Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 482f5d7d30909dd4…

MALICIOUS

Office (OOXML)

1.07 MB Created: 2016-05-27 16:38:37 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-07
MD5: e372e6b54fb017a313be5bb028ba2697 SHA-1: 86185f4d719a322b4fc624c9e2d0395ba97576e4 SHA-256: 482f5d7d30909dd467d2eca7096f6facdf3b8961cc36f61f4d64236cc46c8031
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is an Excel macro-enabled file containing a Workbook_Open macro that utilizes CreateObject and GetObject to download a second file from a URL. The critical heuristic 'OLE_VBA_HTTP_DROP_EXEC' indicates that the VBA code downloads a file via HTTP and saves it to disk, likely for execution. The embedded URLs are suspicious and likely point to the malicious payload.

Heuristics 9

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    'Private Declare Function URLDownloadToFile Lib "urlmon" _
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            strURL = WinHttpReq.ResponseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set CodeTab = GetObject(Dateiname)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • External relationship medium OOXML_EXTERNAL_REL
    External target in xl/externalLinks/_rels/externalLink1.xml.rels: MK_Code.xlsm
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.kaps-computer.de/downloads/mensurkomplett/MK_Code.xlsm Referenced by macro
    • http://www.kaps-computer.de/downloads/mensurkomplett/MK_Standardwerte.xlsxReferenced by macro

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 19780 bytes
SHA-256: b9f549feca1d785aefb6eb34b231895fea7730f22e10447eb34f50482b0f42a4
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "DieseArbeitsmappe"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'Private Declare Function URLDownloadToFile Lib "urlmon" _
'    Alias "URLDownloadToFileA" ( _
'    ByVal pCaller As Long, _
'    ByVal szURL As String, _
'    ByVal szFileName As String, _
'    ByVal dwReserved As Long, _
'    ByVal lpfnCB As Long) As Long

Sub HauptButtonsAnlegen() 'nur temporär - wird sonst nicht benötigt
    Dim Tabelle As Worksheet
    Set Tabelle = Worksheets("Registerübersicht")
    Dim Butneu As Object
    
    With Tabelle.Range("B10:B11")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top + 1, Width:=.Width, Height:=.Height - 2)
    End With
    With Butneu
        .Name = "BtnUbersichtAktualisieren"
        .Characters.Text = "Übersicht aktualisieren"
        .OnAction = "MK_Code.xlsm!Uebersichtanlegen"
    End With
    
    With Tabelle.Range("B12:B13")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top + 1, Width:=.Width, Height:=.Height - 2)
    End With
    With Butneu
        .Name = "BtnUbersichtPDF"
        .Characters.Text = "Übersicht als PDF ausgeben"
        .OnAction = "MK_Code.xlsm!UebersichtPDF"
    End With
    
    With Tabelle.Range("B14:B15")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top + 1, Width:=.Width, Height:=.Height - 2)
    End With
    With Butneu
        .Name = "BtnAllePDF"
        .Characters.Text = "Alle PDF ausgeben"
        .OnAction = "MK_Code.xlsm!AllePDFAusgeben"
    End With
    
    With Tabelle.Range("B16:B17")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top + 1, Width:=.Width, Height:=.Height - 2)
    End With
    With Butneu
        .Name = "BtnAlleDAT"
        .Characters.Text = "Alle DAT ausgeben"
        .OnAction = "MK_Code.xlsm!AlleDatAusgeben"
    End With
    
  

End Sub
Sub buttonanlegen()
    Dim Tabelle As Worksheet
    Set Tabelle = Worksheets("Registerübersicht")
    Dim Butneu As Object
    
    With Tabelle.Range("F20:G21")
        Set Butneu = Tabelle.Buttons.Add(Left:=.Left, Top:=.Top, Width:=.Width, Height:=.Height)
    End With
    With Butneu
        .Name = "BtnRegisterSortieren"
        .Characters.Text = "Register verschieben"
        .OnAction = "MK_Code.xlsm!Registersortieren"
    End With

End Sub

Sub HauptButtonsReset()

    Call BtnReset("BtnUbersichtAktualisieren", "Uebersichtanlegen")
    Call BtnReset("BtnUbersichtPDF", "UebersichPDF")
    Call BtnReset("BtnAllePDF", "AllePDFAusgeben")
    Call BtnReset("BtnAlleDAT", "AlleDatAusgeben")
    Call BtnReset("BtnRegisterSortieren", "Registersortieren")

End Sub

Sub AlleButtonsReset()

Call BtnReset("BtnGemischteStimme", "Mixturfenster")
Call BtnReset("BtnImport", "Import")
Call BtnReset("BtnDruckBereichIntonateur", "ButtonDruckbereichIntonateur")
Call BtnReset("BtnDruckBereichMetallpfeifen", "ButtonDruckbereichMetallpfeifen")
Call BtnReset("BtnDruckBereichholzpfeifen", "ButtonDruckbereichHolzpfeifen")
Call BtnReset("BtnDruckBereichKonstrukteur", "ButtonDruckbereichKonstrukteur")
Call BtnReset("BtnDruckBereichZungen", "ButtonDruckbereichZungen")
Call BtnReset("BtnDATAusgabe", "ButtonDATAusgeben")
Call BtnReset("BtnPDFAusgabe", "ButtonPDFAusgeben")
Call BtnReset("PropKonstReset", "GrundwertProportionKonstante")
Call BtnReset("Fusslaenge", "VorschlagUebernehmenFusslaenge")
Call BtnReset("MaterialPlus", "ButtonPlusMaterial")
Call BtnReset("MaterialMinus", "ButtonMinusMaterial")
Call BtnReset("PfeifePlus", "ButtonPlusPfeife")
Call BtnReset("PfeifeMinus", "ButtonMinusPfeife")
Call BtnReset("KernspalteReset", "KernspalteReset")
Call BtnReset("Aufschnitt", "VorschlagUebernehmenAufschnitt")
Call BtnReset("Schleifenbohrung", "VorschlagUebernehmenSchleifenbohrung")
Call BtnReset("Bohrunggroesser", "ButtonBohrungPlus")
Call BtnReset("BohrungKleiner", "ButtonBohrungMinus")
Call BtnReset("Becherlänge", "VorschlagUebernehmenBecher")
Call BtnReset("btnReset", "Standardsladen")


End Sub

Sub BtnReset(btnName As String, btnAction As String)
With ActiveSheet
    If .Shapes(btnName).OnAction <> "MK_Code.xlsm!" & btnAction Then .Shapes(btnName).OnAction = "MK_Code.xlsm!" & btnAction
End With
End Sub
 

Private Sub Workbook_Open()

Dim strPfad As String
Dim strDatei As String
Dim strVersionsnummer As String
Dim wb As Workbook
Dim binschonoffen, binschonoffen2 As Boolean
Dim lngResult As Long
Dim strURL As String

Dim strDatei2 As String
Dim strURL2 As String

Dim WinHttpReq As Object
Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")


strDatei = "MK_Code.xlsm"
strPfad = ThisWorkbook.Path
strURL = "http://www.kaps-computer.de/downloads/mensurkomplett/MK_Code.xlsm"

strDatei2 = "MK_Standardwerte.xlsx"
strURL2 = "http://www.kaps-computer.de/downloads/mensurkomplett/MK_Standardwerte.xlsx"

Application.ScreenUpdating = False

For Each wb In Application.Workbooks
    If wb.Name = strDatei Then binschonoffen = True
    If wb.Name = strDatei2 Then binschonoffen2 = True
Next wb

If Not binschonoffen Then
    If Dir(strPfad & "\" & strDatei) = "" Then
        WinHttpReq.Open "GET", strURL, False
        WinHttpReq.send
        strURL = WinHttpReq.ResponseBody
        If WinHttpReq.Status = 200 Then
            Set oStream = CreateObject("ADODB.Stream")
            oStream.Open
            oStream.Type = 1
            oStream.Write WinHttpReq.ResponseBody
            oStream.SaveToFile strPfad & "\" & strDatei, 1
            oStream.Close
        End If

'        lngResult = URLDownloadToFile(0, strURL, strPfad & "\" & strDatei, 0, 0)
'        If lngResult = 0 Then
'            MsgBox "Code-Date war nicht vorhanden." & vbCrLf & "Die neueste Version wurde heruntergeladen und im aktuellen Pfad gespeichert."
'        Else
'            MsgBox "Code-Datei nicht vorhanden und Download nicht möglich."
'        End If
    End If
    Call VBA_Laden(strPfad & "\" & strDatei)
End If

If Not binschonoffen2 Then
    If Dir(strPfad & "\" & strDatei2) = "" Then
        WinHttpReq.Open "GET", strURL2, False
        WinHttpReq.send
        strURL2 = WinHttpReq.ResponseBody
        If WinHttpReq.Status = 200 Then
            Set oStream = CreateObject("ADODB.Stream")
            oStream.Open
            oStream.Type = 1
            oStream.Write WinHttpReq.ResponseBody
            oStream.SaveToFile strPfad & "\" & strDatei2, 1
            oStream.Close
        End If
    
    
'        lngResult = URLDownloadToFile(0, strURL2, strPfad & "\" & strDatei2, 0, 0)
'
'        If lngResult = 0 Then
'            MsgBox "Standards-Datei war nicht vorhanden." & vbCrLf & "Die neueste Version wurde heruntergeladen und im aktuellen Pfad gespeichert."
'        Else
'            MsgBox "Standards-Datei nicht vorhanden und Download nicht möglich."
'        End If
    End If
End If


If Worksheets.Count < 3 Then
    Application.Run strDatei & "!Standardsladen"
    Application.Run strDatei & "!TabelleAnlegen"
End If

With Worksheets("Registerübersicht")
    .Range("A20").Value = 1
    .Activate
    .Hyperlinks.Add Anchor:=.Range("E20"), Address:="", SubAddress:="1!B10", TextToDisplay:="zur Tabelle"
End With

Call HauptButtonsReset
Application.Run strDatei & "!Willkommen"
Application.ScreenUpdating = True

End Sub

Attribute VB_Name = "Tabelle1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CommandButton1, 2, 0, MSForms, CommandButton"
Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!WerkNameAendern"
End Sub

Private Sub CommandButton1_Click()
    Dim i As Integer
    Dim strRange As String
    Dim rng As Range
    
    With Application
        .ScreenUpdating = False
        .Calculation = xlCalculationManual
        .EnableEvents = False
    End With

    For i = 20 To 200
        If ActiveSheet.Cells(i, 1).Value = "" Then
            ActiveSheet.Cells(i, 1).Value = ActiveSheet.Cells(i - 1, 1).Value + 1
            strRange = Cells2Range(i + 1, 2) & ":" & Cells2Range(i + 2, 2)
            Set rng = ActiveSheet.Range(strRange)
            
            With ActiveSheet.OLEObjects(1)
                .Top = rng.Top
                .Left = rng.Left
                .Width = rng.Width
                .Height = rng.Height
            End With
            With ActiveSheet
                .Hyperlinks.Add Anchor:=ActiveSheet.Cells(i, 5), Address:="", SubAddress:="'" & i - 19 & "'!B10", TextToDisplay:="zur Tabelle"
                .Range("B" & i & ":D" & i).Interior.Color = RGB(226, 239, 218)
            
            ' In Werk das erste Werk eintragen für praktischere Drop-Downliste
                        
                .Range("C" & i).Value = "32"
                .Range("D" & i).Value = .Range("F6").Value
            
            End With
            Exit For
        End If
    Next
           
    Application.Run "MK_Code.xlsm!TabelleAnlegen"
    
    Worksheets("Registerübersicht").Activate
    
    With Application
        .ScreenUpdating = True
        .Calculation = xlCalculationAutomatic
        .EnableEvents = True
    End With

End Sub

Private Sub Worksheet_Activate()
    Call ThisWorkbook.HauptButtonsReset
End Sub


Attribute VB_Name = "Tabelle2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Modul1"
Option Explicit

Function Cells2Range(Zeile, Spalte)
    Spalte = Columns(Spalte).Address(False, False)
    Spalte = Left(Spalte, InStr(Spalte, ":") - 1)
    Cells2Range = Spalte & Zeile
End Function


Sub VBA_Laden(Dateiname As String)

Dim CodeTab As Workbook
Set CodeTab = GetObject(Dateiname)

End Sub




Attribute VB_Name = "Tabelle8"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox1, 11, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 28, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox7, 28, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 11, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle15"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox1, 11, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 28, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle7"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox7, 28, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 11, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Werk_1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit


Attribute VB_Name = "Tabelle13"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox1, 11, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 28, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox7, 28, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 11, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle5"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox7, 28, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 11, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox1, 11, 0, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 13, 1, MSForms, CheckBox"
Attribute VB_Control = "CheckBox3, 18, 2, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 20, 3, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 22, 4, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 24, 5, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 28, 6, MSForms, CheckBox"
Option Explicit
Private Sub Worksheet_Activate()
    Call ThisWorkbook.AlleButtonsReset
    Application.Run "MK_Code.xlsm!Standardsladen"
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!TabelleBerechnen"
End Sub

Attribute VB_Name = "Tabelle12"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_Activate()
    Application.Run "MK_Code.xlsm!Werktabelle_activate"
End Sub

Private Sub Worksheet_Change(ByVal Target As Range)
    Application.Run "MK_Code.xlsm!Werktabelle_change"
End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 124416 bytes
SHA-256: f0cafdcf0da0f4c3e3582611c68c25ce18d5b07c64dd74d4706fe215502e4337
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image44.emf 2524 bytes
SHA-256: 50a2add13ad46be8b350c5a117c7bee653bc83a2d1364a3ed1ab1063c5b637ea
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image45.emf 2524 bytes
SHA-256: d68f0d882a5231c1598acc19bd184f3e69940299c11b767015a6b86cdd359430
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image46.emf 2524 bytes
SHA-256: 62c0cb325f7dc661b4308526f907d1249a2b46b304f9b7b7ccff8decf775c37e
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 2852 bytes
SHA-256: d1dfb0262a776ed8f3db5d4efa19f607e609242a9f566490d237f92335dd7763
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image47.emf 2524 bytes
SHA-256: 53cd46c124a16beece113207f2bc5e77f026fa2e7bc8ad0277aa112fcf5b5300
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image48.emf 2524 bytes
SHA-256: c6cd5dd13b96f8fe10d34f67d302a52f15e5b9b5c054ce67f6df92bece8cf5bd
emf_06.emf ooxml-emf OOXML EMF part: xl/media/image49.emf 2524 bytes
SHA-256: bb9603e996b574d73126cf4b33cf8133e7d1167d6b31778873c05762be5bb4a8
emf_07.emf ooxml-emf OOXML EMF part: xl/media/image50.emf 2524 bytes
SHA-256: c49920031257b61387e1eeaf494fcd3b72a2d98643b49dd2b0fcf35be5e57983
emf_08.emf ooxml-emf OOXML EMF part: xl/media/image16.emf 2524 bytes
SHA-256: 55c1525b85eb967f0036e3256f43094a5d24fd3cfaa93afa391c62cdf1993a3e
emf_09.emf ooxml-emf OOXML EMF part: xl/media/image51.emf 2524 bytes
SHA-256: 2346f88148c730c752b693d255a8d7e211cbb383caeed4cbce88de0c97cc30e3
emf_10.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 2524 bytes
SHA-256: b2a97583688ee6c78547e8d3a678e7cbfbccf9ca7d4b93e7034b28906820fef8
emf_11.emf ooxml-emf OOXML EMF part: xl/media/image52.emf 2524 bytes
SHA-256: 2b4bf8ecadc2d331a5f919ae5a3838602d13266f5c3202581fff634334bce1e4
emf_12.emf ooxml-emf OOXML EMF part: xl/media/image17.emf 2524 bytes
SHA-256: 2877ef691f5f998a186a3b3cc52d3e0f87360210566517cc0c4010d99319dee8
emf_13.emf ooxml-emf OOXML EMF part: xl/media/image3.emf 2524 bytes
SHA-256: 91179d24fa63daadba45963d250e3a46b05c4f5607927534442252fcdcd5a5fe
emf_14.emf ooxml-emf OOXML EMF part: xl/media/image53.emf 2524 bytes
SHA-256: 16a1e0d7b37c559e1df8da2a3fd0ece290cdc52cd8e39075d69fd4578b68163d
emf_15.emf ooxml-emf OOXML EMF part: xl/media/image54.emf 2524 bytes
SHA-256: 80f8f0261a3848cab1f1f5c7663c35c13f06137599884a09ce940cdcd8c43d13
emf_16.emf ooxml-emf OOXML EMF part: xl/media/image4.emf 2524 bytes
SHA-256: a670fafad25f2179d8c9a41875c10254f7ddf5b2a4dff60ee07106e1ecf8e340
emf_17.emf ooxml-emf OOXML EMF part: xl/media/image18.emf 2524 bytes
SHA-256: 3fff68fcbe2d1c234f16551a6094f84835d5771ae66dfbfef75a3afd1faca7ae
emf_18.emf ooxml-emf OOXML EMF part: xl/media/image55.emf 2524 bytes
SHA-256: 26da9b4227fbeb25ecee3f97fe0d7ccc3d303fd34093133067c2b91818fd8127
emf_19.emf ooxml-emf OOXML EMF part: xl/media/image5.emf 2524 bytes
SHA-256: 04ee005cdbf4962635d9a76e48636df54292792eb44ce9ba34453e8b735a96b4
emf_20.emf ooxml-emf OOXML EMF part: xl/media/image56.emf 2524 bytes
SHA-256: 30dba1b0a23e157d47495cb2a825e27d8b0cd6ad9f8eb0cc01dce0e06f99ed85
emf_21.emf ooxml-emf OOXML EMF part: xl/media/image19.emf 2524 bytes
SHA-256: 6d2aaa39e9ce4613012bdeaada80c4ce8bb0fbcf625faa88236745b5f6bc955c
emf_22.emf ooxml-emf OOXML EMF part: xl/media/image6.emf 2524 bytes
SHA-256: 7befd17618bf9c5aabe8c01038c193510b072618283a40a16fb7a2ecd941485e
emf_23.emf ooxml-emf OOXML EMF part: xl/media/image57.emf 2524 bytes
SHA-256: 198a0f370f3e162e41254b6130393147b571804389525190862d4d514eb07451
emf_24.emf ooxml-emf OOXML EMF part: xl/media/image7.emf 2524 bytes
SHA-256: b4c701b8075dbdc3c8e359c661144dcc759439148843eaa9dd2d17f0f85852f9
emf_25.emf ooxml-emf OOXML EMF part: xl/media/image20.emf 2524 bytes
SHA-256: 898db5c3302db166eaf60b5351049f647e119082ea2f5a322bf1f0680152028d
emf_26.emf ooxml-emf OOXML EMF part: xl/media/image8.emf 2524 bytes
SHA-256: 1a74b357ed045cdc962ac771e9f4f5d0780092d60a408261748b94d84c1c9e29
emf_27.emf ooxml-emf OOXML EMF part: xl/media/image21.emf 2524 bytes
SHA-256: b498ebf980694329d557c4e85537ae4a0b66fefbd1fd7ba80febf184c2ecd76e
emf_28.emf ooxml-emf OOXML EMF part: xl/media/image22.emf 2524 bytes
SHA-256: a5e16b45589b8d60115ef043b9cc92016ce88be14701fbff4ef5842bfc37cc27
emf_29.emf ooxml-emf OOXML EMF part: xl/media/image30.emf 2524 bytes
SHA-256: 4f973a0d2c9a59df7da1dc9d22e5b3c1adc0ea628d22d868f593126d938d1168

Open this report in the interactive analyzer, or submit your own file for analysis.