MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc0715adb07b65af47d660aa7582f9ecdfc770606f1a852fe1aa7a643bba7543. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 8


Maldoc score: 11


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc0715adb07b65af47d660aa7582f9ecdfc770606f1a852fe1aa7a643bba7543
SHA3-384 hash: 2f2deec3efaec1b6de607e1f5014b256e809a3c66700984215770d4adaa7639d3f4bad94b4749baeadf789055136cd99
SHA1 hash: de4e0565d2117a385e4277dcec6a8a53153a20c4
MD5 hash: 5f8bc9b193340a045df1640e77342e3b
humanhash: illinois-river-sweet-twelve
File name:Payment-244581781.doc
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:226'670 bytes
First seen:2020-11-20 13:17:54 UTC
Last seen:2020-11-20 15:05:43 UTC
File type:Word file doc
MIME type:application/msword
ssdeep 3072:Ya9ypojzjRJJ7GS1/iA+Fhl8wF+mxYzzzzzzzzXMgf0LXnVlRs2Bz:/9ypojxRilFhCwFTS0LXnVlRs2Bz
TLSH 6624C1F4B356C25BD1037D714AA6D295A39CAC15CCD94A7F3988BB3B5A3E720D03B1A0
Reporter JAMESWT_WT
Tags:170.106.35.220 Smoke Loader

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 11
Application name is Microsoft Office Word
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 38 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
24096 bytesDocumentSummaryInformation
3524 bytesSummaryInformation
48455 bytes1Table
5121042 bytesData
6920 bytesMacros/PROJECT
7314 bytesMacros/PROJECTwm
897 bytesMacros/UserForm1/CompObj
9266 bytesMacros/UserForm1/VBFrame
1038 bytesMacros/UserForm1/f
110 bytesMacros/UserForm1/o
1297 bytesMacros/UserForm2/CompObj
13266 bytesMacros/UserForm2/VBFrame
1438 bytesMacros/UserForm2/f
150 bytesMacros/UserForm2/o
1697 bytesMacros/UserForm3/CompObj
17266 bytesMacros/UserForm3/VBFrame
1838 bytesMacros/UserForm3/f
190 bytesMacros/UserForm3/o
2097 bytesMacros/UserForm4/CompObj
21266 bytesMacros/UserForm4/VBFrame
2238 bytesMacros/UserForm4/f
230 bytesMacros/UserForm4/o
2497 bytesMacros/UserForm5/CompObj
25266 bytesMacros/UserForm5/VBFrame
2638 bytesMacros/UserForm5/f
270 bytesMacros/UserForm5/o
2815540 bytesMacros/VBA/Imkyf2ff_1d5k_ua
29687 bytesMacros/VBA/K8m82_a7yhx1w2t9i
301160 bytesMacros/VBA/UserForm1
311160 bytesMacros/VBA/UserForm2
321160 bytesMacros/VBA/UserForm3
331160 bytesMacros/VBA/UserForm4
341160 bytesMacros/VBA/UserForm5
351134 bytesMacros/VBA/Zynas813o1a9o17543
366710 bytesMacros/VBA/_VBA_PROJECT
371070 bytesMacros/VBA/dir
3839982 bytesWordDocument
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecDocument_openRuns when the Word or Publisher document is opened
SuspiciousCreateMay execute file or a system command through WMI
SuspiciousCreateObjectMay create an OLE object
SuspiciousChrWMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Enabling the 'hidden' option for recently created files
Connection attempt
Sending an HTTP POST request
Launching a service
Reading critical registry keys
Setting browser functions hooks
Possible injection to a system process
Creating a window
Using the Windows Management Instrumentation requests
Running batch commands
Launching a process
DNS request
Sending a custom TCP request
Creating a file
Creating a process from a recently created file
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Deleting a recently created file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Stealing user critical data
Launching a process by exploiting the app vulnerability
Enabling autorun by creating a file
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/544158
Signature
Antivirus detection for URL or domain
Creates processes via WMI
Encrypted powershell cmdline option found
Machine Learning detection for dropped file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc0715adb07b65af47d660aa7582f9ecdfc770606f1a852fe1aa7a643bba7543/
Threat name:
Script-Macro.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 13:18:04 UTC
File Type:
Document
Extracted files:
44
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3qdrllnqpns26r6wmcvhlaxz5tp4o4dan4nikl7bvj5gio52ovbq._file
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor macro spyware trojan
Link:
https://tria.ge/reports/201120-87595w4era/
Behaviour
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Suspicious use of UnmapMainImage
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
JavaScript code in executable
Loads dropped DLL
Reads user/profile data of web browsers
Blacklisted process makes network request
Executes dropped EXE
Process spawned unexpected child process
SmokeLoader
Malware Config
C2 Extraction:
http://penodux.com/xsmkld/index.php
http://tommusikirtyur.com/xsmkld/index.php
http://ploaernysannyer.com/xsmkld/index.php
http://dersmasfannyer.com/xsmkld/index.php
http://derdsgdannyer.com/xsmkld/index.php
Dropper Extraction:
http://giftcard2naira.com/
https://nc3aaa.org/
https://readaboutcare.site/
https://www.ctrlbfont.com/
https://prosyarmakassar.com/
https://online-theorie.driveddy.com/
http://sbm.balajihandheld.in/
https://kezenelectric.ca/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/dc0715adb07b65af47d660aa7582f9ecdfc770606f1a852fe1aa7a643bba7543

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments