Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 02d02aff74b5d525…

MALICIOUS

Office (OLE)

232.0 KB Created: 2015-08-04 07:43:00 Authoring application: Microsoft Office Word First seen: 2015-09-16
MD5: 3ab30b2593ffca33e0f9bf2f7a2d1c40 SHA-1: ab1d7cfa92365981e7047f28ce65e5d3eb97bf58 SHA-256: 02d02aff74b5d5257f6dbdce7ddee8e342af29349b0fd9f03fe8808a50f7b4ff
230 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate or Obfuscate Malicious Code

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro executes a 'CreateObject' call, indicative of malicious intent. The ClamAV heuristic 'Doc.Dropper.Agent-5897011-0' strongly suggests this is a dropper. The VBA code appears to be designed to download and execute a second-stage payload, though the specific URL is obfuscated. The document body itself is a Romanian legal document, likely used as a lure.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-5897011-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-5897011-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            'awi.CodeModule.DeleteLines 1, awcl
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set fso = CreateObject("Scripting.FileSystemObject")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/officeDocument/2006/customXml In document text (OLE body)
    • http://schemas.microsoft.com/sharepoint/eventsIn document text (OLE body)
    • http://schemas.microsoft.com/office/2006/metadata/contentTypeIn document text (OLE body)
    • http://schemas.microsoft.com/office/2006/metadata/properties/metaAttributesIn document text (OLE body)
    • http://schemas.microsoft.com/office/2006/metadata/propertiesIn document text (OLE body)
    • http://www.w3.org/2001/XMLSchemaIn document text (OLE body)
    • http://schemas.microsoft.com/office/2006/documentManagement/typesIn document text (OLE body)
    • http://schemas.microsoft.com/office/infopath/2007/PartnerControlsIn document text (OLE body)
    • http://schemas.openxmlformats.org/package/2006/metadata/core-propertiesIn document text (OLE body)
    • http://www.w3.org/2001/XMLSchema-instanceIn document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://purl.org/dc/terms/In document text (OLE body)
    • http://schemas.microsoft.com/internal/obdIn document text (OLE body)
    • http://dublincore.org/schemas/xmls/qdc/2003/04/02/dc.xsdIn document text (OLE body)
    • http://dublincore.org/schemas/xmls/qdc/2003/04/02/dcterms.xsdIn document text (OLE body)
    • http://schemas.microsoft.com/sharepoint/v3/contenttype/formsIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32509 bytes
SHA-256: acf4131d403080066db8cfb6b4978c0a4df1dc6748ed1836d6d76f27f6629739
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
' version 4
' The above version number needs to be updated every time there is a change to any of the template code (any .txt file)
' in document_editare_afisare_doc.aspx: The server will compare this number to the one found in the .doc extracted from the db (if any), and inject the new code if the versions differ.
Private Sub Document_Open()

    If Val(Application.Version) >= 14 Then
        ' Office 2010 and newer
        Exit Sub
    End If

    On Error GoTo err_open_templateGen
    CommandBars("TemplateGen").Visible = False
    CommandBars("Operaţii").Visible = True
    Call Init
    Exit Sub
err_open_templateGen:
    On Error GoTo err_open
    CommandBars("Operaţii").Visible = True
    CommandBars("Operaţii").Protection = msoBarNoChangeVisible
    CommandBars("Standard").Visible = True
    CommandBars("Standard").RowIndex = msoBarRowFirst
    CommandBars("Standard").Left = 1
    CommandBars("Formatting").Visible = True
    CommandBars("Formatting").RowIndex = msoBarRowLast
    CommandBars("Formatting").Left = 1
    'CommandBars("Formatare").Visible = True
    'CommandBars("Formatare").RowIndex = msoBarRowLast
    'CommandBars("Formatare").Left = 1

err_open:
    Exit Sub

End Sub

Attribute VB_Name = "Module1"
Const Boundary As String = "---------------------------0123456789012"

Public id_document As Integer
Public srv_url As String
Function GetFile(FileName As String) As String
    Dim FileContents() As Byte, FileNumber As Integer
    ReDim FileContents(FileLen(FileName) - 1)
    FileNumber = FreeFile
    Open FileName For Binary Access Read As FileNumber
        Get FileNumber, , FileContents
    Close FileNumber
    GetFile = StrConv(FileContents, vbUnicode)
End Function

Sub Submit()
    Dim Str1 As String

    If ActiveDocument.Variables.Count > 0 Then
        Module1.srv_url = ActiveDocument.Variables(1).Value
    Else
        Str1 = ActiveDocument.FullName
    
    
        If Module1.id_document = Null Or Module1.id_document = 0 Then
            pos1 = InStr(1, Str1, "?id_document=")
            If pos1 > 0 Then
                pos1 = pos1 + Len("?id_document=")
                pos2 = InStr(pos1, Str1, "&id_sedinta=")
                If pos2 > 0 Then
                    id = Mid(Str1, pos1, pos2 - pos1)
                Else
                    MsgBox "Eroare la obtinerea identificatorului de document (1)!"
                    Exit Sub
                End If
            Else
                MsgBox "Eroare la obtinerea identificatorului de document (1)"
                Exit Sub
            End If
            Module1.id_document = CInt(id)
            pos1 = InStr(Str1, "document_editare_afisare_doc.asp")
            Module1.srv_url = Left(Str1, pos1 - 1)
            Module1.srv_url = Module1.srv_url + "document_upload.asp?id_document=" + CStr(id_document)
    
        End If
    End If
    
    Set fso = CreateObject("Scripting.FileSystemObject")

    Dim cale As String
    cale = fso.GetSpecialFolder(2) & "\_temp_" & Module1.id_document & ".doc" 'ActiveDocument.Name
    
    On Error GoTo a1
    If cale = ActiveDocument.FullName Then
        ActiveDocument.Save
        GoTo a2
    Else
        ActiveDocument.SaveAs cale
        GoTo a2
    End If
a1:
    ActiveDocument.SaveAs fso.GetSpecialFolder(2) & "\_temp_" & Module1.id_document & "_1.doc"
    
a2:
    Set folder = fso.GetFolder(fso.GetSpecialFolder(2))
    Set fisiere = folder.Files
    For Each fisier In fisiere
        Nume = fisier.Name
        pos = InStr(1, Nume, "_temp_")
        If pos = 1 And Nume <> ActiveDocument.Name Then
            On Error GoTo a3
            fso.DeleteFile fso.GetSpecialFolder(2) & "\" & Nume, True
a3:
        End If
    Next
    Set fso = Nothing
    Dim FormData As String, d As String
    FormData = GetFile(ActiveDocument.FullName)

    d = "--" + Boundary + vbCrLf
    'd = d + GetFields
    d = d + "Content-Disposition: form-data; name=""SaveAs"";"
    d = d + " filename=""" + ActiveDocument.Name + """" + vbCrLf
    d = d + "Content-Type: application/msword" + vbCrLf + vbCrLf
    d = d + FormData
    d = d + vbCrLf + "--" + Boundary + "--" + vbCrLf
    
    
    Dim bFormData() As Byte
    ReDim bFormData(Len(d) - 1)
    bFormData = StrConv(d, vbFromUnicode)

    
    Dim Flags As Long
    Dim TargetFrame As String
    
    Flags = 0
    TargetFrame = ""
    
    'Dim ie As InternetExplorer
    'Set ie = CreateObject("InternetExplorer.Application")
    If Val(Application.Version) >= 14 Then
        ' Office 2010 and newer
            Dim ShellApp
            Set ShellApp = CreateObject("Shell.Application")
            Dim ShellWindows
            Set ShellWindows = ShellApp.Windows()
            Dim i
            For i = 0 To ShellWindows.Count - 1
                If ShellWindows.Item(i) Is Nothing Then
                    GoTo nextWnd
                End If
                If InStr(ShellWindows.Item(i).FullName, "iexplore.exe") <> 0 Or InStr(ShellWindows.Item(i).FullName, "Internet Explorer") Then
                    Set ie = ShellWindows.Item(i)
                    If InStr(ie.LocationName, "[European Dynamics]") <> 0 Or _
                                                InStr(ie.LocationUrl, "/ecris_cdms/") <> 0 _
                                                        Then
                        Exit For
                    End If
                End If
nextWnd:
            Next
    Else
        Set ie = CreateObject("InternetExplorer.Application")
    End If
 
    ie.Navigate Module1.srv_url, , , bFormData, "Content-Type: multipart/form-data; boundary=" + Boundary + vbCrLf
    
    Do:  Loop Until ie.Busy = False
    Do:  Loop Until ie.Busy = False
    
    Dim response As String
    response = ie.Document.Body.InnerHTML
    
    If Val(Application.Version) >= 14 Then
                ie.GoBack
    Else
                ie.Visible = False
    End If
    
    Select Case response
    Case "1"
        MsgBox "Documentul a fost salvat in baza de date.", vbInformation
    Case "2"
        MsgBox "Specificati documentul.", vbCritical
    Case "3"
        MsgBox "Documentul nu a putut fi upload-at.", vbCritical
    Case "4"
        MsgBox "Nu exista documentul in baza de date.", vbCritical
    Case "5"
        MsgBox "Eroare la salvarea documentului in baza de date.", vbCritical
    Case "6"
        MsgBox "Eroare la salvarea documentului in format html in baza de date.", vbCritical
    Case Else
        MsgBox "O eroare la salvarea documentului in baza de date.", vbCritical
    End Select
    
    Set IEDoc = Nothing
    
    Set ie = Nothing
End Sub
'Handlers of dropdownlists
Sub FunctiePersonal_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 22 Then
            On Error GoTo err_22
            ActiveDocument.FormFields("functie_personal").result = c.Text
           Exit Sub
err_22:
            MsgBox "Câmpul 'Funcţie' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub
Sub SedintaData_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 21 Then
            On Error GoTo err_21
            ActiveDocument.FormFields("sedinta_data_lista").result = c.Text
           Exit Sub
err_21:
            MsgBox "Câmpul 'Data şedinţei' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub
Sub DepartamentSel_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 25 Then
            On Error GoTo err_25
            ActiveDocument.FormFields("departament_lista").result = c.Text
           Exit Sub
err_25:
            MsgBox "Câmpul 'Departament' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub
'added
Sub JudetLista_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 25 Then
            On Error GoTo err_25
            ActiveDocument.FormFields("judet_lista").result = c.Text
           Exit Sub
err_25:
            MsgBox "Câmpul 'Judeţ' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub TipProcedura_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 4 Then
            On Error GoTo err_4
            ActiveDocument.FormFields("tip_procedura").result = c.Text
            Exit Sub
err_4:
            MsgBox "Câmpul 'Tip procedura' a fost şters din formularul documentului.", 48, "Editare document ..."
            Exit Sub
        End If
    Next
End Sub

Sub TipActiuneParchet_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 12 Then
            On Error GoTo err_12
            ActiveDocument.FormFields("tip_actiune_parchet").result = c.Text
            ActiveDocument.FormFields("tip_actiune_parchet1").result = c.Text
            Exit Sub
err_12:
            MsgBox "Câmpul 'Tip acţiune' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub ParchetProcuror_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 11 Then
            On Error GoTo err_11
            ActiveDocument.FormFields("nume_procuror").result = c.Text
            Exit Sub
err_11:
            MsgBox "Câmpul 'Nume procuror' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub NumeProcSimpl_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 8 Then
            On Error GoTo err_8
            ActiveDocument.FormFields("nume_procuror_simpl").result = c.Text
            Exit Sub
err_8:
            MsgBox "Câmpul 'Nume procuror' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub CeFaceCurtea_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 10 Then
            On Error GoTo err_10
            ActiveDocument.FormFields("ce_face_curtea").result = c.Text
            Exit Sub
err_10:
            MsgBox "Câmpul 'Acţiunea curţii' a fost şters din formularul documentului.", 48, "Editare document ..."
            Exit Sub
        End If
    Next
End Sub

Sub DenumireInstitutie_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 17 Then
            On Error GoTo err_17
            ActiveDocument.FormFields("denumire_institutie").result = c.Text
            Exit Sub
err_17:
            MsgBox "Câmpul 'Denumire institutţie' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub TipFunctie_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 6 Then
            On Error GoTo err_6
            ActiveDocument.FormFields("functia_celui_care_f").result = c.Text
            Exit Sub
err_6:
            MsgBox "Câmpul 'Funcţie' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            
            Exit Sub
        End If
    Next
End Sub

Sub TipDocumentCauza_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 5 Then
            On Error GoTo err_5
            ActiveDocument.FormFields("tip_doc_despre_cauza").result = c.Text
            Exit Sub
err_5:
            MsgBox "Câmpul 'Tip document despre cauză' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub ActiuneDocument_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 7 Then
            On Error GoTo err_7
            ActiveDocument.FormFields("combo_invedereaza").result = c.Text
            Exit Sub
err_7:
            MsgBox "Câmpul 'Învederează' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub TipSedinta_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 3 Then
            On Error GoTo err_3
            ActiveDocument.FormFields("tip_sedinta").result = c.Text
            ActiveDocument.FormFields("tip_sedinta_copie_1").result = c.Text
            ActiveDocument.FormFields("tip_sedinta_copie_2").result = c.Text
            Exit Sub
err_3:
            MsgBox "Câmpul 'Tip şedinţă' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub TipSedintaSecreta_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 14 Then
            On Error GoTo err_14
            ActiveDocument.FormFields("tip_sedinta_secreta").result = c.Text
            ActiveDocument.FormFields("tip_sedinta_copie_1").result = c.Text
            ActiveDocument.FormFields("tip_sedinta_copie_2").result = c.Text
            Exit Sub
err_14:
            MsgBox "Câmpul 'Tip şedinţă secretă' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub TipDecizie_ei_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 16 Then
            On Error GoTo err_16
            ActiveDocument.FormFields("tip_decizie_ei").result = c.Text
            Exit Sub
err_16:
            MsgBox "Câmpul 'Tip decizie' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub TipDecizie_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 15 Then
            On Error GoTo err_15
            ActiveDocument.FormFields("tip_decizie").result = c.Text
            Exit Sub
err_15:
            MsgBox "Câmpul 'Tip decizie' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub

Sub TipIncheiere_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 9 Then
            On Error GoTo err_9
            ActiveDocument.FormFields("tip_incheiere").result = c.Text
            Exit Sub
err_9:
            MsgBox "Câmpul 'Tip încheiere' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub
Sub DecizieLista_Changed()
    Set cmdBar = ActiveDocument.CommandBars("Operaţii")
    Set menu = cmdBar.Controls("Câmpuri")
    For Each c In menu.Controls
        If c.Parameter = 23 Then
            On Error GoTo err_23
            ActiveDocument.FormFields("decizie_lista").result = c.Text
           Exit Sub
err_23:
            MsgBox "Câmpul 'Decizia' a fost şters din formularul documentului.", 48, "Editare document ..."
                
            Exit Sub
        End If
    Next
End Sub
'ED dropdown list method
Sub DropDownList_OnChanged()
    Dim oControl As CommandBarControl
    Set oControl = CommandBars.ActionControl
    If Not oControl Is Nothing Then
        Set cmdBar = ActiveDocument.CommandBars("Operaţii")
        Set menu = cmdBar.Controls("Câmpuri")
        For Each c In menu.Controls
            If c.Tag = oControl.Tag Then
                On Error GoTo err_99:
                ActiveDocument.FormFields(oControl.Tag).result = c.Text
                Exit For
            End If
        Next
    End If
    
    Set oControl = Nothing
    Exit Sub
err_99:
    MsgBox "Câmpul a fost şters din formularul documentului.", 48, "Editare document ..."
    Set oControl = Nothing
End Sub


Attribute VB_Name = "NewMacros"
Sub AutoExec()
    '
    ' TemplateGenerator Macro
    ' Macro created 6/7/2007 by Stelios Fradelakis
    '
    Call Init
End Sub
Sub Test()
    Dim awi
    Dim awcl As Integer
    Dim iCount As Integer
    On Error Resume Next
    For iCount = 1 To ActiveDocument.VBProject.VBComponents.Count
        Set awi = ActiveDocument.VBProject.VBComponents.Item(iCount)
        awcl = awi.CodeModule.CountOfLines
        MsgBox (awi.Name)
        'awi.CodeModule.DeleteLines 1, awcl
        Set awi = Nothing ' Release the object
    Next
End Sub
Sub Init()
    Call LoadParams
    Call ClearControls
    ControlCount = CommandBars(TOOL_BAR_NAME).Controls.Count
    Call InitializeComponents
End Sub
Sub InitializeComponents()
    Dim cbu As Office.CommandBarButton
    
    Call addComboBoxParams
    Call createFieldInfoButton
    Call createAddFieldButton
    Call createSaveButton
    Call createClearFieldButton
End Sub
Sub ClearControls()
    Dim iCount As Integer
    While CommandBars(TOOL_BAR_NAME).Controls.Count <> 0
        CommandBars(TOOL_BAR_NAME).Controls.Item(1).Delete
    Wend
End Sub
Private Sub createFieldInfoButton()
    Dim cbu As Office.CommandBarButton
    ControlCount = ControlCount + 1
    Set cbu = CommandBars(TOOL_BAR_NAME).Controls.Add(msoControlButton, , , ControlCount)
    With cbu
        .Style = msoButtonIcon
        .Caption = "Field Info"
        .TooltipText = "Field Info"
        '.Width = 60
        .FaceId = 984
        .OnAction = "showInfo"
    End With
End Sub
Sub createSaveButton()
    Dim cbu As Office.CommandBarButton
    ControlCount = ControlCount + 1
    Set cbu = CommandBars(TOOL_BAR_NAME).Controls.Add(msoControlButton, , , ControlCount)
    With cbu
        .Style = msoButtonIconAndCaption
        .Caption = "Save"
        .TooltipText = "Save"
        .Width = 50
        .FaceId = 3
        .OnAction = "documentSaveClose"
    End With
End Sub
Sub createClearFieldButton()
    Dim cbu As Office.CommandBarButton
    ControlCount = ControlCount + 1
    Set cbu = CommandBars(TOOL_BAR_NAME).Controls.Add(msoControlButton, , , ControlCount)
    With cbu
        .Style = msoButtonIconAndCaption
        .Caption = "Clear fields"
        .TooltipText = "Clear fields"
        .Width = 60
        .FaceId = 138
        .OnAction = "clearFields"
    End With
End Sub
Sub createAddFieldButton()
    Dim cbu As Office.CommandBarButton
    ControlCount = ControlCount + 1
    Set cbu = CommandBars(TOOL_BAR_NAME).Controls.Add(msoControlButton, , , ControlCount)
    With cbu
        .Style = msoButtonIconAndCaption
        .Caption = "Add field"
        .TooltipText = "Add field"
        .Width = 60
        .FaceId = 137
        .OnAction = "onAddField"
    End With
End Sub
Function addControl(commandBar As Office.commandBar, controlType As Office.MsoControlType) As Office.CommandBarControl
    Dim control As Office.CommandBarControl
    ControlCount = ControlCount + 1
    Set control = commandBar.Controls.Add(controlType, , , ControlCount)
    Set addControl = control
End Function
Sub addComboBoxParams()
    Dim cbo As Office.CommandBarComboBox
    
    ControlCount = ControlCount + 1
    Set cbo = CommandBars(TOOL_BAR_NAME).Controls.Add(msoControlComboBox, , , ControlCount)

    With cbo
        .Caption = "Parameters"
        .Style = msoComboNormal
        '.OnAction = ""
        .Width = 132
        .DropDownLines = 15
        .AddItem PROMPT_PARAM
        .ListIndex = 1
    End With
    Call fillParamComboBox(cbo)
End Sub
'Load parameters into dictionary object
Sub LoadParams()
    Set DicParam = CreateObject("Scripting.Dictionary")
        
    DicParam.Add "absenti", "Lista de parti si participanti absenti de la sedinta curenta (pentru documente de tip încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "adresa_parat", ""
    DicParam.Add "adresa_parat_1", ""
    DicParam.Add "adresa_reclamant", ""
    DicParam.Add "adresa_reclamant_1", ""
    DicParam.Add "adr_instanta_cur", "Adresa instantei curente."
    DicParam.Add "app_email", "[Needs translation]"
    DicParam.Add "app_fax", "[Needs translation]"
    DicParam.Add "app_telephone", "[Needs translation]"
    DicParam.Add "app_webpage", "[Needs translation]"
    DicParam.Add "calitate_parte", ""
    DicParam.Add "ce_face_curtea", ""
    DicParam.Add "citativ", ""
    DicParam.Add "CNP", ""
    DicParam.Add "combo_invedereaza", ""
    DicParam.Add "completul_1", ""
    DicParam.Add "completul_fara_pres", "Componenta completului de judecata pentru sedinta curenta (pentru documente de tip încheiere, decizie, hotarâre din sectiunea de solutii la sedinta). Se afiseaza functia, prenumele si numele persoanei din componenta completului, excluzând presedintele."
    DicParam.Add "completul_simplif", "Componenta completului de judecata în ordinea: presedinte, judecatori, grefieri, magistrati asistenti (pentru documente de tip încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "complexitate_dosar", ""
    DicParam.Add "CUI", ""
    DicParam.Add "data_editarii", "Data curenta."
    DicParam.Add "data_nasterii_p", ""
    DicParam.Add "decizie_lista", ""
    DicParam.Add "denumire_institutie", ""
    DicParam.Add "departament_lista", ""
    DicParam.Add "departament_lista_1", ""
    DicParam.Add "departament_lista_2", ""
    DicParam.Add "document_data", "Data documentului."
    DicParam.Add "document_numar", "Numarul documentului."
    DicParam.Add "domiciliu_parte", ""
    DicParam.Add "dosar_numar", "Numarul dosarului curent."
    DicParam.Add "dosar_numar_copie1", "Numarul dosarului curent."
    DicParam.Add "dosar_numar_sursa", "Numarul dosarului sursa pentru dosarul curent (din lista de dosare componente se alege ultimul dosar dupa data acestuia)."
    DicParam.Add "dosar_numar_sursa_1", ""
    DicParam.Add "dosare_de_fond_incl", "Lista dosarelor de fond incluse în dosarul curent."
    DicParam.Add "flux_document", "Circuitul extern/intern al documentului curent (pentru documentele de intrare/iesire din interfata de documente la dosar)."
    DicParam.Add "flux_document_1", ""
    DicParam.Add "functia_celui_care_f", ""
    DicParam.Add "functie_personal", ""
    DicParam.Add "identificat_prin", ""
    DicParam.Add "inclus_institu_lista", "[Needs translation]"
    DicParam.Add "inclus_sectia_lista", "[Needs translation]"
    DicParam.Add "inculpati", "Lista de parti din dosar cu calitatea Inculpat. Se afiseaza numele si prenumele."
    DicParam.Add "initiale_dactilograf", "Initialele utilizatorului ce editeaza documentul curent."
    DicParam.Add "institutie_dosar_src", "Institutia dosarului sursa pentru dosarul curent."
    DicParam.Add "institutie_dosar1src", ""
    DicParam.Add "judet_lista", ""
    DicParam.Add "locul_nasterii_p", ""
    DicParam.Add "nume_complet", ""
    DicParam.Add "nume_departament", "Numele departamentului curent."
    DicParam.Add "nume_departament_1", "Numele departamentului curent."
    DicParam.Add "nume_grefier_sedinta", ""
    DicParam.Add "nume_inculpat_ex", ""
    DicParam.Add "nume_instanta_cur", "Numele instantei curente."
    DicParam.Add "nume_instanta_cur_1", "Numele instantei curente."
    DicParam.Add "nume_judecator", ""
    DicParam.Add "nume_magistrat_cons", "Numele magistratului consultand dintre participantii din dosar prezenti la sedinta curenta (pentru documente de tip încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "nume_mama", ""
    DicParam.Add "nume_parte_ex", "Numele partilor din dosar. Se afiseaza informatii despre nume, prenume, data nastere, numele mamei, numele tatalui."
    DicParam.Add "nume_parti", "Numele partilor la care se refera documentul (pentru documentele care se refera la parti din dosar din interfata de documente la dosar)."
    DicParam.Add "nume_parti_copie_1", "Numele partilor la care se refera documentul (pentru documentele care se refera la parti din dosar din interfata de documente la dosar)."
    DicParam.Add "nume_parti_cu_adr", ""
    DicParam.Add "nume_parti_cu_adr_1", ""
    DicParam.Add "nume_parti_dr", "Numele partilor din dosar (cei din partea dreapta din sectiunea de parti). Se afiseaza calitatea, numele si prenumele partii."
    DicParam.Add "nume_parti_dr_1", "Numele partilor din dosar (cei din partea dreapta din sectiunea de parti). Se afiseaza calitatea, numele si prenumele partii."
    DicParam.Add "nume_parti_st", "Numele partilor din dosar (cei din partea stânga din sectiunea de parti). Se afiseaza calitatea, numele si prenumele partii."
    DicParam.Add "nume_parti_st_1", "Numele partilor din dosar (cei din partea stânga din sectiunea de parti). Se afiseaza calitatea, numele si prenumele partii."
    DicParam.Add "nume_presedinte_comp", "Prenumele si numele presedintelui completului de judecata pentru sedinta curenta (pentru documente de tip încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "nume_procuror", ""
    DicParam.Add "nume_procuror_simpl", ""
    DicParam.Add "nume_tata", ""
    DicParam.Add "obiect_dosar", "Obiectul dosarului."
    DicParam.Add "obiect_dosar_", ""
    DicParam.Add "obiect_sedinta", "Obiectul sedintei curente (pentru documente de tip încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "ora_sedintei", ""
    DicParam.Add "prezenti", "Lista de parti si participanti prezenti la sedinta curenta (pentru documente de tip încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "recurent_nume", "Numele recurentului din dosarul curent."
    DicParam.Add "redactor", ""
    DicParam.Add "sedinta_componenta", "[Needs translation]"
    DicParam.Add "sedinta_data", "Data sedintei (pentru documente de tip Încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "sedinta_data_copie_1", "Data sedintei (pentru documente de tip Încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "sedinta_data_copie_2", "Data sedintei (pentru documente de tip Încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "sedinta_data_lista", ""
    DicParam.Add "semnaturi_complet_j", ""
    DicParam.Add "solutie_sumar", "Solutia pe scurt (pentru documente de tip încheiere, decizie, hotarâre din sectiunea de solutii la sedinta)."
    DicParam.Add "taxa_timbru", ""
    DicParam.Add "taxa_timbru_copie_1", ""
    DicParam.Add "tip_actiune_parchet", ""
    DicParam.Add "tip_categorie_caz", "Materia dosarului curent."
    DicParam.Add "tip_decizie", ""
    DicParam.Add "tip_decizie_ei", ""
    DicParam.Add "tip_desizie_db", "[Needs translation]"
    DicParam.Add "tip_doc_despre_cauza", ""
    DicParam.Add "tip_incheiere", ""
    DicParam.Add "tip_procedura", ""
    DicParam.Add "tip_sedinta", ""
    DicParam.Add "tip_sedinta_copie_1", ""
    DicParam.Add "tip_sedinta_copie_2", ""
    DicParam.Add "tip_sedinta_secreta", ""

    'New ED Params
End Sub
'Loads data from dictionary object
Sub fillParamComboBox(ByRef cmbParams As CommandBarComboBox)
    Dim KeysArray
    KeysArray = DicParam.Keys
    For i = 0 To UBound(KeysArray)
        cmbParams.AddItem KeysArray(i)
    Next
End Sub
Sub showInfo()
    Dim message As String
    Dim selectedParam As String
    selectedParam = CommandBars(TOOL_BAR_NAME).Controls.Item(1).Text

    If (selectedParam = PROMPT_PARAM Or selectedParam = "") Then
        message = "Please select a param first"
    Else
        If DicParam.Exists(selectedParam) Then
            message = DicParam.Item(selectedParam)
        Else
            message = "Help info does not exists for this parameter"
        End If
    End If
    
    MsgBox message, vbOKOnly, "Parameter help"
End Sub
Sub onAddField()
    Dim selectedParam As String
    
    selectedParam = CommandBars(TOOL_BAR_NAME).Controls.Item(1).Text
    
    If (selectedParam = PROMPT_PARAM Or selectedParam = "") Then
        MsgBox ("Please select a param first")
    Else
        addFormField (selectedParam)
    End If
End Sub
Function generateParamName(paramName As String, suffix As String)
    Dim paramSuffix As Integer
    Dim generatedParam As String
    generatedParam = paramName
    While (paramExists(generatedParam))
        paramSuffix = paramSuffix + 1
        generatedParam = paramName & suffix & paramSuffix
    Wend
    generateParamName = generatedParam
End Function
Sub addFormField(fieldName As String)
    If (paramExists(fieldName)) Then
        MsgBox ("Param allready exists")
        Exit Sub
    End If
    Dim formField As formField
    Set formField = Selection.FormFields.Add(Selection.Range, wdFieldFormTextInput)
    'Selection.PreviousField.Select
    With formField
        .Name = fieldName
        .EntryMacro = ""
        .ExitMacro = ""
        .Enabled = True
        .OwnHelp = False
        .HelpText = ""
        .OwnStatus = False
        .StatusText = ""
        With .TextInput
            .EditType Type:=wdRegularText, Default:="", Format:=""
            .Width = 0
        End With
    End With
End Sub
Sub clearFields()
    If MsgBox("Delete all fields?", vbOKCancel, "Template generator") = vbOK Then
        Dim formField As formField
    
        For Each formField In ActiveDocument.FormFields
            formField.Delete
        Next
    End If
End Sub
Sub documentSaveClose()
    If MsgBox("Save & close document?", vbOKCancel, "Template generator") = vbOK Then
        ActiveDocument.SaveAs
        ActiveDocument.Close
    End If
End Sub
Function paramExists(paramName As String)
    Dim formField As formField
    Dim result As Boolean
    result = False
    For Each formField In ActiveDocument.FormFields
        If (formField.Name = paramName) Then
            result = True
        End If
    Next
    paramExists = result
End Function