Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 f5ac783340c6786a…

MALICIOUS

Office (OOXML) / .XLSX

577.2 KB Created: 2016-01-04 02:26:30 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2026-06-06
MD5: 1004d82f7a1b23791e788bc248b843ac SHA-1: 05be8ba506646de4ef3c0162e5f0e376380e4175 SHA-256: f5ac783340c6786a11dfe86705fe338caa9ef25eae48455b5a56d753a76add1c
178 Risk Score

Heuristics 7

  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell ("cmd /c start chrome " & Sheet3.Range("D1").Value & "upload/")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
        Shell ("cmd /c start chrome " & Sheet3.Range("D1").Value & "upload/")
  • External hyperlinks (1) low OOXML_EXTERNAL_HYPERLINKS
    Document contains 1 external hyperlink — clickable URLs are stored as external relationships. First target: https://cbtadmin-host.bimasoft.web.id/419/
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 1 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cbtadmin-host.bimasoft.web.id/419/ Document hyperlink

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 24647 bytes
SHA-256: 0735026387260f4fd4beb5f75f0098f20c5b8480b7ed0d697474ee150a6caa77
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet12"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module2"
Sub Macro1()
Attribute Macro1.VB_ProcData.VB_Invoke_Func = "B\n14"
'
' Macro1 Macro
'
' Keyboard Shortcut: Ctrl+Shift+B
'
    s = InputBox("Text", "Insert Bold Text")
    If s <> "" Then
        If Selection.Value <> "" Then
            Selection.Value = Selection.Value & " "
        End If
        Selection.Value = Selection.Value & "<b>" & s & "</b>"
    End If
End Sub
Sub Macro2()
Attribute Macro2.VB_ProcData.VB_Invoke_Func = "I\n14"
'
' Macro2 Macro
'
' Keyboard Shortcut: Ctrl+Shift+I
'
    s = InputBox("Text", "Insert Italic Text")
    If s <> "" Then
        If Selection.Value <> "" Then
            Selection.Value = Selection.Value & " "
        End If
        Selection.Value = Selection.Value & "<i>" & s & "</i>"
    End If
End Sub
Sub Macro3()
Attribute Macro3.VB_ProcData.VB_Invoke_Func = "U\n14"
'
' Macro3 Macro
'
' Keyboard Shortcut: Ctrl+Shift+U
'
    s = InputBox("Text", "Insert Underline Text")
    If s <> "" Then
        If Selection.Value <> "" Then
            Selection.Value = Selection.Value & " "
        End If
        Selection.Value = Selection.Value & "<u>" & s & "</u>"
    End If
End Sub

Attribute VB_Name = "Module1"
Sub tablelize()
    r = Selection.Rows.Count
    c = Selection.Columns.Count
    Range("A1").Value = "<table>"
    For j = 1 To r
        Range("A1").Value = Range("A1").Value & "<tr>"
        i = 1
        While i <= c
            s = Selection.Cells(j, i).Value
            addition = "<td style='"
            If Selection.Cells(j, i).MergeCells Then
                If Selection.Cells(j, i).MergeArea.Cells.Count > 1 Then
                    addition = "<td colspan=" & Selection.Cells(j, i).MergeArea.Cells.Count & " style='"
                    i = i + Selection.Cells(j, i).MergeArea.Cells.Count - 1
                End If
            End If
            Range("A1").Value = Range("A1").Value & addition
            Range("A1").Value = Range("A1").Value & "width:" & Round(Selection.Cells(j, i).ColumnWidth * 8) & "px;"
            If Selection.Cells(j, i).Borders(xlEdgeLeft).LineStyle <> xlNone Then
                Range("A1").Value = Range("A1").Value & "border-left:solid thin black;"
            End If
            If Selection.Cells(j, i).Borders(xlEdgeTop).LineStyle <> xlNone Then
                Range("A1").Value = Range("A1").Value & "border-top:solid thin black;"
            End If
            If Selection.Cells(j, i).Borders(xlEdgeRight).LineStyle <> xlNone Then
                Range("A1").Value = Range("A1").Value & "border-right:solid thin black;"
            End If
            If Selection.Cells(j, i).Borders(xlEdgeBottom).LineStyle <> xlNone Then
                Range("A1").Value = Range("A1").Value & "border-bottom:solid thin black;"
            End If
            If Selection.Cells(j, i).Font.Bold Then
                Range("A1").Value = Range("A1").Value & "font-weight:bold;"
            End If
            If Selection.Cells(j, i).Font.Italic Then
                Range("A1").Value = Range("A1").Value & "font-style:italic;"
            End If
            If Selection.Cells(j, i).Font.Underline = xlUnderlineStyleSingle Then
                Range("A1").Value = Range("A1").Value & "text-decoration:underline;"
            End If
            If Selection.Cells(j, i).HorizontalAlignment = xlCenter Then
                Range("A1").Value = Range("A1").Value & "text-align:center;"
            End If
            If Selection.Cells(j, i).HorizontalAlignment = xlLeft Then
                Range("A1").Value = Range("A1").Value & "text-align:left;"
            End If
            If Selection.Cells(j, i).HorizontalAlignment = xlRight Then
                Range("A1").Value = Range("A1").Value & "text-align:right;"
            End If
            If Selection.Cells(j, i).HorizontalAlignment = xlJustify Then
                Range("A1").Value = Range("A1").Value & "text-align:justify;"
            End If
            Range("A1").Value = Range("A1").Value & "'>"
            Range("A1").Value = Range("A1").Value & s
            Range("A1").Value = Range("A1").Value & "</td>"
            i = i + 1
        Wend
        Range("A1").Value = Range("A1").Value & "</tr>"
    Next j
    Range("A1").Value = Range("A1").Value & "</table>"
    Range("A1").Select
    Selection.Copy
End Sub
Sub uploader()
    Shell ("cmd /c start chrome " & Sheet3.Range("D1").Value & "upload/")
End Sub
Sub equationeditor()
    Shell ("cmd /c start chrome " & Sheet3.Range("D1").Value & "equation-editor/")
End Sub
Sub tinymce()
    Shell ("cmd /c start chrome " & Sheet3.Range("D1").Value & "editor/")
End Sub
Sub kirimoptions0()

Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
    URL = Range("D1").Value & "wp-content/themes/unbk/api-18575621/options.php"
    Sheet3.Range("C53").Value = URL
    s = _
    "alokasi=" & Range("D8").Value & _
    "&kode=" & Range("D2").Value & _
    "&key=" & Range("G3").Value & _
    "&nama=" & Range("D3").Value & _
    "&status=" & Range("D4").Value & _
    "&subtest=" & Range("D5").Value & _
    "&shuffle=" & Range("D11").Value & _
    "&shuffle2=" & Range("F11").Value & _
    "&jumlahsoal=" & Range("D9").Value & _
    "&dikerjakan=" & Range("D10").Value & _
    "&timezone=" & Range("F8").Value & _
    "&tanggal=" & Range("H6").Value & "-" & Range("F6").Value & "-" & Range("D6").Value & _
    "&waktu=" & Range("D7").Value & ":" & Range("F7").Value & ""
    For i = 1 To 34
        s = s & "&" & i & "=" & Range("K" & i).Value
        s = s & "&b" & i & "=" & Range("S" & i).Value
        s = s & "&g" & i & "=" & Range("D" & i + 14).Value
    Next i
    For i = 35 To 68
        s = s & "&" & i & "=" & Range("M" & i - 34).Value
        s = s & "&b" & i & "=" & Range("U" & i - 34).Value
        s = s & "&g" & i & "=" & Range("F" & i - 20).Value
    Next i
    For i = 69 To 100
        s = s & "&" & i & "=" & Range("O" & i - 68).Value
        s = s & "&b" & i & "=" & Range("W" & i - 68).Value
        s = s & "&g" & i & "=" & Range("H" & i - 54).Value
    Next i
    'Range("D11").Value = URL & "?" & s
    objHTTP.Open "POST", URL, False
    objHTTP.setRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
    objHTTP.setRequestHeader "Content-type", "application/x-www-form-urlencoded"
    objHTTP.send (s)
        If objHTTP.responsetext = "OK" Then
            MsgBox ("Test Berhasil di Simpan")
        Else
            If objHTTP.responsetext = "KEY DITOLAK" Then
                MsgBox ("KEY DITOLAK")
                Sheet3.Range("R9").Value = objHTTP.responsetext
            Else
                MsgBox ("GAGAL TERHUBUNG KE SERVER")
                Sheet3.Range("R9").Value = objHTTP.responsetext
            End If
        End If
    
End Sub


Sub clear3()
    If MsgBox("Nilai hasi test akan di hapus, apakah anda yakin ?", vbYesNo + vbCritical, "Confirm") = vbYes Then
        Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP")
           URL = Range("D1").Value & "datatest/clear3.php"
           objHTTP.Open "POST", URL, False
           objHTTP.setRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
           objHTTP.send ("")
           Sheet3.Range("R9").Value = objHTTP.responsetext
           MsgBox ("Hasil Test Siswa Sudah Dihapus")
    End If
    
End Sub

Sub uploadsiswa()

Application.Calculation = xlManual
jumlah = Sheet8.Range("D2").Value

s = "first=1&"

For i = 1 To jumlah
    Sheet8.Cells(i + 3, 3).Value = UCase(Sheet8.Cells(i + 3, 3).Value)
Next i

mapel = Sheet3.Range("D2").Value

j = 1
For i = 1 To jumlah
    s = s & _
    "user-" & j & "=" & Sheet8.Cells(i + 3, 3).Value & _
    "&nis-" & j & "=" & Sheet8.Cells(i + 3, 2).Value & _
    "&nama-" & j & "=" & Sheet8.Cells(i + 3, 4).Value & _
    "&key=" & Sheet3.Range("G3").Value & _
    "&nik2-" & j & "=" & Sheet8.Cells(i + 3, 7).Value & _
    "&nik-" & j & "=" & Sheet8.Cells(i + 3, 6).Value & _
    "&server-" & j & "=" & Sheet8.Cells(i + 3, 8).Value & _
    "&sesi-" & j & "=" & Sheet8.Cells(i + 3, 9).Value & _
    "&mapel-" & j & "=" & mapel & _
    "&pass-" & j & "=" & Sheet8.Cells(i + 3, 5).Value & "&"
    If j Mod 50 = 0 Then
        jumlah = 50
        s = "count=" & jumlah & "&" & s
        Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP")
           URL = Sheet3.Range("D1").Value & "wp-content/themes/unbk/api-18575621/uploadsiswa.php"
           objHTTP.Open "POST", URL, False
           'objHTTP.setRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
           objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36)"
           objHTTP.setRequestHeader "Content-type", "application/x-www-form-urlencoded"
           objHTTP.send (s)
           res = objHTTP.responsetext
           Sheet3.Range("R9").Value = objHTTP.responsetext
        j = 0
        s = ""
    End If
    j = j + 1
Next i
        jumlah = j - 1
        If jumlah > 0 Then
            s = "count=" & jumlah & "&" & s
            Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP")
               URL = Sheet3.Range("D1").Value & "wp-content/themes/unbk/api-18575621/uploadsiswa.php"
               'MsgBox (URL)
               objHTTP.Open "POST", URL, False
               objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36)"
               objHTTP.setRequestHeader "Content-type", "application/x-www-form-urlencoded"
               objHTTP.send (s)
               res = objHTTP.responsetext
               Sheet3.Range("R9").Value = objHTTP.responsetext
            j = 0
        End If
'MsgBox (s)
'Range("C13").Value = URL & "?" & s
'Range("C13").Value = res
        s = ""

        If objHTTP.responsetext = "OK" Then
            MsgBox ("Data Siswa Berhasil di Simpan")
            Sheet3.Range("R9").Value = objHTTP.responsetext
        Else
            If objHTTP.responsetext = "KEY DITOLAK" Then
                MsgBox ("KEY DITOLAK")
                Sheet3.Range("R9").Value = objHTTP.responsetext
            Else
                MsgBox ("GAGAL TERHUBUNG KE SERVER")
                Sheet3.Range("R9").Value = objHTTP.responsetext
            End If
        End If

Application.Calculation = xlAutomatic
End Sub

Sub kirim()

'duplikasi soal ke soal formatted

Sheet1.Range("B11:J110").Clear

i = 11
tot = Range("R3").Value
While (Range("B" & i) <> "")
    For j = 2 To 10
        Range("O3").Value = Round((i - 10) / tot * 100) / 100
        DoEvents
        If Cells(i, j).Value = "" Then
            Sheet1.Cells(i, j).Value = "#"
        Else
            Sheet1.Cells(i, j).Value = Cells(i, j).Value
        End If
    Next j
    i = i + 1
Wend

Sheet1.Activate
format

Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP")
   URL = Range("D1").Value & "datatest/clear2.php"
   objHTTP.Open "POST", URL, False
   objHTTP.setRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
   objHTTP.send ("")
   Sheet3.Range("R9").Value = objHTTP.responsetext


i = 11
j = 1
s = ""
While (Range("B" & i) <> "")
    If j = 1 Then
    Else
        s = s & "&"
    End If
    
    s = s & "no" & j & "=" & Range("B" & i).Value & "&soal" & j & "=" & Range("C" & i).Value & "&options" & j & "=" & Range("D" & i).Value & "&a" & j & "=" & Range("E" & i).Value & "&b" & j & "=" & Range("F" & i).Value & "&c" & j & "=" & Range("G" & i).Value & "&d" & j & "=" & Range("H" & i).Value & "&e" & j & "=" & Range("I" & i).Value & "&benar" & j & "=" & Range("J" & i).Value & ""
    i = i + 1
    j = j + 1
Wend
j = j - 1
s = "count=" & j & "&" & s
For i = 11 To 110
    If (Range("B" & i) = "") Then
        Range("J" & i).Value = "X"
    End If
Next i

Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP")
   URL = Range("D1").Value & "submit/"
   objHTTP.Open "POST", URL, False
   objHTTP.setRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
   objHTTP.setRequestHeader "Content-type", "application/x-www-form-urlencoded"
   objHTTP.send (s)
   Sheet3.Range("R9").Value = objHTTP.responsetext
   
Sheet3.Activate

End Sub

Sub upload()
    kirimoptions
    kirim
    MsgBox ("Upload Selesai")
End Sub

Sub format()

Cells.Replace What:="–", Replacement:="-", LookAt:=xlPart, SearchOrder _
    :=xlByRows, MatchCase:=False, SearchFormat:=False, ReplaceFormat:=False
Cells.Replace What:="@#", Replacement:="<img src='", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:="#@", Replacement:="' />", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:="$%", Replacement:="<audio controls><source src=""", _
    LookAt:=xlPart, SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:= _
    False, ReplaceFormat:=False
Cells.Replace What:="%$", Replacement:= _
    """ type=""audio/ogg"">Your browser does not support the audio element.</audio>" _
    , LookAt:=xlPart, SearchOrder:=xlByRows, MatchCase:=False, SearchFormat _
    :=False, ReplaceFormat:=False
Cells.Replace What:="#$", Replacement:= _
    "<video width=""400"" controls><source src=""", LookAt:=xlPart, SearchOrder _
    :=xlByRows, MatchCase:=False, SearchFormat:=False, ReplaceFormat:=False
Cells.Replace What:="$#", Replacement:= _
    """ type=""video/mp4"">Your browser does not support HTML5 video.</video>", _
    LookAt:=xlPart, SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:= _
    False, ReplaceFormat:=False
'Cells.Replace What:="'", Replacement:="''", LookAt:=xlPart, SearchOrder _
    :=xlByRows, MatchCase:=False, SearchFormat:=False, ReplaceFormat:=False
Cells.Replace What:="" & Chr(10) & "", Replacement:="<br/>", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:="""", Replacement:="""""", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:="…", Replacement:="...", LookAt:=xlPart, SearchOrder _
    :=xlByRows, MatchCase:=False, SearchFormat:=False, ReplaceFormat:=False
Cells.Replace What:="\", Replacement:="\\", LookAt:=xlPart, SearchOrder _
    :=xlByRows, MatchCase:=False, SearchFormat:=False, ReplaceFormat:=False
Cells.Replace What:="</b><b>", Replacement:="", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:="</u><u>", Replacement:="", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:="</i><i>", Replacement:="", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:="><", Replacement:=">\<", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:=">\<br/>\<", Replacement:=">\<", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
Cells.Replace What:="&", Replacement:="%26", LookAt:=xlPart, SearchOrder _
    :=xlByRows, MatchCase:=False, SearchFormat:=False, ReplaceFormat:=False
Range("B11:J11").Select
Range(Selection, Selection.End(xlDown)).Select
Selection.Replace What:="+", Replacement:="%2b", LookAt:=xlPart, _
    SearchOrder:=xlByRows, MatchCase:=False, SearchFormat:=False, _
    ReplaceFormat:=False
End Sub

Sub img()
    s = InputBox("Link Image", "Insert Image")
    If s <> "" Then
        If Selection.Value <> "" Then
            Selection.Value = Selection.Value & " "
        End If
        Selection.Value = Selection.Value & "@#" & s & "#@"
    End If
End Sub

Sub math()
    s = InputBox("LaTex Equation", "Insert Equation")
    If s <> "" Then
        If Selection.Value <> "" Then
            Selection.Value = Selection.Value & " "
        End If
        Selection.Value = Selection.Value & "$$" & s & "$$"
    End If
End Sub

Sub audio()
    s = InputBox("Link Audio", "Insert Audio")
    If s <> "" Then
        If Selection.Value <> "" Then
            Selection.Value = Selection.Value & " "
        End If
        Selection.Value = Selection.Value & "$%" & s & "%$"
    End If
End Sub

Sub video()
    s = InputBox("Link Video", "Insert Video")
    If s <> "" Then
        If Selection.Value <> "" Then
            Selection.Value = Selection.Value & " "
        End If
        Selection.Value = Selection.Value & "#$" & s & "$#"
    End If
End Sub

Function post(ByVal URL As String, ByVal parameter As String)
    Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
        objHTTP.SetTimeouts 0, 60000, 30000, 300000
        objHTTP.Open "POST", URL, False
        objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36"
        'objHTTP.setRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
        objHTTP.setRequestHeader "Content-type", "application/x-www-form-urlencoded"
        objHTTP.send (parameter)
        post = objHTTP.responsetext
        Sheet3.Range("R9").Value = objHTTP.responsetext
End Function

Function CountSubInStr(ByVal SubStr As String, ByVal Str As String)
    CountSubInStr = Len(Str) - Len(Replace(Str, SubStr, ""))
End Function

Sub rekaphasil()
    Application.Calculation = xlManual
    s = Sheet3.Range("D1").Value & "wp-content/themes/unbk/api-18575621/showstatuspesertaexcel.php?key=" & Sheet3.Range("G3").Value & "&aktif=" & Sheet3.Range("D2").Value
    s = s & "&XDEBUG_SESSION_START=VBA"
    site = s
    Sheet2.Unprotect ("Nihlah2010")
    Sheet2.Rows("3:10000").ClearContents
    Sheet2.Rows("3:10000").Interior.ColorIndex = 0
    Sheet2.Protect "Nihlah2010", UserInterfaceOnly:=True, AllowFormattingCells:=True, AllowFormattingColumns:=True, AllowFormattingRows:=True, AllowSorting:=True, AllowFiltering:=True
    
    x = post(site, "")
    Sheet12.Range("A1").Value = x
    xrows = Split(x, "|")
    xRowCount = CountSubInStr("|", x)
    Sheet2.Unprotect ("Nihlah2010")
    For i = 0 To xRowCount - 1
        xColcount = CountSubInStr(";", xrows(i))
        xcols = Split(xrows(i), ";")
        For j = 0 To xColcount - 1
            If j + 1 >= 9 Then
                xcols(j) = Replace(xcols(j), "'", "")
                If (Replace(xcols(j), "'", "") = Sheet2.Cells(2, j + 1)) Or (Sheet2.Cells(2, j + 1) = "X") Then
                    Sheet2.Cells(i + 3, j + 1).Interior.Color = RGB(119, 204, 122)
                Else
                    Sheet2.Cells(i + 3, j + 1).Interior.Color = RGB(245, 140, 137)
                End If
            End If
            Sheet2.Cells(i + 3, j + 1).Value = "'" & xcols(j)
        Next j
    Next i
    Application.Calculation = xlAutomatic
    Sheet2.Protect "Nihlah2010", UserInterfaceOnly:=True, AllowFormattingCells:=True, AllowFormattingColumns:=True, AllowFormattingRows:=True, AllowSorting:=True, AllowFiltering:=True
End Sub


Sub kdbreakdown()
    'for i = 0 to
End Sub

Sub kirimoptionsnew()

Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
    URL = Range("D1").Value & "wp-content/themes/unbk/api-18575621/options.php"
    s = _
    "alokasi=" & Range("D8").Value & _
    "&kode=" & Range("D2").Value & _
    "&key=" & Range("G3").Value & _
    "&nama=" & Range("D3").Value & _
    "&status=" & Range("D4").Value & _
    "&subtest=" & Range("D5").Value & _
    "&shuffle=" & Range("D11").Value & _
    "&shuffle2=" & Range("F11").Value & _
    "&jumlahsoal=" & Range("D9").Value & _
    "&dikerjakan=" & Range("D10").Value & _
    "&tanggal=" & Range("H6").Value & "-" & Range("F6").Value & "-" & Range("D6").Value & _
    "&waktu=" & Range("D7").Value & ":" & Range("F7").Value & ""
    's = s & "&XDEBUG_SESSION_START=VBA"
    
    objHTTP.Open "POST", URL, False
    'objHTTP.setRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
    objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36"
    objHTTP.setRequestHeader "Content-type", "application/x-www-form-urlencoded"
    objHTTP.send (s)
    
        If IsNumeric(objHTTP.responsetext) Then
            If CInt(objHTTP.responsetext) >= 0 Then
                MsgBox ("Test Berhasil di Simpan")
                Range("B1").Value = objHTTP.responsetext
                Sheet3.Range("R9").Value = objHTTP.responsetext
            Else
                MsgBox ("GAGAL MENDAPATKAN TEST ID")
                Sheet3.Range("R9").Value = objHTTP.responsetext
            End If
        Else
            If objHTTP.responsetext = "KEY DITOLAK" Then
                MsgBox ("KEY DITOLAK")
                Sheet3.Range("R9").Value = objHTTP.responsetext
            Else
                MsgBox ("GAGAL TERHUBUNG KE SERVER")
                Sheet3.Range("R9").Value = objHTTP.responsetext
            End If
        End If
    
End Sub



Sub kirimkunci()

Set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")
    URL = Range("D1").Value & "wp-content/themes/unbk/api-18575621/kunci.php"
    
    s = _
        "kode=" & Range("D2").Value & _
        "&key=" & Range("G3").Value & _
        "&first=1"
        's = s & "&XDEBUG_SESSION_START=VBA"
    
    x = post(URL, s)
    
    'Range("C52").Value = x

    
    i = 3
    j = 1
    s = ""
    While Sheet3.Cells(i, 10) <> ""
        s = s & _
            "&kode[]=" & Range("D2").Value & _
            "&kodesoal[]=" & Range("D2").Value & _
            "&no[]=" & Range("J" & i).Value & _
            "&kunci[]=" & Range("K" & i).Value & _
            "&bobot[]=" & Range("L" & i).Value & _
            "&key=" & Range("G3").Value & _
            "&grouping[]=" & Range("M" & i).Value & _
            "&locking[]=" & Range("N" & i).Value & _
            "&kd[]=" & Range("O" & i).Value & _
            "&namakd[]=" & Range("C" & i + 13).Value & _
            ""
            
        If Range("D" & i + 13).Value <> "" Then
            s = s & "&alokasikd[]=" & Range("D" & i + 13).Value
        End If
        s = s & "&XDEBUG_SESSION_START=VBA"
        i = i + 1
        j = j + 1
    Wend
    x = post(URL, s)
End Sub





Sub kirimoptions()

    kirimoptionsnew
    kirimkunci

End Sub

Sub test()
    Sheet2.Range("B3").Value = "asdasdd"
End Sub





Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet8"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 100352 bytes
SHA-256: a64a8da9f6902ff8de12b29cd5a696c6bbb2301baa64b691ab6a7de40abeb77a

Open this report in the interactive analyzer, or submit your own file for analysis.