MALICIOUS
224
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is an OOXML document containing VBA macros. Heuristics indicate the presence of a renamed VBA project and critical findings of Shell() and CreateObject() calls within the VBA code. The VBA auto-execution with Shell() suggests the intent to download and execute a second-stage payload, a common technique for malware delivery. No specific family could be identified.
Heuristics 8
-
VBA project inside OOXML medium 4 related findings OOXML_VBADocument contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: word/vbaProjectSignatureV3.bin)
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBAMatched line in script
' Inputs: sCommandLine -- String ' Returns: -1 for shell failure, exit code >= 0 otherwise ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' -
VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMEDThe VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Dim oKeys As Variant Set oKeys = CreateObject("System.Collections.ArrayList") oKeys.addRange oSibs.Keys -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLEDLong run of 0x40 bytes
Disassembly
Attempted x86 opcode disassembly0009C5DB 40 inc eax 0009C5DC 40 inc eax 0009C5DD 40 inc eax 0009C5DE 40 inc eax 0009C5DF 40 inc eax 0009C5E0 40 inc eax 0009C5E1 40 inc eax 0009C5E2 40 inc eax 0009C5E3 40 inc eax 0009C5E4 40 inc eax 0009C5E5 40 inc eax 0009C5E6 40 inc eax 0009C5E7 40 inc eax 0009C5E8 40 inc eax 0009C5E9 40 inc eax 0009C5EA 40 inc eax 0009C5EB 40 inc eax 0009C5EC 40 inc eax 0009C5ED 40 inc eax 0009C5EE 40 inc eax 0009C5EF 40 inc eax 0009C5F0 40 inc eax 0009C5F1 40 inc eax 0009C5F2 40 inc eax 0009C5F3 40 inc eax 0009C5F4 40 inc eax 0009C5F5 40 inc eax 0009C5F6 40 inc eax 0009C5F7 40 inc eax 0009C5F8 40 inc eax 0009C5F9 40 inc eax 0009C5FA 40 inc eax 0009C5FB 40 inc eax 0009C5FC 40 inc eax 0009C5FD 40 inc eax 0009C5FE 40 inc eax 0009C5FF 40 inc eax 0009C600 40 inc eax 0009C601 40 inc eax 0009C602 40 inc eax 0009C603 40 inc eax 0009C604 40 inc eax 0009C605 40 inc eax 0009C606 40 inc eax 0009C607 40 inc eax 0009C608 40 inc eax 0009C609 40 inc eax 0009C60A 40 inc eax 0009C60B 40 inc eax 0009C60C 40 inc eax 0009C60D 40 inc eax 0009C60E 40 inc eax 0009C60F 40 inc eax 0009C610 40 inc eax 0009C611 40 inc eax 0009C612 40 inc eax 0009C613 40 inc eax 0009C614 40 inc eax 0009C615 40 inc eax 0009C616 40 inc eax 0009C617 40 inc eax 0009C618 40 inc eax 0009C619 40 inc eax 0009C61A 40 inc eax 0009C61B 40 inc eax 0009C61C 40 inc eax 0009C61D 40 inc eax 0009C61E 40 inc eax 0009C61F 40 inc eax 0009C620 40 inc eax 0009C621 40 inc eax 0009C622 40 inc eax 0009C623 40 inc eax 0009C624 40 inc eax 0009C625 40 inc eax 0009C626 40 inc eax 0009C627 40 inc eax 0009C628 40 inc eax 0009C629 40 inc eax 0009C62A 40 inc eax 0009C62B 40 inc eax 0009C62C 40 inc eax 0009C62D 40 inc eax 0009C62E 40 inc eax 0009C62F 40 inc eax 0009C630 40 inc eax 0009C631 40 inc eax 0009C632 40 inc eax 0009C633 40 inc eax 0009C634 40 inc eax 0009C635 40 inc eax 0009C636 40 inc eax 0009C637 40 inc eax 0009C638 40 inc eax 0009C639 40 inc eax 0009C63A 40 inc eax
-
VBA project carries a recognised code-signing signature info VBA_SIGNED_TRUSTEDThe VBA project is Authenticode-signed and the signer/issuer chain matches a recognised code-signing publisher or CA. Informational only — the signature is NOT yet verified to cover the current project bytes, so it does not (yet) reduce the verdict.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.fiddler2.com1 In document text (OOXML body / shared strings)
- http://ocsp.digicert.com0OIn document text (OOXML body / shared strings)
- http://ocsp.digicert.com0CIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingCanvasIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)
- http://certs.godaddy.com/repository/1301In document text (OOXML body / shared strings)
- http://ocsp.godaddy.com/05In document text (OOXML body / shared strings)
- http://crl.godaddy.com/gdroot-g2.crl0FIn document text (OOXML body / shared strings)
- https://certs.godaddy.com/repository/0In document text (OOXML body / shared strings)
- http://www.digicert.com/CPS0In document text (OOXML body / shared strings)
- http://crl3.digicert.com/sha2-assured-ts.crl02�0�.�,http://crl4.digicert.com/sha2-assured-ts.crl0��In document text (OOXML body / shared strings)
- http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0In document text (OOXML body / shared strings)
- http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0��In document text (OOXML body / shared strings)
- http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:�8�6�4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0PIn document text (OOXML body / shared strings)
- https://www.digicert.com/CPS0In document text (OOXML body / shared strings)
- http://crl.godaddy.com/gdig2s5-4.crl0In document text (OOXML body / shared strings)
- http://certificates.godaddy.com/repository/0In document text (OOXML body / shared strings)
- http://ocsp.godaddy.com/0@In document text (OOXML body / shared strings)
- http://certificates.godaddy.com/repository/gdig2.crt0In document text (OOXML body / shared strings)
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source from OOXML) | 1196172 bytes |
SHA-256: ba424c2a12f94717d6b5ae782ed19ebab8aba76971ae2c33c0b490943f1b4210 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'Company: Infrastructures For Information - i4i(www.i4i.com)
'Comment: Holds document level events
'Date Created: 2010.10.15
'Developer: Rob Southon
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub Document_ContentControlAfterAdd(ByVal NewContentControl As ContentControl, ByVal InUndoRedo As Boolean)
On Error Resume Next
'Fixed to #20888, #20890
If InUndoRedo Then
g_bSkipEvents = True
Exit Sub
End If
Dim oDoc As Document
Set oDoc = NewContentControl.Parent
'Remove myself if I'm not allowed - don't allow creation of a CO, CC, HD, ST inside of a CO - 12457
If NewContentControl.Tag <> "" Then 'Don't act on CCs without a tag
Dim sMyPrefix As String
Dim sParentPrefix As String
sMyPrefix = Left(NewContentControl.Tag, 3)
sParentPrefix = Left(NewContentControl.ParentContentControl.Tag, 3)
If (sMyPrefix = gc_sCCPrefixPCData Or sMyPrefix = gc_sCCPrefixStructure Or sMyPrefix = gc_sCCPrefixHighlight Or sMyPrefix = gc_sCCPrefixHeading Or sMyPrefix = gc_sCCPrefixStandardText Or sMyPrefix = gc_sCCPrefixHighlight) And (sParentPrefix = gc_sCCPrefixKeyword Or sParentPrefix = gc_sCCPrefixPCData Or sParentPrefix = gc_sCCPrefixHeading Or sParentPrefix = gc_sCCPrefixStandardText) Then
'i4i internal: defect12556
'if parent content control is "st:adverse_highlight", it shouldn't be deleted - special description in highlight for section 6
If NewContentControl.ParentContentControl.Tag <> gc_sCCPrefixStandardText + "adverse_highlight" Then
NewContentControl.Delete False
End If
Exit Sub
End If
End If
'For moving sections so we don't duplicate IDs
If g_bSkipIds = True Then Exit Sub
'Add in our GUID attributes
If g_CAttribute.GetAttributeValue(NewContentControl, gc_sAttGuid, gc_sXmlnsX4wAttVals) = "" Then
g_CAttribute.SetAttributeValue NewContentControl, gc_sAttGuid, CreateGUID, gc_sXmlNsAlicei4i, "", gc_sXmlnsX4wAttVals
End If
'16583 - set our permanent ID attribute values
If g_CAttribute.GetAttributeValue(NewContentControl, gc_sAttPermId, gc_sXmlnsX4wAttVals) = "" Then
g_CAttribute.SetAttributeValue NewContentControl, gc_sAttPermId, CreateGUID, gc_sXmlNsAlicei4i, "", gc_sXmlnsX4wAttVals
End If
End Sub
Private Sub Document_ContentControlOnEnter(ByVal ContentControl As ContentControl)
On Error GoTo PROC_ERR
If g_bSkipEvents = True Then Exit Sub
'for densemarkup - autoselect
If ContentControl.Tag = "ct:DenseMarkup" Then
selectDenseMarkupNode ContentControl
End If
If ContentControl.Tag = "cv:Materials" Then
CleanUpMaterialListEntries
End If
Dim oDoc As Document
Set oDoc = ContentControl.Parent
'i4i internal: defect12631
'Keep a flag to remember if the doc was saved because setting locks dirties the document and we don't want it to
Dim bDocSaved As Boolean
bDocSaved = oDoc.Saved
'i4i internal: defect12087
'this would cause "can't execute code in break mode" error after close IE browser
If IsError(g_ox4oRibbon) = False Then
If Not g_ox4oRibbon Is Nothing Then
g_ox4oRibbon.Invalidate
End If
Else
'We don't have control of the menus! Inform the user and close the document
If MsgBox(g_CLocalization.GetMessage("c_X4O_NOT_CONNECTED_CONFIRM_SAVE", gc_sAppName), vbYesNo + vbCritical, gc_sAppName) = vbYes Then
oDoc.Close True
Else
If MsgBox(g_CLocalization.GetMessage("c_CONFIRM_CLOSE_DOC"), vbYesNo + vbCritical, gc_sAppName) = vbYes Then
oDoc.Close False
Else
oDoc.Close True
End If
End If
End If
'Looks like we can't rely on Word to always unlock on Exit, so we always need to unlock the parent structure tree
oDoc.ContentControls(1).LockContentControl = False
oDoc.ContentControls(1).LockContents = False
g_CContentControls.UnlockParentCCs ContentControl
If oDoc.FullName <> oDoc.AttachedTemplate.FullName Then 'Don't ever lock CCs in design mode
LockCC ContentControl
Else
ContentControl.LockContentControl = False
ContentControl.LockContents = False
End If
oDoc.Saved = bDocSaved
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "Document_ContentControlOnEnter of VBA Document ThisDocument"
Resume Next
End Sub
Private Sub Document_ContentControlOnExit(ByVal ContentControl As ContentControl, Cancel As Boolean)
On Error GoTo PROC_ERR
Dim oDoc As Document
Set oDoc = ContentControl.Parent
'i4i internal: defect12631
'Keep a flag to remember if the doc was saved because setting locks dirties the document and we don't want it to
Dim bDocSaved As Boolean
bDocSaved = oDoc.Saved
oDoc.Saved = bDocSaved
If g_bSkipEvents = True Then Exit Sub
Dim sPrefix As String
sPrefix = Left(ContentControl.Tag, 3)
'If we are leaving a keyword, update all other instances of the keyword
Dim oKeywordCC As ContentControl
Set oKeywordCC = GetCurrentKeywordCC(ContentControl.Range)
If oKeywordCC Is Nothing Then GoTo SKIP
If g_bUpdatingKeywords = False And g_bEditingKeyword = True Then
g_bEditingKeyword = False
'Don't ask to update if we just moved from a keyword CC to its child CC (usually a controlled vocab CC)
Dim oArrivedKeyword As ContentControl
Set oArrivedKeyword = GetCurrentKeywordCC
'Don't update if we are just moving within the same parent keyword
If Not oArrivedKeyword Is Nothing Then
If oArrivedKeyword.ID = oKeywordCC.ID Then GoTo SKIP
End If
If oDoc.SelectContentControlsByTag(oKeywordCC.Tag).Count > 1 Then 'Don't bother updating if we are the only one
If MsgBox(g_CLocalization.GetMessage("c_CONFIRM_KEYWORD_UPDATE_ALL"), vbYesNo, gc_sAppName) = vbYes Then
g_bUpdatingKeywords = True
Application.ScreenUpdating = False
UpdateKeywordByNameValue oKeywordCC
Application.ScreenUpdating = True
g_bUpdatingKeywords = False
End If
Else
If g_CUtilities.GetCustomWordProperty(gc_sCustomPropShading) Then
oKeywordCC.Range.Shading.BackgroundPatternColor = gc_wdHighlightColor
End If
End If
Else
If oDoc.SelectContentControlsByTag(ContentControl.Tag).Count = 1 Then
If g_CUtilities.GetCustomWordProperty(gc_sCustomPropShading) Then
'Fixed to #18584, crash in word2007
Dim bSkipEvents As Boolean
bSkipEvents = g_bSkipEvents
g_bSkipEvents = True
oKeywordCC.LockContents = False
oKeywordCC.Range.Shading.BackgroundPatternColor = gc_wdHighlightColor
oKeywordCC.LockContents = True
g_bSkipEvents = bSkipEvents
End If
End If
End If
SKIP:
oDoc.Saved = bDocSaved
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "Document_ContentControlOnExit of VBA Document ThisDocument"
Resume Next
End Sub
Attribute VB_Name = "frmInput"
Attribute VB_Base = "0{3B24A332-3C25-438E-A39E-4BF7E59CBDC6}{F3823533-2BA5-48E2-88B0-7227B8656C07}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'Company: Infrastructures For Information - i4i(www.i4i.com)
'Comment: User input imformation
'Date Created:
'Developer:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Option Explicit
Private m_sTitle As String
Private m_sInstructions As String
Private m_sAnswer As String
Private m_iMsgBoxAnswer As VbMsgBoxResult
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: Title
' Purpose: Get Title property
' Inputs:
' Returns: String
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Get Title() As String
On Error Resume Next
Title = m_sTitle
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: Title
' Purpose: Set Title property
' Inputs: sTitle -- String
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Let Title(ByVal sTitle As String)
On Error Resume Next
m_sTitle = sTitle
Me.Caption = sTitle
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: Instructions
' Purpose: Get Instructions property
' Inputs:
' Returns: String
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Get Instructions() As String
On Error Resume Next
Instructions = m_sInstructions
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: Instructions
' Purpose: Set Instructions property
' Inputs: sInstructions -- String
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Let Instructions(ByVal sInstructions As String)
On Error Resume Next
m_sInstructions = sInstructions
lblInstruct.Caption = m_sInstructions
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: Answer
' Purpose: Get Answer property
' Inputs:
' Returns: String
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Get Answer() As String
On Error Resume Next
m_sAnswer = txtInput.Value
Answer = m_sAnswer
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: Answer
' Purpose: Set Answer property
' Inputs: sAnswer -- String
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Let Answer(ByVal sAnswer As String)
On Error Resume Next
txtInput.Value = sAnswer
m_sAnswer = sAnswer
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: MsgBoxAnswer
' Purpose: Get MsgBoxAnswer property
' Inputs:
' Returns: VbMsgBoxResult
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Get MsgBoxAnswer() As VbMsgBoxResult
On Error Resume Next
MsgBoxAnswer = m_iMsgBoxAnswer
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdCancel_Click
' Purpose: Unload form
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdCancel_Click()
On Error Resume Next
g_sInputAnswer = ""
m_iMsgBoxAnswer = vbCancel
g_iMsgBoxAnswer = vbCancel
Unload Me
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdOk_Click
' Purpose: Get input text and unload form
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdOk_Click()
On Error Resume Next
g_sInputAnswer = txtInput.Value
m_iMsgBoxAnswer = vbOK
g_iMsgBoxAnswer = vbOK
Unload Me
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: UserForm_Activate
' Purpose: Initialize global variable
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub UserForm_Activate()
On Error Resume Next
g_sInputAnswer = ""
End Sub
Attribute VB_Name = "frmBrowserMetaCompare"
Attribute VB_Base = "0{BCD6E378-BDD4-4452-A658-459640E122D5}{A3FDF9C3-8CA6-4B8A-A13F-3DBC4A738724}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Option Explicit
' The initial HTML Page
Private sHTMLpage As String
' The XML document to load
Private sXMLFile As String
' The XSL transformation to apply
Private sXSLFile As String
' The result string
Private sResult As String
' LDR published file
Private sXMLOutputPath As String
Private bInitDocument As Boolean
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: Title
' Purpose: Set Title Property
' Inputs: sTitle -- String
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Let Title(sTitle As String)
On Error Resume Next
Me.Caption = sTitle
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: HTMLPage
' Purpose: Set HTMLPage Property
' Inputs: sHTMLPageArg -- String
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Let HTMLPage(sHTMLPageArg As String)
On Error Resume Next
sHTMLpage = sHTMLPageArg
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: XMLFile
' Purpose: Set XMLFile Property
' Inputs: sXMLFileArg -- String
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Let XMLFile(sXMLFileArg As String)
On Error Resume Next
sXMLFile = sXMLFileArg
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: XSLFile
' Purpose: Set XSLFile Property
' Inputs: sXSLFileArg -- String
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Let XSLFile(sXSLFileArg As String)
On Error Resume Next
sXSLFile = sXSLFileArg
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: XMLOutputPath
' Purpose: Set XMLOutputPath Property
' Inputs: sXMLOutputPathArg -- String
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Let XMLOutputPath(sXMLOutputPathArg As String)
On Error Resume Next
sXMLOutputPath = sXMLOutputPathArg
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: XMLOutputPath
' Purpose: get XMLOutputPath Property
' Inputs:
' Returns: String
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Get XMLOutputPath() As String
XMLOutputPath = sXMLOutputPath
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: Result
' Purpose: get Result Property
' Inputs:
' Returns: String
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Get Result() As String
Result = sResult
End Property
Public Sub Process(Optional i_bConnectAlice As Boolean = True)
On Error GoTo PROC_ERR
Dim oFS As Scripting.FileSystemObject
Set oFS = New Scripting.FileSystemObject
'Get the alice server config and ask for a login
Dim sAliceConnPath As String
sAliceConnPath = vbNullString
If g_oX4O.IsEnterpriseSetup Then
If i_bConnectAlice Then
g_oX4O.PropFind 0 'Workaround for connecting to Alice
End If
g_oX4O.SPLR4WriteConfigFile
If oFS.FileExists(g_oX4O.GetAliceConnectionXmlPath(False)) Then
sAliceConnPath = "?AliceConnectionXml=" & g_oX4O.GetAliceConnectionXmlPath(True)
End If
End If
bInitDocument = True
wbMyBrowser.Navigate sHTMLpage & sAliceConnPath
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "Process of Form frmBrowserMetaCompare"
Resume Next
End Sub
Private Sub okBtn_Click()
Unload Me
End Sub
Private Sub PrintBtn_Click()
'print
'wbMyBrowser.ExecWB OLECMDID_PRINT, OLECMDEXECOPT_PROMPTUSER
'you can change OLECMDEXECOPT_DONTPROMPTUSER to OLECMDEXECOPT_PROMPTUSER if you wish
wbMyBrowser.ExecWB OLECMDID_PRINTPREVIEW, OLECMDEXECOPT_DONTPROMPTUSER
End Sub
Private Sub SaveBtn_Click()
On Error GoTo PROC_ERR
Dim sNewName As String
'Get the new filename
Dim oFiles As FileDialogSelectedItems
Set oFiles = g_CUtilities.FileChooser(msoFileDialogSaveAs, "Save Compare Data", False, "Save", "", "Html file", "*.html")
If oFiles.Count = 0 Then Exit Sub
sNewName = oFiles(1)
If sNewName = "" Then Exit Sub 'User cancelled
Dim oFS As Scripting.FileSystemObject
Set oFS = New Scripting.FileSystemObject
Dim sEntensionName As String
sEntensionName = oFS.GetExtensionName(sNewName)
Select Case sEntensionName
Case "html", "htm"
Case Else
MsgBox "please save as web page file."
Exit Sub
End Select
Dim sLocationFileName As String
sLocationFileName = Right(wbMyBrowser.LocationURL, Len(wbMyBrowser.LocationURL) - 8)
sLocationFileName = Replace(sLocationFileName, "url", "url")
MsgBox "File save to: " + sNewName, vbInformation + vbOKOnly, gc_sAppName
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "SaveBtn_Click of Form frmBrowserMetaCompare"
Resume Next
End Sub
Private Sub UserForm_Resize()
On Error Resume Next
wbMyBrowser.Width = Me.InsideWidth
wbMyBrowser.Height = Me.InsideHeight
End Sub
Private Sub wbMyBrowser_WindowClosing(ByVal IsChildWindow As Boolean, Cancel As Boolean)
On Error GoTo PROC_ERR
Cancel = True
Me.Hide
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "wbMyBrowser_WindowClosing of Form frmBrowserMetaCompare"
Resume Next
End Sub
Attribute VB_Name = "frmSectionManager"
Attribute VB_Base = "0{F8FA3903-3AD9-4F53-BCF8-AD7CB2F0CBEF}{A6C2856D-E0BE-44C1-8AE7-1A5D3AD105BF}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'Company: Infrastructures For Information - i4i(www.i4i.com)
'Comment: Allows the user to manage the semantic CC document
' sections
'Date Created:
'Developer:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Option Explicit
Private m_oActiveDoc As Word.Document 'So any actions performed occur on the document that was used to launch the dialog
Private m_lLastChosenId As Double
Public Enum MoveDirection
MoveUp = 0
MoveDown = 1
MoveLeft = 2
MoveRight = 3
End Enum
Private m_bTrackingChanges As Boolean 'Used to remember if we were tracking changes and turn it off during document edits
Private m_bUpdateShownCCs As Boolean 'Used to pause update of dialog when checking the visible CCs
Private bInitDocument As Boolean
Private bCmdDeleteVisible As Boolean '#23435, Used to remember whether the selected section exists in the document
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: AssignActiveDocument
' Purpose: Set AssignActiveDocument property
' Inputs: oActiveDoc -- Word document
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Public Property Set AssignActiveDocument(oActiveDoc As Word.Document)
On Error Resume Next
Set m_oActiveDoc = oActiveDoc
End Property
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowAtt_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowAtt_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowBlocks_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowBlocks_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowBodys_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowBodys_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowConcept_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowConcept_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowCustom_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowCustom_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowHeadings_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowHeadings_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowInlineFrags_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowInlineFrags_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowKeywords_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowKeywords_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowSections_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowSections_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowStandardText_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowStandardText_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: chkShowVocab_Click
' Purpose: This is not used in A4L5.2, it will be used in A4L5.3 in the
' Future
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub chkShowVocab_Click()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmbMode_Change
' Purpose: Initialize content controls
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmbMode_Change()
On Error Resume Next
InitCCs
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdCancel_Click
' Purpose: Press cancel button to close form
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdCancel_Click()
On Error Resume Next
Me.Hide
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdDelete_Click
' Purpose: Delete section
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdDelete_Click()
On Error GoTo PROC_ERR
m_oActiveDoc.Activate
SafeStartUndoStack "Delete Section"
Dim oCC As ContentControl
Set oCC = GetCurrentSelectedCC
If oCC.Tag = gc_sCCi4iRoot Then
MsgBox g_CLocalization.GetMessage("c_ROOT_SECTION_DELETE_ALERT"), vbExclamation + vbOKOnly, gc_sAppName
Exit Sub
End If
If Not oCC Is Nothing Then
Dim sNodeID As String
sNodeID = "#id:" & oCC.ID
DeleteCCSemantic oCC
If cmbMode.Value = "Show Allowed" Then
' change node state to missing
wbSectionView.Document.parentWindow.execScript "changeNodeType('" & sNodeID & "', 'imagesurlsection_missing.png', 'x4o-section-missing');"
Else
' delete node from tree
wbSectionView.Document.parentWindow.execScript "deleteNode('" & sNodeID & "');"
End If
End If
'Set dirty to prompt for save
m_oActiveDoc.Saved = False
ActiveWindow.ScrollIntoView Selection.Range, True
SafeEndUndoStack
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "cmdDelete_Click of Form frmSectionManager"
Resume Next
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdInsert_Click
' Purpose: Insert section
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdInsert_Click()
On Error GoTo PROC_ERR
m_oActiveDoc.Activate
Dim sHash As String
sHash = GetHashFromURL(wbSectionView.LocationURL)
If sHash = vbNullString Then
MsgBox g_CLocalization.GetMessage("c_SELECT_SECTION"), vbOKOnly + vbExclamation, gc_sAppName
Exit Sub
End If
Dim oIS As New frmSections
Dim lPos As Long
Dim lStart, lEnd As Long
Dim lSelectionStart, lSelectionEnd As Long
Dim oCC As ContentControl
Set oCC = g_CElements.GetCurrentElement
lStart = oCC.Range.start
lEnd = oCC.Range.End
Dim bFinishInsertSectionFromDlg As Boolean
If cmbMode.Value = "Show Existing" Then
'Move just inside our selected CC because the user wants the options of the child CC
'Then just show the insert section dialog
'#23950
If oCC.Tag = gc_sCCi4iRoot Then
lPos = Selection.Range.ParentContentControl.Range.start
Else
lPos = Selection.Range.ParentContentControl.Range.start + 1
End If
Selection.SetRange lPos, lPos
oIS.Show
bFinishInsertSectionFromDlg = oIS.FinishInsertSection
ElseIf cmbMode.Value = "Show Missing" Then
'we want to insert the selected section
InsertFirstOccurenceOfCC sHash
'Defect AP1-I107
bFinishInsertSectionFromDlg = FinishInsertFirstOccurenceOfCC
ElseIf cmbMode.Value = "Show Allowed" Then
'We could have missing or existing items
'But just insert in the first allowed position for now
InsertFirstOccurenceOfCC sHash
'Defect AP1-I107
bFinishInsertSectionFromDlg = FinishInsertFirstOccurenceOfCC
End If
lSelectionStart = Selection.start
lSelectionEnd = Selection.End
'Set dirty to prompt for save
m_oActiveDoc.Saved = False
'Change the position of selection instead of Locking semantic CC in ShowDocumentSectionsDlg
ActiveDocument.Range(lStart, lEnd).Select
ActiveDocument.Range(lSelectionStart, lSelectionStart).Select
If Application.Version = "12.0" Then
ActiveDocument.UndoClear
End If
'i4i internal: defect12262
'just hide the dlg
'AP1-I66,ESDZ57-I18
If bFinishInsertSectionFromDlg = True Then
Me.Hide
End If
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "cmdInsert_Click of Form frmSectionManager"
Resume Next
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: GetCurrentSelectedCC
' Purpose: Get Current Selected Content Control
' Inputs:
' Returns: Content Control
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Function GetCurrentSelectedCC() As ContentControl
On Error GoTo PROC_ERR
Dim sHash As String
sHash = GetHashFromURL(wbSectionView.LocationURL)
Dim oCC As ContentControl
If sHash = vbNullString Then
ElseIf cmbMode.Value = "Show Allowed" Then
If m_oActiveDoc.SelectContentControlsByTag(sHash).Count > 0 Then
Set oCC = m_oActiveDoc.SelectContentControlsByTag(sHash)(1)
End If
Else
Dim sId As String
sId = Right(sHash, Len(sHash) - Len("id:"))
Set oCC = g_CContentControls.GetCCByID(sId, m_oActiveDoc) '13060 and 13257
End If
If Not oCC Is Nothing Then
Set GetCurrentSelectedCC = oCC
Else
NONESELECTED:
On Error Resume Next
MsgBox g_CLocalization.GetMessage("c_SELECT_SECTION"), vbExclamation, gc_sAppName
Set GetCurrentSelectedCC = Nothing
End If
Exit Function
PROC_ERR:
g_CUtilities.LogError Err, False, "GetCurrentSelectedCC of Form frmSectionManager"
Resume Next
End Function
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdLeft_Click
' Purpose: Move section to left
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdLeft_Click()
On Error GoTo PROC_ERR
m_oActiveDoc.Activate
Dim oMovedCC As ContentControl
Set oMovedCC = MoveSib(MoveLeft)
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "cmdLeft_Click of Form frmSectionManager"
Resume Next
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdRight_Click
' Purpose: Move section to right
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdRight_Click()
On Error GoTo PROC_ERR
m_oActiveDoc.Activate
Dim oMovedCC As ContentControl
Set oMovedCC = MoveSib(MoveRight)
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "cmdRight_Click of Form frmSectionManager"
Resume Next
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdShowAll_Click
' Purpose: This will be used in A4L5.3
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdShowAll_Click()
On Error GoTo PROC_ERR
m_bUpdateShownCCs = False
Dim oCtl As control
For Each oCtl In fraShowItems.Controls
If Left(oCtl.Name, 3) = "chk" Then
oCtl.Value = True
End If
Next
m_bUpdateShownCCs = True
InitCCs
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "cmdShowAll_Click of Form frmSectionManager"
Resume Next
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdShowNone_Click
' Purpose: This will be used in A4L5.3
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdShowNone_Click()
On Error GoTo PROC_ERR
m_bUpdateShownCCs = False
Dim oCtl As control
For Each oCtl In fraShowItems.Controls
If Left(oCtl.Name, 3) = "chk" Then
oCtl.Value = False
End If
Next
m_bUpdateShownCCs = True
InitCCs
Exit Sub
PROC_ERR:
g_CUtilities.LogError Err, False, "cmdShowNone_Click of Form frmSectionManager"
Resume Next
End Sub
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' FunctionurlSub Name: cmdUp_Click
' Purpose: Move section up
' Inputs:
' Returns:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Sub cmdUp_Click()
On Error GoTo PROC_ERR
…
|
|||
vbaProject_00.bin |
vba-project | OOXML VBA project: word/vbaProject.bin | 2851840 bytes |
SHA-256: 6fdb2d526cf81b87e923360406286ca940602a89cc279949e94c21cef9d898ac |
|||
vbaProject_01.bin |
vba-project | OOXML VBA project: word/vbaProjectSignatureV3.bin | 9079 bytes |
SHA-256: bde005c0e2aefa0d75d5334c6ec2a3932736636a21c612d6a85cb6e001e927c9 |
|||
vbaProject_02.bin |
vba-project | OOXML VBA project: word/vbaProjectSignatureAgile.bin | 9079 bytes |
SHA-256: e139901b1d264feecb01c0fe480a4608d2e5ca5e5d2b4b0367fb0ff19ed31575 |
|||
vbaProject_03.bin |
vba-project | OOXML VBA project: word/vbaProjectSignature.bin | 8964 bytes |
SHA-256: 52942a58725394d6478b56503a72e0d1ec454e56b59987ead204b792a89f15d9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.