Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 c35e96019edbfc8c…

MALICIOUS

Office (OOXML)

683.7 KB Created: 2016-02-19 21:43:00 UTC Authoring application: Microsoft Office Word 15.0000 First seen: 2020-09-24
MD5: 737058df48f1f316faa77dfc8db53b4d SHA-1: f97d8c6beb3f7e9d412da5751d16604134a9ee17 SHA-256: c35e96019edbfc8cc5a11f7534770328f582386eae72904eb1cd3b032a0bae12
230 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a malicious VBA macro with a Document_Open auto-execution routine. This macro utilizes WScript.Shell and CreateObject to execute obfuscated code, likely to download and run a second-stage payload. The presence of these critical heuristics indicates a high likelihood of malicious intent.

Heuristics 7

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
      'access Windows scripting
      Set myWS = CreateObject("WScript.Shell")
      'try to read the registry key
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        'End If
        'ShellExecute 0, "Open", "C:\Mes dossiers\Dev\Terminotix toolbar\TXTB2.exe", txtCmd, "", 3
        'IE.stSelText = txtsel
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set FsT = CreateObject("ADODB.Stream")
        FsT.Type = 2 'Specify stream type - we want To save text/string data*.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://206.125.167.136/terminotix/PortageLiveAPI.php In document text (OOXML body / shared strings)
    • http://www.nactem.ac.uk/software/termine/#formIn document text (OOXML body / shared strings)
    • http://www.tausdata.org/index.phpIn document text (OOXML body / shared strings)
    • http://candle.fl.nthu.edu.tw/totalrecall/totalrecall/totalrecall.aspxIn document text (OOXML body / shared strings)
    • https://www.usito.com/dictio/In document text (OOXML body / shared strings)
    • http://btb.termiumplus.gc.ca/verbex-srch?lang=fra&srchtxt=In document text (OOXML body / shared strings)
    • http://btb.termiumplus.gc.ca/clefsfp-srch?srchtxt=In document text (OOXML body / shared strings)
    • http://btb.termiumplus.gc.ca/cooc-srch?lang=fra&srchtxt=In document text (OOXML body / shared strings)
    • https://www.sdc.gov.on.ca/sites/mgcs-onterm/en/Pages/r_names_login.aspxIn document text (OOXML body / shared strings)
    • https://www.sdc.gov.on.ca/sites/mgcs-onterm/fr/Pages/r_names_login.aspxIn document text (OOXML body / shared strings)
    • http://www.e-laws.gov.on.ca/navigation?file=browseStatutes&reset=yes&menu=browse&lang=enIn document text (OOXML body / shared strings)
    • http://kamusi.org/define?headword=In document text (OOXML body / shared strings)
    • http://www.tradooit.com/info.php?q=In document text (OOXML body / shared strings)
    • http://www.navcanada.ca/logiterm/addon/terminav/termino_res.php?couple=engfra&chprincipal=In document text (OOXML body / shared strings)
    • http://www.navcanada.ca/logiterm/addon/terminav/termino_res.php?couple=fraeng&chprincipal=In document text (OOXML body / shared strings)
    • http://www1.navcanada.ca/logiterm/addon/terminav/login_u.php?lng=fr_CAIn document text (OOXML body / shared strings)
    • http://www1.navcanada.ca/logiterm/addon/terminav/termino_res.php?lng=eng&trm=In document text (OOXML body / shared strings)
    • http://www1.navcanada.ca/logiterm/addon/terminav/login_u.php?lng=en_ENIn document text (OOXML body / shared strings)
    • http://www1.navcanada.ca/logiterm/addon/terminav/termino_res.php?lng=fra&trm=In document text (OOXML body / shared strings)
    • http://webitext.caIn document text (OOXML body / shared strings)
    • http://www.webitext.com/bin/webitext.cgi?term=In document text (OOXML body / shared strings)
    • http://webitext.ca/bin/webitext.cgi?sl=fr&tl=en&mnuc=none%3A&uss=pfizer.caIn document text (OOXML body / shared strings)
    • http://localhostIn document text (OOXML body / shared strings)
    • http://gdt.oqlf.gouv.qc.ca/resultat.aspx?terme=In document text (OOXML body / shared strings)
    • http://btb.termiumplus.gc.ca/tpv2alpha/alpha-fra.html?lang=fra&srchtxt=In document text (OOXML body / shared strings)
    • http://www.tsrali.com/query.cgi?userName=In document text (OOXML body / shared strings)
    • http://www.tsrali.com/Members/QueryTrans.aspxIn document text (OOXML body / shared strings)
    • http://www.terminotix.comIn document text (OOXML body / shared strings)
    • http://www.termdat.chIn document text (OOXML body / shared strings)
    • http://www.termdat.ch/In document text (OOXML body / shared strings)
    • http://www.usito.com/In document text (OOXML body / shared strings)
    • http://www.usito.com/dictioIn document text (OOXML body / shared strings)
    • http://ts3.terminotix.com/Members/QueryTrans.aspxIn document text (OOXML body / shared strings)
    • http://webitext.ca/In document text (OOXML body / shared strings)
    • http://webitext.ca/bin/webitext.cgi?sl=In document text (OOXML body / shared strings)
    • http://www.granddictionnaire.com/btml/fra/r_motclef/entete_800_600.aspIn document text (OOXML body / shared strings)
    • http://www.granddictionnaire.com/btml/fra/r_motclef/recherche.aspIn document text (OOXML body / shared strings)
    • https://www.base.onterm.gov.on.ca/MultiTransWeb/Web.mvcIn document text (OOXML body / shared strings)
    • http://www.navcanada.ca/logiterm/addon/terminav/termino.phpIn document text (OOXML body / shared strings)
    • http://www.terminotix.com/index.asp?content=brand&brand=17&lang=enIn document text (OOXML body / shared strings)
    • http://www.terminotix.com/index.asp?content=type&type=1&lang=enIn document text (OOXML body / shared strings)
    • http://www.terminotix.com/index.asp?content=brand&brand=2&lang=enIn document text (OOXML body / shared strings)
    • http://www.terminotix.com/index.asp?name=AlignFactory&content=item&brand=1&item=4&lang=enIn document text (OOXML body / shared strings)
    • http://www.terminotix.com/index.asp?name=SynchroTerm&content=item&brand=4&item=7&lang=enIn document text (OOXML body / shared strings)
    • http://www.webitext.comIn document text (OOXML body / shared strings)
    • https://www.usito.com/dictio/accueil.zulIn document text (OOXML body / shared strings)
    • http://legal.wordscope.com/In document text (OOXML body / shared strings)
    • http://www1.navcanada.ca/logiterm/addon/terminav/termino.phpIn document text (OOXML body / shared strings)
    • http://206.125.167.136/terminotix/PortageLiveAPI.php�In document text (OOXML body / shared strings)
    • http://www.nactem.ac.uk/software/termine/#form�In document text (OOXML body / shared strings)
    +81 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 294567 bytes
SHA-256: e355d768821d4d699dfb62d3b770ebc6f0e6cd3e63c5185adf51b12bb37c7a6a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'
' Terminotix Toolbar. Copyright Terminotix 1996-2013.
' Written by JFR, December 2011.
' Last modified by JFR, April 2012, Bing MT added, WebItext now keeps last config when closed, new section added: writing tools.
' Last modified by JFR, September 2012, Window can be resized..
' Last modified by JFR, October 2012. Search window has tabs. Shortcut keys for external searches, user defined resources, small icons
'                                     TradooIT )-: MyMemory, My own TMX, glosbe, WordReference
' More modifications 2013 JFR

Option Explicit
Dim stTerms As String


Sub SearchCustom(iIndex As Integer, stSel, stTitre As String)
    Dim txtsel As String

    'txtsel = Selection.Text
    txtsel = stSel
    txtsel = CleanUpString(txtsel)
    If txtsel = "" Then Exit Sub
    
    Dim i, iRetVal As Integer
    Dim sTmp As String * 256
    Dim stCmd, sttxt, sTXini, stCmdSearch As String
    
    sTXini = Application.StartupPath & "\terminotix.ini"
    If Not ReadINI Then Exit Sub
    iRetVal = Module.GetPrivateProfileString("Resource" + CStr(iIndex), "FinalURL", "", sTmp, 255, sTXini)
    stCmd = VBA.Left$(sTmp, iRetVal)
    If stCmd = "" Then
        Exit Sub
    End If
    
    iRetVal = Module.GetPrivateProfileString("Resource" + CStr(iIndex), "Searched", "", sTmp, 255, sTXini)
    sttxt = VBA.Left$(sTmp, iRetVal)
    If stCmd = sttxt Then
        Exit Sub
    End If
    
    i = InStr(1, stCmd, sttxt, vbTextCompare)
    If i = 0 Then
        Exit Sub
    End If
    
    stCmdSearch = VBA.Mid(stCmd, 1, i - 1) + URLEncode(txtsel) + VBA.Mid(stCmd, i + Len(sttxt), Len(stCmd))
    
    
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    'frmBrowse.Show
    'IE.WebSearch.Silent = True
    
    iSearchEngine = 101 + iIndex
    LoadBrowser stCmdSearch, stTitre
    wbWB(iNumRes - 1).Silent = True
    'IE.WebSearch.Navigate2 stCmdSearch
    
    'IE.Show
End Sub
Sub SetupSKey()
    If frmSKey Is Nothing Then
        Set frmSKey = New frmHotKeyMgt
    Else
        Unload frmSKey
        Set frmSKey = New frmHotKeyMgt
    End If
    frmSKey.Show
End Sub
Sub SetupCustomRes()
    If frmRes Is Nothing Then
        Set frmRes = New frmCustomRes
    Else
        Unload frmRes
        Set frmRes = New frmCustomRes
    End If
    frmRes.Show
End Sub
Sub SearchInMyTMX(stSel As String)
    Dim txtsel As String
    Dim i As Integer
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    i = SearchTMX(stTMXPath, txtsel)
    If i < 1 Then
        If i = -1 Then
            MsgBox "The file " + stTMXPath + " cannot be found.", , "Terminotix Toolbar"
        End If
        Exit Sub
    End If
    
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    
    'IE.WebSearch.Silent = True
    iSearchEngine = 30
    'IE.WebSearch.Navigate2 Application.StartupPath & "\temp.htm"
    LoadBrowser Application.StartupPath & "\temp.htm", "My TMX"
    
    'IE.Show

End Sub

Function GetREFERName() As String
    Dim stRefer As String
    Dim i As Integer
    
    i = InStr(1, ActiveDocument.FullName, ".LT.")
    If i = 0 Then
        GetREFERName = ""
        Exit Function
    End If
    
    stRefer = VBA.Left$(ActiveDocument.FullName, i + 3)
    GetREFERName = stRefer + "XML"
    
End Function



Sub MTLTBing()
    Dim http As New WinHttp.WinHttpRequest
    Dim i As Integer
    Dim iNodes As Object
    Dim xmldom As New MSXML2.DOMDocument60
    Dim xmlRefer As New MSXML2.DOMDocument60
    Dim httpxml As New MSXML2.DOMDocument60
    Dim xmlPhrase As New MSXML2.DOMDocument60
    Dim stText, txtsel, stToken, stRefer As String
    Dim frmMT As frmBingMT
    Dim rng As Range
    
    If Not ReadINI Then Exit Sub
    
    stToken = GetBINGToken
    
    stRefer = GetREFERName
    
    If Not xmlRefer.Load(stRefer) Then
        MsgBox "Error in xml file: " + stRefer
        Exit Sub
    End If
    
    
    Set http = Nothing

    For i = 1 To Selection.Sentences.Count
        If Selection.Sentences.Item(i).HighlightColorIndex = wdAuto Then
            
            Dim http1 As New WinHttp.WinHttpRequest
            
            txtsel = Selection.Sentences.Item(i).Text
            txtsel = CleanUpString(txtsel)
            If Len(VBA.Trim$(txtsel)) > 4 Then
                
                http1.Open "GET", "http://api.microsofttranslator.com/V2/Http.svc/Translate?appId=&text=" + txtsel + "&from=en&to=fr&contentType=text/plain", False
                http1.setRequestHeader "Authorization", stToken
                
                http1.send
                http1.waitForResponse
                xmldom.LoadXML http1.responseText
                
                Set rng = Selection.Sentences.Item(i)
                If VBA.Right$(Selection.Sentences.Item(i).Text, 1) = " " Then
                    rng.End = Selection.Sentences.Item(i).End - 1
                End If
                
                rng.HighlightColorIndex = wdDarkYellow
                
                Set http1 = Nothing
                stText = "<Phrase><sPhraseAppliquee></sPhraseAppliquee>"
                stText = stText + "<sPhraseOriginale></sPhraseOriginale><iDernSelection>0</iDernSelection><alPropositions>"
                stText = stText + "<Proposition><sLD></sLD><sLA></sLA><sDocument>Traduction automatique</sDocument>"
                stText = stText + "<sCote>85%</sCote><sRang>1</sRang></Proposition></alPropositions></Phrase>"
            
                
                Set iNodes = xmlRefer.SelectNodes("//alPhrases")
                If iNodes.Length = 0 Then
                    Exit Sub
                End If
                
                If Not xmlPhrase.LoadXML(stText) Then
                    MsgBox "Malforemed Phrase XML"
                    Exit Sub
                End If
                xmlPhrase.SelectSingleNode("//sPhraseAppliquee").Text = txtsel
                xmlPhrase.SelectSingleNode("//sPhraseOriginale").Text = txtsel
                xmlPhrase.SelectSingleNode("//sLA").Text = xmldom.Text
                xmlPhrase.SelectSingleNode("//sLD").Text = txtsel
                iNodes.Item(iNodes.Length - 1).appendChild xmlPhrase.SelectSingleNode("Phrase")
                xmlRefer.Save stRefer
            End If
        End If
    Next i
    
    
End Sub
Sub MTLTPortage()
    Dim http As New WinHttp.WinHttpRequest
    Dim i, RefiId, qid, pid, iCount As Integer
    Dim iNodes As MSXML2.IXMLDOMNodeList
    Dim iNode As MSXML2.IXMLDOMNode
    Dim xmldom As New MSXML2.DOMDocument60
    Dim xmlRefer As New MSXML2.DOMDocument60
    Dim httpxml As New MSXML2.DOMDocument60
    Dim xmlPhrase As New MSXML2.DOMDocument60
    Dim stText, txtsel, stToken, stRefer, stSoap As String
    Dim frmMT As frmBingMT
    Dim rng As Range
    
    If Not ReadINI Then Exit Sub
    
    stRefer = GetREFERName
    
    If Not xmlRefer.Load(stRefer) Then
        MsgBox "Error in xml file: " + stRefer
        Exit Sub
    End If
    
    ' Adding Portage as a reference
    Set iNodes = xmlRefer.SelectNodes("//References/Ref")
    
    Set iNode = iNodes.Item(iNodes.Length - 1).CloneNode(True)
    
    If iNode.Text <> "Portage Machine Translation" Then
        RefiId = Val(iNode.Attributes(0).Text) + 1
        iNode.Attributes(0).Text = VBA.Trim$(CStr(RefiId))
        iNode.Text = "Portage Machine Translation"
        iNodes.Item(iNodes.Length - 1).ParentNode.appendChild iNode
    Else
        RefiId = Val(iNode.Attributes(0).Text)
    End If
    
    ' Getting the last query
    Set iNodes = xmlRefer.SelectNodes("//Queries/Query")
    
    Set iNode = iNodes.Item(iNodes.Length - 1)
    
    qid = Val(iNode.Attributes(0).Text) + 1
    pid = Val(iNode.Attributes(1).Text) + 1
    
    'MsgBox pid
    
    xmlRefer.Save stRefer
    
    Set http = Nothing
    
    iCount = 0

    For i = 1 To ActiveDocument.Sentences.Count
        If ActiveDocument.Sentences.Item(i).HighlightColorIndex = wdAuto Then
            
            Dim http1 As New WinHttp.WinHttpRequest
            
            txtsel = ActiveDocument.Sentences.Item(i).Text
            txtsel = CleanUpString(txtsel)
            If Len(VBA.Trim$(txtsel)) > 4 Then
                ' ****************** PORTAGE
                stSoap = "<?xml version=""1.0""?>" + _
                         "<SOAP-ENV:Envelope xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/""><SOAP-ENV:Body xmlns:NS1=""urn:cnrc-nrc:portageliveservice"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/""><NS1:getTranslation2><srcString xsi:type=""xsd:string"">" + txtsel + "</srcString><context xsi:type=""xsd:string"">" + "Hansard-HOC.en2fr" + "</context><newline xsi:type=""xsd:string"">" + "p" + "</newline></NS1:getTranslation2></SOAP-ENV:Body></SOAP-ENV:Envelope>"
    
                http1.Open "POST", "http://206.125.167.136/terminotix/PortageLiveAPI.php", True
                http1.send stSoap
                http1.waitForResponse
    
                xmldom.LoadXML http1.responseText
                
                ' ********************* BING
                'stToken = GetBINGToken
    
                'http1.Open "GET", "http://api.microsofttranslator.com/V2/Http.svc/Translate?appId=&text=" + txtsel + "&from=" + bingsrce + "&to=" + bingtrgt + "&contentType=text/plain", False
                'http1.setRequestHeader "Authorization", stToken
    
                'http1.send
                'http1.waitForResponse
                'xmldom.LoadXML http1.responseText
                
                Set rng = ActiveDocument.Sentences.Item(i)
                               
                If VBA.Right$(ActiveDocument.Sentences.Item(i).Text, 1) = " " Then
                    rng.End = ActiveDocument.Sentences.Item(i).End - 1
                End If
                
                rng.HighlightColorIndex = wdDarkYellow
                
                If VBA.Asc(VBA.Right$(ActiveDocument.Sentences.Item(i).Text, 1)) = 13 Then
                    Dim rng2 As Range
                    Set rng2 = rng
                    rng2.Start = rng2.End - 1
                    rng.HighlightColorIndex = wdAuto
                End If
                
                Set http1 = Nothing
                stText = "<Query id=""" + VBA.Trim$(CStr(qid)) + """ pid=""" + VBA.Trim$(CStr(pid)) + """>"
                stText = stText + "<OriginalText></OriginalText>"
                stText = stText + "<Matches>"
                stText = stText + "<Match score=""100"" weight=""5.5"" words=""0"" matchratio=""1"" lenfactor=""1"" seqfactor=""1"">"
                stText = stText + "<RefId>" + VBA.Trim$(CStr(RefiId)) + "</RefId>"
                stText = stText + "<RefSrc>1</RefSrc>"
                stText = stText + "<RefTgt>2</RefTgt>"
                stText = stText + "</Match>"
                stText = stText + "</Matches>"
                stText = stText + "</Query>"
            
                
                Set iNodes = xmlRefer.SelectNodes("//Queries")
                If iNodes.Length = 0 Then
                    Exit Sub
                End If
                
                If Not xmlPhrase.LoadXML(stText) Then
                    MsgBox "Malforemed Phrase XML"
                    Exit Sub
                End If
                xmlPhrase.SelectSingleNode("//OriginalText").Text = txtsel
                xmlPhrase.SelectSingleNode("//RefSrc").Text = txtsel
                xmlPhrase.SelectSingleNode("//RefTgt").Text = xmldom.Text
                iNodes.Item(iNodes.Length - 1).appendChild xmlPhrase.SelectSingleNode("Query")
                xmlRefer.Save stRefer
                qid = qid + 1
                pid = pid + 1
                iCount = iCount + 1
            End If
        End If
    Next i
    
    If iCount > 0 Then
        MsgBox "Finished translating with Portage. " + VBA.Trim$(CStr(iCount)) + " sentences were translated."
    Else
        MsgBox "Found no sentences to translate."
    End If
    
End Sub
Sub PortageTranslate(stSel As String)
    Dim http As New WinHttp.WinHttpRequest
    Dim xmldom As New MSXML2.DOMDocument60
    Dim stSoap, txtsel As String
    Dim frmMT As frmBingMT
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    
    'stSoap = "<?xml version=""1.0""?>" + _
    '         "<SOAP-ENV:Envelope xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/""><SOAP-ENV:Body xmlns:NS1=""urn:cnrc-nrc:portageliveservice"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/""><NS1:getAllContexts><verbose xsi:type=""xsd:boolean"">true</verbose></NS1:getAllContexts></SOAP-ENV:Body></SOAP-ENV:Envelope>"
    stSoap = "<?xml version=""1.0""?>" + _
             "<SOAP-ENV:Envelope xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/""><SOAP-ENV:Body xmlns:NS1=""urn:cnrc-nrc:portageliveservice"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/""><NS1:getTranslation2><srcString xsi:type=""xsd:string"">" + txtsel + "</srcString><context xsi:type=""xsd:string"">" + stPortageContext + "</context><newline xsi:type=""xsd:string"">" + "p" + "</newline></NS1:getTranslation2></SOAP-ENV:Body></SOAP-ENV:Envelope>"
    
    'http.Open "POST", "http://plive-terminotix-en2fr.iit.nrc.ca/PortageLiveAPI.php", True
    'http.Open "POST", "http://206.125.167.136/terminotix/PortageLiveAPI.php", True
    http.Open "POST", stPortageHttpAPI, True
    http.send stSoap
    http.waitForResponse
    
    xmldom.LoadXML http.responseText
    
    
    'stSoap = "<?xml version=""1.0""?>" + _
    '"<SOAP-ENV:Envelope xmlns:SOAP-ENV=""http://schemas.xmlsoap.org/soap/envelope/"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:SOAP-ENC=""http://schemas.xmlsoap.org/soap/encoding/""><SOAP-ENV:Body xmlns:NS1=""urn:cnrc-nrc:portageliveservice"" SOAP-ENV:encodingStyle=""http://schemas.xmlsoap.org/soap/encoding/""><NS1:getTranslationCE><srcString xsi:type=""xsd:string"">" + txtsel + "</srcString></NS1:getTranslationCE></SOAP-ENV:Body></SOAP-ENV:Envelope>"
    
    'http.Open "POST", "http://plive-terminotix-en2fr.iit.nrc.ca/PortageLiveAPI.php", True
    'http.send stSoap
    'http.waitForResponse
    
    'xmldom.LoadXML http.responseText
    
    Set frmMT = New frmBingMT
    frmBingMT.Caption = "Portage Machine Translation"
    frmBingMT.TextBox1.Text = xmldom.Text
    
    'frmBingMT.TextBox1.Text = http.getResponseHeader("xml")
    
    
    frmBingMT.Show
    
    Set http = Nothing
    
End Sub
Sub BingTranslate(stSel As String)
    
    Dim txtsel, stToken As String
    Dim http As New WinHttp.WinHttpRequest
    Dim xmldom As New MSXML2.DOMDocument60
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    stToken = GetBINGToken
    
    http.Open "GET", "http://api.microsofttranslator.com/V2/Http.svc/Translate?appId=&text=" + txtsel + "&from=" + bingsrce + "&to=" + bingtrgt + "&contentType=text/plain", False
    http.setRequestHeader "Authorization", stToken
    
    http.send
    http.waitForResponse
    xmldom.LoadXML http.responseText
            
    Dim frmMT As frmBingMT
    Set frmMT = New frmBingMT
    frmBingMT.Caption = "Bing Machine Translation"
    frmBingMT.TextBox1.Text = xmldom.Text
    
    
    frmBingMT.Show
    Set http = Nothing
    
End Sub

Sub TERMINE()
    
    
    If Not ReadINI Then Exit Sub
    
    
    LoadBrowser "http://www.nactem.ac.uk/software/termine/#form", "TerMine"
    wbWB(iNumRes - 1).Silent = True
    
    
    
End Sub


Sub TAUS(stSel As String)
    Dim txtCmd, sTXini, txtsel As String
    Dim i As Integer
  
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    sTXini = Application.StartupPath & "\terminotix.ini"
    If Not ReadINI Then Exit Sub
    
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    
    'IE.stSelText = txtsel
    iSearchEngine = 24
    LoadBrowser "http://www.tausdata.org/index.php", "TAUS"
    wbWB(iNumRes - 1).Silent = True
    frmBrowse2.stSelText = txtsel
    
    While iSearchEngine = 24
        Sleep 500
        DoEvents
    Wend
    'wbWB(iNumRes - 1).Document.GetElementById("source_lang").Disabled = False
    i = 0
    While wbWB(iNumRes - 1).Document.GetElementById("source_lang").Disabled And i < 60
        Sleep 100
        DoEvents
        i = i + 1
    Wend
    If i >= 60 Then Exit Sub
    i = 0
    wbWB(iNumRes - 1).Document.GetElementById("source_lang").value = TAUSsrce
    While wbWB(iNumRes - 1).Document.GetElementById("target_lang").Disabled And i < 60
        Sleep 100
        DoEvents
        i = i + 1
    Wend
    If i >= 60 Then Exit Sub
    'wbWB(iNumRes - 1).Document.GetElementById("q").Value = txtsel
    wbWB(iNumRes - 1).Document.GetElementById("target_lang").value = TAUStrgt
    wbWB(iNumRes - 1).Document.parentwindow.execScript ("formSearch()")
End Sub
Sub ITU(stSel As String)
    
    Dim txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    iSearchEngine = 20
    frmBrowse2.stSelText = txtsel
    LoadBrowser "http://www.itu.int/terminology/index.html", "Termite"
    wbWB(iNumRes - 1).Silent = True
    
    
    'IE.WebSearch.Silent = True
    
    
    'IE.WebSearch.Navigate2 "http://www.itu.int/terminology/index.html"
    'IE.Show
End Sub

Sub TotalRecall(stSel As String)
    
    Dim txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    iSearchEngine = 31
    frmBrowse2.stSelText = txtsel
    LoadBrowser "http://candle.fl.nthu.edu.tw/totalrecall/totalrecall/totalrecall.aspx", "TOTALrecall"
    wbWB(iNumRes - 1).Silent = True

End Sub

Sub USITO(stSel As String)
    
    Dim txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    iSearchEngine = 29
    frmBrowse2.stSelText = txtsel
    LoadBrowser "https://www.usito.com/dictio/", "usito"
    wbWB(iNumRes - 1).Silent = True
    While wbWB(iNumRes - 1).Busy
        Sleep (100)
        If iSearchEngine = -1 Then
            Exit Sub
        End If
        DoEvents
    Wend
    If iSearchEngine = -1 Then
        Exit Sub
    End If
    
    SendKeys txtsel, True
    SendKeys "{ENTER}", True

End Sub
Sub ITUMT(stSel As String)
    
    Dim txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    iSearchEngine = 22
    frmBrowse2.stSelText = txtsel
    LoadBrowser "https://www.itu.int/translate/translateItu.jsf", "ITU MT"
    wbWB(iNumRes - 1).Silent = True
    
End Sub

Sub Collins(stSel As String)
    On Error Resume Next
    Dim iRetVal As Integer
    Dim txtCmd, sTXini, txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    sTXini = Application.StartupPath & "\terminotix.ini"
    
    iRetVal = Module.GetPrivateProfileInt("Setup", "COLLINS", 0, sTXini)
    
    Select Case iRetVal
        Case 0: txtCmd = "english-french"
        Case 1: txtCmd = "french-english"
        Case 2: txtCmd = "english-german"
        Case 3: txtCmd = "german-english"
        Case 4: txtCmd = "english-spanish"
        Case 5: txtCmd = "spanish-english"
    End Select
    
    txtCmd = "http://www.collinsdictionary.com/dictionary/" + txtCmd + "/" + txtsel
    
    
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    
    frmBrowse2.stSelText = txtsel
    iSearchEngine = 14
    LoadBrowser txtCmd, "Collins"
    wbWB(iNumRes - 1).Silent = True
    
    'IE.WebSearch.Navigate2 "http://www.linguee.com"
    'IE.WebSearch.Navigate2 txtCmd
    
    'IE.Show
End Sub

Sub Larousse(stSel As String)
    On Error Resume Next
    Dim iRetVal As Integer
    Dim txtCmd, sTXini, txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    sTXini = Application.StartupPath & "\terminotix.ini"
    
    txtCmd = "http://www.larousse.fr/dictionaries/" + stLarousse + "/" + VBA.LCase(txtsel)
    
    
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    
    'IE.stSelText = txtsel
    frmBrowse2.stSelText = txtsel
    
    'IE.WebSearch.Silent = True
    iSearchEngine = 18
    LoadBrowser txtCmd, "Larousse"
    wbWB(iNumRes - 1).Silent = True
    'IE.WebSearch.Navigate2 "http://www.linguee.com"
    'IE.WebSearch.Navigate2 txtCmd
    'IE.Show
End Sub

Sub LEO(stSel As String)
    
    Dim iRetVal As Integer
    Dim txtCmd, sTXini, txtsel As String
    
    'txtsel = Selection.Text
    
    txtsel = stSel 'txtsel = CleanUpString(txtsel)
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    
    txtCmd = "http://dict.leo.org/" + stLEO + "?lp=" + stLEO + "&lang=en&searchLoc=0&cmpType=relaxed&sectHdr=on&spellToler=&search=" + txtsel
    
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    
    frmBrowse2.stSelText = txtsel
    
    'IE.WebSearch.Silent = True
    iSearchEngine = 19
    LoadBrowser txtCmd, "LEO"
    wbWB(iNumRes - 1).Silent = True
End Sub

Sub UNICAEN(stSel As String)

    Dim iRetVal As Integer
    Dim txtCmd, sTXini, txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = VBA.LCase(CleanUpString(txtsel))
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    txtCmd = "http://www.crisco.unicaen.fr/des/synonymes/" + txtsel
    
    If IE Is Nothing Then
        Set IE = New frmBrowse
    Else
        Unload IE
        Set IE = New frmBrowse
    End If
    
    frmBrowse2.stSelText = txtsel
    
    'IE.WebSearch.Silent = True
    iSearchEngine = 27
    LoadBrowser txtCmd, "UNICAEN"
    wbWB(iNumRes - 1).Silent = True
End Sub

Sub ConjugArt(stSel As String)
    
    Dim iRetVal As Integer
    Dim txtCmd, sTXini, txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    txtCmd = "http://btb.termiumplus.gc.ca/verbex-srch?lang=fra&srchtxt=" + txtsel + "&i=1&x=0&y=0"
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    frmBrowse2.stSelText = txtsel
    
    'IE.WebSearch.Silent = True
    iSearchEngine = 17
    LoadBrowser txtCmd, "ConjugArt"
    wbWB(iNumRes - 1).Silent = True
End Sub

Sub Clefsfp(stSel As String)
    
    Dim iRetVal As Integer
    Dim txtCmd, sTXini, txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    txtCmd = "http://btb.termiumplus.gc.ca/clefsfp-srch?srchtxt=" + txtsel + "&i=&lang=fra&cur=1&nmbr=&comencsrch.x=0&comencsrch.y=0"
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    'IE.stSelText = txtsel
    
    frmBrowse2.stSelText = txtsel
    
    'IE.WebSearch.Silent = True
    iSearchEngine = 16
    LoadBrowser txtCmd, "Clefs du français pratique"
    wbWB(iNumRes - 1).Silent = True
End Sub


Sub DicOcc(stSel As String)
    
    Dim iRetVal As Integer
    Dim txtCmd, sTXini, txtsel As String
    
    txtsel = stSel 'txtsel = Selection.Text
    
    txtsel = CleanUpString(txtsel)
    
    If txtsel = "" Then Exit Sub
    
    If Not ReadINI Then Exit Sub
    txtCmd = "http://btb.termiumplus.gc.ca/cooc-srch?lang=fra&srchtxt=" + txtsel + "&cur=2&nmbr=7&lettr=&page="
    
    'If IE Is Nothing Then
    '    Set IE = New frmBrowse
    'Else
    '    Unload IE
    '    Set IE = New frmBrowse
    'End If
    frmBrowse2.stSelText = txtsel
    
    'IE.WebSearch.Silent = True
    iSearchEngine = 15
    LoadBrowser txtCmd, "Dictionnaire des cooccurrences"
    wbWB(iNumRes - 1).Silent = True
End Sub

Function ReadINI() As Boolean
    Dim stReg, sTXini As String
    Dim iRetVal As Integer
    Dim sTmp As String * 255
    
    ReadINI = True
    If Not PaidVersion And iNumRes > 0 Then
        Dim fSnagp As frmSnag
        Set fSnagp = New frmSnag
        fSnagp.Show
        Unload fSnagp
        ReadINI = False
    End If
    
    sTXini = Application.StartupPath & "\terminotix.ini"
    
    iRetVal = Module.GetPrivateProfileString("Setup", "PortageHttpAPI", "", sTmp, 255, sTXini)
    
    stPortageHttpAPI = VBA.Left$(sTmp, iRetVal)
    
    iRetVal = Module.GetPrivateProfileString("Setup", "PortageContext", "", sTmp, 255, sTXini)
    
    stPortageContext = VBA.Left$(sTmp, iRetVal)
    
    iINSTERM = Module.GetPrivateProfileInt("Setup", "Insert", 1, sTXini)
    iKEEPTERM = Module.GetPrivateProfileInt("Setup", "KeepTerm", 1, sTXini)
    
    For iRetVal = 0 To 255
        sTmp = sTmp + " "
    Next
    iRetVal = Module.GetPrivateProfileString("LogiTerm Termino", "SrceIndex", "", sTmp, 255, sTXini)
    ltSrceIndex = VBA.Left$(sTmp, iRetVal)
    
    For iRetVal = 0 To 255
        sTmp = sTmp + " "
    Next
    iRetVal = Module.GetPrivateProfileString("LogiTerm Termino", "TrgtIndex", "", sTmp, 255, sTXini)
    ltTrgtIndex = VBA.Left$(sTmp, iRetVal)

    For iRetVal = 0 To 255
        sTmp = sTmp + " "
    Next
    iRetVal = Module.GetPrivateProfileString("LogiTerm Termino", "Source", "", sTmp, 255, sTXini)
    ltSource = VBA.Left$(sTmp, iRetVal)

    For iRetVal = 0 To 255
        sTmp = sTmp + " "
    Next
    iRetVal = Module.GetPrivateProfileString("LogiTerm Termino", "SrceCtx", "", sTmp, 255, sTXini)
    ltSrceCtx = VBA.Left$(sTmp, iRetVal)

    For iRetVal = 0 To 255
        sTmp = sTmp + " "
    Next
    iRetVal = Module.GetPrivateProfileString("LogiTerm Termino", "TrgtCtx", "", sTmp, 255, sTXini)
    ltTrgtCtx = VBA.Left$(sTmp, iRetVal)
    
    For iRetVal = 0 To 255
        sTmp = sTmp + " "
    Next
    iRetVal = Module.GetPrivateProfileString("LogiTerm Termino", "DocRef", "", sTmp, 255, sTXini)
    ltDocRef = VBA.Left$(sTmp, iRetVal)
    
    For iRetVal = 0 To 255
        sTmp = sTmp + " "
    Next
    iRetVal = Module.GetPrivateProfileString("Setup", "ClientId", "", sTmp, 255, sTXini)
    
    ClientId = VBA.Left$(sTmp, iRetVal)
    
    iRetVal = Module.GetPrivateProfileString("Setup", "ClientSecret", "", sTmp, 255, sTXini)
    
    ClientSecret = VBA.Left$(sTmp, iRetVal)
    
    iRetVal = Module.GetPrivateProfileString("Setup", "TMXPath", "", sTmp, 255, sTXini)
    
    stTMXPath = VBA.Left$(sTmp, iRetVal)
    
    iRetVal = Module.GetPrivateProfileInt("Setup", "bingsrce", 8, sTXini)
    
    Select Case iRetVal
        Case 0
            bingsrce = "ar"
        Case 1
            bingsrce = "bg"
        Case 2
            bingsrce = "ca"
        Case 3
            bingsrce = "zh-CHS"
        Case 4
            bingsrce = "zh-CHT"
        Case 5
            bingsrce = "cs"
        Case 6
            bingsrce = "da"
        Case 7
            bingsrce = "nl"
        Case 8
            bingsrce = "en"
        Case 9
            bingsrce = "et"
        Case 10
            bingsrce = "fi"
        Case 11
            bingsrce = "fr"
        Case 12
            bingsrce = "de"
        Case 13
            bingsrce = "el"
        Case 14
            bingsrce = "ht"
        Case 15
            bingsrce = "he"
        Case 16
            bingsrce = "hi"
        Case 17
            bingsrce = "hu"
        Case 18
            bingsrce = "id"
        Case 19
            bingsrce = "it"
        Case 20
            bingsrce = "ja"
        Case 21
            bingsrce = "ko"
        Case 22
            bingsrce = "lv"
        Case 23
            bingsrce = "lt"
        Case 24
            bingsrce = "no"
        Case 25
            bingsrce = "pl"
        Case 26
            bingsrce = "pt"
        Case 27
            bingsrce = "ro"
        Case 28
            bingsrce = "ru"
        Case 29
            bingsrce = "sk"
        Case 30
            bingsrce = "sl"
        Case 31
            bingsrce = "es"
        Case 32
            bingsrce = "sv"
        Case 33
            bingsrce = "th"
        Case 34
            bingsrce = "tr"
        Case 35
            bingsrce = "uk"
        Case 35
            bingsrce = "vi"
    End Select
    
    iRetVal = Module.GetPrivateProfileInt("Setup", "bingtrgt", 11, sTXini)
    
    Select Case iRetVal
        Case 0
            bingtrgt = "ar"
        Case 1
            bingtrgt = "bg"
        Case 2
            bingtrgt = "ca"
        Case 3
            bingtrgt = "zh-CHS"
…
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 931840 bytes
SHA-256: 2b1a77cc1cc052fc267d3639515ec62c0f010767d3b9dc087232b6b1c7c40d68