| SHA256: | 0e580a720ae8566fb7c771f6985d8a642b8a1f0ca2f55e06f06f7765fd66d383 |
| Detection ratio: | 6 / 59 |
| Analysis date: | 2018-03-14 12:11:52 UTC ( 11 months, 2 weeks ago ) View latest |
| Antivirus | Result | Update |
|---|---|---|
| Arcabit | HEUR.VBA.Trojan.e | 20180314 |
| Baidu | VBA.Trojan-Downloader.Agent.cpf | 20180314 |
| Fortinet | VBA/Agent.FZL!tr.dldr | 20180314 |
| nProtect | Suspicious/W97M.Obfus.Gen | 20180314 |
| Qihoo-360 | virus.office.qexvmc.1100 | 20180314 |
| Zoner | Probably W97Obfuscated | 20180314 |
| Ad-Aware | 20180314 | |
| AegisLab | 20180314 | |
| AhnLab-V3 | 20180314 | |
| Alibaba | 20180314 | |
| ALYac | 20180314 | |
| Antiy-AVL | 20180314 | |
| Avast | 20180314 | |
| Avast-Mobile | 20180314 | |
| AVG | 20180314 | |
| Avira (no cloud) | 20180314 | |
| AVware | 20180314 | |
| BitDefender | 20180314 | |
| Bkav | 20180314 | |
| CAT-QuickHeal | 20180314 | |
| ClamAV | 20180314 | |
| CMC | 20180314 | |
| Comodo | 20180314 | |
| CrowdStrike Falcon (ML) | 20170201 | |
| Cybereason | None | |
| Cylance | 20180314 | |
| Cyren | 20180314 | |
| DrWeb | 20180314 | |
| eGambit | 20180314 | |
| Emsisoft | 20180314 | |
| Endgame | 20180308 | |
| ESET-NOD32 | 20180314 | |
| F-Prot | 20180314 | |
| F-Secure | 20180314 | |
| GData | 20180314 | |
| Ikarus | 20180314 | |
| Sophos ML | 20180121 | |
| Jiangmin | 20180314 | |
| K7AntiVirus | 20180314 | |
| K7GW | 20180314 | |
| Kaspersky | 20180314 | |
| Kingsoft | 20180314 | |
| Malwarebytes | 20180314 | |
| MAX | 20180314 | |
| McAfee | 20180314 | |
| McAfee-GW-Edition | 20180314 | |
| Microsoft | 20180314 | |
| eScan | 20180314 | |
| NANO-Antivirus | 20180314 | |
| Palo Alto Networks (Known Signatures) | 20180314 | |
| Panda | 20180314 | |
| Rising | 20180314 | |
| SentinelOne (Static ML) | 20180225 | |
| Sophos AV | 20180314 | |
| SUPERAntiSpyware | 20180314 | |
| Symantec | 20180314 | |
| Symantec Mobile Insight | 20180311 | |
| Tencent | 20180314 | |
| TheHacker | 20180311 | |
| TrendMicro | 20180314 | |
| TrendMicro-HouseCall | 20180314 | |
| Trustlook | 20180314 | |
| VBA32 | 20180314 | |
| VIPRE | 20180314 | |
| ViRobot | 20180314 | |
| Webroot | 20180314 | |
| WhiteArmor | 20180223 | |
| Yandex | 20180314 | |
| Zillya | 20180314 | |
| ZoneAlarm by Check Point | 20180314 |
The file being studied follows the Compound Document File format!
More specifically, it is a MS Word Document file.
Commonly abused properties
The studied file makes use of macros, a macro is a series of commands
and instructions that you group together as a single command to accomplish a task automatically.
Macros are often abused to perform malicious tasks when working with a document.
May try to run other files, shell commands or applications.
May create OLE objects.
Seems to contain deobfuscation code.
Summary
creation_datetime
2018-03-14 04:27:00
template
Normal.dotm
author
HbKwvDqp
page_count
1
last_saved
2018-03-14 04:27:00
revision_number
1
application_name
Microsoft Office Word
character_count
1
code_page
Latin I
Document summary
line_count
1
characters_with_spaces
1
version
1048576
paragraph_count
1
code_page
Latin I
OLE Streams
Macros and VBA code streams
ExifTool file metadata
SharedDoc
No
Author
HbKwvDqp
CodePage
Windows Latin 1 (Western European)
System
Windows
LinksUpToDate
No
HeadingPairs
Title, 1
Identification
Word 8.0
Template
Normal.dotm
CharCountWithSpaces
1
CreateDate
2018:03:14 11:27:00
Word97
No
LanguageCode
English (US)
CompObjUserType
Microsoft Word 97-2003 Document
ModifyDate
2018:03:14 11:27:00
ScaleCrop
No
Characters
1
HyperlinksChanged
No
RevisionNumber
1
MIMEType
application/msword
Words
0
FileType
DOC
Lines
1
AppVersion
16.0
Security
None
Software
Microsoft Office Word
TotalEditTime
0
Pages
1
CompObjUserTypeLen
32
FileTypeExtension
doc
Paragraphs
1
LastPrinted
0000:00:00 00:00:00
DocFlags
Has picture, 1Table, ExtChar
File identification
MD5 06a71061b33d58d7cda55e2e52c91990
SHA1 ad6e6b99b26230d877938209d9e84dca792a9fb8
SHA256 0e580a720ae8566fb7c771f6985d8a642b8a1f0ca2f55e06f06f7765fd66d383
ssdeep
3072:2iqkCPu57WCdwPbuhyL3UvLBR2YExNNi6UicvRMI6BS3K1GlfE2bXhsqiWovheud:K52jwPDLkvLDt53GIJC
File size
141.0 KB ( 144384 bytes )
File type MS Word Document
Magic literal
CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: HbKwvDqp, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Mar 13 12:27:00 2018, Last Saved Time/Date: Tue Mar 13 12:27:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
| TrID |
Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%) |
Tags
obfuscated
run-file
email-pattern
doc
macros
create-ole
VirusTotal metadata
First submission
2018-03-14 11:43:13 UTC ( 11 months, 2 weeks ago )
Last submission
2018-05-08 00:00:47 UTC ( 9 months, 2 weeks ago )
| File names |
Dokumente #8839194.doc Information #297283798098.doc Informationen #38823605293.doc Rechnung_Nr.65713_#982407337514.doc Rechnungs-Details #90770390934.doc Scan #1320964466.doc RECHNUNG 15138 #689173428.doc UPS Express 506188-CM-EET.doc RECHNUNG 07374 #08156979381.doc #40649519628.doc RECHNUNG 66387 #227379249.doc 06a71061b33d58d7cda55e2e52c91990.virobj Scan #392219142.doc Tracking-821299-GX-ROVMI.doc Dokumente #9238471601.doc Rechnungs-Details #86581264945.doc Scan #611877325992.doc UPS number 92340122-LGVA-QQQDL.doc Rechnungs-Details #886021689.doc Dokumente #764007225796.doc Dokumente vom Notar #02747254.doc Rechnungs-Details #62339964409.doc Rechnung Nr.71365 #500815957853.doc RECHNUNG 08759 #236168926227.doc RECHNUNG 20241 #585005452473.doc |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!