Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 760a1d98394bf8f7…

MALICIOUS

Office (OLE)

589.5 KB Created: 2013-03-26 20:09:00 Authoring application: Microsoft Office Word First seen: 2015-09-16
MD5: 53f3343a0da9af8de300d66cfd554c00 SHA-1: 9c0269f36ab43039d558e27ad07c03f27599b889 SHA-256: 760a1d98394bf8f797229a56641674601f377ca61a391155bb46cfd394f57468
96 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a large VBA macro. The critical heuristic indicates self-replication of VBA code, suggesting the macro is designed to persist or spread within the document or potentially other documents. The presence of a Document_Open macro further supports this, as it automatically executes upon opening. While the specific payload or ultimate goal is not clear from the provided script excerpt, the macro's self-replication and the document's structure suggest it's intended to be delivered via spearphishing.

Heuristics 4

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            .DeleteLines 1, .CountOfLines
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 217777 bytes
SHA-256: d1507ad95d5812c665717b19fdaa7141cf518a73db08d94c622b197a04dea154
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const DocumentCaws = "Hoarelea Y81"
Private Sub Document_Close()
    CloseMenu
End Sub


Private Sub cmdUpdate_Click()
    On Error Resume Next
    Dim oRange As Range
    If ActiveDocument.Bookmarks.Exists("ProjectName") Then
        Set oRange = ActiveDocument.Bookmarks("ProjectName").Range
        oRange.Text = txtProj_Name.Text
        ActiveDocument.Bookmarks.Add Name:="ProjectName", Range:=oRange
    End If
    If ActiveDocument.Bookmarks.Exists("SpecificationTitle") Then
        Set oRange = ActiveDocument.Bookmarks("SpecificationTitle").Range
        oRange.Text = txtSpec_Title.Text
        ActiveDocument.Bookmarks.Add Name:="SpecificationTitle", Range:=oRange
    End If
    UpdateAll
    Unload Me
End Sub

Private Sub UserForm_Initialize()
    On Error Resume Next
    If ActiveDocument.Bookmarks.Exists("ProjectName") Then
        txtProj_Name.Text = ActiveDocument.Bookmarks("ProjectName").Range.Text
    Else
        Label1.Caption = "Project Name: Do not use, bookmark has been deleted!"
    End If
    If ActiveDocument.Bookmarks.Exists("SpecificationTitle") Then
        txtSpec_Title.Text = ActiveDocument.Bookmarks("SpecificationTitle").Range.Text
    Else
        Label2.Caption = "Specification Title: Do not use, bookmark has been deleted!"
    End If
End Sub
Sub UpdateAll()

    Application.ScreenUpdating = False
    Dim sec As section

    ActiveDocument.Fields.Update
    For Each sec In ActiveDocument.Sections
    
    sec.Headers(wdHeaderFooterPrimary).Range.Fields.Update
    
    sec.Headers(wdHeaderFooterFirstPage).Range.Fields.Update
    
    Next

End Sub

Private Sub CommandButton1_Click()
    On Error Resume Next
    'confirm with engineer that he is going to delete the engineering guides
    Dim answer As Integer
    answer = MsgBox("You are about to delete all paragraphs with 'Engineer's Guidance' style applied. Are you sure you want to continue", vbYesNoCancel)
    If answer = vbYes Then
        Application.ScreenUpdating = False
        'delete Issue Status Table - this needs to be done first otherwise program goes into continuous find loop
        deleteIssueTable
        'new Aug 2012
        DeleteAllGuidelines
        'end new
        Application.ScreenUpdating = True
        'Now delete all the code (if required)
        On Error Resume Next
        answer = MsgBox("Some virus checkers prevent word documents from opening if they contain embedded macros, do you want to remove all HoareLea Macros (e.g. Menus, TOC updating) from this document?", vbYesNo)
        If answer = vbYes Then
            deleteAllVba
        Else
            deleteProcedure "ThisDocument", "CommandButton1_Click"
        End If
    End If
End Sub

Private Sub DeleteAllGuidelines()
        On Error GoTo WarnEngineer
        'first do the paragraphs
        If StyleExists("Engineer's Guidance Text") Then
            DeleteTextWithGivenStyle style:="Engineer's Guidance Text"
        End If
        If StyleExists("Engineer's Guidance bullets") Then
            DeleteTextWithGivenStyle style:="Engineer's Guidance bullets"
        End If
        If StyleExists("Engineer's Guidance Text Char") Then
            DeleteTextWithGivenStyle style:="Engineer's Guidance Text Char"
        End If
        If StyleExists("Engineer's Guidance bullets Char") Then
            DeleteTextWithGivenStyle style:="Engineer's Guidance bullets Char"
        End If
        If StyleExists("Engineers Select Char") Then
            'lastly change any Engineer Select text to normal bodytext
            ChangeEngineerSelectToBodyTextStyle
        End If
        Exit Sub
WarnEngineer:
        MsgBox Prompt:="Could not delete all 'Engineering Guidance' text - manually check your document (especially tables).", Buttons:=vbOKOnly, title:="Warning!"
End Sub

'check to see if the style exists - perhaps the engineer has deleted the style!
Function StyleExists(StyleName As String) As Boolean
    Dim MyStyle As Word.style
    On Error Resume Next
     ' maybe this ...
    Set MyStyle = ActiveDocument.Styles(StyleName)
     ' or maybe this ...
     ' Set MyStyle = ActiveDocument.AttachedTemplate.Styles(StyleName)
    StyleExists = Not MyStyle Is Nothing
End Function

Sub DeleteTextWithGivenStyle(ByVal style As String)
  Dim oRng As Range
  Set oRng = ActiveDocument.Range(Start:=0, End:=0)
  With oRng.Find
    ' Preparation
    .ClearFormatting
    .Replacement.ClearFormatting
    .Text = ""
    .Replacement.Text = ""
    .MatchWildcards = False
    .Wrap = wdFindContinue
    .style = ActiveDocument.Styles(style)
    .Execute Replace:=wdReplaceAll
  End With
End Sub

Sub ChangeEngineerSelectToBodyTextStyle()
    With ActiveDocument.Content.Find
        .ClearFormatting
        .MatchWildcards = False
        .Wrap = wdFindContinue
        .style = ActiveDocument.Styles("Engineers Select Char")
        
        With .Replacement
            .ClearFormatting
            .style = ActiveDocument.Styles("Body Text Char")
        End With
        .Execute FindText:="", ReplaceWith:="", Format:=True, Replace:=wdReplaceAll
    End With
End Sub



Private Sub Document_New()
    'this routine intercepts the print request and updates the toc before proceeding
    InitEvents
End Sub



Private Sub Document_Open()

On Error Resume Next
    'this routine intercepts the print request and updates the toc before proceeding
    InitEvents
    'if this is the first time the engineer has opened the file then open the interactive template window
    Dim test As Boolean
    Dim caws As Boolean
    Dim notNew As Boolean
    Dim hideMenu As Boolean
    test = False
    caws = False
    notNew = False
    hideMenu = False
    For Each docvar In ActiveDocument.Variables
        Select Case docvar.Name
            Case "notNew"
                notNew = True
            Case "hideMenu"
                hideMenu = True
            Case "Doc_Saved_As"
                test = True
            Case "caws"
                caws = True
        End Select
    Next docvar
    'Is this the first time that the engineer has openend this document?
    If notNew = False Then
        'first time opening document
        '1 set headers
        'ActiveDocument.Variables("Project_Name1").Value = "[PROJECT NAME]"
        'ActiveDocument.Variables("Project_Name2").Value = "[PROJECT NAME]"
        'ActiveDocument.Variables("Specification_Title1").Value = "[SPECIFICATION TITLE]"
        'ActiveDocument.Variables("Specification_Title2").Value = "[SPECIFICATION TITLE]"
        'Set the docuemnt variable so that frmWizard does not show again
        ActiveDocument.Variables.Add Name:="notNew", Value:=1
        'call the interactive template
        frmWizard.Show
    End If
    'try and eliminate the shutdown menu for other open docuemnts
    If test Then
        ActiveDocument.Variables("Doc_Saved_As").Value = ActiveDocument.Name
    Else
        ActiveDocument.Variables.Add Name:="Doc_Saved_As", Value:=ActiveDocument.Name
    End If
    If caws Then
        ActiveDocument.Variables("caws").Value = "s32"
    Else
        ActiveDocument.Variables.Add Name:="caws", Value:="s32"
    End If
    'add the hoarelea w12 menu - if it exists delete the old version.
    checkmenu = Application.CommandBars("Menu Bar").Controls(DocumentCaws).Application
    If (checkmenu <> "") Then
        Application.CommandBars("Menu Bar").Controls(DocumentCaws).Delete
    End If
    If Not hideMenu Then
        'build_menu
    End If
End Sub



Private Sub change_headers()
    frmDocVariables.Show
End Sub


'This subroutine is only used for testing it reinitialises the docvariables, vba code thinks that this is a first time document and gives the interative template and menu
Private Sub initialConditions()
    On Error Resume Next
    For Each docvar In ActiveDocument.Variables
        If docvar.Name = "notNew" Then
            ActiveDocument.Variables("notNew").Delete
        End If
        If docvar.Name = "hidemenu" Then
            ActiveDocument.Variables("hideMenu").Delete
        End If
    Next docvar
End Sub



Sub deleteAllVba()
    CloseMenu
    'Goes through each vbcomponent and deletes the component, it will only delete the code in ThisDocumnet however
    On Error Resume Next
    Dim vbComp As Object
    For Each vbComp In ActiveDocument.VBProject.VBComponents
        With vbComp
        If .Type <> 100 Then
            ActiveDocument.VBProject.VBComponents.Remove vbComp
        End If
        End With
    Next vbComp
    'delete all the code in thisDocument
    With ActiveDocument.VBProject.VBComponents("ThisDocument").CodeModule
        If .CountOfLines > 0 Then
        .DeleteLines 1, .CountOfLines
        End If
    End With
End Sub


Sub deleteProcedure(componentName As String, procedureName As String)
    'Deletes a named procedure from a named vb component e.g. CommandButton1_Click in ThisDocument
    On Error Resume Next
    Dim startSubLine, numberOfSubLines As Integer
    startSubLine = ActiveDocument.VBProject.VBComponents(componentName).CodeModule.ProcStartLine(procedureName, vbext_pk_Proc)
    If startSubLine > 0 Then
    numberOfSubLines = ActiveDocument.VBProject.VBComponents(componentName).CodeModule.ProcCountLines(procedureName, vbext_pk_Proc)
    ActiveDocument.VBProject.VBComponents(componentName).CodeModule.DeleteLines startSubLine, numberOfSubLines
    End If
End Sub


Private Sub CloseMenu()
    'Delete the menu
    On Error Resume Next
    Dim checkmenu As String
    On Error Resume Next
    checkmenu = Application.CommandBars("Menu Bar").Controls(DocumentCaws).Application
    If (checkmenu <> "") Then
        Application.CommandBars("Menu Bar").Controls(DocumentCaws).Delete
    End If
End Sub
Sub deleteIssueTable()
    If ActiveDocument.Bookmarks.Exists("IssueTable") = True Then
        ActiveDocument.Bookmarks("IssueTable").Range.Select
        Selection.Delete
    End If
    Dim tblTemp As Table
    Dim oDoc1 As Document
    If ActiveDocument.Tables.Count >= 1 Then
        Set oDoc1 = ActiveDocument
        For Each tblTemp In oDoc1.Tables
            'test for range - otherwise it will jump out of subroutine
            If Not tblTemp.Range.style Is Nothing Then
                If tblTemp.Range.style.NameLocal = "Engineer's Guidance Text" Then
                    tblTemp.Delete
                    Exit For
                End If
            End If
        Next
    End If
End Sub


Attribute VB_Name = "frmWizard"
Attribute VB_Base = "0{3FBAA7B5-8EB1-4C11-AA3C-D0060649B9B2}{50FA3F57-AAAA-43C5-A356-DEA4D44DCD35}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Option Explicit
Dim m_iTotalSteps As Integer
Dim m_sCurStep As String
'''''''''''''''''''''''''''''
'Checkbox routines
'''''''''''''''''''''''''''''



Private Sub chk_standards_1_1_Click()
    On Error Resume Next
    If chk_standards_1_1.Value = False Then
        chk_standards_1_1.ForeColor = &H808080
    Else
        chk_standards_1_1.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_2_Click()
    On Error Resume Next
    If chk_standards_1_2.Value = False Then
        chk_standards_1_2.ForeColor = &H808080
    Else
        chk_standards_1_2.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_3_Click()
    On Error Resume Next
    If chk_standards_1_3.Value = False Then
        chk_standards_1_3.ForeColor = &H808080
    Else
        chk_standards_1_3.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_4_Click()
    On Error Resume Next
    If chk_standards_1_4.Value = False Then
        chk_standards_1_4.ForeColor = &H808080
    Else
        chk_standards_1_4.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_5_Click()
    On Error Resume Next
    If chk_standards_1_5.Value = False Then
        chk_standards_1_5.ForeColor = &H808080
    Else
        chk_standards_1_5.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_6_Click()
    On Error Resume Next
    If chk_standards_1_6.Value = False Then
        chk_standards_1_6.ForeColor = &H808080
    Else
        chk_standards_1_6.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_7_Click()
    On Error Resume Next
    If chk_standards_1_7.Value = False Then
        chk_standards_1_7.ForeColor = &H808080
    Else
        chk_standards_1_7.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_8_Click()
    On Error Resume Next
    If chk_standards_1_8.Value = False Then
        chk_standards_1_8.ForeColor = &H808080
    Else
        chk_standards_1_8.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_9_Click()
    On Error Resume Next
    If chk_standards_1_9.Value = False Then
        chk_standards_1_9.ForeColor = &H808080
    Else
        chk_standards_1_9.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_10_Click()
    On Error Resume Next
    If chk_standards_1_10.Value = False Then
        chk_standards_1_10.ForeColor = &H808080
    Else
        chk_standards_1_10.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_11_Click()
    On Error Resume Next
    If chk_standards_1_11.Value = False Then
        chk_standards_1_11.ForeColor = &H808080
    Else
        chk_standards_1_11.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_12_Click()
    On Error Resume Next
    If chk_standards_1_12.Value = False Then
        chk_standards_1_12.ForeColor = &H808080
    Else
        chk_standards_1_12.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_13_Click()
    On Error Resume Next
    If chk_standards_1_13.Value = False Then
        chk_standards_1_13.ForeColor = &H808080
    Else
        chk_standards_1_13.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_14_Click()
    On Error Resume Next
    If chk_standards_1_14.Value = False Then
        chk_standards_1_14.ForeColor = &H808080
    Else
        chk_standards_1_14.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_15_Click()
    On Error Resume Next
    If chk_standards_1_15.Value = False Then
        chk_standards_1_15.ForeColor = &H808080
    Else
        chk_standards_1_15.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_16_Click()
    On Error Resume Next
    If chk_standards_1_16.Value = False Then
        chk_standards_1_16.ForeColor = &H808080
    Else
        chk_standards_1_16.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_17_Click()
    On Error Resume Next
    If chk_standards_1_17.Value = False Then
        chk_standards_1_17.ForeColor = &H808080
    Else
        chk_standards_1_17.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_18_Click()
    On Error Resume Next
    If chk_standards_1_18.Value = False Then
        chk_standards_1_18.ForeColor = &H808080
    Else
        chk_standards_1_18.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_19_Click()
    On Error Resume Next
    If chk_standards_1_19.Value = False Then
        chk_standards_1_19.ForeColor = &H808080
    Else
        chk_standards_1_19.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_20_Click()
    On Error Resume Next
    If chk_standards_1_20.Value = False Then
        chk_standards_1_20.ForeColor = &H808080
    Else
        chk_standards_1_20.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_1_Click()
    On Error Resume Next
    If chk_standards_2_1.Value = False Then
        chk_standards_2_1.ForeColor = &H808080
    Else
        chk_standards_2_1.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_2_Click()
    On Error Resume Next
    If chk_standards_2_2.Value = False Then
        chk_standards_2_2.ForeColor = &H808080
    Else
        chk_standards_2_2.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_3_Click()
    On Error Resume Next
    If chk_standards_2_3.Value = False Then
        chk_standards_2_3.ForeColor = &H808080
    Else
        chk_standards_2_3.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_4_Click()
    On Error Resume Next
    If chk_standards_2_4.Value = False Then
        chk_standards_2_4.ForeColor = &H808080
    Else
        chk_standards_2_4.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_5_Click()
    On Error Resume Next
    If chk_standards_2_5.Value = False Then
        chk_standards_2_5.ForeColor = &H808080
    Else
        chk_standards_2_5.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_6_Click()
    On Error Resume Next
    If chk_standards_2_6.Value = False Then
        chk_standards_2_6.ForeColor = &H808080
    Else
        chk_standards_2_6.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_7_Click()
    On Error Resume Next
    If chk_standards_2_7.Value = False Then
        chk_standards_2_7.ForeColor = &H808080
    Else
        chk_standards_2_7.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_8_Click()
    On Error Resume Next
    If chk_standards_2_8.Value = False Then
        chk_standards_2_8.ForeColor = &H808080
    Else
        chk_standards_2_8.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_9_Click()
    On Error Resume Next
    If chk_standards_2_9.Value = False Then
        chk_standards_2_9.ForeColor = &H808080
    Else
        chk_standards_2_9.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_10_Click()
    On Error Resume Next
    If chk_standards_2_10.Value = False Then
        chk_standards_2_10.ForeColor = &H808080
    Else
        chk_standards_2_10.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_11_Click()
    On Error Resume Next
    If chk_standards_2_11.Value = False Then
        chk_standards_2_11.ForeColor = &H808080
    Else
        chk_standards_2_11.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_12_Click()
    On Error Resume Next
    If chk_standards_2_12.Value = False Then
        chk_standards_2_12.ForeColor = &H808080
    Else
        chk_standards_2_12.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_13_Click()
    On Error Resume Next
    If chk_standards_2_13.Value = False Then
        chk_standards_2_13.ForeColor = &H808080
    Else
        chk_standards_2_13.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_14_Click()
    On Error Resume Next
    If chk_standards_2_14.Value = False Then
        chk_standards_2_14.ForeColor = &H808080
    Else
        chk_standards_2_14.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_15_Click()
    On Error Resume Next
    If chk_standards_2_15.Value = False Then
        chk_standards_2_15.ForeColor = &H808080
    Else
        chk_standards_2_15.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_16_Click()
    On Error Resume Next
    If chk_standards_2_16.Value = False Then
        chk_standards_2_16.ForeColor = &H808080
    Else
        chk_standards_2_16.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_17_Click()
    On Error Resume Next
    If chk_standards_2_17.Value = False Then
        chk_standards_2_17.ForeColor = &H808080
    Else
        chk_standards_2_17.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_18_Click()
    On Error Resume Next
    If chk_standards_2_18.Value = False Then
        chk_standards_2_18.ForeColor = &H808080
    Else
        chk_standards_2_18.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_19_Click()
    On Error Resume Next
    If chk_standards_2_19.Value = False Then
        chk_standards_2_19.ForeColor = &H808080
    Else
        chk_standards_2_19.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_20_Click()
    On Error Resume Next
    If chk_standards_2_20.Value = False Then
        chk_standards_2_20.ForeColor = &H808080
    Else
        chk_standards_2_20.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_1_Click()
    On Error Resume Next
    If chk_standards_3_1.Value = False Then
        chk_standards_3_1.ForeColor = &H808080
    Else
        chk_standards_3_1.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_2_Click()
    On Error Resume Next
    If chk_standards_3_2.Value = False Then
        chk_standards_3_2.ForeColor = &H808080
    Else
        chk_standards_3_2.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_3_Click()
    On Error Resume Next
    If chk_standards_3_3.Value = False Then
        chk_standards_3_3.ForeColor = &H808080
    Else
        chk_standards_3_3.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_4_Click()
    On Error Resume Next
    If chk_standards_3_4.Value = False Then
        chk_standards_3_4.ForeColor = &H808080
    Else
        chk_standards_3_4.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_5_Click()
    On Error Resume Next
    If chk_standards_3_5.Value = False Then
        chk_standards_3_5.ForeColor = &H808080
    Else
        chk_standards_3_5.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_6_Click()
    On Error Resume Next
    If chk_standards_3_6.Value = False Then
        chk_standards_3_6.ForeColor = &H808080
    Else
        chk_standards_3_6.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_7_Click()
    On Error Resume Next
    If chk_standards_3_7.Value = False Then
        chk_standards_3_7.ForeColor = &H808080
    Else
        chk_standards_3_7.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_8_Click()
    On Error Resume Next
    If chk_standards_3_8.Value = False Then
        chk_standards_3_8.ForeColor = &H808080
    Else
        chk_standards_3_8.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_9_Click()
    On Error Resume Next
    If chk_standards_3_9.Value = False Then
        chk_standards_3_9.ForeColor = &H808080
    Else
        chk_standards_3_9.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_10_Click()
    On Error Resume Next
    If chk_standards_3_10.Value = False Then
        chk_standards_3_10.ForeColor = &H808080
    Else
        chk_standards_3_10.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_11_Click()
    On Error Resume Next
    If chk_standards_3_11.Value = False Then
        chk_standards_3_11.ForeColor = &H808080
    Else
        chk_standards_3_11.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_12_Click()
    On Error Resume Next
    If chk_standards_3_12.Value = False Then
        chk_standards_3_12.ForeColor = &H808080
    Else
        chk_standards_3_12.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_13_Click()
    On Error Resume Next
    If chk_standards_3_13.Value = False Then
        chk_standards_3_13.ForeColor = &H808080
    Else
        chk_standards_3_13.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_14_Click()
    On Error Resume Next
    If chk_standards_3_14.Value = False Then
        chk_standards_3_14.ForeColor = &H808080
    Else
        chk_standards_3_14.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_15_Click()
    On Error Resume Next
    If chk_standards_3_15.Value = False Then
        chk_standards_3_15.ForeColor = &H808080
    Else
        chk_standards_3_15.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_16_Click()
    On Error Resume Next
    If chk_standards_3_16.Value = False Then
        chk_standards_3_16.ForeColor = &H808080
    Else
        chk_standards_3_16.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_17_Click()
    On Error Resume Next
    If chk_standards_3_17.Value = False Then
        chk_standards_3_17.ForeColor = &H808080
    Else
        chk_standards_3_17.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_3_18_Click()
    On Error Resume Next
    If chk_standards_3_18.Value = False Then
        chk_standards_3_18.ForeColor = &H808080
    Else
        chk_standards_3_18.ForeColor = &H0&
    End If
End Sub

Private Sub chk_600_1_Click()
    On Error Resume Next
    If chk_600_1.Value = False Then
        chk_600_1.ForeColor = &H808080
    chk_600_1_1.Value = False
    chk_600_1_1.Enabled = False
    chk_600_1_2.Value = False
    chk_600_1_2.Enabled = False
    Else
        chk_600_1.ForeColor = &H0&
    chk_600_1_1.Enabled = True
    chk_600_1_2.Enabled = True
    End If
End Sub


Private Sub chk_600_2_Click()
    On Error Resume Next
    If chk_600_2.Value = False Then
        chk_600_2.ForeColor = &H808080
    chk_600_2_1.Value = False
    chk_600_2_1.Enabled = False
    chk_600_2_2.Value = False
    chk_600_2_2.Enabled = False
    chk_600_2_3.Value = False
    chk_600_2_3.Enabled = False
    chk_600_2_4.Value = False
    chk_600_2_4.Enabled = False
    Else
        chk_600_2.ForeColor = &H0&
    chk_600_2_1.Enabled = True
    chk_600_2_2.Enabled = True
    chk_600_2_3.Enabled = True
    chk_600_2_4.Enabled = True
    End If
End Sub


Private Sub chk_600_3_Click()
    On Error Resume Next
    If chk_600_3.Value = False Then
        chk_600_3.ForeColor = &H808080
    chk_600_3_1.Value = False
    chk_600_3_1.Enabled = False
    chk_600_3_2.Value = False
    chk_600_3_2.Enabled = False
    Else
        chk_600_3.ForeColor = &H0&
    chk_600_3_1.Enabled = True
    chk_600_3_2.Enabled = True
    End If
End Sub


Private Sub chk_600_4_Click()
    On Error Resume Next
    If chk_600_4.Value = False Then
        chk_600_4.ForeColor = &H808080
    chk_600_4_1.Value = False
    chk_600_4_1.Enabled = False
    chk_600_4_2.Value = False
    chk_600_4_2.Enabled = False
    Else
        chk_600_4.ForeColor = &H0&
    chk_600_4_1.Enabled = True
    chk_600_4_2.Enabled = True
    End If
End Sub


Private Sub chk_600_5_Click()
    On Error Resume Next
    If chk_600_5.Value = False Then
        chk_600_5.ForeColor = &H808080
    chk_600_5_1.Value = False
    chk_600_5_1.Enabled = False
    chk_600_5_2.Value = False
    chk_600_5_2.Enabled = False
    chk_600_5_3.Value = False
    chk_600_5_3.Enabled = False
    chk_600_5_4.Value = False
    chk_600_5_4.Enabled = False
    chk_600_5_5.Value = False
    chk_600_5_5.Enabled = False
    chk_600_5_6.Value = False
    chk_600_5_6.Enabled = False
    chk_600_5_7.Value = False
    chk_600_5_7.Enabled = False
    Else
        chk_600_5.ForeColor = &H0&
    chk_600_5_1.Enabled = True
    chk_600_5_2.Enabled = True
    chk_600_5_3.Enabled = True
    chk_600_5_4.Enabled = True
    chk_600_5_5.Enabled = True
    chk_600_5_6.Enabled = True
    chk_600_5_7.Enabled = True
    End If
…