Antivirus scan for 323858d729f1b817e46ba5611dcc3db4f75ab5aff755816ac0f3377fe00ad205 at 2015-03-31 07:59:26 UTC

Antivirus	Result	Update
AVware	LooksLike.Macro.Malware.d (v)	20150331
CAT-QuickHeal	W97M.Dropper.DT	20150331
McAfee	W97M/Downloader.afg	20150331
McAfee-GW-Edition	W97M/Downloader.afg	20150330
VIPRE	LooksLike.Macro.Malware.d (v)	20150331
Ad-Aware		20150331
AegisLab		20150331
Yandex		20150330
AhnLab-V3		20150331
Alibaba		20150331
ALYac		20150331
Antiy-AVL		20150331
Avast		20150331
AVG		20150331
Avira (no cloud)		20150331
Baidu-International		20150330
BitDefender		20150331
Bkav		20150330
ByteHero		20150331
ClamAV		20150331
CMC		20150330
Comodo		20150331
Cyren		20150331
DrWeb		20150331
Emsisoft		20150331
ESET-NOD32		20150331
F-Prot		20150331
F-Secure		20150331
Fortinet		20150331
GData		20150331
Ikarus		20150331
Jiangmin		20150330
K7AntiVirus		20150331
K7GW		20150331
Kaspersky		20150331
Kingsoft		20150331
Malwarebytes		20150331
Microsoft		20150331
eScan		20150331
NANO-Antivirus		20150331
Norman		20150331
nProtect		20150330
Panda		20150330
Qihoo-360		20150331
Rising		20150330
Sophos AV		20150331
SUPERAntiSpyware		20150331
Symantec		20150331
Tencent		20150331
TheHacker		20150330
TotalDefense		20150330
TrendMicro		20150331
TrendMicro-HouseCall		20150331
VBA32		20150330
ViRobot		20150331
Zillya		20150331
Zoner		20150330

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May open a file.

May write to a file.

May perform operations with other files.

May create OLE objects.

May execute code from Dynamically Linked Libraries.

Seems to contain deobfuscation code.

Summary

last_author

creation_datetime

2015-01-19 17:07:00

template

Normal.dot

author

page_count

last_saved

2015-03-31 08:15:00

edit_time

19860

revision_number

644

application_name

Microsoft Office Word

code_page

Cyrillic

Document summary

line_count

version

730895

paragraph_count

code_page

Cyrillic

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] 1Table

[+] Macros/F3/\x01CompObj

[+] Macros/F3/\x03VBFrame

[+] Macros/VBA/PIDLE0

[+] Macros/VBA/SIDL22

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/dir

[+] WordDocument

Macros and VBA code streams

[+] ThisDocument.cls Macros/VBA/ThisDocument 31 bytes

[+] OIDL8.bas Macros/VBA/OIDL8 785 bytes

obfuscated

[+] PIDLE0.bas Macros/VBA/PIDLE0 2069 bytes

exe-pattern run-dll

#If VBA7 And Win64 Then
Public Declare PtrSafe Function SEEEGMATICKS1222 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As LongPtr) As Long
Public Declare PtrSafe Function SEEEGMATICKS122 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As LongPtr
Public Declare PtrSafe Function SEEEGMATICKS21 Lib "wininet.dll" Alias "InternetReadFile" (ByVal cCCc3333 As LongPtr, ByVal SA33LOOOOMMA442 As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Public Declare PtrSafe Function SEEEGMATICKS1 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As LongPtr, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As LongPtr
#Else
Public Declare Function SEEEGMATICKS1222 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As Long) As Long
Public Declare Function SEEEGMATICKS122 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As Long
Public Declare Function SEEEGMATICKS21 Lib "wininet.dll" Alias "InternetReadFile" (ByVal cCCc3333 As Long, ByVal SA33LOOOOMMA442 As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Public Declare Function SEEEGMATICKS1 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As Long, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As Long
#End If


Public Const WIIIN34DIS6 = "3F0112190458280705090B150B031F1902"
Public Const WIIIN34DIS5 = "30021B1A18131B455B5C00580F0F13"
Public Const WIIIN34DIS4 = "041D030552594607070A00170D1206581F0819110A19115905170D050F0500131E471F0047435D58425D4C131212"
Public Const WIIIN34DIS3 = "3F0A051C18020019124B241F0612250F1F1 [... continues ...]

[+] IDL4.bas Macros/VBA/IDL4 89 bytes

[+] FILE6.bas Macros/VBA/FILE6 1210 bytes

create-ole open-file

[+] IDL3.bas Macros/VBA/IDL3 262 bytes

[+] SIDL22.bas Macros/VBA/SIDL22 1875 bytes

handle-file open-file write-file

ExifTool file metadata

SharedDoc

Author

CodePage

Windows Cyrillic

LinksUpToDate

LastModifiedBy

HeadingPairs

, 1

Template

Normal.dot

CharCountWithSpaces

CreateDate

2015:01:19 16:07:00

CompObjUserType

???????? Microsoft Office Word

ModifyDate

2015:03:31 07:15:00

HyperlinksChanged

Characters

ScaleCrop

RevisionNumber

644

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

11.9999

Security

None

Software

Microsoft Office Word

TotalEditTime

5.5 hours

Pages

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

File identification

MD5 2f53b7669482c2d9216a74050630fbb7

SHA1 a574c4eef4fcc0d1172b7921444fdad136aa6d60

SHA256 323858d729f1b817e46ba5611dcc3db4f75ab5aff755816ac0f3377fe00ad205

ssdeep

384:bV6SHHDZFpsGHcId1QGzbSP1EhdXJ3LX41RDtoAW1hO2/Ig0jAr9bCBWUnpUbM:rndFpsqca1v4KbXguAWSEZ9bwWUnp1

File size 51.0 KB ( 52224 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: 1, Template: Normal.dot, Last Saved By: GN, Revision Number: 644, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:31:00, Create Time/Date: Sun Jan 18 16:07:00 2015, Last Saved Time/Date: Mon Mar 30 07:15:00 2015, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0

TrID	Microsoft Word document (80.0%) Generic OLE2 / Multistream Compound File (20.0%)

VirusTotal metadata

First submission 2015-03-31 07:54:03 UTC ( 3 years ago )

Last submission 2016-01-02 13:04:12 UTC ( 2 years, 3 months ago )

File names

APIPO1.docxx
APIPO1__1.doc
APIPO1(4).doc
suspect1.doc
2f53b7669482c2d9216a74050630fbb7.doc
APIPO1.doc
a574c4eef4fcc0d1172b7921444fdad136aa6d60.doc
FOPRT01.DOC

SHA256:	323858d729f1b817e46ba5611dcc3db4f75ab5aff755816ac0f3377fe00ad205
File name:	APIPO1.docxx
Detection ratio:	5 / 57
Analysis date:	2015-03-31 07:59:26 UTC ( 3 years ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in