Other Worm not is detected

[jeffersonsant]

very strange another file with the same sender
Boleto01726319.vbe, but now only 3 antivirus detected.

https://www.virustotal.com/en/file/b1ed6708f21d5f7083b0e1dad4b11e9ed17496f3262aba81875acee8464d70ba/analysis/1439679733/

[Secondmineboy]

Try to scan the unzipped File

[jeffersonsant]

@Steven Winderlich post:2

Try to scan the unzipped File

same result found nothing
see attached

I unzipped it and verify the result again

Boleto.vbe

Detection 16 / 56

https://www.virustotal.com/en/file/4bf498cc6fc58d28fc839b91581f52eb6faac260a9535a2c86add9e5c5d98d25/analysis/1439755229/

Boleto01726319.vbe

Detection: 4 / 56

https://www.virustotal.com/en/file/c77f6af6f309db2d25246ad78332baf6d9fc4e0d11b457059acf850acd692895/analysis/1439755871/

[HonzaZ]

They try to download content from hxxp://mastercash2984.cepcerto.info/01/, which isn’t active any more. I will create detections for the files though (both encoded VBE files and deobfuscated VB scripts).

[jeffersonsant]

@HonzaZ post:4

They try to download content from hxxp://mastercash2984.cepcerto.info/01/, which isn’t active any more. I will create detections for the files though (both encoded VBE files and deobfuscated VB scripts).

I have already sent via virus@avast.com
so far no reaction,wait the next update.
Thank you

---

avast detects both as VBS:Malware-gen in VPS update 150822-0
release date 22/08/15