Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 52f383963f437452…

MALICIOUS

Office (OOXML)

1.62 MB Created: 2011-05-31 17:44:04 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-09-14
MD5: da5b04b67902013629153d654b79c9e4 SHA-1: e59ae3a74fe5716fb53d1cef9016ee02413a0ab8 SHA-256: 52f383963f437452602ed6cdacac44564c4bef3f7043127915a5837837a6eadc
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel macro-enabled workbook containing VBA code. The VBA code attempts to execute functions from an external XLA add-in named 'DutoanGXD.xla' and potentially 'QLCL.xla'. This behavior is indicative of a macro-based downloader, which is often used to fetch and execute further malicious payloads. The ClamAV detection as 'Doc.Dropper.Valyria-6680506-0' further supports this assessment.

Heuristics 6

  • Equation Editor OLE object low CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject1.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • ClamAV: Doc.Dropper.Valyria-6680506-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680506-0
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • External workbook data link medium OOXML_EXTERNAL_REL_DATALINK
    External workbook reference in xl/externalLinks/_rels/externalLink2.xml.rels: file:///Q:\04-Design-Thiet ke\XMT1701B-Nha Van Phong VOV\04-Cost estimate\01-Working\3-BVTC\2-KCT\XMT1701B-3-CKTK.xlsm — a UNC/file path; opening the workbook and updating links could leak NetNTLM credentials to the host
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 43 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 30657 bytes
SHA-256: 6a938467c937e1e35bdb9b55461c49fec8037365d0e7d0ba003b35da5a5351ed
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_SheetBeforeRightClick(ByVal Sh As Object, ByVal Target As Range, Cancel As Boolean)
 If (istpWorkbookOpen("DutoanGXD.xla") = True) Then
     Cancel = False
    On Error Resume Next
    If ActiveSheet.CodeName = "shDGCTXD" Or ActiveSheet.CodeName = "shDGCTTB" Then
        If Target.Column = ThisWorkbook.Names("CTXD_DG").RefersToRange.Column Or Target.Column = ThisWorkbook.Names("CTTB_DG").RefersToRange.Column Then
         
           Cancel = True
           'MsgBox Target.Column
            'Application.Run "'QLCL.xla'!Enter_detail", Target.Row, Target.Column
             Application.Run "'DutoanGXD.xla'!RightClick_DGCT", Target.Row, Target.Column
             Exit Sub
        End If
    End If
    If ActiveSheet.CodeName = "shTHXD" Or ActiveSheet.CodeName = "shTHTB" Then
        If Target.Column = ThisWorkbook.Names("THXD_MSVT").RefersToRange.Column Then
         'If Target.Column = 2 Then
           Cancel = True
           'MsgBox Target.Column
            Application.Run "'DutoanGXD.xla'!GXDPRunTracuu4"
            Exit Sub
        End If
    End If
    If ActiveSheet.CodeName = "shVLHTXD" Or ActiveSheet.CodeName = "shVLHTTB" Then
        If Target.Column = ThisWorkbook.Names("VLXD_MH").RefersToRange.Column Or Target.Column = ThisWorkbook.Names("VLTB_MH").RefersToRange.Column Then
         'If Target.Column = 2 Then
           Cancel = True
           'MsgBox Target.Column
            Application.Run "'DutoanGXD.xla'!GXDPRunTracuu4"
            Exit Sub
        End If
    End If
    If ActiveSheet.CodeName = "shPLVXD" Or ActiveSheet.CodeName = "shPLVTB" Then
        If Target.Column = ThisWorkbook.Names("PLVTB_MVT").RefersToRange.Column Or Target.Column = ThisWorkbook.Names("PLVXD_MVT").RefersToRange.Column Then
         'If Target.Column = 2 Then
           Cancel = True
           'MsgBox Target.Column
            Application.Run "'DutoanGXD.xla'!GXDPRunTracuu4"
            Exit Sub
        End If
    End If
    If ActiveSheet.CodeName = "Sheet10" Then
    
        If Target.Column = 3 Then
            Cancel = True
        
            Application.Run "'DutoanGXD.xla'!TraMaCPVTVB", Target.Row, Target.Column - 1
            Exit Sub
        End If
    End If

    If ActiveSheet.CodeName = "Sheet4" Then
         If Target.Column = 2 Then
           Cancel = True
           'MsgBox Target.Column
            Application.Run "'DutoanGXD.xla'!TraMaCPVTVB", Target.Row, Target.Column
            Exit Sub
        End If
    End If
    If ActiveSheet.CodeName = "Sheet14" Then
        If Target.Column = 4 Then
           Cancel = True
           'MsgBox Target.Column
            Application.Run "'DutoanGXD.xla'!SeachDlgDGVB", Target.Row, Target.Column - 1
        End If
    End If

    If ActiveSheet.CodeName = "Sheet11" Then
    
        If Target.Column = 3 Then
            Cancel = True
        
            Application.Run "'DutoanGXD.xla'!TraMaCPVTVB", Target.Row, Target.Column - 1
            Exit Sub
        End If
    End If
    Application.Run "'DutoanGXD.xla'!RightClickSheet"
    
  End If
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shTS"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True



Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet5"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet12"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet7"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shGxd"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shDTXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet10"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shTHXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shDGCTXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True



Attribute VB_Name = "shVLHTXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

' www.contextures.com

Private Sub Worksheet_Change(ByVal Target As Range)
On Error GoTo errHandler

Dim wsCodes As Worksheet
Set wsCodes = Worksheets("Ts")

If Target.Cells.Count > 1 Then GoTo exitHandler

If Target.Column = 10 Then
  If Target.Value = "" Then GoTo exitHandler
  
  Application.EnableEvents = False
  
  Target.Value = wsCodes.Range("S2") _
    .Offset(Application. _
        WorksheetFunction _
        .Match(Target.Value, _
        wsCodes.Range("bhang"), 0), 0)

End If

exitHandler:
  Application.EnableEvents = True
  Exit Sub

errHandler:
  If Err.Number = 13 Or Err.Number = 1004 Then
    GoTo exitHandler
  Else
    Resume Next
  End If

End Sub



Attribute VB_Name = "shPLVXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True



Attribute VB_Name = "shNCXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shGCMXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shDGTH2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Worksheet_Change(ByVal Target As Range)
'Call call_Timkiem_DTXD(Target.Row, Target.Column)
End Sub

Private Sub Worksheet_SelectionChange(ByVal Target As Range)

End Sub

Attribute VB_Name = "shDTDTXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet18"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet13"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet17"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet22"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet23"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet24"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shGTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shDTTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet9"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shTHTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Attribute VB_Name = "shDGCTTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shVLHTTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

' www.contextures.com

Private Sub Worksheet_Change(ByVal Target As Range)
On Error GoTo errHandler

Dim wsCodes As Worksheet
Set wsCodes = Worksheets("Ts")

If Target.Cells.Count > 1 Then GoTo exitHandler

If Target.Column = 10 Then
  If Target.Value = "" Then GoTo exitHandler
  
  Application.EnableEvents = False
  
  Target.Value = wsCodes.Range("S10") _
    .Offset(Application. _
        WorksheetFunction _
        .Match(Target.Value, _
        wsCodes.Range("bhang"), 0), 0)

End If

exitHandler:
  Application.EnableEvents = True
  Exit Sub

errHandler:
  If Err.Number = 13 Or Err.Number = 1004 Then
    GoTo exitHandler
  Else
    Resume Next
  End If

End Sub




Attribute VB_Name = "shPLVTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Attribute VB_Name = "shNCTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shGCMTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet14"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shDTDTTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module2"
Sub ShowhideBCPTem()
 Application.Run "'DutoanGXD.xla'!ShowhideBCPVB"
End Sub
Sub ShowhideTHVB()
 Application.Run "'DutoanGXD.xla'!xl_Showhide", 0
 If shConfig.Cells(88, 3) = 1 Then
    Application.Run "'DutoanGXD.xla'!xl_Showhide", 1
    shConfig.Cells(88, 3) = 0
    'CommandButton1.Caption = shConfig.Cells(88, 1)
 Else
    Application.Run "'DutoanGXD.xla'!xl_Showhide", 0
    shConfig.Cells(88, 3) = 1
    'CommandButton1.Caption = shConfig.Cells(88, 2)
 End If
End Sub

Sub ShowhideVLHTVB()
 'Application.Run "'DutoanGXD.xla'!xl_Showhide", 0
 If shConfig.Cells(89, 3) = 1 Then
    Application.Run "'DutoanGXD.xla'!xl_ShowhideVLHT", 1, 1, 1
    shConfig.Cells(89, 3) = 0
    'CommandButton1.Caption = shConfig.Cells(88, 1)
 Else
    Application.Run "'DutoanGXD.xla'!xl_ShowhideVLHT", 0, 1, 1
    shConfig.Cells(89, 3) = 1
    'CommandButton1.Caption = shConfig.Cells(88, 2)
 End If
End Sub

Sub ShowhideVLHT1VB()
 'Application.Run "'DutoanGXD.xla'!xl_Showhide", 0
 If shConfig.Cells(90, 3) = 1 Then
    Application.Run "'DutoanGXD.xla'!xl_ShowhideVLHT", 1, 0, 1
    shConfig.Cells(90, 3) = 0
    'CommandButton1.Caption = shConfig.Cells(88, 1)
 Else
    Application.Run "'DutoanGXD.xla'!xl_ShowhideVLHT", 0, 0, 1
    shConfig.Cells(90, 3) = 1
    'CommandButton1.Caption = shConfig.Cells(88, 2)
 End If
End Sub

Sub ShowhideVLHTLDVB()
 'Application.Run "'DutoanGXD.xla'!xl_Showhide", 0
 If shConfig.Cells(91, 3) = 1 Then
    Application.Run "'DutoanGXD.xla'!xl_ShowhideVLHT", 1, 1, 0
    shConfig.Cells(91, 3) = 0
    'CommandButton1.Caption = shConfig.Cells(88, 1)
 Else
    Application.Run "'DutoanGXD.xla'!xl_ShowhideVLHT", 0, 1, 0
    shConfig.Cells(91, 3) = 1
    'CommandButton1.Caption = shConfig.Cells(88, 2)
 End If
End Sub

Sub ShowhideVLHTLD1VB()
 'Application.Run "'DutoanGXD.xla'!xl_Showhide", 0
 If shConfig.Cells(92, 3) = 1 Then
    Application.Run "'DutoanGXD.xla'!xl_ShowhideVLHT", 1, 0, 0
    shConfig.Cells(92, 3) = 0
    'CommandButton1.Caption = shConfig.Cells(88, 1)
 Else
    Application.Run "'DutoanGXD.xla'!xl_ShowhideVLHT", 0, 0, 0
    shConfig.Cells(92, 3) = 1
    'CommandButton1.Caption = shConfig.Cells(88, 2)
 End If
End Sub

Attribute VB_Name = "Sheet16"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet15"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "shNhancong"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet11"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet41"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
 Function vnd(conso) As String
 Dim nSheet As String
 nSheet = ActiveSheet.Name
 If nSheet <> "VLHT XD" And nSheet <> "VLHT TB" Then
 s09 = Array("", " m" & ChrW(7897) & "t", " hai", " ba", " b" & ChrW(7889) & "n", " n" & ChrW(259) & "m", " s" & ChrW(225) & "u", " b" & ChrW(7843) & "y", " t" & ChrW(225) & "m", " ch" & ChrW(237) & "n")
 lop3 = Array("", " tri" & ChrW(7879) & "u", " ngh" & ChrW(236) & "n", " t" & ChrW(7927))
 'Stop
 If Trim(conso) = "" Then
 vnd = ""
 ElseIf IsNumeric(conso) = True Then
 If conso < 0 Then dau = ChrW(226) & "m " Else dau = ""
 conso = Application.WorksheetFunction.Round(Abs(conso), 0)
 conso = " " & conso
 conso = Replace(conso, ",", "", 1)
 vt = InStr(1, conso, "E")
 If vt > 0 Then
 sonhan = Val(Mid(conso, vt + 1))
 conso = Trim(Mid(conso, 2, vt - 2))
 conso = conso & String(sonhan - Len(conso) + 1, "0")
 End If
 conso = Trim(conso)
 sochuso = Len(conso) Mod 9
 If sochuso > 0 Then conso = String(9 - (sochuso Mod 12), "0") & conso
 docso = ""
 i = 1
 LOP = 1
 Do
 n1 = Mid(conso, i, 1)
 n2 = Mid(conso, i + 1, 1)
 n3 = Mid(conso, i + 2, 1)
 baso = Mid(conso, i, 3)
 i = i + 3
 If n1 & n2 & n3 = "000" Then
 If docso <> "" And LOP = 3 And Len(conso) - i > 2 Then s123 = " t" & ChrW(7927) Else s123 = ""
 Else
 If n1 = 0 Then
 If docso = "" Then s1 = "" Else s1 = " kh" & ChrW(244) & "ng tr" & ChrW(259) & "m"
 Else
 s1 = s09(n1) & " tr" & ChrW(259) & "m"
 End If
 If n2 = 0 Then
 If s1 = "" Or n3 = 0 Then
 s2 = ""
 Else
 s2 = " linh"
 End If
 Else
 If n2 = 1 Then s2 = " m" & ChrW(432) & ChrW(7901) & "i" Else s2 = s09(n2) & " m" & ChrW(432) & ChrW(417) & "i"
 End If
 If n3 = 1 Then
 If n2 = 1 Or n2 = 0 Then S3 = " m" & ChrW(7897) & "t" Else S3 = " m" & ChrW(7889) & "t"
 ElseIf n3 = 5 And n2 <> 0 Then
 S3 = " l" & ChrW(259) & "m"
 ElseIf n3 = 4 And n2 <> 1 And n2 <> 4 And n1 = 4 Then S3 = " t" & ChrW(432)
 Else
 S3 = s09(n3)
 End If
 If i > Len(conso) Then
 s123 = s1 & s2 & S3
 Else
 s123 = s1 & s2 & S3 & lop3(LOP)
 End If
 End If
 LOP = LOP + 1
 If LOP > 3 Then LOP = 1
 docso = docso & s123
 If i > Len(conso) Then Exit Do
 Loop
 vnd = UCase(Left(dau & Trim(docso), 1)) & Mid(dau & Trim(docso), 2) & " " & ChrW(273) & ChrW(7891) & "ng."
 If Left(vnd, 2) = "T" & ChrW(432) Then
 vnd = "B" & ChrW(7889) & "n" & Right(vnd, (Len(vnd) - 2))
 End If
 Else
 'vnd = conso
 End If
 End If
 End Function
  Function vitri(kytu As String, chuoidc As String)
 sodaucach = 0
 For i = 1 To Len(chuoidc)
 kytuchuoi = Mid(chuoidc, i, 1)
 If kytuchuoi = kytu Then
 vitri = i
 End If
 Next
 End Function
 Public Function kl(strText As String)
 If Right(strText, 1) = " " Then
 kl = "0"
 Else
 strText = Replace(strText, "m2", "")
 strText = Replace(strText, "m3", "")
 strText = Replace(strText, "M2", "")
 strText = Replace(strText, "M3", "")
 strText = Replace(strText, ",", ".")
     
     If vitri(" ", strText) < Len(strText) And vitri(" ", strText) > 1 Then
     strText = Right(strText, Len(strText) - vitri(" ", strText))
     'Else
     End If
     
     kl = ""
     For i = 1 To Len(strText)
         kytu = Mid(strText, i, 1)
         ktdb = Mid(strText, i, 4)
         If kytu = "0" Or kytu = "1" Or kytu = "2" Or kytu = "3" Or kytu = "4" Or kytu = "5" Or kytu = "6" Or kytu = "7" _
             Or kytu = "8" Or kytu = "9" Or kytu = "+" Or kytu = "-" Or kytu = "*" Or kytu = "/" Or kytu = "^" Or kytu = "." _
             Or kytu = "," Or kytu = "(" Or kytu = ")" Or kytu = "%" Or kytu = "x" Or kytu = "X" Or ktdb = "sqrt" Or ktdb = "Sqrt" Or ktdb = "SQRT" Then
             If ktdb = "sqrt" Or ktdb = "Sqrt" Or ktdb = "SQRT" Then
                kytu = "sqrt"
             End If
             If kytu = "x" Or kytu = "X" Then
                kytu = "*"
             End If
             kl = kl & kytu
         End If
     Next
     If kl = "" Then
     kl = 0
     End If
 End If
 If IsError(Evaluate(kl)) Then
 kl = ""
 Else
     kl = Evaluate(kl)
         If kl = 0 Then
             kl = ""
         End If
 End If
 End Function
 Function USD(Tien)
   If Tien = 0 Then
     Toread = "None"
   Else
     SP = Space(1)
     RR = Space(0)
     Donvi = RR: Hchuc = RR: Khung = RR
     Donvi = Donvi + "one      two      three    four     "
     Donvi = Donvi + "five     six      seven    eight    "
     Donvi = Donvi + "nine     ten      eleven   twelve   "
     Donvi = Donvi + "thirteen fourteen fifteen  sixteen  "
     Donvi = Donvi + "seventeeneighteen nineteen "
     Hchuc = Hchuc + "twenty   thirty   forty    fifty    "
     Hchuc = Hchuc + "sixty    seventy  eighty   ninety   "
     Khung = Khung + "billion  milion   thousand dollars  cents    "
     If Tien < 0 Then
       Toread = "Minus "
     Else
       Toread = RR
     End If
     Chuoi = Format(Abs(Tien), "############.00")
     Chuoi = Right(Space(12) + Chuoi, 15)
     For i = 1 To 5
       NHOM = Mid(Chuoi, i * 3 - 2, 3)
       If NHOM <> Space(3) Then
         Select Case NHOM
         Case "000"
           If i = 4 And Abs(Tien) > 1 Then
             Word = "dollars "
           Else
             Word = RR
           End If
         Case ".00"
           Word = "only"
         Case Else
           X = Val(Left(NHOM, 1))
           Y = Val(Mid(NHOM, 2, 1))
           z = Val(Right(NHOM, 1))
           W = Val(Right(NHOM, 2))
           If X = 0 Then
             Word = RR
           Else
             Word = Trim(Mid(Donvi, X * 9 - 8, 9)) + " hundred "
             If W > 0 And W < 21 Then
               Word = Word + "and "
             End If
           End If
           If i = 5 And Abs(Tien) > 1 Then
             Word = "and " + Word
           End If
           If W < 20 And W > 0 Then
             Word = Word + Trim(Mid(Donvi, W * 9 - 8, 9)) + SP
           Else
             If W >= 20 Then
               Word = Word + Trim(Mid(Hchuc, (Y - 1) * 9 - 8, 9)) + SP
               If z > 0 Then
                 Word = Word + Trim(Mid(Donvi, z * 9 - 8, 9)) + SP
               End If
             End If
           End If
           Word = Word + Trim(Mid(Khung, i * 9 - 8, 9)) + SP
         End Select
         Toread = Toread + Word
       End If
     Next i
   End If
 USD = Trim(UCase(Left(Toread, 1)) + Mid(Toread, 2))
 If Right(USD, 9) = "and cents" Then
 USD = Left(USD, Len(USD) - 10)
 End If
 End Function

Public Function istpWorkbookOpen(WorkBookName As String) As Boolean
    istpWorkbookOpen = False
    On Error GoTo WorkBookNotOpen
    If Len(Application.Workbooks(WorkBookName).Name) > 0 Then
        istpWorkbookOpen = True
        Exit Function
    End If
WorkBookNotOpen:
End Function



Attribute VB_Name = "Sheet42"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet43"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet8"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ribsave"
Sub ribbonLoaded(ribbon As IRibbonUI)
If isWorkbookOpen("DutoanGXD.xla") = True Then
    Application.Run "'DutoanGXD.xla'!ribbonLoaded2", ribbon
End If

    
End Sub
Sub Savedg(control As IRibbonControl, ByRef CancelDefault)
    Dim SaveAs As Variant
    Dim phienban As Long
    If Val(Application.Version) >= 12 Then
       phienban = 1
    Else
        phienban = 2
    End If
    Dim OK As Boolean
    Filename = ActiveWorkbook.FullName
    If Filename <> ActiveWorkbook.Name Then
        ActiveWorkbook.save
    Else
        Do
        SaveAs = Application.GetSaveAsFilename(fileFilter:= _
        " Excel Macro Enabled Workbook (*.xlsm), *.xlsm," & _
        " Excel 2000-2003 Workbook (*.xls), *.xls," & _
        " Excel Binary Workbook (*.xlsb), *.xlsb", _
        FilterIndex:=phienban, Title:="Choose Save Location")
            If SaveAs = False Then
                Exit Sub
            Else
                If phienban <> 2 Then
                ActiveWorkbook.SaveAs SaveAs, FileFormat:=xlOpenXMLWorkbookMacroEnabled
                OK = True
                Else
                ActiveWorkbook.SaveAs SaveAs
                OK = True
                End If
            End If
        Loop Until OK
    End If
End Sub
Sub Savedg2(control As IRibbonControl)
    Dim SaveAs As Variant
    Dim phienban As Long
    If Val(Application.Version) >= 12 Then
       phienban = 1
    Else
        phienban = 2
    End If
    Dim OK As Boolean
    Filename = ActiveWorkbook.FullName
    If Filename <> ActiveWorkbook.Name Then
        ActiveWorkbook.save
    Else
        Do
        SaveAs = Application.GetSaveAsFilename(fileFilter:= _
        " Excel Macro Enabled Workbook (*.xlsm), *.xlsm," & _
        " Excel 2000-2003 Workbook (*.xls), *.xls," & _
        " Excel Binary Workbook (*.xlsb), *.xlsb", _
        FilterIndex:=phienban, Title:="Choose Save Location")
            If SaveAs = False Then
                Exit Sub
            Else
                If phienban <> 2 Then
                ActiveWorkbook.SaveAs SaveAs, FileFormat:=xlOpenXMLWorkbookMacroEnabled
                OK = True
                Else
                ActiveWorkbook.SaveAs SaveAs
                OK = True
                End If
            End If
        Loop Until OK
    End If
End Sub

Public Function isWorkbookOpen(WorkBookName As String) As Boolean
    isWorkbookOpen = False
    On Error GoTo WorkBookNotOpen
    If Len(Application.Workbooks(WorkBookName).Name) > 0 Then
        isWorkbookOpen = True
        Exit Function
    End If
WorkBookNotOpen:
End Function
Public Sub hidden(control As IRibbonControl, ByRef visible)
If isWorkbookOpen("DutoanGXD.xla") = True Then
    visible = True
Else: visible = False
End If
End Sub

Sub label1(control As IRibbonControl, ByRef label)
If isWorkbookOpen("DutoanGXD.xla") = True Then
label = Application.Workbooks("DutoanGXD.xla").Worksheets("NAME").Cells(1, 1).Value
End If
End Sub
Sub MOFILEDT(control As IRibbonControl, ByRef CancelDefault)
If isWorkbookOpen("DutoanGXD.xla") = True Then
Application.Run ("DutoanGXD.xla!MOFILE")
End If
End Sub




Attribute VB_Name = "shConfig"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 2560 bytes
SHA-256: ea88d9a16d6e50171fb2507acb2e2ccb1df4365fd833297905e93ea19edf82c4
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 143360 bytes
SHA-256: cf941ba3d4b5bfab9983499d4ca64a50fbc04e1da5aca8936cf1a8b5a5ec3fb8
Detection
ClamAV: Doc.Dropper.Valyria-6680506-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 5532 bytes
SHA-256: 201a489cbc151425b8dbdf6db55b930c0064ddc83826ca33e1db63a729f83acc

Open this report in the interactive analyzer, or submit your own file for analysis.