Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 113b6d3d42d706b2…

MALICIOUS

Office (OOXML)

1.21 MB Created: 2021-03-06 09:15:38 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-04
MD5: 36513fbe9171160ea99a6febaf87cfc8 SHA-1: 7803d30ac46b68e2e8a32cb278787edc89119030 SHA-256: 113b6d3d42d706b2b3e6dcd05acef45bc7cba10225ed952d395b05c38334ed0b
618 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1071.001 Web Protocols T1204.002 Malicious File T1566.001 Spearphishing Attachment

This OOXML document contains a Workbook_Open macro that utilizes WScript.Shell and CreateObject to download a file from 'http://strokescribe.com/en/ECI.html' using URLDownloadToFile and then execute it. The macro also exhibits self-replication capabilities, suggesting it may attempt to spread via email. The presence of obfuscated code and the use of WMI to create processes further indicate malicious intent.

Heuristics 15

  • VBA project inside OOXML medium 12 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Call Shell("""" & ProgramName & """ """ & Argument & """", vbNormalFocus)
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Set InfoBox = CreateObject("WScript.Shell")
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As LongPtr, ByVal szURL$, ByVal szFileName$, ByVal dwReserved As Long, ByVal lpfnCB As LongPtr) As Long
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set iFSO = CreateObject("Scripting.FileSystemObject")
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
        WebLink = WinHttpReq.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        'ShellExecute 0, "open", "hh.exe", ActiveWorkbook.path & "\Help.chm::/Tudongluubangtinh.html", "", 3
  • VBA email-worm self-replication (Outlook mass-mailer) critical OLE_VBA_EMAIL_WORM_SELF_REPLICATION
    VBA macro drives Outlook to mass-mail itself: it automates Outlook.Application, programmatically creates a mail item, and spreads by attaches a file to the outgoing message, sends the message programmatically. Harvesting recipients from the address book / inbox and auto-attaching the carrier to outgoing messages is the defining behavior of the Melissa / LoveLetter / W97M mass-mailer worm lineage — there is no benign document use, independent of any AV signature.
    Matched line in script
                Set OutMail = OutApp.CreateItem(0)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set iFSO = CreateObject("Scripting.FileSystemObject")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
        Set cimv2 = GetObject("winmgmts:\\" & PubStrComputer & "\root\cimv2")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        FilePath = Environ("SystemDrive") & Environ("HomePath") & Application.PathSeparator & "Desktop" & Application.PathSeparator & "TempImage.jpg"
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chart.googleapis.com/chart?chs= Referenced by macro
    • http://strokescribe.com/en/ECI.htmlReferenced by macro
    • http://www.tondering.dk/claus/calendar.htmlReferenced by macro
    • https://www.giaiphapexcel.com/diendan/threads/filter-and-get-the-unique-values-l%E1%BB%8Dc-v%C3%A0-l%E1%BA%A5y-c%C3%A1c-gi%C3%A1-tr%E1%BB%8B-kh%C3%B4ng-tr%C3%B9ng.35487/Referenced by macro
    • http://www.vbforums.com/showthread.php?277384-VB-Key-COnstsReferenced by macro
    • https://maps.googleapis.com/maps/api/distancematrix/xml?origins=Referenced by macro
    • https://www.howtoexcel.org/vba/how-to-conditionally-concatenate-a-range/Referenced by macro
    • http://www.Google.com.vnReferenced by macro
    • https://portal.vietcombank.com.vn/Usercontrols/TVPortal.TyGia/pExcel.aspx?b=68Referenced by macro
    • https://portal.vietcombank.com.vn/Personal/TG/Pages/ty-gia.aspx?devicechannel=defaultReferenced by macro
    • http://masocongty.vn/search?name=Referenced by macro
    • https://bettersolutions.com/vba/ribbon/face-ids-2003.htmReferenced by macro
    • https://officexinh.com/blog/addins/officexinh-tools-proReferenced by macro
    • https://www.giaiphapexcel.com/diendan/threads/filter-and-get-the-unique-values-l%E1%BB%8Dc-v%C3%A0-l%E1%BA%A5y-c%C3%A1c-gi%C3%A1-tr%E1%BB%8B-kh%C3%B4ng-tr%C3%B9ng.35487/�Referenced by macro
    • https://maps.googleapis.com/maps/ap�Referenced by macro
    • http://www.Google.com.vn�Referenced by macro
    • https://portal.vietcombank.com.vn/Usercontrols/TVPortal.TyGia/pExcel.aspx?b=68�Referenced by macro
    • http://dmcritchie.mvps.org/excel/colors.htmReferenced by macro
    • https://www.timeanddate.com/time/map/Referenced by macro
    • http://time.windows.com/Referenced by macro
    • https://www.ssec.wisc.edu/~tomw/java/unicode.html��Referenced by macro
    • http://www.mrexcel.com/forum/excel-questions/823185-visual-basic-applications-code-udf-count-unique-criteria.htmlReferenced by macro
    • https://onedrive.live.com/embed?cid=FDD9ED31CD88E8AE&resid=FDD9ED31CD88E8AE%2132466&authkey=ANbY_Uh2tx3eAKE&em=2Referenced by macro
    • https://drive.google.com/open?id=1HUILBiXwbJsVzkcCPbZxhQjm2-UNQ3toReferenced by macro
    • https://msdn.microsoft.com/en-us/library/hh826025(v=vs.85).aspxReferenced by macro
    • https://developer.mozilla.org/en-US/docs/Mozilla/Command_Line_Options#BrowserReferenced by macro
    • http://www.opera.com/docs/switches/Referenced by macro
    • https://translate.google.com/translate_tts?ie=utf-8&client=tw-ob&tl=Referenced by macro
    • http://time.windows.com/�Referenced by macro
    • https://www.ssec.wisc.edu/~tomw/java/unicode.html�Referenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1398414 bytes
SHA-256: c500f96ce036eae7c33637d2ff283443418092158f00078ad3703e23ce6d7f09
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 6 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private App_Datas As Class_Data
Private TaskPane_Datas As Class_TaskPane

Private Sub Workbook_Open()
'Keбt noбi sцп kieдn giцхa workbook vфщi caщc class module
    Set App_Datas = New Class_Data
    Set TaskPane_Datas = New Class_TaskPane
End Sub

Attribute VB_Name = "Form_Label"
Attribute VB_Base = "0{40BACD1D-88BD-4905-9E6C-D0F32E9367E2}{75BBEC66-D7ED-4C30-8C73-9B73907F2A44}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Option Explicit
Dim Label_ValidData As Boolean

Private Sub CommandButton7_Click()
'Sao lцu caшi сaлt
Dim n!, a$, b$, i!, iName As Name, Arr() As String, c$, d$, e$
   
With Me
'B1. Kieеm tra giaщ trт hфпp leд
    Label_ValidData = True
    Call CheckData
    If Label_ValidData = False Then Exit Sub

SpeedOn
'B2. Xoщa namerange
    For Each iName In ActiveWorkbook.Names
        If iName.Name Like "*Label_Setting" Then
            iName.Delete
            Exit For
        End If
    Next
        
'B3. Taпo mфщi namerange
    a = "Label_Setting"
    ActiveWorkbook.Names.Add a, True
    ActiveWorkbook.Names(a).Comment = .ComboBox1.ListIndex & ";" & .RefEdit1 & ";" & .CheckBox1 & ";" & .TextBox1 & ";" & .TextBox2 & ";" & .TextBox3 & ";" & .TextBox4 & ";" & .TextBox5 & ";" & _
                                                                        .TextBox7 & ";" & .TextBox8 & ";" & .TextBox9 & ";" & .TextBox10 & ";" & .TextBox11 & ";" & .TextBox12 & ";" & .TextBox13 & ";" & .TextBox14 & ";" & .CheckBox2
End With
SpeedOff
    MsgBoxUni VniUni("Sao lцu caшi сaлt thaшnh coвng!"), vbExclamation + vbOKOnly, VniUni("Thoвng baщo")
End Sub

Private Sub UpdateListbox()
Dim a$, n!, iName As Name, Arr() As String
With Me
    n = 0
    .ListBox1.Clear
    For Each iName In ActiveWorkbook.Names
        If iName.Name Like "*Label_Ref_*" Then
            a = iName.Comment
            Arr = Split(a, ",")
            .ListBox1.AddItem
            .ListBox1.List(n, 0) = Arr(0)
            .ListBox1.List(n, 1) = Arr(1)
            .ListBox1.List(n, 2) = Arr(2)
            n = n + 1
        End If
    Next iName
End With
End Sub

Private Sub UpdateSetting()
Dim a$, n!, iName As Name, Arr() As String
With Me
    n = 0
    For Each iName In ActiveWorkbook.Names
        If iName.Name Like "*Label_Setting*" Then
            a = iName.Comment
            Arr = Split(a, ";")
            .ComboBox1.ListIndex = Arr(0)
            .RefEdit1 = Arr(1)
            .CheckBox1 = Arr(2)
            .TextBox1 = Arr(3)
            .TextBox2 = Arr(4)
            .TextBox3 = Arr(5)
            .TextBox4 = Arr(6)
            .TextBox5 = Arr(7)
            .TextBox7 = Arr(8)
            .TextBox8 = Arr(9)
            .TextBox9 = Arr(10)
            .TextBox10 = Arr(11)
            .TextBox11 = Arr(12)
            .TextBox12 = Arr(13)
            .TextBox13 = Arr(14)
            .TextBox14 = Arr(15)
            .CheckBox2 = Arr(16)
            n = n + 1
        End If
    Next iName
End With
End Sub

Private Sub CommandButton8_Click()
Dim iName As Name
SpeedOn
With Me
    For Each iName In ActiveWorkbook.Names
        If iName.Name Like "*Label_Setting*" Then
            iName.Delete
            Exit For
        End If
    Next iName
    
End With
SpeedOff
MsgBoxUni VniUni("Lцu yщ: Xoщa caшi сaлt giaбy in thaшnh coвng!"), vbExclamation + vbOKOnly, VniUni("Thoвng baщo")
End Sub

Private Sub UserForm_Initialize()
Dim iName As Name
SetUniText Me, VniUni("Taпo Maгu Tem Nhaхn Decal")
With Me
    .Frame1.Caption = VniUni("Tem nhaхn (mm)")
    .Frame2.Caption = VniUni("Giaбy in (mm)")
    .Frame3.Caption = VniUni("Hцфщng daгn")
    Call AddPaperSize 'Theвm noдi dung vaшo tuшy choпn loaпi giaбy vaшo combobox
    Call AddDetailLabel 'Hieеn thт chi tieбt tem in vaшo tцшng textbox
    .ComboBox1.ListIndex = 0
    
    .Label25.Font.SIZE = 8
    Call ButtonStyle(Me, Label4)
    .Label4 = ChrW(169) & VniUni(Thanks())
    
'B1. Caдp nhaдt listbox & caшi сaлt
    Call UpdateListbox
    'Call UpdateSetting
 
'B2. AЕn namerange
    For Each iName In ActiveWorkbook.Names
         If iName.Name Like "*Label_*" Then
            iName.Visible = False
         End If
    Next

End With
End Sub

Private Sub ListBox1_DblClick(ByVal Cancel As MSForms.ReturnBoolean)
Dim i!, iName As Name, a!

    With Me
        a = ListBox1.ListCount - 1
        For i = 0 To a
            If .ListBox1.Selected(i) = True Then
                   Exit For
            End If
        Next i
        
        .TextBox6 = .ListBox1.List(i, 0)
        .RefEdit2 = .ListBox1.List(i, 1)

        .CommandButton3.Enabled = False 'Theвm
        .CommandButton4.Enabled = True 'Sao lцu
        .CommandButton5.Enabled = True 'Huыy
        .CommandButton6.Enabled = False 'Xoщa
    End With
End Sub

Private Sub CommandButton3_Click()
'Nuщt theвm
Dim n!, a$, b$, i!, iName As Name, Arr() As String, c$, d$, e$
   
With Me
'B1. Kieеm tra giaщ trт hфпp leд
    If .TextBox6 = "" Then
        MsgBoxUni VniUni("Lцu yщ: Tham soб khoвng сцфпc troбng!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox12)
        Exit Sub
    End If

     If .RefEdit2 = "" Then
        MsgBoxUni VniUni("Lцu yщ: Vuшng dцх lieдu tham soб khoвng сцфпc troбng!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.RefEdit2)
        Exit Sub
    End If
    
    If ValidRange(.RefEdit2) = False Then
        MsgBoxUni VniUni("Lцu yщ: Vuшng dцх lieдu tham soб khoвng hфпp leд!"), vbExclamation + vbOKOnly, VniUni("Thoвng baщo")
        Label_ValidData = False
        Call SelectText(.RefEdit2)
        Exit Sub
    End If
    
'B2. Taпo NameRange
    b = Randoms(3, 1)
    a = "Label_Ref_" & b
    ActiveWorkbook.Names.Add a, True
    ActiveWorkbook.Names(a).Comment = Replace(RemoveMark(.TextBox6), " ", "") & "," & .RefEdit2 & "," & b

'B3. Caдp nhaдt listbox
    Call UpdateListbox

'B4.AЕn hieдn nuщt baбm
    .CommandButton3.Enabled = True 'Theвm
    .CommandButton4.Enabled = False 'Sao lцu
    .CommandButton5.Enabled = False 'Huыy
    .CommandButton6.Enabled = True 'Xoщa
End With
End Sub

Private Sub CommandButton4_Click()
'Sao lцu tham soб
Dim n!, a$, b$, i!, iName As Name, Arr() As String, c$, d$, e$
   
With Me
'B1. Kieеm tra giaщ trт hфпp leд
    If .TextBox6 = "" Then
        MsgBoxUni VniUni("Lцu yщ: Tham soб khoвng сцфпc troбng!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox12)
        Exit Sub
    End If

     If .RefEdit2 = "" Then
        MsgBoxUni VniUni("Lцu yщ: Vuшng dцх lieдu tham soб khoвng сцфпc troбng!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.RefEdit2)
        Exit Sub
    End If
    
    If ValidRange(.RefEdit2) = False Then
        MsgBoxUni VniUni("Lцu yщ: Vuшng dцх lieдu tham soб khoвng hфпp leд!"), vbExclamation + vbOKOnly, VniUni("Thoвng baщo")
        Label_ValidData = False
        Call SelectText(.RefEdit2)
        Exit Sub
    End If

'B2. Xoщa namerange сang choпn
    b = .ListBox1.ListCount - 1
    For i = 0 To b
        If .ListBox1.Selected(i) = True Then
            Exit For
        End If
    Next i

    With .ListBox1
        a = .List(i, 0) & "," & .List(i, 1) & "," & .List(i, 2)
        b = .List(i, 2)
    End With
        
    For Each iName In ActiveWorkbook.Names
        If iName.Name Like "*Label_*" Then
            If iName.Comment = a Then iName.Delete
            Exit For
        End If
    Next
        
'B3. Taпo mфщi namerange
    a = "Label_Ref_" & b
    ActiveWorkbook.Names.Add a, True
    ActiveWorkbook.Names(a).Comment = Replace(RemoveMark(.TextBox6), " ", "") & "," & .RefEdit2 & "," & b

'B4. Caдp nhaдt listbox
    Call UpdateListbox

'B5.AЕn hieдn nuщt baбm
    .CommandButton3.Enabled = True 'Theвm
    .CommandButton4.Enabled = False 'Sao lцu
    .CommandButton5.Enabled = False 'Huыy
    .CommandButton6.Enabled = True 'Xoщa
End With
End Sub

Private Sub CommandButton5_Click()
With Me
    .CommandButton3.Enabled = True 'Theвm
    .CommandButton4.Enabled = False 'Sao lцu
    .CommandButton5.Enabled = False 'Huыy
    .CommandButton6.Enabled = True 'Xoщa
End With
End Sub

Private Sub CommandButton6_Click()
'Xoщa dцх lieдu trong listbox
Dim i!, n!, iName As Name, a$, b!, c$, d$, e$

    With Me
        With .ListBox1
        b = .ListCount - 1
        For i = 0 To b
            If .Selected(i) = True Then
                    Exit For
            End If
        Next i
        
        a = .List(i, 0) & "," & .List(i, 1) & "," & .List(i, 2)
    End With
        
'B1. Xoщa Namerange
        For Each iName In ActiveWorkbook.Names
            If iName.Name Like "*Label_*" Then
                If iName.Comment = a Then
                    iName.Delete
                    Exit For
                End If
            End If
        Next iName

'B2. Caдp nhaдt laпi listbox
        .ListBox1.RemoveItem (i)
    
'B3. AЕn hieдn nuщt baбm
        If .ListBox1.ListCount = 0 Then
            .CommandButton3.Enabled = True 'Theвm
            .CommandButton4.Enabled = False 'Sao lцu
            .CommandButton5.Enabled = False 'Huыy
            .CommandButton6.Enabled = False 'Xoщa
        Else
            .CommandButton3.Enabled = True 'Theвm
            .CommandButton4.Enabled = False 'Sao lцu
            .CommandButton5.Enabled = False 'Huыy
            .CommandButton6.Enabled = True 'Xoщa
        End If
    End With
End Sub

Private Sub CheckData()
With Me
'B1. Kieеm tra giaщ trт roгng
    If IsNumeric(.TextBox1) = False Or .TextBox1 = "" Or .TextBox1 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Chieаu roдng tem phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox1)
        Exit Sub
    End If
    
    If IsNumeric(.TextBox2) = False Or .TextBox2 = "" Or .TextBox2 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Chieаu cao tem phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox2)
        Exit Sub
    End If
    
    If IsNumeric(.TextBox3) = False Or .TextBox3 = "" Or .TextBox3 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Khoaыng caщch 2 coдt phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox3)
        Exit Sub
    End If
    
    If IsNumeric(.TextBox4) = False Or .TextBox4 = "" Or .TextBox4 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Khoaыng caщch 2 doшng phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox4)
        Exit Sub
    End If

    If IsNumeric(.TextBox5) = False Or .TextBox5 = "" Or .TextBox5 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Soб lцфпng tem phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox5)
        Exit Sub
    End If

    If IsNumeric(.TextBox7) = False Or .TextBox7 = "" Or .TextBox7 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Сoд roдng giaбy in phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox7)
        Exit Sub
    End If

    If IsNumeric(.TextBox8) = False Or .TextBox8 = "" Or .TextBox8 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Chieаu daшi giaбy in phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox8)
        Exit Sub
    End If

    If IsNumeric(.TextBox9) = False Or .TextBox9 = "" Or .TextBox9 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Leа phaыi giaбy in phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox9)
        Exit Sub
    End If

    If IsNumeric(.TextBox10) = False Or .TextBox10 = "" Or .TextBox10 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Leа traщi giaбy in phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox10)
        Exit Sub
    End If

    If IsNumeric(.TextBox11) = False Or .TextBox11 = "" Or .TextBox11 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Leа treвn giaбy in phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox11)
        Exit Sub
    End If

    If IsNumeric(.TextBox12) = False Or .TextBox12 = "" Or .TextBox12 <= 0 Then
        MsgBoxUni VniUni("Lцu yщ: Leа dцфщi giaбy in phaыi lфщn hфn 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox12)
        Exit Sub
    End If
    
    If IsNumeric(.TextBox13) = False Or .TextBox13 = "" Or .TextBox13 < 0 Then
        MsgBoxUni VniUni("Lцu yщ: Leа header phaыi lфщn hфn hoaлc baиng 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox13)
        Exit Sub
    End If

    If IsNumeric(.TextBox14) = False Or .TextBox14 = "" Or .TextBox14 < 0 Then
        MsgBoxUni VniUni("Lцu yщ: Leа footer phaыi lфщn hфn hoaлc baиng 0!"), vbInformation + vbOKOnly, VniUni(TitleNoitice)
        Label_ValidData = False
        Call SelectText(.TextBox14)
        Exit Sub
    End If
    
'B2. Kieеm tra giaщ trт hфпp leд
    If ValidRange(.RefEdit1) = False Then
        MsgBoxUni VniUni("Lцu yщ: OВ noдi dung khoвng hфпp leд!"), vbExclamation + vbOKOnly, VniUni("Thoвng baщo")
        Label_ValidData = False
        Call SelectText(.RefEdit2)
        Exit Sub
    End If
    
    If Range(.RefEdit1).Cells.Count > 1 Then
        MsgBoxUni VniUni("Lцu yщ : Vuшng noдi dung chж trong phaпm vi 1 oв!"), vbExclamation + vbOKOnly, VniUni("Thoвng baщo")
        Label_ValidData = False
       Call SelectText(.RefEdit1)
        Exit Sub
    End If
End With
End Sub

Private Sub ComboBox1_Change()
    Call AddDetailLabel
    Me.TextBox13 = 0
    Me.TextBox14 = 0
End Sub

Private Sub CommandButton9_Click()
'Xem trцфщc noдi dung
Dim FilePath$

'B1. Kieеm tra giaщ trт hфпp leд
    Label_ValidData = True
    Call CheckData
    If Label_ValidData = False Then Exit Sub
    
SpeedOn
    Call CreateLabel
    Call TempImage(1)
    FilePath = Environ("SystemDrive") & Environ("HomePath") & Application.PathSeparator & "Desktop" & Application.PathSeparator & "TempImage.jpg"
    Me.Image1.Picture = LoadPicture(FilePath)
    Kill FilePath
    Application.DisplayAlerts = False
    ActiveSheet.Delete
    Application.DisplayAlerts = True
    ActiveWindow.ScrollWorkbookTabs Position:=xlFirst
SpeedOff
End Sub

Private Sub CommandButton1_Click()
' Taпo tem in
With Me

'B1. Kieеm tra giaщ trт hфпp leд
    Label_ValidData = True
    Call CheckData
    If Label_ValidData = False Then Exit Sub

'B2. Kieеm tra license
    If Limit("System", "Addins", .TextBox5.Value * 1, 10) = False Then
        MsgBoxUni VniUni("Phieвn baыn mieгn phн moгi laаn taпo 10 tem in.") & vbNewLine & vbNewLine & _
                               VniUni("Neбu coщ nhu caаu sцы duпng khoвng giфщi haпn, baпn vui loшng sцы duпng phieвn baыn Pro. Chaвn thaшnh caщm фn!"), vbOKOnly, VniUni(TitleNoitice)
        Call SelectText(.TextBox5)
        Exit Sub
    End If

'B3. Taпo tem in
SpeedOn
    Call CreateLabel
End With
SpeedOff
Title = "Taпo tem in"
Call InfoSuccess(Title)
End Sub

Private Sub CommandButton2_Click()
'Сoщng giao dieдn form
Unload Me
End Sub

Private Sub CreateLabel()
'Taпo danh saщch tem in
Dim nWidth% 'Сoд roдng tem
Dim nHeight% 'Сoд cao tem
Dim iWidth% 'Khoaыng caщch giцхa 2 haшng tem
Dim iHeight% 'Khoaыng caщch giцхa 2 coдt tem
Dim MaxWidth% 'Сoд roдng trang giaбy
Dim MaxHeight% 'Сoд daшi trang giaбy
Dim MaxRow% 'Soб doшng tem toбi сa
Dim n% 'Soб tem caаn in
Dim nTem% 'Soб tem сaх taпo
Dim nRow% 'Soб coдt tem toбi сa in treвn chieаu roдng 1 trang
Dim nColumn% 'Soб doшng tem toбi сa in treвn chieаu daшi 1 trang
Dim a% 'doшng
Dim b% 'coдt
Dim Tem%, t%, TempVar
Dim Content$
Dim iLeft, iRight, iTop, iBottom, iHeader, iFooter, Arr() As String, Rgs As Range, Ref$, ValueRef$, iName As Name, i!

With Me
'Thieбt laдp trang in
iLeft = .TextBox10.Value
iRight = .TextBox9.Value
iTop = .TextBox11.Value
iBottom = .TextBox12.Value
iHeader = .TextBox13.Value
iFooter = .TextBox14.Value
'Thieбt laдp tem im
a = 1
nTem = 0
n = .TextBox5.Value
nWidth = .TextBox1.Value
nHeight = .TextBox2.Value
iWidth = .TextBox3.Value
iHeight = .TextBox4.Value
MaxWidth = .TextBox7.Value
MaxHeight = .TextBox8.Value
nRow = (MaxWidth - iLeft - iRight) / (nWidth + iHeight)
nColumn = (MaxHeight - iTop - iBottom) / (nHeight + iWidth)
MaxRow = WorksheetFunction.RoundUp(n / nRow, 0)

    If .RefEdit1.Value <> "" Then
        Content = Sheets(GetAddress(.RefEdit1, 1)).Range(GetAddress(.RefEdit1)).Value
    Else
        Content = ""
    End If

'B1. Theвm moдt trang tнnh mфщi
    ActiveWorkbook.Sheets.Add After:=Sheets(Worksheets.Count)

'B2. Taпo boб cuпc tem
    For b = 1 To nRow * 2 Step 2 'Taпo tem in treвn tцшng doшng
        ActiveSheet.Cells(a, b).Select   ' Taпo chieаu roдng moгi tem
            Call ColumnWidthInCentimeters(nWidth / 10)
            
        If iWidth <= 10 Then ' Taпo khoaыng caщch giцхa 2 tem
            ActiveSheet.Cells(a, b + 1).ColumnWidth = MilimetersToPoints(iWidth)
        Else
            Call ColumnWidthInCentimeters(iWidth / 10)
        End If
        Tem = Tem + 1
            
        If Tem = nRow Then 'Сaх taпo сuы tem treвn 1 doшng
            Exit For
        End If
    Next b
            
    Tem = 0
    For a = 1 To MaxRow * 2 Step 2 'Taпo tem in treвn tцшng coдt
        ActiveSheet.Cells(a, 1).RowHeight = Application.CentimetersToPoints(nHeight / 10) 'Taпo chieаu cao tem
        ActiveSheet.Cells(a + 1, 1).RowHeight = Application.CentimetersToPoints(iHeight / 10) 'Taпo chieаu cao doшng giцхa 2 haшng tem
        Tem = Tem + 1 'Soб doшng tem hoaшn taбt
        t = t + 1 'Soб doшng tem hoaшn taбt giфщi haпn trong 1 trang in
                
        If Tem = MaxRow Then 'Сaх taпo сuы doшng tem treвn 1 trang in
            Exit For
        End If
        
        If Tem Mod nColumn = 0 Then 'Taпo pagebreak
            ActiveSheet.HPageBreaks.Add before:=ActiveSheet.Cells(a + 2, 1)
            t = 1 'Trфы laпi doшng tem сaаu tieвn treвn trang in mфщi
        End If
     Next a
     ActiveWindow.DisplayWhitespace = True

'B3. Taпo noдi dung tem
    For a = 1 To MaxRow * 2 Step 2
        Tem = 0
        
        If nTem = n Then
            Exit For
        End If
        
        For b = 1 To nRow * 2 Step 2
            If nTem = n Then
                Exit For
            End If
        
            If Content = "" Then
                ActiveSheet.Cells(a, b) = VniUni("Vaкn phoшng phaеm Officexinh")
            Else
                ActiveSheet.Cells(a, b) = Content
            End If
                Tem = Tem + 1
                nTem = nTem + 1
            If Tem = nRow Then 'Сaх taпo сuы noдi dung treвn 1 doшng
                Exit For
            End If
        Next b
    Next a
      
'B4. Taпo tham soб tem
    If .CheckBox2 = True And .ListBox1.ListCount > 0 Then
        nTem = 1
        For a = 1 To MaxRow * 2 Step 2
            Tem = 0
            
    '        If nTem = n - 1 And .CheckBox1.Value = True Then
    '            Exit For
    '        End If
            
            For b = 1 To nRow * 2 Step 2
            
    '            If nTem = n - 1 And .CheckBox1.Value = True Then
    '                Exit For
    '            End If
                
                For Each iName In ActiveWorkbook.Names
                    If iName.Name Like "*Label_Ref_*" Then
                        Arr = Split(iName.Comment, ",")
                        Set Rgs = Sheets(GetAddress(Arr(1), 1)).Range(GetAddress(Arr(1)))
                        
                        If nTem > Rgs.Rows.Count Then Exit For
                        
                        Ref = Arr(0)
                        ValueRef = Rgs.Item(nTem)
                        ActiveSheet.Cells(a, b) = Replace(ActiveSheet.Cells(a, b).Value, Ref, ValueRef)
                    End If
                Next iName
              
                If .CheckBox1.Value = True Then
                    If ActiveSheet.Cells(a, b) = Content Then
                        ActiveSheet.Cells(a, b).Clear
                    End If
                End If
                
                Tem = Tem + 1
                nTem = nTem + 1
                
                If Tem = nRow Then 'Сaх taпo сuы noдi dung treвn 1 doшng
                    Exit For
                End If
            Next b
        Next a
    End If
    
'B5. Стnh daпng
    ActiveSheet.Range(Cells(1, 1), Cells(MaxRow * 2, nColumn * 2 - 1)).Select
    With Selection
        .HorizontalAlignment = xlCenter
        .VerticalAlignment = xlCenter
        .WrapText = True
        .ShrinkToFit = True
        '.Font.Bold = True
        .Font.SIZE = 10
    End With
      
    Cells(1, 1).Select
      
     With ActiveSheet.PageSetup ' Canh leа giaбy in
        .LeftMargin = Application.CentimetersToPoints(iLeft) / 10
        .RightMargin = Application.CentimetersToPoints(iRight) / 10
        .TopMargin = Application.CentimetersToPoints(iTop) / 10
        .BottomMargin = Application.CentimetersToPoints(iBottom) / 10
        .HeaderMargin = Application.CentimetersToPoints(iHeader) / 10
        .FooterMargin = Application.CentimetersToPoints(iFooter) / 10
        .Orientation = xlPortrait
        '.PaperSize = xlPaperA4
    End With
End With
    ActiveWindow.View = xlPageLayoutView
End Sub

Private Sub AddDetailLabel()
'Kнch thцфщc decal Tomy
With Me
    Select Case .ComboBox1.Value
        Case VniUni("Tomy 99 - 7x31mm - 96 tem/tфш")
            .TextBox1.Value = 31
            .TextBox2.Value = 7
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 96
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 100 - 37x96mm - 8 tem/tфш")
            .TextBox1.Value = 96
            .TextBox2.Value = 37
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 8
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 101 - 50x96mm - 6 tem/tфш")
            .TextBox1.Value = 96
            .TextBox2.Value = 50
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 6
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 102 - 52x47mm - 12 tem/tфш")
            .TextBox1.Value = 47
            .TextBox2.Value = 52
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 12
            .TextBox7.Value = 161
            .TextBox8.Value = 211
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 103 - 36x62mm - 12 tem/tфш")
            .TextBox1.Value = 62
            .TextBox2.Value = 36
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 12
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 104 - 25x78mm - 14 tem/tфш")
            .TextBox1.Value = 78
            .TextBox2.Value = 25
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 14
            .TextBox7.Value = 161
            .TextBox8.Value = 211
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 105 - 25x37mm - 30 tem/tфш")
            .TextBox1.Value = 37
            .TextBox2.Value = 25
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 30
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 106 - 25x25mm - 42 tem/tфш")
            .TextBox1.Value = 25
            .TextBox2.Value = 25
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 42
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 107 - 17x50mm - 30 tem/tфш")
            .TextBox1.Value = 50
            .TextBox2.Value = 17
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 30
            .TextBox7.Value = 161
            .TextBox8.Value = 211
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 108 - 19x36mm - 40 tem/tфш")
            .TextBox1.Value = 36
            .TextBox2.Value = 19
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 40
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 109 - 12x37mm - 55 tem/tфш")
            .TextBox1.Value = 37
            .TextBox2.Value = 12
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 55
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 110 - 16x22mm - 72 tem/tфш")
            .TextBox1.Value = 22
            .TextBox2.Value = 16
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 72
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 111 - 14x21mm - 84 tem/tфш")
            .TextBox1.Value = 21
            .TextBox2.Value = 14
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 84
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 112 - 8x20mm - 144 tem/tфш")
            .TextBox1.Value = 20
            .TextBox2.Value = 8
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 144
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 113 - 10x18mm - 128 tem/tфш")
            .TextBox1.Value = 18
            .TextBox2.Value = 10
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 128
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 114 - ш 11mm - 192 tem/tфш")
            .TextBox1.Value = 11
            .TextBox2.Value = 11
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 192
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 115 - ш 14mm - 120 tem/tфш")
            .TextBox1.Value = 14
            .TextBox2.Value = 14
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 120
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 116 - ш 18mm - 80 tem/tфш")
            .TextBox1.Value = 18
            .TextBox2.Value = 18
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 80
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 117 - ш 23mm - 48 tem/tфш")
            .TextBox1.Value = 23
            .TextBox2.Value = 23
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 48
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 118 - ш 30mm - 30 tem/tфш")
            .TextBox1.Value = 30
            .TextBox2.Value = 30
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 30
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 119 - 92x157mm - 2 tem/tфш")
            .TextBox1.Value = 157
            .TextBox2.Value = 92
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 2
            .TextBox7.Value = 161
            .TextBox8.Value = 211
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 120 - 81x121mm - 2 tem/tфш")
            .TextBox1.Value = 121
            .TextBox2.Value = 81
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 2
            .TextBox7.Value = 161
            .TextBox8.Value = 211
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 121 - 36x77mm - 10 tem/tфш")
            .TextBox1.Value = 77
            .TextBox2.Value = 36
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 10
            .TextBox7.Value = 161
            .TextBox8.Value = 211
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 122 - 17x85mm - 16 tem/tфш")
            .TextBox1.Value = 85
            .TextBox2.Value = 17
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 16
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 123 - 10x29mm - 72 tem/tфш")
            .TextBox1.Value = 29
            .TextBox2.Value = 10
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 72
            .TextBox7.Value = 211
            .TextBox8.Value = 161
            .TextBox9.Value = 5
            .TextBox10.Value = 5
            .TextBox11.Value = 5
            .TextBox12.Value = 5
        Case VniUni("Tomy 124 - 38x52mm - 15 tem/tфш")
            .TextBox1.Value = 52
            .TextBox2.Value = 38
            .TextBox3.Value = 2
            .TextBox4.Value = 2
            .TextBox5.Value = 15
            .TextBox7.Value = 161
            .TextBox8.Value = 211
            .TextBox9.Value = 5
            .TextBox10.Value = 5
…
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 2973696 bytes
SHA-256: aa0891f527052a5f77396ed3b3114262a547005790d5c15488937ffda8a1c0c1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.