MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7d04743911aa4264b47d44df511d4c1f72dc789293b2457bf995ca2a592add3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c7d04743911aa4264b47d44df511d4c1f72dc789293b2457bf995ca2a592add3
SHA3-384 hash:	eb43a4f750cf11bef6075d8b701736d8fb416c34bbeaa78ef5666247f8277a64d9ef65b1e58d2748bb3c1e980a25f752
SHA1 hash:	76a7deb9b3324c9e16b79d21e2d6f748d42589d0
MD5 hash:	5470bef17dcaeddad800d71b451e20f1
humanhash:	bravo-indigo-william-monkey
File name:	Договiр_поставки.js
Download:	download sample
Signature	Smoke Loader Alert Create hunting rule
File size:	16'967 bytes
First seen:	2025-02-01 15:36:06 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:o20O2IK22cBlxREsgnoVRlBxBOFtljOxxrg8yJ186CxpjlJxj96lxqctTxlxVlXg:o20O2IK22cBlxREsgnoVRlBxBOFtljOp
Threatray	3'089 similar samples on MalwareBazaar
TLSH	T10E726B360A1D065215D7F1C5CCD4D7261BB3E284BF36AE82AA468AD52FF8CC67903C76
Magika	javascript
Reporter	abuse_ch
Tags:	js Smoke Loader

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

453

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=679e3f7ca9881a7a01c4e70d

Tags:

phishing shell agent sage

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/c7d04743911aa4264b47d44df511d4c1f72dc789293b2457bf995ca2a592add3

Joe Sandbox SmokeLoader

Result

Threat name:

SmokeLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1604512

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

JScript performs obfuscated calls to suspicious functions

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Powershell drops PE file

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c7d04743911aa4264b47d44df511d4c1f72dc789293b2457bf995ca2a592add3

CERT.PL MWDB smokeloader

Detection:

smokeloader

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/c7d04743911aa4264b47d44df511d4c1f72dc789293b2457bf995ca2a592add3/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y7ieoq4rdkscms2h2rg7keouyh3s3r4jfe5siv57tfokfjmsvxjq._file

Threatray smokeloader shellcode_loader_002

Verdict:

malicious

Label(s):

smokeloader

Alert

Create hunting rule

shellcode_loader_002

Alert

Create hunting rule

Similar samples:

0b56c3f36aa9fcda36d68ba0e190b0d3547b16800e2d8c0c03818ccfee5b0014

Smoke Loader

1db54ba35abbe3cb1e178971085be979a8c62351630bd9c6e616a6391ab270bf

Smoke Loader

1efbc80ffd55c78287134a11add66b10bf7b2cd724913721a7f305d483050593

Smoke Loader

1f26aa290b6cf8489f9b7ca5e48ec0bc54e4c3b05bb0d50c3d7cb2e109c6428e

Smoke Loader

2137265dc6a29ece0da45f06d99707cf689ee05393f68c2710e636d006e42412

Smoke Loader

50ca2730d4feb93b8d6cf986a86b34912d83c10dd7d7259d3538d415c904af73

Smoke Loader

8b2095f22cba2c9f35cc78fa2e31c9311af42c70b29ee0847ac92d0c3a5a3f55

Smoke Loader

9b22e78e71dee0ab92ed95b9dee69f142bc5a0d112e26ec9615ffaa37894504c

Smoke Loader

error

Smoke Loader

+ 3'079 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/250201-s14kxszqgn/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Dofoil

Threat name:

Dofoil

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/c7d04743911aa4264b47d44df511d4c1f72dc789293b2457bf995ca2a592add3