Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 952b7ca591c42570…

MALICIOUS

Office (OLE)

159.5 KB Created: 2010-01-22 02:42:36 Authoring application: Microsoft Excel First seen: 2020-09-24
MD5: 1c5e6910e8141259368548426f012f56 SHA-1: d0a9157a8edebabb10b72bb4a568662d6c420195 SHA-256: 952b7ca591c42570b431c55796ca9b4d8a6a3f6fdaa2f1b4065009a0d8a02fcc
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is an Excel document containing VBA macros that utilize WScript.Shell and CreateObject to execute commands. The macros appear to be designed to download and execute a second-stage payload, as indicated by the 'Doc.Dropper.Agent-6335082-0' ClamAV detection and the presence of shell execution calls. The embedded URLs are likely related to the payload delivery mechanism.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6335082-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6335082-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        ' Run VBScript file
    Set wshShell = CreateObject("Wscript.Shell")
    wshShell.Run """" & sFileName & """"
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        ' Instantiate Internet Explorer
    Set ie = CreateObject("InternetExplorer.Application")
    ie.Visible = True
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
        s = s & "Call GetFieldMarkers(sMarkers)" & vbCrLf
    s = s & "Set oXL = GetObject(, ""Excel.Application"")" & vbCrLf
    s = s & "Set oXML = WScript.CreateObject(""MSXML2.XMLHTTP"")" & vbCrLf
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://excelhero.com/blog� In document text (OLE body)
    • http://www.realestateabc.com/home-values/detail/In document text (OLE body)
    • http://excelhero.com/blogIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 62553 bytes
SHA-256: ec8ffc4d9fcc4cafd5ff403d1b8878c993581e0e99145c4bd1e63515c1aa3297
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "cmdStart, 2, 0, MSForms, CommandButton"
Attribute VB_Control = "cmdClear, 17, 1, MSForms, CommandButton"
' Copyright 2010 by Daniel Ferry, http://excelhero.com/blog
' Workbook code licensed under Creative Commons Attribution 3.0 United States.
' You may use for any purpose as long as you keep this copyright notice in place.

Public sProperties_RefAddr As String
Private shtDemo As Worksheet
Private Const SHEET_DEMO = "demo"
Private Const PROP_LIST_COL = "d"


Private Sub cmdClear_Click()

    [a1].Select
    Union(Range(PROP_LIST_COL & "1").End(xlDown).CurrentRegion.Offset(1, 1), _
          [starttime], _
          [endtime], _
          [recordsprocessed]).ClearContents
    
    Sheet2.[speed].EntireColumn.ClearContents
        
End Sub

Private Sub cmdStart_Click()

    [a1].Select
    Set shtDemo = Worksheets(SHEET_DEMO)
    sProperties_RefAddr = shtDemo.Range(PROP_LIST_COL & "1").End(xlDown).Offset(1).Address
    Application.Calculation = xlCalculationAutomatic
    
    Select Case [Method]
        Case "Internet Explorer"
            UpdateStats
            Call IE_Method(shtDemo, sProperties_RefAddr)
        Case "MSXML2"
            UpdateStats
            Call MSXML2_Method(shtDemo, sProperties_RefAddr)
        Case "Swarm"
            UpdateStats
            Call Swarm_Method(shtDemo, sProperties_RefAddr)
    End Select

End Sub

Private Sub UpdateStats()

    [starttime] = Now
    [endtime] = [starttime]
    [recordsprocessed] = 0

End Sub

Private Sub Worksheet_Change(ByVal Target As Range)

    Dim i As Long
    
    With Target
        If .Column <> lngOutputCol Then Exit Sub
        If .Rows.Count > 1 Then Exit Sub
        If Len(.Cells(1, 1)) = 0 Then Exit Sub
        If .Cells.Count = 1 Then Exit Sub
    End With

    
    [endtime] = Now
    i = [recordsprocessed]
    [recordsprocessed] = i + 1
    
    [speed].Offset(i) = [RecordsPerSecond]
    
    If [stopgo] = "Stop" Then
        Exit Sub
    End If
    
    If [Method] = "Swarm" Then
        Call Swarm_Method(shtDemo, sProperties_RefAddr, boolOneAgentOnly:=True)
    End If

End Sub


Attribute VB_Name = "Module1"
' Copyright 2010 by Daniel Ferry, http://excelhero.com/blog
' Workbook code licensed under Creative Commons Attribution 3.0 United States.
' You may use for any purpose as long as you keep this copyright notice in place.

Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
Public lngAgents As Long
Public lngOutputCol As Long


Public Sub IE_Method(shtData As Worksheet, sProperty_RangeAddr)

    ' Note: for this method to work, Microsoft Internet Controls
    '       must be referenced in Tools - References.


    Dim i As Long
    Dim lngCurRec As Long
    Dim sURL_Base As String
    Dim lngRecords As Long
    Dim vAddresses As Variant
    Dim sHTML As String
    Dim sMarkers() As String
    Dim vResults As Variant
    Dim rngOutput As Range
    Dim ie As InternetExplorer
    
    ' Number of output columns
    ReDim vResults(7)
    
    
    ' Instantiate Internet Explorer
    Set ie = CreateObject("InternetExplorer.Application")
    ie.Visible = True
    
    
    ' Setup variables
    sURL_Base = "http://www.realestateabc.com/home-values/detail/"
    With shtData.Range(sProperty_RangeAddr)
        lngRecords = .End(xlDown).Row - .Row + 1
        vAddresses = .Resize(lngRecords)
    End With
    Call GetFieldMarkers(sMarkers(), "ie")
    lngOutputCol = Range(sProperty_RangeAddr).Offset(, 1).Column

    ' Start scraping
    On Error GoTo ResumeFromHere
    For lngCurRec = 1 To UBound(vAddresses)
        
        DoEvents
        Set rngOutput = Range(sProperty_RangeAddr).Offset(lngCurRec - 1, 1)
        
        ' Start at first empty output cell
        If Len(rngOutput) = 0 Then
            
            ' Set semaphore
            rngOutput = "ie"
            
            ' Navigate to property page
            ie.Navigate sURL_Base & vAddresses(lngCurRec, 1)
            Do: DoEvents: Sleep 100: Loop Until ie.Busy = False
            Do: DoEvents: Sleep 100: Loop Until ie.ReadyState = READYSTATE_COMPLETE
            Sleep 10
            
            ' Get html
            sHTML = ie.Document.getElementById("subject_info").innerHTML
            
            ' Parse fields
            For i = 0 To UBound(vResults)
                vResults(i) = ParseText(sHTML, sMarkers(i, 0), sMarkers(i, 1))
            Next i
            
            ' Write results to sheet
            rngOutput.Resize(, UBound(vResults) + 1) = vResults
            If [stopgo] = "Stop" Then
                Exit For
            End If
            
        End If

ResumeFromHere:
    Next lngCurRec
    
    ' Terminate objects
    Set rngOutput = Nothing
    ie.Quit
    Set ie = Nothing
    
End Sub


Public Sub MSXML2_Method(shtData As Worksheet, sProperty_RangeAddr)

    ' Note: for this method to work, Microsoft XML v3.0 (or later)
    '       must be referenced in Tools - References.


    Dim i As Long
    Dim lngCurRec As Long
    Dim sURL_Base As String
    Dim lngRecords As Long
    Dim vAddresses As Variant
    Dim sHTML As String
    Dim sMarkers() As String
    Dim vResults As Variant
    Dim rngOutput As Range
    Dim oXML As MSXML2.XMLHTTP
    
    ' Number of output columns
    ReDim vResults(7)
    
    
    ' Instantiate MSXML2
    Set oXML = New MSXML2.XMLHTTP
    
    
    ' Setup variables
    sURL_Base = "http://www.realestateabc.com/home-values/detail/"
    With shtData.Range(sProperty_RangeAddr)
        lngRecords = .End(xlDown).Row - .Row + 1
        vAddresses = .Resize(lngRecords)
    End With
    Call GetFieldMarkers(sMarkers(), "MSXML2")
    lngOutputCol = Range(sProperty_RangeAddr).Offset(, 1).Column

    ' Start scraping
    On Error GoTo ResumeFromHere
    For lngCurRec = 1 To UBound(vAddresses)
        
        DoEvents
        Set rngOutput = Range(sProperty_RangeAddr).Offset(lngCurRec - 1, 1)
        
        ' Start at first empty output cell
        If Len(rngOutput) = 0 Then
            
            ' Set semaphore
            rngOutput = "MSXML2"
            
            ' Navigate to property page
            oXML.Open "GET", sURL_Base & vAddresses(lngCurRec, 1), True
            oXML.send
            Do: DoEvents: Sleep 100: Loop Until oXML.ReadyState = READYSTATE_COMPLETE
            
            ' Get html
            sHTML = oXML.responseText
            
            ' Parse fields
            For i = 0 To UBound(vResults)
                vResults(i) = ParseText(sHTML, sMarkers(i, 0), sMarkers(i, 1))
            Next i
            
            ' Write results to sheet
            rngOutput.Resize(, UBound(vResults) + 1) = vResults
            If [stopgo] = "Stop" Then
                Exit For
            End If

            
        End If

ResumeFromHere:
    Next lngCurRec
    
    ' Terminate objects
    Set rngOutput = Nothing
    Set oXML = Nothing
    
End Sub

Public Sub Swarm_Method(shtData As Worksheet, sProperty_RangeAddr, Optional boolOneAgentOnly As Boolean)

    ' Note: this method uses a number of independent VBScript files.
    '       You may need to authorize each once when they run for
    '       the first time, depending on your security settings.

    
    Dim lngCurRec As Long
    Dim lngCurAgt As Long
    Dim rngOutput As Range
    
    
    ' Setup variables
    With shtData.Range(sProperty_RangeAddr)
        lngRecords = .End(xlDown).Row - .Row + 1
        vAddresses = .Resize(lngRecords)
    End With
    lngAgents = [SwarmSize]
    lngOutputCol = Range(sProperty_RangeAddr).Offset(, 1).Column
    
    
    ' Create VBScript Agent Swarm
    For lngCurRec = 1 To UBound(vAddresses)
    
        DoEvents
        Set rngOutput = Range(sProperty_RangeAddr).Offset(lngCurRec - 1, 1)
            
        If Len(rngOutput) = 0 Then
            DoEvents
            CreateVBScriptAgentAndLaunch rngOutput
            lngCurAgt = lngCurAgt + 1
            If boolOneAgentOnly Or lngCurAgt = lngAgents Then Exit For
            Sleep 5
        End If
    
    Next lngCurRec

    ' Terminate objects
    Set rngOutput = Nothing

End Sub


Public Function ParseText(s As String, sMarker1 As String, sMarker2 As String)

    Dim ptr As Long
    Dim sTmp As String

    ParseText = "ERROR"
    If Len(s) Then
        If Len(sMarker1) Then
            If Len(sMarker2) Then
                ptr = InStr(s, sMarker1)
                If ptr Then
                    ptr = ptr + Len(sMarker1)
                    sTmp = Mid(s, ptr)
                    If Len(sTmp) Then
                        ptr = InStr(sTmp, sMarker2) - 1
                        If Len(ptr) Then
                            ParseText = Left(sTmp, ptr)
                            Exit Function
                        End If
                    End If
                End If
            End If
        End If
    End If

End Function

Public Sub GetFieldMarkers(sFM, sMethod As String)

    ReDim sFM(7, 1)
    
    If sMethod = "ie" Then
        ' Estimate
        sFM(0, 0) = "<TD class=""px16 bold abcvaluegreen verdana""><SPAN style=""FONT-WEIGHT: 900; FONT-SIZE: 16px; COLOR: #295335; FONT-FAMILY: arial,verdana,helvetica; TEXT-DECORATION: none"">"
        sFM(0, 1) = "</SPAN>"
        ' Last Sale
        sFM(1, 0) = "<TD class=""subjectmenutblleft subjectmenutbltext bold"">Last Sale: </TD>" & vbCrLf & "<TD class=""subjectmenutblright subjectmenutbltext"">"
        sFM(1, 1) = "</TD>"
        ' Last Price
        sFM(2, 0) = "<TD class=""subjectmenutblleft subjectmenutbltext bold"">Sales Price: </TD>" & vbCrLf & "<TD class=""subjectmenutblright subjectmenutbltext"">"
        sFM(2, 1) = "</TD>"
        ' Year Built
        sFM(3, 0) = "<TD class=""subjectmenutblleft subjectmenutbltext bold"">Year Built: </TD>" & vbCrLf & "<TD class=""subjectmenutblright subjectmenutbltext"">"
        sFM(3, 1) = "</TD>"
        ' Bedrooms
        sFM(4, 0) = "<TD class=""subjectmenutblleft subjectmenutbltext bold"">BR: </TD>" & vbCrLf & "<TD class=""subjectmenutblright subjectmenutbltext"">"
        sFM(4, 1) = "</TD>"
        ' Baths
        sFM(5, 0) = "<TD class=""subjectmenutblleft subjectmenutbltext bold"">BA: </TD>" & vbCrLf & "<TD class=""subjectmenutblright subjectmenutbltext"">"
        sFM(5, 1) = "</TD>"
        ' Square Feet
        sFM(6, 0) = "<TD class=""subjectmenutblleft subjectmenutbltext bold"">BLDG SQ FTP: </TD>" & vbCrLf & "<TD class=""subjectmenutblright subjectmenutbltext"">"
        sFM(6, 1) = "</TD>"
        ' Lot
        sFM(7, 0) = "<TD class=""subjectmenutblleft subjectmenutbltext bold"">LOT SQ FT: </TD>" & vbCrLf & "<TD class=""subjectmenutblright subjectmenutbltext"">"
        sFM(7, 1) = "</TD>"
    ElseIf sMethod = "MSXML2" Then
        ' Estimate
        sFM(0, 0) = "<span  style=""font-weight:900;font-family:arial,verdana,helvetica;color:#295335;font-size:16px;text-decoration:none"">"
        sFM(0, 1) = "</span>"
        ' Last Sale
        sFM(1, 0) = "<td class=""subjectmenutblleft subjectmenutbltext bold"">Last Sale: </td>" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & "<td class=""subjectmenutblright subjectmenutbltext"">"
        sFM(1, 1) = "</td>"
        ' Last Price
        sFM(2, 0) = "<td class=""subjectmenutblleft subjectmenutbltext bold"">Sales Price: </td>" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & "<td class=""subjectmenutblright subjectmenutbltext"">"
        sFM(2, 1) = "</td>"
        ' Year Built
        sFM(3, 0) = "<td class=""subjectmenutblleft subjectmenutbltext bold"">Year Built: </td>" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & "<td class=""subjectmenutblright subjectmenutbltext"">"
        sFM(3, 1) = "</td>"
        ' Bedrooms
        sFM(4, 0) = "<td class=""subjectmenutblleft subjectmenutbltext bold"">BR: </td>" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & "<td class=""subjectmenutblright subjectmenutbltext"">"
        sFM(4, 1) = "</td>"
        ' Baths
        sFM(5, 0) = "<td class=""subjectmenutblleft subjectmenutbltext bold"">BA: </td>" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & "<td class=""subjectmenutblright subjectmenutbltext"">"
        sFM(5, 1) = "</td>"
        ' Square Feet
        sFM(6, 0) = "<td class=""subjectmenutblleft subjectmenutbltext bold"">BLDG SQ FTP: </td>" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & "<td class=""subjectmenutblright subjectmenutbltext"">"
        sFM(6, 1) = "</td>"
        ' Lot
        sFM(7, 0) = "<td class=""subjectmenutblleft subjectmenutbltext bold"">LOT SQ FT: </td>" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & "<td class=""subjectmenutblright subjectmenutbltext"">"
        sFM(7, 1) = "</td>"
    End If

End Sub


Public Sub CreateVBScriptAgentAndLaunch(rngOutput As Range)

    Dim sFileName As String
    Dim intFileNum As Integer
    Dim shellWin As New ShellWindows
    Dim s As String
    Dim lngRow As Long, sCol As String, sPropAddr As String, sOutputRangeAddress As String
    Dim lngAgentNumber As Long
       
    
    ' Setup variables
    lngRow = rngOutput.Row
    sCol = rngOutput.Column
    sOutputRangeAddress = rngOutput.Resize(, 8).Address
    sPropAddr = rngOutput.Offset(, -1)
    DoEvents
                
    
    ' Set semaphore
    lngAgentNumber = lngRow Mod lngAgents
    rngOutput = "Agent_" & lngAgentNumber
    DoEvents
       
    
    ' Create string for contents of VBScript file
    DoEvents
    s = s & "Dim oXML, oXL, curRow, outputCol, propAddress, sHTML, i" & vbCrLf
    s = s & "Dim vResults(7)" & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & "' Setup variables" & vbCrLf
    s = s & "curRow = " & lngRow & vbCrLf
    s = s & "outputCol = """ & sCol & """" & vbCrLf
    s = s & "propAddress = """ & sPropAddr & """" & vbCrLf
    s = s & "Call GetFieldMarkers(sMarkers)" & vbCrLf
    s = s & "Set oXL = GetObject(, ""Excel.Application"")" & vbCrLf
    s = s & "Set oXML = WScript.CreateObject(""MSXML2.XMLHTTP"")" & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & "' Navigate to property page" & vbCrLf
    s = s & "oXML.Open ""GET"", ""http://www.realestateabc.com/home-values/detail/"" & propAddress, False" & vbCrLf
    s = s & "Wscript.Sleep 50" & vbCrLf
    s = s & "oXML.send" & vbCrLf
    s = s & "Wscript.Sleep 50" & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & "' Get html" & vbCrLf
    s = s & "sHTML = oXML.responseText" & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & "' Parse fields" & vbCrLf
    s = s & "For i = 0 To UBound(vResults)" & vbCrLf
    s = s & "    vResults(i) = ParseText(sHTML, sMarkers(i, 0), sMarkers(i, 1))" & vbCrLf
    s = s & "Next" & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & "' Write results to Excel sheet" & vbCrLf
    s = s & "RandomNumber = Int(Rnd * (800 + 1 - 350)) + 350" & vbCrLf
    s = s & "Wscript.Sleep RandomNumber" & vbCrLf
    s = s & "oXL.workbooks(""" & ThisWorkbook.Name & """).sheets(""Demo"").Range(""" & sOutputRangeAddress & """) = vResults" & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & "Function ParseText(s, sMarker1, sMarker2)" & vbCrLf
    s = s & vbCrLf
    s = s & "    Dim ptr" & vbCrLf
    s = s & "    Dim sTmp" & vbCrLf
    s = s & vbCrLf
    s = s & "" & vbCrLf
    s = s & "    ParseText = ""ERROR""" & vbCrLf
    s = s & "    If Len(s) Then" & vbCrLf
    s = s & "        If Len(sMarker1) Then" & vbCrLf
    s = s & "            If Len(sMarker2) Then" & vbCrLf
    s = s & "                ptr = InStr(s, sMarker1)" & vbCrLf
    s = s & "                If ptr Then" & vbCrLf
    s = s & "                    ptr = ptr + Len(sMarker1)" & vbCrLf
    s = s & "                    sTmp = Mid(s, ptr)" & vbCrLf
    s = s & "                    If Len(sTmp) Then" & vbCrLf
    s = s & "                        ptr = InStr(sTmp, sMarker2) - 1" & vbCrLf
    s = s & "                        If Len(ptr) Then" & vbCrLf
    s = s & "                            ParseText = Left(sTmp, ptr)" & vbCrLf
    s = s & "                            Exit Function" & vbCrLf
    s = s & "                        End If" & vbCrLf
    s = s & "                    End If" & vbCrLf
    s = s & "                End If" & vbCrLf
    s = s & "            End If" & vbCrLf
    s = s & "        End If" & vbCrLf
    s = s & "    End If" & vbCrLf
    s = s & vbCrLf
    s = s & "" & vbCrLf
    s = s & "End Function" & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & "Sub GetFieldMarkers(sFM)" & vbCrLf
    s = s & vbCrLf
    s = s & "    ReDim sFM(7, 1)" & vbCrLf
    s = s & vbCrLf
    s = s & "    ' Estimate" & vbCrLf
    s = s & vbCrLf
    s = s & "    sFM(0, 0) = ""<span  style=""""font-weight:900;font-family:arial,verdana,helvetica;color:#295335;font-size:16px;text-decoration:none"""">""" & vbCrLf
    s = s & "    sFM(0, 1) = ""</span>""" & vbCrLf
    s = s & "    ' Last Sale" & vbCrLf
    s = s & "    sFM(1, 0) = ""<td class=""""subjectmenutblleft subjectmenutbltext bold"""">Last Sale: </td>"" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & ""<td class=""""subjectmenutblright subjectmenutbltext"""">""" & vbCrLf
    s = s & "    sFM(1, 1) = ""</td>""" & vbCrLf
    s = s & "    ' Last Price" & vbCrLf
    s = s & "    sFM(2, 0) = ""<td class=""""subjectmenutblleft subjectmenutbltext bold"""">Sales Price: </td>"" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & ""<td class=""""subjectmenutblright subjectmenutbltext"""">""" & vbCrLf
    s = s & "    sFM(2, 1) = ""</td>""" & vbCrLf
    s = s & "    ' Year Built" & vbCrLf
    s = s & "    sFM(3, 0) = ""<td class=""""subjectmenutblleft subjectmenutbltext bold"""">Year Built: </td>"" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & ""<td class=""""subjectmenutblright subjectmenutbltext"""">""" & vbCrLf
    s = s & "    sFM(3, 1) = ""</td>""" & vbCrLf
    s = s & "    ' Bedrooms" & vbCrLf
    s = s & "    sFM(4, 0) = ""<td class=""""subjectmenutblleft subjectmenutbltext bold"""">BR: </td>"" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & ""<td class=""""subjectmenutblright subjectmenutbltext"""">""" & vbCrLf
    s = s & "    sFM(4, 1) = ""</td>""" & vbCrLf
    s = s & "    ' Baths" & vbCrLf
    s = s & "    sFM(5, 0) = ""<td class=""""subjectmenutblleft subjectmenutbltext bold"""">BA: </td>"" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & ""<td class=""""subjectmenutblright subjectmenutbltext"""">""" & vbCrLf
    s = s & "    sFM(5, 1) = ""</td>""" & vbCrLf
    s = s & "    ' Square Feet" & vbCrLf
    s = s & "    sFM(6, 0) = ""<td class=""""subjectmenutblleft subjectmenutbltext bold"""">BLDG SQ FTP: </td>"" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & ""<td class=""""subjectmenutblright subjectmenutbltext"""">""" & vbCrLf
    s = s & "    sFM(6, 1) = ""</td>""" & vbCrLf
    s = s & "    ' Lot" & vbCrLf
    s = s & "    sFM(7, 0) = ""<td class=""""subjectmenutblleft subjectmenutbltext bold"""">LOT SQ FT: </td>"" & vbCrLf + vbTab + vbTab + vbTab + vbTab + vbTab + vbTab & ""<td class=""""subjectmenutblright subjectmenutbltext"""">""" & vbCrLf
    s = s & "    sFM(7, 1) = ""</td>""" & vbCrLf
    s = s & vbCrLf
    s = s & vbCrLf
    s = s & "End Sub" & vbCrLf
    
    
    ' Write VBScript file to disk
    sFileName = ActiveWorkbook.Path & "\SwarmAgent_" & lngAgentNumber & ".vbs"
    intFileNum = FreeFile
    Open sFileName For Output As intFileNum
    Print #intFileNum, s
    Close intFileNum
    DoEvents
    ' Run VBScript file
    Set wshShell = CreateObject("Wscript.Shell")
    wshShell.Run """" & sFileName & """"
    
    DoEvents
    Set wshShell = Nothing
 
End Sub


Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

' Processing file: /tmp/qstore_cbk144et
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 1166 bytes
' _VBA_PROJECT_CUR/VBA/Sheet1 - 10246 bytes
' Line #0:
' 	QuoteRem 0x0000 0x003A " Copyright 2010 by Daniel Ferry, http://excelhero.com/blog"
' Line #1:
' 	QuoteRem 0x0000 0x004D " Workbook code licensed under Creative Commons Attribution 3.0 United States."
' Line #2:
' 	QuoteRem 0x0000 0x0050 " You may use for any purpose as long as you keep this copyright notice in place."
' Line #3:
' Line #4:
' 	Dim (Public) 
' 	VarDefn sProperties_RefAddr (As String)
' Line #5:
' 	Dim (Private) 
' 	VarDefn shtDemo (As Worksheet)
' Line #6:
' 	Dim (Private Const) 
' 	LitStr 0x0004 "demo"
' 	VarDefn _B_var_SHEET_DEMO
' Line #7:
' 	Dim (Private Const) 
' 	LitStr 0x0001 "d"
' 	VarDefn _B_var_PROP_LIST_COL
' Line #8:
' Line #9:
' Line #10:
' 	FuncDefn (Private Sub cmdClear_Click())
' Line #11:
' Line #12:
' 	Ld [_B_var_a1] 
' 	ArgsMemCall Select 0x0000 
' Line #13:
' 	LineCont 0x000C 17 00 0A 00 1B 00 0A 00 1F 00 0A 00
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld xlDown 
' 	Ld _B_var_PROP_LIST_COL 
' 	LitStr 0x0001 "1"
' 	Concat 
' 	ArgsLd Range 0x0001 
' 	ArgsMemLd End 0x0001 
' 	MemLd Worksheets 
' 	ArgsMemLd Offset 0x0002 
' 	Ld [starttime] 
' 	Ld [endtime] 
' 	Ld [recordsprocessed] 
' 	ArgsLd Union 0x0004 
' 	ArgsMemCall ClearContents 0x0000 
' Line #14:
' Line #15:
' 	Ld speed 
' 	MemLd [_B_var_speed] 
' 	MemLd Application 
' 	ArgsMemCall ClearContents 0x0000 
' Line #16:
' Line #17:
' 	EndSub 
' Line #18:
' Line #19:
' 	FuncDefn (Private Sub cmdStart_Click())
' Line #20:
' Line #21:
' 	Ld [_B_var_a1] 
' 	ArgsMemCall Select 0x0000 
' Line #22:
' 	SetStmt 
' 	Ld _B_var_SHEET_DEMO 
' 	ArgsLd MSXML2_Method 0x0001 
' 	Set shtDemo 
' Line #23:
' 	LitDI2 0x0001 
' 	Ld xlDown 
' 	Ld _B_var_PROP_LIST_COL 
' 	LitStr 0x0001 "1"
' 	Concat 
' 	Ld shtDemo 
' 	ArgsMemLd Range 0x0001 
' 	ArgsMemLd End 0x0001 
' 	ArgsMemLd Offset 0x0001 
' 	MemLd Address 
' 	St sProperties_RefAddr 
' Line #24:
' 	Ld id_0356 
' 	Ld Calculation 
' 	MemSt xlCalculationAutomatic 
' Line #25:
' Line #26:
' 	Ld [Method] 
' 	SelectCase 
' Line #27:
' 	LitStr 0x0011 "Internet Explorer"
' 	Case 
' 	CaseDone 
' Line #28:
' 	ArgsCall UpdateStats 0x0000 
' Line #29:
' 	Ld shtDemo 
' 	Ld sProperties_RefAddr 
' 	ArgsCall (Call) IE_Method 0x0002 
' Line #30:
' 	LitStr 0x0006 "MSXML2"
' 	Case 
' 	CaseDone 
' Line #31:
' 	ArgsCall UpdateStats 0x0000 
' Line #32:
' 	Ld shtDemo 
' 	Ld sProperties_RefAddr 
' 	ArgsCall (Call) _B_var_MSMXML2_Method 0x0002 
' Line #33:
' 	LitStr 0x0005 "Swarm"
' 	Case 
' 	CaseDone 
' Line #34:
' 	ArgsCall UpdateStats 0x0000 
' Line #35:
' 	Ld shtDemo 
' 	Ld sProperties_RefAddr 
' 	ArgsCall (Call) Swarm_Method 0x0002 
' Line #36:
' 	EndSelect 
' Line #37:
' Line #38:
' 	EndSub 
' Line #39:
' Line #40:
' 	FuncDefn (Private Sub UpdateStats())
' Line #41:
' Line #42:
' 	Ld Now 
' 	St [starttime] 
' Line #43:
' 	Ld [starttime] 
' 	St [endtime] 
' Line #44:
' 	LitDI2 0x0000 
' 	St [recordsprocessed] 
' Line #45:
' Line #46:
' 	EndSub 
' Line #47:
' Line #48:
' 	FuncDefn (Private Sub Worksheet_Change(ByVal Target As ))
' Line #49:
' Line #50:
' 	Dim 
' 	VarDefn i (As Long)
' Line #51:
' Line #52:
' 	StartWithExpr 
' 	Ld Target 
' 	With 
' Line #53:
' 	MemLdWith Column 
' 	Ld lngOutputCol 
' 	Ne 
' 	If 
' 	BoSImplicit 
' 	ExitSub 
' 	EndIf 
' Line #54:
' 	MemLdWith Rows 
' 	MemLd Count 
' 	LitDI2 0x0001 
' 	Gt 
' 	If 
' 	BoSImplicit 
' 	ExitSub 
' 	EndIf 
' Line #55:
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	ArgsMemLdWith Cells 0x0002 
' 	FnLen 
' 	LitDI2 0x0000 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ExitSub 
' 	EndIf 
' Line #56:
' 	MemLdWith Cells 
' 	MemLd Count 
' 	LitDI2 0x0001 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ExitSub 
' 	EndIf 
' Line #57:
' 	EndWith 
' Line #58:
' Line #59:
' Line #60:
' 	Ld Now 
' 	St [endtime] 
' Line #61:
' 	Ld [recordsprocessed] 
' 	St i 
' Line #62:
' 	Ld i 
' 	LitDI2 0x0001 
' 	Add 
' 	St [recordsprocessed] 
' Line #63:
' Line #64:
' 	Ld [EntireColumn] 
' 	Ld i 
' 	Ld [_B_var_speed] 
' 	ArgsMemSt Offset 0x0001 
' Line #65:
' Line #66:
' 	Ld [stopgo] 
' 	LitStr 0x0004 "Stop"
' 	Eq 
' 	IfBlock 
' Line #67:
' 	ExitSub 
' Line #68:
' 	EndIfBlock 
' Line #69:
' Line #70:
' 	Ld [Method] 
' 	LitStr 0x0005 "Swarm"
' 	Eq 
' 	IfBlock 
' Line #71:
' 	Ld shtDemo 
' 	Ld sProperties_RefAddr 
' 	LitVarSpecial (True)
' 	ParamNamed boolOneAgentOnly 
' 	ArgsCall (Call) Swarm_Method 0x0003 
' Line #72:
' 	EndIfBlock 
' Line #73:
' Line #74:
' 	EndSub 
' Line #75:
' _VBA_PROJECT_CUR/VBA/Module1 - 33929 bytes
' Line #0:
' 	QuoteRem 0x0000 0x003A " Copyright 2010 by Daniel Ferry, http://excelhero.com/blog"
' Line #1:
' 	QuoteRem 0x0000 0x004D " Workbook code licensed under Creative Commons Attribution 3.0 United States."
' Line #2:
' 	QuoteRem 0x0000 0x0050 " You may use for any purpose as long as you keep this copyright notice in place."
' Line #3:
' Line #4:
' 	FuncDefn (Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long))
' Line #5:
' 	Dim (Public) 
' 	VarDefn lngAgents (As Long)
' Line #6:
' 	Dim (Public) 
' 	VarDefn lngOutputCol (As Long)
' Line #7:
' Line #8:
' Line #9:
' 	FuncDefn (Public Sub IE_Method(shtData As , sProperty_RangeAddr))
' Line #10:
' Line #11:
' 	QuoteRem 0x0004 0x003B " Note: for this method to work, Microsoft Internet Controls"
' Line #12:
' 	QuoteRem 0x0004 0x0030 "       must be referenced in Tools - References."
' Line #13:
' Line #14:
' Line #15:
' 	Dim 
' 	VarDefn i (As Long)
' Line #16:
' 	Dim 
' 	VarDefn lngCurRec (As Long)
' Line #17:
' 	Dim 
' 	VarDefn sURL_Base (As String)
' Line #18:
' 	Dim 
' 	VarDefn lngRecords (As Long)
' Line #19:
' 	Dim 
' 	VarDefn vAddresses (As Variant)
' Line #20:
' 	Dim 
' 	VarDefn sHTML (As String)
' Line #21:
' 	Dim 
' 	VarDefn sMarkers (As String)
' Line #22:
' 	Dim 
' 	VarDefn vResults (As Variant)
' Line #23:
' 	Dim 
' 	VarDefn rngOutput (As Range)
' Line #24:
' 	Dim 
' 	VarDefn ie (As InternetExplorer)
' Line #25:
' Line #26:
' 	QuoteRem 0x0004 0x0019 " Number of output columns"
' Line #27:
' 	OptionBase 
' 	LitDI2 0x0007 
' 	Redim vResults 0x0001 (As Variant)
' Line #28:
' Line #29:
' Line #30:
' 	QuoteRem 0x0004 0x001E " Instantiate Internet Explorer"
' Line #31:
' 	SetStmt 
' 	LitStr 0x001C "InternetExplorer.Application"
' 	ArgsLd CreateObject 0x0001 
' 	Set ie 
' Line #32:
' 	LitVarSpecial (True)
' 	Ld ie 
' 	MemSt Visible 
' Line #33:
' Line #34:
' Line #35:
' 	QuoteRem 0x0004 0x0010 " Setup variables"
' Line #36:
' 	LitStr 0x0030 "http://www.realestateabc.com/home-values/detail/"
' 	St sURL_Base 
' Line #37:
' 	StartWithExpr 
' 	Ld sProperty_RangeAddr 
' 	Ld shtData 
' 	ArgsMemLd Range 0x0001 
' 	With 
' Line #38:
' 	Ld xlDown 
' 	ArgsMemLdWith End 0x0001 
' 	MemLd Row 
' 	MemLdWith Row 
' 	Sub 
' 	LitDI2 0x0001 
' 	Add 
' 	St lngRecords 
' Line #39:
' 	Ld lngRecords 
' 	ArgsMemLdWith Resize 0x0001 
' 	St vAddresses 
' Line #40:
' 	EndWith 
' Line #41:
' 	ArgsLd sMarkers 0x0000 
' 	LitStr 0x0002 "ie"
' 	ArgsCall (Call) GetFieldMarkers 0x0002 
' Line #42:
' 	ParamOmitted 
' 	LitDI2 0x0001 
' 	Ld sProperty_RangeAddr 
' 	ArgsLd Range 0x0001 
' 	ArgsMemLd Offset 0x0002 
' 	MemLd Column 
' 	St lngOutputCol 
' Line #43:
' Line #44:
' 	QuoteRem 0x0004 0x000F " Start scraping"
' Line #45:
' 	OnError ResumeFromHere 
' Line #46:
' 	StartForVariable 
' 	Ld lngCurRec 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld vAddresses 
' 	FnUBound 0x0000 
' 	For 
' Line #47:
' Line #48:
' 	ArgsCall DoEvents 0x0000 
' Line #49:
' 	SetStmt 
' 	Ld lngCurRec 
' 	LitDI2 0x0001 
' 	Sub 
' 	LitDI2 0x0001 
' 	Ld sProperty_RangeAddr 
' 	ArgsLd Range 0x0001 
' 	ArgsMemLd Offset 0x0002 
' 	Set rngOutput 
' Line #50:
' Line #51:
' 	QuoteRem 0x0008 0x0021 " Start at first empty output cell"
' Line #52:
' 	Ld rngOutput 
' 	FnLen 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #53:
' Line #54:
' 	QuoteRem 0x000C 0x000E " Set semaphore"
' Line #55:
' 	LitStr 0x0002 "ie"
' 	St rngOutput 
' Line #56:
' Line #57:
' 	QuoteRem 0x000C 0x001A " Navigate to property page"
' Line #58:
' 	Ld sURL_Base 
' 	Ld lngCurRec 
' 	LitDI2 0x0001 
' 	ArgsLd vAddresses 0x0002 
' 	Concat 
' 	Ld ie 
' 	ArgsMemCall Navigate 0x0001 
' Line #59:
' 	Do 
' 	BoS 0x0000 
' 	ArgsCall DoEvents 0x0000 
' 	BoS 0x0000 
' 	LitDI2 0x0064 
' 	ArgsCall Sleep 0x0001 
' 	BoS 0x0000 
' 	Ld ie 
' 	MemLd Busy 
' 	LitVarSpecial (False)
' 	Eq 
' 	LoopUntil 
' Line #60:
' 	Do 
' 	BoS 0x0000 
' 	ArgsCall DoEvents 0x0000 
' 	BoS 0x0000 
' 	LitDI2 0x0064 
' 	ArgsCall Sleep 0x0001 
' 	BoS 0x0000 
' 	Ld ie 
' 	MemLd ReadyState 
' 	Ld READYSTATE_COMPLETE 
' 	Eq 
' 	LoopUntil 
' Line #61:
…

Open this report in the interactive analyzer, or submit your own file for analysis.