Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 192ebebf093330c3…

MALICIOUS

Office (OOXML)

1.20 MB Created: 2018-04-20 15:53:13 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2019-03-18
MD5: 2d79f9f2421297fceae4290a101a31d9 SHA-1: 81373d44f87cd3baa937a8c8fe4b25d75716862c SHA-256: 192ebebf093330c31098498e5eaf596a973f9617de48d42d9ac92d68851ea15c
466 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1204.002 Malicious File

The Excel document contains a Workbook_Open macro that utilizes WScript.Shell and cmd.exe to execute PowerShell commands. This indicates the document is designed to download and execute a secondary payload. The presence of advance-fee scam and invoice lures suggests a phishing or social engineering motive.

Heuristics 14

  • VBA project inside OOXML medium 8 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Dim x As Variant
    x = Shell(strApp, vbNormalFocus)
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Dim wsh As Object
    Set wsh = VBA.CreateObject("Wscript.shell")
  • PowerShell reference in VBA critical OLE_VBA_PS
    PowerShell reference in VBA
    Matched line in script
        Dim resp As Variant
    resp = MsgBox("Invoking Powershell to read current worksheet " & ws & " as table and export as both CSV and JSON", vbOKCancel, "Export sheet")
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
        If r = 5 Then 'if access denied, try this alternative
            r = ShellExecute(0, "open", "rundll32.exe", "url.dll,FileProtocolHandler " & strUrl, 0, 1)
    End If
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Dim wsh As Object
    Set wsh = VBA.CreateObject("Wscript.shell")
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
        arg = "cmd.exe /s /c subst.exe h: " & x
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    'PLACE IN ThisWorkbook SHEET MODULE
Private Sub Workbook_Open()
    Application.ScreenUpdating = False
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External hyperlinks (4) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 4 external hyperlinks — clickable URLs are stored as external relationships. First target: Help/Assess.html
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.taltech.com/support/entry/opening_and_closing_an_application_from_vba Document hyperlink
    • https://wellsr.com/vba/2016/excel/create-awesome-excel-splash-screen-for-your-spreadsheet/Document hyperlink
    • https://wellsr.com/vba/Document hyperlink
    • http://www.excelfunctions.net/vba-curdir-function.htmlDocument hyperlink
    • http://www.excel-easy.com/examples/reject-invalid-dates.htmlDocument hyperlink
    • https://www.thespreadsheetguru.com/blog/2014/6/20/the-vba-guide-to-listobject-excel-tablesDocument hyperlink
    • https://www.exceltrick.com/formulas_macros/filesystemobject-in-vba/Document hyperlink
    • https://www.askvg.com/create-a-virtual-drive-for-your-desired-folder-in-my-computer-using-subst-command/Document hyperlink
    • http://learnexcelmacro.com/wp/2017/09/save-excel-range-data-as-csv-file-through-excel-vba/#VBA-to-save-excel-table-to-csvDocument hyperlink
    • https://www.pryor.com/blog/ease-the-pain-of-data-entry-with-an-excel-forms-template/Document hyperlink
    • https://www.exceldemy.com/vlookup-index-and-match-and-dget/Document hyperlink
    • http://www.contextures.com/xlUserForm01.htmlDocument hyperlink
    • https://www.exceldemy.com/using-excel-worksheet-functions-in-vba/Document hyperlink
    • http://learnexcelmacro.com/wp/2014/06/read-write-document-properties-excel-macro/Document hyperlink
    • https://www.techonthenet.com/excel/formulas/rnd.phpDocument hyperlink
    • http://www.lawofwar.org/geneva_prisoner_war_convention.htmDocument hyperlink
    • https://excelmacromastery.com/excel-vba-collections/Document hyperlink
    • https://excelmacromastery.com/vba-dictionary/#A_Quick_Guide_to_the_VBA_DictionaryDocument hyperlink
    • https://chandoo.org/wp/2011/12/01/case-in-sensitive-string-compare-vba/Document hyperlink
    • https://www.thespreadsheetguru.com/the-code-vault/vba-code-add-spreadsheet-hyperlink-to-picture-objectDocument hyperlink
    • http://lawofwar.org/geneva_prisoner_war_convention.htmDocument hyperlink
    • http://www.bluepecantraining.com/portfolio/excel-vba-how-to-add-rows-and-columns-to-excel-table-with-vba-macro/Document hyperlink
    • https://www.boening.us/Document hyperlink
    • https://www.adriann.us/Document hyperlink
    • http://schemas.micrDocument hyperlink
    • http://schemas.mDocument hyperlink
    • http://schemasDocument hyperlink
    • http://schemas.microsoftDocument hyperlink
    • http://schemas.miDocument hyperlink
    • https://excelmacromastery.com/vba-dictionary/Document hyperlink
    • http://tbd.com/Document hyperlink
    • http://www.af.mil/News/Article-Display/Article/601830/cac-change-aids-visually-color-impaired-security-officers/Document hyperlink
    • https://stackoverflow.com/questions/31347919/how-to-export-vbaproject-in-excelDocument hyperlink
    • http://www.fontspace.com/digital-graphics-labs/micr-encodingDocument hyperlink
    • http://www.fontspace.com/juan-casco/hangul-love2Document hyperlink
    • https://stackoverflow.com/questions/17956651/execute-a-command-in-command-prompt-using-excel-vbaDocument hyperlink
    • https://support.office.com/en-us/article/create-or-delete-an-excel-table-e81aa349-b006-4f8a-9806-5af9df0ac664?ui=en-US&rs=en-US&ad=USDocument hyperlink
    • https://support.office.com/en-us/article/create-custom-functions-in-excel-2f06c10b-3622-40d6-a1b2-b6748ae8231fDocument hyperlink
    • https://support.microsoft.com/en-us/help/291073/how-to-use-the-forms-controls-on-a-worksheet-in-excelDocument hyperlink
    • https://download.microsoft.com/download/9/b/4/9b49c8c5-d7a9-45b1-b8b6-52067e9970a8/AF101984660_en-us_xl_qrc_vlookup%20refresher.pdfDocument hyperlink
    • https://support.microsoft.com/en-us/help/213360/how-to-convert-a-numeric-value-into-english-words-in-excelDocument hyperlink
    • https://www.mrexcel.com/excel-tips/replacing-vlookup-using-the-data-model-and-relationships/Document hyperlink
    • https://stackoverflow.com/questions/326476/how-to-round-a-number-in-vba-to-the-nearest-5-or-10-or-xDocument hyperlink
    • https://stackoverflow.com/questions/6040164/excel-vba-if-worksheetwsname-existsDocument hyperlink
    • http://stackoverflow.com/questions/6040164/excel-vba-if-worksheetwsname-existsDocument hyperlink
    • https://stackoverflow.com/questions/18811431/refer-to-excel-cell-in-table-by-header-name-and-row-number-vbaDocument hyperlink
    • https://appsource.microsoft.com/en-us/product/office/WA104051163Document hyperlink
    • http://schemas.microsoft.com/nDocument hyperlink
    • http://schemas.microsoft.com/anawDocument hyperlink
    • http://commons.wikimedia.org/wiki/File:Army_logo.pngDocument hyperlink
    +8 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 35188 bytes
SHA-256: 59161374078a30e83e8c6f43bec86bc976915f1aec0a178b070483acb01a463b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

'PLACE IN ThisWorkbook SHEET MODULE
Private Sub Workbook_Open()
    Application.ScreenUpdating = False
    ActiveWindow.Visible = False
    SplashUserForm.Show
    Windows(ThisWorkbook.name).Visible = True
    Application.ScreenUpdating = True
    
    SetSubst
    Worksheets("Main").Activate
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CommandButton1, 15, 0, MSForms, CommandButton"
Private Sub CommandButton1_Click()

    ControlPanel.Show

End Sub

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Main"
Option Explicit

#If VBA7 Then
   Declare PtrSafe Function ShellExecute Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
#Else
    ' Do nothing
#End If

Sub LaunchURL(strUrl As String)

On Error GoTo Errorhandler
    Dim r As Long
    r = ShellExecute(0, "open", strUrl, 0, 0, 1)
    If r = 5 Then 'if access denied, try this alternative
            r = ShellExecute(0, "open", "rundll32.exe", "url.dll,FileProtocolHandler " & strUrl, 0, 1)
    End If
    Exit Sub
    
Errorhandler:
    MsgBox "Error encountered while trying to launch URL." & vbNewLine & vbNewLine & "Error: " & Err.Number & ", " & Err.Description, vbCritical, "Error Encountered"
    Resume Next
    
End Sub

Public Function GetWorkBookPath()

Const thisfunc As String = "GetWorkBookPath"
    
On Error GoTo Errorhandler
        
    GetWorkBookPath = ThisWorkbook.path
    
Exit Function


Errorhandler:
    MsgBox "Error encountered while trying to run " & thisfunc & vbNewLine & vbNewLine & "Error: " & Err.Number & ", " & Err.Description, vbCritical, "Error Encountered"
    Resume Next
    
End Function

Sub LaunchApp(appPath As String)
    
    'Status: WIP
    'Purpose: Launch App
    'Parameter: path to local executable
    'Author: Luke Boening
    'Create date: 2018-05-02
    'Last update: 2018-05-02
    'Unit Test: TBD
    
    
On Error GoTo Errorhandler

    Dim strApp As String
    strApp = appPath
    
    Dim x As Variant
    x = Shell(strApp, vbNormalFocus)

ExitHere:
    Exit Sub

Errorhandler:
    MsgBox "Error in function: " & Err.Description
    Resume Next

End Sub


'Requires Microsoft Visual Basic for Applications Extensibility
Public Function ExportVBA(path As String)
  
  Dim objVbComp As VBComponent
Dim strPath As String
Dim varItem As Variant
Dim fso As New FileSystemObject
Dim Filename As String

On Error GoTo Errorhandler

Filename = fso.GetFileName(path)

On Error Resume Next
    MkDir ("h:\exportvba\" & Filename & "\")
On Error GoTo 0

'Change the path to suit the users needs
strPath = "d:\code\diamondsaber\export\" & Filename & "\"

  For Each varItem In ActiveWorkbook.VBProject.VBComponents
  Set objVbComp = varItem

  Select Case objVbComp.Type
     Case vbext_ct_StdModule
        objVbComp.Export strPath & "\" & objVbComp.name & ".bas"
     Case vbext_ct_Document, vbext_ct_ClassModule
        ' ThisDocument and class modules
        objVbComp.Export strPath & "\" & objVbComp.name & ".cls"
     Case vbext_ct_MSForm
        objVbComp.Export strPath & "\" & objVbComp.name & ".frm"
     Case Else
        objVbComp.Export strPath & "\" & objVbComp.name
  End Select
Next varItem

ExitHere:
    Exit Function

Errorhandler:
    MsgBox "Error in function: " & Err.Description
    Resume ExitHere

End Function

Sub SetSubst()

Const thisfunc = "SetSubst"

' Function name: SetSubst
' Purpose: Sets drive letter to specified folder
' Parameter: None
' Last update: 2018-05-02
' Revision: 0.2.1

On Error GoTo Errorhandler

    Dim wsh As Object
    Set wsh = VBA.CreateObject("Wscript.shell")

    Dim x As String
    x = GetWorkBookPath

    Dim waitOnReturn As Boolean: waitOnReturn = True
    
    Dim windowStyle As Integer: windowStyle = 1
    
    Dim arg As String
    
    arg = "cmd.exe /s /c subst.exe h: " & x
    
    MsgBox arg, vbInformation, "About to set H: drive letter with these arguments"
    
    wsh.Run arg, windowStyle, waitOnReturn

    MsgBox "Success: drive letter h:", vbOKOnly, "Success or Failure"
    

ExitHere:
    Exit Sub
    
Errorhandler:
    MsgBox "Error in function " & thisfunc & vbCrLf & Err.Description
    Resume ExitHere
    
End Sub



Sub LoopThroughTable()

Const thisfunc = "LoopThroughTable"

On Error GoTo Errorhandler

    'STATUS: wip
    
    'SubName: LoopThroughTable
    'Parameter: none
    'Purpose: Loop through all tables and do something
    'Reference: https://www.thespreadsheetguru.com/blog/2014/6/20/the-vba-guide-to-listobject-excel-tables
    'Revision: 0.1.4
    'Last update: 2018-05-02

     Dim tbl As ListObject
     
     Dim sht As Worksheet
     
     Dim alternativeComment As String
     alternativeComment = ""
     
     For Each sht In ThisWorkbook.Worksheets
     
        For Each tbl In sht.ListObjects
        
            'Do something here
            
            ' tbl.AlternativeText = alternativeComment
            
            Debug.Print tbl.name
            
        Next tbl
     Next sht

Exit Sub

Errorhandler:
    MsgBox "there was an error" & Err.Description
    Resume Next

End Sub

Sub GetTableData()

    'Status: experimental

    MsgBox Sheets("Config").Range("C17")
    
    Dim myrange As Range
    
    Set myrange = Worksheets("Config").Range("a2:c17")
    

End Sub



Public Function DisplaySheetName() As String
    'Status: PRODUCTION
    
    DisplaySheetName = ActiveSheet.name
    
End Function

Public Function GetBook() As String
    'Status: PRODUCTION
    
    GetBook = ActiveWorkbook.name
End Function

Public Function GetFullName() As String
    'Status: PRODUCTION
    
    GetFullName = ActiveWorkbook.FullName
End Function


Sub GetHelp()
    'Status: WIP
    
    Dim currentSheet As String
    
    currentSheet = ActiveSheet.name
    
    MsgBox currentSheet
    
    LaunchURL "h:/help/" & currentSheet & ".html"
    
       
End Sub

Public Function GETRANDCHECKAMT() As Integer
  'STATUS: WIP
  'Purpose: Return a random check amount
  'Record content author: Luke Boening
  'Create date: 2018-05-03
  'Last update: 2018-05-03
  'Revision: 0.1.3
  'Parameter: none
  '
   
   Dim LRandomNumber As Integer

   Dim upperbound As Integer
   Dim lowerbound As Integer
   
   upperbound = 1000
   lowerbound = 10
   
   Randomize
   LRandomNumber = Int((upperbound - lowerbound + 1) * Rnd + lowerbound)

   GETRANDCHECKAMT = Round(LRandomNumber / 5) * 5
End Function



Sub ExportSheet()

Const psScript As String = "Export-SheetName.ps1"
Const workbookname As String = "DiamondSaber_2018.xlsm"
Const driveletter As String = "H:"

On Error GoTo Errorhandler

    Dim ws As String
    ws = DisplaySheetName

    Dim msg As String
    Dim resp As Variant
    resp = MsgBox("Invoking Powershell to read current worksheet " & ws & " as table and export as both CSV and JSON", vbOKCancel, "Export sheet")

    Debug.Print resp
    
    If resp = 2 Then
        MsgBox "Exiting sub"
        Exit Sub
    End If
    
        
       
    Dim arg As String
    Dim arg2 As String
    Dim arg1 As String
    Dim arg3 As String
    arg = driveletter & "\Powershell\" & psScript
    arg1 = driveletter & "\" & workbookname
    arg2 = ws
    arg3 = driveletter & "\export"
    
    Dim path As String
    ' Set the Path variable equal to the path of your program's installation
    path = "PowerShell" & " -file " & arg & " " & arg1 & " " & arg2 & " " & arg3

    Dim x As Variant
    x = Shell(path, vbNormalFocus)
    
Exit Sub
    
Errorhandler:
  MsgBox "Error encountered while trying to export sheet." & vbNewLine & vbNewLine & "Error: " & Err.Number & ", " & Err.Description, vbCritical, "Error Encountered"
  Resume Next

End Sub

Sub ShowThisDataForm()
'
' ShowThisDataForm Macro
' Data form

    ActiveSheet.ShowDataForm
End Sub

Sub LaunchPub(pubPath As String)
    'Launch Microsoft Publisher
    'Parameter: pubFileName
    'Description: Launch Microsoft Publisher with command line argument to file
    Const thisfunc = "LaunchPub"

On Error GoTo Errorhandler
    
    Dim x As Variant
    Dim path As String
    
    Dim arg As String
    arg = pubPath
    
    ' Set the Path variable equal to the path of your program's installation
    path = "MSPUB.EXE" & " /t " & arg

    x = Shell(path, vbNormalFocus)

Exit Sub
    
Errorhandler:
    MsgBox "There was an error in " & thisfunc & ":" & Err.Description
    Resume Next
    
End Sub

Public Function ListAllDocumentProperties()

On Error Resume Next

Dim prop As Variant


'below loop will traverse for all items of this collection of properties
For Each prop In ThisWorkbook.BuiltinDocumentProperties
    Debug.Print prop.name 'Property Name like "Author" etc
    ' Debug.Print prop.Value 'Property value like Author name updated in proprty
Next
End Function

Public Function GetCheckDate() As Long

Const thisfunc As String = "GetCheckDate"


On Error GoTo Errorhandler

   Dim LRandomNumber As Long

   Dim upperbound As Long
   Dim lowerbound As Long
   
   upperbound = 43333
   lowerbound = 43323
   
   Randomize
   LRandomNumber = Int((upperbound - lowerbound + 1) * Rnd + lowerbound)

   GetCheckDate = LRandomNumber



Exit Function

Errorhandler:
    MsgBox "There was an error " & Err.Description
    Resume Next
    

End Function

Public Function GetCheckDateAsString() As String

Const thisfunc = "GetCheckDateAsString"

On Error GoTo Errorhandler

Dim checkdate As Long
checkdate = GetCheckDate

Dim strCheckDate As String

strCheckDate = Format(checkdate, "mmmm d, yyyy")

GetCheckDateAsString = strCheckDate
Exit Function


Errorhandler:
    MsgBox "There was an error " & Err.Description
    Resume Next

End Function

Sub LaunchPowershell(powershellScript As String)

Const workbookname As String = "DiamondSaber_2018.xlsm"
Const driveletter As String = "H:"

On Error GoTo Errorhandler

Dim vscript As String
Select Case powershellScript
    Case "Get-Directory.ps1"
        vscript = "Get-Directory.ps1"
        
    Case Else
        MsgBox "Script not found. Aborting LaunchPowershell"
        Exit Sub
End Select

    Dim ws As String
    ws = DisplaySheetName

    Dim msg As String
    Dim resp As Variant
    resp = MsgBox("Invoking Powershell script: " & vscript, vbOKCancel, "Export sheet")

    Debug.Print resp
    
    If resp = 2 Then
        MsgBox "Exiting sub"
        Exit Sub
    End If
    
        
       
    Dim arg As String
    Dim arg2 As String
    Dim arg1 As String
    Dim arg3 As String
    arg = driveletter & "\Powershell\" & vscript
    'arg1 = driveletter & "\" & workbookname
    'arg2 = ws
    'arg3 = driveletter & "\export"
    
    Dim path As String
    ' Set the Path variable equal to the path of your program's installation
    
    ' path = "PowerShell" & " -file " & arg & " " & arg1 & " " & arg2 & " " & arg3

    path = "PowerShell" & " -file " & arg

    Dim x As Variant
    x = Shell(path, vbNormalFocus)
    
Exit Sub
    
Errorhandler:
  MsgBox "Error encountered while trying to run powershell." & vbNewLine & vbNewLine & "Error: " & Err.Number & ", " & Err.Description, vbCritical, "Error Encountered"
  Resume Next


End Sub

Sub DeleteUnknownSheet()
'
' DeleteUnknownSheet Macro
' Delete unknown sheet by name
'

'
    Sheets("Sheet4").Select
    ActiveWindow.SelectedSheets.Delete
End Sub


Sub HideSheets()

    Dim found, myobject, mycollection(2) As String
    
    found = False
    
    mycollection(0) = "Config"
    
    For Each myobject In mycollection
      Debug.Print myobject
      ActiveWorkbook.Sheets("Config").Visible = xlSheetHidden
    Next
    
End Sub

Sub ExposeSheets()

    Dim found, myobject, mycollection(2) As String
    
    found = False
    
    mycollection(0) = "Config"
    
    For Each myobject In mycollection
        Debug.Print myobject
        ActiveWorkbook.Sheets("Config").Visible = True
    Next
    
End Sub
Sub RefreshDataSheet()
'
' RefreshDataSheet Macro
' Refresh current sheet
'

'
    Range("directory[[#Headers],[Name]]").Select
    Selection.ListObject.TableObject.Refresh
End Sub

Sub GetProgramPath()
        
    Dim path As String
    path = GetWorkBookPath
    
    MsgBox "WorkBook path is " & path, vbInformation
    

End Sub

Sub Launch_Publisher()
    Dim path As String
    path = "h:\publisher\check_to_print.pub"
    
    Dim result As Variant
    
    result = MsgBox("About to print " & path, vbOKCancel)
    
    If result = 2 Then
        MsgBox "Exiting Sub"
        Exit Sub
    End If
    
    LaunchPub path
    
End Sub

Sub Launch_URL()

    Dim file As String
    
    file = "file:///h:/README.html"
    
    LaunchURL file

End Sub

Sub Launch_Powershell()
    Const thisfunc = "Launch_Powershell"
    
On Error GoTo Errorhandler
    LaunchPowershell "Get-Directory.ps1"
    
    RefreshDataSheet

Exit Sub

Errorhandler:
    MsgBox "There was an error " & Err.Description
    Resume Next
    
End Sub


Public Sub AddRowToTable(wrkSheet As String, tblName As String, dataCol1 As String, dataCol2 As String)
Dim ws As Worksheet
Set ws = ActiveSheet
Dim tbl As ListObject
Set tbl = ws.ListObjects("tLog")
Dim newrow As ListRow
Set newrow = tbl.ListRows.Add
With newrow
    .Range(2) = "AddRowToTable"
    .Range(3) = "AddRowToTable"
    .Range(4) = "2018-05-13T11:29:00"
End With

End Sub

Public Function SetDataToTextFile(tblName As String)

'STATUS: Broke

Const thisfunc = "SetDataToTextFile"

Dim myFile As String, tbl As ListObject, cellValue As Variant, i As Integer, j As Integer

Dim rng As Range

myFile = Application.DefaultFilePath & "\data\tGetSheetNameExists.csv"


Set tbl = ActiveSheet.ListObjects("tGetSheetNameExists")

Dim x As Long
Dim r As Long


For x = 1 To tbl.Range.Rows.Count - 1

    For r = 1 To tbl.Range.Columns.Count
        
      Debug.Print tbl.ListColumns(x).Range.Cells(1).Value
    
    Next r
    
Next x


End Function

Public Function getrandchecknumber() As Integer
Const thisfunc = "GetRandCheckNumber"

On Error GoTo Errorhandler

   Dim LRandomNumber As Integer

   Dim upperbound As Integer
   Dim lowerbound As Integer
   
   upperbound = 5000
   lowerbound = 100
   
   Randomize
   getrandchecknumber = Int((upperbound - lowerbound + 1) * Rnd + lowerbound)

Exit Function

Errorhandler:
    MsgBox "There was an error in " & thisfunc
    Resume Next

End Function

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet20"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "TestModule1"
Option Explicit
Option Private Module

'@TestModule
'@Folder("Tests")

Private Assert As Object
Private Fakes As Object

'@ModuleInitialize
Public Sub ModuleInitialize()
    'this method runs once per module.
    Set Assert = CreateObject("Rubberduck.AssertClass")
    Set Fakes = CreateObject("Rubberduck.FakesProvider")
End Sub

'@ModuleCleanup
Public Sub ModuleCleanup()
    'this method runs once per module.
    Set Assert = Nothing
    Set Fakes = Nothing
End Sub

'@TestInitialize
Public Sub TestInitialize()
    'this method runs before every test in the module.
End Sub

'@TestCleanup
Public Sub TestCleanup()
    'this method runs after every test in the module.
End Sub

'@TestMethod
Public Sub TestMethod1() 'TODO Rename test
    On Error GoTo TestFail
    
    'Arrange:

    'Act:

    'Assert:
    Assert.Inconclusive

TestExit:
    Exit Sub
TestFail:
    Assert.Fail "Test raised an error: #" & Err.Number & " - " & Err.Description
End Sub

'@TestMethod
Public Sub TestMethod2() 'TODO Rename test
    On Error GoTo TestFail
    
    'Arrange:

    'Act:

    'Assert:
    Assert.Inconclusive

TestExit:
    Exit Sub
TestFail:
    Assert.Fail "Test raised an error: #" & Err.Number & " - " & Err.Description
End Sub



Attribute VB_Name = "Sheet6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet7"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet8"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "SplashUserForm"
Attribute VB_Base = "0{61FCD812-3952-48B7-B241-45559BD14378}{0E52AC92-7F9C-42A3-8989-D2A4D96964AD}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'PLACE IN YOUR USERFORM CODE
Private Sub UserForm_Activate()
    Application.Wait (Now + TimeValue("00:00:01"))
    SplashUserForm.Label1.Caption = "Loading Data..."
    SplashUserForm.Repaint
    Application.Wait (Now + TimeValue("00:00:01"))
    SplashUserForm.Label1.Caption = "Creating Forms..."
    SplashUserForm.Repaint
    Application.Wait (Now + TimeValue("00:00:01"))
    SplashUserForm.Label1.Caption = "Opening..."
    SplashUserForm.Repaint
    Application.Wait (Now + TimeValue("00:00:01"))
    Unload SplashUserForm
End Sub

Attribute VB_Name = "Sheet10"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet11"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet23"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "UnitIntegrationTests"
Option Compare Text


Sub IntegrationTests()

    Const thisfunc = "IntegrationTests"
    
On Error GoTo Errorhandler

    Dim msg As String
    Dim ans As Variant
    
    msg = "Running integration tests"
    
    ans = MsgBox(msg, vbOKCancel)
    
    If ans = 2 Then
    
        MsgBox "Cancelling"
        Exit Sub
    End If
    
    


Exit Sub

Errorhandler:
    MsgBox "There was an error with " & Err.Description
    Resume Next
    

End Sub

Public Function GetSheetNameExists(wsName As String) As Boolean
    'Status: flaky
    
    
    Const thisfunc = "GetSheetNameExists"
    
On Error GoTo Errorhandler

    

    Dim ws As Worksheet
    Dim ret As Boolean
    
    ret = False
    
    wsName = UCase(wsName)
    For Each ws In ThisWorkbook.Sheets
        If UCase(ws.name) = wsName Then
            ret = True
            Exit For
         End If
        
    Next
    GetSheetNameExists = ret

Exit Function


Errorhandler:
    MsgBox "There was an error " & Err.Description
    GetSheetNameExists = False
    Resume Next
 

End Function


Public Function VBComponentExists(VBCompName As String, Optional VBProj As VBIDE.VBProject = Nothing) As Boolean
    
    Const thisfunc = "CheckProcedureExists"

On Error GoTo Errorhandler
    ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
    ' This returns True or False indicating whether a VBComponent named
    ' VBCompName exists in the VBProject referenced by VBProj. If VBProj
    ' is omitted, the VBProject of the ActiveWorkbook is used.
    ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
        Dim VBP As VBIDE.VBProject
        If VBProj Is Nothing Then
            Set VBP = ActiveWorkbook.VBProject
        Else
            Set VBP = VBProj
        End If
        On Error Resume Next
        VBComponentExists = CBool(Len(VBP.VBComponents(VBCompName).name))
    
Exit Function

Errorhandler:
    MsgBox "There was an error: " & Err.Description
    Resume Next


End Function

Function ModExists(name As String) As Boolean
  
    ModExists = False
    Dim pVBE As VBIDE.VBE
    Set pVBE = Application.VBE
    Dim l As Long
    For l = 1 To pVBE.VBProjects.Count
        Dim k As Long
        For k = 1 To pVBE.VBProjects(l).VBComponents.Count
            If pVBE.VBProjects(l).VBComponents(k).Type = vbext_ct_StdModule Then
                Dim s As String
                s = UCase(pVBE.VBProjects.Item(l).VBComponents(k).name)
                If s = UCase(name) Then
                    ModExists = True
…
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 512512 bytes
SHA-256: d6fe1bf774767e29f1c0e56582b10950be2de9b7d886835ac0ce3697bb1815a5
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 2784 bytes
SHA-256: 31159689b38db36df23aef48c1d168c1b5f5bfaa7072cfc84fb6e13fbf0bbc86

Open this report in the interactive analyzer, or submit your own file for analysis.