| SHA256: | 7c344293212b1de4798beb0cf70c9bec493460d5befba2eef1ce26a83c04ad2f |
| File name: | Invoice.doc |
| Detection ratio: | 15 / 58 |
| Analysis date: | 2018-02-06 06:01:59 UTC ( 1 year ago ) View latest |
| Antivirus | Result | Update |
|---|---|---|
| Ad-Aware | VB:Trojan.VBA.Downloader.IC | 20180206 |
| Arcabit | HEUR.VBA.Trojan.e | 20180206 |
| BitDefender | VB:Trojan.VBA.Downloader.IC | 20180206 |
| Cyren | W97M/Downldr | 20180206 |
| Emsisoft | VB:Trojan.VBA.Downloader.IC (B) | 20180206 |
| ESET-NOD32 | a variant of Generik.IJKTOWC | 20180206 |
| F-Prot | New or modified W97M/Downldr | 20180206 |
| GData | VB:Trojan.VBA.Downloader.IC | 20180206 |
| eScan | VB:Trojan.VBA.Downloader.IC | 20180206 |
| Qihoo-360 | virus.office.qexvmc.1090 | 20180206 |
| Symantec | W97M.Downloader | 20180205 |
| TrendMicro | W2KM_POWLOAD.UHAOEBI | 20180206 |
| TrendMicro-HouseCall | W2KM_POWLOAD.UHAOEBI | 20180206 |
| ZoneAlarm by Check Point | UDS:DangerousObject.Multi.Generic | 20180206 |
| Zoner | Probably W97Shell | 20180206 |
| AegisLab | 20180206 | |
| AhnLab-V3 | 20180206 | |
| Alibaba | 20180206 | |
| ALYac | 20180206 | |
| Antiy-AVL | 20180206 | |
| Avast | 20180206 | |
| Avast-Mobile | 20180205 | |
| AVG | 20180206 | |
| Avira (no cloud) | 20180205 | |
| AVware | 20180206 | |
| Baidu | 20180206 | |
| Bkav | 20180205 | |
| CAT-QuickHeal | 20180205 | |
| ClamAV | 20180206 | |
| CMC | 20180206 | |
| Comodo | 20180206 | |
| CrowdStrike Falcon (ML) | 20170201 | |
| Cybereason | 20180205 | |
| Cylance | 20180206 | |
| DrWeb | 20180206 | |
| eGambit | 20180206 | |
| Endgame | 20171130 | |
| Fortinet | 20180206 | |
| Ikarus | 20180205 | |
| Sophos ML | 20180121 | |
| Jiangmin | 20180206 | |
| K7AntiVirus | 20180206 | |
| K7GW | 20180206 | |
| Kaspersky | 20180206 | |
| Kingsoft | 20180206 | |
| Malwarebytes | 20180206 | |
| MAX | 20180206 | |
| McAfee | 20180206 | |
| McAfee-GW-Edition | 20180206 | |
| Microsoft | 20180206 | |
| NANO-Antivirus | 20180206 | |
| nProtect | 20180206 | |
| Palo Alto Networks (Known Signatures) | 20180206 | |
| Panda | 20180205 | |
| Rising | 20180206 | |
| SentinelOne (Static ML) | 20180115 | |
| Sophos AV | 20180206 | |
| SUPERAntiSpyware | 20180206 | |
| Symantec Mobile Insight | 20180202 | |
| Tencent | 20180206 | |
| TheHacker | 20180206 | |
| Trustlook | 20180206 | |
| VBA32 | 20180205 | |
| VIPRE | 20180206 | |
| ViRobot | 20180206 | |
| Webroot | 20180206 | |
| WhiteArmor | 20180205 | |
| Yandex | 20180204 | |
| Zillya | 20180205 |
The file being studied follows the Compound Document File format!
More specifically, it is a MS Word Document file.
Commonly abused properties
The studied file makes use of macros, a macro is a series of commands
and instructions that you group together as a single command to accomplish a task automatically.
Macros are often abused to perform malicious tasks when working with a document.
May try to run other files, shell commands or applications.
Seems to contain deobfuscation code.
Summary
creation_datetime
2018-02-05 10:26:00
revision_number
1
author
bOEbiVJd
page_count
1
last_saved
2018-02-05 10:26:00
word_count
4
template
Normal.dotm
application_name
Microsoft Office Word
character_count
25
code_page
Latin I
Document summary
line_count
1
characters_with_spaces
28
version
1048576
paragraph_count
1
code_page
Latin I
OLE Streams
Macros and VBA code streams
ExifTool file metadata
SharedDoc
No
Author
bOEbiVJd
HyperlinksChanged
No
System
Windows
LinksUpToDate
No
HeadingPairs
Title, 1
Identification
Word 8.0
Template
Normal.dotm
CharCountWithSpaces
28
CreateDate
2018:02:05 18:26:00
Word97
No
LanguageCode
English (US)
CompObjUserType
Microsoft Word 97-2003 Document
ModifyDate
2018:02:05 18:26:00
Characters
25
CodePage
Windows Latin 1 (Western European)
RevisionNumber
1
MIMEType
application/msword
Words
4
FileType
DOC
Lines
1
AppVersion
16.0
Security
None
Software
Microsoft Office Word
TotalEditTime
0
Pages
1
ScaleCrop
No
CompObjUserTypeLen
32
FileTypeExtension
doc
Paragraphs
1
LastPrinted
0000:00:00 00:00:00
DocFlags
Has picture, 1Table, ExtChar
File identification
MD5 13aaa5c6814602b7ed379812f63c86b0
SHA1 adbcb557eb4d30e20e9856080dd8755e1404da7d
SHA256 7c344293212b1de4798beb0cf70c9bec493460d5befba2eef1ce26a83c04ad2f
ssdeep
3072:86WSYlfQ+81s/vVTko1/t7Lexvklut3y:OBx/tTko1l7LNlEi
File size
119.5 KB ( 122368 bytes )
File type MS Word Document
Magic literal
CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: bOEbiVJd, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sun Feb 04 18:26:00 2018, Last Saved Time/Date: Sun Feb 04 18:26:00 2018, Number of Pages: 1, Number of Words: 4, Number of Characters: 25, Security: 0
| TrID |
Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%) |
Tags
obfuscated
macros
run-file
doc
VirusTotal metadata
First submission
2018-02-05 18:30:00 UTC ( 1 year ago )
Last submission
2018-12-13 00:10:58 UTC ( 2 months, 1 week ago )
| File names |
Outstanding Invoices.doc Information Informationen #0543656336.doc Invoice# 8730594.doc Order Confirmation.doc BKKM8-6029469445.doc LPYQJ5-4021508304.doc 13aaa5c6814602b7ed379812f63c86b0.virobj #2352207.doc Invoice Number 04495.doc Rechnungs-Details #985271799971.doc RECHNUNG 83176 #5038415.doc Invoice Number 492565.doc Purchases 2018.doc RECHNUNG 03154 #3635250265.doc RECHNUNG 17853 #8899148.doc Scan #990633430588.doc Dokumente vom Notar #2809650.doc Dokumente vom Notar #3663803.doc Invoice Number 772516.doc RECHNUNG 19334 #9306732.doc Invoice Number 993173.doc Dokumente #327899680.doc Order Confirmation (17) Dokumente #73231985.doc |
No comments.
No VirusTotal Community member has commented on this item yet, be the first one to do so!
You have not signed in. Only registered users can leave comments, sign in and have a voice!
No votes.
No one has voted on this item yet, be the first one to do so!