Expected end of text error throwing in script

[wroersma]

---

PARSING VBA CODE: INFO parsed Sub Img_Painted ([hHZIubL as Long, AoLnF as IInkRectangle]): 3 statement(s) Module 'ThisDocument' Sub Img_Painted ([hHZIubL as Long, AoLnF as IInkRectangle]): 3 statement(s)

*** PARSING ERROR *** Public Sub xvkBjM() ^

Expected end of text (at char 526), (line:16, col:1)

TRACING VBA CODE (entrypoint = Auto*): Recorded Actions: +--------+------------+-------------+ | Action | Parameters | Description | +--------+------------+-------------+ +--------+------------+-------------+

[decalage2]

Could you please share the full VBA code, or a hash/link to the malware sample? Thanks!

[bryannolen]

6be0c3995eb39a80b5b47b6e81b7177c

[decalage2]

OK, found it:

• https://www.threatcrowd.org/malware.php?md5=6be0c3995eb39a80b5b47b6e81b7177c
• https://www.hybrid-analysis.com/sample/9143bfc1f4e4524b755c883a3307c8529cc050558dd9c46428762258a3048adc/?environmentId=100

[scherma]

Encountering a similar issue: Set ProjectWhileFor = VshiMaoLiznula.Environment(VshiMaoHeadHunter(2 + 2)) VshiMaoLAKOPPC = ProjectWhileFor(VshiMaoHeadHunter(6)) ProjectDarvin = 0 MoveSheets "", "", "" End Sub

---

PARSING VBA CODE: Module 'Module2'

*** PARSING ERROR *** Public Const ProjectTransformation = "avetof" ^ Expected end of text (at char 31), (line:2, col:1)

and

---

PARSING VBA CODE: Module 'Module3'

*** PARSING ERROR *** Public VshiMao4 As String ^ Expected end of text (at char 35), (line:4, col:1)

No recorded actions. https://virustotal.com/en/file/b804d05fba5d07e03997272d111304d36000152ac5145b74d6208d903244e45e/analysis/

I can upload the file if you need a copy.

[nicolasvillatte]

Same type of issue when parsing

PARSING VBA CODE: *** PARSING ERROR *** Sub abcdef() ^ Expected {" " | " "} (at char 0), (line:1, col:1)

For some reason it seems to expect the sub to contain {}.

[Beercow]

I ran into this error too. Ran vmonkey.py -a fixed the issue.

[harin8]

How to scan the ".cls" file in vipermonkey tool. Right now I am scanning a VBA macro code saved in a simple text file. While parsing the VBA code it is throwing an error : "Sub AutoOpen() ^ Expected end of text (at char 0), (line:1, col:1) ERROR Parse Error. Processing Aborted."

Source code is:

Sub AutoOpen() If WsGQFM Or 2 Then tBFjh = "TI" End If Shell("calc.exe") End Sub()