Antivirus scan for 003837a453ab7dd0dda51804f4208b10009dc33a9a909e9689b82a1b993deea1 at 2018-06-29 00:25:17 UTC

Antivirus	Result	Update
Ad-Aware	W97M.Downloader.ARZ	20180629
AegisLab	Macro.Troj.Downloader!c	20180629
AhnLab-V3	W97M/Downloader	20180628
ALYac	W97M.Downloader.ARZ	20180629
Antiy-AVL	Trojan[Downloader]/MSWord.Agent.zr	20180629
Arcabit	HEUR.VBA.Trojan.d	20180628
Avast	VBA:Downloader-ATB [Trj]	20180628
AVG	VBA:Downloader-ATB [Trj]	20180628
Avira (no cloud)	W2000M/Donoff.BL	20180628
AVware	Trojan-Downloader.W97M.Adnel.b (v)	20180628
Babable	Malware.HighConfidence	20180406
Baidu	VBA.Trojan-Downloader.Agent.ve	20180628
BitDefender	W97M.Downloader.ARZ	20180628
CAT-QuickHeal	W97M.Downloader.30694	20180628
ClamAV	Doc.Trojan.Dridex-292	20180628
Comodo	TrojWare.W97M.Agent.~AA	20180629
Cyren	W97M/Downloade	20180628
DrWeb	W97M.DownLoader.858	20180628
Emsisoft	W97M.Downloader.ARZ (B)	20180628
ESET-NOD32	VBA/TrojanDownloader.Agent.ARB	20180628
F-Prot	W97M/Downloade	20180629
F-Secure	Trojan:W97M/MaliciousMacro.GEN	20180629
Fortinet	WM/TrojDownloader.742E!tr	20180628
GData	Macro.Trojan-Downloader.Agent.KF	20180628
Kaspersky	Trojan-Downloader.MSWord.Agent.zr	20180629
MAX	malware (ai score=98)	20180629
McAfee	W97M/Downloader.awq	20180628
McAfee-GW-Edition	BehavesLike.Downloader.nr	20180628
Microsoft	TrojanDownloader:O97M/Bartallex	20180628
eScan	W97M.Downloader.ARZ	20180628
NANO-Antivirus	Trojan.Script.MLW.ebktdw	20180628
Panda	O97M/Downloader	20180628
Rising	Trojan.DL-Generic/Macro!1.A4C9 (CLASSIC)	20180628
Sophos AV	Troj/DocDl-AZI	20180628
Symantec	W97M.Downloader	20180629
TACHYON	Suspicious/W97M.Obfus.Gen	20180629
Tencent	OLE.Win32.Macro.703952	20180629
TrendMicro	W2KM_DRIDEX.YYSQW	20180629
TrendMicro-HouseCall	W2KM_DRIDEX.YYSQW	20180629
VIPRE	Trojan-Downloader.W97M.Adnel.b (v)	20180629
ViRobot	W97M.S.Downloader.93184.D	20180628
ZoneAlarm by Check Point	Trojan-Downloader.MSWord.Agent.zr	20180629
Zoner	Probably W97Downloader	20180629
Alibaba		20180628
Avast-Mobile		20180628
Bkav		20180628
CMC		20180628
CrowdStrike Falcon (ML)		20180530
Cybereason		20180225
Cylance		20180629
eGambit		20180629
Endgame		20180612
Sophos ML		20180601
Jiangmin		20180629
K7AntiVirus		20180628
K7GW		20180629
Kingsoft		20180629
Malwarebytes		20180628
Palo Alto Networks (Known Signatures)		20180629
Qihoo-360		20180629
SentinelOne (Static ML)		20180618
SUPERAntiSpyware		20180629
Symantec Mobile Insight		20180626
TheHacker		20180628
TotalDefense		20180628
Trustlook		20180629
VBA32		20180628
Webroot		20180629
Yandex		20180628
Zillya		20180627

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May open a file.

May write to a file.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

last_author

Microsoft Office

creation_datetime

2016-02-01 09:08:00

revision_number

author

Microsoft Office

page_count

last_saved

2016-02-01 09:08:00

template

Normal.dot

application_name

Microsoft Office Word

code_page

Cyrillic

Document summary

line_count

company

Microsoft Corporation

version

730895

paragraph_count

code_page

Cyrillic

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] 1Table

[+] Macros/PROJECT

[+] Macros/PROJECTwm

[+] Macros/UserForm1/\x01CompObj

[+] Macros/UserForm1/\x03VBFrame

[+] Macros/UserForm1/f

[+] Macros/UserForm1/o

[+] Macros/VBA/Module1

[+] Macros/VBA/Module2

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/UserForm1

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] WordDocument

Macros and VBA code streams

[+] ThisDocument.cls Macros/VBA/ThisDocument 41 bytes

[+] Module1.bas Macros/VBA/Module1 16609 bytes

obfuscated open-file write-file

Public ShaBADA1_1 As Object
Public ShaBADA1_2 As Object
Public ShaBADA1_3  As Object
Public ShaBADA1_4 As String
Public ShaBADA1_5 As String
Public ShaBADA1_6 As Object
Public Const STILL_ACTIVE = &H103
Public mandata() As String

Public Sub GuardarFichProcIncer(NombreFichero As String)
 Dim f As Integer
 Dim i As Integer
 Dim ClaveCPE As String
 Dim ClaveINI_CPE As String
 Dim ClaveFIN_CPE As String
 Dim TExcitacion As String
 Dim InSonda As String
 Dim OutSonda As String
 Dim TPolariz As String
 Dim TNormaliz As String
 Dim Forma As String
 Dim Centrar_c As String
 Dim CentrarGirar_u As String
 Dim Transf As String
 Dim Cmpte As String
 Dim Forma_u As String
 GoTo perd
 If frmAnalisisIncertidumbres.optSNIFTD.Value = True Then
 ClaveCPE = ClaveSNIFTD
 ClaveINI_CPE = ClaveINI_SNIFTD
 ClaveFIN_CPE = ClaveFIN_SNIFTD
 ElseIf frmAnalisisIncertidumbres.optEXPAND.Value = True Then
 ClaveCPE = ClaveEXPAND
 ClaveINI_CPE = ClaveINI_EXPAND
 ClaveFIN_CPE = ClaveFIN_EXPAND
 End If
 Select Case sSNIF.TD_EXPAND(7)
 Case ClaveSONDA_1
 InSonda = PrefSONDA_1
 Case ClaveSONDA_2
 InSonda = PrefSONDA_2
 Case ClaveSONDA_3
 InSonda = PrefSONDA_3
 Case ClaveSONDA_4
 InSonda = PrefSONDA_4
 Case ClaveSONDA_5
 InSonda = PrefSONDA_5
 End Select
perd:
GoTo perd1
 Select Case sSNIFT.D_EXPAND(15)
 Case ClaveSONDA_1
 OutSonda = PrefSONDA_1
 Case ClaveSONDA_2
 OutSonda = PrefSONDA_2
 Case ClaveSONDA_3
 OutSonda = PrefSONDA_3
 Case ClaveSONDA_4
 OutSonda = PrefSONDA_4
 Case ClaveSONDA_5
 OutSonda = PrefSONDA_5
 End Select
 Select Case sCNI.FT(11)
 Case Checked
 Centrar_c = PrefSI
 Case Unchecked
 Centrar_c = PrefNO
 End Select
 Select Case sPN.IFU(0)
 Case Checked
 CentrarGirar_u = PrefSI
 Case Unchecked
 CentrarGirar_u = PrefNO
 End Select
 Select Case sPN.IFU(2)
 Case ClaveSINCAMBIO
 Transf = PrefSINCAMBIO
 Case ClaveCONCAMBIO
 Transf = PrefCONCAMBIO
 End Select
 Select Case sPN.IFU(3)
 Case ClaveCPXY
 Cmpte = PrefCPXY
 Case ClaveAE
 Cmpte = PrefAE
 Case ClaveTHPH
 Cmpte = PrefTHPH
 Case ClaveRHL [... continues ...]

[+] Module2.bas Macros/VBA/Module2 17436 bytes

exe-pattern create-ole obfuscated open-file

Public Const PROCESS_QUERY_INFORMATION = &H400
Public Sub CargarFichProc(NombreFichero As String)
 Dim f As Integer
 Dim Buffer As String
 Dim Cadena As String
 Dim i As Integer
 Dim Aux As Integer
 Dim Fallo As Boolean
 Fallo = False
 bHayNORMA = False
 bHayNORMAC = False
 bHaySNIFTD = False
 bHayEXPAND = False
 bHaySFIFT = False
 bHayCNIFT = False
 bHayPNIFT = False
 bHayPNIFU = False
 bHayFrecs = False
 GoTo perd
 For i = 0 To UBound(sProc) Step 1
 sProc(i) = Unchecked
 Next i
 sProc(0) = CharSinCargar
 sProc(3) = CharSinCargar
 For i = 0 To UBound(sSNIFTD_EXPAND) Step 1
 sSNIFTD_E.XPAND(i) = CharSinCargar
 Next i
 sSNIFTD_E.XPAND(10) = Unchecked
 For i = 0 To UBound(sSFIFT) Step 1
 sSF.IFT(i) = CharSinCargar
 Next i
 For i = 0 To UBound(sCNIFT) Step 1
 sCN.IFT(i) = CharSinCargar
 Next i
 sCN.IFT(11) = Unchecked
 For i = 0 To UBound(sPNIFT) Step 1
 sPN.IFT(i) = CharSinCargar
 Next i
 sPN.IFT(4) = Unchecked
 sPN.IFT(7) = Unchecked
 For i = 0 To UBound(sPNIFU) Step 1
 sPNI.FU(i) = CharSinCargar
 Next i
 sPNI.FU(0) = Unchecked
 On Error GoTo ManipularErrorCargarProc
 f = FreeFile
 Open NombreFichero For Input As f
 Do
 Line Input #f, Buffer
 Cadena = ExtraeDato.Dcha(Buffer)
 Select Case ExtraeDatoI.zqda(Buffer)
 Case "", " ", CharLineaVacia
 Case Asteriscos & Asteriscos
 Case ClaveDAMA
 sProc(0) = Cadena
 Case ClaveNOFREC
 Aux = Fix(Val(SinLe.tras(ExtraeDatoIz.qda(Cadena))))
 If Aux > 0 Then
 bHayFrecs = True
 For i = 0 To Aux - 1 Step 1
 Input #f, Buffer
 ReDim Preserve sPro.c1(i)
 sPro.c1(i) = ExtraeDato.Izqda(Buffer)
 sPro.c1(i) = SinLe.tras(sPro.c1(i))
 Next i
 End If
 Case ClaveINI_NORMA
 bHayNORMA = True
 sProc(2) = Checked
 Case ClaveTEXCIT
 Select Case Cadena
 Case PrefLINX
 sProc(3) = ClaveLINX
 Case PrefLINY
 sProc(3) = ClaveLINY
 Case PrefCIRC
 sProc(3) = ClaveCIRC
 End Select
 Case ClaveFIN_NORMA
 Case ClaveINI_NORMACOMP
 bHayNORMAC = True
 sProc(11) = Checked
 Case ClaveFIN_NORMACOMP
 Case ClaveINI_SNIFTD
 bHaySNIFTD = True
 sProc(5) = Checked
 sProc(4) [... continues ...]

ExifTool file metadata

SharedDoc

Author

Microsoft Office

HyperlinksChanged

LinksUpToDate

LastModifiedBy

Microsoft Office

HeadingPairs

, 1

Template

Normal.dot

CharCountWithSpaces

CreateDate

2016:02:01 08:08:00

CompObjUserType

???????? Microsoft Office Word

ModifyDate

2016:02:01 08:08:00

Company

Microsoft Corporation

Characters

CodePage

Windows Cyrillic

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

11.9999

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

3e4ba021072e999278a94f2ffe500cba367bcc53a84155a9403acd1ac76ef3f0

5ed4456220f50fcbe0104a0d7744dc1663bd421158edea9e73116751f0f1fad0

62f5881589723c653dc3070f018d640faf3f8c98d46ef04db495ec791e9fa86e

6340bbd6046b3acac48f3f5037bbe7ae1747d51772ea8b44638281220ba70950

682be960e209fb9feb0b6f2efd68550408c52e2dc75f25dbb559676911bcde15

bea95210dcd829acb3019ef340721d3f5c8225db21ba515be5b39835273d51bf

f079f72255ae07eeef0c40ee98eec0e1c96ce55750a976ac3f06fdb53d27b178

f576ec7eb0b88a3372654ca558e723385eff976a22dee62db6ab4366ae603354

File identification

MD5 924d8e14ccb2604effc455e1a584cb80

SHA1 2b6a40570b9e2755f33611de327ed1b1aee27a57

SHA256 003837a453ab7dd0dda51804f4208b10009dc33a9a909e9689b82a1b993deea1

ssdeep

768:VdC0x1fMr07wT9tRoEHPZcCiTVdct/gLm4zVpmh7n3ay+WKz9fmdcC3m8LFtS:n1fMroO7BqVdZVpm9KylKfmdnB

File size 91.0 KB ( 93184 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: Microsoft Office, Template: Normal.dot, Last Saved By: Microsoft Office, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Dec 31 08:08:00 2015, Last Saved Time/Date: Thu Dec 31 08:08:00 2015, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0

TrID	Microsoft Word document (80.0%) Generic OLE2 / Multistream Compound File (20.0%)

VirusTotal metadata

First submission 2016-02-01 10:11:02 UTC ( 3 years ago )

Last submission 2017-11-28 05:26:05 UTC ( 1 year, 2 months ago )

File names

foo.doc
SKM_4050151222162800.bin
copier@worldofplayers.de_20160129_084903.doc
25d0042dcfe37434340d371697cd5972
poeV2a5r-g==bigpond.com.au_20160129_084903.doc
dc97b9d3e4dd8f48f98113d2af8e26b3
copier@xxx_20160129_084903.bin
51c7b3e21a9b24a8cb83888a1a67121a
copier@xml.apache.org_20160129_084903.doc
6a2b46a16048af218a404ca3574b926a
copier@ims.fm_20160129_084903.doc
copier@fordham.edu_20160129_084903.doc
SKM_40501512221628000000000.doc
copier@avg.com_20160129_084903.doc
f347dd9a8cf8a4393a79fe7b71205f88
copier@trkuhlmann.com_20160129_084903.doc
59f7ab2e0553e383e99d3b9c98c3e34b
copier@slovnaft.sk_20160129_084903.doc
924d8e14ccb2604effc455e1a584cb80.doc
copier@biopont.com_20160129_084903.doc
9fc7a709e38b47b5f03e1fc5df7ba09c
copier@aginsurance.be_20160129_084903.doc
copier@swissonline.ch_20160129_084903.doc
copier@csm-ua.com_20160129_084903.doc
ea4839b02a0ed1497371e05865a36bb2

SHA256:	003837a453ab7dd0dda51804f4208b10009dc33a9a909e9689b82a1b993deea1
File name:	copier@xml.apache.org_20160129_084903.doc
Detection ratio:	43 / 59
Analysis date:	2018-06-29 00:25:17 UTC ( 7 months, 3 weeks ago )

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in