MALICIOUS
80
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
The file is identified as a malicious Excel document with a critical heuristic firing for a legacy Excel formula macro virus, specifically mentioning 'Poppy by VicodinES' and 'The Narkotic Network'. The embedded VBA macro, while not directly executing malicious code, contains strings and references indicative of this known malware family. The presence of 'Book1.xls' suggests an attempt to infect other workbooks.
Heuristics 2
-
Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUSWorkbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 13676 bytes |
SHA-256: 4dbf310f202d8a71e009b6cad5a0398d762cb43b2b0d7d9e201fd19aedbe1fa7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Tinhtoan"
Option Explicit
Public Function Csi(N As Double, Rn As Double, Ra As Double, Fb As Double, Fa As Double)
Dim Csip As Double
Const Pi = 3.14159
If N <= 0.77 * Rn * 10 ^ 3 * Fb + 0.645 * Ra * 10 ^ 3 * Fa Then
Csi = 0
Do
Csip = Csi
Csi = (N + Ra * 10 ^ 3 * Fa + Rn * 10 ^ 3 * Fb * Sin(2 * Pi * Csip) / (2 * Pi)) / (Rn * 10 ^ 3 * Fb + 2.55 * Ra * 10 ^ 3 * Fa)
Loop Until Abs((Csi - Csip) / Csi) <= 0.01
Else
Csi = 0
Do
Csip = Csi
Csi = (N + Rn * 10 ^ 3 * Fb * Sin(2 * Pi * Csip) / (2 * Pi)) / (Rn * 10 ^ 3 * Fb + Ra * 10 ^ 3 * Fa)
Loop Until Abs((Csi - Csip) / Csi) <= 0.01
End If
End Function
Public Function Can3(N As Double)
Dim Csip As Double
Dim a As Double, b As Double, c As Double, k As Double
a = Sqr(N)
b = Sqr(a)
Do
c = (a + b) / 2
If c * c * c > N Then
a = c
Else
b = c
End If
k = Abs(N - c * c * c) / N * 100
Loop Until k <= 0.1
Can3 = c
End Function
Public Function Noisuy(a1 As Double, a2 As Double, a As Double, g1 As Double, g2 As Double)
Noisuy = g1 + (g2 - g1) * (a - a1) / (a2 - a1)
End Function
Attribute VB_Name = "Tinhsan"
Sub TraHSM()
Dim sodo As String
sodo = Range("C5").Text
Select Case sodo
Case "S¬ ®å 1"
Range("C15").Formula = "=vlookup(C16,So_do_1,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_1,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_1,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_1,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_1,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_1,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_1,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_1,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_1,5)"
Case "S¬ ®å 2"
Range("C15").Formula = "=vlookup(C16,So_do_2,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_2,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_2,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_2,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_2,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_2,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_2,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_2,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_2,5)"
Case "S¬ ®å 3"
Range("C15").Formula = "=vlookup(C16,So_do_3,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_3,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_3,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_3,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_3,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_3,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_3,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_3,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_3,5)"
Case "S¬ ®å 4"
Range("C15").Formula = "=vlookup(C16,So_do_4,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_4,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_4,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_4,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_4,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_4,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_4,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_4,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_4,5)"
Case "S¬ ®å 5"
Range("C15").Formula = "=vlookup(C16,So_do_5,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_5,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_5,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_5,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_5,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_5,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_5,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_5,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_5,5)"
Case "S¬ ®å 6"
Range("C15").Formula = "=vlookup(C16,So_do_6,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_6,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_6,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_6,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_6,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_6,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_6,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_6,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_6,5)"
Case "S¬ ®å 7"
Range("C15").Formula = "=vlookup(C16,So_do_7,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_7,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_7,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_7,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_7,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_7,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_7,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_7,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_7,5)"
Case "S¬ ®å 8"
Range("C15").Formula = "=vlookup(C16,So_do_8,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_8,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_8,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_8,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_8,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_8,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_8,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_8,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_8,5)"
Case "S¬ ®å 9"
Range("C15").Formula = "=vlookup(C16,So_do_9,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_9,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_9,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_9,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_9,5)"
Range("C17").Formula = "=ceiling(C16,0.05)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_9,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_9,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_9,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_9,5)"
Case "S¬ ®å 10"
Range("C15").Formula = "=vlookup(C16,So_do_10,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_10,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_10,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_10,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_10,5)"
Range("C17").Formula = "=ceiling(C16,0.1)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_10,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_10,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_10,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_10,5)"
Case "S¬ ®å 11"
Range("C15").Formula = "=vlookup(C16,So_do_11,1)"
Range("D15").Formula = "=VLOOKUP(C15,So_do_11,2)"
Range("E15").Formula = "=VLOOKUP(C15,So_do_11,3)"
Range("F15").Formula = "=VLOOKUP(C15,So_do_11,4)"
Range("G15").Formula = "=VLOOKUP(C15,So_do_11,5)"
Range("C17").Formula = "=ceiling(C16,0.1)"
Range("D17").Formula = "=VLOOKUP(C17,So_do_11,2)"
Range("E17").Formula = "=VLOOKUP(C17,So_do_11,3)"
Range("F17").Formula = "=VLOOKUP(C17,So_do_11,4)"
Range("G17").Formula = "=VLOOKUP(C17,So_do_11,5)"
End Select
End Sub
Function Kiemtra(a, a1, b, b1, c, c1, d, d1)
Kiemtra = "ThÐp sµn ®¶m b¶o kh¶ n¨ng chÞu lùc"
If a > 0 Then
If a < a1 Then
Kiemtra = "ThÐp sµn kh«ng ®ñ kh¶ n¨ng chÞu lùc"
End If
End If
If b > 0 Then
If b < b1 Then
Kiemtra = "ThÐp sµn kh«ng ®ñ kh¶ n¨ng chÞu lùc"
End If
End If
If c > 0 Then
If c < c1 Then
Kiemtra = "ThÐp sµn kh«ng ®ñ kh¶ n¨ng chÞu lùc"
End If
End If
If d > 0 Then
If d < d1 Then
Kiemtra = "ThÐp sµn kh«ng ®ñ kh¶ n¨ng chÞu lùc"
End If
End If
End Function
Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "cmdTramomen, 118, 0, MSForms, CommandButton"
Private Sub cmdTramomen_Click()
TraHSM
End Sub
Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Sheet13"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "Sheet6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Name = "TCXDVN356"
Option Explicit
Public Function Tinhphi(M, Ml, N, eo, h, beta)
Dim phi As Double
Dim Phi1 As Double
Dim Mt As Double
If M * Ml > 0 Then
phi = 1 + beta * Ml / M
If phi > 1 + beta Then phi = 1 + beta
Else
If Abs(eo) > 0.1 * h Then
phi = 1
Else
Mt = N * h / 2
Phi1 = 1 + beta * Ml / Mt
phi = Phi1 + 10 * (1 - Phi1) * eo / h
End If
End If
Tinhphi = phi
End Function
Public Function Ncr(Eb, Es, Ib, Ia, eo, h, lo, phi)
Ncr = 6.4 * Eb * 10 ^ 3 / lo ^ 2 * (Ib / phi * (0.11 / (0.1 + eo / h) + 0.1) + Es / Eb * Ia)
End Function
Public Function Xir(anfa, Rb, Rs)
Dim omega As Double
omega = anfa - 0.008 * Rb
Xir = omega / (1 + Rs / 500 * (1 - omega / 1.1))
End Function
Public Function Tinhx(muy, N, Rb, b, h, eo, ho, Rs, a, neta, Xir)
Dim x As Double
Dim Fa As Double
x = N / (Rb * 10 ^ 3 * b) 'LT lon
If x / ho > Xir Then 'LT be
Fa = muy * b * h / 100 / 2
x = (N + 2 * Rs * 10 ^ 3 * Fa * (1 / (1 - Xir) - 1)) / (Rb * 10 ^ 3 * b + 2 * Rs * 10 ^ 3 * Fa / (ho * (1 - Xir)))
End If
Tinhx = x
End Function
Public Function Tinhfa(muy, N, Rb, b, h, eo, ho, Rs, a, neta, Xir)
Dim x As Double
Dim e As Double
Dim Fa As Double
x = N / (Rb * 10 ^ 3 * b)
If x / ho <= Xir Then 'LT lon
e = neta * eo + h / 2 - a
Tinhfa = 10 ^ 4 * (N * e - Rb * 10 ^ 3 * b * x * (ho - 0.5 * x)) / (Rs * 10 ^ 3 * (ho - a))
Else
Fa = muy * b * h / 100 / 2
x = (N + 2 * Rs * 10 ^ 3 * Fa * (1 / (1 - Xir) - 1)) / (Rb * 10 ^ 3 * b + 2 * Rs * 10 ^ 3 * Fa / (ho * (1 - Xir)))
e = neta * eo + h / 2 - a
Tinhfa = 10 ^ 4 * (N * e - Rb * 10 ^ 3 * b * x * (ho - 0.5 * x)) / (Rs * 10 ^ 3 * (ho - a))
End If
End Function
Attribute VB_Name = "Sheet5"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "cmdTramomen, 3, 0, MSForms, CommandButton"
Private Sub cmdTramomen_Click()
TraHSM
End Sub
Attribute VB_Name = "Sheet7"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "cmdTramomen, 3, 0, MSForms, CommandButton"
Private Sub cmdTramomen_Click()
TraHSM
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.