Extracted

Extracted

• • Target

    616476ce3c35d67b5edbb73b6c8965d5894f404f90074add16986f8d5c81d6f0.doc

  • Size

    518KB

  • MD5

    1f2d795ca29afadf24325cfbb3f60e4e

  • SHA1

    d5e05bf7300a09b6706082907e726b0d5a09e550

  • SHA256

    616476ce3c35d67b5edbb73b6c8965d5894f404f90074add16986f8d5c81d6f0

  • SHA512

    40ff395e3e62e9c0b47d9ec088129042b26ceeee28c76c23615086c33fcbc57250a8c4ea53464dfd5398a5e023743dca988d7c86ec1f6039a873d8b3352393b7

  • SSDEEP

    6144:sEc+F+HLHNIvPl8qZDC9VT8L38S8WyI6OLxoq5seCsH8BB3y8dqtUO2TsyUrOSo:sEcJHNopZW9eLH8WyITLfyXXvqxj9o

  Score

  10^/10

  smokeloaderbackdoortrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2