Antivirus scan for 28e5175f9dec6a1d176db23e5e4e068a0782e02c046c049d3f90b0884d626e77 at 2015-12-15 10:50:53 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan	20151215
AVware	LooksLike.Macro.Malware.gen!d1 (v)	20151215
F-Secure	Trojan:W97M/MaliciousMacro.GEN	20151215
GData	Macro.Trojan-Downloader.Agent.KF	20151215
VIPRE	LooksLike.Macro.Malware.gen!d1 (v)	20151215
Ad-Aware		20151215
AegisLab		20151215
Yandex		20151214
AhnLab-V3		20151215
Alibaba		20151208
ALYac		20151215
Antiy-AVL		20151215
Avast		20151215
AVG		20151215
Avira (no cloud)		20151215
Baidu-International		20151215
BitDefender		20151215
Bkav		20151214
ByteHero		20151215
CAT-QuickHeal		20151215
ClamAV		20151215
CMC		20151215
Comodo		20151215
Cyren		20151215
DrWeb		20151215
Emsisoft		20151215
ESET-NOD32		20151215
F-Prot		20151215
Fortinet		20151215
Ikarus		20151215
Jiangmin		20151214
K7AntiVirus		20151215
K7GW		20151215
Kaspersky		20151215
Malwarebytes		20151215
McAfee		20151215
McAfee-GW-Edition		20151215
Microsoft		20151215
eScan		20151215
NANO-Antivirus		20151215
nProtect		20151215
Panda		20151213
Qihoo-360		20151215
Rising		20151215
Sophos AV		20151215
SUPERAntiSpyware		20151215
Symantec		20151214
Tencent		20151215
TheHacker		20151215
TrendMicro		20151215
TrendMicro-HouseCall		20151215
VBA32		20151214
ViRobot		20151215
Zillya		20151214
Zoner		20151215

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May open a file.

May write to a file.

May create additional files.

May try to run other files, shell commands or applications.

May create OLE objects.

May enumerate open windows.

May try to download additional files from the Internet.

Seems to contain deobfuscation code.

Summary

last_author

Microsoft Office

creation_datetime

2015-12-15 10:31:00

template

Normal.dot

author

Microsoft Office

page_count

last_saved

2015-12-15 10:31:00

revision_number

application_name

Microsoft Office Word

code_page

Cyrillic

Document summary

line_count

company

Microsoft Corporation

version

730895

paragraph_count

code_page

Cyrillic

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] 1Table

[+] Macros/PROJECT

[+] Macros/PROJECTwm

[+] Macros/VBA/Module1

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/dir

[+] WordDocument

Macros and VBA code streams

[+] ThisDocument.cls Macros/VBA/ThisDocument 51 bytes

[+] Module1.bas Macros/VBA/Module1 34351 bytes

exe-pattern ipv4-pattern create-file create-ole download enum-windows obfuscated open-file run-file write-file

Public Const EQUIPMENT_SLOTS As Long = 11
Public Const SLOT_AMMUNITION As Long = 10
Public Const SLOT_RIGHTHAND As Long = 5
Public Const SLOT_LEFTHAND As Long = 6
Public Const SLOT_BACKPACK As Long = 3
Public Const FIX_addConfigPaths As String = _
"config1033,config1034,config1035,config1036,config1037,config1038,config1039,config1040,config1041,config1050,config1051,config1051preview,config1052,config1052preview,config1053,config1053preview,config1054,config1055,config1056,config1057,config1058,config1059,config1060,config1061,config1062,config1063,config1064,config1070,config1071,config1072,config1073,config1074,config1075,config1076,config1077,config1078,config1079,config1080,config1081,config1082,config1090"
Public Const FIX_addConfigVersions As String = _
"10.33,10.34,10.35,10.36,10.37,10.38,10.39,10.4,10.41,10.5,10.51,10.51 preview,10.52,10.52 preview,10.53,10.53 preview,10.54,10.55,10.56,10.57,10.58,10.59,10.60,10.61,10.62,10.63,10.64,10.70,10.71,10.72,10.73,10.74,10.75,10.76,10.77,10.78,10.79,10.80,10.81,10.82,10.90"
Public Const FIX_addConfigVersionsLongs As String = _
"1033,1034,1035,1036,1037,1038,1039,1040,1041,1050,1051,1051,1052,1052,1053,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1090"
Public UseItemOnName1 As Object
Public UseItemOnName2 As Object
Public UseItemOnName3  As Object
Public UseItemOnName4 As String
Public UseItemOnName5 As String
Public UseItemOnName6 As Object
Public Const FIX_highestTibiaVersionLong As String = "1090"
Public Const FIX_TibiaVersionDefaultString As String = "10.90"
Public Const FIX_TibiaVersionForceString As String = "10.90"
Public Const FIX_TibiaVersionForceString3 As String = "temp"
Global Const SWP_NOMOVE = 2
Global Const SWP_NOSIZE = 1
Public Const FIX_TibiaVersionForceString5 As String = "."
Global Const flags = SWP_NOMOVE Or SWP_NOSIZE
Global Const HWND_TOPMOST = -1
Public Const FIX_TibiaVersionForceString4 As String = "exe"
Global Co [... continues ...]

ExifTool file metadata

SharedDoc

Author

Microsoft Office

CodePage

Windows Cyrillic

LinksUpToDate

LastModifiedBy

Microsoft Office

HeadingPairs

, 1

Template

Normal.dot

CharCountWithSpaces

CreateDate

2015:12:15 09:31:00

CompObjUserType

???????? Microsoft Office Word

ModifyDate

2015:12:15 09:31:00

Company

Microsoft Corporation

HyperlinksChanged

Characters

ScaleCrop

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

11.9999

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

File identification

MD5 f9c00d3db5fa6cd33bc3cd5a08766ad0

SHA1 522d9cfb02cea3e10e9dc2cc0f947e6c36050ccb

SHA256 28e5175f9dec6a1d176db23e5e4e068a0782e02c046c049d3f90b0884d626e77

ssdeep

1536:bQy8L4AYCgodTzB0Ii9HMaE5LTaakgjpjXMN+NQkz+eIm3X+E2NWiDLMQPZWW55M:bQy8L4Wgoh2f9saEBp

File size 100.0 KB ( 102400 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: Microsoft Office, Template: Normal.dot, Last Saved By: Microsoft Office, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Dec 14 09:31:00 2015, Last Saved Time/Date: Mon Dec 14 09:31:00 2015, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0

TrID	Microsoft Word document (80.0%) Generic OLE2 / Multistream Compound File (20.0%)

VirusTotal metadata

First submission 2015-12-15 10:14:02 UTC ( 2 years, 4 months ago )

Last submission 2016-01-13 14:26:26 UTC ( 2 years, 3 months ago )

File names

PS007XX20000584_-_Confirmation_with_Photos.DOC
90d64a26ea951d9a3e5bff68b5b877f5
db149212a43bb6832947841795f5fa15
PS007XX20000584 - Confirmation with Photos - AT.DOC
PM_4HB0U5QZU.DOC
ae9141b430caa97038c5617c0583e5a7
PS007XX20000584 - Confirmation with Photos.DOC
PM_4HB0U5QZU.DOC
PS007XX20000584 - Confirmation with Photos - 1.DOC
2ef3edba9e234aa671bc2a4ab6cd7612

SHA256:	28e5175f9dec6a1d176db23e5e4e068a0782e02c046c049d3f90b0884d626e77
File name:	PS007XX20000584 - Confirmation with Photos.DOC
Detection ratio:	5 / 55
Analysis date:	2015-12-15 10:50:53 UTC ( 2 years, 4 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in