VBE7.DLL

  • File Path: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
  • Description: Visual Basic Design Time Environment
  • Comments: March 16, 2020

Hashes

Type Hash
MD5 E44D64F58DBA1EBAEBCF9FBE54488EC1
SHA1 4DFD31A98FE028C492A6B025089C4DF29AF63014
SHA256 BD93FA07D9220DA03CB1C2E2405ED4AFF356D4EF8E29654098B9B0EE4E95129E
SHA384 1D612DA6ED44DC525FC58B030F0146B6621A63B20A00C99DD7FBB819C9D62F27BD2FBB5C816F1D744222F19C8A45CBF3
SHA512 45B85F80D180EADCF3C6E5C88B61C8D79195D16F73FEB8FB4A7E2E26CDD62C6D61FC279587FDD250EC330B4BB794BA74FE2AD80819A0D607E2EB1174CC6A9531
SSDEEP 49152:9idLP72VmrHxD20IIbyNaQqKsete8plCgKIT6H6cSPUDM3BS9WIFp:cdLPM8HxD20IQycKFtekUHHSPSM3BkJD
IMP 30FB58E9F3E5C1A6A906D83EC668F787
PESHA1 74360082D118E18DFD6307C76B0C2CA2D4523AD8
PE256 2177515E8B31A5DB86B2A05624742D04BDD71C4EBAC2648618DADFF9EF57D84F

DLL Exports:

Function Name Ordinal Type
rtcOctVarFromVar 575 Exported Function
rtcOctBstrFromVar 574 Exported Function
rtcNPV 684 Exported Function
rtcPartition 664 Exported Function
rtcPackTime 539 Exported Function
rtcPackDate 538 Exported Function
rtcNPer 679 Exported Function
rtcMidVar 629 Exported Function
rtcMidCharVar 632 Exported Function
rtcMidCharBstr 631 Exported Function
rtcMsgBox 595 Exported Function
rtcMonthName 707 Exported Function
rtcMIRR 683 Exported Function
rtcReplace 712 Exported Function
rtcRemoveDir 532 Exported Function
rtcRate 680 Exported Function
rtcRightCharBstr 618 Exported Function
rtcRightBstr 514 Exported Function
rtcRgb 588 Exported Function
rtcRandomNext 593 Exported Function
rtcPV 677 Exported Function
rtcPPMT 675 Exported Function
rtcPMT 676 Exported Function
rtcRandomize 594 Exported Function
rtcR8ValFromBstr 581 Exported Function
rtcQBColor 589 Exported Function
rtcMidBstr 628 Exported Function
rtcIsNumeric 561 Exported Function
rtcIsNull 560 Exported Function
rtcIsMissing 592 Exported Function
rtcKillFiles 529 Exported Function
rtcJoin 710 Exported Function
rtcIsObject 562 Exported Function
rtcIsError 559 Exported Function
rtcIRR 682 Exported Function
rtcIPMT 674 Exported Function
rtcIntVar 657 Exported Function
rtcIsEmpty 558 Exported Function
rtcIsDate 557 Exported Function
rtcIsArray 556 Exported Function
rtcLowerCaseBstr 517 Exported Function
rtcLog 587 Exported Function
rtcLenVar 654 Exported Function
rtcMakeDir 531 Exported Function
rtcMacId 590 Exported Function
rtcLowerCaseVar 518 Exported Function
rtcLenCharVar 653 Exported Function
rtcLeftCharVar 617 Exported Function
rtcLeftCharBstr 616 Exported Function
rtcLeftBstr 512 Exported Function
rtcLeftVar 513 Exported Function
rtcLeftTrimVar 522 Exported Function
rtcLeftTrimBstr 521 Exported Function
rtcRightCharVar 619 Exported Function
rtcVarBstrFromByte 695 Exported Function
rtcVarBstrFromAnsi 608 Exported Function
rtcUpperCaseVar 528 Exported Function
rtcVarFromError 652 Exported Function
rtcVarDateFromVar 687 Exported Function
rtcVarBstrFromChar 698 Exported Function
rtcUpperCaseBstr 527 Exported Function
rtcTan 584 Exported Function
rtcSYD 672 Exported Function
rtcSwitch 668 Exported Function
rtcTypeName 591 Exported Function
rtcTrimVar 520 Exported Function
rtcTrimBstr 519 Exported Function
rtR4FromErrVar 639 Exported Function
rtI4FromErrVar 638 Exported Function
rtI2FromErrVar 637 Exported Function
VarPtr 644 Exported Function
rtUI1FromErrVar 686 Exported Function
rtR8FromErrVar 640 Exported Function
rtDecFromVar 564 Exported Function
rtcVarStrFromVar 613 Exported Function
rtcVarFromVar 642 Exported Function
rtcVarFromFormatVar 660 Exported Function
rtCyFromErrVar 636 Exported Function
rtcWeekdayName 706 Exported Function
rtcVarType 563 Exported Function
rtcStrReverse 713 Exported Function
rtcSetDateVar 548 Exported Function
rtcSetDateBstr 549 Exported Function
rtcSetDatabaseLcid 688 Exported Function
rtcSetTimeVar 550 Exported Function
rtcSetTimeBstr 551 Exported Function
rtcSetFileAttr 580 Exported Function
rtcSetCurrentCalendar 699 Exported Function
rtcRightVar 515 Exported Function
rtcRightTrimVar 524 Exported Function
rtcRightTrimBstr 523 Exported Function
rtcSendKeys 599 Exported Function
rtcSaveSetting 690 Exported Function
rtcRound 714 Exported Function
rtcStrConvVar2 717 Exported Function
rtcStrConvVar 622 Exported Function
rtcSqr 614 Exported Function
rtcStringVar 607 Exported Function
rtcStringBstr 606 Exported Function
rtcStrFromVar 536 Exported Function
rtcSplit 711 Exported Function
rtcSin 582 Exported Function
rtcShell 600 Exported Function
rtcSgnVar 658 Exported Function
rtcSpaceVar 526 Exported Function
rtcSpaceBstr 525 Exported Function
rtcSLN 671 Exported Function
rtcInStrRev 709 Exported Function
rtcCommandVar 670 Exported Function
rtcCommandBstr 669 Exported Function
rtcChoose 665 Exported Function
rtcCreateObject 625 Exported Function
rtcCos 583 Exported Function
rtcCompareBstr 649 Exported Function
rtcCharValueBstr 696 Exported Function
rtcByteValueBstr 693 Exported Function
rtcBstrFromFormatVar 650 Exported Function
rtcBstrFromError 651 Exported Function
rtcChangeDrive 533 Exported Function
rtcChangeDir 530 Exported Function
rtcCallByName 715 Exported Function
rtcDeleteSetting 691 Exported Function
rtcDDB 673 Exported Function
rtcDatePart 663 Exported Function
rtcEndOfFile 571 Exported Function
rtcDoEvents 598 Exported Function
rtcDir 645 Exported Function
rtcDateFromVar 641 Exported Function
rtcCurrentDirBstr 646 Exported Function
rtcCurrentDir 647 Exported Function
rtcCreateObject2 716 Exported Function
rtcDateDiff 662 Exported Function
rtcDateAdd 661 Exported Function
rtcCVErrFromVar 643 Exported Function
rtcBstrFromChar 697 Exported Function
DllVbeGetHashOfCode 720 Exported Function
DllVbeGetAntiVirusHashOfCodeStorage 719 Exported Function
DllVbaInitHostAddins 718 Exported Function
DllVbeInit 723 Exported Function
DllVbeGetHashOfCodeStorageEx 722 Exported Function
DllVbeGetHashOfCodeProjectEx 721 Exported Function
DllUnregisterServer 701 Exported Function
DllGetClassObject 604 Exported Function
DllCanUnloadNow 603 Exported Function
_GetLongPathNameA@12 726 Exported Function
DllRegisterServerEx 659 Exported Function
DllRegisterServer 623 Exported Function
DLLGetDocumentation 602 Exported Function
rtcAtn 585 Exported Function
rtcArray 601 Exported Function
rtcAppleScript 627 Exported Function
rtcBstrFromByte 694 Exported Function
rtcBstrFromAnsi 537 Exported Function
rtcBeep 534 Exported Function
rtcAppActivate 597 Exported Function
rtBoolFromErrVar 635 Exported Function
DllVbeTerm 725 Exported Function
DllVbeSetMsiApis 724 Exported Function
rtcAnsiValueBstr 516 Exported Function
rtcAbsVar 656 Exported Function
rtBstrFromErrVar 634 Exported Function
rtcEnvironBstr 667 Exported Function
rtcGetSetting 689 Exported Function
rtcGetSecondOfMinute 547 Exported Function
rtcGetPresentDate 546 Exported Function
rtcGetTimeValue 541 Exported Function
rtcGetTimer 535 Exported Function
rtcGetTimeBstr 611 Exported Function
rtcGetObject 626 Exported Function
rtcGetHostLCID 624 Exported Function
rtcGetFileAttr 579 Exported Function
rtcGetErl 605 Exported Function
rtcGetMonthOfYear 545 Exported Function
rtcGetMinuteOfHour 544 Exported Function
rtcGetHourOfDay 543 Exported Function
rtcInputCount 566 Exported Function
rtcInputCharCountVar 621 Exported Function
rtcInputCharCount 620 Exported Function
rtcInStrChar 633 Exported Function
rtcInStr 630 Exported Function
rtcInputCountVar 567 Exported Function
rtcInputBox 596 Exported Function
rtcHexBstrFromVar 572 Exported Function
rtcGetYear 553 Exported Function
rtcGetTimeVar 612 Exported Function
rtcImmediateIf 681 Exported Function
rtcIMEStatus 615 Exported Function
rtcHexVarFromVar 573 Exported Function
rtcGetDayOfWeek 552 Exported Function
rtcFileReset 554 Exported Function
rtcFileLocation 569 Exported Function
rtcFileLength 570 Exported Function
rtcFilter 708 Exported Function
rtcFileWidth 565 Exported Function
rtcFileSeek 568 Exported Function
rtcFileLen 578 Exported Function
rtcExp 586 Exported Function
rtcErrObj 685 Exported Function
rtcEnvironVar 666 Exported Function
rtcFileDateTime 577 Exported Function
rtcFileCopy 576 Exported Function
rtcFileAttributes 555 Exported Function
rtcGetDateBstr 609 Exported Function
rtcGetCurrentCalendar 700 Exported Function
rtcGetAllSettings 692 Exported Function
rtcGetDayOfMonth 542 Exported Function
rtcGetDateVar 610 Exported Function
rtcGetDateValue 540 Exported Function
rtcFV 678 Exported Function
rtcFormatDateTime 705 Exported Function
rtcFormatCurrency 703 Exported Function
rtcFixVar 655 Exported Function
rtcFreeFile 648 Exported Function
rtcFormatPercent 704 Exported Function
rtcFormatNumber 702 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 33000001529B409F5056997588000000000152
  • Thumbprint: 711AF71DC4C4952C8ED65BB4BA06826ED3922A32
  • Issuer: CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename:
  • Product Name: Visual Basic Environment
  • Company Name: Microsoft Corporation
  • File Version: 7.01.1096
  • Product Version: 7.01.1096
  • Language: Language Neutral
  • Legal Copyright: 2012 Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/bd93fa07d9220da03cb1c2e2405ed4aff356d4ef8e29654098b9b0ee4e95129e/detection/

Possible Misuse

The following table contains possible examples of VBE7.DLL being misused. While VBE7.DLL is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma image_load_susp_winword_vbadll_load.yml - '\VBE7.DLL' DRL 1.0
sigma net_connection_win_malware_backconnect_ports.yml definition: 'Use the following config to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>' DRL 1.0
sigma proc_access_win_malware_verclsid_shellcode.yml definition: 'Use the following config to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>' DRL 1.0
sigma proc_access_win_malware_verclsid_shellcode.yml - 'VBE7.DLL' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.