├── CArg.cls ├── CFunc.cls ├── CRefactor.cls ├── CToken.cls ├── CTokenizer.bas ├── Form1.frm ├── Form1.frx ├── Indent.cls ├── LICENSE ├── Project1.vbp ├── Project1.vbw ├── clsCmnDlg2.cls ├── modParse.bas ├── modSyntaxHighlighting.bas ├── readme.txt ├── screenshot.png ├── test ├── test2.txt ├── tests ├── 72676_word_macros │ ├── E3ofjh.frm │ ├── E3ofjh.frx │ ├── MKKdfgtGTZUMw.frm │ ├── MKKdfgtGTZUMw.frx │ ├── MPcAq0.bas │ ├── RA5yujSIgHYc.bas │ ├── ReisaWtkGEK2g.bas │ ├── VhmNrPNhZaam.frm │ ├── VhmNrPNhZaam.frx │ ├── gP39AxZgbtPq7Av.bas │ ├── oFtRyMlcM.frm │ └── oFtRyMlcM.frx ├── attribute.txt ├── byval.txt ├── const.txt ├── noargs ├── test1.vbs_ └── test2.txt ├── vbScript_deobsfuscator.exe └── versions └── 5-9-16_vbScript_deobsfuscator.7z /CArg.cls: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/CArg.cls -------------------------------------------------------------------------------- /CFunc.cls: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/CFunc.cls -------------------------------------------------------------------------------- /CRefactor.cls: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/CRefactor.cls -------------------------------------------------------------------------------- /CToken.cls: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/CToken.cls -------------------------------------------------------------------------------- /CTokenizer.bas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/CTokenizer.bas -------------------------------------------------------------------------------- /Form1.frm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/Form1.frm -------------------------------------------------------------------------------- /Form1.frx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/Form1.frx -------------------------------------------------------------------------------- /Indent.cls: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/Indent.cls -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/LICENSE -------------------------------------------------------------------------------- /Project1.vbp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/Project1.vbp -------------------------------------------------------------------------------- /Project1.vbw: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/Project1.vbw -------------------------------------------------------------------------------- /clsCmnDlg2.cls: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/clsCmnDlg2.cls -------------------------------------------------------------------------------- /modParse.bas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/modParse.bas -------------------------------------------------------------------------------- /modSyntaxHighlighting.bas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/modSyntaxHighlighting.bas -------------------------------------------------------------------------------- /readme.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/readme.txt -------------------------------------------------------------------------------- /screenshot.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/screenshot.png -------------------------------------------------------------------------------- /test: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/test -------------------------------------------------------------------------------- /test2.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/test2.txt -------------------------------------------------------------------------------- /tests/72676_word_macros/E3ofjh.frm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/E3ofjh.frm -------------------------------------------------------------------------------- /tests/72676_word_macros/E3ofjh.frx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/E3ofjh.frx -------------------------------------------------------------------------------- /tests/72676_word_macros/MKKdfgtGTZUMw.frm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/MKKdfgtGTZUMw.frm -------------------------------------------------------------------------------- /tests/72676_word_macros/MKKdfgtGTZUMw.frx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/MKKdfgtGTZUMw.frx -------------------------------------------------------------------------------- /tests/72676_word_macros/MPcAq0.bas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/MPcAq0.bas -------------------------------------------------------------------------------- /tests/72676_word_macros/RA5yujSIgHYc.bas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/RA5yujSIgHYc.bas -------------------------------------------------------------------------------- /tests/72676_word_macros/ReisaWtkGEK2g.bas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/ReisaWtkGEK2g.bas -------------------------------------------------------------------------------- /tests/72676_word_macros/VhmNrPNhZaam.frm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/VhmNrPNhZaam.frm -------------------------------------------------------------------------------- /tests/72676_word_macros/VhmNrPNhZaam.frx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/VhmNrPNhZaam.frx -------------------------------------------------------------------------------- /tests/72676_word_macros/gP39AxZgbtPq7Av.bas: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/gP39AxZgbtPq7Av.bas -------------------------------------------------------------------------------- /tests/72676_word_macros/oFtRyMlcM.frm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/oFtRyMlcM.frm -------------------------------------------------------------------------------- /tests/72676_word_macros/oFtRyMlcM.frx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/72676_word_macros/oFtRyMlcM.frx -------------------------------------------------------------------------------- /tests/attribute.txt: -------------------------------------------------------------------------------- 1 | Attribute VB_Name = "ReisaWtkGEK2g" 2 | Private Const rEITLfHwWDKjXJN As Long = 8748 3 | -------------------------------------------------------------------------------- /tests/byval.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/byval.txt -------------------------------------------------------------------------------- /tests/const.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/const.txt -------------------------------------------------------------------------------- /tests/noargs: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/noargs -------------------------------------------------------------------------------- /tests/test1.vbs_: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/test1.vbs_ -------------------------------------------------------------------------------- /tests/test2.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/tests/test2.txt -------------------------------------------------------------------------------- /vbScript_deobsfuscator.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/vbScript_deobsfuscator.exe -------------------------------------------------------------------------------- /versions/5-9-16_vbScript_deobsfuscator.7z: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mandiant/vbScript_deobfuscator/HEAD/versions/5-9-16_vbScript_deobsfuscator.7z --------------------------------------------------------------------------------