Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 810a8dc9dbd74576…

MALICIOUS

Office (OOXML)

1.54 MB Created: 2012-06-18 08:38:44 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-05-23
MD5: cfb12012444c165bbc107abf2953bc99 SHA-1: 68b5b27c2c0ed7a21a556d2fe39c5a29278982ef SHA-256: 810a8dc9dbd7457661bf2a8c113987a974faa199b5a3bede094398baa9ccdf18
278 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is an Excel macro-enabled document containing a Workbook_Open macro. This macro triggers obfuscated VBA code that utilizes WScript.Shell and CreateObject to execute commands, likely downloading and running a secondary payload. The presence of Shell() and WScript.Shell usage, along with an obfuscated loader heuristic, strongly indicates a downloader or droppper functionality.

Heuristics 10

  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        init_Stock_Paths
     Set WshShell = CreateObject("WScript.Shell")
    Ping = WshShell.Run("ping -n 1 " & "192.227.20.52", 0, True)
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        presupuesto = "-"
    nomFitx = CreateObject("scripting.filesystemobject").getbasename(ThisWorkbook.Name)
    codCliente = Sheets(hoja).Range("Cliente")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        presupuesto = "-"
    nomFitx = CreateObject("scripting.filesystemobject").getbasename(ThisWorkbook.Name)
    codCliente = Sheets(hoja).Range("Cliente")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    '-------------------
Private Sub Workbook_Open()
    inicializar
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        Data = Now
    user = Environ("Username")
  • External relationship medium OOXML_EXTERNAL_REL
    External target in xl/externalLinks/_rels/externalLink1.xml.rels: /ulma/Repcon_57_test/s26/docTemporal/estudioChequia_XCALVO8788151841963500000150/estudioLMPorCodigo_20180212_9241.xlsm
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://campus/actividadnegocio/soporteproducto/Dibujos%203D/ OOXML external relationship
    • http://www.iec.chOOXML external relationship
    • http://ns.adobe.com/xap/1.0/OOXML external relationship
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#OOXML external relationship
    • http://purl.org/dc/elements/1.1/OOXML external relationship
    • http://www.test.com/engine/3OOXML external relationship
    • http://www.w3.org/1999/XSL/TransformOOXML external relationship
    • https://www.google.com/maps/search/?api=1&query=OOXML external relationship

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1355826 bytes
SHA-256: 066312a2c1feadcf05daadf38faf68dba0bf07596af388c022724102afb2481b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'-------------------
'Ulma CyE.S.Coop 2019
'xcalvo@ulmaconstruction.es
'-------------------

'-------------------
'EXCELa ZABALTZEAN
'-------------------
Private Sub Workbook_Open()
    inicializar
End Sub

'-------------------
'EXCEL orria BIRKALKULATZEAN
'-------------------

Private Sub Workbook_SheetCalculate(ByVal Sh As Object)
    If UlmaLiburuaDa And Not templateAllDa Then
        If Sheets("Data").Range("CargaInicialFinalizada").Value = "X" And Sh.Name = "BoM" Then
            M0_Eventos.cambioNombreBotones
        End If
    End If
End Sub

'-------------------
'EXCEL-eko ORRI BAT ALDATZEAN
'-------------------
Private Sub Workbook_SheetChange(ByVal Sh As Object, ByVal Target As Range)
    cambioEnAlgunaHoja Sh, Target
End Sub

'-------------------
'EXCELEKO ORRI BATEKO HAUTAKETA ALDATZEAN
'-------------------
Private Sub Worksheet_SelectionChange(ByVal Target As Range)
    cambioSeleccionEnAlgunaHoja Target
End Sub







Attribute VB_Name = "Hoja1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "cmd_FromAcadRevit, 53, 0, MSForms, CommandButton"
Attribute VB_Control = "cmd_toRepcon, 52, 1, MSForms, CommandButton"
Attribute VB_Control = "cmd_SavePNG, 49, 2, MSForms, CommandButton"
Attribute VB_Control = "btn_OrderByMode, 41, 3, MSForms, CommandButton"
Attribute VB_Control = "tgb_idiomaENCorp, 40, 4, MSForms, ToggleButton"
Attribute VB_Control = "tgb_idiomaESCorp, 39, 5, MSForms, ToggleButton"
Attribute VB_Control = "tgb_idiomaLocal, 38, 6, MSForms, ToggleButton"
Attribute VB_Control = "CommandButton1, 33, 7, MSForms, CommandButton"
Attribute VB_Control = "cmd_DeleteLine, 31, 8, MSForms, CommandButton"
Attribute VB_Control = "cmd_PrintableSheet, 29, 9, MSForms, CommandButton"
Attribute VB_Control = "cmd_gmaps, 25, 10, MSForms, CommandButton"
Attribute VB_Control = "btn_OrderByDesc, 24, 11, MSForms, CommandButton"
Attribute VB_Control = "btn_OrderByCode, 23, 12, MSForms, CommandButton"
Attribute VB_Control = "btn_Release, 22, 13, MSForms, CommandButton"
Attribute VB_Control = "btn_Freight, 21, 14, MSForms, CommandButton"
Attribute VB_Control = "CheckBox1, 19, 15, MSForms, CheckBox"
Attribute VB_Control = "btnMaterialliste, 17, 16, MSForms, CommandButton"
Attribute VB_Control = "btnQuitarImagenesBoM, 16, 17, MSForms, CommandButton"
Attribute VB_Control = "ComboBox1, 3, 18, MSForms, ComboBox"
Attribute VB_Control = "btnCargarImagenesBoM, 13, 19, MSForms, CommandButton"
Attribute VB_Control = "btn_CrearListaWord, 14, 20, MSForms, CommandButton"
Attribute VB_Control = "btn_importPrecios, 20, 21, MSForms, CommandButton"
Attribute VB_Control = "combo_stock, 30, 22, MSForms, ComboBox"
Attribute VB_Control = "cmd_printFormat, 34, 23, MSForms, CommandButton"
Attribute VB_Control = "cmd_modoXML, 35, 24, MSForms, CommandButton"
Attribute VB_Control = "cmd_updStock, 37, 25, MSForms, CommandButton"
Attribute VB_Control = "cmd_gmaps_cliente, 42, 26, MSForms, CommandButton"
Attribute VB_Control = "cmd_updatePrices, 43, 27, MSForms, CommandButton"
Attribute VB_Control = "btn_OrderByFamily, 45, 28, MSForms, CommandButton"
Attribute VB_Control = "cmd_combinador, 46, 29, MSForms, CommandButton"
Attribute VB_Control = "cmd_Factors, 47, 30, MSForms, CommandButton"
Attribute VB_Control = "cmd_Join, 50, 31, MSForms, CommandButton"
Attribute VB_Control = "cmd_split, 51, 32, MSForms, CommandButton"
Attribute VB_Control = "cmd_XML, 54, 33, MSForms, CommandButton"
'-------------------
'Ulma CyE.S.Coop 2019
'xcalvo@ulmaconstruction.es
'-------------------

'-------------------
'COMBINAR BOTOIA
'-------------------
Private Sub cmd_combinador_Click()
    CombinarForm.Show
End Sub

'-------------------
'FAKTOREAK BOTOIA
'-------------------

Private Sub cmd_Factors_Click()
    FamilyFactors_Form.Show
End Sub

'-------------------
'ACAD/REVIT BOTOIA
'-------------------
Private Sub cmd_FromAcadRevit_Click()
    Mzz_FromAutocadRevit.fromACAD
End Sub

'-------------------
'JOIN BOTOIA
'-------------------
Private Sub cmd_Join_Click()
    Mzz_Split_Join_ColumnasGR.unirAUnaColumna
End Sub

'-------------------
'SPLIT BOTOIA
'-------------------
Private Sub cmd_split_Click()
    SplitInColumns_Form.Show
End Sub

'-------------------
'PNG BOTOIA
'-------------------
Private Sub cmd_SavePNG_Click()
    Mzz_SavePNG.SavePNG
End Sub


'-------------------
'REPCONERA BOTOIA
'-------------------
Private Sub cmd_toRepcon_Click()
    Mzz_ToRepcon.toRepcon
End Sub

'-------------------
'PREZIOAK BOTOIA
'-------------------
Private Sub cmd_updatePrices_Click()
    'actualizarPrecios
End Sub

'-------------------
'XML-ra ESPORTATU
'-------------------
Private Sub cmd_XML_Click()
    sortuXMLFitxategia
End Sub

'-------------------
'HIZKUNTZEN BOTOIAK
'-------------------

Private Sub tgb_idiomaENCorp_Click()
    Application.EnableEvents = False
    Dim finalizado As String
    finalizado = Sheets("Data").Range("CargaInicialFinalizada").Value
    If finalizado = "X" And tgb_idiomas <> "X" Then
        Application.Interactive = False
        If tgb_idiomaENCorp.Value = True Then
            tgb_idiomas = "X"
            If (tgb_idiomaESCorp.Value = False And tgb_idiomaLocal.Value = False) Then
                tgb_idiomas = ""
            End If
            tgb_idiomaESCorp.Value = False
            tgb_idiomaLocal.Value = False
            cambiaIdiomaDesc 2
            Sheets("Data").Range("IdiomaDatos").Value = "ENCorp"
        Else
            tgb_idiomas = "X"
            tgb_idiomaENCorp.Value = True
        End If
        Application.Interactive = True
    Else
        tgb_idiomas = ""
    End If
    Application.EnableEvents = True
End Sub

Private Sub tgb_idiomaESCorp_Click()
    Application.EnableEvents = False
    Dim finalizado As String
    finalizado = Sheets("Data").Range("CargaInicialFinalizada").Value
    If finalizado = "X" And tgb_idiomas <> "X" Then
        Application.Interactive = False
        If tgb_idiomaESCorp.Value = True Then
            tgb_idiomas = "X"
            If (tgb_idiomaENCorp.Value = False And tgb_idiomaLocal.Value = False) Then
                tgb_idiomas = ""
            End If
            tgb_idiomaENCorp.Value = False
            tgb_idiomaLocal.Value = False
            cambiaIdiomaDesc 1
            Sheets("Data").Range("IdiomaDatos").Value = "ESCorp"
        Else
            tgb_idiomas = "X"
            tgb_idiomaESCorp.Value = True
        End If
        Application.Interactive = True
    Else
        tgb_idiomas = ""
    End If
    Application.EnableEvents = True
End Sub

Private Sub tgb_idiomaLocal_Click()
    Application.EnableEvents = False
    Dim finalizado As String
    finalizado = Sheets("Data").Range("CargaInicialFinalizada").Value
    If finalizado = "X" And tgb_idiomas <> "X" Then
        Application.Interactive = False
        If tgb_idiomaLocal.Value = True Then
            tgb_idiomas = "X"
            If (tgb_idiomaENCorp.Value = False And tgb_idiomaESCorp.Value = False) Then
                tgb_idiomas = ""
            End If
            tgb_idiomaENCorp.Value = False
            tgb_idiomaESCorp.Value = False
            cambiaIdiomaDesc 0
            Sheets("Data").Range("IdiomaDatos").Value = "local"
        Else
            tgb_idiomas = "X"
            tgb_idiomaLocal.Value = True
        End If
        Application.Interactive = True
    Else
        tgb_idiomas = ""
    End If
    Application.EnableEvents = True
End Sub

'-------------------
'FREIGHT BOTOIA
'-------------------
Private Sub btn_Freight_Click()
    form_freight.Show
End Sub

'-------------------
'RELEASE BOTOIA
'-------------------
Private Sub btn_Release_Click()
    If (Sheets("BoM").Range("ID_Data_Freight").Value = "") Then
        MsgBox "Please, Fill Freight and Union before exporting to Release", vbOKOnly, "Warning"
    Else
        ReleaseForm.Show
    End If
End Sub

'-------------------
'INPORTAZIO BOTOIA
'-------------------
Private Sub btn_importPrecios_Click()
    ImportForm.Show
End Sub

'-------------------
'ORDENAZIO BOTOIA
'-------------------
Private Sub btn_OrderByCode_Click()
    ordenarFilas (1)
End Sub

Private Sub btn_OrderByDesc_Click()
    ordenarFilas (2)
End Sub


Private Sub btn_OrderByMode_Click()
    ordenarFilas (3)
End Sub

Private Sub btn_OrderByFamily_Click()
    ordenarFilas (4)
End Sub

'-------------------
'3D BOTOIA
'-------------------
Private Sub btnCargarImagenesBoM_Click()
    If Worksheets("Data").Range("UtilizandoCD").Value = "X" Then
        CargarImagenesBoMCD
    Else
        CargarImagenesBoM
    End If
    btnCargarImagenesBoM.Visible = False
    btnQuitarImagenesBoM.Visible = True
    ComprimirImagenes
End Sub

'-------------------
'3D KENDU BOTOIA
'-------------------
Private Sub btnQuitarImagenesBoM_Click()
    QuitarImagenesBoM
    btnQuitarImagenesBoM.Visible = False
    btnCargarImagenesBoM.Visible = True
End Sub

'-------------------
'WORDERA BOTOIA
'-------------------
Private Sub btn_CrearListaWord_Click()
        ImageFormExt.Show
End Sub

'-------------------
'MATERIALLISTE BOTOIA
'-------------------
Private Sub btnMaterialliste_Click()
    If Sheets("Data").Range("tipo_estudio").Value = "estudioAlemania" Then
        ExportMLGermanyNew
    ElseIf Sheets("Data").Range("tipo_estudio").Value = "estudioMexico" Then
        Cotizador
    ElseIf Sheets("Data").Range("tipo_estudio").Value = "estudioChequia" Then
        exportSteny
    ElseIf Sheets("Data").Range("tipo_estudio").Value = "estudioEslovaquia" Then
        exportStenySK
    ElseIf Sheets("Data").Range("tipo_estudio").Value = "estudioPeru" Then
        toCSV
    ElseIf Sheets("Data").Range("tipo_estudio").Value = "estudioArgentina" Then
        Ma16_Argentina.procArgentinaPrevisiones "Baan_Rental"
    ElseIf Sheets("Data").Range("tipo_estudio").Value = "estudioChile" Then
        Ma17_Chile.exportarARM
    End If
End Sub

'-------------------
'EZABATU LERROA BOTOIA
'-------------------
Private Sub cmd_DeleteLine_Click()
    CreaEliminaLinea.Show
End Sub

'-------------------
'EZABATU ZUTABEA BOTOIA
'-------------------
Private Sub CommandButton1_Click()
    CreaEliminaColumna.Show
End Sub

'-------------------
'GOOGLE MAPS BOTOIA
'-------------------
Private Sub cmd_gmaps_Click()
    gmaps_arakatu Sheets("BoM").Range("ID_Data_PoblacionObra").Value
End Sub

Private Sub cmd_gmaps_cliente_Click()
    gmaps_arakatu Sheets("BoM").Range("ID_Data_Direccion").Value & "," & Sheets("BoM").Range("ID_Data_PoblacionCliente").Value
End Sub

'-------------------
'ONLINE/OFFLINE BOTOIA
'-------------------
Private Sub cmd_modoXML_Click()
    If cmd_modoXML.Caption = "Online" Then
        cmd_modoXML.Caption = "Offline"
        cmd_modoXML.BackColor = RGB(255, 0, 0)
        'cbox_idiomaMat.Enabled = False
        tgb_idiomaLocal.Enabled = False
        tgb_idiomaESCorp.Enabled = False
        tgb_idiomaENCorp.Enabled = False
        cmd_updStock.Enabled = False
        'cmd_updatePrices.Enabled = False
    Else
        cmd_modoXML.Caption = "Online"
        cmd_modoXML.BackColor = RGB(102, 255, 102)
        'cbox_idiomaMat.Enabled = True
        tgb_idiomaLocal.Enabled = True
        tgb_idiomaESCorp.Enabled = True
        tgb_idiomaENCorp.Enabled = True
        'Ezgaitu eta berriro gaitu, konexio edukita Offline-tik Onlinera gatozen kasuan, ez baititu lehenengoan hizkuntza botoiak aktibatzen (bug).
        tgb_idiomaLocal.Enabled = False
        tgb_idiomaESCorp.Enabled = False
        tgb_idiomaENCorp.Enabled = False
        tgb_idiomaLocal.Enabled = True
        tgb_idiomaESCorp.Enabled = True
        tgb_idiomaENCorp.Enabled = True
        cmd_updStock.Enabled = True
        'cmd_updatePrices.Enabled = True
    End If
End Sub

'-------------------
'PRINTABLE SHEET BOTOIA
'-------------------
Private Sub cmd_PrintableSheet_Click()
    If Not (Sheets("BoM").Range("ID_Seleccionado").Formula = "=ID_SumaTotalColumnas") Then
        MsgBox "Solo se puede generar el Printable si la operación es SUMA"
    Else
        If Not Sheets("Data").Range("tipo_estudio").Value = "estudioEspana" Then
            SortuPrintable
        Else
            SortuPrintableSpain
        End If
    End If
End Sub

'-------------------
'PRINT BOM BOTOIA
'-------------------
Private Sub cmd_printFormat_Click()
    form_PrintFormat.Show
End Sub

'-------------------
'UPDATE STOCK BOTOIA
'-------------------
Private Sub cmd_updStock_Click()
    If (Sheets("Data").Range("CiaDatos").Value = 310) Then
        updateStock_pl
    ElseIf (Sheets("Data").Range("CiaDatos").Value = 300) Then
        updateStock_czsk
    ElseIf (Sheets("Data").Range("CiaDatos").Value = 302) Then
        updateStock_czsk
    ElseIf (Sheets("Data").Range("CiaDatos").Value = 312) Then
        updateStock_italy
    ElseIf (Sheets("Data").Range("CiaDatos").Value = 318) Then
        updateStock_chile
    ElseIf (Sheets("Data").Range("CiaDatos").Value = 107) Then
        form_stockNegatives.Show
    End If
End Sub

'-------------------
'STOCK COMBO BOTOIA
'-------------------
Private Sub combo_stock_Change()
    If cargaStock = "" Then
        controlStock
    End If
End Sub

'-------------------
'ORRIA ALDATZEAN BOTOIA
'-------------------
Private Sub Worksheet_SelectionChange(ByVal Target As Range)
badago = False
On Error Resume Next
Dim hel As Integer
    badago = ThisWorkbook.Worksheets("Data").Name <> ""
    hel = Sheets("Data").Range("destino_id_seleccionado").Value
    If badago Then
        If (Target.column = Sheets("Data").Range("NumColumnaIDSeleccionado") And Target.row = Sheets("Data").Range("FilaInicioArticulosLR") - 2 Or hel = 1) Then
          Dim egoera As Boolean
          egoera = Application.ScreenUpdating
        Application.ScreenUpdating = False
        egoera2 = Application.EnableEvents
        Application.EnableEvents = False
        
        hel = Sheets("Data").Range("destino_id_seleccionado").Value
        If ActiveWorkbook.ActiveSheet.Name = "BoM" And Target.column = Sheets("Data").Range("NumColumnaIDSeleccionado") And Target.row = Sheets("Data").Range("FilaInicioArticulosLR") - 2 Then
          With ActiveWindow
              Sheets("Data").Range("scroll_col").Value = .ScrollColumn
              Sheets("Data").Range("scroll_lin").Value = .ScrollRow
              Sheets("Data").Range("Zoom").Value = .Zoom
              .Zoom = 150
              .ScrollColumn = 13
              .ScrollRow = Sheets("Data").Range("FilaInicioArticulosLR") - 5
          End With
          Sheets("Data").Range("destino_id_seleccionado").Value = 1
        Else
          hel = Sheets("Data").Range("destino_id_seleccionado").Value
          If hel = 1 Then
              With ActiveWindow
                  .Zoom = Sheets("Data").Range("Zoom").Value
                  .ScrollColumn = Sheets("Data").Range("scroll_col").Value
                  .ScrollRow = Sheets("Data").Range("scroll_lin").Value
              End With
          End If
          Sheets("Data").Range("destino_id_seleccionado").Value = 0
        End If
        Application.ScreenUpdating = egoera
        Application.EnableEvents = egoera2
        End If
    End If
End Sub

'-------------------
'CHECKBOX-en MAKROAK
'-------------------

'CheckBox orokorra
Private Sub CheckBox1_Click()
    checkBoxMacro "CheckBox1"
End Sub


'Lerro bakoitzeko checkboxak
Private Sub CheckBox2_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox2"
End Sub
Private Sub CheckBox3_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox3"
End Sub
Private Sub CheckBox4_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox4"
End Sub
Private Sub CheckBox5_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox5"
End Sub
Private Sub CheckBox6_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox6"
End Sub
Private Sub CheckBox7_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox7"
End Sub
Private Sub CheckBox8_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox8"
End Sub
Private Sub CheckBox9_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox9"
End Sub
Private Sub CheckBox10_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox10"
End Sub
Private Sub CheckBox11_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox11"
End Sub
Private Sub CheckBox12_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox12"
End Sub
Private Sub CheckBox13_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox13"
End Sub
Private Sub CheckBox14_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox14"
End Sub
Private Sub CheckBox15_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox15"
End Sub
Private Sub CheckBox16_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox16"
End Sub
Private Sub CheckBox17_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox17"
End Sub
Private Sub CheckBox18_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox18"
End Sub
Private Sub CheckBox19_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox19"
End Sub
Private Sub CheckBox20_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox20"
End Sub
Private Sub CheckBox21_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox21"
End Sub
Private Sub CheckBox22_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox22"
End Sub
Private Sub CheckBox23_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox23"
End Sub
Private Sub CheckBox24_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox24"
End Sub
Private Sub CheckBox25_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox25"
End Sub
Private Sub CheckBox26_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox26"
End Sub
Private Sub CheckBox27_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox27"
End Sub
Private Sub CheckBox28_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox28"
End Sub
Private Sub CheckBox29_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox29"
End Sub
Private Sub CheckBox30_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox30"
End Sub
Private Sub CheckBox31_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox31"
End Sub
Private Sub CheckBox32_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox32"
End Sub
Private Sub CheckBox33_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox33"
End Sub
Private Sub CheckBox34_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox34"
End Sub
Private Sub CheckBox35_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox35"
End Sub
Private Sub CheckBox36_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox36"
End Sub
Private Sub CheckBox37_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox37"
End Sub
Private Sub CheckBox38_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox38"
End Sub
Private Sub CheckBox39_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox39"
End Sub
Private Sub CheckBox40_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox40"
End Sub
Private Sub CheckBox41_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox41"
End Sub
Private Sub CheckBox42_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox42"
End Sub
Private Sub CheckBox43_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox43"
End Sub
Private Sub CheckBox44_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox44"
End Sub
Private Sub CheckBox45_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox45"
End Sub
Private Sub CheckBox46_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox46"
End Sub
Private Sub CheckBox47_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox47"
End Sub
Private Sub CheckBox48_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox48"
End Sub
Private Sub CheckBox49_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox49"
End Sub
Private Sub CheckBox50_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox50"
End Sub
Private Sub CheckBox51_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox51"
End Sub
Private Sub CheckBox52_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox52"
End Sub
Private Sub CheckBox53_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox53"
End Sub
Private Sub CheckBox54_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox54"
End Sub
Private Sub CheckBox55_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox55"
End Sub
Private Sub CheckBox56_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox56"
End Sub
Private Sub CheckBox57_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox57"
End Sub
Private Sub CheckBox58_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox58"
End Sub
Private Sub CheckBox59_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox59"
End Sub
Private Sub CheckBox60_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox60"
End Sub
Private Sub CheckBox61_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox61"
End Sub
Private Sub CheckBox62_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox62"
End Sub
Private Sub CheckBox63_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox63"
End Sub
Private Sub CheckBox64_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox64"
End Sub
Private Sub CheckBox65_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox65"
End Sub
Private Sub CheckBox66_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox66"
End Sub
Private Sub CheckBox67_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox67"
End Sub
Private Sub CheckBox68_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox68"
End Sub
Private Sub CheckBox69_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox69"
End Sub
Private Sub CheckBox70_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox70"
End Sub
Private Sub CheckBox71_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox71"
End Sub
Private Sub CheckBox72_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox72"
End Sub
Private Sub CheckBox73_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox73"
End Sub
Private Sub CheckBox74_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox74"
End Sub
Private Sub CheckBox75_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox75"
End Sub
Private Sub CheckBox76_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox76"
End Sub
Private Sub CheckBox77_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox77"
End Sub
Private Sub CheckBox78_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox78"
End Sub
Private Sub CheckBox79_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox79"
End Sub
Private Sub CheckBox80_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox80"
End Sub
Private Sub CheckBox81_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox81"
End Sub
Private Sub CheckBox82_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox82"
End Sub
Private Sub CheckBox83_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
   End If
   checkBoxMacro "CheckBox83"
End Sub
Private Sub CheckBox84_Click()
   If checkBox_NoClick = "X" Then
      Exit Sub
…
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 4169216 bytes
SHA-256: d8164b51cbc59ac6e9c26e9f06e72ae6f0558c91f66dbd35929cf5b105eadfec
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image32.emf 2676 bytes
SHA-256: 172ff8495039fc46e3aac9a85e7a1ccef2f06043d69da06237c9c148d7eb26d5
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image39.emf 2780 bytes
SHA-256: 9fb88f43ae5403e905cc0d2f087028cad01056ea9ea28665bbf34590df1df704
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image38.emf 3136 bytes
SHA-256: 607fa9de267ded79d759ad3380b8935dd94936890d7fea388ae270bb8e5f76c7
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image37.emf 2924 bytes
SHA-256: 08f7af331633abec87170ce3ae84412f3c1f97a84e201f9930e9cc3ce4c9cedf
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image31.emf 2768 bytes
SHA-256: 188a08581adeacdb6a04470f1fa940657e730a9ba0af2631a90640e05a91bb7a
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image30.emf 2744 bytes
SHA-256: 901b0d41574ca91759f4c4b745610b0d40fb60a24eeb010ecd2358e893c20c87
emf_06.emf ooxml-emf OOXML EMF part: xl/media/image29.emf 2712 bytes
SHA-256: 8a6f11f62d3024028a1fe2f3b486f20d650b4a72f5eba16329788bc9740097ea
emf_07.emf ooxml-emf OOXML EMF part: xl/media/image21.emf 3632 bytes
SHA-256: 592fb1be93a27cb9b2276de4b6e16594badd1c0892d9b22349debef7a0025401
emf_08.emf ooxml-emf OOXML EMF part: xl/media/image20.emf 17452 bytes
SHA-256: d1bc39f58f985ff6eb73174ace3be953c112e61528d961f0f468b5043db8134f
emf_09.emf ooxml-emf OOXML EMF part: xl/media/image19.emf 26860 bytes
SHA-256: 5ddff714e76530b7c65a36ea9a79c4a96ed274b26a716b5cdf2e41bdc02b0434
emf_10.emf ooxml-emf OOXML EMF part: xl/media/image18.emf 14764 bytes
SHA-256: e9b5759704b99f0956e9b49d003707dce67959096c1d9fd1f730c51afd726ff1
emf_11.emf ooxml-emf OOXML EMF part: xl/media/image17.emf 4228 bytes
SHA-256: 97264fdfdb67d5201fb2372c46e0dba34c36e65057cd8a15b915a6fe431aa0e4
emf_12.emf ooxml-emf OOXML EMF part: xl/media/image22.emf 2708 bytes
SHA-256: fdfac48cf6dfacefbf3413ed340fdecbbb62614b5bb09f2cfca4fb9222c749f0
emf_13.emf ooxml-emf OOXML EMF part: xl/media/image23.emf 2676 bytes
SHA-256: a537fac159dcba39e6eb93c29ec618f96d359f0b08f230039fe755438b354ddb
emf_14.emf ooxml-emf OOXML EMF part: xl/media/image24.emf 2732 bytes
SHA-256: 1cd3ff4d4664c8b06d02b5f80d8cd68a8307452ffa4bac720890d37f045a7dae
emf_15.emf ooxml-emf OOXML EMF part: xl/media/image28.emf 2696 bytes
SHA-256: 7418418ba044829d82956e71c5306a38fddaee9adec8ee3e7a38d9f54c4d704c
emf_16.emf ooxml-emf OOXML EMF part: xl/media/image27.emf 17028 bytes
SHA-256: 845d253b7668b038a1b6c5fbe86b543a2d3158b4a7e3a56d49773f67463c283d
emf_17.emf ooxml-emf OOXML EMF part: xl/media/image26.emf 3028 bytes
SHA-256: d3b4ae89b5dfa860d749be43a7a54e85b4d31d4389980b1b060f3fc7c0912488
emf_18.emf ooxml-emf OOXML EMF part: xl/media/image25.emf 28672 bytes
SHA-256: 62370840f48b90b17db84106f1d09078384fb336150244b81701ae14d2a97227
emf_19.emf ooxml-emf OOXML EMF part: xl/media/image40.emf 2780 bytes
SHA-256: e6d27d91203fa6bb8232e35fab00aec4aabc380e62973f095b7afda2790a3aef
emf_20.emf ooxml-emf OOXML EMF part: xl/media/image41.emf 2732 bytes
SHA-256: 68c5c36a120860c6e13e80ef3bb6e6ec3de29205a49b052bd599282c0682f578
emf_21.emf ooxml-emf OOXML EMF part: xl/media/image42.emf 2768 bytes
SHA-256: b7c2762fc04532c78804812adfe6376b8196939d639c04cf2b0b1b7232d7fbfa
emf_22.emf ooxml-emf OOXML EMF part: xl/media/image45.emf 2868 bytes
SHA-256: 7c574cfc3655bc38fc596caf8868d115d81d570b25c450b6b3d8196ea86e2a1e
emf_23.emf ooxml-emf OOXML EMF part: xl/media/image44.emf 2744 bytes
SHA-256: 2a5bfafd7568e1d9d7561055695deeb88e15a322f8ab4a8c7300fbc63f9c0c02
emf_24.emf ooxml-emf OOXML EMF part: xl/media/image43.emf 17452 bytes
SHA-256: e038c75c1c6a0a36854e4aff5e2e496c3aedef021d11089920e95fcf95142575
emf_25.emf ooxml-emf OOXML EMF part: xl/media/image46.emf 2760 bytes
SHA-256: 40c2ad1e192d1fb4839f9c9b1c9487872b9a283833cba313f76a859b66f574ad
emf_26.emf ooxml-emf OOXML EMF part: xl/media/image47.emf 2780 bytes
SHA-256: 3d3b096c591eef67cbeb04b7b543744bdafbac9a81213ccca4980bb01abd2183
emf_27.emf ooxml-emf OOXML EMF part: xl/media/image48.emf 2732 bytes
SHA-256: b42357a3d9adb2615bd02d690b76310e7fdab60980fdda75a229f12706ede825
emf_28.emf ooxml-emf OOXML EMF part: xl/media/image52.emf 2888 bytes
SHA-256: 069e085cc63f3720cd27cca2dfa37b151f096d4e567ecd289fc2322d5d38f41b
emf_29.emf ooxml-emf OOXML EMF part: xl/media/image51.emf 2744 bytes
SHA-256: e34f1719076686e188fa4b68329f0747664b3874dbf53d90233d2909731d05ea

Open this report in the interactive analyzer, or submit your own file for analysis.