Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a658493adb5ea444…

MALICIOUS

Office (OLE)

215.0 KB Created: 2013-03-26 19:24:00 Authoring application: Microsoft Office Word First seen: 2015-09-27
MD5: 8051718f89d3cedacf60070b5b506ed0 SHA-1: e778bc32edb86d60ef9b2cfd27250c73d9b8f368 SHA-256: a658493adb5ea444537778970e69804557dea24d43c74c6cb990b140f380cd8d
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

The sample is a malicious Office document containing VBA macros. The 'OLE_VBA_MACRO_VIRUS_REPLICATION' heuristic indicates the macros are designed for self-replication and potential AV tampering. The 'Document_Open' macro suggests an auto-execution trigger upon opening. The script's functions like 'deleteAllVba' and 'deleteProcedure' imply an attempt to modify or remove its own code, possibly to evade detection or spread.

Heuristics 3

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            .DeleteLines 1, .CountOfLines
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 61144 bytes
SHA-256: 42ec4cd846dd23ecc72dc24b37549565d4641e8b241945aacc139dc5ff93b175
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "CommandButton1, 0, 0, MSForms, CommandButton"
Const DocumentCaws = "Hoarelea Y62"
Private Sub Document_Close()
    CloseMenu
End Sub


Private Sub CommandButton1_Click()
    On Error Resume Next
    'confirm with engineer that he is going to delete the engineering guides
    Dim answer As Integer
    answer = MsgBox("You are about to delete all paragraphs with 'Engineer's Guidance' style applied. Are you sure you want to continue", vbYesNoCancel)
    If answer = vbYes Then
        Application.ScreenUpdating = False
        'delete Issue Status Table - this needs to be done first otherwise program goes into continuous find loop
        deleteIssueTable
        'new Aug 2012
        DeleteAllGuidelines
        'end new
        Application.ScreenUpdating = True
        'Now delete all the code (if required)
        On Error Resume Next
        answer = MsgBox("Some virus checkers prevent word documents from opening if they contain embedded macros, do you want to remove all HoareLea Macros (e.g. Menus, TOC updating) from this document?", vbYesNo)
        If answer = vbYes Then
            deleteAllVba
        Else
            deleteProcedure "ThisDocument", "CommandButton1_Click"
        End If
    End If
End Sub

Private Sub DeleteAllGuidelines()
        On Error GoTo WarnEngineer
        'first do the paragraphs
        If StyleExists("Engineer's Guidance Text") Then
            DeleteTextWithGivenStyle style:="Engineer's Guidance Text"
        End If
        If StyleExists("Engineer's Guidance bullets") Then
            DeleteTextWithGivenStyle style:="Engineer's Guidance bullets"
        End If
        If StyleExists("Engineer's Guidance Text Char") Then
            DeleteTextWithGivenStyle style:="Engineer's Guidance Text Char"
        End If
        If StyleExists("Engineer's Guidance bullets Char") Then
            DeleteTextWithGivenStyle style:="Engineer's Guidance bullets Char"
        End If
        If StyleExists("Engineers Select Char") Then
            'lastly change any Engineer Select text to normal bodytext
            ChangeEngineerSelectToBodyTextStyle
        End If
        Exit Sub
WarnEngineer:
        MsgBox Prompt:="Could not delete all 'Engineering Guidance' text - manually check your document (especially tables).", Buttons:=vbOKOnly, title:="Warning!"
End Sub

'check to see if the style exists - perhaps the engineer has deleted the style!
Function StyleExists(StyleName As String) As Boolean
    Dim MyStyle As Word.style
    On Error Resume Next
     ' maybe this ...
    Set MyStyle = ActiveDocument.Styles(StyleName)
     ' or maybe this ...
     ' Set MyStyle = ActiveDocument.AttachedTemplate.Styles(StyleName)
    StyleExists = Not MyStyle Is Nothing
End Function

Sub DeleteTextWithGivenStyle(ByVal style As String)
  Dim oRng As Range
  Set oRng = ActiveDocument.Range(Start:=0, End:=0)
  With oRng.Find
    ' Preparation
    .ClearFormatting
    .Replacement.ClearFormatting
    .Text = ""
    .Replacement.Text = ""
    .MatchWildcards = False
    .Wrap = wdFindContinue
    .style = ActiveDocument.Styles(style)
    .Execute Replace:=wdReplaceAll
  End With
End Sub

Sub ChangeEngineerSelectToBodyTextStyle()
    With ActiveDocument.Content.Find
        .ClearFormatting
        .MatchWildcards = False
        .Wrap = wdFindContinue
        .style = ActiveDocument.Styles("Engineers Select Char")
        
        With .Replacement
            .ClearFormatting
            .style = ActiveDocument.Styles("Body Text Char")
        End With
        .Execute FindText:="", ReplaceWith:="", Format:=True, Replace:=wdReplaceAll
    End With
End Sub


Private Sub Document_New()
    'this routine intercepts the print request and updates the toc before proceeding
    InitEvents
End Sub



Private Sub Document_Open()

On Error Resume Next
    'this routine intercepts the print request and updates the toc before proceeding
    InitEvents
    'if this is the first time the engineer has opened the file then open the interactive template window
    Dim test As Boolean
    Dim caws As Boolean
    Dim notNew As Boolean
    Dim hideMenu As Boolean
    test = False
    caws = False
    notNew = False
    hideMenu = False
    For Each docvar In ActiveDocument.Variables
        Select Case docvar.Name
            Case "notNew"
                notNew = True
            Case "hideMenu"
                hideMenu = True
            Case "Doc_Saved_As"
                test = True
            Case "caws"
                caws = True
        End Select
    Next docvar
    'Is this the first time that the engineer has openend this document?
    If notNew = False Then
        'first time opening document
 
        'Set the docuemnt variable so that frmWizard does not show again
        ActiveDocument.Variables.Add Name:="notNew", Value:=1
        'call the interactive template
        frmWizard.Show
    End If
    'try and eliminate the shutdown menu for other open docuemnts
    If test Then
        ActiveDocument.Variables("Doc_Saved_As").Value = ActiveDocument.Name
    Else
        ActiveDocument.Variables.Add Name:="Doc_Saved_As", Value:=ActiveDocument.Name
    End If
    If caws Then
        ActiveDocument.Variables("caws").Value = "s32"
    Else
        ActiveDocument.Variables.Add Name:="caws", Value:="s32"
    End If
    'add the hoarelea w12 menu - if it exists delete the old version.
    checkmenu = Application.CommandBars("Menu Bar").Controls(DocumentCaws).Application
    If (checkmenu <> "") Then
        Application.CommandBars("Menu Bar").Controls(DocumentCaws).Delete
    End If
    If Not hideMenu Then
        build_menu
    End If
End Sub



Private Sub change_headers()
    frmDocVariables.Show
End Sub


'This subroutine is only used for testing it reinitialises the docvariables, vba code thinks that this is a first time document and gives the interative template and menu
Private Sub initialConditions()
    On Error Resume Next
    For Each docvar In ActiveDocument.Variables
        If docvar.Name = "notNew" Then
            ActiveDocument.Variables("notNew").Delete
        End If
        If docvar.Name = "hidemenu" Then
            ActiveDocument.Variables("hideMenu").Delete
        End If
    Next docvar
End Sub



Sub deleteAllVba()
    CloseMenu
    'Goes through each vbcomponent and deletes the component, it will only delete the code in ThisDocumnet however
    On Error Resume Next
    Dim vbComp As Object
    For Each vbComp In ActiveDocument.VBProject.VBComponents
        With vbComp
        If .Type <> 100 Then
            ActiveDocument.VBProject.VBComponents.Remove vbComp
        End If
        End With
    Next vbComp
    'delete all the code in thisDocument
    With ActiveDocument.VBProject.VBComponents("ThisDocument").CodeModule
        If .CountOfLines > 0 Then
        .DeleteLines 1, .CountOfLines
        End If
    End With
End Sub


Sub deleteProcedure(componentName As String, procedureName As String)
    'Deletes a named procedure from a named vb component e.g. CommandButton1_Click in ThisDocument
    On Error Resume Next
    Dim startSubLine, numberOfSubLines As Integer
    startSubLine = ActiveDocument.VBProject.VBComponents(componentName).CodeModule.ProcStartLine(procedureName, vbext_pk_Proc)
    If startSubLine > 0 Then
    numberOfSubLines = ActiveDocument.VBProject.VBComponents(componentName).CodeModule.ProcCountLines(procedureName, vbext_pk_Proc)
    ActiveDocument.VBProject.VBComponents(componentName).CodeModule.DeleteLines startSubLine, numberOfSubLines
    End If
End Sub


Private Sub CloseMenu()
    'Delete the menu
    On Error Resume Next
    Dim checkmenu As String
    On Error Resume Next
    checkmenu = Application.CommandBars("Menu Bar").Controls(DocumentCaws).Application
    If (checkmenu <> "") Then
        Application.CommandBars("Menu Bar").Controls(DocumentCaws).Delete
    End If
End Sub
Sub deleteIssueTable()
    If ActiveDocument.Bookmarks.Exists("IssueTable") = True Then
        ActiveDocument.Bookmarks("IssueTable").Range.Select
        Selection.Delete
        Exit Sub
    End If
    Dim tblTemp As Table
    Dim oDoc1 As Document
    If ActiveDocument.Tables.Count >= 1 Then
        Set oDoc1 = ActiveDocument
        For Each tblTemp In oDoc1.Tables
            'test for range - otherwise it will jump out of subroutine
            If Not tblTemp.Range.style Is Nothing Then
                If tblTemp.Range.style.NameLocal = "Engineer's Guidance Text" Then
                    tblTemp.Delete
                    Exit For
                End If
            End If
        Next
    End If
End Sub




Attribute VB_Name = "frmWizard"
Attribute VB_Base = "0{D71E832E-07C7-4A5D-973B-212481CEBB75}{6BEE222E-3F45-402F-998D-3702EAE4D862}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Option Explicit
Dim m_iTotalSteps As Integer
Dim m_sCurStep As String
'''''''''''''''''''''''''''''
'Checkbox routines
'''''''''''''''''''''''''''''





Private Sub chk_standards_1_1_Click()
    On Error Resume Next
    If chk_standards_1_1.Value = False Then
        chk_standards_1_1.ForeColor = &H808080
    Else
        chk_standards_1_1.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_2_Click()
    On Error Resume Next
    If chk_standards_1_2.Value = False Then
        chk_standards_1_2.ForeColor = &H808080
    Else
        chk_standards_1_2.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_3_Click()
    On Error Resume Next
    If chk_standards_1_3.Value = False Then
        chk_standards_1_3.ForeColor = &H808080
    Else
        chk_standards_1_3.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_4_Click()
    On Error Resume Next
    If chk_standards_1_4.Value = False Then
        chk_standards_1_4.ForeColor = &H808080
    Else
        chk_standards_1_4.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_5_Click()
    On Error Resume Next
    If chk_standards_1_5.Value = False Then
        chk_standards_1_5.ForeColor = &H808080
    Else
        chk_standards_1_5.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_6_Click()
    On Error Resume Next
    If chk_standards_1_6.Value = False Then
        chk_standards_1_6.ForeColor = &H808080
    Else
        chk_standards_1_6.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_7_Click()
    On Error Resume Next
    If chk_standards_1_7.Value = False Then
        chk_standards_1_7.ForeColor = &H808080
    Else
        chk_standards_1_7.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_8_Click()
    On Error Resume Next
    If chk_standards_1_8.Value = False Then
        chk_standards_1_8.ForeColor = &H808080
    Else
        chk_standards_1_8.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_9_Click()
    On Error Resume Next
    If chk_standards_1_9.Value = False Then
        chk_standards_1_9.ForeColor = &H808080
    Else
        chk_standards_1_9.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_10_Click()
    On Error Resume Next
    If chk_standards_1_10.Value = False Then
        chk_standards_1_10.ForeColor = &H808080
    Else
        chk_standards_1_10.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_11_Click()
    On Error Resume Next
    If chk_standards_1_11.Value = False Then
        chk_standards_1_11.ForeColor = &H808080
    Else
        chk_standards_1_11.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_12_Click()
    On Error Resume Next
    If chk_standards_1_12.Value = False Then
        chk_standards_1_12.ForeColor = &H808080
    Else
        chk_standards_1_12.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_13_Click()
    On Error Resume Next
    If chk_standards_1_13.Value = False Then
        chk_standards_1_13.ForeColor = &H808080
    Else
        chk_standards_1_13.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_14_Click()
    On Error Resume Next
    If chk_standards_1_14.Value = False Then
        chk_standards_1_14.ForeColor = &H808080
    Else
        chk_standards_1_14.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_15_Click()
    On Error Resume Next
    If chk_standards_1_15.Value = False Then
        chk_standards_1_15.ForeColor = &H808080
    Else
        chk_standards_1_15.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_16_Click()
    On Error Resume Next
    If chk_standards_1_16.Value = False Then
        chk_standards_1_16.ForeColor = &H808080
    Else
        chk_standards_1_16.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_17_Click()
    On Error Resume Next
    If chk_standards_1_17.Value = False Then
        chk_standards_1_17.ForeColor = &H808080
    Else
        chk_standards_1_17.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_18_Click()
    On Error Resume Next
    If chk_standards_1_18.Value = False Then
        chk_standards_1_18.ForeColor = &H808080
    Else
        chk_standards_1_18.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_19_Click()
    On Error Resume Next
    If chk_standards_1_19.Value = False Then
        chk_standards_1_19.ForeColor = &H808080
    Else
        chk_standards_1_19.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_1_20_Click()
    On Error Resume Next
    If chk_standards_1_20.Value = False Then
        chk_standards_1_20.ForeColor = &H808080
    Else
        chk_standards_1_20.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_1_Click()
    On Error Resume Next
    If chk_standards_2_1.Value = False Then
        chk_standards_2_1.ForeColor = &H808080
    Else
        chk_standards_2_1.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_2_Click()
    On Error Resume Next
    If chk_standards_2_2.Value = False Then
        chk_standards_2_2.ForeColor = &H808080
    Else
        chk_standards_2_2.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_3_Click()
    On Error Resume Next
    If chk_standards_2_3.Value = False Then
        chk_standards_2_3.ForeColor = &H808080
    Else
        chk_standards_2_3.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_4_Click()
    On Error Resume Next
    If chk_standards_2_4.Value = False Then
        chk_standards_2_4.ForeColor = &H808080
    Else
        chk_standards_2_4.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_5_Click()
    On Error Resume Next
    If chk_standards_2_5.Value = False Then
        chk_standards_2_5.ForeColor = &H808080
    Else
        chk_standards_2_5.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_6_Click()
    On Error Resume Next
    If chk_standards_2_6.Value = False Then
        chk_standards_2_6.ForeColor = &H808080
    Else
        chk_standards_2_6.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_7_Click()
    On Error Resume Next
    If chk_standards_2_7.Value = False Then
        chk_standards_2_7.ForeColor = &H808080
    Else
        chk_standards_2_7.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_8_Click()
    On Error Resume Next
    If chk_standards_2_8.Value = False Then
        chk_standards_2_8.ForeColor = &H808080
    Else
        chk_standards_2_8.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_9_Click()
    On Error Resume Next
    If chk_standards_2_9.Value = False Then
        chk_standards_2_9.ForeColor = &H808080
    Else
        chk_standards_2_9.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_10_Click()
    On Error Resume Next
    If chk_standards_2_10.Value = False Then
        chk_standards_2_10.ForeColor = &H808080
    Else
        chk_standards_2_10.ForeColor = &H0&
    End If
End Sub


Private Sub chk_standards_2_11_Click()
    On Error Resume Next
    If chk_standards_2_11.Value = False Then
        chk_standards_2_11.ForeColor = &H808080
    Else
        chk_standards_2_11.ForeColor = &H0&
    End If
End Sub

Private Sub chk_600_1_Click()
    On Error Resume Next
    If chk_600_1.Value = False Then
        chk_600_1.ForeColor = &H808080
    Else
        chk_600_1.ForeColor = &H0&
    End If
End Sub


Private Sub chk_700_1_Click()
    On Error Resume Next
    If chk_700_1.Value = False Then
        chk_700_1.ForeColor = &H808080
    Else
        chk_700_1.ForeColor = &H0&
    End If
End Sub

Private Sub chk200_Click()
    On Error Resume Next
    If chk200.Value = False Then
        chk200.ForeColor = &H808080
    Else
        chk200.ForeColor = &H0&
    End If
End Sub

Private Sub chk300_Click()
    On Error Resume Next
    If chk300.Value = False Then
        chk300.ForeColor = &H808080
    Else
        chk300.ForeColor = &H0&
    End If
End Sub

Private Sub chk400_Click()
    On Error Resume Next
    If chk400.Value = False Then
        chk400.ForeColor = &H808080
    Else
        chk400.ForeColor = &H0&
    End If
End Sub

Private Sub chk7000_Click()
    On Error Resume Next
    If chk7000.Value = False Then
        chk7000.ForeColor = &H808080
    Else
        chk7000.ForeColor = &H0&
    End If
End Sub



''''''''''''''''
'cancel button
''''''''''''''''
'''''''''''''''''''''''''''''
Private Sub cmdCancel_Click()
    deleteWizard
    Unload Me
End Sub
''''''''''''''''
'main routine
''''''''''''''''
Private Sub cmdFinish_Click()
    On Error Resume Next
    Dim ProjName As String, SpecTitle As String
    Dim oRange As Range
    ''''''''''''''''
    'Set the project Name in the Header
    ''''''''''''''''
    If txtProjName.TextLength > 0 Then
        ProjName = UCase(txtProjName.Value)
        If ActiveDocument.Bookmarks.Exists("ProjectName") Then
            Set oRange = ActiveDocument.Bookmarks("ProjectName").Range
            oRange.Text = ProjName
            ActiveDocument.Bookmarks.Add Name:="ProjectName", Range:=oRange
        End If
    End If
    If txtSpecTitle.TextLength > 0 Then
        SpecTitle = UCase(txtSpecTitle.Value)
        If ActiveDocument.Bookmarks.Exists("SpecificationTitle") Then
            Set oRange = ActiveDocument.Bookmarks("SpecificationTitle").Range
            oRange.Text = SpecTitle
            ActiveDocument.Bookmarks.Add Name:="SpecificationTitle", Range:=oRange
        End If
    End If
        
    'process all the checkboxes
  
        


If chk_standards_1_1.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_1") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_1").Range.Delete
    End If

End If


If chk_standards_1_2.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_2") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_2").Range.Delete
    End If

End If


If chk_standards_1_3.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_3") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_3").Range.Delete
    End If

End If


If chk_standards_1_4.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_4") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_4").Range.Delete
    End If

End If


If chk_standards_1_5.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_5") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_5").Range.Delete
    End If

End If


If chk_standards_1_6.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_6") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_6").Range.Delete
    End If

End If


If chk_standards_1_7.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_7") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_7").Range.Delete
    End If

    If ActiveDocument.Bookmarks.Exists("bk_chk_standards_1_7_1") = True Then
        ActiveDocument.Bookmarks("bk_chk_standards_1_7_1").Range.Delete
    End If
    If ActiveDocument.Bookmarks.Exists("bk_chk_standards_1_7_2") = True Then
        ActiveDocument.Bookmarks("bk_chk_standards_1_7_2").Range.Delete
    End If
End If


If chk_standards_1_8.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_8") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_8").Range.Delete
    End If

    If ActiveDocument.Bookmarks.Exists("bk_chk_standards_1_8_1") = True Then
        ActiveDocument.Bookmarks("bk_chk_standards_1_8_1").Range.Delete
    End If
End If


If chk_standards_1_9.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_9") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_9").Range.Delete
    End If

End If


If chk_standards_1_10.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_10") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_10").Range.Delete
    End If

End If


If chk_standards_1_11.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_11") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_11").Range.Delete
    End If

End If


If chk_standards_1_12.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_12") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_12").Range.Delete
    End If

End If


If chk_standards_1_13.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_13") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_13").Range.Delete
    End If

End If


If chk_standards_1_14.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_14") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_14").Range.Delete
    End If

End If


If chk_standards_1_15.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_15") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_15").Range.Delete
    End If

End If


If chk_standards_1_16.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_16") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_16").Range.Delete
    End If

End If


If chk_standards_1_17.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_17") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_17").Range.Delete
    End If

End If


If chk_standards_1_18.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_18") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_18").Range.Delete
    End If

End If


If chk_standards_1_19.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_19") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_19").Range.Delete
    End If

End If


If chk_standards_1_20.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_1_20") = True Then
        ActiveDocument.Bookmarks("bk_standards_1_20").Range.Delete
    End If

End If


If chk_standards_2_1.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_1") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_1").Range.Delete
    End If

End If


If chk_standards_2_2.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_2") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_2").Range.Delete
    End If

End If


If chk_standards_2_3.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_3") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_3").Range.Delete
    End If

End If


If chk_standards_2_4.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_4") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_4").Range.Delete
    End If

End If


If chk_standards_2_5.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_5") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_5").Range.Delete
    End If

End If


If chk_standards_2_6.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_6") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_6").Range.Delete
    End If

End If


If chk_standards_2_7.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_7") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_7").Range.Delete
    End If

End If


If chk_standards_2_8.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_8") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_8").Range.Delete
    End If

End If


If chk_standards_2_9.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_9") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_9").Range.Delete
    End If

    If ActiveDocument.Bookmarks.Exists("bk_chk_standards_2_9_1") = True Then
        ActiveDocument.Bookmarks("bk_chk_standards_2_9_1").Range.Delete
    End If
End If


If chk_standards_2_10.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_10") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_10").Range.Delete
    End If

End If


If chk_standards_2_11.Value = False Then
    If ActiveDocument.Bookmarks.Exists("bk_standards_2_11") = True Then
        ActiveDocument.Bookmarks("bk_standards_2_11").Range.Delete
    End If

End If

    If chk_600_1.Value = False Then
        If ActiveDocument.Bookmarks.Exists("bk_600_1") = True Then
            ActiveDocument.Bookmarks("bk_600_1").Range.Delete
        End If
    End If

    If chk_700_1.Value = False Then
        If ActiveDocument.Bookmarks.Exists("bk_700_1") = True Then
            ActiveDocument.Bookmarks("bk_700_1").Range.Delete
        End If
    End If
    
    
    If chk200.Value = False Then
        If ActiveDocument.Bookmarks.Exists("chk200") = True Then
            ActiveDocument.Bookmarks("chk200").Range.Delete
        End If
    End If
    If chk300.Value = False Then
        If ActiveDocument.Bookmarks.Exists("chk300") = True Then
            ActiveDocument.Bookmarks("chk300").Range.Delete
        End If
    End If
    If chk400.Value = False Then
        If ActiveDocument.Bookmarks.Exists("chk400") = True Then
            ActiveDocument.Bookmarks("chk400").Range.Delete
        End If
    End If
    If chk7000.Value = False Then
        If ActiveDocument.Bookmarks.Exists("chk7000") = True Then
            ActiveDocument.Bookmarks("chk7000").Range.Delete
        End If
    End If

'remove all bookmarks in the document
Dim bookmarkInDoc As Bookmark
For Each bookmarkInDoc In ActiveDocument.Bookmarks
    If bookmarkInDoc.Name = "IssueTable" Or bookmarkInDoc.Name = "ProjectName" Or bookmarkInDoc.Name = "SpecificationTitle" Then
    'do nothing here but above line reads better
    Else
        bookmarkInDoc.Delete
    End If
Next

'move to start of document
ActiveDocument.Paragraphs(1).Range.Select
Selection.Collapse Direction:=wdCollapseStart


'Update the toc
ActiveDocument.Fields.Update
deleteWizard
Unload Me
End Sub

 
'Procedure to remove the frmWizard
…

Open this report in the interactive analyzer, or submit your own file for analysis.