Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f5b6f401eff5a8ff…

MALICIOUS

Office (OOXML)

1.46 MB Created: 2012-11-22 00:41:41 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2021-07-07
MD5: 94a81be0e8e74bf3beb460ae833d3d48 SHA-1: 076fa7a4e8c71f1afa18b4a0d9fe972f06ac6780 SHA-256: f5b6f401eff5a8ff025628caa8daa5e9f65befcbe42d4cc987a36defda28b855
348 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an Excel document containing VBA macros that utilize WScript.Shell and the Shell() function, indicating an attempt to execute arbitrary commands. The presence of an Equation Editor OLE object and the ClamAV detection as 'Doc.Dropper.Valyria-6680532-0' strongly suggest this file is a dropper designed to download and execute a secondary payload. The VBA code's use of WScript.Shell and Shell() directly supports the execution of commands, likely for payload retrieval and execution.

Heuristics 8

  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject8.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • ClamAV: Doc.Dropper.Valyria-6680532-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680532-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
          On Error Resume Next
      Set myWS = CreateObject("WScript.Shell")
      RegKeyRead = myWS.RegRead(i_RegKey)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
          On Error Resume Next
      Set myWS = CreateObject("WScript.Shell")
      RegKeyRead = myWS.RegRead(i_RegKey)
  • External relationship high OOXML_EXTERNAL_REL
    External target in xl/externalLinks/_rels/externalLink1.xml.rels: file:///G:\Users\nhuon_000\Desktop\Demo_PL03a.xls
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 86 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction

Extracted artifacts 22

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 175812 bytes
SHA-256: 018bdafd05b9b46af3723eae24a869428044497dbf2c49cc2804fe8150aa7d75
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Activate()
    On Error Resume Next
    If Kiemtra_WbOpen("DTBN.xla") = True Then
        If Application.Version > 10 Then
            Run "DTBN.xla!UpdateRibbon_Database"
        End If
    End If
End Sub

Private Sub Workbook_SheetActivate(ByVal sh As Object)
  On Error Resume Next
  AppActivate Sheets("Setting").Range("H1").Value
End Sub


Attribute VB_Name = "Sh_Dutoan"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP9(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If KTS9("Setting") = True Then Sheets("Setting").Range("G2").Value = Sh_Dutoan.Name
  End If
End Sub
Function KTS9(NameSh As String) As Boolean
  On Error Resume Next
  KTS9 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP9(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP9 = True Else KT_WbOP9 = False
End Function
'
Private Sub Worksheet_SelectionChange(ByVal Target As Range)
    If Target.Rows.Count = 1 And Target.Columns.Count = 1 Then
        Sheets("Config").Range("D19").FormulaR1C1 = Target.FormulaR1C1
    End If
End Sub

Attribute VB_Name = "Sh_PTVT"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP16(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
Run ("Reset_RightClick")
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
If KTS16("Setting") = True Then Sheets("Setting").Range("G3").Value = Sh_PTVT.Name
End If
End Sub
Function KTS16(NameSh As String) As Boolean
  On Error Resume Next
  KTS16 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP16(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP16 = True Else KT_WbOP16 = False
End Function
Private Sub Worksheet_SelectionChange(ByVal Target As Range)
    If Target.Rows.Count = 1 And Target.Columns.Count = 1 Then
        Sheets("Config").Range("D19").FormulaR1C1 = Target.FormulaR1C1
    End If
End Sub



Attribute VB_Name = "Sh_GTVT"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP11(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
    On Error Resume Next
  Run ("Reset_RightClick")
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If UCase(Sh_GTVT.Name) = "GVT" Then Sh_GTVT.Name = "Gia tri vat tu"
  If KTS11("Setting") = True Then Sheets("Setting").Range("G4").Value = Sh_GTVT.Name
End If
End Sub
Function KTS11(NameSh As String) As Boolean
  On Error Resume Next
  KTS11 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP11(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP11 = True Else KT_WbOP11 = False
End Function

Private Sub Worksheet_SelectionChange(ByVal Target As Range)
    If Target.Rows.Count = 1 And Target.Columns.Count = 1 Then
        Sheets("Config").Range("D19").FormulaR1C1 = Target.FormulaR1C1
    End If
End Sub


Attribute VB_Name = "Sh_DGCT"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP7(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If KTS7("Setting") = True Then Sheets("Setting").Range("G5").Value = Sh_DGCT.Name
  End If
End Sub
Function KTS7(NameSh As String) As Boolean
  On Error Resume Next
  KTS7 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP7(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP7 = True Else KT_WbOP7 = False
End Function



Attribute VB_Name = "Sh_Duthau"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP8(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
If KTS8("Setting") = True Then Sheets("Setting").Range("G6").Value = Sh_Duthau.Name
End If
End Sub
Function KTS8(NameSh As String) As Boolean
  On Error Resume Next
  KTS8 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP8(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP8 = True Else KT_WbOP8 = False
End Function


Attribute VB_Name = "Sh_THKP"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_Activate()
On Error Resume Next
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\Option\THKP\Auto_CPC") <> "1" Then Exit Sub
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\Option\ND32_2015") <> "1" Then Exit Sub
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\ThongtinCT\nsCPC") <> 1 Then Exit Sub
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\ThongtinCT\CPCTinhtheo") <> 1 Then Exit Sub
Dim rg As Long, rNoiSuy As Long, rSTT As Long
rg = EvalFind("G", ActiveSheet.Range("B:B")).Row
rNoiSuy = EvalFind("GNoisuy", Range("B:B")).Row
rSTT = EvalFind("STT", Range("A:A")).Row
If rNoiSuy = 0 Then Exit Sub
If rg = 0 Then Exit Sub
If rSTT = 0 Then Exit Sub
Dim soHM As Long, iHm As Long
soHM = WorksheetFunction.CountA(Range(Cells(rSTT, 6), Cells(rSTT, 256)))
If soHM >= 2 Then soHM = soHM - 1
Dim coTB As Boolean
Application.ScreenUpdating = False
'Application.Calculation = xlCalculationManual
For iHm = 1 To soHM
    If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\Option\DGCT\CPC_HM") = "1" Then
        'Tinh theo tong hang muc
        If soHM = 1 Then soHM = 0
        If Range("E" & rNoiSuy).Offset(0, iHm).Value <> Range("E" & rg).Offset(0, soHM + 1).Value Then
            Application.Iteration = True
            Application.Calculation = xlCalculationAutomatic
            Range("E" & rNoiSuy).Offset(0, iHm).Value = Range("E" & rg).Offset(0, soHM + 1).Value
            Range("E" & rNoiSuy).Offset(0, iHm).Value = Range("E" & rg).Offset(0, soHM + 1).Value
            Application.Iteration = False
            coTB = True
            Exit For
        End If
    Else
        'Tinh theo tung hang muc
        If Range("E" & rNoiSuy).Offset(0, iHm).Value <> Range("E" & rg).Offset(0, iHm).Value Then
            Application.Iteration = True
            Application.Calculation = xlCalculationAutomatic
            Range("E" & rNoiSuy).Offset(0, iHm).Value = Range("E" & rg).Offset(0, iHm).Value
            Range("E" & rNoiSuy).Offset(0, iHm).Value = Range("E" & rg).Offset(0, iHm).Value
            Application.Iteration = False
            coTB = True
            Exit For
            coTB = True
            Exit For
        End If
    End If
Next
If coTB = True Then
    Application.Assistant.DoAlert UniConvert("Du75 toa1n BNSC", "VNI"), UniConvert("Ba3ng To63ng ho75p kinh phi1 d9a4 d9u7o75c ca65p nha65t d9i5nh mu71c ty3 le65 chi phi1 chung", "VNI"), msoAlertButtonOK, msoAlertIconInfo, 0, 0, 0
End If
Application.ScreenUpdating = True
'Application.Calculation = xlCalculationAutomatic
End Sub

Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP20(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If KTS20("Setting") = True Then Sheets("Setting").Range("G7").Value = Sh_THKP.Name
  End If
End Sub
Function KTS20(NameSh As String) As Boolean
  On Error Resume Next
  KTS20 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP20(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP20 = True Else KT_WbOP20 = False
End Function


Attribute VB_Name = "Sh_THCPXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Worksheet_Activate()
    On Error Resume Next
    Run ("Reset_RightClick")
    If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
    If KTS19("Setting") = True Then Sheets("Setting").Range("G17").Value = Sh_THCPXD.Name
    End If
End Sub

Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP19(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Function KTS19(NameSh As String) As Boolean
  On Error Resume Next
  KTS19 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP19(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP19 = True Else KT_WbOP19 = False
End Function

Private Sub Worksheet_Deactivate()
    On Error Resume Next
    Run ("Reset_RightClick")
    If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
    If KTS19("Setting") = True Then Sheets("Setting").Range("G17").Value = Sh_THCPXD.Name
    End If
End Sub

Attribute VB_Name = "Sh_THCPTB"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_Activate()
    On Error Resume Next
    If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
    If KTS18("Setting") = True Then Sheets("Setting").Range("G18").Value = Sh_THCPTB.Name
    End If
End Sub
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP18(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Function KTS18(NameSh As String) As Boolean
  On Error Resume Next
  KTS18 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP18(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP18 = True Else KT_WbOP18 = False
End Function


Attribute VB_Name = "Sh_SBTMDT"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP6(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
Run ("Reset_RightClick")
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
If KTS6("Setting") = True Then Sheets("Setting").Range("G42").Value = Sh_SBTMDT.Name
End If
End Sub
Function KTS6(NameSh As String) As Boolean
  On Error Resume Next
  KTS6 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP6(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP6 = True Else KT_WbOP6 = False
End Function



Attribute VB_Name = "Sh_Bia"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Worksheet_Deactivate()
On Error Resume Next
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
    If KTS2("Setting") = True Then Sheets("Setting").Range("G20").Value = Sh_Bia.Name
End If
End Sub

Function KTS2(NameSh As String) As Boolean
  On Error Resume Next
  KTS2 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function

Attribute VB_Name = "Sh_ConfigBN"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Attribute VB_Name = "Sh_CPVC"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP4(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
    If KTS4("Setting") = True Then Sheets("Setting").Range("G8").Value = Sh_CPVC.Name
End If
End Sub
Function KTS4(NameSh As String) As Boolean
  On Error Resume Next
  KTS4 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP4(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP4 = True Else KT_WbOP4 = False
End Function






Attribute VB_Name = "Sh_CVC"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP6(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
Run ("Reset_RightClick")
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
If KTS6("Setting") = True Then Sheets("Setting").Range("G9").Value = Sh_CVC.Name
End If
End Sub
Function KTS6(NameSh As String) As Boolean
  On Error Resume Next
  KTS6 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP6(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP6 = True Else KT_WbOP6 = False
End Function


Attribute VB_Name = "Sh_LCNXD"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP13(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If KTS13("Setting") = True Then Sheets("Setting").Range("G10").Value = Sh_LCNXD.Name
  End If
End Sub
Function KTS13(NameSh As String) As Boolean
  On Error Resume Next
  KTS13 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP13(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP13 = True Else KT_WbOP13 = False
End Function



Attribute VB_Name = "Sh_PTCM"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP15(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If KTS15("Setting") = True Then Sheets("Setting").Range("G11").Value = Sh_PTCM.Name
  End If
End Sub
Function KTS15(NameSh As String) As Boolean
  On Error Resume Next
  KTS15 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP15(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP15 = True Else KT_WbOP15 = False
End Function



Attribute VB_Name = "Sh_LCNLM"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP12(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If KTS12("Setting") = True Then Sheets("Setting").Range("G12").Value = Sh_LCNLM.Name
  End If
End Sub
Function KTS12(NameSh As String) As Boolean
  On Error Resume Next
  KTS12 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP12(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP12 = True Else KT_WbOP12 = False
End Function




Attribute VB_Name = "Sh_CTDGM"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP5(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If KTS5("Setting") = True Then Sheets("Setting").Range("G13").Value = Sh_CTDGM.Name
  End If
End Sub
Function KTS5(NameSh As String) As Boolean
  On Error Resume Next
  KTS5 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP5(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP5 = True Else KT_WbOP5 = False
End Function



Attribute VB_Name = "Sh_BGM"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP1(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
  If KTS1("Setting") = True Then
    Sheets("Setting").Range("G14").Value = Sh_BGM.Name
  End If
  End If
End Sub

Function KTS1(NameSh As String) As Boolean
  On Error Resume Next
  KTS1 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP1(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP1 = True Else KT_WbOP1 = False
End Function

Attribute VB_Name = "Sh_BuNL_TL"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP3(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Private Sub Worksheet_Deactivate()
On Error Resume Next
  Run ("Reset_RightClick")
  If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
If KTS3("Setting") = True Then Sheets("Setting").Range("G15").Value = Sh_BuNL_TL.Name
End If
End Sub
Function KTS3(NameSh As String) As Boolean
  On Error Resume Next
  KTS3 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP3(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP3 = True Else KT_WbOP3 = False
End Function


Attribute VB_Name = "sh_LuongCN"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sh_DVCM"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Private Sub Worksheet_Deactivate()
On Error Resume Next
Run ("Reset_RightClick")
If RegKeyRead("HKEY_CURRENT_USER\Software\BacNamSoft\Dutoan\AutoRename") = "1" Then
If KTS10("Setting") = True Then Sheets("Setting").Range("G16").Value = Sh_DVCM.Name
End If
End Sub
Private Sub Worksheet_BeforeRightClick(ByVal Target As Range, Cancel As Boolean)
On Error Resume Next
If KT_WbOP10(NameDT) = True Then
    Add_RightClickSheet ActiveSheet
    Run ("Reset_RightClick"): Run (NameDT & "!LoadPopup")
Else
    Run ("Reset_RightClick")
End If
End Sub
Function KTS10(NameSh As String) As Boolean
  On Error Resume Next
  KTS10 = CBool(Len(Worksheets(NameSh).Name) > 0)
End Function
Function KT_WbOP10(WBName As String) As Boolean
    Dim WB As Workbook
    On Error Resume Next
    Set WB = Workbooks(WBName)
    If Err = 0 Then KT_WbOP10 = True Else KT_WbOP10 = False
End Function


Attribute VB_Name = "Sh_Setting"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True



Attribute VB_Name = "Mod_Main"
Option Private Module
Public Const NameDT = "DTBN.xla"
Sub Reset_RightClick()
  Application.CommandBars("Cell").Reset
End Sub
Sub Add_MacroDescription()
    Dim i As Long
    With ThisWorkbook.Sheets("Setting")
        For i = 2 To .Range("B65536").End(xlUp).Row
            If .Range("B" & i) <> "" Then
                Application.MacroOptions .Range("B" & i).Value, .Range("C" & i).Value, Category:="Dutoan"
            End If
        Next
    End With
End Sub
Function EvalFind(What, Where As Range) As Range
  Dim i&, q$
  If VarType(What) = vbString Then q = """"
  On Error Resume Next
  i = Evaluate("MATCH(" & q & What & q & "," & Where.Address(External:=True) & ",0)")
  If i > 0 Then Set EvalFind = Where(i)
End Function
Sub RenameSh()
    On Error Resume Next
    With Sheets("Setting")
        .Range("G2").Value = Sh_Dutoan.Name
        .Range("G3").Value = Sh_PTVT.Name
        .Range("G4").Value = Sh_GTVT.Name
        .Range("G5").Value = Sh_DGCT.Name
        .Range("G6").Value = Sh_Duthau.Name
        .Range("G7").Value = Sh_THKP.Name
        .Range("G8").Value = Sh_CPVC.Name
        .Range("G9").Value = Sh_CVC.Name
        .Range("G10").Value = Sh_LCNXD.Name
        .Range("G11").Value = Sh_PTCM.Name
        .Range("G12").Value = Sh_LCNLM.Name
        .Range("G13").Value = Sh_CTDGM.Name
        .Range("G14").Value = Sh_BGM.Name
        .Range("G15").Value = Sh_BuNL_TL.Name
        .Range("G16").Value = Sh_DVCM.Name
        .Range("G17").Value = Sh_THCPXD.Name
        .Range("G18").Value = Sh_THCPTB.Name
        .Range("G19").Value = Sh_TDT.Name
        .Range("G20").Value = Sh_Bia.Name
        .Range("G21").Value = Sh_ConfigBN.Name
    End With
End Sub
Function GetNameSh(sh As Worksheet) As String
If DemKytu(sh.Name, " ") > 0 Then
    GetNameSh = "'" & sh.Name & "'"
Else
    GetNameSh = sh.Name
End If
End Function

Function DemKytu(Chuoi As String, Kytu As String) As Long
    DemKytu = Len(Chuoi) - Len(Replace(Chuoi, Kytu, ""))
End Function
Sub ShowALL()
    Dim i As Long
    For i = 1 To Worksheets.Count
        Sheets(i).Visible = xlSheetVisible
    Next
End Sub


Attribute VB_Name = "Mod_Support"
Option Private Module
Function UniConvert(Text As String, InputMethod As String) As String
  Dim VNI_Type, Telex_Type, CharCode, Temp, i As Long
  UniConvert = Text
  VNI_Type = Array("a81", "a82", "a83", "a84", "a85", "a61", "a62", "a63", "a64", "a65", "e61", _
      "e62", "e63", "e64", "e65", "o61", "o62", "o63", "o64", "o65", "o71", "o72", "o73", "o74", _
      "o75", "u71", "u72", "u73", "u74", "u75", "a1", "a2", "a3", "a4", "a5", "a8", "a6", "d9", _
      "e1", "e2", "e3", "e4", "e5", "e6", "i1", "i2", "i3", "i4", "i5", "o1", "o2", "o3", "o4", _
      "o5", "o6", "o7", "u1", "u2", "u3", "u4", "u5", "u7", "y1", "y2", "y3", "y4", "y5")
  Telex_Type = Array("aws", "awf", "awr", "awx", "awj", "aas", "aaf", "aar", "aax", "aaj", "ees", _
      "eef", "eer", "eex", "eej", "oos", "oof", "oor", "oox", "ooj", "ows", "owf", "owr", "owx", _
      "owj", "uws", "uwf", "uwr", "uwx", "uwj", "as", "af", "ar", "ax", "aj", "aw", "aa", "dd", _
      "es", "ef", "er", "ex", "ej", "ee", "is", "if", "ir", "ix", "ij", "os", "of", "or", "ox", _
      "oj", "oo", "ow", "us", "uf", "ur", "ux", "uj", "uw", "ys", "yf", "yr", "yx", "yj")
  CharCode = Array(ChrW(7855), ChrW(7857), ChrW(7859), ChrW(7861), ChrW(7863), ChrW(7845), ChrW(7847), _
      ChrW(7849), ChrW(7851), ChrW(7853), ChrW(7871), ChrW(7873), ChrW(7875), ChrW(7877), ChrW(7879), _
      ChrW(7889), ChrW(7891), ChrW(7893), ChrW(7895), ChrW(7897), ChrW(7899), ChrW(7901), ChrW(7903), _
      ChrW(7905), ChrW(7907), ChrW(7913), ChrW(7915), ChrW(7917), ChrW(7919), ChrW(7921), ChrW(225), _
      ChrW(224), ChrW(7843), ChrW(227), ChrW(7841), ChrW(259), ChrW(226), ChrW(273), ChrW(233), ChrW(232), _
      ChrW(7867), ChrW(7869), ChrW(7865), ChrW(234), ChrW(237), ChrW(236), ChrW(7881), ChrW(297), ChrW(7883), _
      ChrW(243), ChrW(242), ChrW(7887), ChrW(245), ChrW(7885), ChrW(244), ChrW(417), ChrW(250), ChrW(249), _
      ChrW(7911), ChrW(361), ChrW(7909), ChrW(432), ChrW(253), ChrW(7923), ChrW(7927), ChrW(7929), ChrW(7925))
  Select Case InputMethod
    Case Is = "VNI": Temp = VNI_Type
    Case Is = "Telex": Temp = Telex_Type
  End Select
  For i = 0 To UBound(CharCode)
    UniConvert = Replace(UniConvert, Temp(i), CharCode(i))
    UniConvert = Replace(UniConvert, UCase(Temp(i)), UCase(CharCode(i)))
  Next i
End Function
Function Kiemtra_Duongdan(FileName) As Boolean ' Ham tra ve true neu co duong dan, false neu khong:
Dim X As String
On Error Resume Next
X = GetAttr(FileName) And 0
If Err = 0 Then Kiemtra_Duongdan = True Else Kiemtra_Duongdan = False
End Function
Function GetValue(StrVal) As Double
    GetValue = Val(Trim(Replace(StrVal, "<", "", 1, -1, vbTextCompare)))
    GetValue = Val(Trim(Replace(GetValue, ">", "", 1, -1, vbTextCompare)))
    GetValue = Val(Trim(Replace(GetValue, "<=", "", 1, -1, vbTextCompare)))
    GetValue = Val(Trim(Replace(GetValue, ">=", "", 1, -1, vbTextCompare)))
End Function

Function MucToithieu(VungNoisuy As String)
    'On Error GoTo 0
    Dim Rng As Range
    Set Rng = Sh_ConfigBN.Range(VungNoisuy)
    With Sh_ConfigBN
        MucToithieu = Rng.Cells(1, 1).Offset(-2, 0).Value
    End With
End Function

Function TK_Khac(DiachiNoiSuy As String, CPXD_Truocthue) As Double
On Error Resume Next
Dim LoaiCT
LoaiCT = ActiveWorkbook.Names("i_BTKKhac").RefersToRange.Value
If DiachiNoiSuy = "" Then
    TK_Khac = 0
Else
   TK_Khac = Round(Noisuy(DiachiNoiSuy, LoaiCT, CPXD_Truocthue / 10 ^ 9), 3)
End If
End Function

Function Noisuy(Dauvao As Variant, xX, yY) As Double
On Error Resume Next
Dim VungTra As Range, shVao As Worksheet
If Left(Dauvao, 1) = "$" Then
    Set VungTra = Sheets("Config").Range(Dauvao)
    Set shVao = Sheets("Config")
Else
    Set shVao = ActiveSheet
    Set VungTra = Dauvao
End If
    If VungTra.Cells(1, VungTra.Columns.Count) = 0 Then
        Dim cotOff As Long
        cotOff = VungTra.Cells(1, VungTra.Columns.Count).End(xlToLeft).Column - VungTra.Cells(0, 0).Column
        Set VungTra = Range(VungTra.Cells(1, 1), VungTra.Cells(VungTra.Rows.Count, cotOff))
    End If
  'Ham Noi Suy 2 Chieu Tai GPE.COM (Sa_DQ)'
   Dim iW As Integer, jI As Integer
    Dim x1 As Double, x2 As Double, y1 As Double, y2 As Double
    Dim a11 As Double, a12 As Double, a21 As Double, a22 As Double
    Dim t1 As Double, t2 As Double

    Dim RgNg As Range, RgDoc As Range
    Dim Rng As Range, Clls As Range
    Set RgNg = VungTra.Cells(1, 1).Resize(1, VungTra.Columns.Count - 1)
    Set RgDoc = VungTra.Cells(1, 1).Resize(VungTra.Rows.Count, 1)
    Dim dd
    Dim xa As Double, xb As Double, xMax As Double, XMin As Double, ya As Double, yb As Double, YMax As Double, YMin As Double
    ya = RgNg.Cells(1, 2).Value
    yb = RgNg.Cells(1, 3).Value
    If yb = 0 Then
        tangy = 1
    Else
        If yb > ya Then tangy = 1 Else tangy = 2
    End If
    If tangy = 1 Then
        YMax = RgNg.Cells(1, VungTra.Columns.Count)
        YMin = ya
…
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject8.bin 2560 bytes
SHA-256: 34e33bbe35827fef1bc54501bbe3211746c16a14b10e816e89b2715edc0fa4b0
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject13.bin 2560 bytes
SHA-256: 2f1531ba4ad98fc2cde44026ffcc1ef2098eb54dbde3deb4bef0e06f9644737e
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 2560 bytes
SHA-256: 8bc1c1cb1dba67ab047a33de445a27ff10131f28e91aad1b8247bcd15b1dbaaa
ooxml_oleobject_03.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject6.bin 2560 bytes
SHA-256: f3fc8e6c4e245c5f4270c72ead0adb0ceb002f916a422ad01afc5807e22dc64d
ooxml_oleobject_04.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject10.bin 2560 bytes
SHA-256: 2ac69cac30340fbcde5fcd38aa78cf2a71aeaa96810a173679ac05ebb0f69b9e
ooxml_oleobject_05.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject12.bin 2560 bytes
SHA-256: 8a220fe4abc6568fced372139682716a291ff437f39d4455c28504385cecf738
ooxml_oleobject_06.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 2560 bytes
SHA-256: a276f771fcf449b8c0a21adeb8e669d4b04b64d289fc85c77077d4a53c0498e0
ooxml_oleobject_07.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 2560 bytes
SHA-256: 833c815a54cd9154498492688dfbdab6d02165d6474ce586aa95549a63746b37
ooxml_oleobject_08.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject7.bin 2560 bytes
SHA-256: d5775756e483654460b49c33e091e92745fde77589bad6d86e15a95c21f2d319
ooxml_oleobject_09.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject11.bin 2560 bytes
SHA-256: e50b03c2d207718ba35f82812dbf97f613d9e7f55edab7503630542cd30cefb1
ooxml_oleobject_10.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject4.bin 2560 bytes
SHA-256: 8ebe07c7b3bef4ab581b1e0d0c50b8ec6cd102de99902d1a577bcf493031ec8c
ooxml_oleobject_11.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject9.bin 2560 bytes
SHA-256: 40893112491003a1a741aff8f88d50cf32b7034d3f6c8541c31c6ad1c202e4fe
ooxml_oleobject_12.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject5.bin 2560 bytes
SHA-256: afbcfc259823712ce727a0f94f6e1fce178940a07944db684605bdd3ca576967
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 584192 bytes
SHA-256: 96fed88fbc8de14aa809dab5350e56b4abcf9befc10b38393742714286970a69
Detection
ClamAV: Doc.Dropper.Valyria-6680532-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image4.emf 7096 bytes
SHA-256: 69182921d9f14c9b33e775a6beb7fa23d7a3d25b26501a1cf628df122e71f9e6
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 7820 bytes
SHA-256: 1c1784a893aec2fb8313a3c8248913eeb851469476520f97b5478e919207ec80
emf_02.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 5544 bytes
SHA-256: 2914ee09a74313f3e70f2ba28d46c471b723c83a8a52ac5cd6e0dbc38677c0c1
emf_03.emf ooxml-emf OOXML EMF part: xl/media/image3.emf 4520 bytes
SHA-256: ae49119e21b1933adb3a6c5111b29fe1097efe131f721bd4acbdc5fcaa404ca7
emf_04.emf ooxml-emf OOXML EMF part: xl/media/image5.emf 5544 bytes
SHA-256: 7e77c9e5123ed3ae130129834d0be8377ebeca56b930161230f90c01418d51c7
emf_05.emf ooxml-emf OOXML EMF part: xl/media/image6.emf 4520 bytes
SHA-256: 61cd815b40eb8f7ed13c3d13bc03aea2abb5185c1cf987b155bb6fffe4117967
emf_06.emf ooxml-emf OOXML EMF part: xl/media/image7.emf 7096 bytes
SHA-256: 67024c7aa2f6382a9ccdf0fd3677d4fde3eff19bfbad7b93db5ec9b5249246c1

Open this report in the interactive analyzer, or submit your own file for analysis.