry or file data 37->64 43 reg.exe 1 37->43         started        52 khmerosja.net 40->52 signatures14 process15 signatures16 70 Creates autostart registry keys with suspicious values (likely registry only malware) 43->70
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29c65d4ad00f4134b8f56f3b19a5880b1e81e24a037cb431efad92eda57d2b26/
Threat name:
Document-Office.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 16:17:04 UTC
AV detection:
1 of 48 (2.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fhdf2swqb5atjohvn45rtjmibmpidyskan6limppvwjo3jl5fmta._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro macro_on_action persistence xlm
Link:
https://tria.ge/reports/210406-1r2ma4crg2/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Adds Run key to start application
Blocklisted process makes network request
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/29c65d4ad00f4134b8f56f3b19a5880b1e81e24a037cb431efad92eda57d2b26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_ZLoader_xls_20210125
Create hunting rule
Author:abuse.ch
Description:Detects ZLoader XLS
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

Excel file xls 29c65d4ad00f4134b8f56f3b19a5880b1e81e24a037cb431efad92eda57d2b26

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/132695/

Comments