Sample details: 6ec466818f70d18b47c615bc298e7aa9 --

Hashes
MD5: 6ec466818f70d18b47c615bc298e7aa9
SHA1: 8c272955e4e5dd948b7c6f58534fbcb412353f75
SHA256: 01430edd47143ac0c29508197aa85ec163f5a05d5b4c1a5883e78f6798cc3244
SSDEEP: 1536:8TxjwKZ09cB7y9ghN8+mQ90MTk+asueYfuy+2YFT:QxjnB29gb8onyFp+fF
Details
File Type: Composite
Yara Hits
YRP/office_document_vba | YRP/Office_AutoOpen_Macro | YRP/Contains_VBA_macro_code | YRP/domain | YRP/url | YRP/contentis_base64 | YRP/maldoc_OLE_file_magic_number | FlorianRoth/Office_AutoOpen_Macro |
Source
http://jobarba.com/wp-content/Download/VJ320265TIMWFE/804310/XCWN-MXIM
http://3music.net/107LZDOC/NUAP41075341901UB/13166/OJQW-WNEE
http://jobarba.com/wp-content/Download/VJ320265TIMWFE/804310/XCWN-MXIM/
Strings
		%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
IM?y'e
L\2B0H
F]<vM$
"$f3{)B
.>:"+>99
Jy~&9~
<Hdk+K
27`?:4Z
-9Nu+(
|YM?E[
6`9R99
n)5+]&
b	,/uH
)JnM-9n
?z1V}9
xL~+	.|-IA
y)EEvJ
Oj$VY%
]:K}Un
D!YO7>_i
<Wceok
5y-y/n
mey#"[]Kh'H
jRMkQENs
\?	~/k
@Kl8uY:
n-dd|F
%77PIs?
RVWFa4{
Jrk[[T
u2,p[M
JhSKc{
ym4k$R
m.on/n#
qS5(VT
/*h]&(
fI	|,nC
Z5!Zp#Y
[jPF^5
};6U*u&
-ty~T-
Eqio*FB
tU)5{u
?1cBP6
DRQp[;i
VsnnN_k~
-m5o*8
[Content_Types].aMo
_KAmz/.KAmz
aEHfc/aEHfc/aEHfcManager.aMo
aEHfc/aEHfc/aEHfc1.aMo
$4vq^W
MB[F7x"
>Yr]H+
a!e9#i
An7jah
aEHfc/aEHfc/_KAmz/aEHfcManager.aMo.KAmz
K(M&$R(.1
[Content_Types].aMoPK
_KAmz/.KAmzPK
aEHfc/aEHfc/aEHfcManager.aMoPK
aEHfc/aEHfc/aEHfc1.aMoPK
aEHfc/aEHfc/_KAmz/aEHfcManager.aMo.KAmzPK
dYojc version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Normal.dotm
Microsoft Office Word
Ocosihyd-PC
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\system3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
!G{2DF
8D04C-5B
FA-101B-
m Files\@Common
icrosoft
 Shared\
OFFICE16
\MSO.DLL
M 16.0
CNqWBC
iYmjonjHLlG
*\CNormalrU
ThisDocument
Project
CNqWBCqCWY
Module1
WJlciYmjonjHl
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB
C:\Windows\system32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
Document
AutoOpen
Attribut
e VB_Nam
e = "CNq
WBCqCWY"D
Normal.T
hisDocum
l False
Cr@eatabl
redecla
BE xpose
mplateDe
$Cust0omiz
b AutoOp
 Error R
x Next
   Typ
Oct(tr
Sgn@(tDUZQ
29335345!
3682163
MoVwcN
Shell@ K
C) + z@bCAiJj
EoqCElO
poJvaFp
kUzJpMrD
DPSroz WXnkF@
zX@bbXYvE
m@rtdLlr@
oLrjMjT
vGwDommV
jfWdsBY
P@vvUsTI@
LBYFOMCB
Qn, 2881
90133 -
5ChrW(vU
ID="{9E8A90FD-DE23-4DC7-A782-68CAD017AB8D}"
Document=CNqWBCqCWY/&H00000000
Module=WJlciYmjonjHl
ExeName32="dlhkDHEmjtlm"
Win64x
Project1
stdole
Project-
ThisDocument<
_Evaluate
Normal
Office
Documentj
CNqWBCqCWY
AutoOpen
TypeName
MoVwcN
ShellV
KeyString
vbKeyC
zbCAiJj
fEoqCElO.v
poJvaFp4
kUzJpMrDu
DPSrozWXnkF
zXbbXYvE
mrtdLlr
HoLrjMjT
vGwDommVncEE
jfWdsY
YzljE(
PvvUsTI
kLBYFOMCBQn
vUQknj1+
Module1b
WJlciYmjonjHl
iwEwJTc
tznkf2
oHusoELkua
rzaVzVwu
OaUzzWlx-
QwEqDBI
BawuTvBqzN
zJPOb)
wRWiuF*H
ElXrlYwpAB
WInbzR
pXjWEr
iQrTPk
icVvIOiuzjJ
lZwOwP
rkPqGFXr
aquaslB
SCmzvD|
mnRwoFACvWj
kiJolu
HGBXaI
UArHFOBZ
EkLokOS
ZjEGUL
ScDqLa
duzSYA
mUCQwZ
wIcTNl
mzVbQzJaJn
VQYmEf
Cjovjn
rXvPZl
RjNbcW
vcBwskuzf
aYNaH+
JPbnbn
TKXMDO
tzjTnBj
lKEPXjVm
dJMrst
zVnYMsPbt
DkzCRK
YbajBw
FPjtvPIjHK
wEnlwqF
sKBlGjor|
lcooRR3
RvUsEz
cVkrELHMFU
LkkIjvJ
sREmYK6
qnnwuF<
HVonhL=
ZfQivCZx
wKnmmz
dBwzjW
GmTOsrVbTHW
FvvmiWw8
rVUYIa
hCTiLu
UvrwzX
MHiGcY
ARJjrclL
PYWaEp
vrTJuvW
JzizWzm
uFNImZhAU
dWTiizoj
MkRhNp
LscYiw
FFtVwh
RuZrp;
OSzjLd
uXthQwvdEBN
LIaUl~
LjQaXO{
qjpVJOs
ISoUzT[
UUQMEb
tMwRVD~q
fGoAhUaWblX
HLtwYi0Y
zjiMza
GmrlQo
PsNtPU
EbNknnYwil
izKDuub
zChFQL=6
QDuUQKFi
QnOGmw
TfDJJZ
UDcwE3
PapNWow
YpUCQEP'
lRHlUE
icDNfvJS
CvzHjt
lizkj|
uFPrsn
pqVLwvX>
sHJLvA
vPDYDY
SCisE"
jmHAoIYc
VuREki
uszfnQuB_B
qaVGfXj
zKnTop4
VHHjjLQj9
rozNKM
ZBbjM/"
AlHfjP0
lKbswp
ThoCYZ
ErRws@
ZbJSJAN
rJbpfG
KSuhoCnHqad(?
HiYCp&
PPSllNb
KwwUi~s
dNGkHlIkC
GMPUAO
CUJLtAXz
wSEbwDzESt
DYmZCtDf=
jKhCcS~H
wWsLNM
tzYNlklNwi
OfESt0
ZbknQY
dwbLpnY
wthHVOwwS
cKzVdb
anqMtk
SdhwimT
oYqzKoPciq7
APQsWlovUDK
HfkCZY
IZtAVP
EJjpnQI
iNuwwTwUd
Cwuow'
lbqsVW
VoaQBUh
mfJIzj
LRoRSlZ-
HzVScHFjfnC
AqPrSY
fZXzp#
BMmZou
DQasVB9
TQZlMd
lRXlbOYdULq
fwKiGS~
wXfsf1
NjwVdwmF
qKPVRB\|
WwccNX#
SMcdsZDCv
BkdkiKSuWj=
hOniIkhtzFo#
isIwbb
bMGiOK
CrkXiQ%i
idDpaz
qnRJQi6}
jdIJAO
CJfBRvOErJR
tnvwYLfZe
QkbChz
ohuTHT
ajBwazWlrDnLpo;
BwZNwwzwCTGYzGG8
NHqPDrcBlO
mnFfbBpBoTBdjEj
UMsPnIF+
swQUjj
ZwRNWL
ae86-4
ng.Dat 
3a6c6f 
-901f-
9b4b7d
ta.Act 
.Model
.Netwo
KQH2uc
fice.S 
dience 
SdkVer 
imeZon
ientId 
em_act 
forman
.Netwo
fice.P
6.775Z
entInf
entInf
erInfo
ssion. 
.Netwo
ent.Sa 
ersion 
.0.103i
cking.
4" }, 
rammar
rammar
 "34"  
 "Micr 
 "P" :
9:34.3 
"C" : i
Teleme
ableEC
"V" : 
bled", 
se, "S
, "P"  
33360Z 
Attribut
e VB_Nam
e = "WJl
ciYmjonj
ction po
JvaFp()
On Erro@r Resu
iwEwJT 
soELkua
m" + "d Q
Str(Chr(
rzaVzVw
OaUzzWl
	BawuT
vBqzN))
(zJPOb *
 wRWiuF
ElXrlYwp
r(97097 
/ WInbzRA
BpXjWE
W(294394
vIOiuzjJE
gJ3gn(rSI
blZwOw
/B(131@450292
kPqGFXr
{Hex(aq
uasl - S CmzvD
RwoFACvW
tn(8195
@kiJolu
@UArHFO
&D26I%274
CUZ jEGUL`]Sc
57447A
s(duzSYA
wIcTNl
mzVbQzJ
!!5nlok
$I:Rpkzq
VQYmEf
1C!38D
+ i|+ 
ix(16818
`QCjovjn
kUzJpMr$Du
n(62148
@RjNbcW
vc@Bwskuz
.;m$Q6d+
JPbnbn
CInt(iKH
TKXMDO
tzjTnB
LmD G"9DY
4cM;540
\@lKEPXj|
d0JMrs
zVnYMs(Pbt
S7;?EJ
W(@DkzCRK
Byte(Yba
vPIjHK!
?CDbl(W
l1Y366
432344,	A
@wEnlwq
og(1093
Q`lcooRl	
,R vUsEz@(70
VkrELHMF
7a$v@ 
0+ C,+
Oct(Lkk
ozWXnkF
B%sREm
,qnnwuF
jHVonhLP(
JqmfQ(ZfQ
dBwzjW
GmTOsr
VbTHWA
FvvmiW
 rVU|YI
WzlYf!
b4402`
MHiGcY
ARJjrc|lL
PYWaEp@
@vrTJuv
Bpool(
XbbXYvE?7
W19229
JzizWM
uFNImZhA
1Pk(741
MkRhNpA@
F`FtVwh
TypeName
 KazmJ
uXthQwvd
EBN = "5
" + ";4
(1;3	8;
 LIaUl
t(TNGuO 
- LjQaXOA
q@jpVJO)
MPvYEC
CDate(84
+Sgn(462@608407
U UQMEb
CInt(890
g61988
hUaWblX
Log(HL
twYi / z jiMza
nnYwil
Str(9485
1 * izKD
J3102 83935
QD@uUQKFiA!5
tn(QnOGm
wL'ChrW(i
EzXbbX
YvE@1uFNI mZhAU@[OS0zjLd
#AKSUDcwE
P apNWo
Function
Error Re
Next)]
icDNfvJSu
<9"?;52
pqVLwvm
iH(sHJLv
Sqr(wO
CjJ,QCSng (vPDY
*&Fix(9
szfnQuB
RVzEzA
C![Aom
jlKbsw
73871p
`ThoCY
ZbJ,SJA	).2
PPSllN
>B;14907A
1402f0
	TCLP>
F+ u5@+ 
7$+ C1+ 
332=]pfKwt
hrB(GpMPUA
HoLrjMjT
wSEbw`DzEStQ 433?
@os@(zmVDk
+13032
jKhCcS
 wWsLNPPtz
C@$9#?P
ZbkxnQY
uE16;C@
Tan(d wbLpn
hHVOww
	zpdNj
K* c KzVdb
55061@
 KPbhc 
qzKoPciq
APQsWlo
 CByte(H
fkCZY -  DatTj
763 / IZ
  TypeNa
me 39543
unction
 vGwDo
mmVncE(
On Error  Resu
RNe0xt
{1069`79017
8EJjpn
QI = "8"@ + ";2
@RmQmB
3013896
iNuwwTwU
)nd(49
2284812
46193489
k63570
k Cwuow
(VoaQBUL,
&@mfJIzj
og(LRoRS
HzVScH
m7Fq4I*fTl
OAqPrS
-AtAnGA@%ZrYqJ
+ Df+ 
BMmZou
@jfWdsY 
gn(TQZlM&d
XlbOYdUL
9*;e=1
HElrfK
 wXfsf
rB(8904
NjwVdacq
CSng(iBu
$Bkdki
60cY%5
iIkhtzFo
iPiQusK
 OtDio
e Fix@(isIwb
XiQ * id0Dpaz
x(hXbZi
37787808
NGFhf?
i7Co$s(
qn(RJQ
e(@jdIJAO
7201446
A0tn(3
ldZzqT
	QkbChz
 CStr(
jBwazWlr DnLpo
ZNwwzwCT
NHqPDrcB
lA'mnFfbB
pBoTBdjE
-swQUbj
Q(Z`wRNWLp
e="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="BDBF9859E812EC12EC12EC12EC"
DPB="7A785F201D211D211D"
GC="373512E772192E1A2E1AD1"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
CNqWBCqCWY=0, 0, 0, 0, C
WJlciYmjonjHl=25, 25, 1385, 693, 
CNqWBCqCWY
WJlciYmjonjHl
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
Normal.dotm
Microsoft Office Word
Ocosihyd-PC