MALICIOUS
232
Risk Score
Heuristics 8
-
VBA project inside OOXML medium 4 related findings OOXML_VBADocument contains a VBA project — VBA macros present
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
GtZaaOxScpihjaaXWFUygW = Shell( _ -
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
.InsertLines KmmEUECMwkqXBYdKCsRUEJ + 1, "" -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set NotesUIWorkspace = CreateObject("Notes.NotesUiWorkspace") -
GetObject call high OLE_VBA_GETOBJGetObject callMatched line in script
eCKGVqVDx = GetObject( _ -
Hidden worksheet (veryHidden, hidden) low OOXML_HIDDEN_SHEETExcel workbook contains 14 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
-
ClamAV scan did not complete info CLAMAV_SCAN_INCOMPLETEClamAV scan on this file did not complete (ClamAV error (exit -15)); the verdict reflects only static heuristics. The result is not cached so a later submission will retry the scan.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 25
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 700504 bytes |
SHA-256: 918f0308bf70fa79917fcbdf79a613d6a42038f7f968ad7ffb09918b7399983d |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
1521 of 2516 identifiers look randomly generated (e.g. 'DVIyEFHKOQcHGoLIOCghDQKDefxOuHL_DblClick') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "DieseArbeitsmappe"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Const FIELD_TMPOGORPHANDOCCHECKED = "TMPOGOrphanDocChecked"
#If VBA7 Then '// 2013-09-11 FS: 64 bit compatibility
Private Declare PtrSafe Function ShowWindow Lib "user32.dll" (ByVal hwnd As LongPtr, ByVal nCmdShow As Long) As Long
Private Declare PtrSafe Function FindWindow Lib "user32.dll" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As LongPtr
#Else
Private Declare Function ShowWindow Lib "user32.dll" (ByVal hwnd As Long, ByVal nCmdShow As Long) As Long
Private Declare Function FindWindow Lib "user32.dll" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
#End If
Public NotesThisUiDoc As Object
Public NotesThisDoc As Object
Public NotesUIWorkspace As Object
Public NotesThisDatabase As Object
Public NotesSession As Object
Public docFullName As String
Dim lastRevisionNumber As Integer
Dim cachedObjects(0 To 3) As Variant
Dim blnReadOnly As Boolean
Dim blnAlwaysTreatAsModifiedOnClose As Boolean
Sub OgTest()
MsgBox NotesThisDoc.GetItemValue("wpActiveDocument")(0)
End Sub
Public Function OgMsgBox(pPar1, pPar2, pPar3)
OgMsgBox = MsgBox(pPar1, pPar2, pPar3)
End Function
Public Sub OgAppActivate(pPar)
AppActivate (pPar)
End Sub
Public Sub SetNotesWindowState(pPar)
#If VBA7 Then
Dim handle As LongPtr
#Else
Dim handle As Long
#End If
handle = FindWindow(vbNullString, NotesThisUiDoc.WindowTitle)
If handle = 0 Then handle = FindWindow(vbNullString, NotesThisUiDoc.WindowTitle & " - IBM Notes") '// 2013-09-17 FS: update application title for window identification (formerly "Lotus Notes", "IBM Lotus Notes")
If handle <> 0 Then Call ShowWindow(handle, pPar)
End Sub
Public Sub IconifyNotes()
Call SetNotesWindowState(2)
End Sub
Public Sub MaximizeNotes()
Call SetNotesWindowState(3)
End Sub
Private Sub UpdateOrphanCheckField()
If Not NotesThisDoc Is Nothing Then
If NotesThisDoc.GetItemValue(FIELD_TMPOGORPHANDOCCHECKED)(0) = "1" Then
NotesThisDoc.ReplaceItemValue(FIELD_TMPOGORPHANDOCCHECKED, "2").SaveToDisk = False
End If
End If
End Sub
Private Sub ResetOrphanCheckField()
If Not NotesThisDoc Is Nothing Then
If NotesThisDoc.GetItemValue(FIELD_TMPOGORPHANDOCCHECKED)(0) = "2" Then
NotesThisDoc.ReplaceItemValue(FIELD_TMPOGORPHANDOCCHECKED, "1").SaveToDisk = False
End If
End If
End Sub
Public Sub IsSaved()
ThisWorkbook.Saved = True
End Sub
Public Sub OGPostOpen_Excel()
Application.ActiveWindow.Activate
If ThisWorkbook.ReadOnly Then
'ThisWorkbook.Activate '// 2013-11-29 FS: do not jump to first worksheet
blnReadOnly = True
MsgBox "Dokument ist schreibgeschützt - Änderungen werden ignoriert.", vbExclamation, "Dokument öffnen"
End If
lastRevisionNumber = 0
docFullName = ThisWorkbook.FullName
Set NotesUIWorkspace = CreateObject("Notes.NotesUiWorkspace")
Set NotesSession = CreateObject("Notes.NotesSession")
Set NotesThisDatabase = NotesSession.currentDatabase
Set NotesThisUiDoc = NotesUIWorkspace.CurrentDocument
'// FS 20060202: Allow initialization when NotesThisUiDoc is unavailable for calls with backend documents.
'// FS 20041025: May indicate second Notes instance is running and no database or document is open.
If NotesThisDatabase Is Nothing Then
Set NotesThisDoc = Nothing
Set NotesThisUiDoc = Nothing
Set NotesUIWorkspace = Nothing
Set NotesSession = Nothing
Set NotesThisDatabase = Nothing
MsgBox "Beim Ermitteln des zugehörigen Notes-Dokuments ist ein Fehler aufgetreten. Vermutlich laufen zur Zeit mehrere Notes Client-Anwendungen auf ihrem Rechner. Wenn diese der Fall ist, schließen Sie bitte die gerade nicht benötigte Notes-Anwendung. Alle Änderungen, die Sie im Office-Dokument noch machen, können aufgrund dieses Problems nicht nach Notes zurückgeschrieben werden.", vbExclamation, "OfficeGateway"
Exit Sub
End If
If Not NotesThisUiDoc Is Nothing Then
Set NotesThisDoc = NotesThisUiDoc.Document
'// FS 20041025: May indicate wrong document was located in second Notes instance.
If NotesThisDoc.GetItemValue("wpActiveDocument")(0) <> ThisWorkbook.Name Then
Set NotesThisDoc = Nothing
Set NotesThisUiDoc = Nothing
Set NotesUIWorkspace = Nothing
Set NotesSession = Nothing
Set NotesThisDatabase = Nothing
MsgBox "Das zugehörige Notes-Dokument ist nicht korrekt. Vermutlich laufen zur Zeit mehrere Notes Client-Anwendungen auf ihrem Rechner. Wenn diese der Fall ist, schließen Sie bitte die gerade nicht benötigte Notes-Anwendung. Alle Änderungen, die Sie im Office-Dokument noch machen, können aufgrund dieses Problems nicht nach Notes zurückgeschrieben werden.", vbExclamation, "OfficeGateway"
Exit Sub
ElseIf Not ThisWorkbook.ReadOnly Then
'// orphan check field
Call UpdateOrphanCheckField
End If
blnAlwaysTreatAsModifiedOnClose = (NotesThisDoc.GetItemValue("wpAlwaysTreatAsModifiedOnClose")(0) = "1")
End If
End Sub
Private Sub Workbook_BeforeSave(ByVal SpeichernAlsDialogfeld As Boolean, Abbrechen As Boolean)
lastRevisionNumber = lastRevisionNumber + 1
End Sub
Private Sub Workbook_BeforeClose(Abbrechen As Boolean)
Dim modified, sSaved
Dim ThisDocument
Dim returnStringQuerySaveEvent
Set ThisDocument = ThisWorkbook
If blnReadOnly Then
ThisDocument.Saved = True
Exit Sub
End If
'// Saved verändert seinen Wert
sSaved = ThisDocument.Saved
modified = (Not sSaved) Or (ThisDocument.FullName <> docFullName) Or (lastRevisionNumber <> 0)
modified = modified Or blnAlwaysTreatAsModifiedOnClose '// @ 2013-09-04 FS: always treat document as modified upon closing
If modified And Not NotesThisUiDoc Is Nothing Then
Select Case MsgBox("Sollen die Änderungen im zugehörigen Notes-Dokument gespeichert werden?", vbYesNoCancel + vbQuestion)
Case vbYes
Call NotesThisDoc.ReplaceItemValue("wpAttachFile", "?")
On Error Resume Next
Call NotesThisUiDoc.Refresh
Call NotesThisUiDoc.Refresh '//2. Mal, damit der Bildschrim aktualisiert wird
On Error GoTo 0
Err = 0
returnStringQuerySaveEvent = NotesThisDoc.GetItemValue("wpAttachFile")(0)
If returnStringQuerySaveEvent = "-" Then
sSaved = True
ElseIf returnStringQuerySaveEvent <> "" Then
If returnStringQuerySaveEvent = "?" Then
returnStringQuerySaveEvent = "Internal OfficeGateway error when processing events"
End If
Call MsgBox(returnStringQuerySaveEvent, vbExclamation)
Abbrechen = True
Exit Sub
Else
'// 2013-09-17 FS: save with local settings to prevent VBA localization (usually US English) from corrupting currency formats
If ThisDocument.FullName = docFullName Then
'Call ThisDocument.Save
Application.DisplayAlerts = False
Call ThisWorkbook.SaveAs(docFullName, Local:=True)
Application.DisplayAlerts = True
Else
On Error Resume Next
Kill docFullName
Err = 0
On Error GoTo 0
Call ThisDocument.SaveAs(docFullName, Local:=True)
End If
sSaved = True
Call NotesThisDoc.ReplaceItemValue("wpAttachFile", "1")
On Error Resume Next
Call NotesThisUiDoc.Refresh
Call NotesThisUiDoc.Refresh '//2. Mal, damit der Bildschrim aktualisiert wird
On Error GoTo 0
Err = 0
End If
Case vbNo
sSaved = True
Case vbCancel
Abbrechen = True
Exit Sub
End Select
End If
'// orphan check field
Call ResetOrphanCheckField
If sSaved Then
Set NotesThisDoc = Nothing
Set NotesThisUiDoc = Nothing
Set NotesUIWorkspace = Nothing
Set NotesThisDatabase = Nothing
Set NotesSession = Nothing
Application.WindowState = xlMinimized
End If
ThisDocument.Saved = sSaved
End Sub
Attribute VB_Name = "Tabelle23"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'< protected by www.CrunchCode.de - DO NOT CHANGE OR REMOVE THIS LABEL! >
Option Explicit
Attribute VB_Name = "sXRhvBgwveYGTWVyAPxSOXkdSRABC"
'< protected by www.CrunchCode.de - DO NOT CHANGE OR REMOVE THIS LABEL! >
Option Explicit
Sub pnYmGEucmQEaXkgzxkZGghxHgllxB(lbEkTSRs As _
Boolean)
With StartGUI
If _
lbEkTSRs = True Then
.CSwekbPMpVSHHTjrMohcaGTNwOsMuwb.Visible = _
True
.ryBHsoKAWoMzQocc.Visible = _
True: .ShortCutLBL.Visible = _
True
.hkcWMURklM.Visible = _
True
.HQXcVQNtZKZmTQHBCxWubXRIy.Visible = _
True
.ShortCutRahmLBL.Visible = _
True
Else
.CSwekbPMpVSHHTjrMohcaGTNwOsMuwb.Visible = False
.ryBHsoKAWoMzQocc.Visible = False: .ShortCutLBL.Visible = False: .hkcWMURklM.Visible = False: .HQXcVQNtZKZmTQHBCxWubXRIy.Visible = False: .ShortCutRahmLBL.Visible = False
End If
End With
End Sub
Sub _
cntjflsSrTBqwD()
Dim _
JJNnGujzQEN As _
Variant
Dim hXHDyIEOaRYpQEvYVknKlhcGPFuM As _
Integer
Dim _
EIcKlxWFjSffNdSZXjIsQdOZi As _
Boolean
If _
FsgxCouSfFNcSHdhLJmUT.Cells( _
2, 50).Value > _
FsgxCouSfFNcSHdhLJmUT.Cells( _
3, _
50).Value Then
EIcKlxWFjSffNdSZXjIsQdOZi = True
Else
EIcKlxWFjSffNdSZXjIsQdOZi = _
False
End If
With _
StartGUI
If TpVtiJlrXGLbE.Cells( _
17, 8).Value <> _
"" And _
EIcKlxWFjSffNdSZXjIsQdOZi = _
False Then
JJNnGujzQEN = _
Split(TpVtiJlrXGLbE.Cells(17, 8).Value, Chr(10))
For hXHDyIEOaRYpQEvYVknKlhcGPFuM = 0 To UBound(JJNnGujzQEN)
.TjmeMDvRTtIvwXzDtjNaEqstgWiwT.AddItem JJNnGujzQEN(hXHDyIEOaRYpQEvYVknKlhcGPFuM)
Next hXHDyIEOaRYpQEvYVknKlhcGPFuM
ElseIf _
owCLiFVnSMZ.Cells( _
9, _
4).Value <> "" Then
JJNnGujzQEN = Split(owCLiFVnSMZ.Cells( _
9, _
4).Value, _
Chr(10))
For _
hXHDyIEOaRYpQEvYVknKlhcGPFuM = 0 To UBound( _
JJNnGujzQEN)
.TjmeMDvRTtIvwXzDtjNaEqstgWiwT.AddItem JJNnGujzQEN( _
hXHDyIEOaRYpQEvYVknKlhcGPFuM): Next hXHDyIEOaRYpQEvYVknKlhcGPFuM
End If
If _
TpVtiJlrXGLbE.Cells( _
28, _
8).Value = "" Then
.XFgOeBGMiNTxWcwP.Value = wOXEhizgpJqFgGxGixoxUU.Cells(21, 3).Value
Else
.XFgOeBGMiNTxWcwP.Value = TpVtiJlrXGLbE.Cells(28, _
8).Value
End If
If TpVtiJlrXGLbE.Cells(13, 8).Value = _
"" Then
.PlAnzMitTB.Value = _
wOXEhizgpJqFgGxGixoxUU.Cells( _
23, 5).Value
Else
.PlAnzMitTB.Value = _
TpVtiJlrXGLbE.Cells(13, 8).Value
End If: .PlAuditTB.Value = TpVtiJlrXGLbE.Cells(30, 24).Value
.PlDokAusTB.Value = TpVtiJlrXGLbE.Cells( _
15, 11).Value: .PlAnzSchichtTB.Value = _
TpVtiJlrXGLbE.Cells( _
13, 24).Value
If _
TpVtiJlrXGLbE.Cells( _
30, _
8).Value <> "" And _
EIcKlxWFjSffNdSZXjIsQdOZi = False Then
.PlLeitAuditTB.Value = _
TpVtiJlrXGLbE.Cells( _
30, 8).Value
ElseIf _
owCLiFVnSMZ.Cells(7, 28).Value <> _
"" Then
.PlLeitAuditTB.Value = _
owCLiFVnSMZ.Cells(7, _
28).Value
End If
If _
TpVtiJlrXGLbE.Cells( _
45, 6).Value <> _
"" And EIcKlxWFjSffNdSZXjIsQdOZi = _
False Then
.PlErstDatTB.Value = _
TpVtiJlrXGLbE.Cells( _
45, _
6).Value
ElseIf _
owCLiFVnSMZ.Cells(5, _
28).Value <> _
"" And _
EIcKlxWFjSffNdSZXjIsQdOZi = _
True Then
.PlErstDatTB.Value = _
owCLiFVnSMZ.Cells(5, _
28).Value
Else
.PlErstDatTB.Value = Date
End If
If TpVtiJlrXGLbE.Cells(13, 28).Value = _
"pro Woche" Then
.tvSPscGNQOpwd.Value = True
Else
.KIDjnzQzudrtIQKJNIW.Value = _
True
End If
If _
TpVtiJlrXGLbE.Cells( _
41, 8).Value = _
"englisch" Then
.ZIpQDtdglbtyBnzYPwqGBrEjgddcTh.Value = True
Else
.oNMfaDGTM.Value = _
True
End If
If _
TpVtiJlrXGLbE.Cells( _
17, 8).Value <> _
"" Then
If _
TpVtiJlrXGLbE.Cells(48, 5).Value = "x" Then .rJekNDhZI.Value = _
True
If TpVtiJlrXGLbE.Cells(48, 13).Value = _
"x" Then .rGECQzoYvDOBWGVylCdBLoxTz.Value = True
If TpVtiJlrXGLbE.Cells(48, _
21).Value = _
"x" Then .NlScIQlJOG.Value = True
Else
.rJekNDhZI.Value = _
True
.NlScIQlJOG.Value = True
.rGECQzoYvDOBWGVylCdBLoxTz.Value = _
True
End If
If TpVtiJlrXGLbE.Cells(19, _
7).Value = _
"x" Then
.zvKeVvebbwlpvcwQQlTNmvoVYY.Value = _
True
Else
.zvKeVvebbwlpvcwQQlTNmvoVYY.Value = False: End If
If _
TpVtiJlrXGLbE.Cells(21, 7).Value = "x" Then
.ZTKZoLsNhQjg.Value = _
True
Else
.ZTKZoLsNhQjg.Value = False
End If
If TpVtiJlrXGLbE.Cells(23, _
7).Value = _
"x" Then
.bWyBbyCyXLaPegzuwfWpq.Value = _
True
Else
.bWyBbyCyXLaPegzuwfWpq.Value = False
End If
If _
TpVtiJlrXGLbE.Cells( _
26, _
7).Value = _
"x" Then
.OGBaNOeDHMKxYixqlVTsDTshLe.Value = True
Else
.OGBaNOeDHMKxYixqlVTsDTshLe.Value = _
False
End If
.ePRidkUwmcB.Value = _
TpVtiJlrXGLbE.Cells( _
35, _
15).Value
.PlBeobachtTB.Value = _
TpVtiJlrXGLbE.Cells(37, _
15).Value
.PlFachexpTB.Value = TpVtiJlrXGLbE.Cells(39, _
15).Value: End With
End Sub
Sub RTrWgMMWPcjKlHVmT(bJntnSAFNZt As Integer)
Dim _
GKPdlOpDVsSnaRrqyHyxTxtbCywKghu As _
Variant
Dim fBLFIRYCgQkFShVMeZgdvnLqNfQxr As Integer
Dim _
AVCqzjAxqqx As Double
Call sdjCaUEZdUrOQDZd
With _
StartGUI
.NEXardecfsNMevQiwSmQQMMmeEwD.Value = _
0
If TpVtiJlrXGLbE.Cells( _
bJntnSAFNZt, 30).Value = "nein" Then
.oKyaffUkuScJrkRecC.Value = True
Else
.rrJZJKCOAYNrxBlPIjCiQqHz.Value = True: End If
If TpVtiJlrXGLbE.Cells(bJntnSAFNZt, 1).Value <> _
"" Then
GKPdlOpDVsSnaRrqyHyxTxtbCywKghu = Split(TpVtiJlrXGLbE.Cells(bJntnSAFNZt, _
1), _
Chr( _
10))
.PlSt1DatTB.Value = _
GKPdlOpDVsSnaRrqyHyxTxtbCywKghu(0)
.PlSt1VonTB.Value = _
Trim(Left( _
GKPdlOpDVsSnaRrqyHyxTxtbCywKghu( _
1), InStr(GKPdlOpDVsSnaRrqyHyxTxtbCywKghu( _
1), "-") - 1)): .PlSt1BisTB.Value = _
Trim(Mid( _
GKPdlOpDVsSnaRrqyHyxTxtbCywKghu( _
1), InStr(GKPdlOpDVsSnaRrqyHyxTxtbCywKghu(1), "-") + _
1))
Else
.PlSt1DatTB.Value = "": .PlSt1VonTB.Value = _
""
.PlSt1BisTB.Value = "": End If
For fBLFIRYCgQkFShVMeZgdvnLqNfQxr = _
43 To _
46
AVCqzjAxqqx = AVCqzjAxqqx + TpVtiJlrXGLbE.Cells( _
bJntnSAFNZt, _
fBLFIRYCgQkFShVMeZgdvnLqNfQxr).Value
Next fBLFIRYCgQkFShVMeZgdvnLqNfQxr: .PlSt1hTB.Value = _
AVCqzjAxqqx
.PlSt114TB.Value = _
TpVtiJlrXGLbE.Cells( _
bJntnSAFNZt, 44).Value
.PlSt145TB.Value = _
TpVtiJlrXGLbE.Cells( _
bJntnSAFNZt, _
45).Value: .PlSt19TB.Value = _
TpVtiJlrXGLbE.Cells( _
bJntnSAFNZt, _
43).Value
.PlSt150TB.Value = _
TpVtiJlrXGLbE.Cells(bJntnSAFNZt, 46).Value: End With
End Sub
Sub _
RbrLQlCVcs()
Dim _
gzYOMktaSCzEHUINugOfv As Integer
Dim _
VdkKBnQznOkLSFqTXLYngCJNVz As Variant
Dim hYdrkiEKHEwciEROsgpzo As Integer
Dim BZdhXDfaEm As Integer
cRMVMAUo = False
For gzYOMktaSCzEHUINugOfv = _
0 To StartGUI.TjmeMDvRTtIvwXzDtjNaEqstgWiwT.ListCount - 1
If InStr( _
StartGUI.TjmeMDvRTtIvwXzDtjNaEqstgWiwT.List(gzYOMktaSCzEHUINugOfv), "50001") > 0 Then cRMVMAUo = _
True
Next gzYOMktaSCzEHUINugOfv
If cRMVMAUo = _
True Then
hYdrkiEKHEwciEROsgpzo = 72
Else
hYdrkiEKHEwciEROsgpzo = _
68
End If
With StartGUI.rSxrfmBNgCIuxmSnOPaNKUmAoaIr
.Clear
BZdhXDfaEm = _
2
For _
gzYOMktaSCzEHUINugOfv = 63 To _
hYdrkiEKHEwciEROsgpzo
.AddItem: .List(.ListCount - _
1, 0) = _
FsgxCouSfFNcSHdhLJmUT.Cells( _
BZdhXDfaEm, 34).Value
BZdhXDfaEm = BZdhXDfaEm + 1
If TpVtiJlrXGLbE.Cells(gzYOMktaSCzEHUINugOfv, _
1).Value <> "" Then
VdkKBnQznOkLSFqTXLYngCJNVz = _
Null: VdkKBnQznOkLSFqTXLYngCJNVz = _
Split(TpVtiJlrXGLbE.Cells( _
gzYOMktaSCzEHUINugOfv, _
1).Value, Chr( _
10))
.List(.ListCount - 1, _
1) = _
VdkKBnQznOkLSFqTXLYngCJNVz( _
0)
.List( _
.ListCount - _
1, _
2) = _
VdkKBnQznOkLSFqTXLYngCJNVz( _
1)
End If
If _
TpVtiJlrXGLbE.Cells( _
gzYOMktaSCzEHUINugOfv, 30).Value <> _
"" Then
.List( _
.ListCount - _
1, _
3) = _
TpVtiJlrXGLbE.Cells( _
gzYOMktaSCzEHUINugOfv, 30).Value
End If
Next gzYOMktaSCzEHUINugOfv
End With
End Sub
Sub _
XXWLiIgGvtULXsr( _
zRukTqzGLFqnJwdFayXgl As Worksheet, _
RMuWPWLDqtJdWxYWxOCOt As Object)
Dim _
AdTEcdikcL As Integer: Dim BeWNvCyKefniBIkNRMoNp As Long: BeWNvCyKefniBIkNRMoNp = fllSYPpCtviZnqagjWpfUcAfoeh(zRukTqzGLFqnJwdFayXgl, _
1)
If _
BeWNvCyKefniBIkNRMoNp < 12 Then
MsgBox "Keine Normelemente für die gewählte Norm hinterlegt.", vbExclamation + _
vbOKOnly, _
"Keine Normelemente"
Exit _
Sub
End If
For _
AdTEcdikcL = 0 To RMuWPWLDqtJdWxYWxOCOt.ListCount - _
1
If _
RMuWPWLDqtJdWxYWxOCOt.Selected( _
AdTEcdikcL) = _
True Then
zRukTqzGLFqnJwdFayXgl.Cells( _
CInt( _
RMuWPWLDqtJdWxYWxOCOt.List( _
AdTEcdikcL, 2)), 5).Value = _
"x"
Else
zRukTqzGLFqnJwdFayXgl.Cells(CInt( _
RMuWPWLDqtJdWxYWxOCOt.List(AdTEcdikcL, 2)), 5).Value = ""
End If
Next _
AdTEcdikcL
End Sub
Sub _
tOmQrruacHvtZbUvJOwGJZ()
Dim _
eFDmafyCkqJGgxUzwbQW As _
Double: Dim KscaifK As Double
Dim uOAuxwygMqMQyXDnFBpZNgtqwyDwp As Double
Dim XlBIQHwGjd As _
Double: Dim wJYVSgPptXwkxCuuUrTFFwkhKnCQR As _
Long
wJYVSgPptXwkxCuuUrTFFwkhKnCQR = TpVtiJlrXGLbE.UsedRange.Rows.Count: XlBIQHwGjd = _
0: KscaifK = _
0
eFDmafyCkqJGgxUzwbQW = _
0
uOAuxwygMqMQyXDnFBpZNgtqwyDwp = 0
With _
TpVtiJlrXGLbE
If _
.Cells(60, _
25).Value <> _
"" Then
KscaifK = WorksheetFunction.Sum( _
.Range(.Cells(63, _
44), .Cells( _
72, 44))): eFDmafyCkqJGgxUzwbQW = _
WorksheetFunction.Sum(.Range( _
.Cells( _
63, 45), _
.Cells(72, _
45)))
uOAuxwygMqMQyXDnFBpZNgtqwyDwp = WorksheetFunction.Sum(.Range( _
.Cells( _
63, 46), .Cells( _
72, 46)))
XlBIQHwGjd = WorksheetFunction.Sum(.Range( _
.Cells( _
63, _
43), .Cells( _
72, 43)))
End If
KscaifK = _
KscaifK + _
WorksheetFunction.Sum( _
.Range( _
.Cells( _
76, _
44), _
.Cells(wJYVSgPptXwkxCuuUrTFFwkhKnCQR, _
44))): eFDmafyCkqJGgxUzwbQW = eFDmafyCkqJGgxUzwbQW + WorksheetFunction.Sum(.Range(.Cells(76, 45), .Cells( _
wJYVSgPptXwkxCuuUrTFFwkhKnCQR, _
45)))
uOAuxwygMqMQyXDnFBpZNgtqwyDwp = uOAuxwygMqMQyXDnFBpZNgtqwyDwp + WorksheetFunction.Sum(.Range( _
.Cells(76, 46), _
.Cells( _
wJYVSgPptXwkxCuuUrTFFwkhKnCQR, 46)))
XlBIQHwGjd = _
XlBIQHwGjd + _
WorksheetFunction.Sum(.Range( _
.Cells(76, _
43), _
.Cells(wJYVSgPptXwkxCuuUrTFFwkhKnCQR, 43))): .Cells(58, 19).Value = eFDmafyCkqJGgxUzwbQW
.Cells( _
58, 14).Value = _
KscaifK: .Cells(58, 24).Value = uOAuxwygMqMQyXDnFBpZNgtqwyDwp
.Cells(58, _
9).Value = _
XlBIQHwGjd
End With
End Sub
Sub _
RXUxiAS(rZVTAZHNPzldfiMnFNVXXFXzOgAF As Boolean, _
zEprbozhPFRwidcjaCSnCWWLtcZx As Boolean)
Dim _
UPtLJjpZZkGcV As _
Double
Dim _
quSnSeaxEjhShzBcRXUgtiUtbl As String: Dim _
rMkfXsjQYYCokNfdJ As Integer: Dim tyGCzLnInplaXt As Boolean
Dim _
bVjYFIKrRgl As _
Boolean
Dim YJiGxGBmNrKgkcLKNRqwqddccrcYb As _
Boolean
Dim epVmVqAMV As _
Boolean
rZVTAZHNPzldfiMnFNVXXFXzOgAF = _
False: Call _
mPFhtgRliaGLsELiaWYWAmMELoWvw( _
StartGUI.PlErstDatTB, _
False, StartGUI, _
1, rZVTAZHNPzldfiMnFNVXXFXzOgAF, False)
If _
rZVTAZHNPzldfiMnFNVXXFXzOgAF = _
True Then Exit _
Sub
Call JeuAdTsXegcVuShTUvBRUYyC(StartGUI.XFgOeBGMiNTxWcwP, _
True, _
StartGUI.GIQSJaAIJSDa, 3, rZVTAZHNPzldfiMnFNVXXFXzOgAF, True)
If rZVTAZHNPzldfiMnFNVXXFXzOgAF Then Exit Sub
If StartGUI.TjmeMDvRTtIvwXzDtjNaEqstgWiwT.ListCount < 1 Then
MsgBox "Bitte eine Auditart und Auditgrundlage auswählen.", _
vbExclamation + vbOKOnly, _
"Keine Auswahl"
StartGUI.OtrLxCCc.SetFocus
Exit _
Sub
End If
If _
StartGUI.oNMfaDGTM.Value = False And StartGUI.ZIpQDtdglbtyBnzYPwqGBrEjgddcTh.Value = False Then
MsgBox "Bitte eine Auditsprache auswählen.", _
vbExclamation + vbOKOnly, "Welche Sprache?"
Exit Sub
End If
Call _
JeuAdTsXegcVuShTUvBRUYyC( _
StartGUI.PlLeitAuditTB, _
True, _
StartGUI.GIQSJaAIJSDa, 3, _
rZVTAZHNPzldfiMnFNVXXFXzOgAF, _
True)
If rZVTAZHNPzldfiMnFNVXXFXzOgAF Then Exit _
Sub
If zEprbozhPFRwidcjaCSnCWWLtcZx = _
True Then
Call _
JeuAdTsXegcVuShTUvBRUYyC( _
StartGUI.ePRidkUwmcB, _
True, StartGUI.GIQSJaAIJSDa, _
4, rZVTAZHNPzldfiMnFNVXXFXzOgAF, True)
If rZVTAZHNPzldfiMnFNVXXFXzOgAF Then Exit Sub
End If
With _
StartGUI
TpVtiJlrXGLbE.Cells(5, _
3).Value = wOXEhizgpJqFgGxGixoxUU.Cells( _
7, _
10).Value
TpVtiJlrXGLbE.Cells(7, 3).Value = _
wOXEhizgpJqFgGxGixoxUU.Cells(9, _
10).Value
TpVtiJlrXGLbE.Cells(9, _
3).Value = _
wOXEhizgpJqFgGxGixoxUU.Cells(11, 10).Value
TpVtiJlrXGLbE.Cells( _
11, _
3).Value = wOXEhizgpJqFgGxGixoxUU.Cells( _
13, 10).Value
TpVtiJlrXGLbE.Cells(5, _
19).Value = _
wOXEhizgpJqFgGxGixoxUU.Cells(34, 1).Value
quSnSeaxEjhShzBcRXUgtiUtbl = .TjmeMDvRTtIvwXzDtjNaEqstgWiwT.List(0)
For rMkfXsjQYYCokNfdJ = 1 To .TjmeMDvRTtIvwXzDtjNaEqstgWiwT.ListCount - _
1
quSnSeaxEjhShzBcRXUgtiUtbl = quSnSeaxEjhShzBcRXUgtiUtbl & _
Chr(10) & .TjmeMDvRTtIvwXzDtjNaEqstgWiwT.List(rMkfXsjQYYCokNfdJ)
Next _
rMkfXsjQYYCokNfdJ: UPtLJjpZZkGcV = _
vegrsldODqRzEcBcmoBeocVktEYq( _
TpVtiJlrXGLbE, 8, _
34, 17, quSnSeaxEjhShzBcRXUgtiUtbl, _
jNzZRYBjIJjg, _
True)
TpVtiJlrXGLbE.Cells( _
17, 8).Value = _
quSnSeaxEjhShzBcRXUgtiUtbl
TpVtiJlrXGLbE.Cells( _
17, 8).Value = Replace(TpVtiJlrXGLbE.Cells( _
17, _
8).Value, Chr( _
13), _
"")
If _
UPtLJjpZZkGcV > _
14.3 Then
TpVtiJlrXGLbE.Cells(17, _
8).RowHeight = UPtLJjpZZkGcV
End If
If _
InStr(quSnSeaxEjhShzBcRXUgtiUtbl, "9001") < 1 Then
tyGCzLnInplaXt = _
True
Else
tyGCzLnInplaXt = False
End If
If _
InStr( _
quSnSeaxEjhShzBcRXUgtiUtbl, _
"14001") < 1 Then
bVjYFIKrRgl = _
True
Else
bVjYFIKrRgl = _
False
End If
If _
InStr(quSnSeaxEjhShzBcRXUgtiUtbl, "45001") < 1 Then
YJiGxGBmNrKgkcLKNRqwqddccrcYb = True
Else
YJiGxGBmNrKgkcLKNRqwqddccrcYb = _
False
End If
If InStr(quSnSeaxEjhShzBcRXUgtiUtbl, "50001") < _
1 Then
epVmVqAMV = True
Else
epVmVqAMV = _
False
End If: Call QNgpeoPXApjGlgbwcjDYjEYcv(tyGCzLnInplaXt, bVjYFIKrRgl, YJiGxGBmNrKgkcLKNRqwqddccrcYb, epVmVqAMV)
TpVtiJlrXGLbE.Cells( _
28, _
8).Value = .XFgOeBGMiNTxWcwP.Value
TpVtiJlrXGLbE.Cells(30, 24).Value = .PlAuditTB.Value
TpVtiJlrXGLbE.Cells(15, 11).Value = _
.PlDokAusTB.Value
TpVtiJlrXGLbE.Cells(30, 8).Value = .PlLeitAuditTB.Value
TpVtiJlrXGLbE.Cells( _
45, 20).Value = "gez. " & _
.PlLeitAuditTB.Value
TpVtiJlrXGLbE.Cells(13, 8).Value = _
.PlAnzMitTB.Value
TpVtiJlrXGLbE.Cells( _
13, _
24).Value = .PlAnzSchichtTB.Value
TpVtiJlrXGLbE.Cells(45, _
6).Value = _
.PlErstDatTB.Value
If _
.KIDjnzQzudrtIQKJNIW.Value = _
True Then
TpVtiJlrXGLbE.Cells( _
13, _
28).Value = _
"pro Tag"
Else
TpVtiJlrXGLbE.Cells( _
13, _
28).Value = "pro Woche"
End If
If .oNMfaDGTM.Value = True Then
TpVtiJlrXGLbE.Cells(41, _
8).Value = _
"deutsch"
Else
TpVtiJlrXGLbE.Cells( _
41, 8).Value = "englisch"
End If
If _
.rJekNDhZI.Value = True Then TpVtiJlrXGLbE.Cells( _
48, 5).Value = "x"
If _
.rGECQzoYvDOBWGVylCdBLoxTz.Value = True Then TpVtiJlrXGLbE.Cells( _
48, 13).Value = _
"x"
If _
.NlScIQlJOG.Value = True Then TpVtiJlrXGLbE.Cells( _
48, 21).Value = _
"x"
If .zvKeVvebbwlpvcwQQlTNmvoVYY.Value = True Then
TpVtiJlrXGLbE.Cells(19, 7).Value = "x"
Else
TpVtiJlrXGLbE.Cells( _
19, 7).Value = ""
End If
If _
.ZTKZoLsNhQjg.Value = True Then
TpVtiJlrXGLbE.Cells( _
21, _
7).Value = "x"
Else
TpVtiJlrXGLbE.Cells( _
21, _
7).Value = ""
End If
If .bWyBbyCyXLaPegzuwfWpq.Value = _
True Then
TpVtiJlrXGLbE.Cells( _
23, _
7).Value = _
"x"
Else
TpVtiJlrXGLbE.Cells(23, 7).Value = ""
End If
If _
.OGBaNOeDHMKxYixqlVTsDTshLe.Value = True Then
TpVtiJlrXGLbE.Cells( _
26, _
7).Value = "x"
Else
TpVtiJlrXGLbE.Cells(26, _
7).Value = ""
End If
TpVtiJlrXGLbE.Cells(35, 15).Value = _
.ePRidkUwmcB.Value
TpVtiJlrXGLbE.Cells( _
37, 15).Value = _
.PlBeobachtTB.Value: TpVtiJlrXGLbE.Cells(39, _
15).Value = .PlFachexpTB.Value
End With
FsgxCouSfFNcSHdhLJmUT.Cells(3, _
50).Value = _
Now
If _
rPKdVTmsDOiQIlZnXKLTXCUuwl = _
1 Then
ThisWorkbook.Save
End If
StartGUI.Saved1LBL.Visible = _
True
StartGUI.Saved2LBL.Visible = True
Application.Wait ( _
Now + TimeSerial(0, _
0, _
1))
StartGUI.Saved1LBL.Visible = _
False: StartGUI.Saved2LBL.Visible = False
End Sub
Sub _
txpgvxhtJUoMARxCrcdmaZCX(ZLrQppsGykIVkvfJRXszZb As Worksheet, _
MizxITcSvWjMfcFCLpOunPnmex As Object, RhzplMLPxbiOS As Integer)
Dim CrLxdBkfivng As _
Integer
Dim _
LJHjysaeWJoQvyElwVQ As Long: LJHjysaeWJoQvyElwVQ = fllSYPpCtviZnqagjWpfUcAfoeh( _
ZLrQppsGykIVkvfJRXszZb, _
1)
If LJHjysaeWJoQvyElwVQ < 12 Then
MsgBox "Keine Normelemente für die gewählte Norm hinterlegt.", vbExclamation + vbOKOnly, _
"Keine Normelemente"
Exit _
Sub
End If
MizxITcSvWjMfcFCLpOunPnmex.Clear
For CrLxdBkfivng = 12 To LJHjysaeWJoQvyElwVQ
If _
( _
ZLrQppsGykIVkvfJRXszZb.Cells( _
CrLxdBkfivng, _
4).Value <> _
"" And ZLrQppsGykIVkvfJRXszZb.Cells(CrLxdBkfivng, 5).Value <> "") Or _
ZLrQppsGykIVkvfJRXszZb.Cells( _
CrLxdBkfivng, 4).Value = _
2 Then
MizxITcSvWjMfcFCLpOunPnmex.AddItem
MizxITcSvWjMfcFCLpOunPnmex.List( _
MizxITcSvWjMfcFCLpOunPnmex.ListCount - 1, 0) = _
Trim( _
ZLrQppsGykIVkvfJRXszZb.Cells(CrLxdBkfivng, _
1).Value)
MizxITcSvWjMfcFCLpOunPnmex.List( _
MizxITcSvWjMfcFCLpOunPnmex.ListCount - _
1, 1) = _
ZLrQppsGykIVkvfJRXszZb.Cells(CrLxdBkfivng, 2).Value
MizxITcSvWjMfcFCLpOunPnmex.List(MizxITcSvWjMfcFCLpOunPnmex.ListCount - 1, 2) = _
ZLrQppsGykIVkvfJRXszZb.Cells( _
CrLxdBkfivng, 7).Value
MizxITcSvWjMfcFCLpOunPnmex.List(MizxITcSvWjMfcFCLpOunPnmex.ListCount - _
1, 3) = _
ZLrQppsGykIVkvfJRXszZb.Cells( _
CrLxdBkfivng, _
13).Value
MizxITcSvWjMfcFCLpOunPnmex.List(MizxITcSvWjMfcFCLpOunPnmex.ListCount - 1, 4) = ZLrQppsGykIVkvfJRXszZb.Cells( _
CrLxdBkfivng, _
19).Value
MizxITcSvWjMfcFCLpOunPnmex.List( _
MizxITcSvWjMfcFCLpOunPnmex.ListCount - _
1, 5) = _
EPWtTHstsal(Trim(ZLrQppsGykIVkvfJRXszZb.Cells(CrLxdBkfivng, _
1).Value), RhzplMLPxbiOS): MizxITcSvWjMfcFCLpOunPnmex.List(MizxITcSvWjMfcFCLpOunPnmex.ListCount - _
1, _
6) = CrLxdBkfivng: End If
Next _
CrLxdBkfivng
End Sub
Sub _
aRPYcZRIHrGetyxfehlQjCpXVeCLomJ()
Dim _
PQTuUBYIMwlfYuKWYbaCLpUeQlRt As String
Dim DZPPzDrIEsZTNKEyhn As _
Integer
StartGUI.PlSt1VonTB.Value = _
Format(StartGUI.PlSt1VonTB.Value, _
"hh:mm")
…
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: xl/vbaProject.bin | 2489856 bytes |
SHA-256: decff93374cca8ff1c5d78825b2ac14bdeac4162e9e5977d3955d96ea96d878e |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
1923 of 3157 identifiers look randomly generated (e.g. 'CDEFGHIJSTUVWXYZcdefghijstuvwxyz') — consistent with name-mangling obfuscation.
|
|||
emf_00.emf |
ooxml-emf | OOXML EMF part: xl/media/image5.emf | 3152 bytes |
SHA-256: cd60930722f8a08c4db96d369d5318742c29787c5030f02b40eba779c336f20f |
|||
emf_01.emf |
ooxml-emf | OOXML EMF part: xl/media/image6.emf | 3136 bytes |
SHA-256: 62bbc48828554e422e39bbb40276a0d9845fed7daf074abd9ab2807a9ae83b6c |
|||
emf_02.emf |
ooxml-emf | OOXML EMF part: xl/media/image7.emf | 3164 bytes |
SHA-256: 495f01eda462609d6d42fe918267b0cae813c9eef3cd5d406360ddc75df8beb6 |
|||
emf_03.emf |
ooxml-emf | OOXML EMF part: xl/media/image8.emf | 3220 bytes |
SHA-256: 1bc00215a45bacf8c0af1ca7994b78a81f840d35ce8ab32d208c3e1b66141b21 |
|||
emf_04.emf |
ooxml-emf | OOXML EMF part: xl/media/image26.emf | 3308 bytes |
SHA-256: c76f7c62204533526e729671d5739961cd148e0362b6025e3ad3a49831f24560 |
|||
emf_05.emf |
ooxml-emf | OOXML EMF part: xl/media/image9.emf | 3148 bytes |
SHA-256: ebfdcdaa31bbd84e20dd9af0d13ddac74af0df51ff49d9685c7a2b1199fe4211 |
|||
emf_06.emf |
ooxml-emf | OOXML EMF part: xl/media/image10.emf | 3136 bytes |
SHA-256: ee80fc33896d970431bf3f0fca9cee09945246967034d2cc6572ac5b4177772c |
|||
emf_07.emf |
ooxml-emf | OOXML EMF part: xl/media/image11.emf | 3220 bytes |
SHA-256: 675fb7e42f92c94589ba301f0ab112d1c9dae3e14cd35f24346f9aeed4ecee13 |
|||
emf_08.emf |
ooxml-emf | OOXML EMF part: xl/media/image12.emf | 3208 bytes |
SHA-256: 877e71c1a75ae39fca72876db764c967968f11591f6a625ef0c8cd87302279c5 |
|||
emf_09.emf |
ooxml-emf | OOXML EMF part: xl/media/image13.emf | 3164 bytes |
SHA-256: 20a22be01f2338fda39938d9380a182d0a90c24f408902a946251fcc517043e6 |
|||
emf_10.emf |
ooxml-emf | OOXML EMF part: xl/media/image14.emf | 3152 bytes |
SHA-256: 02264720eaf32ed1d79d67232fe917dd7f83811658add8ed7eeefdc1ad8776b7 |
|||
emf_11.emf |
ooxml-emf | OOXML EMF part: xl/media/image15.emf | 3172 bytes |
SHA-256: bf7082f4c79edb92118f610ed60dbe9e26e41494761371c03f23f32eb5f66c84 |
|||
emf_12.emf |
ooxml-emf | OOXML EMF part: xl/media/image16.emf | 3220 bytes |
SHA-256: 54b62bb2bbbda173805bf00e243b9457758a81e269261d33257f9b4ee5bf7818 |
|||
emf_13.emf |
ooxml-emf | OOXML EMF part: xl/media/image17.emf | 3260 bytes |
SHA-256: 19adfb30808d1f3d1a5b07968e7019d572d81a805abbbf3764021addf2c66c70 |
|||
emf_14.emf |
ooxml-emf | OOXML EMF part: xl/media/image18.emf | 3188 bytes |
SHA-256: 301bd0d9dd44729f93ca25c87677eb1527b02d21d884c22ec5e668b603cdf173 |
|||
emf_15.emf |
ooxml-emf | OOXML EMF part: xl/media/image19.emf | 3200 bytes |
SHA-256: e13927fae95227f9814adfd41b6d3bd808174eb5f9f61c761d05d7c1173151e8 |
|||
emf_16.emf |
ooxml-emf | OOXML EMF part: xl/media/image20.emf | 3244 bytes |
SHA-256: 84c8504af0f36da0ab68182e845fb40b5a6a74522f35adc0799309fa07f85b24 |
|||
emf_17.emf |
ooxml-emf | OOXML EMF part: xl/media/image21.emf | 3244 bytes |
SHA-256: f3fee870d01a5c2f6a85d3d870338af5959b7dd6701baab11c34f8a1b7515b24 |
|||
emf_18.emf |
ooxml-emf | OOXML EMF part: xl/media/image22.emf | 3328 bytes |
SHA-256: 6ac55bc0c50e1e11b083637a07e4273f3b712bcca6e7b6ee17604498cd8a98df |
|||
emf_19.emf |
ooxml-emf | OOXML EMF part: xl/media/image23.emf | 3628 bytes |
SHA-256: 65878fc8a6f1d76a09c1506312ba28e356520b28fd4bb712eb6d5e0a8c286a85 |
|||
emf_20.emf |
ooxml-emf | OOXML EMF part: xl/media/image24.emf | 3720 bytes |
SHA-256: 2d390b3b6cd59a804a538c9ac58494fa6a7539e11a8c24c237f6053b1132bc77 |
|||
emf_21.emf |
ooxml-emf | OOXML EMF part: xl/media/image25.emf | 3380 bytes |
SHA-256: c7f86397b5e0c3aa96e79f86095b57e81ed2924b1951efa9ed2df7a30f444b45 |
|||
emf_22.emf |
ooxml-emf | OOXML EMF part: xl/media/image27.emf | 3328 bytes |
SHA-256: 04f086d17744f4b07a5f880aac7cf2df9b8a14ca6e171a3ff1b09201177a8ef2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.