Sample details: 421a3e7b7583166ead3b0e6c9fda7a73 --

Hashes
MD5: 421a3e7b7583166ead3b0e6c9fda7a73
SHA1: cdc3d8fcf0c1890267bc3d445765cb773ae189b8
SHA256: d9f8ab50d362072a228b35c072bb71248eb2d4dba69618ed838442a90221522e
SSDEEP: 1536:jTxjwKZ09cB7y9ghN8+mQ90MTS+aUFvztj1quRlsjXG:HxjnB29gb8onnvztcuDKXG
Details
File Type: Composite
Yara Hits
YRP/office_document_vba | YRP/Office_AutoOpen_Macro | YRP/Contains_VBA_macro_code | YRP/domain | YRP/url | YRP/contentis_base64 | YRP/maldoc_OLE_file_magic_number | YRP/Big_Numbers0 | FlorianRoth/Office_AutoOpen_Macro |
Source
http://dpicenter.edu.vn/default/US/Latest-invoice-with-a-new-address-to-update/
http://dpicenter.edu.vn/default/US/Latest-invoice-with-a-new-address-to-update
Strings
		%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
IM?y'e
L\2B0H
F]<vM$
"$f3{)B
.>:"+>99
Jy~&9~
<Hdk+K
27`?:4Z
-9Nu+(
|YM?E[
6`9R99
n)5+]&
b	,/uH
)JnM-9n
?z1V}9
xL~+	.|-IA
y)EEvJ
Oj$VY%
]:K}Un
D!YO7>_i
<Wceok
5y-y/n
mey#"[]Kh'H
jRMkQENs
\?	~/k
@Kl8uY:
n-dd|F
%77PIs?
RVWFa4{
Jrk[[T
u2,p[M
JhSKc{
ym4k$R
m.on/n#
qS5(VT
/*h]&(
fI	|,nC
Z5!Zp#Y
[jPF^5
};6U*u&
-ty~T-
Eqio*FB
tU)5{u
?1cBP6
DRQp[;i
VsnnN_k~
-m5o*8
[Content_Types].lMd
_HnOW/.HnOW
JKhpZ/JKhpZ/JKhpZManager.lMd
JKhpZ/JKhpZ/JKhpZ1.lMd
$4vq^W
MB[F7x"
>Yr]H+
a!e9#i
An7jah
JKhpZ/JKhpZ/_HnOW/JKhpZManager.lMd.HnOW
K(M&$R(.1
[Content_Types].lMdPK
_HnOW/.HnOWPK
JKhpZ/JKhpZ/JKhpZManager.lMdPK
JKhpZ/JKhpZ/JKhpZ1.lMdPK
JKhpZ/JKhpZ/_HnOW/JKhpZManager.lMd.HnOWPK
POiAd version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Normal.dotm
Microsoft Office Word
AElijagabulaezhoc-PC
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\system3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
!G{2DF
8D04C-5B
FA-101B-
m Files\@Common
icrosoft
 Shared\
OFFICE16
\MSO.DLL
M 16.0
tUYtrEjM
miINbfG
*\CNormalrU
ThisDocument
Project
Attribut
e VB_Nam
e = "Mmi
unction 
azFJYQMI
n Error 
 zKUsf
umd @" + "/
(Chr(Qot@NIrinN
RkEUYub
ifiUNLVj
HSBMiW
Sgn(784
W(22720
"@zziOqV
sPYaDp
	oRu	?Rou	
6Sin( wGNZY
7419199
raLzYM
iB	7Cos(
EKwiGC -
 49061 /@ 47893
WJuTiMdDId
dSJ*Dbl(P diToW@
Date(3
1535 * 5
0540@;158ABnaqABw@
DjslESQlRv
WI-ljF
CSng (1953
W(812732
zCktj kPjpi
Kl7NW38 10123
ol(XFkCt
&ZvuXwTA
ZdYNFA
!Lotpilwf
pbOT vTrks,
JfJsPur
 MBYdX
prYqVVEU
lC#@30End 
sZPHBKX?
9i0lMdz
3B(@WINjEM,
iuTjzL
q"nIlGLw
>DWBRIZ
mqrlDom
nYtGzD
e`r6945D09
EFix O7
YLfdiKAp
85136p
\XLB|zq
pSEvhuA
Xcnwa0
xOct(41
352398-
{ jsIOq
aijrUjR
9183268l9 FXFQw
zvChRWk"	4
6kFFwm
Atn(bp
5629B8
397@647981+
7 611220oSr
JzGEJDfS
	T0uBmW
	Sih@qpztBF2
8Jaavm
uVJJjn
bRrXiRNxiEs
qThYpl
Sh EaMQS
wEDzfk
(uzETnB
1740P 9
d(ZhYbF
J abzRu
}SO+ $F+ K
*IwfYB
Q40828A
[aPCW!g?
QhlnuWF
48342859
	jSfSts
5qYpzGw
iLjislC1%
" + "0;
ypeName 
CStr(NSl
`Byte(lr
36193 / @wWMCzL
Iiiqjn =0 "49
Fix(63
tqDQNi
EOTjj,wo
Lng(87
p19418
nKJBZl
HiVdCH
CsWrGzw
BhrB(S
BqE@jtvEuGA 6
K;CBCP;40C%
n4164578
 Sgn(E
tljmchNYxOMm
pQhlnuW FPNOl
GwiLjisl
kNRMlQO
+ Igd+ 
rW(22805
XWPdjj
54077 * 
 jOaZF
d Functi
mOMnYWrm
	On Err
or Resu
NextH]Int
dirjRzAK"fYkCiK
I iUtNv
Ks8rfN
ZVSGjz
pDRHCIp
 CkmXO
6c	Fkv3
Em0).CDbl( mriJCL
Ta0n(58
Rjfwvw -@ FVLDB
PvcnDDQ,$RcX@AW
VHKCsU
OF#m=CN
=a!JPs
itGwDDa
(GZJvRt
Fmsjhp
MMwlLmvS
313 21180
- 4355
7p(wQtEk`S@jvSUlqp
GjjIOL"	
#OH+ FcF+ e>+$ n
'+ 	"+ 
]A^ nXTHVzro]e l]C
e* 808834
_jRGUSjN
%C'2Z/
pOLkAkoLI
JAqOFwi
3Sqr(2
 RZibPjw
@vzCKqP@*z
+ sXmi
.W(jwWk"E
^znfaM
ffziUoQ
fXrjLMA
Oct(1861@l063\
mYXUcLCP
`WhlHX+
fzEwq?
iEFZRk
MIdIBw,
jILVSRYS
52830083
; 75942p
SlGubhU
W+ 9Q+ 
@+ X9+ 
-+ e%+ g
Name 105
   Typ
Chr(23
170 / Zi
d Functi
rSGWHbvG
HOn Err
or Resu
t0ruOW
wIs = ";
5" + "7
x(CkoPOl
qwZ MapsF
=j Lnamw
Dbl@(sSMIK
ZFMahK
Atn(26
p@pMBNnr
7DH	[ut(DWY
n(XwsaJc
:foRcKzv
2777931L
hDBWbhXP
BISwjJb
Round(OR
N BBXQX
(pQQPNw
CDate(U
LlzAccCdl4JwA
B+ I5+ 
ol( z04 -
 KwQCUS
haOM B
zGFMWfkPpLqQ
266 * zb(tbF
qCkkoEMt
SA12C+#+
1#T9D218$
pVw "NCAI
YbztpXa
BMYYzAU
hRLLZHcok
j#<818@f07a
m3514248
FnszFHa
64lMos(iX0jFNZ
BthHtvh
Oct@(19002`7U dwFSI
an(86195
LhrB@(jOanj\
U0ZthjO<S
XaAAoBhd
IVtYNvj
#5<;4t
5253586
A 558758@1j
ipSMrzi
LjdfoVrq
q(jnb2
U HFNWW
'qG qafbLA
AS1vsQAd
Sbi`=532
 vCOtHd
(CSizUs
	40144
044287
JNVpF`qCzNJ
ItLwQWIZ
FOIzJt
TQcZCPJA
MKBSF))
tUYtrEjMQimj
Module1
MmiINbf
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB
C:\Windows\system32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
Document
AutoOpen
Attribut
e VB_Nam
e = "tUY
trEjMQim
1Normal
.ThisDoc ument
lFalse
Creatabl
Predecl
BExpose
Template Deriv
stomiz
Sub Auto
Open()
On Error
58075 - 
aramO +  33705
(56683 /
 jGiWz *
 wqMLEt
@wnwfUh
in(BmtET
Cos(61
AMMfUjuA
hell@ Ke
ng(vb	
JYQMIISH
sZHBKX
QhlnuWFP
YrmO@MnYWrm
n XTVzr
rSGWHbvG
zGFMWfk
AAoBhdF
vCOtHdth
BNwfkfY
QKWTmQj
NVUcj, 1
ChrW(812
EDbl(80!@
End @t
ID="{0B8D1C71-E8A6-441D-846F-DD728768C1E0}"
Document=tUYtrEjMQimj/&H00000000
Module=MmiINbf
ExeName32="QKJkiYd"
Name="Projec
Win64x
Project1
stdole
Project-
ThisDocument<
_Evaluate
Normal
Office
Documentj
tUYtrEjMQimjm
AutoOpen
TypeName
aramOP8
jGiWz#
wqMLEt
wnwfUh
BmtETP
MMfUjuG
ShellV
KeyString
vbKeyC
GjfRkQHb
OQJjlNYb
azFJYQMIISH
sZHBKXD
QhlnuWFPNOl
YrmOMnYWrm0"
nXTVzr
EQrSGWHbvGWS
zGFMWfkpLqQ_
cXaAAoBhdF
vCOtHdth
BNwfkfY
QKWTmQjNVUcj
Module1b
MmiINbf
KAJGzXmvM
QotNIrinN
dRkEUYub
jcwwuifiUNLVjm
HSBMiWb
zziOqV
FraLzYMOn)C
EKwiGC*
sJrGAa
WJuTiMdId
PdiToW
tBKzjK
aqABw"q
jDjslESQlvT
ljFKvV+
zCktjkPjpiJ(
XFkCtP:
ZvuXwTEu
otilwf
TvTrks
fusUciEMza
nGmLMw
fJsPurYD
nNnREVvK
NfiprYqVVEU
ilMdztd
WINjEM
iuTjzL
DWBRIZx
mqrDo1
nYtGzDOUZ
FjvrHj |
pSEvhu,u
jsIOq<J
jzNZFA
ARFSMu?E
aijrUj
FXFQw^
PLHImz
KzvCRWkU
kFFwmd3a
bpdRJs
AmcabJ
RjHYvPDoL
SrJzGEJDfSB
JzCPMl
SihqpztBFi
Jaavmw
bRrXiRNiEs
hEaMQSp
dXUurRY
wEDzfkuDzO,
uzETnB2
wnhYZX@
LhlpFH
iDDRmfj
IwfYBo{K
slswv(:
oFudwK[
jSfStst
pzGwiLjislC
njMlIA
NRMlQO-
lrlibw
wWMCzL}}
EIiiqjn
qDQNia
EOTjjwo
NhdBuG+
oErmuJ0?
nKJBZl
HiVdCH%
CsWrGzwYiIv
BqEjtvEuG
EntXfx
tljmchNYOMm
XWPdjj	
jOaZFI
IiUtNv3t
FKsrfN
ZVSGjzj
pDRHCIp
nEHHpscT
CRcXv{h
WVHKCsUo&
CNAfkmD
JPsmiK.
lzzaRitGwDD
IqLIZ)<
QpTdfT
OPLOGMt
GZJvRt*
Fmsjhp-
MMwlLmS
wQtEk>
jvSUlqhm
IGjjIOL
FahMiH
jRGUSjNFF
VnOLNU
LkAkoLIfiFs
wCJvAo#
JAqOFwidsX9
ZibPjw
vzCKqP
zVAjQm
lRUCqP
sXmiFF\
jwWkE:
nnDSCcC
znfaMK
SlIffziUoQ
rWUzjY
fXrjLM
mYXUcLCPz
iEFZRkzP`
uziXvLwrA
MIdIwi
wjILVSRYSz~
SlGubhUzFia
ZislM2
jHJOwIs
CkoPOl
qwZMapsFm
jLnamwAs
OmGiFs
CZFMahK1Y
amtLGi
ppMBNnr.a
utDWY9;
XwsaJc
foRcKzvBFNQ
ihDBWbhXPKA
ISwjJb
ORUIwz
WiioIM
NBBXQXBR
pQQPNw?v
cCdlJw
KwQCUS
bXVoIq'
zbtbFB
CkkoEMtSW+
QipVwh
NCAIzy
YbztpXa(
YYzAUts
CAohRLLZHco
sBVsmFnszFH
iXjFNZ
BthHvhA
UdwFSId&
sfRSri
rmvhlN0
wSLpkqVE
mAhtF"
PtiMSZk
hOTEdC
aIVtYNvjF
ZClbw(
HdLHws
FOGmYu
jipSMrzi
ldSGM'
jLjdfoVrqv)F
qjnbrlm
ScsjzR
HFNWWZ
qGqafbL
vsQAdK
CSizUs'|
wWhRbnbd`
JNVpFqCzNJ
jItLwQWIZkM
OIzJtlAHi
TQcZCPJALTQ^
lSXzpMKBSF1r
HelpContextID="0"
VersionCompatible32="393222000"
CMG="FCFE1A18EA10EE10EE10EE10EE"
DPB="F8FA1EE11FE11FE1"
GC="F4F61220F21DF31DF3E2"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
tUYtrEjMQimj=0, 0, 0, 0, C
MmiINbf=25, 25, 1385, 693, 
tUYtrEjMQimj
MmiINbf
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
Normal.dotm
Microsoft Office Word
AElijagabulaezhoc-PC