MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3df16653affd5ddd6a27c4b9a4e92aa3e4b87fc61b4332b7c9675ba1cfc8a70f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 15


Maldoc score: 4


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3df16653affd5ddd6a27c4b9a4e92aa3e4b87fc61b4332b7c9675ba1cfc8a70f
SHA3-384 hash: 44fe87822ae517c84c50df2a869dbd0c1f5cc4a78f377826776d42c5cc87623c983b8386f9a5aec79d6ab56740e50673
SHA1 hash: 97e7c1949993ce9246baf1bb5c9d4f34020435f4
MD5 hash: c3dc8fb22795f4efb58e63c8f2110561
humanhash: comet-white-east-xray
File name:#20240627_Edlen_B.xls
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:314'880 bytes
First seen:2024-05-28 07:05:22 UTC
Last seen:2024-05-28 07:24:33 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 6144:q0W8ZkNBZGbxdEKPdQEUD5rvPGW+Z0a42hULbREiMg:FW8qNnSdEkO9rvPB8jKZ
TLSH T12F64130A32C09123CC9A58785EFDE3C69B72FD528F15E25B78E0B79D8D326415B9306E
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:Smoke Loader xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 4
OLE dump

MalwareBazaar was able to identify 15 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
2244 bytesDocumentSummaryInformation
3200 bytesSummaryInformation
499 bytesMBD0005BCAB/CompObj
515123 bytesMBD0005BCAB/Package
6566 bytesMBD0005BCAC/Ole
7282638 bytesWorkbook
8527 bytes_VBA_PROJECT_CUR/PROJECT
9104 bytes_VBA_PROJECT_CUR/PROJECTwm
10977 bytes_VBA_PROJECT_CUR/VBA/Sheet1
11977 bytes_VBA_PROJECT_CUR/VBA/Sheet2
12977 bytes_VBA_PROJECT_CUR/VBA/Sheet3
13985 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
142644 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
15553 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
442
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3df16653affd5ddd6a27c4b9a4e92aa3e4b87fc61b4332b7c9675ba1cfc8a70f.xls
Verdict:
Suspicious activity
Analysis date:
2024-05-28 07:06:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e638e7bb-2aa6-493d-af47-1ceeda456b49

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
TwinWave.EvilDoc.93TilInfinity.20240412.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=665582be3d0e5a324e765326win7simulatehigh_evasion
Tags:
Network Office Stealth Heur
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Creating a window
DNS request
Sending an HTTP GET request
Searching for synchronization primitives
Launching a process
Сreating synchronization primitives
Connection attempt by exploiting the app vulnerability
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/3df16653affd5ddd6a27c4b9a4e92aa3e4b87fc61b4332b7c9675ba1cfc8a70f/results/dashboard
Payload URLs
URL
File name
http://z2.ink/zBOD
Embedded Ole
Behaviour
SuspiciousRTF detected
Verdict:
Suspicious
Labled as:
CVE-2017-0199
Link:
https://www.hybrid-analysis.com/sample/3df16653affd5ddd6a27c4b9a4e92aa3e4b87fc61b4332b7c9675ba1cfc8a70f
Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/3df16653affd5ddd6a27c4b9a4e92aa3e4b87fc61b4332b7c9675ba1cfc8a70f
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
spre.bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1448373
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs new ROOT certificates
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: Equation Editor Network Connection
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell download and load assembly
Sigma detected: Powershell download payload from hardcoded c2 list
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Yara detected Powershell download and execute
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1448373 Sample: #20240627_Edlen_B.xls Startdate: 28/05/2024 Architecture: WINDOWS Score: 100 71 z2.ink 2->71 91 Snort IDS alert for network traffic 2->91 93 Multi AV Scanner detection for domain / URL 2->93 95 Found malware configuration 2->95 97 22 other signatures 2->97 12 EXCEL.EXE 57 31 2->12         started        16 taskeng.exe 1 2->16         started        signatures3 process4 dnsIp5 81 198.46.177.156, 49164, 49169, 49172 AS-COLOCROSSINGUS United States 12->81 83 z2.ink 54.241.153.192, 49163, 49165, 49166 AMAZON-02US United States 12->83 65 lionsarebeautifult...ionbeautiufl[1].doc, ISO-8859 12->65 dropped 18 wscript.exe 11 12->18         started        22 WINWORD.EXE 339 33 12->22         started        25 rugtucw 16->25         started        file6 process7 dnsIp8 73 paste.ee 18->73 75 uploaddeimagens.com.br 188.114.97.3, 443, 49174, 49175 CLOUDFLARENETUS European Union 18->75 99 System process connects to network (likely due to code injection or exploit) 18->99 101 Suspicious powershell command line found 18->101 103 Wscript starts Powershell (via cmd or directly) 18->103 113 5 other signatures 18->113 27 powershell.exe 4 18->27         started        77 z2.ink 22->77 55 C:\Users\user\AppData\Roaming\...\zBOD.url, MS 22->55 dropped 57 C:\Users\user\AppData\Roaming\...\z2.ink.url, MS 22->57 dropped 59 ~WRF{E5BBB120-EEF3...2-2B0745709A9C}.tmp, Composite 22->59 dropped 61 C:\Users\user\AppData\Local\...\6619CBCE.doc, ISO-8859 22->61 dropped 105 Microsoft Office launches external ms-search protocol handler (WebDAV) 22->105 107 Office viewer loads remote template 22->107 109 Microsoft Office drops suspicious files 22->109 30 EQNEDT32.EXE 12 22->30         started        file9 111 Connects to a pastebin service (likely for C&C) 73->111 signatures10 process11 file12 131 Suspicious powershell command line found 27->131 133 Suspicious execution chain found 27->133 33 powershell.exe 12 5 27->33         started        67 C:\Users\...\lionarekingofjungleimageshes.vbs, Unicode 30->67 dropped 135 Office equation editor establishes network connection 30->135 137 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 30->137 signatures13 process14 dnsIp15 69 uploaddeimagens.com.br 33->69 87 Writes to foreign memory regions 33->87 89 Injects a PE file into a foreign processes 33->89 37 RegAsm.exe 33->37         started        signatures16 process17 signatures18 115 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 37->115 117 Maps a DLL or memory area into another process 37->117 119 Checks if the current machine is a virtual machine (disk enumeration) 37->119 121 Creates a thread in another existing process (thread injection) 37->121 40 explorer.exe 3 2 37->40 injected process19 dnsIp20 79 prolinice.ga 77.232.129.190, 49178, 49179, 80 BSTV-ASRU Russian Federation 40->79 63 C:\Users\user\AppData\Roaming\rugtucw, PE32 40->63 dropped 123 Benign windows process drops PE files 40->123 125 Injects code into the Windows Explorer (explorer.exe) 40->125 127 Writes to foreign memory regions 40->127 129 Hides that the sample has been downloaded from the Internet (zone.identifier) 40->129 45 explorer.exe 6 40->45         started        49 explorer.exe 40->49         started        51 explorer.exe 40->51         started        53 6 other processes 40->53 file21 signatures22 process23 dnsIp24 85 prolinice.ga 45->85 139 System process connects to network (likely due to code injection or exploit) 45->139 141 Found evasive API chain (may stop execution after checking mutex) 45->141 143 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 45->143 147 3 other signatures 45->147 145 Tries to harvest and steal browser information (history, passwords, etc) 49->145 signatures25
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3df16653affd5ddd6a27c4b9a4e92aa3e4b87fc61b4332b7c9675ba1cfc8a70f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-05-27 11:33:44 UTC
File Type:
Document
Extracted files:
25
AV detection:
10 of 24 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxywmu5p7vo522rhys42j2jkupslq76gdnbtfn6jm5n2dt6iu4hq._file
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor execution trojan
Link:
https://tria.ge/reports/240528-hw3sqaac7x/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Abuses OpenXML format to download file from external location
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
SmokeLoader
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0dad4958-a6ea-45ef-b503-b01834af4556
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3df16653affd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/3df16653affd5ddd6a27c4b9a4e92aa3e4b87fc61b4332b7c9675ba1cfc8a70f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:office_document_vba
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Office document with embedded VBA
Reference:https://github.com/jipegit/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments